@anthusai/papyrus 5.41.0 → 5.41.1

package/amplify/functions/content-actions/handler.py

@@ -359,8 +359,8 @@ def handler(event, context):
         if field == "intakeEmailSubmissionReferences":
             client, _claims = create_authoring_client()
             try:
-                from papyrus_content.monitoring_view import default_store_factory
-                receipt_store = default_store_factory(os.environ)()
+                from papyrus_content.monitoring_view import default_email_store_factory
+                receipt_store = default_email_store_factory(os.environ)()
                 return intake_email_submission_references(
                     client, arguments, event.get("identity") or {}, receipt_store=receipt_store)
             except IntakeError as error:

package/amplify/functions/monitoring-view/wire.js

@@ -19,11 +19,12 @@ export function monitoringViewParameterArn(region, account) {
  * Environment and least-privilege IAM for the monitoring-view function. A site outside the monitoring
  * account simply finds no parameter and the page says monitoring is not configured.
  */
-export function wireMonitoringView(backend) {
+export function wireMonitoringView(backend, emailMonitorId = "hn") {
     const lambda = backend.monitoringView.resources.lambda;
     const stack = Stack.of(lambda);
     lambda.addEnvironment("PAPYRUS_GRAPHQL_ENDPOINT", backend.data.resources.cfnResources.cfnGraphqlApi.attrGraphQlUrl);
     lambda.addEnvironment("PAPYRUS_MONITORING_TABLE_PARAMETER", MONITORING_TABLE_PARAMETER);
+    lambda.addEnvironment("PAPYRUS_EMAIL_MONITOR_ID", emailMonitorId);
     lambda.addToRolePolicy(new PolicyStatement({
         effect: Effect.ALLOW,
         actions: ["ssm:GetParameter"],
@@ -41,13 +42,14 @@ export function wireMonitoringView(backend) {
         effect: Effect.ALLOW,
         actions: ["dynamodb:PutItem"],
         resources: monitoringViewTableArns(stack.region, stack.account).slice(0, 1),
-        conditions: { "ForAllValues:StringEquals": { "dynamodb:LeadingKeys": ["MONITOR#hn"] } },
+        conditions: { "ForAllValues:StringEquals": { "dynamodb:LeadingKeys": [`MONITOR#${emailMonitorId}`] } },
     }));
 }
 /** Lets the authenticated Reference-intake action verify a selected email receipt. */
-export function wireEmailReferenceIntake(lambda) {
+export function wireEmailReferenceIntake(lambda, emailMonitorId = "hn") {
     const stack = Stack.of(lambda);
     lambda.addEnvironment("PAPYRUS_MONITORING_TABLE_PARAMETER", MONITORING_TABLE_PARAMETER);
+    lambda.addEnvironment("PAPYRUS_EMAIL_MONITOR_ID", emailMonitorId);
     lambda.addToRolePolicy(new PolicyStatement({
         effect: Effect.ALLOW,
         actions: ["ssm:GetParameter"],
@@ -57,6 +59,6 @@ export function wireEmailReferenceIntake(lambda) {
         effect: Effect.ALLOW,
         actions: MONITORING_VIEW_TABLE_ACTIONS,
         resources: monitoringViewTableArns(stack.region, stack.account).slice(0, 1),
-        conditions: { "ForAllValues:StringEquals": { "dynamodb:LeadingKeys": ["MONITOR#hn"] } },
+        conditions: { "ForAllValues:StringEquals": { "dynamodb:LeadingKeys": [`MONITOR#${emailMonitorId}`] } },
     }));
 }

package/amplify/functions/monitoring-view/wire.ts

@@ -25,11 +25,12 @@ export function monitoringViewParameterArn(region: string, account: string): str
  * Environment and least-privilege IAM for the monitoring-view function. A site outside the monitoring
  * account simply finds no parameter and the page says monitoring is not configured.
  */
-export function wireMonitoringView(backend: any): void {
+export function wireMonitoringView(backend: any, emailMonitorId = "hn"): void {
   const lambda = backend.monitoringView.resources.lambda as LambdaFunction;
   const stack = Stack.of(lambda);
   lambda.addEnvironment("PAPYRUS_GRAPHQL_ENDPOINT", backend.data.resources.cfnResources.cfnGraphqlApi.attrGraphQlUrl as string);
   lambda.addEnvironment("PAPYRUS_MONITORING_TABLE_PARAMETER", MONITORING_TABLE_PARAMETER);
+  lambda.addEnvironment("PAPYRUS_EMAIL_MONITOR_ID", emailMonitorId);
   lambda.addToRolePolicy(
     new PolicyStatement({
       effect: Effect.ALLOW,
@@ -52,15 +53,16 @@ export function wireMonitoringView(backend: any): void {
       effect: Effect.ALLOW,
       actions: ["dynamodb:PutItem"],
       resources: monitoringViewTableArns(stack.region, stack.account).slice(0, 1),
-      conditions: { "ForAllValues:StringEquals": { "dynamodb:LeadingKeys": ["MONITOR#hn"] } },
+      conditions: { "ForAllValues:StringEquals": { "dynamodb:LeadingKeys": [`MONITOR#${emailMonitorId}`] } },
     }),
   );
 }
 
 /** Lets the authenticated Reference-intake action verify a selected email receipt. */
-export function wireEmailReferenceIntake(lambda: LambdaFunction): void {
+export function wireEmailReferenceIntake(lambda: LambdaFunction, emailMonitorId = "hn"): void {
   const stack = Stack.of(lambda);
   lambda.addEnvironment("PAPYRUS_MONITORING_TABLE_PARAMETER", MONITORING_TABLE_PARAMETER);
+  lambda.addEnvironment("PAPYRUS_EMAIL_MONITOR_ID", emailMonitorId);
   lambda.addToRolePolicy(
     new PolicyStatement({
       effect: Effect.ALLOW,
@@ -73,7 +75,7 @@ export function wireEmailReferenceIntake(lambda: LambdaFunction): void {
       effect: Effect.ALLOW,
       actions: MONITORING_VIEW_TABLE_ACTIONS,
       resources: monitoringViewTableArns(stack.region, stack.account).slice(0, 1),
-      conditions: { "ForAllValues:StringEquals": { "dynamodb:LeadingKeys": ["MONITOR#hn"] } },
+      conditions: { "ForAllValues:StringEquals": { "dynamodb:LeadingKeys": [`MONITOR#${emailMonitorId}`] } },
     }),
   );
 }

package/amplify/site-backend-config.js

@@ -1,4 +1,23 @@
 export const MAXIMUM_HTML_S_MAXAGE_SECONDS = 86400;
+const MONITOR_ID_PATTERN = /^[a-z0-9][a-z0-9-]{0,62}$/;
+export function validateMonitoringConfig(monitoring) {
+    if (monitoring === undefined)
+        return [];
+    if (typeof monitoring !== "object" || monitoring === null || Array.isArray(monitoring)) {
+        return ["monitoring must be an object"];
+    }
+    const config = monitoring;
+    if (config.emailMonitorId !== undefined
+        && (typeof config.emailMonitorId !== "string" || !MONITOR_ID_PATTERN.test(config.emailMonitorId))) {
+        return ["monitoring.emailMonitorId must be a lowercase monitor id (1-63 letters, digits, or hyphens)"];
+    }
+    return [];
+}
+export function assertValidMonitoringConfig(monitoring) {
+    const problems = validateMonitoringConfig(monitoring);
+    if (problems.length > 0)
+        throw new Error(`Invalid backend.monitoring: ${problems.join("; ")}`);
+}
 const CLOUDFRONT_DISTRIBUTION_ARN = /^arn:aws[a-z-]*:cloudfront::\d{12}:distribution\/[A-Z0-9]+$/;
 function isRelativePathWithoutParentSegments(value) {
     if (value === "" || value.startsWith("/") || value.includes("\\"))

package/amplify/site-backend-config.ts

@@ -40,6 +40,31 @@ export type PapyrusPublicationCacheConfig = {
 
 export const MAXIMUM_HTML_S_MAXAGE_SECONDS = 86400;
 
+export type PapyrusMonitoringConfig = {
+  /** Existing shared Monitoring partition that stores this site's private email receipts. */
+  emailMonitorId?: string;
+};
+
+const MONITOR_ID_PATTERN = /^[a-z0-9][a-z0-9-]{0,62}$/;
+
+export function validateMonitoringConfig(monitoring: unknown): string[] {
+  if (monitoring === undefined) return [];
+  if (typeof monitoring !== "object" || monitoring === null || Array.isArray(monitoring)) {
+    return ["monitoring must be an object"];
+  }
+  const config = monitoring as { emailMonitorId?: unknown };
+  if (config.emailMonitorId !== undefined
+    && (typeof config.emailMonitorId !== "string" || !MONITOR_ID_PATTERN.test(config.emailMonitorId))) {
+    return ["monitoring.emailMonitorId must be a lowercase monitor id (1-63 letters, digits, or hyphens)"];
+  }
+  return [];
+}
+
+export function assertValidMonitoringConfig(monitoring: unknown): void {
+  const problems = validateMonitoringConfig(monitoring);
+  if (problems.length > 0) throw new Error(`Invalid backend.monitoring: ${problems.join("; ")}`);
+}
+
 export type PapyrusPublicationConfig = {
   kind: "s3-projection";
   /** Site repo path (relative, `.py`) of the SiteProjector bundled into content-actions as `site_projector`. */
@@ -138,6 +163,8 @@ export type PapyrusSiteBackendConfig = {
    */
   productionAppId?: string;
   auth?: PapyrusAuthConfig;
+  /** Shared Monitoring partition used by private email intake for this publication. */
+  monitoring?: PapyrusMonitoringConfig;
   /**
    * Maximum number of data model nested stacks CloudFormation creates at once.
    * Stacks are chained in waves of this size so a new AWS account is not hit

package/amplify/site-backend.js

@@ -14,7 +14,7 @@ import { planRenditions } from "./publication/renditions-settings.js";
 import { addProjectionLeaseAccess } from "./publication/projection-lease.js";
 import { contentActionsPublicationWiring, planS3ProjectionBackend } from "./publication/s3-projection-settings.js";
 import { rebuildTriggerSettings } from "./rebuild-trigger-settings.js";
-import { assertValidPublicationConfig } from "./site-backend-config.js";
+import { assertValidMonitoringConfig, assertValidPublicationConfig } from "./site-backend-config.js";
 import { revalidateSecretReadStatement } from "./revalidate-secret-policy.js";
 import { revalidateDistributionEnvironment, revalidateInvalidationStatement, validateRevalidateDistributionIds, } from "./revalidate-invalidation-settings.js";
 import { addInvalidationPathAlarm } from "./publication/invalidation-alarm.js";
@@ -87,6 +87,8 @@ export function defineSiteBackend(papyrusSite) {
     const publication = resolveSitePublication(site, activeBrand?.renderer?.kind);
     if (publication !== undefined)
         assertValidPublicationConfig(publication);
+    assertValidMonitoringConfig(site.monitoring);
+    const emailMonitorId = site.monitoring?.emailMonitorId ?? "hn";
     const publicationPlan = planS3ProjectionBackend(publication);
     const renditionsPlan = planRenditions(publication, process.cwd());
     setSiteFilesForContentActionsBundle(publicationPlan.enabled ? publicationPlan.siteFiles : undefined);
@@ -336,7 +338,7 @@ export function defineSiteBackend(papyrusSite) {
     // and publication to this deployment's pool and existing API endpoint.
     contentActionsLambda.addEnvironment("PAPYRUS_USER_POOL_ISSUER", `https://cognito-idp.${Stack.of(contentActionsLambda).region}.amazonaws.com/${backend.auth.resources.userPool.userPoolId}`);
     contentActionsLambda.addEnvironment("PAPYRUS_GRAPHQL_ENDPOINT", backend.data.resources.cfnResources.cfnGraphqlApi.attrGraphQlUrl);
-    wireEmailReferenceIntake(contentActionsLambda);
+    wireEmailReferenceIntake(contentActionsLambda, emailMonitorId);
     contentActionsLambda.addToRolePolicy(new PolicyStatement({
         actions: ["appsync:GraphQL"],
         resources: ["*"],
@@ -627,7 +629,7 @@ export function defineSiteBackend(papyrusSite) {
         },
     });
     wireEditorialChecks(backend);
-    wireMonitoringView(backend);
+    wireMonitoringView(backend, emailMonitorId);
     wireAutomationView(backend);
     wirePlugins(backend, plugins, contentActionsLambda);
     return backend;

package/amplify/site-backend.ts

@@ -17,7 +17,7 @@ import { planRenditions } from "./publication/renditions-settings";
 import { addProjectionLeaseAccess } from "./publication/projection-lease";
 import { contentActionsPublicationWiring, planS3ProjectionBackend } from "./publication/s3-projection-settings";
 import { rebuildTriggerSettings } from "./rebuild-trigger-settings";
-import { assertValidPublicationConfig } from "./site-backend-config";
+import { assertValidMonitoringConfig, assertValidPublicationConfig } from "./site-backend-config";
 import { revalidateSecretReadStatement } from "./revalidate-secret-policy";
 import {
   revalidateDistributionEnvironment,
@@ -108,6 +108,8 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
   };
   const publication = resolveSitePublication(site, activeBrand?.renderer?.kind);
   if (publication !== undefined) assertValidPublicationConfig(publication);
+  assertValidMonitoringConfig(site.monitoring);
+  const emailMonitorId = site.monitoring?.emailMonitorId ?? "hn";
   const publicationPlan = planS3ProjectionBackend(publication);
   const renditionsPlan = planRenditions(publication, process.cwd());
   setSiteFilesForContentActionsBundle(publicationPlan.enabled ? publicationPlan.siteFiles : undefined);
@@ -429,7 +431,7 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
     "PAPYRUS_GRAPHQL_ENDPOINT",
     backend.data.resources.cfnResources.cfnGraphqlApi.attrGraphQlUrl,
   );
-  wireEmailReferenceIntake(contentActionsLambda);
+  wireEmailReferenceIntake(contentActionsLambda, emailMonitorId);
   contentActionsLambda.addToRolePolicy(
     new PolicyStatement({
       actions: ["appsync:GraphQL"],
@@ -773,7 +775,7 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
     },
   });
   wireEditorialChecks(backend);
-  wireMonitoringView(backend);
+  wireMonitoringView(backend, emailMonitorId);
   wireAutomationView(backend);
   wirePlugins(backend, plugins, contentActionsLambda);
 

package/package.json

@@ -456,7 +456,7 @@
       "optional": true
     }
   },
-  "version": "5.41.0",
+  "version": "5.41.1",
   "dependencies": {
     "@aws-amplify/adapter-nextjs": "^1.7.3",
     "@aws-crypto/sha256-js": "5.2.0",

package/routes.manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "5.41.0",
+  "version": "5.41.1",
   "routes": [
     {
       "file": "app/%5F_preview/[[...path]]/route.ts",