1import * as GCP from "@/GCP";
2import * as Test from "@/Test/Alchemy";
3import * as websecurityscanner from "@distilled.cloud/gcp/websecurityscanner_v1";
4import { expect } from "alchemy-test";
5import * as Effect from "effect/Effect";
6import { MinimumLogLevel } from "effect/References";
7import * as Schedule from "effect/Schedule";
8import { GcpEnvironment } from "@/GCP/Environment";
9
10const { test } = Test.make({ providers: GCP.providers() });
11
12const logLevel = Effect.provideService(
13 MinimumLogLevel,
14 process.env.DEBUG ? "Debug" : "Info",
15);
16const missingNameOf = (project: string) => `projects/${project}/scanConfigs/1`;
17
18const waitUntilGone = (name: string) =>
19 websecurityscanner.getProjectsScanConfigs({ name }).pipe(
20 Effect.as("found" as const),
21 Effect.catchTag("NotFound", () => Effect.succeed("gone" as const)),
22 Effect.repeat({
23 schedule: Schedule.spaced("1 second"),
24 until: (status) => status === "gone",
25 times: 10,
26 }),
27 );
28
29test.provider(
30 "getProjectsScanConfigs on a missing config fails with a typed tag",
31 (stack) =>
32 Effect.gen(function* () {
33 const { project } = yield* GcpEnvironment.current;
34
35 yield* stack.destroy();
36
37 const error = yield* Effect.flip(
38 websecurityscanner.getProjectsScanConfigs({
39 name: missingNameOf(project),
40 }),
41 );
42 expect(error._tag).toEqual("NotFound");
43
44 const page = yield* websecurityscanner.listProjectsScanConfigs({
45 parent: `projects/${project}`,
46 pageSize: 10,
47 });
48 expect(
49 (page.scanConfigs ?? []).map((config) => config.name),
50 ).not.toContain(missingNameOf(project));
51
52 yield* stack.destroy();
53 }).pipe(logLevel),
54 {
55 tags: ["provider:gcp", "provider:gcp:websecurityscanner", "live"],
56 timeout: 90_000,
57 },
58);
59
60test.provider(
61 "createProjectsScanConfigs with an unreserved IP fails with StartingUrlIpNotReserved",
62 (stack) =>
63 Effect.gen(function* () {
64 const { project } = yield* GcpEnvironment.current;
65 yield* stack.destroy();
66
67 // 203.0.113.0/24 is TEST-NET-3; it can never be reserved in the project.
68 const error = yield* Effect.flip(
69 websecurityscanner.createProjectsScanConfigs({
70 parent: `projects/${project}`,
71 body: {
72 displayName: "unreserved",
73 startingUrls: ["http://203.0.113.9/"],
74 targetPlatforms: ["COMPUTE"],
75 exportToSecurityCommandCenter: "DISABLED",
76 },
77 }),
78 );
79 expect(error._tag).toEqual("StartingUrlIpNotReserved");
80
81 yield* stack.destroy();
82 }).pipe(logLevel),
83 {
84 tags: ["provider:gcp", "provider:gcp:websecurityscanner", "live"],
85 timeout: 90_000,
86 },
87);
88
89test.provider(
90 "create, update, and delete a scan config",
91 (stack) =>
92 Effect.gen(function* () {
93 yield* stack.destroy();
94
95 const reserved = yield* stack.deploy(
96 Effect.gen(function* () {
97 return yield* GCP.Compute.Address("ScannerIp", {
98 region: "us-central1",
99 });
100 }),
101 );
102 expect(reserved.address).toEqual(expect.any(String));
103 const startingUrl = `http://${reserved.address}`;
104
105 const created = yield* stack.deploy(
106 Effect.gen(function* () {
107 const ip = yield* GCP.Compute.Address("ScannerIp", {
108 addressName: reserved.addressName,
109 region: "us-central1",
110 });
111 const scan = yield* GCP.WebSecurityScanner.ScanConfig("Scan", {
112 displayName: "alchemy scan",
113 startingUrls: [startingUrl],
114 targetPlatforms: ["COMPUTE"],
115 maxQps: 5,
116 userAgent: "CHROME_LINUX",
117 exportToSecurityCommandCenter: "DISABLED",
118 riskLevel: "LOW",
119 });
120 return { ip, scan };
121 }),
122 );
123
124 expect(created.scan.name).toContain("/scanConfigs/");
125 expect(created.scan.scanConfigId).toEqual(expect.any(String));
126 expect(created.scan.displayName).toEqual("alchemy scan");
127 expect(created.scan.startingUrls).toEqual([
128 `http://${created.ip.address}`,
129 ]);
130 expect(created.scan.maxQps).toEqual(5);
131 expect(created.scan.userAgent).toEqual("CHROME_LINUX");
132 expect(created.scan.targetPlatforms).toEqual(["COMPUTE"]);
133 expect(created.scan.exportToSecurityCommandCenter).toEqual("DISABLED");
134 expect(created.scan.riskLevel).toEqual("LOW");
135
136 const fetched = yield* websecurityscanner.getProjectsScanConfigs({
137 name: created.scan.name,
138 });
139 expect(fetched.name).toEqual(created.scan.name);
140 expect(fetched.displayName).toEqual("alchemy scan");
141 expect(fetched.startingUrls).toEqual([`http://${created.ip.address}`]);
142 expect(fetched.maxQps).toEqual(5);
143 expect(fetched.targetPlatforms).toEqual(["COMPUTE"]);
144
145 const updated = yield* stack.deploy(
146 Effect.gen(function* () {
147 const ip = yield* GCP.Compute.Address("ScannerIp", {
148 addressName: created.ip.addressName,
149 region: "us-central1",
150 });
151 const scan = yield* GCP.WebSecurityScanner.ScanConfig("Scan", {
152 scanConfigId: created.scan.scanConfigId,
153 displayName: "alchemy scan v2",
154 startingUrls: [startingUrl],
155 targetPlatforms: ["COMPUTE"],
156 maxQps: 10,
157 userAgent: "CHROME_ANDROID",
158 blacklistPatterns: [`${startingUrl}/logout`],
159 ignoreHttpStatusErrors: true,
160 exportToSecurityCommandCenter: "DISABLED",
161 riskLevel: "LOW",
162 });
163 return { ip, scan };
164 }),
165 );
166
167 expect(updated.scan.name).toEqual(created.scan.name);
168 expect(updated.scan.scanConfigId).toEqual(created.scan.scanConfigId);
169 expect(updated.scan.displayName).toEqual("alchemy scan v2");
170 expect(updated.scan.maxQps).toEqual(10);
171 expect(updated.scan.userAgent).toEqual("CHROME_ANDROID");
172 expect(updated.scan.blacklistPatterns).toEqual([
173 `http://${updated.ip.address}/logout`,
174 ]);
175 expect(updated.scan.ignoreHttpStatusErrors).toEqual(true);
176
177 const fetchedUpdate = yield* websecurityscanner.getProjectsScanConfigs({
178 name: created.scan.name,
179 });
180 expect(fetchedUpdate.displayName).toEqual("alchemy scan v2");
181 expect(fetchedUpdate.maxQps).toEqual(10);
182 expect(fetchedUpdate.userAgent).toEqual("CHROME_ANDROID");
183 expect(fetchedUpdate.ignoreHttpStatusErrors).toEqual(true);
184
185 yield* stack.destroy();
186
187 const gone = yield* waitUntilGone(created.scan.name);
188 expect(gone).toEqual("gone");
189 }).pipe(logLevel),
190 {
191 tags: ["provider:gcp", "provider:gcp:websecurityscanner", "live"],
192 timeout: 90_000,
193 },
194);