1import * as Cloudflare from "@/Cloudflare/index.ts";
2import * as Test from "@/Test/Alchemy";
3import { expect } from "alchemy-test";
4import * as Data from "effect/Data";
5import * as Effect from "effect/Effect";
6import { MinimumLogLevel } from "effect/References";
7import * as Schedule from "effect/Schedule";
8import * as HttpClient from "effect/http/HttpClient";
9import AnonAccessWorker from "./fixtures/access-context/anon-worker.ts";
10import AuthedAccessWorker from "./fixtures/access-context/authed-worker.ts";
11
12// `dev: true` runs local providers behind the RPC sidecar proxy by default,
13// matching the process topology of the real `alchemy dev` command.
14const { test } = Test.make({
15 providers: Cloudflare.providers(),
16 dev: true,
17});
18
19const logLevel = Effect.provideService(
20 MinimumLogLevel,
21 process.env.DEBUG ? "Debug" : "Info",
22);
23
24class WorkerNotReady extends Data.TaggedError("WorkerNotReady")<{
25 status: number;
26 body: string;
27}> {}
28
29/** GET a route, retrying until the freshly started workerd serves a 200. */
30const getJsonReady = (url: string) =>
31 Effect.gen(function* () {
32 const client = yield* HttpClient.HttpClient;
33 const res = yield* client.get(url).pipe(
34 Effect.flatMap((res) =>
35 res.status === 200
36 ? Effect.succeed(res)
37 : res.text.pipe(
38 Effect.flatMap((body) =>
39 Effect.fail(new WorkerNotReady({ status: res.status, body })),
40 ),
41 ),
42 ),
43 Effect.retry({
44 while: (e): e is WorkerNotReady => e instanceof WorkerNotReady,
45 schedule: Schedule.max([
46 Schedule.min([
47 Schedule.exponential("500 millis"),
48 Schedule.spaced("2 seconds"),
49 ]),
50 Schedule.recurs(10),
51 ]),
52 }),
53 );
54 return (yield* res.json) as Record<string, unknown>;
55 }).pipe(Effect.orDie);
56
57/**
58 * Pins the `dev.access` simulation of `ctx.access` (the alchemy equivalent
59 * of wrangler's `access.dev` config): a worker with `dev.access` sees a
60 * defined `ctx.access` carrying the configured aud, and `getIdentity()`
61 * resolves the configured identity — while a worker without the config sees
62 * `ctx.access === undefined` (unauthenticated).
63 */
64test.provider(
65 "dev.access simulates ctx.access locally",
66 (stack) =>
67 Effect.gen(function* () {
68 yield* stack.destroy();
69
70 const deployed = yield* stack.deploy(
71 Effect.gen(function* () {
72 const authed = yield* AuthedAccessWorker;
73 const anon = yield* AnonAccessWorker;
74 return { authed, anon };
75 }),
76 );
77
78 // Dev markers: both workers serve from the local dev proxy — no cloud
79 // deploy ran.
80 expect(deployed.authed.url).toMatch(/^http:\/\/localhost:\d+$/);
81 expect(deployed.anon.url).toMatch(/^http:\/\/localhost:\d+$/);
82 // No cloud script exists in dev — the local provider fabricates a
83 // `dev:`-marked identity (mode switches replace the resource, so the
84 // two identities never mix).
85 expect(deployed.authed.workerId).toMatch(/^dev:/);
86
87 const authed = yield* getJsonReady(deployed.authed.url!);
88 expect(authed).toEqual({
89 authenticated: true,
90 aud: "test-aud",
91 email: "dev@alchemy.test",
92 groups: [{ id: "g1", name: "devs" }],
93 });
94
95 const anon = yield* getJsonReady(deployed.anon.url!);
96 expect(anon).toEqual({ authenticated: false });
97
98 yield* stack.destroy();
99 }).pipe(logLevel),
100 {
101 tags: [
102 "provider:cloudflare",
103 "provider:cloudflare:access",
104 "provider:cloudflare:worker",
105 "local",
106 ],
107 },
108);