@ossy/platform 3.1.0 → 3.2.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ossy/platform",
-  "version": "3.1.0",
+  "version": "3.2.0",
   "description": "Ossy application server runtime",
   "repository": {
     "type": "git",
@@ -45,16 +45,16 @@
     "@aws-sdk/util-format-url": "^3.972.17",
     "@modelcontextprotocol/sdk": "^1.12.1",
     "@ossy/config": "^3.0.9",
-    "@ossy/event-store": "^3.0.9",
+    "@ossy/event-store": "^3.2.0",
     "@ossy/locale": "^3.0.9",
     "@ossy/manifest": "^3.0.9",
     "@ossy/observability": "^3.0.9",
     "@ossy/policies": "^3.0.9",
     "@ossy/schema": "^3.0.9",
-    "@ossy/sdk": "^3.0.9",
+    "@ossy/sdk": "^3.2.0",
     "@ossy/tokens": "^3.0.9",
-    "@ossy/users": "^3.0.9",
-    "@ossy/workspaces": "^3.1.0",
+    "@ossy/users": "^3.2.0",
+    "@ossy/workspaces": "^3.2.0",
     "cookie-parser": "^1.4.7",
     "dotenv": ">=16.0.0 <18.0.0",
     "express": ">=5.0.0 <6.0.0",
@@ -74,5 +74,5 @@
     "src",
     "Dockerfile"
   ],
-  "gitHead": "9b146fb6fd9769f800863806c5bd16016508b218"
+  "gitHead": "b045f1fd7f2fe00c776b9ea96f76083b93fd8556"
 }

package/src/tasks/task-service.js

@@ -99,10 +99,19 @@ export class TaskService {
 
     const audit = context.audit !== false && task.metadata.audit !== false
 
+    // GET/API handlers often omit integrations; default like dispatch/scheduler so
+    // tasks can always use integrations.get('email') (including local delivery).
+    const invokeContext = {
+      ...context,
+      sdk: context.sdk ?? TaskService._sdk,
+      integrations: context.integrations ?? IntegrationService,
+      log: context.log ?? createLogger(id),
+    }
+
     return TaskRunService.execute({
       taskId: id,
       handler: task.handler,
-      context,
+      context: invokeContext,
       trigger: 'invoke',
       triggeredBy: {
         channel: context.req ? undefined : 'api',

package/src/test/flow-context.js

@@ -0,0 +1,44 @@
+/**
+ * Flow-run context helpers — `$email`-style placeholders for declarative steps.
+ */
+
+/**
+ * Escape a value for use inside a double-quoted CSS attribute selector.
+ * @param {unknown} value
+ * @returns {string}
+ */
+export function escapeCssAttrValue (value) {
+  return String(value).replace(/\\/g, '\\\\').replace(/"/g, '\\"')
+}
+
+/**
+ * Resolve a whole-string `$token` placeholder from the run context.
+ * Non-strings and strings that do not start with `$` are returned as-is.
+ *
+ * @param {unknown} value
+ * @param {{ fields?: Record<string, unknown>, [key: string]: unknown }} context
+ */
+export function resolveContextValue (value, context) {
+  if (typeof value !== 'string' || !value.startsWith('$')) return value
+  const key = value.slice(1)
+  return context[key] ?? context.fields?.[key]
+}
+
+/**
+ * Replace `$token` placeholders embedded in a string (e.g. selectors).
+ * Unknown tokens are left unchanged.
+ *
+ * @param {unknown} template
+ * @param {{ fields?: Record<string, unknown>, [key: string]: unknown }} context
+ * @param {{ escape?: (value: unknown) => string }} [options]
+ * @returns {unknown}
+ */
+export function interpolateContextString (template, context, options = {}) {
+  if (typeof template !== 'string' || !template.includes('$')) return template
+  const escape = typeof options.escape === 'function' ? options.escape : (value) => String(value)
+  return template.replace(/\$([A-Za-z_][A-Za-z0-9_]*)/g, (match, key) => {
+    const value = context[key] ?? context.fields?.[key]
+    if (value == null) return match
+    return escape(value)
+  })
+}

package/src/test/flow-context.spec.js

@@ -0,0 +1,44 @@
+import { describe, expect, it } from '@jest/globals'
+import {
+  escapeCssAttrValue,
+  interpolateContextString,
+  resolveContextValue,
+} from './flow-context.js'
+
+describe('flow-context', () => {
+  const context = {
+    email: 'new@example.com',
+    fields: { firstName: 'Ada', email: 'field@example.com' },
+  }
+
+  it('resolves whole-string $placeholders from context then fields', () => {
+    expect(resolveContextValue('$email', context)).toBe('new@example.com')
+    expect(resolveContextValue('$firstName', context)).toBe('Ada')
+    expect(resolveContextValue('literal', context)).toBe('literal')
+    expect(resolveContextValue('$missing', context)).toBeUndefined()
+  })
+
+  it('interpolates embedded $placeholders in selectors', () => {
+    expect(
+      interpolateContextString('[data-user-email="$email"]', context),
+    ).toBe('[data-user-email="new@example.com"]')
+  })
+
+  it('escapes quotes and backslashes when an escape fn is provided', () => {
+    const tricky = {
+      email: 'a"b\\c@example.com',
+      fields: {},
+    }
+    expect(
+      interpolateContextString('[data-user-email="$email"]', tricky, {
+        escape: escapeCssAttrValue,
+      }),
+    ).toBe('[data-user-email="a\\"b\\\\c@example.com"]')
+  })
+
+  it('leaves unknown embedded tokens unchanged', () => {
+    expect(
+      interpolateContextString('[data-x="$missing"]', context),
+    ).toBe('[data-x="$missing"]')
+  })
+})

package/src/test/flow-runner.js

@@ -14,6 +14,17 @@ import { faker } from '@faker-js/faker'
 import { Router } from '@ossy/router'
 import { Schema } from '@ossy/schema'
 import { test, expect } from '@playwright/test'
+import {
+  escapeCssAttrValue,
+  interpolateContextString,
+  resolveContextValue,
+} from './flow-context.js'
+
+export {
+  escapeCssAttrValue,
+  interpolateContextString,
+  resolveContextValue,
+} from './flow-context.js'
 
 const FLOW_PATTERN = /\.flow\.(mjs|cjs|js)$/
 
@@ -110,13 +121,6 @@ function resolveActionService (action, fallback) {
   return fallback
 }
 
-/** Resolve `$token`-style placeholders from the run context. */
-function resolveContextValue (value, context) {
-  if (typeof value !== 'string' || !value.startsWith('$')) return value
-  const key = value.slice(1)
-  return context[key] ?? context.fields?.[key]
-}
-
 function resolveContextObject (obj, context) {
   if (!obj || typeof obj !== 'object') return obj
   const out = {}
@@ -312,7 +316,10 @@ export async function runFlow (flow, options = {}) {
         await expectFn(page.locator(actionSelector(actionId, service)).first()).toBeVisible({ timeout })
       }
       if (selector != null) {
-        await expectFn(page.locator(selector).first()).toBeVisible({ timeout })
+        const resolvedSelector = interpolateContextString(selector, context, {
+          escape: escapeCssAttrValue,
+        })
+        await expectFn(page.locator(resolvedSelector).first()).toBeVisible({ timeout })
       }
       if (text != null) {
         const pattern = text instanceof RegExp ? text : new RegExp(text, 'i')

package/src/test/test.util.js

@@ -173,6 +173,30 @@ export class TestUtil {
     return ev.payload.token
   }
 
+  static async getLatestEmailChangeJwtForSubject(subjectId) {
+    const ev = await EventStore.Collection.findOne(
+      {
+        type: TOKEN_SCHEMA,
+        event: 'Created',
+        'payload.type': 'EmailChange',
+        'payload.subject': subjectId,
+      },
+      { sort: { created: -1 } },
+    )
+    if (!ev?.payload?.token) {
+      return Promise.reject(new Error('No EmailChange token found for subject'))
+    }
+    return ev.payload.token
+  }
+
+  static countEmailChangeTokenEvents() {
+    return EventStore.Collection.countDocuments({
+      type: TOKEN_SCHEMA,
+      event: 'Created',
+      'payload.type': 'EmailChange',
+    })
+  }
+
   static GetVerificationToken() {
     const email = `${casual.email}`
 
@@ -192,7 +216,7 @@ export class TestUtil {
 
     await TestUtil.AssertActionResponse({
       actionId: '@ossy/authentication/actions/sign-up',
-      body: TestUtil.signUpBody({ email }),
+      payload: { email, firstName: 'Test', lastName: 'User' },
       expectedResponseStatus: 200,
       expectedResponseBody: { ok: true },
     })