@auth-craft/aws-cf-stack 1.1.0 → 1.2.0

package/lib/common.sh

@@ -227,6 +227,17 @@ print_outputs_json() {
   jwtAlg="$(lambda_env "$fn" JWT_ALGORITHM)";             jwtAlg="${jwtAlg:-${LAMBDA_JWT_ALGORITHM:-EdDSA}}"
   svcPub="$(lambda_env "$fn" INTERNAL_JWT_PUBLIC_KEY)";   svcPub="${svcPub:-${LAMBDA_INTERNAL_JWT_PUBLIC_KEY:-}}"
 
+  # Worker names per scope (mirror deploy-gateway.sh: ${APP_NAME}-${STAGE}-${scope}).
+  # These are what a consumer's Cloudflare Pages project references in a Service Binding
+  # (`[[services]] service = "<worker name>"`) to front /{scope}/auth/* same-origin via
+  # @auth-craft/pages-auth-proxy. The binding lives in the consumer's Pages project, not
+  # here — `serviceBindings` is a ready-to-paste snippet they drop into their wrangler.toml.
+  local wnSystem="${APP_NAME}-${STAGE}-system"
+  local wnTenant="${APP_NAME}-${STAGE}-tenant"
+  local wnCustomer="${APP_NAME}-${STAGE}-customer"
+  local bindingSnippet
+  bindingSnippet=$(printf '[[services]]\nbinding = "AUTH_GATEWAY"\nservice = "%s"\n' "$wnCustomer")
+
   jq -n \
     --arg url "$url" --arg base "$base" --arg name "$name" \
     --arg table "$table" --arg backend "$backend" \
@@ -240,13 +251,17 @@ print_outputs_json() {
     --arg rpSystem "${CF_WORKER_ROUTE_PREFIX_SYSTEM:-/system}" \
     --arg rpTenant "${CF_WORKER_ROUTE_PREFIX_TENANT:-/tenant}" \
     --arg rpCustomer "${CF_WORKER_ROUTE_PREFIX_CUSTOMER:-/customer}" \
+    --arg wnSystem "$wnSystem" --arg wnTenant "$wnTenant" --arg wnCustomer "$wnCustomer" \
+    --arg bindingSnippet "$bindingSnippet" \
     '{stage:$stage, project:$project, region:$region,
       lambdaFunctionUrl:$url, apiBasePath:$base, authSystemName:$name,
       dynamodbTable:$table, backendUrl:$backend,
       jwtPublicKey:$jwtPub, jwtIssuer:$jwtIssuer, jwtAlgorithm:$jwtAlg,
       serviceJwtPublicKey:$svcPub,
       gatewayUrls:{system:$gwSystem, tenant:$gwTenant, customer:$gwCustomer},
-      routePrefixes:{system:$rpSystem, tenant:$rpTenant, customer:$rpCustomer}}'
+      workerNames:{system:$wnSystem, tenant:$wnTenant, customer:$wnCustomer},
+      routePrefixes:{system:$rpSystem, tenant:$rpTenant, customer:$rpCustomer},
+      pagesProxy:{serviceBindingExample:$bindingSnippet}}'
 }
 
 # ── Tool command resolution (#7: let a consumer pin its own binaries) ─────────

package/lib/deploy-gateway.sh

@@ -30,6 +30,33 @@ custom_domain_for() {
   echo "${!var:-}"
 }
 
+# Resolve per-scope static CORS origins. Precedence:
+#   CF_ALLOWED_ORIGINS_<SCOPE> > CF_ALLOWED_ORIGINS > LAMBDA_CORS_ORIGINS > '*'.
+allowed_origins_for() {
+  local scope="$1" upper var
+  upper="$(echo "$scope" | tr '[:lower:]' '[:upper:]')"
+  var="CF_ALLOWED_ORIGINS_${upper}"
+  echo "${!var:-${CF_ALLOWED_ORIGINS:-${LAMBDA_CORS_ORIGINS:-*}}}"
+}
+
+# Resolve per-scope dynamic origin SUFFIXES (e.g. '.myplatform.com'). Precedence:
+#   CF_ALLOWED_ORIGIN_SUFFIXES_<SCOPE> > CF_ALLOWED_ORIGIN_SUFFIXES > '' (disabled).
+origin_suffixes_for() {
+  local scope="$1" upper var
+  upper="$(echo "$scope" | tr '[:lower:]' '[:upper:]')"
+  var="CF_ALLOWED_ORIGIN_SUFFIXES_${upper}"
+  echo "${!var:-${CF_ALLOWED_ORIGIN_SUFFIXES:-}}"
+}
+
+# Resolve a per-scope CORS KV namespace id (CF_CORS_KV_ID_CUSTOMER, …) — empty = no
+# dynamic KV allowlist for that scope. Typically only the customer scope sets this.
+cors_kv_id_for() {
+  local scope="$1" upper var
+  upper="$(echo "$scope" | tr '[:lower:]' '[:upper:]')"
+  var="CF_CORS_KV_ID_${upper}"
+  echo "${!var:-}"
+}
+
 # Enable the workers.dev subdomain for a worker with no custom domain (so it's reachable).
 enable_workers_dev() {
   local worker_name="$1"
@@ -60,11 +87,10 @@ deploy_gateway() {
   # Anti-drift: BACKEND_URL the worker forwards onto = Function URL + API base path.
   local backend_url="${LAMBDA_FUNCTION_URL%/}${API_BASE_PATH}"
 
-  # Shared config across the 3 workers.
-  local environment jwt_issuer allowed_origins
+  # Shared config across the 3 workers (CORS is now resolved PER SCOPE below).
+  local environment jwt_issuer
   environment="$RUNTIME_NODE_ENV"
   jwt_issuer="${LAMBDA_JWT_ISSUER:-${AUTH_SYSTEM_NAME:-$RESOURCE_NAME}}"
-  allowed_origins="${CF_ALLOWED_ORIGINS:-${LAMBDA_CORS_ORIGINS:-*}}"
 
   local jwt_alg="${LAMBDA_JWT_ALGORITHM:-EdDSA}"
   local svc_route="${LAMBDA_SERVICE_ROUTE_PATH:-/internal}"
@@ -74,22 +100,43 @@ deploy_gateway() {
 
   GATEWAY_URLS=()
   local scope worker_name route_prefix custom_domain url
+  local allowed_origins origin_suffixes cors_kv_id config_file
   for scope in system tenant customer; do
     worker_name="${APP_NAME}-${STAGE}-${scope}"
     route_prefix="$(route_prefix_for "$scope")"
     custom_domain="$(custom_domain_for "$scope")"
+    allowed_origins="$(allowed_origins_for "$scope")"
+    origin_suffixes="$(origin_suffixes_for "$scope")"
+    cors_kv_id="$(cors_kv_id_for "$scope")"
 
     info "Deploying $worker_name (scope=$scope route_prefix=$route_prefix)…"
 
+    # When a CORS KV id is set for this scope (typically customer), deploy with a
+    # temp config that appends a [[kv_namespaces]] binding (CORS_KV) — a binding can't
+    # be set via --var. Otherwise use the shipped config unchanged (KV disabled).
+    config_file="$WRANGLER_DIR/wrangler.toml"
+    if [[ -n "$cors_kv_id" ]]; then
+      config_file="$(mktemp "${TMPDIR:-/tmp}/wrangler-${scope}.XXXXXX.toml")"
+      cat "$WRANGLER_DIR/wrangler.toml" >"$config_file"
+      {
+        echo ''
+        echo '[[kv_namespaces]]'
+        echo 'binding = "CORS_KV"'
+        echo "id = \"$cors_kv_id\""
+      } >>"$config_file"
+      info "  dynamic CORS: KV binding CORS_KV → $cors_kv_id"
+    fi
+
     # Deploy the prebuilt bundle with per-scope vars (flags override the toml).
     wrangler deploy \
       --name "$worker_name" \
-      --config "$WRANGLER_DIR/wrangler.toml" \
+      --config "$config_file" \
       --no-bundle \
       --var "ENVIRONMENT:$environment" \
       --var "AUTH_SCOPE:$scope" \
       --var "ROUTE_PREFIX:$route_prefix" \
       --var "ALLOWED_ORIGINS:$allowed_origins" \
+      --var "ALLOWED_ORIGIN_SUFFIXES:$origin_suffixes" \
       --var "JWT_ISSUER:$jwt_issuer" \
       --var "JWT_ALLOWED_ALGORITHMS:$jwt_alg" \
       --var "SERVICE_ROUTE_PREFIX:$svc_route" \
@@ -97,6 +144,9 @@ deploy_gateway() {
       --var "SERVICE_JWT_ISSUER:$svc_iss" \
       --var "SERVICE_JWT_ALLOWED_ALGORITHMS:$svc_alg" >/dev/null
 
+    # Clean up the temp config (only created when KV was bound).
+    [[ "$config_file" != "$WRANGLER_DIR/wrangler.toml" ]] && rm -f "$config_file"
+
     # Secrets (piped via stdin).
     put_secret "$worker_name" BACKEND_URL "$backend_url"
     put_secret "$worker_name" BACKEND_GATEWAY_SECRET "${LAMBDA_GATEWAY_SECRET:-}"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@auth-craft/aws-cf-stack",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "description": "Self-contained, versioned distribution of the Auth Craft AWS (DynamoDB + Lambda) + Cloudflare gateway stack. Bundles prebuilt Lambda/worker artifacts + CDK app so consumers deploy without cloning auth-craft.",
   "type": "module",
   "bin": {
@@ -16,17 +16,17 @@
     ".env.example"
   ],
   "dependencies": {
-    "aws-cdk-lib": "^2.258.1",
+    "aws-cdk-lib": "^2.260.0",
     "constructs": "^10.6.0"
   },
   "devDependencies": {
-    "@types/node": "^25.9.2",
+    "@types/node": "^25.9.3",
     "tsx": "^4.22.4",
     "typescript": "^6.0.3"
   },
   "peerDependencies": {
-    "aws-cdk": "^2.1126.0",
-    "wrangler": "^4.99.0"
+    "aws-cdk": "^2.1128.0",
+    "wrangler": "^4.101.0"
   },
   "peerDependenciesMeta": {
     "aws-cdk": {

package/wrangler/wrangler.toml

@@ -4,6 +4,11 @@
 # (assets/gateway/worker.js). deploy-gateway.sh overrides `name` and injects vars
 # per scope via `wrangler deploy --name <name> --var K:V ...`, and pushes secrets via
 # `wrangler secret put`. No source compile happens at deploy time.
+#
+# CORS_KV binding (dynamic CORS allowlist) is NOT declared here: a KV binding can't be
+# set via --var, so when CF_CORS_KV_ID_<SCOPE> is set deploy-gateway.sh deploys that
+# scope with a temp copy of this file that appends a [[kv_namespaces]] block. Leaving
+# it out here keeps scopes without a KV id (system/tenant) binding-free.
 name = "auth-craft-gateway"
 main = "../assets/gateway/worker.js"
 compatibility_date = "2024-11-27"