@ampless/backend 0.2.0-alpha.8 → 1.0.0-alpha.19

package/dist/index.d.ts

@@ -14,6 +14,7 @@ interface DefineAmplessBackendOpts {
     processorUntrusted: FunctionResource;
     apiKeyRenewer: FunctionResource;
     userAdmin: FunctionResource;
+    mcpHandler: FunctionResource;
 }
 type AmplessBackend = any;
 /**
@@ -188,6 +189,52 @@ declare function amplessSchemaModels(a: any, opts?: AmplessSchemaModelsOpts): {
  * when there are no custom models.
  */
 declare function extendAmplessSchema(a: any, custom?: Record<string, any>, opts?: AmplessSchemaModelsOpts): any;
+interface AmplessSchemaAuthorizationOpts {
+    /**
+     * Optional Amplify `defineFunction` ref for the MCP HTTP handler.
+     * When supplied, the schema gains `allow.resource(fn).to(['query',
+     * 'mutate'])` so the Lambda can sign AppSync requests with SigV4
+     * under its own IAM role (no Cognito identity / shared API key).
+     *
+     * Resource auth is currently only honoured at schema scope by
+     * `@aws-amplify/data-schema` (model-level `.authorization` callbacks
+     * destructure `resource` out of their `allow` parameter), so this
+     * grant applies broadly — every model the Lambda calls is reachable.
+     * That's wider than strictly necessary; the MCP tools' GraphQL
+     * operations narrow the effective surface to Post / PostTag in
+     * Phase 4 and Media in Phase 5.
+     *
+     * Typed as `unknown` for the same reason `userAdminFunction` /
+     * `mcpHandlerFunction` are in other helpers — `defineFunction`'s
+     * return type carries internal pnpm paths that don't survive
+     * declaration emit.
+     */
+    mcpHandlerFunction?: unknown;
+}
+/**
+ * Schema-level authorization rules for ampless. Pass the result into
+ * `a.schema({...}).authorization((allow) => [...])` in the user's
+ * `amplify/data/resource.ts`. When no Lambda function refs are
+ * supplied the function returns `[]`, so the schema stays unaffected.
+ *
+ * Return type is `any[]` (matching the rest of this module's
+ * intentional looseness around `@aws-amplify/data-schema`'s heavily
+ * generic builder types) so callers don't have to wrestle the
+ * generic `SchemaAuthorization<…>` parameters that change between
+ * minor versions. `amplify/data/resource.ts` strict-type-checks fine
+ * downstream because the schema itself still resolves through
+ * `ClientSchema<typeof schema>` correctly.
+ *
+ * Usage:
+ *
+ *     const schema = a.schema({
+ *       ...amplessSchemaModels(a, { resolverPaths, userAdminFunction }),
+ *       ...customSchemaModels(a),
+ *     }).authorization((allow) => amplessSchemaAuthorization(allow, {
+ *       mcpHandlerFunction: mcpHandler,
+ *     }))
+ */
+declare function amplessSchemaAuthorization(allow: any, opts?: AmplessSchemaAuthorizationOpts): any[];
 /**
  * Standard authorization modes for ampless. `userPool` is the default
  * (admin/editor access); the API key serves the public read endpoints
@@ -198,4 +245,4 @@ declare function extendAmplessSchema(a: any, custom?: Record<string, any>, opts?
  */
 declare const defaultAuthorizationModes: Parameters<typeof defineData>[0]['authorizationModes'];
 
-export { type AmplessAuthConfigOpts, type AmplessBackend, type AmplessResolverPaths, type AmplessSchemaModelsOpts, DEFAULT_RESOLVER_PATHS, type DefineAmplessBackendOpts, amplessAuthConfig, amplessSchemaModels, amplessStorageConfig, defaultAuthorizationModes, defineAmplessBackend, extendAmplessSchema };
+export { type AmplessAuthConfigOpts, type AmplessBackend, type AmplessResolverPaths, type AmplessSchemaAuthorizationOpts, type AmplessSchemaModelsOpts, DEFAULT_RESOLVER_PATHS, type DefineAmplessBackendOpts, amplessAuthConfig, amplessSchemaAuthorization, amplessSchemaModels, amplessStorageConfig, defaultAuthorizationModes, defineAmplessBackend, extendAmplessSchema };

package/dist/index.js

@@ -1,9 +1,11 @@
+import "./chunk-BYXBJQAS.js";
+
 // src/backend.ts
 import { defineBackend } from "@aws-amplify/backend";
 import { Effect, PolicyStatement, AnyPrincipal } from "aws-cdk-lib/aws-iam";
 import { Duration, Stack } from "aws-cdk-lib";
 import { Queue } from "aws-cdk-lib/aws-sqs";
-import { StartingPosition } from "aws-cdk-lib/aws-lambda";
+import { FunctionUrlAuthType, HttpMethod, StartingPosition } from "aws-cdk-lib/aws-lambda";
 import { DynamoEventSource, SqsEventSource } from "aws-cdk-lib/aws-lambda-event-sources";
 import { Rule, Schedule } from "aws-cdk-lib/aws-events";
 import { LambdaFunction } from "aws-cdk-lib/aws-events-targets";
@@ -17,7 +19,8 @@ function defineAmplessBackend(opts) {
     processorTrusted: opts.processorTrusted,
     processorUntrusted: opts.processorUntrusted,
     apiKeyRenewer: opts.apiKeyRenewer,
-    userAdmin: opts.userAdmin
+    userAdmin: opts.userAdmin,
+    mcpHandler: opts.mcpHandler
   });
   const cfnBucket = backend.storage.resources.cfnResources.cfnBucket;
   cfnBucket.publicAccessBlockConfiguration = {
@@ -166,6 +169,60 @@ function defineAmplessBackend(opts) {
     schedule: Schedule.cron({ minute: "0", hour: "3", day: "1", month: "*", year: "*" }),
     targets: [new LambdaFunction(apiKeyRenewerFn)]
   });
+  const mcpHandlerFn = backend.mcpHandler.resources.lambda;
+  mcpHandlerFn.addToRolePolicy(
+    new PolicyStatement({
+      effect: Effect.ALLOW,
+      actions: ["dynamodb:GetItem"],
+      resources: [kvTable.tableArn]
+    })
+  );
+  mcpHandlerFn.addEnvironment("AMPLESS_KV_TABLE", kvTable.tableName);
+  mcpHandlerFn.addEnvironment(
+    "AMPLESS_APPSYNC_URL",
+    backend.data.resources.cfnResources.cfnGraphqlApi.attrGraphQlUrl
+  );
+  mcpHandlerFn.addToRolePolicy(
+    new PolicyStatement({
+      effect: Effect.ALLOW,
+      actions: ["s3:PutObject"],
+      resources: [`${backend.storage.resources.bucket.bucketArn}/public/media/*`]
+    })
+  );
+  mcpHandlerFn.addToRolePolicy(
+    new PolicyStatement({
+      effect: Effect.ALLOW,
+      actions: ["s3:PutObject", "s3:DeleteObject"],
+      resources: [`${backend.storage.resources.bucket.bucketArn}/public/static/*`]
+    })
+  );
+  mcpHandlerFn.addToRolePolicy(
+    new PolicyStatement({
+      effect: Effect.ALLOW,
+      actions: ["s3:ListBucket"],
+      resources: [backend.storage.resources.bucket.bucketArn],
+      conditions: {
+        StringLike: { "s3:prefix": ["public/static/*"] }
+      }
+    })
+  );
+  mcpHandlerFn.addEnvironment("AMPLESS_BUCKET_NAME", backend.storage.resources.bucket.bucketName);
+  const mcpFunctionUrl = mcpHandlerFn.addFunctionUrl({
+    authType: FunctionUrlAuthType.NONE,
+    cors: {
+      allowedOrigins: ["*"],
+      allowedMethods: [HttpMethod.POST],
+      allowedHeaders: ["*"],
+      maxAge: Duration.hours(1)
+    }
+  });
+  backend.addOutput({
+    custom: {
+      mcp: {
+        endpoint: mcpFunctionUrl.url
+      }
+    }
+  });
   return backend;
 }
 
@@ -213,7 +270,6 @@ function amplessSchemaModels(a, opts = {}) {
   };
   return {
     Post: a.model({
-      siteId: a.string().required(),
       postId: a.id().required(),
       slug: a.string().required(),
       title: a.string().required(),
@@ -230,25 +286,14 @@ function amplessSchemaModels(a, opts = {}) {
       //     chrome). The runtime's post dispatcher redirects to the
       //     raw route handler when this is true.
       // Other keys are passed through unchanged for plugin / app use.
-      metadata: a.json(),
-      // Denormalized GSI keys — set by every write path (admin client,
-      // MCP tools). Same pattern as siteIdStatus: composing the
-      // partition key as a single string lets each public-read query
-      // hit DynamoDB with a pure PK Query, no filter pass.
-      //   siteIdStatus = `${siteId}#${status}`
-      //     → bySiteIdStatus partitions per site×status, sorted by publishedAt
-      //   siteIdSlug = `${siteId}#${slug}`
-      //     → bySiteIdSlug locates a single post by slug in O(1)
-      siteIdStatus: a.string(),
-      siteIdSlug: a.string()
-    }).identifier(["siteId", "postId"]).secondaryIndexes((index) => [
-      index("siteIdStatus").sortKeys(["publishedAt"]).name("bySiteIdStatus"),
-      index("siteIdSlug").name("bySiteIdSlug")
+      metadata: a.json()
+    }).identifier(["postId"]).secondaryIndexes((index) => [
+      index("status").sortKeys(["publishedAt"]).name("byStatus"),
+      index("slug").name("bySlug")
     ]).authorization((allow) => [
       allow.groups(["ampless-admin", "ampless-editor"])
     ]),
     Page: a.model({
-      siteId: a.string().required(),
       pageId: a.id().required(),
       slug: a.string().required(),
       title: a.string().required(),
@@ -256,26 +301,24 @@ function amplessSchemaModels(a, opts = {}) {
       body: a.json(),
       status: a.enum(["draft", "published"]),
       publishedAt: a.datetime()
-    }).identifier(["siteId", "pageId"]).authorization((allow) => [
+    }).identifier(["pageId"]).authorization((allow) => [
       allow.groups(["ampless-admin", "ampless-editor"])
     ]),
     Media: a.model({
-      siteId: a.string().required(),
       mediaId: a.id().required(),
       src: a.string().required(),
       mimeType: a.string().required(),
       size: a.integer(),
       delivery: a.string()
-    }).identifier(["siteId", "mediaId"]).authorization((allow) => [
+    }).identifier(["mediaId"]).authorization((allow) => [
       allow.groups(["ampless-admin", "ampless-editor"])
     ]),
     Taxonomy: a.model({
-      siteId: a.string().required(),
       termId: a.id().required(),
       type: a.enum(["category", "tag"]),
       name: a.string().required(),
       slug: a.string().required()
-    }).identifier(["siteId", "termId"]).authorization((allow) => [
+    }).identifier(["termId"]).authorization((allow) => [
       allow.groups(["ampless-admin", "ampless-editor"])
     ]),
     // Denormalized index for "posts by tag" queries. Each Post tag becomes
@@ -284,13 +327,11 @@ function amplessSchemaModels(a, opts = {}) {
     // sort key. Maintained by the admin client whenever a post is created,
     // updated, or deleted; never edited by end users.
     //
-    //   PK: siteIdTag         e.g. "default#tech"
+    //   PK: tag               e.g. "tech"
     //   SK: publishedAtPostId e.g. "2026-04-27T13:57:05.679Z#post-001"
     PostTag: a.model({
-      siteIdTag: a.string().required(),
-      publishedAtPostId: a.string().required(),
-      siteId: a.string().required(),
       tag: a.string().required(),
+      publishedAtPostId: a.string().required(),
       postId: a.id().required(),
       publishedAt: a.datetime().required(),
       slug: a.string().required(),
@@ -298,11 +339,11 @@ function amplessSchemaModels(a, opts = {}) {
       excerpt: a.string(),
       // Full tag list of the post (for chip rendering on tag pages).
       tags: a.string().array()
-    }).identifier(["siteIdTag", "publishedAtPostId"]).authorization((allow) => [
+    }).identifier(["tag", "publishedAtPostId"]).authorization((allow) => [
       allow.groups(["ampless-admin", "ampless-editor"])
     ]),
     // Generic key/value store. Two roles in one table:
-    //   - Site settings: PK = `siteconfig:{siteId}`, SK = dotted key
+    //   - Site settings: PK = `siteconfig`, SK = dotted key
     //     (`site.name`, `media.imageDisplay`, ...). No TTL → persistent.
     //   - Caches / plugin state: PK = whatever namespace the caller picks
     //     (`cache:{ns}`, `pluginstate:{name}:...`). TTL set → DynamoDB
@@ -324,7 +365,6 @@ function amplessSchemaModels(a, opts = {}) {
     // Custom return type for public post reads. Decoupling from `Post` lets
     // AppSync skip the model-level (admin-only) auth check on fields.
     PublicPost: a.customType({
-      siteId: a.string().required(),
       postId: a.id().required(),
       slug: a.string().required(),
       title: a.string().required(),
@@ -351,7 +391,6 @@ function amplessSchemaModels(a, opts = {}) {
     // only thing guests can see is `status === 'published'` rows projected
     // onto `PublicPost`.
     listPublishedPosts: a.query().arguments({
-      siteId: a.string(),
       // Both ISO 8601 strings; query SK condition is pushed into DynamoDB
       // so only the matching publishedAt range is read.
       from: a.datetime(),
@@ -369,7 +408,7 @@ function amplessSchemaModels(a, opts = {}) {
       allow.publicApiKey(),
       allow.groups(["ampless-admin", "ampless-editor"])
     ]),
-    getPublishedPost: a.query().arguments({ siteId: a.string(), slug: a.string().required() }).returns(a.ref("PublicPost")).handler(
+    getPublishedPost: a.query().arguments({ slug: a.string().required() }).returns(a.ref("PublicPost")).handler(
       a.handler.custom({
         dataSource: a.ref("Post"),
         entry: resolverPaths.getPublishedPost
@@ -381,7 +420,6 @@ function amplessSchemaModels(a, opts = {}) {
     // Tag pages: newest-first only. Archive (date range) within a tag is not
     // a common UX pattern; if it's ever needed, add `from`/`to` args here.
     listPostsByTag: a.query().arguments({
-      siteId: a.string(),
       tag: a.string().required(),
       limit: a.integer(),
       nextToken: a.string()
@@ -422,6 +460,13 @@ function extendAmplessSchema(a, custom, opts) {
     ...custom ?? {}
   });
 }
+function amplessSchemaAuthorization(allow, opts = {}) {
+  const rules = [];
+  if (opts.mcpHandlerFunction) {
+    rules.push(allow.resource(opts.mcpHandlerFunction).to(["query", "mutate"]));
+  }
+  return rules;
+}
 var defaultAuthorizationModes = {
   defaultAuthorizationMode: "userPool",
   apiKeyAuthorizationMode: { expiresInDays: 365 }
@@ -429,6 +474,7 @@ var defaultAuthorizationModes = {
 export {
   DEFAULT_RESOLVER_PATHS,
   amplessAuthConfig,
+  amplessSchemaAuthorization,
   amplessSchemaModels,
   amplessStorageConfig,
   defaultAuthorizationModes,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ampless/backend",
-  "version": "0.2.0-alpha.8",
+  "version": "1.0.0-alpha.19",
   "description": "Amplify Gen 2 backend factories for ampless: auth, data, storage, event processors, API key renewer",
   "license": "MIT",
   "type": "module",
@@ -32,6 +32,10 @@
     "./functions/api-key-renewer": {
       "import": "./dist/functions/api-key-renewer.js",
       "types": "./dist/functions/api-key-renewer.d.ts"
+    },
+    "./functions/mcp-handler": {
+      "import": "./dist/functions/mcp-handler.js",
+      "types": "./dist/functions/mcp-handler.d.ts"
     }
   },
   "files": [
@@ -49,14 +53,20 @@
   "homepage": "https://github.com/heavymoons/ampless/tree/main/packages/backend#readme",
   "bugs": "https://github.com/heavymoons/ampless/issues",
   "dependencies": {
+    "@aws-crypto/sha256-js": "^5.2.0",
     "@aws-sdk/client-appsync": "^3.717.0",
     "@aws-sdk/client-cognito-identity-provider": "^3.717.0",
     "@aws-sdk/client-dynamodb": "^3.717.0",
     "@aws-sdk/client-s3": "^3.1048.0",
     "@aws-sdk/client-sqs": "^3.717.0",
+    "@aws-sdk/credential-provider-node": "^3.717.0",
     "@aws-sdk/lib-dynamodb": "^3.717.0",
     "@aws-sdk/util-dynamodb": "^3.717.0",
-    "ampless": "0.2.0-alpha.6"
+    "@smithy/protocol-http": "^5.3.0",
+    "@smithy/signature-v4": "^5.4.0",
+    "fflate": "^0.8.2",
+    "ampless": "1.0.0-alpha.9",
+    "@ampless/mcp-server": "1.0.0-alpha.10"
   },
   "peerDependencies": {
     "@aws-amplify/backend": "^1",