| 1 | import * as firebaseappcheck from "@distilled.cloud/gcp/firebaseappcheck_v1"; |
| 2 | import * as Effect from "effect/Effect"; |
| 3 | import * as Layer from "effect/Layer"; |
| 4 | import type { AppsDebugToken } from "./AppsDebugToken.ts"; |
| 5 | import { bindGcpHost } from "../Host.ts"; |
| 6 | import { |
| 7 | ExchangeDebugToken, |
| 8 | type ExchangeDebugTokenRequest, |
| 9 | } from "./ExchangeDebugToken.ts"; |
| 10 | |
| 11 | /** |
| 12 | * HTTP implementation of {@link ExchangeDebugToken}. |
| 13 | * |
| 14 | * @layer |
| 15 | * @provides GCP.FirebaseAppCheck.ExchangeDebugToken |
| 16 | */ |
| 17 | export const ExchangeDebugTokenHttp = Layer.effect( |
| 18 | ExchangeDebugToken, |
| 19 | Effect.gen(function* () { |
| 20 | const exchange = yield* firebaseappcheck.exchangeDebugTokenProjectsApps; |
| 21 | return Effect.fn(function* (debugToken: AppsDebugToken) { |
| 22 | yield* bindGcpHost({ |
| 23 | tag: "GCP.FirebaseAppCheck.ExchangeDebugToken", |
| 24 | resource: debugToken, |
| 25 | // exchangeDebugToken is not IAM-gated; the debug token secret is the |
| 26 | // credential. |
| 27 | iam: [], |
| 28 | }); |
| 29 | const app = yield* debugToken.app; |
| 30 | const secret = yield* debugToken.token; |
| 31 | return Effect.fn( |
| 32 | `GCP.FirebaseAppCheck.ExchangeDebugToken(${debugToken.LogicalId})`, |
| 33 | )(function* (request?: ExchangeDebugTokenRequest) { |
| 34 | return yield* exchange({ |
| 35 | app: yield* app, |
| 36 | body: { |
| 37 | debugToken: (yield* secret) ?? "", |
| 38 | limitedUse: request?.limitedUse === true ? true : undefined, |
| 39 | }, |
| 40 | }); |
| 41 | }); |
| 42 | }); |
| 43 | }), |
| 44 | ); |