@anthusai/papyrus 5.41.5 → 5.41.6

package/components/papyrus-private-chat-panel.tsx

@@ -1,8 +1,7 @@
 "use client";
 
+import { Hub } from "aws-amplify/utils";
 import { useCallback, useEffect, useMemo, useRef, useState } from "react";
-import { connectNewsroomChat } from "../lib/newsroom-chat-client";
-import { loadProspectusAccountState, selectProspectusAccount, type ProspectusAccountState } from "../lib/prospectus-account-client";
 import { PapyrusConsoleConversation, type ConsoleConversationMessage } from "./papyrus-console-conversation";
 import {
   listPapyrusPrivateChatMessages,
@@ -30,9 +29,6 @@ function failureMessage(error: unknown): string {
 export function PapyrusPrivateChatPanel({ onClose }: { onClose: () => void }) {
   const [channel, setChannel] = useState<PapyrusPrivateChatChannel | null>(null);
   const [messages, setMessages] = useState<PapyrusPrivateChatMessage[]>([]);
-  const [accountState, setAccountState] = useState<ProspectusAccountState | null>(null);
-  const [connecting, setConnecting] = useState(false);
-  const [connectionNotice, setConnectionNotice] = useState<string | null>(null);
   const [loading, setLoading] = useState(true);
   const [sending, setSending] = useState(false);
   const [error, setError] = useState<string | null>(null);
@@ -55,18 +51,13 @@ export function PapyrusPrivateChatPanel({ onClose }: { onClose: () => void }) {
   const handleFailure = useCallback(async (nextError: unknown) => {
     const failure = failureMessage(nextError);
     setError(failure);
-    if (["sign_in_required", "chat_identity_connection_required", "publishing_account_required", "chat_account_access_denied"].includes(failure)) {
-      const generation = ++identityGeneration.current;
+    if (["sign_in_required", "chat_account_access_denied"].includes(failure)) {
+      ++identityGeneration.current;
       setChannel(null);
       setMessages([]);
-      setAccountState(null);
       retryAttempt.current = null;
       setSending(false);
       setLoading(false);
-      if (failure === "publishing_account_required") {
-        const state = await loadProspectusAccountState(window.location.pathname);
-        if (generation === identityGeneration.current) setAccountState(state);
-      }
     }
   }, []);
 
@@ -81,6 +72,8 @@ export function PapyrusPrivateChatPanel({ onClose }: { onClose: () => void }) {
     setError(null);
     setChannel(null);
     setMessages([]);
+    retryAttempt.current = null;
+    setSending(false);
     try {
       const nextChannel = await openPapyrusPrivateChat();
       if (generation !== identityGeneration.current) return;
@@ -94,14 +87,18 @@ export function PapyrusPrivateChatPanel({ onClose }: { onClose: () => void }) {
   }, [handleFailure, refreshMessages]);
 
   useEffect(() => {
-    const code = new URLSearchParams(window.location.search).get("sign_in_error");
-    if (code) setConnectionNotice(code === "newsroom_identity_mismatch"
-      ? "The selected Google account did not match your newsroom session. Connect again with the same account."
-      : "The publishing-account connection did not complete. You can safely try again.");
     void openConversation();
     return () => { identityGeneration.current += 1; };
   }, [openConversation]);
 
+  useEffect(() => Hub.listen("auth", ({ payload }) => {
+    if (payload.event === "tokenRefresh") {
+      void openConversation();
+    } else if (["signedOut", "signedIn", "tokenRefresh_failure"].includes(payload.event)) {
+      void handleFailure(new Error("sign_in_required"));
+    }
+  }), [handleFailure, openConversation]);
+
   useEffect(() => {
     if (!channel || !isWaitingForReply) return;
     let active = true;
@@ -146,54 +143,16 @@ export function PapyrusPrivateChatPanel({ onClose }: { onClose: () => void }) {
     }
   }, [channel, handleFailure, sending]);
 
-  const connect = async () => {
-    setConnecting(true);
-    try {
-      const returnUrl = new URL(window.location.href);
-      returnUrl.searchParams.delete("sign_in_error");
-      const target = await connectNewsroomChat(`${returnUrl.pathname}${returnUrl.search}${returnUrl.hash}`);
-      window.location.assign(target);
-    } catch (nextError) {
-      setError(failureMessage(nextError));
-      setConnecting(false);
-    }
-  };
-  const chooseAccount = async (accountId: string) => {
-    setConnecting(true);
-    try {
-      const result = await selectProspectusAccount(accountId);
-      if ("error" in result) { setError(result.error); return; }
-      setAccountState(null);
-      await openConversation();
-    } catch (nextError) { setError(failureMessage(nextError)); }
-    finally { setConnecting(false); }
-  };
-
   return <div className="papyrus-console__panel">
     <header className="papyrus-console__header">
       <p className="papyrus-console__header-label">Private chat</p>
       <button className="papyrus-console__close" onClick={onClose} type="button" aria-label="Close console">×</button>
     </header>
-    {channel ? <p className="papyrus-console__empty" role="status">Private conversation for your selected Account.</p> : null}
+    {channel ? <p className="papyrus-console__empty" role="status">Private conversation for this newsroom.</p> : null}
     {!channel && !loading ? <div className="papyrus-console__access" role="alert">
-      {error === "chat_identity_connection_required" ? <>
-        <strong>Connect your publishing account</strong>
-        {connectionNotice ? <span>{connectionNotice}</span> : null}
-        <span>Continue with the same Google account you use in the newsroom, then choose the Account for this private conversation.</span>
-        <button className="papyrus-console__new-session" disabled={connecting} onClick={() => void connect()} type="button">{connecting ? "Connecting…" : "Connect publishing account"}</button>
-      </> : accountState?.status === "signedIn" ? <>
-        <strong>{accountState.publishingAccounts.length === 0 ? "Chat access is unavailable" : "Choose your publishing Account"}</strong>
-        {accountState.publishingAccounts.length === 0 ? <>
-          <span>None of your Accounts is enabled for this publication. Publication setup must be resolved before you can chat.</span>
-          <span>You can return to the newsroom while this is resolved. Check again after access has been corrected.</span>
-          <button className="papyrus-console__new-session" onClick={() => void openConversation()} type="button">Check again</button>
-        </> : accountState.publishingAccounts.map(account => <button className="papyrus-console__new-session" disabled={connecting} key={account.accountId} onClick={() => void chooseAccount(account.accountId)} type="button">{account.name ?? account.accountId}</button>)}
-        {error !== "publishing_account_required" ? <span>{error}</span> : null}
-      </> : <>
-        <strong>Private chat could not be opened.</strong>
-        <span>{error === "sign_in_required" ? "Your newsroom session has expired. Return to the newsroom and sign in from the account menu, then retry." : error === "chat_account_access_denied" ? "Your access to this conversation has changed. Retry to check your current access." : error === "publishing_account_required" ? "Publishing Account access could not be checked. Retry when your connection is available." : error}</span>
-        <button className="papyrus-console__new-session" onClick={() => void openConversation()} type="button">Retry</button>
-      </>}
+      <strong>Private chat could not be opened.</strong>
+      <span>{error === "sign_in_required" ? "Your newsroom session has expired. Return to the newsroom and sign in from the account menu, then retry." : error === "chat_account_access_denied" ? "Your access to this conversation has changed. Retry to check your current access." : error}</span>
+      <button className="papyrus-console__new-session" onClick={() => void openConversation()} type="button">Retry</button>
       <button className="papyrus-console__new-session" onClick={onClose} type="button">Back to newsroom</button>
     </div> : <PapyrusConsoleConversation
       messages={conversationMessages}
@@ -202,7 +161,7 @@ export function PapyrusPrivateChatPanel({ onClose }: { onClose: () => void }) {
       onSendMessage={sendMessage}
       error={error}
       emptyState={loading ? <p className="papyrus-console__empty">Opening private conversation…</p> : (
-        <p className="papyrus-console__empty">This conversation is private to your selected Account and editor session.</p>
+        <p className="papyrus-console__empty">This conversation is private to you in this newsroom.</p>
       )}
     />}
   </div>;

package/lib/newsroom-chat-identity.ts

@@ -3,7 +3,7 @@ import type { JwksCache } from "aws-jwt-verify/jwk";
 import type { NextRequest } from "next/server";
 import { readAmplifyOutputsFile } from "./amplify-outputs-path";
 
-export type NewsroomChatIdentity = { subject: string };
+export type NewsroomChatIdentity = { subject: string; issuer: string; clientId: string; expiresAt: number };
 export type NewsroomChatIdentityResolver = (request: NextRequest) => Promise<NewsroomChatIdentity | null>;
 
 export function newsroomChatIdentityResolver(
@@ -21,7 +21,7 @@ export function newsroomChatIdentityResolver(
     if (!token) return null;
     try {
       const claims = await verifier.verify(token);
-      return { subject: claims.sub };
+      return { subject: claims.sub, issuer: claims.iss, clientId: auth.user_pool_client_id, expiresAt: claims.exp };
     } catch {
       return null;
     }

package/lib/papyrus-hosted-chat.ts

@@ -2,52 +2,35 @@ import { resolveNewsroomChatIdentity, type NewsroomChatIdentityResolver } from "
 import { createHash } from "node:crypto";
 import type { EmbeddedChatAppDependencies } from "chatticus/chat-server";
 import type { NextRequest } from "next/server";
-import {
-  ProspectusAccountsError,
-  authorizeSignedInPersonForAccount,
-} from "./prospectus-site-identity";
-import {
-  resolveProspectusSignInRuntime,
-  signedInProspectusSession,
-  type ProspectusSignInRuntime,
-} from "./prospectus-session";
-import { prospectusSiteProduct, publishingAccountsForSite } from "./prospectus-publication-access";
 import { publicSiteOrigin } from "./site-origin-value";
 
 const NO_STORE_HEADERS = { "cache-control": "no-store" };
 
 export interface PapyrusChatScope {
-  siteProduct: string;
-  accountId: string;
-  personId: string;
   tenantId: string;
   editorId: string;
 }
 
 export interface PapyrusHostedChatOptions {
   resolveNewsroomIdentity?: NewsroomChatIdentityResolver;
-  resolveRuntime?: (siteOrigin: string) => Promise<ProspectusSignInRuntime | null>;
   resolvePrivateDependencies?: () => Promise<EmbeddedChatAppDependencies | null>;
   privateChatEnabled?: boolean;
-  siteProduct?: string | null;
   environment?: Record<string, string | undefined>;
   nowInSeconds?: () => number;
 }
 
-function siteAndAccountKey(siteProduct: string, accountId: string): string {
-  return createHash("sha256").update(JSON.stringify([siteProduct, accountId])).digest("hex");
+/** A new namespace: never aliases Account-scoped or legacy transcripts. */
+export function derivePapyrusChatScope(publicationNamespace: string, issuer: string, subject: string): PapyrusChatScope {
+  const tenantHash = createHash("sha256").update(JSON.stringify(["newsroom-v1", publicationNamespace, issuer])).digest("hex");
+  const editorHash = createHash("sha256").update(JSON.stringify(["newsroom-v1", publicationNamespace, issuer, subject])).digest("hex");
+  return { tenantId: `papyrus-newsroom-v1-${tenantHash.slice(0, 40)}`, editorId: `papyrus-newsroom-editor-v1-${editorHash.slice(0, 40)}` };
 }
 
-export function derivePapyrusChatScope(siteProduct: string, accountId: string, personId: string): PapyrusChatScope {
-  const tenantHash = siteAndAccountKey(siteProduct, accountId);
-  const editorHash = createHash("sha256").update(JSON.stringify([siteProduct, accountId, personId])).digest("hex");
-  return {
-    siteProduct,
-    personId,
-    accountId,
-    tenantId: `papyrus-${tenantHash.slice(0, 40)}`,
-    editorId: `papyrus-editor-${editorHash.slice(0, 40)}`,
-  };
+/** Existing server storage resources bind the publication, independently of request hosts or claims. */
+function publicationNamespace(environment: Record<string, string | undefined>, clientId: string): string | null {
+  const bucket = environment.PAPYRUS_CHAT_SESSION_BUCKET?.trim();
+  const table = environment.PAPYRUS_CHAT_MESSAGING_TABLE?.trim();
+  return bucket && table ? JSON.stringify([bucket, table, clientId]) : null;
 }
 
 type ResolvedPapyrusPrincipal = {
@@ -61,71 +44,24 @@ type ResolvedPapyrusPrincipal = {
 
 async function principalForRequest(
   request: NextRequest,
-  operation: "console:read" | "console:write",
   options: PapyrusHostedChatOptions,
-): Promise<{ principal: ResolvedPapyrusPrincipal | null; status: number; error?: string }> {
-  const environment = options.environment ?? process.env;
-  const siteProduct = options.siteProduct !== undefined ? options.siteProduct : prospectusSiteProduct(environment);
-  if (!siteProduct) return { principal: null, status: 503 };
-
-  let runtime: ProspectusSignInRuntime | null;
-  try {
-    runtime = await (options.resolveRuntime ?? resolveProspectusSignInRuntime)(publicSiteOrigin(request, environment));
-  } catch {
-    return { principal: null, status: 503 };
-  }
-  if (!runtime) return { principal: null, status: 503 };
-
-  let newsroomIdentity;
+): Promise<{ principal: ResolvedPapyrusPrincipal | null; status: number; expiresAt?: number }> {
+  let identity;
   try {
-    newsroomIdentity = await (options.resolveNewsroomIdentity ?? resolveNewsroomChatIdentity)(request);
+    identity = await (options.resolveNewsroomIdentity ?? resolveNewsroomChatIdentity)(request);
   } catch {
     return { principal: null, status: 503 };
   }
-  if (!newsroomIdentity) return { principal: null, status: 401 };
-  const nowInSeconds = options.nowInSeconds?.() ?? Math.floor(Date.now() / 1000);
-  const session = signedInProspectusSession(request, runtime.sealingSecret, nowInSeconds);
-  if (!session || !Number.isFinite(session.accessTokenExpiresAt) || session.accessTokenExpiresAt <= nowInSeconds) {
-    return { principal: null, status: 409, error: "chat_identity_connection_required" };
-  }
-  if (session.newsroomSubject !== newsroomIdentity.subject) {
-    return { principal: null, status: 409, error: "chat_identity_connection_required" };
-  }
-  if (!session.selectedAccountId) return { principal: null, status: 409, error: "publishing_account_required" };
-
-  try {
-    const directory = await runtime.accounts.accountDirectory(session.accessToken);
-    if (directory.person?.id !== session.personId) return { principal: null, status: 401 };
-    if (!publishingAccountsForSite(directory.accounts, siteProduct).some((account) => account.accountId === session.selectedAccountId)) {
-      return { principal: null, status: 403 };
-    }
-    const authorization = await authorizeSignedInPersonForAccount(
-      runtime.accounts,
-      session.accessToken,
-      session.selectedAccountId,
-      operation,
-    );
-    if (authorization.personId !== session.personId || authorization.accountId !== session.selectedAccountId || authorization.operation !== operation) {
-      return { principal: null, status: 403 };
-    }
-    const scope = derivePapyrusChatScope(siteProduct, session.selectedAccountId, session.personId);
-    return {
-      principal: {
-        kind: "user",
-        tenantId: scope.tenantId,
-        userId: scope.editorId,
-        workerId: null,
-        organizationStatus: "enabled",
-        role: "member",
-      },
-      status: 200,
-    };
-  } catch (error) {
-    if (error instanceof ProspectusAccountsError && (error.status === 401 || error.status === 403)) {
-      return { principal: null, status: error.status };
-    }
-    return { principal: null, status: 503 };
-  }
+  const now = options.nowInSeconds?.() ?? Math.floor(Date.now() / 1000);
+  if (!identity || !identity.subject || !identity.issuer || !identity.clientId || !Number.isFinite(identity.expiresAt) || identity.expiresAt <= now) return { principal: null, status: 401 };
+  const namespace = publicationNamespace(options.environment ?? process.env, identity.clientId);
+  if (!namespace) return { principal: null, status: 503 };
+  const scope = derivePapyrusChatScope(namespace, identity.issuer, identity.subject);
+  return {
+    principal: { kind: "user", tenantId: scope.tenantId, userId: scope.editorId, workerId: null, organizationStatus: "enabled", role: "member" },
+    status: 200,
+    expiresAt: identity.expiresAt,
+  };
 }
 
 function jsonFailure(status: number, error: string): Response {
@@ -175,8 +111,8 @@ export async function handlePapyrusHostedChatRequest(
   const privateChatEnabled = options.privateChatEnabled ?? environment.PAPYRUS_PRIVATE_CHAT_ENABLED === "true";
   if (!privateChatEnabled) return jsonFailure(404, "private_chat_disabled");
 
-  const authorization = await principalForRequest(request, request.method === "POST" ? "console:write" : "console:read", options);
-  if (!authorization.principal) return jsonFailure(authorization.status, authorization.error ?? (authorization.status === 401 ? "sign_in_required" : authorization.status === 403 ? "chat_account_access_denied" : "chat_runtime_unavailable"));
+  const authorization = await principalForRequest(request, options);
+  if (!authorization.principal) return jsonFailure(authorization.status, (authorization.status === 401 ? "sign_in_required" : authorization.status === 403 ? "chat_account_access_denied" : "chat_runtime_unavailable"));
 
   let dependencies: EmbeddedChatAppDependencies | null;
   try {
@@ -226,5 +162,38 @@ export async function handlePapyrusHostedChatRequest(
     ...dependencies,
     resolvePrincipal: async () => authorization.principal,
   });
-  return app.fetch(forwarded);
+  const response = await app.fetch(forwarded);
+  if (path[0] !== "turns" || path[2] !== "stream" || !response.ok || !response.body) return response;
+  const remaining = (authorization.expiresAt! - (options.nowInSeconds?.() ?? Date.now() / 1000)) * 1000;
+  return expireChatStream(response, remaining);
+}
+
+/** End an established stream at JWT expiry; reconnect must pass current authorization again. */
+export function expireChatStream(response: Response, remainingMilliseconds: number): Response {
+  if (!response.body) return response;
+  const reader = response.body.getReader();
+  let closed = false;
+  let timer: ReturnType<typeof setTimeout>;
+  const body = new ReadableStream<Uint8Array>({
+    start(controller) {
+      timer = setTimeout(() => {
+        if (closed) return;
+        closed = true;
+        controller.close();
+        void reader.cancel().catch(() => {});
+      }, Math.max(0, Math.min(remainingMilliseconds, 2_147_483_647)));
+    },
+    async pull(controller) {
+      try {
+        const next = await reader.read();
+        if (closed) return;
+        if (next.done) { closed = true; clearTimeout(timer); controller.close(); }
+        else controller.enqueue(next.value);
+      } catch (error) {
+        if (!closed) { closed = true; clearTimeout(timer); controller.error(error); }
+      }
+    },
+    async cancel(reason) { closed = true; clearTimeout(timer); await reader.cancel(reason); },
+  });
+  return new Response(body, { status: response.status, headers: response.headers });
 }

package/lib/papyrus-private-chat-client.ts

@@ -31,6 +31,8 @@ async function requestJson<T>(path: string, init: RequestInit, fetcher: PapyrusP
   });
   const payload = await response.json().catch(() => null) as Record<string, unknown> | null;
   if (!response.ok) {
+    if (response.status === 401) throw new Error("sign_in_required");
+    if (response.status === 403) throw new Error("chat_account_access_denied");
     const error = typeof payload?.error === "string" ? payload.error
       : typeof payload?.detail === "string" ? payload.detail
         : `Private chat request failed (${response.status}).`;
@@ -40,7 +42,7 @@ async function requestJson<T>(path: string, init: RequestInit, fetcher: PapyrusP
   return payload as T;
 }
 
-/** Open the current editor's server-derived private channel using the verified newsroom identity and connected account session. */
+/** Open the current editor's server-derived private channel using the verified publication-local newsroom identity. */
 export async function openPapyrusPrivateChat(fetcher: PapyrusPrivateChatFetch = newsroomChatFetch): Promise<PapyrusPrivateChatChannel> {
   const result = await requestJson<PapyrusPrivateChatChannel>("private-channel", { method: "POST" }, fetcher);
   if (!result.channel_id?.trim() || !Array.isArray(result.participants)) {

package/package.json

@@ -461,7 +461,7 @@
       "optional": true
     }
   },
-  "version": "5.41.5",
+  "version": "5.41.6",
   "dependencies": {
     "@aws-amplify/adapter-nextjs": "^1.7.3",
     "@aws-crypto/sha256-js": "5.2.0",

package/routes.manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "5.41.5",
+  "version": "5.41.6",
   "routes": [
     {
       "file": "app/%5F_preview/[[...path]]/route.ts",