@anthusai/papyrus 2.0.0-next.4 → 2.0.0-next.41

package/amplify/publication/s3-projection.js

@@ -7,11 +7,13 @@ import { SqsDestination } from "aws-cdk-lib/aws-lambda-destinations";
 import * as route53 from "aws-cdk-lib/aws-route53";
 import * as s3 from "aws-cdk-lib/aws-s3";
 import * as sqs from "aws-cdk-lib/aws-sqs";
+import { readFileSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { assertValidPublicationConfig } from "../site-backend-config.js";
 import { addRenditionsFunction } from "./renditions-function.js";
 import { RENDITIONS_FUNCTION_NAME_ENV } from "./renditions-settings.js";
+import { compileRedirectFunctionSource, readEdgeConfig } from "./redirect-rules.js";
 import { addInvalidationPathAlarm } from "./invalidation-alarm.js";
 import { distributionIdFromArn, s3ProjectionEnvironment, s3ProjectionPolicyStatements } from "./s3-projection-settings.js";
 const redirectFunctionSourcePath = resolve(dirname(fileURLToPath(import.meta.url)), "redirect-and-index.js");
@@ -68,9 +70,13 @@ export function addS3ProjectionPublication(scope, props, media) {
     assertValidPublicationConfig({ kind: "s3-projection", ...props });
     const bucket = createSiteBucket(scope, props.retainBucketOnDelete !== false);
     const keyValueStore = new cloudfront.KeyValueStore(scope, "RedirectsKeyValueStore");
+    const edgeConfig = readEdgeConfig(props.staticDir);
     const redirectFunction = new cloudfront.Function(scope, "RedirectAndIndexFunction", {
         runtime: cloudfront.FunctionRuntime.JS_2_0,
-        code: cloudfront.FunctionCode.fromFile({ filePath: redirectFunctionSourcePath }),
+        code: cloudfront.FunctionCode.fromInline(compileRedirectFunctionSource(readFileSync(redirectFunctionSourcePath, "utf8"), edgeConfig.rules, {
+            negotiateMarkdown: edgeConfig.negotiateMarkdown,
+            directoryTwins: edgeConfig.directoryTwins,
+        })),
         keyValueStore,
     });
     const deadLetterQueue = new sqs.Queue(scope, "ProjectionDeadLetterQueue", {

package/amplify/publication/s3-projection.ts

@@ -10,11 +10,13 @@ import * as route53 from "aws-cdk-lib/aws-route53";
 import * as s3 from "aws-cdk-lib/aws-s3";
 import * as sqs from "aws-cdk-lib/aws-sqs";
 import type { Construct } from "constructs";
+import { readFileSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { assertValidPublicationConfig, type PapyrusPublicationConfig } from "../site-backend-config";
 import { addRenditionsFunction, type RenditionsFunction } from "./renditions-function";
 import { RENDITIONS_FUNCTION_NAME_ENV, type RenditionsPlan } from "./renditions-settings";
+import { compileRedirectFunctionSource, readEdgeConfig } from "./redirect-rules";
 import { addInvalidationPathAlarm } from "./invalidation-alarm";
 import { distributionIdFromArn, s3ProjectionEnvironment, s3ProjectionPolicyStatements } from "./s3-projection-settings";
 
@@ -110,9 +112,15 @@ export function addS3ProjectionPublication(
   const bucket = createSiteBucket(scope, props.retainBucketOnDelete !== false);
 
   const keyValueStore = new cloudfront.KeyValueStore(scope, "RedirectsKeyValueStore");
+  const edgeConfig = readEdgeConfig(props.staticDir);
   const redirectFunction = new cloudfront.Function(scope, "RedirectAndIndexFunction", {
     runtime: cloudfront.FunctionRuntime.JS_2_0,
-    code: cloudfront.FunctionCode.fromFile({ filePath: redirectFunctionSourcePath }),
+    code: cloudfront.FunctionCode.fromInline(
+      compileRedirectFunctionSource(readFileSync(redirectFunctionSourcePath, "utf8"), edgeConfig.rules, {
+        negotiateMarkdown: edgeConfig.negotiateMarkdown,
+        directoryTwins: edgeConfig.directoryTwins,
+      }),
+    ),
     keyValueStore,
   });
   const deadLetterQueue = new sqs.Queue(scope, "ProjectionDeadLetterQueue", {

package/amplify/site-backend-config.ts

@@ -145,6 +145,13 @@ export type PapyrusSiteBackendConfig = {
    * DependsOn ordering; no resource changes. Default 12; 0 turns it off.
    */
   resolverWaveSize?: number;
+  /**
+   * Optional model groups to leave out of the data API (see `OPTIONAL_MODEL_GROUPS`; today `editions`).
+   * CloudFormation allows 2,500 resources per stack operation, nested stacks included, and a fresh create of the full
+   * model set exceeds it. Deploy a new site once with a group excluded, then remove the exclusion and deploy again:
+   * the second deploy is an ordinary update that adds the models.
+   */
+  excludeModelGroups?: string[];
   /** Static reader app (Markus-static sites) that a publish rebuilds through IAM `amplify:StartJob`. */
   reader?: { amplifyAppId: string; branchName?: string };
   /** Lets the newsroom start the `staging` branch build of this CMS app. */
@@ -178,6 +185,16 @@ export type PapyrusSiteBackendConfig = {
    * Unset: no plugin, and the synthesized backend is exactly what it was before plugins existed.
    */
   plugins?: PluginRequest[];
+  /**
+   * The public form receiving endpoint every site gets (docs/public-forms.md). It accepts posts only from the site's
+   * own public hosts (distribution aliases, reader domain, revalidate URL, sign-in redirect URLs) plus these.
+   */
+  publicForms?: {
+    /** Extra https origins (or http://localhost) allowed to post, for example `https://www.example.org`. */
+    allowedOrigins?: string[];
+    /** Extra honeypot field names besides `website`. */
+    honeypotFields?: string[];
+  };
   features?: {
     consoleResponder?: boolean;
     inboundEmail?: boolean;

package/amplify/site-backend.js

@@ -20,9 +20,14 @@ import { addInvalidationPathAlarm } from "./publication/invalidation-alarm.js";
 import { applyCognitoDomainPrefix, authConfigFromEnv, defineSiteAuth, siteAuthRedirectUrls } from "./auth/resource.js";
 import { PROSPECTUS_SIGN_IN_CALLBACK_PATH, addProspectusGoogleOnlyClient } from "./auth/prospectus-google-client.js";
 import { defineSiteData } from "./data/resource.js";
+import { editorialChecks } from "./functions/editorial-checks/resource.js";
+import { monitoringView } from "./functions/monitoring-view/resource.js";
+import { wireMonitoringView } from "./functions/monitoring-view/wire.js";
+import { wireEditorialChecks } from "./functions/editorial-checks/wire.js";
 import { resolvePlugins } from "./plugins/registry.js";
 import { wirePlugins } from "./plugins/wire.js";
 import { assignmentAction } from "./functions/assignment-action/resource.js";
+import { scopeAssignmentDataAccess } from "./functions/assignment-action/data-access.js";
 import { categoryAction } from "./functions/category-action/resource.js";
 import { ConsoleChatResponderStack } from "./functions/console-chat-responder/resource.js";
 import { contentActions, setSiteFilesForContentActionsBundle } from "./functions/content-actions/resource.js";
@@ -30,6 +35,9 @@ import { knowledgeQuery } from "./functions/knowledge-query/resource.js";
 import { manageUserRole } from "./functions/manage-user-role/resource.js";
 import { modelAttachmentUpload } from "./functions/model-attachment-upload/resource.js";
 import { newsroomSummary } from "./functions/newsroom-summary/resource.js";
+import { derivePublicFormOrigins } from "./functions/public-forms/origins.js";
+import { publicForms } from "./functions/public-forms/resource.js";
+import { wirePublicForms } from "./functions/public-forms/wire.js";
 import { procedureAction } from "./functions/procedure-action/resource.js";
 import { readerSettings } from "./functions/reader-settings/resource.js";
 import { emailSubmissionProcessor } from "./functions/email-submission-processor/resource.js";
@@ -88,12 +96,15 @@ export function defineSiteBackend(papyrusSite) {
         auth: defineSiteAuth(authConfig),
         categoryAction,
         contentActions,
-        data: defineSiteData(pluginDefinitions),
+        editorialChecks,
+        data: defineSiteData(pluginDefinitions, site.excludeModelGroups ?? []),
         knowledgeQuery,
         manageUserRole,
+        monitoringView,
         modelAttachmentUpload,
         newsroomSummary,
         procedureAction,
+        publicForms,
         readerSettings,
         emailSubmissionProcessor,
         sesInboundReceive,
@@ -304,10 +315,19 @@ export function defineSiteBackend(papyrusSite) {
     }
     grantCorporaRead(backend.knowledgeQuery.resources.lambda);
     grantNewsroomReadWrite(backend.assignmentAction.resources.lambda);
+    scopeAssignmentDataAccess(backend.assignmentAction.resources.lambda, backend.data.resources.graphqlApi.arn);
     grantNewsroomReadWrite(backend.categoryAction.resources.lambda);
     grantNewsroomReadWrite(backend.newsroomSummary.resources.lambda);
     const contentActionsLambda = backend.contentActions.resources.lambda;
     grantNewsroomReadWriteDelete(contentActionsLambda);
+    if ((activeBrand?.corpusKey ?? "").trim() !== "") {
+        // A deploy creates the publication's canonical corpus from the brand when the backend has none.
+        contentActionsLambda.addEnvironment("PAPYRUS_PUBLICATION_CORPUS_KEY", (activeBrand?.corpusKey ?? "").trim());
+        contentActionsLambda.addEnvironment("PAPYRUS_PUBLICATION_NAME", (activeBrand?.publicationName ?? activeBrand?.corpusKey ?? "").trim());
+    }
+    // AppSync validates the token; pending intake additionally binds its actor
+    // and publication to this deployment's pool and existing API endpoint.
+    contentActionsLambda.addEnvironment("PAPYRUS_USER_POOL_ISSUER", `https://cognito-idp.${Stack.of(contentActionsLambda).region}.amazonaws.com/${backend.auth.resources.userPool.userPoolId}`);
     contentActionsLambda.addEnvironment("PAPYRUS_GRAPHQL_ENDPOINT", backend.data.resources.cfnResources.cfnGraphqlApi.attrGraphQlUrl);
     contentActionsLambda.addToRolePolicy(new PolicyStatement({
         actions: ["appsync:GraphQL"],
@@ -548,8 +568,21 @@ export function defineSiteBackend(papyrusSite) {
                 : []),
         ],
     }));
+    const publicFormsEndpoint = wirePublicForms(backend, {
+        allowedOrigins: derivePublicFormOrigins({
+            explicit: site.publicForms?.allowedOrigins,
+            hosts: [activeBrand?.readerDeployment?.domain, ...(publication?.distribution?.aliases ?? [])],
+            urls: [site.revalidateBaseUrl, ...siteAuthRedirectUrls(authConfig)],
+        }),
+        honeypotFields: site.publicForms?.honeypotFields,
+    });
     backend.addOutput({
         custom: {
+            publicForms: { endpoint: publicFormsEndpoint },
+            // Lets the operator CLI re-project on publish without PAPYRUS_PUBLICATION_KIND / PAPYRUS_CONTENT_ACTIONS_FUNCTION (PPY-0c0b75).
+            publication: s3ProjectionPublication !== undefined
+                ? { kind: "s3-projection", contentActionsFunction: contentActionsLambda.functionName }
+                : null,
             prospectusSignIn: prospectusGoogleOnlyClient
                 ? { clientId: prospectusGoogleOnlyClient.ref, callbackPath: PROSPECTUS_SIGN_IN_CALLBACK_PATH }
                 : null,
@@ -584,6 +617,8 @@ export function defineSiteBackend(papyrusSite) {
                 : null,
         },
     });
+    wireEditorialChecks(backend);
+    wireMonitoringView(backend);
     wirePlugins(backend, plugins, contentActionsLambda);
     return backend;
 }

package/amplify/site-backend.ts

@@ -27,9 +27,14 @@ import { addInvalidationPathAlarm } from "./publication/invalidation-alarm";
 import { applyCognitoDomainPrefix, authConfigFromEnv, defineSiteAuth, siteAuthRedirectUrls } from "./auth/resource";
 import { PROSPECTUS_SIGN_IN_CALLBACK_PATH, addProspectusGoogleOnlyClient } from "./auth/prospectus-google-client";
 import { defineSiteData } from "./data/resource";
+import { editorialChecks } from "./functions/editorial-checks/resource";
+import { monitoringView } from "./functions/monitoring-view/resource";
+import { wireMonitoringView } from "./functions/monitoring-view/wire";
+import { wireEditorialChecks } from "./functions/editorial-checks/wire";
 import { resolvePlugins } from "./plugins/registry";
 import { wirePlugins } from "./plugins/wire";
 import { assignmentAction } from "./functions/assignment-action/resource";
+import { scopeAssignmentDataAccess } from "./functions/assignment-action/data-access";
 import { categoryAction } from "./functions/category-action/resource";
 import { ConsoleChatResponderStack } from "./functions/console-chat-responder/resource";
 import { contentActions, setSiteFilesForContentActionsBundle } from "./functions/content-actions/resource";
@@ -37,6 +42,9 @@ import { knowledgeQuery } from "./functions/knowledge-query/resource";
 import { manageUserRole } from "./functions/manage-user-role/resource";
 import { modelAttachmentUpload } from "./functions/model-attachment-upload/resource";
 import { newsroomSummary } from "./functions/newsroom-summary/resource";
+import { derivePublicFormOrigins } from "./functions/public-forms/origins";
+import { publicForms } from "./functions/public-forms/resource";
+import { wirePublicForms } from "./functions/public-forms/wire";
 import { procedureAction } from "./functions/procedure-action/resource";
 import { readerSettings } from "./functions/reader-settings/resource";
 import { emailSubmissionProcessor } from "./functions/email-submission-processor/resource";
@@ -109,12 +117,15 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
     auth: defineSiteAuth(authConfig),
     categoryAction,
     contentActions,
-    data: defineSiteData(pluginDefinitions),
+    editorialChecks,
+    data: defineSiteData(pluginDefinitions, site.excludeModelGroups ?? []),
     knowledgeQuery,
     manageUserRole,
+    monitoringView,
     modelAttachmentUpload,
     newsroomSummary,
     procedureAction,
+    publicForms,
     readerSettings,
     emailSubmissionProcessor,
     sesInboundReceive,
@@ -387,10 +398,25 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
   }
   grantCorporaRead(backend.knowledgeQuery.resources.lambda as LambdaFunction);
   grantNewsroomReadWrite(backend.assignmentAction.resources.lambda as LambdaFunction);
+  scopeAssignmentDataAccess(
+    backend.assignmentAction.resources.lambda as LambdaFunction,
+    backend.data.resources.graphqlApi.arn,
+  );
   grantNewsroomReadWrite(backend.categoryAction.resources.lambda as LambdaFunction);
   grantNewsroomReadWrite(backend.newsroomSummary.resources.lambda as LambdaFunction);
   const contentActionsLambda = backend.contentActions.resources.lambda as LambdaFunction;
   grantNewsroomReadWriteDelete(contentActionsLambda);
+  if ((activeBrand?.corpusKey ?? "").trim() !== "") {
+    // A deploy creates the publication's canonical corpus from the brand when the backend has none.
+    contentActionsLambda.addEnvironment("PAPYRUS_PUBLICATION_CORPUS_KEY", (activeBrand?.corpusKey ?? "").trim());
+    contentActionsLambda.addEnvironment("PAPYRUS_PUBLICATION_NAME", (activeBrand?.publicationName ?? activeBrand?.corpusKey ?? "").trim());
+  }
+  // AppSync validates the token; pending intake additionally binds its actor
+  // and publication to this deployment's pool and existing API endpoint.
+  contentActionsLambda.addEnvironment(
+    "PAPYRUS_USER_POOL_ISSUER",
+    `https://cognito-idp.${Stack.of(contentActionsLambda).region}.amazonaws.com/${backend.auth.resources.userPool.userPoolId}`,
+  );
   contentActionsLambda.addEnvironment(
     "PAPYRUS_GRAPHQL_ENDPOINT",
     backend.data.resources.cfnResources.cfnGraphqlApi.attrGraphQlUrl,
@@ -685,8 +711,23 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
     }),
   );
 
+  const publicFormsEndpoint = wirePublicForms(backend, {
+    allowedOrigins: derivePublicFormOrigins({
+      explicit: site.publicForms?.allowedOrigins,
+      hosts: [activeBrand?.readerDeployment?.domain, ...(publication?.distribution?.aliases ?? [])],
+      urls: [site.revalidateBaseUrl, ...siteAuthRedirectUrls(authConfig)],
+    }),
+    honeypotFields: site.publicForms?.honeypotFields,
+  });
+
   backend.addOutput({
     custom: {
+      publicForms: { endpoint: publicFormsEndpoint },
+      // Lets the operator CLI re-project on publish without PAPYRUS_PUBLICATION_KIND / PAPYRUS_CONTENT_ACTIONS_FUNCTION (PPY-0c0b75).
+      publication:
+        s3ProjectionPublication !== undefined
+          ? { kind: "s3-projection", contentActionsFunction: contentActionsLambda.functionName }
+          : null,
       prospectusSignIn: prospectusGoogleOnlyClient
         ? { clientId: prospectusGoogleOnlyClient.ref, callbackPath: PROSPECTUS_SIGN_IN_CALLBACK_PATH }
         : null,
@@ -721,6 +762,8 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
         : null,
     },
   });
+  wireEditorialChecks(backend);
+  wireMonitoringView(backend);
   wirePlugins(backend, plugins, contentActionsLambda);
 
   return backend;

package/app/api/newsroom/curation/context/route.ts

@@ -0,0 +1,9 @@
+import type { NextRequest } from "next/server";
+import { handleCurationRoute } from "../../../../../lib/curation-routes";
+
+export const dynamic = "force-dynamic";
+export const runtime = "nodejs";
+
+export function GET(request: NextRequest) {
+  return handleCurationRoute(request, "context");
+}

package/app/api/newsroom/curation/priming/route.ts

@@ -0,0 +1,9 @@
+import type { NextRequest } from "next/server";
+import { handleCurationRoute } from "../../../../../lib/curation-routes";
+
+export const dynamic = "force-dynamic";
+export const runtime = "nodejs";
+
+export function POST(request: NextRequest) {
+  return handleCurationRoute(request, "priming");
+}

package/app/api/newsroom/curation/publication/route.ts

@@ -0,0 +1,9 @@
+import type { NextRequest } from "next/server";
+import { handleCurationRoute } from "../../../../../lib/curation-routes";
+
+export const dynamic = "force-dynamic";
+export const runtime = "nodejs";
+
+export function POST(request: NextRequest) {
+  return handleCurationRoute(request, "publication");
+}

package/app/api/reader/handle/route.ts

@@ -0,0 +1,9 @@
+import type { NextRequest } from "next/server";
+import { handleReaderRequest } from "../../../../lib/reader-api";
+
+export const dynamic = "force-dynamic";
+export const runtime = "nodejs";
+
+export function POST(request: NextRequest) {
+  return handleReaderRequest(request, "handle");
+}

package/app/api/reader/me/route.ts

@@ -0,0 +1,9 @@
+import type { NextRequest } from "next/server";
+import { handleReaderRequest } from "../../../../lib/reader-api";
+
+export const dynamic = "force-dynamic";
+export const runtime = "nodejs";
+
+export function GET(request: NextRequest) {
+  return handleReaderRequest(request, "me");
+}

package/app/api/reader/rating/route.ts

@@ -0,0 +1,9 @@
+import type { NextRequest } from "next/server";
+import { handleReaderRequest } from "../../../../lib/reader-api";
+
+export const dynamic = "force-dynamic";
+export const runtime = "nodejs";
+
+export function POST(request: NextRequest) {
+  return handleReaderRequest(request, "rating");
+}

package/app/api/reader/retired/route.ts

@@ -0,0 +1,9 @@
+import type { NextRequest } from "next/server";
+import { handleReaderRetiredSubjects } from "../../../../lib/reader-retirement-route";
+
+export const dynamic = "force-dynamic";
+export const runtime = "nodejs";
+
+export function GET(request: NextRequest) {
+  return handleReaderRetiredSubjects(request);
+}

package/app/api/reader/vote/route.ts

@@ -0,0 +1,9 @@
+import type { NextRequest } from "next/server";
+import { handleReaderRequest } from "../../../../lib/reader-api";
+
+export const dynamic = "force-dynamic";
+export const runtime = "nodejs";
+
+export function POST(request: NextRequest) {
+  return handleReaderRequest(request, "vote");
+}

package/bin/papyrus-infra.mjs

@@ -19,6 +19,7 @@ const USAGE = [
   "       papyrus-infra synth --account-stack github-oidc [--out cdk.out] [--account A] [--region R]",
   "       papyrus-infra print-buildspec --site infra/site.json --app cms-production|cms-staging|reader",
   "       papyrus-infra deploy-edge --stack NAME --template FILE [--adoption-template FILE --adopt-resources FILE] [--parameter KEY=VALUE]... [--delete-function NAME] [--only-branch main] [--only-app-id ID] [--region R]",
+  "       papyrus-infra compile-edge-function --static-dir web [--out FILE]",
   "       papyrus-infra deploy --site infra/site.json [--only-branch main] [--only-app-id ID] [--out cdk.out] [--account A] [--region R]",
 ].join("\n");
 
@@ -36,11 +37,29 @@ const resolveEnvironmentOrExit = () => {
   }
 };
 const command = args[0];
-if (command !== "synth" && command !== "print-buildspec" && command !== "deploy" && command !== "deploy-edge") {
+if (command !== "synth" && command !== "print-buildspec" && command !== "deploy" && command !== "deploy-edge" && command !== "compile-edge-function") {
   console.error(USAGE);
   process.exit(command ? 1 : 0);
 }
 
+if (command === "compile-edge-function") {
+  // The viewer-request CloudFront Function with the site's projection.json rules compiled in: for an edge stack that is
+  // not deployed by the CMS backend, so that no site writes its own redirect function.
+  const staticDir = opt("static-dir");
+  if (!staticDir) {
+    console.error(USAGE);
+    process.exit(1);
+  }
+  const { compileRedirectFunctionSource, readEdgeConfig } = await import("../amplify/publication/redirect-rules.js");
+  const functionSource = fs.readFileSync(new URL("../amplify/publication/redirect-and-index.js", import.meta.url), "utf8");
+  const config = readEdgeConfig(staticDir);
+  const compiled = compileRedirectFunctionSource(functionSource, config.rules, { negotiateMarkdown: config.negotiateMarkdown, directoryTwins: config.directoryTwins });
+  const out = opt("out");
+  if (out) fs.writeFileSync(path.resolve(out), compiled);
+  else process.stdout.write(compiled);
+  process.exit(0);
+}
+
 if (command === "deploy-edge") {
   const buildAppId = process.env.AWS_APP_ID;
   const buildBranch = process.env.AWS_BRANCH;