@ampless/backend 0.2.0-alpha.1 → 0.2.0-alpha.11

package/dist/index.d.ts

@@ -13,6 +13,8 @@ interface DefineAmplessBackendOpts {
     processorTrusted: FunctionResource;
     processorUntrusted: FunctionResource;
     apiKeyRenewer: FunctionResource;
+    userAdmin: FunctionResource;
+    mcpHandler: FunctionResource;
 }
 type AmplessBackend = any;
 /**
@@ -136,6 +138,33 @@ interface AmplessSchemaModelsOpts {
      * they must point to actual `.js` files inside the user's project.
      */
     resolverPaths?: Partial<AmplessResolverPaths>;
+    /**
+     * Optional Amplify `defineFunction` ref backing the user-admin
+     * AppSync ops (`listAdminUsers` query, `setAdminUserRole` mutation).
+     * When supplied, the corresponding `AdminUser` customType + the two
+     * ops are added to the schema, both gated to `ampless-admin`.
+     *
+     * Typed as `unknown` because `defineFunction`'s return type carries
+     * internal pnpm paths that don't survive declaration emit — same
+     * pattern as `AmplessAuthConfigOpts.postConfirmation`.
+     */
+    userAdminFunction?: unknown;
+    /**
+     * Optional Amplify `defineFunction` ref backing the MCP HTTP Lambda.
+     * When supplied, the Post and PostTag models gain an `allow.resource(...)`
+     * authorization clause granting the Lambda `query` + `mutate` access
+     * via AppSync IAM auth. The existing group-based clauses stay intact —
+     * this just adds a second principal so the Lambda can dispatch tool
+     * calls under its own scoped role, with no Cognito identity or
+     * shared API key involved.
+     *
+     * Phase 4 covers Post + PostTag only (the read/write surface for the
+     * post CRUD tools). Media gets the same treatment in Phase 5 once
+     * the presigned-PUT upload flow lands.
+     *
+     * Typed as `unknown` for the same reason as `userAdminFunction`.
+     */
+    mcpHandlerFunction?: unknown;
 }
 /**
  * The Ampless model + custom query definitions, returned as a plain
@@ -153,6 +182,9 @@ interface AmplessSchemaModelsOpts {
  * extra models.
  */
 declare function amplessSchemaModels(a: any, opts?: AmplessSchemaModelsOpts): {
+    AdminUser?: any;
+    listAdminUsers?: any;
+    setAdminUserRole?: any;
     Post: any;
     Page: any;
     Media: any;

package/dist/index.js

@@ -1,9 +1,11 @@
+import "./chunk-BYXBJQAS.js";
+
 // src/backend.ts
 import { defineBackend } from "@aws-amplify/backend";
 import { Effect, PolicyStatement, AnyPrincipal } from "aws-cdk-lib/aws-iam";
 import { Duration, Stack } from "aws-cdk-lib";
 import { Queue } from "aws-cdk-lib/aws-sqs";
-import { StartingPosition } from "aws-cdk-lib/aws-lambda";
+import { FunctionUrlAuthType, HttpMethod, StartingPosition } from "aws-cdk-lib/aws-lambda";
 import { DynamoEventSource, SqsEventSource } from "aws-cdk-lib/aws-lambda-event-sources";
 import { Rule, Schedule } from "aws-cdk-lib/aws-events";
 import { LambdaFunction } from "aws-cdk-lib/aws-events-targets";
@@ -16,7 +18,9 @@ function defineAmplessBackend(opts) {
     eventDispatcher: opts.eventDispatcher,
     processorTrusted: opts.processorTrusted,
     processorUntrusted: opts.processorUntrusted,
-    apiKeyRenewer: opts.apiKeyRenewer
+    apiKeyRenewer: opts.apiKeyRenewer,
+    userAdmin: opts.userAdmin,
+    mcpHandler: opts.mcpHandler
   });
   const cfnBucket = backend.storage.resources.cfnResources.cfnBucket;
   cfnBucket.publicAccessBlockConfiguration = {
@@ -61,6 +65,22 @@ function defineAmplessBackend(opts) {
       resources: ["arn:aws:cognito-idp:*:*:userpool/*"]
     })
   );
+  backend.userAdmin.resources.lambda.addToRolePolicy(
+    new PolicyStatement({
+      effect: Effect.ALLOW,
+      actions: [
+        "cognito-idp:ListUsers",
+        "cognito-idp:AdminListGroupsForUser",
+        "cognito-idp:AdminAddUserToGroup",
+        "cognito-idp:AdminRemoveUserFromGroup"
+      ],
+      resources: ["arn:aws:cognito-idp:*:*:userpool/*"]
+    })
+  );
+  backend.userAdmin.resources.lambda.addEnvironment(
+    "AMPLESS_USER_POOL_ID",
+    backend.auth.resources.userPool.userPoolId
+  );
   const postTable = backend.data.resources.tables["Post"];
   const cfnPostTable = backend.data.resources.cfnResources.amplifyDynamoDbTables["Post"];
   cfnPostTable.streamSpecification = { streamViewType: "NEW_AND_OLD_IMAGES" };
@@ -149,6 +169,35 @@ function defineAmplessBackend(opts) {
     schedule: Schedule.cron({ minute: "0", hour: "3", day: "1", month: "*", year: "*" }),
     targets: [new LambdaFunction(apiKeyRenewerFn)]
   });
+  const mcpHandlerFn = backend.mcpHandler.resources.lambda;
+  mcpHandlerFn.addToRolePolicy(
+    new PolicyStatement({
+      effect: Effect.ALLOW,
+      actions: ["dynamodb:GetItem"],
+      resources: [kvTable.tableArn]
+    })
+  );
+  mcpHandlerFn.addEnvironment("AMPLESS_KV_TABLE", kvTable.tableName);
+  mcpHandlerFn.addEnvironment(
+    "AMPLESS_APPSYNC_URL",
+    backend.data.resources.cfnResources.cfnGraphqlApi.attrGraphQlUrl
+  );
+  const mcpFunctionUrl = mcpHandlerFn.addFunctionUrl({
+    authType: FunctionUrlAuthType.NONE,
+    cors: {
+      allowedOrigins: ["*"],
+      allowedMethods: [HttpMethod.POST],
+      allowedHeaders: ["*"],
+      maxAge: Duration.hours(1)
+    }
+  });
+  backend.addOutput({
+    custom: {
+      mcp: {
+        endpoint: mcpFunctionUrl.url
+      }
+    }
+  });
   return backend;
 }
 
@@ -201,11 +250,19 @@ function amplessSchemaModels(a, opts = {}) {
       slug: a.string().required(),
       title: a.string().required(),
       excerpt: a.string(),
-      format: a.enum(["tiptap", "markdown", "html"]),
+      format: a.enum(["tiptap", "markdown", "html", "static"]),
       body: a.json(),
       status: a.enum(["draft", "published"]),
       publishedAt: a.datetime(),
       tags: a.string().array(),
+      // Free-form per-post metadata (JSON). Reserved well-known keys
+      // are documented on `PostMetadata` in `ampless/src/types.ts`.
+      // Currently:
+      //   no_layout: boolean — serve the post as bare HTML (no theme
+      //     chrome). The runtime's post dispatcher redirects to the
+      //     raw route handler when this is true.
+      // Other keys are passed through unchanged for plugin / app use.
+      metadata: a.json(),
       // Denormalized GSI keys — set by every write path (admin client,
       // MCP tools). Same pattern as siteIdStatus: composing the
       // partition key as a single string lets each public-read query
@@ -220,14 +277,15 @@ function amplessSchemaModels(a, opts = {}) {
       index("siteIdStatus").sortKeys(["publishedAt"]).name("bySiteIdStatus"),
       index("siteIdSlug").name("bySiteIdSlug")
     ]).authorization((allow) => [
-      allow.groups(["ampless-admin", "ampless-editor"])
+      allow.groups(["ampless-admin", "ampless-editor"]),
+      ...opts.mcpHandlerFunction ? [allow.resource(opts.mcpHandlerFunction).to(["query", "mutate"])] : []
     ]),
     Page: a.model({
       siteId: a.string().required(),
       pageId: a.id().required(),
       slug: a.string().required(),
       title: a.string().required(),
-      format: a.enum(["tiptap", "markdown", "html"]),
+      format: a.enum(["tiptap", "markdown", "html", "static"]),
       body: a.json(),
       status: a.enum(["draft", "published"]),
       publishedAt: a.datetime()
@@ -274,7 +332,8 @@ function amplessSchemaModels(a, opts = {}) {
       // Full tag list of the post (for chip rendering on tag pages).
       tags: a.string().array()
     }).identifier(["siteIdTag", "publishedAtPostId"]).authorization((allow) => [
-      allow.groups(["ampless-admin", "ampless-editor"])
+      allow.groups(["ampless-admin", "ampless-editor"]),
+      ...opts.mcpHandlerFunction ? [allow.resource(opts.mcpHandlerFunction).to(["query", "mutate"])] : []
     ]),
     // Generic key/value store. Two roles in one table:
     //   - Site settings: PK = `siteconfig:{siteId}`, SK = dotted key
@@ -308,7 +367,8 @@ function amplessSchemaModels(a, opts = {}) {
       body: a.json(),
       status: a.string(),
       publishedAt: a.datetime(),
-      tags: a.string().array()
+      tags: a.string().array(),
+      metadata: a.json()
     }),
     // Paginated wrapper for list responses.
     PublicPostConnection: a.customType({
@@ -367,7 +427,27 @@ function amplessSchemaModels(a, opts = {}) {
     ).authorization((allow) => [
       allow.publicApiKey(),
       allow.groups(["ampless-admin", "ampless-editor"])
-    ])
+    ]),
+    // User management ops, only wired when the caller supplies a
+    // Lambda function ref. Conditionally spread because
+    // `a.handler.function(undefined)` is not a valid call — projects
+    // that haven't opted into the user-admin Lambda must not see
+    // these schema entries.
+    ...opts.userAdminFunction ? {
+      AdminUser: a.customType({
+        userId: a.string().required(),
+        email: a.string().required(),
+        // 'admin' | 'editor' | 'none' — stored as string because
+        // a.enum() in customType doesn't round-trip cleanly across
+        // AppSync's typegen + the admin client cast pattern.
+        role: a.string().required()
+      }),
+      listAdminUsers: a.query().returns(a.ref("AdminUser").array()).handler(a.handler.function(opts.userAdminFunction)).authorization((allow) => [allow.groups(["ampless-admin"])]),
+      setAdminUserRole: a.mutation().arguments({
+        userId: a.string().required(),
+        role: a.string().required()
+      }).returns(a.ref("AdminUser")).handler(a.handler.function(opts.userAdminFunction)).authorization((allow) => [allow.groups(["ampless-admin"])])
+    } : {}
   };
 }
 function extendAmplessSchema(a, custom, opts) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ampless/backend",
-  "version": "0.2.0-alpha.1",
+  "version": "0.2.0-alpha.11",
   "description": "Amplify Gen 2 backend factories for ampless: auth, data, storage, event processors, API key renewer",
   "license": "MIT",
   "type": "module",
@@ -13,6 +13,10 @@
       "import": "./dist/auth/post-confirmation.js",
       "types": "./dist/auth/post-confirmation.d.ts"
     },
+    "./auth/user-admin": {
+      "import": "./dist/auth/user-admin.js",
+      "types": "./dist/auth/user-admin.d.ts"
+    },
     "./events/dispatcher": {
       "import": "./dist/events/dispatcher.js",
       "types": "./dist/events/dispatcher.d.ts"
@@ -28,6 +32,10 @@
     "./functions/api-key-renewer": {
       "import": "./dist/functions/api-key-renewer.js",
       "types": "./dist/functions/api-key-renewer.d.ts"
+    },
+    "./functions/mcp-handler": {
+      "import": "./dist/functions/mcp-handler.js",
+      "types": "./dist/functions/mcp-handler.d.ts"
     }
   },
   "files": [
@@ -45,14 +53,19 @@
   "homepage": "https://github.com/heavymoons/ampless/tree/main/packages/backend#readme",
   "bugs": "https://github.com/heavymoons/ampless/issues",
   "dependencies": {
+    "@aws-crypto/sha256-js": "^5.2.0",
     "@aws-sdk/client-appsync": "^3.717.0",
     "@aws-sdk/client-cognito-identity-provider": "^3.717.0",
     "@aws-sdk/client-dynamodb": "^3.717.0",
     "@aws-sdk/client-s3": "^3.1048.0",
     "@aws-sdk/client-sqs": "^3.717.0",
+    "@aws-sdk/credential-provider-node": "^3.717.0",
     "@aws-sdk/lib-dynamodb": "^3.717.0",
     "@aws-sdk/util-dynamodb": "^3.717.0",
-    "ampless": "0.2.0-alpha.1"
+    "@smithy/protocol-http": "^5.3.0",
+    "@smithy/signature-v4": "^5.4.0",
+    "ampless": "0.2.0-alpha.6",
+    "@ampless/mcp-server": "0.2.0-alpha.6"
   },
   "peerDependencies": {
     "@aws-amplify/backend": "^1",