1import type * as kms from "@distilled.cloud/aws/kms";
2import type * as Effect from "effect/Effect";
3import * as Binding from "../../Binding.ts";
4import type { AliasName } from "./Alias.ts";
5import type { Key } from "./Key.ts";
6
7export interface VerifyRequest extends Omit<kms.VerifyRequest, "KeyId"> {}
8
9/**
10 * Runtime binding for `kms:Verify`.
11 *
12 * Bind this operation to an asymmetric SIGN_VERIFY KMS {@link Key} (or the
13 * `alias/...` name of a pre-existing key) to get a callable that
14 * automatically injects the `KeyId`. Verifying inside KMS (rather than with
15 * a downloaded public key) means the result is authorized and auditable by
16 * IAM/CloudTrail.
17 *
18 * A mismatched signature surfaces as the typed
19 * `KMSInvalidSignatureException` — a valid signature returns
20 * `SignatureValid: true`.
21 *
22 * ### Signing
23 * **Example:** Verify a Signature
24 * ```typescript
25 * const verify = yield* AWS.KMS.Verify(signingKey);
26 *
27 * const { SignatureValid } = yield* verify({
28 * Message: new TextEncoder().encode("release-manifest-v1"),
29 * Signature: signature,
30 * SigningAlgorithm: "ECDSA_SHA_256",
31 * });
32 * ```
33 *
34 * **Example:** Treat a Bad Signature as a Value
35 * ```typescript
36 * const valid = yield* verify({ Message, Signature, SigningAlgorithm }).pipe(
37 * Effect.map(() => true),
38 * Effect.catchTag("KMSInvalidSignatureException", () =>
39 * Effect.succeed(false),
40 * ),
41 * );
42 * ```
43 *
44 * @binding
45 */
46export interface Verify extends Binding.Service<
47 Verify,
48 "AWS.KMS.Verify",
49 (
50 key: Key | AliasName,
51 ) => Effect.Effect<
52 (
53 request: VerifyRequest,
54 ) => Effect.Effect<kms.VerifyResponse, kms.VerifyError>
55 >
56> {}
57
58export const Verify = Binding.Service<Verify>("AWS.KMS.Verify");