@ampless/backend 1.0.0-beta.77 → 1.0.0-beta.79

package/README.ja.md

@@ -64,7 +64,7 @@ amplessAuthConfig({                                            // カスタム
 amplessAuthConfig({ postConfirmation, webAuthn: false })      // パスワードのみのサインイン
 ```
 
-デフォルト（`true`）では Amplify がデプロイドメインから WebAuthn の Relying Party ID を自動解決します。これは Amplify Hosting ドメインと `localhost` サンドボックスで動作します。管理画面を **CDN 配下のカスタムドメイン** で配信している場合、自動解決された RP ID がブラウザの見る URL と一致せず、サインインが `SecurityError` で失敗します。その場合はオペレーターがアクセスする bare domain を `relyingPartyId` に固定してください。パスキー登録後に RP ID を変更すると、登録済みの認証情報がすべて無効化されます。テンプレートではこのノブを `amplify/auth/resource.custom.ts`（`webAuthn?: AmplessWebAuthnOption | false`）経由で設定します。[docs/passkeys.ja.md](https://github.com/heavymoons/ampless/blob/main/docs/passkeys.ja.md) を参照してください。
+Amplify Hosting パイプラインビルドでは、テンプレートが `cms.config.ts` の `site.url` から `resolveWebAuthn({ override, siteUrl, isPipeline })` を通じて Relying Party ID を自動導出します。最も一般的なケースでは手動設定不要です。`ampx sandbox` では RP ID は `localhost` のまま（Amplify が自動解決）です。管理画面を `site.url` と**異なるサブドメイン**で配信している場合は、`amplify/auth/resource.custom.ts` でオペレーターがアクセスする bare domain を `relyingPartyId` に固定してください。パスキー登録後に RP ID を変更すると、登録済みの認証情報がすべて無効化されます。[docs/passkeys.ja.md](https://github.com/heavymoons/ampless/blob/main/docs/passkeys.ja.md) を参照してください。
 
 ### `amplify/data/resource.ts`
 
@@ -127,7 +127,7 @@ export { handler } from '@ampless/backend/functions/api-key-renewer'
 
 ## サブパス
 
-- `@ampless/backend` — `defineAmplessBackend`、`amplessAuthConfig`、`amplessStorageConfig`、`amplessSchemaModels`、`extendAmplessSchema`、`defaultAuthorizationModes`
+- `@ampless/backend` — `defineAmplessBackend`、`amplessAuthConfig`、`resolveWebAuthn`、`amplessStorageConfig`、`amplessSchemaModels`、`extendAmplessSchema`、`defaultAuthorizationModes`
 - `@ampless/backend/auth/post-confirmation` — Lambda ハンドラー
 - `@ampless/backend/events/dispatcher` — Lambda ハンドラー
 - `@ampless/backend/events/processor-trusted` — `createProcessorTrustedHandler({ plugins, site })`

package/README.md

@@ -64,7 +64,7 @@ amplessAuthConfig({                                            // pin the Relyin
 amplessAuthConfig({ postConfirmation, webAuthn: false })      // password-only sign-in
 ```
 
-The default (`true`) lets Amplify auto-resolve the WebAuthn Relying Party ID from the deployment domain, which works on Amplify Hosting domains and on a `localhost` sandbox. If the admin is served from a **custom domain behind a CDN**, the auto-resolved RP ID won't match the URL the browser sees and sign-in fails with a `SecurityError` — pin `relyingPartyId` to the bare domain operators visit. Changing the RP ID after passkeys exist invalidates every registered credential. The template wires this knob through `amplify/auth/resource.custom.ts` (`webAuthn?: AmplessWebAuthnOption | false`). See [docs/passkeys.md](https://github.com/heavymoons/ampless/blob/main/docs/passkeys.md).
+In Amplify Hosting pipeline builds the template auto-derives the Relying Party ID from `site.url` in `cms.config.ts` via `resolveWebAuthn({ override, siteUrl, isPipeline })` — no manual configuration needed for the common case. In `ampx sandbox` the RP ID stays `localhost` (auto-resolved by Amplify). If the admin is served from a **different subdomain** than `site.url`, pin `relyingPartyId` to the bare domain operators visit in `amplify/auth/resource.custom.ts`. Changing the RP ID after passkeys exist invalidates every registered credential. See [docs/passkeys.md](https://github.com/heavymoons/ampless/blob/main/docs/passkeys.md).
 
 ### `amplify/data/resource.ts`
 
@@ -127,7 +127,7 @@ export { handler } from '@ampless/backend/functions/api-key-renewer'
 
 ## Sub-paths
 
-- `@ampless/backend` — `defineAmplessBackend`, `amplessAuthConfig`, `amplessStorageConfig`, `amplessSchemaModels`, `extendAmplessSchema`, `defaultAuthorizationModes`
+- `@ampless/backend` — `defineAmplessBackend`, `amplessAuthConfig`, `resolveWebAuthn`, `amplessStorageConfig`, `amplessSchemaModels`, `extendAmplessSchema`, `defaultAuthorizationModes`
 - `@ampless/backend/auth/post-confirmation` — Lambda handler
 - `@ampless/backend/events/dispatcher` — Lambda handler
 - `@ampless/backend/events/processor-trusted` — `createProcessorTrustedHandler({ plugins, site })`

package/dist/events/processor-trusted.js

@@ -64,14 +64,6 @@ function decryptSecret(rawKey, b64) {
   const plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
   return plaintext.toString("utf8");
 }
-function safeParse(s) {
-  try {
-    return JSON.parse(s);
-  } catch (err) {
-    console.warn("[trusted-processor] post.body is not valid JSON; passing through as string", err);
-    return s;
-  }
-}
 function createProcessorTrustedHandler(opts) {
   const privilegedHookedPlugins = (opts.plugins ?? []).filter(
     (p) => typeof p === "object" && p.trust_level === "privileged" && !!p.hooks && Object.keys(p.hooks).length > 0
@@ -145,7 +137,15 @@ function createProcessorTrustedHandler(opts) {
           title: row.title,
           excerpt: row.excerpt ?? void 0,
           format: row.format ?? "markdown",
-          body: typeof row.body === "string" ? safeParse(row.body) : row.body,
+          // DynamoDBDocumentClient unmarshals AWSJSON-backed attributes
+          // into native JS types (S→string, N→number, BOOL→boolean,
+          // M→object), so `row.body` is already correctly typed here and
+          // must NOT be re-parsed. Re-running JSON.parse on a pure-numeric
+          // or JSON-looking string body (e.g. a markdown/html body of
+          // "1470" or "123") double-decodes it into a number and corrupts
+          // the post. Only the Amplify GraphQL-client read path returns an
+          // AWSJSON wire string and needs decodeAwsJson.
+          body: row.body,
           status: row.status ?? "published",
           publishedAt: row.publishedAt ?? void 0,
           tags: Array.isArray(row.tags) ? row.tags : []
@@ -281,7 +281,7 @@ function createProcessorTrustedHandler(opts) {
         const sk = row.sk;
         if (!sk) continue;
         const raw = row.value;
-        settings[sk] = typeof raw === "string" ? safeParse(raw) : raw;
+        settings[sk] = raw;
       }
       exclusiveStartKey = res.LastEvaluatedKey;
     } while (exclusiveStartKey);
@@ -314,7 +314,7 @@ function createProcessorTrustedHandler(opts) {
         try {
           await rebuildSiteSettingsCache();
         } catch (err) {
-          console.error("[trusted-processor] site-settings-cache rebuild failed", err);
+          console.error("[trusted-processor][ALERT] site-settings-cache rebuild failed", err);
           throw err;
         }
       }

package/dist/index.d.ts

@@ -120,6 +120,25 @@ interface AmplessAuthConfigOpts {
      */
     webAuthn?: AmplessWebAuthnOption | false;
 }
+interface ResolveWebAuthnOpts {
+    /** Explicit override from resource.custom.ts. When present, takes precedence. */
+    override?: AmplessWebAuthnOption | false;
+    /** `site.url` from cms.config — used to derive hostname in pipeline builds. */
+    siteUrl: string;
+    /** True only in Amplify Hosting pipeline builds (`Boolean(process.env.AWS_BRANCH)`). */
+    isPipeline: boolean;
+}
+/**
+ * Single source of truth for the WebAuthn relying-party configuration.
+ *
+ * Priority:
+ *   1. `override !== undefined` → return it verbatim (supports `false` to disable).
+ *   2. Not a pipeline build (sandbox / local) → return `true` so Amplify
+ *      auto-resolves the RP ID from `localhost` (no RP ID needed in dev).
+ *   3. Pipeline build → derive `{ relyingPartyId }` from `siteUrl`.
+ *      Falls back to `true` if `siteUrl` is not a valid URL (logs a warning).
+ */
+declare function resolveWebAuthn(opts: ResolveWebAuthnOpts): AmplessWebAuthnOption | false;
 /**
  * Build the ampless Cognito configuration (User Pool + Identity Pool
  * with the three role groups and the optional post-confirmation
@@ -327,4 +346,4 @@ declare function amplessSchemaAuthorization(allow: any, opts?: AmplessSchemaAuth
  */
 declare const defaultAuthorizationModes: Parameters<typeof defineData>[0]['authorizationModes'];
 
-export { type AmplessAuthConfigOpts, type AmplessBackend, type AmplessResolverPaths, type AmplessSchemaAuthorizationOpts, type AmplessSchemaModelsOpts, type AmplessWebAuthnOption, DEFAULT_RESOLVER_PATHS, type DefineAmplessBackendOpts, amplessAuthConfig, amplessSchemaAuthorization, amplessSchemaModels, amplessStorageConfig, defaultAuthorizationModes, defineAmplessBackend, extendAmplessSchema };
+export { type AmplessAuthConfigOpts, type AmplessBackend, type AmplessResolverPaths, type AmplessSchemaAuthorizationOpts, type AmplessSchemaModelsOpts, type AmplessWebAuthnOption, DEFAULT_RESOLVER_PATHS, type DefineAmplessBackendOpts, type ResolveWebAuthnOpts, amplessAuthConfig, amplessSchemaAuthorization, amplessSchemaModels, amplessStorageConfig, defaultAuthorizationModes, defineAmplessBackend, extendAmplessSchema, resolveWebAuthn };

package/dist/index.js

@@ -7,6 +7,9 @@ import { FunctionUrlAuthType, HttpMethod, StartingPosition } from "aws-cdk-lib/a
 import { DynamoEventSource, SqsEventSource } from "aws-cdk-lib/aws-lambda-event-sources";
 import { Rule, Schedule } from "aws-cdk-lib/aws-events";
 import { LambdaFunction } from "aws-cdk-lib/aws-events-targets";
+function siteSettingsCacheS3Resources(bucketArn) {
+  return [`${bucketArn}/public/plugins/*`, `${bucketArn}/public/site-settings.json`];
+}
 function defineAmplessBackend(opts) {
   const backend = defineBackend({
     auth: opts.auth,
@@ -152,17 +155,15 @@ function defineAmplessBackend(opts) {
     new PolicyStatement({
       effect: Effect.ALLOW,
       actions: ["s3:PutObject", "s3:DeleteObject"],
-      resources: [
-        `${backend.storage.resources.bucket.bucketArn}/public/plugins/*`,
-        // Built-in cache: rebuildSiteSettingsCache writes the single
-        // JSON file the public site reads. Exact-match resource — a
-        // wildcard like `public/site-settings/*` would NOT match the
-        // single-file key `public/site-settings.json` and the
-        // PutObject would fail silently with AccessDenied, so the
-        // public site would never see admin-side theme / settings
-        // changes.
-        `${backend.storage.resources.bucket.bucketArn}/public/site-settings.json`
-      ]
+      // Built-in cache: rebuildSiteSettingsCache writes the single JSON
+      // file the public site reads. The resource list MUST contain the
+      // exact-match key `public/site-settings.json` — a wildcard like
+      // `public/site-settings/*` would NOT match the single-file key and
+      // the PutObject would fail silently with AccessDenied, so the public
+      // site would never see admin-side theme / settings changes. Extracted
+      // into siteSettingsCacheS3Resources() so backend.test.ts can guard
+      // the exact ARN against this regression.
+      resources: siteSettingsCacheS3Resources(backend.storage.resources.bucket.bucketArn)
     })
   );
   const pluginSecretTable = backend.data.resources.tables["PluginSecret"];
@@ -264,6 +265,20 @@ function defineAmplessBackend(opts) {
 }
 
 // src/auth/index.ts
+function resolveWebAuthn(opts) {
+  if (opts.override !== void 0) return opts.override;
+  if (!opts.isPipeline) return true;
+  try {
+    const hostname = new URL(opts.siteUrl).hostname;
+    return { relyingPartyId: hostname };
+  } catch {
+    console.warn(
+      "[ampless] invalid site.url for WebAuthn relying party, falling back to auto:",
+      opts.siteUrl
+    );
+    return true;
+  }
+}
 function amplessAuthConfig(opts = {}) {
   return {
     loginWith: {
@@ -749,5 +764,6 @@ export {
   amplessStorageConfig,
   defaultAuthorizationModes,
   defineAmplessBackend,
-  extendAmplessSchema
+  extendAmplessSchema,
+  resolveWebAuthn
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ampless/backend",
-  "version": "1.0.0-beta.77",
+  "version": "1.0.0-beta.79",
   "description": "Amplify Gen 2 backend factories for ampless: auth, data, storage, event processors, API key renewer",
   "license": "MIT",
   "type": "module",
@@ -69,8 +69,8 @@
     "@smithy/protocol-http": "^5.4.4",
     "@smithy/signature-v4": "^5.4.4",
     "fflate": "^0.8.3",
-    "@ampless/mcp-server": "1.0.0-beta.58",
-    "ampless": "1.0.0-beta.52"
+    "@ampless/mcp-server": "1.0.0-beta.59",
+    "ampless": "1.0.0-beta.53"
   },
   "peerDependencies": {
     "@aws-amplify/backend": "^1.19.0",