@homeflare/alchemy 0.55.0 → 0.57.0

package/src/unifi/wire-guard.test.ts

@@ -129,7 +129,14 @@ interface ProbeProps {
 const probeSpec = (
   method: string,
   withUpdate = false,
-): UnifiSpec<ProbeProps, ProbeProps, ProbeProps, HttpClientError.HttpClientError> => ({
+): UnifiSpec<
+  ProbeProps,
+  ProbeProps,
+  ProbeProps,
+  HttpClientError.HttpClientError,
+  never,
+  never
+> => ({
   type: 'Test.Probe',
   describe: (props) => `probe/${props.id}`,
   fetchLive: (props) =>
@@ -153,6 +160,41 @@ const probeSpec = (
     : {}),
 });
 
+/**
+ * A create-only probe: `fetchLive` always answers absent (so `resource.ts`'s create branch always
+ * attempts the create), and `create.write` sends one raw request of the given method -- the POST
+ * the wire guard is meant to let through only under the exact conditions `resource.ts`'s own
+ * header names (no prior state, live absent).
+ */
+const createProbeSpec = (
+  writeMethod: string,
+): UnifiSpec<
+  ProbeProps,
+  ProbeProps,
+  ProbeProps,
+  HttpClientError.HttpClientError,
+  never,
+  HttpClientError.HttpClientError
+> => ({
+  type: 'Test.CreateProbe',
+  describe: (props) => `probe/${props.id}`,
+  fetchLive: () => Effect.succeed(undefined),
+  attributes: (live) => live,
+  matches: () => false,
+  create: {
+    allowedWrite: () => ({ method: 'POST' as const, tail: '/probe' }),
+    checkScope: () => Effect.void,
+    write: (props: ProbeProps) =>
+      Effect.gen(function* () {
+        const client = yield* HttpClient.HttpClient;
+        yield* client.execute(HttpClientRequest.make(writeMethod as never)(`${FAKE_BASE}/probe`));
+        return props;
+      }),
+    identify: (props: ProbeProps) => props,
+    driftOf: () => [],
+  },
+});
+
 const configProvider = ConfigProvider.layer(
   ConfigProvider.fromUnknown({
     UNIFI_NETWORK_API_BASE_URL: FAKE_BASE,
@@ -216,3 +258,46 @@ describe('guards are installed in unifiHandlers (IMPORTANT-1, red team 2026-09-2
     expect(fake.seen).toEqual([]);
   });
 });
+
+/**
+ * The hf: create lift's own wire-level proof (`resource.ts`'s `spec.create`-aware allow list,
+ * 2026-10-19): a POST reaches the transport ONLY when there is no prior state at all, and never
+ * otherwise -- even when the family declares `create` and the attempt is "first deploy shaped".
+ */
+describe('guards are installed in unifiHandlers for spec.create (hf: create lift)', () => {
+  test('reconcile lets the one allowed POST through when there is no prior state', async () => {
+    const fake = fakeUnifi(() => Response.json({ id: 'w1' }));
+    const exit = await runHandler(
+      unifiHandlers(createProbeSpec('POST')).reconcile(args),
+      fake.fetch,
+    );
+    // The read-back then fails (this probe's fetchLive always answers absent) -- irrelevant to
+    // this test, which only proves the POST itself reached the transport.
+    expect(Exit.isFailure(exit)).toBe(true);
+    expect(fake.seen.map((s) => s.method)).toEqual(['POST']);
+  });
+
+  test('reconcile refuses a PUT even when the family declares create, not update', async () => {
+    const fake = neverReached('PUT');
+    expectRefused(
+      await runHandler(unifiHandlers(createProbeSpec('PUT')).reconcile(args), fake.fetch),
+      'PUT',
+    );
+    expect(fake.seen).toEqual([]);
+  });
+
+  test('a POST is refused when prior state is present (olds/output set) -- not a fresh create', async () => {
+    // ⚠️ A TYPED refusal here, not a wire-guard die: with `olds`/`output` set, `ops.reconcile`
+    //   never even builds the create allow entry (`resource.ts`'s own condition) and falls to
+    //   `updateReconcile`, which refuses "create" typed (`UnifiWriteRefused`) because this probe
+    //   declares no `update` -- the request never reaches the transport either way.
+    const fake = neverReached('POST');
+    const withState = { ...args, olds: { id: 'w1' }, output: { id: 'w1' } };
+    const exit = await runHandler(
+      unifiHandlers(createProbeSpec('POST')).reconcile(withState),
+      fake.fetch,
+    );
+    expect(Exit.isFailure(exit)).toBe(true);
+    expect(fake.seen).toEqual([]);
+  });
+});

package/src/unifi/wire-guard.ts

@@ -14,6 +14,13 @@
  *   cloud-connector base paths differ, so the base is passed in and compared exactly, `isAllowed`).
  *   A PUT to another network id, the list route, or another family dies here.
  *
+ * ⛔ POST, ADDED 2026-10-19 FOR THE hf: CREATE LIFT (`policy.ts`'s `isHfPolicyName`). The allow
+ *   entry `unifiHandlers` builds for a create attempt (`spec.create.allowedWrite()`) names the
+ *   site's fixed `/v1/sites/<siteId>/firewall/policies` COLLECTION route, never a per-row path —
+ *   there is no row id before the POST creates one. This list is still the ONLY gate on method and
+ *   path; the hf: NAME check is `create-reconcile.ts`'s `checkScope`, run before the POST is even
+ *   attempted, not something this guard can see (it has no view of the request body).
+ *
  * ⚠️ `Effect.die`, NOT A TYPED FAILURE — every generated SDK operation declares its OWN closed
  *   error union from the pinned OpenAPI spec and generated files are never hand-edited, so a typed
  *   `Effect.fail` here would be a failure absent from every op's declared type. A defect is the
@@ -42,7 +49,7 @@ import { UNIFI_WRITE_POLICY } from './policy.ts';
  * base URL (`/v1/sites/<site>/networks/<id>`): the guard compares the request's origin and path to
  * `baseUrl + tail` and requires an empty query and fragment (`isAllowed`).
  */
-export type AllowedWrite = { readonly method: 'PUT'; readonly tail: string };
+export type AllowedWrite = { readonly method: 'PUT' | 'POST'; readonly tail: string };
 
 export class UnifiRefusedRequest extends Error {
   constructor(

package/src/unifi/write-op-reference.test.ts

@@ -56,14 +56,16 @@ const sdkWriteOpNames = (): ReadonlySet<string> => {
 const REAL_WRITE_OP_NAMES = sdkWriteOpNames();
 
 /**
- * ⛔ THE ONE FILE ALLOWED TO NAME ONE WRITE OP (Tim 2026-10-10: `Unifi.Network` update). Keyed by
- * path relative to `src/unifi`. Widening this object is a policy change — `policy.ts` — and a
- * test below pins it to exactly this entry so it cannot grow unnoticed. Everything else the SDK
- * exports (`createNetwork`, `deleteNetwork`, `patchFirewallPolicy`, …) stays an offense even
- * inside the allowlisted file.
+ * ⛔ THE TWO FILES ALLOWED TO NAME ONE WRITE OP EACH (Tim 2026-10-10: `Unifi.Network` update; Tim
+ * 2026-10-19 ~16:20Z: `Unifi.FirewallPolicy` create, hf:-named rows only). Keyed by path relative
+ * to `src/unifi`. Widening this object is a policy change — `policy.ts` — and a test below pins
+ * it to exactly these two entries so it cannot grow unnoticed. Everything else the SDK exports
+ * (`createNetwork`, `deleteNetwork`, `patchFirewallPolicy`, …) stays an offense even inside an
+ * allowlisted file.
  */
 const WRITE_OP_ALLOWLIST: Record<string, ReadonlyArray<string>> = {
   'network-update.ts': ['updateNetwork'],
+  'firewall-policy-create.ts': ['createFirewallPolicy'],
 };
 
 /** Recursive by construction (IMPORTANT-2): a future `src/unifi/<subdir>/*.ts` is walked too. */
@@ -187,8 +189,11 @@ describe('src/unifi never references an SDK write operation (T12)', () => {
     }
   });
 
-  test('the allowlist is exactly network-update.ts -> updateNetwork, nothing else', () => {
-    expect(WRITE_OP_ALLOWLIST).toEqual({ 'network-update.ts': ['updateNetwork'] });
+  test('the allowlist is exactly these two files, nothing else', () => {
+    expect(WRITE_OP_ALLOWLIST).toEqual({
+      'network-update.ts': ['updateNetwork'],
+      'firewall-policy-create.ts': ['createFirewallPolicy'],
+    });
   });
 
   test('network-update.ts may name updateNetwork but still not create/delete/patch ops', () => {
@@ -200,6 +205,15 @@ describe('src/unifi never references an SDK write operation (T12)', () => {
     }
   });
 
+  test('firewall-policy-create.ts may name createFirewallPolicy but still not update/delete ops', () => {
+    const path = join(DIR, 'firewall-policy-create.ts');
+    const src = (op: string) => `import * as f from '${SDK_MARKER}/firewall';\nf.${op}({});\n`;
+    expect(offensesIn(path, src('createFirewallPolicy'))).toEqual([]);
+    for (const op of ['updateFirewallPolicy', 'deleteFirewallPolicy', 'patchFirewallPolicy']) {
+      expect(offensesIn(path, src(op))).toEqual([`${path}: references SDK write op '${op}'`]);
+    }
+  });
+
   test('any other file naming updateNetwork is an offense', () => {
     const path = join(DIR, 'network.ts');
     const src = `import * as n from '${SDK_MARKER}/networks';\nn.updateNetwork({});\n`;