Open History to see the last commit
1import * as ACME from "@alchemy.run/acme";
2import * as Cloudflare from "@alchemy.run/cloudflare";
3import { expect } from "@alchemy.run/test";
4import * as Test from "@alchemy.run/test/Alchemy";
5import * as Effect from "effect/Effect";
6import * as HttpClient from "effect/http/HttpClient";
7import * as Layer from "effect/Layer";
8import * as Schedule from "effect/Schedule";
9import Stack from "./fixtures/issue-zerossl-stack.ts";
10import { ZONE_NAME } from "./fixtures/shared.ts";
11
12/**
13 * Runtime issuance from inside a deployed Worker: the account bound by
14 * `ACME.IssueCertificate`, DNS-01 through `Cloudflare.DNS.WriteDns`.
15 *
16 * The CA is ZeroSSL (production). Let's Encrypt staging returned TLS errors
17 * from Workers during bring-up, so this runs only with
18 * `ACME_TEST_ZEROSSL=1` and `ZERO_SSL_KEY`; `IssueCertificate.local.test.ts`
19 * covers the same Worker against staging from local workerd.
20 */
21const { test, beforeAll, afterAll, deploy, destroy } = Test.make({
22 providers: Layer.mergeAll(Cloudflare.providers(), ACME.providers()),
23});
24
25const enabled =
26 process.env.ACME_TEST_ZEROSSL === "1" &&
27 (process.env.ZERO_SSL_KEY !== undefined || process.env.ZEROSSL_ACCESS_KEY !== undefined);
28
29// No `beforeAll.skipIf`: deploy only when enabled, else hand the (skipped)
30// test an empty handle.
31const stack = beforeAll(enabled ? deploy(Stack) : Effect.succeed({ url: "" } as { url: string }));
32afterAll.skipIf(!enabled || !!process.env.NO_DESTROY)(destroy(Stack));
33
34const NAME = `alchemy-acme-worker.${ZONE_NAME}`;
35
36test.skipIf(!enabled)(
37 "a Worker issues a certificate at runtime through the bound account",
38 Effect.gen(function* () {
39 const { url } = yield* stack;
40 const client = yield* HttpClient.HttpClient;
41
42 // The first requests ride out workers.dev propagation.
43 // A fresh workers.dev hostname answers 404 for a few seconds.
44 const ok = yield* client.get(`${url}/`).pipe(
45 Effect.filterOrFail(
46 (r) => r.status === 200,
47 (r) => new Error(`not ready: ${r.status}`),
48 ),
49 Effect.retry({ schedule: Schedule.spaced("2 seconds"), times: 8 }),
50 );
51 expect(ok.status).toBe(200);
52
53 const response = yield* client.get(`${url}/issue?name=${NAME}`);
54 const text = yield* response.text;
55 expect(text, `status ${response.status}: ${text.slice(0, 2000)}`).toMatch(/^\{/);
56 const body = JSON.parse(text) as {
57 issuer?: string;
58 notAfter?: string;
59 dnsNames?: string[];
60 hasKey?: boolean;
61 chainLength?: number;
62 error?: string;
63 };
64 expect(body.error).toBeUndefined();
65 expect(response.status).toBe(200);
66 expect(body.issuer).toContain("ZeroSSL");
67 expect(body.dnsNames).toEqual([NAME]);
68 expect(body.hasKey).toBe(true);
69 expect(body.chainLength).toBeGreaterThan(1);
70 const now = yield* Effect.sync(() => Date.now());
71 expect(Date.parse(body.notAfter!)).toBeGreaterThan(now);
72 }),
73 {
74 tags: [
75 "provider:acme",
76 "provider:acme:account",
77 "provider:cloudflare",
78 "provider:cloudflare:dns",
79 "provider:cloudflare:worker",
80 "provider:cloudflare:zone",
81 "provider:zerossl",
82 "live",
83 ],
84 timeout: 240_000,
85 },
86);