1import * as Effect from "effect/Effect";
2import * as Binding from "../../Binding.ts";
3import type { Output as OutputType } from "../../Output.ts";
4import { isBindingHost } from "../Lambda/Function.ts";
5import type { Table } from "./Table.ts";
6
7/**
8 * Shared scaffolding for AWS DynamoDB HTTP bindings.
9 *
10 * NOT exported from `index.ts` — every near-identical `{Op}Http.ts` in this
11 * service is a thin `Layer.effect(Cap, make…HttpBinding({ … }))` over one of
12 * the builders below. Everything except the operation, the IAM action list,
13 * and the granted ARNs is boilerplate. Genuinely-different bindings
14 * (multi-table batches/transactions, restores, the batched sink) stay bespoke.
15 */
16
17/**
18 * Build the impl Effect for an account-level operation (`ListTables`,
19 * `DescribeLimits`): the runtime callable passes the caller's request
20 * through unchanged and the deploy-time half grants `actions` on `*`
21 * (these DynamoDB actions do not support resource-level permissions).
22 */
23export const makeAccountHttpBinding = <I, A, E, R>(options: {
24 /** Fully-qualified binding tag, e.g. `AWS.DynamoDB.ListTables`. */
25 tag: string;
26 /** The distilled operation, invoked with the caller's request as-is. */
27 operation: Effect.Effect<(input: I) => Effect.Effect<A, E>, never, R>;
28 /** IAM actions granted on `*`. */
29 actions: readonly string[];
30}) =>
31 Effect.gen(function* () {
32 const op = yield* options.operation;
33
34 return Effect.fn(function* () {
35 if (!globalThis.__ALCHEMY_RUNTIME__) {
36 const host = yield* Binding.Host;
37 if (isBindingHost(host)) {
38 yield* host.bind`Allow(${host}, ${options.tag}())`({
39 policyStatements: [
40 {
41 Effect: "Allow",
42 Action: [...options.actions],
43 Resource: ["*"],
44 },
45 ],
46 });
47 }
48 }
49 return Effect.fn(options.tag)(function* (request?: I) {
50 return yield* op((request ?? {}) as I);
51 });
52 });
53 });
54
55/**
56 * Build the impl Effect for a table-scoped operation: the runtime callable
57 * injects the bound {@link Table}'s physical name as `TableName` and the
58 * deploy-time half grants `actions` on `resources` (default: the table ARN).
59 */
60export const makeTableHttpBinding = <
61 I extends { TableName?: string },
62 A,
63 E,
64 R,
65>(options: {
66 /** Fully-qualified binding tag, e.g. `AWS.DynamoDB.GetItem`. */
67 tag: string;
68 /** The distilled operation; `TableName` is injected from the table. */
69 operation: Effect.Effect<(input: I) => Effect.Effect<A, E>, never, R>;
70 /** IAM actions granted on `resources`. */
71 actions: readonly string[];
72 /** ARNs the actions are granted on. @default the table ARN */
73 resources?: (table: Table) => (string | OutputType<string>)[];
74}) =>
75 Effect.gen(function* () {
76 const op = yield* options.operation;
77
78 return Effect.fn(function* (table: Table) {
79 const TableName = yield* table.tableName;
80 if (!globalThis.__ALCHEMY_RUNTIME__) {
81 const host = yield* Binding.Host;
82 if (isBindingHost(host)) {
83 yield* host.bind`Allow(${host}, ${options.tag}(${table}))`({
84 policyStatements: [
85 {
86 Effect: "Allow",
87 Action: [...options.actions],
88 Resource: options.resources?.(table) ?? [table.tableArn],
89 },
90 ],
91 });
92 }
93 }
94 return Effect.fn(`${options.tag}(${table.LogicalId})`)(function* (
95 request?: Omit<I, "TableName">,
96 ) {
97 return yield* op({
98 ...request,
99 TableName: yield* TableName,
100 } as I);
101 });
102 });
103 });
104
105/**
106 * Build the impl Effect for an ARN-scoped operation: the runtime callable
107 * injects the bound {@link Table}'s ARN under `key` (`ResourceArn` for the
108 * tagging APIs, `TableArn` for the export APIs) and the deploy-time half
109 * grants `actions` on `resources` (default: the table ARN).
110 */
111export const makeTableArnHttpBinding = <
112 K extends "ResourceArn" | "TableArn",
113 I extends { [P in K]?: string },
114 A,
115 E,
116 R,
117>(options: {
118 /** Fully-qualified binding tag, e.g. `AWS.DynamoDB.ListTagsOfResource`. */
119 tag: string;
120 /** The request field the table ARN is injected under. */
121 key: K;
122 /** The distilled operation; the table ARN is injected under `key`. */
123 operation: Effect.Effect<(input: I) => Effect.Effect<A, E>, never, R>;
124 /** IAM actions granted on `resources`. */
125 actions: readonly string[];
126 /** ARNs the actions are granted on. @default the table ARN */
127 resources?: (table: Table) => (string | OutputType<string>)[];
128}) =>
129 Effect.gen(function* () {
130 const op = yield* options.operation;
131
132 return Effect.fn(function* (table: Table) {
133 const TableArn = yield* table.tableArn;
134 if (!globalThis.__ALCHEMY_RUNTIME__) {
135 const host = yield* Binding.Host;
136 if (isBindingHost(host)) {
137 yield* host.bind`Allow(${host}, ${options.tag}(${table}))`({
138 policyStatements: [
139 {
140 Effect: "Allow",
141 Action: [...options.actions],
142 Resource: options.resources?.(table) ?? [table.tableArn],
143 },
144 ],
145 });
146 }
147 }
148 return Effect.fn(`${options.tag}(${table.LogicalId})`)(function* (
149 request?: Omit<I, K>,
150 ) {
151 return yield* op({
152 ...request,
153 [options.key]: yield* TableArn,
154 } as I);
155 });
156 });
157 });
158
159/**
160 * Build the impl Effect for an operation whose request carries its own
161 * identifiers (a PartiQL statement, a backup or export ARN): the bound
162 * {@link Table} only scopes the deploy-time IAM grant; the request passes
163 * through unchanged.
164 */
165export const makeTableIamHttpBinding = <I, A, E, R>(options: {
166 /** Fully-qualified binding tag, e.g. `AWS.DynamoDB.ExecuteStatement`. */
167 tag: string;
168 /** The distilled operation, invoked with the caller's request as-is. */
169 operation: Effect.Effect<(input: I) => Effect.Effect<A, E>, never, R>;
170 /** IAM actions granted on `resources`. */
171 actions: readonly string[];
172 /** ARNs the actions are granted on. */
173 resources: (table: Table) => (string | OutputType<string>)[];
174}) =>
175 Effect.gen(function* () {
176 const op = yield* options.operation;
177
178 return Effect.fn(function* (table: Table) {
179 if (!globalThis.__ALCHEMY_RUNTIME__) {
180 const host = yield* Binding.Host;
181 if (isBindingHost(host)) {
182 yield* host.bind`Allow(${host}, ${options.tag}(${table}))`({
183 policyStatements: [
184 {
185 Effect: "Allow",
186 Action: [...options.actions],
187 Resource: options.resources(table),
188 },
189 ],
190 });
191 }
192 }
193 return Effect.fn(`${options.tag}(${table.LogicalId})`)(function* (
194 request: I,
195 ) {
196 return yield* op(request);
197 });
198 });
199 });