headroom-cms 0.1.1

package/src/api.ts

@@ -0,0 +1,113 @@
+/**
+ * API Infrastructure
+ *
+ * Go Lambda function serving the Headroom API with access to all resources.
+ * Supports dev mode (Go source with live reload) and package mode (pre-compiled binary).
+ */
+
+import path from "path";
+import type { StorageResources } from "./storage.js";
+import type { AuthResources } from "./auth.js";
+import type { WebhookResources } from "./webhooks.js";
+import type { ImageResources } from "./image.js";
+
+export interface ApiArgs {
+  storage: StorageResources;
+  auth: AuthResources;
+  webhooks: WebhookResources;
+  image: ImageResources;
+  pkgRoot: string;
+  dev?: {
+    /** Go source path, e.g. "packages/api" */
+    handler: string;
+  };
+}
+
+export function createApi(name: string, args: ApiArgs) {
+  const { storage, auth, webhooks, image } = args;
+
+  const handlerConfig = args.dev
+    ? {
+        handler: args.dev.handler,
+        runtime: "go" as const,
+      }
+    : {
+        bundle: path.join(args.pkgRoot, "lambda/api"),
+        handler: "bootstrap",
+        runtime: "provided.al2023" as const,
+        architecture: "arm64" as const,
+      };
+
+  const api = new sst.aws.Function(`${name}Api`, {
+    ...handlerConfig,
+    timeout: "60 seconds",
+    url: {
+      cors: false,
+    },
+    environment: {
+      SITES_TABLE: storage.sites.name,
+      CONTENT_TABLE: storage.content.name,
+      DRAFT_CONTENT_TABLE: storage.draftContent.name,
+      BLOCKS_TABLE: storage.blocks.name,
+      MEDIA_TABLE: storage.media.name,
+      COLLECTIONS_TABLE: storage.collections.name,
+      BLOCK_TYPES_TABLE: storage.blockTypes.name,
+      ADMIN_AUDIT_TABLE: storage.adminAudit.name,
+      CONTENT_BUCKET: storage.contentBucket.name,
+      USER_POOL_ID: auth.userPool.id,
+      USER_POOL_CLIENT_ID: auth.userPoolClient.id,
+      KVS_ARN: storage.kvs.arn,
+      AWS_REGION_NAME: aws.getRegionOutput().name,
+      WEBHOOKS_TABLE: webhooks.webhooks.name,
+      WEBHOOK_DELIVERIES_TABLE: webhooks.webhookDeliveries.name,
+      WEBHOOK_QUEUE_URL: webhooks.webhookDeliveryQueue.url,
+      IMAGE_SIGNING_SECRET: image.imageSigningSecret.value,
+      IMAGE_LAMBDA_NAME: image.imageLambda.name,
+      RELATIONSHIPS_TABLE: storage.relationships.name,
+    },
+    link: [
+      storage.sites,
+      storage.content,
+      storage.draftContent,
+      storage.blocks,
+      storage.media,
+      storage.collections,
+      storage.blockTypes,
+      storage.adminAudit,
+      storage.contentBucket,
+      webhooks.webhooks,
+      webhooks.webhookDeliveries,
+      webhooks.webhookDeliveryQueue,
+      image.imageSigningSecret,
+      storage.relationships,
+    ],
+    permissions: [
+      {
+        actions: [
+          "cloudfront-keyvaluestore:DescribeKeyValueStore",
+          "cloudfront-keyvaluestore:PutKey",
+          "cloudfront-keyvaluestore:DeleteKey",
+          "cloudfront-keyvaluestore:GetKey",
+        ],
+        resources: [storage.kvs.arn],
+      },
+      {
+        actions: [
+          "cognito-idp:ListUsers",
+          "cognito-idp:AdminCreateUser",
+          "cognito-idp:AdminDeleteUser",
+          "cognito-idp:AdminGetUser",
+        ],
+        resources: [auth.userPool.arn],
+      },
+      {
+        actions: ["lambda:InvokeFunction"],
+        resources: [image.imageLambda.arn],
+      },
+    ],
+  });
+
+  return { api };
+}
+
+export type ApiResources = ReturnType<typeof createApi>;

package/src/auth.ts

@@ -0,0 +1,110 @@
+/**
+ * Authentication Infrastructure
+ *
+ * Cognito User Pool, SES email identity, and custom message Lambda.
+ * Supports dev mode (source handler) and package mode (pre-bundled handler).
+ */
+
+import path from "path";
+
+export interface AuthArgs {
+  senderEmail: string;
+  passwordPolicy?: {
+    minimumLength?: number;
+    requireLowercase?: boolean;
+    requireUppercase?: boolean;
+    requireNumbers?: boolean;
+    requireSymbols?: boolean;
+  };
+  pkgRoot: string;
+  dev?: {
+    /** SST handler string, e.g. "packages/functions/custom-message.handler" */
+    handler: string;
+  };
+}
+
+export function createAuth(name: string, args: AuthArgs) {
+  const emailIdentity = new aws.ses.EmailIdentity(`${name}EmailIdentity`, {
+    email: args.senderEmail,
+  });
+
+  // Custom message Lambda: customizes Cognito invite emails
+  let customMessageFn: sst.aws.Function;
+  if (args.dev) {
+    customMessageFn = new sst.aws.Function(`${name}CustomMessage`, {
+      handler: args.dev.handler,
+      runtime: "nodejs20.x",
+    });
+  } else {
+    customMessageFn = new sst.aws.Function(`${name}CustomMessage`, {
+      bundle: path.join(args.pkgRoot, "lambda/functions/custom-message"),
+      handler: "index.handler",
+      runtime: "nodejs20.x",
+    });
+  }
+
+  const pp = args.passwordPolicy ?? {};
+
+  const userPool = new sst.aws.CognitoUserPool(`${name}UserPool`, {
+    usernames: ["email"],
+    transform: {
+      userPool: {
+        passwordPolicy: {
+          minimumLength: pp.minimumLength ?? 12,
+          requireLowercase: pp.requireLowercase ?? true,
+          requireUppercase: pp.requireUppercase ?? true,
+          requireNumbers: pp.requireNumbers ?? true,
+          requireSymbols: pp.requireSymbols ?? true,
+        },
+        accountRecoverySetting: {
+          recoveryMechanisms: [{ name: "verified_email", priority: 1 }],
+        },
+        lambdaConfig: {
+          customMessage: customMessageFn.arn,
+        },
+        emailConfiguration: {
+          emailSendingAccount: "DEVELOPER",
+          sourceArn: emailIdentity.arn,
+          fromEmailAddress: `Headroom CMS <${args.senderEmail}>`,
+        },
+        mfaConfiguration: "OPTIONAL",
+        softwareTokenMfaConfiguration: {
+          enabled: true,
+        },
+      },
+    },
+  });
+
+  // Grant Cognito permission to invoke the custom message Lambda
+  new aws.lambda.Permission(`${name}CustomMessagePermission`, {
+    action: "lambda:InvokeFunction",
+    function: customMessageFn.arn,
+    principal: "cognito-idp.amazonaws.com",
+    sourceArn: userPool.arn,
+  });
+
+  const userPoolClient = userPool.addClient(`${name}Client`, {
+    transform: {
+      client: {
+        explicitAuthFlows: [
+          "ALLOW_USER_SRP_AUTH",
+          "ALLOW_REFRESH_TOKEN_AUTH",
+          "ALLOW_ADMIN_USER_PASSWORD_AUTH",
+        ],
+        accessTokenValidity: 1,
+        idTokenValidity: 1,
+        refreshTokenValidity: 365,
+        tokenValidityUnits: {
+          accessToken: "hours",
+          idToken: "hours",
+          refreshToken: "days",
+        },
+        preventUserExistenceErrors: "ENABLED",
+      },
+    },
+  });
+
+  return { userPool, userPoolClient };
+}
+
+export type AuthResources = ReturnType<typeof createAuth>;

package/src/cdn.ts

@@ -0,0 +1,449 @@
+/**
+ * CDN Infrastructure
+ *
+ * CloudFront distribution with edge authentication, version-based caching,
+ * direct S3 media serving, and Sharp Lambda image transforms.
+ */
+
+import type { StorageResources } from "./storage.js";
+import type { ApiResources } from "./api.js";
+import type { ImageResources } from "./image.js";
+
+export interface CdnArgs {
+  api: ApiResources;
+  image: ImageResources;
+  contentBucket: StorageResources["contentBucket"];
+  kvs: StorageResources["kvs"];
+  priceClass?: "PriceClass_100" | "PriceClass_200" | "PriceClass_All";
+  apiCacheTtl?: number;
+  domain?: {
+    name: string;
+    certificateArn: string;
+  };
+}
+
+export function createCdn(name: string, args: CdnArgs) {
+  const { api, image, contentBucket, kvs } = args;
+  const apiCacheTtl = args.apiCacheTtl ?? 3600;
+
+  // Extract KVS UUID from ARN (cf.kvs() needs the UUID, not the name)
+  const kvsUuid = kvs.arn.apply((arn: string) => arn.split("/").pop()!);
+
+  // =========================================================================
+  // CloudFront Function: Edge Auth
+  // =========================================================================
+  const edgeFunction = new aws.cloudfront.Function(`${name}EdgeAuth`, {
+    name: $interpolate`${$app.name}-${$app.stage}-edge-auth`,
+    runtime: "cloudfront-js-2.0",
+    publish: true,
+    keyValueStoreAssociations: [kvs.arn],
+    code: $interpolate`
+    import cf from 'cloudfront';
+    import crypto from 'crypto';
+
+    const kvsId = '${kvsUuid}';
+    const kvsHandle = cf.kvs(kvsId);
+
+    async function handler(event) {
+      const request = event.request;
+      const uri = request.uri;
+      const headers = request.headers;
+
+      // Skip auth for admin paths (use JWT auth at origin)
+      if (uri.startsWith('/v1/admin/')) {
+        return request;
+      }
+
+      // Skip auth for health endpoint
+      if (uri === '/health') {
+        return request;
+      }
+
+      // Skip auth for non-API paths
+      if (!uri.startsWith('/v1/')) {
+        return request;
+      }
+
+      // Extract site from path: /v1/{site}/...
+      var pathParts = uri.split('/');
+      if (pathParts.length < 3) {
+        return {
+          statusCode: 400,
+          statusDescription: 'Bad Request',
+          body: { encoding: 'text', data: 'Invalid path' }
+        };
+      }
+
+      var site = pathParts[2];
+
+      // Get API key from header
+      var apiKeyHeader = headers['x-headroom-key'];
+      if (!apiKeyHeader) {
+        return {
+          statusCode: 401,
+          statusDescription: 'Unauthorized',
+          headers: { 'content-type': { value: 'application/json' } },
+          body: { encoding: 'text', data: JSON.stringify({ error: 'API key required' }) }
+        };
+      }
+
+      // Hash the API key (needed for KVS lookup key)
+      var keyHash = crypto.createHash('sha256').update(apiKeyHeader.value).digest('hex');
+      var hashPrefix = keyHash.substring(0, 8);
+
+      // Fetch API key hash and version in parallel
+      var results = await Promise.all([
+        kvsHandle.get('site:' + site + ':key:' + hashPrefix).catch(function() { return null; }),
+        kvsHandle.get('site:' + site + ':version').catch(function() { return '0'; }),
+      ]);
+
+      var storedHash = results[0];
+      var versionResult = results[1];
+
+      // Validate API key - compare full hash
+      if (!storedHash || storedHash !== keyHash) {
+        return {
+          statusCode: 403,
+          statusDescription: 'Forbidden',
+          headers: { 'content-type': { value: 'application/json' } },
+          body: { encoding: 'text', data: JSON.stringify({ error: 'Invalid API key' }) }
+        };
+      }
+
+      // Add version header for cache key discrimination
+      request.headers['x-site-version'] = { value: versionResult || '0' };
+
+      return request;
+    }
+  `,
+  });
+
+  // =========================================================================
+  // CloudFront Function: Media Rewrite
+  // =========================================================================
+  const mediaRewriteFunction = new aws.cloudfront.Function(
+    `${name}MediaRewrite`,
+    {
+      name: $interpolate`${$app.name}-${$app.stage}-media-rewrite`,
+      runtime: "cloudfront-js-2.0",
+      publish: true,
+      code: `
+    function handler(event) {
+      var request = event.request;
+      var uri = request.uri;
+
+      // Rewrite /media/{site}/{mediaId}/{file} → /sites/{site}/media/{mediaId}/{file}
+      var parts = uri.split('/');
+      // parts: ['', 'media', '{site}', '{mediaId}', '{file}']
+      if (parts.length >= 5 && parts[1] === 'media') {
+        var site = parts[2];
+        var mediaId = parts[3];
+        var rest = parts.slice(4).join('/');
+        request.uri = '/sites/' + site + '/media/' + mediaId + '/' + rest;
+      }
+
+      return request;
+    }
+  `,
+    },
+  );
+
+  // =========================================================================
+  // Cache Policies
+  // =========================================================================
+
+  const apiCachePolicy = new aws.cloudfront.CachePolicy(
+    `${name}APICachePolicy`,
+    {
+      name: $interpolate`${$app.name}-${$app.stage}-api-cache`,
+      comment:
+        "Cache policy for Headroom API with version-based cache busting",
+      defaultTtl: apiCacheTtl,
+      maxTtl: 86400,
+      minTtl: 0,
+      parametersInCacheKeyAndForwardedToOrigin: {
+        cookiesConfig: { cookieBehavior: "none" },
+        headersConfig: {
+          headerBehavior: "whitelist",
+          headers: { items: ["x-site-version"] },
+        },
+        queryStringsConfig: {
+          queryStringBehavior: "whitelist",
+          queryStrings: {
+            items: ["collection", "limit", "cursor", "before", "after", "tag"],
+          },
+        },
+        enableAcceptEncodingBrotli: true,
+        enableAcceptEncodingGzip: true,
+      },
+    },
+  );
+
+  const imageCachePolicy = new aws.cloudfront.CachePolicy(
+    `${name}ImageCachePolicy`,
+    {
+      name: $interpolate`${$app.name}-${$app.stage}-image-cache`,
+      comment: "Cache policy for transformed images (immutable)",
+      defaultTtl: 31536000,
+      maxTtl: 31536000,
+      minTtl: 31536000,
+      parametersInCacheKeyAndForwardedToOrigin: {
+        cookiesConfig: { cookieBehavior: "none" },
+        headersConfig: { headerBehavior: "none" },
+        queryStringsConfig: {
+          queryStringBehavior: "whitelist",
+          queryStrings: {
+            items: ["w", "h", "fit", "format", "q", "sig"],
+          },
+        },
+        enableAcceptEncodingBrotli: true,
+        enableAcceptEncodingGzip: true,
+      },
+    },
+  );
+
+  const mediaCachePolicy = new aws.cloudfront.CachePolicy(
+    `${name}MediaCachePolicy`,
+    {
+      name: $interpolate`${$app.name}-${$app.stage}-media-cache`,
+      comment: "Cache policy for original media files (immutable)",
+      defaultTtl: 31536000,
+      maxTtl: 31536000,
+      minTtl: 31536000,
+      parametersInCacheKeyAndForwardedToOrigin: {
+        cookiesConfig: { cookieBehavior: "none" },
+        headersConfig: { headerBehavior: "none" },
+        queryStringsConfig: { queryStringBehavior: "none" },
+        enableAcceptEncodingBrotli: true,
+        enableAcceptEncodingGzip: true,
+      },
+    },
+  );
+
+  // =========================================================================
+  // Origin Request Policy
+  // =========================================================================
+
+  const originRequestPolicy = new aws.cloudfront.OriginRequestPolicy(
+    `${name}OriginRequestPolicy`,
+    {
+      name: $interpolate`${$app.name}-${$app.stage}-origin-request`,
+      comment: "Forward necessary headers to Lambda origin",
+      cookiesConfig: { cookieBehavior: "none" },
+      headersConfig: {
+        headerBehavior: "whitelist",
+        headers: {
+          items: [
+            "x-headroom-key",
+            "content-type",
+            "accept",
+            "x-site-version",
+          ],
+        },
+      },
+      queryStringsConfig: { queryStringBehavior: "all" },
+    },
+  );
+
+  // Managed AllViewerExceptHostHeader policy for admin paths
+  const adminOriginRequestPolicyId =
+    "b689b0a8-53d0-40ab-baf2-68738e2966ac";
+
+  // =========================================================================
+  // Origin Access Controls (OAC)
+  // =========================================================================
+
+  const mediaOAC = new aws.cloudfront.OriginAccessControl(`${name}MediaOAC`, {
+    name: $interpolate`${$app.name}-${$app.stage}-media-oac`,
+    description: "OAC for S3 media origin",
+    originAccessControlOriginType: "s3",
+    signingBehavior: "always",
+    signingProtocol: "sigv4",
+  });
+
+  const imageOAC = new aws.cloudfront.OriginAccessControl(`${name}ImageOAC`, {
+    name: $interpolate`${$app.name}-${$app.stage}-image-oac`,
+    description: "OAC for image transform Lambda origin",
+    originAccessControlOriginType: "lambda",
+    signingBehavior: "always",
+    signingProtocol: "sigv4",
+  });
+
+  // =========================================================================
+  // CloudFront Distribution
+  // =========================================================================
+
+  const originDomain = api.api.url.apply((url: string) => {
+    const parsed = new URL(url);
+    return parsed.hostname;
+  });
+
+  const imageLambdaDomain = image.imageLambda.url.apply((url: string) => {
+    const parsed = new URL(url);
+    return parsed.hostname;
+  });
+
+  const s3RegionalDomain = $interpolate`${contentBucket.name}.s3.${aws.getRegionOutput().name}.amazonaws.com`;
+
+  const priceClass = args.priceClass ?? "PriceClass_100";
+
+  // Build aliases and certificate config for custom domain
+  const aliases = args.domain ? [args.domain.name] : undefined;
+  const viewerCertificate = args.domain
+    ? {
+        acmCertificateArn: args.domain.certificateArn,
+        sslSupportMethod: "sni-only" as const,
+        minimumProtocolVersion: "TLSv1.2_2021" as const,
+      }
+    : {
+        cloudfrontDefaultCertificate: true,
+      };
+
+  const distribution = new aws.cloudfront.Distribution(
+    `${name}Distribution`,
+    {
+      enabled: true,
+      comment: $interpolate`Headroom CMS API - ${$app.stage}`,
+      httpVersion: "http2and3",
+      priceClass,
+      aliases,
+
+      origins: [
+        {
+          originId: "api",
+          domainName: originDomain,
+          customOriginConfig: {
+            httpPort: 80,
+            httpsPort: 443,
+            originProtocolPolicy: "https-only",
+            originSslProtocols: ["TLSv1.2"],
+          },
+        },
+        {
+          originId: "media-s3",
+          domainName: s3RegionalDomain,
+          originAccessControlId: mediaOAC.id,
+          s3OriginConfig: {
+            originAccessIdentity: "",
+          },
+        },
+        {
+          originId: "image-lambda",
+          domainName: imageLambdaDomain,
+          originAccessControlId: imageOAC.id,
+          customOriginConfig: {
+            httpPort: 80,
+            httpsPort: 443,
+            originProtocolPolicy: "https-only",
+            originSslProtocols: ["TLSv1.2"],
+          },
+        },
+      ],
+
+      defaultCacheBehavior: {
+        targetOriginId: "api",
+        viewerProtocolPolicy: "redirect-to-https",
+        allowedMethods: [
+          "GET",
+          "HEAD",
+          "OPTIONS",
+          "PUT",
+          "POST",
+          "PATCH",
+          "DELETE",
+        ],
+        cachedMethods: ["GET", "HEAD", "OPTIONS"],
+        compress: true,
+        cachePolicyId: apiCachePolicy.id,
+        originRequestPolicyId: originRequestPolicy.id,
+        functionAssociations: [
+          {
+            eventType: "viewer-request",
+            functionArn: edgeFunction.arn,
+          },
+        ],
+      },
+
+      orderedCacheBehaviors: [
+        // Admin paths: no caching, forwards Authorization header
+        {
+          pathPattern: "/v1/admin/*",
+          targetOriginId: "api",
+          viewerProtocolPolicy: "redirect-to-https",
+          allowedMethods: [
+            "GET",
+            "HEAD",
+            "OPTIONS",
+            "PUT",
+            "POST",
+            "PATCH",
+            "DELETE",
+          ],
+          cachedMethods: ["GET", "HEAD", "OPTIONS"],
+          compress: true,
+          cachePolicyId: "4135ea2d-6df8-44a3-9df3-4b5a84be39ad",
+          originRequestPolicyId: adminOriginRequestPolicyId,
+        },
+        // Media originals: served directly from S3 via OAC
+        {
+          pathPattern: "/media/*",
+          targetOriginId: "media-s3",
+          viewerProtocolPolicy: "redirect-to-https",
+          allowedMethods: ["GET", "HEAD", "OPTIONS"],
+          cachedMethods: ["GET", "HEAD", "OPTIONS"],
+          compress: true,
+          cachePolicyId: mediaCachePolicy.id,
+          functionAssociations: [
+            {
+              eventType: "viewer-request",
+              functionArn: mediaRewriteFunction.arn,
+            },
+          ],
+        },
+        // Image transforms: served via Sharp Lambda
+        {
+          pathPattern: "/img/*",
+          targetOriginId: "image-lambda",
+          viewerProtocolPolicy: "redirect-to-https",
+          allowedMethods: ["GET", "HEAD", "OPTIONS"],
+          cachedMethods: ["GET", "HEAD", "OPTIONS"],
+          compress: true,
+          cachePolicyId: imageCachePolicy.id,
+        },
+        // Health endpoint: no caching, no auth
+        {
+          pathPattern: "/health",
+          targetOriginId: "api",
+          viewerProtocolPolicy: "redirect-to-https",
+          allowedMethods: ["GET", "HEAD"],
+          cachedMethods: ["GET", "HEAD"],
+          compress: true,
+          cachePolicyId: "4135ea2d-6df8-44a3-9df3-4b5a84be39ad",
+          originRequestPolicyId: originRequestPolicy.id,
+        },
+      ],
+
+      restrictions: {
+        geoRestriction: { restrictionType: "none" },
+      },
+
+      viewerCertificate,
+    },
+  );
+
+  // Allow CloudFront to invoke the image Lambda via OAC
+  new aws.lambda.Permission(`${name}ImageLambdaCFPermission`, {
+    action: "lambda:InvokeFunctionUrl",
+    function: image.imageLambda.name,
+    principal: "cloudfront.amazonaws.com",
+    sourceArn: distribution.arn,
+  });
+
+  const url = args.domain
+    ? $interpolate`https://${args.domain.name}`
+    : $interpolate`https://${distribution.domainName}`;
+
+  return { distribution, url };
+}
+
+export type CdnResources = ReturnType<typeof createCdn>;