t3-code-android-nightly/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/VulnerabilityScanner/TargetEnvironment.test.ts

import * as Cloudflare from "@/Cloudflare";
import { adopt } from "@/AdoptPolicy";
import { CloudflareEnvironment } from "@/Cloudflare/CloudflareEnvironment";
import { findZoneByName } from "@/Cloudflare/Zone/lookup";
import * as Provider from "@/Provider";
import * as Test from "@/Test/Alchemy";
import * as vulnScanner from "@distilled.cloud/cloudflare/vulnerability-scanner";
import { expect } from "alchemy-test";
import * as Effect from "effect/Effect";
import { MinimumLogLevel } from "effect/References";
import * as Schedule from "effect/Schedule";

const { test } = Test.make({ providers: Cloudflare.providers() });

const logLevel = Effect.provideService(
  MinimumLogLevel,
  process.env.DEBUG ? "Debug" : "Info",
);

const zoneName =
  process.env.CLOUDFLARE_TEST_DNS_ZONE_NAME ?? "alchemy-test-2.us";

// Deterministic per-test names — same on every run, disjoint between tests.
const NAME_DEFAULT = "alchemy-vulnscanner-target-default";
const NAME_UPDATE = "alchemy-vulnscanner-target-update";
const NAME_LIST = "alchemy-vulnscanner-target-list";

const resolveZoneId = Effect.gen(function* () {
  const { accountId } = yield* yield* CloudflareEnvironment;
  const zone = yield* findZoneByName({ accountId, name: zoneName });
  if (!zone) {
    return yield* Effect.die(
      new Error(`zone "${zoneName}" not found in account`),
    );
  }
  return zone.id;
});

const accountIdOf = Effect.gen(function* () {
  const { accountId } = yield* yield* CloudflareEnvironment;
  return accountId;
});

// Freshly minted scoped tokens propagate eventually-consistently across
// Cloudflare's edge; ride out 403 blips on out-of-band verification calls.
const forbiddenRetrySchedule = Schedule.exponential("500 millis");

const getTargetEnvironment = (accountId: string, targetEnvironmentId: string) =>
  vulnScanner.getTargetEnvironment({ accountId, targetEnvironmentId }).pipe(
    Effect.retry({
      while: (e) => e._tag === "Forbidden",
      schedule: forbiddenRetrySchedule,
      times: 8,
    }),
  );

// Typed "is it gone?" probe — `TargetEnvironmentNotFound` (code 11001) maps
// to undefined; anything else propagates.
const findTargetEnvironment = (
  accountId: string,
  targetEnvironmentId: string,
) =>
  getTargetEnvironment(accountId, targetEnvironmentId).pipe(
    Effect.catchTag("TargetEnvironmentNotFound", () =>
      Effect.succeed(undefined),
    ),
  );

test.provider(
  "create, verify, and destroy a target environment",
  (stack) =>
    Effect.gen(function* () {
      const zoneId = yield* resolveZoneId;
      const accountId = yield* accountIdOf;

      yield* stack.destroy();

      const env = yield* stack.deploy(
        Effect.gen(function* () {
          return yield* Cloudflare.VulnerabilityScanner.VulnScannerTargetEnvironment(
            "DefaultEnv",
            {
              name: NAME_DEFAULT,
              zoneId,
              description: "alchemy test target environment",
            },
          ).pipe(adopt(true));
        }),
      );

      expect(env.targetEnvironmentId).toBeDefined();
      expect(env.accountId).toEqual(accountId);
      expect(env.name).toEqual(NAME_DEFAULT);
      expect(env.zoneId).toEqual(zoneId);
      expect(env.description).toEqual("alchemy test target environment");

      // Out-of-band verification against the live API.
      const live = yield* getTargetEnvironment(
        accountId,
        env.targetEnvironmentId,
      );
      expect(live.id).toEqual(env.targetEnvironmentId);
      expect(live.name).toEqual(NAME_DEFAULT);
      expect(live.target.zoneTag).toEqual(zoneId);
      expect(live.description).toEqual("alchemy test target environment");

      yield* stack.destroy();

      const gone = yield* findTargetEnvironment(
        accountId,
        env.targetEnvironmentId,
      );
      expect(gone).toBeUndefined();
    }).pipe(logLevel),
  {
    tags: [
      "provider:cloudflare",
      "provider:cloudflare:vulnerabilityscanner",
      "provider:cloudflare:zone",
      "live",
    ],
  },
);

test.provider(
  "updating name and description patches in place; clearing description",
  (stack) =>
    Effect.gen(function* () {
      const zoneId = yield* resolveZoneId;
      const accountId = yield* accountIdOf;

      yield* stack.destroy();

      const initial = yield* stack.deploy(
        Effect.gen(function* () {
          return yield* Cloudflare.VulnerabilityScanner.VulnScannerTargetEnvironment(
            "UpdateEnv",
            {
              name: NAME_UPDATE,
              zoneId,
              description: "v1",
            },
          ).pipe(adopt(true));
        }),
      );

      expect(initial.description).toEqual("v1");

      const updated = yield* stack.deploy(
        Effect.gen(function* () {
          return yield* Cloudflare.VulnerabilityScanner.VulnScannerTargetEnvironment(
            "UpdateEnv",
            {
              name: `${NAME_UPDATE}-renamed`,
              zoneId,
              description: "v2",
            },
          ).pipe(adopt(true));
        }),
      );

      // Same environment updated in place — not a replacement.
      expect(updated.targetEnvironmentId).toEqual(initial.targetEnvironmentId);
      expect(updated.name).toEqual(`${NAME_UPDATE}-renamed`);
      expect(updated.description).toEqual("v2");

      const live = yield* getTargetEnvironment(
        accountId,
        updated.targetEnvironmentId,
      );
      expect(live.name).toEqual(`${NAME_UPDATE}-renamed`);
      expect(live.description).toEqual("v2");

      // Omitting the description clears it (PUT with explicit null).
      const cleared = yield* stack.deploy(
        Effect.gen(function* () {
          return yield* Cloudflare.VulnerabilityScanner.VulnScannerTargetEnvironment(
            "UpdateEnv",
            {
              name: `${NAME_UPDATE}-renamed`,
              zoneId,
            },
          ).pipe(adopt(true));
        }),
      );

      expect(cleared.targetEnvironmentId).toEqual(initial.targetEnvironmentId);
      expect(cleared.description).toBeUndefined();

      const liveCleared = yield* getTargetEnvironment(
        accountId,
        cleared.targetEnvironmentId,
      );
      expect(liveCleared.description ?? undefined).toBeUndefined();

      yield* stack.destroy();

      const gone = yield* findTargetEnvironment(
        accountId,
        initial.targetEnvironmentId,
      );
      expect(gone).toBeUndefined();
    }).pipe(logLevel),
  {
    tags: [
      "provider:cloudflare",
      "provider:cloudflare:vulnerabilityscanner",
      "provider:cloudflare:zone",
      "live",
    ],
  },
);

// Canonical `list()` test (account collection): deploy a target environment,
// then enumerate the account-scoped collection and assert the deployed item
// appears in the exhaustively-paginated result.
test.provider(
  "list enumerates the deployed target environment",
  (stack) =>
    Effect.gen(function* () {
      const zoneId = yield* resolveZoneId;

      yield* stack.destroy();

      const env = yield* stack.deploy(
        Effect.gen(function* () {
          return yield* Cloudflare.VulnerabilityScanner.VulnScannerTargetEnvironment(
            "ListEnv",
            {
              name: NAME_LIST,
              zoneId,
            },
          ).pipe(adopt(true));
        }),
      );

      const provider = yield* Provider.findProvider(
        Cloudflare.VulnerabilityScanner.VulnScannerTargetEnvironment,
      );
      const all = yield* provider.list();

      expect(
        all.some((e) => e.targetEnvironmentId === env.targetEnvironmentId),
      ).toBe(true);
      const found = all.find(
        (e) => e.targetEnvironmentId === env.targetEnvironmentId,
      );
      expect(found?.name).toEqual(NAME_LIST);
      expect(found?.zoneId).toEqual(zoneId);

      yield* stack.destroy();
    }).pipe(logLevel),
  {
    tags: [
      "provider:cloudflare",
      "provider:cloudflare:vulnerabilityscanner",
      "provider:cloudflare:zone",
      "live",
    ],
  },
);