1import * as GCP from "@/GCP";
2import { GcpEnvironment } from "@/GCP/Environment";
3import * as Test from "@/Test/Alchemy";
4import * as recaptchaenterprise from "@distilled.cloud/gcp/recaptchaenterprise_v1";
5import { expect } from "alchemy-test";
6import * as Effect from "effect/Effect";
7import { MinimumLogLevel } from "effect/References";
8import * as Schedule from "effect/Schedule";
9
10const { test } = Test.make({ providers: GCP.providers() });
11
12const logLevel = Effect.provideService(
13 MinimumLogLevel,
14 process.env.DEBUG ? "Debug" : "Info",
15);
16
17const waitUntilGone = (name: string) =>
18 recaptchaenterprise.getProjectsFirewallpolicies({ name }).pipe(
19 Effect.as("found" as const),
20 Effect.catchTag("NotFound", () => Effect.succeed("gone" as const)),
21 Effect.repeat({
22 schedule: Schedule.spaced("1 second"),
23 until: (status) => status === "gone",
24 times: 10,
25 }),
26 );
27
28// The firewall policy API is allow-listed per project. Set
29// GCP_TEST_RECAPTCHA_FIREWALL=1 on a project with access.
30const runFirewall = !!process.env.GCP_TEST_RECAPTCHA_FIREWALL;
31
32test.provider.skipIf(runFirewall)(
33 "listProjectsFirewallpolicies without API access fails with FirewallPolicyApiUnavailable",
34 (stack) =>
35 Effect.gen(function* () {
36 const { project } = yield* GcpEnvironment.current;
37 yield* stack.destroy();
38
39 const error = yield* Effect.flip(
40 recaptchaenterprise.listProjectsFirewallpolicies({
41 parent: `projects/${project}`,
42 }),
43 );
44 expect(error._tag).toEqual("FirewallPolicyApiUnavailable");
45
46 yield* stack.destroy();
47 }).pipe(logLevel),
48 {
49 tags: ["provider:gcp", "provider:gcp:recaptchaenterprise", "live"],
50 timeout: 60_000,
51 },
52);
53
54test.provider.skipIf(!runFirewall)(
55 "create, update, and delete a firewall policy",
56 (stack) =>
57 Effect.gen(function* () {
58 yield* stack.destroy();
59
60 const created = yield* stack.deploy(
61 Effect.gen(function* () {
62 return yield* GCP.RecaptchaEnterprise.Firewallpolicy("Login", {
63 path: "/login",
64 description: "allow login",
65 actions: [{ allow: {} }],
66 });
67 }),
68 );
69
70 expect(created.name).toContain("/firewallpolicies/");
71 expect(created.firewallpolicyId).toEqual(expect.any(String));
72 expect(created.path).toEqual("/login");
73 expect(created.description).toEqual("allow login");
74 expect(created.actions[0]?.allow).toEqual({});
75
76 const fetched = yield* recaptchaenterprise.getProjectsFirewallpolicies({
77 name: created.name,
78 });
79 expect(fetched.name).toEqual(created.name);
80 expect(fetched.path).toEqual("/login");
81 expect(fetched.description).toEqual("allow login");
82 expect(fetched.actions?.[0]?.allow).toBeDefined();
83
84 const updated = yield* stack.deploy(
85 Effect.gen(function* () {
86 return yield* GCP.RecaptchaEnterprise.Firewallpolicy("Login", {
87 firewallpolicyId: created.firewallpolicyId,
88 path: "/signin",
89 description: "allow sign-in",
90 actions: [{ block: {} }],
91 });
92 }),
93 );
94
95 expect(updated.name).toEqual(created.name);
96 expect(updated.firewallpolicyId).toEqual(created.firewallpolicyId);
97 expect(updated.path).toEqual("/signin");
98 expect(updated.description).toEqual("allow sign-in");
99 expect(updated.actions[0]?.block).toEqual({});
100
101 const fetchedUpdate =
102 yield* recaptchaenterprise.getProjectsFirewallpolicies({
103 name: created.name,
104 });
105 expect(fetchedUpdate.path).toEqual("/signin");
106 expect(fetchedUpdate.description).toEqual("allow sign-in");
107 expect(fetchedUpdate.actions?.[0]?.block).toBeDefined();
108
109 yield* stack.destroy();
110
111 const gone = yield* waitUntilGone(created.name);
112 expect(gone).toEqual("gone");
113 }).pipe(logLevel),
114 {
115 tags: ["provider:gcp", "provider:gcp:recaptchaenterprise", "live"],
116 timeout: 90_000,
117 },
118);