headroom-cms 0.1.9 → 0.1.11

package/src/api.ts

@@ -10,12 +10,19 @@ import type { StorageResources } from "./storage.js";
 import type { AuthResources } from "./auth.js";
 import type { WebhookResources } from "./webhooks.js";
 import type { ImageResources } from "./image.js";
+import type { CollabTableResources } from "./collaboration.js";
 
 export interface ApiArgs {
   storage: StorageResources;
   auth: AuthResources;
   webhooks: WebhookResources;
   image: ImageResources;
+  /**
+   * Just the collab DynamoDB table — the API Lambda only links the table
+   * for ticket reads/writes, it does NOT depend on the WebSocket handler.
+   * (The WS handler is created AFTER the API because its env needs api.url.)
+   */
+  collab: CollabTableResources;
   senderEmail: string;
   pkgRoot: string;
   dev?: {
@@ -25,7 +32,7 @@ export interface ApiArgs {
 }
 
 export function createApi(name: string, args: ApiArgs) {
-  const { storage, auth, webhooks, image } = args;
+  const { storage, auth, webhooks, image, collab } = args;
 
   const handlerConfig = args.dev
     ? {
@@ -67,6 +74,11 @@ export function createApi(name: string, args: ApiArgs) {
       RELATIONSHIPS_TABLE: storage.relationships.name,
       SITE_USERS_TABLE: storage.siteUsers.name,
       SES_FROM_EMAIL: args.senderEmail,
+      COLLAB_TABLE: collab.collabTable.name,
+      // Shared with the collab Lambda. The Go JWT middleware verifies
+      // `X-Headroom-Internal` against this on internal service calls
+      // (collab → draft snapshot). See packages/api/internal/middleware/jwt.go.
+      INTERNAL_SECRET: storage.internalSecret.value,
     },
     link: [
       storage.sites,
@@ -84,6 +96,8 @@ export function createApi(name: string, args: ApiArgs) {
       image.imageSigningSecret,
       storage.relationships,
       storage.siteUsers,
+      collab.collabTable,
+      storage.internalSecret,
     ],
     permissions: [
       {

package/src/{cdn.ts → cdn-api.ts}

@@ -1,18 +1,16 @@
 /**
- * CDN Infrastructure
+ * API CDN Infrastructure
  *
- * CloudFront distribution with edge authentication, version-based caching,
- * direct S3 media serving, and Sharp Lambda image transforms.
+ * CloudFront distribution for the Headroom API only — `/v1/*` and `/health`.
+ * Edge-auth function + KVS association live here. No `/media/*` or `/img/*`
+ * behaviors; those are served by the separate media CDN (see cdn-media.ts).
  */
 
 import type { StorageResources } from "./storage.js";
 import type { ApiResources } from "./api.js";
-import type { ImageResources } from "./image.js";
 
-export interface CdnArgs {
+export interface ApiCdnArgs {
   api: ApiResources;
-  image: ImageResources;
-  contentBucket: StorageResources["contentBucket"];
   kvs: StorageResources["kvs"];
   priceClass?: "PriceClass_100" | "PriceClass_200" | "PriceClass_All";
   apiCacheTtl?: number;
@@ -22,8 +20,8 @@ export interface CdnArgs {
   };
 }
 
-export function createCdn(name: string, args: CdnArgs) {
-  const { api, image, contentBucket, kvs } = args;
+export function createApiCdn(name: string, args: ApiCdnArgs) {
+  const { api, kvs } = args;
   const apiCacheTtl = args.apiCacheTtl ?? 3600;
 
   // Extract KVS UUID from ARN (cf.kvs() needs the UUID, not the name)
@@ -109,36 +107,6 @@ export function createCdn(name: string, args: CdnArgs) {
   `,
   });
 
-  // =========================================================================
-  // CloudFront Function: Media Rewrite
-  // =========================================================================
-  const mediaRewriteFunction = new aws.cloudfront.Function(
-    `${name}MediaRewrite`,
-    {
-      name: $interpolate`${$app.name}-${$app.stage}-media-rewrite`,
-      runtime: "cloudfront-js-2.0",
-      publish: true,
-      code: `
-    function handler(event) {
-      var request = event.request;
-      var uri = request.uri;
-
-      // Rewrite /media/{site}/{mediaId}/{file} → /sites/{site}/media/{mediaId}/{file}
-      var parts = uri.split('/');
-      // parts: ['', 'media', '{site}', '{mediaId}', '{file}']
-      if (parts.length >= 5 && parts[1] === 'media') {
-        var site = parts[2];
-        var mediaId = parts[3];
-        var rest = parts.slice(4).join('/');
-        request.uri = '/sites/' + site + '/media/' + mediaId + '/' + rest;
-      }
-
-      return request;
-    }
-  `,
-    },
-  );
-
   // =========================================================================
   // Cache Policies
   // =========================================================================
@@ -175,47 +143,6 @@ export function createCdn(name: string, args: CdnArgs) {
     },
   );
 
-  const imageCachePolicy = new aws.cloudfront.CachePolicy(
-    `${name}ImageCachePolicy`,
-    {
-      name: $interpolate`${$app.name}-${$app.stage}-image-cache`,
-      comment: "Cache policy for transformed images (immutable)",
-      defaultTtl: 31536000,
-      maxTtl: 31536000,
-      minTtl: 31536000,
-      parametersInCacheKeyAndForwardedToOrigin: {
-        cookiesConfig: { cookieBehavior: "none" },
-        headersConfig: { headerBehavior: "none" },
-        queryStringsConfig: {
-          queryStringBehavior: "whitelist",
-          queryStrings: {
-            items: ["w", "h", "fit", "format", "q", "sig"],
-          },
-        },
-        enableAcceptEncodingBrotli: true,
-        enableAcceptEncodingGzip: true,
-      },
-    },
-  );
-
-  const mediaCachePolicy = new aws.cloudfront.CachePolicy(
-    `${name}MediaCachePolicy`,
-    {
-      name: $interpolate`${$app.name}-${$app.stage}-media-cache`,
-      comment: "Cache policy for original media files (immutable)",
-      defaultTtl: 31536000,
-      maxTtl: 31536000,
-      minTtl: 31536000,
-      parametersInCacheKeyAndForwardedToOrigin: {
-        cookiesConfig: { cookieBehavior: "none" },
-        headersConfig: { headerBehavior: "none" },
-        queryStringsConfig: { queryStringBehavior: "none" },
-        enableAcceptEncodingBrotli: true,
-        enableAcceptEncodingGzip: true,
-      },
-    },
-  );
-
   const versionCachePolicy = new aws.cloudfront.CachePolicy(
     `${name}VersionCachePolicy`,
     {
@@ -275,26 +202,6 @@ export function createCdn(name: string, args: CdnArgs) {
   // authenticated behaviors below.
   const cachingDisabledPolicyId = "4135ea2d-6df8-44a3-9df3-4b5a84be39ad";
 
-  // =========================================================================
-  // Origin Access Controls (OAC)
-  // =========================================================================
-
-  const mediaOAC = new aws.cloudfront.OriginAccessControl(`${name}MediaOAC`, {
-    name: $interpolate`${$app.name}-${$app.stage}-media-oac`,
-    description: "OAC for S3 media origin",
-    originAccessControlOriginType: "s3",
-    signingBehavior: "always",
-    signingProtocol: "sigv4",
-  });
-
-  const imageOAC = new aws.cloudfront.OriginAccessControl(`${name}ImageOAC`, {
-    name: $interpolate`${$app.name}-${$app.stage}-image-oac`,
-    description: "OAC for image transform Lambda origin",
-    originAccessControlOriginType: "lambda",
-    signingBehavior: "always",
-    signingProtocol: "sigv4",
-  });
-
   // =========================================================================
   // CloudFront Distribution
   // =========================================================================
@@ -304,13 +211,6 @@ export function createCdn(name: string, args: CdnArgs) {
     return parsed.hostname;
   });
 
-  const imageLambdaDomain = image.imageLambda.url.apply((url: string) => {
-    const parsed = new URL(url);
-    return parsed.hostname;
-  });
-
-  const s3RegionalDomain = $interpolate`${contentBucket.name}.s3.${aws.getRegionOutput().name}.amazonaws.com`;
-
   const priceClass = args.priceClass ?? "PriceClass_100";
 
   // Build aliases and certificate config for custom domain
@@ -345,25 +245,6 @@ export function createCdn(name: string, args: CdnArgs) {
             originSslProtocols: ["TLSv1.2"],
           },
         },
-        {
-          originId: "media-s3",
-          domainName: s3RegionalDomain,
-          originAccessControlId: mediaOAC.id,
-          s3OriginConfig: {
-            originAccessIdentity: "",
-          },
-        },
-        {
-          originId: "image-lambda",
-          domainName: imageLambdaDomain,
-          originAccessControlId: imageOAC.id,
-          customOriginConfig: {
-            httpPort: 80,
-            httpsPort: 443,
-            originProtocolPolicy: "https-only",
-            originSslProtocols: ["TLSv1.2"],
-          },
-        },
       ],
 
       defaultCacheBehavior: {
@@ -549,32 +430,6 @@ export function createCdn(name: string, args: CdnArgs) {
             },
           ],
         },
-        // Media originals: served directly from S3 via OAC
-        {
-          pathPattern: "/media/*",
-          targetOriginId: "media-s3",
-          viewerProtocolPolicy: "redirect-to-https",
-          allowedMethods: ["GET", "HEAD", "OPTIONS"],
-          cachedMethods: ["GET", "HEAD", "OPTIONS"],
-          compress: true,
-          cachePolicyId: mediaCachePolicy.id,
-          functionAssociations: [
-            {
-              eventType: "viewer-request",
-              functionArn: mediaRewriteFunction.arn,
-            },
-          ],
-        },
-        // Image transforms: served via Sharp Lambda
-        {
-          pathPattern: "/img/*",
-          targetOriginId: "image-lambda",
-          viewerProtocolPolicy: "redirect-to-https",
-          allowedMethods: ["GET", "HEAD", "OPTIONS"],
-          cachedMethods: ["GET", "HEAD", "OPTIONS"],
-          compress: true,
-          cachePolicyId: imageCachePolicy.id,
-        },
         // Health endpoint: no caching, no auth
         {
           pathPattern: "/health",
@@ -596,14 +451,6 @@ export function createCdn(name: string, args: CdnArgs) {
     },
   );
 
-  // Allow CloudFront to invoke the image Lambda via OAC
-  new aws.lambda.Permission(`${name}ImageLambdaCFPermission`, {
-    action: "lambda:InvokeFunctionUrl",
-    function: image.imageLambda.name,
-    principal: "cloudfront.amazonaws.com",
-    sourceArn: distribution.arn,
-  });
-
   const url = args.domain
     ? $interpolate`https://${args.domain.name}`
     : $interpolate`https://${distribution.domainName}`;
@@ -611,4 +458,4 @@ export function createCdn(name: string, args: CdnArgs) {
   return { distribution, url };
 }
 
-export type CdnResources = ReturnType<typeof createCdn>;
+export type ApiCdnResources = ReturnType<typeof createApiCdn>;

package/src/cdn-media.ts

@@ -0,0 +1,250 @@
+/**
+ * Media CDN Infrastructure
+ *
+ * CloudFront distribution for the public media surface — `/media/*` and
+ * `/img/*` only. No edge auth (`/media/*` is OAC-public, `/img/*` is HMAC
+ * signed at the Sharp Lambda). The default behavior targets the S3 origin
+ * with no rewrite, so unmatched paths return AccessDenied from S3 — defense
+ * in depth.
+ */
+
+import type { StorageResources } from "./storage.js";
+import type { ImageResources } from "./image.js";
+
+export interface MediaCdnArgs {
+  image: ImageResources;
+  contentBucket: StorageResources["contentBucket"];
+  priceClass?: "PriceClass_100" | "PriceClass_200" | "PriceClass_All";
+  domain?: {
+    name: string;
+    certificateArn: string;
+  };
+}
+
+export function createMediaCdn(name: string, args: MediaCdnArgs) {
+  const { image, contentBucket } = args;
+
+  // =========================================================================
+  // CloudFront Function: Media Rewrite
+  // =========================================================================
+  const mediaRewriteFunction = new aws.cloudfront.Function(
+    `${name}MediaRewrite`,
+    {
+      name: $interpolate`${$app.name}-${$app.stage}-media-rewrite`,
+      runtime: "cloudfront-js-2.0",
+      publish: true,
+      code: `
+    function handler(event) {
+      var request = event.request;
+      var uri = request.uri;
+
+      // Rewrite /media/{site}/{mediaId}/{file} → /sites/{site}/media/{mediaId}/{file}
+      var parts = uri.split('/');
+      // parts: ['', 'media', '{site}', '{mediaId}', '{file}']
+      if (parts.length >= 5 && parts[1] === 'media') {
+        var site = parts[2];
+        var mediaId = parts[3];
+        var rest = parts.slice(4).join('/');
+        request.uri = '/sites/' + site + '/media/' + mediaId + '/' + rest;
+      }
+
+      return request;
+    }
+  `,
+    },
+  );
+
+  // =========================================================================
+  // Cache Policies
+  // =========================================================================
+
+  const imageCachePolicy = new aws.cloudfront.CachePolicy(
+    `${name}ImageCachePolicy`,
+    {
+      name: $interpolate`${$app.name}-${$app.stage}-image-cache`,
+      comment: "Cache policy for transformed images (immutable)",
+      defaultTtl: 31536000,
+      maxTtl: 31536000,
+      minTtl: 31536000,
+      parametersInCacheKeyAndForwardedToOrigin: {
+        cookiesConfig: { cookieBehavior: "none" },
+        headersConfig: { headerBehavior: "none" },
+        queryStringsConfig: {
+          queryStringBehavior: "whitelist",
+          queryStrings: {
+            items: ["w", "h", "fit", "format", "q", "sig"],
+          },
+        },
+        enableAcceptEncodingBrotli: true,
+        enableAcceptEncodingGzip: true,
+      },
+    },
+  );
+
+  const mediaCachePolicy = new aws.cloudfront.CachePolicy(
+    `${name}MediaCachePolicy`,
+    {
+      name: $interpolate`${$app.name}-${$app.stage}-media-cache`,
+      comment: "Cache policy for original media files (immutable)",
+      defaultTtl: 31536000,
+      maxTtl: 31536000,
+      minTtl: 31536000,
+      parametersInCacheKeyAndForwardedToOrigin: {
+        cookiesConfig: { cookieBehavior: "none" },
+        headersConfig: { headerBehavior: "none" },
+        queryStringsConfig: { queryStringBehavior: "none" },
+        enableAcceptEncodingBrotli: true,
+        enableAcceptEncodingGzip: true,
+      },
+    },
+  );
+
+  // =========================================================================
+  // Origin Access Controls (OAC)
+  // =========================================================================
+
+  const mediaOAC = new aws.cloudfront.OriginAccessControl(`${name}MediaOAC`, {
+    name: $interpolate`${$app.name}-${$app.stage}-media-oac`,
+    description: "OAC for S3 media origin",
+    originAccessControlOriginType: "s3",
+    signingBehavior: "always",
+    signingProtocol: "sigv4",
+  });
+
+  const imageOAC = new aws.cloudfront.OriginAccessControl(`${name}ImageOAC`, {
+    name: $interpolate`${$app.name}-${$app.stage}-image-oac`,
+    description: "OAC for image transform Lambda origin",
+    originAccessControlOriginType: "lambda",
+    signingBehavior: "always",
+    signingProtocol: "sigv4",
+  });
+
+  // =========================================================================
+  // CloudFront Distribution
+  // =========================================================================
+
+  const imageLambdaDomain = image.imageLambda.url.apply((url: string) => {
+    const parsed = new URL(url);
+    return parsed.hostname;
+  });
+
+  const s3RegionalDomain = $interpolate`${contentBucket.name}.s3.${aws.getRegionOutput().name}.amazonaws.com`;
+
+  const priceClass = args.priceClass ?? "PriceClass_100";
+
+  // Build aliases and certificate config for custom domain
+  const aliases = args.domain ? [args.domain.name] : undefined;
+  const viewerCertificate = args.domain
+    ? {
+        acmCertificateArn: args.domain.certificateArn,
+        sslSupportMethod: "sni-only" as const,
+        minimumProtocolVersion: "TLSv1.2_2021" as const,
+      }
+    : {
+        cloudfrontDefaultCertificate: true,
+      };
+
+  // Fresh resource ID `${name}MediaDistribution` (parallel to
+  // `${name}ApiDistribution` in cdn-api.ts) — same blue/green rationale.
+  const distribution = new aws.cloudfront.Distribution(
+    `${name}MediaDistribution`,
+    {
+      enabled: true,
+      comment: $interpolate`Headroom CMS Media - ${$app.stage}`,
+      httpVersion: "http2and3",
+      priceClass,
+      aliases,
+
+      origins: [
+        {
+          originId: "media-s3",
+          domainName: s3RegionalDomain,
+          originAccessControlId: mediaOAC.id,
+          s3OriginConfig: {
+            originAccessIdentity: "",
+          },
+        },
+        {
+          originId: "image-lambda",
+          domainName: imageLambdaDomain,
+          originAccessControlId: imageOAC.id,
+          customOriginConfig: {
+            httpPort: 80,
+            httpsPort: 443,
+            originProtocolPolicy: "https-only",
+            originSslProtocols: ["TLSv1.2"],
+          },
+        },
+      ],
+
+      // Default behavior: target media-s3 with mediaCachePolicy and NO
+      // viewer-request rewrite. Anything not under /media/* or /img/* hits
+      // S3 with the original URI and returns 403 AccessDenied — defense in
+      // depth so a typo can't accidentally rewrite to a real S3 key.
+      defaultCacheBehavior: {
+        targetOriginId: "media-s3",
+        viewerProtocolPolicy: "redirect-to-https",
+        allowedMethods: ["GET", "HEAD", "OPTIONS"],
+        cachedMethods: ["GET", "HEAD", "OPTIONS"],
+        compress: true,
+        cachePolicyId: mediaCachePolicy.id,
+      },
+
+      orderedCacheBehaviors: [
+        // Media originals: served directly from S3 via OAC. Explicit (not
+        // implicit-via-default) so the rewrite never runs on unrelated paths.
+        {
+          pathPattern: "/media/*",
+          targetOriginId: "media-s3",
+          viewerProtocolPolicy: "redirect-to-https",
+          allowedMethods: ["GET", "HEAD", "OPTIONS"],
+          cachedMethods: ["GET", "HEAD", "OPTIONS"],
+          compress: true,
+          cachePolicyId: mediaCachePolicy.id,
+          functionAssociations: [
+            {
+              eventType: "viewer-request",
+              functionArn: mediaRewriteFunction.arn,
+            },
+          ],
+        },
+        // Image transforms: served via Sharp Lambda
+        {
+          pathPattern: "/img/*",
+          targetOriginId: "image-lambda",
+          viewerProtocolPolicy: "redirect-to-https",
+          allowedMethods: ["GET", "HEAD", "OPTIONS"],
+          cachedMethods: ["GET", "HEAD", "OPTIONS"],
+          compress: true,
+          cachePolicyId: imageCachePolicy.id,
+        },
+      ],
+
+      restrictions: {
+        geoRestriction: { restrictionType: "none" },
+      },
+
+      viewerCertificate,
+    },
+  );
+
+  // Allow CloudFront to invoke the image Lambda via OAC.
+  // CRITICAL: sourceArn must reference the MEDIA distribution's ARN. Pointing
+  // it at the API CDN ARN would silently break image transforms in a way
+  // that's hard to spot from logs. (Single most-important consistency point
+  // per the design doc.)
+  new aws.lambda.Permission(`${name}ImageLambdaCFPermission`, {
+    action: "lambda:InvokeFunctionUrl",
+    function: image.imageLambda.name,
+    principal: "cloudfront.amazonaws.com",
+    sourceArn: distribution.arn,
+  });
+
+  const url = args.domain
+    ? $interpolate`https://${args.domain.name}`
+    : $interpolate`https://${distribution.domainName}`;
+
+  return { distribution, url };
+}
+
+export type MediaCdnResources = ReturnType<typeof createMediaCdn>;