@anthusai/papyrus 1.0.0-next.63 → 1.0.0-next.64

package/amplify/auth/prospectus-google-client.js

@@ -0,0 +1,66 @@
+import { CfnOutput } from "aws-cdk-lib";
+import { CfnUserPoolClient, CfnUserPoolIdentityProvider } from "aws-cdk-lib/aws-cognito";
+/**
+ * The Google-only app client a Papyrus site registers with Prospectus
+ * (Prospectus docs/accounts/GOOGLE_IDENTITY.md, policy google-only-unlinked-v1).
+ * It lives on the site's existing user pool next to the email + Google web
+ * client, but admits only the built-in Google provider through code + PKCE from
+ * the site server, with every native, SRP, custom and client-credentials path
+ * left off. Sessions last one access token: the server keeps no refresh token.
+ */
+export const PROSPECTUS_SIGN_IN_CALLBACK_PATH = "/api/auth/prospectus/callback";
+export const PROSPECTUS_SIGN_IN_TOKEN_VALIDITY_MINUTES = 60;
+export function prospectusSignInCallbackUrls(redirectUrls) {
+    const origins = [];
+    for (const redirectUrl of redirectUrls) {
+        try {
+            const origin = new URL(redirectUrl).origin;
+            if (origin !== "null" && !origins.includes(origin))
+                origins.push(origin);
+        }
+        catch {
+            continue;
+        }
+    }
+    return origins.map((origin) => `${origin}${PROSPECTUS_SIGN_IN_CALLBACK_PATH}`);
+}
+export function prospectusSignInLogoutUrls(redirectUrls) {
+    return prospectusSignInCallbackUrls(redirectUrls).map((callbackUrl) => `${new URL(callbackUrl).origin}/`);
+}
+export function addProspectusGoogleOnlyClient(authStack, userPool, redirectUrls) {
+    const callbackUrls = prospectusSignInCallbackUrls(redirectUrls);
+    if (callbackUrls.length === 0)
+        throw new Error("The Prospectus Google-only client needs at least one site origin.");
+    const googleOnlyClient = new CfnUserPoolClient(authStack, "ProspectusGoogleOnlyClient", {
+        userPoolId: userPool.userPoolId,
+        clientName: "prospectus-google-only",
+        generateSecret: false,
+        supportedIdentityProviders: ["Google"],
+        allowedOAuthFlowsUserPoolClient: true,
+        allowedOAuthFlows: ["code"],
+        allowedOAuthScopes: ["openid", "email", "profile"],
+        callbackUrLs: callbackUrls,
+        logoutUrLs: prospectusSignInLogoutUrls(redirectUrls),
+        explicitAuthFlows: ["ALLOW_REFRESH_TOKEN_AUTH"],
+        enableTokenRevocation: true,
+        preventUserExistenceErrors: "ENABLED",
+        accessTokenValidity: PROSPECTUS_SIGN_IN_TOKEN_VALIDITY_MINUTES,
+        idTokenValidity: PROSPECTUS_SIGN_IN_TOKEN_VALIDITY_MINUTES,
+        refreshTokenValidity: PROSPECTUS_SIGN_IN_TOKEN_VALIDITY_MINUTES,
+        tokenValidityUnits: { accessToken: "minutes", idToken: "minutes", refreshToken: "minutes" },
+    });
+    const googleIdentityProviders = authStack.node
+        .findAll()
+        .filter((construct) => construct instanceof CfnUserPoolIdentityProvider && construct.providerName === "Google");
+    for (const googleIdentityProvider of googleIdentityProviders)
+        googleOnlyClient.addDependency(googleIdentityProvider);
+    new CfnOutput(authStack, "ProspectusGoogleOnlyClientId", {
+        value: googleOnlyClient.ref,
+        description: "clientId for this site's Prospectus registration (accounts/papyrus-sites.json)",
+    });
+    new CfnOutput(authStack, "ProspectusGoogleOnlyIssuer", {
+        value: `https://cognito-idp.${authStack.region}.amazonaws.com/${userPool.userPoolId}`,
+        description: "issuer for this site's Prospectus registration (accounts/papyrus-sites.json)",
+    });
+    return googleOnlyClient;
+}

package/amplify/auth/prospectus-google-client.ts

@@ -0,0 +1,71 @@
+import { CfnOutput, type Stack } from "aws-cdk-lib";
+import { CfnUserPoolClient, CfnUserPoolIdentityProvider, type IUserPool } from "aws-cdk-lib/aws-cognito";
+
+/**
+ * The Google-only app client a Papyrus site registers with Prospectus
+ * (Prospectus docs/accounts/GOOGLE_IDENTITY.md, policy google-only-unlinked-v1).
+ * It lives on the site's existing user pool next to the email + Google web
+ * client, but admits only the built-in Google provider through code + PKCE from
+ * the site server, with every native, SRP, custom and client-credentials path
+ * left off. Sessions last one access token: the server keeps no refresh token.
+ */
+export const PROSPECTUS_SIGN_IN_CALLBACK_PATH = "/api/auth/prospectus/callback";
+export const PROSPECTUS_SIGN_IN_TOKEN_VALIDITY_MINUTES = 60;
+
+export function prospectusSignInCallbackUrls(redirectUrls: readonly string[]): string[] {
+  const origins: string[] = [];
+  for (const redirectUrl of redirectUrls) {
+    try {
+      const origin = new URL(redirectUrl).origin;
+      if (origin !== "null" && !origins.includes(origin)) origins.push(origin);
+    } catch {
+      continue;
+    }
+  }
+  return origins.map((origin) => `${origin}${PROSPECTUS_SIGN_IN_CALLBACK_PATH}`);
+}
+
+export function prospectusSignInLogoutUrls(redirectUrls: readonly string[]): string[] {
+  return prospectusSignInCallbackUrls(redirectUrls).map((callbackUrl) => `${new URL(callbackUrl).origin}/`);
+}
+
+export function addProspectusGoogleOnlyClient(
+  authStack: Stack,
+  userPool: IUserPool,
+  redirectUrls: readonly string[],
+): CfnUserPoolClient {
+  const callbackUrls = prospectusSignInCallbackUrls(redirectUrls);
+  if (callbackUrls.length === 0) throw new Error("The Prospectus Google-only client needs at least one site origin.");
+  const googleOnlyClient = new CfnUserPoolClient(authStack, "ProspectusGoogleOnlyClient", {
+    userPoolId: userPool.userPoolId,
+    clientName: "prospectus-google-only",
+    generateSecret: false,
+    supportedIdentityProviders: ["Google"],
+    allowedOAuthFlowsUserPoolClient: true,
+    allowedOAuthFlows: ["code"],
+    allowedOAuthScopes: ["openid", "email", "profile"],
+    callbackUrLs: callbackUrls,
+    logoutUrLs: prospectusSignInLogoutUrls(redirectUrls),
+    explicitAuthFlows: ["ALLOW_REFRESH_TOKEN_AUTH"],
+    enableTokenRevocation: true,
+    preventUserExistenceErrors: "ENABLED",
+    accessTokenValidity: PROSPECTUS_SIGN_IN_TOKEN_VALIDITY_MINUTES,
+    idTokenValidity: PROSPECTUS_SIGN_IN_TOKEN_VALIDITY_MINUTES,
+    refreshTokenValidity: PROSPECTUS_SIGN_IN_TOKEN_VALIDITY_MINUTES,
+    tokenValidityUnits: { accessToken: "minutes", idToken: "minutes", refreshToken: "minutes" },
+  });
+  const googleIdentityProviders = authStack.node
+    .findAll()
+    .filter((construct): construct is CfnUserPoolIdentityProvider => construct instanceof CfnUserPoolIdentityProvider && construct.providerName === "Google");
+  for (const googleIdentityProvider of googleIdentityProviders) googleOnlyClient.addDependency(googleIdentityProvider);
+
+  new CfnOutput(authStack, "ProspectusGoogleOnlyClientId", {
+    value: googleOnlyClient.ref,
+    description: "clientId for this site's Prospectus registration (accounts/papyrus-sites.json)",
+  });
+  new CfnOutput(authStack, "ProspectusGoogleOnlyIssuer", {
+    value: `https://cognito-idp.${authStack.region}.amazonaws.com/${userPool.userPoolId}`,
+    description: "issuer for this site's Prospectus registration (accounts/papyrus-sites.json)",
+  });
+  return googleOnlyClient;
+}

package/amplify/auth/resource.js

@@ -32,8 +32,11 @@ export function authConfigFromEnv() {
         applyCognitoDomainPrefix: process.env.PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX === "true",
     };
 }
+export function siteAuthRedirectUrls(config) {
+    return config.redirectUrls ?? DEFAULT_AUTH_REDIRECT_URLS;
+}
 export function defineSiteAuth(config) {
-    const authRedirectUrls = expandNewsroomRedirectUrls(config.redirectUrls ?? DEFAULT_AUTH_REDIRECT_URLS, config.newsroomBasePath);
+    const authRedirectUrls = expandNewsroomRedirectUrls(siteAuthRedirectUrls(config), config.newsroomBasePath);
     const disableGoogleOAuth = config.disableGoogleOAuth === true;
     return defineAuth({
         loginWith: {

package/amplify/auth/resource.ts

@@ -37,9 +37,13 @@ export function authConfigFromEnv(): PapyrusAuthConfig {
   };
 }
 
+export function siteAuthRedirectUrls(config: PapyrusAuthConfig): string[] {
+  return config.redirectUrls ?? DEFAULT_AUTH_REDIRECT_URLS;
+}
+
 export function defineSiteAuth(config: PapyrusAuthConfig) {
   const authRedirectUrls = expandNewsroomRedirectUrls(
-    config.redirectUrls ?? DEFAULT_AUTH_REDIRECT_URLS,
+    siteAuthRedirectUrls(config),
     config.newsroomBasePath,
   );
   const disableGoogleOAuth = config.disableGoogleOAuth === true;

package/amplify/site-backend.js

@@ -17,7 +17,8 @@ import { assertValidPublicationConfig } from "./site-backend-config.js";
 import { revalidateSecretReadStatement } from "./revalidate-secret-policy.js";
 import { revalidateDistributionEnvironment, revalidateInvalidationStatement, validateRevalidateDistributionIds, } from "./revalidate-invalidation-settings.js";
 import { addInvalidationPathAlarm } from "./publication/invalidation-alarm.js";
-import { applyCognitoDomainPrefix, authConfigFromEnv, defineSiteAuth } from "./auth/resource.js";
+import { applyCognitoDomainPrefix, authConfigFromEnv, defineSiteAuth, siteAuthRedirectUrls } from "./auth/resource.js";
+import { PROSPECTUS_SIGN_IN_CALLBACK_PATH, addProspectusGoogleOnlyClient } from "./auth/prospectus-google-client.js";
 import { defineSiteData } from "./data/resource.js";
 import { resolvePlugins } from "./plugins/registry.js";
 import { wirePlugins } from "./plugins/wire.js";
@@ -107,6 +108,9 @@ export function defineSiteBackend(papyrusSite) {
         && authConfig.disableGoogleOAuth !== true) {
         applyCognitoDomainPrefix(backend.auth.stack, requestedCognitoDomainPrefix);
     }
+    const prospectusGoogleOnlyClient = authConfig.disableGoogleOAuth === true
+        ? undefined
+        : addProspectusGoogleOnlyClient(backend.auth.stack, backend.auth.resources.userPool, siteAuthRedirectUrls(authConfig));
     const amplifyBackendDir = dirname(fileURLToPath(import.meta.url));
     // Repo root in a Papyrus checkout; package root when installed from npm.
     const projectRoot = resolve(amplifyBackendDir, "..");
@@ -546,6 +550,9 @@ export function defineSiteBackend(papyrusSite) {
     }));
     backend.addOutput({
         custom: {
+            prospectusSignIn: prospectusGoogleOnlyClient
+                ? { clientId: prospectusGoogleOnlyClient.ref, callbackPath: PROSPECTUS_SIGN_IN_CALLBACK_PATH }
+                : null,
             inboundEmail: enableInboundEmail
                 ? {
                     domain: inboundEmailDomain,

package/amplify/site-backend.ts

@@ -24,7 +24,8 @@ import {
   validateRevalidateDistributionIds,
 } from "./revalidate-invalidation-settings";
 import { addInvalidationPathAlarm } from "./publication/invalidation-alarm";
-import { applyCognitoDomainPrefix, authConfigFromEnv, defineSiteAuth } from "./auth/resource";
+import { applyCognitoDomainPrefix, authConfigFromEnv, defineSiteAuth, siteAuthRedirectUrls } from "./auth/resource";
+import { PROSPECTUS_SIGN_IN_CALLBACK_PATH, addProspectusGoogleOnlyClient } from "./auth/prospectus-google-client";
 import { defineSiteData } from "./data/resource";
 import { resolvePlugins } from "./plugins/registry";
 import { wirePlugins } from "./plugins/wire";
@@ -137,6 +138,10 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
     applyCognitoDomainPrefix(backend.auth.stack, requestedCognitoDomainPrefix);
   }
 
+  const prospectusGoogleOnlyClient = authConfig.disableGoogleOAuth === true
+    ? undefined
+    : addProspectusGoogleOnlyClient(backend.auth.stack, backend.auth.resources.userPool, siteAuthRedirectUrls(authConfig));
+
   const amplifyBackendDir = dirname(fileURLToPath(import.meta.url));
   // Repo root in a Papyrus checkout; package root when installed from npm.
   const projectRoot = resolve(amplifyBackendDir, "..");
@@ -682,6 +687,9 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
 
   backend.addOutput({
     custom: {
+      prospectusSignIn: prospectusGoogleOnlyClient
+        ? { clientId: prospectusGoogleOnlyClient.ref, callbackPath: PROSPECTUS_SIGN_IN_CALLBACK_PATH }
+        : null,
       inboundEmail: enableInboundEmail
         ? {
             domain: inboundEmailDomain,

package/app/api/auth/prospectus/callback/route.ts

@@ -0,0 +1,9 @@
+import type { NextRequest } from "next/server";
+import { handleProspectusSignInCallback } from "../../../../../lib/prospectus-sign-in-routes";
+
+export const dynamic = "force-dynamic";
+export const runtime = "nodejs";
+
+export function GET(request: NextRequest) {
+  return handleProspectusSignInCallback(request);
+}

package/app/api/auth/prospectus/selection/route.ts

@@ -0,0 +1,9 @@
+import type { NextRequest } from "next/server";
+import { handleProspectusAccountSelection } from "../../../../../lib/prospectus-sign-in-routes";
+
+export const dynamic = "force-dynamic";
+export const runtime = "nodejs";
+
+export function POST(request: NextRequest) {
+  return handleProspectusAccountSelection(request);
+}

package/app/api/auth/prospectus/session/route.ts

@@ -0,0 +1,9 @@
+import type { NextRequest } from "next/server";
+import { handleProspectusSessionRead } from "../../../../../lib/prospectus-sign-in-routes";
+
+export const dynamic = "force-dynamic";
+export const runtime = "nodejs";
+
+export function GET(request: NextRequest) {
+  return handleProspectusSessionRead(request);
+}

package/app/api/auth/prospectus/sign-in/route.ts

@@ -0,0 +1,9 @@
+import type { NextRequest } from "next/server";
+import { handleProspectusSignInStart } from "../../../../../lib/prospectus-sign-in-routes";
+
+export const dynamic = "force-dynamic";
+export const runtime = "nodejs";
+
+export function GET(request: NextRequest) {
+  return handleProspectusSignInStart(request);
+}

package/app/api/auth/prospectus/sign-out/route.ts

@@ -0,0 +1,9 @@
+import type { NextRequest } from "next/server";
+import { handleProspectusSignOut } from "../../../../../lib/prospectus-sign-in-routes";
+
+export const dynamic = "force-dynamic";
+export const runtime = "nodejs";
+
+export function POST(request: NextRequest) {
+  return handleProspectusSignOut(request);
+}

package/infra/amplify-app-shell.js

@@ -1,6 +1,7 @@
 import { ArnFormat, CfnOutput, Duration, Fn, Stack } from "aws-cdk-lib";
 import * as iam from "aws-cdk-lib/aws-iam";
 import * as amplify from "aws-cdk-lib/aws-amplify";
+import * as secretsmanager from "aws-cdk-lib/aws-secretsmanager";
 import { GITHUB_OIDC_PROVIDER_HOST } from "./github-oidc-provider.js";
 import { cmsProductionBuildSpec, cmsStagingBuildSpec, readerBuildSpec } from "./build-specs.js";
 import { PROSPECTUS_PAPYRUS_SITE_ROUTES, hasCmsApp, isStagingEnabled, resolveRedirectSubDomainPrefix, resolveCmsHostName, resolveProspectusAccountsEndpoint, resolveRevalidateSecretParameterName, resolveStackName, resolveStagingDomainName, resolveStoragePreviewPrefix } from "./site-config.js";
@@ -86,9 +87,26 @@ export class AmplifyAppShellStack extends Stack {
             }));
         }
         const prospectusAccountsApiStageArn = config.cms.prospectusAccountsApiStageArn;
-        const prospectusEnvironment = prospectusAccountsApiStageArn
-            ? { PAPYRUS_PROSPECTUS_ACCOUNTS_ENDPOINT: resolveProspectusAccountsEndpoint(prospectusAccountsApiStageArn) }
+        const prospectusSessionSealingSecret = prospectusAccountsApiStageArn
+            ? new secretsmanager.Secret(this, "ProspectusSessionSealingSecret", {
+                description: `Seals the Prospectus sign-in cookies of ${cmsAppName}; replacing it signs everyone out`,
+                generateSecretString: { passwordLength: 64, excludePunctuation: true },
+            })
+            : undefined;
+        const prospectusEnvironment = prospectusAccountsApiStageArn && prospectusSessionSealingSecret
+            ? {
+                PAPYRUS_PROSPECTUS_ACCOUNTS_ENDPOINT: resolveProspectusAccountsEndpoint(prospectusAccountsApiStageArn),
+                PAPYRUS_PROSPECTUS_SESSION_SECRET_ARN: prospectusSessionSealingSecret.secretArn,
+                PAPYRUS_PROSPECTUS_SITE_PRODUCT: `papyrus-${config.siteId}`,
+            }
             : {};
+        if (prospectusSessionSealingSecret) {
+            computeRole.addToPolicy(new iam.PolicyStatement({
+                sid: "ReadProspectusSessionSealingSecret",
+                actions: ["secretsmanager:GetSecretValue"],
+                resources: [prospectusSessionSealingSecret.secretArn],
+            }));
+        }
         if (prospectusAccountsApiStageArn) {
             computeRole.addToPolicy(new iam.PolicyStatement({
                 sid: "InvokeProspectusAccountsAsRegisteredSite",

package/infra/amplify-app-shell.ts

@@ -2,6 +2,7 @@ import { Construct } from "constructs";
 import { ArnFormat, CfnOutput, Duration, Fn, Stack, StackProps } from "aws-cdk-lib";
 import * as iam from "aws-cdk-lib/aws-iam";
 import * as amplify from "aws-cdk-lib/aws-amplify";
+import * as secretsmanager from "aws-cdk-lib/aws-secretsmanager";
 import { GITHUB_OIDC_PROVIDER_HOST } from "./github-oidc-provider";
 import { cmsProductionBuildSpec, cmsStagingBuildSpec, readerBuildSpec } from "./build-specs";
 import { AmplifyAppShellSiteConfig, PROSPECTUS_PAPYRUS_SITE_ROUTES, ReaderCustomHeaderRule, hasCmsApp, isStagingEnabled, resolveRedirectSubDomainPrefix, resolveCmsHostName, resolveProspectusAccountsEndpoint, resolveRevalidateSecretParameterName, resolveStackName, resolveStagingDomainName, resolveStoragePreviewPrefix } from "./site-config";
@@ -97,9 +98,28 @@ export class AmplifyAppShellStack extends Stack {
     }
 
     const prospectusAccountsApiStageArn = config.cms.prospectusAccountsApiStageArn;
-    const prospectusEnvironment = prospectusAccountsApiStageArn
-      ? { PAPYRUS_PROSPECTUS_ACCOUNTS_ENDPOINT: resolveProspectusAccountsEndpoint(prospectusAccountsApiStageArn) }
+    const prospectusSessionSealingSecret = prospectusAccountsApiStageArn
+      ? new secretsmanager.Secret(this, "ProspectusSessionSealingSecret", {
+        description: `Seals the Prospectus sign-in cookies of ${cmsAppName}; replacing it signs everyone out`,
+        generateSecretString: { passwordLength: 64, excludePunctuation: true },
+      })
+      : undefined;
+    const prospectusEnvironment = prospectusAccountsApiStageArn && prospectusSessionSealingSecret
+      ? {
+        PAPYRUS_PROSPECTUS_ACCOUNTS_ENDPOINT: resolveProspectusAccountsEndpoint(prospectusAccountsApiStageArn),
+        PAPYRUS_PROSPECTUS_SESSION_SECRET_ARN: prospectusSessionSealingSecret.secretArn,
+        PAPYRUS_PROSPECTUS_SITE_PRODUCT: `papyrus-${config.siteId}`,
+      }
       : {};
+    if (prospectusSessionSealingSecret) {
+      computeRole.addToPolicy(
+        new iam.PolicyStatement({
+          sid: "ReadProspectusSessionSealingSecret",
+          actions: ["secretsmanager:GetSecretValue"],
+          resources: [prospectusSessionSealingSecret.secretArn],
+        }),
+      );
+    }
     if (prospectusAccountsApiStageArn) {
       computeRole.addToPolicy(
         new iam.PolicyStatement({

package/infra/site-config.js

@@ -17,7 +17,7 @@ const GITHUB_REPO_PATTERN = /^[A-Za-z0-9_.-]+$/;
 const COGNITO_DOMAIN_PREFIX_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
 const COGNITO_RESERVED_WORDS = ["aws", "amazon", "cognito"];
 const PROSPECTUS_ACCOUNTS_API_STAGE_ARN_PATTERN = /^arn:aws:execute-api:[a-z0-9-]+:\d{12}:[a-z0-9]+\/api$/;
-const TEMPLATE_MANAGED_ENVIRONMENT_KEYS = ["PAPYRUS_COGNITO_DOMAIN_PREFIX", "PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX", "PAPYRUS_DISABLE_GOOGLE_OAUTH", "PAPYRUS_REVALIDATE_SECRET_PARAMETER", "PAPYRUS_PROSPECTUS_ACCOUNTS_ENDPOINT"];
+const TEMPLATE_MANAGED_ENVIRONMENT_KEYS = ["PAPYRUS_COGNITO_DOMAIN_PREFIX", "PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX", "PAPYRUS_DISABLE_GOOGLE_OAUTH", "PAPYRUS_REVALIDATE_SECRET_PARAMETER", "PAPYRUS_PROSPECTUS_ACCOUNTS_ENDPOINT", "PAPYRUS_PROSPECTUS_SESSION_SECRET_ARN", "PAPYRUS_PROSPECTUS_SITE_PRODUCT"];
 /** Routes Prospectus admits for a registered Papyrus site (Prospectus accounts/papyrus-sites.ts). */
 export const PROSPECTUS_PAPYRUS_SITE_ROUTES = [
     "GET/v1/identities/me",

package/infra/site-config.ts

@@ -97,7 +97,7 @@ const GITHUB_REPO_PATTERN = /^[A-Za-z0-9_.-]+$/;
 const COGNITO_DOMAIN_PREFIX_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
 const COGNITO_RESERVED_WORDS = ["aws", "amazon", "cognito"];
 const PROSPECTUS_ACCOUNTS_API_STAGE_ARN_PATTERN = /^arn:aws:execute-api:[a-z0-9-]+:\d{12}:[a-z0-9]+\/api$/;
-const TEMPLATE_MANAGED_ENVIRONMENT_KEYS = ["PAPYRUS_COGNITO_DOMAIN_PREFIX", "PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX", "PAPYRUS_DISABLE_GOOGLE_OAUTH", "PAPYRUS_REVALIDATE_SECRET_PARAMETER", "PAPYRUS_PROSPECTUS_ACCOUNTS_ENDPOINT"];
+const TEMPLATE_MANAGED_ENVIRONMENT_KEYS = ["PAPYRUS_COGNITO_DOMAIN_PREFIX", "PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX", "PAPYRUS_DISABLE_GOOGLE_OAUTH", "PAPYRUS_REVALIDATE_SECRET_PARAMETER", "PAPYRUS_PROSPECTUS_ACCOUNTS_ENDPOINT", "PAPYRUS_PROSPECTUS_SESSION_SECRET_ARN", "PAPYRUS_PROSPECTUS_SITE_PRODUCT"];
 
 /** Routes Prospectus admits for a registered Papyrus site (Prospectus accounts/papyrus-sites.ts). */
 export const PROSPECTUS_PAPYRUS_SITE_ROUTES = [

package/lib/prospectus-publication-access.ts

@@ -0,0 +1,53 @@
+import type { ProspectusDirectoryAccount, ProspectusRole } from "./prospectus-site-identity";
+
+/**
+ * What a person may do on this site's publications, decided by Papyrus from the
+ * role Prospectus gives them on an account, never more than that role allows.
+ * An account publishes on this site when its `papyrus-<siteId>` product is
+ * active. For now every member gets their role's capabilities on all of the
+ * account's publications (Ryan, 2026-10-17: role now, per-person grants later);
+ * src/papyrus_content/prospectus_publication_access.py applies the same table
+ * where the curation tools run.
+ */
+export type PublicationCapability = "read" | "review" | "decide" | "steer";
+
+export const PROSPECTUS_ROLE_PUBLICATION_CAPABILITIES: Record<ProspectusRole, readonly PublicationCapability[]> = {
+  viewer: ["read"],
+  member: ["read", "review", "decide"],
+  admin: ["read", "review", "decide", "steer"],
+  owner: ["read", "review", "decide", "steer"],
+};
+
+export const PROSPECTUS_SITE_PRODUCT_ENV = "PAPYRUS_PROSPECTUS_SITE_PRODUCT";
+
+export interface PublishingAccountAccess {
+  accountId: string;
+  accountName: string;
+  role: ProspectusRole;
+  publicationCapabilities: PublicationCapability[];
+}
+
+export function publicationCapabilitiesForProspectusRole(role: string): PublicationCapability[] {
+  return [...(PROSPECTUS_ROLE_PUBLICATION_CAPABILITIES[role as ProspectusRole] ?? [])];
+}
+
+export function prospectusSiteProduct(environment: Record<string, string | undefined> = process.env): string | null {
+  const siteProduct = environment[PROSPECTUS_SITE_PRODUCT_ENV]?.trim();
+  return siteProduct && siteProduct.startsWith("papyrus-") ? siteProduct : null;
+}
+
+export function publishingAccountsForSite(
+  accounts: readonly ProspectusDirectoryAccount[],
+  siteProduct: string | null,
+): PublishingAccountAccess[] {
+  if (!siteProduct) return [];
+  return accounts
+    .filter((account) => account.products.some((product) => product.product === siteProduct && product.status === "active"))
+    .map((account) => ({
+      accountId: account.id,
+      accountName: account.name,
+      role: account.role,
+      publicationCapabilities: publicationCapabilitiesForProspectusRole(account.role),
+    }))
+    .filter((access) => access.publicationCapabilities.length > 0);
+}

package/lib/prospectus-session.ts

@@ -0,0 +1,196 @@
+import { createCipheriv, createDecipheriv, hkdfSync, randomBytes } from "node:crypto";
+import { GetSecretValueCommand, SecretsManagerClient } from "@aws-sdk/client-secrets-manager";
+import { readAmplifyOutputsFile } from "./amplify-outputs-path";
+import {
+  ProspectusSiteAccounts,
+  signedProspectusTransport,
+  type GoogleOnlyCognitoClient,
+  type PendingProspectusSignIn,
+  type ProspectusTransport,
+} from "./prospectus-site-identity";
+
+/**
+ * Browser state for signing in through Prospectus, kept in two sealed cookies so
+ * the site holds no session table. The pending cookie carries one sign-in
+ * attempt (challenge, state, PKCE verifier) from the redirect to the callback;
+ * the session cookie carries the signed-in person and their Cognito access token
+ * until that token expires. Both are AES-256-GCM sealed with a per-cookie key
+ * derived from the site's generated sealing secret, and bound to the cookie name
+ * so one cannot be replayed as the other.
+ */
+export const PROSPECTUS_PENDING_SIGN_IN_COOKIE = "__Host-papyrus-prospectus-pending";
+export const PROSPECTUS_SESSION_COOKIE = "__Host-papyrus-prospectus-session";
+export const PROSPECTUS_ACCOUNTS_ENDPOINT_ENV = "PAPYRUS_PROSPECTUS_ACCOUNTS_ENDPOINT";
+export const PROSPECTUS_SESSION_SECRET_ARN_ENV = "PAPYRUS_PROSPECTUS_SESSION_SECRET_ARN";
+export const PROSPECTUS_SESSION_SECRET_CACHE_MILLISECONDS = 5 * 60 * 1000;
+
+const SEALED_COOKIE_FORMAT_VERSION = "v1";
+const SEALED_COOKIE_KEY_DERIVATION_SALT = "papyrus-prospectus-cookie";
+const GCM_INITIALIZATION_VECTOR_BYTES = 12;
+const GCM_AUTHENTICATION_TAG_BYTES = 16;
+const MINIMUM_SEALING_SECRET_LENGTH = 32;
+
+export interface PendingProspectusSignInCookie extends PendingProspectusSignIn {
+  returnPath: string;
+}
+
+export interface ProspectusSignedInSession {
+  personId: string;
+  accessToken: string;
+  accessTokenExpiresAt: number;
+  selectedAccountId?: string;
+}
+
+function sealingKeyForCookie(sealingSecret: string, cookieName: string): Buffer {
+  if (sealingSecret.length < MINIMUM_SEALING_SECRET_LENGTH) throw new Error("The Prospectus session sealing secret is too short.");
+  return Buffer.from(hkdfSync("sha256", sealingSecret, SEALED_COOKIE_KEY_DERIVATION_SALT, cookieName, 32));
+}
+
+export function sealProspectusCookie(sealingSecret: string, cookieName: string, payload: object, expiresAtSeconds: number): string {
+  const initializationVector = randomBytes(GCM_INITIALIZATION_VECTOR_BYTES);
+  const cipher = createCipheriv("aes-256-gcm", sealingKeyForCookie(sealingSecret, cookieName), initializationVector);
+  cipher.setAAD(Buffer.from(cookieName));
+  const ciphertext = Buffer.concat([cipher.update(JSON.stringify({ payload, expiresAtSeconds })), cipher.final()]);
+  return `${SEALED_COOKIE_FORMAT_VERSION}.${Buffer.concat([initializationVector, ciphertext, cipher.getAuthTag()]).toString("base64url")}`;
+}
+
+export function openProspectusCookie<Payload>(
+  sealingSecret: string,
+  cookieName: string,
+  sealedValue: string | undefined,
+  nowInSeconds: number = Math.floor(Date.now() / 1000),
+): Payload | null {
+  if (!sealedValue?.startsWith(`${SEALED_COOKIE_FORMAT_VERSION}.`)) return null;
+  const sealedBytes = Buffer.from(sealedValue.slice(SEALED_COOKIE_FORMAT_VERSION.length + 1), "base64url");
+  if (sealedBytes.length <= GCM_INITIALIZATION_VECTOR_BYTES + GCM_AUTHENTICATION_TAG_BYTES) return null;
+  try {
+    const decipher = createDecipheriv(
+      "aes-256-gcm",
+      sealingKeyForCookie(sealingSecret, cookieName),
+      sealedBytes.subarray(0, GCM_INITIALIZATION_VECTOR_BYTES),
+    );
+    decipher.setAAD(Buffer.from(cookieName));
+    decipher.setAuthTag(sealedBytes.subarray(sealedBytes.length - GCM_AUTHENTICATION_TAG_BYTES));
+    const plaintext = Buffer.concat([
+      decipher.update(sealedBytes.subarray(GCM_INITIALIZATION_VECTOR_BYTES, sealedBytes.length - GCM_AUTHENTICATION_TAG_BYTES)),
+      decipher.final(),
+    ]).toString("utf8");
+    const { payload, expiresAtSeconds } = JSON.parse(plaintext) as { payload: Payload; expiresAtSeconds: number };
+    if (typeof expiresAtSeconds !== "number" || nowInSeconds >= expiresAtSeconds) return null;
+    return payload;
+  } catch {
+    return null;
+  }
+}
+
+export function sealedCookieAttributes(expiresAtSeconds: number, nowInSeconds: number = Math.floor(Date.now() / 1000)) {
+  return {
+    httpOnly: true,
+    secure: true,
+    sameSite: "lax" as const,
+    path: "/",
+    maxAge: Math.max(0, expiresAtSeconds - nowInSeconds),
+  };
+}
+
+export function sameSiteReturnPath(requestedReturnPath: string | null | undefined): string {
+  if (!requestedReturnPath || !requestedReturnPath.startsWith("/") || requestedReturnPath.startsWith("//")) return "/";
+  if (/[\\\u0000-\u001f]/.test(requestedReturnPath)) return "/";
+  const parsed = new URL(requestedReturnPath, "https://papyrus.invalid");
+  if (parsed.origin !== "https://papyrus.invalid") return "/";
+  return `${parsed.pathname}${parsed.search}${parsed.hash}`;
+}
+
+export type ProspectusSessionSecretReader = (secretArn: string) => Promise<string | null>;
+
+type CachedSealingSecret = { secretArn: string; value: string; expiresAt: number };
+
+let cachedSealingSecret: CachedSealingSecret | null = null;
+let defaultSecretsManagerClient: SecretsManagerClient | null = null;
+
+export function resetProspectusSessionSecretCache(): void {
+  cachedSealingSecret = null;
+}
+
+async function readSealingSecretFromSecretsManager(secretArn: string): Promise<string | null> {
+  defaultSecretsManagerClient ??= new SecretsManagerClient({});
+  const response = await defaultSecretsManagerClient.send(new GetSecretValueCommand({ SecretId: secretArn }));
+  return response.SecretString?.trim() || null;
+}
+
+export async function loadProspectusSessionSealingSecret(
+  options: { environment?: Record<string, string | undefined>; readSecret?: ProspectusSessionSecretReader; now?: number } = {},
+): Promise<string | null> {
+  const environment = options.environment ?? process.env;
+  const secretArn = environment[PROSPECTUS_SESSION_SECRET_ARN_ENV]?.trim();
+  if (!secretArn) return null;
+  const now = options.now ?? Date.now();
+  if (cachedSealingSecret && cachedSealingSecret.secretArn === secretArn && cachedSealingSecret.expiresAt > now) {
+    return cachedSealingSecret.value;
+  }
+  try {
+    const value = (await (options.readSecret ?? readSealingSecretFromSecretsManager)(secretArn))?.trim();
+    if (!value || value.length < MINIMUM_SEALING_SECRET_LENGTH) return null;
+    cachedSealingSecret = { secretArn, value, expiresAt: now + PROSPECTUS_SESSION_SECRET_CACHE_MILLISECONDS };
+    return value;
+  } catch (error) {
+    console.error(`Prospectus session sealing secret could not be read (${error instanceof Error ? error.name : "error"}).`);
+    return null;
+  }
+}
+
+export interface ProspectusSignInRuntime {
+  accounts: ProspectusSiteAccounts;
+  cognitoClient: GoogleOnlyCognitoClient;
+  sealingSecret: string;
+}
+
+interface AmplifyOutputsForProspectusSignIn {
+  auth?: { user_pool_id?: string; oauth?: { domain?: string } };
+  custom?: { prospectusSignIn?: { clientId?: string; callbackPath?: string } | null };
+}
+
+export function regionOfProspectusAccountsEndpoint(endpoint: string): string {
+  const match = /^[a-z0-9]+\.execute-api\.([a-z0-9-]+)\.amazonaws\.com$/.exec(new URL(endpoint).hostname);
+  if (!match) throw new Error("The Prospectus accounts endpoint is not an API Gateway execute-api host.");
+  return match[1];
+}
+
+export function googleOnlyCognitoClientFromOutputs(
+  amplifyOutputs: AmplifyOutputsForProspectusSignIn | null,
+  siteOrigin: string,
+): GoogleOnlyCognitoClient | null {
+  const userPoolId = amplifyOutputs?.auth?.user_pool_id;
+  const hostedUiDomain = amplifyOutputs?.auth?.oauth?.domain;
+  const prospectusSignIn = amplifyOutputs?.custom?.prospectusSignIn;
+  if (!userPoolId || !hostedUiDomain || !prospectusSignIn?.clientId || !prospectusSignIn.callbackPath) return null;
+  return {
+    hostedUiOrigin: `https://${hostedUiDomain}`,
+    userPoolId,
+    clientId: prospectusSignIn.clientId,
+    redirectUri: new URL(prospectusSignIn.callbackPath, siteOrigin).toString(),
+  };
+}
+
+export async function resolveProspectusSignInRuntime(
+  siteOrigin: string,
+  options: {
+    environment?: Record<string, string | undefined>;
+    amplifyOutputs?: AmplifyOutputsForProspectusSignIn | null;
+    readSecret?: ProspectusSessionSecretReader;
+    transport?: ProspectusTransport;
+  } = {},
+): Promise<ProspectusSignInRuntime | null> {
+  const environment = options.environment ?? process.env;
+  const endpoint = environment[PROSPECTUS_ACCOUNTS_ENDPOINT_ENV]?.trim();
+  if (!endpoint) return null;
+  const amplifyOutputs = options.amplifyOutputs !== undefined
+    ? options.amplifyOutputs
+    : (readAmplifyOutputsFile() as AmplifyOutputsForProspectusSignIn | null);
+  const cognitoClient = googleOnlyCognitoClientFromOutputs(amplifyOutputs, siteOrigin);
+  if (!cognitoClient) return null;
+  const sealingSecret = await loadProspectusSessionSealingSecret({ environment, readSecret: options.readSecret });
+  if (!sealingSecret) return null;
+  const transport = options.transport ?? signedProspectusTransport({ endpoint, region: regionOfProspectusAccountsEndpoint(endpoint) });
+  return { accounts: new ProspectusSiteAccounts(transport), cognitoClient, sealingSecret };
+}

package/lib/prospectus-sign-in-routes.ts

@@ -0,0 +1,284 @@
+import { NextResponse, type NextRequest } from "next/server";
+import {
+  CYCLOTRON_LAB_PRODUCT,
+  ProspectusAccountsError,
+  authorizeSignedInPersonForAccount,
+  beginProspectusGoogleSignIn,
+  completeProspectusGoogleSignIn,
+  type CompleteProspectusGoogleSignInInput,
+} from "./prospectus-site-identity";
+import {
+  PROSPECTUS_PENDING_SIGN_IN_COOKIE,
+  PROSPECTUS_SESSION_COOKIE,
+  openProspectusCookie,
+  resolveProspectusSignInRuntime,
+  sameSiteReturnPath,
+  sealProspectusCookie,
+  sealedCookieAttributes,
+  type PendingProspectusSignInCookie,
+  type ProspectusSignInRuntime,
+  type ProspectusSignedInSession,
+} from "./prospectus-session";
+import {
+  prospectusSiteProduct,
+  publicationCapabilitiesForProspectusRole,
+  publishingAccountsForSite,
+  type PublicationCapability,
+} from "./prospectus-publication-access";
+
+/**
+ * The site's sign-in routes for Prospectus accounts: start (challenge, then the
+ * Google-only Cognito redirect), callback (verify, resolve, seal the session),
+ * session (who is signed in and which accounts they belong to) and sign-out.
+ * Every route answers 503 until the site is registered and configured, so an
+ * unregistered deployment never half-signs anyone in.
+ */
+export interface ProspectusSignInRouteOptions {
+  resolveRuntime?: (siteOrigin: string) => Promise<ProspectusSignInRuntime | null>;
+  siteProduct?: string | null;
+  completionOverrides?: Pick<CompleteProspectusGoogleSignInInput, "verifyCognitoTokens" | "fetcher">;
+  nowInSeconds?: () => number;
+}
+
+const NO_STORE_HEADERS = { "cache-control": "no-store" };
+
+function siteProductFor(options: ProspectusSignInRouteOptions): string | null {
+  return options.siteProduct !== undefined ? options.siteProduct : prospectusSiteProduct();
+}
+
+function currentTimeInSeconds(options: ProspectusSignInRouteOptions): number {
+  return options.nowInSeconds?.() ?? Math.floor(Date.now() / 1000);
+}
+
+async function signInRuntimeFor(request: NextRequest, options: ProspectusSignInRouteOptions): Promise<ProspectusSignInRuntime | null> {
+  return (options.resolveRuntime ?? resolveProspectusSignInRuntime)(request.nextUrl.origin);
+}
+
+function signInUnavailableResponse(): NextResponse {
+  return NextResponse.json(
+    { error: "prospectus_sign_in_unavailable", message: "Sign-in through Prospectus is not configured for this site." },
+    { status: 503, headers: NO_STORE_HEADERS },
+  );
+}
+
+function clearSealedCookie(response: NextResponse, cookieName: string): void {
+  response.cookies.set(cookieName, "", sealedCookieAttributes(0, 0));
+}
+
+function signInFailedResponse(status: number, code: string, message: string): NextResponse {
+  return NextResponse.json({ error: code, message }, { status, headers: NO_STORE_HEADERS });
+}
+
+export function signedInProspectusSession(
+  request: NextRequest,
+  sealingSecret: string,
+  nowInSeconds?: number,
+): ProspectusSignedInSession | null {
+  return openProspectusCookie<ProspectusSignedInSession>(
+    sealingSecret,
+    PROSPECTUS_SESSION_COOKIE,
+    request.cookies.get(PROSPECTUS_SESSION_COOKIE)?.value,
+    nowInSeconds,
+  );
+}
+
+export async function handleProspectusSignInStart(request: NextRequest, options: ProspectusSignInRouteOptions = {}): Promise<NextResponse> {
+  const runtime = await signInRuntimeFor(request, options);
+  if (!runtime) return signInUnavailableResponse();
+  const { authorizationUrl, pendingSignIn } = await beginProspectusGoogleSignIn(runtime.accounts, runtime.cognitoClient);
+  const pendingSignInCookie: PendingProspectusSignInCookie = {
+    ...pendingSignIn,
+    returnPath: sameSiteReturnPath(request.nextUrl.searchParams.get("returnTo")),
+  };
+  const response = NextResponse.redirect(authorizationUrl, { status: 303, headers: NO_STORE_HEADERS });
+  response.cookies.set(
+    PROSPECTUS_PENDING_SIGN_IN_COOKIE,
+    sealProspectusCookie(runtime.sealingSecret, PROSPECTUS_PENDING_SIGN_IN_COOKIE, pendingSignInCookie, pendingSignIn.expiresAt),
+    sealedCookieAttributes(pendingSignIn.expiresAt, currentTimeInSeconds(options)),
+  );
+  return response;
+}
+
+export async function handleProspectusSignInCallback(request: NextRequest, options: ProspectusSignInRouteOptions = {}): Promise<NextResponse> {
+  const runtime = await signInRuntimeFor(request, options);
+  if (!runtime) return signInUnavailableResponse();
+  const nowInSeconds = currentTimeInSeconds(options);
+  const pendingSignIn = openProspectusCookie<PendingProspectusSignInCookie>(
+    runtime.sealingSecret,
+    PROSPECTUS_PENDING_SIGN_IN_COOKIE,
+    request.cookies.get(PROSPECTUS_PENDING_SIGN_IN_COOKIE)?.value,
+    nowInSeconds,
+  );
+  const response = await completeCallback(request, runtime, pendingSignIn, options, nowInSeconds);
+  clearSealedCookie(response, PROSPECTUS_PENDING_SIGN_IN_COOKIE);
+  return response;
+}
+
+async function completeCallback(
+  request: NextRequest,
+  runtime: ProspectusSignInRuntime,
+  pendingSignIn: PendingProspectusSignInCookie | null,
+  options: ProspectusSignInRouteOptions,
+  nowInSeconds: number,
+): Promise<NextResponse> {
+  if (!pendingSignIn) return signInFailedResponse(401, "sign_in_expired", "This sign-in is no longer pending. Start again.");
+  const searchParams = request.nextUrl.searchParams;
+  if (searchParams.get("error")) return signInFailedResponse(401, "sign_in_declined", "Google sign-in did not complete.");
+  const authorizationCode = searchParams.get("code");
+  const returnedState = searchParams.get("state");
+  if (!authorizationCode || !returnedState) return signInFailedResponse(400, "sign_in_incomplete", "The sign-in response is missing its code or state.");
+  try {
+    const signedIn = await completeProspectusGoogleSignIn({
+      accounts: runtime.accounts,
+      cognitoClient: runtime.cognitoClient,
+      pendingSignIn,
+      returnedState,
+      authorizationCode,
+      nowInSeconds,
+      ...options.completionOverrides,
+    });
+    const session: ProspectusSignedInSession = {
+      personId: signedIn.person.id,
+      accessToken: signedIn.accessToken,
+      accessTokenExpiresAt: signedIn.accessTokenExpiresAt,
+    };
+    const response = NextResponse.redirect(new URL(pendingSignIn.returnPath, request.nextUrl.origin), { status: 303, headers: NO_STORE_HEADERS });
+    response.cookies.set(
+      PROSPECTUS_SESSION_COOKIE,
+      sealProspectusCookie(runtime.sealingSecret, PROSPECTUS_SESSION_COOKIE, session, session.accessTokenExpiresAt),
+      sealedCookieAttributes(session.accessTokenExpiresAt, nowInSeconds),
+    );
+    return response;
+  } catch (error) {
+    if (error instanceof ProspectusAccountsError) return signInFailedResponse(error.status, error.code, error.message);
+    console.error(`Prospectus sign-in failed (${error instanceof Error ? error.name : "error"}).`);
+    return signInFailedResponse(401, "sign_in_failed", "Sign-in could not be completed.");
+  }
+}
+
+export async function handleProspectusSessionRead(request: NextRequest, options: ProspectusSignInRouteOptions = {}): Promise<NextResponse> {
+  const runtime = await signInRuntimeFor(request, options);
+  if (!runtime) return signInUnavailableResponse();
+  const session = signedInProspectusSession(request, runtime.sealingSecret, currentTimeInSeconds(options));
+  if (!session) return NextResponse.json({ signedIn: false }, { headers: NO_STORE_HEADERS });
+  try {
+    const directory = await runtime.accounts.accountDirectory(session.accessToken);
+    if (!directory.person || directory.person.id !== session.personId) {
+      const response = NextResponse.json({ signedIn: false }, { headers: NO_STORE_HEADERS });
+      clearSealedCookie(response, PROSPECTUS_SESSION_COOKIE);
+      return response;
+    }
+    const publishingAccounts = publishingAccountsForSite(directory.accounts, siteProductFor(options));
+    return NextResponse.json(
+      {
+        signedIn: true,
+        person: directory.person,
+        accounts: directory.accounts,
+        cyclotronLabAccess: directory.accounts.some((account) =>
+          account.products.some((product) => product.product === CYCLOTRON_LAB_PRODUCT && product.status === "active"),
+        ),
+        publishingAccounts,
+        selectedAccountId: publishingAccounts.some((account) => account.accountId === session.selectedAccountId)
+          ? session.selectedAccountId
+          : null,
+      },
+      { headers: NO_STORE_HEADERS },
+    );
+  } catch (error) {
+    if (error instanceof ProspectusAccountsError && error.status === 401) {
+      const response = NextResponse.json({ signedIn: false }, { headers: NO_STORE_HEADERS });
+      clearSealedCookie(response, PROSPECTUS_SESSION_COOKIE);
+      return response;
+    }
+    if (error instanceof ProspectusAccountsError) return signInFailedResponse(error.status, error.code, error.message);
+    console.error(`Prospectus account directory failed (${error instanceof Error ? error.name : "error"}).`);
+    return signInFailedResponse(503, "prospectus_unavailable", "Prospectus could not be reached.");
+  }
+}
+
+export async function handleProspectusSignOut(request: NextRequest, options: ProspectusSignInRouteOptions = {}): Promise<NextResponse> {
+  const runtime = await signInRuntimeFor(request, options);
+  const signedOutDestination = new URL("/", request.nextUrl.origin);
+  const destination = runtime
+    ? new URL(
+      `/logout?${new URLSearchParams({ client_id: runtime.cognitoClient.clientId, logout_uri: signedOutDestination.toString() })}`,
+      runtime.cognitoClient.hostedUiOrigin,
+    )
+    : signedOutDestination;
+  const response = NextResponse.redirect(destination, { status: 303, headers: NO_STORE_HEADERS });
+  clearSealedCookie(response, PROSPECTUS_SESSION_COOKIE);
+  clearSealedCookie(response, PROSPECTUS_PENDING_SIGN_IN_COOKIE);
+  return response;
+}
+
+export interface ProspectusPublishingSelection {
+  personId: string;
+  accountId: string;
+  role: string;
+  publicationCapabilities: PublicationCapability[];
+}
+
+async function freshlyAuthorizedPublishingSelection(
+  runtime: ProspectusSignInRuntime,
+  session: ProspectusSignedInSession,
+  accountId: string,
+  siteProduct: string | null,
+): Promise<ProspectusPublishingSelection | null> {
+  const directory = await runtime.accounts.accountDirectory(session.accessToken);
+  if (!directory.person || directory.person.id !== session.personId) return null;
+  if (!publishingAccountsForSite(directory.accounts, siteProduct).some((account) => account.accountId === accountId)) return null;
+  const authorization = await authorizeSignedInPersonForAccount(runtime.accounts, session.accessToken, accountId, "console:read");
+  if (authorization.personId !== session.personId) return null;
+  const publicationCapabilities = publicationCapabilitiesForProspectusRole(authorization.role);
+  if (publicationCapabilities.length === 0) return null;
+  return { personId: session.personId, accountId, role: authorization.role, publicationCapabilities };
+}
+
+export async function currentProspectusPublishingSelection(
+  request: NextRequest,
+  options: ProspectusSignInRouteOptions = {},
+): Promise<ProspectusPublishingSelection | null> {
+  const runtime = await signInRuntimeFor(request, options);
+  if (!runtime) return null;
+  const session = signedInProspectusSession(request, runtime.sealingSecret, currentTimeInSeconds(options));
+  if (!session?.selectedAccountId) return null;
+  try {
+    return await freshlyAuthorizedPublishingSelection(runtime, session, session.selectedAccountId, siteProductFor(options));
+  } catch (error) {
+    if (error instanceof ProspectusAccountsError) return null;
+    throw error;
+  }
+}
+
+export async function handleProspectusAccountSelection(request: NextRequest, options: ProspectusSignInRouteOptions = {}): Promise<NextResponse> {
+  const runtime = await signInRuntimeFor(request, options);
+  if (!runtime) return signInUnavailableResponse();
+  if (request.headers.get("origin") !== request.nextUrl.origin) {
+    return signInFailedResponse(403, "cross_origin_selection", "Choose an account from this site.");
+  }
+  const nowInSeconds = currentTimeInSeconds(options);
+  const session = signedInProspectusSession(request, runtime.sealingSecret, nowInSeconds);
+  if (!session) return signInFailedResponse(401, "signed_out", "Sign in first.");
+  const body = await request.json().catch(() => null) as { accountId?: unknown } | null;
+  const accountId = typeof body?.accountId === "string" ? body.accountId.trim() : "";
+  if (!accountId) return signInFailedResponse(400, "account_required", "Choose an account.");
+  try {
+    const selection = await freshlyAuthorizedPublishingSelection(runtime, session, accountId, siteProductFor(options));
+    if (!selection) return signInFailedResponse(403, "not_a_publishing_account", "You cannot work on this site's publications in that account.");
+    const response = NextResponse.json(
+      { selectedAccountId: selection.accountId, role: selection.role, publicationCapabilities: selection.publicationCapabilities },
+      { headers: NO_STORE_HEADERS },
+    );
+    const selectedSession: ProspectusSignedInSession = { ...session, selectedAccountId: selection.accountId };
+    response.cookies.set(
+      PROSPECTUS_SESSION_COOKIE,
+      sealProspectusCookie(runtime.sealingSecret, PROSPECTUS_SESSION_COOKIE, selectedSession, session.accessTokenExpiresAt),
+      sealedCookieAttributes(session.accessTokenExpiresAt, nowInSeconds),
+    );
+    return response;
+  } catch (error) {
+    if (error instanceof ProspectusAccountsError) return signInFailedResponse(error.status, error.code, error.message);
+    console.error(`Prospectus account selection failed (${error instanceof Error ? error.name : "error"}).`);
+    return signInFailedResponse(503, "prospectus_unavailable", "Prospectus could not be reached.");
+  }
+}

package/package.json

@@ -209,6 +209,9 @@
     "./lib/presentation-footer": "./lib/presentation-footer.ts",
     "./lib/pretext-layout": "./lib/pretext-layout.ts",
     "./lib/priming-proof-report": "./lib/priming-proof-report.ts",
+    "./lib/prospectus-publication-access": "./lib/prospectus-publication-access.ts",
+    "./lib/prospectus-session": "./lib/prospectus-session.ts",
+    "./lib/prospectus-sign-in-routes": "./lib/prospectus-sign-in-routes.ts",
     "./lib/prospectus-site-identity": "./lib/prospectus-site-identity.ts",
     "./lib/public-placeholder-config": "./lib/public-placeholder-config.ts",
     "./lib/publication-cyclotron": "./lib/publication-cyclotron.ts",
@@ -264,6 +267,11 @@
     "./app/[year]/[month]/[day]/page/[pageNumber]/page": "./app/[year]/[month]/[day]/page/[pageNumber]/page.tsx",
     "./app/[year]/[month]/[day]/section/[sectionKey]/page": "./app/[year]/[month]/[day]/section/[sectionKey]/page.tsx",
     "./app/api/archive/editions/route": "./app/api/archive/editions/route.ts",
+    "./app/api/auth/prospectus/callback/route": "./app/api/auth/prospectus/callback/route.ts",
+    "./app/api/auth/prospectus/selection/route": "./app/api/auth/prospectus/selection/route.ts",
+    "./app/api/auth/prospectus/session/route": "./app/api/auth/prospectus/session/route.ts",
+    "./app/api/auth/prospectus/sign-in/route": "./app/api/auth/prospectus/sign-in/route.ts",
+    "./app/api/auth/prospectus/sign-out/route": "./app/api/auth/prospectus/sign-out/route.ts",
     "./app/api/cyclotron/priming-proof/route": "./app/api/cyclotron/priming-proof/route.ts",
     "./app/api/media/[...path]/route": "./app/api/media/[...path]/route.ts",
     "./app/api/revalidate/route": "./app/api/revalidate/route.ts",
@@ -332,13 +340,14 @@
       "optional": true
     }
   },
-  "version": "1.0.0-next.63",
+  "version": "1.0.0-next.64",
   "dependencies": {
     "@aws-amplify/adapter-nextjs": "^1.7.3",
     "@aws-crypto/sha256-js": "5.2.0",
     "@aws-sdk/client-cognito-identity-provider": "3.1045.0",
     "@aws-sdk/client-lambda": "^3.1045.0",
     "@aws-sdk/client-s3": "^3.1045.0",
+    "@aws-sdk/client-secrets-manager": "3.1045.0",
     "@aws-sdk/client-ssm": "^3.1045.0",
     "@aws-sdk/credential-provider-node": "3.972.84",
     "@aws-sdk/s3-request-presigner": "^3.1045.0",

package/routes.manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.0.0-next.63",
+  "version": "1.0.0-next.64",
   "routes": [
     {
       "file": "app/%5F_preview/[[...path]]/route.ts",
@@ -66,6 +66,61 @@
         "revalidate": "60"
       }
     },
+    {
+      "file": "app/api/auth/prospectus/callback/route.ts",
+      "hasDefault": false,
+      "exports": [
+        "GET"
+      ],
+      "config": {
+        "dynamic": "\"force-dynamic\"",
+        "runtime": "\"nodejs\""
+      }
+    },
+    {
+      "file": "app/api/auth/prospectus/selection/route.ts",
+      "hasDefault": false,
+      "exports": [
+        "POST"
+      ],
+      "config": {
+        "dynamic": "\"force-dynamic\"",
+        "runtime": "\"nodejs\""
+      }
+    },
+    {
+      "file": "app/api/auth/prospectus/session/route.ts",
+      "hasDefault": false,
+      "exports": [
+        "GET"
+      ],
+      "config": {
+        "dynamic": "\"force-dynamic\"",
+        "runtime": "\"nodejs\""
+      }
+    },
+    {
+      "file": "app/api/auth/prospectus/sign-in/route.ts",
+      "hasDefault": false,
+      "exports": [
+        "GET"
+      ],
+      "config": {
+        "dynamic": "\"force-dynamic\"",
+        "runtime": "\"nodejs\""
+      }
+    },
+    {
+      "file": "app/api/auth/prospectus/sign-out/route.ts",
+      "hasDefault": false,
+      "exports": [
+        "POST"
+      ],
+      "config": {
+        "dynamic": "\"force-dynamic\"",
+        "runtime": "\"nodejs\""
+      }
+    },
     {
       "file": "app/api/cyclotron/priming-proof/route.ts",
       "hasDefault": false,