1import * as GCP from "@/GCP";
2import * as Test from "@/Test/Alchemy";
3import * as cloudasset from "@distilled.cloud/gcp/cloudasset_v1";
4import * as resourcemanager from "@distilled.cloud/gcp/cloudresourcemanager_v3";
5import { expect } from "alchemy-test";
6import * as Effect from "effect/Effect";
7import { MinimumLogLevel } from "effect/References";
8import * as Schedule from "effect/Schedule";
9import { GcpEnvironment } from "@/GCP/Environment";
10
11const { test } = Test.make({ providers: GCP.providers() });
12
13const logLevel = Effect.provideService(
14 MinimumLogLevel,
15 process.env.DEBUG ? "Debug" : "Info",
16);
17
18const projectNumber = Effect.gen(function* () {
19 const { project } = yield* GcpEnvironment.current;
20 const resource = yield* resourcemanager.getProjects({
21 name: `projects/${project}`,
22 });
23 const parts = (resource.name ?? "").split("/");
24 return parts[parts.length - 1] || project;
25});
26
27const waitUntilGone = (name: string) =>
28 cloudasset.getSavedQueries({ name }).pipe(
29 Effect.as("found" as const),
30 Effect.catchTag("NotFound", () => Effect.succeed("gone" as const)),
31 Effect.repeat({
32 schedule: Schedule.spaced("1 second"),
33 until: (status) => status === "gone",
34 times: 10,
35 }),
36 );
37
38test.provider(
39 "getSavedQueries on a missing query fails with a typed tag",
40 (stack) =>
41 Effect.gen(function* () {
42 yield* stack.destroy();
43
44 const number = yield* projectNumber;
45 const error = yield* Effect.flip(
46 cloudasset.getSavedQueries({
47 name: `projects/${number}/savedQueries/alchemy-missing-query`,
48 }),
49 );
50 expect(error._tag).toEqual("NotFound");
51
52 yield* stack.destroy();
53 }).pipe(logLevel),
54 {
55 tags: ["provider:gcp", "provider:gcp:cloudasset", "live"],
56 timeout: 90_000,
57 },
58);
59
60test.provider(
61 "create, update, and delete a saved query",
62 (stack) =>
63 Effect.gen(function* () {
64 const { project } = yield* GcpEnvironment.current;
65 yield* stack.destroy();
66
67 const created = yield* stack.deploy(
68 Effect.gen(function* () {
69 return yield* GCP.CloudAsset.SavedQuery("IamAudit", {
70 description: "who can act as service accounts",
71 labels: { env: "test" },
72 content: {
73 iamPolicyAnalysisQuery: {
74 scope: `projects/${project}`,
75 accessSelector: {
76 permissions: ["iam.serviceAccounts.actAs"],
77 },
78 },
79 },
80 });
81 }),
82 );
83
84 expect(created.name).toContain("/savedQueries/");
85 expect(created.savedQueryId).toEqual(expect.any(String));
86 expect(created.description).toEqual("who can act as service accounts");
87 expect(created.labels).toMatchObject({ env: "test" });
88 expect(
89 created.content?.iamPolicyAnalysisQuery?.accessSelector?.permissions,
90 ).toEqual(expect.arrayContaining(["iam.serviceAccounts.actAs"]));
91
92 const fetched = yield* cloudasset.getSavedQueries({ name: created.name });
93 expect(fetched.name).toEqual(created.name);
94 expect(fetched.description).toEqual("who can act as service accounts");
95 expect(fetched.labels?.env).toEqual("test");
96 expect(fetched.labels?.["alchemy-id"]).toEqual(expect.any(String));
97
98 const updated = yield* stack.deploy(
99 Effect.gen(function* () {
100 return yield* GCP.CloudAsset.SavedQuery("IamAudit", {
101 savedQueryId: created.savedQueryId,
102 description: "roles and permissions",
103 labels: { env: "prod", role: "audit" },
104 content: {
105 iamPolicyAnalysisQuery: {
106 scope: `projects/${project}`,
107 accessSelector: {
108 roles: ["roles/owner"],
109 },
110 },
111 },
112 });
113 }),
114 );
115
116 expect(updated.name).toEqual(created.name);
117 expect(updated.savedQueryId).toEqual(created.savedQueryId);
118 expect(updated.description).toEqual("roles and permissions");
119 expect(updated.labels).toMatchObject({ env: "prod", role: "audit" });
120 expect(
121 updated.content?.iamPolicyAnalysisQuery?.accessSelector?.roles,
122 ).toEqual(expect.arrayContaining(["roles/owner"]));
123
124 const refetched = yield* cloudasset.getSavedQueries({
125 name: created.name,
126 });
127 expect(refetched.description).toEqual("roles and permissions");
128 expect(refetched.labels?.env).toEqual("prod");
129 expect(refetched.labels?.role).toEqual("audit");
130
131 yield* stack.destroy();
132
133 const gone = yield* waitUntilGone(created.name);
134 expect(gone).toEqual("gone");
135 }).pipe(logLevel),
136 {
137 tags: ["provider:gcp", "provider:gcp:cloudasset", "live"],
138 timeout: 90_000,
139 },
140);