@ossy/platform 3.0.5 → 3.0.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ossy/platform",
-  "version": "3.0.5",
+  "version": "3.0.7",
   "description": "Ossy application server runtime",
   "repository": {
     "type": "git",
@@ -44,17 +44,17 @@
     "@aws-sdk/util-create-request": "^3.972.26",
     "@aws-sdk/util-format-url": "^3.972.17",
     "@modelcontextprotocol/sdk": "^1.12.1",
-    "@ossy/config": "^3.0.5",
-    "@ossy/event-store": "^3.0.5",
-    "@ossy/locale": "^3.0.5",
-    "@ossy/manifest": "^3.0.5",
-    "@ossy/observability": "^3.0.5",
-    "@ossy/policies": "^3.0.5",
-    "@ossy/schema": "^3.0.5",
-    "@ossy/sdk": "^3.0.5",
-    "@ossy/tokens": "^3.0.5",
-    "@ossy/users": "^3.0.5",
-    "@ossy/workspaces": "^3.0.5",
+    "@ossy/config": "^3.0.7",
+    "@ossy/event-store": "^3.0.7",
+    "@ossy/locale": "^3.0.7",
+    "@ossy/manifest": "^3.0.7",
+    "@ossy/observability": "^3.0.7",
+    "@ossy/policies": "^3.0.7",
+    "@ossy/schema": "^3.0.7",
+    "@ossy/sdk": "^3.0.7",
+    "@ossy/tokens": "^3.0.7",
+    "@ossy/users": "^3.0.7",
+    "@ossy/workspaces": "^3.0.7",
     "cookie-parser": "^1.4.7",
     "dotenv": ">=16.0.0 <18.0.0",
     "express": ">=5.0.0 <6.0.0",
@@ -74,5 +74,5 @@
     "src",
     "Dockerfile"
   ],
-  "gitHead": "e12eb33b42db8ba8a7e1a34f6b0fe30b6879f91b"
+  "gitHead": "5010f51795d5b8f4c63ef52495f4b2935b801b3f"
 }

package/src/runtime.js

@@ -86,7 +86,8 @@ export async function startRuntime ({ port } = {}) {
     if (userSettings.workspaceId && !req.get('workspaceId')) {
       req.headers.workspaceid = userSettings.workspaceId
     }
-    req.isAuthenticated = req.headers.cookie ? req.headers.cookie.includes('auth=') : false
+    // Prefer a verified signed auth cookie; fall back to presence only when unsigned.
+    req.isAuthenticated = !!(req.signedCookies?.auth)
     next()
   })
 

package/src/server.js

@@ -39,6 +39,10 @@ import {
   buildEnableablePackageSet,
   setEnableablePackages,
 } from '@ossy/workspaces/entitlements'
+import {
+  clearAuthCookie,
+  clearWorkspaceFromUserAppSettings,
+} from './user-app-settings.js'
 const log = createLogger('@ossy/platform')
 const MONGO_TIMEOUT_MS = resolveTimeoutMs('OSSY_MONGO_TIMEOUT_MS', 10_000)
 const SSR_RENDER_TIMEOUT_MS = resolveTimeoutMs('OSSY_SSR_RENDER_TIMEOUT_MS', 30_000)
@@ -325,11 +329,15 @@ export async function startServer (options = {}) {
     if (userSettings.workspaceId && !req.get('workspaceId')) {
       req.headers.workspaceid = userSettings.workspaceId
     }
-    const cookieHeader = req.headers.cookie
-    req.isAuthenticated = cookieHeader ? cookieHeader.includes('auth=') : false
     next()
   })
   app.use(UsersMiddleware.AuthenticateUser)
+  app.use((req, _res, next) => {
+    // After auth resolution — not raw Cookie header (stale/invalid `auth=` looked "logged in").
+    const anon = ConfigService.AnonymousUserId
+    req.isAuthenticated = !!(req.userId && req.userId !== anon && req.userId !== 'anonymous')
+    next()
+  })
   app.use(WorkspacesMiddleware.ExtractWorkspaceId())
   app.use(createSlowRequestLogger(log))
   if (fs.existsSync(publicDir)) app.use(express.static(publicDir))
@@ -404,8 +412,17 @@ export async function startServer (options = {}) {
         { abortController: actionAbort },
       )
       actionTimer.finish({ statusCode: 200 })
+      if (actionId === '@ossy/authentication/actions/sign-out') {
+        clearAuthCookie(res)
+        clearWorkspaceFromUserAppSettings(req, res)
+      }
       res.json(result ?? { ok: true })
     } catch (err) {
+      // Still clear auth on sign-out failures so a broken session can recover.
+      if (actionId === '@ossy/authentication/actions/sign-out') {
+        clearAuthCookie(res)
+        clearWorkspaceFromUserAppSettings(req, res)
+      }
       actionTimer.finish({
         statusCode: err instanceof OperationTimeoutError ? 504 : (err?.status ?? 500),
         timedOut: err instanceof OperationTimeoutError,

package/src/user-app-settings.js

@@ -13,6 +13,7 @@ export function mergeUserAppSettingsCookie (req, res, partial) {
   res.cookie(USER_SETTINGS_COOKIE, JSON.stringify(updated), {
     httpOnly: true,
     signed: true,
+    path: '/',
     expires: new Date(Date.now() + USER_SETTINGS_MAX_AGE_MS),
   })
 }
@@ -21,12 +22,13 @@ export function clearWorkspaceFromUserAppSettings (req, res) {
   const settings = readUserAppSettings(req)
   delete settings.workspaceId
   if (Object.keys(settings).length === 0) {
-    res.clearCookie(USER_SETTINGS_COOKIE)
+    res.clearCookie(USER_SETTINGS_COOKIE, { httpOnly: true, signed: true, path: '/' })
     return
   }
   res.cookie(USER_SETTINGS_COOKIE, JSON.stringify(settings), {
     httpOnly: true,
     signed: true,
+    path: '/',
     expires: new Date(Date.now() + USER_SETTINGS_MAX_AGE_MS),
   })
 }
@@ -35,10 +37,20 @@ export function setAuthCookie (res, token) {
   res.cookie(AUTH_COOKIE, token, {
     httpOnly: true,
     signed: true,
+    path: '/',
     expires: new Date(Date.now() + AUTH_MAX_AGE_MS),
   })
 }
 
 export function clearAuthCookie (res) {
-  res.clearCookie(AUTH_COOKIE)
+  // Options must match setAuthCookie or browsers keep the cookie.
+  const clearOpts = { httpOnly: true, path: '/' }
+  res.clearCookie(AUTH_COOKIE, clearOpts)
+  res.clearCookie(AUTH_COOKIE, { ...clearOpts, signed: true })
+  // Force-overwrite in case clearCookie options don't match an older cookie.
+  res.cookie(AUTH_COOKIE, '', {
+    ...clearOpts,
+    signed: true,
+    expires: new Date(0),
+  })
 }