1import type * as secretmanager from "@distilled.cloud/gcp/secretmanager_v1";
2import type * as Effect from "effect/Effect";
3import * as Binding from "../../Binding.ts";
4import type { RuntimeContext } from "../../RuntimeContext.ts";
5import type { SecretBindingTarget } from "./BindingHttp.ts";
6
7/** Version-management client for one Secret Manager secret. */
8export interface WriteSecretClient {
9 /** Add a new version and return its full resource name. */
10 addVersion(
11 value: string | Uint8Array,
12 ): Effect.Effect<
13 string,
14 secretmanager.AddVersionProjectsSecretsError,
15 RuntimeContext
16 >;
17 /** Disable a version (a version id or full version name). */
18 disableVersion(
19 version: string,
20 ): Effect.Effect<
21 void,
22 secretmanager.DisableProjectsSecretsVersionsError,
23 RuntimeContext
24 >;
25 /**
26 * Irrevocably destroy a version's data. Destroying a missing version
27 * succeeds.
28 */
29 destroyVersion(
30 version: string,
31 ): Effect.Effect<
32 void,
33 secretmanager.DestroyProjectsSecretsVersionsError,
34 RuntimeContext
35 >;
36}
37
38/**
39 * Write access to a Secret Manager {@link Secret} (or regional
40 * `LocationsSecret`): `addVersion`, `disableVersion`, `destroyVersion`.
41 * Grants `roles/secretmanager.secretVersionManager` on the secret only
42 * (`secretVersionAdder` cannot disable or destroy). It cannot read payloads.
43 *
44 * ### Rotating a secret
45 * **Example:** Add a version and destroy the previous one
46 * ```typescript
47 * const apiKey = yield* GCP.SecretManager.WriteSecret(secret);
48 * const version = yield* apiKey.addVersion(newKey);
49 * yield* apiKey.destroyVersion(previousVersion);
50 * // …provided with Effect.provide(GCP.SecretManager.WriteSecretHttp)
51 * ```
52 *
53 * @binding
54 * @category SecretManager
55 */
56export interface WriteSecret extends Binding.Service<
57 WriteSecret,
58 "GCP.SecretManager.WriteSecret",
59 (secret: SecretBindingTarget) => Effect.Effect<WriteSecretClient>
60> {}
61
62export const WriteSecret = Binding.Service<WriteSecret>(
63 "GCP.SecretManager.WriteSecret",
64);