@anthusai/papyrus 1.0.0-next.11 → 1.0.0-next.13

package/app/page.tsx

@@ -15,7 +15,8 @@ import {
 } from "../lib/public-placeholder-config";
 import type { PublicationItem } from "../lib/publication-items";
 import { SITE_BRAND, rootRoute } from "../lib/site-brand";
-import { redirect } from "next/navigation";
+import { notFound, redirect } from "next/navigation";
+import { buildRootRedirectTarget } from "../lib/root-route-redirect";
 import NewsDeskRootPage, { type NewsDeskRootSearchParams } from "./newsroom/page";
 
 export const dynamic = "force-dynamic";
@@ -41,8 +42,12 @@ export default async function Home({ searchParams }: HomePageProps) {
     return <NewsDeskRootPage searchParams={searchParams} />;
   }
 
-  if (rootRoute.kind === "redirect" && !scenarioId && !hasOAuthRedirectParams(resolvedSearchParams)) {
-    redirect(rootRoute.destination);
+  if (rootRoute.kind === "redirect") {
+    redirect(buildRootRedirectTarget(rootRoute.destination, resolvedSearchParams));
+  }
+
+  if (SITE_BRAND.renderer.kind === "markus") {
+    notFound();
   }
 
   // Resolved only on the reader path: Markus brands (renderer "markus") have

package/infra/amplify-app-shell.js

@@ -19,7 +19,11 @@ function environmentVariables(variables) {
  *     URL is used), IAM service and compute roles
  *   - `cms.staging: false` omits the staging branch and its domain
  *
- * The stack also creates the `<siteId>-papyrus-authoring` role. The CLI signs
+ * Google sign-in is always on: the branches never set PAPYRUS_DISABLE_GOOGLE_OAUTH,
+and `cms.cognitoDomainPrefix` becomes the stable hosted-UI domain
+(PAPYRUS_COGNITO_DOMAIN_PREFIX). The secrets GOOGLE_CLIENT_ID and
+GOOGLE_CLIENT_SECRET are Amplify backend secrets set in the console, never here.
+The stack also creates the `<siteId>-papyrus-authoring` role. The CLI signs
  * AppSync requests (SigV4) with credentials for that role (SSO, OIDC or any
  * principal in the account that may assume it); no token is stored anywhere.
  *
@@ -83,6 +87,7 @@ export class AmplifyAppShellStack extends Stack {
             enablePerformanceMode: false,
             environmentVariables: environmentVariables({
                 ...config.cms.environment,
+                PAPYRUS_COGNITO_DOMAIN_PREFIX: config.cms.cognitoDomainPrefix,
                 PAPYRUS_OAUTH_REDIRECT_URLS: oauthRedirectUrls,
                 PAPYRUS_SITE_BRAND: config.brand,
                 SITE_ENV: "production",
@@ -99,6 +104,7 @@ export class AmplifyAppShellStack extends Stack {
                 buildSpec: cmsStagingBuildSpec(config),
                 environmentVariables: environmentVariables({
                     ...config.cms.environment,
+                    PAPYRUS_COGNITO_DOMAIN_PREFIX: config.cms.cognitoDomainPrefix,
                     PAPYRUS_OAUTH_REDIRECT_URLS: oauthRedirectUrls,
                     PAPYRUS_SITE_BRAND: config.brand,
                     SITE_ENV: "staging",

package/infra/amplify-app-shell.ts

@@ -22,7 +22,11 @@ function environmentVariables(variables: Record<string, string>): amplify.CfnBra
  *     URL is used), IAM service and compute roles
  *   - `cms.staging: false` omits the staging branch and its domain
  *
- * The stack also creates the `<siteId>-papyrus-authoring` role. The CLI signs
+ * Google sign-in is always on: the branches never set PAPYRUS_DISABLE_GOOGLE_OAUTH,
+and `cms.cognitoDomainPrefix` becomes the stable hosted-UI domain
+(PAPYRUS_COGNITO_DOMAIN_PREFIX). The secrets GOOGLE_CLIENT_ID and
+GOOGLE_CLIENT_SECRET are Amplify backend secrets set in the console, never here.
+The stack also creates the `<siteId>-papyrus-authoring` role. The CLI signs
  * AppSync requests (SigV4) with credentials for that role (SSO, OIDC or any
  * principal in the account that may assume it); no token is stored anywhere.
  *
@@ -94,6 +98,7 @@ export class AmplifyAppShellStack extends Stack {
       enablePerformanceMode: false,
       environmentVariables: environmentVariables({
         ...config.cms.environment,
+        PAPYRUS_COGNITO_DOMAIN_PREFIX: config.cms.cognitoDomainPrefix,
         PAPYRUS_OAUTH_REDIRECT_URLS: oauthRedirectUrls,
         PAPYRUS_SITE_BRAND: config.brand,
         SITE_ENV: "production",
@@ -111,6 +116,7 @@ export class AmplifyAppShellStack extends Stack {
         buildSpec: cmsStagingBuildSpec(config),
         environmentVariables: environmentVariables({
           ...config.cms.environment,
+          PAPYRUS_COGNITO_DOMAIN_PREFIX: config.cms.cognitoDomainPrefix,
           PAPYRUS_OAUTH_REDIRECT_URLS: oauthRedirectUrls,
           PAPYRUS_SITE_BRAND: config.brand,
           SITE_ENV: "staging",

package/infra/site-config.js

@@ -9,6 +9,9 @@ const BRANCH_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9/_.-]*$/;
 const PAPYRUS_VERSION_PATTERN = /^\d+\.\d+\.\d+(-[0-9A-Za-z-]+\.\d+)?$/;
 const GITHUB_OWNER_PATTERN = /^[A-Za-z0-9](?:[A-Za-z0-9]|-(?=[A-Za-z0-9])){0,38}$/;
 const GITHUB_REPO_PATTERN = /^[A-Za-z0-9_.-]+$/;
+const COGNITO_DOMAIN_PREFIX_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+const COGNITO_RESERVED_WORDS = ["aws", "amazon", "cognito"];
+const TEMPLATE_MANAGED_ENVIRONMENT_KEYS = ["PAPYRUS_COGNITO_DOMAIN_PREFIX", "PAPYRUS_DISABLE_GOOGLE_OAUTH"];
 const LOCAL_DEVELOPMENT_ORIGIN = "http://localhost:3001/";
 function fail(field, problem) {
     throw new Error(`site.json: ${field} ${problem}`);
@@ -81,7 +84,7 @@ export function parseSiteConfig(raw) {
     const papyrusVersion = requireString(record.papyrusVersion, "papyrusVersion", PAPYRUS_VERSION_PATTERN, "exact version such as 1.0.0 or 1.0.0-next.1");
     const storagePreviewPrefix = optionalString(record.storagePreviewPrefix, "storagePreviewPrefix", /^[A-Za-z0-9._-]+\/$/, "must end with /");
     const cmsRecord = requireObject(record.cms, "cms");
-    rejectUnknownKeys(cmsRecord, ["appName", "domainName", "staging", "buildComputeType", "environment", "stagingDomainName"], "cms");
+    rejectUnknownKeys(cmsRecord, ["appName", "domainName", "staging", "cognitoDomainPrefix", "buildComputeType", "environment", "stagingDomainName"], "cms");
     const buildComputeType = cmsRecord.buildComputeType;
     if (buildComputeType !== undefined && buildComputeType !== "STANDARD" && buildComputeType !== "STANDARD_8GB") {
         fail("cms.buildComputeType", `must be "STANDARD" or "STANDARD_8GB", got ${JSON.stringify(buildComputeType)}`);
@@ -93,10 +96,20 @@ export function parseSiteConfig(raw) {
         appName: optionalString(cmsRecord.appName, "cms.appName", APP_NAME_PATTERN),
         domainName: optionalString(cmsRecord.domainName, "cms.domainName", HOST_NAME_PATTERN, "host name"),
         staging: cmsRecord.staging,
+        cognitoDomainPrefix: requireString(cmsRecord.cognitoDomainPrefix, "cms.cognitoDomainPrefix", COGNITO_DOMAIN_PREFIX_PATTERN, "lowercase letters, digits and hyphens; globally unique per region"),
         buildComputeType: buildComputeType,
         environment: requireStringRecord(cmsRecord.environment, "cms.environment"),
         stagingDomainName: optionalString(cmsRecord.stagingDomainName, "cms.stagingDomainName", HOST_NAME_PATTERN, "host name"),
     };
+    const reservedWord = COGNITO_RESERVED_WORDS.find((word) => cms.cognitoDomainPrefix.includes(word));
+    if (reservedWord) {
+        fail("cms.cognitoDomainPrefix", `must not contain "${reservedWord}" (Cognito reserves it): ${JSON.stringify(cms.cognitoDomainPrefix)}`);
+    }
+    for (const key of TEMPLATE_MANAGED_ENVIRONMENT_KEYS) {
+        if (key in cms.environment) {
+            fail(`cms.environment.${key}`, "is managed by the template: Google sign-in is always on and the Cognito domain comes from cms.cognitoDomainPrefix");
+        }
+    }
     if (cms.staging === false && cms.stagingDomainName) {
         fail("cms.stagingDomainName", "must not be set when cms.staging is false");
     }

package/infra/site-config.ts

@@ -9,6 +9,7 @@ export type AmplifyAppShellSiteConfig = {
     appName?: string;
     domainName?: string;
     staging?: boolean;
+    cognitoDomainPrefix: string;
     buildComputeType?: "STANDARD" | "STANDARD_8GB";
     environment: Record<string, string>;
     stagingDomainName?: string;
@@ -43,6 +44,9 @@ const BRANCH_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9/_.-]*$/;
 const PAPYRUS_VERSION_PATTERN = /^\d+\.\d+\.\d+(-[0-9A-Za-z-]+\.\d+)?$/;
 const GITHUB_OWNER_PATTERN = /^[A-Za-z0-9](?:[A-Za-z0-9]|-(?=[A-Za-z0-9])){0,38}$/;
 const GITHUB_REPO_PATTERN = /^[A-Za-z0-9_.-]+$/;
+const COGNITO_DOMAIN_PREFIX_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+const COGNITO_RESERVED_WORDS = ["aws", "amazon", "cognito"];
+const TEMPLATE_MANAGED_ENVIRONMENT_KEYS = ["PAPYRUS_COGNITO_DOMAIN_PREFIX", "PAPYRUS_DISABLE_GOOGLE_OAUTH"];
 const LOCAL_DEVELOPMENT_ORIGIN = "http://localhost:3001/";
 
 function fail(field: string, problem: string): never {
@@ -127,7 +131,7 @@ export function parseSiteConfig(raw: unknown): AmplifyAppShellSiteConfig {
   const storagePreviewPrefix = optionalString(record.storagePreviewPrefix, "storagePreviewPrefix", /^[A-Za-z0-9._-]+\/$/, "must end with /");
 
   const cmsRecord = requireObject(record.cms, "cms");
-  rejectUnknownKeys(cmsRecord, ["appName", "domainName", "staging", "buildComputeType", "environment", "stagingDomainName"], "cms");
+  rejectUnknownKeys(cmsRecord, ["appName", "domainName", "staging", "cognitoDomainPrefix", "buildComputeType", "environment", "stagingDomainName"], "cms");
   const buildComputeType = cmsRecord.buildComputeType;
   if (buildComputeType !== undefined && buildComputeType !== "STANDARD" && buildComputeType !== "STANDARD_8GB") {
     fail("cms.buildComputeType", `must be "STANDARD" or "STANDARD_8GB", got ${JSON.stringify(buildComputeType)}`);
@@ -139,11 +143,27 @@ export function parseSiteConfig(raw: unknown): AmplifyAppShellSiteConfig {
     appName: optionalString(cmsRecord.appName, "cms.appName", APP_NAME_PATTERN),
     domainName: optionalString(cmsRecord.domainName, "cms.domainName", HOST_NAME_PATTERN, "host name"),
     staging: cmsRecord.staging as boolean | undefined,
+    cognitoDomainPrefix: requireString(
+      cmsRecord.cognitoDomainPrefix,
+      "cms.cognitoDomainPrefix",
+      COGNITO_DOMAIN_PREFIX_PATTERN,
+      "lowercase letters, digits and hyphens; globally unique per region",
+    ),
     buildComputeType: buildComputeType as "STANDARD" | "STANDARD_8GB" | undefined,
     environment: requireStringRecord(cmsRecord.environment, "cms.environment"),
     stagingDomainName: optionalString(cmsRecord.stagingDomainName, "cms.stagingDomainName", HOST_NAME_PATTERN, "host name"),
   };
 
+  const reservedWord = COGNITO_RESERVED_WORDS.find((word) => cms.cognitoDomainPrefix.includes(word));
+  if (reservedWord) {
+    fail("cms.cognitoDomainPrefix", `must not contain "${reservedWord}" (Cognito reserves it): ${JSON.stringify(cms.cognitoDomainPrefix)}`);
+  }
+  for (const key of TEMPLATE_MANAGED_ENVIRONMENT_KEYS) {
+    if (key in cms.environment) {
+      fail(`cms.environment.${key}`, "is managed by the template: Google sign-in is always on and the Cognito domain comes from cms.cognitoDomainPrefix");
+    }
+  }
+
   if (cms.staging === false && cms.stagingDomainName) {
     fail("cms.stagingDomainName", "must not be set when cms.staging is false");
   }

package/lib/root-route-redirect.ts

@@ -0,0 +1,16 @@
+export type RootSearchParams = Record<string, string | string[] | undefined>;
+
+export function buildRootRedirectTarget(destination: string, searchParams: RootSearchParams | undefined): string {
+  const query = new URLSearchParams();
+  for (const [name, value] of Object.entries(searchParams ?? {})) {
+    if (Array.isArray(value)) {
+      for (const entry of value) query.append(name, entry);
+    } else if (value !== undefined) {
+      query.append(name, value);
+    }
+  }
+  const serialized = query.toString();
+  if (!serialized) return destination;
+  const separator = destination.includes("?") ? "&" : "?";
+  return `${destination}${separator}${serialized}`;
+}

package/package.json

@@ -189,6 +189,7 @@
     "./lib/renderer-config": "./lib/renderer-config.ts",
     "./lib/renderer": "./lib/renderer.ts",
     "./lib/reporting-story-budget": "./lib/reporting-story-budget.ts",
+    "./lib/root-route-redirect": "./lib/root-route-redirect.ts",
     "./lib/semantic-graph": "./lib/semantic-graph.ts",
     "./lib/site-brand-tenant": "./lib/site-brand-tenant.ts",
     "./lib/site-brand": "./lib/site-brand.ts",
@@ -276,7 +277,7 @@
       "optional": true
     }
   },
-  "version": "1.0.0-next.11",
+  "version": "1.0.0-next.13",
   "dependencies": {
     "@aws-amplify/adapter-nextjs": "^1.7.3",
     "@aws-sdk/client-cognito-identity-provider": "3.1045.0",

package/routes.manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.0.0-next.11",
+  "version": "1.0.0-next.13",
   "routes": [
     {
       "file": "app/%5F_preview/[[...path]]/route.ts",