npm - @biffo/cli - Versions diffs - 0.38.0 → 0.41.0 - Mend

@biffo/cli 0.38.0 → 0.41.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (73) hide show

package/_skeletons/sibling-template/apps/frontend/pnpm-workspace.yaml ADDED Viewed

@@ -0,0 +1,19 @@
+# This file exists to STOP pnpm, not to configure a workspace.
+#
+# `pnpm install` walks up the directory tree looking for a workspace root. In a
+# scaffolded sibling repo there is nothing above this directory to find, so this
+# file changes nothing there. Inside biffo-template, however, this skeleton sits
+# under `_skeletons/` — deliberately outside the root `pnpm-workspace.yaml`'s
+# package globs — and without this file `pnpm install` run from here walks all
+# the way up and installs *biffo-template's own root workspace* instead. It
+# reports success, leaves no `node_modules` here at all, and the next command
+# then fails for a reason that looks unrelated.
+#
+# A `preinstall` guard cannot fix this: because `_skeletons/` is excluded from
+# the root workspace globs, pnpm never treats this package as part of that
+# install and so never runs its lifecycle scripts. Declaring this directory a
+# workspace root of its own is what actually terminates the upward walk.
+#
+# `packages: []` is intentional — this app has no sub-packages. pnpm always
+# installs the workspace root package itself, which is this one.
+packages: []

package/_skeletons/sibling-template/apps/frontend/src/app/globals.css ADDED Viewed

@@ -0,0 +1,34 @@
+:root {
+  color-scheme: light;
+}
+body {
+  margin: 0;
+  font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;
+  background: #f9fafb;
+  color: #111827;
+}
+.center-screen {
+  min-height: 100vh;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  text-align: center;
+  padding: 1.5rem;
+}
+.spinner {
+  width: 2rem;
+  height: 2rem;
+  border-radius: 9999px;
+  border: 4px solid #d1d5db;
+  border-top-color: #2563eb;
+  animation: spin 0.8s linear infinite;
+}
+@keyframes spin {
+  to {
+    transform: rotate(360deg);
+  }
+}

package/_skeletons/sibling-template/apps/frontend/src/app/layout.tsx ADDED Viewed

@@ -0,0 +1,15 @@
+import type { Metadata } from 'next'
+import type { ReactNode } from 'react'
+import './globals.css'
+export const metadata: Metadata = {
+  title: 'Sibling App',
+}
+export default function RootLayout({ children }: { children: ReactNode }) {
+  return (
+    <html lang="en">
+      <body>{children}</body>
+    </html>
+  )
+}

package/_skeletons/sibling-template/apps/frontend/src/app/page.test.tsx ADDED Viewed

@@ -0,0 +1,75 @@
+import { render, screen, waitFor } from '@testing-library/react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+vi.mock('@/lib/auth', () => ({
+  getCurrentSession: vi.fn(),
+}))
+vi.mock('@/lib/api-client', () => ({
+  ApiError: class ApiError extends Error {},
+  createApiClient: vi.fn(),
+}))
+// process.env is read at module-evaluation time (page.tsx isn't run through
+// Next's build-time NEXT_PUBLIC_ inlining here, just plain Vite/Node) — stub
+// it and dynamically import afterwards so HomePage sees the value.
+process.env['NEXT_PUBLIC_CORE_PORTAL_URL'] = 'https://core.example.com'
+process.env['NEXT_PUBLIC_SIBLING_PATH_PREFIX'] = '/my-sibling'
+const { getCurrentSession } = await import('@/lib/auth')
+const { createApiClient } = await import('@/lib/api-client')
+const { default: HomePage } = await import('./page')
+function fakeSession(idToken: string) {
+  return {
+    getIdToken: () => ({ getJwtToken: () => idToken }),
+  } as unknown as Awaited<ReturnType<typeof getCurrentSession>>
+}
+beforeEach(() => {
+  vi.clearAllMocks()
+})
+describe('HomePage', () => {
+  it('renders "Hello <username>" once the session and whoami call resolve', async () => {
+    vi.mocked(getCurrentSession).mockResolvedValueOnce(fakeSession('a-jwt'))
+    vi.mocked(createApiClient).mockReturnValue({
+      get: vi.fn().mockResolvedValueOnce({ username: 'keiran' }),
+      post: vi.fn(),
+      put: vi.fn(),
+      delete: vi.fn(),
+    })
+    render(<HomePage />)
+    await waitFor(() => {
+      expect(screen.getByText(/Hello keiran/)).toBeInTheDocument()
+    })
+  })
+  it('redirects to the core portal login when there is no session', async () => {
+    vi.mocked(getCurrentSession).mockResolvedValueOnce(null)
+    // jsdom's real window.location throws "Not implemented: navigation" if
+    // .href is actually set to a new URL — replace it with a plain object
+    // so we can just inspect what the page tried to navigate to.
+    const originalLocation = window.location
+    Object.defineProperty(window, 'location', {
+      value: { href: '' },
+      writable: true,
+      configurable: true,
+    })
+    render(<HomePage />)
+    await waitFor(() => {
+      expect(window.location.href).toContain('/login?return_to=')
+    })
+    Object.defineProperty(window, 'location', {
+      value: originalLocation,
+      writable: true,
+      configurable: true,
+    })
+  })
+})

package/_skeletons/sibling-template/apps/frontend/src/app/page.tsx ADDED Viewed

@@ -0,0 +1,85 @@
+'use client'
+import { useEffect, useState } from 'react'
+import { getCurrentSession } from '@/lib/auth'
+import { createApiClient, ApiError } from '@/lib/api-client'
+const SIBLING_NAME = process.env['NEXT_PUBLIC_SIBLING_NAME'] ?? 'Sibling'
+const SIBLING_PATH_PREFIX = process.env['NEXT_PUBLIC_SIBLING_PATH_PREFIX'] ?? ''
+const CORE_PORTAL_URL = process.env['NEXT_PUBLIC_CORE_PORTAL_URL'] ?? ''
+type State =
+  | { kind: 'loading' }
+  | { kind: 'signed_out' }
+  | { kind: 'ready'; username: string }
+  | { kind: 'error'; message: string }
+// This page's only job is to prove the shared-Cognito-session SSO (ADR-0007)
+// actually works end to end: no session on this origin → bounce to the core
+// portal's login with return_to set to come straight back here; a session →
+// call this sibling's OWN backend (never the core API directly, ADR-0002),
+// which independently re-verifies the JWT and echoes back the username.
+export default function HomePage() {
+  const [state, setState] = useState<State>({ kind: 'loading' })
+  useEffect(() => {
+    let cancelled = false
+    void getCurrentSession().then(async (session) => {
+      if (cancelled) return
+      if (session === null) {
+        setState({ kind: 'signed_out' })
+        return
+      }
+      const idToken = session.getIdToken().getJwtToken()
+      const api = createApiClient(() => idToken)
+      try {
+        const me = await api.get<{ username: string }>('/api/v1/whoami')
+        if (!cancelled) setState({ kind: 'ready', username: me.username })
+      } catch (err) {
+        if (!cancelled) {
+          setState({
+            kind: 'error',
+            message: err instanceof ApiError ? err.message : 'Failed to reach the API',
+          })
+        }
+      }
+    })
+    return () => {
+      cancelled = true
+    }
+  }, [])
+  useEffect(() => {
+    if (state.kind === 'signed_out' && CORE_PORTAL_URL) {
+      const returnTo = encodeURIComponent(`${SIBLING_PATH_PREFIX}/`)
+      window.location.href = `${CORE_PORTAL_URL}/login?return_to=${returnTo}`
+    }
+  }, [state])
+  if (state.kind === 'loading' || state.kind === 'signed_out') {
+    return (
+      <main className="center-screen">
+        <div className="spinner" />
+      </main>
+    )
+  }
+  if (state.kind === 'error') {
+    return (
+      <main className="center-screen">
+        <p>Signed in, but could not reach the API: {state.message}</p>
+      </main>
+    )
+  }
+  return (
+    <main className="center-screen">
+      <h1>
+        {SIBLING_NAME} - Hello {state.username}
+      </h1>
+    </main>
+  )
+}

package/_skeletons/sibling-template/apps/frontend/src/lib/api-client.ts ADDED Viewed

@@ -0,0 +1,58 @@
+// Calls THIS sibling's own backend only (never the core's database directly —
+// ADR-0002/ADR-0007). If this sibling needs core-owned data, its own backend
+// is responsible for calling the core API server-side (see
+// services/api/src/api/core_client.py) — the frontend never talks to the
+// core API directly.
+const API_URL = process.env['NEXT_PUBLIC_API_URL'] ?? ''
+export class ApiError extends Error {
+  constructor(
+    public readonly status: number,
+    message: string,
+  ) {
+    super(message)
+    this.name = 'ApiError'
+  }
+}
+async function handleResponse<T>(res: Response): Promise<T> {
+  if (!res.ok) {
+    const body = await res.text().catch(() => res.statusText)
+    throw new ApiError(res.status, body)
+  }
+  return res.json() as Promise<T>
+}
+export function createApiClient(getIdToken: () => string | null) {
+  function authHeaders(): HeadersInit {
+    const token = getIdToken()
+    return {
+      'Content-Type': 'application/json',
+      ...(token != null ? { Authorization: `Bearer ${token}` } : {}),
+    }
+  }
+  return {
+    get: <T>(path: string): Promise<T> =>
+      fetch(`${API_URL}${path}`, { headers: authHeaders() }).then((r) => handleResponse<T>(r)),
+    post: <T>(path: string, body: unknown): Promise<T> =>
+      fetch(`${API_URL}${path}`, {
+        method: 'POST',
+        headers: authHeaders(),
+        body: JSON.stringify(body),
+      }).then((r) => handleResponse<T>(r)),
+    put: <T>(path: string, body: unknown): Promise<T> =>
+      fetch(`${API_URL}${path}`, {
+        method: 'PUT',
+        headers: authHeaders(),
+        body: JSON.stringify(body),
+      }).then((r) => handleResponse<T>(r)),
+    delete: <T>(path: string): Promise<T> =>
+      fetch(`${API_URL}${path}`, { method: 'DELETE', headers: authHeaders() }).then((r) =>
+        handleResponse<T>(r),
+      ),
+  }
+}

package/_skeletons/sibling-template/apps/frontend/src/lib/auth.test.ts ADDED Viewed

@@ -0,0 +1,135 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+const getCurrentUser = vi.fn()
+const poolConstructor = vi.fn()
+vi.mock('amazon-cognito-identity-js', () => ({
+  CognitoUserPool: class {
+    constructor(...args: unknown[]) {
+      poolConstructor(...args)
+    }
+    getCurrentUser = getCurrentUser
+  },
+}))
+type SessionCallback = (err: Error | null, session: unknown) => void
+function userWithSession(session: unknown, err: Error | null = null) {
+  return {
+    getSession: (cb: SessionCallback) => {
+      cb(err, session)
+    },
+  }
+}
+function configureCognitoEnv() {
+  vi.stubEnv('NEXT_PUBLIC_CORE_COGNITO_USER_POOL_ID', 'us-east-1_TESTPOOL')
+  vi.stubEnv('NEXT_PUBLIC_CORE_COGNITO_CLIENT_ID', 'testclientid')
+}
+// Each test re-imports the module fresh: the pool is memoised after its first
+// construction, so a module instance left over from a previous test would carry
+// that test's env into the next one.
+async function loadAuth() {
+  vi.resetModules()
+  return await import('@/lib/auth')
+}
+describe('getCurrentSession', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    configureCognitoEnv()
+  })
+  afterEach(() => {
+    vi.unstubAllEnvs()
+  })
+  it('returns null when no user is stored in the shared localStorage session', async () => {
+    const { getCurrentSession } = await loadAuth()
+    getCurrentUser.mockReturnValue(null)
+    await expect(getCurrentSession()).resolves.toBeNull()
+  })
+  it('returns the session the portal established when it is valid', async () => {
+    const { getCurrentSession } = await loadAuth()
+    const session = { isValid: () => true }
+    getCurrentUser.mockReturnValue(userWithSession(session))
+    await expect(getCurrentSession()).resolves.toBe(session)
+  })
+  it('returns null when the stored session is expired/invalid', async () => {
+    const { getCurrentSession } = await loadAuth()
+    getCurrentUser.mockReturnValue(userWithSession({ isValid: () => false }))
+    await expect(getCurrentSession()).resolves.toBeNull()
+  })
+  it('returns null when getSession errors', async () => {
+    const { getCurrentSession } = await loadAuth()
+    getCurrentUser.mockReturnValue(userWithSession(null, new Error('nope')))
+    await expect(getCurrentSession()).resolves.toBeNull()
+  })
+})
+// The CognitoUserPool constructor throws ("Both UserPoolId and ClientId are
+// required") when either value is missing, and `next build` prerenders `/` in
+// Node — which imports this module. Building the pool at module scope therefore
+// made the skeleton un-buildable without real Cognito credentials in scope.
+// These tests pin that shut.
+describe('lazy pool construction', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+  afterEach(() => {
+    vi.unstubAllEnvs()
+  })
+  it('does not construct the pool merely by importing the module', async () => {
+    configureCognitoEnv()
+    await loadAuth()
+    expect(poolConstructor).not.toHaveBeenCalled()
+  })
+  it('imports cleanly with no Cognito env vars set', async () => {
+    vi.stubEnv('NEXT_PUBLIC_CORE_COGNITO_USER_POOL_ID', '')
+    vi.stubEnv('NEXT_PUBLIC_CORE_COGNITO_CLIENT_ID', '')
+    await expect(loadAuth()).resolves.toBeDefined()
+    expect(poolConstructor).not.toHaveBeenCalled()
+  })
+  it('resolves null instead of throwing when Cognito env vars are absent', async () => {
+    vi.stubEnv('NEXT_PUBLIC_CORE_COGNITO_USER_POOL_ID', '')
+    vi.stubEnv('NEXT_PUBLIC_CORE_COGNITO_CLIENT_ID', '')
+    const { getCurrentSession } = await loadAuth()
+    await expect(getCurrentSession()).resolves.toBeNull()
+    expect(poolConstructor).not.toHaveBeenCalled()
+  })
+  it('constructs the pool once, on first session read, from the core env vars', async () => {
+    configureCognitoEnv()
+    const { getCurrentSession } = await loadAuth()
+    getCurrentUser.mockReturnValue(null)
+    await getCurrentSession()
+    await getCurrentSession()
+    expect(poolConstructor).toHaveBeenCalledTimes(1)
+    expect(poolConstructor).toHaveBeenCalledWith({
+      UserPoolId: 'us-east-1_TESTPOOL',
+      ClientId: 'testclientid',
+    })
+  })
+})
+// ADR-0007: the core portal owns authentication; a sibling only reads the
+// shared session. Exporting sign-in machinery from a sibling invites a second
+// login path that bypasses the portal and silently breaks single-sign-on.
+// If you are here because you deliberately added one of these, that decision
+// belongs in an ADR — not in a green test suite.
+describe('sibling auth surface', () => {
+  it('exposes only session reading — no sign-in/sign-out machinery', async () => {
+    const authModule = await loadAuth()
+    expect(Object.keys(authModule).sort()).toEqual(['getCurrentSession'])
+  })
+})

package/_skeletons/sibling-template/apps/frontend/src/lib/auth.ts ADDED Viewed

@@ -0,0 +1,87 @@
+import {
+  CognitoUserPool,
+  type CognitoUserSession,
+  type ICognitoUserPoolData,
+} from 'amazon-cognito-identity-js'
+// ---------------------------------------------------------------------------
+// SHARED-SESSION INVARIANT — read this before changing anything below.
+//
+// A sibling NEVER signs anyone in. The core portal owns authentication
+// (ADR-0007): a sibling that finds no valid session redirects to the portal's
+// login with `?return_to=/<name>/`. This module therefore only *reads* the
+// session the portal already established.
+//
+// That works because this points at the SAME Cognito User Pool / App Client ID
+// as the core portal. The sibling and the portal live on the same origin
+// (baseurl.com/ vs baseurl.com/<name>/) and share one Cognito App Client, so
+// amazon-cognito-identity-js's own localStorage keys — keyed only by Client
+// ID, not by path — transparently carry the portal's session over here with
+// zero extra code.
+//
+// Do NOT point this at a different pool/client: that would silently break
+// single-sign-on between the portal and this sibling.
+//
+// Do NOT add signIn/signOut/completeNewPassword here either. A second login
+// path in a sibling bypasses the portal and breaks the SSO model ADR-0007
+// depends on. If this sibling ever genuinely needs sign-out, add it
+// deliberately — and decide first whether it must sign the user out of the
+// portal too.
+// ---------------------------------------------------------------------------
+// Module-private on purpose: the pool is an implementation detail of
+// getCurrentSession(), not part of this sibling's auth surface.
+//
+// Constructed LAZILY, on first session read — never at module scope. The
+// CognitoUserPool constructor throws ("Both UserPoolId and ClientId are
+// required") when either value is missing, and `next build` prerenders `/` in
+// Node, which imports this module. Constructing eagerly therefore made the
+// whole app un-buildable without the real Cognito env vars in scope — a build
+// is not a sign-in, and it has no business needing pool credentials. Deferring
+// keeps `pnpm run build` (and any import of this module) working with no env
+// configured, while an actual session read in a misconfigured deployment
+// surfaces as "signed out" rather than a hard crash.
+let userPool: CognitoUserPool | null = null
+function getUserPool(): CognitoUserPool | null {
+  if (userPool) return userPool
+  const poolData: ICognitoUserPoolData = {
+    UserPoolId: process.env['NEXT_PUBLIC_CORE_COGNITO_USER_POOL_ID'] ?? '',
+    ClientId: process.env['NEXT_PUBLIC_CORE_COGNITO_CLIENT_ID'] ?? '',
+  }
+  if (!poolData.UserPoolId || !poolData.ClientId) return null
+  userPool = new CognitoUserPool(poolData)
+  return userPool
+}
+/**
+ * Read the shared portal session, or null if there isn't a valid one.
+ *
+ * Callers pass the returned session's ID token to this sibling's own backend
+ * (see `createApiClient`, which takes a `getIdToken` callback). A null result
+ * means "redirect the user to the portal's login".
+ */
+export function getCurrentSession(): Promise<CognitoUserSession | null> {
+  return new Promise((resolve) => {
+    // No pool means no core Cognito config, which is indistinguishable from
+    // "not signed in" as far as callers are concerned.
+    const pool = getUserPool()
+    if (!pool) {
+      resolve(null)
+      return
+    }
+    const user = pool.getCurrentUser()
+    if (!user) {
+      resolve(null)
+      return
+    }
+    user.getSession((err: Error | null, session: CognitoUserSession | null) => {
+      if (err ?? !session?.isValid()) {
+        resolve(null)
+      } else {
+        resolve(session)
+      }
+    })
+  })
+}

package/_skeletons/sibling-template/apps/frontend/src/test-setup.ts ADDED Viewed

	@@ -0,0 +1 @@
1	+ import '@testing-library/jest-dom/vitest'

package/_skeletons/sibling-template/apps/frontend/tsconfig.json ADDED Viewed

@@ -0,0 +1,29 @@
+{
+  "compilerOptions": {
+    "target": "ES2017",
+    "lib": ["dom", "dom.iterable", "esnext"],
+    "allowJs": true,
+    "skipLibCheck": true,
+    "strict": true,
+    "exactOptionalPropertyTypes": true,
+    "noEmit": true,
+    "esModuleInterop": true,
+    "module": "esnext",
+    "moduleResolution": "bundler",
+    "resolveJsonModule": true,
+    "isolatedModules": true,
+    "jsx": "preserve",
+    "incremental": true,
+    "baseUrl": ".",
+    "paths": {
+      "@/*": ["./src/*"]
+    },
+    "plugins": [
+      {
+        "name": "next"
+      }
+    ]
+  },
+  "include": ["next-env.d.ts", "**/*.ts", "**/*.tsx", ".next/types/**/*.ts"],
+  "exclude": ["node_modules"]
+}

package/_skeletons/sibling-template/apps/frontend/vitest.config.ts ADDED Viewed

@@ -0,0 +1,18 @@
+import path from 'node:path'
+import react from '@vitejs/plugin-react'
+import { defineConfig } from 'vitest/config'
+export default defineConfig({
+  plugins: [react()],
+  resolve: {
+    alias: {
+      '@': path.resolve(__dirname, './src'),
+    },
+  },
+  test: {
+    globals: true,
+    environment: 'jsdom',
+    include: ['src/**/*.test.{ts,tsx}'],
+    setupFiles: ['src/test-setup.ts'],
+  },
+})

package/_skeletons/sibling-template/biffo.sibling.json ADDED Viewed

@@ -0,0 +1,7 @@
+{
+  "name": "example-sibling",
+  "core_project": "example-core-project",
+  "path_prefix": "example-sibling",
+  "description": "Rewritten by `biffo sibling create` (ADR-0007) with this sibling's real name, its paired core project's name, and its registered path prefix. The identity fields above are not meant to be hand-edited afterwards — path_prefix in particular must always match the entry this sibling was registered under in the core project's infra/siblings.auto.tfvars.json. `routes` below, however, IS yours to maintain.",
+  "routes": []
+}

package/_skeletons/sibling-template/infra/backend.tf ADDED Viewed

@@ -0,0 +1,23 @@
+terraform {
+  required_version = ">= 1.9"
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.0"
+    }
+    http = {
+      source  = "hashicorp/http"
+      version = "~> 3.4"
+    }
+  }
+  # Bucket/key/region supplied at `terraform init -backend-config=backend.hcl`
+  # time (generated by CI, or by `biffo sibling create`'s bootstrap step for
+  # local dev) — never committed. Matches the core project's own convention.
+  backend "s3" {}
+}
+provider "aws" {
+  region = var.aws_region
+}

package/_skeletons/sibling-template/infra/main.tf ADDED Viewed

@@ -0,0 +1,79 @@
+locals {
+  name_prefix = "${var.project_name}-${var.environment}"
+}
+module "storage" {
+  source = "../modules/cloud/aws/storage"
+  project_name = var.project_name
+  environment  = var.environment
+  tags         = var.tags
+}
+# Fetched at apply time and baked into the Lambda's own env vars, so JWT
+# verification never needs an outbound call to Cognito at request time
+# (matches the core project's no-NAT dev environment pattern). Key rotation
+# requires a `terraform apply` to refresh this.
+data "http" "cognito_jwks" {
+  url = "https://cognito-idp.${var.aws_region}.amazonaws.com/${var.core_cognito_user_pool_id}/.well-known/jwks.json"
+}
+module "api" {
+  source = "../modules/cloud/aws/compute"
+  project_name  = var.project_name
+  environment   = var.environment
+  function_name = "api"
+  handler       = "src.api.main.lambda_handler"
+  environment_variables = {
+    SIBLING_ENVIRONMENT          = var.environment
+    SIBLING_CORE_API_URL         = var.core_api_url
+    SIBLING_COGNITO_JWKS_JSON    = data.http.cognito_jwks.response_body
+    SIBLING_COGNITO_USER_POOL_ID = var.core_cognito_user_pool_id
+    SIBLING_COGNITO_CLIENT_ID    = var.core_cognito_client_id
+    SIBLING_COGNITO_REGION       = var.aws_region
+    SIBLING_CORS_ORIGINS         = jsonencode(var.cors_origins)
+  }
+  tags = var.tags
+}
+module "api_gateway" {
+  source = "../modules/cloud/aws/api-gateway"
+  project_name         = var.project_name
+  environment          = var.environment
+  lambda_function_arn  = module.api.function_arn
+  lambda_function_name = module.api.function_name
+  cognito_user_pool_id = var.core_cognito_user_pool_id
+  cognito_client_id    = var.core_cognito_client_id
+  aws_region           = var.aws_region
+  cors_origins         = var.cors_origins
+  tags                 = var.tags
+}
+# See variables.tf's parent_cloudfront_distribution_arn comment: this is
+# deliberately skipped (count = 0) until the core project's registration PR
+# has merged and redeployed with this sibling's origin — there's no
+# distribution ARN to trust before then. Two-phase apply, not a bug.
+resource "aws_s3_bucket_policy" "site" {
+  count  = var.parent_cloudfront_distribution_arn != "" ? 1 : 0
+  bucket = module.storage.site_bucket_name
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Sid       = "AllowCoreCloudFrontOAC"
+      Effect    = "Allow"
+      Principal = { Service = "cloudfront.amazonaws.com" }
+      Action    = "s3:GetObject"
+      Resource  = "${module.storage.site_bucket_arn}/*"
+      Condition = {
+        StringEquals = {
+          "AWS:SourceArn" = var.parent_cloudfront_distribution_arn
+        }
+      }
+    }]
+  })
+}