@ampless/backend 1.0.0-beta.75 → 1.0.0-beta.77

package/README.ja.md

@@ -50,6 +50,22 @@ export const auth = defineAuth(amplessAuthConfig({ postConfirmation }))
 
 > `defineAuth` は `amplify/auth/resource.ts` 自体に記述する必要があります。Amplify Gen 2 のインポートパス検証機能が `defineAuth` / `defineData` / `defineStorage` の呼び出し元を検査し、他のファイル（`node_modules/@ampless/backend/...` 配下のラッパーを含む）から呼び出された場合に `Amplify Auth must be defined in amplify/auth/resource.ts` というエラーを投げます。`amplessAuthConfig` は props オブジェクトを返すため、ampless のデフォルト設定を失わずにこのファイルで `defineAuth(...)` を呼び出せます。
 
+#### パスキー（WebAuthn）
+
+`amplessAuthConfig` はデフォルトでパスキーサインインを有効化します。オペレーターは管理画面のアカウントページからパスキーを登録すると、Face ID / Touch ID / セキュリティキーでサインインできます。パスワードフローは初回ブートストラップ兼フォールバックとして常に利用可能なまま残ります。
+
+```ts
+amplessAuthConfig({ postConfirmation })                       // パスキー有効・RP ID は自動解決
+amplessAuthConfig({ postConfirmation, webAuthn: true })       // デフォルトと同じ
+amplessAuthConfig({                                            // カスタムドメイン用に Relying Party ID を固定
+  postConfirmation,
+  webAuthn: { relyingPartyId: 'admin.example.com' },          // プロトコル・パスなしの bare domain
+})
+amplessAuthConfig({ postConfirmation, webAuthn: false })      // パスワードのみのサインイン
+```
+
+デフォルト（`true`）では Amplify がデプロイドメインから WebAuthn の Relying Party ID を自動解決します。これは Amplify Hosting ドメインと `localhost` サンドボックスで動作します。管理画面を **CDN 配下のカスタムドメイン** で配信している場合、自動解決された RP ID がブラウザの見る URL と一致せず、サインインが `SecurityError` で失敗します。その場合はオペレーターがアクセスする bare domain を `relyingPartyId` に固定してください。パスキー登録後に RP ID を変更すると、登録済みの認証情報がすべて無効化されます。テンプレートではこのノブを `amplify/auth/resource.custom.ts`（`webAuthn?: AmplessWebAuthnOption | false`）経由で設定します。[docs/passkeys.ja.md](https://github.com/heavymoons/ampless/blob/main/docs/passkeys.ja.md) を参照してください。
+
 ### `amplify/data/resource.ts`
 
 ```ts

package/README.md

@@ -50,6 +50,22 @@ export const auth = defineAuth(amplessAuthConfig({ postConfirmation }))
 
 > `defineAuth` must live in `amplify/auth/resource.ts` itself. Amplify Gen 2's import-path verifier inspects the call site of `defineAuth` / `defineData` / `defineStorage` and throws `Amplify Auth must be defined in amplify/auth/resource.ts` if it's invoked from any other file (including a `node_modules/@ampless/backend/...` wrapper). `amplessAuthConfig` returns the props object so you can call `defineAuth(...)` here without losing the ampless defaults.
 
+#### Passkeys (WebAuthn)
+
+`amplessAuthConfig` enables passkey sign-in by default. Operators can register a passkey from the admin account page and then sign in with Face ID / Touch ID / a security key. The password flow always stays available as the bootstrap + fallback.
+
+```ts
+amplessAuthConfig({ postConfirmation })                       // passkeys on, RP ID auto-resolved
+amplessAuthConfig({ postConfirmation, webAuthn: true })       // same as the default
+amplessAuthConfig({                                            // pin the Relying Party ID for a custom domain
+  postConfirmation,
+  webAuthn: { relyingPartyId: 'admin.example.com' },          // bare domain, no protocol or path
+})
+amplessAuthConfig({ postConfirmation, webAuthn: false })      // password-only sign-in
+```
+
+The default (`true`) lets Amplify auto-resolve the WebAuthn Relying Party ID from the deployment domain, which works on Amplify Hosting domains and on a `localhost` sandbox. If the admin is served from a **custom domain behind a CDN**, the auto-resolved RP ID won't match the URL the browser sees and sign-in fails with a `SecurityError` — pin `relyingPartyId` to the bare domain operators visit. Changing the RP ID after passkeys exist invalidates every registered credential. The template wires this knob through `amplify/auth/resource.custom.ts` (`webAuthn?: AmplessWebAuthnOption | false`). See [docs/passkeys.md](https://github.com/heavymoons/ampless/blob/main/docs/passkeys.md).
+
 ### `amplify/data/resource.ts`
 
 ```ts

package/dist/index.d.ts

@@ -82,6 +82,23 @@ type AmplessBackend = any;
  */
 declare function defineAmplessBackend(opts: DefineAmplessBackendOpts): AmplessBackend;
 
+/**
+ * WebAuthn (passkey) login knob. `true` lets Amplify auto-resolve the
+ * Relying Party ID from the deployment domain (works on Amplify Hosting
+ * domains and `localhost` sandboxes); the object form pins the RP ID
+ * explicitly, which is required when the admin is served from a custom
+ * domain behind a CDN (the auto-resolved RP ID would be the Amplify
+ * Hosting domain and the browser raises `SecurityError`).
+ *
+ * Changing the RP ID after passkeys exist invalidates every registered
+ * credential — operators have to re-register. The password flow always
+ * stays available as the fallback.
+ *
+ * Derived from `defineAuth`'s `loginWith.webAuthn` so it tracks the
+ * underlying Amplify type. The non-`undefined` branch is the shape we
+ * accept (`true | { relyingPartyId; userVerification? }`).
+ */
+type AmplessWebAuthnOption = NonNullable<NonNullable<Parameters<typeof defineAuth>[0]['loginWith']>['webAuthn']>;
 interface AmplessAuthConfigOpts {
     /**
      * The `post-confirmation` Cognito Lambda trigger that promotes the
@@ -95,6 +112,13 @@ interface AmplessAuthConfigOpts {
      * through without losing functionality.
      */
     postConfirmation?: unknown;
+    /**
+     * Passkey (WebAuthn) login. Defaults to `true` (auto RP ID) so new
+     * sites get passkeys out of the box. Pass the object form to pin the
+     * Relying Party ID on a custom domain, or `false` to opt out entirely
+     * (the `webAuthn` key is then omitted from the Cognito config).
+     */
+    webAuthn?: AmplessWebAuthnOption | false;
 }
 /**
  * Build the ampless Cognito configuration (User Pool + Identity Pool
@@ -303,4 +327,4 @@ declare function amplessSchemaAuthorization(allow: any, opts?: AmplessSchemaAuth
  */
 declare const defaultAuthorizationModes: Parameters<typeof defineData>[0]['authorizationModes'];
 
-export { type AmplessAuthConfigOpts, type AmplessBackend, type AmplessResolverPaths, type AmplessSchemaAuthorizationOpts, type AmplessSchemaModelsOpts, DEFAULT_RESOLVER_PATHS, type DefineAmplessBackendOpts, amplessAuthConfig, amplessSchemaAuthorization, amplessSchemaModels, amplessStorageConfig, defaultAuthorizationModes, defineAmplessBackend, extendAmplessSchema };
+export { type AmplessAuthConfigOpts, type AmplessBackend, type AmplessResolverPaths, type AmplessSchemaAuthorizationOpts, type AmplessSchemaModelsOpts, type AmplessWebAuthnOption, DEFAULT_RESOLVER_PATHS, type DefineAmplessBackendOpts, amplessAuthConfig, amplessSchemaAuthorization, amplessSchemaModels, amplessStorageConfig, defaultAuthorizationModes, defineAmplessBackend, extendAmplessSchema };

package/dist/index.js

@@ -57,16 +57,14 @@ function defineAmplessBackend(opts) {
     })
   );
   const cfnUserPool = backend.auth.resources.cfnResources.cfnUserPool;
-  cfnUserPool.policies = {
-    passwordPolicy: {
-      minimumLength: 8,
-      requireLowercase: false,
-      requireUppercase: false,
-      requireNumbers: false,
-      requireSymbols: false,
-      temporaryPasswordValidityDays: 7
-    }
-  };
+  cfnUserPool.addPropertyOverride("Policies.PasswordPolicy", {
+    MinimumLength: 8,
+    RequireLowercase: false,
+    RequireUppercase: false,
+    RequireNumbers: false,
+    RequireSymbols: false,
+    TemporaryPasswordValidityDays: 7
+  });
   backend.postConfirmation.resources.lambda.addToRolePolicy(
     new PolicyStatement({
       effect: Effect.ALLOW,
@@ -269,7 +267,10 @@ function defineAmplessBackend(opts) {
 function amplessAuthConfig(opts = {}) {
   return {
     loginWith: {
-      email: true
+      email: true,
+      // Passkeys are on by default; `webAuthn: false` drops the key so
+      // Cognito provisions a password-only sign-in policy.
+      ...opts.webAuthn === false ? {} : { webAuthn: opts.webAuthn ?? true }
     },
     groups: ["ampless-admin", "ampless-editor", "ampless-reader"],
     triggers: opts.postConfirmation ? (

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ampless/backend",
-  "version": "1.0.0-beta.75",
+  "version": "1.0.0-beta.77",
   "description": "Amplify Gen 2 backend factories for ampless: auth, data, storage, event processors, API key renewer",
   "license": "MIT",
   "type": "module",
@@ -73,7 +73,7 @@
     "ampless": "1.0.0-beta.52"
   },
   "peerDependencies": {
-    "@aws-amplify/backend": "^1",
+    "@aws-amplify/backend": "^1.19.0",
     "aws-cdk-lib": "^2"
   },
   "devDependencies": {