1import * as GCP from "@/GCP";
2import * as Test from "@/Test/Alchemy";
3import { KEY_RING_ID } from "./common.ts";
4import * as kms from "@distilled.cloud/gcp/cloudkms_v1";
5import { expect } from "alchemy-test";
6import * as Effect from "effect/Effect";
7import { MinimumLogLevel } from "effect/References";
8import * as Schedule from "effect/Schedule";
9import { GcpEnvironment } from "@/GCP/Environment";
10
11const { test } = Test.make({ providers: GCP.providers() });
12
13const logLevel = Effect.provideService(
14 MinimumLogLevel,
15 process.env.DEBUG ? "Debug" : "Info",
16);
17
18// Cloud KMS KeyRings cannot be deleted. Reuse a constant id so re-runs
19// observe the existing ring instead of leaking a new one every pass.
20
21const waitUntilGone = (name: string) =>
22 kms.getProjectsLocationsKeyRings({ name }).pipe(
23 Effect.as("found" as const),
24 Effect.catchTag("NotFound", () => Effect.succeed("gone" as const)),
25 Effect.repeat({
26 schedule: Schedule.spaced("1 second"),
27 until: (status) => status === "gone",
28 times: 10,
29 }),
30 );
31
32test.provider(
33 "getProjectsLocationsKeyRings on a missing key ring fails with NotFound",
34 () =>
35 Effect.gen(function* () {
36 const { project } = yield* GcpEnvironment.current;
37 const error = yield* Effect.flip(
38 kms.getProjectsLocationsKeyRings({
39 name: `projects/${project}/locations/us-central1/keyRings/alchemy-keyring-does-not-exist`,
40 }),
41 );
42 expect(error._tag).toBe("NotFound");
43 }).pipe(logLevel),
44 { tags: ["provider:gcp", "provider:gcp:kms", "live"] },
45);
46
47test.provider(
48 "create, replace, and destroy a key ring",
49 (stack) =>
50 Effect.gen(function* () {
51 const { project } = yield* GcpEnvironment.current;
52 yield* stack.destroy();
53
54 const created = yield* stack.deploy(
55 Effect.gen(function* () {
56 return yield* GCP.KMS.KeyRing("Keys", {
57 keyRingId: KEY_RING_ID,
58 location: "us-central1",
59 });
60 }),
61 );
62
63 expect(created.keyRingId).toEqual(KEY_RING_ID);
64 expect(created.location).toEqual("us-central1");
65 expect(created.project).toEqual(project);
66 expect(created.name).toEqual(
67 `projects/${project}/locations/us-central1/keyRings/${KEY_RING_ID}`,
68 );
69 expect(created.createTime).toEqual(expect.any(String));
70
71 const fetched = yield* kms.getProjectsLocationsKeyRings({
72 name: created.name,
73 });
74 expect(fetched.name).toEqual(created.name);
75
76 const updated = yield* stack.deploy(
77 Effect.gen(function* () {
78 return yield* GCP.KMS.KeyRing("Keys", {
79 keyRingId: KEY_RING_ID,
80 location: "us-central1",
81 });
82 }),
83 );
84 expect(updated.name).toEqual(created.name);
85 expect(updated.createTime).toEqual(created.createTime);
86
87 const replaced = yield* stack.deploy(
88 Effect.gen(function* () {
89 return yield* GCP.KMS.KeyRing("Keys", {
90 keyRingId: KEY_RING_ID,
91 location: "us-east1",
92 });
93 }),
94 );
95 expect(replaced.location).toEqual("us-east1");
96 expect(replaced.keyRingId).toEqual(KEY_RING_ID);
97 expect(replaced.name).toEqual(
98 `projects/${project}/locations/us-east1/keyRings/${KEY_RING_ID}`,
99 );
100
101 const fetchedReplacement = yield* kms.getProjectsLocationsKeyRings({
102 name: replaced.name,
103 });
104 expect(fetchedReplacement.name).toEqual(replaced.name);
105
106 // The previous location's ring cannot be deleted and remains.
107 const previous = yield* kms.getProjectsLocationsKeyRings({
108 name: created.name,
109 });
110 expect(previous.name).toEqual(created.name);
111
112 yield* stack.destroy();
113
114 const stillThere = yield* kms
115 .getProjectsLocationsKeyRings({ name: replaced.name })
116 .pipe(
117 Effect.as("found" as const),
118 Effect.catchTag("NotFound", () => Effect.succeed("gone" as const)),
119 );
120 expect(stillThere).toEqual("found");
121
122 const gone = yield* waitUntilGone(
123 `projects/${project}/locations/us-central1/keyRings/alchemy-keyring-does-not-exist`,
124 );
125 expect(gone).toEqual("gone");
126 }).pipe(logLevel),
127 { tags: ["provider:gcp", "provider:gcp:kms", "live"], timeout: 90_000 },
128);