1import * as Effect from "effect/Effect";
2import * as Binding from "../../Binding.ts";
3import { isBindingHost } from "../Lambda/Function.ts";
4import type { CloudControlBindingOptions } from "./BindingOptions.ts";
5
6/**
7 * Shared scaffolding for Cloud Control HTTP bindings.
8 *
9 * NOT exported from `index.ts` — every `{Op}Http.ts` in this service is a
10 * thin `Layer.effect(Cap, makeCloudControlHttpBinding({ … }))` over the
11 * builder below. Everything except the operation and the IAM action is
12 * boilerplate.
13 *
14 * All Cloud Control bindings are account-level: the `cloudformation:*Resource`
15 * actions do not support resource-level scoping (the target is an arbitrary
16 * CloudFormation type name), so the grant is on `*`. Because Cloud Control
17 * invokes the resource type's handlers with the caller's credentials, callers
18 * of handler-invoking operations may pass extra
19 * {@link CloudControlBindingOptions.handlerPolicyStatements} that are attached
20 * to the host alongside the Cloud Control grant.
21 */
22export const makeCloudControlHttpBinding = <I, A, E, R>(options: {
23 /** Fully-qualified binding tag, e.g. `AWS.CloudControl.GetResource`. */
24 tag: string;
25 /** The distilled operation, invoked with the caller's request as-is. */
26 operation: Effect.Effect<(input: I) => Effect.Effect<A, E>, never, R>;
27 /** IAM actions granted on `*` (Cloud Control has no resource-level scoping). */
28 actions: readonly string[];
29}) =>
30 Effect.gen(function* () {
31 const op = yield* options.operation;
32
33 return Effect.fn(function* (bindOptions?: CloudControlBindingOptions) {
34 if (!globalThis.__ALCHEMY_RUNTIME__) {
35 const host = yield* Binding.Host;
36 if (isBindingHost(host)) {
37 yield* host.bind`Allow(${host}, ${options.tag}())`({
38 policyStatements: [
39 {
40 Effect: "Allow",
41 Action: [...options.actions],
42 Resource: ["*"],
43 },
44 ...(bindOptions?.handlerPolicyStatements ?? []),
45 ],
46 });
47 }
48 }
49 return Effect.fn(options.tag)(function* (request?: I) {
50 return yield* op((request ?? {}) as I);
51 });
52 });
53 });