1import * as GCP from "@/GCP";
2import type { StackServices } from "@/Stack";
3import * as Test from "@/Test/Alchemy";
4import * as sqladmin from "@distilled.cloud/gcp/sqladmin_v1";
5import { expect } from "alchemy-test";
6import * as Effect from "effect/Effect";
7import * as Layer from "effect/Layer";
8import { MinimumLogLevel } from "effect/References";
9import * as Schedule from "effect/Schedule";
10import { GcpEnvironment } from "@/GCP/Environment";
11
12const { test } = Test.make({
13 providers: GCP.providers() as Layer.Layer<
14 GCP.ProviderRequirements,
15 never,
16 StackServices
17 >,
18});
19
20const logLevel = Effect.provideService(
21 MinimumLogLevel,
22 process.env.DEBUG ? "Debug" : "Info",
23);
24
25// Runs against an existing Cloud SQL instance (creating one takes well over
26// 5 minutes); set GCP_SQL_INSTANCE to its name.
27const sqlInstance =
28 process.env.GCP_SQL_INSTANCE || process.env.GCP_TEST_SQL_INSTANCE;
29const runLifecycle = !!sqlInstance && !process.env.FAST;
30
31const waitUntilGone = (instance: string, sha1Fingerprint: string) =>
32 GcpEnvironment.current.pipe(
33 Effect.flatMap(({ project }) =>
34 sqladmin
35 .getSslCerts({
36 project,
37 instance,
38 sha1Fingerprint,
39 })
40 .pipe(
41 Effect.as("found" as const),
42 Effect.catchTag("NotFound", () => Effect.succeed("gone" as const)),
43 Effect.repeat({
44 schedule: Schedule.spaced("1 second"),
45 until: (status) => status === "gone",
46 times: 10,
47 }),
48 ),
49 ),
50 );
51
52test.provider(
53 "getSslCerts on a missing instance fails with SqlInstanceNotAuthorized",
54 (stack) =>
55 Effect.gen(function* () {
56 const { project } = yield* GcpEnvironment.current;
57 yield* stack.destroy();
58
59 const error = yield* Effect.flip(
60 sqladmin.getSslCerts({
61 project,
62 instance: "alchemy-sql-instance-does-not-exist",
63 sha1Fingerprint: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
64 }),
65 );
66 // Cloud SQL hides unknown instances behind 403 rather than 404.
67 expect(error._tag).toBe("SqlInstanceNotAuthorized");
68
69 yield* stack.destroy();
70 }).pipe(logLevel),
71 { tags: ["provider:gcp", "provider:gcp:sql", "live"], timeout: 90_000 },
72);
73
74test.provider(
75 "listSslCerts on a missing instance fails with SqlInstanceNotAuthorized",
76 (stack) =>
77 Effect.gen(function* () {
78 const { project } = yield* GcpEnvironment.current;
79 yield* stack.destroy();
80
81 const error = yield* Effect.flip(
82 sqladmin.listSslCerts({
83 project,
84 instance: "alchemy-sql-instance-does-not-exist",
85 }),
86 );
87 expect(error._tag).toBe("SqlInstanceNotAuthorized");
88
89 yield* stack.destroy();
90 }).pipe(logLevel),
91 { tags: ["provider:gcp", "provider:gcp:sql", "live"], timeout: 90_000 },
92);
93
94test.provider.skipIf(!runLifecycle)(
95 "create, replace, and delete a sql ssl cert",
96 (stack) =>
97 Effect.gen(function* () {
98 const { project } = yield* GcpEnvironment.current;
99 yield* stack.destroy();
100
101 const instance = sqlInstance!;
102
103 const created = yield* stack.deploy(
104 Effect.gen(function* () {
105 return yield* GCP.SQL.SslCert("Client", {
106 instance,
107 });
108 }),
109 );
110
111 expect(created.commonName).toEqual(expect.any(String));
112 expect(created.commonName.length).toBeGreaterThan(0);
113 expect(created.instance).toEqual(instance);
114 expect(created.project).toEqual(project);
115 expect(created.sha1Fingerprint).toMatch(/^[a-fA-F0-9]{40}$/);
116 expect(created.cert).toEqual(
117 expect.stringContaining("BEGIN CERTIFICATE"),
118 );
119 expect(created.privateKey).toEqual(expect.stringContaining("BEGIN"));
120 expect(created.serverCaCert).toEqual(
121 expect.stringContaining("BEGIN CERTIFICATE"),
122 );
123
124 const fetched = yield* sqladmin.getSslCerts({
125 project: created.project,
126 instance: created.instance,
127 sha1Fingerprint: created.sha1Fingerprint,
128 });
129 expect(fetched.commonName).toEqual(created.commonName);
130 expect(fetched.sha1Fingerprint).toEqual(created.sha1Fingerprint);
131 expect(fetched.cert).toEqual(
132 expect.stringContaining("BEGIN CERTIFICATE"),
133 );
134
135 const unchanged = yield* stack.deploy(
136 Effect.gen(function* () {
137 return yield* GCP.SQL.SslCert("Client", {
138 instance,
139 commonName: created.commonName,
140 });
141 }),
142 );
143 expect(unchanged.sha1Fingerprint).toEqual(created.sha1Fingerprint);
144 expect(unchanged.privateKey).toEqual(created.privateKey);
145 expect(unchanged.serverCaCert).toEqual(created.serverCaCert);
146
147 const nextName =
148 created.commonName.length >= 64
149 ? `${created.commonName.slice(0, 63)}b`
150 : `${created.commonName}b`;
151
152 const replaced = yield* stack.deploy(
153 Effect.gen(function* () {
154 return yield* GCP.SQL.SslCert("Client", {
155 instance,
156 commonName: nextName,
157 });
158 }),
159 );
160
161 expect(replaced.commonName).toEqual(nextName);
162 expect(replaced.sha1Fingerprint).not.toEqual(created.sha1Fingerprint);
163 expect(replaced.privateKey).toEqual(expect.stringContaining("BEGIN"));
164
165 const refetched = yield* sqladmin.getSslCerts({
166 project: replaced.project,
167 instance: replaced.instance,
168 sha1Fingerprint: replaced.sha1Fingerprint,
169 });
170 expect(refetched.commonName).toEqual(nextName);
171
172 const oldGone = yield* waitUntilGone(
173 created.instance,
174 created.sha1Fingerprint,
175 );
176 expect(oldGone).toEqual("gone");
177
178 yield* stack.destroy();
179
180 const gone = yield* waitUntilGone(
181 replaced.instance,
182 replaced.sha1Fingerprint,
183 );
184 expect(gone).toEqual("gone");
185 }).pipe(logLevel),
186 { tags: ["provider:gcp", "provider:gcp:sql", "live"], timeout: 120_000 },
187);