feat(aws/dynamodb): support Cloudflare Worker hosts in HTTP bindings (#1782)

Author: sam-goodwin

packages/alchemy/src/AWS/DynamoDB/BatchExecuteStatementHttp.ts

@@ -1,49 +1,43 @@
 import * as DynamoDB from "@distilled.cloud/aws/dynamodb";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
-import * as Binding from "../../Binding.ts";
 import * as Output from "../../Output.ts";
-import { isBindingHost } from "../Lambda/Function.ts";
 import {
   BatchExecuteStatement,
   type BatchExecuteStatementRequest,
   type BatchExecuteStatementTables,
   sortBatchExecuteStatementTables,
 } from "./BatchExecuteStatement.ts";
+import { grantTables, signed, tablesRegion } from "./BindingHttp.ts";
 
 export const BatchExecuteStatementHttp = Layer.effect(
   BatchExecuteStatement,
   Effect.gen(function* () {
-    const batchExecuteStatement = yield* DynamoDB.batchExecuteStatement;
-
     return Effect.fn(function* (...tables: BatchExecuteStatementTables) {
       const sortedTables = sortBatchExecuteStatementTables(tables);
-      if (!globalThis.__ALCHEMY_RUNTIME__) {
-        const host = yield* Binding.Host;
-        if (isBindingHost(host)) {
-          yield* host.bind`Allow(${host}, AWS.DynamoDB.BatchExecuteStatement(${sortedTables}))`({
-            policyStatements: [
-              {
-                Effect: "Allow",
-                Action: [
-                  "dynamodb:PartiQLDelete",
-                  "dynamodb:PartiQLInsert",
-                  "dynamodb:PartiQLSelect",
-                  "dynamodb:PartiQLUpdate",
-                ],
-                Resource: sortedTables.flatMap((table) => [
-                  table.tableArn,
-                  Output.interpolate`${table.tableArn}/index/*`,
-                ]),
-              },
+      const access = yield* grantTables(
+        `AWS.DynamoDB.BatchExecuteStatement(${sortedTables.map((table) => table.LogicalId).join(", ")})`,
+        () => [
+          {
+            Effect: "Allow",
+            Action: [
+              "dynamodb:PartiQLDelete",
+              "dynamodb:PartiQLInsert",
+              "dynamodb:PartiQLSelect",
+              "dynamodb:PartiQLUpdate",
             ],
-          });
-        }
-      }
+            Resource: sortedTables.flatMap((table) => [
+              table.tableArn,
+              Output.interpolate`${table.tableArn}/index/*`,
+            ]),
+          },
+        ],
+      );
+      const region = yield* tablesRegion(access, sortedTables);
       return Effect.fn(`AWS.DynamoDB.BatchExecuteStatement(${sortedTables})`)(function* (
         request: BatchExecuteStatementRequest,
       ) {
-        return yield* batchExecuteStatement(request);
+        return yield* signed(access, region, DynamoDB.batchExecuteStatement(request));
       });
     });
   }),

packages/alchemy/src/AWS/DynamoDB/BatchGetItemHttp.ts

@@ -1,15 +1,12 @@
 import * as DynamoDB from "@distilled.cloud/aws/dynamodb";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
-import * as Binding from "../../Binding.ts";
-import { isBindingHost } from "../Lambda/Function.ts";
 import { BatchGetItem, type BatchGetItemRequest, type BatchGetItemTables } from "./BatchGetItem.ts";
+import { grantTables, signed, tablesRegion } from "./BindingHttp.ts";
 
 export const BatchGetItemHttp = Layer.effect(
   BatchGetItem,
   Effect.gen(function* () {
-    const batchGetItem = yield* DynamoDB.batchGetItem;
-
     return Effect.fn(function* (...tables: BatchGetItemTables) {
       const sortedTables = sortTables(tables);
       const tableNames = new Map(
@@ -30,20 +27,17 @@ export const BatchGetItemHttp = Layer.effect(
         return yield* TableName;
       });
 
-      if (!globalThis.__ALCHEMY_RUNTIME__) {
-        const host = yield* Binding.Host;
-        if (isBindingHost(host)) {
-          yield* host.bind`Allow(${host}, AWS.DynamoDB.BatchGetItem(${sortedTables}))`({
-            policyStatements: [
-              {
-                Effect: "Allow",
-                Action: ["dynamodb:BatchGetItem"],
-                Resource: sortedTables.map((table) => table.tableArn),
-              },
-            ],
-          });
-        }
-      }
+      const access = yield* grantTables(
+        `AWS.DynamoDB.BatchGetItem(${sortedTables.map((table) => table.LogicalId).join(", ")})`,
+        () => [
+          {
+            Effect: "Allow",
+            Action: ["dynamodb:BatchGetItem"],
+            Resource: sortedTables.map((table) => table.tableArn),
+          },
+        ],
+      );
+      const region = yield* tablesRegion(access, sortedTables);
 
       return Effect.fn(`AWS.DynamoDB.BatchGetItem(${sortedTables})`)(function* (
         request: BatchGetItemRequest,
@@ -56,10 +50,14 @@ export const BatchGetItemHttp = Layer.effect(
             }),
         );
 
-        return yield* batchGetItem({
-          ...request,
-          RequestItems: Object.fromEntries(requestItems),
-        });
+        return yield* signed(
+          access,
+          region,
+          DynamoDB.batchGetItem({
+            ...request,
+            RequestItems: Object.fromEntries(requestItems),
+          }),
+        );
       });
     });
   }),

packages/alchemy/src/AWS/DynamoDB/BatchWriteItemHttp.ts

@@ -1,20 +1,17 @@
 import * as DynamoDB from "@distilled.cloud/aws/dynamodb";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
-import * as Binding from "../../Binding.ts";
-import { isBindingHost } from "../Lambda/Function.ts";
 import {
   BatchWriteItem,
   type BatchWriteItemRequest,
   type BatchWriteItemTables,
   sortBatchWriteItemTables,
 } from "./BatchWriteItem.ts";
+import { grantTables, signed, tablesRegion } from "./BindingHttp.ts";
 
 export const BatchWriteItemHttp = Layer.effect(
   BatchWriteItem,
   Effect.gen(function* () {
-    const batchWriteItem = yield* DynamoDB.batchWriteItem;
-
     return Effect.fn(function* (...tables: BatchWriteItemTables) {
       const sortedTables = sortBatchWriteItemTables(tables);
       const tableNames = new Map(
@@ -35,20 +32,17 @@ export const BatchWriteItemHttp = Layer.effect(
         return yield* TableName;
       });
 
-      if (!globalThis.__ALCHEMY_RUNTIME__) {
-        const host = yield* Binding.Host;
-        if (isBindingHost(host)) {
-          yield* host.bind`Allow(${host}, AWS.DynamoDB.BatchWriteItem(${sortedTables}))`({
-            policyStatements: [
-              {
-                Effect: "Allow",
-                Action: ["dynamodb:BatchWriteItem"],
-                Resource: sortedTables.map((table) => table.tableArn),
-              },
-            ],
-          });
-        }
-      }
+      const access = yield* grantTables(
+        `AWS.DynamoDB.BatchWriteItem(${sortedTables.map((table) => table.LogicalId).join(", ")})`,
+        () => [
+          {
+            Effect: "Allow",
+            Action: ["dynamodb:BatchWriteItem"],
+            Resource: sortedTables.map((table) => table.tableArn),
+          },
+        ],
+      );
+      const region = yield* tablesRegion(access, sortedTables);
 
       return Effect.fn(`AWS.DynamoDB.BatchWriteItem(${sortedTables})`)(function* (
         request: BatchWriteItemRequest,
@@ -61,10 +55,14 @@ export const BatchWriteItemHttp = Layer.effect(
             }),
         );
 
-        return yield* batchWriteItem({
-          ...request,
-          RequestItems: Object.fromEntries(requestItems),
-        });
+        return yield* signed(
+          access,
+          region,
+          DynamoDB.batchWriteItem({
+            ...request,
+            RequestItems: Object.fromEntries(requestItems),
+          }),
+        );
       });
     });
   }),