@deployfoundation/foundation-deploy 0.2.17 → 0.2.19

package/dist/bin/app.js

@@ -8,13 +8,13 @@ import {
   FoundationPages,
   FoundationPipeline,
   NewsletterStack
-} from "../chunk-rq4dc5ns.js";
+} from "../chunk-rhg6yfht.js";
 import {
   adminsFor,
   instanceNames,
   loadInstanceFile,
   provisionsIntegration
-} from "../chunk-9rasrppa.js";
+} from "../chunk-k2rxb77g.js";
 
 // bin/app.ts
 import { execFileSync } from "node:child_process";

package/dist/bin/foundation-deploy.js

@@ -29,7 +29,7 @@ import {
   stackExists,
   stackOutput,
   toolVersion
-} from "../chunk-pygj3x43.js";
+} from "../chunk-fjbc0ydk.js";
 import {
   BASE_SLACK_EVENTS,
   CAPABILITY_IDS,
@@ -45,7 +45,7 @@ import {
   requiredSlackScopes,
   skillsKey,
   slackCommandPrefix
-} from "../chunk-9rasrppa.js";
+} from "../chunk-k2rxb77g.js";
 
 // src/deploy/config-sync.ts
 import { existsSync, mkdirSync, mkdtempSync, readdirSync } from "node:fs";
@@ -793,7 +793,7 @@ function pagesDomainReport(state, baseUrl) {
   if (state.mode === "none" || state.domain === undefined)
     return baseUrl === undefined ? [] : [`  pages are served at ${baseUrl}`];
   if (state.delegated)
-    return [`  pages are served at https://${state.domain}`];
+    return [`  pages are served at https://<pageId>.${state.domain} (sign-in on ${state.domain})`];
   if (state.nameServers.length === 0)
     return [
       `  ${state.domain}: the pages zone is created by this deploy; its NS records follow on the next run.`
@@ -801,8 +801,8 @@ function pagesDomainReport(state, baseUrl) {
   return [
     `  ☐ add these NS records for ${state.domain} at your DNS provider:`,
     ...state.nameServers.map((server) => `      ${state.domain}.  NS  ${server}.`),
-    `    until they resolve, pages are served at ${baseUrl ?? "the CloudFront default domain"}.`,
-    "    Deploy again once they do: that deploy issues the certificate and moves pages to the domain."
+    "    until they resolve, pages are not served and page_publish says so.",
+    "    Deploy again once they do: that deploy issues the certificate and turns pages on."
   ];
 }
 
@@ -1592,12 +1592,7 @@ function slackManifestFor(instance, env) {
     pages: instance.integrations.pages
   }, {
     ...env,
-    ...instance.integrations.pages && instance.pages.domain !== undefined ? {
-      PAGES_AUTH_REDIRECT_URL: [
-        `https://${instance.pages.domain}/_auth/callback`,
-        ...env.PAGES_AUTH_REDIRECT_URL === undefined ? [] : [env.PAGES_AUTH_REDIRECT_URL]
-      ].join(",")
-    } : {}
+    ...instance.integrations.pages && instance.pages.domain !== undefined ? { PAGES_AUTH_REDIRECT_URL: `https://${instance.pages.domain}/_auth/callback` } : {}
   });
 }
 
@@ -1829,10 +1824,7 @@ async function reportSlackManifest(ctx) {
     COMMANDS_REQUEST_URL: await output(ctx, ctx.names.api, "CommandsUrl"),
     INTERACTIVE_REQUEST_URL: await output(ctx, ctx.names.api, "InteractiveUrl"),
     ...ctx.instance.integrations.pages ? {
-      PAGES_AUTH_REDIRECT_URL: [
-        await output(ctx, ctx.names.pages, "PagesAuthRedirectUrl"),
-        await output(ctx, ctx.names.pages, "PagesDefaultAuthRedirectUrl")
-      ].join(",")
+      PAGES_AUTH_REDIRECT_URL: await output(ctx, ctx.names.pages, "PagesAuthRedirectUrl")
     } : {}
   });
   console.log(`  manifest: ${JSON.stringify(manifest)}`);

package/dist/bin/release-account.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env bun
 import {
   DEFAULT_RELEASE_BUCKET
-} from "../chunk-pygj3x43.js";
-import"../chunk-9rasrppa.js";
+} from "../chunk-fjbc0ydk.js";
+import"../chunk-k2rxb77g.js";
 
 // bin/release-account.ts
 import * as cdk2 from "aws-cdk-lib";

package/dist/{chunk-pygj3x43.js → chunk-fjbc0ydk.js}

@@ -6,7 +6,7 @@ import {
   manifestKey,
   releaseCacheDir,
   verifyManifest
-} from "./chunk-9rasrppa.js";
+} from "./chunk-k2rxb77g.js";
 
 // src/deploy/release.ts
 import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2 } from "node:fs";

package/dist/{chunk-9rasrppa.js → chunk-k2rxb77g.js}

@@ -747,6 +747,12 @@ var RawInstance = z2.object({
   newsletter: RawNewsletter,
   pages: RawPages
 }).strict().superRefine((doc, ctx) => {
+  if (doc.integrations.pages && doc.pages.domain === undefined)
+    ctx.addIssue({
+      code: z2.ZodIssueCode.custom,
+      path: ["pages", "domain"],
+      message: "integrations.pages needs pages.domain: each page is served from its own subdomain of it (docs/pages.md)"
+    });
   if (doc.pages.domain !== undefined && !doc.integrations.pages)
     ctx.addIssue({
       code: z2.ZodIssueCode.custom,

package/dist/{chunk-rq4dc5ns.js → chunk-rhg6yfht.js}

@@ -19,7 +19,7 @@ import {
   scheduledJobBindings,
   slackCommandPrefixes,
   webhookJobBindings
-} from "./chunk-9rasrppa.js";
+} from "./chunk-k2rxb77g.js";
 
 // src/stacks/agent-stack.ts
 import * as cdk from "aws-cdk-lib";
@@ -2755,10 +2755,11 @@ var PAGES_VIEWER_REQUEST_SOURCE = `import cf from 'cloudfront';
 import crypto from 'crypto';
 
 var kvs = cf.kvs('__KVS_ID__');
-var COOKIE = 'fpa';
+var DOMAIN = '__DOMAIN__';
+var COOKIE = '__Host-fpa';
 var KEY_NAME = '${PAGES_EDGE_KEY_NAME}';
 var HOST_HEADER = '${PAGES_HOST_HEADER}';
-var PAGE_RE = /^\\/p\\/([a-z0-9]{24})(\\/.*)?$/;
+var PAGE_HOST_RE = /^([a-z0-9]{24})\\.(.+)$/;
 var VERSION_RE = /^\\/v([1-9][0-9]{0,5})(\\/.*)?$/;
 var EXPORT_RE = /^\\/exports\\/v([1-9][0-9]{0,5})\\/([^\\/]+)$/;
 var UNSAFE_RE = /(^|\\/)\\.\\.?(\\/|$)|\\/\\/|%2e|%2f|%5c|\\\\/i;
@@ -2785,6 +2786,11 @@ function redirect(location) {
   };
 }
 
+function toLambda(request, host) {
+  request.headers[HOST_HEADER] = { value: host };
+  return request;
+}
+
 function equal(a, b) {
   if (a.length !== b.length) return false;
   var diff = 0;
@@ -2811,10 +2817,10 @@ function cookieValues(request) {
   return values;
 }
 
-function objectPath(pageId, rest) {
+function objectPath(pageId, uri) {
   var prefix = '/pages/' + pageId;
-  if (rest === '/') return prefix + '/latest.html';
-  var version = VERSION_RE.exec(rest);
+  if (uri === '/') return prefix + '/latest.html';
+  var version = VERSION_RE.exec(uri);
   if (version) {
     var sub = version[2];
     if (sub.charAt(sub.length - 1) === '/') {
@@ -2824,7 +2830,7 @@ function objectPath(pageId, rest) {
     }
     return prefix + '/v' + version[1] + '/build' + sub;
   }
-  var download = EXPORT_RE.exec(rest);
+  var download = EXPORT_RE.exec(uri);
   if (download) return prefix + '/v' + download[1] + '/exports/' + download[2];
   return null;
 }
@@ -2832,18 +2838,20 @@ function objectPath(pageId, rest) {
 async function handler(event) {
   var request = event.request;
   var uri = request.uri;
-  if (uri.indexOf('/_auth/') === 0) {
-    request.headers[HOST_HEADER] = { value: request.headers.host ? request.headers.host.value : '' };
-    return request;
+  var host = request.headers.host ? request.headers.host.value.toLowerCase() : '';
+
+  if (host === DOMAIN) {
+    if (uri === '/_auth/start' || uri === '/_auth/callback') return toLambda(request, host);
+    return reply(404, 'Not Found', 'Not found');
   }
-  var page = PAGE_RE.exec(uri);
-  if (!page || UNSAFE_RE.test(uri)) return reply(404, 'Not Found', 'Not found');
+  var page = PAGE_HOST_RE.exec(host);
+  if (!page || page[2] !== DOMAIN) return reply(404, 'Not Found', 'Not found');
   var pageId = page[1];
-  var rest = page[2] || '';
-  if (rest === '') return redirect(uri + '/');
-  var version = VERSION_RE.exec(rest);
+  if (uri === '/_auth/redeem') return toLambda(request, host);
+  if (UNSAFE_RE.test(uri)) return reply(404, 'Not Found', 'Not found');
+  var version = VERSION_RE.exec(uri);
   if (version && version[2] === undefined) return redirect(uri + '/');
-  var target = objectPath(pageId, rest);
+  var target = objectPath(pageId, uri);
   if (target === null) return reply(404, 'Not Found', 'Not found');
 
   var key;
@@ -2860,20 +2868,22 @@ async function handler(event) {
       return request;
     }
   }
-  return redirect('/_auth/start?page=' + pageId + '&next=' + encodeURIComponent(uri));
+  return redirect('https://' + DOMAIN + '/_auth/start?page=' + pageId + '&next=' + encodeURIComponent(uri));
 }
 `;
-function pagesViewerRequestCode(kvsId) {
-  return PAGES_VIEWER_REQUEST_SOURCE.replace("__KVS_ID__", kvsId);
+function pagesViewerRequestCode(kvsId, domain) {
+  if (!/^(?:[a-z0-9-]+\.)+[a-z]{2,63}$/.test(domain))
+    throw new Error("invalid pages domain");
+  return PAGES_VIEWER_REQUEST_SOURCE.replace("__KVS_ID__", kvsId).replace("__DOMAIN__", domain);
 }
 
 // src/stacks/pages-stack.ts
 function pagesDomainPlan(instance, delegated) {
   const { domain, hostedZoneId } = instance.pages;
   if (domain === undefined)
-    return { ownZone: false };
+    throw new Error("hosted pages need pages.domain");
   const ownZone = hostedZoneId === undefined;
-  return ownZone && !delegated ? { pending: domain, ownZone } : { attached: domain, ownZone };
+  return { domain, attached: !ownZone || delegated, ownZone };
 }
 var PAGES_CONTENT_SECURITY_POLICY = [
   "default-src 'self'",
@@ -2904,7 +2914,8 @@ class FoundationPages extends cdk7.Stack {
     const names = instanceNames(instance);
     const display = instance.displayName;
     const plan = pagesDomainPlan(instance, props.domainDelegated === true);
-    const domain = plan.attached;
+    const pagesDomain = plan.domain;
+    const domain = plan.attached ? pagesDomain : undefined;
     this.bucket = new s32.Bucket(this, "PagesBucket", {
       blockPublicAccess: s32.BlockPublicAccess.BLOCK_ALL,
       encryption: s32.BucketEncryption.S3_MANAGED,
@@ -2965,6 +2976,12 @@ class FoundationPages extends cdk7.Stack {
       actions: ["dynamodb:GetItem"],
       resources: [this.table.tableArn]
     }));
+    authRole.addToPolicy(new iam8.PolicyStatement({
+      sid: "PagesAuthClaimCode",
+      actions: ["dynamodb:PutItem"],
+      resources: [this.table.tableArn],
+      conditions: { "ForAllValues:StringLike": { "dynamodb:LeadingKeys": ["CODE#*"] } }
+    }));
     authRole.addToPolicy(new iam8.PolicyStatement({
       sid: "PagesTableKey",
       actions: ["kms:Decrypt", "kms:DescribeKey"],
@@ -2983,7 +3000,7 @@ class FoundationPages extends cdk7.Stack {
         FOUNDATION_SLACK_TEAM_ID: instance.slack.teamId,
         FOUNDATION_PAGES_TABLE_NAME: this.table.tableName,
         FOUNDATION_DISPLAY_NAME: display,
-        ...domain === undefined ? {} : { FOUNDATION_PAGES_DOMAIN: domain }
+        FOUNDATION_PAGES_DOMAIN: pagesDomain
       }
     });
     const authUrl = authFunction.addFunctionUrl({ authType: lambda3.FunctionUrlAuthType.AWS_IAM });
@@ -3028,7 +3045,7 @@ class FoundationPages extends cdk7.Stack {
       runtime: cloudfront.FunctionRuntime.JS_2_0,
       keyValueStore: edgeKeys,
       comment: `${display} pages: cookie check and path mapping`,
-      code: cloudfront.FunctionCode.fromInline(pagesViewerRequestCode(edgeKeys.keyValueStoreId))
+      code: cloudfront.FunctionCode.fromInline(pagesViewerRequestCode(edgeKeys.keyValueStoreId, pagesDomain))
     });
     const headers = new cloudfront.ResponseHeadersPolicy(this, "PagesHeaders", {
       comment: `${display} pages security headers`,
@@ -3050,16 +3067,21 @@ class FoundationPages extends cdk7.Stack {
         }
       },
       customHeadersBehavior: {
-        customHeaders: [{ header: "X-Robots-Tag", value: "noindex, nofollow", override: true }]
+        customHeaders: [
+          { header: "X-Robots-Tag", value: "noindex, nofollow", override: true },
+          { header: "Cross-Origin-Resource-Policy", value: "same-origin", override: true },
+          { header: "Cross-Origin-Opener-Policy", value: "same-origin", override: true },
+          { header: "Origin-Agent-Cluster", value: "?1", override: true }
+        ]
       }
     });
-    const zoneDomain = instance.pages.domain;
-    const zone = zoneDomain === undefined ? undefined : instance.pages.hostedZoneId !== undefined ? route532.HostedZone.fromHostedZoneId(this, "PagesParentZone", instance.pages.hostedZoneId) : new route532.PublicHostedZone(this, "PagesZone", {
+    const zoneDomain = pagesDomain;
+    const zone = instance.pages.hostedZoneId !== undefined ? route532.HostedZone.fromHostedZoneId(this, "PagesParentZone", instance.pages.hostedZoneId) : new route532.PublicHostedZone(this, "PagesZone", {
       zoneName: zoneDomain,
       comment: `${display} hosted pages (delegated from the company's DNS)`
     });
     let certificate;
-    if (domain !== undefined && zone !== undefined) {
+    if (domain !== undefined) {
       const certificateRole = new iam8.Role(this, "PagesCertificateRole", {
         assumedBy: new iam8.ServicePrincipal("lambda.amazonaws.com"),
         description: `${display} issues the pages domain certificate in us-east-1`,
@@ -3093,7 +3115,11 @@ class FoundationPages extends cdk7.Stack {
       const issued = new cdk7.CustomResource(this, "PagesCertificate", {
         serviceToken: certificateFunction.functionArn,
         resourceType: "Custom::FoundationPagesCertificate",
-        properties: { DomainName: domain, HostedZoneId: zone.hostedZoneId }
+        properties: {
+          DomainName: domain,
+          SubjectAlternativeNames: [`*.${domain}`],
+          HostedZoneId: zone.hostedZoneId
+        }
       });
       certificate = acm2.Certificate.fromCertificateArn(this, "PagesCertificateArn", issued.getAttString("CertificateArn"));
     }
@@ -3102,7 +3128,7 @@ class FoundationPages extends cdk7.Stack {
     ];
     this.distribution = new cloudfront.Distribution(this, "Distribution", {
       comment: `${display} pages`,
-      ...domain === undefined || certificate === undefined ? {} : { domainNames: [domain], certificate },
+      ...domain === undefined || certificate === undefined ? {} : { domainNames: [domain, `*.${domain}`], certificate },
       defaultRootObject: "index.html",
       minimumProtocolVersion: cloudfront.SecurityPolicyProtocol.TLS_V1_2_2021,
       httpVersion: cloudfront.HttpVersion.HTTP2_AND_3,
@@ -3130,13 +3156,18 @@ class FoundationPages extends cdk7.Stack {
       }
     });
     cdk7.Annotations.of(this.distribution).acknowledgeWarning("@aws-cdk/aws-cloudfront-origins:listBucketSecurityRisk", "The viewer function forwards only mapped object keys and 404s `/`; defaultRootObject is set too. LIST only turns a missing key into 404 instead of 403.");
-    if (domain !== undefined && zone !== undefined) {
+    if (domain !== undefined) {
       const target = route532.RecordTarget.fromAlias(new route53Targets2.CloudFrontTarget(this.distribution));
       new route532.ARecord(this, "PagesAliasA", { zone, recordName: `${domain}.`, target });
       new route532.AaaaRecord(this, "PagesAliasAaaa", { zone, recordName: `${domain}.`, target });
+      new route532.ARecord(this, "PagesWildcardA", { zone, recordName: `*.${domain}.`, target });
+      new route532.AaaaRecord(this, "PagesWildcardAaaa", {
+        zone,
+        recordName: `*.${domain}.`,
+        target
+      });
     }
-    const defaultUrl = `https://${this.distribution.distributionDomainName}`;
-    const baseUrl = domain === undefined ? defaultUrl : `https://${domain}`;
+    const signInUrl = `https://${pagesDomain}`;
     const apiRole = new iam8.Role(this, "PagesApiRole", {
       assumedBy: new iam8.ServicePrincipal("lambda.amazonaws.com"),
       description: `${display} Pages API proxy (the only writer of the pages bucket and table)`,
@@ -3182,22 +3213,22 @@ class FoundationPages extends cdk7.Stack {
       environment: {
         FOUNDATION_PAGES_TABLE_NAME: this.table.tableName,
         FOUNDATION_PAGES_BUCKET_NAME: this.bucket.bucketName,
-        FOUNDATION_PAGES_BASE_URL: baseUrl,
+        ...domain === undefined ? {} : { FOUNDATION_PAGES_DOMAIN: domain },
         FOUNDATION_SLACK_TEAM_ID: instance.slack.teamId,
         FOUNDATION_SLACK_SIGNING_SECRET_ID: props.secrets.signing.secretName
       }
     });
     new cdk7.CfnOutput(this, "PagesApiFunctionArn", { value: this.apiFunction.functionArn });
-    new cdk7.CfnOutput(this, "PagesBaseUrl", { value: baseUrl });
+    new cdk7.CfnOutput(this, "PagesBaseUrl", {
+      description: "The sign-in host; each page is https://<pageId>.<this domain>",
+      value: signInUrl
+    });
     new cdk7.CfnOutput(this, "PagesDistributionDomainName", {
       value: this.distribution.distributionDomainName
     });
     new cdk7.CfnOutput(this, "PagesAuthRedirectUrl", {
       description: "Slack OAuth redirect URL for Sign in with Slack on the pages domain",
-      value: `${baseUrl}/_auth/callback`
-    });
-    new cdk7.CfnOutput(this, "PagesDefaultAuthRedirectUrl", {
-      value: `${defaultUrl}/_auth/callback`
+      value: `${signInUrl}/_auth/callback`
     });
     new cdk7.CfnOutput(this, "PagesCustomDomainAttached", {
       value: domain === undefined ? "false" : "true"

package/dist/src/index.js

@@ -10,7 +10,7 @@ import {
   FoundationPipeline,
   NewsletterStack,
   deployStatements
-} from "../chunk-rq4dc5ns.js";
+} from "../chunk-rhg6yfht.js";
 import {
   BUN_VERSION,
   LAMBDA_ENTRY_POINTS,
@@ -43,7 +43,7 @@ import {
   skillsKey,
   skipBundle,
   verifyManifest
-} from "../chunk-9rasrppa.js";
+} from "../chunk-k2rxb77g.js";
 export {
   BUILD_TIMEOUT,
   BUN_VERSION,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deployfoundation/foundation-deploy",
-  "version": "0.2.17",
+  "version": "0.2.19",
   "description": "Deploys one Foundation instance from a published, signed release: the CDK app and the deploy tool.",
   "license": "UNLICENSED",
   "private": false,

package/src/deploy/pages-domain.ts

@@ -5,7 +5,7 @@
  * Route 53 zone for exactly that subdomain and outputs its name servers. The
  * company adds those as NS records at its own DNS provider. Until they
  * resolve, issuing the certificate would leave CloudFormation waiting on ACM
- * validation, so the stack keeps serving on the CloudFront default domain.
+ * validation, so pages are not served (and publishing reports it) until then.
  * Before each `cdk deploy` this module looks the delegation up in public DNS
  * and, once it matches the zone, passes `-c pagesDomainDelegated=true`: that
  * deploy issues the certificate and attaches the domain.
@@ -92,7 +92,8 @@ export async function publicNs(name: string): Promise<string[]> {
 export function pagesDomainReport(state: PagesDomainState, baseUrl: string | undefined): string[] {
   if (state.mode === "none" || state.domain === undefined)
     return baseUrl === undefined ? [] : [`  pages are served at ${baseUrl}`];
-  if (state.delegated) return [`  pages are served at https://${state.domain}`];
+  if (state.delegated)
+    return [`  pages are served at https://<pageId>.${state.domain} (sign-in on ${state.domain})`];
   if (state.nameServers.length === 0)
     return [
       `  ${state.domain}: the pages zone is created by this deploy; its NS records follow on the next run.`,
@@ -100,7 +101,7 @@ export function pagesDomainReport(state: PagesDomainState, baseUrl: string | und
   return [
     `  ☐ add these NS records for ${state.domain} at your DNS provider:`,
     ...state.nameServers.map((server) => `      ${state.domain}.  NS  ${server}.`),
-    `    until they resolve, pages are served at ${baseUrl ?? "the CloudFront default domain"}.`,
-    "    Deploy again once they do: that deploy issues the certificate and moves pages to the domain.",
+    "    until they resolve, pages are not served and page_publish says so.",
+    "    Deploy again once they do: that deploy issues the certificate and turns pages on.",
   ];
 }

package/src/deploy/setup.ts

@@ -190,14 +190,10 @@ async function reportSlackManifest(ctx: AwsContext): Promise<void> {
     EVENTS_REQUEST_URL: await output(ctx, ctx.names.api, "EventsUrl"),
     COMMANDS_REQUEST_URL: await output(ctx, ctx.names.api, "CommandsUrl"),
     INTERACTIVE_REQUEST_URL: await output(ctx, ctx.names.api, "InteractiveUrl"),
-    // Both sign-in callbacks: the pages domain's, and the CloudFront default
-    // name's, which links posted before a custom domain attached still use.
+    // One sign-in callback, on the pages domain itself.
     ...(ctx.instance.integrations.pages
       ? {
-          PAGES_AUTH_REDIRECT_URL: [
-            await output(ctx, ctx.names.pages, "PagesAuthRedirectUrl"),
-            await output(ctx, ctx.names.pages, "PagesDefaultAuthRedirectUrl"),
-          ].join(","),
+          PAGES_AUTH_REDIRECT_URL: await output(ctx, ctx.names.pages, "PagesAuthRedirectUrl"),
         }
       : {}),
   });

package/src/deploy/slack-manifest.ts

@@ -138,15 +138,10 @@ export function slackManifestFor(instance: Instance, env: SlackManifestEnv): Sla
     },
     {
       ...env,
-      // A custom pages domain's callback is known from the instance file alone;
-      // registering it early is harmless while the domain waits for delegation.
+      // The one sign-in callback, on the pages domain, is known from the
+      // instance file alone; registering it before delegation is harmless.
       ...(instance.integrations.pages && instance.pages.domain !== undefined
-        ? {
-            PAGES_AUTH_REDIRECT_URL: [
-              `https://${instance.pages.domain}/_auth/callback`,
-              ...(env.PAGES_AUTH_REDIRECT_URL === undefined ? [] : [env.PAGES_AUTH_REDIRECT_URL]),
-            ].join(","),
-          }
+        ? { PAGES_AUTH_REDIRECT_URL: `https://${instance.pages.domain}/_auth/callback` }
         : {}),
     },
   );

package/src/stacks/pages-edge-function.ts

@@ -1,28 +1,34 @@
 /**
  * The CloudFront viewer-request function in front of every hosted page.
  *
- * It runs on each request, before the cache, in CloudFront's `cloudfront-js-2.0`
- * runtime, and does three things:
+ * Every page is its own origin, `<pageId>.<domain>`, so one page's script can
+ * never read another page, even for a viewer signed in to both. The function
+ * runs on each request, before the cache, in CloudFront's `cloudfront-js-2.0`
+ * runtime, and routes by Host:
  *
- * 1. `/_auth/*` passes through to the sign-in Lambda, with the viewer's Host
- *    copied into `x-foundation-pages-host` (the Lambda's Function URL rejects
- *    a foreign Host, and needs the real one to build Slack's redirect URI).
- * 2. `/p/<pageId>/…` needs a valid `fpa` cookie for that page: the HMAC the
- *    sign-in Lambda made with the key this function reads from the attached
+ * 1. `<domain>` (the sign-in host) serves only `/_auth/start` and
+ *    `/_auth/callback`, passed to the sign-in Lambda with the Host copied into
+ *    `x-foundation-pages-host`. Everything else there is a 404.
+ * 2. `<pageId>.<domain>` serves that one page. `/_auth/redeem` passes to the
+ *    Lambda (it sets the page host's own cookie). Anything else needs a valid
+ *    `__Host-fpa` cookie whose page id is this host's: the HMAC the sign-in
+ *    Lambda made with the key this function reads from the attached
  *    KeyValueStore (`@deployfoundation/foundation-core/page-cookie` is the
- *    signer; a test holds the two to one format). No cookie, a cookie for
- *    another page, or an expired one is a 302 to `/_auth/start`.
+ *    signer; a test holds the two to one format). No cookie, or an expired or
+ *    foreign one, is a 302 to `https://<domain>/_auth/start`.
  * 3. A granted request is rewritten onto its S3 key (the layout in
  *    `packages/capability-pages/src/layout.ts`): a trailing `/` gets
  *    `index.html`, and an extensionless path is a single-page-app route that
  *    gets the version's root `index.html` (how an open-slide deck's `/s/<id>`
- *    route loads). `source/` and `uploads/` have no public path at all.
+ *    route loads). `source/` and `uploads/` have no public path at all. The
+ *    rewritten key carries the page id, so the cache can never serve one
+ *    page's object on another page's host.
  *
- * Anything else is a 404. Dot segments and encoded separators are refused
- * before rewriting so no path can climb into another page's prefix.
+ * Any other host (the distribution's `*.cloudfront.net` name included) is a
+ * 404. Dot segments and encoded separators are refused before rewriting.
  *
  * The runtime is not Node: `var`, plain functions, and only the `crypto`
- * HMAC/hash subset. `__KVS_ID__` is replaced with the store id at synth.
+ * HMAC/hash subset. `__KVS_ID__` and `__DOMAIN__` are replaced at synth.
  */
 
 /** The KeyValueStore key holding the cookie HMAC key; the seeding resource writes it. */
@@ -34,10 +40,11 @@ export const PAGES_VIEWER_REQUEST_SOURCE = `import cf from 'cloudfront';
 import crypto from 'crypto';
 
 var kvs = cf.kvs('__KVS_ID__');
-var COOKIE = 'fpa';
+var DOMAIN = '__DOMAIN__';
+var COOKIE = '__Host-fpa';
 var KEY_NAME = '${PAGES_EDGE_KEY_NAME}';
 var HOST_HEADER = '${PAGES_HOST_HEADER}';
-var PAGE_RE = /^\\/p\\/([a-z0-9]{24})(\\/.*)?$/;
+var PAGE_HOST_RE = /^([a-z0-9]{24})\\.(.+)$/;
 var VERSION_RE = /^\\/v([1-9][0-9]{0,5})(\\/.*)?$/;
 var EXPORT_RE = /^\\/exports\\/v([1-9][0-9]{0,5})\\/([^\\/]+)$/;
 var UNSAFE_RE = /(^|\\/)\\.\\.?(\\/|$)|\\/\\/|%2e|%2f|%5c|\\\\/i;
@@ -64,6 +71,11 @@ function redirect(location) {
   };
 }
 
+function toLambda(request, host) {
+  request.headers[HOST_HEADER] = { value: host };
+  return request;
+}
+
 function equal(a, b) {
   if (a.length !== b.length) return false;
   var diff = 0;
@@ -90,10 +102,10 @@ function cookieValues(request) {
   return values;
 }
 
-function objectPath(pageId, rest) {
+function objectPath(pageId, uri) {
   var prefix = '/pages/' + pageId;
-  if (rest === '/') return prefix + '/latest.html';
-  var version = VERSION_RE.exec(rest);
+  if (uri === '/') return prefix + '/latest.html';
+  var version = VERSION_RE.exec(uri);
   if (version) {
     var sub = version[2];
     if (sub.charAt(sub.length - 1) === '/') {
@@ -103,7 +115,7 @@ function objectPath(pageId, rest) {
     }
     return prefix + '/v' + version[1] + '/build' + sub;
   }
-  var download = EXPORT_RE.exec(rest);
+  var download = EXPORT_RE.exec(uri);
   if (download) return prefix + '/v' + download[1] + '/exports/' + download[2];
   return null;
 }
@@ -111,18 +123,20 @@ function objectPath(pageId, rest) {
 async function handler(event) {
   var request = event.request;
   var uri = request.uri;
-  if (uri.indexOf('/_auth/') === 0) {
-    request.headers[HOST_HEADER] = { value: request.headers.host ? request.headers.host.value : '' };
-    return request;
+  var host = request.headers.host ? request.headers.host.value.toLowerCase() : '';
+
+  if (host === DOMAIN) {
+    if (uri === '/_auth/start' || uri === '/_auth/callback') return toLambda(request, host);
+    return reply(404, 'Not Found', 'Not found');
   }
-  var page = PAGE_RE.exec(uri);
-  if (!page || UNSAFE_RE.test(uri)) return reply(404, 'Not Found', 'Not found');
+  var page = PAGE_HOST_RE.exec(host);
+  if (!page || page[2] !== DOMAIN) return reply(404, 'Not Found', 'Not found');
   var pageId = page[1];
-  var rest = page[2] || '';
-  if (rest === '') return redirect(uri + '/');
-  var version = VERSION_RE.exec(rest);
+  if (uri === '/_auth/redeem') return toLambda(request, host);
+  if (UNSAFE_RE.test(uri)) return reply(404, 'Not Found', 'Not found');
+  var version = VERSION_RE.exec(uri);
   if (version && version[2] === undefined) return redirect(uri + '/');
-  var target = objectPath(pageId, rest);
+  var target = objectPath(pageId, uri);
   if (target === null) return reply(404, 'Not Found', 'Not found');
 
   var key;
@@ -139,11 +153,12 @@ async function handler(event) {
       return request;
     }
   }
-  return redirect('/_auth/start?page=' + pageId + '&next=' + encodeURIComponent(uri));
+  return redirect('https://' + DOMAIN + '/_auth/start?page=' + pageId + '&next=' + encodeURIComponent(uri));
 }
 `;
 
-/** The function source for one store; `kvsId` may be a CDK token. */
-export function pagesViewerRequestCode(kvsId: string): string {
-  return PAGES_VIEWER_REQUEST_SOURCE.replace("__KVS_ID__", kvsId);
+/** The function source for one store and pages domain; `kvsId` may be a CDK token. */
+export function pagesViewerRequestCode(kvsId: string, domain: string): string {
+  if (!/^(?:[a-z0-9-]+\.)+[a-z]{2,63}$/.test(domain)) throw new Error("invalid pages domain");
+  return PAGES_VIEWER_REQUEST_SOURCE.replace("__KVS_ID__", kvsId).replace("__DOMAIN__", domain);
 }

package/src/stacks/pages-stack.ts

@@ -28,27 +28,28 @@ export interface FoundationPagesProps extends cdk.StackProps {
   /**
    * The deploy tool has seen the Foundation-made zone's NS delegation resolve
    * (`-c pagesDomainDelegated=true`), so the certificate can be issued and the
-   * domain attached without the deploy hanging on validation. Irrelevant with
-   * no `pages.domain`, and implied by `pages.hostedZoneId`.
+   * domain attached without the deploy hanging on validation. Implied by
+   * `pages.hostedZoneId`.
    */
   domainDelegated?: boolean;
 }
 
 /** How the stack serves pages for this instance and deploy. */
 export interface PagesDomainPlan {
-  /** The custom domain, attached to the distribution in this deploy. */
-  attached?: string;
-  /** `pages.domain` is set but waits for its NS delegation. */
-  pending?: string;
+  /** `pages.domain`: the sign-in host; each page is `<pageId>.<domain>`. */
+  domain: string;
+  /** The domain and its wildcard are attached to the distribution in this deploy. */
+  attached: boolean;
   /** Foundation creates the zone (no `pages.hostedZoneId`). */
   ownZone: boolean;
 }
 
 export function pagesDomainPlan(instance: Instance, delegated: boolean): PagesDomainPlan {
   const { domain, hostedZoneId } = instance.pages;
-  if (domain === undefined) return { ownZone: false };
+  // The instance schema already requires it; per-page origins need a domain.
+  if (domain === undefined) throw new Error("hosted pages need pages.domain");
   const ownZone = hostedZoneId === undefined;
-  return ownZone && !delegated ? { pending: domain, ownZone } : { attached: domain, ownZone };
+  return { domain, attached: !ownZone || delegated, ownZone };
 }
 
 /**
@@ -107,7 +108,9 @@ export class FoundationPages extends cdk.Stack {
     const names = namesFor(instance);
     const display = instance.displayName;
     const plan = pagesDomainPlan(instance, props.domainDelegated === true);
-    const domain = plan.attached;
+    const pagesDomain = plan.domain;
+    // Set only once the domain is served; until then the Pages API says "not ready".
+    const domain = plan.attached ? pagesDomain : undefined;
 
     this.bucket = new s3.Bucket(this, "PagesBucket", {
       blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
@@ -185,6 +188,15 @@ export class FoundationPages extends cdk.Stack {
         resources: [this.table.tableArn],
       }),
     );
+    // One-time sign-in handoff codes: the only rows it may write, and only new ones.
+    authRole.addToPolicy(
+      new iam.PolicyStatement({
+        sid: "PagesAuthClaimCode",
+        actions: ["dynamodb:PutItem"],
+        resources: [this.table.tableArn],
+        conditions: { "ForAllValues:StringLike": { "dynamodb:LeadingKeys": ["CODE#*"] } },
+      }),
+    );
     authRole.addToPolicy(
       new iam.PolicyStatement({
         sid: "PagesTableKey",
@@ -205,7 +217,7 @@ export class FoundationPages extends cdk.Stack {
         FOUNDATION_SLACK_TEAM_ID: instance.slack.teamId,
         FOUNDATION_PAGES_TABLE_NAME: this.table.tableName,
         FOUNDATION_DISPLAY_NAME: display,
-        ...(domain === undefined ? {} : { FOUNDATION_PAGES_DOMAIN: domain }),
+        FOUNDATION_PAGES_DOMAIN: pagesDomain,
       },
     });
     // IAM auth: only CloudFront, signing through origin access control, can call it.
@@ -260,7 +272,9 @@ export class FoundationPages extends cdk.Stack {
       runtime: cloudfront.FunctionRuntime.JS_2_0,
       keyValueStore: edgeKeys,
       comment: `${display} pages: cookie check and path mapping`,
-      code: cloudfront.FunctionCode.fromInline(pagesViewerRequestCode(edgeKeys.keyValueStoreId)),
+      code: cloudfront.FunctionCode.fromInline(
+        pagesViewerRequestCode(edgeKeys.keyValueStoreId, pagesDomain),
+      ),
     });
     const headers = new cloudfront.ResponseHeadersPolicy(this, "PagesHeaders", {
       comment: `${display} pages security headers`,
@@ -282,7 +296,17 @@ export class FoundationPages extends cdk.Stack {
         },
       },
       customHeadersBehavior: {
-        customHeaders: [{ header: "X-Robots-Tag", value: "noindex, nofollow", override: true }],
+        customHeaders: [
+          { header: "X-Robots-Tag", value: "noindex, nofollow", override: true },
+          // Pages are sibling origins on one site. CORP stops page A pulling
+          // page B's scripts or data in as subresources (the viewer's Lax
+          // cookie would be sent, since the hosts are same-site); COOP cuts
+          // window references between pages; Origin-Agent-Cluster turns off
+          // `document.domain`, so two pages can never merge into one origin.
+          { header: "Cross-Origin-Resource-Policy", value: "same-origin", override: true },
+          { header: "Cross-Origin-Opener-Policy", value: "same-origin", override: true },
+          { header: "Origin-Agent-Cluster", value: "?1", override: true },
+        ],
       },
     });
     // --- custom domain ---------------------------------------------------
@@ -290,22 +314,16 @@ export class FoundationPages extends cdk.Stack {
     // company delegates one name (NS records at its DNS provider) and never
     // hands over its main zone. With `pages.hostedZoneId` the parent zone is
     // already in this account and records go straight into it.
-    const zoneDomain = instance.pages.domain;
-    const zone: route53.IHostedZone | undefined =
-      zoneDomain === undefined
-        ? undefined
-        : instance.pages.hostedZoneId !== undefined
-          ? route53.HostedZone.fromHostedZoneId(
-              this,
-              "PagesParentZone",
-              instance.pages.hostedZoneId,
-            )
-          : new route53.PublicHostedZone(this, "PagesZone", {
-              zoneName: zoneDomain,
-              comment: `${display} hosted pages (delegated from the company's DNS)`,
-            });
+    const zoneDomain = pagesDomain;
+    const zone: route53.IHostedZone =
+      instance.pages.hostedZoneId !== undefined
+        ? route53.HostedZone.fromHostedZoneId(this, "PagesParentZone", instance.pages.hostedZoneId)
+        : new route53.PublicHostedZone(this, "PagesZone", {
+            zoneName: zoneDomain,
+            comment: `${display} hosted pages (delegated from the company's DNS)`,
+          });
     let certificate: acm.ICertificate | undefined;
-    if (domain !== undefined && zone !== undefined) {
+    if (domain !== undefined) {
       const certificateRole = new iam.Role(this, "PagesCertificateRole", {
         assumedBy: new iam.ServicePrincipal("lambda.amazonaws.com"),
         description: `${display} issues the pages domain certificate in us-east-1`,
@@ -347,7 +365,12 @@ export class FoundationPages extends cdk.Stack {
       const issued = new cdk.CustomResource(this, "PagesCertificate", {
         serviceToken: certificateFunction.functionArn,
         resourceType: "Custom::FoundationPagesCertificate",
-        properties: { DomainName: domain, HostedZoneId: zone.hostedZoneId },
+        // The sign-in host and every page host.
+        properties: {
+          DomainName: domain,
+          SubjectAlternativeNames: [`*.${domain}`],
+          HostedZoneId: zone.hostedZoneId,
+        },
       });
       certificate = acm.Certificate.fromCertificateArn(
         this,
@@ -363,7 +386,7 @@ export class FoundationPages extends cdk.Stack {
       comment: `${display} pages`,
       ...(domain === undefined || certificate === undefined
         ? {}
-        : { domainNames: [domain], certificate }),
+        : { domainNames: [domain, `*.${domain}`], certificate }),
       // Never a bucket listing at `/`, even if the viewer function were detached.
       defaultRootObject: "index.html",
       minimumProtocolVersion: cloudfront.SecurityPolicyProtocol.TLS_V1_2_2021,
@@ -399,16 +422,21 @@ export class FoundationPages extends cdk.Stack {
       "@aws-cdk/aws-cloudfront-origins:listBucketSecurityRisk",
       "The viewer function forwards only mapped object keys and 404s `/`; defaultRootObject is set too. LIST only turns a missing key into 404 instead of 403.",
     );
-    if (domain !== undefined && zone !== undefined) {
+    if (domain !== undefined) {
       const target = route53.RecordTarget.fromAlias(
         new route53Targets.CloudFrontTarget(this.distribution),
       );
       // Fully qualified, so the parent-zone case needs no zone name.
       new route53.ARecord(this, "PagesAliasA", { zone, recordName: `${domain}.`, target });
       new route53.AaaaRecord(this, "PagesAliasAaaa", { zone, recordName: `${domain}.`, target });
+      new route53.ARecord(this, "PagesWildcardA", { zone, recordName: `*.${domain}.`, target });
+      new route53.AaaaRecord(this, "PagesWildcardAaaa", {
+        zone,
+        recordName: `*.${domain}.`,
+        target,
+      });
     }
-    const defaultUrl = `https://${this.distribution.distributionDomainName}`;
-    const baseUrl = domain === undefined ? defaultUrl : `https://${domain}`;
+    const signInUrl = `https://${pagesDomain}`;
 
     // --- Pages API proxy -------------------------------------------------
     const apiRole = new iam.Role(this, "PagesApiRole", {
@@ -465,24 +493,23 @@ export class FoundationPages extends cdk.Stack {
       environment: {
         FOUNDATION_PAGES_TABLE_NAME: this.table.tableName,
         FOUNDATION_PAGES_BUCKET_NAME: this.bucket.bucketName,
-        FOUNDATION_PAGES_BASE_URL: baseUrl,
+        ...(domain === undefined ? {} : { FOUNDATION_PAGES_DOMAIN: domain }),
         FOUNDATION_SLACK_TEAM_ID: instance.slack.teamId,
         FOUNDATION_SLACK_SIGNING_SECRET_ID: props.secrets.signing.secretName,
       },
     });
 
     new cdk.CfnOutput(this, "PagesApiFunctionArn", { value: this.apiFunction.functionArn });
-    new cdk.CfnOutput(this, "PagesBaseUrl", { value: baseUrl });
+    new cdk.CfnOutput(this, "PagesBaseUrl", {
+      description: "The sign-in host; each page is https://<pageId>.<this domain>",
+      value: signInUrl,
+    });
     new cdk.CfnOutput(this, "PagesDistributionDomainName", {
       value: this.distribution.distributionDomainName,
     });
     new cdk.CfnOutput(this, "PagesAuthRedirectUrl", {
       description: "Slack OAuth redirect URL for Sign in with Slack on the pages domain",
-      value: `${baseUrl}/_auth/callback`,
-    });
-    // Registered as well, so links from before a custom domain attached keep signing in.
-    new cdk.CfnOutput(this, "PagesDefaultAuthRedirectUrl", {
-      value: `${defaultUrl}/_auth/callback`,
+      value: `${signInUrl}/_auth/callback`,
     });
     new cdk.CfnOutput(this, "PagesCustomDomainAttached", {
       value: domain === undefined ? "false" : "true",