@ossy/platform 3.11.0 → 3.11.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ossy/platform",
-  "version": "3.11.0",
+  "version": "3.11.1",
   "description": "Ossy application server runtime",
   "repository": {
     "type": "git",
@@ -27,6 +27,7 @@
     "./test/flow-runner.js": "./src/test/flow-runner.js",
     "./test/playwright.config.js": "./src/test/playwright.config.js",
     "./locale": "./src/locale.js",
+    "./verify-sign-in-session": "./src/verify-sign-in-session.js",
     "./storage-keys": "./src/storage/storage-keys.js",
     "./mcp": "./src/mcp/mount-platform-mcp.js"
   },
@@ -45,16 +46,16 @@
     "@aws-sdk/util-format-url": "^3.972.17",
     "@modelcontextprotocol/sdk": "^1.12.1",
     "@ossy/config": "^3.0.9",
-    "@ossy/event-store": "^3.11.0",
+    "@ossy/event-store": "^3.11.1",
     "@ossy/locale": "^3.4.0",
     "@ossy/manifest": "^3.9.0",
     "@ossy/observability": "^3.0.9",
     "@ossy/policies": "^3.0.9",
     "@ossy/schema": "^3.8.0",
-    "@ossy/sdk": "^3.5.0",
-    "@ossy/tokens": "^3.5.0",
-    "@ossy/users": "^3.11.0",
-    "@ossy/workspaces": "^3.11.0",
+    "@ossy/sdk": "^3.11.1",
+    "@ossy/tokens": "^3.11.1",
+    "@ossy/users": "^3.11.1",
+    "@ossy/workspaces": "^3.11.1",
     "cookie-parser": "^1.4.7",
     "dotenv": ">=16.0.0 <18.0.0",
     "express": ">=5.0.0 <6.0.0",
@@ -75,5 +76,5 @@
     "Dockerfile",
     "docker-healthcheck.js"
   ],
-  "gitHead": "53ff8456920e09151c9d88df4a6c3ee958d811eb"
+  "gitHead": "f279de3535b6bc76631cbc6b943dae8f92a1565f"
 }

package/src/index.js

@@ -8,6 +8,7 @@ export { validateSchemasForImport, ALLOWED_FIELD_TYPES, normalizeFieldType, reso
 export { IntegrationService } from './integration.service.js'
 export { ConfigService } from './config.service.js'
 export { ActionService } from './actions/action.service.js'
+export { applyVerifySignInSessionCookies } from './verify-sign-in-session.js'
 export { TokenService } from './token.service.js'
 export { UsersMiddleware } from './users.middleware.js'
 export { WorkspacesMiddleware } from './workspaces.middleware.js'

package/src/server.js

@@ -43,8 +43,11 @@ import {
 import {
   clearAuthCookie,
   clearWorkspaceFromUserAppSettings,
+  mergeUserAppSettingsCookie,
   readWorkspaceIdFromCookies,
+  setAuthCookie,
 } from './user-app-settings.js'
+import { applyVerifySignInSessionCookies } from './verify-sign-in-session.js'
 const log = createLogger('@ossy/platform')
 const MONGO_TIMEOUT_MS = resolveTimeoutMs('OSSY_MONGO_TIMEOUT_MS', 10_000)
 const SSR_RENDER_TIMEOUT_MS = resolveTimeoutMs('OSSY_SSR_RENDER_TIMEOUT_MS', 30_000)
@@ -427,6 +430,9 @@ export async function startServer (options = {}) {
         clearAuthCookie(res)
         clearWorkspaceFromUserAppSettings(req, res)
       }
+      if (actionId === '@ossy/authentication/actions/verify-sign-in' && result?.token) {
+        await applyVerifySignInSessionCookies(req, res, result)
+      }
       res.json(result ?? { ok: true })
     } catch (err) {
       // Still clear auth on sign-out failures so a broken session can recover.
@@ -670,6 +676,7 @@ export default startServer
 export { loadLayoutsById, resolvePageLayoutRender }
 export { ConfigService } from './config.service.js'
 export { ActionService } from './actions/action.service.js'
+export { applyVerifySignInSessionCookies } from './verify-sign-in-session.js'
 export { IntegrationService } from './integration.service.js'
 export { StorageClient } from './storage/storage.client.js'
 export { originalObjectKey, derivativeObjectKey, assertStorageKey } from './storage/storage-keys.js'

package/src/test/flow-runner.js

@@ -405,13 +405,13 @@ export async function runFlow (flow, options = {}) {
       const selector = actionSelector(actionId, matchers)
       const actionTimeout = step.timeout ?? 15000
       const actionDeadline = Date.now() + actionTimeout
-      // SSR markup is visible before React attaches onClick. Wait a paint+microtask
-      // so hydration can finish; then use DOM click() (Playwright pointer clicks can
-      // miss React handlers when overlays intercept hit-testing).
+      // SSR markup is visible before React attaches onClick. Wait for visibility,
+      // then click: form submits use remount-safe evaluate + requestSubmit; other
+      // CTAs use Playwright click (programmatic el.click() often skips React onClick).
       //
-      // Re-query the live node after the settle wait: concurrent auth/workspace
-      // fetches can remount the tree and detach Playwright locators mid-scroll
-      // (and wipe uncontrolled form state). Retry within the action timeout.
+      // Re-query the live node after settle: concurrent auth/workspace fetches can
+      // remount the tree and detach Playwright locators mid-scroll (and wipe
+      // uncontrolled form state). Retry within the action timeout.
       // Prefer an actionable match when duplicates exist (e.g. hero CTA under a page overlay).
       let clicked = false
       let lastError
@@ -432,52 +432,63 @@ export async function runFlow (flow, options = {}) {
               state: 'visible',
               timeout: Math.min(5000, Math.max(250, actionDeadline - Date.now())),
             })
-            // Scroll inside evaluate via a fresh querySelector — Playwright's
-            // scrollIntoViewIfNeeded holds a locator through a stability wait and
-            // throws "not attached" when GetWorkspace remounts PackageServiceToggle.
             const fieldRestore = { ...(context.fields ?? {}) }
             if (context.email != null && fieldRestore.email == null) {
               fieldRestore.email = context.email
             }
-            await page.evaluate(async ({ selector: sel, fields }) => {
-              await new Promise((resolve) => {
-                requestAnimationFrame(() => requestAnimationFrame(resolve))
-              })
-              await new Promise((resolve) => setTimeout(resolve, 500))
-              const el = document.querySelector(sel)
-              if (!el) throw new Error(`Action control disappeared after settle: ${sel}`)
-              if (typeof el.scrollIntoView === 'function') {
-                el.scrollIntoView({ block: 'nearest', inline: 'nearest' })
-              }
-              const form = el.closest('form')
-              if (form && fields && typeof fields === 'object') {
-                for (const [name, value] of Object.entries(fields)) {
-                  if (value == null || typeof value === 'object') continue
-                  const input = form.querySelector(`[name="${name}"]`)
-                  if (!input || input.disabled) continue
-                  // File inputs throw InvalidStateError if value is set programmatically.
-                  if (input instanceof HTMLInputElement && input.type === 'file') continue
-                  const asText = String(value)
-                  if (input.value === asText) continue
-                  const proto = Object.getPrototypeOf(input)
-                  const desc = Object.getOwnPropertyDescriptor(proto, 'value')
-                  desc?.set?.call(input, asText)
-                  input.dispatchEvent(new Event('input', { bubbles: true }))
-                  input.dispatchEvent(new Event('change', { bubbles: true }))
+            // Form submits: restore fills + requestSubmit in one evaluate (remount-safe).
+            // Other CTAs (Enable, Publish, OpenExport): Playwright click — programmatic
+            // el.click() often never invokes React onClick (no /actions POST; publish stays off).
+            const isSubmitButton = await candidate.evaluate((el) => {
+              const form = (el instanceof HTMLButtonElement || el instanceof HTMLInputElement)
+                ? el.form
+                : el.closest?.('form')
+              if (!form) return false
+              return (el instanceof HTMLButtonElement || el instanceof HTMLInputElement)
+                ? el.type === 'submit'
+                : el.getAttribute?.('type') === 'submit'
+            })
+            if (isSubmitButton) {
+              await page.evaluate(async ({ selector: sel, fields }) => {
+                await new Promise((resolve) => {
+                  requestAnimationFrame(() => requestAnimationFrame(resolve))
+                })
+                await new Promise((resolve) => setTimeout(resolve, 500))
+                const el = document.querySelector(sel)
+                if (!el) throw new Error(`Action control disappeared after settle: ${sel}`)
+                if (typeof el.scrollIntoView === 'function') {
+                  el.scrollIntoView({ block: 'nearest', inline: 'nearest' })
                 }
-              }
-              const isSubmit = form && (
-                (el instanceof HTMLButtonElement && el.type === 'submit')
-                || el.getAttribute('type') === 'submit'
-              )
-              if (isSubmit && typeof form.requestSubmit === 'function') {
-                form.requestSubmit(el)
-              } else if (typeof el.click === 'function') {
-                el.click()
-              } else {
-                el.dispatchEvent(new MouseEvent('click', { bubbles: true, cancelable: true, view: window }))
-              }
-            }, { selector, fields: fieldRestore })
+                const form = (el instanceof HTMLButtonElement || el instanceof HTMLInputElement)
+                  ? el.form
+                  : el.closest?.('form')
+                if (form && fields && typeof fields === 'object') {
+                  for (const [name, value] of Object.entries(fields)) {
+                    if (value == null || typeof value === 'object') continue
+                    const input = form.querySelector(`[name="${name}"]`)
+                    if (!input || input.disabled) continue
+                    if (input instanceof HTMLInputElement && input.type === 'file') continue
+                    const asText = String(value)
+                    if (input.value === asText) continue
+                    const proto = Object.getPrototypeOf(input)
+                    const desc = Object.getOwnPropertyDescriptor(proto, 'value')
+                    desc?.set?.call(input, asText)
+                    input.dispatchEvent(new Event('input', { bubbles: true }))
+                    input.dispatchEvent(new Event('change', { bubbles: true }))
+                  }
+                }
+                if (form && typeof form.requestSubmit === 'function') {
+                  form.requestSubmit(el)
+                  return
+                }
+                if (typeof el.click === 'function') el.click()
+              }, { selector, fields: fieldRestore })
+            } else {
+              await candidate.scrollIntoViewIfNeeded().catch(() => {})
+              await candidate.click({
+                timeout: Math.min(5000, Math.max(250, actionDeadline - Date.now())),
+              })
+            }
             clicked = true
             break
           } catch (err) {
@@ -538,6 +549,42 @@ export async function runFlow (flow, options = {}) {
       continue
     }
 
+    if (step.inputs != null) {
+      if (!page) throw new Error('inputs step requires a Playwright page')
+      const inputsTimeout = step.timeout ?? 15000
+      for (const [selector, valueSpec] of Object.entries(step.inputs)) {
+        const value = resolveContextValue(valueSpec, context)
+        if (value == null) {
+          throw new Error(`inputs step: no value resolved for selector "${selector}"`)
+        }
+        const resolvedSelector = interpolateContextString(selector, context, {
+          escape: escapeCssAttrValue,
+        })
+        const locator = page.locator(resolvedSelector).first()
+        await locator.waitFor({ state: 'visible', timeout: inputsTimeout })
+        const asText = String(value)
+        for (let attempt = 0; attempt < 3; attempt++) {
+          await locator.fill(asText)
+          await locator.blur().catch(() => {})
+          try {
+            await expectFn(locator).toHaveValue(asText, { timeout: 2000 })
+            break
+          } catch (err) {
+            if (attempt === 2) throw err
+            await page.waitForTimeout(150)
+          }
+        }
+        // Remount-safe action submits restore from context.fields by input name.
+        // Keep ad-hoc fills (e.g. sign-in code) in that map so settle remounts
+        // do not wipe values before requestSubmit.
+        const name = await locator.getAttribute('name')
+        if (name) {
+          context.fields = { ...(context.fields ?? {}), [name]: asText }
+        }
+      }
+      continue
+    }
+
     if (step.capture != null) {
       if (!page) throw new Error('capture step requires a Playwright page')
       for (const [key, spec] of Object.entries(step.capture)) {
@@ -567,37 +614,109 @@ export async function runFlow (flow, options = {}) {
       const to = resolveContextValue(emailStep.to ?? '$email', context)
       const templateId = emailStep.id ?? emailStep.templateId
       const clickLabel = emailStep.click ?? emailStep.link
+      const extract = emailStep.extract
       if (!to) throw new Error('email step requires "to" (recipient email)')
       if (!templateId) throw new Error('email step requires "id" (email template id)')
-      if (!clickLabel) throw new Error('email step requires "click" (link text in the email)')
+      if (!clickLabel && !extract) {
+        throw new Error('email step requires "click" or "extract"')
+      }
 
       const inboxPath = router.getPathname({ id: 'dev-inbox', language: locale }) ?? '/dev/inbox'
       const params = new URLSearchParams({ to: String(to), template: String(templateId) })
       const inboxUrl = `${baseURL}${inboxPath}?${params}`
-      const pattern = linkNamePattern(clickLabel)
       const deadline = Date.now() + (emailStep.timeout ?? 20000)
 
-      let clicked = false
-      while (Date.now() < deadline && !clicked) {
-        await page.goto(inboxUrl)
-        // Scope to email HTML body so chrome auth links (e.g. header "Sign in")
-        // cannot steal the click when the CTA label collides.
-        const body = page.locator('[data-email-body]').first()
-        const link = body.getByRole('link', { name: pattern }).first()
+      const openInboxBody = async (inboxPage) => {
+        await inboxPage.goto(inboxUrl)
+        const body = inboxPage.locator('[data-email-body]').first()
+        await body.waitFor({ state: 'visible', timeout: 2000 })
+        return body
+      }
+
+      // Extract-only must not navigate the flow page — SPA React state (e.g. SignIn
+      // success + code form for PWA) is lost on goto/goBack remount.
+      if (extract && !clickLabel) {
+        const inboxPage = await page.context().newPage()
+        let extracted = false
         try {
-          await body.waitFor({ state: 'visible', timeout: 2000 })
-          await link.waitFor({ state: 'visible', timeout: 2000 })
-          await Promise.all([
-            page.waitForLoadState('domcontentloaded'),
-            link.click(),
-          ])
-          clicked = true
-        } catch {
-          await page.waitForTimeout(500)
+          while (Date.now() < deadline && !extracted) {
+            try {
+              const body = await openInboxBody(inboxPage)
+              for (const [key, spec] of Object.entries(extract)) {
+                const selector = typeof spec === 'string' ? spec : spec.selector
+                const attr = typeof spec === 'object' ? spec.attr : undefined
+                const resolvedSelector = interpolateContextString(selector, context, {
+                  escape: escapeCssAttrValue,
+                })
+                const locator = body.locator(resolvedSelector).first()
+                await locator.waitFor({ state: 'attached', timeout: 2000 })
+                const value = attr
+                  ? await locator.getAttribute(attr)
+                  : await locator.textContent()
+                context[key] = typeof value === 'string' ? value.trim() : value
+              }
+              extracted = true
+            } catch {
+              await page.waitForTimeout(500)
+            }
+          }
+        } finally {
+          await inboxPage.close().catch(() => {})
         }
+        if (!extracted) {
+          throw new Error(`Email extract failed for to=${to}, template=${templateId}`)
+        }
+        continue
       }
-      if (!clicked) {
-        throw new Error(`Email link "${clickLabel}" not found for to=${to}, template=${templateId}`)
+
+      if (extract && clickLabel) {
+        let extracted = false
+        while (Date.now() < deadline && !extracted) {
+          try {
+            const body = await openInboxBody(page)
+            for (const [key, spec] of Object.entries(extract)) {
+              const selector = typeof spec === 'string' ? spec : spec.selector
+              const attr = typeof spec === 'object' ? spec.attr : undefined
+              const resolvedSelector = interpolateContextString(selector, context, {
+                escape: escapeCssAttrValue,
+              })
+              const locator = body.locator(resolvedSelector).first()
+              await locator.waitFor({ state: 'attached', timeout: 2000 })
+              const value = attr
+                ? await locator.getAttribute(attr)
+                : await locator.textContent()
+              context[key] = typeof value === 'string' ? value.trim() : value
+            }
+            extracted = true
+          } catch {
+            await page.waitForTimeout(500)
+          }
+        }
+        if (!extracted) {
+          throw new Error(`Email extract failed for to=${to}, template=${templateId}`)
+        }
+      }
+
+      if (clickLabel) {
+        const pattern = linkNamePattern(clickLabel)
+        let clicked = false
+        while (Date.now() < deadline && !clicked) {
+          const body = await openInboxBody(page)
+          const link = body.getByRole('link', { name: pattern }).first()
+          try {
+            await link.waitFor({ state: 'visible', timeout: 2000 })
+            await Promise.all([
+              page.waitForLoadState('domcontentloaded'),
+              link.click(),
+            ])
+            clicked = true
+          } catch {
+            await page.waitForTimeout(500)
+          }
+        }
+        if (!clicked) {
+          throw new Error(`Email link "${clickLabel}" not found for to=${to}, template=${templateId}`)
+        }
       }
       continue
     }

package/src/test/test.util.js

@@ -173,6 +173,43 @@ export class TestUtil {
     return ev.payload.token
   }
 
+  /**
+   * Resolve a six-digit sign-in code from its stored HMAC digest (integration tests only).
+   *
+   * @param {string} subjectId
+   * @returns {Promise<string>}
+   */
+  static async getLatestVerificationCodeForSubject(subjectId) {
+    const ev = await EventStore.Collection.findOne(
+      {
+        type: TOKEN_SCHEMA,
+        event: 'Created',
+        'payload.type': 'Verification',
+        'payload.subject': subjectId,
+      },
+      { sort: { created: -1 } },
+    )
+    const codeHash = ev?.payload?.codeHash
+    if (!codeHash) {
+      return Promise.reject(new Error('No verification code hash found for subject'))
+    }
+
+    const secret = process.env.TOKEN_SECRET
+    if (!secret) {
+      return Promise.reject(new Error('TOKEN_SECRET is required to resolve verification codes in tests'))
+    }
+
+    const { createHmac } = await import('node:crypto')
+    const hashCode = (code) => createHmac('sha256', secret).update(code).digest('hex')
+
+    for (let i = 0; i < 1_000_000; i += 1) {
+      const code = String(i).padStart(6, '0')
+      if (hashCode(code) === codeHash) return code
+    }
+
+    return Promise.reject(new Error('Could not resolve verification code from hash'))
+  }
+
   static async getLatestEmailChangeJwtForSubject(subjectId) {
     const ev = await EventStore.Collection.findOne(
       {

package/src/verify-sign-in-session.js

@@ -0,0 +1,24 @@
+import { ActionService } from './actions/action.service.js'
+import { mergeUserAppSettingsCookie, setAuthCookie } from './user-app-settings.js'
+
+/**
+ * Set auth (and optional single-workspace default) cookies after verify-sign-in.
+ *
+ * @param {import('express').Request} req
+ * @param {import('express').Response} res
+ * @param {{ sub: string, token: string }} session
+ */
+export async function applyVerifySignInSessionCookies (req, res, { sub, token }) {
+  setAuthCookie(res, token)
+  try {
+    const workspaces = await ActionService.invoke('@ossy/workspaces/actions/list', {
+      payload: { userId: sub },
+      req,
+    })
+    if (workspaces.length === 1) {
+      mergeUserAppSettingsCookie(req, res, { workspaceId: workspaces[0].id })
+    }
+  } catch {
+    // Cookie for the session is enough; workspace default is best-effort.
+  }
+}