@ampless/backend 0.2.0-alpha.7 → 0.2.0-alpha.9

package/README.ja.md

@@ -0,0 +1,130 @@
+> English: [README.md](./README.md)
+> 
+
+# @ampless/backend
+
+[ampless](https://github.com/heavymoons/ampless) 向け Amplify Gen 2 バックエンドファクトリー。IAM / SQS / DynamoDB ストリームの配線、認証 / データ / ストレージの定義、およびすべてのイベント処理 Lambda を `defineAmplessBackend(...)` ひとつのファクトリーにまとめます。
+
+> **プレリリース / アルファ版。** v1.0 まではマイナーバージョンでも破壊的変更が入る可能性があります。
+
+テンプレートから切り出すことで、スキャフォールダーを再実行せずに `npm update @ampless/backend` でアップデートできます。バックエンドのバグ修正やインフラ改善はパッケージ経由で届きます。ユーザー側の `amplify/` ツリーは、ファクトリーを組み合わせる 1〜5 行のシェルだけで済みます。
+
+## インストール
+
+```bash
+npm install @ampless/backend@alpha ampless@alpha
+```
+
+ピア依存: `@aws-amplify/backend`（^1）、`aws-cdk-lib`（^2）。CLI スキャフォールダーがテンプレートの `package.json` に互換バージョンをピン留めします。
+
+## 使い方
+
+### `amplify/backend.ts`
+
+```ts
+import { defineAmplessBackend } from '@ampless/backend'
+import { auth } from './auth/resource'
+import { data } from './data/resource'
+import { storage } from './storage/resource'
+import { postConfirmation } from './auth/post-confirmation/resource'
+import { eventDispatcher } from './events/dispatcher/resource'
+import { processorTrusted } from './events/processor-trusted/resource'
+import { processorUntrusted } from './events/processor-untrusted/resource'
+import { apiKeyRenewer } from './functions/api-key-renewer/resource'
+
+export default defineAmplessBackend({
+  auth, data, storage, postConfirmation,
+  eventDispatcher, processorTrusted, processorUntrusted, apiKeyRenewer,
+})
+```
+
+### `amplify/auth/resource.ts`
+
+```ts
+import { defineAuth } from '@aws-amplify/backend'
+import { amplessAuthConfig } from '@ampless/backend'
+import { postConfirmation } from './post-confirmation/resource'
+
+export const auth = defineAuth(amplessAuthConfig({ postConfirmation }))
+```
+
+> `defineAuth` は `amplify/auth/resource.ts` 自体に記述する必要があります。Amplify Gen 2 のインポートパス検証機能が `defineAuth` / `defineData` / `defineStorage` の呼び出し元を検査し、他のファイル（`node_modules/@ampless/backend/...` 配下のラッパーを含む）から呼び出された場合に `Amplify Auth must be defined in amplify/auth/resource.ts` というエラーを投げます。`amplessAuthConfig` は props オブジェクトを返すため、ampless のデフォルト設定を失わずにこのファイルで `defineAuth(...)` を呼び出せます。
+
+### `amplify/data/resource.ts`
+
+```ts
+import { a, defineData, type ClientSchema } from '@aws-amplify/backend'
+import { amplessSchemaModels, defaultAuthorizationModes } from '@ampless/backend'
+
+const schema = a.schema({
+  ...amplessSchemaModels(a),
+  // カスタムモデルをここに追加 — 組み込みモデルと同居します：
+  // MyCustomModel: a.model({ ... }).authorization((allow) => [...]),
+})
+
+export type Schema = ClientSchema<typeof schema>
+export const data = defineData({ schema, authorizationModes: defaultAuthorizationModes })
+```
+
+3 つの AppSync JS リゾルバーファイル（`list-published-posts.js`、`get-published-post.js`、`list-posts-by-tag.js`）はテンプレート内に残ります — AppSync がリゾルバーの `entry` パスを CDK synth 時に `defineData` を呼び出すファイルからの相対パスで解決するため、pnpm でシンボリックリンクされた `node_modules` パスは解決を通過できません。`amplify/data/` 以外の場所に移動する場合は、`amplessSchemaModels(a, { resolverPaths })` で新しいパスを渡してください。
+
+### `amplify/storage/resource.ts`
+
+```ts
+import { defineStorage } from '@aws-amplify/backend'
+import { amplessStorageConfig } from '@ampless/backend'
+export const storage = defineStorage(amplessStorageConfig())
+```
+
+> 認証と同じインポートパス制約があります — `defineStorage` はこのファイルから直接呼び出す必要があります。`amplessStorageConfig` は props オブジェクトを返します。
+
+### Lambda 薄型シェル
+
+`amplify/auth/`、`amplify/events/`、`amplify/functions/` 内の各ハンドラーファイルは 1〜3 行の re-export になります。Amplify の esbuild がこのパッケージへのインポートを追跡し、実際のハンドラーコードを Lambda アーティファクトにバンドルします。
+
+```ts
+// amplify/auth/post-confirmation/handler.ts
+export { handler } from '@ampless/backend/auth/post-confirmation'
+
+// amplify/events/dispatcher/handler.ts
+export { handler } from '@ampless/backend/events/dispatcher'
+
+// amplify/events/processor-trusted/handler.ts
+import config from '../../../cms.config'
+import { createProcessorTrustedHandler } from '@ampless/backend/events/processor-trusted'
+export const handler = createProcessorTrustedHandler({
+  plugins: config.plugins,
+  site: config.site,
+})
+
+// amplify/events/processor-untrusted/handler.ts
+import config from '../../../cms.config'
+import { createProcessorUntrustedHandler } from '@ampless/backend/events/processor-untrusted'
+export const handler = createProcessorUntrustedHandler({
+  plugins: config.plugins,
+  site: config.site,
+})
+
+// amplify/functions/api-key-renewer/handler.ts
+export { handler } from '@ampless/backend/functions/api-key-renewer'
+```
+
+## サブパス
+
+- `@ampless/backend` — `defineAmplessBackend`、`amplessAuthConfig`、`amplessStorageConfig`、`amplessSchemaModels`、`extendAmplessSchema`、`defaultAuthorizationModes`
+- `@ampless/backend/auth/post-confirmation` — Lambda ハンドラー
+- `@ampless/backend/events/dispatcher` — Lambda ハンドラー
+- `@ampless/backend/events/processor-trusted` — `createProcessorTrustedHandler({ plugins, site })`
+- `@ampless/backend/events/processor-untrusted` — `createProcessorUntrustedHandler({ plugins, site })`
+- `@ampless/backend/functions/api-key-renewer` — Lambda ハンドラー
+
+## テンプレートに残るもの
+
+- `amplify/data/*.js` — AppSync JS リゾルバー（ファイルパス制約のため）。
+- すべての `resource.ts` と `handler.ts` — 薄型シェルですが、Amplify の CDK synth がユーザー側で解決する `entry: './handler.ts'` パスを保持しています。
+- `cms.config.ts` と `themes-registry.ts` — ユーザーが所有するカスタマイズサーフェス。
+- `templates/<theme>/` 以下のテーマコンポーネント — ユーザーが所有。
+
+## ライセンス
+
+MIT

package/README.md

@@ -1,3 +1,6 @@
+> 日本語版: [README.ja.md](./README.ja.md)
+> 
+
 # @ampless/backend
 
 Amplify Gen 2 backend factories for [ampless](https://github.com/heavymoons/ampless). Bundles the IAM / SQS / DynamoDB-stream wiring, the auth / data / storage definitions, and every event-processing Lambda behind one `defineAmplessBackend(...)` factory.

package/dist/functions/mcp-handler.d.ts

@@ -0,0 +1,33 @@
+/**
+ * MCP HTTP endpoint Lambda. Phase 3: Bearer token validation only.
+ *
+ * Reads the KvStore table directly (PK = 'mcp-tokens', SK = SHA-256
+ * hash of the plaintext token) instead of going through AppSync — the
+ * Lambda IAM role only needs `dynamodb:GetItem` on that one table,
+ * which is much narrower than `appsync:GraphQL` and avoids the
+ * IAM-auth-mode complexity of letting Lambdas call AppSync as
+ * privileged identity. Phase 4 will add AppSync IAM auth when tool
+ * dispatch actually needs schema-aware access.
+ *
+ * Function URL event format: Lambda Function URLs emit API Gateway
+ * HTTP v2 events (https://docs.aws.amazon.com/lambda/latest/dg/urls-invocation.html#urls-payloads).
+ * Headers arrive lowercased.
+ */
+interface FunctionUrlEvent {
+    headers?: Record<string, string | undefined>;
+    body?: string;
+    isBase64Encoded?: boolean;
+    requestContext?: {
+        http?: {
+            method?: string;
+        };
+    };
+}
+interface FunctionUrlResult {
+    statusCode: number;
+    headers?: Record<string, string>;
+    body: string;
+}
+declare const handler: (event: FunctionUrlEvent) => Promise<FunctionUrlResult>;
+
+export { handler };

package/dist/functions/mcp-handler.js

@@ -0,0 +1,70 @@
+// src/functions/mcp-handler.ts
+import { DynamoDBClient } from "@aws-sdk/client-dynamodb";
+import { DynamoDBDocumentClient, GetCommand } from "@aws-sdk/lib-dynamodb";
+import { createHash } from "crypto";
+var TOKENS_PK = "mcp-tokens";
+function requireEnv(name) {
+  const v = process.env[name];
+  if (!v) throw new Error(`[mcp-handler] missing required env var ${name}`);
+  return v;
+}
+var KV_TABLE = requireEnv("AMPLESS_KV_TABLE");
+var ddb = DynamoDBDocumentClient.from(new DynamoDBClient({}));
+function hashToken(plain) {
+  return createHash("sha256").update(plain).digest("hex");
+}
+function jsonResponse(statusCode, body) {
+  return {
+    statusCode,
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify(body)
+  };
+}
+async function validateBearer(plaintext) {
+  const hash = hashToken(plaintext);
+  const res = await ddb.send(
+    new GetCommand({
+      TableName: KV_TABLE,
+      Key: { pk: TOKENS_PK, sk: hash }
+    })
+  );
+  const row = res.Item;
+  if (!row?.value) return null;
+  let meta;
+  try {
+    meta = JSON.parse(row.value);
+  } catch {
+    console.error("[mcp-handler] could not parse token row", { hash });
+    return null;
+  }
+  if (meta.revokedAt) return null;
+  if (meta.expiresAt && new Date(meta.expiresAt).getTime() <= Date.now()) return null;
+  return meta;
+}
+var handler = async (event) => {
+  if (event.requestContext?.http?.method === "OPTIONS") {
+    return { statusCode: 204, body: "" };
+  }
+  const authHeader = event.headers?.authorization ?? event.headers?.Authorization;
+  if (!authHeader) {
+    return jsonResponse(401, { error: "missing_authorization" });
+  }
+  const match = /^Bearer\s+(amk_[A-Za-z0-9_-]+)$/.exec(authHeader);
+  if (!match) {
+    return jsonResponse(401, { error: "invalid_authorization" });
+  }
+  const plaintext = match[1];
+  const meta = await validateBearer(plaintext);
+  if (!meta) {
+    return jsonResponse(401, { error: "invalid_token" });
+  }
+  return jsonResponse(200, {
+    ok: true,
+    tokenPrefix: meta.prefix,
+    scope: meta.scope,
+    note: "Phase 3 stub. JSON-RPC tool dispatch lands in Phase 4."
+  });
+};
+export {
+  handler
+};

package/dist/index.d.ts

@@ -14,6 +14,7 @@ interface DefineAmplessBackendOpts {
     processorUntrusted: FunctionResource;
     apiKeyRenewer: FunctionResource;
     userAdmin: FunctionResource;
+    mcpHandler: FunctionResource;
 }
 type AmplessBackend = any;
 /**

package/dist/index.js

@@ -3,7 +3,7 @@ import { defineBackend } from "@aws-amplify/backend";
 import { Effect, PolicyStatement, AnyPrincipal } from "aws-cdk-lib/aws-iam";
 import { Duration, Stack } from "aws-cdk-lib";
 import { Queue } from "aws-cdk-lib/aws-sqs";
-import { StartingPosition } from "aws-cdk-lib/aws-lambda";
+import { FunctionUrlAuthType, HttpMethod, StartingPosition } from "aws-cdk-lib/aws-lambda";
 import { DynamoEventSource, SqsEventSource } from "aws-cdk-lib/aws-lambda-event-sources";
 import { Rule, Schedule } from "aws-cdk-lib/aws-events";
 import { LambdaFunction } from "aws-cdk-lib/aws-events-targets";
@@ -17,7 +17,8 @@ function defineAmplessBackend(opts) {
     processorTrusted: opts.processorTrusted,
     processorUntrusted: opts.processorUntrusted,
     apiKeyRenewer: opts.apiKeyRenewer,
-    userAdmin: opts.userAdmin
+    userAdmin: opts.userAdmin,
+    mcpHandler: opts.mcpHandler
   });
   const cfnBucket = backend.storage.resources.cfnResources.cfnBucket;
   cfnBucket.publicAccessBlockConfiguration = {
@@ -166,6 +167,31 @@ function defineAmplessBackend(opts) {
     schedule: Schedule.cron({ minute: "0", hour: "3", day: "1", month: "*", year: "*" }),
     targets: [new LambdaFunction(apiKeyRenewerFn)]
   });
+  const mcpHandlerFn = backend.mcpHandler.resources.lambda;
+  mcpHandlerFn.addToRolePolicy(
+    new PolicyStatement({
+      effect: Effect.ALLOW,
+      actions: ["dynamodb:GetItem"],
+      resources: [kvTable.tableArn]
+    })
+  );
+  mcpHandlerFn.addEnvironment("AMPLESS_KV_TABLE", kvTable.tableName);
+  const mcpFunctionUrl = mcpHandlerFn.addFunctionUrl({
+    authType: FunctionUrlAuthType.NONE,
+    cors: {
+      allowedOrigins: ["*"],
+      allowedMethods: [HttpMethod.POST, HttpMethod.OPTIONS],
+      allowedHeaders: ["*"],
+      maxAge: Duration.hours(1)
+    }
+  });
+  backend.addOutput({
+    custom: {
+      mcp: {
+        endpoint: mcpFunctionUrl.url
+      }
+    }
+  });
   return backend;
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ampless/backend",
-  "version": "0.2.0-alpha.7",
+  "version": "0.2.0-alpha.9",
   "description": "Amplify Gen 2 backend factories for ampless: auth, data, storage, event processors, API key renewer",
   "license": "MIT",
   "type": "module",
@@ -32,6 +32,10 @@
     "./functions/api-key-renewer": {
       "import": "./dist/functions/api-key-renewer.js",
       "types": "./dist/functions/api-key-renewer.d.ts"
+    },
+    "./functions/mcp-handler": {
+      "import": "./dist/functions/mcp-handler.js",
+      "types": "./dist/functions/mcp-handler.d.ts"
     }
   },
   "files": [
@@ -56,7 +60,7 @@
     "@aws-sdk/client-sqs": "^3.717.0",
     "@aws-sdk/lib-dynamodb": "^3.717.0",
     "@aws-sdk/util-dynamodb": "^3.717.0",
-    "ampless": "0.2.0-alpha.5"
+    "ampless": "0.2.0-alpha.6"
   },
   "peerDependencies": {
     "@aws-amplify/backend": "^1",