@anthusai/papyrus 2.0.0-next.11 → 2.0.0-next.110

package/lib/papyrus-hosted-chat.ts

@@ -0,0 +1,217 @@
+import { createHash } from "node:crypto";
+import type { EmbeddedChatAppDependencies } from "chatticus/chat-server";
+import type { NextRequest } from "next/server";
+import {
+  ProspectusAccountsError,
+  authorizeSignedInPersonForAccount,
+} from "./prospectus-site-identity";
+import {
+  resolveProspectusSignInRuntime,
+  signedInProspectusSession,
+  type ProspectusSignInRuntime,
+} from "./prospectus-session";
+import { prospectusSiteProduct, publishingAccountsForSite } from "./prospectus-publication-access";
+import { publicSiteOrigin } from "./site-origin-value";
+
+const NO_STORE_HEADERS = { "cache-control": "no-store" };
+
+export interface PapyrusChatScope {
+  siteProduct: string;
+  accountId: string;
+  personId: string;
+  tenantId: string;
+  editorId: string;
+}
+
+export interface PapyrusHostedChatOptions {
+  resolveRuntime?: (siteOrigin: string) => Promise<ProspectusSignInRuntime | null>;
+  resolvePrivateDependencies?: () => Promise<EmbeddedChatAppDependencies | null>;
+  privateChatEnabled?: boolean;
+  siteProduct?: string | null;
+  environment?: Record<string, string | undefined>;
+  nowInSeconds?: () => number;
+}
+
+function siteAndAccountKey(siteProduct: string, accountId: string): string {
+  return createHash("sha256").update(JSON.stringify([siteProduct, accountId])).digest("hex");
+}
+
+export function derivePapyrusChatScope(siteProduct: string, accountId: string, personId: string): PapyrusChatScope {
+  const tenantHash = siteAndAccountKey(siteProduct, accountId);
+  const editorHash = createHash("sha256").update(JSON.stringify([siteProduct, accountId, personId])).digest("hex");
+  return {
+    siteProduct,
+    personId,
+    accountId,
+    tenantId: `papyrus-${tenantHash.slice(0, 40)}`,
+    editorId: `papyrus-editor-${editorHash.slice(0, 40)}`,
+  };
+}
+
+type ResolvedPapyrusPrincipal = {
+  kind: "user";
+  tenantId: string;
+  userId: string;
+  workerId: null;
+  organizationStatus: "enabled";
+  role: "member";
+};
+
+async function principalForRequest(
+  request: NextRequest,
+  operation: "console:read" | "console:write",
+  options: PapyrusHostedChatOptions,
+): Promise<{ principal: ResolvedPapyrusPrincipal | null; status: number }> {
+  const environment = options.environment ?? process.env;
+  const siteProduct = options.siteProduct !== undefined ? options.siteProduct : prospectusSiteProduct(environment);
+  if (!siteProduct) return { principal: null, status: 503 };
+
+  let runtime: ProspectusSignInRuntime | null;
+  try {
+    runtime = await (options.resolveRuntime ?? resolveProspectusSignInRuntime)(publicSiteOrigin(request, environment));
+  } catch {
+    return { principal: null, status: 503 };
+  }
+  if (!runtime) return { principal: null, status: 503 };
+
+  const nowInSeconds = options.nowInSeconds?.() ?? Math.floor(Date.now() / 1000);
+  const session = signedInProspectusSession(request, runtime.sealingSecret, nowInSeconds);
+  if (!session || !session.selectedAccountId || !Number.isFinite(session.accessTokenExpiresAt) || session.accessTokenExpiresAt <= nowInSeconds) {
+    return { principal: null, status: 401 };
+  }
+
+  try {
+    const directory = await runtime.accounts.accountDirectory(session.accessToken);
+    if (directory.person?.id !== session.personId) return { principal: null, status: 401 };
+    if (!publishingAccountsForSite(directory.accounts, siteProduct).some((account) => account.accountId === session.selectedAccountId)) {
+      return { principal: null, status: 403 };
+    }
+    const authorization = await authorizeSignedInPersonForAccount(
+      runtime.accounts,
+      session.accessToken,
+      session.selectedAccountId,
+      operation,
+    );
+    if (authorization.personId !== session.personId || authorization.accountId !== session.selectedAccountId || authorization.operation !== operation) {
+      return { principal: null, status: 403 };
+    }
+    const scope = derivePapyrusChatScope(siteProduct, session.selectedAccountId, session.personId);
+    return {
+      principal: {
+        kind: "user",
+        tenantId: scope.tenantId,
+        userId: scope.editorId,
+        workerId: null,
+        organizationStatus: "enabled",
+        role: "member",
+      },
+      status: 200,
+    };
+  } catch (error) {
+    if (error instanceof ProspectusAccountsError && (error.status === 401 || error.status === 403)) {
+      return { principal: null, status: error.status };
+    }
+    return { principal: null, status: 503 };
+  }
+}
+
+function jsonFailure(status: number, error: string): Response {
+  return new Response(JSON.stringify({ error }), {
+    status,
+    headers: { ...NO_STORE_HEADERS, "content-type": "application/json" },
+  });
+}
+
+function supportedPath(path: readonly string[]): boolean {
+  return (path.length === 1 && path[0] === "private-channel") ||
+    (path.length === 3 && path[0] === "channels" && path[2] === "messages") ||
+    (path.length === 3 && path[0] === "turns" && (path[2] === "events" || path[2] === "stream"));
+}
+
+function chatRequestPath(path: readonly string[]): string {
+  return `/${path.map((part) => encodeURIComponent(part)).join("/")}`;
+}
+
+export async function handlePapyrusHostedChatRequest(
+  request: NextRequest,
+  path: readonly string[],
+  options: PapyrusHostedChatOptions = {},
+): Promise<Response> {
+  if (!supportedPath(path) || path.some((part) => !part || part === "." || part === ".." || part.includes("/"))) {
+    return jsonFailure(404, "chat_route_not_found");
+  }
+  if (request.method !== "GET" && request.method !== "POST") return jsonFailure(405, "method_not_allowed");
+  const isMessageRoute = path[0] === "channels";
+  const isPrivateChannelRoute = path[0] === "private-channel";
+  if (isPrivateChannelRoute && request.method !== "POST") return jsonFailure(405, "method_not_allowed");
+  if ((isMessageRoute && path[2] === "messages" && request.method === "POST") || (!isMessageRoute && !isPrivateChannelRoute && request.method !== "GET")) {
+    if (!isMessageRoute && !isPrivateChannelRoute) return jsonFailure(405, "method_not_allowed");
+  }
+  if (isMessageRoute && request.method === "GET" && path[2] !== "messages") return jsonFailure(405, "method_not_allowed");
+  if ((isMessageRoute || isPrivateChannelRoute) && request.method === "POST") {
+    let origin: string;
+    try {
+      origin = publicSiteOrigin(request, options.environment ?? process.env);
+    } catch {
+      return jsonFailure(503, "chat_site_origin_unavailable");
+    }
+    if (request.headers.get("origin") !== origin) return jsonFailure(403, "same_origin_required");
+  }
+
+  const environment = options.environment ?? process.env;
+  const privateChatEnabled = options.privateChatEnabled ?? environment.PAPYRUS_PRIVATE_CHAT_ENABLED === "true";
+  if (!privateChatEnabled) return jsonFailure(404, "private_chat_disabled");
+
+  let dependencies: EmbeddedChatAppDependencies | null;
+  try {
+    if (options.resolvePrivateDependencies) {
+      dependencies = await options.resolvePrivateDependencies();
+    } else {
+      const chatRuntime = await import("chatticus/chat-runtime");
+      dependencies = chatRuntime.createSiteHostedChatDependencies(
+        chatRuntime.siteHostedChatResourcesFromEnvironment(environment),
+        chatRuntime.siteHostedChatClients(),
+      ) as EmbeddedChatAppDependencies;
+    }
+  } catch {
+    dependencies = null;
+  }
+  if (!dependencies) return jsonFailure(503, "private_chat_storage_unavailable");
+
+  const authorization = await principalForRequest(request, request.method === "POST" ? "console:write" : "console:read", options);
+  if (!authorization.principal) return jsonFailure(authorization.status, authorization.status === 401 ? "sign_in_required" : authorization.status === 403 ? "chat_account_access_denied" : "chat_runtime_unavailable");
+
+  const headers = new Headers({ accept: request.headers.get("accept") ?? "application/json" });
+  let body: string | undefined;
+  if (request.method === "POST" && isMessageRoute) {
+    const idempotencyKey = request.headers.get("idempotency-key")?.trim();
+    const input = await request.json().catch(() => null) as Record<string, unknown> | null;
+    const privateBotId = environment.PAPYRUS_CHAT_PRIVATE_BOT_ID?.trim();
+    if (!idempotencyKey || typeof input?.body !== "string" || !input.body.trim()) {
+      return jsonFailure(422, "message_body_and_idempotency_key_required");
+    }
+    if (!privateBotId) return jsonFailure(503, "private_chat_storage_unavailable");
+    headers.set("content-type", "application/json");
+    headers.set("idempotency-key", idempotencyKey);
+    body = JSON.stringify({
+      author_kind: "human",
+      author_id: authorization.principal.userId,
+      body: input.body,
+      addressed_to_bot_id: privateBotId,
+    });
+  }
+
+  const target = new URL(chatRequestPath(path) + new URL(request.url).search, request.url);
+  const forwarded = new Request(target, { method: request.method, headers, ...(body === undefined ? {} : { body }) });
+  let chatServer: typeof import("chatticus/chat-server");
+  try {
+    chatServer = await import("chatticus/chat-server");
+  } catch {
+    return jsonFailure(503, "private_chat_storage_unavailable");
+  }
+  const app = chatServer.createEmbeddedChatApp({
+    ...dependencies,
+    resolvePrincipal: async () => authorization.principal,
+  });
+  return app.fetch(forwarded);
+}

package/lib/papyrus-private-chat-client.ts

@@ -0,0 +1,81 @@
+export type PapyrusPrivateChatChannel = {
+  channel_id: string;
+  participants: Array<{ kind: string; actor_id: string }>;
+};
+
+export type PapyrusPrivateChatMessage = {
+  message_id: string;
+  channel_id: string;
+  seq: number;
+  author_kind: "human" | "bot";
+  body: string;
+  addressed_to_bot_id: string | null;
+  created_at: string;
+};
+
+export type PapyrusPrivateChatSendResult = {
+  message: PapyrusPrivateChatMessage;
+  turn_id: string | null;
+};
+
+export type PapyrusPrivateChatFetch = typeof globalThis.fetch;
+
+const CHAT_API = "/api/newsroom/chat";
+
+async function requestJson<T>(path: string, init: RequestInit, fetcher: PapyrusPrivateChatFetch): Promise<T> {
+  const response = await fetcher(`${CHAT_API}/${path}`, {
+    ...init,
+    credentials: "same-origin",
+    cache: "no-store",
+  });
+  const payload = await response.json().catch(() => null) as Record<string, unknown> | null;
+  if (!response.ok) {
+    const error = typeof payload?.error === "string" ? payload.error
+      : typeof payload?.detail === "string" ? payload.detail
+        : `Private chat request failed (${response.status}).`;
+    throw new Error(error);
+  }
+  if (!payload || typeof payload !== "object") throw new Error("Private chat returned an invalid response.");
+  return payload as T;
+}
+
+/** Open the current editor's server-derived private channel using the signed same-origin session cookie. */
+export async function openPapyrusPrivateChat(fetcher: PapyrusPrivateChatFetch = globalThis.fetch): Promise<PapyrusPrivateChatChannel> {
+  const result = await requestJson<PapyrusPrivateChatChannel>("private-channel", { method: "POST" }, fetcher);
+  if (!result.channel_id?.trim() || !Array.isArray(result.participants)) {
+    throw new Error("Private chat returned an invalid channel.");
+  }
+  return result;
+}
+
+/** Read only the private channel returned by the host's authenticated open request. */
+export async function listPapyrusPrivateChatMessages(
+  channelId: string,
+  fetcher: PapyrusPrivateChatFetch = globalThis.fetch,
+): Promise<PapyrusPrivateChatMessage[]> {
+  if (!channelId.trim()) throw new Error("A private chat channel is required.");
+  const result = await requestJson<{ messages?: unknown }>(`channels/${encodeURIComponent(channelId)}/messages`, { method: "GET" }, fetcher);
+  if (!Array.isArray(result.messages)) throw new Error("Private chat returned an invalid message list.");
+  return result.messages as PapyrusPrivateChatMessage[];
+}
+
+/** One explicit send. The browser sends neither its tenant nor author or bot identity. */
+export async function sendPapyrusPrivateChatMessage(
+  channelId: string,
+  body: string,
+  idempotencyKey: string,
+  fetcher: PapyrusPrivateChatFetch = globalThis.fetch,
+): Promise<PapyrusPrivateChatSendResult> {
+  if (!channelId.trim() || !body.trim() || !idempotencyKey.trim()) {
+    throw new Error("A channel, message and idempotency key are required.");
+  }
+  const result = await requestJson<PapyrusPrivateChatSendResult>(`channels/${encodeURIComponent(channelId)}/messages`, {
+    method: "POST",
+    headers: { "content-type": "application/json", "idempotency-key": idempotencyKey },
+    body: JSON.stringify({ body }),
+  }, fetcher);
+  if (!result.message?.message_id || result.message.channel_id !== channelId) {
+    throw new Error("Private chat returned an invalid sent message.");
+  }
+  return result;
+}

package/lib/prospectus-session.ts

@@ -1,5 +1,6 @@
 import { createCipheriv, createDecipheriv, hkdfSync, randomBytes } from "node:crypto";
-import { GetSecretValueCommand, SecretsManagerClient } from "@aws-sdk/client-secrets-manager";
+import { GetParameterCommand, SSMClient } from "@aws-sdk/client-ssm";
+import type { NextRequest } from "next/server";
 import { readAmplifyOutputsFile } from "./amplify-outputs-path";
 import {
   ProspectusSiteAccounts,
@@ -21,7 +22,7 @@ import {
 export const PROSPECTUS_PENDING_SIGN_IN_COOKIE = "__Host-papyrus-prospectus-pending";
 export const PROSPECTUS_SESSION_COOKIE = "__Host-papyrus-prospectus-session";
 export const PROSPECTUS_ACCOUNTS_ENDPOINT_ENV = "PAPYRUS_PROSPECTUS_ACCOUNTS_ENDPOINT";
-export const PROSPECTUS_SESSION_SECRET_ARN_ENV = "PAPYRUS_PROSPECTUS_SESSION_SECRET_ARN";
+export const PROSPECTUS_SESSION_SECRET_PARAMETER_ENV = "PAPYRUS_PROSPECTUS_SESSION_SECRET_PARAMETER";
 export const PROSPECTUS_SESSION_SECRET_CACHE_MILLISECONDS = 5 * 60 * 1000;
 
 const SEALED_COOKIE_FORMAT_VERSION = "v1";
@@ -39,6 +40,21 @@ export interface ProspectusSignedInSession {
   accessToken: string;
   accessTokenExpiresAt: number;
   selectedAccountId?: string;
+  siteSubject?: string;
+}
+
+/** Open the existing sealed Prospectus session cookie for one server request. */
+export function signedInProspectusSession(
+  request: Pick<NextRequest, "cookies">,
+  sealingSecret: string,
+  nowInSeconds?: number,
+): ProspectusSignedInSession | null {
+  return openProspectusCookie<ProspectusSignedInSession>(
+    sealingSecret,
+    PROSPECTUS_SESSION_COOKIE,
+    request.cookies.get(PROSPECTUS_SESSION_COOKIE)?.value,
+    nowInSeconds,
+  );
 }
 
 function sealingKeyForCookie(sealingSecret: string, cookieName: string): Buffer {
@@ -101,37 +117,37 @@ export function sameSiteReturnPath(requestedReturnPath: string | null | undefine
   return `${parsed.pathname}${parsed.search}${parsed.hash}`;
 }
 
-export type ProspectusSessionSecretReader = (secretArn: string) => Promise<string | null>;
+export type ProspectusSessionSecretReader = (parameterName: string) => Promise<string | null>;
 
-type CachedSealingSecret = { secretArn: string; value: string; expiresAt: number };
+type CachedSealingSecret = { parameterName: string; value: string; expiresAt: number };
 
 let cachedSealingSecret: CachedSealingSecret | null = null;
-let defaultSecretsManagerClient: SecretsManagerClient | null = null;
+let defaultSsmClient: SSMClient | null = null;
 
 export function resetProspectusSessionSecretCache(): void {
   cachedSealingSecret = null;
 }
 
-async function readSealingSecretFromSecretsManager(secretArn: string): Promise<string | null> {
-  defaultSecretsManagerClient ??= new SecretsManagerClient({});
-  const response = await defaultSecretsManagerClient.send(new GetSecretValueCommand({ SecretId: secretArn }));
-  return response.SecretString?.trim() || null;
+export async function readSealingSecretFromSsm(parameterName: string, client?: Pick<SSMClient, "send">): Promise<string | null> {
+  defaultSsmClient ??= new SSMClient({});
+  const response = await (client ?? defaultSsmClient).send(new GetParameterCommand({ Name: parameterName, WithDecryption: true }));
+  return response.Parameter?.Value?.trim() || null;
 }
 
 export async function loadProspectusSessionSealingSecret(
   options: { environment?: Record<string, string | undefined>; readSecret?: ProspectusSessionSecretReader; now?: number } = {},
 ): Promise<string | null> {
   const environment = options.environment ?? process.env;
-  const secretArn = environment[PROSPECTUS_SESSION_SECRET_ARN_ENV]?.trim();
-  if (!secretArn) return null;
+  const parameterName = environment[PROSPECTUS_SESSION_SECRET_PARAMETER_ENV]?.trim();
+  if (!parameterName) return null;
   const now = options.now ?? Date.now();
-  if (cachedSealingSecret && cachedSealingSecret.secretArn === secretArn && cachedSealingSecret.expiresAt > now) {
+  if (cachedSealingSecret && cachedSealingSecret.parameterName === parameterName && cachedSealingSecret.expiresAt > now) {
     return cachedSealingSecret.value;
   }
   try {
-    const value = (await (options.readSecret ?? readSealingSecretFromSecretsManager)(secretArn))?.trim();
+    const value = (await (options.readSecret ?? readSealingSecretFromSsm)(parameterName))?.trim();
     if (!value || value.length < MINIMUM_SEALING_SECRET_LENGTH) return null;
-    cachedSealingSecret = { secretArn, value, expiresAt: now + PROSPECTUS_SESSION_SECRET_CACHE_MILLISECONDS };
+    cachedSealingSecret = { parameterName, value, expiresAt: now + PROSPECTUS_SESSION_SECRET_CACHE_MILLISECONDS };
     return value;
   } catch (error) {
     console.error(`Prospectus session sealing secret could not be read (${error instanceof Error ? error.name : "error"}).`);

package/lib/prospectus-sign-in-routes.ts

@@ -12,6 +12,7 @@ import {
   PROSPECTUS_SESSION_COOKIE,
   openProspectusCookie,
   resolveProspectusSignInRuntime,
+  signedInProspectusSession,
   sameSiteReturnPath,
   sealProspectusCookie,
   sealedCookieAttributes,
@@ -25,6 +26,7 @@ import {
   publishingAccountsForSite,
   type PublicationCapability,
 } from "./prospectus-publication-access";
+import { SiteOriginNotConfiguredError, publicSiteOrigin, siteOriginNotConfiguredResponse } from "./site-origin";
 
 /**
  * The site's sign-in routes for Prospectus accounts: start (challenge, then the
@@ -38,6 +40,10 @@ export interface ProspectusSignInRouteOptions {
   siteProduct?: string | null;
   completionOverrides?: Pick<CompleteProspectusGoogleSignInInput, "verifyCognitoTokens" | "fetcher">;
   nowInSeconds?: () => number;
+  /** Trusted configuration the public site origin is read from; defaults to process.env. */
+  environment?: Record<string, string | undefined>;
+  /** Receives each sign-in failure line; defaults to console.error so it reaches the compute log. */
+  log?: (line: string) => void;
 }
 
 const NO_STORE_HEADERS = { "cache-control": "no-store" };
@@ -50,8 +56,22 @@ function currentTimeInSeconds(options: ProspectusSignInRouteOptions): number {
   return options.nowInSeconds?.() ?? Math.floor(Date.now() / 1000);
 }
 
+function siteOriginFor(request: NextRequest, options: ProspectusSignInRouteOptions): string {
+  return publicSiteOrigin(request, options.environment);
+}
+
 async function signInRuntimeFor(request: NextRequest, options: ProspectusSignInRouteOptions): Promise<ProspectusSignInRuntime | null> {
-  return (options.resolveRuntime ?? resolveProspectusSignInRuntime)(request.nextUrl.origin);
+  return (options.resolveRuntime ?? resolveProspectusSignInRuntime)(siteOriginFor(request, options));
+}
+
+/** Runs a route and answers a missing site origin with 503 site_origin_not_configured, never a localhost redirect. */
+async function failingClosedWithoutSiteOrigin(route: () => Promise<NextResponse>): Promise<NextResponse> {
+  try {
+    return await route();
+  } catch (error) {
+    if (error instanceof SiteOriginNotConfiguredError) return siteOriginNotConfiguredResponse(error);
+    throw error;
+  }
 }
 
 function signInUnavailableResponse(): NextResponse {
@@ -65,30 +85,62 @@ function clearSealedCookie(response: NextResponse, cookieName: string): void {
   response.cookies.set(cookieName, "", sealedCookieAttributes(0, 0));
 }
 
+/** A JSON failure, for the routes the page script calls with fetch (session, account selection and creation). */
 function signInFailedResponse(status: number, code: string, message: string): NextResponse {
   return NextResponse.json({ error: code, message }, { status, headers: NO_STORE_HEADERS });
 }
 
-export function signedInProspectusSession(
-  request: NextRequest,
-  sealingSecret: string,
-  nowInSeconds?: number,
-): ProspectusSignedInSession | null {
-  return openProspectusCookie<ProspectusSignedInSession>(
-    sealingSecret,
-    PROSPECTUS_SESSION_COOKIE,
-    request.cookies.get(PROSPECTUS_SESSION_COOKIE)?.value,
-    nowInSeconds,
-  );
+/**
+ * A failed sign-in never leaves the browser on /api/auth/prospectus/callback: it answers 303 to the page the reader started from
+ * (or the home page when that is not known) with `sign_in_error=<code>`, which the reader plugin turns into a short message.
+ */
+/** Which callback step failed; with the code it tells an operator where a reader's sign-in stopped. */
+type SignInFailureBranch = "pending_cookie" | "provider_error" | "missing_parameters" | "completion" | "unexpected";
+
+/**
+ * One structured line per failed callback: `prospectus_sign_in_failed {"code":...,"branch":...}`. It carries only the
+ * code, the branch, and (for errors from completing the sign-in) the HTTP status, Prospectus error code, its rule text
+ * (`prospectusMessage`, which names the broken rule and carries no personal data) and error name.
+ * Never tokens, authorization codes, state, emails or subjects.
+ */
+function logSignInFailure(
+  options: ProspectusSignInRouteOptions,
+  entry: { code: string; branch: SignInFailureBranch; httpStatus?: number; prospectusError?: string; prospectusMessage?: string; errorName?: string },
+): void {
+  (options.log ?? console.error)(`prospectus_sign_in_failed ${JSON.stringify(entry)}`);
+}
+
+function signInFailedRedirect(request: NextRequest, options: ProspectusSignInRouteOptions, returnPath: string | null, code: string): NextResponse {
+  const target = new URL(returnPath ?? "/", siteOriginFor(request, options));
+  target.searchParams.set("sign_in_error", /^[a-z0-9_]{1,60}$/.test(code) ? code : "sign_in_failed");
+  return NextResponse.redirect(target, { status: 303, headers: NO_STORE_HEADERS });
 }
 
-export async function handleProspectusSignInStart(request: NextRequest, options: ProspectusSignInRouteOptions = {}): Promise<NextResponse> {
+export { signedInProspectusSession } from "./prospectus-session";
+
+/** `returnTo` from the query (a link) or, for the POST form the reader plugin's button submits, from the form body. */
+async function requestedReturnPath(request: NextRequest): Promise<string | null> {
+  if (request.method !== "POST") return request.nextUrl.searchParams.get("returnTo");
+  try {
+    const value = (await request.formData()).get("returnTo");
+    return typeof value === "string" ? value : null;
+  } catch {
+    return null;
+  }
+}
+
+/** GET (a link) or POST (the reader plugin's "Sign in" button, so people are never sent to an /api URL) starts the Google sign-in with a 303 to Google. */
+export function handleProspectusSignInStart(request: NextRequest, options: ProspectusSignInRouteOptions = {}): Promise<NextResponse> {
+  return failingClosedWithoutSiteOrigin(() => handleProspectusSignInStartRoute(request, options));
+}
+
+async function handleProspectusSignInStartRoute(request: NextRequest, options: ProspectusSignInRouteOptions): Promise<NextResponse> {
   const runtime = await signInRuntimeFor(request, options);
   if (!runtime) return signInUnavailableResponse();
   const { authorizationUrl, pendingSignIn } = await beginProspectusGoogleSignIn(runtime.accounts, runtime.cognitoClient);
   const pendingSignInCookie: PendingProspectusSignInCookie = {
     ...pendingSignIn,
-    returnPath: sameSiteReturnPath(request.nextUrl.searchParams.get("returnTo")),
+    returnPath: sameSiteReturnPath(await requestedReturnPath(request)),
   };
   const response = NextResponse.redirect(authorizationUrl, { status: 303, headers: NO_STORE_HEADERS });
   response.cookies.set(
@@ -99,7 +151,11 @@ export async function handleProspectusSignInStart(request: NextRequest, options:
   return response;
 }
 
-export async function handleProspectusSignInCallback(request: NextRequest, options: ProspectusSignInRouteOptions = {}): Promise<NextResponse> {
+export function handleProspectusSignInCallback(request: NextRequest, options: ProspectusSignInRouteOptions = {}): Promise<NextResponse> {
+  return failingClosedWithoutSiteOrigin(() => handleProspectusSignInCallbackRoute(request, options));
+}
+
+async function handleProspectusSignInCallbackRoute(request: NextRequest, options: ProspectusSignInRouteOptions): Promise<NextResponse> {
   const runtime = await signInRuntimeFor(request, options);
   if (!runtime) return signInUnavailableResponse();
   const nowInSeconds = currentTimeInSeconds(options);
@@ -121,12 +177,16 @@ async function completeCallback(
   options: ProspectusSignInRouteOptions,
   nowInSeconds: number,
 ): Promise<NextResponse> {
-  if (!pendingSignIn) return signInFailedResponse(401, "sign_in_expired", "This sign-in is no longer pending. Start again.");
+  const failed = (code: string, branch: SignInFailureBranch, detail: { httpStatus?: number; prospectusError?: string; prospectusMessage?: string; errorName?: string } = {}) => {
+    logSignInFailure(options, { code, branch, ...detail });
+    return signInFailedRedirect(request, options, pendingSignIn?.returnPath ?? null, code);
+  };
+  if (!pendingSignIn) return failed("sign_in_expired", "pending_cookie");
   const searchParams = request.nextUrl.searchParams;
-  if (searchParams.get("error")) return signInFailedResponse(401, "sign_in_declined", "Google sign-in did not complete.");
+  if (searchParams.get("error")) return failed("sign_in_declined", "provider_error");
   const authorizationCode = searchParams.get("code");
   const returnedState = searchParams.get("state");
-  if (!authorizationCode || !returnedState) return signInFailedResponse(400, "sign_in_incomplete", "The sign-in response is missing its code or state.");
+  if (!authorizationCode || !returnedState) return failed("sign_in_incomplete", "missing_parameters");
   try {
     const signedIn = await completeProspectusGoogleSignIn({
       accounts: runtime.accounts,
@@ -141,8 +201,9 @@ async function completeCallback(
       personId: signedIn.person.id,
       accessToken: signedIn.accessToken,
       accessTokenExpiresAt: signedIn.accessTokenExpiresAt,
+      ...(signedIn.person.siteSubject ? { siteSubject: signedIn.person.siteSubject } : {}),
     };
-    const response = NextResponse.redirect(new URL(pendingSignIn.returnPath, request.nextUrl.origin), { status: 303, headers: NO_STORE_HEADERS });
+    const response = NextResponse.redirect(new URL(pendingSignIn.returnPath, siteOriginFor(request, options)), { status: 303, headers: NO_STORE_HEADERS });
     response.cookies.set(
       PROSPECTUS_SESSION_COOKIE,
       sealProspectusCookie(runtime.sealingSecret, PROSPECTUS_SESSION_COOKIE, session, session.accessTokenExpiresAt),
@@ -150,13 +211,16 @@ async function completeCallback(
     );
     return response;
   } catch (error) {
-    if (error instanceof ProspectusAccountsError) return signInFailedResponse(error.status, error.code, error.message);
-    console.error(`Prospectus sign-in failed (${error instanceof Error ? error.name : "error"}).`);
-    return signInFailedResponse(401, "sign_in_failed", "Sign-in could not be completed.");
+    if (error instanceof ProspectusAccountsError) return failed(error.code, "completion", { httpStatus: error.status, prospectusError: error.code, prospectusMessage: error.message.slice(0, 300) });
+    return failed("sign_in_failed", "unexpected", { errorName: error instanceof Error ? error.name : "error" });
   }
 }
 
-export async function handleProspectusSessionRead(request: NextRequest, options: ProspectusSignInRouteOptions = {}): Promise<NextResponse> {
+export function handleProspectusSessionRead(request: NextRequest, options: ProspectusSignInRouteOptions = {}): Promise<NextResponse> {
+  return failingClosedWithoutSiteOrigin(() => handleProspectusSessionReadRoute(request, options));
+}
+
+async function handleProspectusSessionReadRoute(request: NextRequest, options: ProspectusSignInRouteOptions): Promise<NextResponse> {
   const runtime = await signInRuntimeFor(request, options);
   if (!runtime) return signInUnavailableResponse();
   const session = signedInProspectusSession(request, runtime.sealingSecret, currentTimeInSeconds(options));
@@ -169,11 +233,10 @@ export async function handleProspectusSessionRead(request: NextRequest, options:
       return response;
     }
     const publishingAccounts = publishingAccountsForSite(directory.accounts, siteProductFor(options));
+    // Only what the UI reads: no person id, siteSubject or account list ever goes to the browser.
     return NextResponse.json(
       {
         signedIn: true,
-        person: directory.person,
-        accounts: directory.accounts,
         cyclotronLabAccess: directory.accounts.some((account) =>
           account.products.some((product) => product.product === CYCLOTRON_LAB_PRODUCT && product.status === "active"),
         ),
@@ -196,9 +259,13 @@ export async function handleProspectusSessionRead(request: NextRequest, options:
   }
 }
 
-export async function handleProspectusSignOut(request: NextRequest, options: ProspectusSignInRouteOptions = {}): Promise<NextResponse> {
+export function handleProspectusSignOut(request: NextRequest, options: ProspectusSignInRouteOptions = {}): Promise<NextResponse> {
+  return failingClosedWithoutSiteOrigin(() => handleProspectusSignOutRoute(request, options));
+}
+
+async function handleProspectusSignOutRoute(request: NextRequest, options: ProspectusSignInRouteOptions): Promise<NextResponse> {
   const runtime = await signInRuntimeFor(request, options);
-  const signedOutDestination = new URL("/", request.nextUrl.origin);
+  const signedOutDestination = new URL("/", siteOriginFor(request, options));
   const destination = runtime
     ? new URL(
       `/logout?${new URLSearchParams({ client_id: runtime.cognitoClient.clientId, logout_uri: signedOutDestination.toString() })}`,
@@ -250,10 +317,14 @@ export async function currentProspectusPublishingSelection(
   }
 }
 
-export async function handleProspectusAccountSelection(request: NextRequest, options: ProspectusSignInRouteOptions = {}): Promise<NextResponse> {
+export function handleProspectusAccountSelection(request: NextRequest, options: ProspectusSignInRouteOptions = {}): Promise<NextResponse> {
+  return failingClosedWithoutSiteOrigin(() => handleProspectusAccountSelectionRoute(request, options));
+}
+
+async function handleProspectusAccountSelectionRoute(request: NextRequest, options: ProspectusSignInRouteOptions): Promise<NextResponse> {
   const runtime = await signInRuntimeFor(request, options);
   if (!runtime) return signInUnavailableResponse();
-  if (request.headers.get("origin") !== request.nextUrl.origin) {
+  if (request.headers.get("origin") !== siteOriginFor(request, options)) {
     return signInFailedResponse(403, "cross_origin_selection", "Choose an account from this site.");
   }
   const nowInSeconds = currentTimeInSeconds(options);
@@ -287,10 +358,14 @@ const MAXIMUM_PUBLISHING_ACCOUNT_NAME_LENGTH = 150;
 const DEFAULT_PUBLISHING_ACCOUNT_NAME = "Publishing account";
 const IDEMPOTENCY_KEY_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 
-export async function handleProspectusPublishingAccountCreation(request: NextRequest, options: ProspectusSignInRouteOptions = {}): Promise<NextResponse> {
+export function handleProspectusPublishingAccountCreation(request: NextRequest, options: ProspectusSignInRouteOptions = {}): Promise<NextResponse> {
+  return failingClosedWithoutSiteOrigin(() => handleProspectusPublishingAccountCreationRoute(request, options));
+}
+
+async function handleProspectusPublishingAccountCreationRoute(request: NextRequest, options: ProspectusSignInRouteOptions): Promise<NextResponse> {
   const runtime = await signInRuntimeFor(request, options);
   if (!runtime) return signInUnavailableResponse();
-  if (request.headers.get("origin") !== request.nextUrl.origin) {
+  if (request.headers.get("origin") !== siteOriginFor(request, options)) {
     return signInFailedResponse(403, "cross_origin_creation", "Create an account from this site.");
   }
   const nowInSeconds = currentTimeInSeconds(options);