@anthusai/papyrus 1.0.0-next.9 → 1.1.0

package/amplify/auth/prospectus-google-client.js

@@ -0,0 +1,66 @@
+import { CfnOutput } from "aws-cdk-lib";
+import { CfnUserPoolClient, CfnUserPoolIdentityProvider } from "aws-cdk-lib/aws-cognito";
+/**
+ * The Google-only app client a Papyrus site registers with Prospectus
+ * (Prospectus docs/accounts/GOOGLE_IDENTITY.md, policy google-only-unlinked-v1).
+ * It lives on the site's existing user pool next to the email + Google web
+ * client, but admits only the built-in Google provider through code + PKCE from
+ * the site server, with every native, SRP, custom and client-credentials path
+ * left off. Sessions last one access token: the server keeps no refresh token.
+ */
+export const PROSPECTUS_SIGN_IN_CALLBACK_PATH = "/api/auth/prospectus/callback";
+export const PROSPECTUS_SIGN_IN_TOKEN_VALIDITY_MINUTES = 60;
+export function prospectusSignInCallbackUrls(redirectUrls) {
+    const origins = [];
+    for (const redirectUrl of redirectUrls) {
+        try {
+            const origin = new URL(redirectUrl).origin;
+            if (origin !== "null" && !origins.includes(origin))
+                origins.push(origin);
+        }
+        catch {
+            continue;
+        }
+    }
+    return origins.map((origin) => `${origin}${PROSPECTUS_SIGN_IN_CALLBACK_PATH}`);
+}
+export function prospectusSignInLogoutUrls(redirectUrls) {
+    return prospectusSignInCallbackUrls(redirectUrls).map((callbackUrl) => `${new URL(callbackUrl).origin}/`);
+}
+export function addProspectusGoogleOnlyClient(authStack, userPool, redirectUrls) {
+    const callbackUrls = prospectusSignInCallbackUrls(redirectUrls);
+    if (callbackUrls.length === 0)
+        throw new Error("The Prospectus Google-only client needs at least one site origin.");
+    const googleOnlyClient = new CfnUserPoolClient(authStack, "ProspectusGoogleOnlyClient", {
+        userPoolId: userPool.userPoolId,
+        clientName: "prospectus-google-only",
+        generateSecret: false,
+        supportedIdentityProviders: ["Google"],
+        allowedOAuthFlowsUserPoolClient: true,
+        allowedOAuthFlows: ["code"],
+        allowedOAuthScopes: ["openid", "email", "profile"],
+        callbackUrLs: callbackUrls,
+        logoutUrLs: prospectusSignInLogoutUrls(redirectUrls),
+        explicitAuthFlows: ["ALLOW_REFRESH_TOKEN_AUTH"],
+        enableTokenRevocation: true,
+        preventUserExistenceErrors: "ENABLED",
+        accessTokenValidity: PROSPECTUS_SIGN_IN_TOKEN_VALIDITY_MINUTES,
+        idTokenValidity: PROSPECTUS_SIGN_IN_TOKEN_VALIDITY_MINUTES,
+        refreshTokenValidity: PROSPECTUS_SIGN_IN_TOKEN_VALIDITY_MINUTES,
+        tokenValidityUnits: { accessToken: "minutes", idToken: "minutes", refreshToken: "minutes" },
+    });
+    const googleIdentityProviders = authStack.node
+        .findAll()
+        .filter((construct) => construct instanceof CfnUserPoolIdentityProvider && construct.providerName === "Google");
+    for (const googleIdentityProvider of googleIdentityProviders)
+        googleOnlyClient.addDependency(googleIdentityProvider);
+    new CfnOutput(authStack, "ProspectusGoogleOnlyClientId", {
+        value: googleOnlyClient.ref,
+        description: "clientId for this site's Prospectus registration (accounts/papyrus-sites.json)",
+    });
+    new CfnOutput(authStack, "ProspectusGoogleOnlyIssuer", {
+        value: `https://cognito-idp.${authStack.region}.amazonaws.com/${userPool.userPoolId}`,
+        description: "issuer for this site's Prospectus registration (accounts/papyrus-sites.json)",
+    });
+    return googleOnlyClient;
+}

package/amplify/auth/prospectus-google-client.ts

@@ -0,0 +1,71 @@
+import { CfnOutput, type Stack } from "aws-cdk-lib";
+import { CfnUserPoolClient, CfnUserPoolIdentityProvider, type IUserPool } from "aws-cdk-lib/aws-cognito";
+
+/**
+ * The Google-only app client a Papyrus site registers with Prospectus
+ * (Prospectus docs/accounts/GOOGLE_IDENTITY.md, policy google-only-unlinked-v1).
+ * It lives on the site's existing user pool next to the email + Google web
+ * client, but admits only the built-in Google provider through code + PKCE from
+ * the site server, with every native, SRP, custom and client-credentials path
+ * left off. Sessions last one access token: the server keeps no refresh token.
+ */
+export const PROSPECTUS_SIGN_IN_CALLBACK_PATH = "/api/auth/prospectus/callback";
+export const PROSPECTUS_SIGN_IN_TOKEN_VALIDITY_MINUTES = 60;
+
+export function prospectusSignInCallbackUrls(redirectUrls: readonly string[]): string[] {
+  const origins: string[] = [];
+  for (const redirectUrl of redirectUrls) {
+    try {
+      const origin = new URL(redirectUrl).origin;
+      if (origin !== "null" && !origins.includes(origin)) origins.push(origin);
+    } catch {
+      continue;
+    }
+  }
+  return origins.map((origin) => `${origin}${PROSPECTUS_SIGN_IN_CALLBACK_PATH}`);
+}
+
+export function prospectusSignInLogoutUrls(redirectUrls: readonly string[]): string[] {
+  return prospectusSignInCallbackUrls(redirectUrls).map((callbackUrl) => `${new URL(callbackUrl).origin}/`);
+}
+
+export function addProspectusGoogleOnlyClient(
+  authStack: Stack,
+  userPool: IUserPool,
+  redirectUrls: readonly string[],
+): CfnUserPoolClient {
+  const callbackUrls = prospectusSignInCallbackUrls(redirectUrls);
+  if (callbackUrls.length === 0) throw new Error("The Prospectus Google-only client needs at least one site origin.");
+  const googleOnlyClient = new CfnUserPoolClient(authStack, "ProspectusGoogleOnlyClient", {
+    userPoolId: userPool.userPoolId,
+    clientName: "prospectus-google-only",
+    generateSecret: false,
+    supportedIdentityProviders: ["Google"],
+    allowedOAuthFlowsUserPoolClient: true,
+    allowedOAuthFlows: ["code"],
+    allowedOAuthScopes: ["openid", "email", "profile"],
+    callbackUrLs: callbackUrls,
+    logoutUrLs: prospectusSignInLogoutUrls(redirectUrls),
+    explicitAuthFlows: ["ALLOW_REFRESH_TOKEN_AUTH"],
+    enableTokenRevocation: true,
+    preventUserExistenceErrors: "ENABLED",
+    accessTokenValidity: PROSPECTUS_SIGN_IN_TOKEN_VALIDITY_MINUTES,
+    idTokenValidity: PROSPECTUS_SIGN_IN_TOKEN_VALIDITY_MINUTES,
+    refreshTokenValidity: PROSPECTUS_SIGN_IN_TOKEN_VALIDITY_MINUTES,
+    tokenValidityUnits: { accessToken: "minutes", idToken: "minutes", refreshToken: "minutes" },
+  });
+  const googleIdentityProviders = authStack.node
+    .findAll()
+    .filter((construct): construct is CfnUserPoolIdentityProvider => construct instanceof CfnUserPoolIdentityProvider && construct.providerName === "Google");
+  for (const googleIdentityProvider of googleIdentityProviders) googleOnlyClient.addDependency(googleIdentityProvider);
+
+  new CfnOutput(authStack, "ProspectusGoogleOnlyClientId", {
+    value: googleOnlyClient.ref,
+    description: "clientId for this site's Prospectus registration (accounts/papyrus-sites.json)",
+  });
+  new CfnOutput(authStack, "ProspectusGoogleOnlyIssuer", {
+    value: `https://cognito-idp.${authStack.region}.amazonaws.com/${userPool.userPoolId}`,
+    description: "issuer for this site's Prospectus registration (accounts/papyrus-sites.json)",
+  });
+  return googleOnlyClient;
+}

package/amplify/auth/redirect-urls.js

@@ -0,0 +1,54 @@
+export const DEFAULT_NEWSROOM_BASE_PATH = "/newsroom";
+function parseRedirectUrl(value) {
+    try {
+        const parsed = new URL(value);
+        return { original: value, origin: parsed.origin, path: parsed.pathname.replace(/\/+$/, "") };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Expands every origin in an OAuth redirect list to both the newsroom return
+ * path and the site root, newsroom first. Amplify signs in with the first
+ * entry that matches the current origin, so a list that names only
+ * `https://host/` would land a signed-in editor on the public reader.
+ *
+ * With `newsroomBasePath` of `""` (a CMS-only host that mounts the newsroom at
+ * `/`), the root already is the newsroom and nothing is added. Explicit
+ * entries are kept; unparseable entries pass through unchanged.
+ */
+export function expandNewsroomRedirectUrls(redirectUrls, newsroomBasePath = DEFAULT_NEWSROOM_BASE_PATH) {
+    const newsroomPath = newsroomBasePath.replace(/\/+$/, "");
+    const originOrder = [];
+    const explicitByOrigin = new Map();
+    const passthrough = [];
+    for (const value of redirectUrls) {
+        const parsed = parseRedirectUrl(value);
+        if (!parsed) {
+            passthrough.push(value);
+            continue;
+        }
+        if (!explicitByOrigin.has(parsed.origin)) {
+            originOrder.push(parsed.origin);
+            explicitByOrigin.set(parsed.origin, []);
+        }
+        explicitByOrigin.get(parsed.origin)?.push(value);
+    }
+    const expanded = [];
+    for (const origin of originOrder) {
+        const explicit = explicitByOrigin.get(origin) ?? [];
+        if (newsroomPath === "") {
+            expanded.push(...explicit);
+            continue;
+        }
+        const newsroomEntries = explicit.filter((value) => parseRedirectUrl(value)?.path === newsroomPath);
+        const otherEntries = explicit.filter((value) => {
+            const path = parseRedirectUrl(value)?.path;
+            return path !== newsroomPath && path !== "";
+        });
+        expanded.push(...(newsroomEntries.length > 0 ? newsroomEntries : [`${origin}${newsroomPath}`]), `${origin}/`, ...otherEntries);
+    }
+    expanded.push(...passthrough);
+    return [...new Set(expanded)];
+}

package/amplify/auth/redirect-urls.ts

@@ -0,0 +1,66 @@
+export const DEFAULT_NEWSROOM_BASE_PATH = "/newsroom";
+
+type ParsedRedirectUrl = { original: string; origin: string; path: string } | null;
+
+function parseRedirectUrl(value: string): ParsedRedirectUrl {
+  try {
+    const parsed = new URL(value);
+    return { original: value, origin: parsed.origin, path: parsed.pathname.replace(/\/+$/, "") };
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Expands every origin in an OAuth redirect list to both the newsroom return
+ * path and the site root, newsroom first. Amplify signs in with the first
+ * entry that matches the current origin, so a list that names only
+ * `https://host/` would land a signed-in editor on the public reader.
+ *
+ * With `newsroomBasePath` of `""` (a CMS-only host that mounts the newsroom at
+ * `/`), the root already is the newsroom and nothing is added. Explicit
+ * entries are kept; unparseable entries pass through unchanged.
+ */
+export function expandNewsroomRedirectUrls(
+  redirectUrls: readonly string[],
+  newsroomBasePath: string = DEFAULT_NEWSROOM_BASE_PATH,
+): string[] {
+  const newsroomPath = newsroomBasePath.replace(/\/+$/, "");
+  const originOrder: string[] = [];
+  const explicitByOrigin = new Map<string, string[]>();
+  const passthrough: string[] = [];
+
+  for (const value of redirectUrls) {
+    const parsed = parseRedirectUrl(value);
+    if (!parsed) {
+      passthrough.push(value);
+      continue;
+    }
+    if (!explicitByOrigin.has(parsed.origin)) {
+      originOrder.push(parsed.origin);
+      explicitByOrigin.set(parsed.origin, []);
+    }
+    explicitByOrigin.get(parsed.origin)?.push(value);
+  }
+
+  const expanded: string[] = [];
+  for (const origin of originOrder) {
+    const explicit = explicitByOrigin.get(origin) ?? [];
+    if (newsroomPath === "") {
+      expanded.push(...explicit);
+      continue;
+    }
+    const newsroomEntries = explicit.filter((value) => parseRedirectUrl(value)?.path === newsroomPath);
+    const otherEntries = explicit.filter((value) => {
+      const path = parseRedirectUrl(value)?.path;
+      return path !== newsroomPath && path !== "";
+    });
+    expanded.push(
+      ...(newsroomEntries.length > 0 ? newsroomEntries : [`${origin}${newsroomPath}`]),
+      `${origin}/`,
+      ...otherEntries,
+    );
+  }
+  expanded.push(...passthrough);
+  return [...new Set(expanded)];
+}

package/amplify/auth/resource.js

@@ -1,8 +1,11 @@
 import { defineAuth, secret } from "@aws-amplify/backend";
 import { manageUserRole } from "../functions/manage-user-role/resource.js";
+import { CfnUserPoolDomain } from "aws-cdk-lib/aws-cognito";
+import { expandNewsroomRedirectUrls } from "./redirect-urls.js";
 // Default OAuth redirect URLs for the p.apyr.us app. Other publications pass
 // `auth.redirectUrls` to `defineSiteBackend` (or, for Papyrus's own backend,
 // the PAPYRUS_OAUTH_REDIRECT_URLS branch env var, comma-separated).
+// `defineSiteAuth` adds the newsroom and root variants of every origin listed.
 // See docs/google-oauth-setup.md.
 const DEFAULT_AUTH_REDIRECT_URLS = [
     "http://localhost:3001/",
@@ -25,15 +28,16 @@ export function authConfigFromEnv() {
     return {
         redirectUrls: resolveAuthRedirectUrls(),
         disableGoogleOAuth: process.env.PAPYRUS_DISABLE_GOOGLE_OAUTH === "1",
-        // Stable Cognito hosted-UI domain prefix for Google OAuth redirect URIs.
-        // See docs/google-oauth-setup.md.
         cognitoDomainPrefix: (process.env.PAPYRUS_COGNITO_DOMAIN_PREFIX ?? "").trim(),
+        applyCognitoDomainPrefix: process.env.PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX === "true",
     };
 }
+export function siteAuthRedirectUrls(config) {
+    return config.redirectUrls ?? DEFAULT_AUTH_REDIRECT_URLS;
+}
 export function defineSiteAuth(config) {
-    const authRedirectUrls = config.redirectUrls ?? DEFAULT_AUTH_REDIRECT_URLS;
+    const authRedirectUrls = expandNewsroomRedirectUrls(siteAuthRedirectUrls(config), config.newsroomBasePath);
     const disableGoogleOAuth = config.disableGoogleOAuth === true;
-    const cognitoDomainPrefix = (config.cognitoDomainPrefix ?? "").trim();
     return defineAuth({
         loginWith: {
             email: true,
@@ -49,7 +53,6 @@ export function defineSiteAuth(config) {
                         scopes: ["EMAIL", "PROFILE", "OPENID"],
                         callbackUrls: authRedirectUrls,
                         logoutUrls: authRedirectUrls,
-                        ...(cognitoDomainPrefix ? { domainPrefix: cognitoDomainPrefix } : {}),
                     },
                 }),
         },
@@ -59,3 +62,18 @@ export function defineSiteAuth(config) {
         ],
     });
 }
+// Amplify Gen2's auth factory overwrites `externalProviders.domainPrefix` with a
+// hash of the backend id, so the prefix cannot be passed through `defineAuth`.
+// This sets the user pool domain on the synthesized resource instead. Cognito
+// cannot rename a pool domain in place: CloudFormation replaces the domain,
+// which changes the hosted-UI URL and the Google redirect URI. Callers must
+// only use it when the site opted in (see docs/google-oauth-setup.md).
+export function applyCognitoDomainPrefix(authStack, cognitoDomainPrefix) {
+    const domainResources = authStack.node
+        .findAll()
+        .filter((construct) => construct instanceof CfnUserPoolDomain);
+    if (domainResources.length !== 1) {
+        throw new Error(`Expected exactly one Cognito user pool domain in the auth stack to apply cognitoDomainPrefix, found ${domainResources.length}`);
+    }
+    domainResources[0].domain = cognitoDomainPrefix;
+}

package/amplify/auth/resource.ts

@@ -1,10 +1,14 @@
 import { defineAuth, secret } from "@aws-amplify/backend";
 import { manageUserRole } from "../functions/manage-user-role/resource";
+import { Stack } from "aws-cdk-lib";
+import { CfnUserPoolDomain } from "aws-cdk-lib/aws-cognito";
 import type { PapyrusAuthConfig } from "../site-backend-config";
+import { expandNewsroomRedirectUrls } from "./redirect-urls";
 
 // Default OAuth redirect URLs for the p.apyr.us app. Other publications pass
 // `auth.redirectUrls` to `defineSiteBackend` (or, for Papyrus's own backend,
 // the PAPYRUS_OAUTH_REDIRECT_URLS branch env var, comma-separated).
+// `defineSiteAuth` adds the newsroom and root variants of every origin listed.
 // See docs/google-oauth-setup.md.
 const DEFAULT_AUTH_REDIRECT_URLS = [
   "http://localhost:3001/",
@@ -28,16 +32,21 @@ export function authConfigFromEnv(): PapyrusAuthConfig {
   return {
     redirectUrls: resolveAuthRedirectUrls(),
     disableGoogleOAuth: process.env.PAPYRUS_DISABLE_GOOGLE_OAUTH === "1",
-    // Stable Cognito hosted-UI domain prefix for Google OAuth redirect URIs.
-    // See docs/google-oauth-setup.md.
     cognitoDomainPrefix: (process.env.PAPYRUS_COGNITO_DOMAIN_PREFIX ?? "").trim(),
+    applyCognitoDomainPrefix: process.env.PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX === "true",
   };
 }
 
+export function siteAuthRedirectUrls(config: PapyrusAuthConfig): string[] {
+  return config.redirectUrls ?? DEFAULT_AUTH_REDIRECT_URLS;
+}
+
 export function defineSiteAuth(config: PapyrusAuthConfig) {
-  const authRedirectUrls = config.redirectUrls ?? DEFAULT_AUTH_REDIRECT_URLS;
+  const authRedirectUrls = expandNewsroomRedirectUrls(
+    siteAuthRedirectUrls(config),
+    config.newsroomBasePath,
+  );
   const disableGoogleOAuth = config.disableGoogleOAuth === true;
-  const cognitoDomainPrefix = (config.cognitoDomainPrefix ?? "").trim();
   return defineAuth({
     loginWith: {
       email: true,
@@ -53,7 +62,6 @@ export function defineSiteAuth(config: PapyrusAuthConfig) {
               scopes: ["EMAIL", "PROFILE", "OPENID"],
               callbackUrls: authRedirectUrls,
               logoutUrls: authRedirectUrls,
-              ...(cognitoDomainPrefix ? { domainPrefix: cognitoDomainPrefix } : {}),
             },
           }),
     },
@@ -63,3 +71,21 @@ export function defineSiteAuth(config: PapyrusAuthConfig) {
     ],
   });
 }
+
+// Amplify Gen2's auth factory overwrites `externalProviders.domainPrefix` with a
+// hash of the backend id, so the prefix cannot be passed through `defineAuth`.
+// This sets the user pool domain on the synthesized resource instead. Cognito
+// cannot rename a pool domain in place: CloudFormation replaces the domain,
+// which changes the hosted-UI URL and the Google redirect URI. Callers must
+// only use it when the site opted in (see docs/google-oauth-setup.md).
+export function applyCognitoDomainPrefix(authStack: Stack, cognitoDomainPrefix: string): void {
+  const domainResources = authStack.node
+    .findAll()
+    .filter((construct): construct is CfnUserPoolDomain => construct instanceof CfnUserPoolDomain);
+  if (domainResources.length !== 1) {
+    throw new Error(
+      `Expected exactly one Cognito user pool domain in the auth stack to apply cognitoDomainPrefix, found ${domainResources.length}`,
+    );
+  }
+  domainResources[0].domain = cognitoDomainPrefix;
+}