@anthusai/papyrus 0.0.0 → 1.0.0-next.1

package/amplify/functions/email-submission-processor/handler.py

@@ -0,0 +1,46 @@
+from __future__ import annotations
+
+import json
+import os
+from typing import Any
+
+
+def handler(event: dict[str, Any], _context: Any = None) -> dict[str, Any]:
+    if isinstance(event.get("Records"), list):
+        record = event["Records"][0]
+        body = record.get("body") if isinstance(record, dict) else None
+        if isinstance(body, str):
+            event = json.loads(body)
+        elif isinstance(body, dict):
+            event = body
+
+    message_id = str(event.get("messageId") or event.get("message_id") or "").strip()
+    if not message_id:
+        raise ValueError("messageId is required.")
+
+    if event.get("sendFeedbackOnly") or event.get("send_feedback_only"):
+        from papyrus_content.graphql_authoring import PapyrusGraphQLAuthoringClient
+        from papyrus_newsroom.email_submissions import send_submission_feedback_for_message
+
+        endpoint = os.environ.get("PAPYRUS_GRAPHQL_ENDPOINT", "").strip()
+        client = PapyrusGraphQLAuthoringClient(endpoint=endpoint or None)
+        return send_submission_feedback_for_message(client, message_id=message_id)
+
+    corpus_key = str(
+        event.get("corpusKey")
+        or event.get("corpus_key")
+        or os.environ.get("PAPYRUS_INBOUND_EMAIL_CORPUS_KEY")
+        or "AI-ML-research"
+    ).strip()
+
+    from papyrus_content.graphql_authoring import PapyrusGraphQLAuthoringClient
+    from papyrus_newsroom.email_submissions import process_email_submission_message
+
+    endpoint = os.environ.get("PAPYRUS_GRAPHQL_ENDPOINT", "").strip()
+    client = PapyrusGraphQLAuthoringClient(endpoint=endpoint or None)
+    return process_email_submission_message(
+        client,
+        message_id=message_id,
+        corpus_key=corpus_key,
+        apply=True,
+    )

package/amplify/functions/email-submission-processor/requirements.txt

@@ -0,0 +1,2 @@
+PyYAML>=6.0.2,<7
+requests>=2.32.3,<3

package/amplify/functions/email-submission-processor/resource.js

@@ -0,0 +1,56 @@
+import { defineFunction } from "@aws-amplify/backend";
+import { Duration } from "aws-cdk-lib";
+import { Architecture, Function, Runtime } from "aws-cdk-lib/aws-lambda";
+import { execSync } from "node:child_process";
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { pythonLambdaCode } from "../shared/python-bundle.js";
+const dirname = path.dirname(fileURLToPath(import.meta.url));
+const projectRoot = path.resolve(dirname, "../../..");
+function copyCheckoutCorpora(outputDir) {
+    const corporaDir = path.join(outputDir, "corpora");
+    fs.mkdirSync(corporaDir, { recursive: true });
+    for (const entry of fs.readdirSync(path.join(projectRoot, "corpora"))) {
+        if (!entry.endsWith(".yml"))
+            continue;
+        fs.copyFileSync(path.join(projectRoot, "corpora", entry), path.join(corporaDir, entry));
+    }
+    installPythonRequirements(outputDir);
+}
+function installPythonRequirements(outputDir) {
+    const requirementsPath = path.join(projectRoot, "amplify/functions/email-submission-processor/requirements.txt");
+    execSync(`python3 -m pip install -r "${requirementsPath}" -t "${outputDir}" --no-cache-dir`, {
+        cwd: projectRoot,
+        stdio: "inherit",
+    });
+}
+export const emailSubmissionProcessor = defineFunction((scope) => {
+    return new Function(scope, "papyrus-email-submission-processor", {
+        runtime: Runtime.PYTHON_3_12,
+        architecture: Architecture.ARM_64,
+        handler: "handler.handler",
+        timeout: Duration.minutes(5),
+        memorySize: 1024,
+        code: pythonLambdaCode({
+            functionDir: "email-submission-processor",
+            modules: ["papyrus_newsroom", "papyrus_content", "papyrus_knowledge_query"],
+            requirements: ["PyYAML>=6.0.2,<7", "requests>=2.32.3,<3", "boto3>=1.34.0,<2.0.0"],
+            corpora: true,
+            checkoutExtras: copyCheckoutCorpora,
+        }, [
+            "bash",
+            "-c",
+            [
+                "set -euo pipefail",
+                "mkdir -p /asset-output/papyrus_newsroom /asset-output/papyrus_content /asset-output/papyrus_knowledge_query /asset-output/corpora",
+                "cp amplify/functions/email-submission-processor/handler.py /asset-output/handler.py",
+                "cp -R src/papyrus_newsroom/. /asset-output/papyrus_newsroom/",
+                "cp -R src/papyrus_content/. /asset-output/papyrus_content/",
+                "cp -R src/papyrus_knowledge_query/. /asset-output/papyrus_knowledge_query/",
+                "cp corpora/*.yml /asset-output/corpora/",
+                "python3 -m pip install -r amplify/functions/email-submission-processor/requirements.txt -t /asset-output --no-cache-dir",
+            ].join(" && "),
+        ]),
+    });
+}, { resourceGroupName: "data" });

package/amplify/functions/email-submission-processor/resource.ts

@@ -0,0 +1,69 @@
+import { defineFunction } from "@aws-amplify/backend";
+import { Duration } from "aws-cdk-lib";
+import { Architecture, Function, Runtime } from "aws-cdk-lib/aws-lambda";
+import { Construct } from "constructs";
+import { execSync } from "node:child_process";
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { pythonLambdaCode } from "../shared/python-bundle";
+
+const dirname = path.dirname(fileURLToPath(import.meta.url));
+const projectRoot = path.resolve(dirname, "../../..");
+
+function copyCheckoutCorpora(outputDir: string): void {
+  const corporaDir = path.join(outputDir, "corpora");
+  fs.mkdirSync(corporaDir, { recursive: true });
+  for (const entry of fs.readdirSync(path.join(projectRoot, "corpora"))) {
+    if (!entry.endsWith(".yml")) continue;
+    fs.copyFileSync(path.join(projectRoot, "corpora", entry), path.join(corporaDir, entry));
+  }
+  installPythonRequirements(outputDir);
+}
+
+function installPythonRequirements(outputDir: string): void {
+  const requirementsPath = path.join(
+    projectRoot,
+    "amplify/functions/email-submission-processor/requirements.txt",
+  );
+  execSync(`python3 -m pip install -r "${requirementsPath}" -t "${outputDir}" --no-cache-dir`, {
+    cwd: projectRoot,
+    stdio: "inherit",
+  });
+}
+
+export const emailSubmissionProcessor = defineFunction(
+  (scope: Construct) => {
+    return new Function(scope, "papyrus-email-submission-processor", {
+      runtime: Runtime.PYTHON_3_12,
+      architecture: Architecture.ARM_64,
+      handler: "handler.handler",
+      timeout: Duration.minutes(5),
+      memorySize: 1024,
+      code: pythonLambdaCode(
+        {
+          functionDir: "email-submission-processor",
+          modules: ["papyrus_newsroom", "papyrus_content", "papyrus_knowledge_query"],
+          requirements: ["PyYAML>=6.0.2,<7", "requests>=2.32.3,<3", "boto3>=1.34.0,<2.0.0"],
+          corpora: true,
+          checkoutExtras: copyCheckoutCorpora,
+        },
+        [
+          "bash",
+          "-c",
+          [
+            "set -euo pipefail",
+            "mkdir -p /asset-output/papyrus_newsroom /asset-output/papyrus_content /asset-output/papyrus_knowledge_query /asset-output/corpora",
+            "cp amplify/functions/email-submission-processor/handler.py /asset-output/handler.py",
+            "cp -R src/papyrus_newsroom/. /asset-output/papyrus_newsroom/",
+            "cp -R src/papyrus_content/. /asset-output/papyrus_content/",
+            "cp -R src/papyrus_knowledge_query/. /asset-output/papyrus_knowledge_query/",
+            "cp corpora/*.yml /asset-output/corpora/",
+            "python3 -m pip install -r amplify/functions/email-submission-processor/requirements.txt -t /asset-output --no-cache-dir",
+          ].join(" && "),
+        ],
+      ),
+    });
+  },
+  { resourceGroupName: "data" },
+);

package/amplify/functions/graphql-jwt-authorizer/handler.ts

@@ -0,0 +1,193 @@
+import { createHmac, timingSafeEqual } from "node:crypto";
+import { GetParameterCommand, SSMClient } from "@aws-sdk/client-ssm";
+
+type AppSyncAuthorizerEvent = {
+  authorizationToken?: string;
+};
+
+type JwtHeader = {
+  alg?: string;
+  typ?: string;
+};
+
+type JwtClaims = {
+  iss?: string;
+  sub?: string;
+  aud?: string | string[];
+  exp?: number;
+  nbf?: number;
+  iat?: number;
+  scope?: string;
+  scp?: string | string[];
+  groups?: string | string[];
+  roles?: string | string[];
+  [key: string]: unknown;
+};
+
+export const handler = async (event: AppSyncAuthorizerEvent) => {
+  try {
+    const token = normalizeAuthorizationToken(event.authorizationToken);
+    const jwtSecret = await getJwtSecret();
+    const claims = verifyHs256Jwt(token, jwtSecret);
+    assertExpectedIssuer(claims);
+    assertExpectedAudience(claims);
+    assertRequiredScope(claims);
+
+    return {
+      isAuthorized: true,
+      resolverContext: {
+        sub: claims.sub ?? "unknown",
+        iss: claims.iss ?? "unknown",
+        scope: getClaimValues(claims.scope).join(" "),
+      },
+      ttlOverride: 300,
+    };
+  } catch (error) {
+    console.warn(`JWT authorizer rejected request: ${(error as Error).message}`);
+    return {
+      isAuthorized: false,
+      ttlOverride: 0,
+    };
+  }
+};
+
+function normalizeAuthorizationToken(value: string | undefined): string {
+  const token = value
+    ?.replace(/^PapyrusJwt\s+/i, "")
+    .replace(/^papyrus-jwt:/i, "")
+    .replace(/^Bearer\s+/i, "")
+    .trim();
+  if (!token) throw new Error("Missing Authorization token.");
+  return token;
+}
+
+function verifyHs256Jwt(token: string, jwtSecret: string): JwtClaims {
+  const [encodedHeader, encodedPayload, encodedSignature] = token.split(".");
+  if (!encodedHeader || !encodedPayload || !encodedSignature) {
+    throw new Error("JWT must have header, payload, and signature.");
+  }
+
+  const header = decodeJson<JwtHeader>(encodedHeader);
+  if (header.alg !== "HS256") {
+    throw new Error(`Unsupported JWT alg ${header.alg ?? "unknown"}.`);
+  }
+
+  const claims = decodeJson<JwtClaims>(encodedPayload);
+  const expectedSignature = createHmac("sha256", jwtSecret)
+    .update(`${encodedHeader}.${encodedPayload}`)
+    .digest("base64url");
+
+  if (!constantTimeEqual(encodedSignature, expectedSignature)) {
+    throw new Error("JWT signature verification failed.");
+  }
+
+  const now = Math.floor(Date.now() / 1000);
+  if (typeof claims.exp === "number" && claims.exp <= now) {
+    throw new Error("JWT is expired.");
+  }
+  if (typeof claims.nbf === "number" && claims.nbf > now) {
+    throw new Error("JWT is not yet valid.");
+  }
+
+  return claims;
+}
+
+function decodeJson<T>(encoded: string): T {
+  try {
+    return JSON.parse(Buffer.from(encoded, "base64url").toString("utf8")) as T;
+  } catch {
+    throw new Error("JWT contains invalid base64url JSON.");
+  }
+}
+
+let cachedJwtSecret: string | null = null;
+let ssmClient: SSMClient | null = null;
+
+async function getJwtSecret(): Promise<string> {
+  if (cachedJwtSecret) return cachedJwtSecret;
+
+  const directSecret = normalizeOptionalString(process.env.PAPYRUS_JWT_SECRET);
+  if (directSecret && !isAmplifySecretPlaceholder(directSecret)) {
+    cachedJwtSecret = directSecret;
+    return directSecret;
+  }
+
+  const parameterName = resolveAmplifySsmSecretPath("PAPYRUS_JWT_SECRET");
+  if (!parameterName) throw new Error("PAPYRUS_JWT_SECRET is not configured.");
+  ssmClient ??= new SSMClient({});
+  const response = await ssmClient.send(new GetParameterCommand({
+    Name: parameterName,
+    WithDecryption: true,
+  }));
+  const secret = normalizeOptionalString(response.Parameter?.Value);
+  if (!secret) throw new Error(`SSM parameter ${parameterName} did not return a value.`);
+  cachedJwtSecret = secret;
+  return secret;
+}
+
+function isAmplifySecretPlaceholder(value: string): boolean {
+  return /^<.*will be resolved.*>$/i.test(value);
+}
+
+function resolveAmplifySsmSecretPath(name: string): string | null {
+  const rawConfig = normalizeOptionalString(process.env.AMPLIFY_SSM_ENV_CONFIG);
+  if (!rawConfig) return null;
+  try {
+    const config = JSON.parse(rawConfig) as Record<string, { path?: string; sharedPath?: string } | undefined>;
+    return normalizeOptionalString(config[name]?.path) ?? normalizeOptionalString(config[name]?.sharedPath);
+  } catch {
+    throw new Error("AMPLIFY_SSM_ENV_CONFIG contains invalid JSON.");
+  }
+}
+
+function normalizeOptionalString(value: unknown): string | null {
+  if (typeof value !== "string") return null;
+  const trimmed = value.trim();
+  return trimmed ? trimmed : null;
+}
+
+function assertExpectedIssuer(claims: JwtClaims): void {
+  const expectedIssuer = process.env.PAPYRUS_JWT_ISSUER;
+  if (expectedIssuer && claims.iss !== expectedIssuer) {
+    throw new Error("JWT issuer is not authorized.");
+  }
+}
+
+function assertExpectedAudience(claims: JwtClaims): void {
+  const expectedAudience = process.env.PAPYRUS_JWT_AUDIENCE;
+  if (!expectedAudience) return;
+
+  const audiences = Array.isArray(claims.aud) ? claims.aud : claims.aud ? [claims.aud] : [];
+  if (!audiences.includes(expectedAudience)) {
+    throw new Error("JWT audience is not authorized.");
+  }
+}
+
+function assertRequiredScope(claims: JwtClaims): void {
+  const requiredScope = process.env.PAPYRUS_JWT_REQUIRED_SCOPE;
+  if (!requiredScope) return;
+
+  const values = new Set([
+    ...getClaimValues(claims.scope),
+    ...getClaimValues(claims.scp),
+    ...getClaimValues(claims.groups),
+    ...getClaimValues(claims.roles),
+  ]);
+
+  if (!values.has(requiredScope)) {
+    throw new Error("JWT does not include the required authoring scope.");
+  }
+}
+
+function getClaimValues(value: unknown): string[] {
+  if (Array.isArray(value)) return value.flatMap(getClaimValues);
+  if (typeof value === "string") return value.split(/[,\s]+/).filter(Boolean);
+  return [];
+}
+
+function constantTimeEqual(left: string, right: string): boolean {
+  const leftBuffer = Buffer.from(left);
+  const rightBuffer = Buffer.from(right);
+  if (leftBuffer.length !== rightBuffer.length) return false;
+  return timingSafeEqual(leftBuffer, rightBuffer);
+}

package/amplify/functions/graphql-jwt-authorizer/resource.js

@@ -0,0 +1,14 @@
+import { defineFunction, secret } from "@aws-amplify/backend";
+export const graphqlJwtAuthorizer = defineFunction({
+    name: "papyrus-graphql-jwt-authorizer",
+    entry: "./handler.ts",
+    timeoutSeconds: 5,
+    memoryMB: 256,
+    resourceGroupName: "data",
+    environment: {
+        PAPYRUS_JWT_SECRET: secret("PAPYRUS_JWT_SECRET"),
+        PAPYRUS_JWT_ISSUER: "papyrus-cli",
+        PAPYRUS_JWT_AUDIENCE: "papyrus-authoring",
+        PAPYRUS_JWT_REQUIRED_SCOPE: "papyrus:write",
+    },
+});

package/amplify/functions/graphql-jwt-authorizer/resource.ts

@@ -0,0 +1,15 @@
+import { defineFunction, secret } from "@aws-amplify/backend";
+
+export const graphqlJwtAuthorizer = defineFunction({
+  name: "papyrus-graphql-jwt-authorizer",
+  entry: "./handler.ts",
+  timeoutSeconds: 5,
+  memoryMB: 256,
+  resourceGroupName: "data",
+  environment: {
+    PAPYRUS_JWT_SECRET: secret("PAPYRUS_JWT_SECRET"),
+    PAPYRUS_JWT_ISSUER: "papyrus-cli",
+    PAPYRUS_JWT_AUDIENCE: "papyrus-authoring",
+    PAPYRUS_JWT_REQUIRED_SCOPE: "papyrus:write",
+  },
+});

package/amplify/functions/knowledge-query/handler.py

@@ -0,0 +1 @@
+from papyrus_knowledge_query.lambda_handler import handler

package/amplify/functions/knowledge-query/requirements.txt

@@ -0,0 +1,3 @@
+# Intentionally empty for deploy stability in Amplify Hosting CI.
+# The knowledge-query engine falls back to regex token accounting when tiktoken
+# is unavailable.

package/amplify/functions/knowledge-query/resource.js

@@ -0,0 +1,50 @@
+import { defineFunction } from "@aws-amplify/backend";
+import { Duration } from "aws-cdk-lib";
+import { Architecture, Function, Runtime } from "aws-cdk-lib/aws-lambda";
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { isPackageMode, pythonLambdaCode } from "../shared/python-bundle.js";
+const dirname = path.dirname(fileURLToPath(import.meta.url));
+// Repo root in a checkout, package root when installed from npm.
+const projectRoot = path.resolve(dirname, "../../..");
+function storageBucketName() {
+    if (process.env.PAPYRUS_STORAGE_BUCKET_NAME)
+        return process.env.PAPYRUS_STORAGE_BUCKET_NAME;
+    // Publication repo root (cwd) in package mode; repo root in a checkout.
+    const outputsPath = path.join(isPackageMode() ? process.cwd() : projectRoot, "amplify_outputs.json");
+    if (!fs.existsSync(outputsPath))
+        return "";
+    try {
+        const outputs = JSON.parse(fs.readFileSync(outputsPath, "utf8"));
+        return outputs.storage?.bucket_name ?? "";
+    }
+    catch {
+        return "";
+    }
+}
+export const knowledgeQuery = defineFunction((scope) => {
+    return new Function(scope, "papyrus-knowledge-query", {
+        runtime: Runtime.PYTHON_3_12,
+        architecture: Architecture.ARM_64,
+        handler: "handler.handler",
+        timeout: Duration.seconds(300),
+        memorySize: 512,
+        environment: {
+            PAPYRUS_STORAGE_BUCKET_NAME: storageBucketName(),
+        },
+        code: pythonLambdaCode({
+            functionDir: "knowledge-query",
+            modules: ["papyrus_knowledge_query"],
+        }, [
+            "bash",
+            "-c",
+            [
+                "set -euo pipefail",
+                "mkdir -p /asset-output/papyrus_knowledge_query",
+                "cp amplify/functions/knowledge-query/handler.py /asset-output/handler.py",
+                "cp -R src/papyrus_knowledge_query/. /asset-output/papyrus_knowledge_query/",
+            ].join(" && "),
+        ]),
+    });
+}, { resourceGroupName: "data" });

package/amplify/functions/knowledge-query/resource.ts

@@ -0,0 +1,61 @@
+import { defineFunction } from "@aws-amplify/backend";
+import { Duration } from "aws-cdk-lib";
+import { Architecture, Function, Runtime } from "aws-cdk-lib/aws-lambda";
+import { Construct } from "constructs";
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { isPackageMode, pythonLambdaCode } from "../shared/python-bundle";
+
+const dirname = path.dirname(fileURLToPath(import.meta.url));
+// Repo root in a checkout, package root when installed from npm.
+const projectRoot = path.resolve(dirname, "../../..");
+
+function storageBucketName(): string {
+  if (process.env.PAPYRUS_STORAGE_BUCKET_NAME) return process.env.PAPYRUS_STORAGE_BUCKET_NAME;
+
+  // Publication repo root (cwd) in package mode; repo root in a checkout.
+  const outputsPath = path.join(isPackageMode() ? process.cwd() : projectRoot, "amplify_outputs.json");
+  if (!fs.existsSync(outputsPath)) return "";
+
+  try {
+    const outputs = JSON.parse(fs.readFileSync(outputsPath, "utf8")) as {
+      storage?: { bucket_name?: string };
+    };
+    return outputs.storage?.bucket_name ?? "";
+  } catch {
+    return "";
+  }
+}
+
+export const knowledgeQuery = defineFunction(
+  (scope: Construct) => {
+    return new Function(scope, "papyrus-knowledge-query", {
+      runtime: Runtime.PYTHON_3_12,
+      architecture: Architecture.ARM_64,
+      handler: "handler.handler",
+      timeout: Duration.seconds(300),
+      memorySize: 512,
+      environment: {
+        PAPYRUS_STORAGE_BUCKET_NAME: storageBucketName(),
+      },
+      code: pythonLambdaCode(
+        {
+          functionDir: "knowledge-query",
+          modules: ["papyrus_knowledge_query"],
+        },
+        [
+          "bash",
+          "-c",
+          [
+            "set -euo pipefail",
+            "mkdir -p /asset-output/papyrus_knowledge_query",
+            "cp amplify/functions/knowledge-query/handler.py /asset-output/handler.py",
+            "cp -R src/papyrus_knowledge_query/. /asset-output/papyrus_knowledge_query/",
+          ].join(" && "),
+        ],
+      ),
+    });
+  },
+  { resourceGroupName: "data" },
+);