1import * as GCP from "@/GCP";
2import * as Test from "@/Test/Alchemy";
3import * as networksecurity from "@distilled.cloud/gcp/networksecurity_v1";
4import { expect } from "alchemy-test";
5import * as Effect from "effect/Effect";
6import { MinimumLogLevel } from "effect/References";
7import * as Schedule from "effect/Schedule";
8import { GcpEnvironment } from "@/GCP/Environment";
9
10const { test } = Test.make({ providers: GCP.providers() });
11
12const logLevel = Effect.provideService(
13 MinimumLogLevel,
14 process.env.DEBUG ? "Debug" : "Info",
15);
16
17const waitUntilGone = (name: string) =>
18 networksecurity.getProjectsLocationsSecurityProfileGroups({ name }).pipe(
19 Effect.as("found" as const),
20 Effect.catchTag("NotFound", () => Effect.succeed("gone" as const)),
21 Effect.repeat({
22 schedule: Schedule.spaced("1 second"),
23 until: (status) => status === "gone",
24 times: 10,
25 }),
26 );
27
28test.provider(
29 "getProjectsLocationsSecurityProfileGroups on a missing group fails with a typed tag",
30 (stack) =>
31 Effect.gen(function* () {
32 yield* stack.destroy();
33
34 const { project } = yield* GcpEnvironment.current;
35 const error = yield* Effect.flip(
36 networksecurity.getProjectsLocationsSecurityProfileGroups({
37 name: `projects/${project}/locations/global/securityProfileGroups/alchemy-missing`,
38 }),
39 );
40 expect(error._tag).toEqual("NotFound");
41
42 yield* stack.destroy();
43 }).pipe(logLevel),
44 {
45 tags: ["provider:gcp", "provider:gcp:networksecurity", "live"],
46 timeout: 90_000,
47 },
48);
49
50test.provider(
51 "create, update, and delete a security profile group",
52 (stack) =>
53 Effect.gen(function* () {
54 yield* stack.destroy();
55
56 const created = yield* stack.deploy(
57 Effect.gen(function* () {
58 const profile = yield* GCP.NetworkSecurity.SecurityProfile("Threat", {
59 location: "global",
60 type: "THREAT_PREVENTION",
61 labels: { env: "test" },
62 threatPreventionProfile: {
63 severityOverrides: [{ severity: "HIGH", action: "ALERT" }],
64 },
65 });
66 return yield* GCP.NetworkSecurity.SecurityProfileGroup("Ngfw", {
67 location: "global",
68 description: "profile group a",
69 labels: { env: "test" },
70 threatPreventionProfile: profile.name,
71 });
72 }),
73 );
74
75 expect(created.name).toContain("/securityProfileGroups/");
76 expect(created.name).toContain("/locations/global/");
77 expect(created.securityProfileGroupId).toEqual(expect.any(String));
78 expect(created.location).toEqual("global");
79 expect(created.description).toEqual("profile group a");
80 expect(created.threatPreventionProfile).toContain("/securityProfiles/");
81 expect(created.labels).toMatchObject({ env: "test" });
82 expect(created.createTime).toEqual(expect.any(String));
83
84 const fetched =
85 yield* networksecurity.getProjectsLocationsSecurityProfileGroups({
86 name: created.name,
87 });
88 expect(fetched.name).toEqual(created.name);
89 expect(fetched.description).toEqual("profile group a");
90 expect(fetched.labels?.env).toEqual("test");
91 expect(
92 Object.keys(fetched.labels ?? {}).some((key) =>
93 key.startsWith("alchemy-"),
94 ),
95 ).toEqual(true);
96
97 const updated = yield* stack.deploy(
98 Effect.gen(function* () {
99 const profile = yield* GCP.NetworkSecurity.SecurityProfile("Threat", {
100 location: "global",
101 securityProfileId: created.threatPreventionProfile
102 ?.split("/")
103 .pop(),
104 type: "THREAT_PREVENTION",
105 labels: { env: "test" },
106 threatPreventionProfile: {
107 severityOverrides: [{ severity: "HIGH", action: "ALERT" }],
108 },
109 });
110 return yield* GCP.NetworkSecurity.SecurityProfileGroup("Ngfw", {
111 securityProfileGroupId: created.securityProfileGroupId,
112 location: "global",
113 description: "profile group b",
114 labels: { env: "prod", role: "ngfw" },
115 threatPreventionProfile: profile.name,
116 });
117 }),
118 );
119
120 expect(updated.name).toEqual(created.name);
121 expect(updated.description).toEqual("profile group b");
122 expect(updated.labels).toMatchObject({ env: "prod", role: "ngfw" });
123
124 const refetched =
125 yield* networksecurity.getProjectsLocationsSecurityProfileGroups({
126 name: created.name,
127 });
128 expect(refetched.description).toEqual("profile group b");
129 expect(refetched.labels?.env).toEqual("prod");
130 expect(refetched.labels?.role).toEqual("ngfw");
131
132 yield* stack.destroy();
133
134 const gone = yield* waitUntilGone(created.name);
135 expect(gone).toEqual("gone");
136 }).pipe(logLevel),
137 {
138 tags: ["provider:gcp", "provider:gcp:networksecurity", "live"],
139 timeout: 90_000,
140 },
141);