1import * as GCP from "@/GCP";
2import * as Test from "@/Test/Alchemy";
3import * as secretmanager from "@distilled.cloud/gcp/secretmanager_v1";
4import { expect } from "alchemy-test";
5import * as Effect from "effect/Effect";
6import { MinimumLogLevel } from "effect/References";
7import * as Schedule from "effect/Schedule";
8import { GcpEnvironment } from "@/GCP/Environment";
9
10const { test } = Test.make({ providers: GCP.providers() });
11
12const logLevel = Effect.provideService(
13 MinimumLogLevel,
14 process.env.DEBUG ? "Debug" : "Info",
15);
16
17const waitUntilGone = (name: string) =>
18 secretmanager.getProjectsLocationsSecrets({ name }).pipe(
19 Effect.as("found" as const),
20 Effect.catchTag(["NotFound"], () => Effect.succeed("gone" as const)),
21 Effect.repeat({
22 schedule: Schedule.spaced("1 second"),
23 until: (status) => status === "gone",
24 times: 10,
25 }),
26 );
27
28test.provider(
29 "a missing regional secret reaches the regional endpoint and fails with NotFound",
30 (stack) =>
31 Effect.gen(function* () {
32 const { project } = yield* GcpEnvironment.current;
33 yield* stack.destroy();
34 // Distilled routes locations/{region} Secret Manager requests to
35 // secretmanager.{region}.rep.googleapis.com; the global endpoint would
36 // answer BadRequest instead.
37 const error = yield* Effect.flip(
38 secretmanager.getProjectsLocationsSecrets({
39 name: `projects/${project}/locations/us-central1/secrets/alchemy-missing-regional`,
40 }),
41 );
42 expect(error._tag).toEqual("NotFound");
43 yield* stack.destroy();
44 }).pipe(logLevel),
45 {
46 tags: ["provider:gcp", "provider:gcp:secretmanager", "live"],
47 timeout: 60_000,
48 },
49);
50
51test.provider(
52 "create, update, and delete a regional secret",
53 (stack) =>
54 Effect.gen(function* () {
55 yield* stack.destroy();
56
57 const created = yield* stack.deploy(
58 Effect.gen(function* () {
59 return yield* GCP.SecretManager.LocationsSecret("ApiKey", {
60 location: "us-central1",
61 labels: { env: "test" },
62 annotations: { owner: "payments" },
63 });
64 }),
65 );
66
67 expect(created.name).toContain("/locations/us-central1/secrets/");
68 expect(created.secretId).toEqual(expect.any(String));
69 expect(created.location).toEqual("us-central1");
70 expect(created.labels).toMatchObject({ env: "test" });
71 expect(created.annotations).toMatchObject({ owner: "payments" });
72
73 const fetched = yield* secretmanager.getProjectsLocationsSecrets({
74 name: created.name,
75 });
76 expect(fetched.name).toEqual(created.name);
77 expect(fetched.labels?.env).toEqual("test");
78 expect(fetched.labels?.["alchemy-id"]).toEqual(expect.any(String));
79 expect(fetched.annotations?.owner).toEqual("payments");
80
81 const payload = yield* Effect.sync(() =>
82 Buffer.from("alchemy-regional-secret", "utf8").toString("base64"),
83 );
84 const version = yield* secretmanager.addVersionProjectsLocationsSecrets({
85 parent: created.name,
86 body: { payload: { data: payload } },
87 });
88 expect(version.name).toContain("/versions/");
89
90 const accessed =
91 yield* secretmanager.accessProjectsLocationsSecretsVersions({
92 name: `${created.name}/versions/latest`,
93 });
94 expect(accessed.payload?.data).toEqual(payload);
95
96 const updated = yield* stack.deploy(
97 Effect.gen(function* () {
98 return yield* GCP.SecretManager.LocationsSecret("ApiKey", {
99 secretId: created.secretId,
100 location: "us-central1",
101 labels: { env: "prod", role: "api" },
102 annotations: { owner: "platform" },
103 });
104 }),
105 );
106
107 expect(updated.name).toEqual(created.name);
108 expect(updated.labels).toMatchObject({ env: "prod", role: "api" });
109 expect(updated.annotations).toMatchObject({ owner: "platform" });
110
111 const fetchedUpdate = yield* secretmanager.getProjectsLocationsSecrets({
112 name: created.name,
113 });
114 expect(fetchedUpdate.labels?.env).toEqual("prod");
115 expect(fetchedUpdate.labels?.role).toEqual("api");
116 expect(fetchedUpdate.annotations?.owner).toEqual("platform");
117
118 yield* stack.destroy();
119
120 const gone = yield* waitUntilGone(created.name);
121 expect(gone).toEqual("gone");
122 }).pipe(logLevel),
123 {
124 tags: ["provider:gcp", "provider:gcp:secretmanager", "live"],
125 timeout: 90_000,
126 },
127);
128
129test.provider(
130 "replace a regional secret when location changes",
131 (stack) =>
132 Effect.gen(function* () {
133 yield* stack.destroy();
134
135 const created = yield* stack.deploy(
136 Effect.gen(function* () {
137 return yield* GCP.SecretManager.LocationsSecret("RegionalKey", {
138 location: "us-central1",
139 });
140 }),
141 );
142
143 expect(created.location).toEqual("us-central1");
144 expect(created.name).toContain("/locations/us-central1/secrets/");
145
146 const replaced = yield* stack.deploy(
147 Effect.gen(function* () {
148 return yield* GCP.SecretManager.LocationsSecret("RegionalKey", {
149 secretId: created.secretId,
150 location: "us-east1",
151 });
152 }),
153 );
154
155 expect(replaced.secretId).toEqual(created.secretId);
156 expect(replaced.location).toEqual("us-east1");
157 expect(replaced.name).toContain("/locations/us-east1/secrets/");
158 expect(replaced.name).not.toEqual(created.name);
159
160 const fetched = yield* secretmanager.getProjectsLocationsSecrets({
161 name: replaced.name,
162 });
163 expect(fetched.name).toEqual(replaced.name);
164
165 const oldGone = yield* waitUntilGone(created.name);
166 expect(oldGone).toEqual("gone");
167
168 yield* stack.destroy();
169
170 const gone = yield* waitUntilGone(replaced.name);
171 expect(gone).toEqual("gone");
172 }).pipe(logLevel),
173 {
174 tags: ["provider:gcp", "provider:gcp:secretmanager", "live"],
175 timeout: 90_000,
176 },
177);