@anthusai/papyrus 1.15.0 → 1.16.0

package/infra/amplify-app-shell.js

@@ -43,11 +43,22 @@ The stack also creates the `<siteId>-papyrus-authoring` role. The CLI signs
  * AppSync requests (SigV4) with credentials for that role (SSO, OIDC or any
  * principal in the account that may assume it); no token is stored anywhere.
  *
- * No repository and no access token are configured: the apps are manual-deploy
- * until Amplify's GitHub App is connected once in the console
- * (docs/site-hosting.md). The Papyrus backend itself is created inside the CMS
+ * Unless `repositoryAccessTokenSecretArn` is set, no repository and no access
+ * token are configured: the apps are manual-deploy until Amplify's GitHub App is
+ * connected once in the console (docs/site-hosting.md). When it is set, both apps
+ * are created against `repository` and read the GitHub token from that Secrets
+ * Manager secret through a CloudFormation dynamic reference, so the token never
+ * appears in site.json or the synthesized template. The Papyrus backend itself is created inside the CMS
  * app by `ampx pipeline-deploy` from the production build.
  */
+function repositoryConnectionProperties(config) {
+    if (config.repositoryAccessTokenSecretArn === undefined)
+        return {};
+    return {
+        repository: config.repository,
+        accessToken: `{{resolve:secretsmanager:${config.repositoryAccessTokenSecretArn}:SecretString}}`,
+    };
+}
 export class AmplifyAppShellStack extends Stack {
     cmsAppId;
     readerAppId;
@@ -114,7 +125,9 @@ export class AmplifyAppShellStack extends Stack {
                 resources: PROSPECTUS_PAPYRUS_SITE_ROUTES.map((route) => `${prospectusAccountsApiStageArn}/${route}`),
             }));
         }
+        const repositoryConnection = repositoryConnectionProperties(config);
         const cmsApp = new amplify.CfnApp(this, "App", {
+            ...repositoryConnection,
             name: cmsAppName,
             description: `Papyrus newsroom CMS for ${config.siteId} (WEB_COMPUTE)`,
             platform: "WEB_COMPUTE",
@@ -332,6 +345,7 @@ export class AmplifyAppShellStack extends Stack {
             resources: ["arn:aws:s3:::amplify-*/media/*"],
         }));
         const readerApp = new amplify.CfnApp(this, "ReaderApp", {
+            ...repositoryConnectionProperties(config),
             name: readerAppName,
             description: `Papyrus static reader for ${config.siteId} (WEB)`,
             platform: "WEB",

package/infra/amplify-app-shell.ts

@@ -46,11 +46,22 @@ The stack also creates the `<siteId>-papyrus-authoring` role. The CLI signs
  * AppSync requests (SigV4) with credentials for that role (SSO, OIDC or any
  * principal in the account that may assume it); no token is stored anywhere.
  *
- * No repository and no access token are configured: the apps are manual-deploy
- * until Amplify's GitHub App is connected once in the console
- * (docs/site-hosting.md). The Papyrus backend itself is created inside the CMS
+ * Unless `repositoryAccessTokenSecretArn` is set, no repository and no access
+ * token are configured: the apps are manual-deploy until Amplify's GitHub App is
+ * connected once in the console (docs/site-hosting.md). When it is set, both apps
+ * are created against `repository` and read the GitHub token from that Secrets
+ * Manager secret through a CloudFormation dynamic reference, so the token never
+ * appears in site.json or the synthesized template. The Papyrus backend itself is created inside the CMS
  * app by `ampx pipeline-deploy` from the production build.
  */
+function repositoryConnectionProperties(config: AmplifyAppShellSiteConfig): { repository?: string; accessToken?: string } {
+  if (config.repositoryAccessTokenSecretArn === undefined) return {};
+  return {
+    repository: config.repository,
+    accessToken: `{{resolve:secretsmanager:${config.repositoryAccessTokenSecretArn}:SecretString}}`,
+  };
+}
+
 export class AmplifyAppShellStack extends Stack {
   public readonly cmsAppId?: string;
   public readonly readerAppId?: string;
@@ -130,7 +141,10 @@ export class AmplifyAppShellStack extends Stack {
       );
     }
 
+    const repositoryConnection = repositoryConnectionProperties(config);
+
     const cmsApp = new amplify.CfnApp(this, "App", {
+      ...repositoryConnection,
       name: cmsAppName,
       description: `Papyrus newsroom CMS for ${config.siteId} (WEB_COMPUTE)`,
       platform: "WEB_COMPUTE",
@@ -389,6 +403,7 @@ export class AmplifyAppShellStack extends Stack {
     );
 
     const readerApp = new amplify.CfnApp(this, "ReaderApp", {
+      ...repositoryConnectionProperties(config),
       name: readerAppName,
       description: `Papyrus static reader for ${config.siteId} (WEB)`,
       platform: "WEB",

package/infra/site-config.js

@@ -5,6 +5,7 @@ export function hasCmsApp(config) {
 export const DEFAULT_CI_BRANCHES = ["main", "staging"];
 const SITE_ID_PATTERN = /^[a-z][a-z0-9]*(-[a-z0-9]+)*$/;
 const REPOSITORY_PATTERN = /^https:\/\/github\.com\/[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
+const SECRETS_MANAGER_SECRET_ARN_PATTERN = /^arn:aws:secretsmanager:[a-z0-9-]+:\d{12}:secret:[A-Za-z0-9/_+=.@-]+$/;
 const HOSTED_ZONE_ID_PATTERN = /^Z[A-Z0-9]+$/;
 const HOST_NAME_PATTERN = /^([a-z0-9]([a-z0-9-]*[a-z0-9])?\.)+[a-z]{2,}$/;
 const DOMAIN_PREFIX_PATTERN = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/;
@@ -297,9 +298,12 @@ function validateOauthRedirectUrls(config) {
 }
 export function parseSiteConfig(raw) {
     const record = requireObject(raw, "site");
-    rejectUnknownKeys(record, ["siteId", "repository", "brand", "frontend", "hostedZoneId", "stackName", "cms", "reader", "papyrusVersion", "storagePreviewPrefix", "github"], "site");
+    rejectUnknownKeys(record, ["siteId", "repository", "repositoryAccessTokenSecretArn", "brand", "frontend", "hostedZoneId", "stackName", "cms", "reader", "papyrusVersion", "storagePreviewPrefix", "github"], "site");
     const siteId = requireString(record.siteId, "siteId", SITE_ID_PATTERN, "kebab-case");
     const repository = requireString(record.repository, "repository", REPOSITORY_PATTERN, "https://github.com/<org>/<repo>");
+    const repositoryAccessTokenSecretArn = record.repositoryAccessTokenSecretArn === undefined
+        ? undefined
+        : requireString(record.repositoryAccessTokenSecretArn, "repositoryAccessTokenSecretArn", SECRETS_MANAGER_SECRET_ARN_PATTERN, "Secrets Manager secret ARN");
     const brand = requireString(record.brand, "brand");
     const frontend = requireString(record.frontend, "frontend");
     if (frontend !== "pretext" && frontend !== "markus-static") {
@@ -382,6 +386,7 @@ export function parseSiteConfig(raw) {
     const config = {
         siteId,
         repository,
+        repositoryAccessTokenSecretArn,
         brand,
         frontend,
         hostedZoneId,

package/infra/site-config.ts

@@ -47,6 +47,7 @@ export type CmsConfig = {
 export type AmplifyAppShellSiteConfig = {
   siteId: string;
   repository: string;
+  repositoryAccessTokenSecretArn?: string;
   brand: string;
   frontend: "pretext" | "markus-static";
   hostedZoneId?: string;
@@ -85,6 +86,7 @@ export const DEFAULT_CI_BRANCHES = ["main", "staging"];
 
 const SITE_ID_PATTERN = /^[a-z][a-z0-9]*(-[a-z0-9]+)*$/;
 const REPOSITORY_PATTERN = /^https:\/\/github\.com\/[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
+const SECRETS_MANAGER_SECRET_ARN_PATTERN = /^arn:aws:secretsmanager:[a-z0-9-]+:\d{12}:secret:[A-Za-z0-9/_+=.@-]+$/;
 const HOSTED_ZONE_ID_PATTERN = /^Z[A-Z0-9]+$/;
 const HOST_NAME_PATTERN = /^([a-z0-9]([a-z0-9-]*[a-z0-9])?\.)+[a-z]{2,}$/;
 const DOMAIN_PREFIX_PATTERN = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/;
@@ -392,12 +394,15 @@ export function parseSiteConfig(raw: unknown): AmplifyAppShellSiteConfig {
   const record = requireObject(raw, "site");
   rejectUnknownKeys(
     record,
-    ["siteId", "repository", "brand", "frontend", "hostedZoneId", "stackName", "cms", "reader", "papyrusVersion", "storagePreviewPrefix", "github"],
+    ["siteId", "repository", "repositoryAccessTokenSecretArn", "brand", "frontend", "hostedZoneId", "stackName", "cms", "reader", "papyrusVersion", "storagePreviewPrefix", "github"],
     "site",
   );
 
   const siteId = requireString(record.siteId, "siteId", SITE_ID_PATTERN, "kebab-case");
   const repository = requireString(record.repository, "repository", REPOSITORY_PATTERN, "https://github.com/<org>/<repo>");
+  const repositoryAccessTokenSecretArn = record.repositoryAccessTokenSecretArn === undefined
+    ? undefined
+    : requireString(record.repositoryAccessTokenSecretArn, "repositoryAccessTokenSecretArn", SECRETS_MANAGER_SECRET_ARN_PATTERN, "Secrets Manager secret ARN");
   const brand = requireString(record.brand, "brand");
   const frontend = requireString(record.frontend, "frontend");
   if (frontend !== "pretext" && frontend !== "markus-static") {
@@ -480,6 +485,7 @@ export function parseSiteConfig(raw: unknown): AmplifyAppShellSiteConfig {
   const config: AmplifyAppShellSiteConfig = {
     siteId,
     repository,
+    repositoryAccessTokenSecretArn,
     brand,
     frontend,
     hostedZoneId,

package/package.json

@@ -377,7 +377,7 @@
       "optional": true
     }
   },
-  "version": "1.15.0",
+  "version": "1.16.0",
   "dependencies": {
     "@aws-amplify/adapter-nextjs": "^1.7.3",
     "@aws-crypto/sha256-js": "5.2.0",

package/routes.manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.15.0",
+  "version": "1.16.0",
   "routes": [
     {
       "file": "app/%5F_preview/[[...path]]/route.ts",