@anthusai/papyrus 2.0.0-next.40 → 2.0.0-next.42

package/lib/newsletter-pages.ts

@@ -0,0 +1,264 @@
+import { NextResponse } from "next/server";
+
+/**
+ * The small server-rendered pages of the newsletter plugin (confirm prompt, confirmed, expired).
+ * Plain HTML, no scripts, themed from the plugin's public settings. Every dynamic value is escaped, the token never
+ * reaches a link, and the pages are never cached or indexed.
+ */
+export type NewsletterPageTheme = { accent: string; text: string; background: string; surface: string; muted: string; fontFamily: string };
+
+export const DEFAULT_PAGE_THEME: NewsletterPageTheme = {
+  accent: "#1a4d8f",
+  text: "#1b1b1b",
+  background: "#ffffff",
+  surface: "#f4f4f4",
+  muted: "#555555",
+  fontFamily: "Georgia, 'Times New Roman', serif",
+};
+
+const UNSAFE_CSS = /[<>{};"\\`]|url\(|expression\(|@import/i;
+const MAXIMUM_LISTS_SHOWN = 20;
+
+export function escapeHtml(value: string): string {
+  return value.replace(/[&<>"']/g, (character) => `&#${character.charCodeAt(0)};`);
+}
+
+/** Theme tokens from `custom.papyrusPlugins.newsletter.theme`; a missing or unsafe value falls back to the default. */
+export function pageTheme(raw: unknown): NewsletterPageTheme {
+  const theme: NewsletterPageTheme = { ...DEFAULT_PAGE_THEME };
+  if (typeof raw !== "object" || raw === null) return theme;
+  for (const key of Object.keys(theme) as Array<keyof NewsletterPageTheme>) {
+    const value = (raw as Record<string, unknown>)[key];
+    if (typeof value === "string" && value.length > 0 && value.length <= 200 && !UNSAFE_CSS.test(value)) theme[key] = value;
+  }
+  return theme;
+}
+
+export type FormSpec = {
+  action: string;
+  /** Hidden fields, such as the token. */
+  hidden: Record<string, string>;
+  checkboxes?: Array<{ name: string; value: string; label: string; checked: boolean }>;
+  /** Every button says what it does in words. `secondary` only changes how it looks. */
+  buttons: Array<{ label: string; name?: string; value?: string; secondary?: boolean }>;
+};
+
+export type PageContent = {
+  siteName: string;
+  theme: NewsletterPageTheme;
+  heading: string;
+  /** A short status line shown above the text (for example "Saved"), as words. */
+  notice?: string;
+  paragraphs: string[];
+  lists?: string[];
+  forms?: FormSpec[];
+  links?: Array<{ href: string; label: string }>;
+};
+
+function renderForm(form: FormSpec): string {
+  const hidden = Object.entries(form.hidden)
+    .map(([name, value]) => `<input type="hidden" name="${escapeHtml(name)}" value="${escapeHtml(value)}">`)
+    .join("");
+  const boxes = (form.checkboxes ?? [])
+    .map(
+      (box, index) =>
+        `<p class="box"><input type="checkbox" id="c${index}" name="${escapeHtml(box.name)}" value="${escapeHtml(box.value)}"${box.checked ? " checked" : ""}> <label for="c${index}">${escapeHtml(box.label)}</label></p>`,
+    )
+    .join("");
+  const buttons = form.buttons
+    .map(
+      (button) =>
+        `<button type="submit"${button.name ? ` name="${escapeHtml(button.name)}" value="${escapeHtml(button.value ?? "")}"` : ""}${button.secondary ? ' class="secondary"' : ""}>${escapeHtml(button.label)}</button>`,
+    )
+    .join(" ");
+  return `<form method="post" action="${escapeHtml(form.action)}">${hidden}${boxes}<p class="actions">${buttons}</p></form>`;
+}
+
+export function renderPage(page: PageContent): string {
+  const { theme } = page;
+  const lists = (page.lists ?? []).slice(0, MAXIMUM_LISTS_SHOWN);
+  const links = (page.links ?? []).map((link) => `<p><a href="${escapeHtml(link.href)}">${escapeHtml(link.label)}</a></p>`).join("\n");
+  return `<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="robots" content="noindex"><meta name="referrer" content="no-referrer">
+<title>${escapeHtml(page.heading)} - ${escapeHtml(page.siteName)}</title>
+<style>
+body{margin:0;background:${theme.background};color:${theme.text};font-family:${theme.fontFamily};line-height:1.5}
+main{max-width:34rem;margin:0 auto;padding:3rem 1.25rem}
+.site{color:${theme.muted};font-size:.95rem;margin:0 0 1.5rem}
+h1{font-size:1.6rem;line-height:1.2;margin:0 0 1rem}
+.notice{background:${theme.surface};border-left:4px solid ${theme.accent};padding:.5rem .75rem;font-weight:bold}
+ul{background:${theme.surface};margin:1rem 0;padding:.75rem 1.25rem 1rem 2rem}
+.box{margin:.6rem 0}
+input[type=checkbox]{width:1.1rem;height:1.1rem;vertical-align:middle}
+.actions{margin:1.25rem 0}
+button{background:${theme.accent};color:#fff;border:2px solid ${theme.accent};font:inherit;font-weight:bold;padding:.7rem 1.4rem;cursor:pointer;border-radius:4px;margin:0 .5rem .5rem 0}
+button.secondary{background:${theme.background};color:${theme.accent}}
+button:focus-visible,a:focus-visible,input:focus-visible{outline:3px solid ${theme.text};outline-offset:2px}
+a{color:${theme.accent}}
+</style></head><body><main>
+<p class="site">${escapeHtml(page.siteName)}</p>
+<h1>${escapeHtml(page.heading)}</h1>
+${page.notice ? `<p class="notice" role="status">${escapeHtml(page.notice)}</p>` : ""}
+${page.paragraphs.map((paragraph) => `<p>${escapeHtml(paragraph)}</p>`).join("\n")}
+${lists.length > 0 ? `<ul>${lists.map((name) => `<li>${escapeHtml(name)}</li>`).join("")}</ul>` : ""}
+${(page.forms ?? []).map(renderForm).join("\n")}
+${links}
+</main></body></html>`;
+}
+
+export const PAGE_HEADERS = {
+  "content-type": "text/html; charset=utf-8",
+  "cache-control": "no-store",
+  "referrer-policy": "no-referrer",
+  "x-content-type-options": "nosniff",
+  "content-security-policy": "default-src 'none'; style-src 'unsafe-inline'; form-action 'self'; base-uri 'none'; frame-ancestors 'none'",
+} as const;
+
+export function pageResponse(page: PageContent, status = 200): NextResponse {
+  return new NextResponse(renderPage(page), { status, headers: PAGE_HEADERS });
+}
+
+export const CONFIRM_PATH = "/api/newsletter/confirm";
+
+type Base = Pick<PageContent, "siteName" | "theme">;
+const home = (base: Base) => ({ href: "/", label: `Back to ${base.siteName}` });
+
+export function confirmPromptPage(base: Base, lists: string[], token: string): PageContent {
+  return {
+    ...base,
+    heading: "Confirm your subscription",
+    paragraphs: [`Press the button to start getting email from ${base.siteName}.${lists.length > 0 ? " You are signing up for:" : ""}`],
+    lists,
+    forms: [{ action: CONFIRM_PATH, hidden: { t: token }, buttons: [{ label: "Confirm subscription" }] }],
+  };
+}
+
+export function confirmedPage(base: Base, lists: string[], preferencesHref?: string): PageContent {
+  return {
+    ...base,
+    heading: "You are subscribed",
+    paragraphs: [lists.length > 0 ? "Thank you. You will get:" : "Thank you. Your subscription is confirmed."],
+    lists,
+    links: [...(preferencesHref ? [{ href: preferencesHref, label: "Manage your subscriptions" }] : []), home(base)],
+  };
+}
+
+export function expiredPage(base: Base): PageContent {
+  return {
+    ...base,
+    heading: "This link has expired",
+    paragraphs: [
+      "This confirmation link has expired or was already used. If you already confirmed, you are all set.",
+      "If you did not finish signing up, go back to the site and sign up again to get a new link.",
+    ],
+    links: [home(base)],
+  };
+}
+
+export function unavailablePage(base: Base): PageContent {
+  return {
+    ...base,
+    heading: "Something went wrong",
+    paragraphs: ["We could not complete this just now. Open the link in your email again in a minute."],
+    links: [home(base)],
+  };
+}
+
+export const UNSUBSCRIBE_PATH = "/api/newsletter/unsubscribe";
+export const PREFERENCES_PATH = "/api/newsletter/preferences";
+
+export function preferencesHref(token: string): string {
+  return `${PREFERENCES_PATH}?t=${encodeURIComponent(token)}`;
+}
+
+export function invalidManagePage(base: Base): PageContent {
+  return {
+    ...base,
+    heading: "This link is not valid",
+    paragraphs: ["This link is not valid, or the subscription it belongs to has been deleted. Use the link in a recent email from us."],
+    links: [home(base)],
+  };
+}
+
+export function unsubscribePromptPage(base: Base, token: string, listId: string | null, listName: string | null): PageContent {
+  return {
+    ...base,
+    heading: "Unsubscribe",
+    paragraphs: [listName ? `Stop getting "${listName}" from ${base.siteName}?` : `Stop getting all email from ${base.siteName}?`],
+    forms: [
+      {
+        action: UNSUBSCRIBE_PATH,
+        hidden: { t: token, ...(listId ? { l: listId } : {}), page: "1" },
+        buttons: [{ label: listName ? "Unsubscribe from this list" : "Unsubscribe from everything" }],
+      },
+    ],
+    links: [{ href: preferencesHref(token), label: "Choose which lists you get instead" }],
+  };
+}
+
+export function unsubscribedPage(base: Base, names: string[], token: string | null): PageContent {
+  return {
+    ...base,
+    heading: "You are unsubscribed",
+    paragraphs: [names.length > 0 ? `You will no longer get these from ${base.siteName}:` : `You will no longer get this email from ${base.siteName}.`],
+    lists: names,
+    links: [...(token ? [{ href: preferencesHref(token), label: "Change your mind? Manage your subscriptions" }] : []), home(base)],
+  };
+}
+
+export type PreferenceList = { id: string; name: string; description: string; subscribed: boolean };
+
+export function preferencesPage(base: Base, input: { token: string; email: string; lists: PreferenceList[]; notice?: string }): PageContent {
+  return {
+    ...base,
+    heading: "Your subscriptions",
+    notice: input.notice,
+    paragraphs: [`Email preferences for ${input.email}. Tick the lists you want.`],
+    forms: [
+      {
+        action: PREFERENCES_PATH,
+        hidden: { t: input.token },
+        checkboxes: input.lists.map((list) => ({
+          name: "l",
+          value: list.id,
+          label: list.description ? `${list.name}: ${list.description}` : list.name,
+          checked: list.subscribed,
+        })),
+        buttons: [
+          { label: "Save preferences", name: "action", value: "save" },
+          { label: "Unsubscribe from everything", name: "action", value: "unsubscribe_all", secondary: true },
+          { label: "Delete my data", name: "action", value: "delete", secondary: true },
+        ],
+      },
+    ],
+    links: [home(base)],
+  };
+}
+
+export function deleteConfirmPage(base: Base, token: string): PageContent {
+  return {
+    ...base,
+    heading: "Delete your data?",
+    paragraphs: [
+      `This erases your address and everything ${base.siteName} holds about your subscriptions. You will not get any more email. This cannot be undone.`,
+    ],
+    forms: [
+      {
+        action: PREFERENCES_PATH,
+        hidden: { t: token, action: "delete", confirm: "1" },
+        buttons: [{ label: "Yes, delete my data" }],
+      },
+    ],
+    links: [{ href: preferencesHref(token), label: "No, go back" }],
+  };
+}
+
+export function deletedPage(base: Base): PageContent {
+  return {
+    ...base,
+    heading: "Your data is deleted",
+    paragraphs: ["Your address and subscriptions have been erased. You will not get any more email from us."],
+    links: [home(base)],
+  };
+}

package/lib/prospectus-session.ts

@@ -39,6 +39,7 @@ export interface ProspectusSignedInSession {
   accessToken: string;
   accessTokenExpiresAt: number;
   selectedAccountId?: string;
+  siteSubject?: string;
 }
 
 function sealingKeyForCookie(sealingSecret: string, cookieName: string): Buffer {

package/lib/prospectus-sign-in-routes.ts

@@ -166,6 +166,7 @@ async function completeCallback(
       personId: signedIn.person.id,
       accessToken: signedIn.accessToken,
       accessTokenExpiresAt: signedIn.accessTokenExpiresAt,
+      ...(signedIn.person.siteSubject ? { siteSubject: signedIn.person.siteSubject } : {}),
     };
     const response = NextResponse.redirect(new URL(pendingSignIn.returnPath, siteOriginFor(request, options)), { status: 303, headers: NO_STORE_HEADERS });
     response.cookies.set(
@@ -198,11 +199,10 @@ async function handleProspectusSessionReadRoute(request: NextRequest, options: P
       return response;
     }
     const publishingAccounts = publishingAccountsForSite(directory.accounts, siteProductFor(options));
+    // Only what the UI reads: no person id, siteSubject or account list ever goes to the browser.
     return NextResponse.json(
       {
         signedIn: true,
-        person: directory.person,
-        accounts: directory.accounts,
         cyclotronLabAccess: directory.accounts.some((account) =>
           account.products.some((product) => product.product === CYCLOTRON_LAB_PRODUCT && product.status === "active"),
         ),

package/lib/prospectus-site-identity.ts

@@ -24,6 +24,7 @@ export type ProspectusOperation = "console:read" | "console:write" | "members:re
 export interface ProspectusPerson {
   id: string;
   createdAt: string;
+  siteSubject?: string;
 }
 
 export interface ProspectusAccountAuthorization {
@@ -36,6 +37,20 @@ export interface ProspectusAccountAuthorization {
   revision: number;
 }
 
+/** One retired reader site subject, from `GET /v1/accounts/site-subjects/retired` (reader sites only). */
+export interface ProspectusRetiredSiteSubject {
+  siteSubject: string;
+  reason: "deleted" | "merged";
+  survivingSiteSubject?: string;
+  retiredAt: string;
+}
+
+export interface ProspectusRetiredSiteSubjectsPage {
+  retired: ProspectusRetiredSiteSubject[];
+  cursor: string;
+  more: boolean;
+}
+
 export interface ProspectusDirectoryAccount {
   id: string;
   name: string;
@@ -100,8 +115,10 @@ export function signedProspectusTransport(options: SignedProspectusTransportOpti
       ...(payload ? { "content-type": "application/json" } : {}),
     };
     const signer = new SignatureV4({ service: "execute-api", region: options.region, credentials, sha256: Sha256 });
+    // The query string is part of what API Gateway verifies, so it has to be signed as well as sent.
+    const query: Record<string, string> = Object.fromEntries(url.searchParams.entries());
     const signed = await signer.sign(
-      new HttpRequest({ protocol: url.protocol, hostname: url.hostname, path: url.pathname, method, headers, body: payload }),
+      new HttpRequest({ protocol: url.protocol, hostname: url.hostname, path: url.pathname, method, headers, body: payload, query }),
     );
     const response = await fetcher(url, { method, headers: signed.headers, body: payload, cache: "no-store", redirect: "error" });
     const responseBody = await response.json().catch(() => ({}));
@@ -156,6 +173,12 @@ export class ProspectusSiteAccounts {
     }) as Promise<{ account: { id: string; name: string; role: ProspectusRole } }>;
   }
 
+  /** The calling site's retired reader subjects since `since` (omit it the first time): at most 100, oldest first. */
+  retiredSiteSubjects(since?: string): Promise<ProspectusRetiredSiteSubjectsPage> {
+    const query = since ? `?since=${encodeURIComponent(since)}` : "";
+    return this.transport({ path: `/v1/accounts/site-subjects/retired${query}`, method: "GET" }) as Promise<ProspectusRetiredSiteSubjectsPage>;
+  }
+
   accountDirectory(humanAccessToken: string): Promise<{ person: ProspectusPerson | null; accounts: ProspectusDirectoryAccount[] }> {
     return this.transport({ path: "/v1/account-directory", method: "GET", humanAccessToken }) as Promise<{
       person: ProspectusPerson | null;

package/lib/reader-api.ts

@@ -0,0 +1,145 @@
+import { NextResponse, type NextRequest } from "next/server";
+import { readAmplifyOutputsFile } from "./amplify-outputs-path";
+import { loadProspectusSessionSealingSecret, type ProspectusSignedInSession } from "./prospectus-session";
+import { signedInProspectusSession } from "./prospectus-sign-in-routes";
+import { readerIsStaff, readerSubject } from "./reader-subject";
+import { SiteOriginNotConfiguredError, publicSiteOrigin, siteOriginNotConfiguredResponse } from "./site-origin";
+
+export const READER_ACTIONS_FUNCTION_ENV = "PAPYRUS_READER_ACTIONS_FUNCTION";
+export const READER_MAXIMUM_BODY_BYTES = 4096;
+/** Larger bodies for actions that carry reader text: a URL, a title and a note; a comment of 2,000 characters. */
+export const READER_BODY_BYTES_BY_ACTION: Partial<Record<ReaderAction, number>> = { submit: 8192, comment: 12288, "comment-edit": 12288 };
+export const READER_MAXIMUM_SUBJECTS = 50;
+export const READER_SUBJECT_KEY = /^[A-Za-z0-9._:-]{1,200}$/;
+
+export type ReaderAction = "me" | "handle" | "vote" | "rating" | "submit" | "comment" | "comment-edit" | "comment-delete" | "report";
+
+export interface ReaderActionEvent {
+  publication: string;
+  siteSubject: string;
+  isStaff: boolean;
+  action: ReaderAction;
+  payload: Record<string, unknown>;
+}
+
+export interface ReaderActionResult {
+  statusCode: number;
+  body: Record<string, unknown>;
+}
+
+export type ReaderActionInvoker = (functionName: string, event: ReaderActionEvent) => Promise<ReaderActionResult>;
+
+export interface ReaderApiOptions {
+  environment?: Record<string, string | undefined>;
+  invoke?: ReaderActionInvoker;
+  actionsFunctionName?: string | null;
+  loadSealingSecret?: () => Promise<string | null>;
+  nowInSeconds?: number;
+}
+
+const NO_STORE_HEADERS = { "cache-control": "no-store" };
+
+function failure(status: number, error: string, message: string, extra: Record<string, unknown> = {}, headers: Record<string, string> = {}): NextResponse {
+  return NextResponse.json({ error, message, ...extra }, { status, headers: { ...NO_STORE_HEADERS, ...headers } });
+}
+
+export function identityUnavailableResponse(): NextResponse {
+  return failure(503, "reader_identity_unavailable", "Reader sign-in is not open yet.");
+}
+
+function actionsFunctionNameFrom(options: ReaderApiOptions, environment: Record<string, string | undefined>): string | null {
+  if (options.actionsFunctionName !== undefined) return options.actionsFunctionName;
+  const fromEnvironment = (environment[READER_ACTIONS_FUNCTION_ENV] ?? "").trim();
+  if (fromEnvironment) return fromEnvironment;
+  const outputs = readAmplifyOutputsFile() as { custom?: { readerSteering?: { actionsFunction?: unknown } | null } } | null;
+  const fromOutputs = outputs?.custom?.readerSteering?.actionsFunction;
+  return typeof fromOutputs === "string" && fromOutputs.trim() ? fromOutputs.trim() : null;
+}
+
+export async function invokeReaderActionsLambda(functionName: string, event: ReaderActionEvent): Promise<ReaderActionResult> {
+  const { InvokeCommand, LambdaClient } = await import("@aws-sdk/client-lambda");
+  const response = await new LambdaClient({}).send(
+    new InvokeCommand({ FunctionName: functionName, InvocationType: "RequestResponse", Payload: Buffer.from(JSON.stringify(event)) }),
+  );
+  if (response.FunctionError || !response.Payload) throw new Error("reader-actions failed");
+  const result = JSON.parse(Buffer.from(response.Payload).toString("utf8")) as Partial<ReaderActionResult>;
+  if (typeof result.statusCode !== "number" || typeof result.body !== "object" || result.body === null) throw new Error("reader-actions returned an unexpected shape");
+  return { statusCode: result.statusCode, body: result.body as Record<string, unknown> };
+}
+
+async function readJsonBody(request: NextRequest, maximumBytes: number): Promise<{ payload: Record<string, unknown> } | { response: NextResponse }> {
+  const contentType = (request.headers.get("content-type") ?? "").split(";")[0].trim().toLowerCase();
+  if (contentType !== "application/json") return { response: failure(415, "unsupported_media_type", "Send application/json.") };
+  const declared = Number(request.headers.get("content-length") ?? "0");
+  if (Number.isFinite(declared) && declared > maximumBytes) return { response: failure(413, "payload_too_large", "The request body is too large.") };
+  const text = await request.text();
+  if (Buffer.byteLength(text, "utf8") > maximumBytes) return { response: failure(413, "payload_too_large", "The request body is too large.") };
+  try {
+    const parsed = JSON.parse(text) as unknown;
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) throw new Error("not an object");
+    return { payload: parsed as Record<string, unknown> };
+  } catch {
+    return { response: failure(400, "invalid_json", "The request body is not a JSON object.") };
+  }
+}
+
+function subjectsFromQuery(request: NextRequest): { payload: Record<string, unknown> } | { response: NextResponse } {
+  const raw = request.nextUrl.searchParams.get("subjects") ?? "";
+  const subjects = raw === "" ? [] : raw.split(",");
+  if (subjects.length > READER_MAXIMUM_SUBJECTS || !subjects.every((subject) => READER_SUBJECT_KEY.test(subject))) {
+    return { response: failure(400, "invalid_subjects", `Send at most ${READER_MAXIMUM_SUBJECTS} comma separated item keys.`) };
+  }
+  return { payload: { subjects } };
+}
+
+async function signedInReaderSession(request: NextRequest, options: ReaderApiOptions): Promise<ProspectusSignedInSession | null | "unavailable"> {
+  const sealingSecret = await (options.loadSealingSecret ?? (() => loadProspectusSessionSealingSecret({ environment: options.environment })))();
+  if (!sealingSecret) return "unavailable";
+  return signedInProspectusSession(request, sealingSecret, options.nowInSeconds);
+}
+
+/**
+ * One reader route: session, readerSubject (503 while Prospectus has no siteSubject), Origin, JSON size, then the
+ * reader-actions function. The siteSubject only travels to the function and never into a response.
+ */
+export async function handleReaderRequest(request: NextRequest, action: ReaderAction, options: ReaderApiOptions = {}): Promise<NextResponse> {
+  const environment = options.environment ?? process.env;
+  let origin: string;
+  try {
+    origin = publicSiteOrigin(request, environment);
+  } catch (error) {
+    if (error instanceof SiteOriginNotConfiguredError) return siteOriginNotConfiguredResponse(error);
+    throw error;
+  }
+  const session = await signedInReaderSession(request, options);
+  if (session === "unavailable") return identityUnavailableResponse();
+  if (!session) return failure(401, "signed_out", "Sign in to continue.");
+  const siteSubject = readerSubject(session, environment);
+  if (siteSubject === null) return identityUnavailableResponse();
+
+  let parsed: { payload: Record<string, unknown> } | { response: NextResponse };
+  if (action === "me") {
+    parsed = subjectsFromQuery(request);
+  } else {
+    if (request.headers.get("origin") !== origin) return failure(403, "origin_mismatch", "This request did not come from this site.");
+    parsed = await readJsonBody(request, READER_BODY_BYTES_BY_ACTION[action] ?? READER_MAXIMUM_BODY_BYTES);
+  }
+  if ("response" in parsed) return parsed.response;
+
+  const functionName = actionsFunctionNameFrom(options, environment);
+  if (!functionName) return failure(503, "reader_actions_unavailable", "Reader features are not enabled for this site.");
+  try {
+    const result = await (options.invoke ?? invokeReaderActionsLambda)(functionName, {
+      publication: new URL(origin).host,
+      siteSubject,
+      isStaff: readerIsStaff(session),
+      action,
+      payload: parsed.payload,
+    });
+    const retryAfter: Record<string, string> = typeof result.body.retryAfter === "number" ? { "retry-after": String(result.body.retryAfter) } : {};
+    return NextResponse.json(result.body, { status: result.statusCode, headers: { ...NO_STORE_HEADERS, ...retryAfter } });
+  } catch (error) {
+    console.error(`Reader action ${action} failed (${error instanceof Error ? error.name : "error"}).`);
+    return failure(502, "reader_actions_failed", "Reader features could not be reached.");
+  }
+}