1import * as Cloudflare from "@/Cloudflare";
2import { CloudflareEnvironment } from "@/Cloudflare/CloudflareEnvironment";
3import * as Provider from "@/Provider";
4import * as Test from "@/Test/Alchemy";
5import * as resourceSharing from "@distilled.cloud/cloudflare/resource-sharing";
6import { expect } from "alchemy-test";
7import * as Effect from "effect/Effect";
8import { MinimumLogLevel } from "effect/References";
9import * as Schedule from "effect/Schedule";
10
11const { test } = Test.make({ providers: Cloudflare.providers() });
12
13const logLevel = Effect.provideService(
14 MinimumLogLevel,
15 process.env.DEBUG ? "Debug" : "Info",
16);
17
18// Resource Sharing writes are permission-gated: on the standard testing
19// account every POST/PUT/DELETE under /accounts/{id}/shares fails with the
20// typed `Forbidden` error (HTTP 403, Cloudflare code 10000). Reads
21// (list/get) succeed. Sharing also requires a *second* account/organization
22// as recipient. The deploy half of the list test is gated behind an explicit
23// opt-in env var pointing at a recipient account; the read-only list
24// assertion always runs.
25const recipientAccountId =
26 process.env.CLOUDFLARE_TEST_SHARE_RECIPIENT_ACCOUNT_ID;
27
28const getShare = (accountId: string, shareId: string) =>
29 resourceSharing.getResourceSharing({ accountId, shareId }).pipe(
30 Effect.retry({
31 while: (e) => e._tag === "Forbidden",
32 schedule: Schedule.exponential("500 millis"),
33 times: 8,
34 }),
35 );
36
37// Poll until the share is gone after destroy — deletion is asynchronous
38// (`active → deleting → deleted`); a fully purged share answers with the
39// typed `ShareNotFound` (Cloudflare error code 1004).
40const expectGone = (accountId: string, shareId: string) =>
41 getShare(accountId, shareId).pipe(
42 Effect.flatMap((share) =>
43 share.status === "deleting" || share.status === "deleted"
44 ? Effect.void
45 : Effect.fail({ _tag: "ShareNotDeleted" } as const),
46 ),
47 Effect.catchTag("ShareNotFound", () => Effect.void),
48 Effect.retry({
49 while: (e) => e._tag === "ShareNotDeleted",
50 schedule: Schedule.max([
51 Schedule.exponential("500 millis"),
52 Schedule.recurs(10),
53 ]),
54 }),
55 );
56
57test.provider(
58 "list enumerates share resources across the account's sent shares (typed Attributes), and includes a deployed entry when entitled",
59 (stack) =>
60 Effect.gen(function* () {
61 const { accountId } = yield* yield* CloudflareEnvironment;
62
63 yield* stack.destroy();
64
65 const provider = yield* Provider.findProvider(
66 Cloudflare.ResourceSharing.ShareResource,
67 );
68
69 // Reads (list) succeed without the Resource Sharing Edit permission, so
70 // the read-only assertion always runs: list() fans out over every sent
71 // share and returns the exhaustively-paginated resource entries in the
72 // read Attributes shape. On a non-entitled account with no sent shares
73 // this is a well-typed `[]`.
74 const before = yield* provider.list();
75 expect(Array.isArray(before)).toBe(true);
76 for (const entry of before) {
77 expect(typeof entry.shareResourceId).toBe("string");
78 expect(entry.accountId).toEqual(accountId);
79 expect(typeof entry.shareId).toBe("string");
80 expect(typeof entry.resourceId).toBe("string");
81 // Deleted / deleting entries are filtered out — never surfaced.
82 expect(entry.status).not.toEqual("deleted");
83 expect(entry.status).not.toEqual("deleting");
84 }
85
86 // Writes are permission-gated (and need a second recipient account), so
87 // only assert presence of a freshly-deployed entry when an entitled
88 // recipient account is provided. On the standard testing token the
89 // deploy would fail with the typed `Forbidden` (HTTP 403, code 10000).
90 if (recipientAccountId) {
91 const policyA = yield* stack.deploy(
92 Cloudflare.Gateway.Rule("ListEntryPolicyA", {
93 action: "block",
94 traffic: 'dns.fqdn == "list-entry-a.alchemy-test.example"',
95 filters: ["dns"],
96 enabled: false,
97 }),
98 );
99 const policyB = yield* stack.deploy(
100 Cloudflare.Gateway.Rule("ListEntryPolicyB", {
101 action: "block",
102 traffic: 'dns.fqdn == "list-entry-b.alchemy-test.example"',
103 filters: ["dns"],
104 enabled: false,
105 }),
106 );
107
108 const share = yield* stack.deploy(
109 Cloudflare.ResourceSharing.Share("ListEntryShare", {
110 name: "alchemy-list-entry-share",
111 recipients: [{ accountId: recipientAccountId }],
112 resources: [
113 { resourceType: "gateway-policy", resourceId: policyA.ruleId },
114 ],
115 }),
116 );
117
118 const entry = yield* stack.deploy(
119 Cloudflare.ResourceSharing.ShareResource("ListEntry", {
120 shareId: share.shareId,
121 resourceType: "gateway-policy",
122 resourceId: policyB.ruleId,
123 }),
124 );
125
126 const all = yield* provider.list();
127 expect(
128 all.some((e) => e.shareResourceId === entry.shareResourceId),
129 ).toBe(true);
130 // The deployed entry surfaces in the read Attributes shape.
131 const found = all.find(
132 (e) => e.shareResourceId === entry.shareResourceId,
133 )!;
134 expect(found.shareId).toEqual(share.shareId);
135 expect(found.resourceId).toEqual(policyB.ruleId);
136
137 yield* stack.destroy();
138 yield* expectGone(accountId, share.shareId);
139 }
140
141 yield* stack.destroy();
142 }).pipe(logLevel),
143 {
144 tags: [
145 "provider:cloudflare",
146 "provider:cloudflare:gateway",
147 "provider:cloudflare:resourcesharing",
148 "live",
149 ],
150 timeout: 180_000,
151 },
152);