1import * as paymentcryptographydata from "@distilled.cloud/aws/payment-cryptography-data";
2import * as Effect from "effect/Effect";
3import * as Layer from "effect/Layer";
4import * as Binding from "../../Binding.ts";
5import { isBindingHost } from "../Lambda/Function.ts";
6import {
7 GenerateMacEmvPinChange,
8 type GenerateMacEmvPinChangeRequest,
9} from "./GenerateMacEmvPinChange.ts";
10import type { Key } from "./Key.ts";
11
12/**
13 * HTTP implementation of {@link GenerateMacEmvPinChange} — bespoke (not
14 * scaffolded): the operation spans three keys (the new PIN PEK plus the
15 * secure-messaging integrity and confidentiality keys). Grants the host
16 * Function `payment-cryptography:GenerateMacEmvPinChange` on all three key
17 * ARNs and injects each identifier at runtime.
18 */
19export const GenerateMacEmvPinChangeHttp = Layer.effect(
20 GenerateMacEmvPinChange,
21 Effect.gen(function* () {
22 const generateMacEmvPinChange =
23 yield* paymentcryptographydata.generateMacEmvPinChange;
24
25 return Effect.fn(function* <P extends Key, I extends Key, C extends Key>(
26 newPinPek: P,
27 secureMessagingIntegrityKey: I,
28 secureMessagingConfidentialityKey: C,
29 ) {
30 const NewPinPekArn = yield* newPinPek.keyArn;
31 const IntegrityKeyArn = yield* secureMessagingIntegrityKey.keyArn;
32 const ConfidentialityKeyArn =
33 yield* secureMessagingConfidentialityKey.keyArn;
34 if (!globalThis.__ALCHEMY_RUNTIME__) {
35 const host = yield* Binding.Host;
36 if (isBindingHost(host)) {
37 for (const key of [
38 newPinPek,
39 secureMessagingIntegrityKey,
40 secureMessagingConfidentialityKey,
41 ]) {
42 yield* host.bind`Allow(${host}, AWS.PaymentCryptography.GenerateMacEmvPinChange(${key}))`(
43 {
44 policyStatements: [
45 {
46 Effect: "Allow",
47 Action: ["payment-cryptography:GenerateMacEmvPinChange"],
48 Resource: [key.keyArn],
49 },
50 ],
51 },
52 );
53 }
54 }
55 }
56 return Effect.fn(
57 `AWS.PaymentCryptography.GenerateMacEmvPinChange(${newPinPek.LogicalId})`,
58 )(function* (request: GenerateMacEmvPinChangeRequest) {
59 return yield* generateMacEmvPinChange({
60 ...request,
61 NewPinPekIdentifier: yield* NewPinPekArn,
62 SecureMessagingIntegrityKeyIdentifier: yield* IntegrityKeyArn,
63 SecureMessagingConfidentialityKeyIdentifier:
64 yield* ConfidentialityKeyArn,
65 });
66 });
67 });
68 }),
69);