@anthusai/papyrus 1.0.0-next.28 → 1.0.0-next.29

package/lib/staging-preview-object.ts

@@ -8,6 +8,7 @@ export const PREVIEW_KEY_PREFIX = "preview/";
 
 const PRESIGN_SECONDS = 60;
 const NOT_FOUND_ERROR_NAMES = ["NotFound", "NoSuchKey"];
+const FORBIDDEN_ERROR_NAMES = ["Forbidden", "AccessDenied"];
 const PREVIEW_EXCLUDED_PREFIXES = ["/newsroom", "/api", "/_next", PREVIEW_ROUTE_PREFIX];
 
 export function isStaticPreviewEnabled(environment: Record<string, string | undefined> = process.env): boolean {
@@ -32,13 +33,14 @@ export function previewCandidateKeys(requestPath: string): string[] | null {
   return [base, `${base}.html`, `${base}/index.html`];
 }
 
-export function shouldRewriteToPreview(pathname: string): boolean {
+export function shouldRewriteToPreview(pathname: string, newsroomAtRoot: boolean = false): boolean {
   if (pathname === "/favicon.ico" || pathname === "/robots.txt" || pathname.startsWith("/icon")) return false;
-  return !PREVIEW_EXCLUDED_PREFIXES.some((prefix) => pathname === prefix || pathname.startsWith(`${prefix}/`));
+  if (PREVIEW_EXCLUDED_PREFIXES.some((prefix) => pathname === prefix || pathname.startsWith(`${prefix}/`))) return false;
+  return !newsroomAtRoot || pathname.endsWith(".html");
 }
 
-export function isPreviewGatedPath(pathname: string): boolean {
-  return shouldRewriteToPreview(pathname) || pathname === PREVIEW_ROUTE_PREFIX || pathname.startsWith(`${PREVIEW_ROUTE_PREFIX}/`);
+export function isPreviewGatedPath(pathname: string, newsroomAtRoot: boolean = false): boolean {
+  return shouldRewriteToPreview(pathname, newsroomAtRoot) || pathname === PREVIEW_ROUTE_PREFIX || pathname.startsWith(`${PREVIEW_ROUTE_PREFIX}/`);
 }
 
 export function previewRewritePathname(pathname: string): string {
@@ -54,6 +56,12 @@ function isNotFoundError(error: unknown): boolean {
   return NOT_FOUND_ERROR_NAMES.includes(name);
 }
 
+function isForbiddenError(error: unknown): boolean {
+  const candidate = error as { name?: string; $metadata?: { httpStatusCode?: number }; metadata?: { httpStatusCode?: number } } | null;
+  const status = candidate?.$metadata?.httpStatusCode ?? candidate?.metadata?.httpStatusCode;
+  return status === 403 || FORBIDDEN_ERROR_NAMES.includes(candidate?.name ?? "");
+}
+
 async function presignFirstExistingKey(candidateKeys: string[]): Promise<URL | null> {
   const { runWithAmplifyServerContext } = getAmplifyServerRuntime();
   return runWithAmplifyServerContext({
@@ -83,7 +91,15 @@ export async function streamPreviewObject(pathname: string): Promise<Response> {
   if (!isStaticPreviewEnabled()) return notFound();
   const candidateKeys = previewCandidateKeys(previewRequestPath(pathname));
   if (!candidateKeys) return notFound();
-  const presigned = await presignFirstExistingKey(candidateKeys);
+  let presigned: URL | null;
+  try {
+    presigned = await presignFirstExistingKey(candidateKeys);
+  } catch (error) {
+    if (isForbiddenError(error)) {
+      return new Response("Staging preview is limited to editors and admins.", { status: 403, headers: { "Cache-Control": "private, no-store" } });
+    }
+    throw error;
+  }
   if (!presigned) return notFound();
   const upstream = await fetch(presigned);
   if (!upstream.ok || !upstream.body) return notFound();

package/middleware.ts

@@ -23,7 +23,7 @@ function isStagingGatedPathForBrand(pathname: string): boolean {
 }
 
 function routeRequest(request: NextRequest): NextResponse {
-  if (isStaticPreviewEnabled() && shouldRewriteToPreview(request.nextUrl.pathname)) {
+  if (isStaticPreviewEnabled() && shouldRewriteToPreview(request.nextUrl.pathname, usesNewsroomRootPaths())) {
     const rewriteUrl = request.nextUrl.clone();
     rewriteUrl.pathname = previewRewritePathname(request.nextUrl.pathname);
     return NextResponse.rewrite(rewriteUrl);
@@ -61,8 +61,8 @@ function routeRequest(request: NextRequest): NextResponse {
 export async function middleware(request: NextRequest): Promise<NextResponse> {
   let sessionResponse: NextResponse | null = null;
   const { pathname } = request.nextUrl;
-  const gated = isStaticPreviewEnabled() && !usesNewsroomRootPaths()
-    ? isPreviewGatedPath(pathname)
+  const gated = isStaticPreviewEnabled()
+    ? isPreviewGatedPath(pathname, usesNewsroomRootPaths())
     : isStagingGatedPathForBrand(pathname);
   if (getSiteEnv() === "staging" && gated) {
     sessionResponse = NextResponse.next();

package/package.json

@@ -294,7 +294,7 @@
       "optional": true
     }
   },
-  "version": "1.0.0-next.28",
+  "version": "1.0.0-next.29",
   "dependencies": {
     "@aws-amplify/adapter-nextjs": "^1.7.3",
     "@aws-sdk/client-cognito-identity-provider": "3.1045.0",

package/routes.manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.0.0-next.28",
+  "version": "1.0.0-next.29",
   "routes": [
     {
       "file": "app/%5F_preview/[[...path]]/route.ts",