@ossy/platform 3.11.1 → 3.12.0

package/Dockerfile

@@ -1,16 +1,15 @@
 # Build context: ossy/packages/platform directory.
-# From repo root: docker build -f ossy/packages/platform/Dockerfile ossy/packages/platform
-# In CI, this image is built and pushed to ghcr.io/ossy-se/runtime:latest by the Publish workflow.
+# From repo root: docker build -f packages/platform/Dockerfile packages/platform
+# Pushed by the manual "Deploy platform runtime" workflow (not npm Publish).
 FROM node:24-bookworm-slim
 
 WORKDIR /app
 
 COPY package.json ./
 
-# Install production deps only.
-# @ossy/router and @ossy/sdk must be resolvable — in production these are
-# published npm packages; in monorepo CI use npm pack + install.
-RUN npm install --omit=dev --no-audit --no-fund --loglevel=error
+# Production deps from npm. --legacy-peer-deps: transitive peers on an older
+# lockstep patch must not fail the image when ranges are otherwise valid.
+RUN npm install --omit=dev --no-audit --no-fund --loglevel=error --legacy-peer-deps
 
 COPY src ./src
 COPY docker-healthcheck.js ./docker-healthcheck.js
@@ -29,7 +28,7 @@ HEALTHCHECK --interval=30s --timeout=5s --start-period=60s --retries=3 \
 
 # Required env vars at runtime:
 #   OSSY_API_KEY   — Ossy API JWT for CMS reads
-#   OSSY_API_URL   — (optional) override API base, default https://api.ossy.se/api/v0
+#   OSSY_API_URL   — (optional) override API base, default https://ossy.se/api/v0
 #   PORT           — (optional) override listen port, default 3000
 #   OSSY_SERVICE_NAME — (optional) `/health` service label, default runtime
 CMD ["node", "src/runtime.js"]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ossy/platform",
-  "version": "3.11.1",
+  "version": "3.12.0",
   "description": "Ossy application server runtime",
   "repository": {
     "type": "git",
@@ -46,16 +46,16 @@
     "@aws-sdk/util-format-url": "^3.972.17",
     "@modelcontextprotocol/sdk": "^1.12.1",
     "@ossy/config": "^3.0.9",
-    "@ossy/event-store": "^3.11.1",
+    "@ossy/event-store": "^3.12.0",
     "@ossy/locale": "^3.4.0",
     "@ossy/manifest": "^3.9.0",
     "@ossy/observability": "^3.0.9",
     "@ossy/policies": "^3.0.9",
     "@ossy/schema": "^3.8.0",
-    "@ossy/sdk": "^3.11.1",
+    "@ossy/sdk": "^3.12.0",
     "@ossy/tokens": "^3.11.1",
-    "@ossy/users": "^3.11.1",
-    "@ossy/workspaces": "^3.11.1",
+    "@ossy/users": "^3.12.0",
+    "@ossy/workspaces": "^3.12.0",
     "cookie-parser": "^1.4.7",
     "dotenv": ">=16.0.0 <18.0.0",
     "express": ">=5.0.0 <6.0.0",
@@ -76,5 +76,5 @@
     "Dockerfile",
     "docker-healthcheck.js"
   ],
-  "gitHead": "f279de3535b6bc76631cbc6b943dae8f92a1565f"
+  "gitHead": "c2650803219ad1831559b512848358d9550ffad2"
 }

package/src/proxy-internal.js

@@ -14,6 +14,25 @@ function normalizeWorkspaceIdHeader (value) {
   return first || undefined
 }
 
+/**
+ * Map `/@ossy…` to the same-process path (`/actions` or `/api/v0…`).
+ * @param {string} originalUrl
+ * @returns {string}
+ */
+export function ossyProxyLocalPath (originalUrl) {
+  const pathAfterOssy = String(originalUrl || '').replace(/^\/@ossy/, '') || '/'
+  const pathOnly = pathAfterOssy.split('?')[0]
+  if (pathOnly === '/actions' || pathOnly === '/events') {
+    return pathAfterOssy.startsWith('/') ? pathAfterOssy : `/${pathAfterOssy}`
+  }
+  return `/api/v0${pathAfterOssy.startsWith('/') ? pathAfterOssy : `/${pathAfterOssy}`}`
+}
+
+/** Absolute OSSY_API_URL → HTTP hop. Unset / relative → same Express app. */
+export function isRemoteOssyApiUrl (envUrl = process.env.OSSY_API_URL) {
+  return /^https?:\/\//i.test(String(envUrl || '').trim())
+}
+
 export function ProxyInternal () {
   return (req, res, next) => {
     if (!req.originalUrl.startsWith('/@ossy')) {
@@ -47,15 +66,20 @@ export function ProxyInternal () {
       return
     }
 
+    if (!isRemoteOssyApiUrl()) {
+      const dest = ossyProxyLocalPath(req.originalUrl)
+      log.info(`[@ossy/platform][proxy] ${req.method} ${req.originalUrl} → ${dest} (same origin)`)
+      req.url = dest
+      req.originalUrl = dest
+      return next()
+    }
+
     log.info(`[@ossy/platform][proxy] ${req.method} ${req.originalUrl}`)
 
-    const domain = (process.env.OSSY_API_URL || 'https://api.ossy.se')
+    const domain = String(process.env.OSSY_API_URL).trim()
       .replace(/\/api\/v0\/?$/, '')
       .replace(/\/$/, '')
-    const pathAfterOssy = req.originalUrl.replace(/^\/@ossy/, '') || '/'
-    // POST /actions lives on the app server root — not under /api/v0.
-    const upstreamPath = pathAfterOssy === '/actions' ? '/actions' : `/api/v0${pathAfterOssy}`
-    const url = `${domain}${upstreamPath}`
+    const url = `${domain}${ossyProxyLocalPath(req.originalUrl)}`
     const forwardedHeaders = JSON.parse(JSON.stringify(req.headers))
     const workspaceId = normalizeWorkspaceIdHeader(req.get('workspaceId'))
 

package/src/proxy-internal.spec.js

@@ -0,0 +1,62 @@
+import { afterEach, describe, expect, it, jest } from '@jest/globals'
+import {
+  isRemoteOssyApiUrl,
+  ossyProxyLocalPath,
+  ProxyInternal,
+} from './proxy-internal.js'
+
+describe('ossyProxyLocalPath', () => {
+  it('maps REST under /@ossy onto /api/v0', () => {
+    expect(ossyProxyLocalPath('/@ossy/users/me')).toBe('/api/v0/users/me')
+    expect(ossyProxyLocalPath('/@ossy/apps/ask?domain=ossy.se'))
+      .toBe('/api/v0/apps/ask?domain=ossy.se')
+  })
+
+  it('keeps POST /actions and GET /events at the server root', () => {
+    expect(ossyProxyLocalPath('/@ossy/actions')).toBe('/actions')
+    expect(ossyProxyLocalPath('/@ossy/actions?x=1')).toBe('/actions?x=1')
+    expect(ossyProxyLocalPath('/@ossy/events')).toBe('/events')
+  })
+})
+
+describe('isRemoteOssyApiUrl', () => {
+  it('treats unset, empty, and relative values as same-origin', () => {
+    expect(isRemoteOssyApiUrl(undefined)).toBe(false)
+    expect(isRemoteOssyApiUrl('')).toBe(false)
+    expect(isRemoteOssyApiUrl('/api/v0')).toBe(false)
+  })
+
+  it('treats absolute http(s) as a remote hop', () => {
+    expect(isRemoteOssyApiUrl('https://ossy.se/api/v0')).toBe(true)
+    expect(isRemoteOssyApiUrl('http://localhost:3006')).toBe(true)
+  })
+})
+
+describe('ProxyInternal same-origin rewrite', () => {
+  const original = process.env.OSSY_API_URL
+
+  afterEach(() => {
+    if (original === undefined) delete process.env.OSSY_API_URL
+    else process.env.OSSY_API_URL = original
+  })
+
+  it('rewrites /@ossy onto this process when OSSY_API_URL is unset', () => {
+    delete process.env.OSSY_API_URL
+    const req = { originalUrl: '/@ossy/users/me', url: '/@ossy/users/me', method: 'GET' }
+    const next = jest.fn()
+    ProxyInternal()(req, {}, next)
+    expect(req.url).toBe('/api/v0/users/me')
+    expect(req.originalUrl).toBe('/api/v0/users/me')
+    expect(next).toHaveBeenCalledTimes(1)
+  })
+
+  it('rewrites /@ossy/actions onto POST /actions', () => {
+    delete process.env.OSSY_API_URL
+    const req = { originalUrl: '/@ossy/actions', url: '/@ossy/actions', method: 'POST' }
+    const next = jest.fn()
+    ProxyInternal()(req, {}, next)
+    expect(req.url).toBe('/actions')
+    expect(req.originalUrl).toBe('/actions')
+    expect(next).toHaveBeenCalledTimes(1)
+  })
+})

package/src/runtime.js

@@ -71,13 +71,24 @@ async function getSiteContext (domain) {
  *
  * Environment variables:
  *   OSSY_API_KEY  — API JWT for CMS reads (required)
- *   OSSY_API_URL  — Override API base URL (default: https://api.ossy.se/api/v0)
+ *   OSSY_API_URL  — Override API base URL (default: https://ossy.se/api/v0)
  *   PORT          — Override listen port (default: 3000)
  */
 export async function startRuntime ({ port } = {}) {
   const resolvedPort = port ?? resolvePort()
 
   const app = express()
+  // CloudFront → ALB → Node: hop count so `req.ip` is the viewer (#769).
+  // Default 2. Avoid `true` (leftmost XFF — spoofable). Override via OSSY_TRUST_PROXY_HOPS.
+  {
+    const raw = process.env.OSSY_TRUST_PROXY_HOPS
+    if (raw != null && String(raw).trim() !== '') {
+      const hops = Number(raw)
+      app.set('trust proxy', Number.isFinite(hops) && hops >= 0 ? hops : 2)
+    } else {
+      app.set('trust proxy', 2)
+    }
+  }
   // Liveness for ALB/ECS — before site loading so probes never depend on CMS/domain.
   // Prefer OSSY_SERVICE_NAME (ECS task env) when set.
   mountHealthEndpoint(app)
@@ -97,7 +108,7 @@ export async function startRuntime ({ port } = {}) {
     next()
   })
 
-  // Proxy /@ossy/* to the upstream Ossy API
+  // Proxy leftover /@ossy/* onto this process (/api/v0, /actions) unless OSSY_API_URL is absolute.
   app.use(ProxyInternal())
 
   // Force a fresh site download without waiting for the TTL to expire

package/src/server.js

@@ -326,6 +326,17 @@ export async function startServer (options = {}) {
   }
 
   const app = express()
+  // CloudFront → ALB → Node: hop count so `req.ip` is the viewer (#769).
+  // Default 2. Avoid `true` (leftmost XFF — spoofable). Override via OSSY_TRUST_PROXY_HOPS.
+  {
+    const raw = process.env.OSSY_TRUST_PROXY_HOPS
+    if (raw != null && String(raw).trim() !== '') {
+      const hops = Number(raw)
+      app.set('trust proxy', Number.isFinite(hops) && hops >= 0 ? hops : 2)
+    } else {
+      app.set('trust proxy', 2)
+    }
+  }
   // Liveness for ALB/ECS — before auth so probes never depend on cookies/Mongo.
   // Prefer OSSY_SERVICE_NAME (ECS task env) when set.
   mountHealthEndpoint(app)

package/src/site-loader.js

@@ -10,7 +10,7 @@ const CACHE_TTL_MS = 5 * 60 * 1000 // 5 minutes
 const DOWNLOAD_CONCURRENCY = 10
 const BASE_DIR = path.join(os.tmpdir(), 'ossy-rt')
 
-const API_URL = process.env.OSSY_API_URL || 'https://api.ossy.se/api/v0'
+const API_URL = process.env.OSSY_API_URL || 'https://ossy.se/api/v0'
 const API_KEY = process.env.OSSY_API_KEY
 
 /** @type {Map<string, { buildDir: string, workspaceId: string, loadedAt: number }>} */

package/src/tasks/task-service.js

@@ -4,6 +4,7 @@ import { IntegrationService } from '../integration.service.js'
 import { createLogger } from '@ossy/observability'
 import { isPrimaryTaskForAction, taskIdFromActionId } from '@ossy/schema'
 import { TaskRunService } from '../audit/task-run-service.js'
+import { resolveClientIp, runWithEventContext } from '@ossy/event-store'
 
 const SCHEDULER_INTERVAL_MS = 60_000
 const _serviceLog = createLogger('TaskService')
@@ -108,18 +109,20 @@ export class TaskService {
       log: context.log ?? createLogger(id),
     }
 
-    return TaskRunService.execute({
-      taskId: id,
-      handler: task.handler,
-      context: invokeContext,
-      trigger: 'invoke',
-      triggeredBy: {
-        channel: context.req ? undefined : 'api',
-        actionInvocationId: context.actionInvocationId ?? null,
-      },
-      executionEnv: 'ossy_server',
-      audit,
-    })
+    return runWithEventContext({ ip: resolveClientIp(context.req) }, () =>
+      TaskRunService.execute({
+        taskId: id,
+        handler: task.handler,
+        context: invokeContext,
+        trigger: 'invoke',
+        triggeredBy: {
+          channel: context.req ? undefined : 'api',
+          actionInvocationId: context.actionInvocationId ?? null,
+        },
+        executionEnv: 'ossy_server',
+        audit,
+      }),
+    )
   }
 
   /** @param {string} id */

package/src/test/flow-runner.js

@@ -26,6 +26,7 @@ import { assertDownloadFilenames, resolveDownloadTarget } from './flow-download.
 import { resolveFilesTarget } from './flow-files.js'
 import { resolvePressKey } from './flow-press.js'
 import { resolveViewportSize } from './flow-viewport.js'
+import { flowBelongsToShard, parseFlowShard, sortFlowsForShard } from './flow-shard.js'
 
 export {
   applyFormFieldOverrides,
@@ -39,6 +40,12 @@ export {
   resolveActionMatchers,
   resolveActionService,
 } from './flow-action.js'
+export {
+  flowBelongsToShard,
+  flowIdsForShard,
+  parseFlowShard,
+  sortFlowsForShard,
+} from './flow-shard.js'
 export { resolveClickTarget } from './flow-click.js'
 export {
   assertDownloadFilenames,
@@ -840,17 +847,32 @@ export function registerFlow (mod, options = {}) {
 /**
  * Register all flows listed in `manifest.flows[]`.
  * @param {string} manifestPath Absolute path to build/manifest.json
+ * @param {{ shard?: string }} [options] Optional shard override (`N/M`); defaults to `E2E_FLOW_SHARD`
  */
-export async function registerFlowsFromManifest (manifestPath) {
+export async function registerFlowsFromManifest (manifestPath, options = {}) {
   const manifest = loadManifest(manifestPath)
   const buildDir = path.dirname(manifestPath)
   const staticDir = path.join(buildDir, 'public', 'static')
-
-  for (const entry of manifest.flows ?? []) {
+  const shard = parseFlowShard(options.shard ?? process.env.E2E_FLOW_SHARD)
+  // Sort by stable flow id so independently built matrix jobs partition identically
+  // even when package discovery/`readdir` order differs (#768 / #770).
+  const flows = sortFlowsForShard(manifest.flows ?? [])
+  let registered = 0
+
+  for (let i = 0; i < flows.length; i++) {
+    if (!flowBelongsToShard(i, shard)) continue
+    const entry = flows[i]
     const chunkName = entry.entry.replace(/^\/static\//, '')
     const chunkPath = path.join(staticDir, chunkName)
     const mod = await import(pathToFileURL(chunkPath).href + `?ts=${Date.now()}`)
     registerFlow(mod, { manifestPath, locale: manifest.config?.defaultLanguage })
+    registered += 1
+  }
+
+  if (shard) {
+    console.log(
+      `[e2e] flow shard ${shard.index}/${shard.total}: registered ${registered}/${flows.length} flows`,
+    )
   }
 }
 

package/src/test/flow-shard.js

@@ -0,0 +1,66 @@
+/**
+ * CI flow partitioning helpers.
+ *
+ * All product flows register from one Playwright `runner.spec.js`, so Playwright's
+ * file-level `--shard` leaves shards 2..N empty. Matrix jobs set `E2E_FLOW_SHARD=N/M`
+ * and the flow runner registers only that slice.
+ *
+ * Membership is by **stable flow id order**, not discovery/`readdir` order — each
+ * matrix job builds independently (#768 / #770).
+ */
+
+/**
+ * Parse `E2E_FLOW_SHARD` / explicit shard string (`1/4`) into 1-based index + total.
+ *
+ * @param {string | undefined | null} value
+ * @returns {{ index: number, total: number } | null}
+ */
+export function parseFlowShard (value = process.env.E2E_FLOW_SHARD) {
+  if (value == null || value === '') return null
+  const match = String(value).trim().match(/^(\d+)\s*\/\s*(\d+)$/)
+  if (!match) {
+    throw new Error(`Invalid E2E_FLOW_SHARD "${value}" (expected N/M, e.g. 1/4)`)
+  }
+  const index = Number(match[1])
+  const total = Number(match[2])
+  if (!Number.isInteger(index) || !Number.isInteger(total) || total < 1 || index < 1 || index > total) {
+    throw new Error(`Invalid E2E_FLOW_SHARD "${value}" (index must be 1..total)`)
+  }
+  return { index, total }
+}
+
+/**
+ * Deterministic order for shard partitioning (localeCompare on flow id).
+ *
+ * @param {Array<{ id?: string }>} flows
+ * @returns {Array<{ id?: string }>}
+ */
+export function sortFlowsForShard (flows) {
+  return [...(flows ?? [])].sort((a, b) =>
+    String(a?.id ?? '').localeCompare(String(b?.id ?? '')),
+  )
+}
+
+/**
+ * Stable round-robin membership for CI flow matrix jobs.
+ * @param {number} flowIndex 0-based position in the **id-sorted** flow list
+ * @param {{ index: number, total: number } | null} shard
+ */
+export function flowBelongsToShard (flowIndex, shard) {
+  if (!shard) return true
+  return flowIndex % shard.total === shard.index - 1
+}
+
+/**
+ * Flow ids owned by a shard for a given (unordered) manifest list.
+ *
+ * @param {Array<{ id?: string }>} flows
+ * @param {{ index: number, total: number } | null} shard
+ * @returns {string[]}
+ */
+export function flowIdsForShard (flows, shard) {
+  const ordered = sortFlowsForShard(flows)
+  return ordered
+    .filter((_, i) => flowBelongsToShard(i, shard))
+    .map((flow) => String(flow.id ?? ''))
+}

package/src/test/flow-shard.spec.js

@@ -0,0 +1,73 @@
+import { describe, expect, it } from '@jest/globals'
+import {
+  flowBelongsToShard,
+  flowIdsForShard,
+  parseFlowShard,
+  sortFlowsForShard,
+} from './flow-shard.js'
+
+describe('parseFlowShard', () => {
+  it('returns null for empty values', () => {
+    expect(parseFlowShard(undefined)).toBeNull()
+    expect(parseFlowShard(null)).toBeNull()
+    expect(parseFlowShard('')).toBeNull()
+  })
+
+  it('parses N/M', () => {
+    expect(parseFlowShard('1/4')).toEqual({ index: 1, total: 4 })
+    expect(parseFlowShard(' 3 / 4 ')).toEqual({ index: 3, total: 4 })
+  })
+
+  it('rejects invalid shapes', () => {
+    expect(() => parseFlowShard('4')).toThrow(/Invalid E2E_FLOW_SHARD/)
+    expect(() => parseFlowShard('0/4')).toThrow(/Invalid E2E_FLOW_SHARD/)
+    expect(() => parseFlowShard('5/4')).toThrow(/Invalid E2E_FLOW_SHARD/)
+  })
+})
+
+describe('flowBelongsToShard', () => {
+  it('keeps every flow when shard is null', () => {
+    expect(flowBelongsToShard(0, null)).toBe(true)
+    expect(flowBelongsToShard(7, null)).toBe(true)
+  })
+
+  it('round-robins indices across shards', () => {
+    const shard1 = { index: 1, total: 4 }
+    const shard2 = { index: 2, total: 4 }
+    const owned = [...Array(8).keys()].filter(i => flowBelongsToShard(i, shard1))
+    const owned2 = [...Array(8).keys()].filter(i => flowBelongsToShard(i, shard2))
+    expect(owned).toEqual([0, 4])
+    expect(owned2).toEqual([1, 5])
+  })
+})
+
+describe('sortFlowsForShard / flowIdsForShard', () => {
+  it('sorts by stable id regardless of input order', () => {
+    const a = [{ id: 'zeta' }, { id: 'alpha' }, { id: 'mu' }]
+    const b = [{ id: 'mu' }, { id: 'zeta' }, { id: 'alpha' }]
+    expect(sortFlowsForShard(a).map(f => f.id)).toEqual(['alpha', 'mu', 'zeta'])
+    expect(sortFlowsForShard(b).map(f => f.id)).toEqual(['alpha', 'mu', 'zeta'])
+  })
+
+  it('assigns the same ids to shard 1/4 for two different input orders', () => {
+    const shard = { index: 1, total: 4 }
+    const orderA = [
+      { id: '@ossy/z/flows/c' },
+      { id: '@ossy/a/flows/x' },
+      { id: '@ossy/m/flows/y' },
+      { id: '@ossy/b/flows/w' },
+      { id: '@ossy/n/flows/v' },
+      { id: '@ossy/c/flows/u' },
+      { id: '@ossy/d/flows/t' },
+      { id: '@ossy/e/flows/s' },
+    ]
+    const orderB = [...orderA].reverse()
+
+    expect(flowIdsForShard(orderA, shard)).toEqual(flowIdsForShard(orderB, shard))
+    // id-sorted: a/x, b/w, c/u, d/t, e/s, m/y, n/v, z/c → shard 1 owns indices 0,4
+    expect(flowIdsForShard(orderA, shard)).toEqual([
+      '@ossy/a/flows/x',
+      '@ossy/e/flows/s',
+    ])
+  })
+})