@anthusai/papyrus 1.0.0-next.8 → 1.0.0

package/amplify/auth/redirect-urls.js

@@ -0,0 +1,54 @@
+export const DEFAULT_NEWSROOM_BASE_PATH = "/newsroom";
+function parseRedirectUrl(value) {
+    try {
+        const parsed = new URL(value);
+        return { original: value, origin: parsed.origin, path: parsed.pathname.replace(/\/+$/, "") };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Expands every origin in an OAuth redirect list to both the newsroom return
+ * path and the site root, newsroom first. Amplify signs in with the first
+ * entry that matches the current origin, so a list that names only
+ * `https://host/` would land a signed-in editor on the public reader.
+ *
+ * With `newsroomBasePath` of `""` (a CMS-only host that mounts the newsroom at
+ * `/`), the root already is the newsroom and nothing is added. Explicit
+ * entries are kept; unparseable entries pass through unchanged.
+ */
+export function expandNewsroomRedirectUrls(redirectUrls, newsroomBasePath = DEFAULT_NEWSROOM_BASE_PATH) {
+    const newsroomPath = newsroomBasePath.replace(/\/+$/, "");
+    const originOrder = [];
+    const explicitByOrigin = new Map();
+    const passthrough = [];
+    for (const value of redirectUrls) {
+        const parsed = parseRedirectUrl(value);
+        if (!parsed) {
+            passthrough.push(value);
+            continue;
+        }
+        if (!explicitByOrigin.has(parsed.origin)) {
+            originOrder.push(parsed.origin);
+            explicitByOrigin.set(parsed.origin, []);
+        }
+        explicitByOrigin.get(parsed.origin)?.push(value);
+    }
+    const expanded = [];
+    for (const origin of originOrder) {
+        const explicit = explicitByOrigin.get(origin) ?? [];
+        if (newsroomPath === "") {
+            expanded.push(...explicit);
+            continue;
+        }
+        const newsroomEntries = explicit.filter((value) => parseRedirectUrl(value)?.path === newsroomPath);
+        const otherEntries = explicit.filter((value) => {
+            const path = parseRedirectUrl(value)?.path;
+            return path !== newsroomPath && path !== "";
+        });
+        expanded.push(...(newsroomEntries.length > 0 ? newsroomEntries : [`${origin}${newsroomPath}`]), `${origin}/`, ...otherEntries);
+    }
+    expanded.push(...passthrough);
+    return [...new Set(expanded)];
+}

package/amplify/auth/redirect-urls.ts

@@ -0,0 +1,66 @@
+export const DEFAULT_NEWSROOM_BASE_PATH = "/newsroom";
+
+type ParsedRedirectUrl = { original: string; origin: string; path: string } | null;
+
+function parseRedirectUrl(value: string): ParsedRedirectUrl {
+  try {
+    const parsed = new URL(value);
+    return { original: value, origin: parsed.origin, path: parsed.pathname.replace(/\/+$/, "") };
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Expands every origin in an OAuth redirect list to both the newsroom return
+ * path and the site root, newsroom first. Amplify signs in with the first
+ * entry that matches the current origin, so a list that names only
+ * `https://host/` would land a signed-in editor on the public reader.
+ *
+ * With `newsroomBasePath` of `""` (a CMS-only host that mounts the newsroom at
+ * `/`), the root already is the newsroom and nothing is added. Explicit
+ * entries are kept; unparseable entries pass through unchanged.
+ */
+export function expandNewsroomRedirectUrls(
+  redirectUrls: readonly string[],
+  newsroomBasePath: string = DEFAULT_NEWSROOM_BASE_PATH,
+): string[] {
+  const newsroomPath = newsroomBasePath.replace(/\/+$/, "");
+  const originOrder: string[] = [];
+  const explicitByOrigin = new Map<string, string[]>();
+  const passthrough: string[] = [];
+
+  for (const value of redirectUrls) {
+    const parsed = parseRedirectUrl(value);
+    if (!parsed) {
+      passthrough.push(value);
+      continue;
+    }
+    if (!explicitByOrigin.has(parsed.origin)) {
+      originOrder.push(parsed.origin);
+      explicitByOrigin.set(parsed.origin, []);
+    }
+    explicitByOrigin.get(parsed.origin)?.push(value);
+  }
+
+  const expanded: string[] = [];
+  for (const origin of originOrder) {
+    const explicit = explicitByOrigin.get(origin) ?? [];
+    if (newsroomPath === "") {
+      expanded.push(...explicit);
+      continue;
+    }
+    const newsroomEntries = explicit.filter((value) => parseRedirectUrl(value)?.path === newsroomPath);
+    const otherEntries = explicit.filter((value) => {
+      const path = parseRedirectUrl(value)?.path;
+      return path !== newsroomPath && path !== "";
+    });
+    expanded.push(
+      ...(newsroomEntries.length > 0 ? newsroomEntries : [`${origin}${newsroomPath}`]),
+      `${origin}/`,
+      ...otherEntries,
+    );
+  }
+  expanded.push(...passthrough);
+  return [...new Set(expanded)];
+}

package/amplify/auth/resource.js

@@ -1,8 +1,11 @@
 import { defineAuth, secret } from "@aws-amplify/backend";
 import { manageUserRole } from "../functions/manage-user-role/resource.js";
+import { CfnUserPoolDomain } from "aws-cdk-lib/aws-cognito";
+import { expandNewsroomRedirectUrls } from "./redirect-urls.js";
 // Default OAuth redirect URLs for the p.apyr.us app. Other publications pass
 // `auth.redirectUrls` to `defineSiteBackend` (or, for Papyrus's own backend,
 // the PAPYRUS_OAUTH_REDIRECT_URLS branch env var, comma-separated).
+// `defineSiteAuth` adds the newsroom and root variants of every origin listed.
 // See docs/google-oauth-setup.md.
 const DEFAULT_AUTH_REDIRECT_URLS = [
     "http://localhost:3001/",
@@ -25,15 +28,13 @@ export function authConfigFromEnv() {
     return {
         redirectUrls: resolveAuthRedirectUrls(),
         disableGoogleOAuth: process.env.PAPYRUS_DISABLE_GOOGLE_OAUTH === "1",
-        // Stable Cognito hosted-UI domain prefix for Google OAuth redirect URIs.
-        // See docs/google-oauth-setup.md.
         cognitoDomainPrefix: (process.env.PAPYRUS_COGNITO_DOMAIN_PREFIX ?? "").trim(),
+        applyCognitoDomainPrefix: process.env.PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX === "true",
     };
 }
 export function defineSiteAuth(config) {
-    const authRedirectUrls = config.redirectUrls ?? DEFAULT_AUTH_REDIRECT_URLS;
+    const authRedirectUrls = expandNewsroomRedirectUrls(config.redirectUrls ?? DEFAULT_AUTH_REDIRECT_URLS, config.newsroomBasePath);
     const disableGoogleOAuth = config.disableGoogleOAuth === true;
-    const cognitoDomainPrefix = (config.cognitoDomainPrefix ?? "").trim();
     return defineAuth({
         loginWith: {
             email: true,
@@ -49,7 +50,6 @@ export function defineSiteAuth(config) {
                         scopes: ["EMAIL", "PROFILE", "OPENID"],
                         callbackUrls: authRedirectUrls,
                         logoutUrls: authRedirectUrls,
-                        ...(cognitoDomainPrefix ? { domainPrefix: cognitoDomainPrefix } : {}),
                     },
                 }),
         },
@@ -59,3 +59,18 @@ export function defineSiteAuth(config) {
         ],
     });
 }
+// Amplify Gen2's auth factory overwrites `externalProviders.domainPrefix` with a
+// hash of the backend id, so the prefix cannot be passed through `defineAuth`.
+// This sets the user pool domain on the synthesized resource instead. Cognito
+// cannot rename a pool domain in place: CloudFormation replaces the domain,
+// which changes the hosted-UI URL and the Google redirect URI. Callers must
+// only use it when the site opted in (see docs/google-oauth-setup.md).
+export function applyCognitoDomainPrefix(authStack, cognitoDomainPrefix) {
+    const domainResources = authStack.node
+        .findAll()
+        .filter((construct) => construct instanceof CfnUserPoolDomain);
+    if (domainResources.length !== 1) {
+        throw new Error(`Expected exactly one Cognito user pool domain in the auth stack to apply cognitoDomainPrefix, found ${domainResources.length}`);
+    }
+    domainResources[0].domain = cognitoDomainPrefix;
+}

package/amplify/auth/resource.ts

@@ -1,10 +1,14 @@
 import { defineAuth, secret } from "@aws-amplify/backend";
 import { manageUserRole } from "../functions/manage-user-role/resource";
+import { Stack } from "aws-cdk-lib";
+import { CfnUserPoolDomain } from "aws-cdk-lib/aws-cognito";
 import type { PapyrusAuthConfig } from "../site-backend-config";
+import { expandNewsroomRedirectUrls } from "./redirect-urls";
 
 // Default OAuth redirect URLs for the p.apyr.us app. Other publications pass
 // `auth.redirectUrls` to `defineSiteBackend` (or, for Papyrus's own backend,
 // the PAPYRUS_OAUTH_REDIRECT_URLS branch env var, comma-separated).
+// `defineSiteAuth` adds the newsroom and root variants of every origin listed.
 // See docs/google-oauth-setup.md.
 const DEFAULT_AUTH_REDIRECT_URLS = [
   "http://localhost:3001/",
@@ -28,16 +32,17 @@ export function authConfigFromEnv(): PapyrusAuthConfig {
   return {
     redirectUrls: resolveAuthRedirectUrls(),
     disableGoogleOAuth: process.env.PAPYRUS_DISABLE_GOOGLE_OAUTH === "1",
-    // Stable Cognito hosted-UI domain prefix for Google OAuth redirect URIs.
-    // See docs/google-oauth-setup.md.
     cognitoDomainPrefix: (process.env.PAPYRUS_COGNITO_DOMAIN_PREFIX ?? "").trim(),
+    applyCognitoDomainPrefix: process.env.PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX === "true",
   };
 }
 
 export function defineSiteAuth(config: PapyrusAuthConfig) {
-  const authRedirectUrls = config.redirectUrls ?? DEFAULT_AUTH_REDIRECT_URLS;
+  const authRedirectUrls = expandNewsroomRedirectUrls(
+    config.redirectUrls ?? DEFAULT_AUTH_REDIRECT_URLS,
+    config.newsroomBasePath,
+  );
   const disableGoogleOAuth = config.disableGoogleOAuth === true;
-  const cognitoDomainPrefix = (config.cognitoDomainPrefix ?? "").trim();
   return defineAuth({
     loginWith: {
       email: true,
@@ -53,7 +58,6 @@ export function defineSiteAuth(config: PapyrusAuthConfig) {
               scopes: ["EMAIL", "PROFILE", "OPENID"],
               callbackUrls: authRedirectUrls,
               logoutUrls: authRedirectUrls,
-              ...(cognitoDomainPrefix ? { domainPrefix: cognitoDomainPrefix } : {}),
             },
           }),
     },
@@ -63,3 +67,21 @@ export function defineSiteAuth(config: PapyrusAuthConfig) {
     ],
   });
 }
+
+// Amplify Gen2's auth factory overwrites `externalProviders.domainPrefix` with a
+// hash of the backend id, so the prefix cannot be passed through `defineAuth`.
+// This sets the user pool domain on the synthesized resource instead. Cognito
+// cannot rename a pool domain in place: CloudFormation replaces the domain,
+// which changes the hosted-UI URL and the Google redirect URI. Callers must
+// only use it when the site opted in (see docs/google-oauth-setup.md).
+export function applyCognitoDomainPrefix(authStack: Stack, cognitoDomainPrefix: string): void {
+  const domainResources = authStack.node
+    .findAll()
+    .filter((construct): construct is CfnUserPoolDomain => construct instanceof CfnUserPoolDomain);
+  if (domainResources.length !== 1) {
+    throw new Error(
+      `Expected exactly one Cognito user pool domain in the auth stack to apply cognitoDomainPrefix, found ${domainResources.length}`,
+    );
+  }
+  domainResources[0].domain = cognitoDomainPrefix;
+}