@ossy/platform 1.39.2 → 1.39.3

package/src/storage/s3.client.js

@@ -2,8 +2,9 @@ import { S3, PutObjectCommand, GetObjectCommand, HeadObjectCommand } from '@aws-
 import { S3RequestPresigner } from '@aws-sdk/s3-request-presigner'
 import { createRequest } from '@aws-sdk/util-create-request'
 import { formatUrl } from '@aws-sdk/util-format-url'
-import { ConfigService } from '../config.service.js'
 import { createLogger } from '@ossy/observability'
+import { createResourceReadUrl } from './resource-read-url.js'
+import { ConfigService } from '../config.service.js'
 
 const log = createLogger('storage')
 
@@ -30,35 +31,18 @@ function normalizeKey(keyOrShape) {
 export class S3Client {
 
   /**
-   * Public CDN URL (CloudFront) for objects under `media/` — use only when `access === 'public'`.
+   * App read URL — same shape as local filesystem (`/r/{resourceId}`).
    */
   static createDownloadUrl(keyOrShape) {
     const Key = normalizeKey(keyOrShape)
-    const pathAfterMedia = Key.includes('media/') ? Key.split('media/')[1] : Key
-    const base = ConfigService.MediaCdnDomainName || ''
-    return `${base.replace(/\/$/, '')}/${pathAfterMedia}`
+    return createResourceReadUrl(Key)
   }
 
   /**
-   * Short-lived presigned GET for private bucket reads (restricted resources, workspace members).
+   * Same as createDownloadUrl — auth is enforced by `/r/` route handlers.
    */
-  static createPresignedDownloadUrl(keyOrShape, { expiresIn = 15 * 60 } = {}) {
-    const Key = normalizeKey(keyOrShape)
-    const Bucket = ConfigService.MediaRepository
-    if (!Bucket) {
-      return Promise.reject(new Error('[S3Client] MEDIA_REPOSITORY is not configured'))
-    }
-
-    const s3Client = createS3Client()
-    const signedRequest = new S3RequestPresigner(s3Client.config)
-
-    return createRequest(s3Client, new GetObjectCommand({ Bucket, Key }))
-      .then(request => signedRequest.presign(request, { expiresIn }))
-      .then(formatUrl)
-      .catch(error => {
-        log.error('S3Client.createPresignedDownloadUrl error', undefined, error)
-        return Promise.reject(error)
-      })
+  static createPresignedDownloadUrl(keyOrShape) {
+    return Promise.resolve(S3Client.createDownloadUrl(keyOrShape))
   }
 
   static createUploadUrl({ ContentType, ContentLength, Key, Bucket, expiresIn = 60 * 60 * 24 }) {
@@ -97,4 +81,24 @@ export class S3Client {
     return s3Client.send(new HeadObjectCommand({ Bucket: bucket, Key }))
   }
 
+  static async load(keyOrShape) {
+    const Key = normalizeKey(keyOrShape)
+    const Bucket = ConfigService.MediaRepository
+    if (!Bucket) {
+      return { buffer: null, exists: false }
+    }
+    const s3Client = createS3Client()
+    try {
+      const response = await s3Client.send(new GetObjectCommand({ Bucket, Key }))
+      const bytes = await response.Body?.transformToByteArray?.()
+      if (!bytes) return { buffer: null, exists: false }
+      return { buffer: Buffer.from(bytes), exists: true }
+    } catch (err) {
+      if (err?.$metadata?.httpStatusCode === 404 || err?.name === 'NoSuchKey') {
+        return { buffer: null, exists: false }
+      }
+      throw err
+    }
+  }
+
 }

package/src/storage/storage-keys.js

@@ -0,0 +1,37 @@
+/**
+ * Flat blob keys — folder hierarchy lives in Mongo resource metadata (`location`), not in storage.
+ *
+ * Original binary: `{resourceId}`
+ * Derivatives (thumbnails, etc.): `{resourceId}:{variant}`
+ */
+
+const KEY_PATTERN = /^[A-Za-z0-9_-]+(:[A-Za-z0-9_-]+)?$/
+
+export function originalObjectKey (resourceId) {
+  assertResourceId(resourceId)
+  return resourceId
+}
+
+export function derivativeObjectKey (resourceId, variant) {
+  assertResourceId(resourceId)
+  if (!variant || typeof variant !== 'string') {
+    throw new Error('[storage-keys] variant is required')
+  }
+  if (!/^[A-Za-z0-9_-]+$/.test(variant)) {
+    throw new Error('[storage-keys] invalid variant')
+  }
+  return `${resourceId}:${variant}`
+}
+
+export function assertStorageKey (key) {
+  if (!key || typeof key !== 'string' || !KEY_PATTERN.test(key)) {
+    throw new Error(`[storage-keys] invalid storage key: ${key}`)
+  }
+  return key
+}
+
+function assertResourceId (resourceId) {
+  if (!resourceId || typeof resourceId !== 'string' || !/^[A-Za-z0-9_-]+$/.test(resourceId)) {
+    throw new Error(`[storage-keys] invalid resourceId: ${resourceId}`)
+  }
+}

package/src/storage/storage-keys.spec.js

@@ -0,0 +1,16 @@
+import { describe, expect, it } from '@jest/globals'
+import { originalObjectKey, derivativeObjectKey, assertStorageKey } from './storage-keys.js'
+
+describe('storage-keys', () => {
+  it('originalObjectKey returns flat resourceId', () => {
+    expect(originalObjectKey('abc123XYZ')).toBe('abc123XYZ')
+  })
+
+  it('derivativeObjectKey uses resourceId:variant', () => {
+    expect(derivativeObjectKey('abc123', 'galleryMedium')).toBe('abc123:galleryMedium')
+  })
+
+  it('rejects path-like keys', () => {
+    expect(() => assertStorageKey('media/ws/file')).toThrow()
+  })
+})

package/src/storage/storage.client.js

@@ -1,12 +1,56 @@
-import { S3Client } from './s3.client.js'
-import { LocalStorageClient } from './local-storage.client.js'
+import { IntegrationService } from '../integration.service.js'
 import { ConfigService } from '../config.service.js'
+import { createFilesystemStorageClient } from './filesystem-storage.client.js'
+import { createS3StorageClient } from './s3-storage.client.js'
+
+/** @type {import('./filesystem-storage.client.js').createFilesystemStorageClient extends (...args: any) => infer R ? R : never | null} */
+let fallbackClient = null
+
+function getFallbackClient () {
+  if (!fallbackClient) {
+    if (ConfigService.MediaRepository && ConfigService.awsAccessKeyId && ConfigService.awsSecretAccessKey) {
+      fallbackClient = createS3StorageClient({
+        bucket: ConfigService.MediaRepository,
+        cdnDomainName: ConfigService.MediaCdnDomainName,
+        accessKeyId: ConfigService.awsAccessKeyId,
+        secretAccessKey: ConfigService.awsSecretAccessKey,
+      })
+    } else {
+      fallbackClient = createFilesystemStorageClient()
+    }
+  }
+  return fallbackClient
+}
+
+function getStorageClient () {
+  return IntegrationService.get('storage') ?? getFallbackClient()
+}
+
+function bindMethod (name) {
+  return (...args) => {
+    const client = getStorageClient()
+    const fn = client[name]
+    if (typeof fn !== 'function') {
+      throw new Error(`[StorageClient] storage backend missing method "${name}"`)
+    }
+    return fn.apply(client, args)
+  }
+}
 
 /**
- * Active storage backend.
- *
- * - When `MEDIA_REPOSITORY` is set (production): delegates to S3.
- * - When `MEDIA_REPOSITORY` is unset (local dev): delegates to LocalStorageClient,
- *   which stores files in /tmp/ossy-local-media/ and serves them via GET /local-storage.
+ * Active primary storage backend (filesystem or S3 via `storage` integration).
  */
-export const StorageClient = ConfigService.MediaRepository ? S3Client : LocalStorageClient
+export const StorageClient = {
+  get backend () {
+    return getStorageClient().backend
+  },
+  createUploadUrl: bindMethod('createUploadUrl'),
+  createPresignedDownloadUrl: bindMethod('createPresignedDownloadUrl'),
+  createDownloadUrl: bindMethod('createDownloadUrl'),
+  load: bindMethod('load'),
+  headObject: bindMethod('headObject'),
+  save: bindMethod('save'),
+}
+
+export { LocalStorageClient } from './filesystem-storage.client.js'
+export { S3Client } from './s3.client.js'

package/src/storage/storage.integration.js

@@ -0,0 +1,40 @@
+import { createLogger } from '@ossy/observability'
+import { createFilesystemStorageClient } from './filesystem-storage.client.js'
+import { createS3StorageClient } from './s3-storage.client.js'
+
+const log = createLogger('storage')
+
+export const id = 'storage'
+
+/** Always connect — filesystem when S3 is not configured. */
+export const credentials = []
+
+/**
+ * Primary blob storage: S3 when MEDIA_REPOSITORY is set, otherwise local filesystem.
+ *
+ * Logical keys are flat resource ids (see storage-keys.js). Mongo holds folder paths.
+ *
+ * @param {{ env: NodeJS.ProcessEnv }} opts
+ */
+export async function connect ({ env }) {
+  const bucket = env.MEDIA_REPOSITORY
+
+  if (bucket) {
+    const missing = ['AWS_ACCESS_KEY_ID', 'AWS_SECRET_ACCESS_KEY'].filter((key) => !(key in env))
+    if (missing.length) {
+      log.warn(`[storage] MEDIA_REPOSITORY set but missing ${missing.join(', ')} — using filesystem fallback`)
+    } else {
+      log.info('[storage] Using S3 backend')
+      return createS3StorageClient({
+        bucket,
+        cdnDomainName: env.MEDIA_CDN_DOMAIN_NAME,
+        accessKeyId: env.AWS_ACCESS_KEY_ID,
+        secretAccessKey: env.AWS_SECRET_ACCESS_KEY,
+      })
+    }
+  }
+
+  const client = createFilesystemStorageClient({ env })
+  log.info(`[storage] Using filesystem backend at ${client.root}`)
+  return client
+}

package/src/tasks/change-stream.js

@@ -1,6 +1,6 @@
 import { TaskService } from './task-service.js'
 import { createLogger } from '@ossy/observability'
-import { resolveMongoUrl } from '@ossy/event-store'
+import { ProjectionRebuild, PushInvalidation, resolveMongoUrl } from '@ossy/event-store'
 
 const log = createLogger('platform')
 
@@ -121,7 +121,14 @@ export class ChangeStream {
 
     changeStream.on('change', (change) => {
       log.info('[ChangeStream] Change detected')
-      TaskService.dispatch(change.fullDocument)
+      const event = change.fullDocument
+      if (event) {
+        ProjectionRebuild.dispatch(event).catch((error) => {
+          log.error('[ChangeStream] Projection rebuild failed', undefined, error)
+        })
+        PushInvalidation.publish(event)
+      }
+      TaskService.dispatch(event)
     })
 
     changeStream.on('close', () => {

package/src/tasks/task-service.js

@@ -1,11 +1,21 @@
 import { matchesGlob } from './glob.js'
 import { matchesCron } from './cron.js'
 import { IntegrationService } from '../integration.service.js'
-import { createLogger, metrics } from '@ossy/observability'
+import { createLogger } from '@ossy/observability'
+import { isPrimaryTaskForAction, taskIdFromActionId } from '@ossy/schema'
+import { TaskRunService } from '../audit/task-run-service.js'
 
 const SCHEDULER_INTERVAL_MS = 60_000
 const _serviceLog = createLogger('TaskService')
 
+function buildTaskContext (baseContext, extras = {}) {
+  return {
+    ...baseContext,
+    ...extras,
+    payload: baseContext.payload ?? extras.payload,
+  }
+}
+
 export class TaskService {
 
   static _stopped = false
@@ -80,13 +90,44 @@ export class TaskService {
    * Synchronously invoke a task by id (HTTP / sdk.invoke path).
    *
    * @param {string} id
-   * @param {{ payload?: unknown, sdk?: unknown, log?: unknown, integrations?: unknown, req?: unknown }} context
+   * @param {{ payload?: unknown, sdk?: unknown, log?: unknown, integrations?: unknown, req?: unknown, actionInvocationId?: string }} context
    * @returns {Promise<unknown>}
    */
   static async invoke(id, context = {}) {
     const task = TaskService._tasksById.get(id)
     if (!task) throw new Error(`[TaskService] Task not found: "${id}"`)
-    return task.handler(context)
+
+    const audit = context.audit !== false && task.metadata.audit !== false
+
+    return TaskRunService.execute({
+      taskId: id,
+      handler: task.handler,
+      context,
+      trigger: 'invoke',
+      triggeredBy: {
+        channel: context.req ? undefined : 'api',
+        actionInvocationId: context.actionInvocationId ?? null,
+      },
+      executionEnv: 'ossy_server',
+      audit,
+    })
+  }
+
+  /** @param {string} id */
+  static has (id) {
+    return TaskService._tasksById.has(id)
+  }
+
+  /**
+   * @param {string} actionId
+   * @returns {boolean}
+   */
+  static hasTaskForAction (actionId) {
+    try {
+      return TaskService.has(taskIdFromActionId(actionId))
+    } catch {
+      return false
+    }
   }
 
   /**
@@ -101,23 +142,107 @@ export class TaskService {
 
     for (const { metadata, handler } of TaskService._tasks) {
       const triggers = metadata.triggers ?? []
-      const matched = triggers.some(trigger => TaskService._matchesTrigger(trigger, event))
+      const matched = triggers.some(trigger => TaskService._matchesEventTrigger(trigger, event))
 
       if (!matched) continue
 
       _serviceLog.info(`Dispatching task "${metadata.id}"`)
 
+      const taskContext = buildTaskContext(
+        { sdk: effectiveSdk, integrations: IntegrationService, log: createLogger(metadata.id) },
+        {
+          event,
+          payload: { workspaceId: event.payload?.belongsTo },
+        },
+      )
+
       const _taskId = metadata.id
-      const _start = Date.now()
-      Promise.resolve()
-        .then(() => handler({ event, sdk: effectiveSdk, integrations: IntegrationService, log: createLogger(metadata.id) }))
-        .catch(error =>
-          _serviceLog.error(`Task "${metadata.id}" failed`, undefined, error),
-        )
-        .finally(() => {
-          try { metrics.timing('task.duration', Date.now() - _start, { task: _taskId }) } catch {}
-          try { metrics.increment('task.run', { task: _taskId }) } catch {}
-        })
+      TaskRunService.executeAsync({
+        taskId: _taskId,
+        handler,
+        context: taskContext,
+        trigger: 'on_event',
+        triggeredBy: {
+          eventId: event.id,
+          resourceId: event.resourceId,
+          type: event.type,
+          event: event.event,
+        },
+        executionEnv: 'ossy_server',
+        audit: metadata.audit !== false,
+      })
+    }
+  }
+
+  /**
+   * Dispatches follow-up tasks registered with `on_action` triggers after an action completes.
+   *
+   * @param {{
+   *   actionId: string,
+   *   actionInvocationId?: string,
+   *   payload?: unknown,
+   *   result?: unknown,
+   *   success: boolean,
+   *   error?: Error,
+   *   req?: import('express').Request,
+   *   sdk?: unknown,
+   * }} actionContext
+   */
+  static dispatchOnAction (actionContext) {
+    const {
+      actionId,
+      actionInvocationId,
+      payload,
+      result,
+      success,
+      error,
+      req,
+      sdk,
+    } = actionContext
+
+    for (const { metadata, handler } of TaskService._tasks) {
+      if (isPrimaryTaskForAction(actionId, metadata.id)) continue
+
+      const triggers = metadata.triggers ?? []
+      const matched = triggers.some(trigger => TaskService._matchesActionTrigger(trigger, actionId))
+
+      if (!matched) continue
+
+      _serviceLog.info(`Dispatching on_action task "${metadata.id}" for action "${actionId}"`)
+
+      const taskContext = buildTaskContext(
+        {
+          sdk: sdk ?? TaskService._sdk,
+          integrations: IntegrationService,
+          log: createLogger(metadata.id),
+          req,
+          actionInvocationId,
+          payload,
+        },
+        {
+          action: {
+            id: actionId,
+            success,
+            result,
+            error: error ? { message: error.message } : undefined,
+          },
+        },
+      )
+
+      const _taskId = metadata.id
+      TaskRunService.executeAsync({
+        taskId: _taskId,
+        handler,
+        context: taskContext,
+        trigger: 'on_action',
+        triggeredBy: {
+          actionId,
+          actionInvocationId: actionInvocationId ?? null,
+          success,
+        },
+        executionEnv: 'ossy_server',
+        audit: metadata.audit !== false,
+      })
     }
   }
 
@@ -143,17 +268,23 @@ export class TaskService {
 
         _serviceLog.info(`Schedule fired for task "${metadata.id}"`)
 
+        const taskContext = {
+          event: { type: 'scheduled', taskId: metadata.id },
+          sdk: TaskService._sdk,
+          integrations: IntegrationService,
+          log: createLogger(metadata.id),
+        }
+
         const _taskId = metadata.id
-        const _start = Date.now()
-        Promise.resolve()
-          .then(() => handler({ event: { type: 'scheduled', taskId: metadata.id }, sdk: TaskService._sdk, integrations: IntegrationService, log: createLogger(metadata.id) }))
-          .catch(error =>
-            _serviceLog.error(`Scheduled task "${metadata.id}" failed`, undefined, error),
-          )
-          .finally(() => {
-            try { metrics.timing('task.duration', Date.now() - _start, { task: _taskId }) } catch {}
-            try { metrics.increment('task.run', { task: _taskId }) } catch {}
-          })
+        TaskRunService.executeAsync({
+          taskId: _taskId,
+          handler,
+          context: taskContext,
+          trigger: 'on_schedule',
+          triggeredBy: { schedule: metadata.schedule },
+          executionEnv: 'ossy_server',
+          audit: metadata.audit !== false,
+        })
       }
     }, SCHEDULER_INTERVAL_MS)
   }
@@ -170,19 +301,65 @@ export class TaskService {
   }
 
   /**
-   * Returns true when a trigger descriptor matches the given eventstore document.
+   * Returns true when an `on_action` trigger matches the given action id.
    *
-   * Matching rules:
-   *   trigger.aggregateType          — exact match against event.aggregateType
-   *   trigger.event                  — exact match against event.type
-   *   trigger.resource.type          — glob match (supports *) against event.payload.type
-   *   trigger.location.startsWith    — prefix match against event.payload.location
+   * @param {object} trigger
+   * @param {string} actionId
    */
-  static _matchesTrigger(trigger, event) {
-    if (trigger.aggregateType && trigger.aggregateType !== event.aggregateType) return false
-    if (trigger.event && trigger.event !== event.type) return false
-    if (trigger.resource?.type && !matchesGlob(trigger.resource.type, event.payload?.type)) return false
+  static _matchesActionTrigger (trigger, actionId) {
+    const kind = trigger.trigger ?? trigger.on
+    if (kind !== 'on_action') return false
+
+    const pattern = trigger.action
+    if (!pattern) return false
+
+    return matchesGlob(pattern, actionId)
+  }
+
+  /**
+   * Returns true when an event trigger descriptor matches the given eventstore document.
+   *
+   * ADR 0008: `trigger.type` = schemaId, `trigger.event` = lifecycle/custom name.
+   * Skips `on_action` triggers (handled by {@link TaskService.dispatchOnAction}).
+   */
+  static _matchesEventTrigger (trigger, event) {
+    const kind = trigger.trigger ?? trigger.on
+    if (kind === 'on_action') return false
+
+    if (trigger.excludeTypes?.includes(event.type)) return false
+
+    const hasPositiveFilter = Boolean(
+      trigger.type ||
+      trigger.event ||
+      trigger.match ||
+      trigger.resource ||
+      trigger.location,
+    )
+    if (!hasPositiveFilter && trigger.excludeTypes?.length) return true
+
+    if (trigger.type && trigger.type !== event.type) return false
+    if (trigger.event && trigger.event !== event.event) return false
+
+    if (trigger.match) {
+      for (const [path, pattern] of Object.entries(trigger.match)) {
+        const fullPath = path.startsWith('payload.') ? path : `payload.${path}`
+        const parts = fullPath.split('.')
+        let cur = event
+        for (const part of parts) {
+          if (cur == null || typeof cur !== 'object') { cur = undefined; break }
+          cur = cur[part]
+        }
+        if (!matchesGlob(pattern, cur)) return false
+      }
+    }
+
+    if (trigger.resource?.type) {
+      const mime = event.payload?.content?.ContentType ?? event.type
+      if (!matchesGlob(trigger.resource.type, mime)) return false
+    }
+
     if (trigger.location?.startsWith && !event.payload?.location?.startsWith?.(trigger.location.startsWith)) return false
+
     return true
   }