1import { adopt, stripUnowned, Unowned } from "@/AdoptPolicy.ts";
2import {
3 OrganizationSpendingLimit,
4 organizationSpendingLimitSnapshot,
5 validateOrganizationSpendingLimit,
6} from "@/Neon/OrganizationSpendingLimit.ts";
7import { providers } from "@/Neon/Providers.ts";
8import * as Output from "@/Output.ts";
9import * as Test from "@/Test/Alchemy";
10import * as SDK from "@distilled.cloud/neon";
11import { expect } from "alchemy-test";
12import * as Effect from "effect/Effect";
13import * as Result from "effect/Result";
14
15const { test } = Test.make({ providers: providers() });
16
17const context = {
18 id: "Alert",
19 fqn: "Alert",
20 instanceId: "alert-validation",
21 oldBindings: [],
22 newBindings: [],
23};
24
25test(
26 "spending alerts require positive integer cents and an organization identity",
27 Effect.gen(function* () {
28 for (const spendingLimitCents of [
29 0,
30 -1,
31 1.5,
32 Infinity,
33 NaN,
34 Number.MAX_SAFE_INTEGER + 1,
35 ]) {
36 expect(
37 Result.isFailure(
38 yield* validateOrganizationSpendingLimit({
39 orgId: "org-dedicated-fixture",
40 spendingLimitCents,
41 }).pipe(Effect.result),
42 ),
43 ).toBe(true);
44 }
45 expect(
46 Result.isFailure(
47 yield* validateOrganizationSpendingLimit({
48 orgId: "",
49 spendingLimitCents: 100,
50 }).pipe(Effect.result),
51 ),
52 ).toBe(true);
53 yield* validateOrganizationSpendingLimit({
54 orgId: "org-dedicated-fixture",
55 spendingLimitCents: 100,
56 });
57 }),
58 {
59 tags: ["provider:neon", "provider:neon:organizationspendinglimit", "live"],
60 },
61);
62
63test.provider(
64 "spending organization changes fail before replacing the existing policy",
65 () =>
66 Effect.gen(function* () {
67 const provider = yield* OrganizationSpendingLimit.Provider;
68 const olds = { orgId: "org-old", spendingLimitCents: 100 };
69 expect(
70 yield* provider.diff!({
71 ...context,
72 olds,
73 news: { orgId: "org-new", spendingLimitCents: 100 },
74 output: undefined,
75 }).pipe(
76 Effect.as(false),
77 Effect.catchTag("InvalidOrganizationSpendingLimit", () =>
78 Effect.succeed(true),
79 ),
80 ),
81 ).toBe(true);
82 for (const news of [
83 Output.literal(olds),
84 Effect.succeed(olds),
85 { ...olds, orgId: Output.literal("org-new") },
86 ]) {
87 expect(
88 yield* provider.diff!({
89 ...context,
90 olds,
91 news,
92 output: undefined,
93 }),
94 ).toBeUndefined();
95 }
96 expect(
97 yield* provider.diff!({
98 ...context,
99 olds,
100 news: { ...olds, spendingLimitCents: Output.literal(200) },
101 output: undefined,
102 }),
103 ).toBeUndefined();
104 }).pipe(
105 Effect.provideService(
106 SDK.Credentials,
107 Effect.die("Unexpected Neon request in a no-I/O guard test"),
108 ),
109 ),
110 {
111 tags: ["provider:neon", "provider:neon:organizationspendinglimit", "live"],
112 },
113);
114
115test.provider(
116 "spending reconciliation rejects a cached identity from another organization before I/O",
117 () =>
118 Effect.gen(function* () {
119 const provider = yield* OrganizationSpendingLimit.Provider;
120 expect(
121 yield* provider
122 .reconcile({
123 ...context,
124 bindings: [],
125 session: {
126 emit: () => Effect.void,
127 done: () => Effect.void,
128 note: () => Effect.void,
129 },
130 olds: undefined,
131 news: { orgId: "org-new", spendingLimitCents: 100 },
132 output: {
133 orgId: "org-old",
134 spendingLimitCents: 200,
135 initialSpendingLimitCents: 200,
136 managedSpendingLimitCents: 200,
137 },
138 })
139 .pipe(
140 Effect.as(false),
141 Effect.catchTag("InvalidOrganizationSpendingLimit", () =>
142 Effect.succeed(true),
143 ),
144 ),
145 ).toBe(true);
146 }).pipe(
147 Effect.provideService(
148 SDK.Credentials,
149 Effect.die("Unexpected Neon request in a no-I/O guard test"),
150 ),
151 ),
152 {
153 tags: ["provider:neon", "provider:neon:organizationspendinglimit", "live"],
154 },
155);
156
157test(
158 "spending snapshots capture null without adoption and retain the baseline across interrupted writes",
159 Effect.sync(() => {
160 for (const baseline of [null, 400]) {
161 const snapshot = organizationSpendingLimitSnapshot(
162 "org-fixture",
163 baseline,
164 );
165 expect(Unowned.is(snapshot)).toBe(baseline !== null);
166 expect(snapshot.initialSpendingLimitCents).toBe(baseline);
167 expect(snapshot.managedSpendingLimitCents).toBe(baseline);
168 const refreshed = organizationSpendingLimitSnapshot(
169 "org-fixture",
170 100,
171 stripUnowned(snapshot),
172 );
173 expect(Unowned.is(refreshed)).toBe(false);
174 expect(refreshed.spendingLimitCents).toBe(100);
175 expect(refreshed.initialSpendingLimitCents).toBe(baseline);
176 expect(refreshed.managedSpendingLimitCents).toBe(baseline);
177 const disappeared = organizationSpendingLimitSnapshot(
178 "org-fixture",
179 null,
180 refreshed,
181 );
182 expect(disappeared.initialSpendingLimitCents).toBe(baseline);
183 }
184 }),
185 {
186 tags: ["provider:neon", "provider:neon:organizationspendinglimit", "live"],
187 },
188);
189
190test.provider(
191 "spending reconciliation refuses missing baseline snapshots before I/O even with adoption enabled",
192 () =>
193 Effect.gen(function* () {
194 const provider = yield* OrganizationSpendingLimit.Provider;
195 const incomplete = organizationSpendingLimitSnapshot("org-fixture", null);
196 yield* Effect.sync(() =>
197 Reflect.deleteProperty(incomplete, "initialSpendingLimitCents"),
198 );
199 for (const output of [undefined, incomplete]) {
200 expect(
201 yield* provider
202 .reconcile({
203 ...context,
204 bindings: [],
205 session: {
206 emit: () => Effect.void,
207 done: () => Effect.void,
208 note: () => Effect.void,
209 },
210 olds: undefined,
211 news: { orgId: "org-fixture", spendingLimitCents: 100 },
212 output,
213 })
214 .pipe(
215 adopt(true),
216 Effect.as(false),
217 Effect.catchTag("InvalidOrganizationSpendingLimit", () =>
218 Effect.succeed(true),
219 ),
220 ),
221 ).toBe(true);
222 }
223 }).pipe(
224 Effect.provideService(
225 SDK.Credentials,
226 Effect.die("Unexpected Neon request in a no-I/O guard test"),
227 ),
228 ),
229 {
230 tags: ["provider:neon", "provider:neon:organizationspendinglimit", "live"],
231 },
232);
233
234const orgId = process.env.NEON_GOVERNANCE_TEST_ORG_ID;
235const threshold = Number(process.env.NEON_GOVERNANCE_TEST_SPENDING_LIMIT_CENTS);
236const enabled =
237 !!orgId &&
238 process.env.NEON_GOVERNANCE_TEST_SPENDING === "1" &&
239 Number.isSafeInteger(threshold) &&
240 threshold > 0 &&
241 threshold < Number.MAX_SAFE_INTEGER - 100;
242
243test.provider.skipIf(!enabled)(
244 "dedicated spending fixture preserves adopted baseline and removes only managed new alerts",
245 (stack) =>
246 Effect.gen(function* () {
247 yield* stack.destroy();
248 const organization = orgId!;
249 const request = { org_id: organization };
250 const original = (yield* SDK.getOrganizationSpendingLimit(request))
251 .spending_limit_cents;
252 const application = (value: number, takeOwnership = false) =>
253 OrganizationSpendingLimit("Alert", {
254 orgId: organization,
255 spendingLimitCents: value,
256 }).pipe(adopt(takeOwnership));
257
258 if (original === null) {
259 const planned = yield* stack.plan(application(threshold));
260 expect(planned.resources.Alert.state?.attr).toMatchObject({
261 orgId: organization,
262 spendingLimitCents: null,
263 initialSpendingLimitCents: null,
264 managedSpendingLimitCents: null,
265 });
266 expect(
267 (yield* SDK.getOrganizationSpendingLimit(request))
268 .spending_limit_cents,
269 ).toBeNull();
270 const created = yield* stack.deploy(application(threshold));
271 expect(created.initialSpendingLimitCents).toBeNull();
272 expect(
273 (yield* SDK.getOrganizationSpendingLimit(request))
274 .spending_limit_cents,
275 ).toBe(threshold);
276 yield* stack.deploy(application(threshold + 1));
277 yield* SDK.setOrganizationSpendingLimit({
278 ...request,
279 spending_limit_cents: threshold + 2,
280 });
281 expect(
282 Result.isFailure(yield* stack.destroy().pipe(Effect.result)),
283 ).toBe(true);
284 expect(
285 (yield* SDK.getOrganizationSpendingLimit(request))
286 .spending_limit_cents,
287 ).toBe(threshold + 2);
288 yield* SDK.setOrganizationSpendingLimit({
289 ...request,
290 spending_limit_cents: threshold + 1,
291 });
292 yield* stack.destroy();
293 expect(
294 (yield* SDK.getOrganizationSpendingLimit(request))
295 .spending_limit_cents,
296 ).toBeNull();
297 }
298
299 const baseline = original ?? threshold + 100;
300 if (original === null)
301 yield* SDK.setOrganizationSpendingLimit({
302 ...request,
303 spending_limit_cents: baseline,
304 });
305 expect(
306 Result.isFailure(
307 yield* stack.plan(application(threshold)).pipe(Effect.result),
308 ),
309 ).toBe(true);
310 expect(
311 (yield* SDK.getOrganizationSpendingLimit(request)).spending_limit_cents,
312 ).toBe(baseline);
313 const adopted = yield* stack.deploy(application(threshold, true));
314 expect(adopted.initialSpendingLimitCents).toBe(baseline);
315 expect(
316 (yield* SDK.getOrganizationSpendingLimit(request)).spending_limit_cents,
317 ).toBe(threshold);
318 const updated = yield* stack.deploy(application(threshold + 1));
319 expect(updated.initialSpendingLimitCents).toBe(baseline);
320 yield* stack.destroy();
321 expect(
322 (yield* SDK.getOrganizationSpendingLimit(request)).spending_limit_cents,
323 ).toBe(baseline);
324 if (original === null)
325 yield* SDK.deleteOrganizationSpendingLimit(request);
326 expect(
327 (yield* SDK.getOrganizationSpendingLimit(request)).spending_limit_cents,
328 ).toBe(original);
329 yield* stack.destroy();
330 }),
331 {
332 tags: ["provider:neon", "provider:neon:organizationspendinglimit", "live"],
333 timeout: 120_000,
334 exclusive: true,
335 },
336);