@ampless/backend 1.0.0-beta.77 → 1.0.0-beta.78

package/README.ja.md

@@ -64,7 +64,7 @@ amplessAuthConfig({                                            // カスタム
 amplessAuthConfig({ postConfirmation, webAuthn: false })      // パスワードのみのサインイン
 ```
 
-デフォルト（`true`）では Amplify がデプロイドメインから WebAuthn の Relying Party ID を自動解決します。これは Amplify Hosting ドメインと `localhost` サンドボックスで動作します。管理画面を **CDN 配下のカスタムドメイン** で配信している場合、自動解決された RP ID がブラウザの見る URL と一致せず、サインインが `SecurityError` で失敗します。その場合はオペレーターがアクセスする bare domain を `relyingPartyId` に固定してください。パスキー登録後に RP ID を変更すると、登録済みの認証情報がすべて無効化されます。テンプレートではこのノブを `amplify/auth/resource.custom.ts`（`webAuthn?: AmplessWebAuthnOption | false`）経由で設定します。[docs/passkeys.ja.md](https://github.com/heavymoons/ampless/blob/main/docs/passkeys.ja.md) を参照してください。
+Amplify Hosting パイプラインビルドでは、テンプレートが `cms.config.ts` の `site.url` から `resolveWebAuthn({ override, siteUrl, isPipeline })` を通じて Relying Party ID を自動導出します。最も一般的なケースでは手動設定不要です。`ampx sandbox` では RP ID は `localhost` のまま（Amplify が自動解決）です。管理画面を `site.url` と**異なるサブドメイン**で配信している場合は、`amplify/auth/resource.custom.ts` でオペレーターがアクセスする bare domain を `relyingPartyId` に固定してください。パスキー登録後に RP ID を変更すると、登録済みの認証情報がすべて無効化されます。[docs/passkeys.ja.md](https://github.com/heavymoons/ampless/blob/main/docs/passkeys.ja.md) を参照してください。
 
 ### `amplify/data/resource.ts`
 
@@ -127,7 +127,7 @@ export { handler } from '@ampless/backend/functions/api-key-renewer'
 
 ## サブパス
 
-- `@ampless/backend` — `defineAmplessBackend`、`amplessAuthConfig`、`amplessStorageConfig`、`amplessSchemaModels`、`extendAmplessSchema`、`defaultAuthorizationModes`
+- `@ampless/backend` — `defineAmplessBackend`、`amplessAuthConfig`、`resolveWebAuthn`、`amplessStorageConfig`、`amplessSchemaModels`、`extendAmplessSchema`、`defaultAuthorizationModes`
 - `@ampless/backend/auth/post-confirmation` — Lambda ハンドラー
 - `@ampless/backend/events/dispatcher` — Lambda ハンドラー
 - `@ampless/backend/events/processor-trusted` — `createProcessorTrustedHandler({ plugins, site })`

package/README.md

@@ -64,7 +64,7 @@ amplessAuthConfig({                                            // pin the Relyin
 amplessAuthConfig({ postConfirmation, webAuthn: false })      // password-only sign-in
 ```
 
-The default (`true`) lets Amplify auto-resolve the WebAuthn Relying Party ID from the deployment domain, which works on Amplify Hosting domains and on a `localhost` sandbox. If the admin is served from a **custom domain behind a CDN**, the auto-resolved RP ID won't match the URL the browser sees and sign-in fails with a `SecurityError` — pin `relyingPartyId` to the bare domain operators visit. Changing the RP ID after passkeys exist invalidates every registered credential. The template wires this knob through `amplify/auth/resource.custom.ts` (`webAuthn?: AmplessWebAuthnOption | false`). See [docs/passkeys.md](https://github.com/heavymoons/ampless/blob/main/docs/passkeys.md).
+In Amplify Hosting pipeline builds the template auto-derives the Relying Party ID from `site.url` in `cms.config.ts` via `resolveWebAuthn({ override, siteUrl, isPipeline })` — no manual configuration needed for the common case. In `ampx sandbox` the RP ID stays `localhost` (auto-resolved by Amplify). If the admin is served from a **different subdomain** than `site.url`, pin `relyingPartyId` to the bare domain operators visit in `amplify/auth/resource.custom.ts`. Changing the RP ID after passkeys exist invalidates every registered credential. See [docs/passkeys.md](https://github.com/heavymoons/ampless/blob/main/docs/passkeys.md).
 
 ### `amplify/data/resource.ts`
 
@@ -127,7 +127,7 @@ export { handler } from '@ampless/backend/functions/api-key-renewer'
 
 ## Sub-paths
 
-- `@ampless/backend` — `defineAmplessBackend`, `amplessAuthConfig`, `amplessStorageConfig`, `amplessSchemaModels`, `extendAmplessSchema`, `defaultAuthorizationModes`
+- `@ampless/backend` — `defineAmplessBackend`, `amplessAuthConfig`, `resolveWebAuthn`, `amplessStorageConfig`, `amplessSchemaModels`, `extendAmplessSchema`, `defaultAuthorizationModes`
 - `@ampless/backend/auth/post-confirmation` — Lambda handler
 - `@ampless/backend/events/dispatcher` — Lambda handler
 - `@ampless/backend/events/processor-trusted` — `createProcessorTrustedHandler({ plugins, site })`

package/dist/index.d.ts

@@ -120,6 +120,25 @@ interface AmplessAuthConfigOpts {
      */
     webAuthn?: AmplessWebAuthnOption | false;
 }
+interface ResolveWebAuthnOpts {
+    /** Explicit override from resource.custom.ts. When present, takes precedence. */
+    override?: AmplessWebAuthnOption | false;
+    /** `site.url` from cms.config — used to derive hostname in pipeline builds. */
+    siteUrl: string;
+    /** True only in Amplify Hosting pipeline builds (`Boolean(process.env.AWS_BRANCH)`). */
+    isPipeline: boolean;
+}
+/**
+ * Single source of truth for the WebAuthn relying-party configuration.
+ *
+ * Priority:
+ *   1. `override !== undefined` → return it verbatim (supports `false` to disable).
+ *   2. Not a pipeline build (sandbox / local) → return `true` so Amplify
+ *      auto-resolves the RP ID from `localhost` (no RP ID needed in dev).
+ *   3. Pipeline build → derive `{ relyingPartyId }` from `siteUrl`.
+ *      Falls back to `true` if `siteUrl` is not a valid URL (logs a warning).
+ */
+declare function resolveWebAuthn(opts: ResolveWebAuthnOpts): AmplessWebAuthnOption | false;
 /**
  * Build the ampless Cognito configuration (User Pool + Identity Pool
  * with the three role groups and the optional post-confirmation
@@ -327,4 +346,4 @@ declare function amplessSchemaAuthorization(allow: any, opts?: AmplessSchemaAuth
  */
 declare const defaultAuthorizationModes: Parameters<typeof defineData>[0]['authorizationModes'];
 
-export { type AmplessAuthConfigOpts, type AmplessBackend, type AmplessResolverPaths, type AmplessSchemaAuthorizationOpts, type AmplessSchemaModelsOpts, type AmplessWebAuthnOption, DEFAULT_RESOLVER_PATHS, type DefineAmplessBackendOpts, amplessAuthConfig, amplessSchemaAuthorization, amplessSchemaModels, amplessStorageConfig, defaultAuthorizationModes, defineAmplessBackend, extendAmplessSchema };
+export { type AmplessAuthConfigOpts, type AmplessBackend, type AmplessResolverPaths, type AmplessSchemaAuthorizationOpts, type AmplessSchemaModelsOpts, type AmplessWebAuthnOption, DEFAULT_RESOLVER_PATHS, type DefineAmplessBackendOpts, type ResolveWebAuthnOpts, amplessAuthConfig, amplessSchemaAuthorization, amplessSchemaModels, amplessStorageConfig, defaultAuthorizationModes, defineAmplessBackend, extendAmplessSchema, resolveWebAuthn };

package/dist/index.js

@@ -264,6 +264,20 @@ function defineAmplessBackend(opts) {
 }
 
 // src/auth/index.ts
+function resolveWebAuthn(opts) {
+  if (opts.override !== void 0) return opts.override;
+  if (!opts.isPipeline) return true;
+  try {
+    const hostname = new URL(opts.siteUrl).hostname;
+    return { relyingPartyId: hostname };
+  } catch {
+    console.warn(
+      "[ampless] invalid site.url for WebAuthn relying party, falling back to auto:",
+      opts.siteUrl
+    );
+    return true;
+  }
+}
 function amplessAuthConfig(opts = {}) {
   return {
     loginWith: {
@@ -749,5 +763,6 @@ export {
   amplessStorageConfig,
   defaultAuthorizationModes,
   defineAmplessBackend,
-  extendAmplessSchema
+  extendAmplessSchema,
+  resolveWebAuthn
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ampless/backend",
-  "version": "1.0.0-beta.77",
+  "version": "1.0.0-beta.78",
   "description": "Amplify Gen 2 backend factories for ampless: auth, data, storage, event processors, API key renewer",
   "license": "MIT",
   "type": "module",