@anthusai/papyrus 2.0.0-next.9 → 2.0.0-next.90

package/amplify/auth/resource.js

@@ -1,6 +1,6 @@
 import { defineAuth, secret } from "@aws-amplify/backend";
 import { manageUserRole } from "../functions/manage-user-role/resource.js";
-import { CfnUserPoolDomain } from "aws-cdk-lib/aws-cognito";
+import { CfnUserPoolDomain, CfnUserPoolIdentityProvider } from "aws-cdk-lib/aws-cognito";
 import { expandNewsroomRedirectUrls } from "./redirect-urls.js";
 // Default OAuth redirect URLs for the p.apyr.us app. Other publications pass
 // `auth.redirectUrls` to `defineSiteBackend` (or, for Papyrus's own backend,
@@ -35,6 +35,21 @@ export function authConfigFromEnv() {
 export function siteAuthRedirectUrls(config) {
     return config.redirectUrls ?? DEFAULT_AUTH_REDIRECT_URLS;
 }
+/** Keep Cognito's federated email verification state in sync with Google's verified claim. */
+export function applyGoogleEmailVerifiedMapping(authStack) {
+    const googleProviders = authStack.node
+        .findAll()
+        .filter((construct) => construct instanceof CfnUserPoolIdentityProvider && construct.providerName === "Google");
+    if (googleProviders.length !== 1) {
+        throw new Error(`Expected exactly one Google identity provider to map email_verified, found ${googleProviders.length}`);
+    }
+    const [provider] = googleProviders;
+    const mapping = provider.attributeMapping;
+    if (mapping !== undefined && (typeof mapping !== "object" || Array.isArray(mapping))) {
+        throw new Error("Expected Google identity provider attribute mappings to be a plain object");
+    }
+    provider.attributeMapping = { ...(mapping ?? {}), email_verified: "email_verified" };
+}
 export function defineSiteAuth(config) {
     const authRedirectUrls = expandNewsroomRedirectUrls(siteAuthRedirectUrls(config), config.newsroomBasePath);
     const disableGoogleOAuth = config.disableGoogleOAuth === true;

package/amplify/auth/resource.ts

@@ -1,7 +1,7 @@
 import { defineAuth, secret } from "@aws-amplify/backend";
 import { manageUserRole } from "../functions/manage-user-role/resource";
 import { Stack } from "aws-cdk-lib";
-import { CfnUserPoolDomain } from "aws-cdk-lib/aws-cognito";
+import { CfnUserPoolDomain, CfnUserPoolIdentityProvider } from "aws-cdk-lib/aws-cognito";
 import type { PapyrusAuthConfig } from "../site-backend-config";
 import { expandNewsroomRedirectUrls } from "./redirect-urls";
 
@@ -41,6 +41,24 @@ export function siteAuthRedirectUrls(config: PapyrusAuthConfig): string[] {
   return config.redirectUrls ?? DEFAULT_AUTH_REDIRECT_URLS;
 }
 
+/** Keep Cognito's federated email verification state in sync with Google's verified claim. */
+export function applyGoogleEmailVerifiedMapping(authStack: Stack): void {
+  const googleProviders = authStack.node
+    .findAll()
+    .filter((construct): construct is CfnUserPoolIdentityProvider =>
+      construct instanceof CfnUserPoolIdentityProvider && construct.providerName === "Google");
+  if (googleProviders.length !== 1) {
+    throw new Error(`Expected exactly one Google identity provider to map email_verified, found ${googleProviders.length}`);
+  }
+
+  const [provider] = googleProviders;
+  const mapping = provider.attributeMapping;
+  if (mapping !== undefined && (typeof mapping !== "object" || Array.isArray(mapping))) {
+    throw new Error("Expected Google identity provider attribute mappings to be a plain object");
+  }
+  provider.attributeMapping = { ...(mapping ?? {}), email_verified: "email_verified" };
+}
+
 export function defineSiteAuth(config: PapyrusAuthConfig) {
   const authRedirectUrls = expandNewsroomRedirectUrls(
     siteAuthRedirectUrls(config),

package/amplify/data/function-handler.js

@@ -0,0 +1,20 @@
+import { a } from "@aws-amplify/backend";
+const registered = new Map();
+/** The shared name for a Lambda: stable, alphanumeric, unique per function. */
+export function sharedFunctionName(name) {
+    return `Fn${name.charAt(0).toUpperCase()}${name.slice(1)}`;
+}
+/** A schema handler for `fn` that shares one data source with every other field handled by `fn`. */
+export function functionHandler(name, fn) {
+    const shared = sharedFunctionName(name);
+    const existing = registered.get(shared);
+    if (existing !== undefined && existing !== fn) {
+        throw new Error(`Two different functions are registered as "${shared}"`);
+    }
+    registered.set(shared, fn);
+    return a.handler.function(shared);
+}
+/** Every function that a schema handler refers to by shared name, for `defineData({ functions })`. */
+export function sharedFunctions() {
+    return Object.fromEntries(registered);
+}

package/amplify/data/function-handler.ts

@@ -0,0 +1,40 @@
+import { a } from "@aws-amplify/backend";
+
+/**
+ * One AppSync Lambda data source per Lambda, not one per field.
+ *
+ * `a.handler.function(fn)` names every field's function `Fn<FieldName>`, and the @function transformer creates a data
+ * source, an IAM role, an IAM policy and two function configurations for each distinct name, all in one nested stack
+ * (`FunctionDirectiveStack`). CloudFormation allows 500 resources in a stack, and that stack grows by six resources per
+ * Lambda-backed field. Giving every field that calls the same Lambda the same name makes them share one data source,
+ * role, policy and function configuration, so each extra field costs only its resolver. The Lambda receives the same
+ * event as before (`typeName`, `fieldName`, `arguments`, `identity`), so no handler changes.
+ *
+ * Every function used this way is registered here and handed to `defineData({ functions })`, which is how Amplify
+ * resolves a handler given by name.
+ */
+/** What `a.handler.function` accepts, and what `defineData({ functions })` takes by name. */
+type HandlerFunction = Exclude<Parameters<typeof a.handler.function>[0], string>;
+
+const registered = new Map<string, HandlerFunction>();
+
+/** The shared name for a Lambda: stable, alphanumeric, unique per function. */
+export function sharedFunctionName(name: string): string {
+  return `Fn${name.charAt(0).toUpperCase()}${name.slice(1)}`;
+}
+
+/** A schema handler for `fn` that shares one data source with every other field handled by `fn`. */
+export function functionHandler(name: string, fn: HandlerFunction) {
+  const shared = sharedFunctionName(name);
+  const existing = registered.get(shared);
+  if (existing !== undefined && existing !== fn) {
+    throw new Error(`Two different functions are registered as "${shared}"`);
+  }
+  registered.set(shared, fn);
+  return a.handler.function(shared);
+}
+
+/** Every function that a schema handler refers to by shared name, for `defineData({ functions })`. */
+export function sharedFunctions(): Record<string, HandlerFunction> {
+  return Object.fromEntries(registered);
+}