alchemy 2.0.0-beta.17 → 2.0.0-beta.18

package/lib/AWS/CloudFront/OriginRequestPolicy.js

@@ -0,0 +1,139 @@
+import * as cloudfront from "@distilled.cloud/aws/cloudfront";
+import * as Effect from "effect/Effect";
+import { isResolved } from "../../Diff.js";
+import { createPhysicalName } from "../../PhysicalName.js";
+import * as Provider from "../../Provider.js";
+import { Resource } from "../../Resource.js";
+/**
+ * A CloudFront origin request policy.
+ *
+ * Origin request policies control which values from the viewer request (in
+ * addition to those used in the cache key) CloudFront includes when sending
+ * a request to the origin. They are referenced by ID on a Distribution's
+ * default behavior or per-path cache behaviors.
+ *
+ * @section Creating Origin Request Policies
+ * @example Forward all viewer headers and cookies
+ * ```typescript
+ * const originRequestPolicy = yield* OriginRequestPolicy("AppOriginRequest", {
+ *   comment: "Forward auth + locale",
+ *   headersConfig: {
+ *     HeaderBehavior: "whitelist",
+ *     Headers: { Quantity: 2, Items: ["Authorization", "Accept-Language"] },
+ *   },
+ *   cookiesConfig: { CookieBehavior: "all" },
+ *   queryStringsConfig: { QueryStringBehavior: "all" },
+ * });
+ * ```
+ */
+export const OriginRequestPolicy = Resource("AWS.CloudFront.OriginRequestPolicy");
+export const OriginRequestPolicyProvider = () => Provider.effect(OriginRequestPolicy, Effect.gen(function* () {
+    const getById = Effect.fn(function* (id) {
+        const config = yield* cloudfront
+            .getOriginRequestPolicyConfig({ Id: id })
+            .pipe(Effect.catchTag("NoSuchOriginRequestPolicy", () => Effect.succeed(undefined)));
+        if (!config?.OriginRequestPolicyConfig)
+            return undefined;
+        return { config: config.OriginRequestPolicyConfig, etag: config.ETag };
+    });
+    const getByName = Effect.fn(function* (name) {
+        const listed = yield* cloudfront.listOriginRequestPolicies({
+            Type: "custom",
+        });
+        const summary = listed.OriginRequestPolicyList?.Items?.find((item) => item.OriginRequestPolicy?.OriginRequestPolicyConfig?.Name === name);
+        if (!summary?.OriginRequestPolicy?.Id)
+            return undefined;
+        return yield* getById(summary.OriginRequestPolicy.Id).pipe(Effect.map((found) => found ? { id: summary.OriginRequestPolicy.Id, ...found } : undefined));
+    });
+    const buildConfig = (name, props) => ({
+        Name: name,
+        Comment: props.comment,
+        HeadersConfig: props.headersConfig,
+        CookiesConfig: props.cookiesConfig,
+        QueryStringsConfig: props.queryStringsConfig,
+    });
+    const toAttrs = (id, config, etag) => ({
+        originRequestPolicyId: id,
+        name: config.Name,
+        etag,
+        comment: config.Comment,
+        headersConfig: config.HeadersConfig,
+        cookiesConfig: config.CookiesConfig,
+        queryStringsConfig: config.QueryStringsConfig,
+    });
+    return {
+        stables: ["originRequestPolicyId"],
+        diff: Effect.fn(function* ({ id, news, olds }) {
+            if (!isResolved(news))
+                return undefined;
+            if ((yield* createName(id, olds ?? {})) !==
+                (yield* createName(id, news))) {
+                return { action: "replace" };
+            }
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+            if (output?.originRequestPolicyId) {
+                const found = yield* getById(output.originRequestPolicyId);
+                if (found) {
+                    return toAttrs(output.originRequestPolicyId, found.config, found.etag);
+                }
+            }
+            const name = yield* createName(id, olds ?? {});
+            const found = yield* getByName(name);
+            if (!found)
+                return undefined;
+            return toAttrs(found.id, found.config, found.etag);
+        }),
+        create: Effect.fn(function* ({ id, news, session }) {
+            const name = yield* createName(id, news);
+            const created = yield* cloudfront
+                .createOriginRequestPolicy({
+                OriginRequestPolicyConfig: buildConfig(name, news),
+            })
+                .pipe(Effect.catchTag("OriginRequestPolicyAlreadyExists", () => getByName(name).pipe(Effect.flatMap((existing) => existing
+                ? Effect.succeed({
+                    OriginRequestPolicy: {
+                        Id: existing.id,
+                        LastModifiedTime: new Date(),
+                        OriginRequestPolicyConfig: existing.config,
+                    },
+                    ETag: existing.etag,
+                    Location: undefined,
+                })
+                : Effect.fail(new Error(`Origin request policy '${name}' already exists but could not be recovered`))))));
+            if (!created.OriginRequestPolicy?.Id) {
+                return yield* Effect.fail(new Error("createOriginRequestPolicy returned no identifier"));
+            }
+            yield* session.note(created.OriginRequestPolicy.Id);
+            return toAttrs(created.OriginRequestPolicy.Id, created.OriginRequestPolicy.OriginRequestPolicyConfig, created.ETag);
+        }),
+        update: Effect.fn(function* ({ news, output, session }) {
+            const current = yield* getById(output.originRequestPolicyId);
+            const updated = yield* cloudfront.updateOriginRequestPolicy({
+                Id: output.originRequestPolicyId,
+                IfMatch: current?.etag ?? output.etag,
+                OriginRequestPolicyConfig: buildConfig(output.name, news),
+            });
+            if (!updated.OriginRequestPolicy?.Id) {
+                return yield* Effect.fail(new Error("updateOriginRequestPolicy returned no identifier"));
+            }
+            yield* session.note(output.originRequestPolicyId);
+            return toAttrs(updated.OriginRequestPolicy.Id, updated.OriginRequestPolicy.OriginRequestPolicyConfig, updated.ETag);
+        }),
+        delete: Effect.fn(function* ({ output }) {
+            const current = yield* getById(output.originRequestPolicyId);
+            if (!current)
+                return;
+            yield* cloudfront
+                .deleteOriginRequestPolicy({
+                Id: output.originRequestPolicyId,
+                IfMatch: current.etag,
+            })
+                .pipe(Effect.catchTag("NoSuchOriginRequestPolicy", () => Effect.void));
+        }),
+    };
+}));
+const createName = (id, props) => props.name
+    ? Effect.succeed(props.name)
+    : createPhysicalName({ id, maxLength: 128, lowercase: true });
+//# sourceMappingURL=OriginRequestPolicy.js.map

package/lib/AWS/CloudFront/OriginRequestPolicy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"OriginRequestPolicy.js","sourceRoot":"","sources":["../../../src/AWS/CloudFront/OriginRequestPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAC9D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAiE7C;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,QAAQ,CACzC,oCAAoC,CACrC,CAAC;AAEF,MAAM,CAAC,MAAM,2BAA2B,GAAG,GAAG,EAAE,CAC9C,QAAQ,CAAC,MAAM,CACb,mBAAmB,EACnB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAU;QAC7C,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,UAAU;aAC7B,4BAA4B,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;aACxC,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE,CAChD,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAC1B,CACF,CAAC;QACJ,IAAI,CAAC,MAAM,EAAE,yBAAyB;YAAE,OAAO,SAAS,CAAC;QACzD,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,yBAAyB,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IACzE,CAAC,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,IAAY;QACjD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,yBAAyB,CAAC;YACzD,IAAI,EAAE,QAAQ;SACf,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,CAAC,uBAAuB,EAAE,KAAK,EAAE,IAAI,CACzD,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,mBAAmB,EAAE,yBAAyB,EAAE,IAAI,KAAK,IAAI,CACrE,CAAC;QACF,IAAI,CAAC,OAAO,EAAE,mBAAmB,EAAE,EAAE;YAAE,OAAO,SAAS,CAAC;QACxD,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC,IAAI,CACxD,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACnB,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,mBAAmB,CAAC,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CACrE,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,MAAM,WAAW,GAAG,CAClB,IAAY,EACZ,KAA+B,EACO,EAAE,CAAC,CAAC;QAC1C,IAAI,EAAE,IAAI;QACV,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;KAC7C,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,CACd,EAAU,EACV,MAA4C,EAC5C,IAAwB,EACxB,EAAE,CAAC,CAAC;QACJ,qBAAqB,EAAE,EAAE;QACzB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,IAAI;QACJ,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;KAC9C,CAAC,CAAC;IAEH,OAAO;QACL,OAAO,EAAE,CAAC,uBAAuB,CAAC;QAClC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;YAC3C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC;YACxC,IACE,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;gBACnC,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,EAC7B,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;YACxC,CAAC;QACH,CAAC,CAAC;QACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;YAC7C,IAAI,MAAM,EAAE,qBAAqB,EAAE,CAAC;gBAClC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;gBAC3D,IAAI,KAAK,EAAE,CAAC;oBACV,OAAO,OAAO,CAAC,MAAM,CAAC,qBAAqB,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;gBACzE,CAAC;YACH,CAAC;YACD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;YAC/C,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACrC,IAAI,CAAC,KAAK;gBAAE,OAAO,SAAS,CAAC;YAC7B,OAAO,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACrD,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;YAChD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YACzC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,UAAU;iBAC9B,yBAAyB,CAAC;gBACzB,yBAAyB,EAAE,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC;aACnD,CAAC;iBACD,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,kCAAkC,EAAE,GAAG,EAAE,CACvD,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,CAClB,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC1B,QAAQ;gBACN,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;oBACb,mBAAmB,EAAE;wBACnB,EAAE,EAAE,QAAQ,CAAC,EAAE;wBACf,gBAAgB,EAAE,IAAI,IAAI,EAAE;wBAC5B,yBAAyB,EAAE,QAAQ,CAAC,MAAM;qBAC3C;oBACD,IAAI,EAAE,QAAQ,CAAC,IAAI;oBACnB,QAAQ,EAAE,SAAS;iBACpB,CAAC;gBACJ,CAAC,CAAC,MAAM,CAAC,IAAI,CACT,IAAI,KAAK,CACP,0BAA0B,IAAI,6CAA6C,CAC5E,CACF,CACN,CACF,CACF,CACF,CAAC;YACJ,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,EAAE,CAAC;gBACrC,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAC9D,CAAC;YACJ,CAAC;YACD,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC;YACpD,OAAO,OAAO,CACZ,OAAO,CAAC,mBAAmB,CAAC,EAAE,EAC9B,OAAO,CAAC,mBAAmB,CAAC,yBAAyB,EACrD,OAAO,CAAC,IAAI,CACb,CAAC;QACJ,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;YACpD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;YAC7D,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,yBAAyB,CAAC;gBAC1D,EAAE,EAAE,MAAM,CAAC,qBAAqB;gBAChC,OAAO,EAAE,OAAO,EAAE,IAAI,IAAI,MAAM,CAAC,IAAI;gBACrC,yBAAyB,EAAE,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC;aAC1D,CAAC,CAAC;YACH,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,EAAE,CAAC;gBACrC,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAC9D,CAAC;YACJ,CAAC;YACD,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;YAClD,OAAO,OAAO,CACZ,OAAO,CAAC,mBAAmB,CAAC,EAAE,EAC9B,OAAO,CAAC,mBAAmB,CAAC,yBAAyB,EACrD,OAAO,CAAC,IAAI,CACb,CAAC;QACJ,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;YACrC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;YAC7D,IAAI,CAAC,OAAO;gBAAE,OAAO;YACrB,KAAK,CAAC,CAAC,UAAU;iBACd,yBAAyB,CAAC;gBACzB,EAAE,EAAE,MAAM,CAAC,qBAAqB;gBAChC,OAAO,EAAE,OAAO,CAAC,IAAI;aACtB,CAAC;iBACD,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAChE,CAAC;QACN,CAAC,CAAC;KACH,CAAC;AACJ,CAAC,CAAC,CACH,CAAC;AAEJ,MAAM,UAAU,GAAG,CAAC,EAAU,EAAE,KAA+B,EAAE,EAAE,CACjE,KAAK,CAAC,IAAI;IACR,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC;IAC5B,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC"}

package/lib/AWS/CloudFront/PublicKey.d.ts

@@ -0,0 +1,72 @@
+import * as Redacted from "effect/Redacted";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+export interface PublicKeyProps {
+    /**
+     * Name of the public key. If omitted, a deterministic name is generated.
+     *
+     * Names must be unique per AWS account. Changing the name triggers
+     * a replacement.
+     */
+    name?: string;
+    /**
+     * PEM-encoded public key body. Changing the key material triggers a
+     * replacement (CloudFront does not allow rotating an existing public
+     * key in place).
+     */
+    encodedKey: Redacted.Redacted<string> | string;
+    /**
+     * Optional comment describing the key.
+     */
+    comment?: string;
+}
+export interface PublicKey extends Resource<"AWS.CloudFront.PublicKey", PublicKeyProps, {
+    /**
+     * CloudFront-assigned public key identifier. Used by KeyGroups to
+     * reference the key.
+     */
+    publicKeyId: string;
+    /**
+     * Name of the public key.
+     */
+    name: string;
+    /**
+     * PEM-encoded public key body.
+     */
+    encodedKey: string;
+    /**
+     * Caller reference used at create time. Stable across updates.
+     */
+    callerReference: string;
+    /**
+     * Most recent entity tag for update/delete operations.
+     */
+    etag: string | undefined;
+    /**
+     * Current comment on the key.
+     */
+    comment: string | undefined;
+}, never, Providers> {
+}
+/**
+ * A CloudFront public key.
+ *
+ * Public keys are uploaded ahead of being grouped into a {@link KeyGroup} and
+ * used by Distributions for signed URL or signed cookie verification.
+ *
+ * The key body is immutable after creation — changing `encodedKey` triggers
+ * a replacement (CloudFront returns no API to rotate a key in place).
+ *
+ * @section Creating Public Keys
+ * @example PEM-encoded RSA public key
+ * ```typescript
+ * const key = yield* PublicKey("SignedUrlKey", {
+ *   encodedKey: Redacted.make(yield* fs.readFileString("./public_key.pem")),
+ *   comment: "RSA-2048 signed URL key for /private",
+ * });
+ * ```
+ */
+export declare const PublicKey: import("../../Resource.ts").ResourceClass<PublicKey>;
+export declare const PublicKeyProvider: () => import("effect/Layer").Layer<Provider.Provider<PublicKey>, never, import("effect/unstable/http/HttpClient").HttpClient | import("../../Stage.ts").Stage | import("../../Stack.ts").Stack | import("@distilled.cloud/aws/Region").Region | import("@distilled.cloud/aws/Credentials").Credentials>;
+//# sourceMappingURL=PublicKey.d.ts.map

package/lib/AWS/CloudFront/PublicKey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PublicKey.d.ts","sourceRoot":"","sources":["../../../src/AWS/CloudFront/PublicKey.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAG5C,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAGjD,MAAM,WAAW,cAAc;IAC7B;;;;;OAKG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;IAC/C;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,SAAU,SAAQ,QAAQ,CACzC,0BAA0B,EAC1B,cAAc,EACd;IACE;;;OAGG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;OAEG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB;;OAEG;IACH,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB;;OAEG;IACH,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7B,EACD,KAAK,EACL,SAAS,CACV;CAAG;AAEJ;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,SAAS,sDAAkD,CAAC;AAEzE,eAAO,MAAM,iBAAiB,ySA2J3B,CAAC"}

package/lib/AWS/CloudFront/PublicKey.js

@@ -0,0 +1,137 @@
+import * as cloudfront from "@distilled.cloud/aws/cloudfront";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import { isResolved } from "../../Diff.js";
+import { createPhysicalName } from "../../PhysicalName.js";
+import * as Provider from "../../Provider.js";
+import { Resource } from "../../Resource.js";
+import { extractValue } from "./common.js";
+/**
+ * A CloudFront public key.
+ *
+ * Public keys are uploaded ahead of being grouped into a {@link KeyGroup} and
+ * used by Distributions for signed URL or signed cookie verification.
+ *
+ * The key body is immutable after creation — changing `encodedKey` triggers
+ * a replacement (CloudFront returns no API to rotate a key in place).
+ *
+ * @section Creating Public Keys
+ * @example PEM-encoded RSA public key
+ * ```typescript
+ * const key = yield* PublicKey("SignedUrlKey", {
+ *   encodedKey: Redacted.make(yield* fs.readFileString("./public_key.pem")),
+ *   comment: "RSA-2048 signed URL key for /private",
+ * });
+ * ```
+ */
+export const PublicKey = Resource("AWS.CloudFront.PublicKey");
+export const PublicKeyProvider = () => Provider.effect(PublicKey, Effect.gen(function* () {
+    const getById = Effect.fn(function* (id) {
+        const config = yield* cloudfront
+            .getPublicKeyConfig({ Id: id })
+            .pipe(Effect.catchTag("NoSuchPublicKey", () => Effect.succeed(undefined)));
+        if (!config?.PublicKeyConfig)
+            return undefined;
+        return { config: config.PublicKeyConfig, etag: config.ETag };
+    });
+    const getByName = Effect.fn(function* (name) {
+        const listed = yield* cloudfront.listPublicKeys({});
+        const summary = listed.PublicKeyList?.Items?.find((item) => item.Name === name);
+        if (!summary?.Id)
+            return undefined;
+        return yield* getById(summary.Id).pipe(Effect.map((found) => found ? { id: summary.Id, ...found } : undefined));
+    });
+    const buildConfig = (name, callerReference, props) => ({
+        Name: name,
+        CallerReference: callerReference,
+        EncodedKey: extractValue(props.encodedKey),
+        Comment: props.comment,
+    });
+    const toAttrs = (id, config, etag) => ({
+        publicKeyId: id,
+        name: config.Name,
+        encodedKey: config.EncodedKey,
+        callerReference: config.CallerReference,
+        etag,
+        comment: config.Comment,
+    });
+    return {
+        stables: ["publicKeyId", "callerReference"],
+        diff: Effect.fn(function* ({ id, news, olds }) {
+            if (!isResolved(news))
+                return undefined;
+            if ((yield* createName(id, olds ?? {})) !==
+                (yield* createName(id, news))) {
+                return { action: "replace" };
+            }
+            if (isResolved(olds.encodedKey) &&
+                extractValue(olds.encodedKey) !== extractValue(news.encodedKey)) {
+                return { action: "replace" };
+            }
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+            if (output?.publicKeyId) {
+                const found = yield* getById(output.publicKeyId);
+                if (found)
+                    return toAttrs(output.publicKeyId, found.config, found.etag);
+            }
+            const name = yield* createName(id, olds ?? {});
+            const found = yield* getByName(name);
+            if (!found)
+                return undefined;
+            return toAttrs(found.id, found.config, found.etag);
+        }),
+        create: Effect.fn(function* ({ id, news, session }) {
+            const name = yield* createName(id, news);
+            const callerReference = name;
+            const created = yield* cloudfront
+                .createPublicKey({
+                PublicKeyConfig: buildConfig(name, callerReference, news),
+            })
+                .pipe(Effect.catchTag("PublicKeyAlreadyExists", () => getByName(name).pipe(Effect.flatMap((existing) => existing
+                ? Effect.succeed({
+                    PublicKey: {
+                        Id: existing.id,
+                        CreatedTime: new Date(),
+                        PublicKeyConfig: existing.config,
+                    },
+                    ETag: existing.etag,
+                    Location: undefined,
+                })
+                : Effect.fail(new Error(`Public key '${name}' already exists but could not be recovered`))))));
+            if (!created.PublicKey?.Id) {
+                return yield* Effect.fail(new Error("createPublicKey returned no identifier"));
+            }
+            yield* session.note(created.PublicKey.Id);
+            return toAttrs(created.PublicKey.Id, created.PublicKey.PublicKeyConfig, created.ETag);
+        }),
+        update: Effect.fn(function* ({ news, output, session }) {
+            const current = yield* getById(output.publicKeyId);
+            const updated = yield* cloudfront.updatePublicKey({
+                Id: output.publicKeyId,
+                IfMatch: current?.etag ?? output.etag,
+                PublicKeyConfig: buildConfig(output.name, output.callerReference, news),
+            });
+            if (!updated.PublicKey?.Id) {
+                return yield* Effect.fail(new Error("updatePublicKey returned no identifier"));
+            }
+            yield* session.note(output.publicKeyId);
+            return toAttrs(updated.PublicKey.Id, updated.PublicKey.PublicKeyConfig, updated.ETag);
+        }),
+        delete: Effect.fn(function* ({ output }) {
+            const current = yield* getById(output.publicKeyId);
+            if (!current)
+                return;
+            yield* cloudfront
+                .deletePublicKey({
+                Id: output.publicKeyId,
+                IfMatch: current.etag,
+            })
+                .pipe(Effect.catchTag("NoSuchPublicKey", () => Effect.void));
+        }),
+    };
+}));
+const createName = (id, props) => props.name
+    ? Effect.succeed(props.name)
+    : createPhysicalName({ id, maxLength: 128, lowercase: true });
+//# sourceMappingURL=PublicKey.js.map

package/lib/AWS/CloudFront/PublicKey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PublicKey.js","sourceRoot":"","sources":["../../../src/AWS/CloudFront/PublicKey.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAC9D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAE7C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAwD3C;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,QAAQ,CAAY,0BAA0B,CAAC,CAAC;AAEzE,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,EAAE,CACpC,QAAQ,CAAC,MAAM,CACb,SAAS,EACT,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAU;QAC7C,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,UAAU;aAC7B,kBAAkB,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;aAC9B,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CACpE,CAAC;QACJ,IAAI,CAAC,MAAM,EAAE,eAAe;YAAE,OAAO,SAAS,CAAC;QAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,eAAe,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,IAAY;QACjD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;QACpD,MAAM,OAAO,GAAG,MAAM,CAAC,aAAa,EAAE,KAAK,EAAE,IAAI,CAC/C,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAC7B,CAAC;QACF,IAAI,CAAC,OAAO,EAAE,EAAE;YAAE,OAAO,SAAS,CAAC;QACnC,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CACpC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACnB,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CACjD,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,MAAM,WAAW,GAAG,CAClB,IAAY,EACZ,eAAuB,EACvB,KAAqB,EACO,EAAE,CAAC,CAAC;QAChC,IAAI,EAAE,IAAI;QACV,eAAe,EAAE,eAAe;QAChC,UAAU,EAAE,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC;QAC1C,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,CACd,EAAU,EACV,MAAkC,EAClC,IAAwB,EACxB,EAAE,CAAC,CAAC;QACJ,WAAW,EAAE,EAAE;QACf,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,IAAI;QACJ,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAC,CAAC;IAEH,OAAO;QACL,OAAO,EAAE,CAAC,aAAa,EAAE,iBAAiB,CAAC;QAC3C,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;YAC3C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC;YACxC,IACE,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;gBACnC,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,EAC7B,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;YACxC,CAAC;YACD,IACE,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;gBAC3B,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,EAC/D,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;YACxC,CAAC;QACH,CAAC,CAAC;QACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;YAC7C,IAAI,MAAM,EAAE,WAAW,EAAE,CAAC;gBACxB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;gBACjD,IAAI,KAAK;oBAAE,OAAO,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAC1E,CAAC;YACD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;YAC/C,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACrC,IAAI,CAAC,KAAK;gBAAE,OAAO,SAAS,CAAC;YAC7B,OAAO,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACrD,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;YAChD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YACzC,MAAM,eAAe,GAAG,IAAI,CAAC;YAC7B,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,UAAU;iBAC9B,eAAe,CAAC;gBACf,eAAe,EAAE,WAAW,CAAC,IAAI,EAAE,eAAe,EAAE,IAAI,CAAC;aAC1D,CAAC;iBACD,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE,CAC7C,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,CAClB,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC1B,QAAQ;gBACN,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;oBACb,SAAS,EAAE;wBACT,EAAE,EAAE,QAAQ,CAAC,EAAE;wBACf,WAAW,EAAE,IAAI,IAAI,EAAE;wBACvB,eAAe,EAAE,QAAQ,CAAC,MAAM;qBACjC;oBACD,IAAI,EAAE,QAAQ,CAAC,IAAI;oBACnB,QAAQ,EAAE,SAAS;iBACpB,CAAC;gBACJ,CAAC,CAAC,MAAM,CAAC,IAAI,CACT,IAAI,KAAK,CACP,eAAe,IAAI,6CAA6C,CACjE,CACF,CACN,CACF,CACF,CACF,CAAC;YACJ,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,EAAE,CAAC;gBAC3B,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,KAAK,CAAC,wCAAwC,CAAC,CACpD,CAAC;YACJ,CAAC;YACD,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YAC1C,OAAO,OAAO,CACZ,OAAO,CAAC,SAAS,CAAC,EAAE,EACpB,OAAO,CAAC,SAAS,CAAC,eAAe,EACjC,OAAO,CAAC,IAAI,CACb,CAAC;QACJ,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;YACpD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YACnD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,eAAe,CAAC;gBAChD,EAAE,EAAE,MAAM,CAAC,WAAW;gBACtB,OAAO,EAAE,OAAO,EAAE,IAAI,IAAI,MAAM,CAAC,IAAI;gBACrC,eAAe,EAAE,WAAW,CAC1B,MAAM,CAAC,IAAI,EACX,MAAM,CAAC,eAAe,EACtB,IAAI,CACL;aACF,CAAC,CAAC;YACH,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,EAAE,CAAC;gBAC3B,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,KAAK,CAAC,wCAAwC,CAAC,CACpD,CAAC;YACJ,CAAC;YACD,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YACxC,OAAO,OAAO,CACZ,OAAO,CAAC,SAAS,CAAC,EAAE,EACpB,OAAO,CAAC,SAAS,CAAC,eAAe,EACjC,OAAO,CAAC,IAAI,CACb,CAAC;QACJ,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;YACrC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YACnD,IAAI,CAAC,OAAO;gBAAE,OAAO;YACrB,KAAK,CAAC,CAAC,UAAU;iBACd,eAAe,CAAC;gBACf,EAAE,EAAE,MAAM,CAAC,WAAW;gBACtB,OAAO,EAAE,OAAO,CAAC,IAAI;aACtB,CAAC;iBACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACjE,CAAC,CAAC;KACH,CAAC;AACJ,CAAC,CAAC,CACH,CAAC;AAEJ,MAAM,UAAU,GAAG,CAAC,EAAU,EAAE,KAAqB,EAAE,EAAE,CACvD,KAAK,CAAC,IAAI;IACR,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC;IAC5B,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC"}

package/lib/AWS/CloudFront/ResponseHeadersPolicy.d.ts

@@ -0,0 +1,114 @@
+import * as cloudfront from "@distilled.cloud/aws/cloudfront";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+export interface ResponseHeadersPolicyProps {
+    /**
+     * Name of the response headers policy. If omitted, a deterministic name is
+     * generated. Names must be unique per AWS account. Changing the name
+     * triggers a replacement.
+     */
+    name?: string;
+    /**
+     * Optional comment describing the policy.
+     */
+    comment?: string;
+    /**
+     * CORS configuration applied to viewer responses.
+     */
+    corsConfig?: cloudfront.ResponseHeadersPolicyCorsConfig;
+    /**
+     * Standard security headers (HSTS, X-Frame-Options, etc.) added to
+     * viewer responses.
+     */
+    securityHeadersConfig?: cloudfront.ResponseHeadersPolicySecurityHeadersConfig;
+    /**
+     * Server-Timing header configuration for measuring CloudFront performance.
+     */
+    serverTimingHeadersConfig?: cloudfront.ResponseHeadersPolicyServerTimingHeadersConfig;
+    /**
+     * Custom headers to add to viewer responses.
+     */
+    customHeadersConfig?: cloudfront.ResponseHeadersPolicyCustomHeadersConfig;
+    /**
+     * Headers to remove from viewer responses.
+     */
+    removeHeadersConfig?: cloudfront.ResponseHeadersPolicyRemoveHeadersConfig;
+}
+export interface ResponseHeadersPolicy extends Resource<"AWS.CloudFront.ResponseHeadersPolicy", ResponseHeadersPolicyProps, {
+    /**
+     * CloudFront-assigned response headers policy identifier.
+     */
+    responseHeadersPolicyId: string;
+    /**
+     * Name of the response headers policy.
+     */
+    name: string;
+    /**
+     * Most recent entity tag for update/delete operations.
+     */
+    etag: string | undefined;
+    /**
+     * Current comment on the policy.
+     */
+    comment: string | undefined;
+    /**
+     * Current CORS configuration.
+     */
+    corsConfig: cloudfront.ResponseHeadersPolicyCorsConfig | undefined;
+    /**
+     * Current security headers configuration.
+     */
+    securityHeadersConfig: cloudfront.ResponseHeadersPolicySecurityHeadersConfig | undefined;
+    /**
+     * Current Server-Timing configuration.
+     */
+    serverTimingHeadersConfig: cloudfront.ResponseHeadersPolicyServerTimingHeadersConfig | undefined;
+    /**
+     * Current custom headers configuration.
+     */
+    customHeadersConfig: cloudfront.ResponseHeadersPolicyCustomHeadersConfig | undefined;
+    /**
+     * Current remove-headers configuration.
+     */
+    removeHeadersConfig: cloudfront.ResponseHeadersPolicyRemoveHeadersConfig | undefined;
+}, never, Providers> {
+}
+/**
+ * A CloudFront response headers policy.
+ *
+ * Response headers policies add or remove headers in viewer responses,
+ * including CORS, standard security headers (HSTS, X-Frame-Options,
+ * X-Content-Type-Options, Referrer-Policy, etc.), Server-Timing, custom
+ * headers and explicit header removal. They are referenced by ID on a
+ * Distribution's default behavior or per-path cache behaviors.
+ *
+ * @section Creating Response Headers Policies
+ * @example Standard security + CORS
+ * ```typescript
+ * const responseHeadersPolicy = yield* ResponseHeadersPolicy("AppResponseHeaders", {
+ *   comment: "Default app security + CORS",
+ *   corsConfig: {
+ *     AccessControlAllowOrigins: { Quantity: 1, Items: ["https://app.example.com"] },
+ *     AccessControlAllowMethods: { Quantity: 2, Items: ["GET", "OPTIONS"] },
+ *     AccessControlAllowHeaders: { Quantity: 1, Items: ["Authorization"] },
+ *     AccessControlAllowCredentials: false,
+ *     OriginOverride: true,
+ *   },
+ *   securityHeadersConfig: {
+ *     StrictTransportSecurity: {
+ *       AccessControlMaxAgeSec: 31536000,
+ *       IncludeSubdomains: true,
+ *       Preload: true,
+ *       Override: true,
+ *     },
+ *     ContentTypeOptions: { Override: true },
+ *     FrameOptions: { FrameOption: "DENY", Override: true },
+ *     ReferrerPolicy: { ReferrerPolicy: "no-referrer", Override: true },
+ *   },
+ * });
+ * ```
+ */
+export declare const ResponseHeadersPolicy: import("../../Resource.ts").ResourceClass<ResponseHeadersPolicy>;
+export declare const ResponseHeadersPolicyProvider: () => import("effect/Layer").Layer<Provider.Provider<ResponseHeadersPolicy>, never, import("effect/unstable/http/HttpClient").HttpClient | import("../../Stage.ts").Stage | import("../../Stack.ts").Stack | import("@distilled.cloud/aws/Region").Region | import("@distilled.cloud/aws/Credentials").Credentials>;
+//# sourceMappingURL=ResponseHeadersPolicy.d.ts.map

package/lib/AWS/CloudFront/ResponseHeadersPolicy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ResponseHeadersPolicy.d.ts","sourceRoot":"","sources":["../../../src/AWS/CloudFront/ResponseHeadersPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAI9D,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD,MAAM,WAAW,0BAA0B;IACzC;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC,+BAA+B,CAAC;IACxD;;;OAGG;IACH,qBAAqB,CAAC,EAAE,UAAU,CAAC,0CAA0C,CAAC;IAC9E;;OAEG;IACH,yBAAyB,CAAC,EAAE,UAAU,CAAC,8CAA8C,CAAC;IACtF;;OAEG;IACH,mBAAmB,CAAC,EAAE,UAAU,CAAC,wCAAwC,CAAC;IAC1E;;OAEG;IACH,mBAAmB,CAAC,EAAE,UAAU,CAAC,wCAAwC,CAAC;CAC3E;AAED,MAAM,WAAW,qBAAsB,SAAQ,QAAQ,CACrD,sCAAsC,EACtC,0BAA0B,EAC1B;IACE;;OAEG;IACH,uBAAuB,EAAE,MAAM,CAAC;IAChC;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;OAEG;IACH,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB;;OAEG;IACH,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B;;OAEG;IACH,UAAU,EAAE,UAAU,CAAC,+BAA+B,GAAG,SAAS,CAAC;IACnE;;OAEG;IACH,qBAAqB,EACjB,UAAU,CAAC,0CAA0C,GACrD,SAAS,CAAC;IACd;;OAEG;IACH,yBAAyB,EACrB,UAAU,CAAC,8CAA8C,GACzD,SAAS,CAAC;IACd;;OAEG;IACH,mBAAmB,EACf,UAAU,CAAC,wCAAwC,GACnD,SAAS,CAAC;IACd;;OAEG;IACH,mBAAmB,EACf,UAAU,CAAC,wCAAwC,GACnD,SAAS,CAAC;CACf,EACD,KAAK,EACL,SAAS,CACV;CAAG;AAEJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,eAAO,MAAM,qBAAqB,kEAEjC,CAAC;AAEF,eAAO,MAAM,6BAA6B,qTAwKvC,CAAC"}

package/lib/AWS/CloudFront/ResponseHeadersPolicy.js

@@ -0,0 +1,162 @@
+import * as cloudfront from "@distilled.cloud/aws/cloudfront";
+import * as Effect from "effect/Effect";
+import { isResolved } from "../../Diff.js";
+import { createPhysicalName } from "../../PhysicalName.js";
+import * as Provider from "../../Provider.js";
+import { Resource } from "../../Resource.js";
+/**
+ * A CloudFront response headers policy.
+ *
+ * Response headers policies add or remove headers in viewer responses,
+ * including CORS, standard security headers (HSTS, X-Frame-Options,
+ * X-Content-Type-Options, Referrer-Policy, etc.), Server-Timing, custom
+ * headers and explicit header removal. They are referenced by ID on a
+ * Distribution's default behavior or per-path cache behaviors.
+ *
+ * @section Creating Response Headers Policies
+ * @example Standard security + CORS
+ * ```typescript
+ * const responseHeadersPolicy = yield* ResponseHeadersPolicy("AppResponseHeaders", {
+ *   comment: "Default app security + CORS",
+ *   corsConfig: {
+ *     AccessControlAllowOrigins: { Quantity: 1, Items: ["https://app.example.com"] },
+ *     AccessControlAllowMethods: { Quantity: 2, Items: ["GET", "OPTIONS"] },
+ *     AccessControlAllowHeaders: { Quantity: 1, Items: ["Authorization"] },
+ *     AccessControlAllowCredentials: false,
+ *     OriginOverride: true,
+ *   },
+ *   securityHeadersConfig: {
+ *     StrictTransportSecurity: {
+ *       AccessControlMaxAgeSec: 31536000,
+ *       IncludeSubdomains: true,
+ *       Preload: true,
+ *       Override: true,
+ *     },
+ *     ContentTypeOptions: { Override: true },
+ *     FrameOptions: { FrameOption: "DENY", Override: true },
+ *     ReferrerPolicy: { ReferrerPolicy: "no-referrer", Override: true },
+ *   },
+ * });
+ * ```
+ */
+export const ResponseHeadersPolicy = Resource("AWS.CloudFront.ResponseHeadersPolicy");
+export const ResponseHeadersPolicyProvider = () => Provider.effect(ResponseHeadersPolicy, Effect.gen(function* () {
+    const getById = Effect.fn(function* (id) {
+        const config = yield* cloudfront
+            .getResponseHeadersPolicyConfig({ Id: id })
+            .pipe(Effect.catchTag("NoSuchResponseHeadersPolicy", () => Effect.succeed(undefined)));
+        if (!config?.ResponseHeadersPolicyConfig)
+            return undefined;
+        return {
+            config: config.ResponseHeadersPolicyConfig,
+            etag: config.ETag,
+        };
+    });
+    const getByName = Effect.fn(function* (name) {
+        const listed = yield* cloudfront.listResponseHeadersPolicies({
+            Type: "custom",
+        });
+        const summary = listed.ResponseHeadersPolicyList?.Items?.find((item) => item.ResponseHeadersPolicy?.ResponseHeadersPolicyConfig?.Name ===
+            name);
+        if (!summary?.ResponseHeadersPolicy?.Id)
+            return undefined;
+        return yield* getById(summary.ResponseHeadersPolicy.Id).pipe(Effect.map((found) => found
+            ? { id: summary.ResponseHeadersPolicy.Id, ...found }
+            : undefined));
+    });
+    const buildConfig = (name, props) => ({
+        Name: name,
+        Comment: props.comment,
+        CorsConfig: props.corsConfig,
+        SecurityHeadersConfig: props.securityHeadersConfig,
+        ServerTimingHeadersConfig: props.serverTimingHeadersConfig,
+        CustomHeadersConfig: props.customHeadersConfig,
+        RemoveHeadersConfig: props.removeHeadersConfig,
+    });
+    const toAttrs = (id, config, etag) => ({
+        responseHeadersPolicyId: id,
+        name: config.Name,
+        etag,
+        comment: config.Comment,
+        corsConfig: config.CorsConfig,
+        securityHeadersConfig: config.SecurityHeadersConfig,
+        serverTimingHeadersConfig: config.ServerTimingHeadersConfig,
+        customHeadersConfig: config.CustomHeadersConfig,
+        removeHeadersConfig: config.RemoveHeadersConfig,
+    });
+    return {
+        stables: ["responseHeadersPolicyId"],
+        diff: Effect.fn(function* ({ id, news, olds }) {
+            if (!isResolved(news))
+                return undefined;
+            if ((yield* createName(id, olds ?? {})) !==
+                (yield* createName(id, news))) {
+                return { action: "replace" };
+            }
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+            if (output?.responseHeadersPolicyId) {
+                const found = yield* getById(output.responseHeadersPolicyId);
+                if (found) {
+                    return toAttrs(output.responseHeadersPolicyId, found.config, found.etag);
+                }
+            }
+            const name = yield* createName(id, olds ?? {});
+            const found = yield* getByName(name);
+            if (!found)
+                return undefined;
+            return toAttrs(found.id, found.config, found.etag);
+        }),
+        create: Effect.fn(function* ({ id, news, session }) {
+            const name = yield* createName(id, news);
+            const created = yield* cloudfront
+                .createResponseHeadersPolicy({
+                ResponseHeadersPolicyConfig: buildConfig(name, news),
+            })
+                .pipe(Effect.catchTag("ResponseHeadersPolicyAlreadyExists", () => getByName(name).pipe(Effect.flatMap((existing) => existing
+                ? Effect.succeed({
+                    ResponseHeadersPolicy: {
+                        Id: existing.id,
+                        LastModifiedTime: new Date(),
+                        ResponseHeadersPolicyConfig: existing.config,
+                    },
+                    ETag: existing.etag,
+                    Location: undefined,
+                })
+                : Effect.fail(new Error(`Response headers policy '${name}' already exists but could not be recovered`))))));
+            if (!created.ResponseHeadersPolicy?.Id) {
+                return yield* Effect.fail(new Error("createResponseHeadersPolicy returned no identifier"));
+            }
+            yield* session.note(created.ResponseHeadersPolicy.Id);
+            return toAttrs(created.ResponseHeadersPolicy.Id, created.ResponseHeadersPolicy.ResponseHeadersPolicyConfig, created.ETag);
+        }),
+        update: Effect.fn(function* ({ news, output, session }) {
+            const current = yield* getById(output.responseHeadersPolicyId);
+            const updated = yield* cloudfront.updateResponseHeadersPolicy({
+                Id: output.responseHeadersPolicyId,
+                IfMatch: current?.etag ?? output.etag,
+                ResponseHeadersPolicyConfig: buildConfig(output.name, news),
+            });
+            if (!updated.ResponseHeadersPolicy?.Id) {
+                return yield* Effect.fail(new Error("updateResponseHeadersPolicy returned no identifier"));
+            }
+            yield* session.note(output.responseHeadersPolicyId);
+            return toAttrs(updated.ResponseHeadersPolicy.Id, updated.ResponseHeadersPolicy.ResponseHeadersPolicyConfig, updated.ETag);
+        }),
+        delete: Effect.fn(function* ({ output }) {
+            const current = yield* getById(output.responseHeadersPolicyId);
+            if (!current)
+                return;
+            yield* cloudfront
+                .deleteResponseHeadersPolicy({
+                Id: output.responseHeadersPolicyId,
+                IfMatch: current.etag,
+            })
+                .pipe(Effect.catchTag("NoSuchResponseHeadersPolicy", () => Effect.void));
+        }),
+    };
+}));
+const createName = (id, props) => props.name
+    ? Effect.succeed(props.name)
+    : createPhysicalName({ id, maxLength: 128, lowercase: true });
+//# sourceMappingURL=ResponseHeadersPolicy.js.map