1import * as GCP from "@/GCP";
2import * as Test from "@/Test/Alchemy";
3import * as compute from "@distilled.cloud/gcp/compute_v1";
4import * as resourcemanager from "@distilled.cloud/gcp/cloudresourcemanager_v3";
5import { expect } from "alchemy-test";
6import * as Effect from "effect/Effect";
7import { MinimumLogLevel } from "effect/References";
8import * as Schedule from "effect/Schedule";
9import { GcpEnvironment } from "@/GCP/Environment";
10
11const { test } = Test.make({ providers: GCP.providers() });
12
13const logLevel = Effect.provideService(
14 MinimumLogLevel,
15 process.env.DEBUG ? "Debug" : "Info",
16);
17
18const runLifecycle =
19 !!process.env.GCP_TEST_ORG_SECURITY_POLICY && !process.env.FAST;
20
21const waitUntilGone = (securityPolicy: string) =>
22 compute.getOrganizationSecurityPolicies({ securityPolicy }).pipe(
23 Effect.as("found" as const),
24 Effect.catchTag("NotFound", () => Effect.succeed("gone" as const)),
25 Effect.repeat({
26 schedule: Schedule.spaced("1 second"),
27 until: (status) => status === "gone",
28 times: 10,
29 }),
30 );
31
32const ruleAt = (
33 rules: compute.SecurityPolicyRule[] | undefined,
34 priority: number,
35) => (rules ?? []).find((rule) => rule.priority === priority);
36
37test.provider(
38 "getOrganizationSecurityPolicies with an invalid id fails with BadRequest",
39 (stack) =>
40 Effect.gen(function* () {
41 yield* stack.destroy();
42
43 const error = yield* Effect.flip(
44 compute.getOrganizationSecurityPolicies({
45 securityPolicy: "0",
46 }),
47 );
48 expect(error._tag).toEqual("BadRequest");
49
50 yield* stack.destroy();
51 }).pipe(logLevel),
52 { tags: ["provider:gcp", "provider:gcp:compute", "live"], timeout: 90_000 },
53);
54
55test.provider.skipIf(!!process.env.GCP_TEST_ORG_SECURITY_POLICY)(
56 "insertOrganizationSecurityPolicies without org IAM fails with Forbidden",
57 (stack) =>
58 Effect.gen(function* () {
59 const { project } = yield* GcpEnvironment.current;
60 yield* stack.destroy();
61
62 const resource = yield* resourcemanager.getProjects({
63 name: `projects/${project}`,
64 });
65 expect(resource.parent).toEqual(expect.any(String));
66
67 const error = yield* Effect.flip(
68 compute.insertOrganizationSecurityPolicies({
69 parentId: resource.parent,
70 body: {
71 shortName: "alchemy-orgarmor-probe",
72 description: "probe",
73 type: "CLOUD_ARMOR",
74 },
75 }),
76 );
77 expect(error._tag).toEqual("Forbidden");
78
79 yield* stack.destroy();
80 }).pipe(logLevel),
81 { tags: ["provider:gcp", "provider:gcp:compute", "live"], timeout: 90_000 },
82);
83
84test.provider.skipIf(!runLifecycle)(
85 "create, update, and delete an organization security policy",
86 (stack) =>
87 Effect.gen(function* () {
88 yield* stack.destroy();
89
90 const created = yield* stack.deploy(
91 Effect.gen(function* () {
92 return yield* GCP.Compute.OrganizationSecurityPolicy("OrgArmor", {
93 description: "deny scanner",
94 rules: [
95 {
96 action: "deny(403)",
97 priority: 1000,
98 match: {
99 versionedExpr: "SRC_IPS_V1",
100 config: { srcIpRanges: ["9.9.9.0/24"] },
101 },
102 },
103 ],
104 });
105 }),
106 );
107
108 expect(created.shortName).toEqual(expect.any(String));
109 expect(created.securityPolicyId).toEqual(expect.any(String));
110 expect(created.type).toEqual("CLOUD_ARMOR");
111 expect(created.description).toEqual("deny scanner");
112 expect(ruleAt(created.rules, 1000)?.action).toEqual("deny(403)");
113
114 const fetched = yield* compute.getOrganizationSecurityPolicies({
115 securityPolicy: created.securityPolicyId,
116 });
117 expect(fetched.shortName).toEqual(created.shortName);
118 expect(fetched.description).toContain("[alchemy ");
119
120 const updated = yield* stack.deploy(
121 Effect.gen(function* () {
122 return yield* GCP.Compute.OrganizationSecurityPolicy("OrgArmor", {
123 shortName: created.shortName,
124 parent: created.parent,
125 description: "updated armor",
126 rules: [
127 {
128 action: "deny(403)",
129 priority: 1000,
130 match: {
131 versionedExpr: "SRC_IPS_V1",
132 config: { srcIpRanges: ["9.9.9.0/24", "8.8.8.8/32"] },
133 },
134 },
135 ],
136 });
137 }),
138 );
139
140 expect(updated.securityPolicyId).toEqual(created.securityPolicyId);
141 expect(updated.description).toEqual("updated armor");
142
143 yield* stack.destroy();
144
145 const gone = yield* waitUntilGone(created.securityPolicyId);
146 expect(gone).toEqual("gone");
147 }).pipe(logLevel),
148 { tags: ["provider:gcp", "provider:gcp:compute", "live"], timeout: 90_000 },
149);