1import * as GCP from "@/GCP";
2import * as Test from "@/Test/Alchemy";
3import * as networksecurity from "@distilled.cloud/gcp/networksecurity_v1";
4import { expect } from "alchemy-test";
5import * as Effect from "effect/Effect";
6import { MinimumLogLevel } from "effect/References";
7import * as Schedule from "effect/Schedule";
8import { GcpEnvironment } from "@/GCP/Environment";
9import { withNetworkSlot } from "../networkQuota.ts";
10
11const { test } = Test.make({ providers: GCP.providers() });
12
13const logLevel = Effect.provideService(
14 MinimumLogLevel,
15 process.env.DEBUG ? "Debug" : "Info",
16);
17
18// Firewall endpoints (Cloud NGFW Enterprise) bill hourly and take well over 5
19// minutes to provision; set GCP_TEST_NGFW=1 together with GCP_TEST_SLOW to run.
20const runLifecycle =
21 !!process.env.GCP_TEST_NGFW &&
22 !!process.env.GCP_TEST_SLOW &&
23 !process.env.FAST;
24
25const waitUntilGone = (name: string) =>
26 networksecurity
27 .getProjectsLocationsFirewallEndpointAssociations({ name })
28 .pipe(
29 Effect.as("found" as const),
30 Effect.catchTag("NotFound", () => Effect.succeed("gone" as const)),
31 Effect.repeat({
32 schedule: Schedule.spaced("2 seconds"),
33 until: (status) => status === "gone",
34 times: 10,
35 }),
36 );
37
38test.provider(
39 "getProjectsLocationsFirewallEndpointAssociations on a missing association fails with a typed tag",
40 (stack) =>
41 Effect.gen(function* () {
42 yield* stack.destroy();
43
44 const { project } = yield* GcpEnvironment.current;
45 const error = yield* Effect.flip(
46 networksecurity.getProjectsLocationsFirewallEndpointAssociations({
47 name: `projects/${project}/locations/us-central1-a/firewallEndpointAssociations/alchemy-missing`,
48 }),
49 );
50 expect(error._tag).toEqual("NotFound");
51
52 yield* stack.destroy();
53 }).pipe(logLevel),
54 {
55 tags: ["provider:gcp", "provider:gcp:networksecurity", "live"],
56 timeout: 90_000,
57 },
58);
59
60test.provider.skipIf(!runLifecycle)(
61 "create, update, and delete a firewall endpoint association",
62 (stack) =>
63 Effect.gen(function* () {
64 yield* stack.destroy();
65
66 const created = yield* stack.deploy(
67 Effect.gen(function* () {
68 const vpc = yield* GCP.Compute.Network("Vpc", {
69 autoCreateSubnetworks: false,
70 description: "association vpc",
71 });
72 const endpoint = yield* GCP.NetworkSecurity.FirewallEndpoint("Ngfw", {
73 location: "us-central1-a",
74 description: "association endpoint",
75 labels: { env: "test" },
76 });
77 const association =
78 yield* GCP.NetworkSecurity.FirewallEndpointAssociation("Inspect", {
79 location: "us-central1-a",
80 firewallEndpoint: endpoint.name,
81 network: vpc.selfLink.as<string>(),
82 labels: { env: "test" },
83 });
84 return { vpc, endpoint, association };
85 }),
86 );
87
88 expect(created.association.name).toContain(
89 "/firewallEndpointAssociations/",
90 );
91 expect(created.association.location).toEqual("us-central1-a");
92 expect(created.association.disabled).toEqual(false);
93 expect(created.association.labels).toMatchObject({ env: "test" });
94 expect(created.association.firewallEndpoint).toEqual(
95 created.endpoint.name,
96 );
97
98 const fetched =
99 yield* networksecurity.getProjectsLocationsFirewallEndpointAssociations(
100 {
101 name: created.association.name,
102 },
103 );
104 expect(fetched.name).toEqual(created.association.name);
105 expect(fetched.labels?.env).toEqual("test");
106 expect(
107 Object.keys(fetched.labels ?? {}).some((key) =>
108 key.startsWith("alchemy-"),
109 ),
110 ).toEqual(true);
111
112 const updated = yield* stack.deploy(
113 Effect.gen(function* () {
114 const vpc = yield* GCP.Compute.Network("Vpc", {
115 networkName: created.vpc.networkName,
116 autoCreateSubnetworks: false,
117 description: "association vpc",
118 });
119 const endpoint = yield* GCP.NetworkSecurity.FirewallEndpoint("Ngfw", {
120 firewallEndpointId: created.endpoint.firewallEndpointId,
121 location: "us-central1-a",
122 description: "association endpoint",
123 labels: { env: "test" },
124 });
125 const association =
126 yield* GCP.NetworkSecurity.FirewallEndpointAssociation("Inspect", {
127 firewallEndpointAssociationId:
128 created.association.firewallEndpointAssociationId,
129 location: "us-central1-a",
130 firewallEndpoint: endpoint.name,
131 network: vpc.selfLink.as<string>(),
132 disabled: true,
133 labels: { env: "prod", role: "ngfw" },
134 });
135 return { vpc, endpoint, association };
136 }),
137 );
138
139 expect(updated.association.name).toEqual(created.association.name);
140 expect(updated.association.disabled).toEqual(true);
141 expect(updated.association.labels).toMatchObject({
142 env: "prod",
143 role: "ngfw",
144 });
145
146 const refetched =
147 yield* networksecurity.getProjectsLocationsFirewallEndpointAssociations(
148 {
149 name: created.association.name,
150 },
151 );
152 expect(refetched.disabled).toEqual(true);
153 expect(refetched.labels?.env).toEqual("prod");
154 expect(refetched.labels?.role).toEqual("ngfw");
155
156 yield* stack.destroy();
157
158 const gone = yield* waitUntilGone(created.association.name);
159 expect(gone).toEqual("gone");
160 }).pipe(logLevel, withNetworkSlot),
161 {
162 tags: ["provider:gcp", "provider:gcp:networksecurity", "live"],
163 timeout: 90_000,
164 },
165);