alchemy 2.0.0-beta.30 → 2.0.0-beta.32

package/src/AWS/IAM/Role.ts

@@ -1,5 +1,6 @@
 import * as iam from "@distilled.cloud/aws/iam";
 import * as Effect from "effect/Effect";
+import { Unowned } from "../../AdoptPolicy.ts";
 import { isResolved } from "../../Diff.ts";
 import { createPhysicalName } from "../../PhysicalName.ts";
 import * as Provider from "../../Provider.ts";
@@ -9,7 +10,7 @@ import {
   createInternalTags,
   createTagsList,
   diffTags,
-  hasTags,
+  hasAlchemyTags,
 } from "../../Tags.ts";
 import type { AccountID } from "../Environment.ts";
 import { AWSEnvironment } from "../Environment.ts";
@@ -250,13 +251,12 @@ export const RoleProvider = () =>
             return { action: "replace" } as const;
           }
         }),
-        read: Effect.fn(function* ({ output }) {
-          if (!output) {
-            return undefined;
-          }
+        read: Effect.fn(function* ({ id, olds, output }) {
+          const roleName =
+            output?.roleName ?? (yield* toRoleName(id, olds ?? {}));
           const role = yield* iam
             .getRole({
-              RoleName: output.roleName,
+              RoleName: roleName,
             })
             .pipe(
               Effect.catchTag("NoSuchEntityException", () =>
@@ -268,16 +268,19 @@ export const RoleProvider = () =>
           }
 
           const [managedPolicyArns, inlinePolicies, tags] = yield* Effect.all([
-            readManagedPolicies(output.roleName),
-            readInlinePolicies(output.roleName),
-            readTags(output.roleName),
+            readManagedPolicies(roleName),
+            readInlinePolicies(roleName),
+            readTags(roleName),
           ]);
 
           const assumeRolePolicyDocument =
             parsePolicyDocument(role.Role.AssumeRolePolicyDocument) ??
-            output.assumeRolePolicyDocument;
+            output?.assumeRolePolicyDocument;
+          if (!assumeRolePolicyDocument) {
+            return undefined;
+          }
 
-          return {
+          const attrs = {
             roleArn: role.Role.Arn as RoleArn,
             roleName: role.Role.RoleName,
             roleId: role.Role.RoleId,
@@ -291,98 +294,96 @@ export const RoleProvider = () =>
               role.Role.PermissionsBoundary?.PermissionsBoundaryArn,
             tags,
           };
+          return (yield* hasAlchemyTags(id, tags)) ? attrs : Unowned(attrs);
         }),
-        create: Effect.fn(function* ({ id, news, session }) {
-          const roleName = yield* toRoleName(id, news);
-          const tags = {
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+          const roleName = output?.roleName ?? (yield* toRoleName(id, news));
+          const desiredTags = {
             ...(yield* createInternalTags(id)),
             ...news.tags,
           };
 
-          const created = yield* iam
-            .createRole({
-              Path: news.path,
-              RoleName: roleName,
-              AssumeRolePolicyDocument: stringifyPolicyDocument(
-                news.assumeRolePolicyDocument,
-              ),
-              Description: news.description,
-              MaxSessionDuration: news.maxSessionDuration,
-              PermissionsBoundary: news.permissionsBoundary,
-              Tags: createTagsList(tags),
-            })
+          // Observe — read the role from IAM. Absence is signalled by
+          // `NoSuchEntityException`; ownership has already been verified
+          // upstream so adopting a `Unowned` role is the engine's call.
+          let observedRole = yield* iam
+            .getRole({ RoleName: roleName })
             .pipe(
-              Effect.catchTag("EntityAlreadyExistsException", () =>
-                iam.getRole({ RoleName: roleName }).pipe(
-                  Effect.filterOrFail(
-                    (existing) => hasTags(tags, existing.Role?.Tags),
-                    () =>
-                      new Error(
-                        `Role '${roleName}' already exists and is not managed by alchemy`,
-                      ),
-                  ),
-                ),
+              Effect.catchTag("NoSuchEntityException", () =>
+                Effect.succeed(undefined),
               ),
             );
 
-          yield* syncManagedPolicies({
-            roleName,
-            olds: [],
-            news: news.managedPolicyArns ?? [],
-          });
-          yield* syncInlinePolicies({
-            roleName,
-            olds: {},
-            news: news.inlinePolicies ?? {},
-          });
+          // Ensure — create the role when missing. A peer reconciler may
+          // have created it concurrently; tolerate that race by reading
+          // the existing role.
+          if (!observedRole?.Role) {
+            observedRole = yield* iam
+              .createRole({
+                Path: news.path,
+                RoleName: roleName,
+                AssumeRolePolicyDocument: stringifyPolicyDocument(
+                  news.assumeRolePolicyDocument,
+                ),
+                Description: news.description,
+                MaxSessionDuration: news.maxSessionDuration,
+                PermissionsBoundary: news.permissionsBoundary,
+                Tags: createTagsList(desiredTags),
+              })
+              .pipe(
+                Effect.catchTag("EntityAlreadyExistsException", () =>
+                  iam.getRole({ RoleName: roleName }),
+                ),
+              );
+          }
 
-          const roleArn = (created.Role?.Arn ??
-            `arn:aws:iam::${(yield* AWSEnvironment).accountId}:role/${roleName}`) as RoleArn;
-          yield* session.note(roleArn);
+          const observedAssumePolicy = parsePolicyDocument(
+            observedRole.Role?.AssumeRolePolicyDocument,
+          );
+          const observedDescription = observedRole.Role?.Description;
+          const observedMaxSessionDuration =
+            observedRole.Role?.MaxSessionDuration;
+          const observedPermissionsBoundary =
+            observedRole.Role?.PermissionsBoundary?.PermissionsBoundaryArn;
 
-          return {
-            roleArn,
-            roleName,
-            roleId: created.Role?.RoleId,
-            path: created.Role?.Path ?? news.path ?? "/",
-            assumeRolePolicyDocument: news.assumeRolePolicyDocument,
-            managedPolicyArns: news.managedPolicyArns ?? [],
-            inlinePolicies: news.inlinePolicies ?? {},
-            description: news.description,
-            maxSessionDuration: news.maxSessionDuration,
-            permissionsBoundary: news.permissionsBoundary,
-            tags,
-          };
-        }),
-        update: Effect.fn(function* ({ id, news, olds, output, session }) {
-          yield* iam.updateAssumeRolePolicy({
-            RoleName: output.roleName,
-            PolicyDocument: stringifyPolicyDocument(
-              news.assumeRolePolicyDocument,
-            ),
-          });
+          // Sync assume-role policy — only call updateAssumeRolePolicy
+          // when the document actually differs.
+          if (
+            JSON.stringify(observedAssumePolicy ?? null) !==
+            JSON.stringify(news.assumeRolePolicyDocument)
+          ) {
+            yield* iam.updateAssumeRolePolicy({
+              RoleName: roleName,
+              PolicyDocument: stringifyPolicyDocument(
+                news.assumeRolePolicyDocument,
+              ),
+            });
+          }
 
+          // Sync description / maxSessionDuration via updateRole.
           if (
-            news.description !== olds.description ||
-            news.maxSessionDuration !== olds.maxSessionDuration
+            observedDescription !== news.description ||
+            observedMaxSessionDuration !== news.maxSessionDuration
           ) {
             yield* iam.updateRole({
-              RoleName: output.roleName,
+              RoleName: roleName,
               Description: news.description,
               MaxSessionDuration: news.maxSessionDuration,
             });
           }
 
-          if (news.permissionsBoundary !== olds.permissionsBoundary) {
+          // Sync permissions boundary — put when desired, delete when
+          // cleared, no-op when unchanged.
+          if (news.permissionsBoundary !== observedPermissionsBoundary) {
             if (news.permissionsBoundary) {
               yield* iam.putRolePermissionsBoundary({
-                RoleName: output.roleName,
+                RoleName: roleName,
                 PermissionsBoundary: news.permissionsBoundary,
               });
-            } else if (olds.permissionsBoundary) {
+            } else if (observedPermissionsBoundary) {
               yield* iam
                 .deleteRolePermissionsBoundary({
-                  RoleName: output.roleName,
+                  RoleName: roleName,
                 })
                 .pipe(
                   Effect.catchTag("NoSuchEntityException", () => Effect.void),
@@ -390,49 +391,58 @@ export const RoleProvider = () =>
             }
           }
 
+          // Sync managed and inline policies — observe the live state
+          // and apply only the delta. This is robust to manual edits in
+          // the AWS console and to adoption.
+          const [observedManagedPolicies, observedInlinePolicies] =
+            yield* Effect.all([
+              readManagedPolicies(roleName),
+              readInlinePolicies(roleName),
+            ]);
           yield* syncManagedPolicies({
-            roleName: output.roleName,
-            olds: olds.managedPolicyArns ?? [],
+            roleName,
+            olds: observedManagedPolicies,
             news: news.managedPolicyArns ?? [],
           });
           yield* syncInlinePolicies({
-            roleName: output.roleName,
-            olds: olds.inlinePolicies ?? {},
+            roleName,
+            olds: observedInlinePolicies,
             news: news.inlinePolicies ?? {},
           });
 
-          const oldTags = {
-            ...(yield* createInternalTags(id)),
-            ...olds.tags,
-          };
-          const newTags = {
-            ...(yield* createInternalTags(id)),
-            ...news.tags,
-          };
-          const { removed, upsert } = diffTags(oldTags, newTags);
+          // Sync tags against the cloud's actual tags so adoption /
+          // out-of-band tag changes converge.
+          const observedTags = yield* readTags(roleName);
+          const { removed, upsert } = diffTags(observedTags, desiredTags);
           if (upsert.length > 0) {
             yield* iam.tagRole({
-              RoleName: output.roleName,
+              RoleName: roleName,
               Tags: upsert,
             });
           }
           if (removed.length > 0) {
             yield* iam.untagRole({
-              RoleName: output.roleName,
+              RoleName: roleName,
               TagKeys: removed,
             });
           }
 
-          const liveRole = yield* iam.getRole({
-            RoleName: output.roleName,
-          });
+          // Re-read for fresh attributes after all mutations.
+          const liveRole = yield* iam.getRole({ RoleName: roleName });
+          const roleArn = (liveRole.Role?.Arn ??
+            observedRole.Role?.Arn ??
+            `arn:aws:iam::${(yield* AWSEnvironment).accountId}:role/${roleName}`) as RoleArn;
 
-          yield* session.note(output.roleArn);
+          yield* session.note(roleArn);
           return {
-            roleArn: (liveRole.Role?.Arn ?? output.roleArn) as RoleArn,
-            roleName: liveRole.Role?.RoleName ?? output.roleName,
-            roleId: liveRole.Role?.RoleId ?? output.roleId,
-            path: liveRole.Role?.Path ?? output.path,
+            roleArn,
+            roleName: liveRole.Role?.RoleName ?? roleName,
+            roleId: liveRole.Role?.RoleId ?? observedRole.Role?.RoleId,
+            path:
+              liveRole.Role?.Path ??
+              observedRole.Role?.Path ??
+              news.path ??
+              "/",
             assumeRolePolicyDocument: news.assumeRolePolicyDocument,
             managedPolicyArns: news.managedPolicyArns ?? [],
             inlinePolicies: news.inlinePolicies ?? {},
@@ -442,7 +452,7 @@ export const RoleProvider = () =>
             permissionsBoundary:
               liveRole.Role?.PermissionsBoundary?.PermissionsBoundaryArn ??
               news.permissionsBoundary,
-            tags: newTags,
+            tags: desiredTags,
           };
         }),
         delete: Effect.fn(function* ({ output }) {

package/src/AWS/IAM/SAMLProvider.ts

@@ -101,91 +101,115 @@ export const SAMLProviderProvider = () =>
         tags: toTagRecord(tags.Tags),
       };
     }),
-    create: Effect.fn(function* ({ id, news, session }) {
+    reconcile: Effect.fn(function* ({ id, news, output, session }) {
       const internalTags = yield* createInternalTags(id);
-      const tags = {
+      const desiredTags = {
         ...internalTags,
         ...news.tags,
       };
-      const response = yield* iam
-        .createSAMLProvider({
-          Name: news.name,
-          SAMLMetadataDocument: news.samlMetadataDocument,
-          AssertionEncryptionMode: news.assertionEncryptionMode,
-          AddPrivateKey: news.addPrivateKey
-            ? unwrapRedactedString(news.addPrivateKey)
-            : undefined,
-          Tags: Object.entries(tags).map(([Key, Value]) => ({
-            Key,
-            Value,
-          })),
-        })
+      const accountId = (yield* AWSEnvironment).accountId;
+      const samlProviderArn =
+        output?.samlProviderArn ??
+        `arn:aws:iam::${accountId}:saml-provider/${news.name}`;
+
+      // Observe — `getSAMLProvider` returns the metadata, encryption
+      // mode, and UUID; absence is `NoSuchEntityException`.
+      let observed = yield* iam
+        .getSAMLProvider({ SAMLProviderArn: samlProviderArn })
         .pipe(
-          Effect.catchTag("EntityAlreadyExistsException", () =>
-            Effect.gen(function* () {
-              const accountId = (yield* AWSEnvironment).accountId;
-              const existingArn = `arn:aws:iam::${accountId}:saml-provider/${news.name}`;
-              const existingTags = yield* iam.listSAMLProviderTags({
-                SAMLProviderArn: existingArn,
-              });
-              if (!hasTags(internalTags, existingTags.Tags)) {
-                return yield* Effect.fail(
-                  new Error(
-                    `SAML provider '${news.name}' already exists and is not managed by alchemy`,
-                  ),
-                );
-              }
-              return { SAMLProviderArn: existingArn };
-            }),
+          Effect.catchTag("NoSuchEntityException", () =>
+            Effect.succeed(undefined),
           ),
         );
-      const samlProviderArn = response.SAMLProviderArn ?? news.name;
-      yield* session.note(samlProviderArn);
-      return {
-        samlProviderArn,
-        name: news.name,
-        samlProviderUUID: undefined,
-        samlMetadataDocument: news.samlMetadataDocument,
-        assertionEncryptionMode: news.assertionEncryptionMode,
-        tags,
-      };
-    }),
-    update: Effect.fn(function* ({ id, news, olds, output, session }) {
-      yield* iam.updateSAMLProvider({
-        SAMLProviderArn: output.samlProviderArn,
-        SAMLMetadataDocument:
-          news.samlMetadataDocument !== olds.samlMetadataDocument
-            ? news.samlMetadataDocument
-            : undefined,
-        AssertionEncryptionMode: news.assertionEncryptionMode,
-        AddPrivateKey: news.addPrivateKey
-          ? unwrapRedactedString(news.addPrivateKey)
-          : undefined,
+
+      // Ensure — create when missing. Race with a peer is recovered by
+      // verifying alchemy ownership tags on the existing provider.
+      if (!observed) {
+        const created = yield* iam
+          .createSAMLProvider({
+            Name: news.name,
+            SAMLMetadataDocument: news.samlMetadataDocument,
+            AssertionEncryptionMode: news.assertionEncryptionMode,
+            AddPrivateKey: news.addPrivateKey
+              ? unwrapRedactedString(news.addPrivateKey)
+              : undefined,
+            Tags: Object.entries(desiredTags).map(([Key, Value]) => ({
+              Key,
+              Value,
+            })),
+          })
+          .pipe(
+            Effect.catchTag("EntityAlreadyExistsException", () =>
+              Effect.gen(function* () {
+                const existingTags = yield* iam.listSAMLProviderTags({
+                  SAMLProviderArn: samlProviderArn,
+                });
+                if (!hasTags(internalTags, existingTags.Tags)) {
+                  return yield* Effect.fail(
+                    new Error(
+                      `SAML provider '${news.name}' already exists and is not managed by alchemy`,
+                    ),
+                  );
+                }
+                return { SAMLProviderArn: samlProviderArn };
+              }),
+            ),
+          );
+        observed = yield* iam.getSAMLProvider({
+          SAMLProviderArn: created.SAMLProviderArn ?? samlProviderArn,
+        });
+      } else {
+        // Sync metadata / encryption mode — `updateSAMLProvider` is a
+        // partial update; only push the doc when it actually differs.
+        if (
+          (observed.SAMLMetadataDocument ?? undefined) !==
+            news.samlMetadataDocument ||
+          observed.AssertionEncryptionMode !== news.assertionEncryptionMode ||
+          news.addPrivateKey !== undefined
+        ) {
+          yield* iam.updateSAMLProvider({
+            SAMLProviderArn: samlProviderArn,
+            SAMLMetadataDocument:
+              (observed.SAMLMetadataDocument ?? undefined) !==
+              news.samlMetadataDocument
+                ? news.samlMetadataDocument
+                : undefined,
+            AssertionEncryptionMode: news.assertionEncryptionMode,
+            AddPrivateKey: news.addPrivateKey
+              ? unwrapRedactedString(news.addPrivateKey)
+              : undefined,
+          });
+        }
+      }
+
+      // Sync tags against the cloud's actual tags.
+      const observedTagsResp = yield* iam.listSAMLProviderTags({
+        SAMLProviderArn: samlProviderArn,
       });
-      const internalTags = yield* createInternalTags(id);
-      const oldTags = { ...internalTags, ...(olds.tags ?? {}) };
-      const newTags = { ...internalTags, ...(news.tags ?? {}) };
-      const { removed, upsert } = diffTags(oldTags, newTags);
+      const observedTags = toTagRecord(observedTagsResp.Tags);
+      const { removed, upsert } = diffTags(observedTags, desiredTags);
       if (upsert.length > 0) {
         yield* iam.tagSAMLProvider({
-          SAMLProviderArn: output.samlProviderArn,
+          SAMLProviderArn: samlProviderArn,
           Tags: upsert,
         });
       }
       if (removed.length > 0) {
         yield* iam.untagSAMLProvider({
-          SAMLProviderArn: output.samlProviderArn,
+          SAMLProviderArn: samlProviderArn,
           TagKeys: removed,
         });
       }
-      yield* session.note(output.samlProviderArn);
+
+      yield* session.note(samlProviderArn);
       return {
-        samlProviderArn: output.samlProviderArn,
-        name: output.name,
-        samlProviderUUID: output.samlProviderUUID,
+        samlProviderArn,
+        name: news.name,
+        samlProviderUUID:
+          observed?.SAMLProviderUUID ?? output?.samlProviderUUID,
         samlMetadataDocument: news.samlMetadataDocument,
         assertionEncryptionMode: news.assertionEncryptionMode,
-        tags: newTags,
+        tags: desiredTags,
       };
     }),
     delete: Effect.fn(function* ({ output }) {

package/src/AWS/IAM/SSHPublicKey.ts

@@ -96,49 +96,59 @@ export const SSHPublicKeyProvider = () =>
         uploadDate: response.SSHPublicKey.UploadDate,
       };
     }),
-    create: Effect.fn(function* ({ news, session }) {
-      const created = yield* iam.uploadSSHPublicKey({
-        UserName: news.userName,
-        SSHPublicKeyBody: news.sshPublicKeyBody,
-      });
-      if (!created.SSHPublicKey?.SSHPublicKeyId) {
-        return yield* Effect.fail(
-          new Error(`uploadSSHPublicKey returned no key id`),
-        );
-      }
-      if (
-        news.status !== undefined &&
-        created.SSHPublicKey.Status !== news.status
-      ) {
-        yield* iam.updateSSHPublicKey({
+    reconcile: Effect.fn(function* ({ news, output, session }) {
+      // Observe — SSH key ids are AWS-generated; we can only locate the
+      // existing key when we have its id from a prior output. The body
+      // and identity are immutable (`diff` triggers replacement on body
+      // change), so a missing key always means we need to upload.
+      const observed = output
+        ? yield* iam
+            .getSSHPublicKey({
+              UserName: output.userName,
+              SSHPublicKeyId: output.sshPublicKeyId,
+              Encoding: "SSH",
+            })
+            .pipe(
+              Effect.map((r) => r.SSHPublicKey),
+              Effect.catchTag("NoSuchEntityException", () =>
+                Effect.succeed(undefined),
+              ),
+            )
+        : undefined;
+
+      // Ensure — upload when missing.
+      let key = observed;
+      if (!key?.SSHPublicKeyId) {
+        const uploaded = yield* iam.uploadSSHPublicKey({
           UserName: news.userName,
-          SSHPublicKeyId: created.SSHPublicKey.SSHPublicKeyId,
-          Status: news.status,
+          SSHPublicKeyBody: news.sshPublicKeyBody,
         });
+        if (!uploaded.SSHPublicKey?.SSHPublicKeyId) {
+          return yield* Effect.fail(
+            new Error(`uploadSSHPublicKey returned no key id`),
+          );
+        }
+        key = uploaded.SSHPublicKey;
       }
-      yield* session.note(created.SSHPublicKey.SSHPublicKeyId);
-      return {
-        userName: created.SSHPublicKey.UserName,
-        sshPublicKeyId: created.SSHPublicKey.SSHPublicKeyId,
-        fingerprint: created.SSHPublicKey.Fingerprint,
-        sshPublicKeyBody: created.SSHPublicKey.SSHPublicKeyBody,
-        status: news.status ?? created.SSHPublicKey.Status,
-        uploadDate: created.SSHPublicKey.UploadDate,
-      };
-    }),
-    update: Effect.fn(function* ({ news, output, session }) {
-      const status = news.status ?? output.status;
-      if (status !== output.status) {
+
+      // Sync — apply the desired status when it differs from observed.
+      const desiredStatus = news.status ?? key.Status;
+      if (desiredStatus !== key.Status) {
         yield* iam.updateSSHPublicKey({
-          UserName: output.userName,
-          SSHPublicKeyId: output.sshPublicKeyId,
-          Status: status,
+          UserName: news.userName,
+          SSHPublicKeyId: key.SSHPublicKeyId!,
+          Status: desiredStatus,
         });
       }
-      yield* session.note(output.sshPublicKeyId);
+
+      yield* session.note(key.SSHPublicKeyId!);
       return {
-        ...output,
-        status,
+        userName: key.UserName,
+        sshPublicKeyId: key.SSHPublicKeyId!,
+        fingerprint: key.Fingerprint,
+        sshPublicKeyBody: key.SSHPublicKeyBody,
+        status: desiredStatus,
+        uploadDate: key.UploadDate,
       };
     }),
     delete: Effect.fn(function* ({ output }) {