@ampless/backend 1.0.0-alpha.45 → 1.0.0-alpha.46

package/dist/events/processor-trusted.js

@@ -1,6 +1,7 @@
 // src/events/processor-trusted.ts
 import { S3Client, PutObjectCommand } from "@aws-sdk/client-s3";
-import { DynamoDBClient } from "@aws-sdk/client-dynamodb";
+import { DynamoDBClient, GetItemCommand } from "@aws-sdk/client-dynamodb";
+import { marshall, unmarshall } from "@aws-sdk/util-dynamodb";
 import {
   DynamoDBDocumentClient,
   DeleteCommand,
@@ -85,7 +86,9 @@ function createProcessorTrustedHandler(opts) {
   const POST_TABLE = requireEnv("AMPLESS_POST_TABLE");
   const KV_TABLE = requireEnv("AMPLESS_KV_TABLE");
   const POSTTAG_TABLE = requireEnv("AMPLESS_POSTTAG_TABLE");
+  const PLUGIN_SECRET_TABLE = requireEnv("AMPLESS_PLUGIN_SECRET_TABLE");
   const REGION = requireEnv("AWS_REGION");
+  const rawDdb = new DynamoDBClient({});
   async function listPublished() {
     const items = [];
     let exclusiveStartKey;
@@ -121,6 +124,7 @@ function createProcessorTrustedHandler(opts) {
   function makeContext(plugin) {
     const namespace = plugin.instanceId ?? plugin.name;
     const label = plugin.instanceId ? `${plugin.name}#${plugin.instanceId}` : plugin.name;
+    const secretCache = /* @__PURE__ */ new Map();
     return {
       site: opts.site,
       listPublishedPosts: () => listPublished(),
@@ -146,6 +150,30 @@ function createProcessorTrustedHandler(opts) {
           })
         );
         return formatPublicAssetUrl(BUCKET, REGION, objectKey);
+      },
+      async secret(key) {
+        const cacheKey = `${namespace}:${key}`;
+        if (secretCache.has(cacheKey)) {
+          return secretCache.get(cacheKey);
+        }
+        const sk = `plugins.${namespace}.${key}`;
+        try {
+          const result = await rawDdb.send(
+            new GetItemCommand({
+              TableName: PLUGIN_SECRET_TABLE,
+              Key: marshall({ siteId: "default", sk })
+            })
+          );
+          const value = result.Item ? unmarshall(result.Item).value : void 0;
+          secretCache.set(cacheKey, value);
+          return value;
+        } catch (err) {
+          console.error(
+            `[trusted-processor] ${label}: ctx.secret("${key}") DDB read failed`,
+            err
+          );
+          return void 0;
+        }
       }
     };
   }

package/dist/index.d.ts

@@ -175,6 +175,7 @@ declare function amplessSchemaModels(a: any, opts?: AmplessSchemaModelsOpts): {
     PostTag: any;
     KvStore: any;
     McpToken: any;
+    PluginSecret: any;
     PublicPost: any;
     PublicPostConnection: any;
     PublicMedia: any;

package/dist/index.js

@@ -396,6 +396,47 @@ function amplessSchemaModels(a, opts = {}) {
     }).identifier(["hash"]).authorization((allow) => [
       allow.groups(["ampless-admin"])
     ]),
+    // Isolated secret storage for trusted plugins (Phase 6a).
+    //
+    // This is a COMPLETELY SEPARATE model from KvStore. KvStore grants
+    // admin/editor full read access through AppSync, which means any
+    // value stored there can be read by anyone with admin/editor
+    // credentials. PluginSecret has NO read authorization for any
+    // Cognito group — read is exclusively granted to IAM-authenticated
+    // principals (i.e. the trusted-processor Lambda role).
+    //
+    // Authorization design:
+    //   - admin / editor: CREATE, UPDATE, DELETE only. The AppSync
+    //     schema will not generate getPluginSecret / listPluginSecrets
+    //     queries for these groups because 'read' is absent.
+    //   - IAM (Lambda): read only. The trusted-processor Lambda uses
+    //     DDB SDK GetItem directly (not AppSync) to read secrets.
+    //
+    // Storage key convention:
+    //   siteId = 'default'   (single-site architecture)
+    //   sk = `plugins.${instanceId ?? name}.${fieldKey}`
+    //
+    // DynamoDB auto-encrypts at rest (AWS-managed KMS key). Secrets
+    // never flow to the S3 site-settings mirror because the trusted
+    // processor only queries KvStore (pk='siteconfig') for that path —
+    // PluginSecret is a structurally separate table.
+    PluginSecret: a.model({
+      // Single-site architecture: siteId is always 'default'.
+      siteId: a.string().required(),
+      // Composite sort key: `plugins.<instanceId>.<fieldKey>`
+      sk: a.string().required(),
+      // The secret value (plaintext string). DynamoDB's server-side
+      // encryption (SSE) with AWS-owned KMS protects the value at
+      // rest. IAM controls Lambda read; AppSync controls admin write.
+      value: a.string().required()
+    }).identifier(["siteId", "sk"]).authorization((allow) => [
+      // admin/editor can create/update/delete but NOT read.
+      // 'read' is intentionally omitted so AppSync does not generate
+      // getPluginSecret / listPluginSecrets queries for these groups.
+      allow.groups(["ampless-admin", "ampless-editor"]).to(["create", "update", "delete"]),
+      // Trusted Lambda reads via IAM-signed requests (SigV4).
+      allow.authenticated("iam").to(["read"])
+    ]),
     // Custom return type for public post reads. Decoupling from `Post` lets
     // AppSync skip the model-level (admin-only) auth check on fields.
     //

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ampless/backend",
-  "version": "1.0.0-alpha.45",
+  "version": "1.0.0-alpha.46",
   "description": "Amplify Gen 2 backend factories for ampless: auth, data, storage, event processors, API key renewer",
   "license": "MIT",
   "type": "module",
@@ -65,8 +65,8 @@
     "@smithy/protocol-http": "^5.4.4",
     "@smithy/signature-v4": "^5.4.4",
     "fflate": "^0.8.3",
-    "ampless": "1.0.0-alpha.28",
-    "@ampless/mcp-server": "1.0.0-alpha.34"
+    "ampless": "1.0.0-alpha.29",
+    "@ampless/mcp-server": "1.0.0-alpha.35"
   },
   "peerDependencies": {
     "@aws-amplify/backend": "^1",