@ampless/backend 0.2.0-alpha.2 → 0.2.0-alpha.3

package/dist/auth/user-admin.d.ts

@@ -0,0 +1,17 @@
+import { AppSyncResolverHandler } from 'aws-lambda';
+
+type AdminRole = 'admin' | 'editor' | 'none';
+interface AdminUserDto {
+    userId: string;
+    email: string;
+    role: AdminRole;
+}
+interface ListArgs {
+}
+interface SetArgs {
+    userId: string;
+    role: string;
+}
+declare const handler: AppSyncResolverHandler<ListArgs | SetArgs, AdminUserDto | AdminUserDto[] | null>;
+
+export { handler };

package/dist/auth/user-admin.js

@@ -0,0 +1,105 @@
+// src/auth/user-admin.ts
+import {
+  CognitoIdentityProviderClient,
+  ListUsersCommand,
+  AdminListGroupsForUserCommand,
+  AdminAddUserToGroupCommand,
+  AdminRemoveUserFromGroupCommand
+} from "@aws-sdk/client-cognito-identity-provider";
+var cognito = new CognitoIdentityProviderClient({});
+var ADMIN_GROUP = "ampless-admin";
+var EDITOR_GROUP = "ampless-editor";
+function requireUserPoolId() {
+  const v = process.env.AMPLESS_USER_POOL_ID;
+  if (!v) {
+    console.error("[user-admin] missing required env var AMPLESS_USER_POOL_ID");
+    throw new Error("user-admin: missing required env var AMPLESS_USER_POOL_ID");
+  }
+  return v;
+}
+function emailOf(user) {
+  const attr = user.Attributes?.find((a) => a.Name === "email");
+  return attr?.Value ?? "";
+}
+async function roleOf(userPoolId, username) {
+  const { Groups } = await cognito.send(
+    new AdminListGroupsForUserCommand({ UserPoolId: userPoolId, Username: username })
+  );
+  const names = (Groups ?? []).map((g) => g.GroupName);
+  if (names.includes(ADMIN_GROUP)) return "admin";
+  if (names.includes(EDITOR_GROUP)) return "editor";
+  return "none";
+}
+async function listAdminUsers(userPoolId) {
+  const { Users } = await cognito.send(
+    new ListUsersCommand({ UserPoolId: userPoolId, Limit: 60 })
+  );
+  const users = Users ?? [];
+  const out = [];
+  for (const u of users) {
+    if (!u.Username) continue;
+    const role = await roleOf(userPoolId, u.Username);
+    out.push({ userId: u.Username, email: emailOf(u), role });
+  }
+  return out;
+}
+async function setAdminUserRole(userPoolId, userId, role) {
+  for (const group of [ADMIN_GROUP, EDITOR_GROUP]) {
+    await cognito.send(
+      new AdminRemoveUserFromGroupCommand({
+        UserPoolId: userPoolId,
+        Username: userId,
+        GroupName: group
+      })
+    );
+  }
+  if (role !== "none") {
+    await cognito.send(
+      new AdminAddUserToGroupCommand({
+        UserPoolId: userPoolId,
+        Username: userId,
+        GroupName: role === "admin" ? ADMIN_GROUP : EDITOR_GROUP
+      })
+    );
+  }
+  const { Users } = await cognito.send(
+    new ListUsersCommand({
+      UserPoolId: userPoolId,
+      Filter: `sub = "${userId}"`,
+      Limit: 1
+    })
+  );
+  const user = Users?.[0];
+  const email = user ? emailOf(user) : "";
+  const finalRole = await roleOf(userPoolId, userId);
+  return { userId, email, role: finalRole };
+}
+var handler = async (event) => {
+  const userPoolId = requireUserPoolId();
+  const field = event.info.fieldName;
+  try {
+    if (field === "listAdminUsers") {
+      return await listAdminUsers(userPoolId);
+    }
+    if (field === "setAdminUserRole") {
+      const { userId, role } = event.arguments;
+      if (role !== "admin" && role !== "editor" && role !== "none") {
+        console.error(`[user-admin] invalid role: ${role}`);
+        throw new Error(`Invalid role: ${role}`);
+      }
+      if (!userId) {
+        console.error("[user-admin] missing userId argument");
+        throw new Error("Missing userId argument");
+      }
+      return await setAdminUserRole(userPoolId, userId, role);
+    }
+    console.error(`[user-admin] unsupported fieldName: ${field}`);
+    throw new Error(`Unsupported fieldName: ${field}`);
+  } catch (err) {
+    console.error(`[user-admin] ${field} failed:`, err);
+    throw err;
+  }
+};
+export {
+  handler
+};

package/dist/index.d.ts

@@ -13,6 +13,7 @@ interface DefineAmplessBackendOpts {
     processorTrusted: FunctionResource;
     processorUntrusted: FunctionResource;
     apiKeyRenewer: FunctionResource;
+    userAdmin: FunctionResource;
 }
 type AmplessBackend = any;
 /**
@@ -136,6 +137,17 @@ interface AmplessSchemaModelsOpts {
      * they must point to actual `.js` files inside the user's project.
      */
     resolverPaths?: Partial<AmplessResolverPaths>;
+    /**
+     * Optional Amplify `defineFunction` ref backing the user-admin
+     * AppSync ops (`listAdminUsers` query, `setAdminUserRole` mutation).
+     * When supplied, the corresponding `AdminUser` customType + the two
+     * ops are added to the schema, both gated to `ampless-admin`.
+     *
+     * Typed as `unknown` because `defineFunction`'s return type carries
+     * internal pnpm paths that don't survive declaration emit — same
+     * pattern as `AmplessAuthConfigOpts.postConfirmation`.
+     */
+    userAdminFunction?: unknown;
 }
 /**
  * The Ampless model + custom query definitions, returned as a plain
@@ -153,6 +165,9 @@ interface AmplessSchemaModelsOpts {
  * extra models.
  */
 declare function amplessSchemaModels(a: any, opts?: AmplessSchemaModelsOpts): {
+    AdminUser?: any;
+    listAdminUsers?: any;
+    setAdminUserRole?: any;
     Post: any;
     Page: any;
     Media: any;

package/dist/index.js

@@ -16,7 +16,8 @@ function defineAmplessBackend(opts) {
     eventDispatcher: opts.eventDispatcher,
     processorTrusted: opts.processorTrusted,
     processorUntrusted: opts.processorUntrusted,
-    apiKeyRenewer: opts.apiKeyRenewer
+    apiKeyRenewer: opts.apiKeyRenewer,
+    userAdmin: opts.userAdmin
   });
   const cfnBucket = backend.storage.resources.cfnResources.cfnBucket;
   cfnBucket.publicAccessBlockConfiguration = {
@@ -61,6 +62,22 @@ function defineAmplessBackend(opts) {
       resources: ["arn:aws:cognito-idp:*:*:userpool/*"]
     })
   );
+  backend.userAdmin.resources.lambda.addToRolePolicy(
+    new PolicyStatement({
+      effect: Effect.ALLOW,
+      actions: [
+        "cognito-idp:ListUsers",
+        "cognito-idp:AdminListGroupsForUser",
+        "cognito-idp:AdminAddUserToGroup",
+        "cognito-idp:AdminRemoveUserFromGroup"
+      ],
+      resources: ["arn:aws:cognito-idp:*:*:userpool/*"]
+    })
+  );
+  backend.userAdmin.resources.lambda.addEnvironment(
+    "AMPLESS_USER_POOL_ID",
+    backend.auth.resources.userPool.userPoolId
+  );
   const postTable = backend.data.resources.tables["Post"];
   const cfnPostTable = backend.data.resources.cfnResources.amplifyDynamoDbTables["Post"];
   cfnPostTable.streamSpecification = { streamViewType: "NEW_AND_OLD_IMAGES" };
@@ -206,6 +223,14 @@ function amplessSchemaModels(a, opts = {}) {
       status: a.enum(["draft", "published"]),
       publishedAt: a.datetime(),
       tags: a.string().array(),
+      // Free-form per-post metadata (JSON). Reserved well-known keys
+      // are documented on `PostMetadata` in `ampless/src/types.ts`.
+      // Currently:
+      //   no_layout: boolean — serve the post as bare HTML (no theme
+      //     chrome). The runtime's post dispatcher redirects to the
+      //     raw route handler when this is true.
+      // Other keys are passed through unchanged for plugin / app use.
+      metadata: a.json(),
       // Denormalized GSI keys — set by every write path (admin client,
       // MCP tools). Same pattern as siteIdStatus: composing the
       // partition key as a single string lets each public-read query
@@ -308,7 +333,8 @@ function amplessSchemaModels(a, opts = {}) {
       body: a.json(),
       status: a.string(),
       publishedAt: a.datetime(),
-      tags: a.string().array()
+      tags: a.string().array(),
+      metadata: a.json()
     }),
     // Paginated wrapper for list responses.
     PublicPostConnection: a.customType({
@@ -367,7 +393,27 @@ function amplessSchemaModels(a, opts = {}) {
     ).authorization((allow) => [
       allow.publicApiKey(),
       allow.groups(["ampless-admin", "ampless-editor"])
-    ])
+    ]),
+    // User management ops, only wired when the caller supplies a
+    // Lambda function ref. Conditionally spread because
+    // `a.handler.function(undefined)` is not a valid call — projects
+    // that haven't opted into the user-admin Lambda must not see
+    // these schema entries.
+    ...opts.userAdminFunction ? {
+      AdminUser: a.customType({
+        userId: a.string().required(),
+        email: a.string().required(),
+        // 'admin' | 'editor' | 'none' — stored as string because
+        // a.enum() in customType doesn't round-trip cleanly across
+        // AppSync's typegen + the admin client cast pattern.
+        role: a.string().required()
+      }),
+      listAdminUsers: a.query().returns(a.ref("AdminUser").array()).handler(a.handler.function(opts.userAdminFunction)).authorization((allow) => [allow.groups(["ampless-admin"])]),
+      setAdminUserRole: a.mutation().arguments({
+        userId: a.string().required(),
+        role: a.string().required()
+      }).returns(a.ref("AdminUser")).handler(a.handler.function(opts.userAdminFunction)).authorization((allow) => [allow.groups(["ampless-admin"])])
+    } : {}
   };
 }
 function extendAmplessSchema(a, custom, opts) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ampless/backend",
-  "version": "0.2.0-alpha.2",
+  "version": "0.2.0-alpha.3",
   "description": "Amplify Gen 2 backend factories for ampless: auth, data, storage, event processors, API key renewer",
   "license": "MIT",
   "type": "module",
@@ -13,6 +13,10 @@
       "import": "./dist/auth/post-confirmation.js",
       "types": "./dist/auth/post-confirmation.d.ts"
     },
+    "./auth/user-admin": {
+      "import": "./dist/auth/user-admin.js",
+      "types": "./dist/auth/user-admin.d.ts"
+    },
     "./events/dispatcher": {
       "import": "./dist/events/dispatcher.js",
       "types": "./dist/events/dispatcher.d.ts"
@@ -52,7 +56,7 @@
     "@aws-sdk/client-sqs": "^3.717.0",
     "@aws-sdk/lib-dynamodb": "^3.717.0",
     "@aws-sdk/util-dynamodb": "^3.717.0",
-    "ampless": "0.2.0-alpha.1"
+    "ampless": "0.2.0-alpha.2"
   },
   "peerDependencies": {
     "@aws-amplify/backend": "^1",