1import { GcpEnvironment } from "@/GCP/Environment";
2import * as GCP from "@/GCP";
3import * as Test from "@/Test/Alchemy";
4import * as scc from "@distilled.cloud/gcp/securitycenter_v1";
5import { expect } from "alchemy-test";
6import * as Effect from "effect/Effect";
7import { MinimumLogLevel } from "effect/References";
8import * as Schedule from "effect/Schedule";
9
10const { test } = Test.make({ providers: GCP.providers() });
11
12const logLevel = Effect.provideService(
13 MinimumLogLevel,
14 process.env.DEBUG ? "Debug" : "Info",
15);
16
17const waitUntilGone = (name: string) =>
18 scc.getProjectsNotificationConfigs({ name }).pipe(
19 Effect.as("found" as const),
20 Effect.catchTag("NotFound", () => Effect.succeed("gone" as const)),
21 Effect.repeat({
22 schedule: Schedule.spaced("1 second"),
23 until: (status) => status === "gone",
24 times: 10,
25 }),
26 );
27
28// Security Command Center is not activated on the testing project (every
29// call fails with ServiceDisabled). Set GCP_TEST_SECURITY_CENTER=1 on a
30// project with SCC activated.
31const runLifecycle = !!process.env.GCP_TEST_SECURITY_CENTER;
32
33test.provider(
34 "getProjectsNotificationConfigs on a missing config fails with a typed tag",
35 (stack) =>
36 Effect.gen(function* () {
37 const { project } = yield* GcpEnvironment.current;
38
39 yield* stack.destroy();
40
41 const error = yield* Effect.flip(
42 scc.getProjectsNotificationConfigs({
43 name: `projects/${project}/notificationConfigs/alchemy-missing`,
44 }),
45 );
46 expect(error._tag).toEqual("ServiceDisabled");
47
48 yield* stack.destroy();
49 }).pipe(logLevel),
50 {
51 tags: ["provider:gcp", "provider:gcp:securitycenter", "live"],
52 timeout: 90_000,
53 },
54);
55
56test.provider.skipIf(!runLifecycle)(
57 "create, update, and delete a notification config",
58 (stack) =>
59 Effect.gen(function* () {
60 const { project } = yield* GcpEnvironment.current;
61
62 yield* stack.destroy();
63
64 const created = yield* stack.deploy(
65 Effect.gen(function* () {
66 const topic = yield* GCP.PubSub.Topic("SccNotify", {});
67 const config = yield* GCP.SecurityCenter.NotificationConfig("High", {
68 pubsubTopic: topic.name,
69 description: "high severity",
70 streamingConfig: { filter: 'severity="HIGH"' },
71 });
72 return { topic, config };
73 }),
74 );
75
76 expect(created.config.configId).toEqual(expect.any(String));
77 expect(created.config.name).toEqual(
78 `projects/${project}/notificationConfigs/${created.config.configId}`,
79 );
80 expect(created.config.pubsubTopic).toEqual(created.topic.name);
81 expect(created.config.description).toEqual("high severity");
82 expect(created.config.streamingConfig?.filter).toEqual('severity="HIGH"');
83
84 const fetched = yield* scc.getProjectsNotificationConfigs({
85 name: created.config.name,
86 });
87 expect(fetched.name).toEqual(created.config.name);
88 expect(fetched.description).toContain("alchemy-id=");
89 expect(fetched.pubsubTopic).toEqual(created.topic.name);
90
91 const updated = yield* stack.deploy(
92 Effect.gen(function* () {
93 const topic = yield* GCP.PubSub.Topic("SccNotify", {
94 topicId: created.topic.topicId,
95 });
96 const config = yield* GCP.SecurityCenter.NotificationConfig("High", {
97 configId: created.config.configId,
98 pubsubTopic: topic.name,
99 description: "high and critical",
100 streamingConfig: {
101 filter: 'severity="HIGH" OR severity="CRITICAL"',
102 },
103 });
104 return { topic, config };
105 }),
106 );
107
108 expect(updated.config.name).toEqual(created.config.name);
109 expect(updated.config.description).toEqual("high and critical");
110 expect(updated.config.streamingConfig?.filter).toEqual(
111 'severity="HIGH" OR severity="CRITICAL"',
112 );
113
114 yield* stack.destroy();
115
116 const gone = yield* waitUntilGone(created.config.name);
117 expect(gone).toEqual("gone");
118 }).pipe(logLevel),
119 {
120 tags: ["provider:gcp", "provider:gcp:securitycenter", "live"],
121 timeout: 90_000,
122 },
123);