@ossy/platform 3.0.9 → 3.2.0

package/README.md

@@ -53,6 +53,8 @@ The server reads configuration from:
 - `build/manifest.json` — produced by `@ossy/app build`.
 - `process.env` — used by integrations for their credentials and by startup hooks.
 
+Platform integrations are **boot-time and process-global** via `IntegrationService`. Per-workspace credentials are a separate design — see [WORKSPACE-INTEGRATION-SECRETS.md](../../docs/concepts/WORKSPACE-INTEGRATION-SECRETS.md) (SPEC only; not implemented).
+
 Optional environment variables used by the platform itself:
 
 | Variable | Description |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ossy/platform",
-  "version": "3.0.9",
+  "version": "3.2.0",
   "description": "Ossy application server runtime",
   "repository": {
     "type": "git",
@@ -45,16 +45,16 @@
     "@aws-sdk/util-format-url": "^3.972.17",
     "@modelcontextprotocol/sdk": "^1.12.1",
     "@ossy/config": "^3.0.9",
-    "@ossy/event-store": "^3.0.9",
+    "@ossy/event-store": "^3.2.0",
     "@ossy/locale": "^3.0.9",
     "@ossy/manifest": "^3.0.9",
     "@ossy/observability": "^3.0.9",
     "@ossy/policies": "^3.0.9",
     "@ossy/schema": "^3.0.9",
-    "@ossy/sdk": "^3.0.9",
+    "@ossy/sdk": "^3.2.0",
     "@ossy/tokens": "^3.0.9",
-    "@ossy/users": "^3.0.9",
-    "@ossy/workspaces": "^3.0.9",
+    "@ossy/users": "^3.2.0",
+    "@ossy/workspaces": "^3.2.0",
     "cookie-parser": "^1.4.7",
     "dotenv": ">=16.0.0 <18.0.0",
     "express": ">=5.0.0 <6.0.0",
@@ -74,5 +74,5 @@
     "src",
     "Dockerfile"
   ],
-  "gitHead": "908fae28675f6c3c179d4c2eecb451e8a1af886e"
+  "gitHead": "b045f1fd7f2fe00c776b9ea96f76083b93fd8556"
 }

package/src/Definition.js

@@ -1,7 +1,7 @@
 export const Definition = {
   id: 'platform',
   title: 'Platform',
-  description: 'Deployment platform configuration aligned with deployment-tools S3 platform-config.json.',
+  description: 'Deployment platform configuration aligned with deployment-tools platforms.json / PlatformConfig.',
   icon: 'controller',
   status: ['beta'],
   entitlementRequired: false,

package/src/platform-config.schema.js

@@ -1,12 +1,10 @@
 /**
- * Matches the shape written to S3 as `platform-config.json` by deployment-tools
- * (`BucketDeployment` → `Source.jsonData('platform-config.json', { ...config, awsRoleToAssume: undefined })`).
+ * Matches the `platforms.json` / PlatformConfig shape used by `@ossy/deployment-tools`.
  *
  * @see ossy/packages/deployment-tools/src/config/platform-config.js (PlatformConfig typedef)
- * @see ossy/packages/deployment-tools/src/infrastructure/container-deployment-target/container-deployment-target.js
  *
- * Note: `awsRoleToAssume` is intentionally omitted from the uploaded file (secret); do not store it here.
- * Optional `sesDomains` / `dnsRecords` are JSON text fields for arrays/objects.
+ * Note: `env` secret values live in `platforms.json` and Secrets Manager; do not store them here.
+ * Optional `domains` / `services` / `sesDomains` / `dnsRecords` / `githubDeployRepos` are JSON text fields.
  */
 export default {
   name: 'Platform config',
@@ -34,29 +32,29 @@ export default {
       type: 'text',
     },
     {
-      name: 'awsKeyPairName',
-      label: 'awsKeyPairName',
-      type: 'text',
+      name: 'domains',
+      label: 'domains (JSON array — Route53 → CloudFront + ACM)',
+      type: 'textarea',
     },
     {
-      name: 'awsStaticBucketName',
-      label: 'awsStaticBucketName',
-      type: 'text',
+      name: 'services',
+      label: 'services (JSON array — HTTP → ECS/ALB; TCP ignored)',
+      type: 'textarea',
     },
     {
-      name: 'awsDeploymentSqsName',
-      label: 'awsDeploymentSqsName',
-      type: 'text',
+      name: 'githubDeployRepos',
+      label: 'githubDeployRepos (JSON array of owner/repo for OIDC)',
+      type: 'textarea',
     },
     {
-      name: 'awsDeploymentSqsArn',
-      label: 'awsDeploymentSqsArn',
-      type: 'text',
+      name: 'sesDomains',
+      label: 'sesDomains (JSON array of strings, optional)',
+      type: 'textarea',
     },
     {
-      name: 'ciGithubActionsRepo',
-      label: 'ciGithubActionsRepo (org/repo)',
-      type: 'text',
+      name: 'dnsRecords',
+      label: 'dnsRecords (JSON object, optional)',
+      type: 'textarea',
     },
     {
       name: 'ciDockerNetworkName',
@@ -64,14 +62,9 @@ export default {
       type: 'text',
     },
     {
-      name: 'sesDomains',
-      label: 'sesDomains (JSON array of strings, optional)',
-      type: 'textarea',
-    },
-    {
-      name: 'dnsRecords',
-      label: 'dnsRecords (JSON object, optional)',
-      type: 'textarea',
+      name: 'awsKeyPairName',
+      label: 'awsKeyPairName (unused after EC2 decommission)',
+      type: 'text',
     },
     {
       name: 'Notes',

package/src/tasks/task-service.js

@@ -99,10 +99,19 @@ export class TaskService {
 
     const audit = context.audit !== false && task.metadata.audit !== false
 
+    // GET/API handlers often omit integrations; default like dispatch/scheduler so
+    // tasks can always use integrations.get('email') (including local delivery).
+    const invokeContext = {
+      ...context,
+      sdk: context.sdk ?? TaskService._sdk,
+      integrations: context.integrations ?? IntegrationService,
+      log: context.log ?? createLogger(id),
+    }
+
     return TaskRunService.execute({
       taskId: id,
       handler: task.handler,
-      context,
+      context: invokeContext,
       trigger: 'invoke',
       triggeredBy: {
         channel: context.req ? undefined : 'api',

package/src/test/flow-context.js

@@ -0,0 +1,44 @@
+/**
+ * Flow-run context helpers — `$email`-style placeholders for declarative steps.
+ */
+
+/**
+ * Escape a value for use inside a double-quoted CSS attribute selector.
+ * @param {unknown} value
+ * @returns {string}
+ */
+export function escapeCssAttrValue (value) {
+  return String(value).replace(/\\/g, '\\\\').replace(/"/g, '\\"')
+}
+
+/**
+ * Resolve a whole-string `$token` placeholder from the run context.
+ * Non-strings and strings that do not start with `$` are returned as-is.
+ *
+ * @param {unknown} value
+ * @param {{ fields?: Record<string, unknown>, [key: string]: unknown }} context
+ */
+export function resolveContextValue (value, context) {
+  if (typeof value !== 'string' || !value.startsWith('$')) return value
+  const key = value.slice(1)
+  return context[key] ?? context.fields?.[key]
+}
+
+/**
+ * Replace `$token` placeholders embedded in a string (e.g. selectors).
+ * Unknown tokens are left unchanged.
+ *
+ * @param {unknown} template
+ * @param {{ fields?: Record<string, unknown>, [key: string]: unknown }} context
+ * @param {{ escape?: (value: unknown) => string }} [options]
+ * @returns {unknown}
+ */
+export function interpolateContextString (template, context, options = {}) {
+  if (typeof template !== 'string' || !template.includes('$')) return template
+  const escape = typeof options.escape === 'function' ? options.escape : (value) => String(value)
+  return template.replace(/\$([A-Za-z_][A-Za-z0-9_]*)/g, (match, key) => {
+    const value = context[key] ?? context.fields?.[key]
+    if (value == null) return match
+    return escape(value)
+  })
+}

package/src/test/flow-context.spec.js

@@ -0,0 +1,44 @@
+import { describe, expect, it } from '@jest/globals'
+import {
+  escapeCssAttrValue,
+  interpolateContextString,
+  resolveContextValue,
+} from './flow-context.js'
+
+describe('flow-context', () => {
+  const context = {
+    email: 'new@example.com',
+    fields: { firstName: 'Ada', email: 'field@example.com' },
+  }
+
+  it('resolves whole-string $placeholders from context then fields', () => {
+    expect(resolveContextValue('$email', context)).toBe('new@example.com')
+    expect(resolveContextValue('$firstName', context)).toBe('Ada')
+    expect(resolveContextValue('literal', context)).toBe('literal')
+    expect(resolveContextValue('$missing', context)).toBeUndefined()
+  })
+
+  it('interpolates embedded $placeholders in selectors', () => {
+    expect(
+      interpolateContextString('[data-user-email="$email"]', context),
+    ).toBe('[data-user-email="new@example.com"]')
+  })
+
+  it('escapes quotes and backslashes when an escape fn is provided', () => {
+    const tricky = {
+      email: 'a"b\\c@example.com',
+      fields: {},
+    }
+    expect(
+      interpolateContextString('[data-user-email="$email"]', tricky, {
+        escape: escapeCssAttrValue,
+      }),
+    ).toBe('[data-user-email="a\\"b\\\\c@example.com"]')
+  })
+
+  it('leaves unknown embedded tokens unchanged', () => {
+    expect(
+      interpolateContextString('[data-x="$missing"]', context),
+    ).toBe('[data-x="$missing"]')
+  })
+})

package/src/test/flow-runner.js

@@ -14,6 +14,17 @@ import { faker } from '@faker-js/faker'
 import { Router } from '@ossy/router'
 import { Schema } from '@ossy/schema'
 import { test, expect } from '@playwright/test'
+import {
+  escapeCssAttrValue,
+  interpolateContextString,
+  resolveContextValue,
+} from './flow-context.js'
+
+export {
+  escapeCssAttrValue,
+  interpolateContextString,
+  resolveContextValue,
+} from './flow-context.js'
 
 const FLOW_PATTERN = /\.flow\.(mjs|cjs|js)$/
 
@@ -110,13 +121,6 @@ function resolveActionService (action, fallback) {
   return fallback
 }
 
-/** Resolve `$token`-style placeholders from the run context. */
-function resolveContextValue (value, context) {
-  if (typeof value !== 'string' || !value.startsWith('$')) return value
-  const key = value.slice(1)
-  return context[key] ?? context.fields?.[key]
-}
-
 function resolveContextObject (obj, context) {
   if (!obj || typeof obj !== 'object') return obj
   const out = {}
@@ -312,7 +316,10 @@ export async function runFlow (flow, options = {}) {
         await expectFn(page.locator(actionSelector(actionId, service)).first()).toBeVisible({ timeout })
       }
       if (selector != null) {
-        await expectFn(page.locator(selector).first()).toBeVisible({ timeout })
+        const resolvedSelector = interpolateContextString(selector, context, {
+          escape: escapeCssAttrValue,
+        })
+        await expectFn(page.locator(resolvedSelector).first()).toBeVisible({ timeout })
       }
       if (text != null) {
         const pattern = text instanceof RegExp ? text : new RegExp(text, 'i')

package/src/test/test.util.js

@@ -173,6 +173,30 @@ export class TestUtil {
     return ev.payload.token
   }
 
+  static async getLatestEmailChangeJwtForSubject(subjectId) {
+    const ev = await EventStore.Collection.findOne(
+      {
+        type: TOKEN_SCHEMA,
+        event: 'Created',
+        'payload.type': 'EmailChange',
+        'payload.subject': subjectId,
+      },
+      { sort: { created: -1 } },
+    )
+    if (!ev?.payload?.token) {
+      return Promise.reject(new Error('No EmailChange token found for subject'))
+    }
+    return ev.payload.token
+  }
+
+  static countEmailChangeTokenEvents() {
+    return EventStore.Collection.countDocuments({
+      type: TOKEN_SCHEMA,
+      event: 'Created',
+      'payload.type': 'EmailChange',
+    })
+  }
+
   static GetVerificationToken() {
     const email = `${casual.email}`
 
@@ -192,7 +216,7 @@ export class TestUtil {
 
     await TestUtil.AssertActionResponse({
       actionId: '@ossy/authentication/actions/sign-up',
-      body: TestUtil.signUpBody({ email }),
+      payload: { email, firstName: 'Test', lastName: 'User' },
       expectedResponseStatus: 200,
       expectedResponseBody: { ok: true },
     })