Deploy AXP Edge with CloudFront

// Publive AXP Edge — CloudFront Function (viewer request)
// Tags eligible requests so the origin-request Lambda@Edge function
// knows whether to route to Publive CDS or pass through to origin.
// CloudFront Functions cannot make network calls — this only inspects
// and tags the request; the actual CDS fetch happens in Lambda@Edge.

var AGENT_BOTS = [
  "GPTBot",
  "OAI-SearchBot",
  "ChatGPT-User",
  "ClaudeBot",
  "Claude-User",
  "Claude-SearchBot",
  "Google-Extended",
  "anthropic-ai",
  "PerplexityBot",
  "Perplexity-User"
];

var TARGETED_PATHS = null; // null = all HTML pages, or e.g. ['/', '/products', '/about']
var YOUR_DEFAULT_ORIGIN = "YOUR_DEFAULT_ORIGIN"; // replace with your existing origin name

var STATIC_FILE_EXTENSIONS = /\.(js|css|map|json|xml|txt|ico|png|jpe?g|gif|svg|webp|avif|woff2?|ttf|eot|otf|mp4|webm|mov|mp3|wav|pdf|zip|rar|7z|gz)$/i;

function isAgenticUA(ua) {
  var lower = ua.toLowerCase();
  for (var i = 0; i < AGENT_BOTS.length; i++) {
    if (lower.indexOf(AGENT_BOTS[i].toLowerCase()) !== -1) return true;
  }
  return false;
}

function isHtmlPageRequest(method, uri) {
  var isGetOrHead = method === "GET" || method === "HEAD";
  return isGetOrHead && !STATIC_FILE_EXTENSIONS.test(uri);
}

function isTargetedPath(uri) {
  if (TARGETED_PATHS === null) return true;
  return TARGETED_PATHS.indexOf(uri) !== -1;
}

function handler(event) {
  var request = event.request;
  var headers = request.headers;
  var uri = request.uri;
  var method = request.method;

  var ua = headers["user-agent"] ? headers["user-agent"].value : "";
  var alreadyRouted = !!headers["x-pl-request"];
  var previewFlag = headers["x-pl-preview"] && headers["x-pl-preview"].value === "1";
  var botMatch = isAgenticUA(ua);

  var eligible =
    !alreadyRouted &&
    (previewFlag || botMatch) &&
    isHtmlPageRequest(method, uri) &&
    isTargetedPath(uri);

  if (eligible) {
    console.log("Routing to Publive CDS origin for userAgent: " + ua);
    request.headers["x-pl-origin-choice"] = { value: "cds" };
  } else {
    console.log("Routing to Default origin for userAgent: " + ua);
    request.headers["x-pl-origin-choice"] = { value: YOUR_DEFAULT_ORIGIN };
  }

  return request;
}

// Publive AXP Edge — Lambda@Edge (origin request + origin response)
// Origin request: fetches from Publive CDS for eligible requests; on
// error, marks the request to fail over to the client's real origin.
// Origin response: tags failover responses with x-pl-fo.

'use strict';

const https = require('https');

const CLIENT_HOST = 'www.example.com'; // replace with your domain
const CDS_BACKEND_HOST = 'cds.thepublive.com'; // replace with your CDS backend host
const API_KEY = 'YOUR_PL_EDGE_API_KEY'; // replace, or source from a secrets mechanism
const FAILOVER_ON_4XX = true;
const FAILOVER_ON_5XX = true;

exports.handler = async (event) => {
  const cf = event.Records[0].cf;
  const request = cf.request;
  const eventType = cf.config.eventType;

  if (eventType === 'origin-request') {
    return handleOriginRequest(request);
  }
  if (eventType === 'origin-response') {
    return handleOriginResponse(request, cf.response);
  }
  return request;
};

function handleOriginRequest(request) {
  const headers = request.headers;
  const originChoice = headers['x-pl-origin-choice']
    ? headers['x-pl-origin-choice'][0].value
    : null;

  // CloudFront Function (viewer request) already decided eligibility.
  // If it tagged this request for the default origin, do nothing —
  // let it pass through to the distribution's configured origin.
  if (originChoice !== 'cds') {
    return request;
  }

  // Strip inbound trusted headers before setting our own (header hygiene).
  delete headers['x-pl-api-key'];
  delete headers['x-pl-url'];
  delete headers['x-pl-host'];
  delete headers['x-pl-client-ip'];
  delete headers['x-pl-origin-choice'];

  const clientIp =
    (request.clientIp) || '';

  headers['x-pl-host'] = [{ key: 'x-pl-host', value: CLIENT_HOST }];
  headers['x-pl-url'] = [{ key: 'x-pl-url', value: request.uri + (request.querystring ? '?' + request.querystring : '') }];
  headers['x-pl-api-key'] = [{ key: 'x-pl-api-key', value: API_KEY }];
  headers['x-pl-request'] = [{ key: 'x-pl-request', value: 'edge' }];
  headers['x-pl-client-ip'] = [{ key: 'x-pl-client-ip', value: clientIp }];

  // Redirect this request to the Publive CDS origin.
  request.origin = {
    custom: {
      domainName: CDS_BACKEND_HOST,
      port: 443,
      protocol: 'https',
      sslProtocols: ['TLSv1.2'],
      readTimeout: 20,
      keepaliveTimeout: 5,
      path: '',
      customHeaders: {}
    }
  };
  request.headers['host'] = [{ key: 'host', value: CDS_BACKEND_HOST }];

  return request;
}

function handleOriginResponse(request, response) {
  const status = parseInt(response.status, 10);
  const isErrorStatus =
    (FAILOVER_ON_4XX && status >= 400 && status < 500) ||
    (FAILOVER_ON_5XX && status >= 500 && status < 600);

  const wasCdsRequest = request.headers['x-pl-request'] &&
    request.headers['x-pl-request'][0].value === 'edge';

  if (wasCdsRequest && isErrorStatus) {
    console.log('Failover Triggered for agentic requests');
    // In production this branch performs (or signals) a same-request
    // fetch to the client's real origin and returns that body, tagging
    // the response with x-pl-fo: 1. Implementation depends on whether
    // failover is done via a second Lambda@Edge origin-request pass or
    // an origin-group configured on the distribution (see Troubleshooting).
    response.headers['x-pl-fo'] = [{ key: 'x-pl-fo', value: '1' }];
    return response;
  }

  if (wasCdsRequest) {
    console.log('Calling Publive CDS Origin for agentic requests');
  }

  return response;
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": [
          "lambda.amazonaws.com",
          "edgelambda.amazonaws.com"
        ]
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "logs:CreateLogGroup",
        "logs:CreateLogStream",
        "logs:PutLogEvents"
      ],
      "Resource": "arn:aws:logs:*:ACCOUNT_ID:log-group:/aws/lambda/*.FUNCTION_NAME:*"
    }
  ]
}