1import { GcpEnvironment } from "@/GCP/Environment";
2import * as GCP from "@/GCP";
3import * as Test from "@/Test/Alchemy";
4import * as networkmanagement from "@distilled.cloud/gcp/networkmanagement_v1";
5import * as resourcemanager from "@distilled.cloud/gcp/cloudresourcemanager_v3";
6import { expect } from "alchemy-test";
7import * as Effect from "effect/Effect";
8import { MinimumLogLevel } from "effect/References";
9import * as Schedule from "effect/Schedule";
10
11const { test } = Test.make({ providers: GCP.providers() });
12
13const logLevel = Effect.provideService(
14 MinimumLogLevel,
15 process.env.DEBUG ? "Debug" : "Info",
16);
17// Organization flow-log configs need Network Management admin on the org; the
18// testing credentials are rejected (probe). Set GOOGLE_ORGANIZATION_ID when the
19// credentials administer the org.
20const runOrgLifecycle = !!process.env.GOOGLE_ORGANIZATION_ID;
21
22const waitUntilGone = (name: string) =>
23 networkmanagement.getOrganizationsLocationsVpcFlowLogsConfigs({ name }).pipe(
24 Effect.as("found" as const),
25 Effect.catchTag("NotFound", () => Effect.succeed("gone" as const)),
26 Effect.repeat({
27 schedule: Schedule.spaced("1 second"),
28 until: (status) => status === "gone",
29 times: 10,
30 }),
31 );
32
33const resolveOrganization = () =>
34 Effect.gen(function* () {
35 const { project } = yield* GcpEnvironment.current;
36
37 const resource = yield* resourcemanager.getProjects({
38 name: `projects/${project}`,
39 });
40 const parent = resource.parent ?? "organizations/0";
41 if (parent.startsWith("organizations/")) {
42 return parent.slice("organizations/".length);
43 }
44 return process.env.GOOGLE_ORGANIZATION_ID ?? "0";
45 });
46
47test.provider(
48 "getOrganizationsLocationsVpcFlowLogsConfigs on a missing config fails with NotFound (Forbidden without org IAM)",
49 (stack) =>
50 Effect.gen(function* () {
51 yield* stack.destroy();
52
53 const organization = yield* resolveOrganization();
54 const error = yield* Effect.flip(
55 networkmanagement.getOrganizationsLocationsVpcFlowLogsConfigs({
56 name: `organizations/${organization}/locations/global/vpcFlowLogsConfigs/alchemy-missing`,
57 }),
58 );
59 expect(error._tag).toEqual(runOrgLifecycle ? "NotFound" : "Forbidden");
60
61 yield* stack.destroy();
62 }).pipe(logLevel),
63 {
64 tags: ["provider:gcp", "provider:gcp:networkmanagement", "live"],
65 timeout: 90_000,
66 },
67);
68
69test.provider.skipIf(runOrgLifecycle)(
70 "createOrganizationsLocationsVpcFlowLogsConfigs without org IAM fails with Forbidden",
71 (stack) =>
72 Effect.gen(function* () {
73 yield* stack.destroy();
74
75 const organization = yield* resolveOrganization();
76 const error = yield* Effect.flip(
77 networkmanagement.createOrganizationsLocationsVpcFlowLogsConfigs({
78 parent: `organizations/${organization}/locations/global`,
79 vpcFlowLogsConfigId: "alchemy-org-flow-logs-probe",
80 body: {
81 state: "ENABLED",
82 aggregationInterval: "INTERVAL_5_SEC",
83 flowSampling: 1,
84 },
85 }),
86 );
87 expect(error._tag).toEqual("Forbidden");
88
89 yield* stack.destroy();
90 }).pipe(logLevel),
91 {
92 tags: ["provider:gcp", "provider:gcp:networkmanagement", "live"],
93 timeout: 90_000,
94 },
95);
96
97test.provider.skipIf(!runOrgLifecycle)(
98 "create, update, and delete an organization vpc flow logs config",
99 (stack) =>
100 Effect.gen(function* () {
101 yield* stack.destroy();
102
103 const created = yield* stack.deploy(
104 Effect.gen(function* () {
105 return yield* GCP.NetworkManagement.OrganizationsVpcFlowLogsConfig(
106 "OrgLogs",
107 {
108 description: "org flow logs a",
109 labels: { env: "test" },
110 aggregationInterval: "INTERVAL_5_SEC",
111 },
112 );
113 }),
114 );
115
116 expect(created.name).toContain("/vpcFlowLogsConfigs/");
117 expect(created.name).toContain("organizations/");
118 expect(created.location).toEqual("global");
119 expect(created.description).toEqual("org flow logs a");
120 expect(created.labels).toMatchObject({ env: "test" });
121
122 const fetched =
123 yield* networkmanagement.getOrganizationsLocationsVpcFlowLogsConfigs({
124 name: created.name,
125 });
126 expect(fetched.name).toEqual(created.name);
127 expect(fetched.labels?.env).toEqual("test");
128 expect(
129 Object.keys(fetched.labels ?? {}).some((key) =>
130 key.startsWith("alchemy-"),
131 ),
132 ).toEqual(true);
133
134 const updated = yield* stack.deploy(
135 Effect.gen(function* () {
136 return yield* GCP.NetworkManagement.OrganizationsVpcFlowLogsConfig(
137 "OrgLogs",
138 {
139 vpcFlowLogsConfigId: created.vpcFlowLogsConfigId,
140 organization: created.organization,
141 description: "org flow logs b",
142 labels: { env: "prod", role: "logs" },
143 aggregationInterval: "INTERVAL_1_MIN",
144 },
145 );
146 }),
147 );
148
149 expect(updated.name).toEqual(created.name);
150 expect(updated.description).toEqual("org flow logs b");
151 expect(updated.labels).toMatchObject({ env: "prod", role: "logs" });
152
153 yield* stack.destroy();
154
155 const gone = yield* waitUntilGone(created.name);
156 expect(gone).toEqual("gone");
157 }).pipe(logLevel),
158 {
159 tags: ["provider:gcp", "provider:gcp:networkmanagement", "live"],
160 timeout: 180_000,
161 },
162);