@anthusai/papyrus 1.0.0-next.9 → 1.0.0

package/infra/amplify-app-shell.js

@@ -3,22 +3,45 @@ import * as iam from "aws-cdk-lib/aws-iam";
 import * as amplify from "aws-cdk-lib/aws-amplify";
 import { GITHUB_OIDC_PROVIDER_HOST } from "./github-oidc-provider.js";
 import { cmsProductionBuildSpec, cmsStagingBuildSpec, readerBuildSpec } from "./build-specs.js";
-import { isStagingEnabled, resolveStackName, resolveStagingDomainName } from "./site-config.js";
+import { PROSPECTUS_PAPYRUS_SITE_ROUTES, hasCmsApp, isStagingEnabled, resolveRedirectSubDomainPrefix, resolveCmsHostName, resolveProspectusAccountsEndpoint, resolveRevalidateSecretParameterName, resolveStackName, resolveStagingDomainName, resolveStoragePreviewPrefix } from "./site-config.js";
 function environmentVariables(variables) {
     return Object.entries(variables).map(([name, value]) => ({ name, value }));
 }
+function readerCustomHeaders(rules) {
+    if (!rules)
+        return undefined;
+    const lines = ["customHeaders:"];
+    for (const rule of rules) {
+        lines.push(`  - pattern: ${JSON.stringify(rule.pattern)}`, "    headers:");
+        for (const [key, value] of Object.entries(rule.headers)) {
+            lines.push(`      - key: ${JSON.stringify(key)}`, `        value: ${JSON.stringify(value)}`);
+        }
+    }
+    return lines.join("\n") + "\n";
+}
 /**
  * Provisions the Amplify *app shell* of a Papyrus publication from its
  * site.json:
  *
  *   - CMS app (WEB_COMPUTE) with branches `main` (production, owns the backend)
  *     and `staging` (frontend only, reads the production backend)
- *   - for `markus-static` sites, a reader app (WEB) with branch `main`
+ *   - for `markus-static` sites, a reader app (WEB) with branch `main`; a
+ *     `markus-static` site may omit `cms` to get the reader app alone (no CMS
+ *     app, no CMS roles, no authoring role)
  *   - a domain association per branch/app when a domain is configured (without
  *     one, no AWS::Amplify::Domain is created and the default amplifyapp.com
  *     URL is used), IAM service and compute roles
  *   - `cms.staging: false` omits the staging branch and its domain
  *
+ * Google sign-in is always on: the branches never set PAPYRUS_DISABLE_GOOGLE_OAUTH,
+and `cms.cognitoDomainPrefix` becomes the hosted-UI domain
+(PAPYRUS_COGNITO_DOMAIN_PREFIX) only when `cms.applyCognitoDomainPrefix` is true
+(PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX); otherwise Amplify's generated domain is kept. The secrets GOOGLE_CLIENT_ID and
+GOOGLE_CLIENT_SECRET are Amplify backend secrets set in the console, never here.
+The stack also creates the `<siteId>-papyrus-authoring` role. The CLI signs
+ * AppSync requests (SigV4) with credentials for that role (SSO, OIDC or any
+ * principal in the account that may assume it); no token is stored anywhere.
+ *
  * No repository and no access token are configured: the apps are manual-deploy
  * until Amplify's GitHub App is connected once in the console
  * (docs/site-hosting.md). The Papyrus backend itself is created inside the CMS
@@ -29,9 +52,16 @@ export class AmplifyAppShellStack extends Stack {
     readerAppId;
     constructor(scope, id, config, props) {
         super(scope, id, props);
+        if (!hasCmsApp(config)) {
+            if (!config.reader)
+                throw new Error(`site ${config.siteId} has neither a cms section nor a reader`);
+            this.readerAppId = this.addReaderApp(config, config.reader);
+            return;
+        }
         const cmsAppName = config.cms.appName ?? `${config.siteId}-cms`;
         const stagingEnabled = isStagingEnabled(config);
         const stagingDomainName = resolveStagingDomainName(config);
+        const cmsHostName = resolveCmsHostName(config);
         const cmsServiceRole = new iam.Role(this, "AmplifyServiceRole", {
             assumedBy: new iam.ServicePrincipal("amplify.amazonaws.com"),
             description: `Backend deploy and staging build service role for Amplify app ${cmsAppName} (AdministratorAccess: documented risk)`,
@@ -45,6 +75,27 @@ export class AmplifyAppShellStack extends Stack {
                 iam.ManagedPolicy.fromAwsManagedPolicyName("CloudWatchLogsFullAccess"),
             ],
         });
+        const revalidateSecretParameterName = config.frontend === "pretext" ? resolveRevalidateSecretParameterName(config) : undefined;
+        if (revalidateSecretParameterName) {
+            computeRole.addToPolicy(new iam.PolicyStatement({
+                sid: "ReadRevalidateSecret",
+                actions: ["ssm:GetParameter"],
+                resources: [
+                    this.formatArn({ service: "ssm", resource: "parameter", resourceName: revalidateSecretParameterName.slice(1), arnFormat: ArnFormat.SLASH_RESOURCE_NAME }),
+                ],
+            }));
+        }
+        const prospectusAccountsApiStageArn = config.cms.prospectusAccountsApiStageArn;
+        const prospectusEnvironment = prospectusAccountsApiStageArn
+            ? { PAPYRUS_PROSPECTUS_ACCOUNTS_ENDPOINT: resolveProspectusAccountsEndpoint(prospectusAccountsApiStageArn) }
+            : {};
+        if (prospectusAccountsApiStageArn) {
+            computeRole.addToPolicy(new iam.PolicyStatement({
+                sid: "InvokeProspectusAccountsAsRegisteredSite",
+                actions: ["execute-api:Invoke"],
+                resources: PROSPECTUS_PAPYRUS_SITE_ROUTES.map((route) => `${prospectusAccountsApiStageArn}/${route}`),
+            }));
+        }
         const cmsApp = new amplify.CfnApp(this, "App", {
             name: cmsAppName,
             description: `Papyrus newsroom CMS for ${config.siteId} (WEB_COMPUTE)`,
@@ -53,17 +104,25 @@ export class AmplifyAppShellStack extends Stack {
             computeRoleArn: computeRole.roleArn,
             buildSpec: cmsProductionBuildSpec(config),
             jobConfig: config.cms.buildComputeType ? { buildComputeType: config.cms.buildComputeType } : undefined,
-            customRules: [{ source: "/<*>", target: "/index.html", status: "404-200" }],
+            customRules: [
+                ...(config.cms.redirects ?? []).map((redirect) => ({
+                    source: `https://${redirect.source}`,
+                    target: `https://${resolveCmsHostName(config)}`,
+                    status: String(redirect.status),
+                })),
+                { source: "/<*>", target: "/index.html", status: "404-200" },
+            ],
         });
         const stagingMode = config.frontend === "markus-static"
             ? { PAPYRUS_STAGING_PREVIEW: "static" }
             : { PAPYRUS_CONTENT_SOURCE: "drafts" };
-        const productionOrigin = config.cms.domainName
-            ? `https://${config.cms.domainName}/`
+        const productionOrigin = cmsHostName
+            ? `https://${cmsHostName}/`
             : Fn.join("", ["https://main.", cmsApp.attrDefaultDomain, "/"]);
         const stagingOrigin = stagingDomainName
             ? `https://${stagingDomainName}/`
             : Fn.join("", ["https://staging.", cmsApp.attrDefaultDomain, "/"]);
+        const sharedRootDomain = config.cms.domainPrefix !== undefined;
         const defaultOriginsToAllow = [
             ...(config.cms.domainName ? [] : [productionOrigin]),
             ...(stagingEnabled && !stagingDomainName ? [stagingOrigin] : []),
@@ -79,14 +138,19 @@ export class AmplifyAppShellStack extends Stack {
             enablePerformanceMode: false,
             environmentVariables: environmentVariables({
                 ...config.cms.environment,
+                PAPYRUS_COGNITO_DOMAIN_PREFIX: config.cms.cognitoDomainPrefix,
+                ...(config.cms.applyCognitoDomainPrefix ? { PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX: "true" } : {}),
                 PAPYRUS_OAUTH_REDIRECT_URLS: oauthRedirectUrls,
                 PAPYRUS_SITE_BRAND: config.brand,
                 SITE_ENV: "production",
                 PAPYRUS_CONTENT_SOURCE: "published",
+                ...(revalidateSecretParameterName ? { PAPYRUS_REVALIDATE_SECRET_PARAMETER: revalidateSecretParameterName } : {}),
+                ...prospectusEnvironment,
             }),
         });
+        let stagingBranch;
         if (stagingEnabled) {
-            const stagingBranch = new amplify.CfnBranch(this, "StagingBranch", {
+            stagingBranch = new amplify.CfnBranch(this, "StagingBranch", {
                 appId: cmsApp.attrAppId,
                 branchName: "staging",
                 stage: "BETA",
@@ -95,16 +159,19 @@ export class AmplifyAppShellStack extends Stack {
                 buildSpec: cmsStagingBuildSpec(config),
                 environmentVariables: environmentVariables({
                     ...config.cms.environment,
+                    PAPYRUS_COGNITO_DOMAIN_PREFIX: config.cms.cognitoDomainPrefix,
+                    ...(config.cms.applyCognitoDomainPrefix ? { PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX: "true" } : {}),
                     PAPYRUS_OAUTH_REDIRECT_URLS: oauthRedirectUrls,
                     PAPYRUS_SITE_BRAND: config.brand,
                     SITE_ENV: "staging",
                     ...stagingMode,
+                    ...prospectusEnvironment,
                     NEXT_PUBLIC_PAPYRUS_STAGING_URL: stagingDomainName
                         ? `https://${stagingDomainName}`
                         : Fn.join("", ["https://staging.", cmsApp.attrDefaultDomain]),
                 }),
             });
-            if (stagingDomainName) {
+            if (stagingDomainName && !sharedRootDomain) {
                 const stagingDomain = new amplify.CfnDomain(this, "StagingDomain", {
                     appId: cmsApp.attrAppId,
                     domainName: stagingDomainName,
@@ -114,27 +181,89 @@ export class AmplifyAppShellStack extends Stack {
             }
         }
         if (config.cms.domainName) {
+            const subDomainSettings = sharedRootDomain
+                ? [
+                    { branchName: "main", prefix: config.cms.domainPrefix },
+                    ...(config.cms.redirects ?? []).map((redirect) => ({
+                        branchName: "main",
+                        prefix: resolveRedirectSubDomainPrefix(config.cms.domainName, redirect.source),
+                    })),
+                    ...(stagingBranch ? [{ branchName: "staging", prefix: config.cms.stagingDomainPrefix }] : []),
+                ]
+                : [{ branchName: "main", prefix: "" }];
             const productionDomain = new amplify.CfnDomain(this, "Domain", {
                 appId: cmsApp.attrAppId,
                 domainName: config.cms.domainName,
-                subDomainSettings: [{ branchName: "main", prefix: "" }],
+                subDomainSettings,
             });
             productionDomain.addResourceDependency(productionBranch);
+            if (sharedRootDomain && stagingBranch) {
+                productionDomain.addResourceDependency(stagingBranch);
+            }
         }
         this.cmsAppId = cmsApp.attrAppId;
         new CfnOutput(this, "CmsAppId", { value: cmsApp.attrAppId, description: `Amplify app id for ${cmsAppName}` });
         new CfnOutput(this, "CmsOrigin", { value: productionOrigin });
+        new CfnOutput(this, "CmsComputeRoleArn", {
+            value: computeRole.roleArn,
+            description: `SSR compute role for ${cmsAppName}; the roleArn of its Prospectus site registration`,
+        });
         if (stagingEnabled) {
             new CfnOutput(this, "StagingOrigin", { value: stagingOrigin });
         }
         if (config.reader) {
             this.readerAppId = this.addReaderApp(config, config.reader);
         }
+        const amplifyAppIds = [cmsApp.attrAppId, ...(this.readerAppId ? [this.readerAppId] : [])];
+        this.addAuthoringRole(config, cmsApp.attrAppId, amplifyAppIds);
         if (config.github) {
-            this.addGithubCiRole(config, config.github, [cmsApp.attrAppId, ...(this.readerAppId ? [this.readerAppId] : [])]);
+            this.addGithubCiRole(config, config.github, cmsApp.attrAppId, amplifyAppIds);
+        }
+    }
+    authoringStatements(config, cmsAppId, amplifyAppIds) {
+        const mediaBucketArn = `arn:${this.partition}:s3:::amplify-${cmsAppId}-*`;
+        return [
+            new iam.PolicyStatement({
+                sid: "SignAppSyncAuthoringRequests",
+                actions: ["appsync:GraphQL"],
+                resources: ["Query", "Mutation"].map((typeName) => this.formatArn({ service: "appsync", resource: "apis", resourceName: `*/types/${typeName}/fields/*`, arnFormat: ArnFormat.SLASH_RESOURCE_NAME })),
+            }),
+            new iam.PolicyStatement({
+                sid: "ReadWriteMediaAndPreview",
+                actions: ["s3:GetObject", "s3:PutObject", "s3:DeleteObject"],
+                resources: [`${mediaBucketArn}/media/*`, `${mediaBucketArn}/${resolveStoragePreviewPrefix(config)}*`],
+            }),
+            new iam.PolicyStatement({
+                sid: "ListMediaAndPreview",
+                actions: ["s3:ListBucket"],
+                resources: [mediaBucketArn],
+                conditions: { StringLike: { "s3:prefix": ["media/*", `${resolveStoragePreviewPrefix(config)}*`] } },
+            }),
+            new iam.PolicyStatement({
+                sid: "StartAndInspectAmplifyJobs",
+                actions: ["amplify:StartJob", "amplify:ListJobs", "amplify:GetJob", "amplify:ListBranches"],
+                resources: amplifyAppIds.flatMap((appId) => [
+                    this.formatArn({ service: "amplify", resource: "apps", resourceName: appId, arnFormat: ArnFormat.SLASH_RESOURCE_NAME }),
+                    this.formatArn({ service: "amplify", resource: "apps", resourceName: `${appId}/*`, arnFormat: ArnFormat.SLASH_RESOURCE_NAME }),
+                ]),
+            }),
+        ];
+    }
+    addAuthoringRole(config, cmsAppId, amplifyAppIds) {
+        const authoringRole = new iam.Role(this, "PapyrusAuthoringRole", {
+            roleName: `${config.siteId}-papyrus-authoring`,
+            description: `Papyrus CLI authoring role for ${config.siteId}: AppSync (SigV4), media and preview storage, rebuild jobs. Assumable by principals in this account that are allowed sts:AssumeRole on it.`,
+            assumedBy: new iam.AccountRootPrincipal(),
+        });
+        for (const statement of this.authoringStatements(config, cmsAppId, amplifyAppIds)) {
+            authoringRole.addToPolicy(statement);
         }
+        new CfnOutput(this, "PapyrusAuthoringRoleArn", {
+            value: authoringRole.roleArn,
+            description: `Role the Papyrus CLI assumes for ${config.siteId} (profile role_arn)`,
+        });
     }
-    addGithubCiRole(config, github, amplifyAppIds) {
+    addGithubCiRole(config, github, cmsAppId, amplifyAppIds) {
         const provider = iam.OpenIdConnectProvider.fromOpenIdConnectProviderArn(this, "GithubOidcProvider", this.formatArn({
             service: "iam",
             region: "",
@@ -153,22 +282,9 @@ export class AmplifyAppShellStack extends Stack {
                 },
             }),
         });
-        ciRole.addToPolicy(new iam.PolicyStatement({
-            sid: "StartAndInspectAmplifyJobs",
-            actions: ["amplify:StartJob", "amplify:ListJobs", "amplify:GetJob", "amplify:ListBranches"],
-            resources: amplifyAppIds.flatMap((appId) => [
-                this.formatArn({ service: "amplify", resource: "apps", resourceName: appId, arnFormat: ArnFormat.SLASH_RESOURCE_NAME }),
-                this.formatArn({ service: "amplify", resource: "apps", resourceName: `${appId}/*`, arnFormat: ArnFormat.SLASH_RESOURCE_NAME }),
-            ]),
-        }));
-        ciRole.addToPolicy(new iam.PolicyStatement({
-            sid: "ReadSiteSecretsForJwtMinting",
-            actions: ["ssm:GetParameter", "ssm:GetParameters"],
-            resources: [
-                this.formatArn({ service: "ssm", resource: "parameter", resourceName: `amplify/${this.cmsAppId}/*`, arnFormat: ArnFormat.SLASH_RESOURCE_NAME }),
-                this.formatArn({ service: "ssm", resource: "parameter", resourceName: `amplify/shared/${this.cmsAppId}/*`, arnFormat: ArnFormat.SLASH_RESOURCE_NAME }),
-            ],
-        }));
+        for (const statement of this.authoringStatements(config, cmsAppId, amplifyAppIds)) {
+            ciRole.addToPolicy(statement);
+        }
         ciRole.addToPolicy(new iam.PolicyStatement({
             sid: "WhoAmI",
             actions: ["sts:GetCallerIdentity"],
@@ -203,6 +319,11 @@ export class AmplifyAppShellStack extends Stack {
             platform: "WEB",
             iamServiceRole: readerServiceRole.roleArn,
             buildSpec: readerBuildSpec(config),
+            customRules: [
+                ...(reader.redirects ?? []),
+                { source: "/<*>", target: "/404.html", status: "404-200" },
+            ],
+            customHeaders: readerCustomHeaders(reader.customHeaders),
         });
         const readerBranch = new amplify.CfnBranch(this, "ReaderBranch", {
             appId: readerApp.attrAppId,
@@ -219,7 +340,7 @@ export class AmplifyAppShellStack extends Stack {
             const readerDomain = new amplify.CfnDomain(this, "ReaderDomain", {
                 appId: readerApp.attrAppId,
                 domainName: reader.domainName,
-                subDomainSettings: [{ branchName: readerBranchName, prefix: "" }],
+                subDomainSettings: (reader.domainPrefixes ?? [""]).map((prefix) => ({ branchName: readerBranchName, prefix })),
             });
             readerDomain.addResourceDependency(readerBranch);
         }

package/infra/amplify-app-shell.ts

@@ -4,39 +4,69 @@ import * as iam from "aws-cdk-lib/aws-iam";
 import * as amplify from "aws-cdk-lib/aws-amplify";
 import { GITHUB_OIDC_PROVIDER_HOST } from "./github-oidc-provider";
 import { cmsProductionBuildSpec, cmsStagingBuildSpec, readerBuildSpec } from "./build-specs";
-import { AmplifyAppShellSiteConfig, isStagingEnabled, resolveStackName, resolveStagingDomainName } from "./site-config";
+import { AmplifyAppShellSiteConfig, PROSPECTUS_PAPYRUS_SITE_ROUTES, ReaderCustomHeaderRule, hasCmsApp, isStagingEnabled, resolveRedirectSubDomainPrefix, resolveCmsHostName, resolveProspectusAccountsEndpoint, resolveRevalidateSecretParameterName, resolveStackName, resolveStagingDomainName, resolveStoragePreviewPrefix } from "./site-config";
 
 function environmentVariables(variables: Record<string, string>): amplify.CfnBranch.EnvironmentVariableProperty[] {
   return Object.entries(variables).map(([name, value]) => ({ name, value }));
 }
 
+function readerCustomHeaders(rules: ReaderCustomHeaderRule[] | undefined): string | undefined {
+  if (!rules) return undefined;
+  const lines = ["customHeaders:"];
+  for (const rule of rules) {
+    lines.push(`  - pattern: ${JSON.stringify(rule.pattern)}`, "    headers:");
+    for (const [key, value] of Object.entries(rule.headers)) {
+      lines.push(`      - key: ${JSON.stringify(key)}`, `        value: ${JSON.stringify(value)}`);
+    }
+  }
+  return lines.join("\n") + "\n";
+}
+
 /**
  * Provisions the Amplify *app shell* of a Papyrus publication from its
  * site.json:
  *
  *   - CMS app (WEB_COMPUTE) with branches `main` (production, owns the backend)
  *     and `staging` (frontend only, reads the production backend)
- *   - for `markus-static` sites, a reader app (WEB) with branch `main`
+ *   - for `markus-static` sites, a reader app (WEB) with branch `main`; a
+ *     `markus-static` site may omit `cms` to get the reader app alone (no CMS
+ *     app, no CMS roles, no authoring role)
  *   - a domain association per branch/app when a domain is configured (without
  *     one, no AWS::Amplify::Domain is created and the default amplifyapp.com
  *     URL is used), IAM service and compute roles
  *   - `cms.staging: false` omits the staging branch and its domain
  *
+ * Google sign-in is always on: the branches never set PAPYRUS_DISABLE_GOOGLE_OAUTH,
+and `cms.cognitoDomainPrefix` becomes the hosted-UI domain
+(PAPYRUS_COGNITO_DOMAIN_PREFIX) only when `cms.applyCognitoDomainPrefix` is true
+(PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX); otherwise Amplify's generated domain is kept. The secrets GOOGLE_CLIENT_ID and
+GOOGLE_CLIENT_SECRET are Amplify backend secrets set in the console, never here.
+The stack also creates the `<siteId>-papyrus-authoring` role. The CLI signs
+ * AppSync requests (SigV4) with credentials for that role (SSO, OIDC or any
+ * principal in the account that may assume it); no token is stored anywhere.
+ *
  * No repository and no access token are configured: the apps are manual-deploy
  * until Amplify's GitHub App is connected once in the console
  * (docs/site-hosting.md). The Papyrus backend itself is created inside the CMS
  * app by `ampx pipeline-deploy` from the production build.
  */
 export class AmplifyAppShellStack extends Stack {
-  public readonly cmsAppId: string;
+  public readonly cmsAppId?: string;
   public readonly readerAppId?: string;
 
   constructor(scope: Construct, id: string, config: AmplifyAppShellSiteConfig, props?: StackProps) {
     super(scope, id, props);
 
+    if (!hasCmsApp(config)) {
+      if (!config.reader) throw new Error(`site ${config.siteId} has neither a cms section nor a reader`);
+      this.readerAppId = this.addReaderApp(config, config.reader);
+      return;
+    }
+
     const cmsAppName = config.cms.appName ?? `${config.siteId}-cms`;
     const stagingEnabled = isStagingEnabled(config);
     const stagingDomainName = resolveStagingDomainName(config);
+    const cmsHostName = resolveCmsHostName(config);
 
     const cmsServiceRole = new iam.Role(this, "AmplifyServiceRole", {
       assumedBy: new iam.ServicePrincipal("amplify.amazonaws.com"),
@@ -53,6 +83,33 @@ export class AmplifyAppShellStack extends Stack {
       ],
     });
 
+    const revalidateSecretParameterName = config.frontend === "pretext" ? resolveRevalidateSecretParameterName(config) : undefined;
+    if (revalidateSecretParameterName) {
+      computeRole.addToPolicy(
+        new iam.PolicyStatement({
+          sid: "ReadRevalidateSecret",
+          actions: ["ssm:GetParameter"],
+          resources: [
+            this.formatArn({ service: "ssm", resource: "parameter", resourceName: revalidateSecretParameterName.slice(1), arnFormat: ArnFormat.SLASH_RESOURCE_NAME }),
+          ],
+        }),
+      );
+    }
+
+    const prospectusAccountsApiStageArn = config.cms.prospectusAccountsApiStageArn;
+    const prospectusEnvironment = prospectusAccountsApiStageArn
+      ? { PAPYRUS_PROSPECTUS_ACCOUNTS_ENDPOINT: resolveProspectusAccountsEndpoint(prospectusAccountsApiStageArn) }
+      : {};
+    if (prospectusAccountsApiStageArn) {
+      computeRole.addToPolicy(
+        new iam.PolicyStatement({
+          sid: "InvokeProspectusAccountsAsRegisteredSite",
+          actions: ["execute-api:Invoke"],
+          resources: PROSPECTUS_PAPYRUS_SITE_ROUTES.map((route) => `${prospectusAccountsApiStageArn}/${route}`),
+        }),
+      );
+    }
+
     const cmsApp = new amplify.CfnApp(this, "App", {
       name: cmsAppName,
       description: `Papyrus newsroom CMS for ${config.siteId} (WEB_COMPUTE)`,
@@ -61,19 +118,27 @@ export class AmplifyAppShellStack extends Stack {
       computeRoleArn: computeRole.roleArn,
       buildSpec: cmsProductionBuildSpec(config),
       jobConfig: config.cms.buildComputeType ? { buildComputeType: config.cms.buildComputeType } : undefined,
-      customRules: [{ source: "/<*>", target: "/index.html", status: "404-200" }],
+      customRules: [
+        ...(config.cms.redirects ?? []).map((redirect) => ({
+          source: `https://${redirect.source}`,
+          target: `https://${resolveCmsHostName(config)}`,
+          status: String(redirect.status),
+        })),
+        { source: "/<*>", target: "/index.html", status: "404-200" },
+      ],
     });
 
     const stagingMode: Record<string, string> = config.frontend === "markus-static"
       ? { PAPYRUS_STAGING_PREVIEW: "static" }
       : { PAPYRUS_CONTENT_SOURCE: "drafts" };
 
-    const productionOrigin = config.cms.domainName
-      ? `https://${config.cms.domainName}/`
+    const productionOrigin = cmsHostName
+      ? `https://${cmsHostName}/`
       : Fn.join("", ["https://main.", cmsApp.attrDefaultDomain, "/"]);
     const stagingOrigin = stagingDomainName
       ? `https://${stagingDomainName}/`
       : Fn.join("", ["https://staging.", cmsApp.attrDefaultDomain, "/"]);
+    const sharedRootDomain = config.cms.domainPrefix !== undefined;
     const defaultOriginsToAllow = [
       ...(config.cms.domainName ? [] : [productionOrigin]),
       ...(stagingEnabled && !stagingDomainName ? [stagingOrigin] : []),
@@ -90,15 +155,20 @@ export class AmplifyAppShellStack extends Stack {
       enablePerformanceMode: false,
       environmentVariables: environmentVariables({
         ...config.cms.environment,
+        PAPYRUS_COGNITO_DOMAIN_PREFIX: config.cms.cognitoDomainPrefix,
+        ...(config.cms.applyCognitoDomainPrefix ? { PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX: "true" } : {}),
         PAPYRUS_OAUTH_REDIRECT_URLS: oauthRedirectUrls,
         PAPYRUS_SITE_BRAND: config.brand,
         SITE_ENV: "production",
         PAPYRUS_CONTENT_SOURCE: "published",
+        ...(revalidateSecretParameterName ? { PAPYRUS_REVALIDATE_SECRET_PARAMETER: revalidateSecretParameterName } : {}),
+        ...prospectusEnvironment,
       }),
     });
 
+    let stagingBranch: amplify.CfnBranch | undefined;
     if (stagingEnabled) {
-      const stagingBranch = new amplify.CfnBranch(this, "StagingBranch", {
+      stagingBranch = new amplify.CfnBranch(this, "StagingBranch", {
         appId: cmsApp.attrAppId,
         branchName: "staging",
         stage: "BETA",
@@ -107,17 +177,20 @@ export class AmplifyAppShellStack extends Stack {
         buildSpec: cmsStagingBuildSpec(config),
         environmentVariables: environmentVariables({
           ...config.cms.environment,
+          PAPYRUS_COGNITO_DOMAIN_PREFIX: config.cms.cognitoDomainPrefix,
+          ...(config.cms.applyCognitoDomainPrefix ? { PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX: "true" } : {}),
           PAPYRUS_OAUTH_REDIRECT_URLS: oauthRedirectUrls,
           PAPYRUS_SITE_BRAND: config.brand,
           SITE_ENV: "staging",
           ...stagingMode,
+          ...prospectusEnvironment,
           NEXT_PUBLIC_PAPYRUS_STAGING_URL: stagingDomainName
             ? `https://${stagingDomainName}`
             : Fn.join("", ["https://staging.", cmsApp.attrDefaultDomain]),
         }),
       });
 
-      if (stagingDomainName) {
+      if (stagingDomainName && !sharedRootDomain) {
         const stagingDomain = new amplify.CfnDomain(this, "StagingDomain", {
           appId: cmsApp.attrAppId,
           domainName: stagingDomainName,
@@ -128,17 +201,34 @@ export class AmplifyAppShellStack extends Stack {
     }
 
     if (config.cms.domainName) {
+      const subDomainSettings = sharedRootDomain
+        ? [
+            { branchName: "main", prefix: config.cms.domainPrefix as string },
+            ...(config.cms.redirects ?? []).map((redirect) => ({
+              branchName: "main",
+              prefix: resolveRedirectSubDomainPrefix(config.cms.domainName as string, redirect.source),
+            })),
+            ...(stagingBranch ? [{ branchName: "staging", prefix: config.cms.stagingDomainPrefix as string }] : []),
+          ]
+        : [{ branchName: "main", prefix: "" }];
       const productionDomain = new amplify.CfnDomain(this, "Domain", {
         appId: cmsApp.attrAppId,
         domainName: config.cms.domainName,
-        subDomainSettings: [{ branchName: "main", prefix: "" }],
+        subDomainSettings,
       });
       productionDomain.addResourceDependency(productionBranch);
+      if (sharedRootDomain && stagingBranch) {
+        productionDomain.addResourceDependency(stagingBranch);
+      }
     }
 
     this.cmsAppId = cmsApp.attrAppId;
     new CfnOutput(this, "CmsAppId", { value: cmsApp.attrAppId, description: `Amplify app id for ${cmsAppName}` });
     new CfnOutput(this, "CmsOrigin", { value: productionOrigin });
+    new CfnOutput(this, "CmsComputeRoleArn", {
+      value: computeRole.roleArn,
+      description: `SSR compute role for ${cmsAppName}; the roleArn of its Prospectus site registration`,
+    });
     if (stagingEnabled) {
       new CfnOutput(this, "StagingOrigin", { value: stagingOrigin });
     }
@@ -147,14 +237,65 @@ export class AmplifyAppShellStack extends Stack {
       this.readerAppId = this.addReaderApp(config, config.reader);
     }
 
+    const amplifyAppIds = [cmsApp.attrAppId, ...(this.readerAppId ? [this.readerAppId] : [])];
+    this.addAuthoringRole(config, cmsApp.attrAppId, amplifyAppIds);
+
     if (config.github) {
-      this.addGithubCiRole(config, config.github, [cmsApp.attrAppId, ...(this.readerAppId ? [this.readerAppId] : [])]);
+      this.addGithubCiRole(config, config.github, cmsApp.attrAppId, amplifyAppIds);
+    }
+  }
+
+  private authoringStatements(config: AmplifyAppShellSiteConfig, cmsAppId: string, amplifyAppIds: string[]): iam.PolicyStatement[] {
+    const mediaBucketArn = `arn:${this.partition}:s3:::amplify-${cmsAppId}-*`;
+    return [
+      new iam.PolicyStatement({
+        sid: "SignAppSyncAuthoringRequests",
+        actions: ["appsync:GraphQL"],
+        resources: ["Query", "Mutation"].map((typeName) =>
+          this.formatArn({ service: "appsync", resource: "apis", resourceName: `*/types/${typeName}/fields/*`, arnFormat: ArnFormat.SLASH_RESOURCE_NAME }),
+        ),
+      }),
+      new iam.PolicyStatement({
+        sid: "ReadWriteMediaAndPreview",
+        actions: ["s3:GetObject", "s3:PutObject", "s3:DeleteObject"],
+        resources: [`${mediaBucketArn}/media/*`, `${mediaBucketArn}/${resolveStoragePreviewPrefix(config)}*`],
+      }),
+      new iam.PolicyStatement({
+        sid: "ListMediaAndPreview",
+        actions: ["s3:ListBucket"],
+        resources: [mediaBucketArn],
+        conditions: { StringLike: { "s3:prefix": ["media/*", `${resolveStoragePreviewPrefix(config)}*`] } },
+      }),
+      new iam.PolicyStatement({
+        sid: "StartAndInspectAmplifyJobs",
+        actions: ["amplify:StartJob", "amplify:ListJobs", "amplify:GetJob", "amplify:ListBranches"],
+        resources: amplifyAppIds.flatMap((appId) => [
+          this.formatArn({ service: "amplify", resource: "apps", resourceName: appId, arnFormat: ArnFormat.SLASH_RESOURCE_NAME }),
+          this.formatArn({ service: "amplify", resource: "apps", resourceName: `${appId}/*`, arnFormat: ArnFormat.SLASH_RESOURCE_NAME }),
+        ]),
+      }),
+    ];
+  }
+
+  private addAuthoringRole(config: AmplifyAppShellSiteConfig, cmsAppId: string, amplifyAppIds: string[]): void {
+    const authoringRole = new iam.Role(this, "PapyrusAuthoringRole", {
+      roleName: `${config.siteId}-papyrus-authoring`,
+      description: `Papyrus CLI authoring role for ${config.siteId}: AppSync (SigV4), media and preview storage, rebuild jobs. Assumable by principals in this account that are allowed sts:AssumeRole on it.`,
+      assumedBy: new iam.AccountRootPrincipal(),
+    });
+    for (const statement of this.authoringStatements(config, cmsAppId, amplifyAppIds)) {
+      authoringRole.addToPolicy(statement);
     }
+    new CfnOutput(this, "PapyrusAuthoringRoleArn", {
+      value: authoringRole.roleArn,
+      description: `Role the Papyrus CLI assumes for ${config.siteId} (profile role_arn)`,
+    });
   }
 
   private addGithubCiRole(
     config: AmplifyAppShellSiteConfig,
     github: NonNullable<AmplifyAppShellSiteConfig["github"]>,
+    cmsAppId: string,
     amplifyAppIds: string[],
   ): void {
     const provider = iam.OpenIdConnectProvider.fromOpenIdConnectProviderArn(
@@ -183,26 +324,9 @@ export class AmplifyAppShellStack extends Stack {
       }),
     });
 
-    ciRole.addToPolicy(
-      new iam.PolicyStatement({
-        sid: "StartAndInspectAmplifyJobs",
-        actions: ["amplify:StartJob", "amplify:ListJobs", "amplify:GetJob", "amplify:ListBranches"],
-        resources: amplifyAppIds.flatMap((appId) => [
-          this.formatArn({ service: "amplify", resource: "apps", resourceName: appId, arnFormat: ArnFormat.SLASH_RESOURCE_NAME }),
-          this.formatArn({ service: "amplify", resource: "apps", resourceName: `${appId}/*`, arnFormat: ArnFormat.SLASH_RESOURCE_NAME }),
-        ]),
-      }),
-    );
-    ciRole.addToPolicy(
-      new iam.PolicyStatement({
-        sid: "ReadSiteSecretsForJwtMinting",
-        actions: ["ssm:GetParameter", "ssm:GetParameters"],
-        resources: [
-          this.formatArn({ service: "ssm", resource: "parameter", resourceName: `amplify/${this.cmsAppId}/*`, arnFormat: ArnFormat.SLASH_RESOURCE_NAME }),
-          this.formatArn({ service: "ssm", resource: "parameter", resourceName: `amplify/shared/${this.cmsAppId}/*`, arnFormat: ArnFormat.SLASH_RESOURCE_NAME }),
-        ],
-      }),
-    );
+    for (const statement of this.authoringStatements(config, cmsAppId, amplifyAppIds)) {
+      ciRole.addToPolicy(statement);
+    }
     ciRole.addToPolicy(
       new iam.PolicyStatement({
         sid: "WhoAmI",
@@ -250,6 +374,11 @@ export class AmplifyAppShellStack extends Stack {
       platform: "WEB",
       iamServiceRole: readerServiceRole.roleArn,
       buildSpec: readerBuildSpec(config),
+      customRules: [
+        ...(reader.redirects ?? []),
+        { source: "/<*>", target: "/404.html", status: "404-200" },
+      ],
+      customHeaders: readerCustomHeaders(reader.customHeaders),
     });
 
     const readerBranch = new amplify.CfnBranch(this, "ReaderBranch", {
@@ -268,7 +397,7 @@ export class AmplifyAppShellStack extends Stack {
       const readerDomain = new amplify.CfnDomain(this, "ReaderDomain", {
         appId: readerApp.attrAppId,
         domainName: reader.domainName,
-        subDomainSettings: [{ branchName: readerBranchName, prefix: "" }],
+        subDomainSettings: (reader.domainPrefixes ?? [""]).map((prefix) => ({ branchName: readerBranchName, prefix })),
       });
       readerDomain.addResourceDependency(readerBranch);
     }