1import type * as kms from "@distilled.cloud/aws/kms";
2import type * as Effect from "effect/Effect";
3import * as Binding from "../../Binding.ts";
4import type { AliasName } from "./Alias.ts";
5import type { Key } from "./Key.ts";
6
7export interface VerifyMacRequest extends Omit<kms.VerifyMacRequest, "KeyId"> {}
8
9/**
10 * Runtime binding for `kms:VerifyMac`.
11 *
12 * Bind this operation to an HMAC KMS {@link Key} (or the `alias/...` name of
13 * a pre-existing key) to get a callable that automatically injects the
14 * `KeyId`. A mismatched MAC surfaces as the typed
15 * `KMSInvalidMacException` — a valid MAC returns `MacValid: true`.
16 *
17 * ### Message Authentication
18 * **Example:** Verify an HMAC
19 * ```typescript
20 * const verifyMac = yield* AWS.KMS.VerifyMac(hmacKey);
21 *
22 * const { MacValid } = yield* verifyMac({
23 * Message: new TextEncoder().encode("session-token-payload"),
24 * Mac: mac,
25 * MacAlgorithm: "HMAC_SHA_256",
26 * });
27 * ```
28 *
29 * **Example:** Treat a Bad MAC as a Value
30 * ```typescript
31 * const valid = yield* verifyMac({ Message, Mac, MacAlgorithm }).pipe(
32 * Effect.map(() => true),
33 * Effect.catchTag("KMSInvalidMacException", () => Effect.succeed(false)),
34 * );
35 * ```
36 *
37 * @binding
38 */
39export interface VerifyMac extends Binding.Service<
40 VerifyMac,
41 "AWS.KMS.VerifyMac",
42 (
43 key: Key | AliasName,
44 ) => Effect.Effect<
45 (
46 request: VerifyMacRequest,
47 ) => Effect.Effect<kms.VerifyMacResponse, kms.VerifyMacError>
48 >
49> {}
50
51export const VerifyMac = Binding.Service<VerifyMac>("AWS.KMS.VerifyMac");