1import * as GCP from "@/GCP";
2import * as Test from "@/Test/Alchemy";
3import * as networksecurity from "@distilled.cloud/gcp/networksecurity_v1";
4import * as resourcemanager from "@distilled.cloud/gcp/cloudresourcemanager_v3";
5import { expect } from "alchemy-test";
6import * as Effect from "effect/Effect";
7import { MinimumLogLevel } from "effect/References";
8import * as Schedule from "effect/Schedule";
9import { GcpEnvironment } from "@/GCP/Environment";
10
11const { test } = Test.make({ providers: GCP.providers() });
12
13const logLevel = Effect.provideService(
14 MinimumLogLevel,
15 process.env.DEBUG ? "Debug" : "Info",
16);
17
18const waitUntilGone = (name: string) =>
19 networksecurity.getOrganizationsLocationsFirewallEndpoints({ name }).pipe(
20 Effect.as("found" as const),
21 Effect.catchTag("NotFound", () => Effect.succeed("gone" as const)),
22 Effect.repeat({
23 schedule: Schedule.spaced("2 seconds"),
24 until: (status) => status === "gone",
25 times: 10,
26 }),
27 );
28
29test.provider(
30 "getOrganizationsLocationsFirewallEndpoints on a missing endpoint fails with NotFound (Forbidden without org IAM)",
31 (stack) =>
32 Effect.gen(function* () {
33 const { project } = yield* GcpEnvironment.current;
34 yield* stack.destroy();
35
36 const resource = yield* resourcemanager.getProjects({
37 name: `projects/${project}`,
38 });
39 const parent = resource.parent ?? "organizations/0";
40 const organization = parent.startsWith("organizations/")
41 ? parent.slice("organizations/".length)
42 : "0";
43 const error = yield* Effect.flip(
44 networksecurity.getOrganizationsLocationsFirewallEndpoints({
45 name: `organizations/${organization}/locations/us-central1-a/firewallEndpoints/alchemy-missing-fwep`,
46 }),
47 );
48 expect(error._tag).toEqual(
49 process.env.GCP_TEST_ORG_NETWORKSECURITY ? "NotFound" : "Forbidden",
50 );
51
52 yield* stack.destroy();
53 }).pipe(logLevel),
54 {
55 tags: ["provider:gcp", "provider:gcp:networksecurity", "live"],
56 timeout: 90_000,
57 },
58);
59
60// The testing credentials lack org-level Network Security IAM (Forbidden:
61// "Permission 'networksecurity.….get' denied on 'organizations/…'"). Set
62// GCP_TEST_ORG_NETWORKSECURITY=1 when they administer the organization.
63test.provider.skipIf(!!process.env.GCP_TEST_ORG_NETWORKSECURITY)(
64 "createOrganizationsLocationsFirewallEndpoints without org IAM fails with Forbidden",
65 (stack) =>
66 Effect.gen(function* () {
67 const { project } = yield* GcpEnvironment.current;
68 yield* stack.destroy();
69
70 const resource = yield* resourcemanager.getProjects({
71 name: `projects/${project}`,
72 });
73 const parent = resource.parent ?? "organizations/0";
74 const organization = parent.startsWith("organizations/")
75 ? parent.slice("organizations/".length)
76 : "0";
77 const error = yield* Effect.flip(
78 networksecurity.createOrganizationsLocationsFirewallEndpoints({
79 parent: `organizations/${organization}/locations/us-central1-a`,
80 firewallEndpointId: "alchemy-org-fwep-probe",
81 body: { billingProjectId: project },
82 }),
83 );
84 expect(error._tag).toBe("Forbidden");
85
86 yield* stack.destroy();
87 }).pipe(logLevel),
88 {
89 tags: ["provider:gcp", "provider:gcp:networksecurity", "live"],
90 timeout: 90_000,
91 },
92);
93
94test.provider.skipIf(
95 !!process.env.FAST || !process.env.GCP_TEST_ORG_NETWORKSECURITY,
96)(
97 "create, update, and delete an organization firewall endpoint",
98 (stack) =>
99 Effect.gen(function* () {
100 yield* stack.destroy();
101
102 const created = yield* stack.deploy(
103 Effect.gen(function* () {
104 return yield* GCP.NetworkSecurity.OrganizationsFirewallEndpoint(
105 "Ngfw",
106 {
107 location: "us-central1-a",
108 description: "fwep a",
109 labels: { env: "test" },
110 },
111 );
112 }),
113 );
114
115 expect(created.name).toContain("/firewallEndpoints/");
116 expect(created.name).toContain("organizations/");
117 expect(created.location).toEqual("us-central1-a");
118 expect(created.labels).toMatchObject({ env: "test" });
119
120 const fetched =
121 yield* networksecurity.getOrganizationsLocationsFirewallEndpoints({
122 name: created.name,
123 });
124 expect(fetched.name).toEqual(created.name);
125 expect(fetched.labels?.env).toEqual("test");
126
127 const updated = yield* stack.deploy(
128 Effect.gen(function* () {
129 return yield* GCP.NetworkSecurity.OrganizationsFirewallEndpoint(
130 "Ngfw",
131 {
132 firewallEndpointId: created.firewallEndpointId,
133 organization: created.organization,
134 location: "us-central1-a",
135 billingProjectId: created.billingProjectId,
136 description: "fwep b",
137 labels: { env: "prod", role: "ngfw" },
138 },
139 );
140 }),
141 );
142
143 expect(updated.name).toEqual(created.name);
144 expect(updated.description).toEqual("fwep b");
145 expect(updated.labels).toMatchObject({ env: "prod", role: "ngfw" });
146
147 yield* stack.destroy();
148
149 const gone = yield* waitUntilGone(created.name);
150 expect(gone).toEqual("gone");
151 }).pipe(logLevel),
152 {
153 tags: ["provider:gcp", "provider:gcp:networksecurity", "live"],
154 timeout: 120_000,
155 },
156);