@ampless/backend 1.0.0-beta.78 → 1.0.0-beta.80

package/dist/events/processor-trusted.js

@@ -64,14 +64,6 @@ function decryptSecret(rawKey, b64) {
   const plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
   return plaintext.toString("utf8");
 }
-function safeParse(s) {
-  try {
-    return JSON.parse(s);
-  } catch (err) {
-    console.warn("[trusted-processor] post.body is not valid JSON; passing through as string", err);
-    return s;
-  }
-}
 function createProcessorTrustedHandler(opts) {
   const privilegedHookedPlugins = (opts.plugins ?? []).filter(
     (p) => typeof p === "object" && p.trust_level === "privileged" && !!p.hooks && Object.keys(p.hooks).length > 0
@@ -145,7 +137,15 @@ function createProcessorTrustedHandler(opts) {
           title: row.title,
           excerpt: row.excerpt ?? void 0,
           format: row.format ?? "markdown",
-          body: typeof row.body === "string" ? safeParse(row.body) : row.body,
+          // DynamoDBDocumentClient unmarshals AWSJSON-backed attributes
+          // into native JS types (S→string, N→number, BOOL→boolean,
+          // M→object), so `row.body` is already correctly typed here and
+          // must NOT be re-parsed. Re-running JSON.parse on a pure-numeric
+          // or JSON-looking string body (e.g. a markdown/html body of
+          // "1470" or "123") double-decodes it into a number and corrupts
+          // the post. Only the Amplify GraphQL-client read path returns an
+          // AWSJSON wire string and needs decodeAwsJson.
+          body: row.body,
           status: row.status ?? "published",
           publishedAt: row.publishedAt ?? void 0,
           tags: Array.isArray(row.tags) ? row.tags : []
@@ -281,7 +281,7 @@ function createProcessorTrustedHandler(opts) {
         const sk = row.sk;
         if (!sk) continue;
         const raw = row.value;
-        settings[sk] = typeof raw === "string" ? safeParse(raw) : raw;
+        settings[sk] = raw;
       }
       exclusiveStartKey = res.LastEvaluatedKey;
     } while (exclusiveStartKey);
@@ -314,7 +314,7 @@ function createProcessorTrustedHandler(opts) {
         try {
           await rebuildSiteSettingsCache();
         } catch (err) {
-          console.error("[trusted-processor] site-settings-cache rebuild failed", err);
+          console.error("[trusted-processor][ALERT] site-settings-cache rebuild failed", err);
           throw err;
         }
       }

package/dist/index.d.ts

@@ -170,6 +170,7 @@ declare function amplessAuthConfig(opts?: AmplessAuthConfigOpts): Parameters<typ
  * Build the ampless S3 bucket configuration as a plain options object
  * suitable for `defineStorage(...)`. Access map:
  *   - `public/media/*`   — guest read, admin/editor full
+ *   - `public/static/*`  — guest read, admin/editor full (static-bundle posts)
  *   - `public/plugins/*` — guest read, admin full
  *
  * Bucket-level overrides (PublicAccessBlock, CORS, IAM policies for

package/dist/index.js

@@ -7,6 +7,9 @@ import { FunctionUrlAuthType, HttpMethod, StartingPosition } from "aws-cdk-lib/a
 import { DynamoEventSource, SqsEventSource } from "aws-cdk-lib/aws-lambda-event-sources";
 import { Rule, Schedule } from "aws-cdk-lib/aws-events";
 import { LambdaFunction } from "aws-cdk-lib/aws-events-targets";
+function siteSettingsCacheS3Resources(bucketArn) {
+  return [`${bucketArn}/public/plugins/*`, `${bucketArn}/public/site-settings.json`];
+}
 function defineAmplessBackend(opts) {
   const backend = defineBackend({
     auth: opts.auth,
@@ -152,17 +155,15 @@ function defineAmplessBackend(opts) {
     new PolicyStatement({
       effect: Effect.ALLOW,
       actions: ["s3:PutObject", "s3:DeleteObject"],
-      resources: [
-        `${backend.storage.resources.bucket.bucketArn}/public/plugins/*`,
-        // Built-in cache: rebuildSiteSettingsCache writes the single
-        // JSON file the public site reads. Exact-match resource — a
-        // wildcard like `public/site-settings/*` would NOT match the
-        // single-file key `public/site-settings.json` and the
-        // PutObject would fail silently with AccessDenied, so the
-        // public site would never see admin-side theme / settings
-        // changes.
-        `${backend.storage.resources.bucket.bucketArn}/public/site-settings.json`
-      ]
+      // Built-in cache: rebuildSiteSettingsCache writes the single JSON
+      // file the public site reads. The resource list MUST contain the
+      // exact-match key `public/site-settings.json` — a wildcard like
+      // `public/site-settings/*` would NOT match the single-file key and
+      // the PutObject would fail silently with AccessDenied, so the public
+      // site would never see admin-side theme / settings changes. Extracted
+      // into siteSettingsCacheS3Resources() so backend.test.ts can guard
+      // the exact ARN against this regression.
+      resources: siteSettingsCacheS3Resources(backend.storage.resources.bucket.bucketArn)
     })
   );
   const pluginSecretTable = backend.data.resources.tables["PluginSecret"];
@@ -303,6 +304,16 @@ function amplessStorageConfig() {
         allow.guest.to(["read"]),
         allow.groups(["ampless-admin", "ampless-editor"]).to(["read", "write", "delete"])
       ],
+      // Static-bundle posts (`format: 'static'`) upload their files to
+      // `public/static/<slug>/...` from the browser admin via Cognito
+      // identity-pool credentials. Without this rule the admin group's
+      // role is denied `s3:PutObject` and saving the post fails. Mirrors
+      // the media grant; the MCP/Lambda upload path is granted separately
+      // on the function role in `defineAmplessBackend`.
+      "public/static/*": [
+        allow.guest.to(["read"]),
+        allow.groups(["ampless-admin", "ampless-editor"]).to(["read", "write", "delete"])
+      ],
       "public/plugins/*": [
         allow.guest.to(["read"]),
         allow.groups(["ampless-admin"]).to(["read", "write", "delete"])

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ampless/backend",
-  "version": "1.0.0-beta.78",
+  "version": "1.0.0-beta.80",
   "description": "Amplify Gen 2 backend factories for ampless: auth, data, storage, event processors, API key renewer",
   "license": "MIT",
   "type": "module",
@@ -69,8 +69,8 @@
     "@smithy/protocol-http": "^5.4.4",
     "@smithy/signature-v4": "^5.4.4",
     "fflate": "^0.8.3",
-    "@ampless/mcp-server": "1.0.0-beta.58",
-    "ampless": "1.0.0-beta.52"
+    "@ampless/mcp-server": "1.0.0-beta.59",
+    "ampless": "1.0.0-beta.53"
   },
   "peerDependencies": {
     "@aws-amplify/backend": "^1.19.0",