1import * as paymentcryptographydata from "@distilled.cloud/aws/payment-cryptography-data";
2import * as Effect from "effect/Effect";
3import * as Layer from "effect/Layer";
4import * as Binding from "../../Binding.ts";
5import { isBindingHost } from "../Lambda/Function.ts";
6import type { Key } from "./Key.ts";
7import {
8 TranslateKeyMaterial,
9 type TranslateKeyMaterialRequest,
10} from "./TranslateKeyMaterial.ts";
11
12/**
13 * HTTP implementation of {@link TranslateKeyMaterial} — bespoke (not
14 * scaffolded): the key identifiers live in nested request structures
15 * (`IncomingKeyMaterial.DiffieHellmanTr31KeyBlock.PrivateKeyIdentifier`,
16 * `OutgoingKeyMaterial.Tr31KeyBlock.WrappingKeyIdentifier`) whose union arms
17 * vary by exchange scheme, so nothing is injected. The deploy-time half
18 * grants `payment-cryptography:TranslateKeyMaterial` on every bound
19 * {@link Key}; the caller supplies the full request (resolving each key's
20 * ARN itself).
21 */
22export const TranslateKeyMaterialHttp = Layer.effect(
23 TranslateKeyMaterial,
24 Effect.gen(function* () {
25 const translateKeyMaterial =
26 yield* paymentcryptographydata.translateKeyMaterial;
27
28 return Effect.fn(function* (...keys: readonly [Key, ...Key[]]) {
29 if (!globalThis.__ALCHEMY_RUNTIME__) {
30 const host = yield* Binding.Host;
31 if (isBindingHost(host)) {
32 for (const key of keys) {
33 yield* host.bind`Allow(${host}, AWS.PaymentCryptography.TranslateKeyMaterial(${key}))`(
34 {
35 policyStatements: [
36 {
37 Effect: "Allow",
38 Action: ["payment-cryptography:TranslateKeyMaterial"],
39 Resource: [key.keyArn],
40 },
41 ],
42 },
43 );
44 }
45 }
46 }
47 return Effect.fn(
48 `AWS.PaymentCryptography.TranslateKeyMaterial(${keys
49 .map((key) => key.LogicalId)
50 .join(", ")})`,
51 )(function* (request: TranslateKeyMaterialRequest) {
52 return yield* translateKeyMaterial(request);
53 });
54 });
55 }),
56);