1import * as Effect from "effect/Effect";
2import * as Redacted from "effect/Redacted";
3import { AuthError } from "../Auth/AuthProvider.ts";
4import { getEnvRedacted } from "../Auth/Env.ts";
5import {
6 makeStoredAuthProvider,
7 storedSecret,
8 type StoredAuthConfig,
9} from "../Auth/StoredAuthProvider.ts";
10
11export const PRISMA_AUTH_PROVIDER_NAME = "Prisma";
12
13export type PrismaAuthConfig = StoredAuthConfig;
14
15export interface PrismaResolvedCredentials {
16 type: "serviceToken";
17 serviceToken: Redacted.Redacted<string>;
18 source: { type: PrismaAuthConfig["method"] | "env"; details?: string };
19}
20
21const prismaAuth = makeStoredAuthProvider<PrismaResolvedCredentials>({
22 provider: PRISMA_AUTH_PROVIDER_NAME,
23 fields: [
24 {
25 name: "serviceToken",
26 label: "Prisma Service Token",
27 secret: true,
28 validate: (value) => (value.trim().length === 0 ? "Required" : undefined),
29 },
30 ],
31 toResolved: (values) => ({
32 type: "serviceToken",
33 serviceToken: storedSecret(values.serviceToken) ?? Redacted.make(""),
34 source: { type: "stored" },
35 }),
36 readEnvironment: Effect.gen(function* () {
37 const serviceToken = yield* getEnvRedacted("PRISMA_SERVICE_TOKEN");
38 const apiToken = yield* getEnvRedacted("PRISMA_API_TOKEN");
39 const token = serviceToken ?? apiToken;
40 if (token === undefined || Redacted.value(token).trim().length === 0) {
41 return yield* new AuthError({
42 message:
43 "Prisma CI credentials not found. Set PRISMA_SERVICE_TOKEN or PRISMA_API_TOKEN.",
44 });
45 }
46 return {
47 type: "serviceToken" as const,
48 serviceToken: Redacted.make(Redacted.value(token).trim()),
49 source: {
50 type: "env" as const,
51 details:
52 serviceToken === undefined
53 ? "PRISMA_API_TOKEN"
54 : "PRISMA_SERVICE_TOKEN",
55 },
56 };
57 }),
58 environment: [
59 {
60 name: "PRISMA_SERVICE_TOKEN",
61 required: true,
62 secret: true,
63 alternatives: ["PRISMA_API_TOKEN"],
64 description: "Prisma Platform service token.",
65 },
66 {
67 name: "PRISMA_API_URL",
68 required: false,
69 alternatives: ["PRISMA_MANAGEMENT_API_URL"],
70 description: "Management API base URL override.",
71 },
72 ],
73});
74
75/**
76 * Layer that registers the Prisma Management API auth provider.
77 */
78export const PrismaAuth = prismaAuth.layer;
79
80/** Schema of Prisma's inline static-token values. */
81export const PrismaStoredCredentials = prismaAuth.storedSchema;
82export type PrismaStoredCredentials = typeof PrismaStoredCredentials.Type;