alchemy 2.0.0-beta.16 → 2.0.0-beta.18

package/src/AWS/CloudFront/OriginRequestPolicy.ts

@@ -0,0 +1,256 @@
+import * as cloudfront from "@distilled.cloud/aws/cloudfront";
+import * as Effect from "effect/Effect";
+import { isResolved } from "../../Diff.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+
+export interface OriginRequestPolicyProps {
+  /**
+   * Name of the origin request policy. If omitted, a deterministic name is
+   * generated. Names must be unique per AWS account. Changing the name
+   * triggers a replacement.
+   */
+  name?: string;
+  /**
+   * Optional comment describing the policy.
+   */
+  comment?: string;
+  /**
+   * Headers to forward to the origin (in addition to the cache key).
+   */
+  headersConfig: cloudfront.OriginRequestPolicyHeadersConfig;
+  /**
+   * Cookies to forward to the origin (in addition to the cache key).
+   */
+  cookiesConfig: cloudfront.OriginRequestPolicyCookiesConfig;
+  /**
+   * Query strings to forward to the origin (in addition to the cache key).
+   */
+  queryStringsConfig: cloudfront.OriginRequestPolicyQueryStringsConfig;
+}
+
+export interface OriginRequestPolicy extends Resource<
+  "AWS.CloudFront.OriginRequestPolicy",
+  OriginRequestPolicyProps,
+  {
+    /**
+     * CloudFront-assigned origin request policy identifier.
+     */
+    originRequestPolicyId: string;
+    /**
+     * Name of the origin request policy.
+     */
+    name: string;
+    /**
+     * Most recent entity tag for update/delete operations.
+     */
+    etag: string | undefined;
+    /**
+     * Current comment on the policy.
+     */
+    comment: string | undefined;
+    /**
+     * Current headers configuration.
+     */
+    headersConfig: cloudfront.OriginRequestPolicyHeadersConfig;
+    /**
+     * Current cookies configuration.
+     */
+    cookiesConfig: cloudfront.OriginRequestPolicyCookiesConfig;
+    /**
+     * Current query strings configuration.
+     */
+    queryStringsConfig: cloudfront.OriginRequestPolicyQueryStringsConfig;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * A CloudFront origin request policy.
+ *
+ * Origin request policies control which values from the viewer request (in
+ * addition to those used in the cache key) CloudFront includes when sending
+ * a request to the origin. They are referenced by ID on a Distribution's
+ * default behavior or per-path cache behaviors.
+ *
+ * @section Creating Origin Request Policies
+ * @example Forward all viewer headers and cookies
+ * ```typescript
+ * const originRequestPolicy = yield* OriginRequestPolicy("AppOriginRequest", {
+ *   comment: "Forward auth + locale",
+ *   headersConfig: {
+ *     HeaderBehavior: "whitelist",
+ *     Headers: { Quantity: 2, Items: ["Authorization", "Accept-Language"] },
+ *   },
+ *   cookiesConfig: { CookieBehavior: "all" },
+ *   queryStringsConfig: { QueryStringBehavior: "all" },
+ * });
+ * ```
+ */
+export const OriginRequestPolicy = Resource<OriginRequestPolicy>(
+  "AWS.CloudFront.OriginRequestPolicy",
+);
+
+export const OriginRequestPolicyProvider = () =>
+  Provider.effect(
+    OriginRequestPolicy,
+    Effect.gen(function* () {
+      const getById = Effect.fn(function* (id: string) {
+        const config = yield* cloudfront
+          .getOriginRequestPolicyConfig({ Id: id })
+          .pipe(
+            Effect.catchTag("NoSuchOriginRequestPolicy", () =>
+              Effect.succeed(undefined),
+            ),
+          );
+        if (!config?.OriginRequestPolicyConfig) return undefined;
+        return { config: config.OriginRequestPolicyConfig, etag: config.ETag };
+      });
+
+      const getByName = Effect.fn(function* (name: string) {
+        const listed = yield* cloudfront.listOriginRequestPolicies({
+          Type: "custom",
+        });
+        const summary = listed.OriginRequestPolicyList?.Items?.find(
+          (item) =>
+            item.OriginRequestPolicy?.OriginRequestPolicyConfig?.Name === name,
+        );
+        if (!summary?.OriginRequestPolicy?.Id) return undefined;
+        return yield* getById(summary.OriginRequestPolicy.Id).pipe(
+          Effect.map((found) =>
+            found ? { id: summary.OriginRequestPolicy.Id, ...found } : undefined,
+          ),
+        );
+      });
+
+      const buildConfig = (
+        name: string,
+        props: OriginRequestPolicyProps,
+      ): cloudfront.OriginRequestPolicyConfig => ({
+        Name: name,
+        Comment: props.comment,
+        HeadersConfig: props.headersConfig,
+        CookiesConfig: props.cookiesConfig,
+        QueryStringsConfig: props.queryStringsConfig,
+      });
+
+      const toAttrs = (
+        id: string,
+        config: cloudfront.OriginRequestPolicyConfig,
+        etag: string | undefined,
+      ) => ({
+        originRequestPolicyId: id,
+        name: config.Name,
+        etag,
+        comment: config.Comment,
+        headersConfig: config.HeadersConfig,
+        cookiesConfig: config.CookiesConfig,
+        queryStringsConfig: config.QueryStringsConfig,
+      });
+
+      return {
+        stables: ["originRequestPolicyId"],
+        diff: Effect.fn(function* ({ id, news, olds }) {
+          if (!isResolved(news)) return undefined;
+          if (
+            (yield* createName(id, olds ?? {})) !==
+            (yield* createName(id, news))
+          ) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+          if (output?.originRequestPolicyId) {
+            const found = yield* getById(output.originRequestPolicyId);
+            if (found) {
+              return toAttrs(output.originRequestPolicyId, found.config, found.etag);
+            }
+          }
+          const name = yield* createName(id, olds ?? {});
+          const found = yield* getByName(name);
+          if (!found) return undefined;
+          return toAttrs(found.id, found.config, found.etag);
+        }),
+        create: Effect.fn(function* ({ id, news, session }) {
+          const name = yield* createName(id, news);
+          const created = yield* cloudfront
+            .createOriginRequestPolicy({
+              OriginRequestPolicyConfig: buildConfig(name, news),
+            })
+            .pipe(
+              Effect.catchTag("OriginRequestPolicyAlreadyExists", () =>
+                getByName(name).pipe(
+                  Effect.flatMap((existing) =>
+                    existing
+                      ? Effect.succeed({
+                          OriginRequestPolicy: {
+                            Id: existing.id,
+                            LastModifiedTime: new Date(),
+                            OriginRequestPolicyConfig: existing.config,
+                          },
+                          ETag: existing.etag,
+                          Location: undefined,
+                        })
+                      : Effect.fail(
+                          new Error(
+                            `Origin request policy '${name}' already exists but could not be recovered`,
+                          ),
+                        ),
+                  ),
+                ),
+              ),
+            );
+          if (!created.OriginRequestPolicy?.Id) {
+            return yield* Effect.fail(
+              new Error("createOriginRequestPolicy returned no identifier"),
+            );
+          }
+          yield* session.note(created.OriginRequestPolicy.Id);
+          return toAttrs(
+            created.OriginRequestPolicy.Id,
+            created.OriginRequestPolicy.OriginRequestPolicyConfig,
+            created.ETag,
+          );
+        }),
+        update: Effect.fn(function* ({ news, output, session }) {
+          const current = yield* getById(output.originRequestPolicyId);
+          const updated = yield* cloudfront.updateOriginRequestPolicy({
+            Id: output.originRequestPolicyId,
+            IfMatch: current?.etag ?? output.etag,
+            OriginRequestPolicyConfig: buildConfig(output.name, news),
+          });
+          if (!updated.OriginRequestPolicy?.Id) {
+            return yield* Effect.fail(
+              new Error("updateOriginRequestPolicy returned no identifier"),
+            );
+          }
+          yield* session.note(output.originRequestPolicyId);
+          return toAttrs(
+            updated.OriginRequestPolicy.Id,
+            updated.OriginRequestPolicy.OriginRequestPolicyConfig,
+            updated.ETag,
+          );
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          const current = yield* getById(output.originRequestPolicyId);
+          if (!current) return;
+          yield* cloudfront
+            .deleteOriginRequestPolicy({
+              Id: output.originRequestPolicyId,
+              IfMatch: current.etag,
+            })
+            .pipe(
+              Effect.catchTag("NoSuchOriginRequestPolicy", () => Effect.void),
+            );
+        }),
+      };
+    }),
+  );
+
+const createName = (id: string, props: OriginRequestPolicyProps) =>
+  props.name
+    ? Effect.succeed(props.name)
+    : createPhysicalName({ id, maxLength: 128, lowercase: true });

package/src/AWS/CloudFront/PublicKey.ts

@@ -0,0 +1,245 @@
+import * as cloudfront from "@distilled.cloud/aws/cloudfront";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import { isResolved } from "../../Diff.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import { extractValue } from "./common.ts";
+
+export interface PublicKeyProps {
+  /**
+   * Name of the public key. If omitted, a deterministic name is generated.
+   *
+   * Names must be unique per AWS account. Changing the name triggers
+   * a replacement.
+   */
+  name?: string;
+  /**
+   * PEM-encoded public key body. Changing the key material triggers a
+   * replacement (CloudFront does not allow rotating an existing public
+   * key in place).
+   */
+  encodedKey: Redacted.Redacted<string> | string;
+  /**
+   * Optional comment describing the key.
+   */
+  comment?: string;
+}
+
+export interface PublicKey extends Resource<
+  "AWS.CloudFront.PublicKey",
+  PublicKeyProps,
+  {
+    /**
+     * CloudFront-assigned public key identifier. Used by KeyGroups to
+     * reference the key.
+     */
+    publicKeyId: string;
+    /**
+     * Name of the public key.
+     */
+    name: string;
+    /**
+     * PEM-encoded public key body.
+     */
+    encodedKey: string;
+    /**
+     * Caller reference used at create time. Stable across updates.
+     */
+    callerReference: string;
+    /**
+     * Most recent entity tag for update/delete operations.
+     */
+    etag: string | undefined;
+    /**
+     * Current comment on the key.
+     */
+    comment: string | undefined;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * A CloudFront public key.
+ *
+ * Public keys are uploaded ahead of being grouped into a {@link KeyGroup} and
+ * used by Distributions for signed URL or signed cookie verification.
+ *
+ * The key body is immutable after creation — changing `encodedKey` triggers
+ * a replacement (CloudFront returns no API to rotate a key in place).
+ *
+ * @section Creating Public Keys
+ * @example PEM-encoded RSA public key
+ * ```typescript
+ * const key = yield* PublicKey("SignedUrlKey", {
+ *   encodedKey: Redacted.make(yield* fs.readFileString("./public_key.pem")),
+ *   comment: "RSA-2048 signed URL key for /private",
+ * });
+ * ```
+ */
+export const PublicKey = Resource<PublicKey>("AWS.CloudFront.PublicKey");
+
+export const PublicKeyProvider = () =>
+  Provider.effect(
+    PublicKey,
+    Effect.gen(function* () {
+      const getById = Effect.fn(function* (id: string) {
+        const config = yield* cloudfront
+          .getPublicKeyConfig({ Id: id })
+          .pipe(
+            Effect.catchTag("NoSuchPublicKey", () => Effect.succeed(undefined)),
+          );
+        if (!config?.PublicKeyConfig) return undefined;
+        return { config: config.PublicKeyConfig, etag: config.ETag };
+      });
+
+      const getByName = Effect.fn(function* (name: string) {
+        const listed = yield* cloudfront.listPublicKeys({});
+        const summary = listed.PublicKeyList?.Items?.find(
+          (item) => item.Name === name,
+        );
+        if (!summary?.Id) return undefined;
+        return yield* getById(summary.Id).pipe(
+          Effect.map((found) =>
+            found ? { id: summary.Id, ...found } : undefined,
+          ),
+        );
+      });
+
+      const buildConfig = (
+        name: string,
+        callerReference: string,
+        props: PublicKeyProps,
+      ): cloudfront.PublicKeyConfig => ({
+        Name: name,
+        CallerReference: callerReference,
+        EncodedKey: extractValue(props.encodedKey),
+        Comment: props.comment,
+      });
+
+      const toAttrs = (
+        id: string,
+        config: cloudfront.PublicKeyConfig,
+        etag: string | undefined,
+      ) => ({
+        publicKeyId: id,
+        name: config.Name,
+        encodedKey: config.EncodedKey,
+        callerReference: config.CallerReference,
+        etag,
+        comment: config.Comment,
+      });
+
+      return {
+        stables: ["publicKeyId", "callerReference"],
+        diff: Effect.fn(function* ({ id, news, olds }) {
+          if (!isResolved(news)) return undefined;
+          if (
+            (yield* createName(id, olds ?? {})) !==
+            (yield* createName(id, news))
+          ) {
+            return { action: "replace" } as const;
+          }
+          if (
+            isResolved(olds.encodedKey) &&
+            extractValue(olds.encodedKey) !== extractValue(news.encodedKey)
+          ) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+          if (output?.publicKeyId) {
+            const found = yield* getById(output.publicKeyId);
+            if (found) return toAttrs(output.publicKeyId, found.config, found.etag);
+          }
+          const name = yield* createName(id, olds ?? {});
+          const found = yield* getByName(name);
+          if (!found) return undefined;
+          return toAttrs(found.id, found.config, found.etag);
+        }),
+        create: Effect.fn(function* ({ id, news, session }) {
+          const name = yield* createName(id, news);
+          const callerReference = name;
+          const created = yield* cloudfront
+            .createPublicKey({
+              PublicKeyConfig: buildConfig(name, callerReference, news),
+            })
+            .pipe(
+              Effect.catchTag("PublicKeyAlreadyExists", () =>
+                getByName(name).pipe(
+                  Effect.flatMap((existing) =>
+                    existing
+                      ? Effect.succeed({
+                          PublicKey: {
+                            Id: existing.id,
+                            CreatedTime: new Date(),
+                            PublicKeyConfig: existing.config,
+                          },
+                          ETag: existing.etag,
+                          Location: undefined,
+                        })
+                      : Effect.fail(
+                          new Error(
+                            `Public key '${name}' already exists but could not be recovered`,
+                          ),
+                        ),
+                  ),
+                ),
+              ),
+            );
+          if (!created.PublicKey?.Id) {
+            return yield* Effect.fail(
+              new Error("createPublicKey returned no identifier"),
+            );
+          }
+          yield* session.note(created.PublicKey.Id);
+          return toAttrs(
+            created.PublicKey.Id,
+            created.PublicKey.PublicKeyConfig,
+            created.ETag,
+          );
+        }),
+        update: Effect.fn(function* ({ news, output, session }) {
+          const current = yield* getById(output.publicKeyId);
+          const updated = yield* cloudfront.updatePublicKey({
+            Id: output.publicKeyId,
+            IfMatch: current?.etag ?? output.etag,
+            PublicKeyConfig: buildConfig(
+              output.name,
+              output.callerReference,
+              news,
+            ),
+          });
+          if (!updated.PublicKey?.Id) {
+            return yield* Effect.fail(
+              new Error("updatePublicKey returned no identifier"),
+            );
+          }
+          yield* session.note(output.publicKeyId);
+          return toAttrs(
+            updated.PublicKey.Id,
+            updated.PublicKey.PublicKeyConfig,
+            updated.ETag,
+          );
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          const current = yield* getById(output.publicKeyId);
+          if (!current) return;
+          yield* cloudfront
+            .deletePublicKey({
+              Id: output.publicKeyId,
+              IfMatch: current.etag,
+            })
+            .pipe(Effect.catchTag("NoSuchPublicKey", () => Effect.void));
+        }),
+      };
+    }),
+  );
+
+const createName = (id: string, props: PublicKeyProps) =>
+  props.name
+    ? Effect.succeed(props.name)
+    : createPhysicalName({ id, maxLength: 128, lowercase: true });