@ampless/backend 1.0.0-beta.80 → 1.0.0-beta.81

package/dist/auth/user-admin.d.ts

@@ -39,7 +39,12 @@ interface UserAdminEvent {
     typeName: string;
     fieldName: string;
     arguments: Partial<SetArgs>;
-    identity?: unknown;
+    identity?: {
+        sub?: string;
+        username?: string;
+        groups?: string[];
+        [k: string]: unknown;
+    };
     source?: unknown;
     request?: unknown;
     prev?: unknown;

package/dist/auth/user-admin.js

@@ -74,10 +74,17 @@ async function setAdminUserRole(userPoolId, userId, role) {
   const finalRole = await roleOf(userPoolId, userId);
   return { userId, email, role: finalRole };
 }
+function isAdmin(identity) {
+  return (identity?.groups ?? []).includes(ADMIN_GROUP);
+}
 var handler = async (event) => {
   const userPoolId = requireUserPoolId();
   const field = event.fieldName;
   try {
+    if (!isAdmin(event.identity)) {
+      console.error("[user-admin] caller is not in the ampless-admin group");
+      throw new Error("Unauthorized: ampless-admin group required");
+    }
     if (field === "listAdminUsers") {
       return await listAdminUsers(userPoolId);
     }

package/dist/events/dispatcher.js

@@ -32,6 +32,8 @@ function projectPost(raw) {
     slug: raw.slug,
     title: raw.title,
     status: raw.status ?? "draft",
+    format: raw.format,
+    excerpt: raw.excerpt,
     publishedAt: raw.publishedAt,
     tags: raw.tags
   };
@@ -86,7 +88,15 @@ function emitKvEvents(record, timestamp) {
 async function sendBatch(queueUrl, entries) {
   for (let i = 0; i < entries.length; i += 10) {
     const chunk = entries.slice(i, i + 10);
-    await sqs.send(new SendMessageBatchCommand({ QueueUrl: queueUrl, Entries: chunk }));
+    const res = await sqs.send(
+      new SendMessageBatchCommand({ QueueUrl: queueUrl, Entries: chunk })
+    );
+    if (res.Failed && res.Failed.length > 0) {
+      console.error("[event-dispatcher] SQS SendMessageBatch partial failure:", res.Failed);
+      throw new Error(
+        `SendMessageBatch: ${res.Failed.length}/${chunk.length} message(s) failed for ${queueUrl}`
+      );
+    }
   }
 }
 function revisedAtForRecord(record, post) {

package/dist/events/processor-trusted.js

@@ -35,7 +35,12 @@ function postTagItemsFromPost(p) {
     publishedAt: p.publishedAt,
     slug: p.slug,
     title: p.title,
-    tags
+    tags,
+    // Omit when absent — PostTag rows are written via a direct DynamoDB put
+    // with no `removeUndefinedValues`, so an `undefined` attribute would
+    // throw "Unsupported type passed: undefined".
+    ...p.format !== void 0 && { format: p.format },
+    ...p.excerpt !== void 0 && { excerpt: p.excerpt }
   }));
 }
 function itemKey(item) {

package/dist/functions/api-key-renewer.js

@@ -13,26 +13,31 @@ function requireEnv(name) {
 var APPSYNC_API_ID = requireEnv("APPSYNC_API_ID");
 var TTL_DAYS = 364;
 var handler = async () => {
-  const { apiKeys } = await client.send(
-    new ListApiKeysCommand({ apiId: APPSYNC_API_ID })
-  );
-  if (!apiKeys || apiKeys.length === 0) {
-    console.warn("[api-key-renewer] no api keys to renew");
-    return;
-  }
-  const expires = Math.floor(Date.now() / 1e3) + TTL_DAYS * 86400;
-  const targetIso = new Date(expires * 1e3).toISOString();
-  for (const k of apiKeys) {
-    if (!k.id) continue;
-    const beforeIso = k.expires ? new Date(k.expires * 1e3).toISOString() : "(none)";
-    await client.send(
-      new UpdateApiKeyCommand({
-        apiId: APPSYNC_API_ID,
-        id: k.id,
-        expires
-      })
+  try {
+    const { apiKeys } = await client.send(
+      new ListApiKeysCommand({ apiId: APPSYNC_API_ID })
     );
-    console.log(`[api-key-renewer] ${k.id}: ${beforeIso} -> ${targetIso}`);
+    if (!apiKeys || apiKeys.length === 0) {
+      console.warn("[api-key-renewer] no api keys to renew");
+      return;
+    }
+    const expires = Math.floor(Date.now() / 1e3) + TTL_DAYS * 86400;
+    const targetIso = new Date(expires * 1e3).toISOString();
+    for (const k of apiKeys) {
+      if (!k.id) continue;
+      const beforeIso = k.expires ? new Date(k.expires * 1e3).toISOString() : "(none)";
+      await client.send(
+        new UpdateApiKeyCommand({
+          apiId: APPSYNC_API_ID,
+          id: k.id,
+          expires
+        })
+      );
+      console.log(`[api-key-renewer] ${k.id}: ${beforeIso} -> ${targetIso}`);
+    }
+  } catch (err) {
+    console.error("[api-key-renewer] failed to renew API keys:", err);
+    throw err;
   }
 };
 export {

package/dist/functions/mcp-handler.js

@@ -462,7 +462,23 @@ var uploadMediaSchema = {
     }
   }
 };
+var MIME_TYPE_RE = /^[a-z0-9][a-z0-9!#$&^_.+-]{0,126}\/[a-z0-9][a-z0-9!#$&^_.+-]{0,126}$/i;
+var BLOCKED_MIME_TYPES = /* @__PURE__ */ new Set([
+  "text/html",
+  "application/xhtml+xml",
+  "application/javascript",
+  "text/javascript"
+]);
+function assertSafeMimeType(mimeType) {
+  if (!MIME_TYPE_RE.test(mimeType)) {
+    throw new Error(`upload_media: invalid mimeType: ${JSON.stringify(mimeType)}`);
+  }
+  if (BLOCKED_MIME_TYPES.has(mimeType.toLowerCase())) {
+    throw new Error(`upload_media: mimeType not allowed for public media: ${mimeType}`);
+  }
+}
 async function uploadMedia(graphql, storage, args) {
+  assertSafeMimeType(args.mimeType);
   const body = Buffer.from(args.base64Data, "base64");
   const key = buildMediaKey(args.filename);
   const putResult = await storage.putObject(key, body, args.mimeType);
@@ -647,13 +663,16 @@ var GET_BY_ID2 = (
   }
 `
 );
-var GET_BY_SRC = (
+var FIND_BY_SRC = (
   /* GraphQL */
   `
-  query GetMediaBySrc($src: String!) {
-    getMediaBySrc(src: $src) {
-      mediaId
-      src
+  query FindMediaBySrc($filter: ModelMediaFilterInput!, $nextToken: String) {
+    listMedia(filter: $filter, limit: 100, nextToken: $nextToken) {
+      items {
+        mediaId
+        src
+      }
+      nextToken
     }
   }
 `
@@ -722,12 +741,18 @@ async function deleteMedia(graphql, storage, args) {
       assertMediaPrefix(src);
     }
   } else {
-    const data = await graphql.query(GET_BY_SRC, { src: args.src });
-    if (data.getMediaBySrc) {
-      mediaId = data.getMediaBySrc.mediaId;
-      src = data.getMediaBySrc.src;
-      assertMediaPrefix(src);
-    }
+    let cursor;
+    do {
+      const data = await graphql.query(FIND_BY_SRC, { filter: { src: { eq: args.src } }, nextToken: cursor });
+      const row = data.listMedia.items[0];
+      if (row) {
+        mediaId = row.mediaId;
+        src = row.src;
+        assertMediaPrefix(src);
+        break;
+      }
+      cursor = data.listMedia.nextToken ?? void 0;
+    } while (cursor);
   }
   if (!mediaId) {
     if (args.src) {
@@ -782,7 +807,12 @@ function getSchema() {
           slug: { type: "string", required: true, description: "URL slug, unique" },
           title: { type: "string", required: true },
           excerpt: { type: "string" },
-          format: { type: "enum", values: ["tiptap", "markdown", "html"], required: true },
+          format: {
+            type: "enum",
+            values: ["tiptap", "markdown", "html", "static"],
+            required: true,
+            description: "`static` is read-only here \u2014 get_post / list_posts can return it, but it is created/edited only via the static-bundle tools (upload_static_bundle, upload_static_file, delete_static_file, commit_static_post), NOT create_post / update_post. See notes.staticFormat."
+          },
           body: {
             type: "json",
             description: "tiptap node JSON when format=tiptap; markdown source string when format=markdown; raw HTML string when format=html"
@@ -821,7 +851,7 @@ function getSchema() {
         }
       }
     ],
-    formats: ["tiptap", "markdown", "html"],
+    formats: ["tiptap", "markdown", "html", "static"],
     notes: {
       editorTrust: 'editor stores arbitrary HTML/JS verbatim \u2014 same trust shape as WordPress unfiltered_html capability. See docs/architecture/04-access-layer-mcp.md \xA7"editor \u306E\u4FE1\u983C\u30E2\u30C7\u30EB".',
       tiptapBody: 'When format=tiptap, body is the tiptap document JSON: { type: "doc", content: [...] }. The renderer expects this shape.',
@@ -1466,8 +1496,10 @@ async function uploadStaticBundle(graphql, storage, args) {
   }
   const prefix = bundlePrefix(slug);
   const existing = await storage.listObjects(prefix).catch((err2) => {
-    console.error("[upload_static_bundle] listObjects failed (proceeding)", err2);
-    return [];
+    console.error("[upload_static_bundle] listObjects failed", err2);
+    throw new Error(
+      `upload_static_bundle: failed to list existing bundle objects for full-prefix wipe: ${err2 instanceof Error ? err2.message : String(err2)}`
+    );
   });
   for (const obj of existing) {
     await storage.deleteObject(obj.key);

package/dist/index.js

@@ -409,6 +409,10 @@ function amplessSchemaModels(a, opts = {}) {
       slug: a.string().required(),
       title: a.string().required(),
       excerpt: a.string(),
+      // Denormalized from the source Post so tag pages render the real
+      // format without a second lookup. Maintained by the trusted
+      // processor (posttag-sync) on every Post mutation.
+      format: a.enum(["tiptap", "markdown", "html", "static"]),
       // Full tag list of the post (for chip rendering on tag pages).
       tags: a.string().array()
     }).identifier(["tag", "publishedAtPostId"]).authorization((allow) => [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ampless/backend",
-  "version": "1.0.0-beta.80",
+  "version": "1.0.0-beta.81",
   "description": "Amplify Gen 2 backend factories for ampless: auth, data, storage, event processors, API key renewer",
   "license": "MIT",
   "type": "module",
@@ -69,8 +69,8 @@
     "@smithy/protocol-http": "^5.4.4",
     "@smithy/signature-v4": "^5.4.4",
     "fflate": "^0.8.3",
-    "@ampless/mcp-server": "1.0.0-beta.59",
-    "ampless": "1.0.0-beta.53"
+    "@ampless/mcp-server": "1.0.0-beta.60",
+    "ampless": "1.0.0-beta.54"
   },
   "peerDependencies": {
     "@aws-amplify/backend": "^1.19.0",