@deployfoundation/foundation-deploy 0.2.15 → 0.2.17

package/src/deploy/deploy.ts

@@ -46,6 +46,13 @@ import {
   plannedLicenseCheck,
   verifyLicense,
 } from "./license.ts";
+import {
+  type PagesDomainState,
+  pagesDomainMode,
+  pagesDomainReport,
+  pagesDomainState,
+  publicNs,
+} from "./pages-domain.ts";
 import { AGENT_DOCKERFILE, FOUNDATION_ROOT, INFRA_ROOT } from "./paths.ts";
 import {
   type ReleaseRequest,
@@ -239,6 +246,7 @@ export async function cdkDeploy(ctx: AwsContext, opts: CdkDeployOptions): Promis
     ...(opts.runtimeSecretDigest === undefined
       ? []
       : ["-c", `runtimeSecretDigest=${opts.runtimeSecretDigest}`]),
+    ...(await pagesDomainContext(ctx)),
   ];
   await run(
     [
@@ -259,6 +267,39 @@ export async function cdkDeploy(ctx: AwsContext, opts: CdkDeployOptions): Promis
   );
 }
 
+/** The custom pages domain's state, read from the pages stack and public DNS. */
+async function pagesDomain(ctx: AwsContext): Promise<PagesDomainState> {
+  return pagesDomainState(ctx.instance, {
+    output: (key) => optionalOutput(ctx, ctx.names.pages, key),
+    resolveNs: publicNs,
+  });
+}
+
+/**
+ * `-c pagesDomainDelegated=true` once a Foundation-made pages zone is
+ * delegated, so this deploy issues the certificate and attaches the domain
+ * (`pages-domain.ts`). A dry run looks nothing up and leaves it pending.
+ */
+async function pagesDomainContext(ctx: AwsContext): Promise<string[]> {
+  if (pagesDomainMode(ctx.instance) !== "own-zone" || ctx.dryRun === true) return [];
+  return (await pagesDomain(ctx)).delegated ? ["-c", "pagesDomainDelegated=true"] : [];
+}
+
+/** Where pages are served, and the NS checklist step while a custom domain waits. */
+export async function reportPagesDomain(ctx: AwsContext): Promise<void> {
+  if (!ctx.instance.integrations.pages) return;
+  console.log("▶ hosted pages");
+  if (ctx.dryRun === true) {
+    console.log(
+      `  <${ctx.names.pages}.PagesBaseUrl>; NS records from <${ctx.names.pages}.PagesNameServers>`,
+    );
+    return;
+  }
+  const state = await pagesDomain(ctx);
+  const baseUrl = await optionalOutput(ctx, ctx.names.pages, "PagesBaseUrl");
+  for (const line of pagesDomainReport(state, baseUrl)) console.log(line);
+}
+
 /** A stack output that may not exist yet (a stack deployed before it was added). */
 async function optionalOutput(
   ctx: AwsContext,
@@ -370,6 +411,12 @@ export async function syncRuntimeSecret(ctx: AwsContext): Promise<string[]> {
       ? `<${api}.CrmPolicyFingerprint>`
       : await optionalOutput(ctx, api, "CrmPolicyFingerprint")
     : undefined;
+  // Pages have a stack of their own, present only with the integration.
+  const pagesApiFunctionArn = ctx.instance.integrations.pages
+    ? dry
+      ? `<${ctx.names.pages}.PagesApiFunctionArn>`
+      : await optionalOutput(ctx, ctx.names.pages, "PagesApiFunctionArn")
+    : undefined;
   const otterProxyFunctionArn = dry
     ? `<${api}.OtterProxyFunctionArn>`
     : await optionalOutput(ctx, api, "OtterProxyFunctionArn");
@@ -414,6 +461,7 @@ export async function syncRuntimeSecret(ctx: AwsContext): Promise<string[]> {
     ...(browserProxyFunctionArn === undefined ? {} : { browserProxyFunctionArn }),
     ...(crmProxyFunctionArn === undefined ? {} : { crmProxyFunctionArn }),
     ...(crmPolicyFingerprint === undefined ? {} : { crmPolicyFingerprint }),
+    ...(pagesApiFunctionArn === undefined ? {} : { pagesApiFunctionArn }),
     ...(otterProxyFunctionArn === undefined ? {} : { otterProxyFunctionArn }),
     ...(knockProxyFunctionArn === undefined ? {} : { knockProxyFunctionArn }),
     ...(upworkProxyFunctionArn === undefined ? {} : { upworkProxyFunctionArn }),
@@ -630,6 +678,7 @@ export async function deploy(ctx: AwsContext, opts: DeployOptions): Promise<void
       ...(runtimeSecretDigest === undefined ? {} : { runtimeSecretDigest }),
     });
   await deployStacks(deployed);
+  await reportPagesDomain(ctx);
   if (ctx.instance.integrations.knock) {
     console.log(`▶ Knock OAuth public-client registration (${ctx.names.secretKnockOauthClient})`);
     console.log(`  ${await syncKnockOAuthClient(ctx)}`);

package/src/deploy/pages-domain.ts

@@ -0,0 +1,106 @@
+/**
+ * The custom pages domain's delegation, as the deploy tool sees it.
+ *
+ * With `pages.domain` and no `pages.hostedZoneId`, the pages stack creates a
+ * Route 53 zone for exactly that subdomain and outputs its name servers. The
+ * company adds those as NS records at its own DNS provider. Until they
+ * resolve, issuing the certificate would leave CloudFormation waiting on ACM
+ * validation, so the stack keeps serving on the CloudFront default domain.
+ * Before each `cdk deploy` this module looks the delegation up in public DNS
+ * and, once it matches the zone, passes `-c pagesDomainDelegated=true`: that
+ * deploy issues the certificate and attaches the domain.
+ *
+ * Sticky: once the stack reports this domain attached, it stays attached
+ * without another lookup, so a transient DNS failure can never detach a
+ * working domain. A changed `pages.domain` starts over.
+ */
+import { Resolver } from "node:dns/promises";
+
+export type PagesDomainMode = "none" | "own-zone" | "parent-zone";
+
+export interface PagesDomainInstance {
+  integrations: { pages: boolean };
+  pages: { domain?: string; hostedZoneId?: string };
+}
+
+export interface PagesDomainDeps {
+  /** A pages stack output, or undefined when the stack or output does not exist yet. */
+  output(key: string): Promise<string | undefined>;
+  /** NS records for a name from public DNS; empty when there are none. */
+  resolveNs(name: string): Promise<string[]>;
+}
+
+export interface PagesDomainState {
+  mode: PagesDomainMode;
+  domain?: string;
+  /** The certificate and alias may be (or already are) attached. */
+  delegated: boolean;
+  /** The Foundation-made zone's name servers, for the NS checklist step. */
+  nameServers: string[];
+}
+
+export function pagesDomainMode(instance: PagesDomainInstance): PagesDomainMode {
+  if (!instance.integrations.pages || instance.pages.domain === undefined) return "none";
+  return instance.pages.hostedZoneId === undefined ? "own-zone" : "parent-zone";
+}
+
+function normal(name: string): string {
+  return name.trim().toLowerCase().replace(/\.$/, "");
+}
+
+export async function pagesDomainState(
+  instance: PagesDomainInstance,
+  deps: PagesDomainDeps,
+): Promise<PagesDomainState> {
+  const mode = pagesDomainMode(instance);
+  const domain = instance.pages.domain;
+  if (mode === "none" || domain === undefined) return { mode, delegated: false, nameServers: [] };
+  // The company's own zone is authoritative already: nothing to wait for.
+  if (mode === "parent-zone") return { mode, domain, delegated: true, nameServers: [] };
+  const nameServers = ((await deps.output("PagesNameServers")) ?? "")
+    .split(",")
+    .map(normal)
+    .filter((server) => server !== "");
+  if (
+    (await deps.output("PagesCustomDomainAttached")) === "true" &&
+    (await deps.output("PagesCustomDomain")) === domain
+  )
+    return { mode, domain, delegated: true, nameServers };
+  if (nameServers.length === 0) return { mode, domain, delegated: false, nameServers };
+  let answer: string[];
+  try {
+    answer = (await deps.resolveNs(domain)).map(normal);
+  } catch {
+    answer = [];
+  }
+  const delegated = nameServers.every((server) => answer.includes(server));
+  return { mode, domain, delegated, nameServers };
+}
+
+/** Public DNS, not the machine's resolver: a split-horizon office network must not decide. */
+export async function publicNs(name: string): Promise<string[]> {
+  const resolver = new Resolver({ timeout: 5_000, tries: 2 });
+  resolver.setServers(["1.1.1.1", "8.8.8.8"]);
+  try {
+    return await resolver.resolveNs(name);
+  } catch {
+    return [];
+  }
+}
+
+/** The lines the deploy prints: a checklist step while pending, the address once attached. */
+export function pagesDomainReport(state: PagesDomainState, baseUrl: string | undefined): string[] {
+  if (state.mode === "none" || state.domain === undefined)
+    return baseUrl === undefined ? [] : [`  pages are served at ${baseUrl}`];
+  if (state.delegated) return [`  pages are served at https://${state.domain}`];
+  if (state.nameServers.length === 0)
+    return [
+      `  ${state.domain}: the pages zone is created by this deploy; its NS records follow on the next run.`,
+    ];
+  return [
+    `  ☐ add these NS records for ${state.domain} at your DNS provider:`,
+    ...state.nameServers.map((server) => `      ${state.domain}.  NS  ${server}.`),
+    `    until they resolve, pages are served at ${baseUrl ?? "the CloudFront default domain"}.`,
+    "    Deploy again once they do: that deploy issues the certificate and moves pages to the domain.",
+  ];
+}

package/src/deploy/runtime-secret.ts

@@ -76,6 +76,11 @@ export interface RuntimeSecretInputs {
   crmProxyFunctionArn?: string;
   /** Hash of the CRM policy baked into the deployed proxy; never a credential. */
   crmPolicyFingerprint?: string;
+  /**
+   * `FoundationPages.PagesApiFunctionArn` — the only pages binding the
+   * container gets. Bucket, table and cookie key stay behind the proxy.
+   */
+  pagesApiFunctionArn?: string;
   /**
    * `FoundationApi.OtterProxyFunctionArn` — the ONLY Otter binding given to the
    * shell-capable container. The API credential remains readable solely by
@@ -217,6 +222,9 @@ export function composeRuntimeSecret(inputs: RuntimeSecretInputs): Record<string
     ...(inputs.crmPolicyFingerprint !== undefined && inputs.crmPolicyFingerprint !== ""
       ? { FOUNDATION_CRM_POLICY_FINGERPRINT: inputs.crmPolicyFingerprint }
       : {}),
+    ...(inputs.pagesApiFunctionArn !== undefined && inputs.pagesApiFunctionArn !== ""
+      ? { FOUNDATION_PAGES_API_FUNCTION_ARN: inputs.pagesApiFunctionArn }
+      : {}),
     ...(inputs.otterProxyFunctionArn !== undefined && inputs.otterProxyFunctionArn !== ""
       ? { FOUNDATION_OTTER_PROXY_FUNCTION_ARN: inputs.otterProxyFunctionArn }
       : {}),

package/src/deploy/setup.ts

@@ -33,6 +33,7 @@ import {
   cdkDeploy,
   currentRuntimeSecretDigest,
   refreshRuntimeSecret,
+  reportPagesDomain,
   syncKnockOAuthClient,
   syncRuntimeSecret,
 } from "./deploy.ts";
@@ -189,6 +190,16 @@ async function reportSlackManifest(ctx: AwsContext): Promise<void> {
     EVENTS_REQUEST_URL: await output(ctx, ctx.names.api, "EventsUrl"),
     COMMANDS_REQUEST_URL: await output(ctx, ctx.names.api, "CommandsUrl"),
     INTERACTIVE_REQUEST_URL: await output(ctx, ctx.names.api, "InteractiveUrl"),
+    // Both sign-in callbacks: the pages domain's, and the CloudFront default
+    // name's, which links posted before a custom domain attached still use.
+    ...(ctx.instance.integrations.pages
+      ? {
+          PAGES_AUTH_REDIRECT_URL: [
+            await output(ctx, ctx.names.pages, "PagesAuthRedirectUrl"),
+            await output(ctx, ctx.names.pages, "PagesDefaultAuthRedirectUrl"),
+          ].join(","),
+        }
+      : {}),
   });
   console.log(`  manifest: ${JSON.stringify(manifest)}`);
   console.log(
@@ -411,8 +422,9 @@ export async function setup(
   step(13, "deploy the instance's own pipeline, if it has one");
   await deployPipelineStack(ctx);
 
-  step(14, "the Slack app manifest for the deployed API");
+  step(14, "the Slack app manifest for the deployed API, and the pages domain");
   await reportSlackManifest(ctx);
+  await reportPagesDomain(ctx);
 
   step(15, "smoke test the runtime");
   await smokeTest(ctx);

package/src/deploy/slack-manifest.ts

@@ -33,17 +33,27 @@ export interface SlackManifestInstance {
   displayName: string;
   /** Rendered into `/<prefix>-<suffix>` for every slash command. */
   commandPrefix: string;
+  /**
+   * The instance hosts pages: the app then asks for the `openid` user scope
+   * that Sign in with Slack needs, and registers the pages sign-in redirect.
+   */
+  pages?: boolean;
 }
 
 export interface SlackManifestEnv {
   EVENTS_REQUEST_URL?: string;
   COMMANDS_REQUEST_URL?: string;
   INTERACTIVE_REQUEST_URL?: string;
+  /**
+   * Comma-separated sign-in callbacks: the pages stack's `PagesAuthRedirectUrl`
+   * and `PagesDefaultAuthRedirectUrl` outputs.
+   */
+  PAGES_AUTH_REDIRECT_URL?: string;
 }
 
 export interface SlackManifest {
   features: { slash_commands?: Array<{ command: string }> };
-  oauth_config: { scopes: { bot: string[] } };
+  oauth_config: { scopes: { bot: string[]; user?: string[] }; redirect_urls?: string[] };
   settings: {
     event_subscriptions?: { request_url: string; bot_events: string[] };
     interactivity?: unknown;
@@ -75,6 +85,21 @@ export function buildSlackManifest(
       "app-manifest.yml: bot scopes are generated from the Foundation capability registry; remove them from the template",
     );
   manifest.oauth_config = { scopes: { bot: requiredSlackScopes(CAPABILITY_IDS) } };
+  if (instance.pages === true) {
+    // Sign in with Slack (OpenID Connect) for hosted pages: a user scope and
+    // the sign-in callback. Without the URL (the pages stack is not deployed
+    // yet) the scope alone is harmless and the redirect is added next time.
+    manifest.oauth_config.scopes.user = ["openid"];
+    const redirects = [
+      ...new Set(
+        (env.PAGES_AUTH_REDIRECT_URL ?? "")
+          .split(",")
+          .map((url) => url.trim())
+          .filter((url) => url !== ""),
+      ),
+    ];
+    if (redirects.length > 0) manifest.oauth_config.redirect_urls = redirects;
+  }
 
   // Every command a registered capability needs must be in the template; the
   // template may carry more (help, drive) than the registry knows about.
@@ -106,7 +131,23 @@ export function buildSlackManifest(
 export function slackManifestFor(instance: Instance, env: SlackManifestEnv): SlackManifest {
   return buildSlackManifest(
     readFileSync(SLACK_APP_MANIFEST_PATH, "utf8"),
-    { displayName: instance.displayName, commandPrefix: slackCommandPrefix(instance) },
-    env,
+    {
+      displayName: instance.displayName,
+      commandPrefix: slackCommandPrefix(instance),
+      pages: instance.integrations.pages,
+    },
+    {
+      ...env,
+      // A custom pages domain's callback is known from the instance file alone;
+      // registering it early is harmless while the domain waits for delegation.
+      ...(instance.integrations.pages && instance.pages.domain !== undefined
+        ? {
+            PAGES_AUTH_REDIRECT_URL: [
+              `https://${instance.pages.domain}/_auth/callback`,
+              ...(env.PAGES_AUTH_REDIRECT_URL === undefined ? [] : [env.PAGES_AUTH_REDIRECT_URL]),
+            ].join(","),
+          }
+        : {}),
+    },
   );
 }

package/src/index.ts

@@ -52,6 +52,7 @@ export { FoundationCi, type FoundationCiProps } from "./stacks/ci-stack.ts";
 export { FoundationData, type FoundationDataProps } from "./stacks/data-stack.ts";
 export { FoundationNetwork, type FoundationNetworkProps } from "./stacks/network-stack.ts";
 export { NewsletterStack, type NewsletterStackProps } from "./stacks/newsletter-stack.ts";
+export { FoundationPages, type FoundationPagesProps } from "./stacks/pages-stack.ts";
 export {
   BUILD_TIMEOUT,
   DEFAULT_BUILDSPEC_PATH,

package/src/stacks/agent-stack.ts

@@ -401,6 +401,82 @@ export class FoundationAgent extends cdk.Stack {
     );
   }
 
+  /**
+   * Hosted pages belong to the conversations that made them, and every read
+   * or write goes through the Pages API, which checks the conversation. The
+   * shell-capable agent (and the ReadOnlyAccess role it can assume, which
+   * would otherwise read any bucket) must not reach the bucket, table, cookie
+   * key or edge key store directly: that would let one channel's turn read
+   * another channel's pages, or mint a viewing cookie. Matched by name
+   * pattern, like the CRM table, so retained resources stay covered and
+   * FoundationAgent needs nothing from FoundationPages.
+   *
+   * The execution role also gets its one pages grant here: invoking the Pages
+   * API, by function name. Both go in a managed policy of their own so the
+   * roles' inline policies (the execution role's is near IAM's size limit)
+   * are unchanged for instances without pages.
+   */
+  private pagesPolicy(
+    id: string,
+    role: iam.Role,
+    instance: Instance,
+    options: { invoke: boolean },
+  ): void {
+    if (!provisionsIntegration(instance, "pages")) return;
+    const stack = cdk.Stack.of(this);
+    const table = stack.formatArn({
+      service: "dynamodb",
+      resource: "table",
+      resourceName: "*-PagesTable*",
+    });
+    const statements = [
+      new iam.PolicyStatement({
+        sid: "DenyDirectPagesAccess",
+        effect: iam.Effect.DENY,
+        actions: [
+          "s3:*",
+          "dynamodb:*",
+          "secretsmanager:GetSecretValue",
+          "secretsmanager:BatchGetSecretValue",
+          "cloudfront-keyvaluestore:*",
+        ],
+        resources: [
+          `arn:${stack.partition}:s3:::*pagesbucket*`,
+          `arn:${stack.partition}:s3:::*pagesbucket*/*`,
+          table,
+          `${table}/index/*`,
+          stack.formatArn({
+            service: "secretsmanager",
+            resource: "secret",
+            resourceName: `${this.names.secretPagesCookieKey}-??????`,
+            arnFormat: cdk.ArnFormat.COLON_RESOURCE_NAME,
+          }),
+          `arn:${stack.partition}:cloudfront::${stack.account}:key-value-store/*`,
+        ],
+      }),
+    ];
+    if (options.invoke)
+      statements.push(
+        new iam.PolicyStatement({
+          sid: "PagesApiInvoke",
+          actions: ["lambda:InvokeFunction"],
+          resources: [
+            stack.formatArn({
+              service: "lambda",
+              resource: "function",
+              resourceName: this.names.pagesApiFunctionName,
+              arnFormat: cdk.ArnFormat.COLON_RESOURCE_NAME,
+            }),
+          ],
+        }),
+      );
+    new iam.ManagedPolicy(this, id, {
+      description: `${instance.displayName} hosted pages: only through the Pages API`,
+      roles: [role],
+      statements,
+    });
+  }
+
   private denyDirectUpworkApprovalAccess(
     role: iam.Role,
     upworkApprovalTable: dynamodb.ITable | undefined,
@@ -484,6 +560,7 @@ export class FoundationAgent extends cdk.Stack {
     this.denyDirectKnockSecretAccess(role, props);
     this.denyDirectUpworkApprovalAccess(role, props.upworkApprovalTable);
     this.denyDirectEtradeAccess(role, props);
+    this.pagesPolicy("AgentReadOnlyPagesPolicy", role, props.instance, { invoke: false });
     role.addToPolicy(
       new iam.PolicyStatement({
         sid: "DenyAgentCoreBrowserMetadata",
@@ -576,6 +653,7 @@ export class FoundationAgent extends cdk.Stack {
     this.denyDirectKnockSecretAccess(role, props);
     this.denyDirectUpworkApprovalAccess(role, props.upworkApprovalTable);
     this.denyDirectEtradeAccess(role, props);
+    this.pagesPolicy("AgentExecutionPagesPolicy", role, props.instance, { invoke: true });
 
     // Foundation's own repository when a release names the image, because the
     // runtime then pulls across accounts. The pull also needs Foundation's

package/src/stacks/pages-edge-function.ts

@@ -0,0 +1,149 @@
+/**
+ * The CloudFront viewer-request function in front of every hosted page.
+ *
+ * It runs on each request, before the cache, in CloudFront's `cloudfront-js-2.0`
+ * runtime, and does three things:
+ *
+ * 1. `/_auth/*` passes through to the sign-in Lambda, with the viewer's Host
+ *    copied into `x-foundation-pages-host` (the Lambda's Function URL rejects
+ *    a foreign Host, and needs the real one to build Slack's redirect URI).
+ * 2. `/p/<pageId>/…` needs a valid `fpa` cookie for that page: the HMAC the
+ *    sign-in Lambda made with the key this function reads from the attached
+ *    KeyValueStore (`@deployfoundation/foundation-core/page-cookie` is the
+ *    signer; a test holds the two to one format). No cookie, a cookie for
+ *    another page, or an expired one is a 302 to `/_auth/start`.
+ * 3. A granted request is rewritten onto its S3 key (the layout in
+ *    `packages/capability-pages/src/layout.ts`): a trailing `/` gets
+ *    `index.html`, and an extensionless path is a single-page-app route that
+ *    gets the version's root `index.html` (how an open-slide deck's `/s/<id>`
+ *    route loads). `source/` and `uploads/` have no public path at all.
+ *
+ * Anything else is a 404. Dot segments and encoded separators are refused
+ * before rewriting so no path can climb into another page's prefix.
+ *
+ * The runtime is not Node: `var`, plain functions, and only the `crypto`
+ * HMAC/hash subset. `__KVS_ID__` is replaced with the store id at synth.
+ */
+
+/** The KeyValueStore key holding the cookie HMAC key; the seeding resource writes it. */
+export const PAGES_EDGE_KEY_NAME = "cookie-key-v1";
+/** Header the function sets for the sign-in Lambda. */
+export const PAGES_HOST_HEADER = "x-foundation-pages-host";
+
+export const PAGES_VIEWER_REQUEST_SOURCE = `import cf from 'cloudfront';
+import crypto from 'crypto';
+
+var kvs = cf.kvs('__KVS_ID__');
+var COOKIE = 'fpa';
+var KEY_NAME = '${PAGES_EDGE_KEY_NAME}';
+var HOST_HEADER = '${PAGES_HOST_HEADER}';
+var PAGE_RE = /^\\/p\\/([a-z0-9]{24})(\\/.*)?$/;
+var VERSION_RE = /^\\/v([1-9][0-9]{0,5})(\\/.*)?$/;
+var EXPORT_RE = /^\\/exports\\/v([1-9][0-9]{0,5})\\/([^\\/]+)$/;
+var UNSAFE_RE = /(^|\\/)\\.\\.?(\\/|$)|\\/\\/|%2e|%2f|%5c|\\\\/i;
+var USER_RE = /^[UW][A-Z0-9]{2,31}$/;
+var EXP_RE = /^[0-9]{1,12}$/;
+
+function reply(status, description, body) {
+  return {
+    statusCode: status,
+    statusDescription: description,
+    headers: {
+      'content-type': { value: 'text/plain; charset=utf-8' },
+      'cache-control': { value: 'no-store' }
+    },
+    body: { encoding: 'text', data: body }
+  };
+}
+
+function redirect(location) {
+  return {
+    statusCode: 302,
+    statusDescription: 'Found',
+    headers: { location: { value: location }, 'cache-control': { value: 'no-store' } }
+  };
+}
+
+function equal(a, b) {
+  if (a.length !== b.length) return false;
+  var diff = 0;
+  for (var i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  return diff === 0;
+}
+
+function validCookie(value, pageId, key, now) {
+  if (typeof value !== 'string' || value.length > 256) return false;
+  var parts = value.split('.');
+  if (parts.length !== 5 || parts[0] !== 'v1' || parts[1] !== pageId) return false;
+  if (!USER_RE.test(parts[2]) || !EXP_RE.test(parts[3]) || Number(parts[3]) <= now) return false;
+  var mac = crypto.createHmac('sha256', key).update(parts.slice(0, 4).join('.')).digest('hex');
+  return equal(mac, parts[4]);
+}
+
+function cookieValues(request) {
+  var cookie = request.cookies ? request.cookies[COOKIE] : undefined;
+  if (!cookie) return [];
+  var values = [cookie.value];
+  if (cookie.multiValue) {
+    for (var i = 0; i < cookie.multiValue.length; i++) values.push(cookie.multiValue[i].value);
+  }
+  return values;
+}
+
+function objectPath(pageId, rest) {
+  var prefix = '/pages/' + pageId;
+  if (rest === '/') return prefix + '/latest.html';
+  var version = VERSION_RE.exec(rest);
+  if (version) {
+    var sub = version[2];
+    if (sub.charAt(sub.length - 1) === '/') {
+      sub = sub + 'index.html';
+    } else if (sub.slice(sub.lastIndexOf('/') + 1).indexOf('.') === -1) {
+      sub = '/index.html';
+    }
+    return prefix + '/v' + version[1] + '/build' + sub;
+  }
+  var download = EXPORT_RE.exec(rest);
+  if (download) return prefix + '/v' + download[1] + '/exports/' + download[2];
+  return null;
+}
+
+async function handler(event) {
+  var request = event.request;
+  var uri = request.uri;
+  if (uri.indexOf('/_auth/') === 0) {
+    request.headers[HOST_HEADER] = { value: request.headers.host ? request.headers.host.value : '' };
+    return request;
+  }
+  var page = PAGE_RE.exec(uri);
+  if (!page || UNSAFE_RE.test(uri)) return reply(404, 'Not Found', 'Not found');
+  var pageId = page[1];
+  var rest = page[2] || '';
+  if (rest === '') return redirect(uri + '/');
+  var version = VERSION_RE.exec(rest);
+  if (version && version[2] === undefined) return redirect(uri + '/');
+  var target = objectPath(pageId, rest);
+  if (target === null) return reply(404, 'Not Found', 'Not found');
+
+  var key;
+  try {
+    key = await kvs.get(KEY_NAME);
+  } catch (err) {
+    return reply(503, 'Service Unavailable', 'Pages sign-in is starting up. Try again in a minute.');
+  }
+  var now = Math.floor(Date.now() / 1000);
+  var values = cookieValues(request);
+  for (var i = 0; i < values.length; i++) {
+    if (validCookie(values[i], pageId, key, now)) {
+      request.uri = target;
+      return request;
+    }
+  }
+  return redirect('/_auth/start?page=' + pageId + '&next=' + encodeURIComponent(uri));
+}
+`;
+
+/** The function source for one store; `kvsId` may be a CDK token. */
+export function pagesViewerRequestCode(kvsId: string): string {
+  return PAGES_VIEWER_REQUEST_SOURCE.replace("__KVS_ID__", kvsId);
+}