@plusscommunities/pluss-newsletter-aws 2.0.12-auth.0 → 2.0.13

package/addNewsletterEntry.js

@@ -15,170 +15,182 @@ const publishActivity = require("./common/db/activity/publishActivity");
 const { values } = require("./values.config");
 
 const sendNewsSubmissionEmail = (update) => {
-  getRef(
-    "strings",
-    "RowId",
-    `${update.Site}_${values.stringPostfixSubmissionEmail}`
-  )
-    .then((ev) => {
-      sendEmail(
-        ev.Value,
-        newsletterSubmissionEmail.subject.replace("___TITLE___", update.Title),
-        newsletterSubmissionEmail.content
-          .replace("___TITLE___", update.Title)
-          .replace("___TEXT___", update.Text)
-          .replace("___NAME___", update.SubmittedBy.displayName)
-          .replace(/\n/g, " <br /> "),
-        true
-      );
-    })
-    .catch((err) => {
-      console.log("No email to send to");
-    });
+	getRef(
+		"strings",
+		"RowId",
+		`${update.Site}_${values.stringPostfixSubmissionEmail}`,
+	)
+		.then((ev) => {
+			sendEmail(
+				ev.Value,
+				newsletterSubmissionEmail.subject.replace("___TITLE___", update.Title),
+				newsletterSubmissionEmail.content
+					.replace("___TITLE___", update.Title)
+					.replace("___TEXT___", update.Text)
+					.replace("___NAME___", update.SubmittedBy.displayName)
+					.replace(/\n/g, " <br /> "),
+				true,
+			);
+		})
+		.catch((err) => {
+			console.log("No email to send to");
+		});
 };
 
 module.exports.addNewsletterEntry = (event, context, callback) => {
-  initConfig();
-  const data = JSON.parse(event.body);
+	initConfig();
+	const data = JSON.parse(event.body);
 
-  data.update.Id = uuid.v1();
+	// PC-1444 §AC-B.7: strip caller-supplied HqSourceId. Only the stream
+	// handler (newsletterChanged.js) writes HqSourceId on community-copy rows
+	// (via fanOutHqSource). Allowing callers to set it would let them forge
+	// "ghost-locked" rows that bypass Story A's Boolean(HqSourceId) lock guard
+	// — defense-in-depth pairing with the lock guard.
+	if (data.update && data.update.HqSourceId !== undefined) {
+		console.warn(
+			"addNewsletterEntry: stripped caller-supplied HqSourceId",
+		);
+		delete data.update.HqSourceId;
+	}
 
-  if (!data.update.Timestamp && !data.update.UnixTimestamp) {
-    data.update.Timestamp = moment.utc().toISOString();
-    data.update.UnixTimestamp = moment.utc().valueOf();
-  }
-  data.update.UnixTimestampReverse =
-    Number.MAX_SAFE_INTEGER - data.update.UnixTimestamp;
-  data.update.RowId = getRowId(data.update.Site, data.update.Id);
-  if (data.update.IsFeatured && !data.update.IsFeaturedDate) {
-    data.update.IsFeaturedDate = moment.utc().unix();
-  } else if (!data.update.IsFeatured) {
-    data.update.IsFeaturedDate = null;
-  }
+	data.update.Id = uuid.v1();
 
-  if (data.update.Video) {
-    if (!isValidVideo(data.update.Video)) {
-      return callback(
-        null,
-        generateJsonResponse(400, {
-          message:
-            "The video URL is from a domain that is not recognized and therefore blocked for security reasons.",
-        })
-      );
-    }
-  }
+	if (!data.update.Timestamp && !data.update.UnixTimestamp) {
+		data.update.Timestamp = moment.utc().toISOString();
+		data.update.UnixTimestamp = moment.utc().valueOf();
+	}
+	data.update.UnixTimestampReverse =
+		Number.MAX_SAFE_INTEGER - data.update.UnixTimestamp;
+	data.update.RowId = getRowId(data.update.Site, data.update.Id);
+	if (data.update.IsFeatured && !data.update.IsFeaturedDate) {
+		data.update.IsFeaturedDate = moment.utc().unix();
+	} else if (!data.update.IsFeatured) {
+		data.update.IsFeaturedDate = null;
+	}
 
-  if (data.update.Notification) data.update.UnsentNotification = "X";
+	if (data.update.Video) {
+		if (!isValidVideo(data.update.Video)) {
+			return callback(
+				null,
+				generateJsonResponse(400, {
+					message:
+						"The video URL is from a domain that is not recognized and therefore blocked for security reasons.",
+				}),
+			);
+		}
+	}
 
-  getSessionUserFromReqAuthKey(event).then((uid) => {
-    getUserPreview(uid).then((user) => {
-      data.update.SubmittedBy = user;
-      if (data.update.AuthorDisplay === "name") {
-        data.update.Author = user;
-      }
+	if (data.update.Notification) data.update.UnsentNotification = "X";
 
-      validateMasterAuth(event, values.permissionNewsletter).then(
-        (authorised) => {
-          if (!authorised) {
-            validateMasterAuth(event, values.permissionNewsletterSubmit).then(
-              (authorised) => {
-                if (!authorised) {
-                  console.error("Authorization not valid");
-                  callback(
-                    null,
-                    generateJsonResponse(403, {
-                      message: "Authorization not valid.",
-                    })
-                  );
-                  return;
-                }
+	getSessionUserFromReqAuthKey(event).then((uid) => {
+		getUserPreview(uid).then((user) => {
+			data.update.SubmittedBy = user;
+			if (data.update.AuthorDisplay === "name") {
+				data.update.Author = user;
+			}
 
-                if (data.update.Private) {
-                  updateRef(values.tableNameNewsletterEntries, data.update)
-                    .then((result) => {
-                      callback(
-                        null,
-                        generateJsonResponse(200, {
-                          success: true,
-                          update: result,
-                          reviewRequired: false,
-                        })
-                      );
-                    })
-                    .catch((error) => {
-                      console.log("error", error);
-                      callback(
-                        null,
-                        generateJsonResponse(500, {
-                          message: "Something went wrong.",
-                        })
-                      );
-                    });
-                } else {
-                  updateRef(values.tableNameNewsletterSubmissions, data.update)
-                    .then((result) => {
-                      publishActivity(
-                        values.activityAddNewsSubmission,
-                        data.update.Site,
-                        data.update.RowId,
-                        user,
-                        { title: data.update.Title }
-                      );
-                      sendNewsSubmissionEmail(data.update);
-                      callback(
-                        null,
-                        generateJsonResponse(200, {
-                          success: true,
-                          update: result,
-                          reviewRequired: true,
-                        })
-                      );
-                    })
-                    .catch((error) => {
-                      console.log("error", error);
-                      callback(
-                        null,
-                        generateJsonResponse(500, {
-                          message: "Something went wrong.",
-                        })
-                      );
-                    });
-                }
-              }
-            );
-          } else {
-            updateRef(values.tableNameNewsletterEntries, data.update)
-              .then((result) => {
-                if (!data.update.Private) {
-                  publishActivity(
-                    values.activityAddNews,
-                    data.update.Site,
-                    data.update.RowId,
-                    user,
-                    { title: data.update.Title }
-                  );
-                }
-                callback(
-                  null,
-                  generateJsonResponse(200, {
-                    success: true,
-                    update: result,
-                    reviewRequired: false,
-                  })
-                );
-              })
-              .catch((error) => {
-                console.log("error", error);
-                callback(
-                  null,
-                  generateJsonResponse(500, {
-                    message: "Something went wrong.",
-                  })
-                );
-              });
-          }
-        }
-      );
-    });
-  });
+			validateMasterAuth(event, values.permissionNewsletter).then(
+				(authorised) => {
+					if (!authorised) {
+						validateMasterAuth(event, values.permissionNewsletterSubmit).then(
+							(authorised) => {
+								if (!authorised) {
+									console.error("Authorization not valid");
+									callback(
+										null,
+										generateJsonResponse(403, {
+											message: "Authorization not valid.",
+										}),
+									);
+									return;
+								}
+
+								if (data.update.Private) {
+									updateRef(values.tableNameNewsletterEntries, data.update)
+										.then((result) => {
+											callback(
+												null,
+												generateJsonResponse(200, {
+													success: true,
+													update: result,
+													reviewRequired: false,
+												}),
+											);
+										})
+										.catch((error) => {
+											console.log("error", error);
+											callback(
+												null,
+												generateJsonResponse(500, {
+													message: "Something went wrong.",
+												}),
+											);
+										});
+								} else {
+									updateRef(values.tableNameNewsletterSubmissions, data.update)
+										.then((result) => {
+											publishActivity(
+												values.activityAddNewsSubmission,
+												data.update.Site,
+												data.update.RowId,
+												user,
+												{ title: data.update.Title },
+											);
+											sendNewsSubmissionEmail(data.update);
+											callback(
+												null,
+												generateJsonResponse(200, {
+													success: true,
+													update: result,
+													reviewRequired: true,
+												}),
+											);
+										})
+										.catch((error) => {
+											console.log("error", error);
+											callback(
+												null,
+												generateJsonResponse(500, {
+													message: "Something went wrong.",
+												}),
+											);
+										});
+								}
+							},
+						);
+					} else {
+						updateRef(values.tableNameNewsletterEntries, data.update)
+							.then((result) => {
+								if (!data.update.Private) {
+									publishActivity(
+										values.activityAddNews,
+										data.update.Site,
+										data.update.RowId,
+										user,
+										{ title: data.update.Title },
+									);
+								}
+								callback(
+									null,
+									generateJsonResponse(200, {
+										success: true,
+										update: result,
+										reviewRequired: false,
+									}),
+								);
+							})
+							.catch((error) => {
+								console.log("error", error);
+								callback(
+									null,
+									generateJsonResponse(500, {
+										message: "Something went wrong.",
+									}),
+								);
+							});
+					}
+				},
+			);
+		});
+	});
 };

package/common/ai/authorizeNewsletterDraft.js

@@ -0,0 +1,120 @@
+const getRef = require("@plusscommunities/pluss-core-aws/db/common/getRef");
+const validateMasterAuth = require("../helper/auth/validateMasterAuth");
+const { AuthenticationDependencyError } = require("./errors");
+const { safeErrorMetadata, safeLog } = require("./safeLog");
+const getPostAuthSessionUser = require("./safeSessionUser");
+
+const getHeader = (headers, name) => {
+	if (!headers || typeof headers !== "object") return undefined;
+	const key = Object.keys(headers).find(
+		(headerName) => headerName.toLowerCase() === name.toLowerCase(),
+	);
+	return key ? headers[key] : undefined;
+};
+
+const getRoles = (user) => {
+	if (!user || typeof user !== "object") return [];
+	if (Object.hasOwn(user, "Roles")) {
+		return Array.isArray(user.Roles) ? user.Roles : [];
+	}
+	if (typeof user.site === "string" && typeof user.type === "string") {
+		return [{ site: user.site, type: user.type }];
+	}
+	return [];
+};
+
+const authorizeNewsletterDraft = async (event, permission, site) => {
+	// AI draft generation never accepts API keys, including non-canonical header
+	// casing. This must happen before validateMasterAuth, which can authorise API
+	// keys for other extension endpoints.
+	if (getHeader(event?.headers, "apikey") !== undefined) return false;
+
+	if (
+		typeof permission !== "string" ||
+		permission.trim() === "" ||
+		typeof site !== "string" ||
+		site.trim() === ""
+	) {
+		return false;
+	}
+
+	const token = getHeader(event?.headers, "authkey");
+	if (typeof token !== "string" || token.trim() === "") return false;
+
+	// validateMasterAuth expects canonical lowercase headers. Preserve the
+	// existing case-insensitive authkey contract while ensuring the shared path
+	// validates the same token used by the post-auth checks below.
+	const authEvent =
+		event?.headers?.authkey === token
+			? event
+			: { ...event, headers: { ...event?.headers, authkey: token } };
+
+	let sharedAuthorised;
+	try {
+		sharedAuthorised = await validateMasterAuth(
+			authEvent,
+			permission,
+			site,
+			undefined,
+			{ throwOnDependencyError: true },
+		);
+	} catch (error) {
+		safeLog("error", "shared-auth-dependency-failed", {
+			originalError: safeErrorMetadata(error),
+		});
+		throw new AuthenticationDependencyError();
+	}
+	if (sharedAuthorised !== true) return false;
+
+	// validateMasterAuth owns JWT verification and permission evaluation. These
+	// checks intentionally run only after shared authorization to retain the AI
+	// path's stricter fail-closed blacklist and deleted-user behavior.
+	const userId = await getPostAuthSessionUser(token);
+	if (!userId) return false;
+
+	// Lookup failures below are operational (DynamoDB outage), not authorization
+	// denials: log safe metadata at the dependency boundary, then propagate a
+	// typed error so the handler can return a retryable server response.
+	let user;
+	try {
+		user = await getRef("users", "Id", userId);
+	} catch (error) {
+		safeLog("error", "authorize-user-lookup-failed", {
+			originalError: safeErrorMetadata(error),
+		});
+		throw new AuthenticationDependencyError();
+	}
+	if (!user || typeof user !== "object" || user.Deleted === true) {
+		return false;
+	}
+
+	const roles = getRoles(user);
+	if (
+		Object.hasOwn(user, "Roles") &&
+		(!Array.isArray(user.Roles) ||
+			user.Roles.length === 0 ||
+			user.Roles.some(
+				(role) =>
+					!role ||
+					typeof role.site !== "string" ||
+					role.site.trim() === "" ||
+					typeof role.type !== "string" ||
+					role.type.trim() === "",
+			))
+	) {
+		return false;
+	}
+	if (roles.length === 0) return false;
+
+	// Shared auth permits a small allowlist of kiosk actions. Newsletter draft
+	// generation remains categorically unavailable to kiosk roles.
+	const hasKioskRoleForSite = roles.some(
+		(role) =>
+			role?.site === site && ["KIOSK", "FORMKIOSK"].includes(role?.type),
+	);
+	return !hasKioskRoleForSite;
+};
+
+module.exports = authorizeNewsletterDraft;
+module.exports.getHeader = getHeader;
+module.exports.getRoles = getRoles;

package/common/ai/bedrockClient.js

@@ -0,0 +1,165 @@
+const {
+	BedrockRuntimeClient,
+	ConverseCommand,
+} = require("@aws-sdk/client-bedrock-runtime");
+const {
+	withLlmTelemetry,
+} = require("@plusscommunities/pluss-core-aws/helper/llmTelemetry");
+const { AI_DRAFT_MODE_CONTINUE } = require("./constants");
+const { createAiDraftError, markPreResponseFailure } = require("./errors");
+const { assertMobileSafeDraft } = require("./mobileSafe");
+const { buildPrompt } = require("./promptBuilder");
+const {
+	assertNoExistingOverlap,
+	assertNotRepetitive,
+} = require("./repetitionGuard");
+const { sanitizeDraftText } = require("./sanitizer");
+
+// Converse stop reasons that mean a complete answer. max_tokens / guardrail /
+// content_filtered indicate a truncated or blocked draft we must not return.
+const ACCEPTED_STOP_REASONS = new Set(["end_turn", "stop_sequence"]);
+
+const clientsByRegion = {};
+
+const getBedrockClient = (region) => {
+	if (!clientsByRegion[region]) {
+		clientsByRegion[region] = new BedrockRuntimeClient({
+			maxAttempts: 5,
+			region,
+			retryMode: "adaptive",
+		});
+	}
+	return clientsByRegion[region];
+};
+
+const sendWithTimeout = async (client, command, timeoutMs) => {
+	const controller = new AbortController();
+	const timeout = setTimeout(() => controller.abort(), timeoutMs);
+	try {
+		return await client.send(command, { abortSignal: controller.signal });
+	} finally {
+		clearTimeout(timeout);
+	}
+};
+
+const extractConverseText = (response) => {
+	const content = response?.output?.message
+		? response.output.message.content
+		: [];
+	return content
+		.map((part) => (part?.text ? part.text : ""))
+		.join("\n")
+		.trim();
+};
+
+const buildConverseInput = (request, config) => {
+	const prompt = buildPrompt(request);
+	return {
+		// Only maxTokens is sent: newer Claude models (4.x, incl. Opus 4.x via the
+		// AU inference profile) reject `temperature` and `topP` as deprecated, so
+		// we rely on the model's default sampling.
+		inferenceConfig: {
+			maxTokens: 900,
+		},
+		messages: [
+			{
+				content: [{ text: prompt.user }],
+				role: "user",
+			},
+		],
+		modelId: config.modelId,
+		system: [{ text: prompt.system }],
+	};
+};
+
+// Explicit whitelist of Bedrock Runtime modeled exceptions that are raised
+// before the model runs inference (request refused at the front door), so a
+// quota refund cannot double-spend a consumed model attempt. Notably excluded:
+// ModelTimeoutException (408) and ModelErrorException (424), where the model
+// was invoked, and anything indeterminate (AbortError, socket drops, 5xx).
+const PRE_INFERENCE_EXCEPTIONS = new Set([
+	"AccessDeniedException",
+	"ResourceNotFoundException",
+	"ServiceQuotaExceededException",
+	"ThrottlingException",
+	"ValidationException",
+]);
+
+const isRejectedBeforeInference = (error) =>
+	Number.isFinite(error?.$metadata?.httpStatusCode) &&
+	PRE_INFERENCE_EXCEPTIONS.has(error?.name);
+
+const generateDraftWithBedrock = async (
+	request,
+	config,
+	telemetryContext = {},
+) => {
+	const client = getBedrockClient(config.region);
+	const input = buildConverseInput(request, config);
+	let response;
+	try {
+		response = await withLlmTelemetry({
+			invoke: () =>
+				sendWithTimeout(
+					client,
+					new ConverseCommand(input),
+					config.requestTimeoutMs,
+				),
+			operation: "converse",
+			modelId: input.modelId,
+			region: config.region,
+			prompt: {
+				system: input.system,
+				messages: input.messages,
+			},
+			featureId: "newsletter-draft-generation",
+			communityId: request.site,
+			traceId: telemetryContext.traceId,
+			pricing: config.pricing,
+			extractSuccess: (result) => ({
+				completion: result?.output?.message?.content,
+				inputTokens: result?.usage?.inputTokens,
+				outputTokens: result?.usage?.outputTokens,
+				totalTokens: result?.usage?.totalTokens,
+				stopReason: result?.stopReason,
+			}),
+		});
+	} catch (error) {
+		// Refund quota only for whitelisted modeled rejections that prove the
+		// request was refused before inference ran. Everything else (model
+		// timeouts/errors, client-side aborts, socket drops, 5xx) keeps the
+		// reservation because a model attempt may already have been consumed.
+		if (isRejectedBeforeInference(error)) {
+			throw markPreResponseFailure(error);
+		}
+		throw error;
+	}
+	const stopReason = response?.stopReason;
+	if (!ACCEPTED_STOP_REASONS.has(stopReason)) {
+		throw createAiDraftError(
+			502,
+			"AI_DRAFT_INCOMPLETE",
+			"The generated draft did not finish cleanly. Please try again.",
+			{ stopReason },
+		);
+	}
+	const text = sanitizeDraftText(extractConverseText(response));
+	assertNotRepetitive(text);
+	assertMobileSafeDraft(text, request.mode);
+	if (request.mode === AI_DRAFT_MODE_CONTINUE) {
+		assertNoExistingOverlap(text, request.existingText);
+	}
+	return {
+		stopReason,
+		text,
+		usage: response.usage || null,
+	};
+};
+
+module.exports = {
+	buildConverseInput,
+	extractConverseText,
+	generateDraftWithBedrock,
+	getBedrockClient,
+	sendWithTimeout,
+};