create-ampless 1.0.0-beta.155 → 1.0.0-beta.157

package/dist/templates/_shared/amplify/auth/resource.custom.ts

@@ -9,21 +9,22 @@
 //
 // ── Passkeys (WebAuthn) ──────────────────────────────────────────────
 //
-// Passkeys are ENABLED BY DEFAULT (the empty object below). With the
-// default, Amplify auto-resolves the WebAuthn Relying Party ID from the
-// deployment domain, which works on Amplify Hosting domains and on a
-// `localhost` sandbox.
+// Passkeys are ENABLED BY DEFAULT. `amplify/auth/resource.ts` auto-
+// derives the WebAuthn Relying Party ID from `cms.config.ts` `site.url`
+// in Amplify Hosting pipeline builds, and uses `localhost` (auto-
+// resolved by Amplify) in `ampx sandbox`. This file is usually unneeded
+// for passkeys.
 //
-// If you serve the admin from a CUSTOM DOMAIN behind a CDN, the
-// auto-resolved RP ID won't match the URL the browser sees and passkey
-// sign-in fails with a `SecurityError`. Pin the RP ID to the bare
-// domain (no protocol, no path) the operators visit:
+// Set `webAuthn: { relyingPartyId: 'admin.example.com' }` ONLY when the
+// admin is served from a different subdomain than `site.url` (e.g. site
+// is at `example.com` but the admin CDN origin is `admin.example.com`).
 //
 //   export const authCustomizations: Pick<AmplessAuthConfigOpts, 'webAuthn'> = {
 //     webAuthn: { relyingPartyId: 'admin.example.com' },
 //   }
 //
-// To turn passkeys off entirely (password-only sign-in):
+// To turn passkeys off entirely (password-only sign-in AND removes the
+// passkey UI from the admin completely):
 //
 //   export const authCustomizations: Pick<AmplessAuthConfigOpts, 'webAuthn'> = {
 //     webAuthn: false,
@@ -33,6 +34,9 @@
 // invalidates every existing credential — they'll have to register
 // again from the account page. The password flow always stays available
 // as the fallback. See `docs/passkeys.md`.
+//
+// ⚠️ cms.config.ts must not import theme CSS or browser-only modules —
+// it is loaded at CDK synth time when deriving the RP ID.
 
 import type { AmplessAuthConfigOpts } from '@ampless/backend'
 

package/dist/templates/_shared/amplify/auth/resource.ts

@@ -1,5 +1,5 @@
 import { defineAuth } from '@aws-amplify/backend'
-import { amplessAuthConfig } from '@ampless/backend'
+import { amplessAuthConfig, resolveWebAuthn } from '@ampless/backend'
 import { postConfirmation } from './post-confirmation/resource.js'
 import { authCustomizations } from './resource.custom.js'
 
@@ -12,9 +12,23 @@ import { authCustomizations } from './resource.custom.js'
 // import-path verifier requires it to live at amplify/auth/resource.ts.
 // `amplessAuthConfig` just returns the props object.
 //
-// Per-site auth knobs (e.g. passkey Relying Party ID on a custom
-// domain) live in `resource.custom.ts` — that file is yours to edit and
-// is never overwritten by `update-ampless`.
+// The WebAuthn Relying Party ID is auto-derived from `cms.config.ts`
+// `site.url` in Amplify Hosting pipeline builds. In sandbox (`ampx
+// sandbox`) the RP ID stays `localhost` (Amplify auto-resolves it).
+// Override with `webAuthn: { relyingPartyId }` in resource.custom.ts
+// only when the admin is served from a different subdomain than site.url.
+import cmsConfig from '../../cms.config'
+
+const { webAuthn: webAuthnOverride, ...otherAuthCustomizations } = authCustomizations
+
 export const auth = defineAuth(
-  amplessAuthConfig({ postConfirmation, ...authCustomizations })
+  amplessAuthConfig({
+    postConfirmation,
+    ...otherAuthCustomizations,
+    webAuthn: resolveWebAuthn({
+      override: webAuthnOverride,
+      siteUrl: cmsConfig.site.url,
+      isPipeline: Boolean(process.env.AWS_BRANCH),
+    }),
+  })
 )

package/dist/templates/_shared/package.json

@@ -36,8 +36,8 @@
     "@ampless/plugin-schema-jsonld": "^0.1.1-beta.31",
     "@ampless/plugin-seo": "^0.2.0-beta.52",
     "@ampless/plugin-webhook": "^0.2.0-beta.53",
-    "@ampless/admin": "^1.0.0-beta.91",
-    "@ampless/backend": "^1.0.0-beta.77",
+    "@ampless/admin": "^1.0.0-beta.92",
+    "@ampless/backend": "^1.0.0-beta.78",
     "@ampless/runtime": "^1.0.0-beta.61",
     "@digital-go-jp/tailwind-theme-plugin": "^0.3.4",
     "ampless": "^1.0.0-beta.52",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-ampless",
-  "version": "1.0.0-beta.155",
+  "version": "1.0.0-beta.157",
   "description": "Create a new ampless project",
   "license": "MIT",
   "type": "module",