@anthusai/papyrus 5.41.0 → 5.41.2

package/amplify/functions/content-actions/handler.py

@@ -359,8 +359,8 @@ def handler(event, context):
         if field == "intakeEmailSubmissionReferences":
             client, _claims = create_authoring_client()
             try:
-                from papyrus_content.monitoring_view import default_store_factory
-                receipt_store = default_store_factory(os.environ)()
+                from papyrus_content.monitoring_view import default_email_store_factory
+                receipt_store = default_email_store_factory(os.environ)()
                 return intake_email_submission_references(
                     client, arguments, event.get("identity") or {}, receipt_store=receipt_store)
             except IntakeError as error:

package/amplify/functions/monitoring-view/wire.js

@@ -19,11 +19,12 @@ export function monitoringViewParameterArn(region, account) {
  * Environment and least-privilege IAM for the monitoring-view function. A site outside the monitoring
  * account simply finds no parameter and the page says monitoring is not configured.
  */
-export function wireMonitoringView(backend) {
+export function wireMonitoringView(backend, emailMonitorId = "hn") {
     const lambda = backend.monitoringView.resources.lambda;
     const stack = Stack.of(lambda);
     lambda.addEnvironment("PAPYRUS_GRAPHQL_ENDPOINT", backend.data.resources.cfnResources.cfnGraphqlApi.attrGraphQlUrl);
     lambda.addEnvironment("PAPYRUS_MONITORING_TABLE_PARAMETER", MONITORING_TABLE_PARAMETER);
+    lambda.addEnvironment("PAPYRUS_EMAIL_MONITOR_ID", emailMonitorId);
     lambda.addToRolePolicy(new PolicyStatement({
         effect: Effect.ALLOW,
         actions: ["ssm:GetParameter"],
@@ -41,13 +42,14 @@ export function wireMonitoringView(backend) {
         effect: Effect.ALLOW,
         actions: ["dynamodb:PutItem"],
         resources: monitoringViewTableArns(stack.region, stack.account).slice(0, 1),
-        conditions: { "ForAllValues:StringEquals": { "dynamodb:LeadingKeys": ["MONITOR#hn"] } },
+        conditions: { "ForAllValues:StringEquals": { "dynamodb:LeadingKeys": [`MONITOR#${emailMonitorId}`] } },
     }));
 }
 /** Lets the authenticated Reference-intake action verify a selected email receipt. */
-export function wireEmailReferenceIntake(lambda) {
+export function wireEmailReferenceIntake(lambda, emailMonitorId = "hn") {
     const stack = Stack.of(lambda);
     lambda.addEnvironment("PAPYRUS_MONITORING_TABLE_PARAMETER", MONITORING_TABLE_PARAMETER);
+    lambda.addEnvironment("PAPYRUS_EMAIL_MONITOR_ID", emailMonitorId);
     lambda.addToRolePolicy(new PolicyStatement({
         effect: Effect.ALLOW,
         actions: ["ssm:GetParameter"],
@@ -57,6 +59,6 @@ export function wireEmailReferenceIntake(lambda) {
         effect: Effect.ALLOW,
         actions: MONITORING_VIEW_TABLE_ACTIONS,
         resources: monitoringViewTableArns(stack.region, stack.account).slice(0, 1),
-        conditions: { "ForAllValues:StringEquals": { "dynamodb:LeadingKeys": ["MONITOR#hn"] } },
+        conditions: { "ForAllValues:StringEquals": { "dynamodb:LeadingKeys": [`MONITOR#${emailMonitorId}`] } },
     }));
 }

package/amplify/functions/monitoring-view/wire.ts

@@ -25,11 +25,12 @@ export function monitoringViewParameterArn(region: string, account: string): str
  * Environment and least-privilege IAM for the monitoring-view function. A site outside the monitoring
  * account simply finds no parameter and the page says monitoring is not configured.
  */
-export function wireMonitoringView(backend: any): void {
+export function wireMonitoringView(backend: any, emailMonitorId = "hn"): void {
   const lambda = backend.monitoringView.resources.lambda as LambdaFunction;
   const stack = Stack.of(lambda);
   lambda.addEnvironment("PAPYRUS_GRAPHQL_ENDPOINT", backend.data.resources.cfnResources.cfnGraphqlApi.attrGraphQlUrl as string);
   lambda.addEnvironment("PAPYRUS_MONITORING_TABLE_PARAMETER", MONITORING_TABLE_PARAMETER);
+  lambda.addEnvironment("PAPYRUS_EMAIL_MONITOR_ID", emailMonitorId);
   lambda.addToRolePolicy(
     new PolicyStatement({
       effect: Effect.ALLOW,
@@ -52,15 +53,16 @@ export function wireMonitoringView(backend: any): void {
       effect: Effect.ALLOW,
       actions: ["dynamodb:PutItem"],
       resources: monitoringViewTableArns(stack.region, stack.account).slice(0, 1),
-      conditions: { "ForAllValues:StringEquals": { "dynamodb:LeadingKeys": ["MONITOR#hn"] } },
+      conditions: { "ForAllValues:StringEquals": { "dynamodb:LeadingKeys": [`MONITOR#${emailMonitorId}`] } },
     }),
   );
 }
 
 /** Lets the authenticated Reference-intake action verify a selected email receipt. */
-export function wireEmailReferenceIntake(lambda: LambdaFunction): void {
+export function wireEmailReferenceIntake(lambda: LambdaFunction, emailMonitorId = "hn"): void {
   const stack = Stack.of(lambda);
   lambda.addEnvironment("PAPYRUS_MONITORING_TABLE_PARAMETER", MONITORING_TABLE_PARAMETER);
+  lambda.addEnvironment("PAPYRUS_EMAIL_MONITOR_ID", emailMonitorId);
   lambda.addToRolePolicy(
     new PolicyStatement({
       effect: Effect.ALLOW,
@@ -73,7 +75,7 @@ export function wireEmailReferenceIntake(lambda: LambdaFunction): void {
       effect: Effect.ALLOW,
       actions: MONITORING_VIEW_TABLE_ACTIONS,
       resources: monitoringViewTableArns(stack.region, stack.account).slice(0, 1),
-      conditions: { "ForAllValues:StringEquals": { "dynamodb:LeadingKeys": ["MONITOR#hn"] } },
+      conditions: { "ForAllValues:StringEquals": { "dynamodb:LeadingKeys": [`MONITOR#${emailMonitorId}`] } },
     }),
   );
 }

package/amplify/site-backend-config.js

@@ -1,4 +1,23 @@
 export const MAXIMUM_HTML_S_MAXAGE_SECONDS = 86400;
+const MONITOR_ID_PATTERN = /^[a-z0-9][a-z0-9-]{0,62}$/;
+export function validateMonitoringConfig(monitoring) {
+    if (monitoring === undefined)
+        return [];
+    if (typeof monitoring !== "object" || monitoring === null || Array.isArray(monitoring)) {
+        return ["monitoring must be an object"];
+    }
+    const config = monitoring;
+    if (config.emailMonitorId !== undefined
+        && (typeof config.emailMonitorId !== "string" || !MONITOR_ID_PATTERN.test(config.emailMonitorId))) {
+        return ["monitoring.emailMonitorId must be a lowercase monitor id (1-63 letters, digits, or hyphens)"];
+    }
+    return [];
+}
+export function assertValidMonitoringConfig(monitoring) {
+    const problems = validateMonitoringConfig(monitoring);
+    if (problems.length > 0)
+        throw new Error(`Invalid backend.monitoring: ${problems.join("; ")}`);
+}
 const CLOUDFRONT_DISTRIBUTION_ARN = /^arn:aws[a-z-]*:cloudfront::\d{12}:distribution\/[A-Z0-9]+$/;
 function isRelativePathWithoutParentSegments(value) {
     if (value === "" || value.startsWith("/") || value.includes("\\"))

package/amplify/site-backend-config.ts

@@ -40,6 +40,31 @@ export type PapyrusPublicationCacheConfig = {
 
 export const MAXIMUM_HTML_S_MAXAGE_SECONDS = 86400;
 
+export type PapyrusMonitoringConfig = {
+  /** Existing shared Monitoring partition that stores this site's private email receipts. */
+  emailMonitorId?: string;
+};
+
+const MONITOR_ID_PATTERN = /^[a-z0-9][a-z0-9-]{0,62}$/;
+
+export function validateMonitoringConfig(monitoring: unknown): string[] {
+  if (monitoring === undefined) return [];
+  if (typeof monitoring !== "object" || monitoring === null || Array.isArray(monitoring)) {
+    return ["monitoring must be an object"];
+  }
+  const config = monitoring as { emailMonitorId?: unknown };
+  if (config.emailMonitorId !== undefined
+    && (typeof config.emailMonitorId !== "string" || !MONITOR_ID_PATTERN.test(config.emailMonitorId))) {
+    return ["monitoring.emailMonitorId must be a lowercase monitor id (1-63 letters, digits, or hyphens)"];
+  }
+  return [];
+}
+
+export function assertValidMonitoringConfig(monitoring: unknown): void {
+  const problems = validateMonitoringConfig(monitoring);
+  if (problems.length > 0) throw new Error(`Invalid backend.monitoring: ${problems.join("; ")}`);
+}
+
 export type PapyrusPublicationConfig = {
   kind: "s3-projection";
   /** Site repo path (relative, `.py`) of the SiteProjector bundled into content-actions as `site_projector`. */
@@ -138,6 +163,8 @@ export type PapyrusSiteBackendConfig = {
    */
   productionAppId?: string;
   auth?: PapyrusAuthConfig;
+  /** Shared Monitoring partition used by private email intake for this publication. */
+  monitoring?: PapyrusMonitoringConfig;
   /**
    * Maximum number of data model nested stacks CloudFormation creates at once.
    * Stacks are chained in waves of this size so a new AWS account is not hit

package/amplify/site-backend.js

@@ -14,7 +14,7 @@ import { planRenditions } from "./publication/renditions-settings.js";
 import { addProjectionLeaseAccess } from "./publication/projection-lease.js";
 import { contentActionsPublicationWiring, planS3ProjectionBackend } from "./publication/s3-projection-settings.js";
 import { rebuildTriggerSettings } from "./rebuild-trigger-settings.js";
-import { assertValidPublicationConfig } from "./site-backend-config.js";
+import { assertValidMonitoringConfig, assertValidPublicationConfig } from "./site-backend-config.js";
 import { revalidateSecretReadStatement } from "./revalidate-secret-policy.js";
 import { revalidateDistributionEnvironment, revalidateInvalidationStatement, validateRevalidateDistributionIds, } from "./revalidate-invalidation-settings.js";
 import { addInvalidationPathAlarm } from "./publication/invalidation-alarm.js";
@@ -87,6 +87,8 @@ export function defineSiteBackend(papyrusSite) {
     const publication = resolveSitePublication(site, activeBrand?.renderer?.kind);
     if (publication !== undefined)
         assertValidPublicationConfig(publication);
+    assertValidMonitoringConfig(site.monitoring);
+    const emailMonitorId = site.monitoring?.emailMonitorId ?? "hn";
     const publicationPlan = planS3ProjectionBackend(publication);
     const renditionsPlan = planRenditions(publication, process.cwd());
     setSiteFilesForContentActionsBundle(publicationPlan.enabled ? publicationPlan.siteFiles : undefined);
@@ -336,7 +338,7 @@ export function defineSiteBackend(papyrusSite) {
     // and publication to this deployment's pool and existing API endpoint.
     contentActionsLambda.addEnvironment("PAPYRUS_USER_POOL_ISSUER", `https://cognito-idp.${Stack.of(contentActionsLambda).region}.amazonaws.com/${backend.auth.resources.userPool.userPoolId}`);
     contentActionsLambda.addEnvironment("PAPYRUS_GRAPHQL_ENDPOINT", backend.data.resources.cfnResources.cfnGraphqlApi.attrGraphQlUrl);
-    wireEmailReferenceIntake(contentActionsLambda);
+    wireEmailReferenceIntake(contentActionsLambda, emailMonitorId);
     contentActionsLambda.addToRolePolicy(new PolicyStatement({
         actions: ["appsync:GraphQL"],
         resources: ["*"],
@@ -627,7 +629,7 @@ export function defineSiteBackend(papyrusSite) {
         },
     });
     wireEditorialChecks(backend);
-    wireMonitoringView(backend);
+    wireMonitoringView(backend, emailMonitorId);
     wireAutomationView(backend);
     wirePlugins(backend, plugins, contentActionsLambda);
     return backend;

package/amplify/site-backend.ts

@@ -17,7 +17,7 @@ import { planRenditions } from "./publication/renditions-settings";
 import { addProjectionLeaseAccess } from "./publication/projection-lease";
 import { contentActionsPublicationWiring, planS3ProjectionBackend } from "./publication/s3-projection-settings";
 import { rebuildTriggerSettings } from "./rebuild-trigger-settings";
-import { assertValidPublicationConfig } from "./site-backend-config";
+import { assertValidMonitoringConfig, assertValidPublicationConfig } from "./site-backend-config";
 import { revalidateSecretReadStatement } from "./revalidate-secret-policy";
 import {
   revalidateDistributionEnvironment,
@@ -108,6 +108,8 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
   };
   const publication = resolveSitePublication(site, activeBrand?.renderer?.kind);
   if (publication !== undefined) assertValidPublicationConfig(publication);
+  assertValidMonitoringConfig(site.monitoring);
+  const emailMonitorId = site.monitoring?.emailMonitorId ?? "hn";
   const publicationPlan = planS3ProjectionBackend(publication);
   const renditionsPlan = planRenditions(publication, process.cwd());
   setSiteFilesForContentActionsBundle(publicationPlan.enabled ? publicationPlan.siteFiles : undefined);
@@ -429,7 +431,7 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
     "PAPYRUS_GRAPHQL_ENDPOINT",
     backend.data.resources.cfnResources.cfnGraphqlApi.attrGraphQlUrl,
   );
-  wireEmailReferenceIntake(contentActionsLambda);
+  wireEmailReferenceIntake(contentActionsLambda, emailMonitorId);
   contentActionsLambda.addToRolePolicy(
     new PolicyStatement({
       actions: ["appsync:GraphQL"],
@@ -773,7 +775,7 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
     },
   });
   wireEditorialChecks(backend);
-  wireMonitoringView(backend);
+  wireMonitoringView(backend, emailMonitorId);
   wireAutomationView(backend);
   wirePlugins(backend, plugins, contentActionsLambda);
 

package/components/papyrus-private-chat-panel.tsx

@@ -1,6 +1,8 @@
 "use client";
 
 import { useCallback, useEffect, useMemo, useRef, useState } from "react";
+import { connectNewsroomChat } from "../lib/newsroom-chat-client";
+import { loadProspectusAccountState, selectProspectusAccount, type ProspectusAccountState } from "../lib/prospectus-account-client";
 import { PapyrusConsoleConversation, type ConsoleConversationMessage } from "./papyrus-console-conversation";
 import {
   listPapyrusPrivateChatMessages,
@@ -28,9 +30,13 @@ function failureMessage(error: unknown): string {
 export function PapyrusPrivateChatPanel({ onClose }: { onClose: () => void }) {
   const [channel, setChannel] = useState<PapyrusPrivateChatChannel | null>(null);
   const [messages, setMessages] = useState<PapyrusPrivateChatMessage[]>([]);
+  const [accountState, setAccountState] = useState<ProspectusAccountState | null>(null);
+  const [connecting, setConnecting] = useState(false);
+  const [connectionNotice, setConnectionNotice] = useState<string | null>(null);
   const [loading, setLoading] = useState(true);
   const [sending, setSending] = useState(false);
   const [error, setError] = useState<string | null>(null);
+  const identityGeneration = useRef(0);
   const retryAttempt = useRef<{ text: string; key: string } | null>(null);
   const isWaitingForReply = messages.length > 0 && messages[messages.length - 1].author_kind === "human" &&
     messages[messages.length - 1].addressed_to_bot_id !== null;
@@ -46,38 +52,66 @@ export function PapyrusPrivateChatPanel({ onClose }: { onClose: () => void }) {
     }];
   }, [isWaitingForReply, messages]);
 
-  const refreshMessages = useCallback(async (channelId: string) => {
+  const handleFailure = useCallback(async (nextError: unknown) => {
+    const failure = failureMessage(nextError);
+    setError(failure);
+    if (["sign_in_required", "chat_identity_connection_required", "publishing_account_required", "chat_account_access_denied"].includes(failure)) {
+      const generation = ++identityGeneration.current;
+      setChannel(null);
+      setMessages([]);
+      setAccountState(null);
+      retryAttempt.current = null;
+      setSending(false);
+      setLoading(false);
+      if (failure === "publishing_account_required") {
+        const state = await loadProspectusAccountState(window.location.pathname);
+        if (generation === identityGeneration.current) setAccountState(state);
+      }
+    }
+  }, []);
+
+  const refreshMessages = useCallback(async (channelId: string, generation: number) => {
     const next = await listPapyrusPrivateChatMessages(channelId);
-    setMessages(next);
+    if (generation === identityGeneration.current) setMessages(next);
   }, []);
 
   const openConversation = useCallback(async () => {
+    const generation = ++identityGeneration.current;
     setLoading(true);
     setError(null);
+    setChannel(null);
+    setMessages([]);
     try {
       const nextChannel = await openPapyrusPrivateChat();
+      if (generation !== identityGeneration.current) return;
       setChannel(nextChannel);
-      await refreshMessages(nextChannel.channel_id);
+      await refreshMessages(nextChannel.channel_id, generation);
     } catch (nextError) {
-      setError(failureMessage(nextError));
+      if (generation === identityGeneration.current) await handleFailure(nextError);
     } finally {
-      setLoading(false);
+      if (generation === identityGeneration.current) setLoading(false);
     }
-  }, [refreshMessages]);
+  }, [handleFailure, refreshMessages]);
 
   useEffect(() => {
+    const code = new URLSearchParams(window.location.search).get("sign_in_error");
+    if (code) setConnectionNotice(code === "newsroom_identity_mismatch"
+      ? "The selected Google account did not match your newsroom session. Connect again with the same account."
+      : "The publishing-account connection did not complete. You can safely try again.");
     void openConversation();
+    return () => { identityGeneration.current += 1; };
   }, [openConversation]);
 
   useEffect(() => {
     if (!channel || !isWaitingForReply) return;
     let active = true;
+    const generation = identityGeneration.current;
     let timer: ReturnType<typeof setTimeout> | null = null;
     const poll = async () => {
       try {
-        await refreshMessages(channel.channel_id);
+        await refreshMessages(channel.channel_id, generation);
       } catch (nextError) {
-        if (active) setError(failureMessage(nextError));
+        if (active && generation === identityGeneration.current) await handleFailure(nextError);
         return;
       }
       if (active) timer = setTimeout(poll, REFRESH_MS);
@@ -87,10 +121,11 @@ export function PapyrusPrivateChatPanel({ onClose }: { onClose: () => void }) {
       active = false;
       if (timer) clearTimeout(timer);
     };
-  }, [channel, isWaitingForReply, refreshMessages]);
+  }, [channel, handleFailure, isWaitingForReply, refreshMessages]);
 
   const sendMessage = useCallback(async (text: string) => {
     if (!channel || !text.trim() || sending) return;
+    const generation = identityGeneration.current;
     const attempt = retryAttempt.current?.text === text
       ? retryAttempt.current
       : { text, key: globalThis.crypto.randomUUID() };
@@ -99,16 +134,40 @@ export function PapyrusPrivateChatPanel({ onClose }: { onClose: () => void }) {
     setError(null);
     try {
       const result = await sendPapyrusPrivateChatMessage(channel.channel_id, text, attempt.key);
+      if (generation !== identityGeneration.current) return;
       setMessages((current) => current.some((message) => message.message_id === result.message.message_id)
         ? current
         : [...current, result.message]);
       retryAttempt.current = null;
     } catch (nextError) {
-      setError(failureMessage(nextError));
+      if (generation === identityGeneration.current) await handleFailure(nextError);
     } finally {
-      setSending(false);
+      if (generation === identityGeneration.current) setSending(false);
+    }
+  }, [channel, handleFailure, sending]);
+
+  const connect = async () => {
+    setConnecting(true);
+    try {
+      const returnUrl = new URL(window.location.href);
+      returnUrl.searchParams.delete("sign_in_error");
+      const target = await connectNewsroomChat(`${returnUrl.pathname}${returnUrl.search}${returnUrl.hash}`);
+      window.location.assign(target);
+    } catch (nextError) {
+      setError(failureMessage(nextError));
+      setConnecting(false);
     }
-  }, [channel, sending]);
+  };
+  const chooseAccount = async (accountId: string) => {
+    setConnecting(true);
+    try {
+      const result = await selectProspectusAccount(accountId);
+      if ("error" in result) { setError(result.error); return; }
+      setAccountState(null);
+      await openConversation();
+    } catch (nextError) { setError(failureMessage(nextError)); }
+    finally { setConnecting(false); }
+  };
 
   return <div className="papyrus-console__panel">
     <header className="papyrus-console__header">
@@ -117,9 +176,20 @@ export function PapyrusPrivateChatPanel({ onClose }: { onClose: () => void }) {
     </header>
     {channel ? <p className="papyrus-console__empty" role="status">Private conversation for your selected Account.</p> : null}
     {!channel && !loading ? <div className="papyrus-console__empty" role="alert">
-      <strong>Private chat could not be opened.</strong>
-      <span>{error}</span>
-      <button className="papyrus-console__new-session" onClick={() => void openConversation()} type="button">Retry</button>
+      {error === "chat_identity_connection_required" ? <>
+        <strong>Connect your publishing account</strong>
+        {connectionNotice ? <span>{connectionNotice}</span> : null}
+        <span>Continue with the same Google account you use in the newsroom, then choose the Account for this private conversation.</span>
+        <button className="papyrus-console__new-session" disabled={connecting} onClick={() => void connect()} type="button">{connecting ? "Connecting…" : "Connect publishing account"}</button>
+      </> : accountState?.status === "signedIn" ? <>
+        <strong>Choose your publishing Account</strong>
+        {accountState.publishingAccounts.length === 0 ? <span>This identity has no publishing Account for this site. Ask the Account owner to confirm your existing access.</span> : accountState.publishingAccounts.map(account => <button className="papyrus-console__new-session" disabled={connecting} key={account.accountId} onClick={() => void chooseAccount(account.accountId)} type="button">{account.name ?? account.accountId}</button>)}
+        {error !== "publishing_account_required" ? <span>{error}</span> : null}
+      </> : <>
+        <strong>Private chat could not be opened.</strong>
+        <span>{error === "sign_in_required" ? "Your newsroom session has expired. Sign in from the account menu, then retry." : error}</span>
+        <button className="papyrus-console__new-session" onClick={() => void openConversation()} type="button">Retry</button>
+      </>}
     </div> : <PapyrusConsoleConversation
       messages={conversationMessages}
       isSending={sending || loading || !channel}

package/lib/newsroom-chat-client.ts

@@ -0,0 +1,30 @@
+export type NewsroomChatFetch = typeof fetch;
+
+export function createNewsroomChatFetch(
+  accessToken: () => Promise<string | null>,
+  fetcher: NewsroomChatFetch,
+): NewsroomChatFetch {
+  return async (input, init) => {
+    if (typeof input !== "string" || (!input.startsWith("/api/newsroom/chat/") && !input.startsWith("/api/auth/prospectus/"))) {
+      throw new Error("Newsroom credentials can only be sent to this site's chat identity routes.");
+    }
+    const token = await accessToken();
+    if (!token) throw new Error("sign_in_required");
+    const headers = new Headers(init?.headers);
+    headers.set("authorization", `Bearer ${token}`);
+    return fetcher(input, { ...init, headers, credentials: "same-origin", cache: "no-store" });
+  };
+}
+
+export const newsroomChatFetch: NewsroomChatFetch = createNewsroomChatFetch(async () => {
+  const { fetchAuthSession } = await import("aws-amplify/auth");
+  const session = await fetchAuthSession();
+  return session.tokens?.accessToken?.toString() ?? null;
+}, (input, init) => globalThis.fetch(input, init));
+
+export async function connectNewsroomChat(returnPath: string, fetcher: NewsroomChatFetch = newsroomChatFetch): Promise<string> {
+  const response = await fetcher(`/api/auth/prospectus/sign-in?newsroomChat=true&returnTo=${encodeURIComponent(returnPath)}`, { method: "POST" });
+  const body = await response.json() as { authorizationUrl?: string; message?: string };
+  if (!response.ok || !body.authorizationUrl) throw new Error(body.message ?? "Private chat could not connect to your publishing account.");
+  return body.authorizationUrl;
+}

package/lib/newsroom-chat-identity.ts

@@ -0,0 +1,39 @@
+import { CognitoJwtVerifier } from "aws-jwt-verify";
+import type { JwksCache } from "aws-jwt-verify/jwk";
+import type { NextRequest } from "next/server";
+import { readAmplifyOutputsFile } from "./amplify-outputs-path";
+
+export type NewsroomChatIdentity = { subject: string };
+export type NewsroomChatIdentityResolver = (request: NextRequest) => Promise<NewsroomChatIdentity | null>;
+
+export function newsroomChatIdentityResolver(
+  auth: { user_pool_id: string; user_pool_client_id: string },
+  jwksCache?: JwksCache,
+): NewsroomChatIdentityResolver {
+  const verifier = CognitoJwtVerifier.create({
+    userPoolId: auth.user_pool_id,
+    clientId: auth.user_pool_client_id,
+    tokenUse: "access",
+    groups: ["editor", "admin"],
+  }, jwksCache ? { jwksCache } : undefined);
+  return async (request) => {
+    const token = request.headers.get("authorization")?.match(/^Bearer ([^\s]+)$/i)?.[1];
+    if (!token) return null;
+    try {
+      const claims = await verifier.verify(token);
+      return { subject: claims.sub };
+    } catch {
+      return null;
+    }
+  };
+}
+
+let configuredResolver: { key: string; resolve: NewsroomChatIdentityResolver } | undefined;
+
+export async function resolveNewsroomChatIdentity(request: NextRequest): Promise<NewsroomChatIdentity | null> {
+  const auth = readAmplifyOutputsFile()?.auth as { user_pool_id?: string; user_pool_client_id?: string } | undefined;
+  if (!auth?.user_pool_id || !auth.user_pool_client_id) throw new Error("Newsroom identity configuration is unavailable");
+  const key = `${auth.user_pool_id}:${auth.user_pool_client_id}`;
+  if (configuredResolver?.key !== key) configuredResolver = { key, resolve: newsroomChatIdentityResolver({ user_pool_id: auth.user_pool_id, user_pool_client_id: auth.user_pool_client_id }) };
+  return configuredResolver.resolve(request);
+}

package/lib/papyrus-hosted-chat.ts

@@ -1,3 +1,4 @@
+import { resolveNewsroomChatIdentity, type NewsroomChatIdentityResolver } from "./newsroom-chat-identity";
 import { createHash } from "node:crypto";
 import type { EmbeddedChatAppDependencies } from "chatticus/chat-server";
 import type { NextRequest } from "next/server";
@@ -24,6 +25,7 @@ export interface PapyrusChatScope {
 }
 
 export interface PapyrusHostedChatOptions {
+  resolveNewsroomIdentity?: NewsroomChatIdentityResolver;
   resolveRuntime?: (siteOrigin: string) => Promise<ProspectusSignInRuntime | null>;
   resolvePrivateDependencies?: () => Promise<EmbeddedChatAppDependencies | null>;
   privateChatEnabled?: boolean;
@@ -61,7 +63,7 @@ async function principalForRequest(
   request: NextRequest,
   operation: "console:read" | "console:write",
   options: PapyrusHostedChatOptions,
-): Promise<{ principal: ResolvedPapyrusPrincipal | null; status: number }> {
+): Promise<{ principal: ResolvedPapyrusPrincipal | null; status: number; error?: string }> {
   const environment = options.environment ?? process.env;
   const siteProduct = options.siteProduct !== undefined ? options.siteProduct : prospectusSiteProduct(environment);
   if (!siteProduct) return { principal: null, status: 503 };
@@ -74,11 +76,22 @@ async function principalForRequest(
   }
   if (!runtime) return { principal: null, status: 503 };
 
+  let newsroomIdentity;
+  try {
+    newsroomIdentity = await (options.resolveNewsroomIdentity ?? resolveNewsroomChatIdentity)(request);
+  } catch {
+    return { principal: null, status: 503 };
+  }
+  if (!newsroomIdentity) return { principal: null, status: 401 };
   const nowInSeconds = options.nowInSeconds?.() ?? Math.floor(Date.now() / 1000);
   const session = signedInProspectusSession(request, runtime.sealingSecret, nowInSeconds);
-  if (!session || !session.selectedAccountId || !Number.isFinite(session.accessTokenExpiresAt) || session.accessTokenExpiresAt <= nowInSeconds) {
-    return { principal: null, status: 401 };
+  if (!session || !Number.isFinite(session.accessTokenExpiresAt) || session.accessTokenExpiresAt <= nowInSeconds) {
+    return { principal: null, status: 409, error: "chat_identity_connection_required" };
+  }
+  if (session.newsroomSubject !== newsroomIdentity.subject) {
+    return { principal: null, status: 409, error: "chat_identity_connection_required" };
   }
+  if (!session.selectedAccountId) return { principal: null, status: 409, error: "publishing_account_required" };
 
   try {
     const directory = await runtime.accounts.accountDirectory(session.accessToken);
@@ -162,6 +175,9 @@ export async function handlePapyrusHostedChatRequest(
   const privateChatEnabled = options.privateChatEnabled ?? environment.PAPYRUS_PRIVATE_CHAT_ENABLED === "true";
   if (!privateChatEnabled) return jsonFailure(404, "private_chat_disabled");
 
+  const authorization = await principalForRequest(request, request.method === "POST" ? "console:write" : "console:read", options);
+  if (!authorization.principal) return jsonFailure(authorization.status, authorization.error ?? (authorization.status === 401 ? "sign_in_required" : authorization.status === 403 ? "chat_account_access_denied" : "chat_runtime_unavailable"));
+
   let dependencies: EmbeddedChatAppDependencies | null;
   try {
     if (options.resolvePrivateDependencies) {
@@ -178,9 +194,6 @@ export async function handlePapyrusHostedChatRequest(
   }
   if (!dependencies) return jsonFailure(503, "private_chat_storage_unavailable");
 
-  const authorization = await principalForRequest(request, request.method === "POST" ? "console:write" : "console:read", options);
-  if (!authorization.principal) return jsonFailure(authorization.status, authorization.status === 401 ? "sign_in_required" : authorization.status === 403 ? "chat_account_access_denied" : "chat_runtime_unavailable");
-
   const headers = new Headers({ accept: request.headers.get("accept") ?? "application/json" });
   let body: string | undefined;
   if (request.method === "POST" && isMessageRoute) {

package/lib/papyrus-private-chat-client.ts

@@ -1,3 +1,4 @@
+import { newsroomChatFetch } from "./newsroom-chat-client";
 export type PapyrusPrivateChatChannel = {
   channel_id: string;
   participants: Array<{ kind: string; actor_id: string }>;
@@ -39,8 +40,8 @@ async function requestJson<T>(path: string, init: RequestInit, fetcher: PapyrusP
   return payload as T;
 }
 
-/** Open the current editor's server-derived private channel using the signed same-origin session cookie. */
-export async function openPapyrusPrivateChat(fetcher: PapyrusPrivateChatFetch = globalThis.fetch): Promise<PapyrusPrivateChatChannel> {
+/** Open the current editor's server-derived private channel using the verified newsroom identity and connected account session. */
+export async function openPapyrusPrivateChat(fetcher: PapyrusPrivateChatFetch = newsroomChatFetch): Promise<PapyrusPrivateChatChannel> {
   const result = await requestJson<PapyrusPrivateChatChannel>("private-channel", { method: "POST" }, fetcher);
   if (!result.channel_id?.trim() || !Array.isArray(result.participants)) {
     throw new Error("Private chat returned an invalid channel.");
@@ -51,7 +52,7 @@ export async function openPapyrusPrivateChat(fetcher: PapyrusPrivateChatFetch =
 /** Read only the private channel returned by the host's authenticated open request. */
 export async function listPapyrusPrivateChatMessages(
   channelId: string,
-  fetcher: PapyrusPrivateChatFetch = globalThis.fetch,
+  fetcher: PapyrusPrivateChatFetch = newsroomChatFetch,
 ): Promise<PapyrusPrivateChatMessage[]> {
   if (!channelId.trim()) throw new Error("A private chat channel is required.");
   const result = await requestJson<{ messages?: unknown }>(`channels/${encodeURIComponent(channelId)}/messages`, { method: "GET" }, fetcher);
@@ -64,7 +65,7 @@ export async function sendPapyrusPrivateChatMessage(
   channelId: string,
   body: string,
   idempotencyKey: string,
-  fetcher: PapyrusPrivateChatFetch = globalThis.fetch,
+  fetcher: PapyrusPrivateChatFetch = newsroomChatFetch,
 ): Promise<PapyrusPrivateChatSendResult> {
   if (!channelId.trim() || !body.trim() || !idempotencyKey.trim()) {
     throw new Error("A channel, message and idempotency key are required.");

package/lib/prospectus-session.ts

@@ -33,6 +33,7 @@ const MINIMUM_SEALING_SECRET_LENGTH = 32;
 
 export interface PendingProspectusSignInCookie extends PendingProspectusSignIn {
   returnPath: string;
+  newsroomSubject?: string;
 }
 
 export interface ProspectusSignedInSession {
@@ -40,6 +41,7 @@ export interface ProspectusSignedInSession {
   accessToken: string;
   accessTokenExpiresAt: number;
   selectedAccountId?: string;
+  newsroomSubject?: string;
   siteSubject?: string;
 }
 

package/lib/prospectus-sign-in-routes.ts

@@ -1,3 +1,4 @@
+import { resolveNewsroomChatIdentity, type NewsroomChatIdentityResolver } from "./newsroom-chat-identity";
 import { NextResponse, type NextRequest } from "next/server";
 import {
   CYCLOTRON_LAB_PRODUCT,
@@ -36,6 +37,7 @@ import { SiteOriginNotConfiguredError, publicSiteOrigin, siteOriginNotConfigured
  * unregistered deployment never half-signs anyone in.
  */
 export interface ProspectusSignInRouteOptions {
+  resolveNewsroomIdentity?: NewsroomChatIdentityResolver;
   resolveRuntime?: (siteOrigin: string) => Promise<ProspectusSignInRuntime | null>;
   siteProduct?: string | null;
   completionOverrides?: Pick<CompleteProspectusGoogleSignInInput, "verifyCognitoTokens" | "fetcher">;
@@ -137,12 +139,25 @@ export function handleProspectusSignInStart(request: NextRequest, options: Prosp
 async function handleProspectusSignInStartRoute(request: NextRequest, options: ProspectusSignInRouteOptions): Promise<NextResponse> {
   const runtime = await signInRuntimeFor(request, options);
   if (!runtime) return signInUnavailableResponse();
+  const newsroomConnection = request.nextUrl.searchParams.get("newsroomChat") === "true";
+  let newsroomSubject: string | undefined;
+  if (newsroomConnection) {
+    if (request.method !== "POST" || request.headers.get("origin") !== siteOriginFor(request, options)) {
+      return signInFailedResponse(403, "same_origin_required", "Connect chat from this newsroom.");
+    }
+    const identity = await (options.resolveNewsroomIdentity ?? resolveNewsroomChatIdentity)(request).catch(() => null);
+    if (!identity) return signInFailedResponse(401, "sign_in_required", "An authenticated newsroom editor is required.");
+    newsroomSubject = identity.subject;
+  }
   const { authorizationUrl, pendingSignIn } = await beginProspectusGoogleSignIn(runtime.accounts, runtime.cognitoClient);
   const pendingSignInCookie: PendingProspectusSignInCookie = {
     ...pendingSignIn,
-    returnPath: sameSiteReturnPath(await requestedReturnPath(request)),
+    ...(newsroomSubject ? { newsroomSubject } : {}),
+    returnPath: sameSiteReturnPath(newsroomConnection ? request.nextUrl.searchParams.get("returnTo") : await requestedReturnPath(request)),
   };
-  const response = NextResponse.redirect(authorizationUrl, { status: 303, headers: NO_STORE_HEADERS });
+  const response = newsroomConnection
+    ? NextResponse.json({ authorizationUrl }, { headers: NO_STORE_HEADERS })
+    : NextResponse.redirect(authorizationUrl, { status: 303, headers: NO_STORE_HEADERS });
   response.cookies.set(
     PROSPECTUS_PENDING_SIGN_IN_COOKIE,
     sealProspectusCookie(runtime.sealingSecret, PROSPECTUS_PENDING_SIGN_IN_COOKIE, pendingSignInCookie, pendingSignIn.expiresAt),
@@ -194,11 +209,13 @@ async function completeCallback(
       pendingSignIn,
       returnedState,
       authorizationCode,
+      expectedNewsroomSubject: pendingSignIn.newsroomSubject,
       nowInSeconds,
       ...options.completionOverrides,
     });
     const session: ProspectusSignedInSession = {
       personId: signedIn.person.id,
+      ...(pendingSignIn.newsroomSubject ? { newsroomSubject: pendingSignIn.newsroomSubject } : {}),
       accessToken: signedIn.accessToken,
       accessTokenExpiresAt: signedIn.accessTokenExpiresAt,
       ...(signedIn.person.siteSubject ? { siteSubject: signedIn.person.siteSubject } : {}),

package/lib/prospectus-site-identity.ts

@@ -281,6 +281,7 @@ export interface CompleteProspectusGoogleSignInInput {
   pendingSignIn: PendingProspectusSignIn;
   returnedState: string;
   authorizationCode: string;
+  expectedNewsroomSubject?: string;
   verifyCognitoTokens?: CognitoTokenVerifier;
   fetcher?: typeof fetch;
   nowInSeconds?: number;
@@ -320,6 +321,12 @@ export async function completeProspectusGoogleSignIn(
     expiresInSeconds: Number(tokenBody.expires_in) || 0,
   };
   await (input.verifyCognitoTokens ?? cognitoTokenVerifier(input.cognitoClient))(tokens, input.pendingSignIn.nonce);
+  if (input.expectedNewsroomSubject) {
+    const claims = JSON.parse(Buffer.from(tokens.accessToken.split(".")[1], "base64url").toString("utf8")) as { sub?: string };
+    if (claims.sub !== input.expectedNewsroomSubject) {
+      throw new ProspectusAccountsError(403, "newsroom_identity_mismatch", "Continue with the same Google account as your newsroom session.");
+    }
+  }
   const { person } = await input.accounts.resolveGoogleSignIn(input.pendingSignIn, tokens.accessToken, tokens.idToken);
   return {
     person,

package/package.json

@@ -257,6 +257,8 @@
     "./lib/newsroom-board": "./lib/newsroom-board.ts",
     "./lib/newsroom-card-layout": "./lib/newsroom-card-layout.ts",
     "./lib/newsroom-category-drilldown": "./lib/newsroom-category-drilldown.ts",
+    "./lib/newsroom-chat-client": "./lib/newsroom-chat-client.ts",
+    "./lib/newsroom-chat-identity": "./lib/newsroom-chat-identity.ts",
     "./lib/newsroom-demo-articles": "./lib/newsroom-demo-articles.ts",
     "./lib/newsroom-demo-dashboard": "./lib/newsroom-demo-dashboard.ts",
     "./lib/newsroom-demo-profile": "./lib/newsroom-demo-profile.ts",
@@ -456,7 +458,7 @@
       "optional": true
     }
   },
-  "version": "5.41.0",
+  "version": "5.41.2",
   "dependencies": {
     "@aws-amplify/adapter-nextjs": "^1.7.3",
     "@aws-crypto/sha256-js": "5.2.0",

package/routes.manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "5.41.0",
+  "version": "5.41.2",
   "routes": [
     {
       "file": "app/%5F_preview/[[...path]]/route.ts",