@anthusai/papyrus 0.0.0 → 1.0.0-next.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Anthus AI Solutions
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/amplify/auth/resource.js

@@ -0,0 +1,61 @@
+import { defineAuth, secret } from "@aws-amplify/backend";
+import { manageUserRole } from "../functions/manage-user-role/resource.js";
+// Default OAuth redirect URLs for the p.apyr.us app. Other publications pass
+// `auth.redirectUrls` to `defineSiteBackend` (or, for Papyrus's own backend,
+// the PAPYRUS_OAUTH_REDIRECT_URLS branch env var, comma-separated).
+// See docs/google-oauth-setup.md.
+const DEFAULT_AUTH_REDIRECT_URLS = [
+    "http://localhost:3001/",
+    "http://localhost:3000/",
+    "https://p.apyr.us/",
+    "https://main.dbsyytcm9drqa.amplifyapp.com/",
+    "https://codex-rehydration-api-split.dbsyytcm9drqa.amplifyapp.com/",
+];
+function resolveAuthRedirectUrls() {
+    const raw = (process.env.PAPYRUS_OAUTH_REDIRECT_URLS ?? "").trim();
+    if (!raw)
+        return DEFAULT_AUTH_REDIRECT_URLS;
+    return raw
+        .split(",")
+        .map((url) => url.trim())
+        .filter((url) => url.length > 0);
+}
+/** Auth config from the environment (what Papyrus's own backend uses today). */
+export function authConfigFromEnv() {
+    return {
+        redirectUrls: resolveAuthRedirectUrls(),
+        disableGoogleOAuth: process.env.PAPYRUS_DISABLE_GOOGLE_OAUTH === "1",
+        // Stable Cognito hosted-UI domain prefix for Google OAuth redirect URIs.
+        // See docs/google-oauth-setup.md.
+        cognitoDomainPrefix: (process.env.PAPYRUS_COGNITO_DOMAIN_PREFIX ?? "").trim(),
+    };
+}
+export function defineSiteAuth(config) {
+    const authRedirectUrls = config.redirectUrls ?? DEFAULT_AUTH_REDIRECT_URLS;
+    const disableGoogleOAuth = config.disableGoogleOAuth === true;
+    const cognitoDomainPrefix = (config.cognitoDomainPrefix ?? "").trim();
+    return defineAuth({
+        loginWith: {
+            email: true,
+            ...(disableGoogleOAuth
+                ? {}
+                : {
+                    externalProviders: {
+                        google: {
+                            clientId: secret("GOOGLE_CLIENT_ID"),
+                            clientSecret: secret("GOOGLE_CLIENT_SECRET"),
+                            scopes: ["email", "profile", "openid"],
+                        },
+                        scopes: ["EMAIL", "PROFILE", "OPENID"],
+                        callbackUrls: authRedirectUrls,
+                        logoutUrls: authRedirectUrls,
+                        ...(cognitoDomainPrefix ? { domainPrefix: cognitoDomainPrefix } : {}),
+                    },
+                }),
+        },
+        groups: ["admin", "editor", "curator"],
+        access: (allow) => [
+            allow.resource(manageUserRole).to(["addUserToGroup", "removeUserFromGroup", "listUsers", "listGroupsForUser"]),
+        ],
+    });
+}

package/amplify/auth/resource.ts

@@ -0,0 +1,65 @@
+import { defineAuth, secret } from "@aws-amplify/backend";
+import { manageUserRole } from "../functions/manage-user-role/resource";
+import type { PapyrusAuthConfig } from "../site-backend-config";
+
+// Default OAuth redirect URLs for the p.apyr.us app. Other publications pass
+// `auth.redirectUrls` to `defineSiteBackend` (or, for Papyrus's own backend,
+// the PAPYRUS_OAUTH_REDIRECT_URLS branch env var, comma-separated).
+// See docs/google-oauth-setup.md.
+const DEFAULT_AUTH_REDIRECT_URLS = [
+  "http://localhost:3001/",
+  "http://localhost:3000/",
+  "https://p.apyr.us/",
+  "https://main.dbsyytcm9drqa.amplifyapp.com/",
+  "https://codex-rehydration-api-split.dbsyytcm9drqa.amplifyapp.com/",
+];
+
+function resolveAuthRedirectUrls(): string[] {
+  const raw = (process.env.PAPYRUS_OAUTH_REDIRECT_URLS ?? "").trim();
+  if (!raw) return DEFAULT_AUTH_REDIRECT_URLS;
+  return raw
+    .split(",")
+    .map((url) => url.trim())
+    .filter((url) => url.length > 0);
+}
+
+/** Auth config from the environment (what Papyrus's own backend uses today). */
+export function authConfigFromEnv(): PapyrusAuthConfig {
+  return {
+    redirectUrls: resolveAuthRedirectUrls(),
+    disableGoogleOAuth: process.env.PAPYRUS_DISABLE_GOOGLE_OAUTH === "1",
+    // Stable Cognito hosted-UI domain prefix for Google OAuth redirect URIs.
+    // See docs/google-oauth-setup.md.
+    cognitoDomainPrefix: (process.env.PAPYRUS_COGNITO_DOMAIN_PREFIX ?? "").trim(),
+  };
+}
+
+export function defineSiteAuth(config: PapyrusAuthConfig) {
+  const authRedirectUrls = config.redirectUrls ?? DEFAULT_AUTH_REDIRECT_URLS;
+  const disableGoogleOAuth = config.disableGoogleOAuth === true;
+  const cognitoDomainPrefix = (config.cognitoDomainPrefix ?? "").trim();
+  return defineAuth({
+    loginWith: {
+      email: true,
+      ...(disableGoogleOAuth
+        ? {}
+        : {
+            externalProviders: {
+              google: {
+                clientId: secret("GOOGLE_CLIENT_ID"),
+                clientSecret: secret("GOOGLE_CLIENT_SECRET"),
+                scopes: ["email", "profile", "openid"],
+              },
+              scopes: ["EMAIL", "PROFILE", "OPENID"],
+              callbackUrls: authRedirectUrls,
+              logoutUrls: authRedirectUrls,
+              ...(cognitoDomainPrefix ? { domainPrefix: cognitoDomainPrefix } : {}),
+            },
+          }),
+    },
+    groups: ["admin", "editor", "curator"],
+    access: (allow) => [
+      allow.resource(manageUserRole).to(["addUserToGroup", "removeUserFromGroup", "listUsers", "listGroupsForUser"]),
+    ],
+  });
+}