@anthusai/papyrus 1.0.0-next.43 → 1.0.0-next.45

package/amplify/publication/renditions-settings.js

@@ -0,0 +1,43 @@
+/**
+ * Pure planning for the upload-time renditions function of an s3-projection
+ * site (no CDK imports, so it can be tested without synthesizing).
+ *
+ * The function exists only for a site whose `projection.json` carries an
+ * `images` section: that section is the one place the image pipeline settings
+ * live, shared by the renditions function and the projector.
+ */
+import fs from "node:fs";
+import path from "node:path";
+export const RENDITIONS_MEMORY_MB = 3008;
+export const RENDITIONS_TIMEOUT_SECONDS = 300;
+export const RENDITIONS_EPHEMERAL_STORAGE_MB = 2048;
+export const RENDITIONS_STATIC_DIRECTORY = "/var/task/site_static";
+export const RENDITIONS_MEDIA_PREFIX = "media/";
+export const RENDITIONS_FUNCTION_NAME_ENV = "PAPYRUS_RENDITIONS_FUNCTION_NAME";
+export function projectionSettingsHaveImages(settingsPath) {
+    if (!fs.existsSync(settingsPath))
+        return false;
+    const parsed = JSON.parse(fs.readFileSync(settingsPath, "utf8"));
+    return typeof parsed.images === "object" && parsed.images !== null;
+}
+export function planRenditions(publication, workingDirectory) {
+    if (publication?.staticDir === undefined)
+        return { enabled: false, siteFiles: [] };
+    const settingsFile = path.join(publication.staticDir, "projection.json");
+    if (!projectionSettingsHaveImages(path.resolve(workingDirectory, settingsFile)))
+        return { enabled: false, siteFiles: [] };
+    return { enabled: true, siteFiles: [{ from: settingsFile, to: "site_static/projection.json" }] };
+}
+export function renditionsEventPattern(mediaBucketName) {
+    return {
+        source: ["aws.s3"],
+        detailType: ["Object Created"],
+        detail: { bucket: { name: [mediaBucketName] }, object: { key: [{ prefix: RENDITIONS_MEDIA_PREFIX }] } },
+    };
+}
+export function renditionsEnvironment(siteBucketName) {
+    return {
+        PAPYRUS_SITE_BUCKET: siteBucketName,
+        PAPYRUS_SITE_STATIC_DIR: RENDITIONS_STATIC_DIRECTORY,
+    };
+}

package/amplify/publication/renditions-settings.ts

@@ -0,0 +1,50 @@
+/**
+ * Pure planning for the upload-time renditions function of an s3-projection
+ * site (no CDK imports, so it can be tested without synthesizing).
+ *
+ * The function exists only for a site whose `projection.json` carries an
+ * `images` section: that section is the one place the image pipeline settings
+ * live, shared by the renditions function and the projector.
+ */
+import fs from "node:fs";
+import path from "node:path";
+
+export const RENDITIONS_MEMORY_MB = 3008;
+export const RENDITIONS_TIMEOUT_SECONDS = 300;
+export const RENDITIONS_EPHEMERAL_STORAGE_MB = 2048;
+export const RENDITIONS_STATIC_DIRECTORY = "/var/task/site_static";
+export const RENDITIONS_MEDIA_PREFIX = "media/";
+export const RENDITIONS_FUNCTION_NAME_ENV = "PAPYRUS_RENDITIONS_FUNCTION_NAME";
+
+export type RenditionsPlan = {
+  enabled: boolean;
+  siteFiles: Array<{ from: string; to: string }>;
+};
+
+export function projectionSettingsHaveImages(settingsPath: string): boolean {
+  if (!fs.existsSync(settingsPath)) return false;
+  const parsed = JSON.parse(fs.readFileSync(settingsPath, "utf8")) as Record<string, unknown>;
+  return typeof parsed.images === "object" && parsed.images !== null;
+}
+
+export function planRenditions(publication: { staticDir?: string } | undefined, workingDirectory: string): RenditionsPlan {
+  if (publication?.staticDir === undefined) return { enabled: false, siteFiles: [] };
+  const settingsFile = path.join(publication.staticDir, "projection.json");
+  if (!projectionSettingsHaveImages(path.resolve(workingDirectory, settingsFile))) return { enabled: false, siteFiles: [] };
+  return { enabled: true, siteFiles: [{ from: settingsFile, to: "site_static/projection.json" }] };
+}
+
+export function renditionsEventPattern(mediaBucketName: string): Record<string, unknown> {
+  return {
+    source: ["aws.s3"],
+    detailType: ["Object Created"],
+    detail: { bucket: { name: [mediaBucketName] }, object: { key: [{ prefix: RENDITIONS_MEDIA_PREFIX }] } },
+  };
+}
+
+export function renditionsEnvironment(siteBucketName: string): Record<string, string> {
+  return {
+    PAPYRUS_SITE_BUCKET: siteBucketName,
+    PAPYRUS_SITE_STATIC_DIR: RENDITIONS_STATIC_DIRECTORY,
+  };
+}

package/amplify/publication/s3-projection-settings.js

@@ -0,0 +1,63 @@
+export const S3_PROJECTION_PROJECTOR_MODULE = "site_projector";
+export const S3_PROJECTION_STATIC_DIRECTORY = "/var/task/site_static";
+export function distributionIdFromArn(distributionArn) {
+    return distributionArn.slice(distributionArn.lastIndexOf("/") + 1);
+}
+export function s3ProjectionEnvironment(input) {
+    const environment = {
+        PAPYRUS_PUBLICATION_KIND: "s3-projection",
+        PAPYRUS_SITE_BUCKET: input.bucketName,
+    };
+    const distributionId = input.distributionId
+        ?? (input.distributionArn !== undefined ? distributionIdFromArn(input.distributionArn) : undefined);
+    if (distributionId !== undefined)
+        environment.PAPYRUS_EDGE_DISTRIBUTION_ID = distributionId;
+    environment.PAPYRUS_REDIRECTS_KVS_ARN = input.keyValueStoreArn;
+    environment.PAPYRUS_PROJECTION_DLQ_URL = input.deadLetterQueueUrl;
+    if (input.publicHostName !== undefined)
+        environment.PAPYRUS_SITE_PUBLIC_URL = `https://${input.publicHostName}`;
+    if (input.projector !== undefined)
+        environment.PAPYRUS_SITE_PROJECTOR = S3_PROJECTION_PROJECTOR_MODULE;
+    if (input.staticDir !== undefined)
+        environment.PAPYRUS_SITE_STATIC_DIR = S3_PROJECTION_STATIC_DIRECTORY;
+    return environment;
+}
+export function s3ProjectionPolicyStatements(input) {
+    const statements = [
+        { actions: ["s3:PutObject", "s3:DeleteObject", "s3:GetObject"], resources: [`${input.bucketArn}/*`] },
+        { actions: ["s3:ListBucket"], resources: [input.bucketArn] },
+    ];
+    if (input.distributionArn !== undefined) {
+        statements.push({ actions: ["cloudfront:CreateInvalidation"], resources: [input.distributionArn] });
+    }
+    statements.push({
+        actions: [
+            "cloudfront-keyvaluestore:DescribeKeyValueStore",
+            "cloudfront-keyvaluestore:GetKey",
+            "cloudfront-keyvaluestore:PutKey",
+            "cloudfront-keyvaluestore:DeleteKey",
+            "cloudfront-keyvaluestore:UpdateKeys",
+            "cloudfront-keyvaluestore:ListKeys",
+        ],
+        resources: [input.keyValueStoreArn],
+    }, { actions: ["sqs:SendMessage"], resources: [input.deadLetterQueueArn] });
+    return statements;
+}
+export const S3_PROJECTION_CONTENT_ACTIONS_MEMORY_MB = 2048;
+export function planS3ProjectionBackend(publication) {
+    if (publication === undefined)
+        return { enabled: false, siteFiles: [], contentActionsMemorySize: undefined };
+    const siteFiles = [];
+    if (publication.projector !== undefined) {
+        siteFiles.push({ from: publication.projector, to: `${S3_PROJECTION_PROJECTOR_MODULE}.py` });
+    }
+    if (publication.staticDir !== undefined) {
+        siteFiles.push({ from: publication.staticDir, to: "site_static" });
+    }
+    return { enabled: true, siteFiles, contentActionsMemorySize: S3_PROJECTION_CONTENT_ACTIONS_MEMORY_MB };
+}
+export function contentActionsPublicationWiring(publication) {
+    if (publication === undefined)
+        return { environment: {}, policyStatements: [] };
+    return { environment: publication.environment, policyStatements: publication.policyStatements };
+}

package/amplify/publication/s3-projection-settings.ts

@@ -0,0 +1,98 @@
+/**
+ * Environment contract and IAM statements for the s3-projection publication.
+ * Pure (no CDK imports) so both can be tested without synthesizing.
+ */
+export type S3ProjectionSettingsInput = {
+  bucketName: string;
+  bucketArn: string;
+  keyValueStoreArn: string;
+  deadLetterQueueUrl: string;
+  deadLetterQueueArn: string;
+  distributionArn?: string;
+  distributionId?: string;
+  publicHostName?: string;
+  projector?: string;
+  staticDir?: string;
+};
+
+export type S3ProjectionPolicyStatementSpec = {
+  actions: string[];
+  resources: string[];
+};
+
+export const S3_PROJECTION_PROJECTOR_MODULE = "site_projector";
+export const S3_PROJECTION_STATIC_DIRECTORY = "/var/task/site_static";
+
+export function distributionIdFromArn(distributionArn: string): string {
+  return distributionArn.slice(distributionArn.lastIndexOf("/") + 1);
+}
+
+export function s3ProjectionEnvironment(input: S3ProjectionSettingsInput): Record<string, string> {
+  const environment: Record<string, string> = {
+    PAPYRUS_PUBLICATION_KIND: "s3-projection",
+    PAPYRUS_SITE_BUCKET: input.bucketName,
+  };
+  const distributionId = input.distributionId
+    ?? (input.distributionArn !== undefined ? distributionIdFromArn(input.distributionArn) : undefined);
+  if (distributionId !== undefined) environment.PAPYRUS_EDGE_DISTRIBUTION_ID = distributionId;
+  environment.PAPYRUS_REDIRECTS_KVS_ARN = input.keyValueStoreArn;
+  environment.PAPYRUS_PROJECTION_DLQ_URL = input.deadLetterQueueUrl;
+  if (input.publicHostName !== undefined) environment.PAPYRUS_SITE_PUBLIC_URL = `https://${input.publicHostName}`;
+  if (input.projector !== undefined) environment.PAPYRUS_SITE_PROJECTOR = S3_PROJECTION_PROJECTOR_MODULE;
+  if (input.staticDir !== undefined) environment.PAPYRUS_SITE_STATIC_DIR = S3_PROJECTION_STATIC_DIRECTORY;
+  return environment;
+}
+
+export function s3ProjectionPolicyStatements(input: S3ProjectionSettingsInput): S3ProjectionPolicyStatementSpec[] {
+  const statements: S3ProjectionPolicyStatementSpec[] = [
+    { actions: ["s3:PutObject", "s3:DeleteObject", "s3:GetObject"], resources: [`${input.bucketArn}/*`] },
+    { actions: ["s3:ListBucket"], resources: [input.bucketArn] },
+  ];
+  if (input.distributionArn !== undefined) {
+    statements.push({ actions: ["cloudfront:CreateInvalidation"], resources: [input.distributionArn] });
+  }
+  statements.push(
+    {
+      actions: [
+        "cloudfront-keyvaluestore:DescribeKeyValueStore",
+        "cloudfront-keyvaluestore:GetKey",
+        "cloudfront-keyvaluestore:PutKey",
+        "cloudfront-keyvaluestore:DeleteKey",
+        "cloudfront-keyvaluestore:UpdateKeys",
+        "cloudfront-keyvaluestore:ListKeys",
+      ],
+      resources: [input.keyValueStoreArn],
+    },
+    { actions: ["sqs:SendMessage"], resources: [input.deadLetterQueueArn] },
+  );
+  return statements;
+}
+
+export type S3ProjectionBackendPlan = {
+  enabled: boolean;
+  siteFiles: Array<{ from: string; to: string }>;
+  contentActionsMemorySize: number | undefined;
+};
+
+export const S3_PROJECTION_CONTENT_ACTIONS_MEMORY_MB = 2048;
+
+export function planS3ProjectionBackend(
+  publication: { projector?: string; staticDir?: string } | undefined,
+): S3ProjectionBackendPlan {
+  if (publication === undefined) return { enabled: false, siteFiles: [], contentActionsMemorySize: undefined };
+  const siteFiles: Array<{ from: string; to: string }> = [];
+  if (publication.projector !== undefined) {
+    siteFiles.push({ from: publication.projector, to: `${S3_PROJECTION_PROJECTOR_MODULE}.py` });
+  }
+  if (publication.staticDir !== undefined) {
+    siteFiles.push({ from: publication.staticDir, to: "site_static" });
+  }
+  return { enabled: true, siteFiles, contentActionsMemorySize: S3_PROJECTION_CONTENT_ACTIONS_MEMORY_MB };
+}
+
+export function contentActionsPublicationWiring<Statement>(
+  publication: { environment: Record<string, string>; policyStatements: Statement[] } | undefined,
+): { environment: Record<string, string>; policyStatements: Statement[] } {
+  if (publication === undefined) return { environment: {}, policyStatements: [] };
+  return { environment: publication.environment, policyStatements: publication.policyStatements };
+}

package/amplify/publication/s3-projection.js

@@ -0,0 +1,126 @@
+import { Duration, RemovalPolicy } from "aws-cdk-lib";
+import * as acm from "aws-cdk-lib/aws-certificatemanager";
+import * as cloudfront from "aws-cdk-lib/aws-cloudfront";
+import * as origins from "aws-cdk-lib/aws-cloudfront-origins";
+import { Effect, PolicyStatement, ServicePrincipal } from "aws-cdk-lib/aws-iam";
+import * as route53 from "aws-cdk-lib/aws-route53";
+import * as s3 from "aws-cdk-lib/aws-s3";
+import * as sqs from "aws-cdk-lib/aws-sqs";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { assertValidPublicationConfig } from "../site-backend-config.js";
+import { addRenditionsFunction } from "./renditions-function.js";
+import { RENDITIONS_FUNCTION_NAME_ENV } from "./renditions-settings.js";
+import { s3ProjectionEnvironment, s3ProjectionPolicyStatements } from "./s3-projection-settings.js";
+const redirectFunctionSourcePath = resolve(dirname(fileURLToPath(import.meta.url)), "redirect-and-index.js");
+function createSiteBucket(scope, retainBucketOnDelete) {
+    return new s3.Bucket(scope, "SiteBucket", {
+        versioned: true,
+        blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
+        enforceSSL: true,
+        encryption: s3.BucketEncryption.S3_MANAGED,
+        lifecycleRules: [{ noncurrentVersionExpiration: Duration.days(90) }],
+        removalPolicy: retainBucketOnDelete ? RemovalPolicy.RETAIN : RemovalPolicy.DESTROY,
+        autoDeleteObjects: !retainBucketOnDelete,
+    });
+}
+function createDnsValidatedCertificate(scope, aliases, hostedZone) {
+    const zone = route53.HostedZone.fromHostedZoneAttributes(scope, "SiteHostedZone", {
+        hostedZoneId: hostedZone.hostedZoneId,
+        zoneName: hostedZone.hostedZoneName,
+    });
+    return new acm.DnsValidatedCertificate(scope, "SiteCertificate", {
+        domainName: aliases[0],
+        subjectAlternativeNames: aliases.slice(1),
+        hostedZone: zone,
+        region: "us-east-1",
+    });
+}
+function createDistribution(scope, props, bucket, redirectFunction) {
+    const aliases = props.distribution?.aliases ?? [];
+    let certificate;
+    if (aliases.length > 0) {
+        certificate = props.distribution?.acm !== undefined
+            ? createDnsValidatedCertificate(scope, aliases, props.distribution.acm)
+            : acm.Certificate.fromCertificateArn(scope, "SiteCertificate", props.distribution?.certificateArn ?? "");
+    }
+    return new cloudfront.Distribution(scope, "SiteDistribution", {
+        defaultRootObject: "index.html",
+        httpVersion: cloudfront.HttpVersion.HTTP2_AND_3,
+        enableLogging: false,
+        domainNames: aliases.length > 0 ? aliases : undefined,
+        certificate,
+        defaultBehavior: {
+            origin: origins.S3BucketOrigin.withOriginAccessControl(bucket),
+            viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+            compress: true,
+            functionAssociations: [{ function: redirectFunction, eventType: cloudfront.FunctionEventType.VIEWER_REQUEST }],
+        },
+        errorResponses: [
+            { httpStatus: 404, responseHttpStatus: 404, responsePagePath: "/404.html" },
+            { httpStatus: 403, responseHttpStatus: 404, responsePagePath: "/404.html" },
+        ],
+    });
+}
+export function addS3ProjectionPublication(scope, props, media) {
+    assertValidPublicationConfig({ kind: "s3-projection", ...props });
+    const bucket = createSiteBucket(scope, props.retainBucketOnDelete !== false);
+    const keyValueStore = new cloudfront.KeyValueStore(scope, "RedirectsKeyValueStore");
+    const redirectFunction = new cloudfront.Function(scope, "RedirectAndIndexFunction", {
+        runtime: cloudfront.FunctionRuntime.JS_2_0,
+        code: cloudfront.FunctionCode.fromFile({ filePath: redirectFunctionSourcePath }),
+        keyValueStore,
+    });
+    const deadLetterQueue = new sqs.Queue(scope, "ProjectionDeadLetterQueue", {
+        encryption: sqs.QueueEncryption.SQS_MANAGED,
+        retentionPeriod: Duration.days(14),
+        enforceSSL: true,
+    });
+    const createsDistribution = props.distribution?.create === true;
+    const distribution = createsDistribution ? createDistribution(scope, props, bucket, redirectFunction) : undefined;
+    let distributionArn;
+    if (distribution !== undefined) {
+        distributionArn = distribution.distributionArn;
+    }
+    else if (props.edgeDistributionArn !== undefined) {
+        distributionArn = props.edgeDistributionArn;
+        bucket.addToResourcePolicy(new PolicyStatement({
+            effect: Effect.ALLOW,
+            principals: [new ServicePrincipal("cloudfront.amazonaws.com")],
+            actions: ["s3:GetObject"],
+            resources: [bucket.arnForObjects("*")],
+            conditions: { StringEquals: { "aws:SourceArn": props.edgeDistributionArn } },
+        }));
+    }
+    const renditions = media?.renditions.enabled === true
+        ? addRenditionsFunction(scope, { siteBucket: bucket, mediaBucket: media.mediaBucket, siteFiles: media.renditions.siteFiles, code: media.renditionsCode })
+        : undefined;
+    const settingsInput = {
+        bucketName: bucket.bucketName,
+        bucketArn: bucket.bucketArn,
+        keyValueStoreArn: keyValueStore.keyValueStoreArn,
+        deadLetterQueueUrl: deadLetterQueue.queueUrl,
+        deadLetterQueueArn: deadLetterQueue.queueArn,
+        distributionArn,
+        distributionId: distribution?.distributionId,
+        publicHostName: distribution !== undefined
+            ? (props.distribution?.aliases?.[0] ?? distribution.distributionDomainName)
+            : undefined,
+        projector: props.projector,
+        staticDir: props.staticDir,
+    };
+    return {
+        bucket,
+        keyValueStore,
+        redirectFunction,
+        deadLetterQueue,
+        distribution,
+        distributionId: distribution?.distributionId,
+        renditions,
+        environment: {
+            ...s3ProjectionEnvironment(settingsInput),
+            ...(renditions !== undefined ? { [RENDITIONS_FUNCTION_NAME_ENV]: renditions.function.functionName } : {}),
+        },
+        policyStatements: s3ProjectionPolicyStatements(settingsInput).map((statement) => new PolicyStatement({ effect: Effect.ALLOW, actions: statement.actions, resources: statement.resources })),
+    };
+}

package/amplify/publication/s3-projection.ts

@@ -0,0 +1,174 @@
+import { Duration, RemovalPolicy } from "aws-cdk-lib";
+import * as acm from "aws-cdk-lib/aws-certificatemanager";
+import * as cloudfront from "aws-cdk-lib/aws-cloudfront";
+import type { Code } from "aws-cdk-lib/aws-lambda";
+import * as origins from "aws-cdk-lib/aws-cloudfront-origins";
+import { Effect, PolicyStatement, ServicePrincipal } from "aws-cdk-lib/aws-iam";
+import * as route53 from "aws-cdk-lib/aws-route53";
+import * as s3 from "aws-cdk-lib/aws-s3";
+import * as sqs from "aws-cdk-lib/aws-sqs";
+import type { Construct } from "constructs";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { assertValidPublicationConfig, type PapyrusPublicationConfig } from "../site-backend-config";
+import { addRenditionsFunction, type RenditionsFunction } from "./renditions-function";
+import { RENDITIONS_FUNCTION_NAME_ENV, type RenditionsPlan } from "./renditions-settings";
+import { s3ProjectionEnvironment, s3ProjectionPolicyStatements } from "./s3-projection-settings";
+
+const redirectFunctionSourcePath = resolve(dirname(fileURLToPath(import.meta.url)), "redirect-and-index.js");
+
+export type S3ProjectionPublicationProps = Omit<PapyrusPublicationConfig, "kind"> & { kind?: "s3-projection" };
+
+export type S3ProjectionMedia = {
+  mediaBucket: s3.IBucket;
+  renditions: RenditionsPlan;
+  renditionsCode?: Code;
+};
+
+export type S3ProjectionPublication = {
+  bucket: s3.Bucket;
+  keyValueStore: cloudfront.KeyValueStore;
+  redirectFunction: cloudfront.Function;
+  deadLetterQueue: sqs.Queue;
+  distribution?: cloudfront.Distribution;
+  distributionId?: string;
+  renditions?: RenditionsFunction;
+  environment: Record<string, string>;
+  policyStatements: PolicyStatement[];
+};
+
+function createSiteBucket(scope: Construct, retainBucketOnDelete: boolean): s3.Bucket {
+  return new s3.Bucket(scope, "SiteBucket", {
+    versioned: true,
+    blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
+    enforceSSL: true,
+    encryption: s3.BucketEncryption.S3_MANAGED,
+    lifecycleRules: [{ noncurrentVersionExpiration: Duration.days(90) }],
+    removalPolicy: retainBucketOnDelete ? RemovalPolicy.RETAIN : RemovalPolicy.DESTROY,
+    autoDeleteObjects: !retainBucketOnDelete,
+  });
+}
+
+function createDnsValidatedCertificate(
+  scope: Construct,
+  aliases: string[],
+  hostedZone: { hostedZoneId: string; hostedZoneName: string },
+): acm.ICertificate {
+  const zone = route53.HostedZone.fromHostedZoneAttributes(scope, "SiteHostedZone", {
+    hostedZoneId: hostedZone.hostedZoneId,
+    zoneName: hostedZone.hostedZoneName,
+  });
+  return new acm.DnsValidatedCertificate(scope, "SiteCertificate", {
+    domainName: aliases[0],
+    subjectAlternativeNames: aliases.slice(1),
+    hostedZone: zone,
+    region: "us-east-1",
+  });
+}
+
+function createDistribution(
+  scope: Construct,
+  props: S3ProjectionPublicationProps,
+  bucket: s3.Bucket,
+  redirectFunction: cloudfront.Function,
+): cloudfront.Distribution {
+  const aliases = props.distribution?.aliases ?? [];
+  let certificate: acm.ICertificate | undefined;
+  if (aliases.length > 0) {
+    certificate = props.distribution?.acm !== undefined
+      ? createDnsValidatedCertificate(scope, aliases, props.distribution.acm)
+      : acm.Certificate.fromCertificateArn(scope, "SiteCertificate", props.distribution?.certificateArn ?? "");
+  }
+  return new cloudfront.Distribution(scope, "SiteDistribution", {
+    defaultRootObject: "index.html",
+    httpVersion: cloudfront.HttpVersion.HTTP2_AND_3,
+    enableLogging: false,
+    domainNames: aliases.length > 0 ? aliases : undefined,
+    certificate,
+    defaultBehavior: {
+      origin: origins.S3BucketOrigin.withOriginAccessControl(bucket),
+      viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+      compress: true,
+      functionAssociations: [{ function: redirectFunction, eventType: cloudfront.FunctionEventType.VIEWER_REQUEST }],
+    },
+    errorResponses: [
+      { httpStatus: 404, responseHttpStatus: 404, responsePagePath: "/404.html" },
+      { httpStatus: 403, responseHttpStatus: 404, responsePagePath: "/404.html" },
+    ],
+  });
+}
+
+export function addS3ProjectionPublication(
+  scope: Construct,
+  props: S3ProjectionPublicationProps,
+  media?: S3ProjectionMedia,
+): S3ProjectionPublication {
+  assertValidPublicationConfig({ kind: "s3-projection", ...props });
+  const bucket = createSiteBucket(scope, props.retainBucketOnDelete !== false);
+
+  const keyValueStore = new cloudfront.KeyValueStore(scope, "RedirectsKeyValueStore");
+  const redirectFunction = new cloudfront.Function(scope, "RedirectAndIndexFunction", {
+    runtime: cloudfront.FunctionRuntime.JS_2_0,
+    code: cloudfront.FunctionCode.fromFile({ filePath: redirectFunctionSourcePath }),
+    keyValueStore,
+  });
+  const deadLetterQueue = new sqs.Queue(scope, "ProjectionDeadLetterQueue", {
+    encryption: sqs.QueueEncryption.SQS_MANAGED,
+    retentionPeriod: Duration.days(14),
+    enforceSSL: true,
+  });
+
+  const createsDistribution = props.distribution?.create === true;
+  const distribution = createsDistribution ? createDistribution(scope, props, bucket, redirectFunction) : undefined;
+
+  let distributionArn: string | undefined;
+  if (distribution !== undefined) {
+    distributionArn = distribution.distributionArn;
+  } else if (props.edgeDistributionArn !== undefined) {
+    distributionArn = props.edgeDistributionArn;
+    bucket.addToResourcePolicy(
+      new PolicyStatement({
+        effect: Effect.ALLOW,
+        principals: [new ServicePrincipal("cloudfront.amazonaws.com")],
+        actions: ["s3:GetObject"],
+        resources: [bucket.arnForObjects("*")],
+        conditions: { StringEquals: { "aws:SourceArn": props.edgeDistributionArn } },
+      }),
+    );
+  }
+
+  const renditions = media?.renditions.enabled === true
+    ? addRenditionsFunction(scope, { siteBucket: bucket, mediaBucket: media.mediaBucket, siteFiles: media.renditions.siteFiles, code: media.renditionsCode })
+    : undefined;
+
+  const settingsInput = {
+    bucketName: bucket.bucketName,
+    bucketArn: bucket.bucketArn,
+    keyValueStoreArn: keyValueStore.keyValueStoreArn,
+    deadLetterQueueUrl: deadLetterQueue.queueUrl,
+    deadLetterQueueArn: deadLetterQueue.queueArn,
+    distributionArn,
+    distributionId: distribution?.distributionId,
+    publicHostName: distribution !== undefined
+      ? (props.distribution?.aliases?.[0] ?? distribution.distributionDomainName)
+      : undefined,
+    projector: props.projector,
+    staticDir: props.staticDir,
+  };
+  return {
+    bucket,
+    keyValueStore,
+    redirectFunction,
+    deadLetterQueue,
+    distribution,
+    distributionId: distribution?.distributionId,
+    renditions,
+    environment: {
+      ...s3ProjectionEnvironment(settingsInput),
+      ...(renditions !== undefined ? { [RENDITIONS_FUNCTION_NAME_ENV]: renditions.function.functionName } : {}),
+    },
+    policyStatements: s3ProjectionPolicyStatements(settingsInput).map(
+      (statement) => new PolicyStatement({ effect: Effect.ALLOW, actions: statement.actions, resources: statement.resources }),
+    ),
+  };
+}

package/amplify/site-backend-config.js

@@ -1 +1,51 @@
-export {};
+const CLOUDFRONT_DISTRIBUTION_ARN = /^arn:aws[a-z-]*:cloudfront::\d{12}:distribution\/[A-Z0-9]+$/;
+function isRelativePathWithoutParentSegments(value) {
+    if (value === "" || value.startsWith("/") || value.includes("\\"))
+        return false;
+    return !value.split("/").includes("..");
+}
+export function validatePublicationConfig(publication) {
+    const problems = [];
+    if (typeof publication !== "object" || publication === null) {
+        return ["publication must be an object"];
+    }
+    const config = publication;
+    if (config.kind !== "s3-projection") {
+        problems.push(`publication.kind must be "s3-projection" (got ${JSON.stringify(config.kind)})`);
+    }
+    if (config.projector !== undefined) {
+        if (typeof config.projector !== "string" || !isRelativePathWithoutParentSegments(config.projector) || !config.projector.endsWith(".py")) {
+            problems.push("publication.projector must be a relative .py path without '..'");
+        }
+    }
+    if (config.staticDir !== undefined) {
+        if (typeof config.staticDir !== "string" || !isRelativePathWithoutParentSegments(config.staticDir)) {
+            problems.push("publication.staticDir must be a relative path without '..'");
+        }
+    }
+    if (config.edgeDistributionArn !== undefined && !CLOUDFRONT_DISTRIBUTION_ARN.test(config.edgeDistributionArn)) {
+        problems.push("publication.edgeDistributionArn must be a CloudFront distribution ARN (arn:aws:cloudfront::<account>:distribution/<id>)");
+    }
+    const distribution = config.distribution;
+    if (distribution !== undefined) {
+        if (config.edgeDistributionArn !== undefined && distribution.create === true) {
+            problems.push("publication.edgeDistributionArn and publication.distribution.create are mutually exclusive");
+        }
+        const aliases = distribution.aliases ?? [];
+        if (aliases.length > 0 && distribution.create !== true) {
+            problems.push("publication.distribution.aliases require distribution.create to be true");
+        }
+        if (aliases.length > 0 && !distribution.certificateArn && !distribution.acm) {
+            problems.push("publication.distribution.aliases require certificateArn or acm");
+        }
+        if (distribution.acm !== undefined && (!distribution.acm.hostedZoneId || !distribution.acm.hostedZoneName)) {
+            problems.push("publication.distribution.acm requires hostedZoneId and hostedZoneName");
+        }
+    }
+    return problems;
+}
+export function assertValidPublicationConfig(publication) {
+    const problems = validatePublicationConfig(publication);
+    if (problems.length > 0)
+        throw new Error(`Invalid backend.publication: ${problems.join("; ")}`);
+}