1import * as Cloudflare from "@/Cloudflare";
2import { CloudflareEnvironment } from "@/Cloudflare/CloudflareEnvironment";
3import { findZoneByName } from "@/Cloudflare/Zone/lookup";
4import * as Test from "@/Test/Alchemy";
5import * as cache from "@distilled.cloud/cloudflare/cache";
6import { expect } from "alchemy-test";
7import * as Effect from "effect/Effect";
8import { MinimumLogLevel } from "effect/References";
9import * as Schedule from "effect/Schedule";
10
11const { test } = Test.make({ providers: Cloudflare.providers() });
12
13const logLevel = Effect.provideService(
14 MinimumLogLevel,
15 process.env.DEBUG ? "Debug" : "Info",
16);
17
18const zoneName =
19 process.env.CLOUDFLARE_TEST_DNS_ZONE_NAME ?? "alchemy-test-2.us";
20
21const resolveZoneId = Effect.gen(function* () {
22 const { accountId } = yield* yield* CloudflareEnvironment;
23 const zone = yield* findZoneByName({ accountId, name: zoneName });
24 if (!zone) {
25 return yield* Effect.die(
26 new Error(`zone "${zoneName}" not found in account`),
27 );
28 }
29 return zone.id;
30});
31
32// The scoped API token the test harness mints propagates eventually-
33// consistently across Cloudflare's edge — a fresh token intermittently 403s.
34const forbiddenRetrySchedule = Schedule.exponential("500 millis");
35
36/**
37 * Probe the origin_cloud_regions API. As of 2026-06 the endpoint exists in
38 * the Cloudflare TypeScript SDK spec but is not yet routed on the public
39 * API — every call answers HTTP 400 with codes 7003/7000 ("No route for
40 * that URI"), surfaced as the typed `InvalidRoute` error. The probe maps
41 * that to "unreleased" so the lifecycle test self-enables the moment
42 * Cloudflare ships the route.
43 */
44const probeAvailability = (zoneId: string) =>
45 cache.listOriginCloudRegions({ zoneId }).pipe(
46 Effect.map(() => "available" as const),
47 Effect.catchTag("InvalidRoute", () =>
48 Effect.succeed("unreleased" as const),
49 ),
50 Effect.retry({
51 while: (e) => e._tag === "Forbidden",
52 schedule: forbiddenRetrySchedule,
53 times: 8,
54 }),
55 );
56
57/** Observe a single mapping out-of-band, `undefined` when gone (typed). */
58const getMapping = (zoneId: string, ip: string) =>
59 cache.getOriginCloudRegion({ zoneId, originIP: ip }).pipe(
60 Effect.catchTag("OriginCloudRegionNotFound", () =>
61 Effect.succeed(undefined),
62 ),
63 Effect.retry({
64 while: (e) => e._tag === "Forbidden",
65 schedule: forbiddenRetrySchedule,
66 times: 8,
67 }),
68 );
69
70test.provider(
71 "creates, updates in place, replaces on ip change, and deletes the mapping",
72 (stack) =>
73 Effect.gen(function* () {
74 const zoneId = yield* resolveZoneId;
75
76 // The endpoint is in the vendor spec but not yet deployed on the
77 // public API. When unreleased, the typed `InvalidRoute` is the whole
78 // observable behavior — assert it and stop. The lifecycle below runs
79 // automatically once Cloudflare routes the endpoint.
80 const availability = yield* probeAvailability(zoneId);
81 if (availability === "unreleased") {
82 yield* Effect.logInfo(
83 "origin_cloud_regions API not yet routed (typed InvalidRoute) — skipping lifecycle",
84 );
85 return;
86 }
87
88 yield* stack.destroy();
89
90 const created = yield* stack.deploy(
91 Effect.gen(function* () {
92 return yield* Cloudflare.Cache.OriginCloudRegion("ApiOrigin", {
93 zoneId,
94 ip: "192.0.2.10",
95 vendor: "aws",
96 region: "us-east-1",
97 });
98 }),
99 );
100 expect(created.zoneId).toEqual(zoneId);
101 expect(created.originIp).toEqual("192.0.2.10");
102 expect(created.vendor).toEqual("aws");
103 expect(created.region).toEqual("us-east-1");
104
105 // Out-of-band verification via the distilled API.
106 const live = yield* getMapping(zoneId, "192.0.2.10");
107 expect(live).toBeDefined();
108 expect(live!.vendor).toEqual("aws");
109 expect(live!.region).toEqual("us-east-1");
110
111 // Update in place — vendor/region are mutable; the IP identity holds.
112 const updated = yield* stack.deploy(
113 Effect.gen(function* () {
114 return yield* Cloudflare.Cache.OriginCloudRegion("ApiOrigin", {
115 zoneId,
116 ip: "192.0.2.10",
117 vendor: "aws",
118 region: "eu-west-1",
119 });
120 }),
121 );
122 expect(updated.originIp).toEqual("192.0.2.10");
123 expect(updated.region).toEqual("eu-west-1");
124
125 const liveUpdated = yield* getMapping(zoneId, "192.0.2.10");
126 expect(liveUpdated!.region).toEqual("eu-west-1");
127
128 // Replacement — the IP is the mapping's identity; the old mapping
129 // must be gone and the new one present.
130 const replaced = yield* stack.deploy(
131 Effect.gen(function* () {
132 return yield* Cloudflare.Cache.OriginCloudRegion("ApiOrigin", {
133 zoneId,
134 ip: "192.0.2.20",
135 vendor: "aws",
136 region: "eu-west-1",
137 });
138 }),
139 );
140 expect(replaced.originIp).toEqual("192.0.2.20");
141
142 const oldGone = yield* getMapping(zoneId, "192.0.2.10");
143 expect(oldGone).toBeUndefined();
144 const newLive = yield* getMapping(zoneId, "192.0.2.20");
145 expect(newLive).toBeDefined();
146
147 yield* stack.destroy();
148
149 // Destroy removed the mapping — observed via the typed
150 // `OriginCloudRegionNotFound` error (mapped to `undefined`).
151 const gone = yield* getMapping(zoneId, "192.0.2.20");
152 expect(gone).toBeUndefined();
153 }).pipe(logLevel),
154 {
155 tags: [
156 "provider:cloudflare",
157 "provider:cloudflare:cache",
158 "provider:cloudflare:zone",
159 "live",
160 ],
161 timeout: 120_000,
162 },
163);