@ossy/platform 3.0.8 → 3.1.0

package/README.md

@@ -53,6 +53,8 @@ The server reads configuration from:
 - `build/manifest.json` — produced by `@ossy/app build`.
 - `process.env` — used by integrations for their credentials and by startup hooks.
 
+Platform integrations are **boot-time and process-global** via `IntegrationService`. Per-workspace credentials are a separate design — see [WORKSPACE-INTEGRATION-SECRETS.md](../../docs/concepts/WORKSPACE-INTEGRATION-SECRETS.md) (SPEC only; not implemented).
+
 Optional environment variables used by the platform itself:
 
 | Variable | Description |
@@ -61,6 +63,16 @@ Optional environment variables used by the platform itself:
 | `API_URL` + `OSSY_API_KEY` | SDK configuration. When set, tasks receive a pre-configured SDK instance. |
 | `PORT` | HTTP port. |
 
+## Health check
+
+Both `startServer` (website / app images) and `startRuntime` (CMS multi-tenant image) expose an unauthenticated liveness probe:
+
+| Method | Path | Response |
+|---|---|---|
+| `GET` / `HEAD` | `/health` | `200` with `{ ok: true, status: "ok", service }` |
+
+The route is mounted before auth and before CMS site loading, so ALB target groups and ECS container health checks can use path `/health` without cookies, API tokens, or a resolvable hostname.
+
 ## Exported API
 
 ```js

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ossy/platform",
-  "version": "3.0.8",
+  "version": "3.1.0",
   "description": "Ossy application server runtime",
   "repository": {
     "type": "git",
@@ -44,17 +44,17 @@
     "@aws-sdk/util-create-request": "^3.972.26",
     "@aws-sdk/util-format-url": "^3.972.17",
     "@modelcontextprotocol/sdk": "^1.12.1",
-    "@ossy/config": "^3.0.8",
-    "@ossy/event-store": "^3.0.8",
-    "@ossy/locale": "^3.0.8",
-    "@ossy/manifest": "^3.0.8",
-    "@ossy/observability": "^3.0.8",
-    "@ossy/policies": "^3.0.8",
-    "@ossy/schema": "^3.0.8",
-    "@ossy/sdk": "^3.0.8",
-    "@ossy/tokens": "^3.0.8",
-    "@ossy/users": "^3.0.8",
-    "@ossy/workspaces": "^3.0.8",
+    "@ossy/config": "^3.0.9",
+    "@ossy/event-store": "^3.0.9",
+    "@ossy/locale": "^3.0.9",
+    "@ossy/manifest": "^3.0.9",
+    "@ossy/observability": "^3.0.9",
+    "@ossy/policies": "^3.0.9",
+    "@ossy/schema": "^3.0.9",
+    "@ossy/sdk": "^3.0.9",
+    "@ossy/tokens": "^3.0.9",
+    "@ossy/users": "^3.0.9",
+    "@ossy/workspaces": "^3.1.0",
     "cookie-parser": "^1.4.7",
     "dotenv": ">=16.0.0 <18.0.0",
     "express": ">=5.0.0 <6.0.0",
@@ -74,5 +74,5 @@
     "src",
     "Dockerfile"
   ],
-  "gitHead": "980b380c9dee0de78ef3ebabe86efcec1c223a9a"
+  "gitHead": "9b146fb6fd9769f800863806c5bd16016508b218"
 }

package/src/Definition.js

@@ -1,7 +1,7 @@
 export const Definition = {
   id: 'platform',
   title: 'Platform',
-  description: 'Deployment platform configuration aligned with deployment-tools S3 platform-config.json.',
+  description: 'Deployment platform configuration aligned with deployment-tools platforms.json / PlatformConfig.',
   icon: 'controller',
   status: ['beta'],
   entitlementRequired: false,

package/src/health.js

@@ -0,0 +1,24 @@
+/**
+ * Stable liveness probe for ALB / ECS health checks.
+ *
+ * Mounted before auth and site loading so probes succeed whenever the
+ * process can accept HTTP traffic. No authentication required.
+ */
+export const HEALTH_PATH = '/health'
+
+/**
+ * @param {import('express').Express} app
+ * @param {{ service?: string }} [options]
+ */
+export function mountHealthEndpoint (app, { service = 'ossy' } = {}) {
+  const handler = (_req, res) => {
+    res.status(200).json({
+      ok: true,
+      status: 'ok',
+      service,
+    })
+  }
+
+  app.get(HEALTH_PATH, handler)
+  app.head(HEALTH_PATH, handler)
+}

package/src/health.spec.js

@@ -0,0 +1,53 @@
+import { describe, expect, it, jest } from '@jest/globals'
+import express from 'express'
+import { HEALTH_PATH, mountHealthEndpoint } from './health.js'
+
+function createMockRes () {
+  const res = {
+    statusCode: 200,
+    body: undefined,
+    status (code) {
+      this.statusCode = code
+      return this
+    },
+    json (body) {
+      this.body = body
+      return this
+    },
+  }
+  return res
+}
+
+describe('mountHealthEndpoint', () => {
+  it('registers GET /health that returns 200 without auth', () => {
+    const app = express()
+    const get = jest.spyOn(app, 'get')
+    const head = jest.spyOn(app, 'head')
+
+    mountHealthEndpoint(app, { service: 'platform-runtime' })
+
+    expect(get).toHaveBeenCalledWith(HEALTH_PATH, expect.any(Function))
+    expect(head).toHaveBeenCalledWith(HEALTH_PATH, expect.any(Function))
+
+    const handler = get.mock.calls[0][1]
+    const res = createMockRes()
+    handler({}, res)
+
+    expect(res.statusCode).toBe(200)
+    expect(res.body).toEqual({
+      ok: true,
+      status: 'ok',
+      service: 'platform-runtime',
+    })
+  })
+
+  it('defaults service name to ossy', () => {
+    const app = express()
+    const get = jest.spyOn(app, 'get')
+    mountHealthEndpoint(app)
+    const handler = get.mock.calls[0][1]
+    const res = createMockRes()
+    handler({}, res)
+    expect(res.body.service).toBe('ossy')
+  })
+})

package/src/platform-config.schema.js

@@ -1,12 +1,10 @@
 /**
- * Matches the shape written to S3 as `platform-config.json` by deployment-tools
- * (`BucketDeployment` → `Source.jsonData('platform-config.json', { ...config, awsRoleToAssume: undefined })`).
+ * Matches the `platforms.json` / PlatformConfig shape used by `@ossy/deployment-tools`.
  *
  * @see ossy/packages/deployment-tools/src/config/platform-config.js (PlatformConfig typedef)
- * @see ossy/packages/deployment-tools/src/infrastructure/container-deployment-target/container-deployment-target.js
  *
- * Note: `awsRoleToAssume` is intentionally omitted from the uploaded file (secret); do not store it here.
- * Optional `sesDomains` / `dnsRecords` are JSON text fields for arrays/objects.
+ * Note: `env` secret values live in `platforms.json` and Secrets Manager; do not store them here.
+ * Optional `domains` / `services` / `sesDomains` / `dnsRecords` / `githubDeployRepos` are JSON text fields.
  */
 export default {
   name: 'Platform config',
@@ -34,29 +32,29 @@ export default {
       type: 'text',
     },
     {
-      name: 'awsKeyPairName',
-      label: 'awsKeyPairName',
-      type: 'text',
+      name: 'domains',
+      label: 'domains (JSON array — Route53 → CloudFront + ACM)',
+      type: 'textarea',
     },
     {
-      name: 'awsStaticBucketName',
-      label: 'awsStaticBucketName',
-      type: 'text',
+      name: 'services',
+      label: 'services (JSON array — HTTP → ECS/ALB; TCP ignored)',
+      type: 'textarea',
     },
     {
-      name: 'awsDeploymentSqsName',
-      label: 'awsDeploymentSqsName',
-      type: 'text',
+      name: 'githubDeployRepos',
+      label: 'githubDeployRepos (JSON array of owner/repo for OIDC)',
+      type: 'textarea',
     },
     {
-      name: 'awsDeploymentSqsArn',
-      label: 'awsDeploymentSqsArn',
-      type: 'text',
+      name: 'sesDomains',
+      label: 'sesDomains (JSON array of strings, optional)',
+      type: 'textarea',
     },
     {
-      name: 'ciGithubActionsRepo',
-      label: 'ciGithubActionsRepo (org/repo)',
-      type: 'text',
+      name: 'dnsRecords',
+      label: 'dnsRecords (JSON object, optional)',
+      type: 'textarea',
     },
     {
       name: 'ciDockerNetworkName',
@@ -64,14 +62,9 @@ export default {
       type: 'text',
     },
     {
-      name: 'sesDomains',
-      label: 'sesDomains (JSON array of strings, optional)',
-      type: 'textarea',
-    },
-    {
-      name: 'dnsRecords',
-      label: 'dnsRecords (JSON object, optional)',
-      type: 'textarea',
+      name: 'awsKeyPairName',
+      label: 'awsKeyPairName (unused after EC2 decommission)',
+      type: 'text',
     },
     {
       name: 'Notes',

package/src/runtime.js

@@ -10,6 +10,7 @@ import { buildManifestSummary } from '@ossy/manifest/build-manifest-summary'
 import { ProxyInternal } from './proxy-internal.js'
 import { loadSite, invalidateSite } from './site-loader.js'
 import { createLogger } from '@ossy/observability'
+import { mountHealthEndpoint } from './health.js'
 
 const log = createLogger('platform')
 
@@ -76,6 +77,8 @@ export async function startRuntime ({ port } = {}) {
   const resolvedPort = port ?? resolvePort()
 
   const app = express()
+  // Liveness for ALB/ECS — before site loading so probes never depend on CMS/domain.
+  mountHealthEndpoint(app, { service: 'platform-runtime' })
   app.use(morgan('tiny'))
   app.use(express.json({ strict: false }))
   app.use(cookieParser(process.env.OSSY_COOKIE_SECRET || 'default_secret'))

package/src/server.js

@@ -27,6 +27,7 @@ import {
   createWorkspaceLoader,
 } from './entitlements/action-entitlement.js'
 import { closePushSseConnections, mountPushSse } from './push/mount-push-sse.js'
+import { mountHealthEndpoint } from './health.js'
 import {
   createSlowRequestLogger,
   createTimedOperation,
@@ -320,6 +321,8 @@ export async function startServer (options = {}) {
   }
 
   const app = express()
+  // Liveness for ALB/ECS — before auth so probes never depend on cookies/Mongo.
+  mountHealthEndpoint(app, { service: 'platform' })
   app.use(morgan('tiny'))
   app.use(express.json({ strict: false }))
   app.use(cookieParser(ConfigService.TokenSecret))