1import * as binaryauthorization from "@distilled.cloud/gcp/binaryauthorization_v1";
2import * as Effect from "effect/Effect";
3import * as Layer from "effect/Layer";
4import type { Attestor } from "./Attestor.ts";
5import { bindGcpHost } from "../Host.ts";
6import { grantFor } from "../HttpBinding.ts";
7import {
8 ValidateAttestation,
9 type ValidateAttestationRequest,
10} from "./ValidateAttestation.ts";
11
12/**
13 * HTTP implementation of {@link ValidateAttestation}.
14 *
15 * @layer
16 * @provides GCP.BinaryAuthorization.ValidateAttestation
17 */
18export const ValidateAttestationHttp = Layer.effect(
19 ValidateAttestation,
20 Effect.gen(function* () {
21 const validate =
22 yield* binaryauthorization.validateAttestationOccurrenceProjectsAttestors;
23 return Effect.fn(function* (attestor: Attestor) {
24 yield* bindGcpHost({
25 tag: "GCP.BinaryAuthorization.ValidateAttestation",
26 resource: attestor,
27 iam: [
28 grantFor(
29 {
30 role: "roles/binaryauthorization.attestorsVerifier",
31 on: "binaryauthorization.attestor",
32 },
33 attestor.name,
34 ),
35 ],
36 });
37 const project = yield* attestor.project;
38 const attestorId = yield* attestor.attestorId;
39 const noteReference = yield* attestor.noteReference;
40 return Effect.fn(
41 `GCP.BinaryAuthorization.ValidateAttestation(${attestor.LogicalId})`,
42 )(function* (request: ValidateAttestationRequest) {
43 const projectId = yield* project;
44 const id = yield* attestorId;
45 const occurrenceNote = request.occurrenceNote ?? (yield* noteReference);
46 return yield* validate({
47 attestor: `projects/${projectId}/attestors/${id}`,
48 body: {
49 occurrenceResourceUri: request.occurrenceResourceUri,
50 occurrenceNote,
51 attestation: request.attestation,
52 },
53 });
54 });
55 });
56 }),
57);