@anthusai/papyrus 5.14.0 → 5.15.1

package/infra/amplify-app-shell.js

@@ -1,10 +1,10 @@
 import { ArnFormat, CfnOutput, Duration, Fn, Stack } from "aws-cdk-lib";
 import * as iam from "aws-cdk-lib/aws-iam";
 import * as amplify from "aws-cdk-lib/aws-amplify";
-import * as secretsmanager from "aws-cdk-lib/aws-secretsmanager";
+import { SecureStringParameter } from "./secure-string-parameter.js";
 import { GITHUB_OIDC_PROVIDER_HOST } from "./github-oidc-provider.js";
 import { cmsProductionBuildSpec, cmsStagingBuildSpec, readerBuildSpec } from "./build-specs.js";
-import { PROSPECTUS_PAPYRUS_SITE_ROUTES, hasCmsApp, isStagingEnabled, resolveRedirectSubDomainPrefix, resolveCmsHostName, githubOidcSubjects, resolveGithubRepository, resolveProspectusAccountsEndpoint, resolveRevalidateSecretParameterName, resolveStackName, resolveStagingDomainName, resolveStoragePreviewPrefix } from "./site-config.js";
+import { PROSPECTUS_PAPYRUS_SITE_ROUTES, hasCmsApp, isStagingEnabled, resolveRedirectSubDomainPrefix, resolveCmsHostName, githubOidcSubjects, resolveGithubRepository, resolveProspectusAccountsEndpoint, resolveProspectusSessionSealingParameterName, resolveRevalidateSecretParameterName, resolveStackName, resolveStagingDomainName, resolveStoragePreviewPrefix } from "./site-config.js";
 function environmentVariables(variables) {
     return Object.entries(variables).map(([name, value]) => ({ name, value }));
 }
@@ -92,33 +92,35 @@ export class AmplifyAppShellStack extends Stack {
         });
         const revalidateSecretParameterName = config.frontend === "pretext" ? resolveRevalidateSecretParameterName(config) : undefined;
         if (revalidateSecretParameterName) {
+            const revalidateSecret = new SecureStringParameter(this, "RevalidateSecretParameter", {
+                parameterName: revalidateSecretParameterName,
+                description: `Shared secret that authorizes publishes to call the /api/revalidate route of ${cmsAppName}`,
+            });
             computeRole.addToPolicy(new iam.PolicyStatement({
                 sid: "ReadRevalidateSecret",
                 actions: ["ssm:GetParameter"],
-                resources: [
-                    this.formatArn({ service: "ssm", resource: "parameter", resourceName: revalidateSecretParameterName.slice(1), arnFormat: ArnFormat.SLASH_RESOURCE_NAME }),
-                ],
+                resources: [revalidateSecret.parameterArn],
             }));
         }
         const prospectusAccountsApiStageArn = config.cms.prospectusAccountsApiStageArn;
-        const prospectusSessionSealingSecret = prospectusAccountsApiStageArn
-            ? new secretsmanager.Secret(this, "ProspectusSessionSealingSecret", {
+        const prospectusSessionSealing = prospectusAccountsApiStageArn
+            ? new SecureStringParameter(this, "ProspectusSessionSealingParameter", {
+                parameterName: resolveProspectusSessionSealingParameterName(config),
                 description: `Seals the Prospectus sign-in cookies of ${cmsAppName}; replacing it signs everyone out`,
-                generateSecretString: { passwordLength: 64, excludePunctuation: true },
             })
             : undefined;
-        const prospectusEnvironment = prospectusAccountsApiStageArn && prospectusSessionSealingSecret
+        const prospectusEnvironment = prospectusAccountsApiStageArn && prospectusSessionSealing
             ? {
                 PAPYRUS_PROSPECTUS_ACCOUNTS_ENDPOINT: resolveProspectusAccountsEndpoint(prospectusAccountsApiStageArn),
-                PAPYRUS_PROSPECTUS_SESSION_SECRET_ARN: prospectusSessionSealingSecret.secretArn,
+                PAPYRUS_PROSPECTUS_SESSION_SECRET_PARAMETER: prospectusSessionSealing.parameterName,
                 PAPYRUS_PROSPECTUS_SITE_PRODUCT: `papyrus-${config.siteId}`,
             }
             : {};
-        if (prospectusSessionSealingSecret) {
+        if (prospectusSessionSealing) {
             computeRole.addToPolicy(new iam.PolicyStatement({
                 sid: "ReadProspectusSessionSealingSecret",
-                actions: ["secretsmanager:GetSecretValue"],
-                resources: [prospectusSessionSealingSecret.secretArn],
+                actions: ["ssm:GetParameter"],
+                resources: [prospectusSessionSealing.parameterArn],
             }));
         }
         if (prospectusAccountsApiStageArn) {
@@ -156,6 +158,9 @@ export class AmplifyAppShellStack extends Stack {
         const stagingOrigin = stagingDomainName
             ? `https://${stagingDomainName}/`
             : Fn.join("", ["https://staging.", cmsApp.attrDefaultDomain, "/"]);
+        // The compute adapter's request URL is https://localhost:3000, so the site names its own public origin.
+        const productionSiteOrigin = cmsHostName ? `https://${cmsHostName}` : Fn.join("", ["https://main.", cmsApp.attrDefaultDomain]);
+        const stagingSiteOrigin = stagingDomainName ? `https://${stagingDomainName}` : Fn.join("", ["https://staging.", cmsApp.attrDefaultDomain]);
         const sharedRootDomain = config.cms.domainPrefix !== undefined;
         const defaultOriginsToAllow = [
             ...(config.cms.domainName ? [] : [productionOrigin]),
@@ -178,6 +183,7 @@ export class AmplifyAppShellStack extends Stack {
                 PAPYRUS_OAUTH_REDIRECT_URLS: oauthRedirectUrls,
                 PAPYRUS_SITE_BRAND: config.brand,
                 SITE_ENV: "production",
+                PAPYRUS_SITE_ORIGIN: productionSiteOrigin,
                 PAPYRUS_CONTENT_SOURCE: "published",
                 ...(revalidateSecretParameterName ? { PAPYRUS_REVALIDATE_SECRET_PARAMETER: revalidateSecretParameterName } : {}),
                 ...prospectusEnvironment,
@@ -199,6 +205,7 @@ export class AmplifyAppShellStack extends Stack {
                     PAPYRUS_OAUTH_REDIRECT_URLS: oauthRedirectUrls,
                     PAPYRUS_SITE_BRAND: config.brand,
                     SITE_ENV: "staging",
+                    PAPYRUS_SITE_ORIGIN: stagingSiteOrigin,
                     ...stagingMode,
                     ...prospectusEnvironment,
                     NEXT_PUBLIC_PAPYRUS_STAGING_URL: stagingDomainName

package/infra/amplify-app-shell.ts

@@ -2,10 +2,10 @@ import { Construct } from "constructs";
 import { ArnFormat, CfnOutput, Duration, Fn, Stack, StackProps } from "aws-cdk-lib";
 import * as iam from "aws-cdk-lib/aws-iam";
 import * as amplify from "aws-cdk-lib/aws-amplify";
-import * as secretsmanager from "aws-cdk-lib/aws-secretsmanager";
+import { SecureStringParameter } from "./secure-string-parameter";
 import { GITHUB_OIDC_PROVIDER_HOST } from "./github-oidc-provider";
 import { cmsProductionBuildSpec, cmsStagingBuildSpec, readerBuildSpec } from "./build-specs";
-import { AmplifyAppShellSiteConfig, PROSPECTUS_PAPYRUS_SITE_ROUTES, ReaderCustomHeaderRule, hasCmsApp, isStagingEnabled, resolveRedirectSubDomainPrefix, resolveCmsHostName, githubOidcSubjects, resolveGithubRepository, resolveProspectusAccountsEndpoint, resolveRevalidateSecretParameterName, resolveStackName, resolveStagingDomainName, resolveStoragePreviewPrefix } from "./site-config";
+import { AmplifyAppShellSiteConfig, PROSPECTUS_PAPYRUS_SITE_ROUTES, ReaderCustomHeaderRule, hasCmsApp, isStagingEnabled, resolveRedirectSubDomainPrefix, resolveCmsHostName, githubOidcSubjects, resolveGithubRepository, resolveProspectusAccountsEndpoint, resolveProspectusSessionSealingParameterName, resolveRevalidateSecretParameterName, resolveStackName, resolveStagingDomainName, resolveStoragePreviewPrefix } from "./site-config";
 
 function environmentVariables(variables: Record<string, string>): amplify.CfnBranch.EnvironmentVariableProperty[] {
   return Object.entries(variables).map(([name, value]) => ({ name, value }));
@@ -100,37 +100,39 @@ export class AmplifyAppShellStack extends Stack {
 
     const revalidateSecretParameterName = config.frontend === "pretext" ? resolveRevalidateSecretParameterName(config) : undefined;
     if (revalidateSecretParameterName) {
+      const revalidateSecret = new SecureStringParameter(this, "RevalidateSecretParameter", {
+        parameterName: revalidateSecretParameterName,
+        description: `Shared secret that authorizes publishes to call the /api/revalidate route of ${cmsAppName}`,
+      });
       computeRole.addToPolicy(
         new iam.PolicyStatement({
           sid: "ReadRevalidateSecret",
           actions: ["ssm:GetParameter"],
-          resources: [
-            this.formatArn({ service: "ssm", resource: "parameter", resourceName: revalidateSecretParameterName.slice(1), arnFormat: ArnFormat.SLASH_RESOURCE_NAME }),
-          ],
+          resources: [revalidateSecret.parameterArn],
         }),
       );
     }
 
     const prospectusAccountsApiStageArn = config.cms.prospectusAccountsApiStageArn;
-    const prospectusSessionSealingSecret = prospectusAccountsApiStageArn
-      ? new secretsmanager.Secret(this, "ProspectusSessionSealingSecret", {
+    const prospectusSessionSealing = prospectusAccountsApiStageArn
+      ? new SecureStringParameter(this, "ProspectusSessionSealingParameter", {
+        parameterName: resolveProspectusSessionSealingParameterName(config),
         description: `Seals the Prospectus sign-in cookies of ${cmsAppName}; replacing it signs everyone out`,
-        generateSecretString: { passwordLength: 64, excludePunctuation: true },
       })
       : undefined;
-    const prospectusEnvironment = prospectusAccountsApiStageArn && prospectusSessionSealingSecret
+    const prospectusEnvironment = prospectusAccountsApiStageArn && prospectusSessionSealing
       ? {
         PAPYRUS_PROSPECTUS_ACCOUNTS_ENDPOINT: resolveProspectusAccountsEndpoint(prospectusAccountsApiStageArn),
-        PAPYRUS_PROSPECTUS_SESSION_SECRET_ARN: prospectusSessionSealingSecret.secretArn,
+        PAPYRUS_PROSPECTUS_SESSION_SECRET_PARAMETER: prospectusSessionSealing.parameterName,
         PAPYRUS_PROSPECTUS_SITE_PRODUCT: `papyrus-${config.siteId}`,
       }
       : {};
-    if (prospectusSessionSealingSecret) {
+    if (prospectusSessionSealing) {
       computeRole.addToPolicy(
         new iam.PolicyStatement({
           sid: "ReadProspectusSessionSealingSecret",
-          actions: ["secretsmanager:GetSecretValue"],
-          resources: [prospectusSessionSealingSecret.secretArn],
+          actions: ["ssm:GetParameter"],
+          resources: [prospectusSessionSealing.parameterArn],
         }),
       );
     }
@@ -175,6 +177,9 @@ export class AmplifyAppShellStack extends Stack {
     const stagingOrigin = stagingDomainName
       ? `https://${stagingDomainName}/`
       : Fn.join("", ["https://staging.", cmsApp.attrDefaultDomain, "/"]);
+    // The compute adapter's request URL is https://localhost:3000, so the site names its own public origin.
+    const productionSiteOrigin = cmsHostName ? `https://${cmsHostName}` : Fn.join("", ["https://main.", cmsApp.attrDefaultDomain]);
+    const stagingSiteOrigin = stagingDomainName ? `https://${stagingDomainName}` : Fn.join("", ["https://staging.", cmsApp.attrDefaultDomain]);
     const sharedRootDomain = config.cms.domainPrefix !== undefined;
     const defaultOriginsToAllow = [
       ...(config.cms.domainName ? [] : [productionOrigin]),
@@ -198,6 +203,7 @@ export class AmplifyAppShellStack extends Stack {
         PAPYRUS_OAUTH_REDIRECT_URLS: oauthRedirectUrls,
         PAPYRUS_SITE_BRAND: config.brand,
         SITE_ENV: "production",
+        PAPYRUS_SITE_ORIGIN: productionSiteOrigin,
         PAPYRUS_CONTENT_SOURCE: "published",
         ...(revalidateSecretParameterName ? { PAPYRUS_REVALIDATE_SECRET_PARAMETER: revalidateSecretParameterName } : {}),
         ...prospectusEnvironment,
@@ -220,6 +226,7 @@ export class AmplifyAppShellStack extends Stack {
           PAPYRUS_OAUTH_REDIRECT_URLS: oauthRedirectUrls,
           PAPYRUS_SITE_BRAND: config.brand,
           SITE_ENV: "staging",
+          PAPYRUS_SITE_ORIGIN: stagingSiteOrigin,
           ...stagingMode,
           ...prospectusEnvironment,
           NEXT_PUBLIC_PAPYRUS_STAGING_URL: stagingDomainName

package/infra/index.js

@@ -10,6 +10,7 @@ try {
   );
 }
 export const { AmplifyAppShellStack } = await import("./amplify-app-shell.js");
+export const { SecureStringParameter } = await import("./secure-string-parameter.js");
 export const { GithubOidcProviderStack } = await import("./github-oidc-provider.js");
 export { parseSiteConfig } from "./site-config.js";
 export { cmsProductionBuildSpec, cmsStagingBuildSpec, readerBuildSpec, buildSpecFor } from "./build-specs.js";

package/infra/secure-string-parameter-handler.js

@@ -0,0 +1,41 @@
+/**
+ * Source of the Lambda behind SecureStringParameter, as a string so the staged
+ * package (which ships only .ts under infra/) can inline it and tests can run it
+ * against a fake SSM client. CommonJS, under the 4096-character inline limit.
+ *
+ * It creates the parameter when it is missing and does nothing else: it never
+ * overwrites an existing value, never reads one back, never logs the value, and
+ * returns no data (only the parameter name as the physical id).
+ */
+export const SECURE_STRING_PARAMETER_HANDLER_SOURCE = `
+const { randomInt } = require("node:crypto");
+const ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
+function generate(length) {
+  let value = "";
+  for (let index = 0; index < length; index += 1) value += ALPHABET[randomInt(ALPHABET.length)];
+  return value;
+}
+exports.createHandler = (ssm, PutParameterCommand) => async (event) => {
+  const name = event.ResourceProperties.ParameterName;
+  if (event.RequestType === "Delete") return { PhysicalResourceId: event.PhysicalResourceId };
+  try {
+    await ssm.send(new PutParameterCommand({
+      Name: name,
+      Description: event.ResourceProperties.Description,
+      Type: "SecureString",
+      Tier: "Standard",
+      Overwrite: false,
+      Value: generate(Number(event.ResourceProperties.Length)),
+    }));
+  } catch (error) {
+    if (!error || error.name !== "ParameterAlreadyExists") {
+      throw new Error("PutParameter failed for " + name + " (" + (error && error.name ? error.name : "error") + ")");
+    }
+  }
+  return { PhysicalResourceId: name };
+};
+exports.handler = async (event) => {
+  const { SSMClient, PutParameterCommand } = require("@aws-sdk/client-ssm");
+  return exports.createHandler(new SSMClient({}), PutParameterCommand)(event);
+};
+`;

package/infra/secure-string-parameter-handler.ts

@@ -0,0 +1,41 @@
+/**
+ * Source of the Lambda behind SecureStringParameter, as a string so the staged
+ * package (which ships only .ts under infra/) can inline it and tests can run it
+ * against a fake SSM client. CommonJS, under the 4096-character inline limit.
+ *
+ * It creates the parameter when it is missing and does nothing else: it never
+ * overwrites an existing value, never reads one back, never logs the value, and
+ * returns no data (only the parameter name as the physical id).
+ */
+export const SECURE_STRING_PARAMETER_HANDLER_SOURCE = `
+const { randomInt } = require("node:crypto");
+const ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
+function generate(length) {
+  let value = "";
+  for (let index = 0; index < length; index += 1) value += ALPHABET[randomInt(ALPHABET.length)];
+  return value;
+}
+exports.createHandler = (ssm, PutParameterCommand) => async (event) => {
+  const name = event.ResourceProperties.ParameterName;
+  if (event.RequestType === "Delete") return { PhysicalResourceId: event.PhysicalResourceId };
+  try {
+    await ssm.send(new PutParameterCommand({
+      Name: name,
+      Description: event.ResourceProperties.Description,
+      Type: "SecureString",
+      Tier: "Standard",
+      Overwrite: false,
+      Value: generate(Number(event.ResourceProperties.Length)),
+    }));
+  } catch (error) {
+    if (!error || error.name !== "ParameterAlreadyExists") {
+      throw new Error("PutParameter failed for " + name + " (" + (error && error.name ? error.name : "error") + ")");
+    }
+  }
+  return { PhysicalResourceId: name };
+};
+exports.handler = async (event) => {
+  const { SSMClient, PutParameterCommand } = require("@aws-sdk/client-ssm");
+  return exports.createHandler(new SSMClient({}), PutParameterCommand)(event);
+};
+`;

package/infra/secure-string-parameter.js

@@ -0,0 +1,79 @@
+import { Construct } from "constructs";
+import { ArnFormat, CustomResource, Duration, RemovalPolicy, Stack } from "aws-cdk-lib";
+import * as iam from "aws-cdk-lib/aws-iam";
+import * as lambda from "aws-cdk-lib/aws-lambda";
+import * as customResources from "aws-cdk-lib/custom-resources";
+import { SECURE_STRING_PARAMETER_HANDLER_SOURCE } from "./secure-string-parameter-handler.js";
+/** One Lambda and role per stack, shared by every SecureStringParameter in it. */
+class SecureStringParameterProvider extends Construct {
+    static ID = "SecureStringParameterProvider";
+    role;
+    provider;
+    static of(stack) {
+        return stack.node.tryFindChild(SecureStringParameterProvider.ID)
+            ?? new SecureStringParameterProvider(stack);
+    }
+    constructor(stack) {
+        super(stack, SecureStringParameterProvider.ID);
+        this.role = new iam.Role(this, "Role", {
+            assumedBy: new iam.ServicePrincipal("lambda.amazonaws.com"),
+            description: "Creates generated SecureString parameters: PutParameter per named parameter, never overwriting",
+            managedPolicies: [iam.ManagedPolicy.fromAwsManagedPolicyName("service-role/AWSLambdaBasicExecutionRole")],
+        });
+        const onEvent = new lambda.Function(this, "OnEvent", {
+            runtime: lambda.Runtime.NODEJS_22_X,
+            handler: "index.handler",
+            code: lambda.Code.fromInline(SECURE_STRING_PARAMETER_HANDLER_SOURCE),
+            role: this.role,
+            timeout: Duration.seconds(30),
+            description: "Creates a generated SecureString parameter once; never returns or logs the value",
+        });
+        this.provider = new customResources.Provider(this, "Provider", { onEventHandler: onEvent });
+    }
+}
+/**
+ * A generated secret in SSM Parameter Store as a standard SecureString (free,
+ * AWS-managed `aws/ssm` key), instead of a Secrets Manager secret ($0.40/month).
+ *
+ * CloudFormation cannot create a SecureString, so a custom resource Lambda puts
+ * it. The Lambda generates a random value at create time and never returns or
+ * logs it, so the value is in no template, output or stack event. It is
+ * create-only: an update never regenerates it and never overwrites a parameter
+ * that already exists (a hand-made one is adopted as it is), and delete retains
+ * it, so a stack teardown cannot sign anyone out. Rotate it with
+ * `aws ssm put-parameter --overwrite`. Readers get `ssm:GetParameter` on
+ * `parameterArn` only; decrypting with the AWS-managed key needs no KMS grant.
+ */
+export class SecureStringParameter extends Construct {
+    parameterName;
+    parameterArn;
+    constructor(scope, id, props) {
+        super(scope, id);
+        if (!props.parameterName.startsWith("/"))
+            throw new Error(`SSM parameter name must be absolute: ${props.parameterName}`);
+        const length = props.length ?? 64;
+        if (!Number.isInteger(length) || length < 32)
+            throw new Error("A generated secret must be at least 32 characters.");
+        const stack = Stack.of(this);
+        this.parameterName = props.parameterName;
+        this.parameterArn = stack.formatArn({
+            service: "ssm",
+            resource: "parameter",
+            resourceName: props.parameterName.slice(1),
+            arnFormat: ArnFormat.SLASH_RESOURCE_NAME,
+        });
+        const shared = SecureStringParameterProvider.of(stack);
+        shared.role.addToPolicy(new iam.PolicyStatement({
+            sid: `Put${id.replace(/[^A-Za-z0-9]/g, "")}`,
+            actions: ["ssm:PutParameter"],
+            resources: [this.parameterArn],
+        }));
+        const resource = new CustomResource(this, "Resource", {
+            serviceToken: shared.provider.serviceToken,
+            resourceType: "Custom::SecureStringParameter",
+            properties: { ParameterName: props.parameterName, Description: props.description, Length: String(length) },
+            removalPolicy: RemovalPolicy.RETAIN,
+        });
+        resource.node.addDependency(shared.role);
+    }
+}

package/infra/secure-string-parameter.ts

@@ -0,0 +1,91 @@
+import { Construct } from "constructs";
+import { ArnFormat, CustomResource, Duration, RemovalPolicy, Stack } from "aws-cdk-lib";
+import * as iam from "aws-cdk-lib/aws-iam";
+import * as lambda from "aws-cdk-lib/aws-lambda";
+import * as customResources from "aws-cdk-lib/custom-resources";
+import { SECURE_STRING_PARAMETER_HANDLER_SOURCE } from "./secure-string-parameter-handler";
+
+export interface SecureStringParameterProps {
+  /** Absolute parameter name, e.g. `/papyrus/<siteId>/prospectus-session-sealing`. */
+  parameterName: string;
+  description: string;
+  /** Length of the generated value. Default 64. */
+  length?: number;
+}
+
+/** One Lambda and role per stack, shared by every SecureStringParameter in it. */
+class SecureStringParameterProvider extends Construct {
+  static readonly ID = "SecureStringParameterProvider";
+  public readonly role: iam.Role;
+  public readonly provider: customResources.Provider;
+
+  static of(stack: Stack): SecureStringParameterProvider {
+    return (stack.node.tryFindChild(SecureStringParameterProvider.ID) as SecureStringParameterProvider | undefined)
+      ?? new SecureStringParameterProvider(stack);
+  }
+
+  private constructor(stack: Stack) {
+    super(stack, SecureStringParameterProvider.ID);
+    this.role = new iam.Role(this, "Role", {
+      assumedBy: new iam.ServicePrincipal("lambda.amazonaws.com"),
+      description: "Creates generated SecureString parameters: PutParameter per named parameter, never overwriting",
+      managedPolicies: [iam.ManagedPolicy.fromAwsManagedPolicyName("service-role/AWSLambdaBasicExecutionRole")],
+    });
+    const onEvent = new lambda.Function(this, "OnEvent", {
+      runtime: lambda.Runtime.NODEJS_22_X,
+      handler: "index.handler",
+      code: lambda.Code.fromInline(SECURE_STRING_PARAMETER_HANDLER_SOURCE),
+      role: this.role,
+      timeout: Duration.seconds(30),
+      description: "Creates a generated SecureString parameter once; never returns or logs the value",
+    });
+    this.provider = new customResources.Provider(this, "Provider", { onEventHandler: onEvent });
+  }
+}
+
+/**
+ * A generated secret in SSM Parameter Store as a standard SecureString (free,
+ * AWS-managed `aws/ssm` key), instead of a Secrets Manager secret ($0.40/month).
+ *
+ * CloudFormation cannot create a SecureString, so a custom resource Lambda puts
+ * it. The Lambda generates a random value at create time and never returns or
+ * logs it, so the value is in no template, output or stack event. It is
+ * create-only: an update never regenerates it and never overwrites a parameter
+ * that already exists (a hand-made one is adopted as it is), and delete retains
+ * it, so a stack teardown cannot sign anyone out. Rotate it with
+ * `aws ssm put-parameter --overwrite`. Readers get `ssm:GetParameter` on
+ * `parameterArn` only; decrypting with the AWS-managed key needs no KMS grant.
+ */
+export class SecureStringParameter extends Construct {
+  public readonly parameterName: string;
+  public readonly parameterArn: string;
+
+  constructor(scope: Construct, id: string, props: SecureStringParameterProps) {
+    super(scope, id);
+    if (!props.parameterName.startsWith("/")) throw new Error(`SSM parameter name must be absolute: ${props.parameterName}`);
+    const length = props.length ?? 64;
+    if (!Number.isInteger(length) || length < 32) throw new Error("A generated secret must be at least 32 characters.");
+    const stack = Stack.of(this);
+    this.parameterName = props.parameterName;
+    this.parameterArn = stack.formatArn({
+      service: "ssm",
+      resource: "parameter",
+      resourceName: props.parameterName.slice(1),
+      arnFormat: ArnFormat.SLASH_RESOURCE_NAME,
+    });
+
+    const shared = SecureStringParameterProvider.of(stack);
+    shared.role.addToPolicy(new iam.PolicyStatement({
+      sid: `Put${id.replace(/[^A-Za-z0-9]/g, "")}`,
+      actions: ["ssm:PutParameter"],
+      resources: [this.parameterArn],
+    }));
+    const resource = new CustomResource(this, "Resource", {
+      serviceToken: shared.provider.serviceToken,
+      resourceType: "Custom::SecureStringParameter",
+      properties: { ParameterName: props.parameterName, Description: props.description, Length: String(length) },
+      removalPolicy: RemovalPolicy.RETAIN,
+    });
+    resource.node.addDependency(shared.role);
+  }
+}

package/infra/site-config.js

@@ -34,7 +34,7 @@ const GITHUB_REPO_PATTERN = /^[A-Za-z0-9_.-]+$/;
 const COGNITO_DOMAIN_PREFIX_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
 const COGNITO_RESERVED_WORDS = ["aws", "amazon", "cognito"];
 const PROSPECTUS_ACCOUNTS_API_STAGE_ARN_PATTERN = /^arn:aws:execute-api:[a-z0-9-]+:\d{12}:[a-z0-9]+\/api$/;
-const TEMPLATE_MANAGED_ENVIRONMENT_KEYS = ["PAPYRUS_COGNITO_DOMAIN_PREFIX", "PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX", "PAPYRUS_DISABLE_GOOGLE_OAUTH", "PAPYRUS_REVALIDATE_SECRET_PARAMETER", "PAPYRUS_PROSPECTUS_ACCOUNTS_ENDPOINT", "PAPYRUS_PROSPECTUS_SESSION_SECRET_ARN", "PAPYRUS_PROSPECTUS_SITE_PRODUCT"];
+const TEMPLATE_MANAGED_ENVIRONMENT_KEYS = ["PAPYRUS_COGNITO_DOMAIN_PREFIX", "PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX", "PAPYRUS_DISABLE_GOOGLE_OAUTH", "PAPYRUS_REVALIDATE_SECRET_PARAMETER", "PAPYRUS_PROSPECTUS_ACCOUNTS_ENDPOINT", "PAPYRUS_PROSPECTUS_SESSION_SECRET_PARAMETER", "PAPYRUS_PROSPECTUS_SITE_PRODUCT", "PAPYRUS_SITE_ORIGIN"];
 /** Routes Prospectus admits for a registered Papyrus site (Prospectus accounts/papyrus-sites.ts). */
 export const PROSPECTUS_PAPYRUS_SITE_ROUTES = [
     "GET/v1/identities/me",
@@ -59,6 +59,9 @@ function originOfRedirectUrl(value) {
         return value;
     }
 }
+export function resolveProspectusSessionSealingParameterName(config) {
+    return `/papyrus/${config.siteId}/prospectus-session-sealing`;
+}
 export function resolveRevalidateSecretParameterName(config) {
     return `/papyrus/${config.siteId}/revalidate-secret`;
 }
@@ -251,7 +254,7 @@ function parseCms(value) {
     }
     for (const key of TEMPLATE_MANAGED_ENVIRONMENT_KEYS) {
         if (key in cms.environment) {
-            fail(`cms.environment.${key}`, "is managed by the template: Google sign-in is always on, the Cognito domain comes from cms.cognitoDomainPrefix, the revalidation secret parameter is derived from siteId and the Prospectus endpoint comes from cms.prospectusAccountsApiStageArn");
+            fail(`cms.environment.${key}`, "is managed by the template: Google sign-in is always on, the Cognito domain comes from cms.cognitoDomainPrefix, the revalidation secret parameter is derived from siteId and the Prospectus endpoint comes from cms.prospectusAccountsApiStageArn and the public site origin comes from the site host");
         }
     }
     if (cms.staging === false && cms.stagingDomainName) {
@@ -316,9 +319,20 @@ function validateOauthRedirectUrls(config) {
         }
     }
 }
+function parseAws(value) {
+    if (value === undefined)
+        return undefined;
+    const record = requireObject(value, "aws");
+    rejectUnknownKeys(record, ["profile", "accountId", "region"], "aws");
+    return {
+        profile: optionalString(record.profile, "aws.profile", /^[A-Za-z0-9_.-]+$/, "AWS CLI profile name"),
+        accountId: optionalString(record.accountId, "aws.accountId", /^\d{12}$/, "12-digit account id"),
+        region: optionalString(record.region, "aws.region", /^[a-z]{2}(-[a-z]+)+-\d$/, "AWS region such as us-east-1"),
+    };
+}
 export function parseSiteConfig(raw) {
     const record = requireObject(raw, "site");
-    rejectUnknownKeys(record, ["siteId", "repository", "repositoryAccessTokenSecretArn", "brand", "frontend", "hostedZoneId", "stackName", "cms", "reader", "papyrusVersion", "storagePreviewPrefix", "autoDeploy", "github"], "site");
+    rejectUnknownKeys(record, ["siteId", "repository", "repositoryAccessTokenSecretArn", "brand", "frontend", "hostedZoneId", "stackName", "aws", "cms", "reader", "papyrusVersion", "storagePreviewPrefix", "autoDeploy", "github"], "site");
     const siteId = requireString(record.siteId, "siteId", SITE_ID_PATTERN, "kebab-case");
     const repository = requireString(record.repository, "repository", REPOSITORY_PATTERN, "https://github.com/<org>/<repo>");
     const repositoryAccessTokenSecretArn = record.repositoryAccessTokenSecretArn === undefined
@@ -331,6 +345,7 @@ export function parseSiteConfig(raw) {
     }
     const hostedZoneId = optionalString(record.hostedZoneId, "hostedZoneId", HOSTED_ZONE_ID_PATTERN, "Route 53 zone id");
     const stackName = optionalString(record.stackName, "stackName", STACK_NAME_PATTERN, "CloudFormation stack name");
+    const aws = parseAws(record.aws);
     const papyrusVersion = requireString(record.papyrusVersion, "papyrusVersion", PAPYRUS_VERSION_PATTERN, "exact version such as 1.0.0 or 1.0.0-next.1");
     const storagePreviewPrefix = optionalString(record.storagePreviewPrefix, "storagePreviewPrefix", /^[A-Za-z0-9._-]+\/$/, "must end with /");
     const cms = record.cms === undefined && frontend === "markus-static" ? undefined : parseCms(record.cms);
@@ -425,6 +440,7 @@ export function parseSiteConfig(raw) {
         frontend,
         hostedZoneId,
         stackName,
+        aws,
         cms,
         reader,
         papyrusVersion,

package/infra/site-config.ts

@@ -53,6 +53,7 @@ export type AmplifyAppShellSiteConfig = {
   frontend: "pretext" | "markus-static";
   hostedZoneId?: string;
   stackName?: string;
+  aws?: SiteAwsConfig;
   cms?: CmsConfig;
   reader?: {
     appName?: string;
@@ -91,6 +92,17 @@ export type AmplifyAppShellSiteConfig = {
   };
 };
 
+/**
+ * Where the site's AWS resources live, for operator tooling (`papyrus site google-secrets`). Not read by the
+ * stack: the deploy account comes from the CDK environment. `accountId` is what the CLI asserts with STS
+ * before it writes anything.
+ */
+export type SiteAwsConfig = {
+  profile?: string;
+  accountId?: string;
+  region?: string;
+};
+
 export type CmsSiteConfig = AmplifyAppShellSiteConfig & { cms: CmsConfig };
 
 export function hasCmsApp(config: AmplifyAppShellSiteConfig): config is CmsSiteConfig {
@@ -131,7 +143,7 @@ const GITHUB_REPO_PATTERN = /^[A-Za-z0-9_.-]+$/;
 const COGNITO_DOMAIN_PREFIX_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
 const COGNITO_RESERVED_WORDS = ["aws", "amazon", "cognito"];
 const PROSPECTUS_ACCOUNTS_API_STAGE_ARN_PATTERN = /^arn:aws:execute-api:[a-z0-9-]+:\d{12}:[a-z0-9]+\/api$/;
-const TEMPLATE_MANAGED_ENVIRONMENT_KEYS = ["PAPYRUS_COGNITO_DOMAIN_PREFIX", "PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX", "PAPYRUS_DISABLE_GOOGLE_OAUTH", "PAPYRUS_REVALIDATE_SECRET_PARAMETER", "PAPYRUS_PROSPECTUS_ACCOUNTS_ENDPOINT", "PAPYRUS_PROSPECTUS_SESSION_SECRET_ARN", "PAPYRUS_PROSPECTUS_SITE_PRODUCT"];
+const TEMPLATE_MANAGED_ENVIRONMENT_KEYS = ["PAPYRUS_COGNITO_DOMAIN_PREFIX", "PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX", "PAPYRUS_DISABLE_GOOGLE_OAUTH", "PAPYRUS_REVALIDATE_SECRET_PARAMETER", "PAPYRUS_PROSPECTUS_ACCOUNTS_ENDPOINT", "PAPYRUS_PROSPECTUS_SESSION_SECRET_PARAMETER", "PAPYRUS_PROSPECTUS_SITE_PRODUCT", "PAPYRUS_SITE_ORIGIN"];
 
 /** Routes Prospectus admits for a registered Papyrus site (Prospectus accounts/papyrus-sites.ts). */
 export const PROSPECTUS_PAPYRUS_SITE_ROUTES = [
@@ -158,6 +170,10 @@ function originOfRedirectUrl(value: string): string {
   }
 }
 
+export function resolveProspectusSessionSealingParameterName(config: Pick<AmplifyAppShellSiteConfig, "siteId">): string {
+  return `/papyrus/${config.siteId}/prospectus-session-sealing`;
+}
+
 export function resolveRevalidateSecretParameterName(config: Pick<AmplifyAppShellSiteConfig, "siteId">): string {
   return `/papyrus/${config.siteId}/revalidate-secret`;
 }
@@ -360,7 +376,7 @@ function parseCms(value: unknown): CmsConfig {
   }
   for (const key of TEMPLATE_MANAGED_ENVIRONMENT_KEYS) {
     if (key in cms.environment) {
-      fail(`cms.environment.${key}`, "is managed by the template: Google sign-in is always on, the Cognito domain comes from cms.cognitoDomainPrefix, the revalidation secret parameter is derived from siteId and the Prospectus endpoint comes from cms.prospectusAccountsApiStageArn");
+      fail(`cms.environment.${key}`, "is managed by the template: Google sign-in is always on, the Cognito domain comes from cms.cognitoDomainPrefix, the revalidation secret parameter is derived from siteId and the Prospectus endpoint comes from cms.prospectusAccountsApiStageArn and the public site origin comes from the site host");
     }
   }
 
@@ -426,11 +442,22 @@ function validateOauthRedirectUrls(config: CmsSiteConfig): void {
   }
 }
 
+function parseAws(value: unknown): SiteAwsConfig | undefined {
+  if (value === undefined) return undefined;
+  const record = requireObject(value, "aws");
+  rejectUnknownKeys(record, ["profile", "accountId", "region"], "aws");
+  return {
+    profile: optionalString(record.profile, "aws.profile", /^[A-Za-z0-9_.-]+$/, "AWS CLI profile name"),
+    accountId: optionalString(record.accountId, "aws.accountId", /^\d{12}$/, "12-digit account id"),
+    region: optionalString(record.region, "aws.region", /^[a-z]{2}(-[a-z]+)+-\d$/, "AWS region such as us-east-1"),
+  };
+}
+
 export function parseSiteConfig(raw: unknown): AmplifyAppShellSiteConfig {
   const record = requireObject(raw, "site");
   rejectUnknownKeys(
     record,
-    ["siteId", "repository", "repositoryAccessTokenSecretArn", "brand", "frontend", "hostedZoneId", "stackName", "cms", "reader", "papyrusVersion", "storagePreviewPrefix", "autoDeploy", "github"],
+    ["siteId", "repository", "repositoryAccessTokenSecretArn", "brand", "frontend", "hostedZoneId", "stackName", "aws", "cms", "reader", "papyrusVersion", "storagePreviewPrefix", "autoDeploy", "github"],
     "site",
   );
 
@@ -446,6 +473,7 @@ export function parseSiteConfig(raw: unknown): AmplifyAppShellSiteConfig {
   }
   const hostedZoneId = optionalString(record.hostedZoneId, "hostedZoneId", HOSTED_ZONE_ID_PATTERN, "Route 53 zone id");
   const stackName = optionalString(record.stackName, "stackName", STACK_NAME_PATTERN, "CloudFormation stack name");
+  const aws = parseAws(record.aws);
   const papyrusVersion = requireString(record.papyrusVersion, "papyrusVersion", PAPYRUS_VERSION_PATTERN, "exact version such as 1.0.0 or 1.0.0-next.1");
   const storagePreviewPrefix = optionalString(record.storagePreviewPrefix, "storagePreviewPrefix", /^[A-Za-z0-9._-]+\/$/, "must end with /");
 
@@ -537,6 +565,7 @@ export function parseSiteConfig(raw: unknown): AmplifyAppShellSiteConfig {
     frontend,
     hostedZoneId,
     stackName,
+    aws,
     cms,
     reader,
     papyrusVersion,

package/lib/curation-routes.ts

@@ -8,6 +8,7 @@ import {
   type ProspectusSignInRouteOptions,
 } from "./prospectus-sign-in-routes";
 import { resolveProspectusSignInRuntime } from "./prospectus-session";
+import { SiteOriginNotConfiguredError, publicSiteOrigin } from "./site-origin";
 
 /**
  * Same-origin curation routes for the References tab. Each is an authenticated
@@ -270,7 +271,8 @@ export async function handleCurationRoute(request: NextRequest, route: CurationR
     if (!base) return jsonResponse({ error: "curation_not_configured", message: "Curation is not configured for this site." }, 503);
 
     const origin = request.headers.get("origin");
-    if (route !== "context" ? origin !== request.nextUrl.origin : origin !== null && origin !== request.nextUrl.origin) {
+    const siteOrigin = publicSiteOrigin(request, options.environment);
+    if (route !== "context" ? origin !== siteOrigin : origin !== null && origin !== siteOrigin) {
       throw refusal(403, "cross_origin", "Curation requests must come from this site.");
     }
     let text: string | null = null;
@@ -279,7 +281,7 @@ export async function handleCurationRoute(request: NextRequest, route: CurationR
       text = await boundedText(request);
     }
 
-    const runtime = await (options.resolveRuntime ?? resolveProspectusSignInRuntime)(request.nextUrl.origin);
+    const runtime = await (options.resolveRuntime ?? resolveProspectusSignInRuntime)(siteOrigin);
     if (!runtime) return jsonResponse({ error: "prospectus_sign_in_unavailable", message: "Sign-in through Prospectus is not configured for this site." }, 503);
     const nowInSeconds = options.nowInSeconds?.();
     const cookieSession = signedInProspectusSession(request, runtime.sealingSecret, nowInSeconds);
@@ -336,6 +338,7 @@ export async function handleCurationRoute(request: NextRequest, route: CurationR
     });
   } catch (error) {
     if (error instanceof CurationRefusal) return jsonResponse({ error: error.message, code: error.code }, error.status);
+    if (error instanceof SiteOriginNotConfiguredError) return jsonResponse({ error: error.message, code: error.code }, error.status);
     console.error(`Curation route failed (${error instanceof Error ? error.name : "error"}).`);
     return jsonResponse({ error: "Curation is unavailable. Check saved history before retrying.", code: "curation_unavailable" }, 503);
   }

package/lib/prospectus-session.ts

@@ -1,5 +1,5 @@
 import { createCipheriv, createDecipheriv, hkdfSync, randomBytes } from "node:crypto";
-import { GetSecretValueCommand, SecretsManagerClient } from "@aws-sdk/client-secrets-manager";
+import { GetParameterCommand, SSMClient } from "@aws-sdk/client-ssm";
 import { readAmplifyOutputsFile } from "./amplify-outputs-path";
 import {
   ProspectusSiteAccounts,
@@ -21,7 +21,7 @@ import {
 export const PROSPECTUS_PENDING_SIGN_IN_COOKIE = "__Host-papyrus-prospectus-pending";
 export const PROSPECTUS_SESSION_COOKIE = "__Host-papyrus-prospectus-session";
 export const PROSPECTUS_ACCOUNTS_ENDPOINT_ENV = "PAPYRUS_PROSPECTUS_ACCOUNTS_ENDPOINT";
-export const PROSPECTUS_SESSION_SECRET_ARN_ENV = "PAPYRUS_PROSPECTUS_SESSION_SECRET_ARN";
+export const PROSPECTUS_SESSION_SECRET_PARAMETER_ENV = "PAPYRUS_PROSPECTUS_SESSION_SECRET_PARAMETER";
 export const PROSPECTUS_SESSION_SECRET_CACHE_MILLISECONDS = 5 * 60 * 1000;
 
 const SEALED_COOKIE_FORMAT_VERSION = "v1";
@@ -101,37 +101,37 @@ export function sameSiteReturnPath(requestedReturnPath: string | null | undefine
   return `${parsed.pathname}${parsed.search}${parsed.hash}`;
 }
 
-export type ProspectusSessionSecretReader = (secretArn: string) => Promise<string | null>;
+export type ProspectusSessionSecretReader = (parameterName: string) => Promise<string | null>;
 
-type CachedSealingSecret = { secretArn: string; value: string; expiresAt: number };
+type CachedSealingSecret = { parameterName: string; value: string; expiresAt: number };
 
 let cachedSealingSecret: CachedSealingSecret | null = null;
-let defaultSecretsManagerClient: SecretsManagerClient | null = null;
+let defaultSsmClient: SSMClient | null = null;
 
 export function resetProspectusSessionSecretCache(): void {
   cachedSealingSecret = null;
 }
 
-async function readSealingSecretFromSecretsManager(secretArn: string): Promise<string | null> {
-  defaultSecretsManagerClient ??= new SecretsManagerClient({});
-  const response = await defaultSecretsManagerClient.send(new GetSecretValueCommand({ SecretId: secretArn }));
-  return response.SecretString?.trim() || null;
+export async function readSealingSecretFromSsm(parameterName: string, client?: Pick<SSMClient, "send">): Promise<string | null> {
+  defaultSsmClient ??= new SSMClient({});
+  const response = await (client ?? defaultSsmClient).send(new GetParameterCommand({ Name: parameterName, WithDecryption: true }));
+  return response.Parameter?.Value?.trim() || null;
 }
 
 export async function loadProspectusSessionSealingSecret(
   options: { environment?: Record<string, string | undefined>; readSecret?: ProspectusSessionSecretReader; now?: number } = {},
 ): Promise<string | null> {
   const environment = options.environment ?? process.env;
-  const secretArn = environment[PROSPECTUS_SESSION_SECRET_ARN_ENV]?.trim();
-  if (!secretArn) return null;
+  const parameterName = environment[PROSPECTUS_SESSION_SECRET_PARAMETER_ENV]?.trim();
+  if (!parameterName) return null;
   const now = options.now ?? Date.now();
-  if (cachedSealingSecret && cachedSealingSecret.secretArn === secretArn && cachedSealingSecret.expiresAt > now) {
+  if (cachedSealingSecret && cachedSealingSecret.parameterName === parameterName && cachedSealingSecret.expiresAt > now) {
     return cachedSealingSecret.value;
   }
   try {
-    const value = (await (options.readSecret ?? readSealingSecretFromSecretsManager)(secretArn))?.trim();
+    const value = (await (options.readSecret ?? readSealingSecretFromSsm)(parameterName))?.trim();
     if (!value || value.length < MINIMUM_SEALING_SECRET_LENGTH) return null;
-    cachedSealingSecret = { secretArn, value, expiresAt: now + PROSPECTUS_SESSION_SECRET_CACHE_MILLISECONDS };
+    cachedSealingSecret = { parameterName, value, expiresAt: now + PROSPECTUS_SESSION_SECRET_CACHE_MILLISECONDS };
     return value;
   } catch (error) {
     console.error(`Prospectus session sealing secret could not be read (${error instanceof Error ? error.name : "error"}).`);

package/lib/prospectus-sign-in-routes.ts

@@ -25,6 +25,7 @@ import {
   publishingAccountsForSite,
   type PublicationCapability,
 } from "./prospectus-publication-access";
+import { SiteOriginNotConfiguredError, publicSiteOrigin, siteOriginNotConfiguredResponse } from "./site-origin";
 
 /**
  * The site's sign-in routes for Prospectus accounts: start (challenge, then the
@@ -38,6 +39,8 @@ export interface ProspectusSignInRouteOptions {
   siteProduct?: string | null;
   completionOverrides?: Pick<CompleteProspectusGoogleSignInInput, "verifyCognitoTokens" | "fetcher">;
   nowInSeconds?: () => number;
+  /** Trusted configuration the public site origin is read from; defaults to process.env. */
+  environment?: Record<string, string | undefined>;
 }
 
 const NO_STORE_HEADERS = { "cache-control": "no-store" };
@@ -50,8 +53,22 @@ function currentTimeInSeconds(options: ProspectusSignInRouteOptions): number {
   return options.nowInSeconds?.() ?? Math.floor(Date.now() / 1000);
 }
 
+function siteOriginFor(request: NextRequest, options: ProspectusSignInRouteOptions): string {
+  return publicSiteOrigin(request, options.environment);
+}
+
 async function signInRuntimeFor(request: NextRequest, options: ProspectusSignInRouteOptions): Promise<ProspectusSignInRuntime | null> {
-  return (options.resolveRuntime ?? resolveProspectusSignInRuntime)(request.nextUrl.origin);
+  return (options.resolveRuntime ?? resolveProspectusSignInRuntime)(siteOriginFor(request, options));
+}
+
+/** Runs a route and answers a missing site origin with 503 site_origin_not_configured, never a localhost redirect. */
+async function failingClosedWithoutSiteOrigin(route: () => Promise<NextResponse>): Promise<NextResponse> {
+  try {
+    return await route();
+  } catch (error) {
+    if (error instanceof SiteOriginNotConfiguredError) return siteOriginNotConfiguredResponse(error);
+    throw error;
+  }
 }
 
 function signInUnavailableResponse(): NextResponse {
@@ -82,7 +99,11 @@ export function signedInProspectusSession(
   );
 }
 
-export async function handleProspectusSignInStart(request: NextRequest, options: ProspectusSignInRouteOptions = {}): Promise<NextResponse> {
+export function handleProspectusSignInStart(request: NextRequest, options: ProspectusSignInRouteOptions = {}): Promise<NextResponse> {
+  return failingClosedWithoutSiteOrigin(() => handleProspectusSignInStartRoute(request, options));
+}
+
+async function handleProspectusSignInStartRoute(request: NextRequest, options: ProspectusSignInRouteOptions): Promise<NextResponse> {
   const runtime = await signInRuntimeFor(request, options);
   if (!runtime) return signInUnavailableResponse();
   const { authorizationUrl, pendingSignIn } = await beginProspectusGoogleSignIn(runtime.accounts, runtime.cognitoClient);
@@ -99,7 +120,11 @@ export async function handleProspectusSignInStart(request: NextRequest, options:
   return response;
 }
 
-export async function handleProspectusSignInCallback(request: NextRequest, options: ProspectusSignInRouteOptions = {}): Promise<NextResponse> {
+export function handleProspectusSignInCallback(request: NextRequest, options: ProspectusSignInRouteOptions = {}): Promise<NextResponse> {
+  return failingClosedWithoutSiteOrigin(() => handleProspectusSignInCallbackRoute(request, options));
+}
+
+async function handleProspectusSignInCallbackRoute(request: NextRequest, options: ProspectusSignInRouteOptions): Promise<NextResponse> {
   const runtime = await signInRuntimeFor(request, options);
   if (!runtime) return signInUnavailableResponse();
   const nowInSeconds = currentTimeInSeconds(options);
@@ -142,7 +167,7 @@ async function completeCallback(
       accessToken: signedIn.accessToken,
       accessTokenExpiresAt: signedIn.accessTokenExpiresAt,
     };
-    const response = NextResponse.redirect(new URL(pendingSignIn.returnPath, request.nextUrl.origin), { status: 303, headers: NO_STORE_HEADERS });
+    const response = NextResponse.redirect(new URL(pendingSignIn.returnPath, siteOriginFor(request, options)), { status: 303, headers: NO_STORE_HEADERS });
     response.cookies.set(
       PROSPECTUS_SESSION_COOKIE,
       sealProspectusCookie(runtime.sealingSecret, PROSPECTUS_SESSION_COOKIE, session, session.accessTokenExpiresAt),
@@ -156,7 +181,11 @@ async function completeCallback(
   }
 }
 
-export async function handleProspectusSessionRead(request: NextRequest, options: ProspectusSignInRouteOptions = {}): Promise<NextResponse> {
+export function handleProspectusSessionRead(request: NextRequest, options: ProspectusSignInRouteOptions = {}): Promise<NextResponse> {
+  return failingClosedWithoutSiteOrigin(() => handleProspectusSessionReadRoute(request, options));
+}
+
+async function handleProspectusSessionReadRoute(request: NextRequest, options: ProspectusSignInRouteOptions): Promise<NextResponse> {
   const runtime = await signInRuntimeFor(request, options);
   if (!runtime) return signInUnavailableResponse();
   const session = signedInProspectusSession(request, runtime.sealingSecret, currentTimeInSeconds(options));
@@ -196,9 +225,13 @@ export async function handleProspectusSessionRead(request: NextRequest, options:
   }
 }
 
-export async function handleProspectusSignOut(request: NextRequest, options: ProspectusSignInRouteOptions = {}): Promise<NextResponse> {
+export function handleProspectusSignOut(request: NextRequest, options: ProspectusSignInRouteOptions = {}): Promise<NextResponse> {
+  return failingClosedWithoutSiteOrigin(() => handleProspectusSignOutRoute(request, options));
+}
+
+async function handleProspectusSignOutRoute(request: NextRequest, options: ProspectusSignInRouteOptions): Promise<NextResponse> {
   const runtime = await signInRuntimeFor(request, options);
-  const signedOutDestination = new URL("/", request.nextUrl.origin);
+  const signedOutDestination = new URL("/", siteOriginFor(request, options));
   const destination = runtime
     ? new URL(
       `/logout?${new URLSearchParams({ client_id: runtime.cognitoClient.clientId, logout_uri: signedOutDestination.toString() })}`,
@@ -250,10 +283,14 @@ export async function currentProspectusPublishingSelection(
   }
 }
 
-export async function handleProspectusAccountSelection(request: NextRequest, options: ProspectusSignInRouteOptions = {}): Promise<NextResponse> {
+export function handleProspectusAccountSelection(request: NextRequest, options: ProspectusSignInRouteOptions = {}): Promise<NextResponse> {
+  return failingClosedWithoutSiteOrigin(() => handleProspectusAccountSelectionRoute(request, options));
+}
+
+async function handleProspectusAccountSelectionRoute(request: NextRequest, options: ProspectusSignInRouteOptions): Promise<NextResponse> {
   const runtime = await signInRuntimeFor(request, options);
   if (!runtime) return signInUnavailableResponse();
-  if (request.headers.get("origin") !== request.nextUrl.origin) {
+  if (request.headers.get("origin") !== siteOriginFor(request, options)) {
     return signInFailedResponse(403, "cross_origin_selection", "Choose an account from this site.");
   }
   const nowInSeconds = currentTimeInSeconds(options);
@@ -287,10 +324,14 @@ const MAXIMUM_PUBLISHING_ACCOUNT_NAME_LENGTH = 150;
 const DEFAULT_PUBLISHING_ACCOUNT_NAME = "Publishing account";
 const IDEMPOTENCY_KEY_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 
-export async function handleProspectusPublishingAccountCreation(request: NextRequest, options: ProspectusSignInRouteOptions = {}): Promise<NextResponse> {
+export function handleProspectusPublishingAccountCreation(request: NextRequest, options: ProspectusSignInRouteOptions = {}): Promise<NextResponse> {
+  return failingClosedWithoutSiteOrigin(() => handleProspectusPublishingAccountCreationRoute(request, options));
+}
+
+async function handleProspectusPublishingAccountCreationRoute(request: NextRequest, options: ProspectusSignInRouteOptions): Promise<NextResponse> {
   const runtime = await signInRuntimeFor(request, options);
   if (!runtime) return signInUnavailableResponse();
-  if (request.headers.get("origin") !== request.nextUrl.origin) {
+  if (request.headers.get("origin") !== siteOriginFor(request, options)) {
     return signInFailedResponse(403, "cross_origin_creation", "Create an account from this site.");
   }
   const nowInSeconds = currentTimeInSeconds(options);

package/lib/site-origin.ts

@@ -0,0 +1,67 @@
+import { NextResponse, type NextRequest } from "next/server";
+import { getSiteEnv } from "./site-env";
+
+type EnvironmentVariables = Record<string, string | undefined>;
+
+export const SITE_ORIGIN_ENV = "PAPYRUS_SITE_ORIGIN";
+
+/**
+ * The site's public origin cannot be read from the request on Amplify SSR (WEB_COMPUTE):
+ * there `request.nextUrl.origin` is the compute adapter's internal https://localhost:3000.
+ * It also must never be derived from Host or X-Forwarded-* headers, which a client can set.
+ * The one trusted source is PAPYRUS_SITE_ORIGIN, set by the app shell from the site's host.
+ */
+export class SiteOriginNotConfiguredError extends Error {
+  readonly status = 503;
+  readonly code = "site_origin_not_configured";
+}
+
+export function siteOriginNotConfiguredResponse(error: SiteOriginNotConfiguredError): NextResponse {
+  return NextResponse.json({ error: error.code, message: error.message }, { status: error.status, headers: { "cache-control": "no-store" } });
+}
+
+function isLoopbackHostname(hostname: string): boolean {
+  return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]";
+}
+
+function configuredOrigin(value: string): string {
+  const invalid = () => new SiteOriginNotConfiguredError(`${SITE_ORIGIN_ENV} must be an https origin such as https://example.com with no path.`);
+  let parsed: URL;
+  try {
+    parsed = new URL(value);
+  } catch {
+    throw invalid();
+  }
+  if (parsed.protocol !== "https:" || parsed.origin !== value) throw invalid();
+  return parsed.origin;
+}
+
+function siteEnvOrNull(environment: EnvironmentVariables): string | null {
+  try {
+    return getSiteEnv(environment);
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * The site's public origin, from trusted configuration.
+ * - PAPYRUS_SITE_ORIGIN set: it must be an https origin with no path; it is used as is.
+ * - Unset: `request.nextUrl.origin` only when it is loopback, SITE_ENV resolves to development
+ *   and NODE_ENV is not production (a local `next dev` server). Anything else, production and staging included, throws
+ *   SiteOriginNotConfiguredError so routes answer 503 instead of redirecting to localhost.
+ */
+export function publicSiteOrigin(request: Pick<NextRequest, "nextUrl">, environment: EnvironmentVariables = process.env): string {
+  const configured = (environment[SITE_ORIGIN_ENV] ?? "").trim();
+  if (configured) return configuredOrigin(configured);
+  const { hostname, origin } = request.nextUrl;
+  // SITE_ENV defaults to development when a runtime never received it, so NODE_ENV=production also closes the fallback.
+  const developing = siteEnvOrNull(environment) === "development" && environment.NODE_ENV !== "production";
+  if (isLoopbackHostname(hostname) && developing) return origin;
+  throw new SiteOriginNotConfiguredError(`${SITE_ORIGIN_ENV} is not set; this site cannot tell its public origin.`);
+}
+
+/** An absolute URL on the site's public origin, for redirects. Fails closed like publicSiteOrigin. */
+export function publicSiteUrl(path: string, request: Pick<NextRequest, "nextUrl">, environment: EnvironmentVariables = process.env): URL {
+  return new URL(path, publicSiteOrigin(request, environment));
+}

package/middleware.ts

@@ -5,6 +5,7 @@ import { newsroomHref } from "./lib/newsroom-base-path";
 import { getReaderBasePath } from "./lib/reader-base-path";
 import { isStagingGatedPath, isStaticOrApiPath } from "./lib/staging-gated-path";
 import { getSiteEnv, isIndexable } from "./lib/site-env";
+import { SiteOriginNotConfiguredError, publicSiteUrl, siteOriginNotConfiguredResponse } from "./lib/site-origin";
 import { getStagingAccess } from "./lib/staging-gate";
 import {
   isPreviewGatedPath,
@@ -38,11 +39,11 @@ function routeRequest(request: NextRequest): NextResponse {
   }
 
   if (pathname === "/newsroom" || pathname === "/newsroom/") {
-    return NextResponse.redirect(new URL(`/${request.nextUrl.search}`, request.url));
+    return NextResponse.redirect(publicSiteUrl(`/${request.nextUrl.search}`, request));
   }
   if (pathname.startsWith("/newsroom/")) {
     const target = pathname.slice("/newsroom".length) || "/";
-    return NextResponse.redirect(new URL(`${target}${request.nextUrl.search}`, request.url));
+    return NextResponse.redirect(publicSiteUrl(`${target}${request.nextUrl.search}`, request));
   }
 
   if (pathname === "/" || pathname === "") {
@@ -59,6 +60,16 @@ function routeRequest(request: NextRequest): NextResponse {
 }
 
 export async function middleware(request: NextRequest): Promise<NextResponse> {
+  try {
+    return await handleRequest(request);
+  } catch (error) {
+    // Redirects name the site's public origin (request.url is localhost on Amplify); without it, fail closed.
+    if (error instanceof SiteOriginNotConfiguredError) return withRobotsHeader(siteOriginNotConfiguredResponse(error));
+    throw error;
+  }
+}
+
+async function handleRequest(request: NextRequest): Promise<NextResponse> {
   let sessionResponse: NextResponse | null = null;
   const { pathname } = request.nextUrl;
   const gated = isStaticPreviewEnabled()
@@ -68,7 +79,7 @@ export async function middleware(request: NextRequest): Promise<NextResponse> {
     sessionResponse = NextResponse.next();
     const access = await getStagingAccess(request, sessionResponse);
     if (access === "anonymous") {
-      return withRobotsHeader(NextResponse.redirect(new URL(newsroomHref(), request.url)));
+      return withRobotsHeader(NextResponse.redirect(publicSiteUrl(newsroomHref(), request)));
     }
     if (access === "forbidden") {
       return withRobotsHeader(new NextResponse("Staging is limited to editors and admins.", { status: 403 }));

package/package.json

@@ -296,6 +296,7 @@
     "./lib/site-brand-tenant": "./lib/site-brand-tenant.ts",
     "./lib/site-brand": "./lib/site-brand.ts",
     "./lib/site-env": "./lib/site-env.ts",
+    "./lib/site-origin": "./lib/site-origin.ts",
     "./lib/site-renderer": "./lib/site-renderer.ts",
     "./lib/site-section-suggestions": "./lib/site-section-suggestions.ts",
     "./lib/site-stack": "./lib/site-stack.ts",
@@ -406,7 +407,7 @@
       "optional": true
     }
   },
-  "version": "5.14.0",
+  "version": "5.15.1",
   "dependencies": {
     "@aws-amplify/adapter-nextjs": "^1.7.3",
     "@aws-crypto/sha256-js": "5.2.0",
@@ -414,7 +415,6 @@
     "@aws-sdk/client-dynamodb": "^3.1045.0",
     "@aws-sdk/client-lambda": "^3.1045.0",
     "@aws-sdk/client-s3": "^3.1045.0",
-    "@aws-sdk/client-secrets-manager": "3.1045.0",
     "@aws-sdk/client-ssm": "^3.1045.0",
     "@aws-sdk/credential-provider-node": "3.972.84",
     "@aws-sdk/s3-request-presigner": "^3.1045.0",

package/routes.manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "5.14.0",
+  "version": "5.15.1",
   "routes": [
     {
       "file": "app/%5F_preview/[[...path]]/route.ts",