@anthusai/papyrus 1.0.0-next.2 → 1.0.0-next.20

package/amplify/auth/resource.js

@@ -1,5 +1,6 @@
 import { defineAuth, secret } from "@aws-amplify/backend";
 import { manageUserRole } from "../functions/manage-user-role/resource.js";
+import { CfnUserPoolDomain } from "aws-cdk-lib/aws-cognito";
 // Default OAuth redirect URLs for the p.apyr.us app. Other publications pass
 // `auth.redirectUrls` to `defineSiteBackend` (or, for Papyrus's own backend,
 // the PAPYRUS_OAUTH_REDIRECT_URLS branch env var, comma-separated).
@@ -25,15 +26,13 @@ export function authConfigFromEnv() {
     return {
         redirectUrls: resolveAuthRedirectUrls(),
         disableGoogleOAuth: process.env.PAPYRUS_DISABLE_GOOGLE_OAUTH === "1",
-        // Stable Cognito hosted-UI domain prefix for Google OAuth redirect URIs.
-        // See docs/google-oauth-setup.md.
         cognitoDomainPrefix: (process.env.PAPYRUS_COGNITO_DOMAIN_PREFIX ?? "").trim(),
+        applyCognitoDomainPrefix: process.env.PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX === "true",
     };
 }
 export function defineSiteAuth(config) {
     const authRedirectUrls = config.redirectUrls ?? DEFAULT_AUTH_REDIRECT_URLS;
     const disableGoogleOAuth = config.disableGoogleOAuth === true;
-    const cognitoDomainPrefix = (config.cognitoDomainPrefix ?? "").trim();
     return defineAuth({
         loginWith: {
             email: true,
@@ -49,7 +48,6 @@ export function defineSiteAuth(config) {
                         scopes: ["EMAIL", "PROFILE", "OPENID"],
                         callbackUrls: authRedirectUrls,
                         logoutUrls: authRedirectUrls,
-                        ...(cognitoDomainPrefix ? { domainPrefix: cognitoDomainPrefix } : {}),
                     },
                 }),
         },
@@ -59,3 +57,18 @@ export function defineSiteAuth(config) {
         ],
     });
 }
+// Amplify Gen2's auth factory overwrites `externalProviders.domainPrefix` with a
+// hash of the backend id, so the prefix cannot be passed through `defineAuth`.
+// This sets the user pool domain on the synthesized resource instead. Cognito
+// cannot rename a pool domain in place: CloudFormation replaces the domain,
+// which changes the hosted-UI URL and the Google redirect URI. Callers must
+// only use it when the site opted in (see docs/google-oauth-setup.md).
+export function applyCognitoDomainPrefix(authStack, cognitoDomainPrefix) {
+    const domainResources = authStack.node
+        .findAll()
+        .filter((construct) => construct instanceof CfnUserPoolDomain);
+    if (domainResources.length !== 1) {
+        throw new Error(`Expected exactly one Cognito user pool domain in the auth stack to apply cognitoDomainPrefix, found ${domainResources.length}`);
+    }
+    domainResources[0].domain = cognitoDomainPrefix;
+}

package/amplify/auth/resource.ts

@@ -1,5 +1,7 @@
 import { defineAuth, secret } from "@aws-amplify/backend";
 import { manageUserRole } from "../functions/manage-user-role/resource";
+import { Stack } from "aws-cdk-lib";
+import { CfnUserPoolDomain } from "aws-cdk-lib/aws-cognito";
 import type { PapyrusAuthConfig } from "../site-backend-config";
 
 // Default OAuth redirect URLs for the p.apyr.us app. Other publications pass
@@ -28,16 +30,14 @@ export function authConfigFromEnv(): PapyrusAuthConfig {
   return {
     redirectUrls: resolveAuthRedirectUrls(),
     disableGoogleOAuth: process.env.PAPYRUS_DISABLE_GOOGLE_OAUTH === "1",
-    // Stable Cognito hosted-UI domain prefix for Google OAuth redirect URIs.
-    // See docs/google-oauth-setup.md.
     cognitoDomainPrefix: (process.env.PAPYRUS_COGNITO_DOMAIN_PREFIX ?? "").trim(),
+    applyCognitoDomainPrefix: process.env.PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX === "true",
   };
 }
 
 export function defineSiteAuth(config: PapyrusAuthConfig) {
   const authRedirectUrls = config.redirectUrls ?? DEFAULT_AUTH_REDIRECT_URLS;
   const disableGoogleOAuth = config.disableGoogleOAuth === true;
-  const cognitoDomainPrefix = (config.cognitoDomainPrefix ?? "").trim();
   return defineAuth({
     loginWith: {
       email: true,
@@ -53,7 +53,6 @@ export function defineSiteAuth(config: PapyrusAuthConfig) {
               scopes: ["EMAIL", "PROFILE", "OPENID"],
               callbackUrls: authRedirectUrls,
               logoutUrls: authRedirectUrls,
-              ...(cognitoDomainPrefix ? { domainPrefix: cognitoDomainPrefix } : {}),
             },
           }),
     },
@@ -63,3 +62,21 @@ export function defineSiteAuth(config: PapyrusAuthConfig) {
     ],
   });
 }
+
+// Amplify Gen2's auth factory overwrites `externalProviders.domainPrefix` with a
+// hash of the backend id, so the prefix cannot be passed through `defineAuth`.
+// This sets the user pool domain on the synthesized resource instead. Cognito
+// cannot rename a pool domain in place: CloudFormation replaces the domain,
+// which changes the hosted-UI URL and the Google redirect URI. Callers must
+// only use it when the site opted in (see docs/google-oauth-setup.md).
+export function applyCognitoDomainPrefix(authStack: Stack, cognitoDomainPrefix: string): void {
+  const domainResources = authStack.node
+    .findAll()
+    .filter((construct): construct is CfnUserPoolDomain => construct instanceof CfnUserPoolDomain);
+  if (domainResources.length !== 1) {
+    throw new Error(
+      `Expected exactly one Cognito user pool domain in the auth stack to apply cognitoDomainPrefix, found ${domainResources.length}`,
+    );
+  }
+  domainResources[0].domain = cognitoDomainPrefix;
+}

package/amplify/data/resource.js

@@ -1,7 +1,7 @@
 import { a, defineData } from "@aws-amplify/backend";
 import { assignmentAction } from "../functions/assignment-action/resource.js";
 import { categoryAction } from "../functions/category-action/resource.js";
-import { graphqlJwtAuthorizer } from "../functions/graphql-jwt-authorizer/resource.js";
+import { contentActions } from "../functions/content-actions/resource.js";
 import { knowledgeQuery } from "../functions/knowledge-query/resource.js";
 import { manageUserRole } from "../functions/manage-user-role/resource.js";
 import { modelAttachmentUpload } from "../functions/model-attachment-upload/resource.js";
@@ -43,7 +43,6 @@ const schema = a.schema({
         .authorization((allow) => [
         allow.owner(),
         allow.group(adminGroup),
-        allow.custom().to(["read"]),
     ]),
     UserIdentity: a
         .model({
@@ -63,7 +62,6 @@ const schema = a.schema({
     ])
         .authorization((allow) => [
         allow.group(adminGroup),
-        allow.custom().to(["read"]),
     ]),
     UserRoleAssignment: a
         .model({
@@ -293,7 +291,6 @@ const schema = a.schema({
         .returns(a.ref("ReferenceCurationActionResult"))
         .authorization((allow) => [
         allow.groups(categoryWriteGroups),
-        allow.custom(),
     ])
         .handler(a.handler.function(categoryAction)),
     setReferenceQualityRating: a
@@ -308,7 +305,6 @@ const schema = a.schema({
         .returns(a.ref("ReferenceQualityActionResult"))
         .authorization((allow) => [
         allow.groups(categoryWriteGroups),
-        allow.custom(),
     ])
         .handler(a.handler.function(categoryAction)),
     createReferenceInsight: a
@@ -323,7 +319,6 @@ const schema = a.schema({
         .returns(a.ref("ReferenceInsightActionResult"))
         .authorization((allow) => [
         allow.groups(categoryWriteGroups),
-        allow.custom(),
     ])
         .handler(a.handler.function(categoryAction)),
     moveReferenceCorpus: a
@@ -338,7 +333,6 @@ const schema = a.schema({
         .returns(a.ref("ReferenceCorpusMoveActionResult"))
         .authorization((allow) => [
         allow.groups(categoryWriteGroups),
-        allow.custom(),
     ])
         .handler(a.handler.function(categoryAction)),
     startReferenceCuration: a
@@ -352,7 +346,6 @@ const schema = a.schema({
         .returns(a.ref("ReferenceCurationStartResult"))
         .authorization((allow) => [
         allow.groups(categoryWriteGroups),
-        allow.custom(),
     ])
         .handler(a.handler.function(categoryAction)),
     getReferenceCurationStatus: a
@@ -363,7 +356,6 @@ const schema = a.schema({
         .returns(a.ref("ReferenceCurationStatusResult"))
         .authorization((allow) => [
         allow.groups(categoryWriteGroups),
-        allow.custom(),
     ])
         .handler(a.handler.function(categoryAction)),
     createCategorySetDraft: a
@@ -466,15 +458,45 @@ const schema = a.schema({
     getNewsroomSummary: a
         .query()
         .returns(a.ref("NewsroomSummary"))
-        .authorization((allow) => [allow.groups(categoryWriteGroups), allow.custom()])
+        .authorization((allow) => [allow.groups(categoryWriteGroups)])
         .handler(a.handler.function(newsroomSummary)),
+    deriveMarkus: a
+        .query()
+        .arguments({ input: a.json().required() })
+        .returns(a.json())
+        .authorization((allow) => [allow.groups(contentWriteGroups)])
+        .handler(a.handler.function(contentActions)),
+    saveItemDraft: a
+        .mutation()
+        .arguments({ input: a.json().required() })
+        .returns(a.json())
+        .authorization((allow) => [allow.groups(contentWriteGroups)])
+        .handler(a.handler.function(contentActions)),
+    publishItem: a
+        .mutation()
+        .arguments({ input: a.json().required() })
+        .returns(a.json())
+        .authorization((allow) => [allow.groups(contentWriteGroups)])
+        .handler(a.handler.function(contentActions)),
+    unpublishItem: a
+        .mutation()
+        .arguments({ input: a.json().required() })
+        .returns(a.json())
+        .authorization((allow) => [allow.groups(contentWriteGroups)])
+        .handler(a.handler.function(contentActions)),
+    requestStagingBuild: a
+        .mutation()
+        .arguments({ input: a.json().required() })
+        .returns(a.json())
+        .authorization((allow) => [allow.groups(contentWriteGroups)])
+        .handler(a.handler.function(contentActions)),
     knowledgeQuery: a
         .query()
         .arguments({
         input: a.json().required(),
     })
         .returns(a.json())
-        .authorization((allow) => [allow.groups(categoryWriteGroups), allow.custom()])
+        .authorization((allow) => [allow.groups(categoryWriteGroups)])
         .handler(a.handler.function(knowledgeQuery)),
     updateNewsroomSummary: a
         .mutation()
@@ -484,7 +506,7 @@ const schema = a.schema({
         reason: a.string(),
     })
         .returns(a.ref("NewsroomSummary"))
-        .authorization((allow) => [allow.groups(categoryWriteGroups), allow.custom()])
+        .authorization((allow) => [allow.groups(categoryWriteGroups)])
         .handler(a.handler.function(newsroomSummary)),
     ModelAttachmentUploadSlot: a.customType({
         ok: a.boolean().required(),
@@ -540,7 +562,7 @@ const schema = a.schema({
         status: a.string(),
     })
         .returns(a.ref("ModelAttachmentUploadSlot"))
-        .authorization((allow) => [allow.groups(categoryWriteGroups), allow.custom()])
+        .authorization((allow) => [allow.groups(categoryWriteGroups)])
         .handler(a.handler.function(modelAttachmentUpload)),
     completeModelAttachmentUpload: a
         .mutation()
@@ -561,7 +583,7 @@ const schema = a.schema({
         status: a.string(),
     })
         .returns(a.ref("ModelAttachment"))
-        .authorization((allow) => [allow.groups(categoryWriteGroups), allow.custom()])
+        .authorization((allow) => [allow.groups(categoryWriteGroups)])
         .handler(a.handler.function(modelAttachmentUpload)),
     abortModelAttachmentUpload: a
         .mutation()
@@ -582,7 +604,7 @@ const schema = a.schema({
         status: a.string(),
     })
         .returns(a.ref("ModelAttachmentUploadAbortResult"))
-        .authorization((allow) => [allow.groups(categoryWriteGroups), allow.custom()])
+        .authorization((allow) => [allow.groups(categoryWriteGroups)])
         .handler(a.handler.function(modelAttachmentUpload)),
     createModelAttachmentDownload: a
         .mutation()
@@ -590,7 +612,7 @@ const schema = a.schema({
         attachmentId: a.id().required(),
     })
         .returns(a.ref("ModelAttachmentDownloadSlot"))
-        .authorization((allow) => [allow.groups(categoryWriteGroups), allow.custom()])
+        .authorization((allow) => [allow.groups(categoryWriteGroups)])
         .handler(a.handler.function(modelAttachmentUpload)),
     AssignmentActionResult: a.customType({
         ok: a.boolean().required(),
@@ -677,7 +699,7 @@ const schema = a.schema({
         limit: a.integer(),
     })
         .returns(a.ref("AssignmentContext").array().required())
-        .authorization((allow) => [allow.groups(categoryWriteGroups), allow.custom()])
+        .authorization((allow) => [allow.groups(categoryWriteGroups)])
         .handler(a.handler.function(assignmentAction)),
     listAssignmentQueue: a
         .query()
@@ -687,7 +709,7 @@ const schema = a.schema({
         limit: a.integer(),
     })
         .returns(a.ref("AssignmentContext").array().required())
-        .authorization((allow) => [allow.groups(categoryWriteGroups), allow.custom()])
+        .authorization((allow) => [allow.groups(categoryWriteGroups)])
         .handler(a.handler.function(assignmentAction)),
     getAssignmentContext: a
         .query()
@@ -695,7 +717,7 @@ const schema = a.schema({
         assignmentId: a.id().required(),
     })
         .returns(a.ref("AssignmentContext"))
-        .authorization((allow) => [allow.groups(categoryWriteGroups), allow.custom()])
+        .authorization((allow) => [allow.groups(categoryWriteGroups)])
         .handler(a.handler.function(assignmentAction)),
     claimAssignment: a
         .mutation()
@@ -711,7 +733,7 @@ const schema = a.schema({
         note: a.string(),
     })
         .returns(a.ref("AssignmentActionResult"))
-        .authorization((allow) => [allow.groups(categoryWriteGroups), allow.custom()])
+        .authorization((allow) => [allow.groups(categoryWriteGroups)])
         .handler(a.handler.function(assignmentAction)),
     releaseAssignment: a
         .mutation()
@@ -722,7 +744,7 @@ const schema = a.schema({
         note: a.string(),
     })
         .returns(a.ref("AssignmentActionResult"))
-        .authorization((allow) => [allow.groups(categoryWriteGroups), allow.custom()])
+        .authorization((allow) => [allow.groups(categoryWriteGroups)])
         .handler(a.handler.function(assignmentAction)),
     completeAssignment: a
         .mutation()
@@ -733,7 +755,7 @@ const schema = a.schema({
         note: a.string(),
     })
         .returns(a.ref("AssignmentActionResult"))
-        .authorization((allow) => [allow.groups(categoryWriteGroups), allow.custom()])
+        .authorization((allow) => [allow.groups(categoryWriteGroups)])
         .handler(a.handler.function(assignmentAction)),
     cancelAssignment: a
         .mutation()
@@ -744,7 +766,7 @@ const schema = a.schema({
         note: a.string(),
     })
         .returns(a.ref("AssignmentActionResult"))
-        .authorization((allow) => [allow.groups(categoryWriteGroups), allow.custom()])
+        .authorization((allow) => [allow.groups(categoryWriteGroups)])
         .handler(a.handler.function(assignmentAction)),
     reopenAssignment: a
         .mutation()
@@ -755,7 +777,7 @@ const schema = a.schema({
         note: a.string(),
     })
         .returns(a.ref("AssignmentActionResult"))
-        .authorization((allow) => [allow.groups(categoryWriteGroups), allow.custom()])
+        .authorization((allow) => [allow.groups(categoryWriteGroups)])
         .handler(a.handler.function(assignmentAction)),
     retryImmediateAssignment: a
         .mutation()
@@ -766,7 +788,7 @@ const schema = a.schema({
         note: a.string(),
     })
         .returns(a.ref("AssignmentActionResult"))
-        .authorization((allow) => [allow.groups(categoryWriteGroups), allow.custom()])
+        .authorization((allow) => [allow.groups(categoryWriteGroups)])
         .handler(a.handler.function(assignmentAction)),
     listNewsroomProcedureDefinitions: a
         .query()
@@ -780,7 +802,7 @@ const schema = a.schema({
         procedureKey: a.string(),
     })
         .returns(a.json())
-        .authorization((allow) => [allow.group(adminGroup), allow.custom()])
+        .authorization((allow) => [allow.group(adminGroup)])
         .handler(a.handler.function(procedureAction)),
     saveNewsroomProcedureDefinition: a
         .mutation()
@@ -818,7 +840,7 @@ const schema = a.schema({
         actorLabel: a.string(),
     })
         .returns(a.json())
-        .authorization((allow) => [allow.groups(categoryWriteGroups), allow.custom()])
+        .authorization((allow) => [allow.groups(categoryWriteGroups)])
         .handler(a.handler.function(procedureAction)),
     getNewsroomProcedureRun: a
         .query()
@@ -826,7 +848,7 @@ const schema = a.schema({
         id: a.id().required(),
     })
         .returns(a.json())
-        .authorization((allow) => [allow.groups(categoryWriteGroups), allow.custom()])
+        .authorization((allow) => [allow.groups(categoryWriteGroups)])
         .handler(a.handler.function(procedureAction)),
     listNewsroomProcedureRunsByProcedure: a
         .query()
@@ -834,7 +856,7 @@ const schema = a.schema({
         procedureId: a.id().required(),
     })
         .returns(a.json())
-        .authorization((allow) => [allow.groups(categoryWriteGroups), allow.custom()])
+        .authorization((allow) => [allow.groups(categoryWriteGroups)])
         .handler(a.handler.function(procedureAction)),
     Assignment: a
         .model({
@@ -884,7 +906,6 @@ const schema = a.schema({
         .authorization((allow) => [
         allow.groups(categoryWriteGroups).to(categoryAppendOnlyOperations),
         allow.authenticated("identityPool").to(authoringOperations),
-        allow.custom().to(authoringOperations),
     ]),
     AssignmentEvent: a
         .model({
@@ -907,7 +928,6 @@ const schema = a.schema({
     ])
         .authorization((allow) => [
         allow.groups(categoryWriteGroups).to(categoryAppendOnlyOperations),
-        allow.custom().to(authoringOperations),
     ]),
     ProcedureDefinition: a
         .model({
@@ -932,7 +952,6 @@ const schema = a.schema({
     ])
         .authorization((allow) => [
         allow.group(adminGroup),
-        allow.custom().to(authoringOperations),
     ]),
     ProcedureVersion: a
         .model({
@@ -959,7 +978,6 @@ const schema = a.schema({
     ])
         .authorization((allow) => [
         allow.group(adminGroup),
-        allow.custom().to(authoringOperations),
     ]),
     ProcedureRun: a
         .model({
@@ -992,7 +1010,6 @@ const schema = a.schema({
         .authorization((allow) => [
         allow.group("editor").to(["read"]),
         allow.group(adminGroup).to(authoringOperations),
-        allow.custom().to(authoringOperations),
     ]),
     NewsroomSection: a
         .model({
@@ -1020,7 +1037,6 @@ const schema = a.schema({
     ])
         .authorization((allow) => [
         allow.groups(categoryWriteGroups),
-        allow.custom().to(authoringOperations),
     ]),
     KnowledgeCorpus: a
         .model({
@@ -1038,7 +1054,6 @@ const schema = a.schema({
     ])
         .authorization((allow) => [
         allow.groups(categoryWriteGroups).to(["read"]),
-        allow.custom().to(authoringOperations),
     ]),
     KnowledgeImportRun: a
         .model({
@@ -1066,7 +1081,6 @@ const schema = a.schema({
     ])
         .authorization((allow) => [
         allow.groups(categoryWriteGroups).to(["read"]),
-        allow.custom().to(authoringOperations),
     ]),
     KnowledgeRawPayload: a
         .model({
@@ -1084,7 +1098,6 @@ const schema = a.schema({
     ])
         .authorization((allow) => [
         allow.groups(categoryWriteGroups),
-        allow.custom().to(authoringOperations),
     ]),
     KnowledgeArtifact: a
         .model({
@@ -1104,7 +1117,6 @@ const schema = a.schema({
     ])
         .authorization((allow) => [
         allow.groups(categoryWriteGroups).to(["read"]),
-        allow.custom().to(authoringOperations),
     ]),
     CategorySet: a
         .model({
@@ -1134,7 +1146,6 @@ const schema = a.schema({
     ])
         .authorization((allow) => [
         allow.groups(categoryWriteGroups),
-        allow.custom().to(authoringOperations),
     ]),
     Category: a
         .model({
@@ -1176,7 +1187,6 @@ const schema = a.schema({
     ])
         .authorization((allow) => [
         allow.groups(categoryWriteGroups),
-        allow.custom().to(authoringOperations),
     ]),
     CategoryKeyword: a
         .model({
@@ -1205,7 +1215,6 @@ const schema = a.schema({
     ])
         .authorization((allow) => [
         allow.groups(categoryWriteGroups),
-        allow.custom().to(authoringOperations),
     ]),
     LexicalSteeringRule: a
         .model({
@@ -1234,7 +1243,6 @@ const schema = a.schema({
     ])
         .authorization((allow) => [
         allow.groups(categoryWriteGroups),
-        allow.custom().to(authoringOperations),
     ]),
     SteeringProposal: a
         .model({
@@ -1272,7 +1280,6 @@ const schema = a.schema({
     ])
         .authorization((allow) => [
         allow.groups(categoryWriteGroups).to(["read"]),
-        allow.custom().to(authoringOperations),
     ]),
     SteeringDecision: a
         .model({
@@ -1292,7 +1299,6 @@ const schema = a.schema({
     ])
         .authorization((allow) => [
         allow.groups(categoryWriteGroups).to(categoryAppendOnlyOperations),
-        allow.custom().to(authoringOperations),
     ]),
     Reference: a
         .model({
@@ -1344,7 +1350,6 @@ const schema = a.schema({
     ])
         .authorization((allow) => [
         allow.groups(categoryWriteGroups).to(["read"]),
-        allow.custom().to(authoringOperations),
     ]),
     ReferenceAttachment: a
         .model({
@@ -1374,7 +1379,6 @@ const schema = a.schema({
     ])
         .authorization((allow) => [
         allow.groups(categoryWriteGroups).to(["read"]),
-        allow.custom().to(authoringOperations),
     ]),
     SemanticNode: a
         .model({
@@ -1417,7 +1421,6 @@ const schema = a.schema({
     ])
         .authorization((allow) => [
         allow.groups(categoryWriteGroups).to(["read"]),
-        allow.custom().to(authoringOperations),
     ]),
     Message: a
         .model({
@@ -1466,7 +1469,6 @@ const schema = a.schema({
     ])
         .authorization((allow) => [
         allow.groups(categoryWriteGroups).to(categoryAppendOnlyOperations),
-        allow.custom().to(authoringOperations),
         allow.authenticated("identityPool").to(["read", "create", "update"]),
     ]),
     MessageThread: a
@@ -1505,7 +1507,6 @@ const schema = a.schema({
         .authorization((allow) => [
         allow.groups(categoryWriteGroups).to(["read", "create", "update"]),
         allow.authenticated("identityPool").to(authoringOperations),
-        allow.custom().to(authoringOperations),
     ]),
     ModelAttachment: a
         .model({
@@ -1537,7 +1538,6 @@ const schema = a.schema({
     ])
         .authorization((allow) => [
         allow.groups(categoryWriteGroups).to(["read"]),
-        allow.custom().to(authoringOperations),
     ]),
     SemanticRelationType: a
         .model({
@@ -1565,7 +1565,6 @@ const schema = a.schema({
     ])
         .authorization((allow) => [
         allow.groups(categoryWriteGroups),
-        allow.custom().to(authoringOperations),
     ]),
     SemanticRelation: a
         .model({
@@ -1616,7 +1615,6 @@ const schema = a.schema({
     ])
         .authorization((allow) => [
         allow.groups(categoryWriteGroups).to(categoryAppendOnlyOperations),
-        allow.custom().to(authoringOperations),
     ]),
     Item: a
         .model({
@@ -1666,7 +1664,6 @@ const schema = a.schema({
     ])
         .authorization((allow) => [
         allow.groups(contentWriteGroups),
-        allow.custom().to(authoringOperations),
     ]),
     Tag: a
         .model({
@@ -1683,7 +1680,6 @@ const schema = a.schema({
     ])
         .authorization((allow) => [
         allow.groups(contentWriteGroups),
-        allow.custom().to(authoringOperations),
     ]),
     ItemTag: a
         .model({
@@ -1703,7 +1699,6 @@ const schema = a.schema({
     ])
         .authorization((allow) => [
         allow.groups(contentWriteGroups),
-        allow.custom().to(authoringOperations),
     ]),
     MediaAsset: a
         .model({
@@ -1736,7 +1731,6 @@ const schema = a.schema({
     ])
         .authorization((allow) => [
         allow.groups(contentWriteGroups),
-        allow.custom().to(authoringOperations),
     ]),
     Edition: a
         .model({
@@ -1769,7 +1763,6 @@ const schema = a.schema({
     ])
         .authorization((allow) => [
         allow.groups(contentWriteGroups),
-        allow.custom().to(authoringOperations),
     ]),
     EditionSlot: a
         .model({
@@ -1795,7 +1788,6 @@ const schema = a.schema({
     ])
         .authorization((allow) => [
         allow.groups(categoryWriteGroups).to(categoryAppendOnlyOperations),
-        allow.custom().to(authoringOperations),
     ]),
     EditionItem: a
         .model({
@@ -1818,7 +1810,6 @@ const schema = a.schema({
     ])
         .authorization((allow) => [
         allow.groups(contentWriteGroups),
-        allow.custom().to(authoringOperations),
     ]),
     PublishedItem: a
         .model({
@@ -1859,7 +1850,6 @@ const schema = a.schema({
         .authorization((allow) => [
         allow.guest().to(["read"]),
         allow.groups(contentWriteGroups),
-        allow.custom().to(authoringOperations),
     ]),
     PublishedMediaAsset: a
         .model({
@@ -1895,7 +1885,6 @@ const schema = a.schema({
         .authorization((allow) => [
         allow.guest().to(["read"]),
         allow.groups(contentWriteGroups),
-        allow.custom().to(authoringOperations),
     ]),
     PublishedEdition: a
         .model({
@@ -1921,7 +1910,6 @@ const schema = a.schema({
         .authorization((allow) => [
         allow.guest().to(["read"]),
         allow.groups(contentWriteGroups),
-        allow.custom().to(authoringOperations),
     ]),
     PublishedEditionItem: a
         .model({
@@ -1946,7 +1934,6 @@ const schema = a.schema({
         .authorization((allow) => [
         allow.guest().to(["read"]),
         allow.groups(contentWriteGroups),
-        allow.custom().to(authoringOperations),
     ]),
     PublishedCategorySet: a
         .model({
@@ -1972,7 +1959,6 @@ const schema = a.schema({
         .authorization((allow) => [
         allow.guest().to(["read"]),
         allow.groups(contentWriteGroups),
-        allow.custom().to(authoringOperations),
     ]),
     PublishedCategory: a
         .model({
@@ -2008,10 +1994,10 @@ const schema = a.schema({
         .authorization((allow) => [
         allow.guest().to(["read"]),
         allow.groups(contentWriteGroups),
-        allow.custom().to(authoringOperations),
     ]),
 }).authorization((allow) => [
     allow.resource(categoryAction),
+    allow.resource(contentActions),
     allow.resource(manageUserRole),
     allow.resource(modelAttachmentUpload),
     allow.resource(newsroomSummary),
@@ -2029,9 +2015,5 @@ export const data = defineData({
         apiKeyAuthorizationMode: {
             expiresInDays: 365,
         },
-        lambdaAuthorizationMode: {
-            function: graphqlJwtAuthorizer,
-            timeToLiveInSeconds: 300,
-        },
     },
 });