@anthusai/papyrus 1.0.0-next.62 → 1.0.0-next.64

package/lib/prospectus-sign-in-routes.ts

@@ -0,0 +1,284 @@
+import { NextResponse, type NextRequest } from "next/server";
+import {
+  CYCLOTRON_LAB_PRODUCT,
+  ProspectusAccountsError,
+  authorizeSignedInPersonForAccount,
+  beginProspectusGoogleSignIn,
+  completeProspectusGoogleSignIn,
+  type CompleteProspectusGoogleSignInInput,
+} from "./prospectus-site-identity";
+import {
+  PROSPECTUS_PENDING_SIGN_IN_COOKIE,
+  PROSPECTUS_SESSION_COOKIE,
+  openProspectusCookie,
+  resolveProspectusSignInRuntime,
+  sameSiteReturnPath,
+  sealProspectusCookie,
+  sealedCookieAttributes,
+  type PendingProspectusSignInCookie,
+  type ProspectusSignInRuntime,
+  type ProspectusSignedInSession,
+} from "./prospectus-session";
+import {
+  prospectusSiteProduct,
+  publicationCapabilitiesForProspectusRole,
+  publishingAccountsForSite,
+  type PublicationCapability,
+} from "./prospectus-publication-access";
+
+/**
+ * The site's sign-in routes for Prospectus accounts: start (challenge, then the
+ * Google-only Cognito redirect), callback (verify, resolve, seal the session),
+ * session (who is signed in and which accounts they belong to) and sign-out.
+ * Every route answers 503 until the site is registered and configured, so an
+ * unregistered deployment never half-signs anyone in.
+ */
+export interface ProspectusSignInRouteOptions {
+  resolveRuntime?: (siteOrigin: string) => Promise<ProspectusSignInRuntime | null>;
+  siteProduct?: string | null;
+  completionOverrides?: Pick<CompleteProspectusGoogleSignInInput, "verifyCognitoTokens" | "fetcher">;
+  nowInSeconds?: () => number;
+}
+
+const NO_STORE_HEADERS = { "cache-control": "no-store" };
+
+function siteProductFor(options: ProspectusSignInRouteOptions): string | null {
+  return options.siteProduct !== undefined ? options.siteProduct : prospectusSiteProduct();
+}
+
+function currentTimeInSeconds(options: ProspectusSignInRouteOptions): number {
+  return options.nowInSeconds?.() ?? Math.floor(Date.now() / 1000);
+}
+
+async function signInRuntimeFor(request: NextRequest, options: ProspectusSignInRouteOptions): Promise<ProspectusSignInRuntime | null> {
+  return (options.resolveRuntime ?? resolveProspectusSignInRuntime)(request.nextUrl.origin);
+}
+
+function signInUnavailableResponse(): NextResponse {
+  return NextResponse.json(
+    { error: "prospectus_sign_in_unavailable", message: "Sign-in through Prospectus is not configured for this site." },
+    { status: 503, headers: NO_STORE_HEADERS },
+  );
+}
+
+function clearSealedCookie(response: NextResponse, cookieName: string): void {
+  response.cookies.set(cookieName, "", sealedCookieAttributes(0, 0));
+}
+
+function signInFailedResponse(status: number, code: string, message: string): NextResponse {
+  return NextResponse.json({ error: code, message }, { status, headers: NO_STORE_HEADERS });
+}
+
+export function signedInProspectusSession(
+  request: NextRequest,
+  sealingSecret: string,
+  nowInSeconds?: number,
+): ProspectusSignedInSession | null {
+  return openProspectusCookie<ProspectusSignedInSession>(
+    sealingSecret,
+    PROSPECTUS_SESSION_COOKIE,
+    request.cookies.get(PROSPECTUS_SESSION_COOKIE)?.value,
+    nowInSeconds,
+  );
+}
+
+export async function handleProspectusSignInStart(request: NextRequest, options: ProspectusSignInRouteOptions = {}): Promise<NextResponse> {
+  const runtime = await signInRuntimeFor(request, options);
+  if (!runtime) return signInUnavailableResponse();
+  const { authorizationUrl, pendingSignIn } = await beginProspectusGoogleSignIn(runtime.accounts, runtime.cognitoClient);
+  const pendingSignInCookie: PendingProspectusSignInCookie = {
+    ...pendingSignIn,
+    returnPath: sameSiteReturnPath(request.nextUrl.searchParams.get("returnTo")),
+  };
+  const response = NextResponse.redirect(authorizationUrl, { status: 303, headers: NO_STORE_HEADERS });
+  response.cookies.set(
+    PROSPECTUS_PENDING_SIGN_IN_COOKIE,
+    sealProspectusCookie(runtime.sealingSecret, PROSPECTUS_PENDING_SIGN_IN_COOKIE, pendingSignInCookie, pendingSignIn.expiresAt),
+    sealedCookieAttributes(pendingSignIn.expiresAt, currentTimeInSeconds(options)),
+  );
+  return response;
+}
+
+export async function handleProspectusSignInCallback(request: NextRequest, options: ProspectusSignInRouteOptions = {}): Promise<NextResponse> {
+  const runtime = await signInRuntimeFor(request, options);
+  if (!runtime) return signInUnavailableResponse();
+  const nowInSeconds = currentTimeInSeconds(options);
+  const pendingSignIn = openProspectusCookie<PendingProspectusSignInCookie>(
+    runtime.sealingSecret,
+    PROSPECTUS_PENDING_SIGN_IN_COOKIE,
+    request.cookies.get(PROSPECTUS_PENDING_SIGN_IN_COOKIE)?.value,
+    nowInSeconds,
+  );
+  const response = await completeCallback(request, runtime, pendingSignIn, options, nowInSeconds);
+  clearSealedCookie(response, PROSPECTUS_PENDING_SIGN_IN_COOKIE);
+  return response;
+}
+
+async function completeCallback(
+  request: NextRequest,
+  runtime: ProspectusSignInRuntime,
+  pendingSignIn: PendingProspectusSignInCookie | null,
+  options: ProspectusSignInRouteOptions,
+  nowInSeconds: number,
+): Promise<NextResponse> {
+  if (!pendingSignIn) return signInFailedResponse(401, "sign_in_expired", "This sign-in is no longer pending. Start again.");
+  const searchParams = request.nextUrl.searchParams;
+  if (searchParams.get("error")) return signInFailedResponse(401, "sign_in_declined", "Google sign-in did not complete.");
+  const authorizationCode = searchParams.get("code");
+  const returnedState = searchParams.get("state");
+  if (!authorizationCode || !returnedState) return signInFailedResponse(400, "sign_in_incomplete", "The sign-in response is missing its code or state.");
+  try {
+    const signedIn = await completeProspectusGoogleSignIn({
+      accounts: runtime.accounts,
+      cognitoClient: runtime.cognitoClient,
+      pendingSignIn,
+      returnedState,
+      authorizationCode,
+      nowInSeconds,
+      ...options.completionOverrides,
+    });
+    const session: ProspectusSignedInSession = {
+      personId: signedIn.person.id,
+      accessToken: signedIn.accessToken,
+      accessTokenExpiresAt: signedIn.accessTokenExpiresAt,
+    };
+    const response = NextResponse.redirect(new URL(pendingSignIn.returnPath, request.nextUrl.origin), { status: 303, headers: NO_STORE_HEADERS });
+    response.cookies.set(
+      PROSPECTUS_SESSION_COOKIE,
+      sealProspectusCookie(runtime.sealingSecret, PROSPECTUS_SESSION_COOKIE, session, session.accessTokenExpiresAt),
+      sealedCookieAttributes(session.accessTokenExpiresAt, nowInSeconds),
+    );
+    return response;
+  } catch (error) {
+    if (error instanceof ProspectusAccountsError) return signInFailedResponse(error.status, error.code, error.message);
+    console.error(`Prospectus sign-in failed (${error instanceof Error ? error.name : "error"}).`);
+    return signInFailedResponse(401, "sign_in_failed", "Sign-in could not be completed.");
+  }
+}
+
+export async function handleProspectusSessionRead(request: NextRequest, options: ProspectusSignInRouteOptions = {}): Promise<NextResponse> {
+  const runtime = await signInRuntimeFor(request, options);
+  if (!runtime) return signInUnavailableResponse();
+  const session = signedInProspectusSession(request, runtime.sealingSecret, currentTimeInSeconds(options));
+  if (!session) return NextResponse.json({ signedIn: false }, { headers: NO_STORE_HEADERS });
+  try {
+    const directory = await runtime.accounts.accountDirectory(session.accessToken);
+    if (!directory.person || directory.person.id !== session.personId) {
+      const response = NextResponse.json({ signedIn: false }, { headers: NO_STORE_HEADERS });
+      clearSealedCookie(response, PROSPECTUS_SESSION_COOKIE);
+      return response;
+    }
+    const publishingAccounts = publishingAccountsForSite(directory.accounts, siteProductFor(options));
+    return NextResponse.json(
+      {
+        signedIn: true,
+        person: directory.person,
+        accounts: directory.accounts,
+        cyclotronLabAccess: directory.accounts.some((account) =>
+          account.products.some((product) => product.product === CYCLOTRON_LAB_PRODUCT && product.status === "active"),
+        ),
+        publishingAccounts,
+        selectedAccountId: publishingAccounts.some((account) => account.accountId === session.selectedAccountId)
+          ? session.selectedAccountId
+          : null,
+      },
+      { headers: NO_STORE_HEADERS },
+    );
+  } catch (error) {
+    if (error instanceof ProspectusAccountsError && error.status === 401) {
+      const response = NextResponse.json({ signedIn: false }, { headers: NO_STORE_HEADERS });
+      clearSealedCookie(response, PROSPECTUS_SESSION_COOKIE);
+      return response;
+    }
+    if (error instanceof ProspectusAccountsError) return signInFailedResponse(error.status, error.code, error.message);
+    console.error(`Prospectus account directory failed (${error instanceof Error ? error.name : "error"}).`);
+    return signInFailedResponse(503, "prospectus_unavailable", "Prospectus could not be reached.");
+  }
+}
+
+export async function handleProspectusSignOut(request: NextRequest, options: ProspectusSignInRouteOptions = {}): Promise<NextResponse> {
+  const runtime = await signInRuntimeFor(request, options);
+  const signedOutDestination = new URL("/", request.nextUrl.origin);
+  const destination = runtime
+    ? new URL(
+      `/logout?${new URLSearchParams({ client_id: runtime.cognitoClient.clientId, logout_uri: signedOutDestination.toString() })}`,
+      runtime.cognitoClient.hostedUiOrigin,
+    )
+    : signedOutDestination;
+  const response = NextResponse.redirect(destination, { status: 303, headers: NO_STORE_HEADERS });
+  clearSealedCookie(response, PROSPECTUS_SESSION_COOKIE);
+  clearSealedCookie(response, PROSPECTUS_PENDING_SIGN_IN_COOKIE);
+  return response;
+}
+
+export interface ProspectusPublishingSelection {
+  personId: string;
+  accountId: string;
+  role: string;
+  publicationCapabilities: PublicationCapability[];
+}
+
+async function freshlyAuthorizedPublishingSelection(
+  runtime: ProspectusSignInRuntime,
+  session: ProspectusSignedInSession,
+  accountId: string,
+  siteProduct: string | null,
+): Promise<ProspectusPublishingSelection | null> {
+  const directory = await runtime.accounts.accountDirectory(session.accessToken);
+  if (!directory.person || directory.person.id !== session.personId) return null;
+  if (!publishingAccountsForSite(directory.accounts, siteProduct).some((account) => account.accountId === accountId)) return null;
+  const authorization = await authorizeSignedInPersonForAccount(runtime.accounts, session.accessToken, accountId, "console:read");
+  if (authorization.personId !== session.personId) return null;
+  const publicationCapabilities = publicationCapabilitiesForProspectusRole(authorization.role);
+  if (publicationCapabilities.length === 0) return null;
+  return { personId: session.personId, accountId, role: authorization.role, publicationCapabilities };
+}
+
+export async function currentProspectusPublishingSelection(
+  request: NextRequest,
+  options: ProspectusSignInRouteOptions = {},
+): Promise<ProspectusPublishingSelection | null> {
+  const runtime = await signInRuntimeFor(request, options);
+  if (!runtime) return null;
+  const session = signedInProspectusSession(request, runtime.sealingSecret, currentTimeInSeconds(options));
+  if (!session?.selectedAccountId) return null;
+  try {
+    return await freshlyAuthorizedPublishingSelection(runtime, session, session.selectedAccountId, siteProductFor(options));
+  } catch (error) {
+    if (error instanceof ProspectusAccountsError) return null;
+    throw error;
+  }
+}
+
+export async function handleProspectusAccountSelection(request: NextRequest, options: ProspectusSignInRouteOptions = {}): Promise<NextResponse> {
+  const runtime = await signInRuntimeFor(request, options);
+  if (!runtime) return signInUnavailableResponse();
+  if (request.headers.get("origin") !== request.nextUrl.origin) {
+    return signInFailedResponse(403, "cross_origin_selection", "Choose an account from this site.");
+  }
+  const nowInSeconds = currentTimeInSeconds(options);
+  const session = signedInProspectusSession(request, runtime.sealingSecret, nowInSeconds);
+  if (!session) return signInFailedResponse(401, "signed_out", "Sign in first.");
+  const body = await request.json().catch(() => null) as { accountId?: unknown } | null;
+  const accountId = typeof body?.accountId === "string" ? body.accountId.trim() : "";
+  if (!accountId) return signInFailedResponse(400, "account_required", "Choose an account.");
+  try {
+    const selection = await freshlyAuthorizedPublishingSelection(runtime, session, accountId, siteProductFor(options));
+    if (!selection) return signInFailedResponse(403, "not_a_publishing_account", "You cannot work on this site's publications in that account.");
+    const response = NextResponse.json(
+      { selectedAccountId: selection.accountId, role: selection.role, publicationCapabilities: selection.publicationCapabilities },
+      { headers: NO_STORE_HEADERS },
+    );
+    const selectedSession: ProspectusSignedInSession = { ...session, selectedAccountId: selection.accountId };
+    response.cookies.set(
+      PROSPECTUS_SESSION_COOKIE,
+      sealProspectusCookie(runtime.sealingSecret, PROSPECTUS_SESSION_COOKIE, selectedSession, session.accessTokenExpiresAt),
+      sealedCookieAttributes(session.accessTokenExpiresAt, nowInSeconds),
+    );
+    return response;
+  } catch (error) {
+    if (error instanceof ProspectusAccountsError) return signInFailedResponse(error.status, error.code, error.message);
+    console.error(`Prospectus account selection failed (${error instanceof Error ? error.name : "error"}).`);
+    return signInFailedResponse(503, "prospectus_unavailable", "Prospectus could not be reached.");
+  }
+}

package/lib/site-brand.ts

@@ -64,6 +64,19 @@ export type SiteBrandVideo = {
   rhythm?: Record<string, unknown>;
 };
 
+/**
+ * The publication's name for its one content item. A content item keeps one
+ * identity and one lifecycle from idea through research, reporting,
+ * copywriting and publication; only the word editors see changes per
+ * publication (for example Story, Article or Post).
+ */
+export type ContentItemName = {
+  singular: string;
+  plural: string;
+};
+
+export const DEFAULT_CONTENT_ITEM_NAME: ContentItemName = { singular: "Story", plural: "Stories" };
+
 export type SiteBrand = {
   id: SiteBrandId;
   appTitle: string;
@@ -77,6 +90,8 @@ export type SiteBrand = {
   mastheadTaglineLines?: SiteBrandTaglineLine[];
   backToHomeLabel: string;
   articleTitleSuffix: string;
+  /** Defaults to Story / Stories, the newsroom term. */
+  contentItemName?: ContentItemName;
   placeholderByline: string;
   defaultPresentation: EditionPresentationFormat;
   forcedPresentation?: EditionPresentationFormat;
@@ -204,6 +219,10 @@ export function getSiteBrand(id: SiteBrandId = resolveSiteBrandId()): SiteBrand
 
 export const SITE_BRAND = getSiteBrand();
 
+export function getContentItemName(brand: SiteBrand = SITE_BRAND): ContentItemName {
+  return brand.contentItemName ?? DEFAULT_CONTENT_ITEM_NAME;
+}
+
 /** Root-route config for a brand, defaulting to `{ kind: "reader" }`. */
 export function getRootRoute(brand: SiteBrand = SITE_BRAND): RootRouteConfig {
   return brand.rootRoute ?? { kind: "reader" };

package/package.json

@@ -155,6 +155,7 @@
     "./lib/console-web-context": "./lib/console-web-context.ts",
     "./lib/content-actions-client": "./lib/content-actions-client.ts",
     "./lib/content-actions-demo": "./lib/content-actions-demo.ts",
+    "./lib/content-item-lifecycle": "./lib/content-item-lifecycle.ts",
     "./lib/content-load-timing": "./lib/content-load-timing.ts",
     "./lib/content-repository": "./lib/content-repository.ts",
     "./lib/content-source-context": "./lib/content-source-context.ts",
@@ -208,6 +209,9 @@
     "./lib/presentation-footer": "./lib/presentation-footer.ts",
     "./lib/pretext-layout": "./lib/pretext-layout.ts",
     "./lib/priming-proof-report": "./lib/priming-proof-report.ts",
+    "./lib/prospectus-publication-access": "./lib/prospectus-publication-access.ts",
+    "./lib/prospectus-session": "./lib/prospectus-session.ts",
+    "./lib/prospectus-sign-in-routes": "./lib/prospectus-sign-in-routes.ts",
     "./lib/prospectus-site-identity": "./lib/prospectus-site-identity.ts",
     "./lib/public-placeholder-config": "./lib/public-placeholder-config.ts",
     "./lib/publication-cyclotron": "./lib/publication-cyclotron.ts",
@@ -263,6 +267,11 @@
     "./app/[year]/[month]/[day]/page/[pageNumber]/page": "./app/[year]/[month]/[day]/page/[pageNumber]/page.tsx",
     "./app/[year]/[month]/[day]/section/[sectionKey]/page": "./app/[year]/[month]/[day]/section/[sectionKey]/page.tsx",
     "./app/api/archive/editions/route": "./app/api/archive/editions/route.ts",
+    "./app/api/auth/prospectus/callback/route": "./app/api/auth/prospectus/callback/route.ts",
+    "./app/api/auth/prospectus/selection/route": "./app/api/auth/prospectus/selection/route.ts",
+    "./app/api/auth/prospectus/session/route": "./app/api/auth/prospectus/session/route.ts",
+    "./app/api/auth/prospectus/sign-in/route": "./app/api/auth/prospectus/sign-in/route.ts",
+    "./app/api/auth/prospectus/sign-out/route": "./app/api/auth/prospectus/sign-out/route.ts",
     "./app/api/cyclotron/priming-proof/route": "./app/api/cyclotron/priming-proof/route.ts",
     "./app/api/media/[...path]/route": "./app/api/media/[...path]/route.ts",
     "./app/api/revalidate/route": "./app/api/revalidate/route.ts",
@@ -331,13 +340,14 @@
       "optional": true
     }
   },
-  "version": "1.0.0-next.62",
+  "version": "1.0.0-next.64",
   "dependencies": {
     "@aws-amplify/adapter-nextjs": "^1.7.3",
     "@aws-crypto/sha256-js": "5.2.0",
     "@aws-sdk/client-cognito-identity-provider": "3.1045.0",
     "@aws-sdk/client-lambda": "^3.1045.0",
     "@aws-sdk/client-s3": "^3.1045.0",
+    "@aws-sdk/client-secrets-manager": "3.1045.0",
     "@aws-sdk/client-ssm": "^3.1045.0",
     "@aws-sdk/credential-provider-node": "3.972.84",
     "@aws-sdk/s3-request-presigner": "^3.1045.0",

package/routes.manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.0.0-next.62",
+  "version": "1.0.0-next.64",
   "routes": [
     {
       "file": "app/%5F_preview/[[...path]]/route.ts",
@@ -66,6 +66,61 @@
         "revalidate": "60"
       }
     },
+    {
+      "file": "app/api/auth/prospectus/callback/route.ts",
+      "hasDefault": false,
+      "exports": [
+        "GET"
+      ],
+      "config": {
+        "dynamic": "\"force-dynamic\"",
+        "runtime": "\"nodejs\""
+      }
+    },
+    {
+      "file": "app/api/auth/prospectus/selection/route.ts",
+      "hasDefault": false,
+      "exports": [
+        "POST"
+      ],
+      "config": {
+        "dynamic": "\"force-dynamic\"",
+        "runtime": "\"nodejs\""
+      }
+    },
+    {
+      "file": "app/api/auth/prospectus/session/route.ts",
+      "hasDefault": false,
+      "exports": [
+        "GET"
+      ],
+      "config": {
+        "dynamic": "\"force-dynamic\"",
+        "runtime": "\"nodejs\""
+      }
+    },
+    {
+      "file": "app/api/auth/prospectus/sign-in/route.ts",
+      "hasDefault": false,
+      "exports": [
+        "GET"
+      ],
+      "config": {
+        "dynamic": "\"force-dynamic\"",
+        "runtime": "\"nodejs\""
+      }
+    },
+    {
+      "file": "app/api/auth/prospectus/sign-out/route.ts",
+      "hasDefault": false,
+      "exports": [
+        "POST"
+      ],
+      "config": {
+        "dynamic": "\"force-dynamic\"",
+        "runtime": "\"nodejs\""
+      }
+    },
     {
       "file": "app/api/cyclotron/priming-proof/route.ts",
       "hasDefault": false,