@anthusai/papyrus 5.34.0 → 5.35.0

package/amplify/auth/resource.js

@@ -1,6 +1,6 @@
 import { defineAuth, secret } from "@aws-amplify/backend";
 import { manageUserRole } from "../functions/manage-user-role/resource.js";
-import { CfnUserPoolDomain } from "aws-cdk-lib/aws-cognito";
+import { CfnUserPoolDomain, CfnUserPoolIdentityProvider } from "aws-cdk-lib/aws-cognito";
 import { expandNewsroomRedirectUrls } from "./redirect-urls.js";
 // Default OAuth redirect URLs for the p.apyr.us app. Other publications pass
 // `auth.redirectUrls` to `defineSiteBackend` (or, for Papyrus's own backend,
@@ -35,6 +35,21 @@ export function authConfigFromEnv() {
 export function siteAuthRedirectUrls(config) {
     return config.redirectUrls ?? DEFAULT_AUTH_REDIRECT_URLS;
 }
+/** Keep Cognito's federated email verification state in sync with Google's verified claim. */
+export function applyGoogleEmailVerifiedMapping(authStack) {
+    const googleProviders = authStack.node
+        .findAll()
+        .filter((construct) => construct instanceof CfnUserPoolIdentityProvider && construct.providerName === "Google");
+    if (googleProviders.length !== 1) {
+        throw new Error(`Expected exactly one Google identity provider to map email_verified, found ${googleProviders.length}`);
+    }
+    const [provider] = googleProviders;
+    const mapping = provider.attributeMapping;
+    if (mapping !== undefined && (typeof mapping !== "object" || Array.isArray(mapping))) {
+        throw new Error("Expected Google identity provider attribute mappings to be a plain object");
+    }
+    provider.attributeMapping = { ...(mapping ?? {}), email_verified: "email_verified" };
+}
 export function defineSiteAuth(config) {
     const authRedirectUrls = expandNewsroomRedirectUrls(siteAuthRedirectUrls(config), config.newsroomBasePath);
     const disableGoogleOAuth = config.disableGoogleOAuth === true;

package/amplify/auth/resource.ts

@@ -1,7 +1,7 @@
 import { defineAuth, secret } from "@aws-amplify/backend";
 import { manageUserRole } from "../functions/manage-user-role/resource";
 import { Stack } from "aws-cdk-lib";
-import { CfnUserPoolDomain } from "aws-cdk-lib/aws-cognito";
+import { CfnUserPoolDomain, CfnUserPoolIdentityProvider } from "aws-cdk-lib/aws-cognito";
 import type { PapyrusAuthConfig } from "../site-backend-config";
 import { expandNewsroomRedirectUrls } from "./redirect-urls";
 
@@ -41,6 +41,24 @@ export function siteAuthRedirectUrls(config: PapyrusAuthConfig): string[] {
   return config.redirectUrls ?? DEFAULT_AUTH_REDIRECT_URLS;
 }
 
+/** Keep Cognito's federated email verification state in sync with Google's verified claim. */
+export function applyGoogleEmailVerifiedMapping(authStack: Stack): void {
+  const googleProviders = authStack.node
+    .findAll()
+    .filter((construct): construct is CfnUserPoolIdentityProvider =>
+      construct instanceof CfnUserPoolIdentityProvider && construct.providerName === "Google");
+  if (googleProviders.length !== 1) {
+    throw new Error(`Expected exactly one Google identity provider to map email_verified, found ${googleProviders.length}`);
+  }
+
+  const [provider] = googleProviders;
+  const mapping = provider.attributeMapping;
+  if (mapping !== undefined && (typeof mapping !== "object" || Array.isArray(mapping))) {
+    throw new Error("Expected Google identity provider attribute mappings to be a plain object");
+  }
+  provider.attributeMapping = { ...(mapping ?? {}), email_verified: "email_verified" };
+}
+
 export function defineSiteAuth(config: PapyrusAuthConfig) {
   const authRedirectUrls = expandNewsroomRedirectUrls(
     siteAuthRedirectUrls(config),

package/amplify/site-backend.js

@@ -18,7 +18,7 @@ import { assertValidPublicationConfig } from "./site-backend-config.js";
 import { revalidateSecretReadStatement } from "./revalidate-secret-policy.js";
 import { revalidateDistributionEnvironment, revalidateInvalidationStatement, validateRevalidateDistributionIds, } from "./revalidate-invalidation-settings.js";
 import { addInvalidationPathAlarm } from "./publication/invalidation-alarm.js";
-import { applyCognitoDomainPrefix, authConfigFromEnv, defineSiteAuth, siteAuthRedirectUrls } from "./auth/resource.js";
+import { applyCognitoDomainPrefix, applyGoogleEmailVerifiedMapping, authConfigFromEnv, defineSiteAuth, siteAuthRedirectUrls } from "./auth/resource.js";
 import { PROSPECTUS_SIGN_IN_CALLBACK_PATH, addProspectusGoogleOnlyClient } from "./auth/prospectus-google-client.js";
 import { defineSiteData } from "./data/resource.js";
 import { editorialChecks } from "./functions/editorial-checks/resource.js";
@@ -116,6 +116,9 @@ export function defineSiteBackend(papyrusSite) {
         slackDelivery,
         storage,
     });
+    if (authConfig.disableGoogleOAuth !== true) {
+        applyGoogleEmailVerifiedMapping(backend.auth.stack);
+    }
     orderModelStacksInWaves(backend.data.resources.graphqlApi.node.scope, Object.keys(backend.data.resources.tables), site.resolverWaveSize ?? DEFAULT_RESOLVER_WAVE_SIZE);
     const requestedCognitoDomainPrefix = (authConfig.cognitoDomainPrefix ?? "").trim();
     if (authConfig.applyCognitoDomainPrefix === true

package/amplify/site-backend.ts

@@ -25,7 +25,7 @@ import {
   validateRevalidateDistributionIds,
 } from "./revalidate-invalidation-settings";
 import { addInvalidationPathAlarm } from "./publication/invalidation-alarm";
-import { applyCognitoDomainPrefix, authConfigFromEnv, defineSiteAuth, siteAuthRedirectUrls } from "./auth/resource";
+import { applyCognitoDomainPrefix, applyGoogleEmailVerifiedMapping, authConfigFromEnv, defineSiteAuth, siteAuthRedirectUrls } from "./auth/resource";
 import { PROSPECTUS_SIGN_IN_CALLBACK_PATH, addProspectusGoogleOnlyClient } from "./auth/prospectus-google-client";
 import { defineSiteData } from "./data/resource";
 import { editorialChecks } from "./functions/editorial-checks/resource";
@@ -138,6 +138,10 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
     storage,
   });
 
+  if (authConfig.disableGoogleOAuth !== true) {
+    applyGoogleEmailVerifiedMapping(backend.auth.stack);
+  }
+
   orderModelStacksInWaves(
     backend.data.resources.graphqlApi.node.scope as Construct,
     Object.keys(backend.data.resources.tables),

package/package.json

@@ -448,7 +448,7 @@
       "optional": true
     }
   },
-  "version": "5.34.0",
+  "version": "5.35.0",
   "dependencies": {
     "@aws-amplify/adapter-nextjs": "^1.7.3",
     "@aws-crypto/sha256-js": "5.2.0",

package/routes.manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "5.34.0",
+  "version": "5.35.0",
   "routes": [
     {
       "file": "app/%5F_preview/[[...path]]/route.ts",