import * as HttpClient from "effect/unstable/http/HttpClient";
import * as redacted from "effect/Redacted";
import * as S from "effect/Schema";
import * as API from "../client/api.js";
import * as T from "../traits.js";
import * as C from "../category.js";
import { SensitiveString } from "../sensitive.js";
const svc = T.AwsApiService({
    sdkId: "EKS Auth",
    serviceShapeName: "EKSAuthFrontend",
});
const auth = T.AwsAuthSigv4({ name: "eks-auth" });
const ver = T.ServiceVersion("2023-11-26");
const proto = T.AwsProtocolsRestJson1();
const rules = T.EndpointResolver((p, _) => {
    const { Region, UseFIPS = false, Endpoint } = p;
    const e = (u, p = {}, h = {}) => ({
        type: "endpoint",
        endpoint: { url: u, properties: p, headers: h },
    });
    const err = (m) => ({
        type: "error",
        message: m,
    });
    if (Endpoint != null) {
        if (UseFIPS === true) {
            return err("Invalid Configuration: FIPS and custom endpoint are not supported");
        }
        return e(Endpoint);
    }
    if (Region != null) {
        {
            const PartitionResult = _.partition(Region);
            if (PartitionResult != null && PartitionResult !== false) {
                if (true === _.getAttr(PartitionResult, "supportsDualStack")) {
                    if (UseFIPS === true) {
                        if (_.getAttr(PartitionResult, "supportsFIPS") === true) {
                            return e(`https://eks-auth-fips.${Region}.${_.getAttr(PartitionResult, "dualStackDnsSuffix")}`);
                        }
                        return err("FIPS is enabled but this partition does not support FIPS");
                    }
                    return e(`https://eks-auth.${Region}.${_.getAttr(PartitionResult, "dualStackDnsSuffix")}`);
                }
                if (UseFIPS === true) {
                    if (_.getAttr(PartitionResult, "supportsFIPS") === true) {
                        return e(`https://eks-auth-fips.${Region}.${_.getAttr(PartitionResult, "dnsSuffix")}`);
                    }
                    return err("FIPS is enabled but this partition does not support FIPS");
                }
                return e(`https://eks-auth.${Region}.${_.getAttr(PartitionResult, "dnsSuffix")}`);
            }
        }
    }
    return err("Invalid Configuration: Missing Region");
});
export const AssumeRoleForPodIdentityRequest = 
/*@__PURE__*/ /*#__PURE__*/ S.suspend(() => S.Struct({
    clusterName: S.String.pipe(T.HttpLabel("clusterName")),
    token: SensitiveString,
}).pipe(T.all(T.Http({
    method: "POST",
    uri: "/clusters/{clusterName}/assume-role-for-pod-identity",
}), svc, auth, proto, ver, rules))).annotate({
    identifier: "AssumeRoleForPodIdentityRequest",
});
export const Subject = /*@__PURE__*/ /*#__PURE__*/ S.suspend(() => S.Struct({ namespace: S.String, serviceAccount: S.String })).annotate({ identifier: "Subject" });
export const PodIdentityAssociation = /*@__PURE__*/ /*#__PURE__*/ S.suspend(() => S.Struct({ associationArn: S.String, associationId: S.String })).annotate({
    identifier: "PodIdentityAssociation",
});
export const AssumedRoleUser = /*@__PURE__*/ /*#__PURE__*/ S.suspend(() => S.Struct({ arn: S.String, assumeRoleId: S.String })).annotate({
    identifier: "AssumedRoleUser",
});
export const Credentials = /*@__PURE__*/ /*#__PURE__*/ S.suspend(() => S.Struct({
    sessionToken: S.String,
    secretAccessKey: S.String,
    accessKeyId: S.String,
    expiration: S.Date.pipe(T.TimestampFormat("epoch-seconds")),
})).annotate({ identifier: "Credentials" });
export const AssumeRoleForPodIdentityResponse = 
/*@__PURE__*/ /*#__PURE__*/ S.suspend(() => S.Struct({
    subject: Subject,
    audience: S.String,
    podIdentityAssociation: PodIdentityAssociation,
    assumedRoleUser: AssumedRoleUser,
    credentials: Credentials,
})).annotate({
    identifier: "AssumeRoleForPodIdentityResponse",
});
//# Errors
export class AccessDeniedException extends S.TaggedErrorClass()("AccessDeniedException", { message: S.optional(S.String) }).pipe(C.withBadRequestError, C.withAuthError) {
}
export class ExpiredTokenException extends S.TaggedErrorClass()("ExpiredTokenException", { message: S.optional(S.String) }).pipe(C.withBadRequestError) {
}
export class InternalServerException extends S.TaggedErrorClass()("InternalServerException", { message: S.optional(S.String) }).pipe(C.withServerError) {
}
export class InvalidParameterException extends S.TaggedErrorClass()("InvalidParameterException", { message: S.optional(S.String) }).pipe(C.withBadRequestError) {
}
export class InvalidRequestException extends S.TaggedErrorClass()("InvalidRequestException", { message: S.optional(S.String) }).pipe(C.withBadRequestError) {
}
export class InvalidTokenException extends S.TaggedErrorClass()("InvalidTokenException", { message: S.optional(S.String) }).pipe(C.withBadRequestError) {
}
export class ResourceNotFoundException extends S.TaggedErrorClass()("ResourceNotFoundException", { message: S.optional(S.String) }).pipe(C.withBadRequestError) {
}
export class ServiceUnavailableException extends S.TaggedErrorClass()("ServiceUnavailableException", { message: S.optional(S.String) }).pipe(C.withServerError) {
}
export class ThrottlingException extends S.TaggedErrorClass()("ThrottlingException", { message: S.optional(S.String) }).pipe(C.withThrottlingError) {
}
/**
 * The Amazon EKS Auth API and the `AssumeRoleForPodIdentity` action are only used
 * by the EKS Pod Identity Agent.
 *
 * We recommend that applications use the Amazon Web Services SDKs to connect to Amazon Web Services services; if
 * credentials from an EKS Pod Identity association are available in the pod, the latest versions of the
 * SDKs use them automatically.
 */
export const assumeRoleForPodIdentity = /*@__PURE__*/ /*#__PURE__*/ API.make(() => ({
    input: AssumeRoleForPodIdentityRequest,
    output: AssumeRoleForPodIdentityResponse,
    errors: [
        AccessDeniedException,
        ExpiredTokenException,
        InternalServerException,
        InvalidParameterException,
        InvalidRequestException,
        InvalidTokenException,
        ResourceNotFoundException,
        ServiceUnavailableException,
        ThrottlingException,
    ],
}));
//# sourceMappingURL=eks-auth.js.map