@anthusai/papyrus 5.5.0 → 5.6.0

package/amplify/data/resource.js

@@ -6,6 +6,7 @@ import { knowledgeQuery } from "../functions/knowledge-query/resource.js";
 import { manageUserRole } from "../functions/manage-user-role/resource.js";
 import { modelAttachmentUpload } from "../functions/model-attachment-upload/resource.js";
 import { newsroomSummary } from "../functions/newsroom-summary/resource.js";
+import { publicForms } from "../functions/public-forms/resource.js";
 import { procedureAction } from "../functions/procedure-action/resource.js";
 import { readerSettings } from "../functions/reader-settings/resource.js";
 import { emailSubmissionProcessor } from "../functions/email-submission-processor/resource.js";
@@ -2165,6 +2166,7 @@ const schema = a.schema({
     allow.resource(modelAttachmentUpload),
     allow.resource(newsroomSummary),
     allow.resource(procedureAction),
+    allow.resource(publicForms).to(["mutate"]),
     allow.resource(sesInboundReceive),
     allow.resource(emailSubmissionProcessor),
     allow.resource(slackEvents),

package/amplify/data/resource.ts

@@ -6,6 +6,7 @@ import { knowledgeQuery } from "../functions/knowledge-query/resource";
 import { manageUserRole } from "../functions/manage-user-role/resource";
 import { modelAttachmentUpload } from "../functions/model-attachment-upload/resource";
 import { newsroomSummary } from "../functions/newsroom-summary/resource";
+import { publicForms } from "../functions/public-forms/resource";
 import { procedureAction } from "../functions/procedure-action/resource";
 import { readerSettings } from "../functions/reader-settings/resource";
 import { emailSubmissionProcessor } from "../functions/email-submission-processor/resource";
@@ -2292,6 +2293,7 @@ const schema = a.schema({
   allow.resource(modelAttachmentUpload),
   allow.resource(newsroomSummary),
   allow.resource(procedureAction),
+  allow.resource(publicForms).to(["mutate"]),
   allow.resource(sesInboundReceive),
   allow.resource(emailSubmissionProcessor),
   allow.resource(slackEvents),

package/amplify/data/schema.js

@@ -8,6 +8,7 @@ import { knowledgeQuery } from "../functions/knowledge-query/resource.js";
 import { manageUserRole } from "../functions/manage-user-role/resource.js";
 import { modelAttachmentUpload } from "../functions/model-attachment-upload/resource.js";
 import { newsroomSummary } from "../functions/newsroom-summary/resource.js";
+import { publicForms } from "../functions/public-forms/resource.js";
 import { procedureAction } from "../functions/procedure-action/resource.js";
 import { readerSettings } from "../functions/reader-settings/resource.js";
 const authoringOperations = [
@@ -2012,6 +2013,7 @@ export const schema = a.schema(baseDefinitions).authorization((allow) => [
     allow.resource(modelAttachmentUpload),
     allow.resource(newsroomSummary),
     allow.resource(procedureAction),
+    allow.resource(publicForms).to(["mutate"]),
 ]);
 /** The deployed schema of a site that enables plugins: the base definitions plus what each plugin contributes (docs/plugins.md). */
 export function schemaWithPlugins(pluginDefinitions) {

package/amplify/data/schema.ts

@@ -8,6 +8,7 @@ import { knowledgeQuery } from "../functions/knowledge-query/resource";
 import { manageUserRole } from "../functions/manage-user-role/resource";
 import { modelAttachmentUpload } from "../functions/model-attachment-upload/resource";
 import { newsroomSummary } from "../functions/newsroom-summary/resource";
+import { publicForms } from "../functions/public-forms/resource";
 import { procedureAction } from "../functions/procedure-action/resource";
 import { readerSettings } from "../functions/reader-settings/resource";
 
@@ -2133,6 +2134,7 @@ export const schema = a.schema(baseDefinitions).authorization((allow) => [
   allow.resource(modelAttachmentUpload),
   allow.resource(newsroomSummary),
   allow.resource(procedureAction),
+  allow.resource(publicForms).to(["mutate"]),
 ]);
 
 /** The deployed schema of a site that enables plugins: the base definitions plus what each plugin contributes (docs/plugins.md). */

package/amplify/functions/public-forms/core.js

@@ -0,0 +1,247 @@
+import { createHash, randomUUID } from "node:crypto";
+/**
+ * The public form receiving endpoint, without any AWS in it: `handlePublicFormRequest` takes the Function URL
+ * event plus a store and a rate limiter, so every rule here is exercised by `scripts/test-public-forms.ts`.
+ *
+ * Contract (docs/public-forms.md): POST JSON from one of the site's own origins; the answer never reflects input.
+ */
+export const FORM_SUBMISSION_MESSAGE_KIND = "form_submission";
+export const FORM_SUBMISSION_MESSAGE_DOMAIN = "inbox";
+export const FORM_SUBMISSION_FEED_KEY = "messages";
+export const NEWSLETTER_FORM_ID = "newsletter";
+export const NEWSLETTER_MESSAGE_TYPE = "newsletter_signup";
+export const DEFAULT_FORM_ID = "contact";
+export const DEFAULT_HONEYPOT_FIELDS = ["website"];
+export const DEFAULT_PUBLIC_FORMS_CONFIG = {
+    allowedOrigins: [],
+    honeypotFields: DEFAULT_HONEYPOT_FIELDS,
+    maxBodyBytes: 16 * 1024,
+    maxFields: 20,
+    maxValueLength: 5000,
+    ipLimit: 10,
+    ipWindowSeconds: 600,
+    formLimitPerHour: 120,
+    siteLimitPerHour: 400,
+};
+const FORM_ID = /^[a-z0-9][a-z0-9-]{0,39}$/;
+const FIELD_NAME = /^[A-Za-z][A-Za-z0-9_]{0,39}$/;
+const EMAIL = /^[^\s@<>"]+@[^\s@<>"]+\.[^\s@<>"]+$/;
+const CONTROL = /[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/g;
+export function parseOrigins(value) {
+    const origins = [];
+    for (const entry of (value ?? "").split(",")) {
+        const trimmed = entry.trim();
+        if (trimmed === "")
+            continue;
+        try {
+            const url = new URL(trimmed);
+            if (url.protocol === "https:" || url.hostname === "localhost")
+                origins.push(url.origin);
+        }
+        catch {
+            // An unparsable origin is dropped: the allow-list can only get stricter.
+        }
+    }
+    return [...new Set(origins)];
+}
+function positiveInteger(value, fallback) {
+    const parsed = Number.parseInt(value ?? "", 10);
+    return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
+}
+export function configFromEnvironment(env) {
+    const honeypots = (env.PAPYRUS_PUBLIC_FORMS_HONEYPOTS ?? "").split(",").map((entry) => entry.trim()).filter(Boolean);
+    return {
+        ...DEFAULT_PUBLIC_FORMS_CONFIG,
+        allowedOrigins: parseOrigins(env.PAPYRUS_PUBLIC_FORMS_ORIGINS),
+        honeypotFields: [...new Set([...DEFAULT_HONEYPOT_FIELDS, ...honeypots])],
+        ipLimit: positiveInteger(env.PAPYRUS_PUBLIC_FORMS_IP_LIMIT, DEFAULT_PUBLIC_FORMS_CONFIG.ipLimit),
+        formLimitPerHour: positiveInteger(env.PAPYRUS_PUBLIC_FORMS_FORM_LIMIT, DEFAULT_PUBLIC_FORMS_CONFIG.formLimitPerHour),
+        siteLimitPerHour: positiveInteger(env.PAPYRUS_PUBLIC_FORMS_SITE_LIMIT, DEFAULT_PUBLIC_FORMS_CONFIG.siteLimitPerHour),
+    };
+}
+function reply(statusCode, body, headers = {}) {
+    return {
+        statusCode,
+        headers: { "Cache-Control": "no-store", "Content-Type": "application/json", "X-Content-Type-Options": "nosniff", ...headers },
+        body: body === null ? "" : JSON.stringify(body),
+    };
+}
+function header(event, name) {
+    const headers = event.headers ?? {};
+    for (const [key, value] of Object.entries(headers)) {
+        if (key.toLowerCase() === name && typeof value === "string")
+            return value;
+    }
+    return "";
+}
+function clean(value, multiline) {
+    const stripped = value.replace(CONTROL, "").replace(/\r\n?/g, "\n");
+    return (multiline ? stripped : stripped.replace(/\n/g, " ")).trim();
+}
+function parseSubmission(event, config) {
+    const raw = event.isBase64Encoded === true ? Buffer.from(event.body ?? "", "base64").toString("utf8") : (event.body ?? "");
+    let payload;
+    try {
+        payload = JSON.parse(raw);
+    }
+    catch {
+        return { ok: false, error: "invalid-json" };
+    }
+    if (typeof payload !== "object" || payload === null || Array.isArray(payload))
+        return { ok: false, error: "invalid-body" };
+    const entries = Object.entries(payload);
+    if (entries.length > config.maxFields)
+        return { ok: false, error: "too-many-fields" };
+    const fields = {};
+    let formId = "";
+    let page = "";
+    let honeypotFilled = false;
+    for (const [name, value] of entries) {
+        if (!FIELD_NAME.test(name))
+            return { ok: false, error: "invalid-field" };
+        if (value === null || value === undefined)
+            continue;
+        if (typeof value !== "string")
+            return { ok: false, error: "invalid-field" };
+        if (value.length > config.maxValueLength)
+            return { ok: false, error: "field-too-long" };
+        if (config.honeypotFields.includes(name)) {
+            if (value.trim() !== "")
+                honeypotFilled = true;
+            continue;
+        }
+        if (name === "form")
+            formId = value.trim().toLowerCase();
+        else if (name === "page")
+            page = clean(value, false).slice(0, 500);
+        else
+            fields[name] = clean(value, name === "message");
+    }
+    return { ok: true, formId, fields, page, honeypotFilled };
+}
+function queryFormId(event) {
+    const match = /(?:^|&)form=([^&]*)/.exec(event.rawQueryString ?? "");
+    if (match === null)
+        return "";
+    try {
+        return decodeURIComponent(match[1]).trim().toLowerCase();
+    }
+    catch {
+        return "";
+    }
+}
+function ipSubject(ip) {
+    return createHash("sha256").update(`papyrus-public-forms:${ip}`).digest("hex").slice(0, 32);
+}
+export function buildSubmissionRecord(input) {
+    const { formId, fields } = input;
+    const newsletter = formId === NEWSLETTER_FORM_ID;
+    const name = fields.name ?? "";
+    const email = fields.email ?? "";
+    const topic = fields.topic ?? "";
+    const message = fields.message ?? "";
+    const who = name !== "" ? (email !== "" ? `${name} <${email}>` : name) : email;
+    const headline = newsletter ? "Newsletter signup" : topic !== "" ? `${formId}: ${topic}` : formId;
+    const lines = [`Form: ${formId}`];
+    for (const [key, value] of Object.entries(fields)) {
+        if (key === "message" || value === "")
+            continue;
+        lines.push(`${key}: ${value}`);
+    }
+    if (input.page !== "")
+        lines.push(`page: ${input.page}`);
+    const content = message !== "" ? `${lines.join("\n")}\n\n${message}` : lines.join("\n");
+    const summarySource = message !== "" ? message.replace(/\s+/g, " ") : "";
+    const summary = `${headline}${who !== "" ? ` from ${who}` : ""}${summarySource !== "" ? `: ${summarySource}` : ""}`.slice(0, 200);
+    return {
+        id: input.id,
+        messageKind: FORM_SUBMISSION_MESSAGE_KIND,
+        messageDomain: FORM_SUBMISSION_MESSAGE_DOMAIN,
+        messageType: newsletter ? NEWSLETTER_MESSAGE_TYPE : FORM_SUBMISSION_MESSAGE_KIND,
+        status: "active",
+        summary,
+        content,
+        source: "public-form",
+        authorLabel: who !== "" ? who.slice(0, 200) : "Anonymous visitor",
+        searchVisibility: "private",
+        responseTarget: "none",
+        responseStatus: "COMPLETED",
+        metadata: JSON.stringify({
+            kind: newsletter ? NEWSLETTER_MESSAGE_TYPE : FORM_SUBMISSION_MESSAGE_KIND,
+            formId,
+            topic,
+            fields,
+            page: input.page,
+            origin: input.origin,
+            receivedAt: input.receivedAt,
+        }),
+        createdAt: input.receivedAt,
+        updatedAt: input.receivedAt,
+        newsroomFeedKey: FORM_SUBMISSION_FEED_KEY,
+    };
+}
+export async function handlePublicFormRequest(event, config, deps) {
+    const method = (event.requestContext?.http?.method ?? "").toUpperCase();
+    const origin = header(event, "origin");
+    const allowed = origin !== "" && config.allowedOrigins.includes(origin);
+    const cors = allowed
+        ? {
+            "Access-Control-Allow-Origin": origin,
+            "Access-Control-Allow-Methods": "POST, OPTIONS",
+            "Access-Control-Allow-Headers": "Content-Type",
+            "Access-Control-Max-Age": "600",
+            Vary: "Origin",
+        }
+        : { Vary: "Origin" };
+    if (method === "OPTIONS")
+        return allowed ? reply(204, null, cors) : reply(403, { ok: false, error: "origin-not-allowed" }, cors);
+    if (method !== "POST")
+        return reply(405, { ok: false, error: "method-not-allowed" }, { ...cors, Allow: "POST, OPTIONS" });
+    if (!allowed)
+        return reply(403, { ok: false, error: "origin-not-allowed" }, cors);
+    if (!/^application\/json\s*(;|$)/i.test(header(event, "content-type")))
+        return reply(415, { ok: false, error: "unsupported-media-type" }, cors);
+    const bodyBytes = Buffer.byteLength(event.body ?? "", event.isBase64Encoded === true ? "base64" : "utf8");
+    if (bodyBytes > config.maxBodyBytes)
+        return reply(413, { ok: false, error: "payload-too-large" }, cors);
+    const parsed = parseSubmission(event, config);
+    if (!parsed.ok)
+        return reply(400, { ok: false, error: parsed.error }, cors);
+    // A filled honeypot looks like success to the bot and stores nothing.
+    if (parsed.honeypotFilled)
+        return reply(200, { ok: true }, cors);
+    const formId = parsed.formId || queryFormId(event) || DEFAULT_FORM_ID;
+    if (!FORM_ID.test(formId))
+        return reply(400, { ok: false, error: "invalid-form" }, cors);
+    const { fields } = parsed;
+    const email = fields.email ?? "";
+    if (email !== "" && (email.length > 254 || !EMAIL.test(email)))
+        return reply(400, { ok: false, error: "invalid-email" }, cors);
+    if (formId === NEWSLETTER_FORM_ID && email === "")
+        return reply(400, { ok: false, error: "email-required" }, cors);
+    if (email === "" && (fields.message ?? "") === "")
+        return reply(400, { ok: false, error: "empty-submission" }, cors);
+    const subject = ipSubject(event.requestContext?.http?.sourceIp ?? "unknown");
+    let within;
+    try {
+        within =
+            (await deps.limiter.hit("ip", subject, config.ipWindowSeconds, config.ipLimit))
+                && (await deps.limiter.hit("form", formId, 3600, config.formLimitPerHour))
+                && (await deps.limiter.hit("site", "all", 3600, config.siteLimitPerHour));
+    }
+    catch {
+        return reply(503, { ok: false, error: "unavailable" }, cors);
+    }
+    if (!within)
+        return reply(429, { ok: false, error: "rate-limited" }, { ...cors, "Retry-After": "600" });
+    const receivedAt = (deps.now ?? (() => new Date()))().toISOString();
+    const id = (deps.newId ?? (() => `form-${randomUUID().replace(/-/g, "")}`))();
+    try {
+        await deps.store.save(buildSubmissionRecord({ id, formId, fields, page: parsed.page, origin, receivedAt }));
+    }
+    catch {
+        // Never pretend a submission was received when it was not.
+        return reply(500, { ok: false, error: "store-failed" }, cors);
+    }
+    return reply(200, { ok: true }, cors);
+}

package/amplify/functions/public-forms/core.ts

@@ -0,0 +1,310 @@
+import { createHash, randomUUID } from "node:crypto";
+
+/**
+ * The public form receiving endpoint, without any AWS in it: `handlePublicFormRequest` takes the Function URL
+ * event plus a store and a rate limiter, so every rule here is exercised by `scripts/test-public-forms.ts`.
+ *
+ * Contract (docs/public-forms.md): POST JSON from one of the site's own origins; the answer never reflects input.
+ */
+
+export const FORM_SUBMISSION_MESSAGE_KIND = "form_submission";
+export const FORM_SUBMISSION_MESSAGE_DOMAIN = "inbox";
+export const FORM_SUBMISSION_FEED_KEY = "messages";
+export const NEWSLETTER_FORM_ID = "newsletter";
+export const NEWSLETTER_MESSAGE_TYPE = "newsletter_signup";
+export const DEFAULT_FORM_ID = "contact";
+export const DEFAULT_HONEYPOT_FIELDS = ["website"];
+
+export type PublicFormsConfig = {
+  /** Exact origins (scheme + host [+ port]) the browser may post from. Empty: every request is refused. */
+  allowedOrigins: string[];
+  /** Field names that, when filled, mark a bot. */
+  honeypotFields: string[];
+  maxBodyBytes: number;
+  maxFields: number;
+  maxValueLength: number;
+  /** Submissions one address may make per `ipWindowSeconds`, across all forms. */
+  ipLimit: number;
+  ipWindowSeconds: number;
+  /** Submissions one form accepts per hour from everyone; and the whole site across all form ids. */
+  formLimitPerHour: number;
+  siteLimitPerHour: number;
+};
+
+export const DEFAULT_PUBLIC_FORMS_CONFIG: PublicFormsConfig = {
+  allowedOrigins: [],
+  honeypotFields: DEFAULT_HONEYPOT_FIELDS,
+  maxBodyBytes: 16 * 1024,
+  maxFields: 20,
+  maxValueLength: 5000,
+  ipLimit: 10,
+  ipWindowSeconds: 600,
+  formLimitPerHour: 120,
+  siteLimitPerHour: 400,
+};
+
+export type FormSubmissionRecord = {
+  id: string;
+  messageKind: typeof FORM_SUBMISSION_MESSAGE_KIND;
+  messageDomain: string;
+  messageType: string;
+  status: "active";
+  summary: string;
+  content: string;
+  source: string;
+  authorLabel: string;
+  searchVisibility: "private";
+  responseTarget: "none";
+  responseStatus: "COMPLETED";
+  metadata: string;
+  createdAt: string;
+  updatedAt: string;
+  newsroomFeedKey: string;
+};
+
+export type SubmissionStore = { save(record: FormSubmissionRecord): Promise<void> };
+
+/** `hit` counts one event in the window and answers whether it is still within `limit`. */
+export type RateLimiter = {
+  hit(scope: string, subject: string, windowSeconds: number, limit: number): Promise<boolean>;
+};
+
+export type PublicFormsDeps = {
+  store: SubmissionStore;
+  limiter: RateLimiter;
+  now?: () => Date;
+  newId?: () => string;
+};
+
+export type FunctionUrlEvent = {
+  rawQueryString?: string;
+  headers?: Record<string, string | undefined>;
+  body?: string | null;
+  isBase64Encoded?: boolean;
+  requestContext?: { http?: { method?: string; sourceIp?: string } };
+};
+
+export type FunctionUrlResult = { statusCode: number; headers: Record<string, string>; body: string };
+
+const FORM_ID = /^[a-z0-9][a-z0-9-]{0,39}$/;
+const FIELD_NAME = /^[A-Za-z][A-Za-z0-9_]{0,39}$/;
+const EMAIL = /^[^\s@<>"]+@[^\s@<>"]+\.[^\s@<>"]+$/;
+const CONTROL = /[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/g;
+
+export function parseOrigins(value: string | undefined): string[] {
+  const origins: string[] = [];
+  for (const entry of (value ?? "").split(",")) {
+    const trimmed = entry.trim();
+    if (trimmed === "") continue;
+    try {
+      const url = new URL(trimmed);
+      if (url.protocol === "https:" || url.hostname === "localhost") origins.push(url.origin);
+    } catch {
+      // An unparsable origin is dropped: the allow-list can only get stricter.
+    }
+  }
+  return [...new Set(origins)];
+}
+
+function positiveInteger(value: string | undefined, fallback: number): number {
+  const parsed = Number.parseInt(value ?? "", 10);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
+}
+
+export function configFromEnvironment(env: Record<string, string | undefined>): PublicFormsConfig {
+  const honeypots = (env.PAPYRUS_PUBLIC_FORMS_HONEYPOTS ?? "").split(",").map((entry) => entry.trim()).filter(Boolean);
+  return {
+    ...DEFAULT_PUBLIC_FORMS_CONFIG,
+    allowedOrigins: parseOrigins(env.PAPYRUS_PUBLIC_FORMS_ORIGINS),
+    honeypotFields: [...new Set([...DEFAULT_HONEYPOT_FIELDS, ...honeypots])],
+    ipLimit: positiveInteger(env.PAPYRUS_PUBLIC_FORMS_IP_LIMIT, DEFAULT_PUBLIC_FORMS_CONFIG.ipLimit),
+    formLimitPerHour: positiveInteger(env.PAPYRUS_PUBLIC_FORMS_FORM_LIMIT, DEFAULT_PUBLIC_FORMS_CONFIG.formLimitPerHour),
+    siteLimitPerHour: positiveInteger(env.PAPYRUS_PUBLIC_FORMS_SITE_LIMIT, DEFAULT_PUBLIC_FORMS_CONFIG.siteLimitPerHour),
+  };
+}
+
+function reply(statusCode: number, body: Record<string, unknown> | null, headers: Record<string, string> = {}): FunctionUrlResult {
+  return {
+    statusCode,
+    headers: { "Cache-Control": "no-store", "Content-Type": "application/json", "X-Content-Type-Options": "nosniff", ...headers },
+    body: body === null ? "" : JSON.stringify(body),
+  };
+}
+
+function header(event: FunctionUrlEvent, name: string): string {
+  const headers = event.headers ?? {};
+  for (const [key, value] of Object.entries(headers)) {
+    if (key.toLowerCase() === name && typeof value === "string") return value;
+  }
+  return "";
+}
+
+function clean(value: string, multiline: boolean): string {
+  const stripped = value.replace(CONTROL, "").replace(/\r\n?/g, "\n");
+  return (multiline ? stripped : stripped.replace(/\n/g, " ")).trim();
+}
+
+type Parsed =
+  | { ok: true; formId: string; fields: Record<string, string>; page: string; honeypotFilled: boolean }
+  | { ok: false; error: string };
+
+function parseSubmission(event: FunctionUrlEvent, config: PublicFormsConfig): Parsed {
+  const raw = event.isBase64Encoded === true ? Buffer.from(event.body ?? "", "base64").toString("utf8") : (event.body ?? "");
+  let payload: unknown;
+  try {
+    payload = JSON.parse(raw);
+  } catch {
+    return { ok: false, error: "invalid-json" };
+  }
+  if (typeof payload !== "object" || payload === null || Array.isArray(payload)) return { ok: false, error: "invalid-body" };
+  const entries = Object.entries(payload as Record<string, unknown>);
+  if (entries.length > config.maxFields) return { ok: false, error: "too-many-fields" };
+
+  const fields: Record<string, string> = {};
+  let formId = "";
+  let page = "";
+  let honeypotFilled = false;
+  for (const [name, value] of entries) {
+    if (!FIELD_NAME.test(name)) return { ok: false, error: "invalid-field" };
+    if (value === null || value === undefined) continue;
+    if (typeof value !== "string") return { ok: false, error: "invalid-field" };
+    if (value.length > config.maxValueLength) return { ok: false, error: "field-too-long" };
+    if (config.honeypotFields.includes(name)) {
+      if (value.trim() !== "") honeypotFilled = true;
+      continue;
+    }
+    if (name === "form") formId = value.trim().toLowerCase();
+    else if (name === "page") page = clean(value, false).slice(0, 500);
+    else fields[name] = clean(value, name === "message");
+  }
+  return { ok: true, formId, fields, page, honeypotFilled };
+}
+
+function queryFormId(event: FunctionUrlEvent): string {
+  const match = /(?:^|&)form=([^&]*)/.exec(event.rawQueryString ?? "");
+  if (match === null) return "";
+  try {
+    return decodeURIComponent(match[1]).trim().toLowerCase();
+  } catch {
+    return "";
+  }
+}
+
+function ipSubject(ip: string): string {
+  return createHash("sha256").update(`papyrus-public-forms:${ip}`).digest("hex").slice(0, 32);
+}
+
+export function buildSubmissionRecord(input: {
+  id: string;
+  formId: string;
+  fields: Record<string, string>;
+  page: string;
+  origin: string;
+  receivedAt: string;
+}): FormSubmissionRecord {
+  const { formId, fields } = input;
+  const newsletter = formId === NEWSLETTER_FORM_ID;
+  const name = fields.name ?? "";
+  const email = fields.email ?? "";
+  const topic = fields.topic ?? "";
+  const message = fields.message ?? "";
+  const who = name !== "" ? (email !== "" ? `${name} <${email}>` : name) : email;
+  const headline = newsletter ? "Newsletter signup" : topic !== "" ? `${formId}: ${topic}` : formId;
+  const lines = [`Form: ${formId}`];
+  for (const [key, value] of Object.entries(fields)) {
+    if (key === "message" || value === "") continue;
+    lines.push(`${key}: ${value}`);
+  }
+  if (input.page !== "") lines.push(`page: ${input.page}`);
+  const content = message !== "" ? `${lines.join("\n")}\n\n${message}` : lines.join("\n");
+  const summarySource = message !== "" ? message.replace(/\s+/g, " ") : "";
+  const summary = `${headline}${who !== "" ? ` from ${who}` : ""}${summarySource !== "" ? `: ${summarySource}` : ""}`.slice(0, 200);
+  return {
+    id: input.id,
+    messageKind: FORM_SUBMISSION_MESSAGE_KIND,
+    messageDomain: FORM_SUBMISSION_MESSAGE_DOMAIN,
+    messageType: newsletter ? NEWSLETTER_MESSAGE_TYPE : FORM_SUBMISSION_MESSAGE_KIND,
+    status: "active",
+    summary,
+    content,
+    source: "public-form",
+    authorLabel: who !== "" ? who.slice(0, 200) : "Anonymous visitor",
+    searchVisibility: "private",
+    responseTarget: "none",
+    responseStatus: "COMPLETED",
+    metadata: JSON.stringify({
+      kind: newsletter ? NEWSLETTER_MESSAGE_TYPE : FORM_SUBMISSION_MESSAGE_KIND,
+      formId,
+      topic,
+      fields,
+      page: input.page,
+      origin: input.origin,
+      receivedAt: input.receivedAt,
+    }),
+    createdAt: input.receivedAt,
+    updatedAt: input.receivedAt,
+    newsroomFeedKey: FORM_SUBMISSION_FEED_KEY,
+  };
+}
+
+export async function handlePublicFormRequest(
+  event: FunctionUrlEvent,
+  config: PublicFormsConfig,
+  deps: PublicFormsDeps,
+): Promise<FunctionUrlResult> {
+  const method = (event.requestContext?.http?.method ?? "").toUpperCase();
+  const origin = header(event, "origin");
+  const allowed = origin !== "" && config.allowedOrigins.includes(origin);
+  const cors: Record<string, string> = allowed
+    ? {
+        "Access-Control-Allow-Origin": origin,
+        "Access-Control-Allow-Methods": "POST, OPTIONS",
+        "Access-Control-Allow-Headers": "Content-Type",
+        "Access-Control-Max-Age": "600",
+        Vary: "Origin",
+      }
+    : { Vary: "Origin" };
+
+  if (method === "OPTIONS") return allowed ? reply(204, null, cors) : reply(403, { ok: false, error: "origin-not-allowed" }, cors);
+  if (method !== "POST") return reply(405, { ok: false, error: "method-not-allowed" }, { ...cors, Allow: "POST, OPTIONS" });
+  if (!allowed) return reply(403, { ok: false, error: "origin-not-allowed" }, cors);
+  if (!/^application\/json\s*(;|$)/i.test(header(event, "content-type"))) return reply(415, { ok: false, error: "unsupported-media-type" }, cors);
+
+  const bodyBytes = Buffer.byteLength(event.body ?? "", event.isBase64Encoded === true ? "base64" : "utf8");
+  if (bodyBytes > config.maxBodyBytes) return reply(413, { ok: false, error: "payload-too-large" }, cors);
+
+  const parsed = parseSubmission(event, config);
+  if (!parsed.ok) return reply(400, { ok: false, error: parsed.error }, cors);
+  // A filled honeypot looks like success to the bot and stores nothing.
+  if (parsed.honeypotFilled) return reply(200, { ok: true }, cors);
+
+  const formId = parsed.formId || queryFormId(event) || DEFAULT_FORM_ID;
+  if (!FORM_ID.test(formId)) return reply(400, { ok: false, error: "invalid-form" }, cors);
+  const { fields } = parsed;
+  const email = fields.email ?? "";
+  if (email !== "" && (email.length > 254 || !EMAIL.test(email))) return reply(400, { ok: false, error: "invalid-email" }, cors);
+  if (formId === NEWSLETTER_FORM_ID && email === "") return reply(400, { ok: false, error: "email-required" }, cors);
+  if (email === "" && (fields.message ?? "") === "") return reply(400, { ok: false, error: "empty-submission" }, cors);
+
+  const subject = ipSubject(event.requestContext?.http?.sourceIp ?? "unknown");
+  let within: boolean;
+  try {
+    within =
+      (await deps.limiter.hit("ip", subject, config.ipWindowSeconds, config.ipLimit))
+      && (await deps.limiter.hit("form", formId, 3600, config.formLimitPerHour))
+      && (await deps.limiter.hit("site", "all", 3600, config.siteLimitPerHour));
+  } catch {
+    return reply(503, { ok: false, error: "unavailable" }, cors);
+  }
+  if (!within) return reply(429, { ok: false, error: "rate-limited" }, { ...cors, "Retry-After": "600" });
+
+  const receivedAt = (deps.now ?? (() => new Date()))().toISOString();
+  const id = (deps.newId ?? (() => `form-${randomUUID().replace(/-/g, "")}`))();
+  try {
+    await deps.store.save(buildSubmissionRecord({ id, formId, fields, page: parsed.page, origin, receivedAt }));
+  } catch {
+    // Never pretend a submission was received when it was not.
+    return reply(500, { ok: false, error: "store-failed" }, cors);
+  }
+  return reply(200, { ok: true }, cors);
+}

package/amplify/functions/public-forms/handler.ts

@@ -0,0 +1,41 @@
+import { DynamoDBClient, UpdateItemCommand } from "@aws-sdk/client-dynamodb";
+import { getLambdaDataClient, LAMBDA_DATA_AUTH_MODE } from "../shared/lambda-data-client";
+import {
+  configFromEnvironment,
+  handlePublicFormRequest,
+  type FormSubmissionRecord,
+  type FunctionUrlEvent,
+  type RateLimiter,
+  type SubmissionStore,
+} from "./core";
+
+const dynamo = new DynamoDBClient({});
+
+/** Counters live in a TTL table; the window number is part of the key, so a window simply stops being read. */
+const limiter: RateLimiter = {
+  async hit(scope, subject, windowSeconds, limit) {
+    const nowSeconds = Math.floor(Date.now() / 1000);
+    const window = Math.floor(nowSeconds / windowSeconds);
+    const result = await dynamo.send(
+      new UpdateItemCommand({
+        TableName: process.env.PAPYRUS_PUBLIC_FORMS_TABLE,
+        Key: { pk: { S: `${scope}#${subject}#${windowSeconds}#${window}` } },
+        UpdateExpression: "ADD hits :one SET expiresAt = :expires",
+        ExpressionAttributeValues: { ":one": { N: "1" }, ":expires": { N: String((window + 2) * windowSeconds) } },
+        ReturnValues: "UPDATED_NEW",
+      }),
+    );
+    return Number(result.Attributes?.hits?.N ?? "0") <= limit;
+  },
+};
+
+const store: SubmissionStore = {
+  async save(record: FormSubmissionRecord) {
+    const client = await getLambdaDataClient();
+    const created = await client.models.Message.create(record as never, { authMode: LAMBDA_DATA_AUTH_MODE });
+    if (created.errors?.length) throw new Error("Message create failed");
+  },
+};
+
+export const handler = (event: FunctionUrlEvent) =>
+  handlePublicFormRequest(event, configFromEnvironment(process.env), { store, limiter });

package/amplify/functions/public-forms/origins.js

@@ -0,0 +1,35 @@
+function httpsOrigin(value) {
+    try {
+        const url = new URL(value.includes("://") ? value : `https://${value}`);
+        return url.protocol === "https:" && url.hostname !== "localhost" ? url.origin : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+export function derivePublicFormOrigins(sources) {
+    const origins = new Set();
+    for (const value of sources.explicit ?? []) {
+        try {
+            const url = new URL(value);
+            if (url.protocol === "https:" || (url.protocol === "http:" && url.hostname === "localhost"))
+                origins.add(url.origin);
+            else
+                throw new Error("not allowed");
+        }
+        catch {
+            throw new Error(`publicForms.allowedOrigins entry ${JSON.stringify(value)} must be an https origin (or http://localhost).`);
+        }
+    }
+    for (const host of sources.hosts ?? []) {
+        const origin = host === undefined || host.trim() === "" ? undefined : httpsOrigin(host.trim());
+        if (origin !== undefined)
+            origins.add(origin);
+    }
+    for (const value of sources.urls ?? []) {
+        const origin = value === undefined || value.trim() === "" ? undefined : httpsOrigin(value.trim());
+        if (origin !== undefined)
+            origins.add(origin);
+    }
+    return [...origins].sort();
+}

package/amplify/functions/public-forms/origins.ts

@@ -0,0 +1,43 @@
+/**
+ * The browser origins a site's public forms accept: the site's own public hosts, never a wildcard.
+ * Pure so that `scripts/test-public-forms.ts` can pin it.
+ */
+export type PublicFormsOriginSources = {
+  /** `publicForms.allowedOrigins` in the site's backend config: always honoured (https, or localhost for development). */
+  explicit?: readonly string[];
+  /** Public hosts the site is served from: distribution aliases, the reader domain. Bare hosts become https origins. */
+  hosts?: readonly (string | undefined)[];
+  /** URLs whose origin is the site's own: the revalidate base URL, the sign-in redirect URLs. https only, never localhost. */
+  urls?: readonly (string | undefined)[];
+};
+
+function httpsOrigin(value: string): string | undefined {
+  try {
+    const url = new URL(value.includes("://") ? value : `https://${value}`);
+    return url.protocol === "https:" && url.hostname !== "localhost" ? url.origin : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+export function derivePublicFormOrigins(sources: PublicFormsOriginSources): string[] {
+  const origins = new Set<string>();
+  for (const value of sources.explicit ?? []) {
+    try {
+      const url = new URL(value);
+      if (url.protocol === "https:" || (url.protocol === "http:" && url.hostname === "localhost")) origins.add(url.origin);
+      else throw new Error("not allowed");
+    } catch {
+      throw new Error(`publicForms.allowedOrigins entry ${JSON.stringify(value)} must be an https origin (or http://localhost).`);
+    }
+  }
+  for (const host of sources.hosts ?? []) {
+    const origin = host === undefined || host.trim() === "" ? undefined : httpsOrigin(host.trim());
+    if (origin !== undefined) origins.add(origin);
+  }
+  for (const value of sources.urls ?? []) {
+    const origin = value === undefined || value.trim() === "" ? undefined : httpsOrigin(value.trim());
+    if (origin !== undefined) origins.add(origin);
+  }
+  return [...origins].sort();
+}

package/amplify/functions/public-forms/resource.js

@@ -0,0 +1,9 @@
+import { defineFunction } from "@aws-amplify/backend";
+/** The public form receiving endpoint. Wired (table, Function URL, origins, output) by `wire.ts`. */
+export const publicForms = defineFunction({
+    name: "papyrus-public-forms",
+    entry: "./handler.ts",
+    timeoutSeconds: 10,
+    memoryMB: 256,
+    resourceGroupName: "data",
+});

package/amplify/functions/public-forms/resource.ts

@@ -0,0 +1,10 @@
+import { defineFunction } from "@aws-amplify/backend";
+
+/** The public form receiving endpoint. Wired (table, Function URL, origins, output) by `wire.ts`. */
+export const publicForms = defineFunction({
+  name: "papyrus-public-forms",
+  entry: "./handler.ts",
+  timeoutSeconds: 10,
+  memoryMB: 256,
+  resourceGroupName: "data",
+});

package/amplify/functions/public-forms/wire.js

@@ -0,0 +1,25 @@
+import { RemovalPolicy, Stack } from "aws-cdk-lib";
+import * as dynamodb from "aws-cdk-lib/aws-dynamodb";
+import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
+import { FunctionUrlAuthType } from "aws-cdk-lib/aws-lambda";
+export const PUBLIC_FORMS_OUTPUT_KEY = "publicForms";
+/**
+ * Wires the endpoint: the rate-limit counter table (TTL), the Function URL and the function's settings, and returns
+ * the URL for the `custom.publicForms.endpoint` output. Everything lives in the function's own stack.
+ */
+export function wirePublicForms(backend, wiring) {
+    const lambda = backend.publicForms.resources.lambda;
+    const stack = Stack.of(lambda);
+    const table = new dynamodb.Table(stack, "PublicFormsLimits", {
+        partitionKey: { name: "pk", type: dynamodb.AttributeType.STRING },
+        billingMode: dynamodb.BillingMode.PAY_PER_REQUEST,
+        timeToLiveAttribute: "expiresAt",
+        removalPolicy: RemovalPolicy.DESTROY,
+    });
+    lambda.addToRolePolicy(new PolicyStatement({ effect: Effect.ALLOW, actions: ["dynamodb:UpdateItem"], resources: [table.tableArn] }));
+    backend.publicForms.addEnvironment("PAPYRUS_PUBLIC_FORMS_TABLE", table.tableName);
+    backend.publicForms.addEnvironment("PAPYRUS_PUBLIC_FORMS_ORIGINS", wiring.allowedOrigins.join(","));
+    backend.publicForms.addEnvironment("PAPYRUS_PUBLIC_FORMS_HONEYPOTS", (wiring.honeypotFields ?? []).join(","));
+    // CORS is answered by the handler (it must echo exactly one allowed origin), so the URL carries no CORS block.
+    return lambda.addFunctionUrl({ authType: FunctionUrlAuthType.NONE }).url;
+}

package/amplify/functions/public-forms/wire.ts

@@ -0,0 +1,32 @@
+import { RemovalPolicy, Stack } from "aws-cdk-lib";
+import * as dynamodb from "aws-cdk-lib/aws-dynamodb";
+import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
+import { type Function as LambdaFunction, FunctionUrlAuthType } from "aws-cdk-lib/aws-lambda";
+
+export const PUBLIC_FORMS_OUTPUT_KEY = "publicForms";
+
+export type PublicFormsWiring = {
+  allowedOrigins: string[];
+  honeypotFields?: string[];
+};
+
+/**
+ * Wires the endpoint: the rate-limit counter table (TTL), the Function URL and the function's settings, and returns
+ * the URL for the `custom.publicForms.endpoint` output. Everything lives in the function's own stack.
+ */
+export function wirePublicForms(backend: { publicForms: { resources: { lambda: unknown }; addEnvironment: (name: string, value: string) => void } }, wiring: PublicFormsWiring): string {
+  const lambda = backend.publicForms.resources.lambda as LambdaFunction;
+  const stack = Stack.of(lambda);
+  const table = new dynamodb.Table(stack, "PublicFormsLimits", {
+    partitionKey: { name: "pk", type: dynamodb.AttributeType.STRING },
+    billingMode: dynamodb.BillingMode.PAY_PER_REQUEST,
+    timeToLiveAttribute: "expiresAt",
+    removalPolicy: RemovalPolicy.DESTROY,
+  });
+  lambda.addToRolePolicy(new PolicyStatement({ effect: Effect.ALLOW, actions: ["dynamodb:UpdateItem"], resources: [table.tableArn] }));
+  backend.publicForms.addEnvironment("PAPYRUS_PUBLIC_FORMS_TABLE", table.tableName);
+  backend.publicForms.addEnvironment("PAPYRUS_PUBLIC_FORMS_ORIGINS", wiring.allowedOrigins.join(","));
+  backend.publicForms.addEnvironment("PAPYRUS_PUBLIC_FORMS_HONEYPOTS", (wiring.honeypotFields ?? []).join(","));
+  // CORS is answered by the handler (it must echo exactly one allowed origin), so the URL carries no CORS block.
+  return lambda.addFunctionUrl({ authType: FunctionUrlAuthType.NONE }).url;
+}

package/amplify/site-backend-config.ts

@@ -178,6 +178,16 @@ export type PapyrusSiteBackendConfig = {
    * Unset: no plugin, and the synthesized backend is exactly what it was before plugins existed.
    */
   plugins?: PluginRequest[];
+  /**
+   * The public form receiving endpoint every site gets (docs/public-forms.md). It accepts posts only from the site's
+   * own public hosts (distribution aliases, reader domain, revalidate URL, sign-in redirect URLs) plus these.
+   */
+  publicForms?: {
+    /** Extra https origins (or http://localhost) allowed to post, for example `https://www.example.org`. */
+    allowedOrigins?: string[];
+    /** Extra honeypot field names besides `website`. */
+    honeypotFields?: string[];
+  };
   features?: {
     consoleResponder?: boolean;
     inboundEmail?: boolean;

package/amplify/site-backend.js

@@ -35,6 +35,9 @@ import { knowledgeQuery } from "./functions/knowledge-query/resource.js";
 import { manageUserRole } from "./functions/manage-user-role/resource.js";
 import { modelAttachmentUpload } from "./functions/model-attachment-upload/resource.js";
 import { newsroomSummary } from "./functions/newsroom-summary/resource.js";
+import { derivePublicFormOrigins } from "./functions/public-forms/origins.js";
+import { publicForms } from "./functions/public-forms/resource.js";
+import { wirePublicForms } from "./functions/public-forms/wire.js";
 import { procedureAction } from "./functions/procedure-action/resource.js";
 import { readerSettings } from "./functions/reader-settings/resource.js";
 import { emailSubmissionProcessor } from "./functions/email-submission-processor/resource.js";
@@ -101,6 +104,7 @@ export function defineSiteBackend(papyrusSite) {
         modelAttachmentUpload,
         newsroomSummary,
         procedureAction,
+        publicForms,
         readerSettings,
         emailSubmissionProcessor,
         sesInboundReceive,
@@ -564,8 +568,17 @@ export function defineSiteBackend(papyrusSite) {
                 : []),
         ],
     }));
+    const publicFormsEndpoint = wirePublicForms(backend, {
+        allowedOrigins: derivePublicFormOrigins({
+            explicit: site.publicForms?.allowedOrigins,
+            hosts: [activeBrand?.readerDeployment?.domain, ...(publication?.distribution?.aliases ?? [])],
+            urls: [site.revalidateBaseUrl, ...siteAuthRedirectUrls(authConfig)],
+        }),
+        honeypotFields: site.publicForms?.honeypotFields,
+    });
     backend.addOutput({
         custom: {
+            publicForms: { endpoint: publicFormsEndpoint },
             prospectusSignIn: prospectusGoogleOnlyClient
                 ? { clientId: prospectusGoogleOnlyClient.ref, callbackPath: PROSPECTUS_SIGN_IN_CALLBACK_PATH }
                 : null,

package/amplify/site-backend.ts

@@ -42,6 +42,9 @@ import { knowledgeQuery } from "./functions/knowledge-query/resource";
 import { manageUserRole } from "./functions/manage-user-role/resource";
 import { modelAttachmentUpload } from "./functions/model-attachment-upload/resource";
 import { newsroomSummary } from "./functions/newsroom-summary/resource";
+import { derivePublicFormOrigins } from "./functions/public-forms/origins";
+import { publicForms } from "./functions/public-forms/resource";
+import { wirePublicForms } from "./functions/public-forms/wire";
 import { procedureAction } from "./functions/procedure-action/resource";
 import { readerSettings } from "./functions/reader-settings/resource";
 import { emailSubmissionProcessor } from "./functions/email-submission-processor/resource";
@@ -122,6 +125,7 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
     modelAttachmentUpload,
     newsroomSummary,
     procedureAction,
+    publicForms,
     readerSettings,
     emailSubmissionProcessor,
     sesInboundReceive,
@@ -707,8 +711,18 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
     }),
   );
 
+  const publicFormsEndpoint = wirePublicForms(backend, {
+    allowedOrigins: derivePublicFormOrigins({
+      explicit: site.publicForms?.allowedOrigins,
+      hosts: [activeBrand?.readerDeployment?.domain, ...(publication?.distribution?.aliases ?? [])],
+      urls: [site.revalidateBaseUrl, ...siteAuthRedirectUrls(authConfig)],
+    }),
+    honeypotFields: site.publicForms?.honeypotFields,
+  });
+
   backend.addOutput({
     custom: {
+      publicForms: { endpoint: publicFormsEndpoint },
       prospectusSignIn: prospectusGoogleOnlyClient
         ? { clientId: prospectusGoogleOnlyClient.ref, callbackPath: PROSPECTUS_SIGN_IN_CALLBACK_PATH }
         : null,

package/package.json

@@ -406,11 +406,12 @@
       "optional": true
     }
   },
-  "version": "5.5.0",
+  "version": "5.6.0",
   "dependencies": {
     "@aws-amplify/adapter-nextjs": "^1.7.3",
     "@aws-crypto/sha256-js": "5.2.0",
     "@aws-sdk/client-cognito-identity-provider": "3.1045.0",
+    "@aws-sdk/client-dynamodb": "^3.1045.0",
     "@aws-sdk/client-lambda": "^3.1045.0",
     "@aws-sdk/client-s3": "^3.1045.0",
     "@aws-sdk/client-secrets-manager": "3.1045.0",

package/routes.manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "5.5.0",
+  "version": "5.6.0",
   "routes": [
     {
       "file": "app/%5F_preview/[[...path]]/route.ts",