canopycms-cdk 0.0.68-int.100 → 0.0.68-int.102

package/dist/constructs/asset-support.d.ts

@@ -127,6 +127,29 @@ export interface AssetSupportProps {
      * @default false
      */
     readonly autoDeleteObjects?: boolean;
+    /**
+     * Deny every `s3:PutObject` to `assets/*`, `asset-originals/*` and `asset-meta/*` that carries
+     * no `If-None-Match`, so no principal can replace an object under those content-addressed
+     * prefixes. Standalone mode only: with a BYO `bucket` the prop is refused, and the same statement
+     * belongs in that bucket's own policy (see docs/deploying-to-aws.md).
+     *
+     * Opt-in because the Deny binds every writer: the CMS Lambda, which runs the `canopycms` your app
+     * installs, and with `lazyPublicTransforms` the transform Lambda, which bundles the `canopycms`
+     * this package was built with and calls S3 through the Lambda runtime's AWS SDK. Upgrade and
+     * deploy both to releases whose stores write create-only, then enable this. It also denies every
+     * unconditional write, such as a plain `aws s3 cp`, and every multipart upload (`UploadPart`
+     * carries no `If-None-Match`). Replication is authorized as `s3:ReplicateObject`, so it is not
+     * denied; a replica bucket takes the same statement.
+     *
+     * Create-only holds only as far as `s3:DeleteObject` does: a delete then a create replaces an
+     * object, so keep Delete on `assets/*` and `asset-originals/*` to a break-glass role. That is
+     * also how a bad derivative is replaced: delete it, then rerun `materialize-assets`. On a
+     * versioned bucket the delete writes a delete marker and the bad version stays restorable; a
+     * replica keeps the bad version until the rematerialized object replicates.
+     *
+     * @default false
+     */
+    readonly enforceCreateOnlyWrites?: boolean;
     /**
      * A replica of the bucket's `assets/` prefix. Both public behaviors fail over
      * to it on 500, 502, 503 or 504 from the primary, never on a miss: the

package/dist/constructs/asset-support.js

@@ -2,7 +2,7 @@ import { existsSync } from 'node:fs';
 import * as path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { Construct } from 'constructs';
-import { Duration, RemovalPolicy, Stack, Token, aws_cloudfront as cloudfront, aws_cloudfront_origins as origins, aws_lambda as lambda, aws_logs as logs, aws_s3 as s3, } from 'aws-cdk-lib';
+import { Duration, RemovalPolicy, Stack, Token, aws_cloudfront as cloudfront, aws_cloudfront_origins as origins, aws_iam as iam, aws_lambda as lambda, aws_logs as logs, aws_s3 as s3, } from 'aws-cdk-lib';
 import { attachLambdaExecutionPolicies } from './lambda-execution-role.js';
 // This package (`canopycms-cdk`) is `"type": "module"`, so its compiled
 // output is real ESM - `__dirname` is not a global there. Derive it from
@@ -42,6 +42,8 @@ const PREFIXES = {
     public: 'assets',
     transform: 'assets/t',
 };
+/** The content-addressed prefixes, whose objects no correct writer ever replaces. */
+const CREATE_ONLY_PREFIXES = [PREFIXES.public, PREFIXES.originals, PREFIXES.meta];
 /**
  * The tag on every object the transform Lambda writes, copied as literals for
  * the same reason as `PREFIXES`. Source of truth is `LAZY_TRANSFORM_TAG` in
@@ -519,6 +521,13 @@ export class AssetSupport extends Construct {
                 '`lazyPublicTransforms` and run `canopycms materialize-assets` in your release ' +
                 'pipeline instead.');
         }
+        if (props.bucket && props.enforceCreateOnlyWrites) {
+            throw new Error('AssetSupport: `enforceCreateOnlyWrites` writes its Deny into the policy of a bucket this ' +
+                'construct creates, and cannot write one on a BYO `bucket`. Drop the prop and add the ' +
+                "statement to your bucket's own policy: Deny s3:PutObject to any principal on " +
+                `${CREATE_ONLY_PREFIXES.map((prefix) => `${prefix}/*`).join(', ')} under the condition ` +
+                '{ Null: { "s3:if-none-match": "true" } }.');
+        }
         // Fail closed: a bundle without the marker has no linux/arm64 sharp and
         // throws at cold start on the first image request, far from the cause.
         // `pnpm test` leaves exactly such a fixture on disk.
@@ -610,6 +619,16 @@ export class AssetSupport extends Construct {
                     : undefined,
             });
         }
+        if (props.enforceCreateOnlyWrites) {
+            this.bucket.addToResourcePolicy(new iam.PolicyStatement({
+                sid: 'DenyAssetOverwrites',
+                effect: iam.Effect.DENY,
+                principals: [new iam.StarPrincipal()],
+                actions: ['s3:PutObject'],
+                resources: CREATE_ONLY_PREFIXES.map((prefix) => this.bucket.arnForObjects(`${prefix}/*`)),
+                conditions: { Null: { 's3:if-none-match': 'true' } },
+            }));
+        }
         if (lazy) {
             const transform = this.buildTransformLambda(props);
             this.transformFunction = transform.fn;

package/dist/constructs/editor-routing.d.ts

@@ -76,8 +76,8 @@ export interface CanopyCmsAttachOptions {
      *
      * It must set `x-forwarded-host` from the viewer's Host, or sign-in
      * redirects point at the Function URL and 403. It must not gate on HTTP
-     * Basic auth: the API answers 401 without `WWW-Authenticate`, and a browser
-     * that sees that drops its cached Basic credential and prompts again.
+     * Basic auth; the CMS authenticates these routes itself. A Basic-gated site sets
+     * the CMS config's `unauthenticatedStatus: 419` (see docs/deploying-to-aws.md).
      *
      * @default - a function that sets `x-forwarded-host` and nothing else
      */