@ampless/backend 0.2.0-alpha.8 → 0.2.0-alpha.9

package/dist/functions/mcp-handler.d.ts

@@ -0,0 +1,33 @@
+/**
+ * MCP HTTP endpoint Lambda. Phase 3: Bearer token validation only.
+ *
+ * Reads the KvStore table directly (PK = 'mcp-tokens', SK = SHA-256
+ * hash of the plaintext token) instead of going through AppSync — the
+ * Lambda IAM role only needs `dynamodb:GetItem` on that one table,
+ * which is much narrower than `appsync:GraphQL` and avoids the
+ * IAM-auth-mode complexity of letting Lambdas call AppSync as
+ * privileged identity. Phase 4 will add AppSync IAM auth when tool
+ * dispatch actually needs schema-aware access.
+ *
+ * Function URL event format: Lambda Function URLs emit API Gateway
+ * HTTP v2 events (https://docs.aws.amazon.com/lambda/latest/dg/urls-invocation.html#urls-payloads).
+ * Headers arrive lowercased.
+ */
+interface FunctionUrlEvent {
+    headers?: Record<string, string | undefined>;
+    body?: string;
+    isBase64Encoded?: boolean;
+    requestContext?: {
+        http?: {
+            method?: string;
+        };
+    };
+}
+interface FunctionUrlResult {
+    statusCode: number;
+    headers?: Record<string, string>;
+    body: string;
+}
+declare const handler: (event: FunctionUrlEvent) => Promise<FunctionUrlResult>;
+
+export { handler };

package/dist/functions/mcp-handler.js

@@ -0,0 +1,70 @@
+// src/functions/mcp-handler.ts
+import { DynamoDBClient } from "@aws-sdk/client-dynamodb";
+import { DynamoDBDocumentClient, GetCommand } from "@aws-sdk/lib-dynamodb";
+import { createHash } from "crypto";
+var TOKENS_PK = "mcp-tokens";
+function requireEnv(name) {
+  const v = process.env[name];
+  if (!v) throw new Error(`[mcp-handler] missing required env var ${name}`);
+  return v;
+}
+var KV_TABLE = requireEnv("AMPLESS_KV_TABLE");
+var ddb = DynamoDBDocumentClient.from(new DynamoDBClient({}));
+function hashToken(plain) {
+  return createHash("sha256").update(plain).digest("hex");
+}
+function jsonResponse(statusCode, body) {
+  return {
+    statusCode,
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify(body)
+  };
+}
+async function validateBearer(plaintext) {
+  const hash = hashToken(plaintext);
+  const res = await ddb.send(
+    new GetCommand({
+      TableName: KV_TABLE,
+      Key: { pk: TOKENS_PK, sk: hash }
+    })
+  );
+  const row = res.Item;
+  if (!row?.value) return null;
+  let meta;
+  try {
+    meta = JSON.parse(row.value);
+  } catch {
+    console.error("[mcp-handler] could not parse token row", { hash });
+    return null;
+  }
+  if (meta.revokedAt) return null;
+  if (meta.expiresAt && new Date(meta.expiresAt).getTime() <= Date.now()) return null;
+  return meta;
+}
+var handler = async (event) => {
+  if (event.requestContext?.http?.method === "OPTIONS") {
+    return { statusCode: 204, body: "" };
+  }
+  const authHeader = event.headers?.authorization ?? event.headers?.Authorization;
+  if (!authHeader) {
+    return jsonResponse(401, { error: "missing_authorization" });
+  }
+  const match = /^Bearer\s+(amk_[A-Za-z0-9_-]+)$/.exec(authHeader);
+  if (!match) {
+    return jsonResponse(401, { error: "invalid_authorization" });
+  }
+  const plaintext = match[1];
+  const meta = await validateBearer(plaintext);
+  if (!meta) {
+    return jsonResponse(401, { error: "invalid_token" });
+  }
+  return jsonResponse(200, {
+    ok: true,
+    tokenPrefix: meta.prefix,
+    scope: meta.scope,
+    note: "Phase 3 stub. JSON-RPC tool dispatch lands in Phase 4."
+  });
+};
+export {
+  handler
+};

package/dist/index.d.ts

@@ -14,6 +14,7 @@ interface DefineAmplessBackendOpts {
     processorUntrusted: FunctionResource;
     apiKeyRenewer: FunctionResource;
     userAdmin: FunctionResource;
+    mcpHandler: FunctionResource;
 }
 type AmplessBackend = any;
 /**

package/dist/index.js

@@ -3,7 +3,7 @@ import { defineBackend } from "@aws-amplify/backend";
 import { Effect, PolicyStatement, AnyPrincipal } from "aws-cdk-lib/aws-iam";
 import { Duration, Stack } from "aws-cdk-lib";
 import { Queue } from "aws-cdk-lib/aws-sqs";
-import { StartingPosition } from "aws-cdk-lib/aws-lambda";
+import { FunctionUrlAuthType, HttpMethod, StartingPosition } from "aws-cdk-lib/aws-lambda";
 import { DynamoEventSource, SqsEventSource } from "aws-cdk-lib/aws-lambda-event-sources";
 import { Rule, Schedule } from "aws-cdk-lib/aws-events";
 import { LambdaFunction } from "aws-cdk-lib/aws-events-targets";
@@ -17,7 +17,8 @@ function defineAmplessBackend(opts) {
     processorTrusted: opts.processorTrusted,
     processorUntrusted: opts.processorUntrusted,
     apiKeyRenewer: opts.apiKeyRenewer,
-    userAdmin: opts.userAdmin
+    userAdmin: opts.userAdmin,
+    mcpHandler: opts.mcpHandler
   });
   const cfnBucket = backend.storage.resources.cfnResources.cfnBucket;
   cfnBucket.publicAccessBlockConfiguration = {
@@ -166,6 +167,31 @@ function defineAmplessBackend(opts) {
     schedule: Schedule.cron({ minute: "0", hour: "3", day: "1", month: "*", year: "*" }),
     targets: [new LambdaFunction(apiKeyRenewerFn)]
   });
+  const mcpHandlerFn = backend.mcpHandler.resources.lambda;
+  mcpHandlerFn.addToRolePolicy(
+    new PolicyStatement({
+      effect: Effect.ALLOW,
+      actions: ["dynamodb:GetItem"],
+      resources: [kvTable.tableArn]
+    })
+  );
+  mcpHandlerFn.addEnvironment("AMPLESS_KV_TABLE", kvTable.tableName);
+  const mcpFunctionUrl = mcpHandlerFn.addFunctionUrl({
+    authType: FunctionUrlAuthType.NONE,
+    cors: {
+      allowedOrigins: ["*"],
+      allowedMethods: [HttpMethod.POST, HttpMethod.OPTIONS],
+      allowedHeaders: ["*"],
+      maxAge: Duration.hours(1)
+    }
+  });
+  backend.addOutput({
+    custom: {
+      mcp: {
+        endpoint: mcpFunctionUrl.url
+      }
+    }
+  });
   return backend;
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ampless/backend",
-  "version": "0.2.0-alpha.8",
+  "version": "0.2.0-alpha.9",
   "description": "Amplify Gen 2 backend factories for ampless: auth, data, storage, event processors, API key renewer",
   "license": "MIT",
   "type": "module",
@@ -32,6 +32,10 @@
     "./functions/api-key-renewer": {
       "import": "./dist/functions/api-key-renewer.js",
       "types": "./dist/functions/api-key-renewer.d.ts"
+    },
+    "./functions/mcp-handler": {
+      "import": "./dist/functions/mcp-handler.js",
+      "types": "./dist/functions/mcp-handler.d.ts"
     }
   },
   "files": [