@ossy/platform 1.39.3 → 3.0.2

package/src/resources/schema.validation.js

@@ -1,90 +1,6 @@
-import { Schema } from '@ossy/schema'
-
-/** Field input types accepted in schema definitions (UI + API contract). */
-export const ALLOWED_FIELD_TYPES = new Set([
-  'text',
-  'email',
-  'textarea',
-  'richtext',
-  'number',
-  'select',
-  'multiselect',
-  'file',
-  'image',
-  'boolean',
-  'date',
-  'timestamp',
-  'date-range',
-  'date-ranges',
-  'id',
-  'path',
-])
-
-/**
- * Normalize template field `type` to the canonical editor type.
- * `image` is an alias for `file` with default `accept: 'image/*'` when accept is omitted.
- *
- * @param {string | undefined} type
- * @returns {{ type: string, defaultAccept?: string }}
- */
-export function normalizeFieldType (type) {
-  const raw = typeof type === 'string' ? type.trim() : ''
-  if (raw === 'image') return { type: 'file', defaultAccept: 'image/*' }
-  return { type: raw }
-}
-
-/**
- * @param {{ type?: string, accept?: string, min?: number, max?: number } & Record<string, unknown>} field
- */
-export function resolveFieldDef (field) {
-  const { type: canonical, defaultAccept } = normalizeFieldType(field?.type)
-  return {
-    ...field,
-    type: canonical,
-    accept: field?.accept ?? defaultAccept,
-    max: field?.max ?? 1,
-  }
-}
-
-/**
- * Validates a batch import of workspace schemas.
- *
- * @param {unknown} templates
- * @param {Set<string>} reservedIds - System schema ids that must not be redefined
- * @returns {{ ok: true } | { ok: false, code: string, message: string }}
- */
-export function validateSchemasForImport (templates, reservedIds) {
-  if (!Array.isArray(templates)) {
-    return { ok: false, code: 'INVALID_PAYLOAD', message: 'Body must be a JSON array of schemas' }
-  }
-
-  const engine = Schema.of({ schemas: templates })
-  const seenIds = new Set()
-
-  for (const template of templates) {
-    if (reservedIds?.has(template?.id)) {
-      return {
-        ok: false,
-        code: 'RESERVED_SCHEMA_ID',
-        message: `Template id "${template.id}" is reserved by a system template`,
-      }
-    }
-
-    const result = engine.validate(template)
-    if (!result.ok) {
-      const first = result.errors[0]
-      return { ok: false, code: first.code, message: first.message }
-    }
-
-    if (seenIds.has(template.id)) {
-      return {
-        ok: false,
-        code: 'DUPLICATE_SCHEMA_ID',
-        message: `Duplicate schema id "${template.id}" in import payload`,
-      }
-    }
-    seenIds.add(template.id)
-  }
-
-  return { ok: true }
-}
+export {
+  validateSchemasForImport,
+  ALLOWED_FIELD_TYPES,
+  normalizeFieldType,
+  resolveFieldDef,
+} from '@ossy/schema'

package/src/runtime.js

@@ -4,9 +4,9 @@ import express from 'express'
 import cookieParser from 'cookie-parser'
 import morgan from 'morgan'
 import { Router as OssyRouter } from '@ossy/router'
-import { loadManifest, resolveEntryUrl } from './server.js'
+import { loadManifest, resolveEntryUrl, loadLayoutsById, resolvePageLayoutRender } from './server.js'
 import { resolveRequestLocale } from './locale.js'
-import { buildManifestSummary } from '@ossy/app/manifest/build-manifest-summary'
+import { buildManifestSummary } from '@ossy/manifest/build-manifest-summary'
 import { ProxyInternal } from './proxy-internal.js'
 import { loadSite, invalidateSite } from './site-loader.js'
 import { createLogger } from '@ossy/observability'
@@ -31,7 +31,7 @@ function cloneSerializable (value) {
  */
 const siteContextCache = new Map()
 
-function buildSiteContext (manifest, buildDir) {
+function buildSiteContext (manifest, buildDir, layoutsById) {
   const config = manifest.config
   const supportedLanguages = Array.isArray(config.supportedLanguages) ? config.supportedLanguages : []
 
@@ -50,14 +50,15 @@ function buildSiteContext (manifest, buildDir) {
     return promise
   }
 
-  return { pageRouter, apiRouter, manifest, manifestSummary: buildManifestSummary(manifest), loadEntry, buildDir }
+  return { pageRouter, apiRouter, manifest, manifestSummary: buildManifestSummary(manifest), loadEntry, buildDir, layoutsById }
 }
 
 async function getSiteContext (domain) {
   if (siteContextCache.has(domain)) return siteContextCache.get(domain)
   const buildDir = await loadSite(domain)
   const manifest = loadManifest(buildDir)
-  const context = buildSiteContext(manifest, buildDir)
+  const layoutsById = await loadLayoutsById(manifest.layouts, buildDir, log)
+  const context = buildSiteContext(manifest, buildDir, layoutsById)
   siteContextCache.set(domain, context)
   return context
 }
@@ -129,7 +130,7 @@ export async function startRuntime ({ port } = {}) {
       return
     }
 
-    const { pageRouter, apiRouter, manifest, manifestSummary, loadEntry, buildDir } = context
+    const { pageRouter, apiRouter, manifest, manifestSummary, loadEntry, buildDir, layoutsById } = context
 
     try {
       const apiRoute = apiRouter.getPageByUrl(requestUrl)
@@ -169,6 +170,11 @@ export async function startRuntime ({ port } = {}) {
 
       const config = manifest.config
       const { language, messages, fallbackMessages } = resolveRequestLocale(pageRouter, requestUrl, buildDir, config)
+      const {
+        Layout,
+        layoutEntry,
+        layoutSlots,
+      } = resolvePageLayoutRender(layoutsById, pageEntry)
       const props = {
         ...config,
         ...(req.userAppSettings || {}),
@@ -190,6 +196,11 @@ export async function startRuntime ({ port } = {}) {
           ...(page.package ? { package: page.package } : {}),
         })),
         pageId: pageRoute.id,
+        componentEntries: manifest.components,
+        resolveComponentEntry: (entry) => resolveEntryUrl(entry, buildDir),
+        layoutSlots,
+        Layout,
+        layoutEntry,
       }
       const html = await mod.render(props)
       res.status(200).type('html').send(html)

package/src/select-workspace.api.js

@@ -0,0 +1,50 @@
+import {
+  ActionService,
+  mergeUserAppSettingsCookie,
+} from '@ossy/platform'
+
+export const metadata = {
+  id: 'users.select-workspace',
+  path: '/api/v0/users/select-workspace',
+  method: 'GET',
+  query: ['workspaceId', 'redirect'],
+}
+
+export default async function handle (req, res) {
+  if (req.method !== 'GET') {
+    res.setHeader('Allow', 'GET')
+    res.status(405).json({ error: 'Method Not Allowed' })
+    return
+  }
+
+  if (!req.userId || req.userId === 'anonymous') {
+    res.status(401).json({ error: 'Unauthorized' })
+    return
+  }
+
+  const workspaceId = req.query.workspaceId
+  if (!workspaceId || typeof workspaceId !== 'string') {
+    res.status(400).json({ message: 'No workspaceId provided' })
+    return
+  }
+
+  try {
+    const workspaces = await ActionService.invoke('@ossy/workspaces/actions/list', { req })
+    if (!workspaces.some((w) => w.id === workspaceId)) {
+      res.status(403).json({ message: 'Forbidden' })
+      return
+    }
+
+    mergeUserAppSettingsCookie(req, res, { workspaceId })
+
+    const redirect = req.query.redirect
+    if (redirect && typeof redirect === 'string') {
+      res.redirect(302, redirect)
+      return
+    }
+
+    res.status(200).json('')
+  } catch (err) {
+    res.status(err.status || 500).json({ message: err.message || 'Internal Server Error' })
+  }
+}

package/src/server.js

@@ -7,10 +7,10 @@ import { Router as OssyRouter } from '@ossy/router'
 import cookieParser from 'cookie-parser'
 import { ProxyInternal } from './proxy-internal.js'
 import { SDK, resolveActionId } from '@ossy/sdk'
-import { AggregateRebuild, resolveMongoUrl } from '@ossy/event-store'
+import { AggregateRebuild, ensureEventStoreIndexes, Mongo, resolveMongoUrl } from '@ossy/event-store'
 import { TaskService } from './tasks/task-service.js'
 import { ChangeStream } from './tasks/change-stream.js'
-import { buildManifestSummary } from '@ossy/app/manifest/build-manifest-summary'
+import { buildManifestSummary } from '@ossy/manifest/build-manifest-summary'
 import { registerSchema } from './resources/schema.registry.js'
 import { initPlatformSchema } from './resources/schema.service.js'
 import { IntegrationService } from './integration.service.js'
@@ -26,13 +26,23 @@ import {
   buildActionEntitlementIndex,
   createWorkspaceLoader,
 } from './entitlements/action-entitlement.js'
-import { mountPushSse } from './push/mount-push-sse.js'
+import { closePushSseConnections, mountPushSse } from './push/mount-push-sse.js'
+import {
+  createSlowRequestLogger,
+  createTimedOperation,
+  OperationTimeoutError,
+  resolveTimeoutMs,
+  withTimeout,
+} from './request-diagnostics.js'
 import { mergeWorkspaceSchemas } from '@ossy/workspaces/merge-workspace-schemas'
 import {
   buildEnableablePackageSet,
   setEnableablePackages,
 } from '@ossy/workspaces/entitlements'
 const log = createLogger('@ossy/platform')
+const MONGO_TIMEOUT_MS = resolveTimeoutMs('OSSY_MONGO_TIMEOUT_MS', 10_000)
+const SSR_RENDER_TIMEOUT_MS = resolveTimeoutMs('OSSY_SSR_RENDER_TIMEOUT_MS', 30_000)
+const ACTION_TIMEOUT_MS = resolveTimeoutMs('OSSY_ACTION_TIMEOUT_MS', 60_000)
 
 const DEFAULT_PORT = 3000
 const MANIFEST_FILE = 'manifest.json'
@@ -77,7 +87,8 @@ export function loadManifest (buildDir) {
   const actions = Array.isArray(manifest.actions) ? manifest.actions : []
   const emails = Array.isArray(manifest.emails) ? manifest.emails : []
   const layouts = Array.isArray(manifest.layouts) ? manifest.layouts : []
-  for (const e of entries) {    if ((e.type === 'page' || e.type === 'api') && !validRoutable(e)) {
+  for (const e of entries) {
+    if ((e.type === 'page' || e.type === 'api') && !validRoutable(e)) {
       log.warn(`Skipping ${e.type} "${e.id}" — manifest entry has no path.`)
     }
   }
@@ -117,6 +128,49 @@ function cloneSerializable (value) {
   return value == null ? value : JSON.parse(JSON.stringify(value))
 }
 
+/**
+ * Load all registered layout bundles keyed by canonical layout id.
+ *
+ * @param {Array<{ id: string, entry: string }>} layoutManifest
+ * @param {string} buildDir
+ * @param {import('@ossy/observability').Logger} log
+ */
+async function loadLayoutsById (layoutManifest, buildDir, log) {
+  /** @type {Map<string, { component: import('react').ComponentType, entry: string }>} */
+  const layoutsById = new Map()
+  for (const layoutEntry of layoutManifest ?? []) {
+    if (!layoutEntry?.id || !layoutEntry?.entry) continue
+    try {
+      const mod = await import(/* @vite-ignore */ resolveEntryUrl(layoutEntry.entry, buildDir))
+      if (typeof mod.default === 'function') {
+        layoutsById.set(layoutEntry.id, { component: mod.default, entry: layoutEntry.entry })
+      }
+    } catch (err) {
+      log.warn(`Failed to load layout "${layoutEntry.id}"`, undefined, err)
+    }
+  }
+  return layoutsById
+}
+
+/**
+ * @param {Map<string, { component: import('react').ComponentType, entry: string }>} layoutsById
+ * @param {{ layout?: string, slots?: Record<string, string | null> }} pageEntry
+ */
+function resolvePageLayoutRender (layoutsById, pageEntry) {
+  const layoutId = pageEntry?.layout ?? '@ossy/app/layout/default'
+  const layoutRecord = layoutsById.get(layoutId) ?? layoutsById.get('@ossy/app/layout/default') ?? null
+  const layoutSlots =
+    pageEntry?.slots && typeof pageEntry.slots === 'object' && !Array.isArray(pageEntry.slots)
+      ? pageEntry.slots
+      : {}
+  return {
+    Layout: layoutRecord?.component ?? null,
+    layoutEntry: layoutRecord?.entry ?? null,
+    layoutSlots,
+    layoutId,
+  }
+}
+
 export async function startServer (options = {}) {
   const cwd = options.cwd ? path.resolve(options.cwd) : process.cwd()
   const buildDir = path.resolve(cwd, options.buildDir || 'build')
@@ -169,6 +223,8 @@ export async function startServer (options = {}) {
 
   // Aggregate registration — mirrors task and schema registration above.
   // AggregateRebuild is provided by @ossy/event-store.
+  /** @type {(() => void) | null} */
+  let runStartupRebuild = null
   if (AggregateRebuild) {
     for (const agg of manifest.aggregates ?? []) {
       try {
@@ -179,9 +235,13 @@ export async function startServer (options = {}) {
       }
     }
 
-    AggregateRebuild.BuildAndSaveAll().catch((error) => {
-      log.error('BuildAndSaveAll failed — is MongoDB reachable?', undefined, error)
-    })
+    // Defer full startup rebuild until the server is listening so request handling
+    // is not starved while snapshots catch up (332k+ streams on large local DBs).
+    runStartupRebuild = () => {
+      AggregateRebuild.BuildAndSaveAll().catch((error) => {
+        log.error('BuildAndSaveAll failed — is MongoDB reachable?', undefined, error)
+      })
+    }
   }
 
   for (const startup of manifest.startups ?? []) {
@@ -206,34 +266,9 @@ export async function startServer (options = {}) {
     }
   }
 
-  // Layout loading — one `*.layout.jsx` per app wraps every page render. The
-  // layout component decides route-specific chrome (auth, public flows, etc.).
-  /** @type {{ component: import('react').ComponentType, entry: string } | null} */
-  let appLayout = null
+  // Layout loading — registered layouts keyed by id; each page picks layout + merged slots at build time.
   const layoutManifest = manifest.layouts ?? []
-  if (layoutManifest.length > 1) {
-    log.warn(
-      `Multiple layouts in manifest (${layoutManifest.length}); only the first is used. Use one *.layout.jsx per app.`,
-    )
-  }
-  const layoutEntry = layoutManifest[0]
-  if (layoutEntry) {
-    try {
-      const mod = await import(/* @vite-ignore */ resolveEntryUrl(layoutEntry.entry, buildDir))
-      if (typeof mod.default === 'function') {
-        appLayout = { component: mod.default, entry: layoutEntry.entry }
-      }
-    } catch (err) {
-      log.warn(`Failed to load layout "${layoutEntry.id}"`, undefined, err)
-    }
-  }
-
-  // App-controlled shell slots: `export const slots` in `*.layout.jsx` is recorded
-  // on `manifest.layouts[0].slots` at build time and resolved at render in page-runtime.
-  const layoutSlots =
-    layoutEntry && typeof layoutEntry.slots === 'object' && !Array.isArray(layoutEntry.slots)
-      ? layoutEntry.slots
-      : {}
+  const layoutsById = await loadLayoutsById(layoutManifest, buildDir, log)
 
   // Register the SDK so all tasks receive it as `sdk`.
   // Priority: explicit options.sdk → SDK.of() from env vars → null (direct-DB fallback in tasks).
@@ -245,6 +280,9 @@ export async function startServer (options = {}) {
   TaskService.startScheduler()
 
   if (process.env.DB_URL) {
+    await ensureEventStoreIndexes().catch((err) => {
+      log.error('Failed to ensure MongoDB indexes — aggregate reads may be very slow', undefined, err)
+    })
     ChangeStream.start(resolveMongoUrl(process.env.DB_URL))
   }
 
@@ -267,7 +305,12 @@ export async function startServer (options = {}) {
   let loadWorkspaceForEntitlements = null
   try {
     const { Workspace } = await import('@ossy/workspaces/server')
-    loadWorkspaceForEntitlements = createWorkspaceLoader(Workspace)
+    const loadWorkspace = createWorkspaceLoader(Workspace)
+    loadWorkspaceForEntitlements = (workspaceId) => withTimeout(
+      loadWorkspace(workspaceId),
+      MONGO_TIMEOUT_MS,
+      `loadWorkspace(${workspaceId})`,
+    )
   } catch (err) {
     log.warn('[@ossy/platform] Workspace aggregate unavailable — action entitlements disabled', err)
   }
@@ -288,6 +331,7 @@ export async function startServer (options = {}) {
   })
   app.use(UsersMiddleware.AuthenticateUser)
   app.use(WorkspacesMiddleware.ExtractWorkspaceId())
+  app.use(createSlowRequestLogger(log))
   if (fs.existsSync(publicDir)) app.use(express.static(publicDir))
   app.use(ProxyInternal())
 
@@ -343,16 +387,33 @@ export async function startServer (options = {}) {
     }
 
     const actionLog = createLogger(actionId)
+    const actionTimer = createTimedOperation(`POST /actions ${actionId}`, { log: actionLog })
+    const actionAbort = new AbortController()
     try {
-      const result = await ActionService.invoke(actionId, {
-        payload,
-        sdk: req.sdk ?? null,
-        log: actionLog,
-        integrations: IntegrationService,
-        req,
-      })
+      const result = await withTimeout(
+        ActionService.invoke(actionId, {
+          payload,
+          sdk: req.sdk ?? null,
+          log: actionLog,
+          integrations: IntegrationService,
+          req,
+          signal: actionAbort.signal,
+        }),
+        ACTION_TIMEOUT_MS,
+        `POST /actions ${actionId}`,
+        { abortController: actionAbort },
+      )
+      actionTimer.finish({ statusCode: 200 })
       res.json(result ?? { ok: true })
     } catch (err) {
+      actionTimer.finish({
+        statusCode: err instanceof OperationTimeoutError ? 504 : (err?.status ?? 500),
+        timedOut: err instanceof OperationTimeoutError,
+      })
+      if (err instanceof OperationTimeoutError) {
+        actionLog.error('Action timed out', { id: actionId, timeoutMs: err.timeoutMs })
+        return res.status(504).json({ error: 'Action timed out', code: 'ACTION_TIMEOUT' })
+      }
       actionLog.error('Action failed', { id: actionId }, err)
       const status = err?.status ?? 500
       res.status(status).json({ error: err?.message ?? 'Internal error' })
@@ -368,6 +429,7 @@ export async function startServer (options = {}) {
 
   app.all('*all', async (req, res) => {
     const requestUrl = req.originalUrl || '/'
+    const pageTimer = createTimedOperation(`page ${req.method} ${requestUrl}`, { log })
     try {
       const apiRoute = apiRouter.getPageByUrl(requestUrl)
       if (apiRoute) {
@@ -393,18 +455,25 @@ export async function startServer (options = {}) {
           res.status(404).send('Not found')
           return
         }
+        const loadEntryTimer = createTimedOperation(`SSR loadEntry ${pageRoute.id}`, { log })
         const mod = await loadEntry(pageEntry.entry)
+        loadEntryTimer.finish()
         if (typeof mod.render !== 'function') {
           res.status(503).type('text').send('SSR runtime unavailable')
           return
         }
-        const Layout = appLayout?.component ?? null
-        const layoutEntry = appLayout?.entry ?? null
+        const {
+          Layout,
+          layoutEntry,
+          layoutSlots,
+        } = resolvePageLayoutRender(layoutsById, pageEntry)
         const { language, messages, fallbackMessages } = resolveRequestLocale(pageRouter, requestUrl, buildDir, config)
         let schemasForPage = cloneSerializable(manifest.schemas || [])
         if (req.workspaceId && loadWorkspaceForEntitlements) {
+          const workspaceTimer = createTimedOperation(`SSR loadWorkspace ${req.workspaceId}`, { log })
           try {
             const workspace = await loadWorkspaceForEntitlements(req.workspaceId)
+            workspaceTimer.finish({ pageId: pageRoute.id })
             if (workspace?.schemas?.length) {
               schemasForPage = mergeWorkspaceSchemas(
                 schemasForPage,
@@ -412,7 +481,20 @@ export async function startServer (options = {}) {
               )
             }
           } catch (err) {
-            log.warn('[@ossy/platform] Failed to merge workspace schemas for SSR', err)
+            workspaceTimer.finish({
+              pageId: pageRoute.id,
+              error: err?.message ?? String(err),
+              timedOut: err instanceof OperationTimeoutError,
+            })
+            if (err instanceof OperationTimeoutError) {
+              log.warn('[@ossy/platform] SSR workspace schema merge timed out — using manifest schemas only', {
+                workspaceId: req.workspaceId,
+                pageId: pageRoute.id,
+                timeoutMs: err.timeoutMs,
+              })
+            } else {
+              log.warn('[@ossy/platform] Failed to merge workspace schemas for SSR', err)
+            }
           }
         }
         // Page component → `app:content` is resolved in page-runtime (SSR + hydrate).
@@ -439,17 +521,44 @@ export async function startServer (options = {}) {
           })),
           pageId: pageRoute.id,
           componentEntries: manifest.components,
+          resolveComponentEntry: (entry) => resolveEntryUrl(entry, buildDir),
           layoutSlots,
           Layout,
           layoutEntry,
         }
-        const html = await mod.render(props)
+        const renderTimer = createTimedOperation(`SSR render ${pageRoute.id}`, { log })
+        let html
+        try {
+          html = await withTimeout(
+            mod.render(props),
+            SSR_RENDER_TIMEOUT_MS,
+            `SSR render(${pageRoute.id})`,
+          )
+        } catch (err) {
+          renderTimer.finish({ timedOut: err instanceof OperationTimeoutError })
+          if (err instanceof OperationTimeoutError) {
+            log.error('[@ossy/platform] SSR render timed out', {
+              pageId: pageRoute.id,
+              url: requestUrl,
+              timeoutMs: err.timeoutMs,
+            })
+            if (!res.headersSent) {
+              res.status(504).type('text').send('Page render timed out')
+            }
+            return
+          }
+          throw err
+        }
+        renderTimer.finish()
+        pageTimer.finish({ pageId: pageRoute.id, statusCode: 200 })
         res.status(200).type('html').send(html)
         return
       }
 
+      pageTimer.finish({ statusCode: 404 })
       res.status(404).send('Not found')
     } catch (err) {
+      pageTimer.finish({ error: err?.message ?? String(err) })
       log.error('Request handling failed', undefined, err)
       if (!res.headersSent) {
         res.status(500).type('text').send('Internal Server Error')
@@ -466,7 +575,12 @@ export async function startServer (options = {}) {
   log.info(`Running on http://localhost:${port}`)
   log.info('Press Ctrl+C to stop.')
 
-  const closeServer = () => new Promise((resolve) => server.close(() => resolve()))
+  runStartupRebuild?.()
+
+  const closeServer = () => new Promise((resolve) => {
+    server.closeAllConnections?.()
+    server.close(() => resolve())
+  })
 
   let shuttingDown = false
   const handleShutdown = async (signal) => {
@@ -474,6 +588,10 @@ export async function startServer (options = {}) {
     shuttingDown = true
     log.info(`Received ${signal}, shutting down...`)
     try {
+      TaskService.stop()
+      closePushSseConnections()
+      await ChangeStream.stop()
+      await Mongo.closeConnection()
       await closeServer()
     } finally {
       process.exit(0)
@@ -488,6 +606,7 @@ export async function startServer (options = {}) {
 }
 
 export default startServer
+export { loadLayoutsById, resolvePageLayoutRender }
 export { ConfigService } from './config.service.js'
 export { ActionService } from './actions/action.service.js'
 export { IntegrationService } from './integration.service.js'
@@ -496,7 +615,6 @@ export { originalObjectKey, derivativeObjectKey, assertStorageKey } from './stor
 export { S3Client } from './storage/s3.client.js'
 export { LocalStorageClient } from './storage/local-storage.client.js'
 export { getSystemSchemas } from './resources/schema.registry.js'
-export { PlatformSchema } from './schema-ids.js'
 export { getPlatformSchema, initPlatformSchema, createSchemaEngine, schemaForWorkspace } from './resources/schema.service.js'
 export { validateSchemasForImport } from './resources/schema.validation.js'
 export {