@anthusai/papyrus 5.43.0-next.49 → 5.43.0-next.50

package/amplify/data/message-actions.js

@@ -0,0 +1,68 @@
+import { a } from "@aws-amplify/backend";
+/**
+ * Messages belong to their author, and the backend says so. The browser cannot create, edit or delete a Message through the
+ * model (editors and admins only read it); it calls these four mutations, whose resolvers stamp the author from the signed-in
+ * identity and check ownership against the stored `authorSub` in the same DynamoDB write. `renameThread` does the same for a
+ * conversation's title. Functions and IAM callers (the router, procedures, the console responder, email, Slack) write the
+ * model directly with their own grants, as before.
+ *
+ * Each resolver is one self-contained file (AppSync takes a single file and offers `@aws-appsync/utils` only).
+ */
+const people = (allow) => [allow.group("editor"), allow.group("admin")];
+const adminsOnly = (allow) => [allow.group("admin")];
+const onMessages = (entry) => a.handler.custom({ dataSource: a.ref("Message"), entry });
+const onThreads = (entry) => a.handler.custom({ dataSource: a.ref("MessageThread"), entry });
+export const messageActionsSchemaDefinitions = {
+    postMessage: a
+        .mutation()
+        .arguments({
+        id: a.id().required(),
+        threadId: a.id().required(),
+        content: a.string(),
+        summary: a.string(),
+        parentMessageId: a.id(),
+        sequenceNumber: a.integer(),
+        messageKind: a.string().required(),
+        messageDomain: a.string().required(),
+        messageType: a.string(),
+        role: a.string(),
+        source: a.string(),
+        authorLabel: a.string(),
+        semanticLayer: a.string(),
+        searchVisibility: a.string(),
+        responseTarget: a.string(),
+        responseStatus: a.string(),
+        responseOwner: a.string(),
+        responseStartedAt: a.datetime(),
+        responseCompletedAt: a.datetime(),
+        metadata: a.json(),
+        newsroomFeedKey: a.string(),
+    })
+        .returns(a.ref("Message"))
+        .authorization(people)
+        .handler(onMessages("./resolvers/post-message.js")),
+    editMessage: a
+        .mutation()
+        .arguments({ id: a.id().required(), content: a.string().required(), summary: a.string() })
+        .returns(a.ref("Message"))
+        .authorization(people)
+        .handler(onMessages("./resolvers/edit-message.js")),
+    deleteOwnMessage: a
+        .mutation()
+        .arguments({ id: a.id().required() })
+        .returns(a.ref("Message"))
+        .authorization(people)
+        .handler(onMessages("./resolvers/delete-own-message.js")),
+    moderateMessage: a
+        .mutation()
+        .arguments({ id: a.id().required() })
+        .returns(a.ref("Message"))
+        .authorization(adminsOnly)
+        .handler(onMessages("./resolvers/moderate-message.js")),
+    renameThread: a
+        .mutation()
+        .arguments({ id: a.id().required(), title: a.string().required() })
+        .returns(a.ref("MessageThread"))
+        .authorization(people)
+        .handler(onThreads("./resolvers/rename-thread.js")),
+};

package/amplify/data/message-actions.ts

@@ -0,0 +1,70 @@
+import { a } from "@aws-amplify/backend";
+
+/**
+ * Messages belong to their author, and the backend says so. The browser cannot create, edit or delete a Message through the
+ * model (editors and admins only read it); it calls these four mutations, whose resolvers stamp the author from the signed-in
+ * identity and check ownership against the stored `authorSub` in the same DynamoDB write. `renameThread` does the same for a
+ * conversation's title. Functions and IAM callers (the router, procedures, the console responder, email, Slack) write the
+ * model directly with their own grants, as before.
+ *
+ * Each resolver is one self-contained file (AppSync takes a single file and offers `@aws-appsync/utils` only).
+ */
+const people = (allow: any) => [allow.group("editor"), allow.group("admin")];
+const adminsOnly = (allow: any) => [allow.group("admin")];
+const onMessages = (entry: string) => a.handler.custom({ dataSource: a.ref("Message"), entry });
+const onThreads = (entry: string) => a.handler.custom({ dataSource: a.ref("MessageThread"), entry });
+
+export const messageActionsSchemaDefinitions = {
+  postMessage: a
+    .mutation()
+    .arguments({
+      id: a.id().required(),
+      threadId: a.id().required(),
+      content: a.string(),
+      summary: a.string(),
+      parentMessageId: a.id(),
+      sequenceNumber: a.integer(),
+      messageKind: a.string().required(),
+      messageDomain: a.string().required(),
+      messageType: a.string(),
+      role: a.string(),
+      source: a.string(),
+      authorLabel: a.string(),
+      semanticLayer: a.string(),
+      searchVisibility: a.string(),
+      responseTarget: a.string(),
+      responseStatus: a.string(),
+      responseOwner: a.string(),
+      responseStartedAt: a.datetime(),
+      responseCompletedAt: a.datetime(),
+      metadata: a.json(),
+      newsroomFeedKey: a.string(),
+    })
+    .returns(a.ref("Message"))
+    .authorization(people)
+    .handler(onMessages("./resolvers/post-message.js")),
+  editMessage: a
+    .mutation()
+    .arguments({ id: a.id().required(), content: a.string().required(), summary: a.string() })
+    .returns(a.ref("Message"))
+    .authorization(people)
+    .handler(onMessages("./resolvers/edit-message.js")),
+  deleteOwnMessage: a
+    .mutation()
+    .arguments({ id: a.id().required() })
+    .returns(a.ref("Message"))
+    .authorization(people)
+    .handler(onMessages("./resolvers/delete-own-message.js")),
+  moderateMessage: a
+    .mutation()
+    .arguments({ id: a.id().required() })
+    .returns(a.ref("Message"))
+    .authorization(adminsOnly)
+    .handler(onMessages("./resolvers/moderate-message.js")),
+  renameThread: a
+    .mutation()
+    .arguments({ id: a.id().required(), title: a.string().required() })
+    .returns(a.ref("MessageThread"))
+    .authorization(people)
+    .handler(onThreads("./resolvers/rename-thread.js")),
+};

package/amplify/data/resolvers/delete-own-message.js

@@ -0,0 +1,30 @@
+// deleteOwnMessage: the author deletes their own Message. A soft delete: the Message stays (replies keep their place) marked
+// deleted, with when and by whom. Nothing is removed.
+import { util } from "@aws-appsync/utils";
+import * as ddb from "@aws-appsync/utils/dynamodb";
+
+export function request(ctx) {
+  const identity = ctx.identity;
+  if (!identity || !identity.sub) util.error("Sign in to delete a message.", "Unauthorized");
+  const now = util.time.nowISO8601();
+  return ddb.update({
+    key: { id: ctx.args.id },
+    update: {
+      status: ddb.operations.replace("deleted"),
+      deletedAt: ddb.operations.replace(now),
+      deletedBySub: ddb.operations.replace(identity.sub),
+      updatedAt: ddb.operations.replace(now),
+    },
+    condition: { authorSub: { eq: identity.sub }, status: { ne: "deleted" } },
+  });
+}
+
+export function response(ctx) {
+  if (ctx.error) {
+    if (ctx.error.type === "DynamoDB:ConditionalCheckFailedException") {
+      util.error("Only the author can delete their own message, and it may already be deleted.", "Unauthorized");
+    }
+    util.error(ctx.error.message, ctx.error.type);
+  }
+  return ctx.result;
+}

package/amplify/data/resolvers/edit-message.js

@@ -0,0 +1,33 @@
+// editMessage: a person changes the text of their own Message, and no one else's. The condition is checked by DynamoDB against the
+// stored authorSub in the same write, so there is no window between the check and the change. A deleted Message cannot be edited.
+// Authorship cannot be reassigned: the update never touches authorSub.
+import { util } from "@aws-appsync/utils";
+import * as ddb from "@aws-appsync/utils/dynamodb";
+
+export function request(ctx) {
+  const identity = ctx.identity;
+  if (!identity || !identity.sub) util.error("Sign in to edit a message.", "Unauthorized");
+  const content = typeof ctx.args.content === "string" ? ctx.args.content.trim() : "";
+  if (!content) util.error("A message cannot be empty.", "BadRequest");
+  const now = util.time.nowISO8601();
+  return ddb.update({
+    key: { id: ctx.args.id },
+    update: {
+      content: ddb.operations.replace(content),
+      summary: ddb.operations.replace(ctx.args.summary ? ctx.args.summary : content.slice(0, 120)),
+      editedAt: ddb.operations.replace(now),
+      updatedAt: ddb.operations.replace(now),
+    },
+    condition: { authorSub: { eq: identity.sub }, status: { ne: "deleted" } },
+  });
+}
+
+export function response(ctx) {
+  if (ctx.error) {
+    if (ctx.error.type === "DynamoDB:ConditionalCheckFailedException") {
+      util.error("Only the author can edit a message, and a deleted message cannot be edited.", "Unauthorized");
+    }
+    util.error(ctx.error.message, ctx.error.type);
+  }
+  return ctx.result;
+}

package/amplify/data/resolvers/moderate-message.js

@@ -0,0 +1,32 @@
+// moderateMessage: an admin removes anyone's Message. The same soft delete as the author's, with no change to the text, and only
+// for the admin group (checked here as well as by the mutation's authorization).
+import { util } from "@aws-appsync/utils";
+import * as ddb from "@aws-appsync/utils/dynamodb";
+
+export function request(ctx) {
+  const identity = ctx.identity;
+  if (!identity || !identity.sub) util.error("Sign in to moderate a message.", "Unauthorized");
+  const groups = identity.groups || [];
+  if (groups.indexOf("admin") < 0) util.error("Only an admin can delete someone else's message.", "Unauthorized");
+  const now = util.time.nowISO8601();
+  return ddb.update({
+    key: { id: ctx.args.id },
+    update: {
+      status: ddb.operations.replace("deleted"),
+      deletedAt: ddb.operations.replace(now),
+      deletedBySub: ddb.operations.replace(identity.sub),
+      updatedAt: ddb.operations.replace(now),
+    },
+    condition: { id: { attributeExists: true }, status: { ne: "deleted" } },
+  });
+}
+
+export function response(ctx) {
+  if (ctx.error) {
+    if (ctx.error.type === "DynamoDB:ConditionalCheckFailedException") {
+      util.error("That message does not exist or is already deleted.", "NotFound");
+    }
+    util.error(ctx.error.message, ctx.error.type);
+  }
+  return ctx.result;
+}

package/amplify/data/resolvers/post-message.js

@@ -0,0 +1,68 @@
+// postMessage: the only way a person's Message is created. The author is the signed-in user (the identity's sub), whatever the
+// client sends: the mutation has no author argument, and a label is only a label. One DynamoDB PutItem that refuses to replace an
+// existing Message (ids are derived from the sequence number, so a lost race comes back as a conflict the caller retries).
+import { util } from "@aws-appsync/utils";
+import * as ddb from "@aws-appsync/utils/dynamodb";
+
+function clean(value) {
+  const out = {};
+  const keys = Object.keys(value);
+  for (let index = 0; index < keys.length; index++) {
+    const key = keys[index];
+    if (value[key] !== null && value[key] !== undefined) out[key] = value[key];
+  }
+  return out;
+}
+
+export function request(ctx) {
+  const identity = ctx.identity;
+  if (!identity || !identity.sub) util.error("Sign in to post a message.", "Unauthorized");
+  const args = ctx.args;
+  const content = typeof args.content === "string" ? args.content.trim() : "";
+  // A placeholder waiting for a responder (PENDING) may start empty; any other message needs text.
+  if (!content && args.responseStatus !== "PENDING") util.error("A message cannot be empty.", "BadRequest");
+  if (!args.id || !args.threadId) util.error("A message needs an id and a conversation.", "BadRequest");
+  const now = util.time.nowISO8601();
+  const claims = identity.claims || {};
+  const email = typeof claims.email === "string" ? claims.email : "";
+  const label = typeof args.authorLabel === "string" && args.authorLabel.trim() ? args.authorLabel.trim() : email ? email : "editor";
+  const item = clean({
+    __typename: "Message",
+    id: args.id,
+    messageKind: args.messageKind,
+    messageDomain: args.messageDomain,
+    status: "active",
+    summary: args.summary ? args.summary : content.slice(0, 120),
+    source: args.source,
+    authorSub: identity.sub,
+    authorLabel: label,
+    threadId: args.threadId,
+    parentMessageId: args.parentMessageId,
+    sequenceNumber: args.sequenceNumber,
+    role: args.role ? args.role : "human",
+    messageType: args.messageType,
+    content: content,
+    semanticLayer: args.semanticLayer,
+    searchVisibility: args.searchVisibility,
+    responseTarget: args.responseTarget,
+    responseStatus: args.responseStatus ? args.responseStatus : "COMPLETED",
+    responseOwner: args.responseOwner,
+    responseStartedAt: args.responseStartedAt,
+    responseCompletedAt: args.responseCompletedAt,
+    metadata: args.metadata,
+    createdAt: now,
+    updatedAt: now,
+    newsroomFeedKey: args.newsroomFeedKey,
+  });
+  return ddb.put({ key: { id: args.id }, item: item, condition: { id: { attributeExists: false } } });
+}
+
+export function response(ctx) {
+  if (ctx.error) {
+    if (ctx.error.type === "DynamoDB:ConditionalCheckFailedException") {
+      util.error("A message with this id already exists (conditional check failed); try again.", "Conflict");
+    }
+    util.error(ctx.error.message, ctx.error.type);
+  }
+  return ctx.result;
+}

package/amplify/data/resolvers/rename-thread.js

@@ -0,0 +1,28 @@
+// renameThread: the person who started a conversation, or an admin, gives it a new title. The browser's own update of a thread
+// cannot change the title (the field is read and create only), so this is the one way. Nothing else about the thread changes.
+import { util } from "@aws-appsync/utils";
+import * as ddb from "@aws-appsync/utils/dynamodb";
+
+export function request(ctx) {
+  const identity = ctx.identity;
+  if (!identity || !identity.sub) util.error("Sign in to rename a conversation.", "Unauthorized");
+  const title = typeof ctx.args.title === "string" ? ctx.args.title.trim() : "";
+  if (!title) util.error("A title cannot be empty.", "BadRequest");
+  const groups = identity.groups || [];
+  const isAdmin = groups.indexOf("admin") >= 0;
+  return ddb.update({
+    key: { id: ctx.args.id },
+    update: { title: ddb.operations.replace(title.slice(0, 120)) },
+    condition: isAdmin ? { id: { attributeExists: true } } : { createdBySub: { eq: identity.sub } },
+  });
+}
+
+export function response(ctx) {
+  if (ctx.error) {
+    if (ctx.error.type === "DynamoDB:ConditionalCheckFailedException") {
+      util.error("Only the person who started this conversation, or an admin, can rename it.", "Unauthorized");
+    }
+    util.error(ctx.error.message, ctx.error.type);
+  }
+  return ctx.result;
+}

package/amplify/data/resource.js

@@ -1726,12 +1726,11 @@ const schema = a.schema({
         index("searchVisibility").sortKeys(["createdAt"]).name("messagesBySearchVisibilityCreatedAt").queryField("listMessagesBySearchVisibilityAndCreatedAt"),
     ])
         .authorization((allow) => [
-        // One rule per group (a group may appear once per model): editors read and add; admins also delete, for moderation.
-        allow.group("editor").to(categoryAppendOnlyOperations),
-        allow.group(adminGroup).to(["read", "create", "delete"]),
+        // Messages belong to their author, and the backend stamps the author: people read Messages here and write them only through
+        // postMessage, editMessage, deleteOwnMessage and moderateMessage (message-actions.ts). Functions and IAM callers write directly.
+        allow.group("editor").to(["read"]),
+        allow.group(adminGroup).to(["read"]),
         allow.authenticated("identityPool").to(["read", "create", "update"]),
-        // Messages belong to their author: the author edits (and soft-deletes) their own, and only an admin can remove someone else's.
-        allow.ownerDefinedIn("authorSub").identityClaim("sub").to(["read", "update", "delete"]),
     ]),
     MessageThread: a
         .model({

package/amplify/data/resource.ts

@@ -1842,12 +1842,11 @@ const schema = a.schema({
       index("searchVisibility").sortKeys(["createdAt"]).name("messagesBySearchVisibilityCreatedAt").queryField("listMessagesBySearchVisibilityAndCreatedAt"),
     ])
     .authorization((allow) => [
-      // One rule per group (a group may appear once per model): editors read and add; admins also delete, for moderation.
-      allow.group("editor").to(categoryAppendOnlyOperations),
-      allow.group(adminGroup).to(["read", "create", "delete"]),
+      // Messages belong to their author, and the backend stamps the author: people read Messages here and write them only through
+      // postMessage, editMessage, deleteOwnMessage and moderateMessage (message-actions.ts). Functions and IAM callers write directly.
+      allow.group("editor").to(["read"]),
+      allow.group(adminGroup).to(["read"]),
       allow.authenticated("identityPool").to(["read", "create", "update"]),
-      // Messages belong to their author: the author edits (and soft-deletes) their own, and only an admin can remove someone else's.
-      allow.ownerDefinedIn("authorSub").identityClaim("sub").to(["read", "update", "delete"]),
     ]),
 
   MessageThread: a

package/amplify/data/schema.js

@@ -4,6 +4,7 @@ import { categoryAction } from "../functions/category-action/resource.js";
 import { editorialChecksSchemaDefinitions } from "../functions/editorial-checks/schema.js";
 import { automationViewSchemaDefinitions } from "../functions/automation-view/schema.js";
 import { proposalActionsSchemaDefinitions } from "../functions/proposal-actions/schema.js";
+import { messageActionsSchemaDefinitions } from "./message-actions.js";
 import { monitoringViewSchemaDefinitions } from "../functions/monitoring-view/schema.js";
 import { contentActions } from "../functions/content-actions/resource.js";
 import { knowledgeQuery } from "../functions/knowledge-query/resource.js";
@@ -1629,23 +1630,24 @@ function buildBaseDefinitions(includeEditions) {
             index("searchVisibility").sortKeys(["createdAt"]).name("messagesBySearchVisibilityCreatedAt").queryField("listMessagesBySearchVisibilityAndCreatedAt"),
         ])
             .authorization((allow) => [
-            // One rule per group (a group may appear once per model): editors read and add; admins also delete, for moderation.
-            allow.group("editor").to(categoryAppendOnlyOperations),
-            allow.group(adminGroup).to(["read", "create", "delete"]),
-            // Messages belong to their author: the author edits (and soft-deletes) their own, and only an admin can remove someone else's.
-            allow.ownerDefinedIn("authorSub").identityClaim("sub").to(["read", "update", "delete"]),
+            // Messages belong to their author, and the backend stamps the author: people read Messages here and write them only through
+            // postMessage, editMessage, deleteOwnMessage and moderateMessage (message-actions.ts). Functions and IAM callers write directly.
+            allow.group("editor").to(["read"]),
+            allow.group(adminGroup).to(["read"]),
         ]),
         MessageThread: realtimeModel({
             id: a.id().required(),
             threadKind: a.string().required(),
             status: a.string().required(),
-            title: a.string().required(),
+            // The title and the creator are set when a conversation is created and read afterwards; a title changes only through
+            // renameThread (its creator or an admin), and the creator never changes.
+            title: a.string().required().authorization((allow) => [allow.group("editor").to(["read", "create"]), allow.group(adminGroup).to(["read", "create"])]),
             summary: a.string(),
             primaryAnchorKind: a.string(),
             primaryAnchorId: a.id(),
             primaryAnchorLineageId: a.id(),
             primaryAnchorKey: a.string(),
-            createdBySub: a.string(),
+            createdBySub: a.string().authorization((allow) => [allow.group("editor").to(["read", "create"]), allow.group(adminGroup).to(["read", "create"])]),
             createdByUserProfileId: a.id(),
             createdByLabel: a.string(),
             messageCount: a.integer(),
@@ -2130,6 +2132,7 @@ function buildBaseDefinitions(includeEditions) {
         ...monitoringViewSchemaDefinitions,
         ...automationViewSchemaDefinitions,
         ...proposalActionsSchemaDefinitions,
+        ...messageActionsSchemaDefinitions,
     };
     if (!includeEditions) {
         const mutableDefinitions = definitions;

package/amplify/data/schema.ts

@@ -4,6 +4,7 @@ import { categoryAction } from "../functions/category-action/resource";
 import { editorialChecksSchemaDefinitions } from "../functions/editorial-checks/schema";
 import { automationViewSchemaDefinitions } from "../functions/automation-view/schema";
 import { proposalActionsSchemaDefinitions } from "../functions/proposal-actions/schema";
+import { messageActionsSchemaDefinitions } from "./message-actions";
 import { monitoringViewSchemaDefinitions } from "../functions/monitoring-view/schema";
 import { contentActions } from "../functions/content-actions/resource";
 import { knowledgeQuery } from "../functions/knowledge-query/resource";
@@ -1743,24 +1744,25 @@ const definitions = {
       index("searchVisibility").sortKeys(["createdAt"]).name("messagesBySearchVisibilityCreatedAt").queryField("listMessagesBySearchVisibilityAndCreatedAt"),
     ])
     .authorization((allow) => [
-      // One rule per group (a group may appear once per model): editors read and add; admins also delete, for moderation.
-      allow.group("editor").to(categoryAppendOnlyOperations),
-      allow.group(adminGroup).to(["read", "create", "delete"]),
-      // Messages belong to their author: the author edits (and soft-deletes) their own, and only an admin can remove someone else's.
-      allow.ownerDefinedIn("authorSub").identityClaim("sub").to(["read", "update", "delete"]),
+      // Messages belong to their author, and the backend stamps the author: people read Messages here and write them only through
+      // postMessage, editMessage, deleteOwnMessage and moderateMessage (message-actions.ts). Functions and IAM callers write directly.
+      allow.group("editor").to(["read"]),
+      allow.group(adminGroup).to(["read"]),
     ]),
 
   MessageThread: realtimeModel({
       id: a.id().required(),
       threadKind: a.string().required(),
       status: a.string().required(),
-      title: a.string().required(),
+      // The title and the creator are set when a conversation is created and read afterwards; a title changes only through
+      // renameThread (its creator or an admin), and the creator never changes.
+      title: a.string().required().authorization((allow) => [allow.group("editor").to(["read", "create"]), allow.group(adminGroup).to(["read", "create"])]),
       summary: a.string(),
       primaryAnchorKind: a.string(),
       primaryAnchorId: a.id(),
       primaryAnchorLineageId: a.id(),
       primaryAnchorKey: a.string(),
-      createdBySub: a.string(),
+      createdBySub: a.string().authorization((allow) => [allow.group("editor").to(["read", "create"]), allow.group(adminGroup).to(["read", "create"])]),
       createdByUserProfileId: a.id(),
       createdByLabel: a.string(),
       messageCount: a.integer(),
@@ -2260,6 +2262,7 @@ const definitions = {
   ...monitoringViewSchemaDefinitions,
   ...automationViewSchemaDefinitions,
   ...proposalActionsSchemaDefinitions,
+  ...messageActionsSchemaDefinitions,
 };
 if (!includeEditions) {
   const mutableDefinitions = definitions as Record<string, unknown>;

package/components/news-desk-taxonomy-client.ts

@@ -60,6 +60,7 @@ import {
   type ConversationAnchor,
   type ConversationMessage,
 } from "../lib/conversation";
+import { postMessageArguments, postMessageMutation } from "../lib/post-message";
 import { legacyStageKeysToLoad, type ContentItemVersionRecord } from "../lib/content-item-lifecycle";
 import { getContentItemStageDefinitions } from "../lib/site-brand";
 import { DOCTRINE_DEFINITIONS, getCategoryDoctrineDefinitions, type DoctrineCategory } from "../lib/doctrine";
@@ -220,40 +221,7 @@ const UPDATE_MESSAGE_THREAD_MUTATION = `
   }
 `;
 
-const CREATE_MESSAGE_MUTATION = `
-  mutation CreateMessage($input: CreateMessageInput!) {
-    createMessage(input: $input) {
-      id
-      messageKind
-      messageDomain
-      status
-      summary
-      source
-      importRunId
-      authorSub
-      authorUserProfileId
-      authorLabel
-      threadId
-      parentMessageId
-      sequenceNumber
-      role
-      messageType
-      content
-      semanticLayer
-      searchVisibility
-      responseTarget
-      responseStatus
-      responseOwner
-      responseStartedAt
-      responseCompletedAt
-      responseError
-      metadata
-      createdAt
-      updatedAt
-      newsroomFeedKey
-    }
-  }
-`;
+const POST_MESSAGE_SELECTION = "id messageKind messageDomain status summary source importRunId authorSub authorUserProfileId authorLabel threadId parentMessageId sequenceNumber role messageType content semanticLayer searchVisibility responseTarget responseStatus responseOwner responseStartedAt responseCompletedAt responseError metadata createdAt updatedAt newsroomFeedKey";
 
 const UPDATE_MESSAGE_MUTATION = `
   mutation UpdateMessage($input: UpdateMessageInput!) {
@@ -1434,10 +1402,12 @@ async function appendMessageToThread(thread: MessageThreadRecord, build: (sequen
       // `createdAt` is part of the composite sort key of messagesByResponseTargetStatusCreatedAt, so AppSync refuses a Message that
       // sets it without `responseStatus`. A person's message waits on no responder: COMPLETED, as the Python message contract writes.
       built = { responseStatus: "COMPLETED", ...build(sequenceNumber, now) };
-      return runGraphql<{ createMessage?: MessageRecord | null }>(CREATE_MESSAGE_MUTATION, { input: built });
+      // The backend stamps the author from the signed-in identity (postMessage); nothing here names one.
+      const args = postMessageArguments(built as unknown as Record<string, unknown>);
+      return runGraphql<{ postMessage?: MessageRecord | null }>(postMessageMutation(args, POST_MESSAGE_SELECTION), args);
     },
   });
-  const createdMessage = normalizeMessageRecord(created.createMessage ?? built!);
+  const createdMessage = normalizeMessageRecord(created.postMessage ?? built!);
   const updated = await runGraphql<{ updateMessageThread?: MessageThreadRecord | null }>(
     UPDATE_MESSAGE_THREAD_MUTATION,
     {
@@ -1608,7 +1578,6 @@ export async function appendConversationMessage(input: {
     status: "active",
     summary: content.slice(0, 120),
     source: "newsroom.conversation",
-    authorSub: author.sub,
     authorLabel: author.label,
     threadId: thread.id,
     parentMessageId: input.parentMessageId?.trim() || null,

package/lib/console-chat-client.ts

@@ -3,6 +3,7 @@
 import { generateClient } from "aws-amplify/data";
 import type { Schema } from "../amplify/data/resource";
 import { configureAmplifyClient } from "../components/amplify-client-provider";
+import { postMessageArguments, postMessageMutation } from "./post-message";
 import { loadModelPayloadsForOwner, uploadModelPayloadForOwner } from "../components/news-desk-taxonomy-client";
 
 const USER_POOL_AUTH_MODE = "userPool";
@@ -190,14 +191,6 @@ const UPDATE_CONSOLE_THREAD = `
   }
 `;
 
-const CREATE_CONSOLE_MESSAGE_LEGACY = `
-  mutation CreateMessage($input: CreateMessageInput!) {
-    createMessage(input: $input) {
-      ${CONSOLE_MESSAGE_FIELDS_LEGACY}
-    }
-  }
-`;
-
 export type ConsoleChatThread = {
   id: string;
   threadKind: string;
@@ -383,79 +376,6 @@ function chooseMessageSelectionSet(schemaFields: Set<string> | null): string {
   return selected.join("\n  ");
 }
 
-function fieldValuesForCreateMessageInput(input: CreateConsoleMessageInput): Record<string, unknown> {
-  return {
-    id: input.id,
-    messageKind: input.messageKind,
-    messageDomain: input.messageDomain,
-    status: input.status,
-    summary: input.summary ?? truncateSummary(input.content ?? null),
-    source: input.source,
-    importRunId: null,
-    authorSub: null,
-    authorUserProfileId: input.authorUserProfileId ?? null,
-    authorLabel: input.authorLabel,
-    threadId: input.threadId ?? null,
-    parentMessageId: input.parentMessageId ?? null,
-    sequenceNumber: input.sequenceNumber ?? null,
-    role: input.role ?? null,
-    messageType: input.messageType ?? null,
-    semanticLayer: input.semanticLayer,
-    searchVisibility: input.searchVisibility,
-    responseTarget: input.responseTarget,
-    responseStatus: input.responseStatus ?? null,
-    responseOwner: input.responseOwner ?? null,
-    responseStartedAt: input.responseStartedAt ?? null,
-    responseCompletedAt: input.responseCompletedAt ?? null,
-    responseError: input.responseError ?? null,
-    metadata: input.metadata,
-    createdAt: input.createdAt,
-    updatedAt: input.updatedAt,
-    newsroomFeedKey: input.newsroomFeedKey,
-  };
-}
-
-function buildCreateMessageInputCandidates(
-  input: CreateConsoleMessageInput,
-  availableFields: Set<string>,
-): Record<string, unknown>[] {
-  const values = fieldValuesForCreateMessageInput(input);
-  const candidates: Record<string, unknown>[] = [];
-  const seen = new Set<string>();
-
-  const pushCandidate = (candidate: Record<string, unknown>) => {
-    const cleaned: Record<string, unknown> = {};
-    for (const [key, value] of Object.entries(candidate)) {
-      if (value !== undefined) cleaned[key] = value;
-    }
-    const signature = JSON.stringify(Object.keys(cleaned).sort().map((key) => [key, cleaned[key]]));
-    if (!seen.has(signature)) {
-      seen.add(signature);
-      candidates.push(cleaned);
-    }
-  };
-
-  if (availableFields.size) {
-    pushCandidate(sanitizeCreateMessageInput(input, availableFields));
-  } else {
-    pushCandidate(values);
-    pushCandidate({
-      id: values.id,
-      messageKind: values.messageKind,
-      messageDomain: values.messageDomain,
-      status: values.status,
-      summary: values.summary,
-      source: values.source,
-      authorLabel: values.authorLabel,
-      createdAt: values.createdAt,
-      updatedAt: values.updatedAt,
-      newsroomFeedKey: values.newsroomFeedKey,
-    });
-  }
-
-  return candidates;
-}
-
 async function loadConsoleSchemaSnapshot(): Promise<ConsoleSchemaSnapshot> {
   if (consoleSchemaSnapshot) return consoleSchemaSnapshot;
   if (consoleSchemaSnapshotPromise) return consoleSchemaSnapshotPromise;
@@ -540,70 +460,6 @@ function buildListMessagesQuery(
   `;
 }
 
-function sanitizeCreateMessageInput(
-  input: CreateConsoleMessageInput,
-  availableFields: Set<string>,
-): Record<string, unknown> {
-  const fieldValues: Record<string, unknown> = {
-    id: input.id,
-    messageKind: input.messageKind,
-    messageDomain: input.messageDomain,
-    status: input.status,
-    summary: input.summary ?? truncateSummary(input.content ?? null),
-    source: input.source,
-    importRunId: null,
-    authorSub: null,
-    authorUserProfileId: input.authorUserProfileId ?? null,
-    authorLabel: input.authorLabel,
-    threadId: input.threadId ?? null,
-    parentMessageId: input.parentMessageId ?? null,
-    sequenceNumber: input.sequenceNumber ?? null,
-    role: input.role ?? null,
-    messageType: input.messageType ?? null,
-    semanticLayer: input.semanticLayer,
-    searchVisibility: input.searchVisibility,
-    responseTarget: input.responseTarget,
-    responseStatus: input.responseStatus ?? null,
-    responseOwner: input.responseOwner ?? null,
-    responseStartedAt: input.responseStartedAt ?? null,
-    responseCompletedAt: input.responseCompletedAt ?? null,
-    responseError: input.responseError ?? null,
-    metadata: input.metadata,
-    createdAt: input.createdAt,
-    updatedAt: input.updatedAt,
-    newsroomFeedKey: input.newsroomFeedKey,
-  };
-
-  if (!availableFields.size) {
-    const conservativeFields = [
-      "id",
-      "messageKind",
-      "messageDomain",
-      "status",
-      "summary",
-      "source",
-      "authorLabel",
-      "createdAt",
-      "updatedAt",
-      "newsroomFeedKey",
-    ] as const;
-    const conservative: Record<string, unknown> = {};
-    for (const key of conservativeFields) {
-      const value = fieldValues[key];
-      if (value !== undefined) conservative[key] = value;
-    }
-    return conservative;
-  }
-
-  const sanitized: Record<string, unknown> = {};
-  for (const [key, value] of Object.entries(fieldValues)) {
-    if (!availableFields.has(key)) continue;
-    if (value === undefined) continue;
-    sanitized[key] = value;
-  }
-  return sanitized;
-}
-
 function truncateSummary(value: string | null): string | null {
   if (!value) return null;
   const normalized = value.replace(/\s+/g, " ").trim();
@@ -733,53 +589,27 @@ export async function createConsoleMessage(input: CreateConsoleMessageInput): Pr
   const selectionSets = snapshot.messageFields.size
     ? [chooseMessageSelectionSet(snapshot.messageFields)]
     : [CONSOLE_MESSAGE_FIELDS, CONSOLE_MESSAGE_FIELDS_LEGACY];
-  const inputCandidates = buildCreateMessageInputCandidates(input, snapshot.createMessageInputFields);
+  // The backend stamps the author from the signed-in identity (postMessage): the browser names none and sets no timestamps.
+  const args = postMessageArguments({ ...input, summary: input.summary ?? truncateSummary(input.content ?? null) } as unknown as Record<string, unknown>);
   let lastError: unknown = null;
 
   for (const selectionSet of selectionSets) {
-    const createMutation = `
-      mutation CreateMessage($input: CreateMessageInput!) {
-        createMessage(input: $input) {
-          ${selectionSet}
-        }
-      }
-    `;
-    for (const candidateInput of inputCandidates) {
-      try {
-        const response = await getGraphQLClient().graphql({
-          query: createMutation,
-          variables: { input: candidateInput },
-          authMode: USER_POOL_AUTH_MODE,
-        });
-        const created = normalizeConsoleMessageRecord(assertGraphQL<Record<string, unknown>>(response, "createMessage"));
-        await maybeUploadConsoleMessageBody(created.id, input.content);
-        return input.content?.trim() ? { ...created, content: input.content } : created;
-      } catch (error) {
-        if (!isUnavailableQueryError(error)) throw normalizeUnknownError(error, "createMessage");
-        lastError = error;
-      }
-    }
-  }
-
-  if (lastError) {
     try {
       const response = await getGraphQLClient().graphql({
-        query: CREATE_CONSOLE_MESSAGE_LEGACY,
-        variables: {
-          input: inputCandidates[inputCandidates.length - 1] ?? {},
-        },
+        query: postMessageMutation(args, selectionSet),
+        variables: args,
         authMode: USER_POOL_AUTH_MODE,
       });
-      const created = normalizeConsoleMessageRecord(assertGraphQL<Record<string, unknown>>(response, "createMessage"));
+      const created = normalizeConsoleMessageRecord(assertGraphQL<Record<string, unknown>>(response, "postMessage"));
       await maybeUploadConsoleMessageBody(created.id, input.content);
       return input.content?.trim() ? { ...created, content: input.content } : created;
     } catch (error) {
-      if (!isUnavailableQueryError(error)) throw normalizeUnknownError(error, "createMessage");
+      if (!isUnavailableQueryError(error)) throw normalizeUnknownError(error, "postMessage");
       lastError = error;
     }
   }
 
-  throw normalizeUnknownError(lastError, "createMessage");
+  throw normalizeUnknownError(lastError, "postMessage");
 }
 
 export async function updateConsoleMessage(

package/lib/post-message.ts

@@ -0,0 +1,54 @@
+/**
+ * Messages are created through the `postMessage` mutation, never through `createMessage`: the backend stamps the author from the
+ * signed-in identity, so a browser cannot name one. This is the one place that turns a Message record into that mutation and its
+ * arguments, shared by the conversation, forum and console chat writers. Authorship and timestamps are left out on purpose.
+ */
+
+const ARGUMENT_TYPES = {
+  id: "ID!",
+  threadId: "ID!",
+  content: "String",
+  messageKind: "String!",
+  messageDomain: "String!",
+  summary: "String",
+  parentMessageId: "ID",
+  sequenceNumber: "Int",
+  messageType: "String",
+  role: "String",
+  source: "String",
+  authorLabel: "String",
+  semanticLayer: "String",
+  searchVisibility: "String",
+  responseTarget: "String",
+  responseStatus: "String",
+  responseOwner: "String",
+  responseStartedAt: "AWSDateTime",
+  responseCompletedAt: "AWSDateTime",
+  metadata: "AWSJSON",
+  newsroomFeedKey: "String",
+} as const;
+
+export type PostMessageArguments = Partial<Record<keyof typeof ARGUMENT_TYPES, string | number | null>>;
+
+type MessageLike = Record<string, unknown>;
+
+/** The arguments of `postMessage` from a Message record. Anything else on the record (authorSub, authorUserProfileId, createdAt, updatedAt) is dropped. */
+export function postMessageArguments(record: MessageLike): PostMessageArguments {
+  const args: PostMessageArguments = {};
+  for (const key of Object.keys(ARGUMENT_TYPES) as Array<keyof typeof ARGUMENT_TYPES>) {
+    let value = record[key === "content" ? "content" : key];
+    if (key === "content") value = record.content ?? record.body;
+    if (value === undefined || value === null) continue;
+    if (key === "metadata") value = typeof value === "string" ? value : JSON.stringify(value);
+    args[key] = value as string | number;
+  }
+  return args;
+}
+
+/** `mutation PostMessage($id: ID!, …) { postMessage(id: $id, …) { <selection> } }` declaring exactly the arguments given. */
+export function postMessageMutation(args: PostMessageArguments, selection: string): string {
+  const keys = Object.keys(args) as Array<keyof typeof ARGUMENT_TYPES>;
+  const declared = keys.map((key) => `$${key}: ${ARGUMENT_TYPES[key]}`).join(", ");
+  const passed = keys.map((key) => `${key}: $${key}`).join(", ");
+  return `mutation PostMessage(${declared}) { postMessage(${passed}) { ${selection} } }`;
+}

package/package.json

@@ -327,6 +327,7 @@
     "./lib/papyrus-web-locations": "./lib/papyrus-web-locations.ts",
     "./lib/pilobol-sample": "./lib/pilobol-sample.ts",
     "./lib/plugin-settings": "./lib/plugin-settings.ts",
+    "./lib/post-message": "./lib/post-message.ts",
     "./lib/presentation-footer": "./lib/presentation-footer.ts",
     "./lib/pretext-layout": "./lib/pretext-layout.ts",
     "./lib/priming-proof-report": "./lib/priming-proof-report.ts",
@@ -517,7 +518,7 @@
       "optional": true
     }
   },
-  "version": "5.43.0-next.49",
+  "version": "5.43.0-next.50",
   "dependencies": {
     "@aws-amplify/adapter-nextjs": "^1.7.3",
     "@aws-crypto/sha256-js": "5.2.0",

package/routes.manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "5.43.0-next.49",
+  "version": "5.43.0-next.50",
   "routes": [
     {
       "file": "app/%5F_preview/[[...path]]/route.ts",