@alchemy.run/fly 0.0.0-stage → 2.0.0-beta.84

package/src/Sign.ts

@@ -0,0 +1,46 @@
+import type { SignSecretKeyError } from "@distilled.cloud/fly-io/machines";
+import * as Binding from "alchemy/Binding";
+import type { RuntimeContext } from "alchemy/RuntimeContext";
+import type * as Effect from "effect/Effect";
+import type { SecretKey } from "./SecretKey.ts";
+
+export interface SignRequest {
+  /** Bytes to sign. */
+  plaintext: Uint8Array | ArrayLike<number>;
+}
+
+export interface SignResult {
+  signature: Uint8Array;
+}
+
+/**
+ * Sign with a Fly {@link SecretKey} (`nacl_sign`, `hs256`, `es256`,
+ * …). The private key never leaves Fly KMS.
+ *
+ *
+ * ### Sign a payload
+ * The App and key name are fixed by `Sign(key)`. Provide
+ * {@link SignHttp} on the Action or Service Effect.
+ *
+ * **Example:** Sign
+ * ```typescript
+ * const sign = yield* Fly.Sign(Signing);
+ * const { signature } = yield* sign({
+ *   plaintext: new TextEncoder().encode("release-manifest-v1"),
+ * });
+ * ```
+ *
+ * @binding
+ * @product Secret Key
+ */
+export interface Sign extends Binding.Service<
+  Sign,
+  "Fly.Sign",
+  (
+    key: SecretKey,
+  ) => Effect.Effect<
+    (request: SignRequest) => Effect.Effect<SignResult, SignSecretKeyError, RuntimeContext>
+  >
+> {}
+
+export const Sign = Binding.Service<Sign>("Fly.Sign");

package/src/SignHttp.ts

@@ -0,0 +1,44 @@
+import * as machines from "@distilled.cloud/fly-io/machines";
+import * as Effect from "effect/Effect";
+import * as FetchHttpClient from "effect/http/FetchHttpClient";
+import * as Layer from "effect/Layer";
+import { CredentialsFromAmbientOrEnv } from "./Credentials.ts";
+import { base64ToBytes, bytesToBase64, makeHttpSecretKeyBinding } from "./SecretKeyHttp.ts";
+import { Sign, type SignRequest } from "./Sign.ts";
+
+/**
+ * HTTP implementation of {@link Sign}. Provide it on the
+ * {@link Service} or Action Effect.
+ *
+ *
+ * ### Provide the layer
+ * **Example:** On a Service
+ * ```typescript
+ * Effect.gen(function* () {
+ *   const sign = yield* Fly.Sign(Signing);
+ *   // ...
+ * }).pipe(Effect.provide(Fly.SignHttp))
+ * ```
+ *
+ * @layer
+ * @product Secret Key
+ * @provides Fly.Sign
+ */
+export const SignHttp = Layer.effect(
+  Sign,
+  Effect.suspend(() =>
+    makeHttpSecretKeyBinding({
+      makeClient: (auth, appName, secretName) =>
+        Effect.fn("Fly.Sign")(function* (request: SignRequest) {
+          const res = yield* auth.authorize(
+            machines.signSecretKey({
+              app_name: yield* appName,
+              secret_name: yield* secretName,
+              plaintext: bytesToBase64(request.plaintext),
+            }),
+          );
+          return { signature: base64ToBytes(res.signature) };
+        }),
+    }),
+  ),
+).pipe(Layer.provide(FetchHttpClient.layer), Layer.provide(CredentialsFromAmbientOrEnv));