@anthusai/papyrus 2.0.0-next.11 → 2.0.0-next.110

package/amplify/functions/public-forms/core.ts

@@ -0,0 +1,310 @@
+import { createHash, randomUUID } from "node:crypto";
+
+/**
+ * The public form receiving endpoint, without any AWS in it: `handlePublicFormRequest` takes the Function URL
+ * event plus a store and a rate limiter, so every rule here is exercised by `scripts/test-public-forms.ts`.
+ *
+ * Contract (docs/public-forms.md): POST JSON from one of the site's own origins; the answer never reflects input.
+ */
+
+export const FORM_SUBMISSION_MESSAGE_KIND = "form_submission";
+export const FORM_SUBMISSION_MESSAGE_DOMAIN = "inbox";
+export const FORM_SUBMISSION_FEED_KEY = "messages";
+export const NEWSLETTER_FORM_ID = "newsletter";
+export const NEWSLETTER_MESSAGE_TYPE = "newsletter_signup";
+export const DEFAULT_FORM_ID = "contact";
+export const DEFAULT_HONEYPOT_FIELDS = ["website"];
+
+export type PublicFormsConfig = {
+  /** Exact origins (scheme + host [+ port]) the browser may post from. Empty: every request is refused. */
+  allowedOrigins: string[];
+  /** Field names that, when filled, mark a bot. */
+  honeypotFields: string[];
+  maxBodyBytes: number;
+  maxFields: number;
+  maxValueLength: number;
+  /** Submissions one address may make per `ipWindowSeconds`, across all forms. */
+  ipLimit: number;
+  ipWindowSeconds: number;
+  /** Submissions one form accepts per hour from everyone; and the whole site across all form ids. */
+  formLimitPerHour: number;
+  siteLimitPerHour: number;
+};
+
+export const DEFAULT_PUBLIC_FORMS_CONFIG: PublicFormsConfig = {
+  allowedOrigins: [],
+  honeypotFields: DEFAULT_HONEYPOT_FIELDS,
+  maxBodyBytes: 16 * 1024,
+  maxFields: 20,
+  maxValueLength: 5000,
+  ipLimit: 10,
+  ipWindowSeconds: 600,
+  formLimitPerHour: 120,
+  siteLimitPerHour: 400,
+};
+
+export type FormSubmissionRecord = {
+  id: string;
+  messageKind: typeof FORM_SUBMISSION_MESSAGE_KIND;
+  messageDomain: string;
+  messageType: string;
+  status: "active";
+  summary: string;
+  content: string;
+  source: string;
+  authorLabel: string;
+  searchVisibility: "private";
+  responseTarget: "none";
+  responseStatus: "COMPLETED";
+  metadata: string;
+  createdAt: string;
+  updatedAt: string;
+  newsroomFeedKey: string;
+};
+
+export type SubmissionStore = { save(record: FormSubmissionRecord): Promise<void> };
+
+/** `hit` counts one event in the window and answers whether it is still within `limit`. */
+export type RateLimiter = {
+  hit(scope: string, subject: string, windowSeconds: number, limit: number): Promise<boolean>;
+};
+
+export type PublicFormsDeps = {
+  store: SubmissionStore;
+  limiter: RateLimiter;
+  now?: () => Date;
+  newId?: () => string;
+};
+
+export type FunctionUrlEvent = {
+  rawQueryString?: string;
+  headers?: Record<string, string | undefined>;
+  body?: string | null;
+  isBase64Encoded?: boolean;
+  requestContext?: { http?: { method?: string; sourceIp?: string } };
+};
+
+export type FunctionUrlResult = { statusCode: number; headers: Record<string, string>; body: string };
+
+const FORM_ID = /^[a-z0-9][a-z0-9-]{0,39}$/;
+const FIELD_NAME = /^[A-Za-z][A-Za-z0-9_]{0,39}$/;
+const EMAIL = /^[^\s@<>"]+@[^\s@<>"]+\.[^\s@<>"]+$/;
+const CONTROL = /[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/g;
+
+export function parseOrigins(value: string | undefined): string[] {
+  const origins: string[] = [];
+  for (const entry of (value ?? "").split(",")) {
+    const trimmed = entry.trim();
+    if (trimmed === "") continue;
+    try {
+      const url = new URL(trimmed);
+      if (url.protocol === "https:" || url.hostname === "localhost") origins.push(url.origin);
+    } catch {
+      // An unparsable origin is dropped: the allow-list can only get stricter.
+    }
+  }
+  return [...new Set(origins)];
+}
+
+function positiveInteger(value: string | undefined, fallback: number): number {
+  const parsed = Number.parseInt(value ?? "", 10);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
+}
+
+export function configFromEnvironment(env: Record<string, string | undefined>): PublicFormsConfig {
+  const honeypots = (env.PAPYRUS_PUBLIC_FORMS_HONEYPOTS ?? "").split(",").map((entry) => entry.trim()).filter(Boolean);
+  return {
+    ...DEFAULT_PUBLIC_FORMS_CONFIG,
+    allowedOrigins: parseOrigins(env.PAPYRUS_PUBLIC_FORMS_ORIGINS),
+    honeypotFields: [...new Set([...DEFAULT_HONEYPOT_FIELDS, ...honeypots])],
+    ipLimit: positiveInteger(env.PAPYRUS_PUBLIC_FORMS_IP_LIMIT, DEFAULT_PUBLIC_FORMS_CONFIG.ipLimit),
+    formLimitPerHour: positiveInteger(env.PAPYRUS_PUBLIC_FORMS_FORM_LIMIT, DEFAULT_PUBLIC_FORMS_CONFIG.formLimitPerHour),
+    siteLimitPerHour: positiveInteger(env.PAPYRUS_PUBLIC_FORMS_SITE_LIMIT, DEFAULT_PUBLIC_FORMS_CONFIG.siteLimitPerHour),
+  };
+}
+
+function reply(statusCode: number, body: Record<string, unknown> | null, headers: Record<string, string> = {}): FunctionUrlResult {
+  return {
+    statusCode,
+    headers: { "Cache-Control": "no-store", "Content-Type": "application/json", "X-Content-Type-Options": "nosniff", ...headers },
+    body: body === null ? "" : JSON.stringify(body),
+  };
+}
+
+function header(event: FunctionUrlEvent, name: string): string {
+  const headers = event.headers ?? {};
+  for (const [key, value] of Object.entries(headers)) {
+    if (key.toLowerCase() === name && typeof value === "string") return value;
+  }
+  return "";
+}
+
+function clean(value: string, multiline: boolean): string {
+  const stripped = value.replace(CONTROL, "").replace(/\r\n?/g, "\n");
+  return (multiline ? stripped : stripped.replace(/\n/g, " ")).trim();
+}
+
+type Parsed =
+  | { ok: true; formId: string; fields: Record<string, string>; page: string; honeypotFilled: boolean }
+  | { ok: false; error: string };
+
+function parseSubmission(event: FunctionUrlEvent, config: PublicFormsConfig): Parsed {
+  const raw = event.isBase64Encoded === true ? Buffer.from(event.body ?? "", "base64").toString("utf8") : (event.body ?? "");
+  let payload: unknown;
+  try {
+    payload = JSON.parse(raw);
+  } catch {
+    return { ok: false, error: "invalid-json" };
+  }
+  if (typeof payload !== "object" || payload === null || Array.isArray(payload)) return { ok: false, error: "invalid-body" };
+  const entries = Object.entries(payload as Record<string, unknown>);
+  if (entries.length > config.maxFields) return { ok: false, error: "too-many-fields" };
+
+  const fields: Record<string, string> = {};
+  let formId = "";
+  let page = "";
+  let honeypotFilled = false;
+  for (const [name, value] of entries) {
+    if (!FIELD_NAME.test(name)) return { ok: false, error: "invalid-field" };
+    if (value === null || value === undefined) continue;
+    if (typeof value !== "string") return { ok: false, error: "invalid-field" };
+    if (value.length > config.maxValueLength) return { ok: false, error: "field-too-long" };
+    if (config.honeypotFields.includes(name)) {
+      if (value.trim() !== "") honeypotFilled = true;
+      continue;
+    }
+    if (name === "form") formId = value.trim().toLowerCase();
+    else if (name === "page") page = clean(value, false).slice(0, 500);
+    else fields[name] = clean(value, name === "message");
+  }
+  return { ok: true, formId, fields, page, honeypotFilled };
+}
+
+function queryFormId(event: FunctionUrlEvent): string {
+  const match = /(?:^|&)form=([^&]*)/.exec(event.rawQueryString ?? "");
+  if (match === null) return "";
+  try {
+    return decodeURIComponent(match[1]).trim().toLowerCase();
+  } catch {
+    return "";
+  }
+}
+
+function ipSubject(ip: string): string {
+  return createHash("sha256").update(`papyrus-public-forms:${ip}`).digest("hex").slice(0, 32);
+}
+
+export function buildSubmissionRecord(input: {
+  id: string;
+  formId: string;
+  fields: Record<string, string>;
+  page: string;
+  origin: string;
+  receivedAt: string;
+}): FormSubmissionRecord {
+  const { formId, fields } = input;
+  const newsletter = formId === NEWSLETTER_FORM_ID;
+  const name = fields.name ?? "";
+  const email = fields.email ?? "";
+  const topic = fields.topic ?? "";
+  const message = fields.message ?? "";
+  const who = name !== "" ? (email !== "" ? `${name} <${email}>` : name) : email;
+  const headline = newsletter ? "Newsletter signup" : topic !== "" ? `${formId}: ${topic}` : formId;
+  const lines = [`Form: ${formId}`];
+  for (const [key, value] of Object.entries(fields)) {
+    if (key === "message" || value === "") continue;
+    lines.push(`${key}: ${value}`);
+  }
+  if (input.page !== "") lines.push(`page: ${input.page}`);
+  const content = message !== "" ? `${lines.join("\n")}\n\n${message}` : lines.join("\n");
+  const summarySource = message !== "" ? message.replace(/\s+/g, " ") : "";
+  const summary = `${headline}${who !== "" ? ` from ${who}` : ""}${summarySource !== "" ? `: ${summarySource}` : ""}`.slice(0, 200);
+  return {
+    id: input.id,
+    messageKind: FORM_SUBMISSION_MESSAGE_KIND,
+    messageDomain: FORM_SUBMISSION_MESSAGE_DOMAIN,
+    messageType: newsletter ? NEWSLETTER_MESSAGE_TYPE : FORM_SUBMISSION_MESSAGE_KIND,
+    status: "active",
+    summary,
+    content,
+    source: "public-form",
+    authorLabel: who !== "" ? who.slice(0, 200) : "Anonymous visitor",
+    searchVisibility: "private",
+    responseTarget: "none",
+    responseStatus: "COMPLETED",
+    metadata: JSON.stringify({
+      kind: newsletter ? NEWSLETTER_MESSAGE_TYPE : FORM_SUBMISSION_MESSAGE_KIND,
+      formId,
+      topic,
+      fields,
+      page: input.page,
+      origin: input.origin,
+      receivedAt: input.receivedAt,
+    }),
+    createdAt: input.receivedAt,
+    updatedAt: input.receivedAt,
+    newsroomFeedKey: FORM_SUBMISSION_FEED_KEY,
+  };
+}
+
+export async function handlePublicFormRequest(
+  event: FunctionUrlEvent,
+  config: PublicFormsConfig,
+  deps: PublicFormsDeps,
+): Promise<FunctionUrlResult> {
+  const method = (event.requestContext?.http?.method ?? "").toUpperCase();
+  const origin = header(event, "origin");
+  const allowed = origin !== "" && config.allowedOrigins.includes(origin);
+  const cors: Record<string, string> = allowed
+    ? {
+        "Access-Control-Allow-Origin": origin,
+        "Access-Control-Allow-Methods": "POST, OPTIONS",
+        "Access-Control-Allow-Headers": "Content-Type",
+        "Access-Control-Max-Age": "600",
+        Vary: "Origin",
+      }
+    : { Vary: "Origin" };
+
+  if (method === "OPTIONS") return allowed ? reply(204, null, cors) : reply(403, { ok: false, error: "origin-not-allowed" }, cors);
+  if (method !== "POST") return reply(405, { ok: false, error: "method-not-allowed" }, { ...cors, Allow: "POST, OPTIONS" });
+  if (!allowed) return reply(403, { ok: false, error: "origin-not-allowed" }, cors);
+  if (!/^application\/json\s*(;|$)/i.test(header(event, "content-type"))) return reply(415, { ok: false, error: "unsupported-media-type" }, cors);
+
+  const bodyBytes = Buffer.byteLength(event.body ?? "", event.isBase64Encoded === true ? "base64" : "utf8");
+  if (bodyBytes > config.maxBodyBytes) return reply(413, { ok: false, error: "payload-too-large" }, cors);
+
+  const parsed = parseSubmission(event, config);
+  if (!parsed.ok) return reply(400, { ok: false, error: parsed.error }, cors);
+  // A filled honeypot looks like success to the bot and stores nothing.
+  if (parsed.honeypotFilled) return reply(200, { ok: true }, cors);
+
+  const formId = parsed.formId || queryFormId(event) || DEFAULT_FORM_ID;
+  if (!FORM_ID.test(formId)) return reply(400, { ok: false, error: "invalid-form" }, cors);
+  const { fields } = parsed;
+  const email = fields.email ?? "";
+  if (email !== "" && (email.length > 254 || !EMAIL.test(email))) return reply(400, { ok: false, error: "invalid-email" }, cors);
+  if (formId === NEWSLETTER_FORM_ID && email === "") return reply(400, { ok: false, error: "email-required" }, cors);
+  if (email === "" && (fields.message ?? "") === "") return reply(400, { ok: false, error: "empty-submission" }, cors);
+
+  const subject = ipSubject(event.requestContext?.http?.sourceIp ?? "unknown");
+  let within: boolean;
+  try {
+    within =
+      (await deps.limiter.hit("ip", subject, config.ipWindowSeconds, config.ipLimit))
+      && (await deps.limiter.hit("form", formId, 3600, config.formLimitPerHour))
+      && (await deps.limiter.hit("site", "all", 3600, config.siteLimitPerHour));
+  } catch {
+    return reply(503, { ok: false, error: "unavailable" }, cors);
+  }
+  if (!within) return reply(429, { ok: false, error: "rate-limited" }, { ...cors, "Retry-After": "600" });
+
+  const receivedAt = (deps.now ?? (() => new Date()))().toISOString();
+  const id = (deps.newId ?? (() => `form-${randomUUID().replace(/-/g, "")}`))();
+  try {
+    await deps.store.save(buildSubmissionRecord({ id, formId, fields, page: parsed.page, origin, receivedAt }));
+  } catch {
+    // Never pretend a submission was received when it was not.
+    return reply(500, { ok: false, error: "store-failed" }, cors);
+  }
+  return reply(200, { ok: true }, cors);
+}

package/amplify/functions/public-forms/handler.ts

@@ -0,0 +1,41 @@
+import { DynamoDBClient, UpdateItemCommand } from "@aws-sdk/client-dynamodb";
+import { getLambdaDataClient, LAMBDA_DATA_AUTH_MODE } from "../shared/lambda-data-client";
+import {
+  configFromEnvironment,
+  handlePublicFormRequest,
+  type FormSubmissionRecord,
+  type FunctionUrlEvent,
+  type RateLimiter,
+  type SubmissionStore,
+} from "./core";
+
+const dynamo = new DynamoDBClient({});
+
+/** Counters live in a TTL table; the window number is part of the key, so a window simply stops being read. */
+const limiter: RateLimiter = {
+  async hit(scope, subject, windowSeconds, limit) {
+    const nowSeconds = Math.floor(Date.now() / 1000);
+    const window = Math.floor(nowSeconds / windowSeconds);
+    const result = await dynamo.send(
+      new UpdateItemCommand({
+        TableName: process.env.PAPYRUS_PUBLIC_FORMS_TABLE,
+        Key: { pk: { S: `${scope}#${subject}#${windowSeconds}#${window}` } },
+        UpdateExpression: "ADD hits :one SET expiresAt = :expires",
+        ExpressionAttributeValues: { ":one": { N: "1" }, ":expires": { N: String((window + 2) * windowSeconds) } },
+        ReturnValues: "UPDATED_NEW",
+      }),
+    );
+    return Number(result.Attributes?.hits?.N ?? "0") <= limit;
+  },
+};
+
+const store: SubmissionStore = {
+  async save(record: FormSubmissionRecord) {
+    const client = await getLambdaDataClient();
+    const created = await client.models.Message.create(record as never, { authMode: LAMBDA_DATA_AUTH_MODE });
+    if (created.errors?.length) throw new Error("Message create failed");
+  },
+};
+
+export const handler = (event: FunctionUrlEvent) =>
+  handlePublicFormRequest(event, configFromEnvironment(process.env), { store, limiter });

package/amplify/functions/public-forms/origins.js

@@ -0,0 +1,35 @@
+function httpsOrigin(value) {
+    try {
+        const url = new URL(value.includes("://") ? value : `https://${value}`);
+        return url.protocol === "https:" && url.hostname !== "localhost" ? url.origin : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+export function derivePublicFormOrigins(sources) {
+    const origins = new Set();
+    for (const value of sources.explicit ?? []) {
+        try {
+            const url = new URL(value);
+            if (url.protocol === "https:" || (url.protocol === "http:" && url.hostname === "localhost"))
+                origins.add(url.origin);
+            else
+                throw new Error("not allowed");
+        }
+        catch {
+            throw new Error(`publicForms.allowedOrigins entry ${JSON.stringify(value)} must be an https origin (or http://localhost).`);
+        }
+    }
+    for (const host of sources.hosts ?? []) {
+        const origin = host === undefined || host.trim() === "" ? undefined : httpsOrigin(host.trim());
+        if (origin !== undefined)
+            origins.add(origin);
+    }
+    for (const value of sources.urls ?? []) {
+        const origin = value === undefined || value.trim() === "" ? undefined : httpsOrigin(value.trim());
+        if (origin !== undefined)
+            origins.add(origin);
+    }
+    return [...origins].sort();
+}

package/amplify/functions/public-forms/origins.ts

@@ -0,0 +1,43 @@
+/**
+ * The browser origins a site's public forms accept: the site's own public hosts, never a wildcard.
+ * Pure so that `scripts/test-public-forms.ts` can pin it.
+ */
+export type PublicFormsOriginSources = {
+  /** `publicForms.allowedOrigins` in the site's backend config: always honoured (https, or localhost for development). */
+  explicit?: readonly string[];
+  /** Public hosts the site is served from: distribution aliases, the reader domain. Bare hosts become https origins. */
+  hosts?: readonly (string | undefined)[];
+  /** URLs whose origin is the site's own: the revalidate base URL, the sign-in redirect URLs. https only, never localhost. */
+  urls?: readonly (string | undefined)[];
+};
+
+function httpsOrigin(value: string): string | undefined {
+  try {
+    const url = new URL(value.includes("://") ? value : `https://${value}`);
+    return url.protocol === "https:" && url.hostname !== "localhost" ? url.origin : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+export function derivePublicFormOrigins(sources: PublicFormsOriginSources): string[] {
+  const origins = new Set<string>();
+  for (const value of sources.explicit ?? []) {
+    try {
+      const url = new URL(value);
+      if (url.protocol === "https:" || (url.protocol === "http:" && url.hostname === "localhost")) origins.add(url.origin);
+      else throw new Error("not allowed");
+    } catch {
+      throw new Error(`publicForms.allowedOrigins entry ${JSON.stringify(value)} must be an https origin (or http://localhost).`);
+    }
+  }
+  for (const host of sources.hosts ?? []) {
+    const origin = host === undefined || host.trim() === "" ? undefined : httpsOrigin(host.trim());
+    if (origin !== undefined) origins.add(origin);
+  }
+  for (const value of sources.urls ?? []) {
+    const origin = value === undefined || value.trim() === "" ? undefined : httpsOrigin(value.trim());
+    if (origin !== undefined) origins.add(origin);
+  }
+  return [...origins].sort();
+}

package/amplify/functions/public-forms/resource.js

@@ -0,0 +1,9 @@
+import { defineFunction } from "@aws-amplify/backend";
+/** The public form receiving endpoint. Wired (table, Function URL, origins, output) by `wire.ts`. */
+export const publicForms = defineFunction({
+    name: "papyrus-public-forms",
+    entry: "./handler.ts",
+    timeoutSeconds: 10,
+    memoryMB: 256,
+    resourceGroupName: "data",
+});

package/amplify/functions/public-forms/resource.ts

@@ -0,0 +1,10 @@
+import { defineFunction } from "@aws-amplify/backend";
+
+/** The public form receiving endpoint. Wired (table, Function URL, origins, output) by `wire.ts`. */
+export const publicForms = defineFunction({
+  name: "papyrus-public-forms",
+  entry: "./handler.ts",
+  timeoutSeconds: 10,
+  memoryMB: 256,
+  resourceGroupName: "data",
+});

package/amplify/functions/public-forms/wire.js

@@ -0,0 +1,25 @@
+import { RemovalPolicy, Stack } from "aws-cdk-lib";
+import * as dynamodb from "aws-cdk-lib/aws-dynamodb";
+import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
+import { FunctionUrlAuthType } from "aws-cdk-lib/aws-lambda";
+export const PUBLIC_FORMS_OUTPUT_KEY = "publicForms";
+/**
+ * Wires the endpoint: the rate-limit counter table (TTL), the Function URL and the function's settings, and returns
+ * the URL for the `custom.publicForms.endpoint` output. Everything lives in the function's own stack.
+ */
+export function wirePublicForms(backend, wiring) {
+    const lambda = backend.publicForms.resources.lambda;
+    const stack = Stack.of(lambda);
+    const table = new dynamodb.Table(stack, "PublicFormsLimits", {
+        partitionKey: { name: "pk", type: dynamodb.AttributeType.STRING },
+        billingMode: dynamodb.BillingMode.PAY_PER_REQUEST,
+        timeToLiveAttribute: "expiresAt",
+        removalPolicy: RemovalPolicy.DESTROY,
+    });
+    lambda.addToRolePolicy(new PolicyStatement({ effect: Effect.ALLOW, actions: ["dynamodb:UpdateItem"], resources: [table.tableArn] }));
+    backend.publicForms.addEnvironment("PAPYRUS_PUBLIC_FORMS_TABLE", table.tableName);
+    backend.publicForms.addEnvironment("PAPYRUS_PUBLIC_FORMS_ORIGINS", wiring.allowedOrigins.join(","));
+    backend.publicForms.addEnvironment("PAPYRUS_PUBLIC_FORMS_HONEYPOTS", (wiring.honeypotFields ?? []).join(","));
+    // CORS is answered by the handler (it must echo exactly one allowed origin), so the URL carries no CORS block.
+    return lambda.addFunctionUrl({ authType: FunctionUrlAuthType.NONE }).url;
+}

package/amplify/functions/public-forms/wire.ts

@@ -0,0 +1,32 @@
+import { RemovalPolicy, Stack } from "aws-cdk-lib";
+import * as dynamodb from "aws-cdk-lib/aws-dynamodb";
+import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
+import { type Function as LambdaFunction, FunctionUrlAuthType } from "aws-cdk-lib/aws-lambda";
+
+export const PUBLIC_FORMS_OUTPUT_KEY = "publicForms";
+
+export type PublicFormsWiring = {
+  allowedOrigins: string[];
+  honeypotFields?: string[];
+};
+
+/**
+ * Wires the endpoint: the rate-limit counter table (TTL), the Function URL and the function's settings, and returns
+ * the URL for the `custom.publicForms.endpoint` output. Everything lives in the function's own stack.
+ */
+export function wirePublicForms(backend: { publicForms: { resources: { lambda: unknown }; addEnvironment: (name: string, value: string) => void } }, wiring: PublicFormsWiring): string {
+  const lambda = backend.publicForms.resources.lambda as LambdaFunction;
+  const stack = Stack.of(lambda);
+  const table = new dynamodb.Table(stack, "PublicFormsLimits", {
+    partitionKey: { name: "pk", type: dynamodb.AttributeType.STRING },
+    billingMode: dynamodb.BillingMode.PAY_PER_REQUEST,
+    timeToLiveAttribute: "expiresAt",
+    removalPolicy: RemovalPolicy.DESTROY,
+  });
+  lambda.addToRolePolicy(new PolicyStatement({ effect: Effect.ALLOW, actions: ["dynamodb:UpdateItem"], resources: [table.tableArn] }));
+  backend.publicForms.addEnvironment("PAPYRUS_PUBLIC_FORMS_TABLE", table.tableName);
+  backend.publicForms.addEnvironment("PAPYRUS_PUBLIC_FORMS_ORIGINS", wiring.allowedOrigins.join(","));
+  backend.publicForms.addEnvironment("PAPYRUS_PUBLIC_FORMS_HONEYPOTS", (wiring.honeypotFields ?? []).join(","));
+  // CORS is answered by the handler (it must echo exactly one allowed origin), so the URL carries no CORS block.
+  return lambda.addFunctionUrl({ authType: FunctionUrlAuthType.NONE }).url;
+}

package/amplify/functions/shared/editorial-context.ts

@@ -13,6 +13,10 @@ export type EditorialOptions = {
   storyLineageId?: string | null;
   assignmentId?: string | null;
   maxCharacters?: number | null;
+  /** A publication without a current mission or policy record yields missingPublicationDoctrine instead of an error, and a
+   * section value that matches no NewsroomSection yields missingSectionConfiguration instead of an error.
+   * Only the editorial check asks for this (its rule lane needs neither); more than one current record is still an error. */
+  optionalPublicationDoctrine?: boolean | null;
   readAttachment: (attachment: EditorialRecord) => Promise<string>;
 };
 
@@ -38,6 +42,47 @@ async function get(client: EditorialClient, model: string, id: string) {
   return row;
 }
 
+const slugOf = (value: string) => value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+const localPart = (id: string) => id.split("#").at(-1) ?? id;
+
+async function allSections(client: EditorialClient) {
+  const rows: EditorialRecord[] = [];
+  let nextToken: string | null | undefined;
+  do {
+    const response = checked(await client.models.NewsroomSection.list({ limit: 100, nextToken }), "read NewsroomSection list");
+    rows.push(...(response.data as EditorialRecord[] ?? []));
+    nextToken = response.nextToken;
+  } while (nextToken);
+  return rows;
+}
+
+/** An item stores its section as an id, a slug or a name; find the NewsroomSection of this publication it means.
+ * Order: id (as given, then tenant-scoped), then slug (the id's local part), then name (title or short title).
+ * Returns null when nothing matches; two sections matching at the same step is an error. */
+async function findSection(client: EditorialClient, value: string, tenantId?: string) {
+  const direct = checked(await client.models.NewsroomSection.get({ id: value }), "read NewsroomSection").data as EditorialRecord | null;
+  if (direct) return direct;
+  if (tenantId) {
+    const scoped = checked(await client.models.NewsroomSection.get({ id: tenantScopedValue(tenantId, value) }), "read NewsroomSection").data as EditorialRecord | null;
+    if (scoped) return scoped;
+  }
+  const all = tenantId
+    ? await pages(client, "NewsroomSection", "listNewsroomSectionsByTenantAndSortOrder", { tenantId })
+    : (await allSections(client)).filter(row => !row.tenantId);
+  const wanted = slugOf(value);
+  const steps: ((row: EditorialRecord) => boolean)[] = [
+    row => slugOf(localPart(String(row.id ?? ""))) === wanted,
+    row => [row.title, row.shortTitle].some(name => typeof name === "string" && name.trim().toLowerCase() === value.trim().toLowerCase()),
+    row => [row.title, row.shortTitle].some(name => typeof name === "string" && slugOf(name) === wanted),
+  ];
+  for (const step of steps) {
+    const matches = all.filter(step);
+    if (matches.length > 1) throw new Error(`Section "${value}" is ambiguous: ${matches.map(row => row.id).join(", ")}.`);
+    if (matches.length === 1) return matches[0];
+  }
+  return null;
+}
+
 function tenant(row: EditorialRecord, tenantId?: string) {
   if ((row.tenantId || null) !== (tenantId || null)) throw new Error("Editorial record tenant does not match the configured authoring scope.");
 }
@@ -55,7 +100,7 @@ function entry(scope: string, kind: string, text: string, record: EditorialRecor
   } };
 }
 
-export function buildEditorialContext(publication: EditorialRecord, scope: EditorialRecord, entries: EditorialRecord[], warnings: string[], maxCharacters = 0) {
+export function buildEditorialContext(publication: EditorialRecord, scope: EditorialRecord, entries: EditorialRecord[], warnings: string[], maxCharacters = 0, missingPublicationDoctrine: string[] = [], missingSectionConfiguration: string[] = []) {
   const lines = [`Editorial context: ${publication.key}`, "Source: cloud",
     "Precedence: publication > section > assignment. Surface conflicts; narrower instructions do not silently override publication policy.",
     "Private operating guidance; not evidence or reader-facing copy."];
@@ -65,7 +110,9 @@ export function buildEditorialContext(publication: EditorialRecord, scope: Edito
   if (!Number.isInteger(maxCharacters) || maxCharacters < 0) throw new Error("Editorial context budget must be nonnegative.");
   if (maxCharacters && totalCharacters > maxCharacters) throw new Error(`Editorial context budget ${maxCharacters} cannot hold ${totalCharacters} required characters; policy was not truncated.`);
   const payload = { schemaVersion: 1, rendererVersion: "editorial-context/v1", publication, scope, sourceMode: "cloud",
-    precedence: ["publication", "section", "assignment"], entries, sources: entries.map(value => value.source), warnings, text, totalCharacters };
+    precedence: ["publication", "section", "assignment"], entries, sources: entries.map(value => value.source), warnings, text, totalCharacters,
+    ...(missingPublicationDoctrine.length ? { missingPublicationDoctrine } : {}),
+    ...(missingSectionConfiguration.length ? { missingSectionConfiguration } : {}) };
   return { ...payload, contextHash: digest(JSON.stringify(canonical(payload))), resolvedAt: new Date().toISOString() };
 }
 
@@ -83,7 +130,10 @@ export async function resolveEditorialContext(client: EditorialClient, options:
     corpusId: corpora[0].id, tenantId: options.tenantId ?? null, endpoint: options.endpoint };
   const entries: EditorialRecord[] = [];
   const warnings: string[] = [];
+  const missingPublicationDoctrine: string[] = [];
   let sectionId = options.sectionId || null;
+  let requestedSection: string | null = null;
+  const missingSectionConfiguration: string[] = [];
   let storyLineageId = options.storyLineageId || null;
   const assignmentId = options.assignmentId || null;
   let assignment: EditorialRecord | undefined;
@@ -110,6 +160,7 @@ export async function resolveEditorialContext(client: EditorialClient, options:
     const rows = await pages(client, "Item", options.tenantId ? "itemByTenantSlug" : "itemBySlug",
       options.tenantId ? { tenantSlug: tenantScopedValue(options.tenantId, slug) } : { slug });
     const current = rows.filter(row => row.type === "doctrine" && row.status === "private" && row.versionState === "current");
+    if (current.length === 0 && options.optionalPublicationDoctrine) { missingPublicationDoctrine.push(kind); continue; }
     if (current.length !== 1) throw new Error(`Publication ${kind}: expected exactly one current record, found ${current.length}.`);
     const record = current[0];
     tenant(record, options.tenantId);
@@ -118,13 +169,19 @@ export async function resolveEditorialContext(client: EditorialClient, options:
     entries.push(entry("publication", kind, text, record));
   }
   if (sectionId) {
-    const section = await get(client, "NewsroomSection", sectionId);
+    const section = await findSection(client, sectionId, options.tenantId);
+    if (!section && !options.optionalPublicationDoctrine) throw new Error(`NewsroomSection not found: ${sectionId}`);
+    if (!section) { missingSectionConfiguration.push(sectionId); requestedSection = sectionId; sectionId = null; }
+    else {
     tenant(section, options.tenantId);
+    if (section.id !== sectionId) requestedSection = sectionId;
+    sectionId = section.id;
     for (const [kind, key] of [["mission", "editorialMission"], ["policy", "editorialPolicy"], ["guidance", "assignmentGuidance"], ["kill criteria", "killCriteria"]]) {
       const text = String(section[key] || "").trim();
       if (text) entries.push(entry("section", kind, text, section));
       else if (kind === "mission" || kind === "policy") warnings.push(`Section ${section.id} intentionally has an empty ${kind} slot; publication doctrine still applies.`);
     }
+    }
   }
   if (assignment) {
     if (options.tenantId && !storyLineageId && !sectionId) throw new Error("A tenant assignment needs a scoped story or section to establish its publication.");
@@ -147,7 +204,9 @@ export async function resolveEditorialContext(client: EditorialClient, options:
       warnings.push("No assignment brief attachment exists; the Assignment summary is supplied as its brief.");
     }
   }
-  return buildEditorialContext(publication, { sectionId, storyLineageId, assignmentId }, entries, warnings, options.maxCharacters ?? 0);
+  // requestedSection: the value the caller asked for when it was not the section's id (a slug or name, or nothing matched).
+  const scope = { sectionId, storyLineageId, assignmentId, ...(requestedSection ? { requestedSection } : {}) };
+  return buildEditorialContext(publication, scope, entries, warnings, options.maxCharacters ?? 0, missingPublicationDoctrine, missingSectionConfiguration);
 }
 
 export function assignmentDoctrine(pack: Awaited<ReturnType<typeof resolveEditorialContext>>) {