@anthusai/papyrus 5.43.0-next.45 → 5.43.0-next.46

package/amplify/data/resource.js

@@ -1670,6 +1670,9 @@ const schema = a.schema({
         authorSub: a.string(),
         authorUserProfileId: a.id(),
         authorLabel: a.string(),
+        editedAt: a.datetime(),
+        deletedAt: a.datetime(),
+        deletedBySub: a.string(),
         threadId: a.id(),
         parentMessageId: a.id(),
         sequenceNumber: a.integer(),
@@ -1704,8 +1707,12 @@ const schema = a.schema({
         index("searchVisibility").sortKeys(["createdAt"]).name("messagesBySearchVisibilityCreatedAt").queryField("listMessagesBySearchVisibilityAndCreatedAt"),
     ])
         .authorization((allow) => [
-        allow.groups(categoryWriteGroups).to(categoryAppendOnlyOperations),
+        // One rule per group (a group may appear once per model): editors read and add; admins also delete, for moderation.
+        allow.group("editor").to(categoryAppendOnlyOperations),
+        allow.group(adminGroup).to(["read", "create", "delete"]),
         allow.authenticated("identityPool").to(["read", "create", "update"]),
+        // Messages belong to their author: the author edits (and soft-deletes) their own, and only an admin can remove someone else's.
+        allow.ownerDefinedIn("authorSub").identityClaim("sub").to(["read", "update", "delete"]),
     ]),
     MessageThread: a
         .model({

package/amplify/data/resource.ts

@@ -1786,6 +1786,9 @@ const schema = a.schema({
       authorSub: a.string(),
       authorUserProfileId: a.id(),
       authorLabel: a.string(),
+      editedAt: a.datetime(),
+      deletedAt: a.datetime(),
+      deletedBySub: a.string(),
       threadId: a.id(),
       parentMessageId: a.id(),
       sequenceNumber: a.integer(),
@@ -1820,8 +1823,12 @@ const schema = a.schema({
       index("searchVisibility").sortKeys(["createdAt"]).name("messagesBySearchVisibilityCreatedAt").queryField("listMessagesBySearchVisibilityAndCreatedAt"),
     ])
     .authorization((allow) => [
-      allow.groups(categoryWriteGroups).to(categoryAppendOnlyOperations),
+      // One rule per group (a group may appear once per model): editors read and add; admins also delete, for moderation.
+      allow.group("editor").to(categoryAppendOnlyOperations),
+      allow.group(adminGroup).to(["read", "create", "delete"]),
       allow.authenticated("identityPool").to(["read", "create", "update"]),
+      // Messages belong to their author: the author edits (and soft-deletes) their own, and only an admin can remove someone else's.
+      allow.ownerDefinedIn("authorSub").identityClaim("sub").to(["read", "update", "delete"]),
     ]),
 
   MessageThread: a

package/amplify/data/schema.js

@@ -1573,6 +1573,9 @@ function buildBaseDefinitions(includeEditions) {
             authorSub: a.string(),
             authorUserProfileId: a.id(),
             authorLabel: a.string(),
+            editedAt: a.datetime(),
+            deletedAt: a.datetime(),
+            deletedBySub: a.string(),
             threadId: a.id(),
             parentMessageId: a.id(),
             sequenceNumber: a.integer(),
@@ -1607,7 +1610,11 @@ function buildBaseDefinitions(includeEditions) {
             index("searchVisibility").sortKeys(["createdAt"]).name("messagesBySearchVisibilityCreatedAt").queryField("listMessagesBySearchVisibilityAndCreatedAt"),
         ])
             .authorization((allow) => [
-            allow.groups(categoryWriteGroups).to(categoryAppendOnlyOperations),
+            // One rule per group (a group may appear once per model): editors read and add; admins also delete, for moderation.
+            allow.group("editor").to(categoryAppendOnlyOperations),
+            allow.group(adminGroup).to(["read", "create", "delete"]),
+            // Messages belong to their author: the author edits (and soft-deletes) their own, and only an admin can remove someone else's.
+            allow.ownerDefinedIn("authorSub").identityClaim("sub").to(["read", "update", "delete"]),
         ]),
         MessageThread: realtimeModel({
             id: a.id().required(),

package/amplify/data/schema.ts

@@ -1687,6 +1687,9 @@ const definitions = {
       authorSub: a.string(),
       authorUserProfileId: a.id(),
       authorLabel: a.string(),
+      editedAt: a.datetime(),
+      deletedAt: a.datetime(),
+      deletedBySub: a.string(),
       threadId: a.id(),
       parentMessageId: a.id(),
       sequenceNumber: a.integer(),
@@ -1721,7 +1724,11 @@ const definitions = {
       index("searchVisibility").sortKeys(["createdAt"]).name("messagesBySearchVisibilityCreatedAt").queryField("listMessagesBySearchVisibilityAndCreatedAt"),
     ])
     .authorization((allow) => [
-      allow.groups(categoryWriteGroups).to(categoryAppendOnlyOperations),
+      // One rule per group (a group may appear once per model): editors read and add; admins also delete, for moderation.
+      allow.group("editor").to(categoryAppendOnlyOperations),
+      allow.group(adminGroup).to(["read", "create", "delete"]),
+      // Messages belong to their author: the author edits (and soft-deletes) their own, and only an admin can remove someone else's.
+      allow.ownerDefinedIn("authorSub").identityClaim("sub").to(["read", "update", "delete"]),
     ]),
 
   MessageThread: realtimeModel({

package/package.json

@@ -516,7 +516,7 @@
       "optional": true
     }
   },
-  "version": "5.43.0-next.45",
+  "version": "5.43.0-next.46",
   "dependencies": {
     "@aws-amplify/adapter-nextjs": "^1.7.3",
     "@aws-crypto/sha256-js": "5.2.0",

package/routes.manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "5.43.0-next.45",
+  "version": "5.43.0-next.46",
   "routes": [
     {
       "file": "app/%5F_preview/[[...path]]/route.ts",