1import { GcpEnvironment } from "@/GCP/Environment";
2import * as GCP from "@/GCP";
3import * as Test from "@/Test/Alchemy";
4import * as scc from "@distilled.cloud/gcp/securitycenter_v1";
5import { expect } from "alchemy-test";
6import * as Effect from "effect/Effect";
7import { MinimumLogLevel } from "effect/References";
8import * as Schedule from "effect/Schedule";
9
10const { test } = Test.make({ providers: GCP.providers() });
11
12const logLevel = Effect.provideService(
13 MinimumLogLevel,
14 process.env.DEBUG ? "Debug" : "Info",
15);
16
17const waitUntilGone = (name: string) =>
18 scc.getProjectsBigQueryExports({ name }).pipe(
19 Effect.as("found" as const),
20 Effect.catchTag("NotFound", () => Effect.succeed("gone" as const)),
21 Effect.repeat({
22 schedule: Schedule.spaced("1 second"),
23 until: (status) => status === "gone",
24 times: 10,
25 }),
26 );
27
28// Security Command Center is not activated on the testing project (every
29// call fails with ServiceDisabled). Set GCP_TEST_SECURITY_CENTER=1 on a
30// project with SCC activated.
31const runLifecycle = !!process.env.GCP_TEST_SECURITY_CENTER;
32
33test.provider(
34 "getProjectsBigQueryExports on a missing export fails with a typed tag",
35 (stack) =>
36 Effect.gen(function* () {
37 const { project } = yield* GcpEnvironment.current;
38
39 yield* stack.destroy();
40
41 const error = yield* Effect.flip(
42 scc.getProjectsBigQueryExports({
43 name: `projects/${project}/bigQueryExports/alchemy-missing`,
44 }),
45 );
46 expect(error._tag).toEqual("ServiceDisabled");
47
48 yield* stack.destroy();
49 }).pipe(logLevel),
50 {
51 tags: ["provider:gcp", "provider:gcp:securitycenter", "live"],
52 timeout: 90_000,
53 },
54);
55
56test.provider.skipIf(!runLifecycle)(
57 "create, update, and delete a BigQuery export",
58 (stack) =>
59 Effect.gen(function* () {
60 const { project } = yield* GcpEnvironment.current;
61
62 yield* stack.destroy();
63
64 const created = yield* stack.deploy(
65 Effect.gen(function* () {
66 const dataset = yield* GCP.BigQuery.Dataset("SccExport", {
67 location: "US",
68 forceDestroy: true,
69 });
70 const exp = yield* GCP.SecurityCenter.BigQueryExport("High", {
71 dataset: dataset.name,
72 description: "high severity",
73 filter: 'severity="HIGH"',
74 });
75 return { dataset, exp };
76 }),
77 );
78
79 expect(created.exp.exportId).toEqual(expect.any(String));
80 expect(created.exp.name).toEqual(
81 `projects/${project}/bigQueryExports/${created.exp.exportId}`,
82 );
83 expect(created.exp.dataset).toEqual(created.dataset.name);
84 expect(created.exp.description).toEqual("high severity");
85 expect(created.exp.filter).toEqual('severity="HIGH"');
86
87 const fetched = yield* scc.getProjectsBigQueryExports({
88 name: created.exp.name,
89 });
90 expect(fetched.name).toEqual(created.exp.name);
91 expect(fetched.description).toContain("alchemy-id=");
92 expect(fetched.dataset).toEqual(created.dataset.name);
93
94 const updated = yield* stack.deploy(
95 Effect.gen(function* () {
96 const dataset = yield* GCP.BigQuery.Dataset("SccExport", {
97 datasetId: created.dataset.datasetId,
98 location: "US",
99 forceDestroy: true,
100 });
101 const exp = yield* GCP.SecurityCenter.BigQueryExport("High", {
102 exportId: created.exp.exportId,
103 dataset: dataset.name,
104 description: "high and critical",
105 filter: 'severity="HIGH" OR severity="CRITICAL"',
106 });
107 return { dataset, exp };
108 }),
109 );
110
111 expect(updated.exp.name).toEqual(created.exp.name);
112 expect(updated.exp.description).toEqual("high and critical");
113 expect(updated.exp.filter).toEqual(
114 'severity="HIGH" OR severity="CRITICAL"',
115 );
116
117 yield* stack.destroy();
118
119 const gone = yield* waitUntilGone(created.exp.name);
120 expect(gone).toEqual("gone");
121 }).pipe(logLevel),
122 {
123 tags: ["provider:gcp", "provider:gcp:securitycenter", "live"],
124 timeout: 90_000,
125 },
126);