@anthusai/papyrus 1.0.0-next.33 → 1.0.0-next.34

package/amplify/auth/redirect-urls.js

@@ -0,0 +1,54 @@
+export const DEFAULT_NEWSROOM_BASE_PATH = "/newsroom";
+function parseRedirectUrl(value) {
+    try {
+        const parsed = new URL(value);
+        return { original: value, origin: parsed.origin, path: parsed.pathname.replace(/\/+$/, "") };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Expands every origin in an OAuth redirect list to both the newsroom return
+ * path and the site root, newsroom first. Amplify signs in with the first
+ * entry that matches the current origin, so a list that names only
+ * `https://host/` would land a signed-in editor on the public reader.
+ *
+ * With `newsroomBasePath` of `""` (a CMS-only host that mounts the newsroom at
+ * `/`), the root already is the newsroom and nothing is added. Explicit
+ * entries are kept; unparseable entries pass through unchanged.
+ */
+export function expandNewsroomRedirectUrls(redirectUrls, newsroomBasePath = DEFAULT_NEWSROOM_BASE_PATH) {
+    const newsroomPath = newsroomBasePath.replace(/\/+$/, "");
+    const originOrder = [];
+    const explicitByOrigin = new Map();
+    const passthrough = [];
+    for (const value of redirectUrls) {
+        const parsed = parseRedirectUrl(value);
+        if (!parsed) {
+            passthrough.push(value);
+            continue;
+        }
+        if (!explicitByOrigin.has(parsed.origin)) {
+            originOrder.push(parsed.origin);
+            explicitByOrigin.set(parsed.origin, []);
+        }
+        explicitByOrigin.get(parsed.origin)?.push(value);
+    }
+    const expanded = [];
+    for (const origin of originOrder) {
+        const explicit = explicitByOrigin.get(origin) ?? [];
+        if (newsroomPath === "") {
+            expanded.push(...explicit);
+            continue;
+        }
+        const newsroomEntries = explicit.filter((value) => parseRedirectUrl(value)?.path === newsroomPath);
+        const otherEntries = explicit.filter((value) => {
+            const path = parseRedirectUrl(value)?.path;
+            return path !== newsroomPath && path !== "";
+        });
+        expanded.push(...(newsroomEntries.length > 0 ? newsroomEntries : [`${origin}${newsroomPath}`]), `${origin}/`, ...otherEntries);
+    }
+    expanded.push(...passthrough);
+    return [...new Set(expanded)];
+}

package/amplify/auth/redirect-urls.ts

@@ -0,0 +1,66 @@
+export const DEFAULT_NEWSROOM_BASE_PATH = "/newsroom";
+
+type ParsedRedirectUrl = { original: string; origin: string; path: string } | null;
+
+function parseRedirectUrl(value: string): ParsedRedirectUrl {
+  try {
+    const parsed = new URL(value);
+    return { original: value, origin: parsed.origin, path: parsed.pathname.replace(/\/+$/, "") };
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Expands every origin in an OAuth redirect list to both the newsroom return
+ * path and the site root, newsroom first. Amplify signs in with the first
+ * entry that matches the current origin, so a list that names only
+ * `https://host/` would land a signed-in editor on the public reader.
+ *
+ * With `newsroomBasePath` of `""` (a CMS-only host that mounts the newsroom at
+ * `/`), the root already is the newsroom and nothing is added. Explicit
+ * entries are kept; unparseable entries pass through unchanged.
+ */
+export function expandNewsroomRedirectUrls(
+  redirectUrls: readonly string[],
+  newsroomBasePath: string = DEFAULT_NEWSROOM_BASE_PATH,
+): string[] {
+  const newsroomPath = newsroomBasePath.replace(/\/+$/, "");
+  const originOrder: string[] = [];
+  const explicitByOrigin = new Map<string, string[]>();
+  const passthrough: string[] = [];
+
+  for (const value of redirectUrls) {
+    const parsed = parseRedirectUrl(value);
+    if (!parsed) {
+      passthrough.push(value);
+      continue;
+    }
+    if (!explicitByOrigin.has(parsed.origin)) {
+      originOrder.push(parsed.origin);
+      explicitByOrigin.set(parsed.origin, []);
+    }
+    explicitByOrigin.get(parsed.origin)?.push(value);
+  }
+
+  const expanded: string[] = [];
+  for (const origin of originOrder) {
+    const explicit = explicitByOrigin.get(origin) ?? [];
+    if (newsroomPath === "") {
+      expanded.push(...explicit);
+      continue;
+    }
+    const newsroomEntries = explicit.filter((value) => parseRedirectUrl(value)?.path === newsroomPath);
+    const otherEntries = explicit.filter((value) => {
+      const path = parseRedirectUrl(value)?.path;
+      return path !== newsroomPath && path !== "";
+    });
+    expanded.push(
+      ...(newsroomEntries.length > 0 ? newsroomEntries : [`${origin}${newsroomPath}`]),
+      `${origin}/`,
+      ...otherEntries,
+    );
+  }
+  expanded.push(...passthrough);
+  return [...new Set(expanded)];
+}

package/amplify/auth/resource.js

@@ -1,9 +1,11 @@
 import { defineAuth, secret } from "@aws-amplify/backend";
 import { manageUserRole } from "../functions/manage-user-role/resource.js";
 import { CfnUserPoolDomain } from "aws-cdk-lib/aws-cognito";
+import { expandNewsroomRedirectUrls } from "./redirect-urls.js";
 // Default OAuth redirect URLs for the p.apyr.us app. Other publications pass
 // `auth.redirectUrls` to `defineSiteBackend` (or, for Papyrus's own backend,
 // the PAPYRUS_OAUTH_REDIRECT_URLS branch env var, comma-separated).
+// `defineSiteAuth` adds the newsroom and root variants of every origin listed.
 // See docs/google-oauth-setup.md.
 const DEFAULT_AUTH_REDIRECT_URLS = [
     "http://localhost:3001/",
@@ -31,7 +33,7 @@ export function authConfigFromEnv() {
     };
 }
 export function defineSiteAuth(config) {
-    const authRedirectUrls = config.redirectUrls ?? DEFAULT_AUTH_REDIRECT_URLS;
+    const authRedirectUrls = expandNewsroomRedirectUrls(config.redirectUrls ?? DEFAULT_AUTH_REDIRECT_URLS, config.newsroomBasePath);
     const disableGoogleOAuth = config.disableGoogleOAuth === true;
     return defineAuth({
         loginWith: {

package/amplify/auth/resource.ts

@@ -3,10 +3,12 @@ import { manageUserRole } from "../functions/manage-user-role/resource";
 import { Stack } from "aws-cdk-lib";
 import { CfnUserPoolDomain } from "aws-cdk-lib/aws-cognito";
 import type { PapyrusAuthConfig } from "../site-backend-config";
+import { expandNewsroomRedirectUrls } from "./redirect-urls";
 
 // Default OAuth redirect URLs for the p.apyr.us app. Other publications pass
 // `auth.redirectUrls` to `defineSiteBackend` (or, for Papyrus's own backend,
 // the PAPYRUS_OAUTH_REDIRECT_URLS branch env var, comma-separated).
+// `defineSiteAuth` adds the newsroom and root variants of every origin listed.
 // See docs/google-oauth-setup.md.
 const DEFAULT_AUTH_REDIRECT_URLS = [
   "http://localhost:3001/",
@@ -36,7 +38,10 @@ export function authConfigFromEnv(): PapyrusAuthConfig {
 }
 
 export function defineSiteAuth(config: PapyrusAuthConfig) {
-  const authRedirectUrls = config.redirectUrls ?? DEFAULT_AUTH_REDIRECT_URLS;
+  const authRedirectUrls = expandNewsroomRedirectUrls(
+    config.redirectUrls ?? DEFAULT_AUTH_REDIRECT_URLS,
+    config.newsroomBasePath,
+  );
   const disableGoogleOAuth = config.disableGoogleOAuth === true;
   return defineAuth({
     loginWith: {

package/amplify/site-backend-config.ts

@@ -7,6 +7,12 @@ export type PapyrusAuthConfig = {
   /** OAuth callback/logout URLs for Google sign-in (ignored when Google is disabled). */
   redirectUrls?: string[];
   disableGoogleOAuth?: boolean;
+  /**
+   * Public newsroom path prefix for sign-in return URLs. Default `/newsroom`;
+   * `""` on a CMS-only host where the newsroom is the root. Filled from the
+   * active brand's `newsroomBasePath` by `defineSiteBackend` when unset.
+   */
+  newsroomBasePath?: string;
   /** Desired Cognito hosted-UI domain prefix. Only applied when `applyCognitoDomainPrefix` is true. */
   cognitoDomainPrefix?: string;
   /**

package/amplify/site-backend.js

@@ -54,7 +54,12 @@ export function defineSiteBackend(papyrusSite) {
     const enableInboundEmail = featureFlags.inboundEmail;
     const enableSlackAgent = featureFlags.slack;
     const enableStorageBackups = featureFlags.storageBackups;
-    const authConfig = site.auth ?? authConfigFromEnv();
+    const baseAuthConfig = site.auth ?? authConfigFromEnv();
+    const activeBrand = (papyrusSite.brands ?? []).find((brand) => brand.id.toLowerCase() === siteBackendIdentity.brandId);
+    const authConfig = {
+        ...baseAuthConfig,
+        newsroomBasePath: baseAuthConfig.newsroomBasePath ?? activeBrand?.newsroomBasePath,
+    };
     const backend = defineBackend({
         assignmentAction,
         auth: defineSiteAuth(authConfig),

package/amplify/site-backend.ts

@@ -71,7 +71,12 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
   const enableSlackAgent = featureFlags.slack;
   const enableStorageBackups = featureFlags.storageBackups;
 
-  const authConfig = site.auth ?? authConfigFromEnv();
+  const baseAuthConfig = site.auth ?? authConfigFromEnv();
+  const activeBrand = (papyrusSite.brands ?? []).find((brand) => brand.id.toLowerCase() === siteBackendIdentity.brandId);
+  const authConfig = {
+    ...baseAuthConfig,
+    newsroomBasePath: baseAuthConfig.newsroomBasePath ?? activeBrand?.newsroomBasePath,
+  };
   const backend = defineBackend({
     assignmentAction,
     auth: defineSiteAuth(authConfig),

package/components/amplify-client-provider.tsx

@@ -8,6 +8,8 @@ import { CookieStorage, Hub } from "aws-amplify/utils";
 import { useEffect } from "react";
 import { assertSandboxAmplifyOutputsForDev } from "../lib/amplify-outputs-guard";
 import amplifyOutputs from "papyrus-amplify-outputs";
+import { getPublicNewsroomBasePath } from "../lib/newsroom-base-path";
+import { prioritizeRedirectUrlsForOrigin } from "../lib/oauth-redirect-priority";
 
 let configured = false;
 
@@ -72,14 +74,10 @@ function prioritizeCurrentOrigin(config: ResourcesConfig): ResourcesConfig {
   const auth = (config as { auth?: { oauth?: Record<string, unknown> } }).auth;
   const oauth = auth?.oauth;
   if (!auth || !oauth) return config;
-  const origin = normalizeUrlOrigin(window.location.origin);
   const reorder = (urls: unknown) => {
     if (!Array.isArray(urls)) return urls;
-    const normalized = urls.filter((value): value is string => typeof value === "string");
-    const head = normalized.filter((value) => normalizeUrlOrigin(value) === origin);
-    if (!head.length) return normalized;
-    const tail = normalized.filter((value) => normalizeUrlOrigin(value) !== origin);
-    return [...head, ...tail];
+    const strings = urls.filter((value): value is string => typeof value === "string");
+    return prioritizeRedirectUrlsForOrigin(strings, window.location.origin, getPublicNewsroomBasePath());
   };
   return {
     ...config,
@@ -111,22 +109,6 @@ function redirectLoopbackToLocalhost(): void {
   window.location.replace(target);
 }
 
-function normalizeUrlOrigin(value: string): string {
-  const trimmed = value.replace(/\/+$/, "");
-  try {
-    const parsed = new URL(trimmed);
-    const hostname = normalizeLoopbackHostname(parsed.hostname);
-    return `${parsed.protocol}//${hostname}${parsed.port ? `:${parsed.port}` : ""}`;
-  } catch {
-    return trimmed;
-  }
-}
-
-function normalizeLoopbackHostname(hostname: string): string {
-  if (hostname === "127.0.0.1" || hostname === "::1") return "localhost";
-  return hostname;
-}
-
 function extractAuthFailureDetail(error: unknown): string | null {
   if (!error) return null;
   if (typeof error === "string") return error;

package/infra/site-config.js

@@ -13,6 +13,14 @@ const GITHUB_REPO_PATTERN = /^[A-Za-z0-9_.-]+$/;
 const COGNITO_DOMAIN_PREFIX_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
 const COGNITO_RESERVED_WORDS = ["aws", "amazon", "cognito"];
 const TEMPLATE_MANAGED_ENVIRONMENT_KEYS = ["PAPYRUS_COGNITO_DOMAIN_PREFIX", "PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX", "PAPYRUS_DISABLE_GOOGLE_OAUTH", "PAPYRUS_REVALIDATE_SECRET_PARAMETER"];
+function originOfRedirectUrl(value) {
+    try {
+        return new URL(value).origin;
+    }
+    catch {
+        return value;
+    }
+}
 export function resolveRevalidateSecretParameterName(config) {
     return `/papyrus/${config.siteId}/revalidate-secret`;
 }
@@ -259,14 +267,15 @@ export function parseSiteConfig(raw) {
         fail("cms.environment.PAPYRUS_OAUTH_REDIRECT_URLS", "is required");
     const redirectUrls = redirectValue.split(",").map((url) => url.trim());
     const stagingDomainName = resolveStagingDomainName(config);
+    const listedOrigins = new Set(redirectUrls.map(originOfRedirectUrl));
     const requiredOrigins = [
-        ...(resolveCmsHostName(config) ? [`https://${resolveCmsHostName(config)}/`] : []),
-        ...(stagingDomainName ? [`https://${stagingDomainName}/`] : []),
-        LOCAL_DEVELOPMENT_ORIGIN,
+        ...(resolveCmsHostName(config) ? [`https://${resolveCmsHostName(config)}`] : []),
+        ...(stagingDomainName ? [`https://${stagingDomainName}`] : []),
+        originOfRedirectUrl(LOCAL_DEVELOPMENT_ORIGIN),
     ];
     for (const origin of requiredOrigins) {
-        if (!redirectUrls.includes(origin)) {
-            fail("cms.environment.PAPYRUS_OAUTH_REDIRECT_URLS", `must include ${origin}`);
+        if (!listedOrigins.has(origin)) {
+            fail("cms.environment.PAPYRUS_OAUTH_REDIRECT_URLS", `must include ${origin}/ (or just the origin: the backend also registers its newsroom path)`);
         }
     }
     return config;

package/infra/site-config.ts

@@ -57,6 +57,14 @@ const GITHUB_REPO_PATTERN = /^[A-Za-z0-9_.-]+$/;
 const COGNITO_DOMAIN_PREFIX_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
 const COGNITO_RESERVED_WORDS = ["aws", "amazon", "cognito"];
 const TEMPLATE_MANAGED_ENVIRONMENT_KEYS = ["PAPYRUS_COGNITO_DOMAIN_PREFIX", "PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX", "PAPYRUS_DISABLE_GOOGLE_OAUTH", "PAPYRUS_REVALIDATE_SECRET_PARAMETER"];
+function originOfRedirectUrl(value: string): string {
+  try {
+    return new URL(value).origin;
+  } catch {
+    return value;
+  }
+}
+
 export function resolveRevalidateSecretParameterName(config: Pick<AmplifyAppShellSiteConfig, "siteId">): string {
   return `/papyrus/${config.siteId}/revalidate-secret`;
 }
@@ -321,14 +329,15 @@ export function parseSiteConfig(raw: unknown): AmplifyAppShellSiteConfig {
   if (redirectValue === undefined) fail("cms.environment.PAPYRUS_OAUTH_REDIRECT_URLS", "is required");
   const redirectUrls = redirectValue.split(",").map((url) => url.trim());
   const stagingDomainName = resolveStagingDomainName(config);
+  const listedOrigins = new Set(redirectUrls.map(originOfRedirectUrl));
   const requiredOrigins = [
-    ...(resolveCmsHostName(config) ? [`https://${resolveCmsHostName(config)}/`] : []),
-    ...(stagingDomainName ? [`https://${stagingDomainName}/`] : []),
-    LOCAL_DEVELOPMENT_ORIGIN,
+    ...(resolveCmsHostName(config) ? [`https://${resolveCmsHostName(config)}`] : []),
+    ...(stagingDomainName ? [`https://${stagingDomainName}`] : []),
+    originOfRedirectUrl(LOCAL_DEVELOPMENT_ORIGIN),
   ];
   for (const origin of requiredOrigins) {
-    if (!redirectUrls.includes(origin)) {
-      fail("cms.environment.PAPYRUS_OAUTH_REDIRECT_URLS", `must include ${origin}`);
+    if (!listedOrigins.has(origin)) {
+      fail("cms.environment.PAPYRUS_OAUTH_REDIRECT_URLS", `must include ${origin}/ (or just the origin: the backend also registers its newsroom path)`);
     }
   }
 

package/lib/oauth-redirect-priority.ts

@@ -0,0 +1,40 @@
+function originOf(value: string): string {
+  const trimmed = value.replace(/\/+$/, "");
+  try {
+    const parsed = new URL(trimmed);
+    const hostname = parsed.hostname === "127.0.0.1" || parsed.hostname === "::1" ? "localhost" : parsed.hostname;
+    return `${parsed.protocol}//${hostname}${parsed.port ? `:${parsed.port}` : ""}`;
+  } catch {
+    return trimmed;
+  }
+}
+
+function pathOf(value: string): string | null {
+  try {
+    return new URL(value).pathname.replace(/\/+$/, "");
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Puts the redirect URLs of the current origin first; among those, the
+ * newsroom return path leads when the site has one, so Amplify (which signs in
+ * with the first entry) returns an editor to the newsroom.
+ */
+export function prioritizeRedirectUrlsForOrigin(
+  urls: readonly string[],
+  currentOrigin: string,
+  publicNewsroomBasePath: string,
+): string[] {
+  const origin = originOf(currentOrigin);
+  const newsroomPath = publicNewsroomBasePath.replace(/\/+$/, "");
+  const head = urls.filter((value) => originOf(value) === origin);
+  if (head.length === 0) return [...urls];
+  const tail = urls.filter((value) => originOf(value) !== origin);
+  const newsroomFirst =
+    newsroomPath === ""
+      ? head
+      : [...head.filter((value) => pathOf(value) === newsroomPath), ...head.filter((value) => pathOf(value) !== newsroomPath)];
+  return [...newsroomFirst, ...tail];
+}

package/package.json

@@ -186,6 +186,7 @@
     "./lib/newsroom-references": "./lib/newsroom-references.ts",
     "./lib/newsroom-sections": "./lib/newsroom-sections.ts",
     "./lib/newsroom-topics": "./lib/newsroom-topics.ts",
+    "./lib/oauth-redirect-priority": "./lib/oauth-redirect-priority.ts",
     "./lib/papyrus-object-kinds": "./lib/papyrus-object-kinds.ts",
     "./lib/papyrus-web-locations": "./lib/papyrus-web-locations.ts",
     "./lib/pilobol-sample": "./lib/pilobol-sample.ts",
@@ -299,7 +300,7 @@
       "optional": true
     }
   },
-  "version": "1.0.0-next.33",
+  "version": "1.0.0-next.34",
   "dependencies": {
     "@aws-amplify/adapter-nextjs": "^1.7.3",
     "@aws-sdk/client-cognito-identity-provider": "3.1045.0",

package/routes.manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.0.0-next.33",
+  "version": "1.0.0-next.34",
   "routes": [
     {
       "file": "app/%5F_preview/[[...path]]/route.ts",