1import * as GCP from "@/GCP";
2import * as Effect from "effect/Effect";
3import { serveProbes } from "../../bindingHost.ts";
4import { KEY_RING_ID, kmsTestId } from "../common.ts";
5
6/** Key the bindings are granted on (roles/cloudkms.cryptoKey{En,De}crypter). */
7export const Cipher = Effect.gen(function* () {
8 const ring = yield* GCP.KMS.KeyRing("Keys", {
9 keyRingId: KEY_RING_ID,
10 location: "us-central1",
11 });
12 return yield* GCP.KMS.CryptoKey("Cipher", {
13 keyRing: ring.name,
14 cryptoKeyId: kmsTestId("binding"),
15 });
16});
17
18/**
19 * Effect-native Cloud Run service exercising every KMS binding as its own
20 * runtime service account. Deployed from {@link ../Bindings.test.ts}.
21 */
22export default class KmsBindingsHost extends GCP.Function<KmsBindingsHost>()(
23 "KmsBindingsHost",
24 { main: import.meta.url, invokerIamDisabled: true },
25 Effect.gen(function* () {
26 const encrypt = yield* GCP.KMS.Encrypt(Cipher);
27 const decrypt = yield* GCP.KMS.Decrypt(Cipher);
28 const plaintext = btoa("alchemy-kms-binding");
29
30 return {
31 fetch: serveProbes({
32 roundTrip: Effect.gen(function* () {
33 const encrypted = yield* encrypt({ body: { plaintext } });
34 const decrypted = yield* decrypt({
35 body: { ciphertext: encrypted.ciphertext },
36 });
37 return {
38 plaintext,
39 ciphertext: encrypted.ciphertext,
40 decrypted: decrypted.plaintext,
41 };
42 }),
43 }),
44 };
45 }).pipe(
46 Effect.provide(GCP.KMS.EncryptHttp),
47 Effect.provide(GCP.KMS.DecryptHttp),
48 ),
49) {}