@infoxchange/make-it-so 2.11.0-internal-testing-vdt-199-add-auth-token-verify-function.4 → 2.11.0-internal-testing-vdt-199-add-auth-token-verify-function-2.2

package/README.md

@@ -89,6 +89,12 @@ Unlike [NextjsSite](https://v2.sst.dev/constructs/NextjsSite), any environment v
 | customDomain.isIxManagedDomain       | boolean                                                          | (optional) If true will attempt to create DNS records and certs for it using the IX shared infra. Only required if explicitly setting customDomains and you want DNS records + certs setup for them                                                                                                                        |
 | customDomain.additionalDomainAliases | string[]                                                         | (optional) Works like `customDomain.domainAlias` but `domainAlias` only allows one domain, additionalDomainAliases allows setting additional domains                                                                                                                                                                       |
 | environment                          | Record<string, string \| {buildtime?: string, runtime?: string}> | (optional) As well as accepting strings for environment variable values as is already done by [NextjsSite](https://v2.sst.dev/constructs/NextjsSite) it also accepts an object with the properties `buildtime` and/or `runtime` which allows you to customise the environment variable value during those different steps. |
+| auth                                 | object                                                           | (optional) If provided will put the site behind auth.                                                                                                                                                                                                                                                                      |
+| auth.oidc                            | object                                                           |                                                                                                                                                                                                                                                                                                                            |
+| auth.oidc.issuerUrl                  | string                                                           | An issuer URL for the OIDC server to use.                                                                                                                                                                                                                                                                                  |
+| auth.oidc.clientId                   | string                                                           | The OIDC client ID to use.                                                                                                                                                                                                                                                                                                 |
+| auth.oidc.scope                      | string                                                           | The scope used for the auth request.                                                                                                                                                                                                                                                                                       |
+| auth.prefix                          | string                                                           | (optional) A custom path to be used for the auth route.                                                                                                                                                                                                                                                                    |
 
 ```typescript
 import { IxNextjsSite } from "@infoxchange/make-it-so/cdk-constructs";
@@ -123,9 +129,15 @@ Also if `isIxManagedDomain` is true DNS records will be automatically created fo
 
 | Prop                                 | Type     | Description                                                                                                                                                                                         |
 | ------------------------------------ | -------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| [...NextjsSiteProps]                 |          | Any props accepted by [SST's StaticSite](https://v2.sst.dev/constructs/StaticSite)                                                                                                                  |
+| [...StaticSiteProps]                 |          | Any props accepted by [SST's StaticSite](https://v2.sst.dev/constructs/StaticSite)                                                                                                                  |
 | customDomain.isIxManagedDomain       | boolean  | (optional) If true will attempt to create DNS records and certs for it using the IX shared infra. Only required if explicitly setting customDomains and you want DNS records + certs setup for them |
 | customDomain.additionalDomainAliases | string[] | (optional) Works like `customDomain.domainAlias` but `domainAlias` only allows one domain, additionalDomainAliases allows setting additional domains                                                |
+| auth                                 | object   | (optional) If provided will put the site behind auth.                                                                                                                                               |
+| auth.oidc                            | object   |                                                                                                                                                                                                     |
+| auth.oidc.issuerUrl                  | string   | An issuer URL for the OIDC server to use.                                                                                                                                                           |
+| auth.oidc.clientId                   | string   | The OIDC client ID to use.                                                                                                                                                                          |
+| auth.oidc.scope                      | string   | The scope used for the auth request.                                                                                                                                                                |
+| auth.prefix                          | string   | (optional) A custom path to be used for the auth route.                                                                                                                                             |
 
 ```typescript
 import { IxStaticSite } from "@infoxchange/make-it-so/cdk-constructs";
@@ -290,31 +302,7 @@ const vpcDetails = new IxVpcDetails(scope, "VpcDetails");
 
 </details>
 
-<details>
-<summary><strong>CloudFrontOidcAuth</strong> - Adds OIDC authentication to a CloudFront distribution.</summary>
-
-```typescript
-import { CloudFrontOidcAuth } from "@infoxchange/make-it-so/cdk-constructs";
-
-// You first create an instance of CloudFrontOidcAuth
-const auth = new CloudFrontOidcAuth(stack, "CloudFrontOidcAuth", {
-  oidcIssuerUrl: "https://your-oidc-server.com/path/",
-  oidcClientId: "your-client-id",
-  oidcScope: "email",
-});
-
-// Then you apply it to the a CloudFront backed site when it's created
-const site = new IxStaticSite(stack, "IxStaticSite", {
-  path: "path/to/site/files",
-  cdk: {
-    distribution: auth.addToDistributionDefinition(stack, {
-      distributionDefinition: {},
-    }),
-  },
-});
-```
-
-## Full Example
+## Example App Using Make It So
 
 To deploy a Next.js based site you would include a `sst.config.ts` file at the root of repo with contents like this:
 
@@ -348,9 +336,7 @@ export default {
 } satisfies SSTConfig;
 ```
 
-Then simply configure the IX pipeline to deploy that repo as a serverless app.
-
-important that sst and aws lib version match those used in ix-deploy-support
+Then simply configure the IX pipeline to deploy that repo as a serverless app. Note it is important that any AWS CDK libraries included in package.json match version match the version used by SST.
 
 # The Name
 

package/dist/cdk-constructs/IxNextjsSite.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"IxNextjsSite.d.ts","sourceRoot":"","sources":["../../src/cdk-constructs/IxNextjsSite.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAE5C,OAAO,EACL,KAAK,uBAAuB,EAe7B,MAAM,wBAAwB,CAAC;AAEhC,KAAK,cAAc,GAAG,qBAAqB,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AAClE,KAAK,WAAW,GAAG,qBAAqB,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/D,KAAK,cAAc,GAAG,uBAAuB,CAAC;AAE9C,qBAAa,YAAa,SAAQ,UAAU;gBAExC,KAAK,EAAE,cAAc,EACrB,EAAE,EAAE,WAAW,EACf,KAAK,GAAE,cAAmB;IAkB5B,IAAW,aAAa,IAAI,MAAM,EAAE,CAEnC;IAED,IAAW,mBAAmB,IAAI,MAAM,GAAG,IAAI,CAE9C;IAED,IAAW,WAAW,IAAI,MAAM,GAAG,IAAI,CAEtC;IAED,IAAW,kBAAkB,IAAI,MAAM,EAAE,CAExC;IAED,IAAW,aAAa,IAAI,MAAM,GAAG,IAAI,CAExC;IAED,IAAW,aAAa,IAAI,MAAM,GAAG,IAAI,CAExC;CACF"}
+{"version":3,"file":"IxNextjsSite.d.ts","sourceRoot":"","sources":["../../src/cdk-constructs/IxNextjsSite.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAE5C,OAAO,EACL,KAAK,uBAAuB,EAgB7B,MAAM,wBAAwB,CAAC;AAEhC,KAAK,cAAc,GAAG,qBAAqB,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AAClE,KAAK,WAAW,GAAG,qBAAqB,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/D,KAAK,cAAc,GAAG,uBAAuB,CAAC;AAE9C,qBAAa,YAAa,SAAQ,UAAU;gBAExC,KAAK,EAAE,cAAc,EACrB,EAAE,EAAE,WAAW,EACf,KAAK,GAAE,cAAmB;IAmB5B,IAAW,aAAa,IAAI,MAAM,EAAE,CAEnC;IAED,IAAW,mBAAmB,IAAI,MAAM,GAAG,IAAI,CAE9C;IAED,IAAW,WAAW,IAAI,MAAM,GAAG,IAAI,CAEtC;IAED,IAAW,kBAAkB,IAAI,MAAM,EAAE,CAExC;IAED,IAAW,aAAa,IAAI,MAAM,GAAG,IAAI,CAExC;IAED,IAAW,aAAa,IAAI,MAAM,GAAG,IAAI,CAExC;CACF"}

package/dist/cdk-constructs/IxNextjsSite.js

@@ -1,6 +1,6 @@
 import { NextjsSite } from "sst/constructs";
 import ixDeployConfig from "../deployConfig.js";
-import { getAliasDomain, getAlternativeDomains, getCustomDomains, getPrimaryCustomDomain, getPrimaryDomain, getPrimaryOrigin, setupCertificate, setupCustomDomain, setupDnsRecords, setupDomainAliasRedirect, setupVpcDetails, setupDefaultEnvVars, applyConditionalEnvironmentVariables, parentCompatibleSsrProps, } from "../lib/site/support.js";
+import { getAliasDomain, getAlternativeDomains, getCustomDomains, getPrimaryCustomDomain, getPrimaryDomain, getPrimaryOrigin, setupCertificate, setupCustomDomain, setupDnsRecords, setupDomainAliasRedirect, setupVpcDetails, setupDefaultEnvVars, applyConditionalEnvironmentVariables, parentCompatibleSsrProps, processAuthProps, } from "../lib/site/support.js";
 export class IxNextjsSite extends NextjsSite {
     constructor(scope, id, props = {}) {
         if (ixDeployConfig.isIxDeploy) {
@@ -9,6 +9,7 @@ export class IxNextjsSite extends NextjsSite {
             props = setupCertificate(scope, id, props);
             props = setupDomainAliasRedirect(scope, id, props);
         }
+        props = processAuthProps(scope, id, "SsrSite", props);
         props = setupDefaultEnvVars(scope, id, props);
         props = applyConditionalEnvironmentVariables(scope, id, props);
         super(scope, id, parentCompatibleSsrProps(props));

package/dist/cdk-constructs/IxStaticSite.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"IxStaticSite.d.ts","sourceRoot":"","sources":["../../src/cdk-constructs/IxStaticSite.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAE5C,OAAO,EACL,uBAAuB,EAWxB,MAAM,wBAAwB,CAAC;AAEhC,KAAK,cAAc,GAAG,qBAAqB,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AAClE,KAAK,WAAW,GAAG,qBAAqB,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/D,KAAK,cAAc,GAAG,uBAAuB,CAAC;AAE9C,qBAAa,YAAa,SAAQ,UAAU;IAE1C,OAAO,CAAC,aAAa,CAAiB;gBAGpC,KAAK,EAAE,cAAc,EACrB,EAAE,EAAE,WAAW,EACf,KAAK,GAAE,cAAmB;IAgB5B,IAAW,aAAa,IAAI,MAAM,EAAE,CAEnC;IAED,IAAW,mBAAmB,IAAI,MAAM,GAAG,IAAI,CAE9C;IAED,IAAW,WAAW,IAAI,MAAM,GAAG,IAAI,CAEtC;IAED,IAAW,kBAAkB,IAAI,MAAM,EAAE,CAExC;IAED,IAAW,aAAa,IAAI,MAAM,GAAG,IAAI,CAExC;IAED,IAAW,aAAa,IAAI,MAAM,GAAG,IAAI,CAExC;CACF"}
+{"version":3,"file":"IxStaticSite.d.ts","sourceRoot":"","sources":["../../src/cdk-constructs/IxStaticSite.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAE5C,OAAO,EACL,uBAAuB,EAYxB,MAAM,wBAAwB,CAAC;AAEhC,KAAK,cAAc,GAAG,qBAAqB,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AAClE,KAAK,WAAW,GAAG,qBAAqB,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/D,KAAK,cAAc,GAAG,uBAAuB,CAAC;AAE9C,qBAAa,YAAa,SAAQ,UAAU;IAE1C,OAAO,CAAC,aAAa,CAAiB;gBAGpC,KAAK,EAAE,cAAc,EACrB,EAAE,EAAE,WAAW,EACf,KAAK,GAAE,cAAmB;IAiB5B,IAAW,aAAa,IAAI,MAAM,EAAE,CAEnC;IAED,IAAW,mBAAmB,IAAI,MAAM,GAAG,IAAI,CAE9C;IAED,IAAW,WAAW,IAAI,MAAM,GAAG,IAAI,CAEtC;IAED,IAAW,kBAAkB,IAAI,MAAM,EAAE,CAExC;IAED,IAAW,aAAa,IAAI,MAAM,GAAG,IAAI,CAExC;IAED,IAAW,aAAa,IAAI,MAAM,GAAG,IAAI,CAExC;CACF"}

package/dist/cdk-constructs/IxStaticSite.js

@@ -1,6 +1,6 @@
 import { StaticSite } from "sst/constructs";
 import ixDeployConfig from "../deployConfig.js";
-import { getAliasDomain, getAlternativeDomains, getCustomDomains, getPrimaryCustomDomain, getPrimaryDomain, getPrimaryOrigin, setupCertificate, setupCustomDomain, setupDnsRecords, setupDomainAliasRedirect, } from "../lib/site/support.js";
+import { getAliasDomain, getAlternativeDomains, getCustomDomains, getPrimaryCustomDomain, getPrimaryDomain, getPrimaryOrigin, processAuthProps, setupCertificate, setupCustomDomain, setupDnsRecords, setupDomainAliasRedirect, } from "../lib/site/support.js";
 export class IxStaticSite extends StaticSite {
     // StaticSite's props are private, so we need to store them separately
     propsExtended;
@@ -10,6 +10,7 @@ export class IxStaticSite extends StaticSite {
             props = setupCertificate(scope, id, props);
             props = setupDomainAliasRedirect(scope, id, props);
         }
+        props = processAuthProps(scope, id, "StaticSite", props);
         super(scope, id, props);
         this.propsExtended = props;
         if (ixDeployConfig.isIxDeploy) {

package/dist/cdk-constructs/SiteOidcAuth/auth-check-handler-body.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=auth-check-handler-body.d.ts.map

package/dist/cdk-constructs/SiteOidcAuth/auth-check-handler-body.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-check-handler-body.d.ts","sourceRoot":"","sources":["../../../src/cdk-constructs/SiteOidcAuth/auth-check-handler-body.ts"],"names":[],"mappings":""}

package/dist/cdk-constructs/{CloudFrontOidcAuth/auth-check.js → SiteOidcAuth/auth-check-handler-body.js}

@@ -1,10 +1,30 @@
 // Based off: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/example_cloudfront_functions_kvs_jwt_verify_section.html
-// Note that as a CloudFront Function, this code has limitations compared to a Lambda@Edge function.
-// For example, no external libraries can be used, and the runtime is more limited.
-import crypto from "crypto";
-import cf from "cloudfront";
-const kvsKey = "__placeholder-for-jwt-secret-key__";
+// Note that as a CloudFront Function, this code has limitations compared to a Lambda@Edge function. For example, no
+// external libraries can be used, and the runtime is more limited. Because SST v2's SsrSite construct uses JS v1.0
+// runtime for CloudFront Functions, this code must also be compatible with that runtime. Also this is used in the body
+// of a function where the variables event and request are already defined.
+// eslint-disable-next-line @typescript-eslint/no-var-requires -- v1 runtime for CloudFront Functions do not support import statements
+const crypto = require("crypto");
+const jwtSecret = "__placeholder-for-jwt-secret__";
 const authRoutePrefix = "__placeholder-for-auth-route-prefix__";
+// Set to true to enable console logging
+const loggingEnabled = false;
+const log = function () {
+    if (!loggingEnabled)
+        return;
+    // CloudFront Function runtime only prints first argument passed to console.log so add other args to the first one if given.
+    // eslint-disable-next-line prefer-rest-params -- We can't use spread or rest parameters in CloudFront Functions
+    let message = arguments[0];
+    if (arguments.length > 1) {
+        const otherArgs = [];
+        for (let i = 1; i < arguments.length; i++) {
+            // eslint-disable-next-line prefer-rest-params
+            otherArgs[i - 1] = arguments[i];
+        }
+        message += " - additional args: " + JSON.stringify(otherArgs);
+    }
+    console.log(message);
+};
 //Response when JWT is not valid.
 const redirectResponse = {
     statusCode: 302,
@@ -12,8 +32,6 @@ const redirectResponse = {
         location: { value: `${authRoutePrefix}/oidc/authorize` },
     },
 };
-// Set to true to enable console logging
-const loggingEnabled = false;
 function jwtDecode(token, key, noVerify) {
     // check segments
     const segments = token.split(".");
@@ -71,55 +89,19 @@ function _sign(input, key, method) {
 function _base64urlDecode(str) {
     return Buffer.from(str, "base64url").toString();
 }
-async function handler(event) {
-    const request = event.request;
-    const secret_key = await getSecret();
-    if (!secret_key) {
-        // It's not possible for us to validate requests without the secret key so we have no choice but to block all requests.
-        throw new Error("Error retrieving JWT secret key");
-    }
-    const jwtToken = request.cookies["auth-token"] && request.cookies["auth-token"].value;
-    if (!jwtToken) {
-        log("Error: No JWT in the cookies");
-        return redirectResponse;
-    }
-    try {
-        jwtDecode(jwtToken, secret_key);
-    }
-    catch (e) {
-        log(e);
-        return redirectResponse;
-    }
-    log("Valid JWT token");
-    return request;
+const jwtToken = request.cookies["auth-token"] && request.cookies["auth-token"].value;
+if (!jwtToken) {
+    log("Error: No JWT in the cookies");
+    // @ts-expect-error -- This code is added to a function body so we can use return here but typescript doesn't know that.
+    return redirectResponse;
 }
-// Get secret from key value store
-async function getSecret() {
-    try {
-        const kvsHandle = cf.kvs();
-        return await kvsHandle.get(kvsKey);
-    }
-    catch (err) {
-        log(`Error reading value for key: ${kvsKey}, error: ${err}`);
-        return null;
-    }
+try {
+    jwtDecode(jwtToken, jwtSecret);
 }
-const log = function () {
-    if (!loggingEnabled)
-        return;
-    // CloudFront Function runtime only prints first argument passed to console.log so add other args to the first one if given.
-    // eslint-disable-next-line prefer-rest-params -- We can't use spread or rest parameters in CloudFront Functions
-    let message = arguments[0];
-    if (arguments.length > 1) {
-        const otherArgs = [];
-        for (let i = 1; i < arguments.length; i++) {
-            // eslint-disable-next-line prefer-rest-params
-            otherArgs[i - 1] = arguments[i];
-        }
-        message += " - additional args: " + JSON.stringify(otherArgs);
-    }
-    console.log(message);
-};
-// This serves no purpose other than to make TypeScript and eslint happy by showing that that handler is used. We can't
-// export handler as an alterative because CloudFront Functions don't support exports.
-handler;
+catch (e) {
+    log(e);
+    // @ts-expect-error -- This code is added to a function body so we can use return here but typescript doesn't know that.
+    return redirectResponse;
+}
+log("Valid JWT token");
+export {};

package/dist/cdk-constructs/SiteOidcAuth/auth-route.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-route.d.ts","sourceRoot":"","sources":["../../../src/cdk-constructs/SiteOidcAuth/auth-route.ts"],"names":[],"mappings":"AAyBA,eAAO,MAAM,OAAO,4CAiCnB,CAAC"}

package/dist/cdk-constructs/SiteOidcAuth/index.d.ts

@@ -0,0 +1,197 @@
+import { Construct } from "constructs";
+import CloudFront from "aws-cdk-lib/aws-cloudfront";
+import CDK from "aws-cdk-lib";
+import * as SST from "sst/constructs";
+import type { ExtendedNextjsSiteProps, ExtendedStaticSiteProps } from "../../lib/site/support.js";
+type ConstructScope = ConstructorParameters<typeof Construct>[0];
+type ConstructId = ConstructorParameters<typeof Construct>[1];
+export type Props = {
+    oidcIssuerUrl: string;
+    oidcClientId: string;
+    oidcScope: string;
+};
+export type AddToSiteProps = {
+    prefix?: string;
+};
+export declare class SiteOidcAuth extends Construct {
+    readonly oidcIssuerUrl: string;
+    readonly oidcClientId: string;
+    readonly oidcScope: string;
+    readonly id: string;
+    constructor(scope: ConstructScope, id: ConstructId, props: Props);
+    addToStaticSiteProps<SiteProps extends ExtendedStaticSiteProps>(scope: ConstructScope, siteProps: SiteProps, { prefix }?: AddToSiteProps): SiteProps & {
+        cdk: {
+            distribution: {
+                additionalBehaviors: Record<string, CloudFront.BehaviorOptions>;
+                defaultBehavior: {
+                    functionAssociations: CloudFront.FunctionAssociation[];
+                    allowedMethods?: CloudFront.AllowedMethods | undefined;
+                    cachedMethods?: CloudFront.CachedMethods | undefined;
+                    cachePolicy?: CloudFront.ICachePolicy | undefined;
+                    compress?: boolean | undefined;
+                    originRequestPolicy?: CloudFront.IOriginRequestPolicy | undefined;
+                    realtimeLogConfig?: CloudFront.IRealtimeLogConfig | undefined;
+                    responseHeadersPolicy?: CloudFront.IResponseHeadersPolicy | undefined;
+                    smoothStreaming?: boolean | undefined;
+                    viewerProtocolPolicy?: CloudFront.ViewerProtocolPolicy | undefined;
+                    edgeLambdas?: CloudFront.EdgeLambda[] | undefined;
+                    trustedKeyGroups?: CloudFront.IKeyGroup[] | undefined;
+                    origin?: CloudFront.IOrigin | undefined;
+                };
+            } | {
+                additionalBehaviors: Record<string, CloudFront.BehaviorOptions>;
+                defaultBehavior: {
+                    functionAssociations: CloudFront.FunctionAssociation[];
+                    allowedMethods?: CloudFront.AllowedMethods | undefined;
+                    cachedMethods?: CloudFront.CachedMethods | undefined;
+                    cachePolicy?: CloudFront.ICachePolicy | undefined;
+                    compress?: boolean | undefined;
+                    originRequestPolicy?: CloudFront.IOriginRequestPolicy | undefined;
+                    realtimeLogConfig?: CloudFront.IRealtimeLogConfig | undefined;
+                    responseHeadersPolicy?: CloudFront.IResponseHeadersPolicy | undefined;
+                    smoothStreaming?: boolean | undefined;
+                    viewerProtocolPolicy?: CloudFront.ViewerProtocolPolicy | undefined;
+                    edgeLambdas?: CloudFront.EdgeLambda[] | undefined;
+                    trustedKeyGroups?: CloudFront.IKeyGroup[] | undefined;
+                    origin?: CloudFront.IOrigin | undefined;
+                };
+                distributionDomainName: string;
+                distributionId: string;
+                grant(identity: CDK.aws_iam.IGrantable, ...actions: string[]): CDK.aws_iam.Grant;
+                grantCreateInvalidation(identity: CDK.aws_iam.IGrantable): CDK.aws_iam.Grant;
+                stack: CDK.Stack;
+                env: CDK.ResourceEnvironment;
+                applyRemovalPolicy(policy: CDK.RemovalPolicy): void;
+                node: import("constructs").Node;
+            } | {
+                additionalBehaviors: Record<string, CloudFront.BehaviorOptions>;
+                defaultBehavior: {
+                    functionAssociations: CloudFront.FunctionAssociation[];
+                    allowedMethods?: CloudFront.AllowedMethods | undefined;
+                    cachedMethods?: CloudFront.CachedMethods | undefined;
+                    cachePolicy?: CloudFront.ICachePolicy | undefined;
+                    compress?: boolean | undefined;
+                    originRequestPolicy?: CloudFront.IOriginRequestPolicy | undefined;
+                    realtimeLogConfig?: CloudFront.IRealtimeLogConfig | undefined;
+                    responseHeadersPolicy?: CloudFront.IResponseHeadersPolicy | undefined;
+                    smoothStreaming?: boolean | undefined;
+                    viewerProtocolPolicy?: CloudFront.ViewerProtocolPolicy | undefined;
+                    edgeLambdas?: CloudFront.EdgeLambda[] | undefined;
+                    trustedKeyGroups?: CloudFront.IKeyGroup[] | undefined;
+                    origin?: CloudFront.IOrigin | undefined;
+                };
+                certificate?: CDK.aws_certificatemanager.ICertificate | undefined;
+                comment?: string | undefined;
+                defaultRootObject?: string | undefined;
+                domainNames?: string[] | undefined;
+                enabled?: boolean | undefined;
+                enableIpv6?: boolean | undefined;
+                enableLogging?: boolean | undefined;
+                geoRestriction?: CloudFront.GeoRestriction | undefined;
+                httpVersion?: CloudFront.HttpVersion | undefined;
+                logBucket?: CDK.aws_s3.IBucket | undefined;
+                logIncludesCookies?: boolean | undefined;
+                logFilePrefix?: string | undefined;
+                priceClass?: CloudFront.PriceClass | undefined;
+                webAclId?: string | undefined;
+                errorResponses?: CloudFront.ErrorResponse[] | undefined;
+                minimumProtocolVersion?: CloudFront.SecurityPolicyProtocol | undefined;
+                sslSupportMethod?: CloudFront.SSLMethod | undefined;
+                publishAdditionalMetrics?: boolean | undefined;
+            };
+            id?: string | undefined;
+            bucket?: CDK.aws_s3.IBucket | CDK.aws_s3.BucketProps | undefined;
+        };
+    };
+    addToSsrSiteProps<SiteProps extends ExtendedNextjsSiteProps>(scope: ConstructScope, siteProps: SiteProps, { prefix }?: AddToSiteProps): SiteProps & {
+        cdk: {
+            distribution: {
+                additionalBehaviors: Record<string, CloudFront.BehaviorOptions>;
+                defaultBehavior?: (Omit<CloudFront.BehaviorOptions, "origin"> & {
+                    origin?: CloudFront.IOrigin | undefined;
+                }) | undefined;
+                certificate?: CDK.aws_certificatemanager.ICertificate | undefined;
+                comment?: string | undefined;
+                defaultRootObject?: string | undefined;
+                domainNames?: string[] | undefined;
+                enabled?: boolean | undefined;
+                enableIpv6?: boolean | undefined;
+                enableLogging?: boolean | undefined;
+                geoRestriction?: CloudFront.GeoRestriction | undefined;
+                httpVersion?: CloudFront.HttpVersion | undefined;
+                logBucket?: CDK.aws_s3.IBucket | undefined;
+                logIncludesCookies?: boolean | undefined;
+                logFilePrefix?: string | undefined;
+                priceClass?: CloudFront.PriceClass | undefined;
+                webAclId?: string | undefined;
+                errorResponses?: CloudFront.ErrorResponse[] | undefined;
+                minimumProtocolVersion?: CloudFront.SecurityPolicyProtocol | undefined;
+                sslSupportMethod?: CloudFront.SSLMethod | undefined;
+                publishAdditionalMetrics?: boolean | undefined;
+            };
+            id?: string | undefined;
+            bucket?: CDK.aws_s3.IBucket | CDK.aws_s3.BucketProps | undefined;
+            s3Origin?: CDK.aws_cloudfront_origins.S3OriginProps | undefined;
+            serverCachePolicy?: CloudFront.ICachePolicy | undefined;
+            responseHeadersPolicy?: CloudFront.IResponseHeadersPolicy | undefined;
+            viewerProtocolPolicy?: CloudFront.ViewerProtocolPolicy | undefined;
+            server?: (Pick<CDK.aws_lambda.FunctionProps, "vpc" | "layers" | "vpcSubnets" | "securityGroups" | "allowAllOutbound" | "allowPublicSubnet" | "architecture" | "logRetention"> & Pick<SST.FunctionProps, "copyFiles">) | undefined;
+            transform?: ((args: {
+                cloudFrontFunctions?: Record<string, {
+                    constructId: string;
+                    injections: string[];
+                }> | undefined;
+                edgeFunctions?: Record<string, {
+                    constructId: string;
+                    function: import("sst/constructs/EdgeFunction.js").EdgeFunctionProps;
+                }> | undefined;
+                origins: Record<string, {
+                    type: "function";
+                    constructId: string;
+                    function: import("sst/constructs/SsrFunction.js").SsrFunctionProps;
+                    injections?: string[] | undefined;
+                    streaming?: boolean | undefined;
+                } | {
+                    type: "image-optimization-function";
+                    function: CDK.aws_lambda.FunctionProps;
+                } | {
+                    type: "s3";
+                    originPath?: string | undefined;
+                    copy: {
+                        from: string;
+                        to: string;
+                        cached: boolean;
+                        versionedSubDir?: string | undefined;
+                    }[];
+                } | {
+                    type: "group";
+                    primaryOriginName: string;
+                    fallbackOriginName: string;
+                    fallbackStatusCodes?: number[] | undefined;
+                }>;
+                edge: boolean;
+                behaviors: {
+                    cacheType: "server" | "static";
+                    pattern?: string | undefined;
+                    origin: string;
+                    allowedMethods?: CloudFront.AllowedMethods | undefined;
+                    cfFunction?: string | undefined;
+                    edgeFunction?: string | undefined;
+                }[];
+                errorResponses?: CloudFront.ErrorResponse[] | undefined;
+                serverCachePolicy?: {
+                    allowedHeaders?: string[] | undefined;
+                } | undefined;
+                buildId?: string | undefined;
+            }) => void) | undefined;
+            revalidation?: Pick<CDK.aws_lambda.FunctionProps, "vpc" | "vpcSubnets"> | undefined;
+        };
+    };
+    private createJwtSecret;
+    private getFunctionAssociation;
+    private getAuthCheckHandlerBodyCode;
+    private convertToCloudFrontFunctionCompatibleCode;
+    private getAuthBehaviorOptions;
+}
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/cdk-constructs/SiteOidcAuth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/cdk-constructs/SiteOidcAuth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvC,OAAO,UAAU,MAAM,4BAA4B,CAAC;AACpD,OAAO,GAAG,MAAM,aAAa,CAAC;AAE9B,OAAO,KAAK,GAAG,MAAM,gBAAgB,CAAC;AAOtC,OAAO,KAAK,EACV,uBAAuB,EACvB,uBAAuB,EACxB,MAAM,2BAA2B,CAAC;AAEnC,KAAK,cAAc,GAAG,qBAAqB,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;AACjE,KAAK,WAAW,GAAG,qBAAqB,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;AAE9D,MAAM,MAAM,KAAK,GAAG;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AACF,MAAM,MAAM,cAAc,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAIjD,qBAAa,YAAa,SAAQ,SAAS;IACzC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;gBAER,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK;IAQhE,oBAAoB,CAAC,SAAS,SAAS,uBAAuB,EAC5D,KAAK,EAAE,cAAc,EACrB,SAAS,EAAE,SAAS,EACpB,EAAE,MAA+B,EAAE,GAAE,cAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA4C1D,iBAAiB,CAAC,SAAS,SAAS,uBAAuB,EACzD,KAAK,EAAE,cAAc,EACrB,SAAS,EAAE,SAAS,EACpB,EAAE,MAA+B,EAAE,GAAE,cAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAqC1D,OAAO,CAAC,eAAe;IAgBvB,OAAO,CAAC,sBAAsB;IA6B9B,OAAO,CAAC,2BAA2B;IAgBnC,OAAO,CAAC,yCAAyC;IAejD,OAAO,CAAC,sBAAsB;CAiF/B"}

package/dist/cdk-constructs/SiteOidcAuth/index.js

@@ -0,0 +1,184 @@
+import { Construct } from "constructs";
+import SecretsManager from "aws-cdk-lib/aws-secretsmanager";
+import CloudFront from "aws-cdk-lib/aws-cloudfront";
+import CDK from "aws-cdk-lib";
+import Lambda from "aws-cdk-lib/aws-lambda";
+import * as SST from "sst/constructs";
+import { isCDKConstruct } from "sst/constructs/Construct.js";
+import { Config as SSTInternalConfig } from "sst/config.js";
+import CloudFrontOrigins from "aws-cdk-lib/aws-cloudfront-origins";
+import path from "node:path";
+import fs from "node:fs";
+import { transformSync } from "esbuild";
+const defaultAuthRoutePrefix = "/auth";
+export class SiteOidcAuth extends Construct {
+    oidcIssuerUrl;
+    oidcClientId;
+    oidcScope;
+    id;
+    constructor(scope, id, props) {
+        super(scope, id);
+        this.oidcIssuerUrl = props.oidcIssuerUrl;
+        this.oidcClientId = props.oidcClientId;
+        this.oidcScope = props.oidcScope;
+        this.id = id;
+    }
+    addToStaticSiteProps(scope, siteProps, { prefix = defaultAuthRoutePrefix } = {}) {
+        prefix = prefix.replace(/\/$/, ""); // Remove trailing slash from prefix if it has one
+        const behaviourName = `${prefix.replace(/^\//g, "")}/*`;
+        const distribution = siteProps.cdk?.distribution;
+        if (isCDKConstruct(distribution)) {
+            throw new Error(`CDK Construct for distribution is not supported when adding CloudFront OIDC Auth behavior for prefix ${prefix}`);
+        }
+        const updatedSiteProps = {
+            ...siteProps,
+            cdk: {
+                ...siteProps.cdk,
+                distribution: {
+                    ...siteProps.cdk?.distribution,
+                    additionalBehaviors: distribution?.additionalBehaviors ?? {},
+                    defaultBehavior: {
+                        ...distribution?.defaultBehavior,
+                        functionAssociations: distribution?.defaultBehavior?.functionAssociations ?? [],
+                    },
+                },
+            },
+        };
+        if (updatedSiteProps.cdk.distribution.additionalBehaviors[behaviourName]) {
+            throw new Error(`Behavior for prefix ${prefix} already exists in distribution definition`);
+        }
+        const jwtSecret = this.createJwtSecret();
+        updatedSiteProps.cdk.distribution.defaultBehavior.functionAssociations.push(this.getFunctionAssociation(scope, jwtSecret, prefix));
+        updatedSiteProps.cdk.distribution.additionalBehaviors[behaviourName] =
+            this.getAuthBehaviorOptions(scope, jwtSecret, prefix);
+        return updatedSiteProps;
+    }
+    addToSsrSiteProps(scope, siteProps, { prefix = defaultAuthRoutePrefix } = {}) {
+        prefix = prefix.replace(/\/$/, ""); // Remove trailing slash from prefix if it has one
+        const behaviourName = `${prefix.replace(/^\//g, "")}/*`;
+        const updatedSiteProps = {
+            ...siteProps,
+            cdk: {
+                ...siteProps.cdk,
+                distribution: {
+                    ...siteProps.cdk?.distribution,
+                    additionalBehaviors: siteProps.cdk?.distribution?.additionalBehaviors ?? {},
+                },
+            },
+        };
+        if (updatedSiteProps.cdk.distribution.additionalBehaviors[behaviourName]) {
+            throw new Error(`Behavior for prefix ${prefix} already exists in distribution definition`);
+        }
+        const jwtSecret = this.createJwtSecret();
+        updatedSiteProps.cdk.transform = (plan) => {
+            siteProps?.cdk?.transform?.(plan);
+            plan.cloudFrontFunctions?.serverCfFunction.injections.push(this.getAuthCheckHandlerBodyCode(jwtSecret, prefix));
+        };
+        updatedSiteProps.cdk.distribution.additionalBehaviors[behaviourName] =
+            this.getAuthBehaviorOptions(scope, jwtSecret, prefix);
+        return updatedSiteProps;
+    }
+    createJwtSecret() {
+        return new SecretsManager.Secret(this, `${this.id}JwtSecret`, {
+            description: "JWT Signing Secret",
+            generateSecretString: {
+                passwordLength: 32,
+                excludePunctuation: true,
+                includeSpace: false,
+                requireEachIncludedType: true,
+            },
+            // Secret is only used for sessions so it's safe to delete on stack removal
+            removalPolicy: CDK.RemovalPolicy.DESTROY,
+        });
+    }
+    // Get the CloudFront Function Association for auth checking
+    // Roughly based off https://github.com/sst/v2/blob/4283d706f251724308b397996ff307929bf3a976/packages/sst/src/constructs/SsrSite.ts#L941
+    getFunctionAssociation(scope, jwtSecret, authRoutePrefix) {
+        const authCheckFunction = new CloudFront.Function(scope, `${this.id}AuthCheckFunction`, {
+            code: CloudFront.FunctionCode.fromInline(this.convertToCloudFrontFunctionCompatibleCode(`function handler(event) {
+              var request = event.request;
+              ${this.getAuthCheckHandlerBodyCode(jwtSecret, authRoutePrefix)}
+              return request;
+            }`)),
+            // We could specify the JS v2.0 runtime here but for SSR sites SST does the function creation and that currently
+            // uses JS v1.0 so no point using v2.0 here as the code has to be compatible with v1.0 anyway.
+        });
+        return {
+            function: authCheckFunction,
+            eventType: CloudFront.FunctionEventType.VIEWER_REQUEST,
+        };
+    }
+    getAuthCheckHandlerBodyCode(jwtSecret, authRoutePrefix) {
+        return fs
+            .readFileSync(path.join(import.meta.dirname, "auth-check-handler-body.js"), "utf8")
+            .replace("__placeholder-for-jwt-secret__", jwtSecret.secretValue.toString())
+            .replace("__placeholder-for-auth-route-prefix__", authRoutePrefix);
+    }
+    convertToCloudFrontFunctionCompatibleCode(sourceCode) {
+        // ESBuild doesn't currently support transforming const/let to var, which is required for CloudFront Functions
+        // JS runtime 1.0.
+        sourceCode = sourceCode
+            .replaceAll(/const /g, "var ")
+            .replaceAll(/let /g, "var ");
+        return transformSync(sourceCode, {
+            minify: true,
+            target: "es5",
+        }).code;
+    }
+    // Get the behavior options for the auth route
+    getAuthBehaviorOptions(scope, jwtSecret, prefix) {
+        const authRouteFunction = new SST.Function(scope, `${this.id}AuthRouteFunction`, {
+            runtime: "nodejs20.x",
+            handler: path.join(import.meta.dirname, "auth-route.handler"),
+            environment: {
+                OIDC_ISSUER_URL: this.oidcIssuerUrl,
+                OIDC_CLIENT_ID: this.oidcClientId,
+                OIDC_SCOPE: this.oidcScope,
+                JWT_SECRET: jwtSecret.secretValue.toString(),
+            },
+        });
+        // authRouteFunction uses SST's AuthHandler construct which is normally run inside a lambda that's
+        // created by SST's Auth construct. AuthHandler expects certain environment variables to be set
+        // by the Auth construct so we have to set them ourselves here to keep it happy.
+        const envVarName = SSTInternalConfig.envFor({
+            type: "Auth",
+            id: "id", // It seems like the env var will still be found no matter what this value is
+            prop: "prefix",
+        });
+        authRouteFunction.addEnvironment(envVarName, prefix);
+        const authRouteFunctionUrl = authRouteFunction.addFunctionUrl({
+            authType: Lambda.FunctionUrlAuthType.NONE,
+        });
+        const forwardHostHeaderCfFunction = new CloudFront.Function(scope, `${this.id}ForwardHostHeaderFunction`, {
+            code: CloudFront.FunctionCode.fromInline(this.convertToCloudFrontFunctionCompatibleCode(`function handler(event) {
+              const request = event.request;
+              request.headers["x-forwarded-host"] = { value: request.headers.host.value };
+              return request;
+            }`)),
+            runtime: CloudFront.FunctionRuntime.JS_2_0,
+        });
+        return {
+            origin: new CloudFrontOrigins.HttpOrigin(CDK.Fn.parseDomainName(authRouteFunctionUrl.url)),
+            allowedMethods: CloudFront.AllowedMethods.ALLOW_ALL,
+            cachePolicy: new CloudFront.CachePolicy(scope, `${this.id}AllowAllCookiesPolicy`, {
+                cachePolicyName: `${this.id}-AllowAllCookiesPolicy`,
+                comment: "Cache policy that forwards all cookies",
+                defaultTtl: CDK.Duration.seconds(1),
+                minTtl: CDK.Duration.seconds(1),
+                maxTtl: CDK.Duration.seconds(1),
+                cookieBehavior: CloudFront.CacheCookieBehavior.all(),
+                headerBehavior: CloudFront.CacheHeaderBehavior.allowList("X-Forwarded-Host"),
+                queryStringBehavior: CloudFront.CacheQueryStringBehavior.all(),
+                enableAcceptEncodingGzip: true,
+                enableAcceptEncodingBrotli: true,
+            }),
+            viewerProtocolPolicy: CloudFront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+            functionAssociations: [
+                {
+                    function: forwardHostHeaderCfFunction,
+                    eventType: CloudFront.FunctionEventType.VIEWER_REQUEST,
+                },
+            ],
+        };
+    }
+}

package/dist/cdk-constructs/index.d.ts

@@ -6,5 +6,5 @@ export * from "./IxStaticSite.js";
 export * from "./IxElasticache.js";
 export * from "./IxApi.js";
 export * from "./IxQuicksightWorkspace.js";
-export * from "./CloudFrontOidcAuth/index.js";
+export * from "./SiteOidcAuth/index.js";
 //# sourceMappingURL=index.d.ts.map