@intentius/chant-lexicon-gcp 0.124.34 → 0.124.35

package/src/op/activities/gcp-compute.ts

@@ -0,0 +1,319 @@
+/**
+ * Compute Engine mappers for the Cloud Run load balancer (#4233): ComputeAddress,
+ * ComputeRegionNetworkEndpointGroup (serverless NEGs), ComputeBackendService,
+ * ComputeURLMap, ComputeTargetHTTPProxy and ComputeForwardingRule.
+ *
+ * Each maps a CNRM spec onto the compute v1 insert body. A resource is global
+ * or regional by its CNRM `location` (`"global"` or a region; a NEG has
+ * `region`), and that picks `projects/<p>/global/<collection>` or
+ * `projects/<p>/regions/<r>/<collection>`. `*Ref` fields become the referenced
+ * resource's partial URL, which compute accepts; a ref to a resource in the
+ * same manifest takes its scope from that resource's own spec, so a global
+ * backend service can point at a regional NEG.
+ *
+ * Inserts return a compute `Operation`, polled at its `selfLink` (rebased onto
+ * the endpoint override, so floci-gcp answers). These kinds reconcile by
+ * existence only: an existing resource is left as it is, since compute updates
+ * need the live `fingerprint` and most of these fields are immutable.
+ */
+import { GCP_RESOURCE_OWNERSHIP_KEYS } from "../../ownership";
+import { OWNERSHIP_MANAGED_BY_VALUE } from "@intentius/chant/ownership";
+import type { GcpResource, OperationSpec, ResourceMapper } from "./gcp-apply";
+
+export const COMPUTE_HOST = "https://compute.googleapis.com";
+
+const enc = encodeURIComponent;
+
+type Ref = { name?: string; external?: string; kind?: string };
+type Obj = Record<string, unknown>;
+
+function isObj(v: unknown): v is Obj {
+  return v !== null && typeof v === "object" && !Array.isArray(v);
+}
+
+/** What a `*Ref` key points at: the CNRM kind (for a manifest lookup), the collection, and whether it is global only. */
+const REF_TARGETS: Record<string, { kind: string; collection: string; scope: "global" | "regional" | "either" }> = {
+  addressRef: { kind: "ComputeAddress", collection: "addresses", scope: "either" },
+  networkEndpointGroupRef: { kind: "ComputeRegionNetworkEndpointGroup", collection: "networkEndpointGroups", scope: "regional" },
+  backendServiceRef: { kind: "ComputeBackendService", collection: "backendServices", scope: "either" },
+  backendBucketRef: { kind: "ComputeBackendBucket", collection: "backendBuckets", scope: "global" },
+  urlMapRef: { kind: "ComputeURLMap", collection: "urlMaps", scope: "either" },
+  targetHTTPProxyRef: { kind: "ComputeTargetHTTPProxy", collection: "targetHttpProxies", scope: "either" },
+  targetHTTPSProxyRef: { kind: "ComputeTargetHTTPSProxy", collection: "targetHttpsProxies", scope: "either" },
+  healthCheckRef: { kind: "ComputeHealthCheck", collection: "healthChecks", scope: "either" },
+  securityPolicyRef: { kind: "ComputeSecurityPolicy", collection: "securityPolicies", scope: "global" },
+  networkRef: { kind: "ComputeNetwork", collection: "networks", scope: "global" },
+  subnetworkRef: { kind: "ComputeSubnetwork", collection: "subnetworks", scope: "regional" },
+};
+
+export interface ComputeCtx {
+  base: string;
+  project: string;
+  manifest?: readonly GcpResource[];
+}
+
+/** The region or `"global"` a CNRM compute spec declares. A NEG names `region`; the rest `location`. */
+export function scopeOf(spec: Obj | undefined, env: NodeJS.ProcessEnv = process.env): string {
+  const loc = spec?.location ?? spec?.region;
+  return typeof loc === "string" && loc !== "" ? loc : (env.GCP_REGION || "us-central1");
+}
+
+function scopePath(project: string, scope: string): string {
+  return scope === "global" ? `projects/${enc(project)}/global` : `projects/${enc(project)}/regions/${enc(scope)}`;
+}
+
+/** The compute name: CNRM's `resourceID` when set, else `metadata.name`. */
+export function computeName(resource: GcpResource): string {
+  const id = (resource.spec as Obj | undefined)?.resourceID;
+  const name = typeof id === "string" && id !== "" ? id : resource.metadata?.name;
+  if (!name) throw new Error(`${resource.kind ?? "compute resource"} has no metadata.name`);
+  return name;
+}
+
+/**
+ * The partial URL a `*Ref` resolves to. `external` is used as given when it is
+ * a path or URL; a bare name (or `name`) is scoped by the referenced resource's
+ * own spec when the manifest holds it, else by `fallbackScope`. Pure.
+ */
+export function refUrl(key: string, ref: Ref, ctx: ComputeCtx, fallbackScope: string): string {
+  const target = REF_TARGETS[key];
+  if (!target) throw new Error(`no compute collection for ${key}`);
+  if (typeof ref.external === "string" && ref.external !== "") {
+    if (ref.external.startsWith("projects/") || ref.external.startsWith("https://")) return ref.external;
+  }
+  const name = ref.name ?? ref.external;
+  if (!name) throw new Error(`${key} has no name or external`);
+  const declared = ctx.manifest?.find((r) => r.kind === target.kind && (r.metadata?.name === name || (r.spec as Obj | undefined)?.resourceID === name));
+  const scope =
+    target.scope === "global"
+      ? "global"
+      : declared
+        ? scopeOf(declared.spec as Obj)
+        : target.scope === "regional" && fallbackScope === "global"
+          ? scopeOf(undefined)
+          : fallbackScope;
+  const resolvedName = declared ? computeName(declared) : name;
+  return `${scopePath(ctx.project, scope)}/${target.collection}/${resolvedName}`;
+}
+
+/** Resolve the one `*Ref` key an object holds (`{ backendServiceRef: {...} }` → URL), or undefined. */
+function oneRef(value: unknown, ctx: ComputeCtx, scope: string): string | undefined {
+  if (!isObj(value)) return undefined;
+  for (const [k, v] of Object.entries(value)) {
+    if (REF_TARGETS[k] && isObj(v)) return refUrl(k, v as Ref, ctx, scope);
+  }
+  return undefined;
+}
+
+/** Copy the listed fields that are set. */
+function pick(spec: Obj, keys: readonly string[]): Obj {
+  const out: Obj = {};
+  for (const k of keys) if (spec[k] !== undefined) out[k] = spec[k];
+  return out;
+}
+
+/**
+ * The resource's labels GCP accepts, plus the ownership marker. Composites put
+ * Kubernetes-style keys (`app.kubernetes.io/component`) in `metadata.labels`,
+ * which a compute label key can't hold, so those are left out.
+ */
+export function computeLabels(labels: Record<string, string> | undefined): Record<string, string> {
+  const out: Record<string, string> = {};
+  for (const [k, v] of Object.entries(labels ?? {})) {
+    if (/^[a-z][a-z0-9_-]{0,62}$/.test(k) && typeof v === "string" && /^[a-z0-9_-]{0,63}$/.test(v)) out[k] = v;
+  }
+  return { ...out, [GCP_RESOURCE_OWNERSHIP_KEYS.managedBy]: OWNERSHIP_MANAGED_BY_VALUE };
+}
+
+/** ComputeAddress → addresses.insert body. Pure. */
+export function addressBody(resource: GcpResource, ctx: ComputeCtx): Obj {
+  const spec = (resource.spec ?? {}) as Obj;
+  const scope = scopeOf(spec);
+  const body: Obj = {
+    name: computeName(resource),
+    ...pick(spec, ["address", "addressType", "description", "ipVersion", "ipv6EndpointType", "networkTier", "prefixLength", "purpose"]),
+    labels: computeLabels(resource.metadata?.labels),
+  };
+  if (isObj(spec.networkRef)) body.network = refUrl("networkRef", spec.networkRef as Ref, ctx, scope);
+  if (isObj(spec.subnetworkRef)) body.subnetwork = refUrl("subnetworkRef", spec.subnetworkRef as Ref, ctx, scope);
+  return body;
+}
+
+/** ComputeRegionNetworkEndpointGroup → regionNetworkEndpointGroups.insert body (serverless NEGs). Pure. */
+export function negBody(resource: GcpResource, ctx: ComputeCtx): Obj {
+  const spec = (resource.spec ?? {}) as Obj;
+  const scope = scopeOf(spec);
+  const body: Obj = {
+    name: computeName(resource),
+    networkEndpointType: (spec.networkEndpointType as string | undefined) ?? "SERVERLESS",
+    ...pick(spec, ["description", "pscTargetService"]),
+  };
+  const serviceName = (ref: unknown): string | undefined => {
+    if (!isObj(ref)) return undefined;
+    const r = ref as Ref;
+    // A serverless NEG names the service, not its path.
+    return (r.external ?? r.name)?.split("/").pop();
+  };
+  if (isObj(spec.cloudRun)) {
+    const c = spec.cloudRun as Obj;
+    body.cloudRun = { ...pick(c, ["tag", "urlMask"]), ...(serviceName(c.serviceRef) ? { service: serviceName(c.serviceRef) } : {}) };
+  }
+  if (isObj(spec.cloudFunction)) {
+    const c = spec.cloudFunction as Obj;
+    body.cloudFunction = { ...pick(c, ["urlMask"]), ...(serviceName(c.functionRef) ? { function: serviceName(c.functionRef) } : {}) };
+  }
+  if (isObj(spec.appEngine)) body.appEngine = spec.appEngine;
+  if (isObj(spec.networkRef)) body.network = refUrl("networkRef", spec.networkRef as Ref, ctx, scope);
+  if (isObj(spec.subnetworkRef)) body.subnetwork = refUrl("subnetworkRef", spec.subnetworkRef as Ref, ctx, scope);
+  return body;
+}
+
+/** ComputeBackendService → backendServices.insert body. Pure. */
+export function backendServiceBody(resource: GcpResource, ctx: ComputeCtx): Obj {
+  const spec = (resource.spec ?? {}) as Obj;
+  const scope = scopeOf(spec);
+  const body: Obj = {
+    name: computeName(resource),
+    ...pick(spec, [
+      "affinityCookieTtlSec",
+      "cdnPolicy",
+      "compressionMode",
+      "customRequestHeaders",
+      "customResponseHeaders",
+      "description",
+      "loadBalancingScheme",
+      "localityLbPolicy",
+      "logConfig",
+      "portName",
+      "protocol",
+      "sessionAffinity",
+      "timeoutSec",
+    ]),
+  };
+  if (spec.enableCdn !== undefined) body.enableCDN = spec.enableCdn;
+  if (spec.connectionDrainingTimeoutSec !== undefined) body.connectionDraining = { drainingTimeoutSec: spec.connectionDrainingTimeoutSec };
+  if (Array.isArray(spec.backend)) {
+    body.backends = (spec.backend as Obj[]).map((b) => {
+      const { group, ...rest } = b;
+      const groupUrl = isObj(group) ? oneRef(group, ctx, scope) ?? ((group as Obj).instanceGroupRef as Ref | undefined)?.external : undefined;
+      return { ...rest, ...(groupUrl ? { group: groupUrl } : {}) };
+    });
+  }
+  if (Array.isArray(spec.healthChecks)) {
+    body.healthChecks = (spec.healthChecks as Obj[]).map((h) => oneRef(h, ctx, scope)).filter((u): u is string => !!u);
+  }
+  if (isObj(spec.securityPolicyRef)) body.securityPolicy = refUrl("securityPolicyRef", spec.securityPolicyRef as Ref, ctx, scope);
+  else if (typeof spec.securityPolicy === "string") body.securityPolicy = spec.securityPolicy;
+  return body;
+}
+
+/** ComputeURLMap → urlMaps.insert body. Pure. */
+export function urlMapBody(resource: GcpResource, ctx: ComputeCtx): Obj {
+  const spec = (resource.spec ?? {}) as Obj;
+  const scope = scopeOf(spec);
+  const service = (v: unknown) => oneRef(v, ctx, scope);
+  const body: Obj = {
+    name: computeName(resource),
+    ...pick(spec, ["description", "defaultUrlRedirect", "headerAction"]),
+  };
+  const def = service(spec.defaultService);
+  if (def) body.defaultService = def;
+  if (Array.isArray(spec.hostRule)) body.hostRules = spec.hostRule;
+  if (Array.isArray(spec.pathMatcher)) {
+    body.pathMatchers = (spec.pathMatcher as Obj[]).map((m) => {
+      const { defaultService, pathRule, ...rest } = m;
+      const out: Obj = { ...rest };
+      const d = service(defaultService);
+      if (d) out.defaultService = d;
+      if (Array.isArray(pathRule)) {
+        out.pathRules = (pathRule as Obj[]).map((r) => {
+          const { service: s, ...rr } = r;
+          const u = service(s);
+          return { ...rr, ...(u ? { service: u } : {}) };
+        });
+      }
+      return out;
+    });
+  }
+  return body;
+}
+
+/** ComputeTargetHTTPProxy → targetHttpProxies.insert body. Pure. */
+export function targetHttpProxyBody(resource: GcpResource, ctx: ComputeCtx): Obj {
+  const spec = (resource.spec ?? {}) as Obj;
+  const body: Obj = { name: computeName(resource), ...pick(spec, ["description", "proxyBind", "httpKeepAliveTimeoutSec"]) };
+  if (isObj(spec.urlMapRef)) body.urlMap = refUrl("urlMapRef", spec.urlMapRef as Ref, ctx, scopeOf(spec));
+  return body;
+}
+
+/** ComputeForwardingRule → forwardingRules.insert body. Pure. */
+export function forwardingRuleBody(resource: GcpResource, ctx: ComputeCtx): Obj {
+  const spec = (resource.spec ?? {}) as Obj;
+  const scope = scopeOf(spec);
+  const body: Obj = {
+    name: computeName(resource),
+    ...pick(spec, ["allowGlobalAccess", "description", "ipVersion", "isMirroringCollector", "loadBalancingScheme", "networkTier", "portRange", "ports", "allPorts"]),
+    labels: computeLabels(resource.metadata?.labels),
+  };
+  if (spec.ipProtocol !== undefined) body.IPProtocol = spec.ipProtocol;
+  if (isObj(spec.ipAddress)) {
+    const ip = spec.ipAddress as Obj;
+    const addr = isObj(ip.addressRef) ? refUrl("addressRef", ip.addressRef as Ref, ctx, scope) : (ip.ip as string | undefined);
+    if (addr) body.IPAddress = addr;
+  }
+  const target = oneRef(spec.target, ctx, scope);
+  if (target) body.target = target;
+  if (isObj(spec.backendServiceRef)) body.backendService = refUrl("backendServiceRef", spec.backendServiceRef as Ref, ctx, scope);
+  if (isObj(spec.networkRef)) body.network = refUrl("networkRef", spec.networkRef as Ref, ctx, scope);
+  if (isObj(spec.subnetworkRef)) body.subnetwork = refUrl("subnetworkRef", spec.subnetworkRef as Ref, ctx, scope);
+  return body;
+}
+
+/**
+ * A compute `Operation`: the insert or delete returns one with a `selfLink`,
+ * polled until `status: "DONE"`. The link is rebased onto `base`, so an
+ * endpoint override (floci-gcp) is polled too. A create that returned the
+ * resource itself has nothing to poll.
+ */
+export const computeOperation: OperationSpec = {
+  pollUrl(body, { base }) {
+    const op = body as { kind?: string; selfLink?: string } | undefined;
+    const link = op?.selfLink;
+    if (!link || !link.includes("/operations/")) return undefined;
+    const at = link.indexOf("/compute/v1/");
+    return at >= 0 ? `${base}${link.slice(at)}` : link;
+  },
+  isDone(body) {
+    return (body as { status?: string })?.status === "DONE";
+  },
+  error(body) {
+    const errors = (body as { error?: { errors?: Array<{ message?: string; code?: string }> } })?.error?.errors;
+    return errors?.length ? errors.map((e) => e.message ?? e.code ?? "error").join("; ") : undefined;
+  },
+};
+
+function computeMapper(
+  kind: string,
+  collection: string,
+  build: (resource: GcpResource, ctx: ComputeCtx) => Obj,
+  regionalCollection = collection,
+): ResourceMapper {
+  return {
+    kind,
+    defaultHost: COMPUTE_HOST,
+    operation: computeOperation,
+    plan(resource, ctx) {
+      const scope = scopeOf(resource.spec as Obj | undefined);
+      const coll = `${ctx.base}/compute/v1/${scopePath(ctx.project, scope)}/${scope === "global" ? collection : regionalCollection}`;
+      const name = computeName(resource);
+      return { getUrl: `${coll}/${enc(name)}`, create: { method: "POST", url: coll, body: build(resource, ctx) } };
+    },
+  };
+}
+
+export const computeAddressMapper = computeMapper("ComputeAddress", "addresses", addressBody);
+export const regionNetworkEndpointGroupMapper = computeMapper("ComputeRegionNetworkEndpointGroup", "networkEndpointGroups", negBody);
+export const backendServiceMapper = computeMapper("ComputeBackendService", "backendServices", backendServiceBody);
+export const urlMapMapper = computeMapper("ComputeURLMap", "urlMaps", urlMapBody);
+export const targetHttpProxyMapper = computeMapper("ComputeTargetHTTPProxy", "targetHttpProxies", targetHttpProxyBody);
+export const forwardingRuleMapper = computeMapper("ComputeForwardingRule", "forwardingRules", forwardingRuleBody);

package/src/op/activities/gcp-iam.test.ts

@@ -0,0 +1,152 @@
+import { beforeEach, describe, expect, test } from "vitest";
+import { applyResource, deleteResource, MAPPERS, type GcpHttp, type GcpResource } from "./gcp-apply";
+import { iamPolicyMemberMapper, iamTarget, policyHasMember, withMember, withoutMember } from "./gcp-iam";
+import { getResource } from "../../api/read-client";
+
+const binding = (overrides: Record<string, unknown> = {}): GcpResource => ({
+  kind: "IAMPolicyMember",
+  metadata: { name: "web-public" },
+  spec: {
+    member: "allUsers",
+    role: "roles/run.invoker",
+    resourceRef: { apiVersion: "run.cnrm.cloud.google.com/v1beta1", kind: "RunService", name: "web" },
+    ...overrides,
+  },
+});
+
+/** A fake policy store: one policy per `:getIamPolicy` path, recording each call. */
+function policyServer(initial: Record<string, unknown> = { etag: "e1", bindings: [{ role: "roles/viewer", members: ["user:a@x.io"] }] }) {
+  let policy = initial as { etag?: string; bindings?: Array<{ role: string; members: string[] }> };
+  const calls: Array<{ method: string; url: string; body?: unknown }> = [];
+  let conflicts = 0;
+  const http: GcpHttp = async (method, url, body) => {
+    calls.push({ method, url, ...(body !== undefined ? { body } : {}) });
+    if (url.includes(":getIamPolicy")) return { status: 200, text: JSON.stringify(policy) };
+    if (url.includes(":setIamPolicy")) {
+      if (conflicts > 0) {
+        conflicts--;
+        return { status: 409, text: "etag mismatch" };
+      }
+      policy = { ...(body as { policy: typeof policy }).policy, etag: "e2" };
+      return { status: 200, text: JSON.stringify(policy) };
+    }
+    return { status: 404, text: "" };
+  };
+  return { http, calls, policy: () => policy, conflict: (n: number) => (conflicts = n) };
+}
+
+const ctx = { base: "https://iam.googleapis.com", project: "p1" };
+
+// The region default reads GCP_REGION; pin it so the URLs below hold.
+beforeEach(() => {
+  delete process.env.GCP_REGION;
+});
+
+describe("IAMPolicyMember targets (#4233)", () => {
+  test("a RunService takes its region from the manifest, and its host when there is no override", () => {
+    const manifest: GcpResource[] = [{ kind: "RunService", metadata: { name: "web" }, spec: { location: "europe-west1" } }];
+    const t = iamTarget(binding().spec as never, "p1", manifest)!;
+    expect(t.get(t.host)).toEqual({
+      method: "GET",
+      url: "https://run.googleapis.com/v2/projects/p1/locations/europe-west1/services/web:getIamPolicy?options.requestedPolicyVersion=3",
+    });
+  });
+
+  test("Project, IAMServiceAccount, StorageBucket, PubSub and secrets resolve; other kinds do not", () => {
+    const of = (resourceRef: Record<string, unknown>) => iamTarget({ member: "m", role: "r", resourceRef } as never, "p1");
+    expect(of({ kind: "Project", external: "projects/other" })!.path).toBe("projects/other");
+    expect(of({ kind: "IAMServiceAccount", name: "sa" })!.path).toBe("projects/p1/serviceAccounts/sa@p1.iam.gserviceaccount.com");
+    expect(of({ kind: "StorageBucket", name: "b" })!.set("https://storage.googleapis.com", { bindings: [] })).toEqual({
+      method: "PUT",
+      url: "https://storage.googleapis.com/storage/v1/b/b/iam",
+      body: { bindings: [] },
+    });
+    expect(of({ kind: "PubSubSubscription", name: "s" })!.path).toBe("projects/p1/subscriptions/s");
+    expect(of({ kind: "SecretManagerSecret", name: "k" })!.path).toBe("projects/p1/secrets/k");
+    expect(of({ kind: "CloudFunctionsFunction", name: "f" })).toBeUndefined();
+  });
+});
+
+describe("policy merge (#4233)", () => {
+  const spec = { member: "allUsers", role: "roles/run.invoker" };
+
+  test("adds the member to its role and keeps every other binding", () => {
+    const next = withMember({ etag: "e1", bindings: [{ role: "roles/viewer", members: ["user:a"] }] }, spec);
+    expect(next).toEqual({
+      etag: "e1",
+      bindings: [
+        { role: "roles/viewer", members: ["user:a"] },
+        { role: "roles/run.invoker", members: ["allUsers"] },
+      ],
+    });
+    expect(policyHasMember(next, spec)).toBe(true);
+  });
+
+  test("a conditional binding is its own binding, at policy version 3", () => {
+    const cond = { ...spec, condition: { title: "t", expression: "request.time < timestamp('2030-01-01T00:00:00Z')" } };
+    const next = withMember({ bindings: [{ role: "roles/run.invoker", members: ["user:b"] }] }, cond);
+    expect(next.version).toBe(3);
+    expect(next.bindings).toHaveLength(2);
+    expect(policyHasMember(next, spec)).toBe(false);
+  });
+
+  test("removing the last member drops the binding", () => {
+    expect(withoutMember({ bindings: [{ role: "roles/run.invoker", members: ["allUsers"] }] }, spec).bindings).toEqual([]);
+  });
+});
+
+describe("IAMPolicyMember apply, delete and read (#4233)", () => {
+  test("apply reads, merges and writes the policy with its etag, then leaves it alone", async () => {
+    const server = policyServer();
+    const first = await applyResource(iamPolicyMemberMapper, binding(), ctx, server.http);
+    expect(first).toEqual({ kind: "IAMPolicyMember", name: "web-public", created: true, updated: false });
+    const set = server.calls.find((c) => c.url.endsWith(":setIamPolicy"))!;
+    expect(set.url).toBe("https://run.googleapis.com/v2/projects/p1/locations/us-central1/services/web:setIamPolicy");
+    expect((set.body as { policy: { etag: string; bindings: unknown[] } }).policy).toEqual({
+      etag: "e1",
+      bindings: [
+        { role: "roles/viewer", members: ["user:a@x.io"] },
+        { role: "roles/run.invoker", members: ["allUsers"] },
+      ],
+    });
+    const again = await applyResource(iamPolicyMemberMapper, binding(), ctx, server.http);
+    expect(again.created).toBe(false);
+    expect(server.calls.filter((c) => c.url.endsWith(":setIamPolicy"))).toHaveLength(1);
+  });
+
+  test("an etag conflict is read again and retried", async () => {
+    const server = policyServer();
+    server.conflict(1);
+    await applyResource(iamPolicyMemberMapper, binding(), ctx, server.http);
+    expect(server.calls.filter((c) => c.url.endsWith(":setIamPolicy"))).toHaveLength(2);
+    expect(policyHasMember(server.policy(), { member: "allUsers", role: "roles/run.invoker" })).toBe(true);
+  });
+
+  test("an endpoint override serves every target", async () => {
+    const server = policyServer();
+    await applyResource(iamPolicyMemberMapper, binding(), { base: "http://localhost:4588", project: "p1" }, server.http);
+    expect(server.calls.every((c) => c.url.startsWith("http://localhost:4588/v2/"))).toBe(true);
+  });
+
+  test("delete removes only this member", async () => {
+    const server = policyServer({ etag: "e1", bindings: [{ role: "roles/run.invoker", members: ["allUsers", "user:b"] }] });
+    expect((await deleteResource(iamPolicyMemberMapper, binding(), ctx, server.http)).deleted).toBe(true);
+    expect(server.policy().bindings).toEqual([{ role: "roles/run.invoker", members: ["user:b"] }]);
+    expect((await deleteResource(iamPolicyMemberMapper, binding(), ctx, server.http)).deleted).toBe(false);
+  });
+
+  test("the reader answers present when the policy grants the member, absent when not", async () => {
+    const server = policyServer({ bindings: [{ role: "roles/run.invoker", members: ["allUsers"] }] });
+    const props = binding().spec as Record<string, unknown>;
+    const body = await getResource({ project: "p1", http: server.http }, "IAMPolicyMember", "web-public", props);
+    expect(body).toMatchObject({ member: "allUsers", role: "roles/run.invoker", resource: "projects/p1/locations/us-central1/services/web" });
+
+    const empty = policyServer({ bindings: [] });
+    await expect(getResource({ project: "p1", http: empty.http }, "IAMPolicyMember", "web-public", props)).rejects.toMatchObject({ status: 404 });
+  });
+
+  test("a binding on a target chant cannot reach is not accepted", () => {
+    const fn = binding({ resourceRef: { kind: "CloudFunctionsFunction", name: "f" } });
+    expect(MAPPERS.IAMPolicyMember.accepts!(fn, ctx)).toBe(false);
+  });
+});