alchemy-effect 0.5.0 → 0.6.2

package/src/AWS/IAM/SSHPublicKey.ts

@@ -0,0 +1,148 @@
+import * as iam from "@distilled.cloud/aws/iam";
+import * as Effect from "effect/Effect";
+import { isResolved } from "../../Diff.ts";
+import { Resource } from "../../Resource.ts";
+
+export interface SSHPublicKeyProps {
+  /**
+   * User that owns the SSH public key.
+   */
+  userName: string;
+  /**
+   * SSH public key body.
+   */
+  sshPublicKeyBody: string;
+  /**
+   * Desired key status.
+   * @default "Active"
+   */
+  status?: iam.StatusType;
+}
+
+export interface SSHPublicKey extends Resource<
+  "AWS.IAM.SSHPublicKey",
+  SSHPublicKeyProps,
+  {
+    userName: string;
+    sshPublicKeyId: string;
+    fingerprint: string;
+    sshPublicKeyBody: string;
+    status: iam.StatusType;
+    uploadDate: Date | undefined;
+  }
+> {}
+
+/**
+ * An IAM SSH public key for CodeCommit-compatible workflows.
+ *
+ * `SSHPublicKey` uploads and manages a user's public key for services such as
+ * AWS CodeCommit that authenticate through IAM-backed SSH credentials.
+ *
+ * @section Managing SSH Keys
+ * @example Upload an SSH Public Key
+ * ```typescript
+ * const user = yield* User("GitUser", {
+ *   userName: "codecommit-user",
+ * });
+ *
+ * const key = yield* SSHPublicKey("GitKey", {
+ *   userName: user.userName,
+ *   sshPublicKeyBody: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIExample codecommit-user",
+ * });
+ * ```
+ */
+export const SSHPublicKey = Resource<SSHPublicKey>("AWS.IAM.SSHPublicKey");
+
+export const SSHPublicKeyProvider = () =>
+  SSHPublicKey.provider.succeed({
+    stables: ["sshPublicKeyId"],
+    diff: Effect.fn(function* ({ olds, news }) {
+      if (!isResolved(news)) return;
+      if (
+        olds.userName !== news.userName ||
+        olds.sshPublicKeyBody !== news.sshPublicKeyBody
+      ) {
+        return { action: "replace" } as const;
+      }
+    }),
+    read: Effect.fn(function* ({ output }) {
+      if (!output) {
+        return undefined;
+      }
+      const response = yield* iam
+        .getSSHPublicKey({
+          UserName: output.userName,
+          SSHPublicKeyId: output.sshPublicKeyId,
+          Encoding: "SSH",
+        })
+        .pipe(
+          Effect.catchTag("NoSuchEntityException", () =>
+            Effect.succeed(undefined),
+          ),
+        );
+      if (!response?.SSHPublicKey?.SSHPublicKeyId) {
+        return undefined;
+      }
+      return {
+        userName: response.SSHPublicKey.UserName,
+        sshPublicKeyId: response.SSHPublicKey.SSHPublicKeyId,
+        fingerprint: response.SSHPublicKey.Fingerprint,
+        sshPublicKeyBody: response.SSHPublicKey.SSHPublicKeyBody,
+        status: response.SSHPublicKey.Status,
+        uploadDate: response.SSHPublicKey.UploadDate,
+      };
+    }),
+    create: Effect.fn(function* ({ news, session }) {
+      const created = yield* iam.uploadSSHPublicKey({
+        UserName: news.userName,
+        SSHPublicKeyBody: news.sshPublicKeyBody,
+      });
+      if (!created.SSHPublicKey?.SSHPublicKeyId) {
+        return yield* Effect.fail(
+          new Error(`uploadSSHPublicKey returned no key id`),
+        );
+      }
+      if (
+        news.status !== undefined &&
+        created.SSHPublicKey.Status !== news.status
+      ) {
+        yield* iam.updateSSHPublicKey({
+          UserName: news.userName,
+          SSHPublicKeyId: created.SSHPublicKey.SSHPublicKeyId,
+          Status: news.status,
+        });
+      }
+      yield* session.note(created.SSHPublicKey.SSHPublicKeyId);
+      return {
+        userName: created.SSHPublicKey.UserName,
+        sshPublicKeyId: created.SSHPublicKey.SSHPublicKeyId,
+        fingerprint: created.SSHPublicKey.Fingerprint,
+        sshPublicKeyBody: created.SSHPublicKey.SSHPublicKeyBody,
+        status: news.status ?? created.SSHPublicKey.Status,
+        uploadDate: created.SSHPublicKey.UploadDate,
+      };
+    }),
+    update: Effect.fn(function* ({ news, output, session }) {
+      const status = news.status ?? output.status;
+      if (status !== output.status) {
+        yield* iam.updateSSHPublicKey({
+          UserName: output.userName,
+          SSHPublicKeyId: output.sshPublicKeyId,
+          Status: status,
+        });
+      }
+      yield* session.note(output.sshPublicKeyId);
+      return {
+        ...output,
+        status,
+      };
+    }),
+    delete: Effect.fn(function* ({ output }) {
+      yield* iam
+        .deleteSSHPublicKey({
+          UserName: output.userName,
+          SSHPublicKeyId: output.sshPublicKeyId,
+        })
+        .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.void));
+    }),
+  });

package/src/AWS/IAM/ServerCertificate.ts

@@ -0,0 +1,261 @@
+import * as iam from "@distilled.cloud/aws/iam";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import { isResolved } from "../../Diff.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import { Resource } from "../../Resource.ts";
+import {
+  createInternalTags,
+  createTagsList,
+  diffTags,
+  hasTags,
+} from "../../Tags.ts";
+import { toTagRecord } from "./common.ts";
+
+export interface ServerCertificateProps {
+  /**
+   * Name of the server certificate. If omitted, a deterministic name is generated.
+   */
+  serverCertificateName?: string;
+  /**
+   * Optional IAM path prefix.
+   * @default "/"
+   */
+  path?: string;
+  /**
+   * PEM-encoded leaf certificate body.
+   */
+  certificateBody: string;
+  /**
+   * PEM-encoded private key. AWS never returns this after upload.
+   */
+  privateKey: Redacted.Redacted<string> | string;
+  /**
+   * Optional PEM-encoded certificate chain.
+   */
+  certificateChain?: string;
+  /**
+   * User-defined tags.
+   */
+  tags?: Record<string, string>;
+}
+
+export interface ServerCertificate extends Resource<
+  "AWS.IAM.ServerCertificate",
+  ServerCertificateProps,
+  {
+    serverCertificateArn: string;
+    serverCertificateName: string;
+    serverCertificateId: string | undefined;
+    path: string | undefined;
+    certificateBody: string;
+    certificateChain: string | undefined;
+    uploadDate: Date | undefined;
+    expiration: Date | undefined;
+    tags: Record<string, string>;
+  }
+> {}
+
+/**
+ * An IAM server certificate.
+ *
+ * `ServerCertificate` uploads and tracks a TLS certificate bundle for legacy
+ * IAM-integrated services. The private key is write-only and should be provided
+ * as a redacted value when possible.
+ *
+ * @section Uploading Server Certificates
+ * @example Upload a TLS Certificate
+ * ```typescript
+ * const certificate = yield* ServerCertificate("ApiTlsCertificate", {
+ *   certificateBody: "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----",
+ *   privateKey: Redacted.make(
+ *     "-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----",
+ *   ),
+ *   certificateChain: "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----",
+ * });
+ * ```
+ */
+export const ServerCertificate = Resource<ServerCertificate>(
+  "AWS.IAM.ServerCertificate",
+);
+
+export const ServerCertificateProvider = () =>
+  ServerCertificate.provider.effect(
+    Effect.gen(function* () {
+      const toName = (id: string, props: ServerCertificateProps) =>
+        props.serverCertificateName
+          ? Effect.succeed(props.serverCertificateName)
+          : createPhysicalName({ id, maxLength: 128 });
+
+      const readCertificate = Effect.fn(function* (name: string) {
+        const response = yield* iam
+          .getServerCertificate({
+            ServerCertificateName: name,
+          })
+          .pipe(
+            Effect.catchTag("NoSuchEntityException", () =>
+              Effect.succeed(undefined),
+            ),
+          );
+        return response?.ServerCertificate;
+      });
+
+      return {
+        stables: [
+          "serverCertificateArn",
+          "serverCertificateName",
+          "serverCertificateId",
+        ],
+        diff: Effect.fn(function* ({ id, olds, news }) {
+          if (!isResolved(news)) return;
+          if (
+            (yield* toName(id, olds ?? ({} as ServerCertificateProps))) !==
+              (yield* toName(id, news)) ||
+            (olds.path ?? "/") !== (news.path ?? "/") ||
+            olds.certificateBody !== news.certificateBody ||
+            olds.certificateChain !== news.certificateChain
+          ) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+          const name =
+            output?.serverCertificateName ??
+            (yield* toName(id, olds ?? ({} as ServerCertificateProps)));
+          const cert = yield* readCertificate(name);
+          if (!cert?.ServerCertificateMetadata?.Arn) {
+            return undefined;
+          }
+          const tags = yield* iam.listServerCertificateTags({
+            ServerCertificateName: name,
+          });
+          return {
+            serverCertificateArn: cert.ServerCertificateMetadata.Arn,
+            serverCertificateName:
+              cert.ServerCertificateMetadata.ServerCertificateName,
+            serverCertificateId:
+              cert.ServerCertificateMetadata.ServerCertificateId,
+            path: cert.ServerCertificateMetadata.Path,
+            certificateBody: cert.CertificateBody,
+            certificateChain: cert.CertificateChain,
+            uploadDate: cert.ServerCertificateMetadata.UploadDate,
+            expiration: cert.ServerCertificateMetadata.Expiration,
+            tags: toTagRecord(tags.Tags),
+          };
+        }),
+        create: Effect.fn(function* ({ id, news, session }) {
+          const name = yield* toName(id, news);
+          const tags = {
+            ...(yield* createInternalTags(id)),
+            ...news.tags,
+          };
+          const created = yield* iam
+            .uploadServerCertificate({
+              Path: news.path,
+              ServerCertificateName: name,
+              CertificateBody: news.certificateBody,
+              PrivateKey:
+                typeof news.privateKey === "string"
+                  ? news.privateKey
+                  : Redacted.value(news.privateKey),
+              CertificateChain: news.certificateChain,
+              Tags: createTagsList(tags),
+            })
+            .pipe(
+              Effect.catchTag("EntityAlreadyExistsException", () =>
+                Effect.gen(function* () {
+                  const existing = yield* readCertificate(name);
+                  if (!existing?.ServerCertificateMetadata?.Arn) {
+                    return yield* Effect.fail(
+                      new Error(
+                        `Server certificate '${name}' already exists but could not be described`,
+                      ),
+                    );
+                  }
+                  if (!hasTags(tags, existing.Tags)) {
+                    return yield* Effect.fail(
+                      new Error(
+                        `Server certificate '${name}' already exists and is not managed by alchemy`,
+                      ),
+                    );
+                  }
+                  return {
+                    ServerCertificateMetadata:
+                      existing.ServerCertificateMetadata,
+                  };
+                }),
+              ),
+            );
+          const metadata = created.ServerCertificateMetadata;
+          if (!metadata?.Arn || !metadata.ServerCertificateName) {
+            return yield* Effect.fail(
+              new Error(`uploadServerCertificate returned no metadata`),
+            );
+          }
+          yield* session.note(metadata.Arn);
+          return {
+            serverCertificateArn: metadata.Arn,
+            serverCertificateName: metadata.ServerCertificateName,
+            serverCertificateId: metadata.ServerCertificateId,
+            path: metadata.Path,
+            certificateBody: news.certificateBody,
+            certificateChain: news.certificateChain,
+            uploadDate: metadata.UploadDate,
+            expiration: metadata.Expiration,
+            tags,
+          };
+        }),
+        update: Effect.fn(function* ({ id, news, olds, output, session }) {
+          const oldTags = {
+            ...(yield* createInternalTags(id)),
+            ...olds.tags,
+          };
+          const newTags = {
+            ...(yield* createInternalTags(id)),
+            ...news.tags,
+          };
+          const { removed, upsert } = diffTags(oldTags, newTags);
+          if (upsert.length > 0) {
+            yield* iam.tagServerCertificate({
+              ServerCertificateName: output.serverCertificateName,
+              Tags: upsert,
+            });
+          }
+          if (removed.length > 0) {
+            yield* iam.untagServerCertificate({
+              ServerCertificateName: output.serverCertificateName,
+              TagKeys: removed,
+            });
+          }
+          const cert = yield* readCertificate(output.serverCertificateName);
+          yield* session.note(output.serverCertificateArn);
+          return {
+            serverCertificateArn:
+              cert?.ServerCertificateMetadata?.Arn ??
+              output.serverCertificateArn,
+            serverCertificateName:
+              cert?.ServerCertificateMetadata?.ServerCertificateName ??
+              output.serverCertificateName,
+            serverCertificateId:
+              cert?.ServerCertificateMetadata?.ServerCertificateId ??
+              output.serverCertificateId,
+            path: cert?.ServerCertificateMetadata?.Path ?? output.path,
+            certificateBody: cert?.CertificateBody ?? output.certificateBody,
+            certificateChain: cert?.CertificateChain ?? output.certificateChain,
+            uploadDate:
+              cert?.ServerCertificateMetadata?.UploadDate ?? output.uploadDate,
+            expiration:
+              cert?.ServerCertificateMetadata?.Expiration ?? output.expiration,
+            tags: newTags,
+          };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* iam
+            .deleteServerCertificate({
+              ServerCertificateName: output.serverCertificateName,
+            })
+            .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.void));
+        }),
+      };
+    }),
+  );

package/src/AWS/IAM/ServiceSpecificCredential.ts

@@ -0,0 +1,172 @@
+import * as iam from "@distilled.cloud/aws/iam";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import { isResolved } from "../../Diff.ts";
+import { Resource } from "../../Resource.ts";
+import { toRedactedString } from "./common.ts";
+
+export interface ServiceSpecificCredentialProps {
+  /**
+   * User that owns the service-specific credential.
+   */
+  userName: string;
+  /**
+   * AWS service name that will consume the credential.
+   */
+  serviceName: string;
+  /**
+   * Optional credential age in days.
+   */
+  credentialAgeDays?: number;
+  /**
+   * Desired credential status.
+   * @default "Active"
+   */
+  status?: iam.StatusType;
+}
+
+export interface ServiceSpecificCredential extends Resource<
+  "AWS.IAM.ServiceSpecificCredential",
+  ServiceSpecificCredentialProps,
+  {
+    userName: string;
+    serviceName: string;
+    serviceSpecificCredentialId: string;
+    status: iam.StatusType;
+    createDate: Date | undefined;
+    expirationDate: Date | undefined;
+    serviceUserName: string | undefined;
+    serviceCredentialAlias: string | undefined;
+    servicePassword: Redacted.Redacted<string> | undefined;
+    serviceCredentialSecret: Redacted.Redacted<string> | undefined;
+  }
+> {}
+
+/**
+ * A service-specific IAM credential.
+ *
+ * `ServiceSpecificCredential` creates service-bound credentials such as
+ * CodeCommit HTTPS passwords for an IAM user. AWS only returns the secret
+ * fields during creation, so subsequent reads preserve the originally stored
+ * redacted values.
+ *
+ * @section Managing Service Credentials
+ * @example Create a CodeCommit Credential
+ * ```typescript
+ * const user = yield* User("CodeCommitUser", {
+ *   userName: "codecommit-user",
+ * });
+ *
+ * const credential = yield* ServiceSpecificCredential("CodeCommitCredential", {
+ *   userName: user.userName,
+ *   serviceName: "codecommit.amazonaws.com",
+ * });
+ * ```
+ */
+export const ServiceSpecificCredential = Resource<ServiceSpecificCredential>(
+  "AWS.IAM.ServiceSpecificCredential",
+);
+
+export const ServiceSpecificCredentialProvider = () =>
+  ServiceSpecificCredential.provider.succeed({
+    stables: ["serviceSpecificCredentialId"],
+    diff: Effect.fn(function* ({ olds, news }) {
+      if (!isResolved(news)) return;
+      if (
+        olds.userName !== news.userName ||
+        olds.serviceName !== news.serviceName ||
+        olds.credentialAgeDays !== news.credentialAgeDays
+      ) {
+        return { action: "replace" } as const;
+      }
+    }),
+    read: Effect.fn(function* ({ output }) {
+      if (!output) {
+        return undefined;
+      }
+      const listed = yield* iam.listServiceSpecificCredentials({
+        UserName: output.userName,
+        ServiceName: output.serviceName,
+      });
+      const metadata = listed.ServiceSpecificCredentials?.find(
+        (entry) =>
+          entry.ServiceSpecificCredentialId ===
+          output.serviceSpecificCredentialId,
+      );
+      if (!metadata?.ServiceSpecificCredentialId) {
+        return undefined;
+      }
+      return {
+        userName: metadata.UserName,
+        serviceName: metadata.ServiceName,
+        serviceSpecificCredentialId: metadata.ServiceSpecificCredentialId,
+        status: metadata.Status,
+        createDate: metadata.CreateDate,
+        expirationDate: metadata.ExpirationDate,
+        serviceUserName: metadata.ServiceUserName,
+        serviceCredentialAlias: metadata.ServiceCredentialAlias,
+        servicePassword: output.servicePassword,
+        serviceCredentialSecret: output.serviceCredentialSecret,
+      };
+    }),
+    create: Effect.fn(function* ({ news, session }) {
+      const created = yield* iam.createServiceSpecificCredential({
+        UserName: news.userName,
+        ServiceName: news.serviceName,
+        CredentialAgeDays: news.credentialAgeDays,
+      });
+      const credential = created.ServiceSpecificCredential;
+      if (!credential?.ServiceSpecificCredentialId) {
+        return yield* Effect.fail(
+          new Error(
+            `createServiceSpecificCredential returned no credential id`,
+          ),
+        );
+      }
+      if (news.status !== undefined && credential.Status !== news.status) {
+        yield* iam.updateServiceSpecificCredential({
+          UserName: news.userName,
+          ServiceSpecificCredentialId: credential.ServiceSpecificCredentialId,
+          Status: news.status,
+        });
+      }
+      yield* session.note(credential.ServiceSpecificCredentialId);
+      return {
+        userName: credential.UserName,
+        serviceName: credential.ServiceName,
+        serviceSpecificCredentialId: credential.ServiceSpecificCredentialId,
+        status: news.status ?? credential.Status,
+        createDate: credential.CreateDate,
+        expirationDate: credential.ExpirationDate,
+        serviceUserName: credential.ServiceUserName,
+        serviceCredentialAlias: credential.ServiceCredentialAlias,
+        servicePassword: toRedactedString(credential.ServicePassword),
+        serviceCredentialSecret: toRedactedString(
+          credential.ServiceCredentialSecret,
+        ),
+      };
+    }),
+    update: Effect.fn(function* ({ news, output, session }) {
+      const status = news.status ?? output.status;
+      if (status !== output.status) {
+        yield* iam.updateServiceSpecificCredential({
+          UserName: output.userName,
+          ServiceSpecificCredentialId: output.serviceSpecificCredentialId,
+          Status: status,
+        });
+      }
+      yield* session.note(output.serviceSpecificCredentialId);
+      return {
+        ...output,
+        status,
+      };
+    }),
+    delete: Effect.fn(function* ({ output }) {
+      yield* iam
+        .deleteServiceSpecificCredential({
+          UserName: output.userName,
+          ServiceSpecificCredentialId: output.serviceSpecificCredentialId,
+        })
+        .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.void));
+    }),
+  });