@ossy/platform 3.4.0 → 3.5.1

package/Dockerfile

@@ -13,11 +13,23 @@ COPY package.json ./
 RUN npm install --omit=dev --no-audit --no-fund --loglevel=error
 
 COPY src ./src
+COPY docker-healthcheck.js ./docker-healthcheck.js
+
+# ECS/ALB map container port 3000. `startRuntime` honors PORT (see runtime.js).
+ENV PORT=3000
+# Default label for `/health`; ECS task defs override with the service key.
+ENV OSSY_SERVICE_NAME=runtime
 
 EXPOSE 3000
 
+# Image-local Docker HEALTHCHECK (PORT + /health + 4s abort). ECS container
+# checks use the same probe shape via inline `node -e` fetch (ossy#589).
+HEALTHCHECK --interval=30s --timeout=5s --start-period=60s --retries=3 \
+  CMD ["node", "docker-healthcheck.js"]
+
 # Required env vars at runtime:
 #   OSSY_API_KEY   — Ossy API JWT for CMS reads
 #   OSSY_API_URL   — (optional) override API base, default https://api.ossy.se/api/v0
 #   PORT           — (optional) override listen port, default 3000
+#   OSSY_SERVICE_NAME — (optional) `/health` service label, default runtime
 CMD ["node", "src/runtime.js"]

package/README.md

@@ -73,6 +73,8 @@ Both `startServer` (website / app images) and `startRuntime` (CMS multi-tenant i
 
 The route is mounted before auth and before CMS site loading, so ALB target groups and ECS container health checks can use path `/health` without cookies, API tokens, or a resolvable hostname.
 
+The runtime image `Dockerfile` sets `PORT` / `OSSY_SERVICE_NAME` and a Docker `HEALTHCHECK` via WORKDIR-root `docker-healthcheck.js` (same PORT + `/health` + 4s abort shape as ECS inline probes from `@ossy/deployment-tools`).
+
 ## Exported API
 
 ```js

package/docker-healthcheck.js

@@ -0,0 +1,32 @@
+/**
+ * Docker HEALTHCHECK entrypoint for the platform runtime image (WORKDIR root).
+ *
+ * ECS Fargate container checks use an inline Node `fetch` one-liner from
+ * `@ossy/deployment-tools` `ecsContainerHealthCheckCommand` (ossy#589) — they
+ * do not require this file. Keep the same PORT + `/health` +
+ * `HEALTHCHECK_FETCH_TIMEOUT_MS` probe shape so local `docker build` /
+ * `docker run` health matches ECS/ALB liveness.
+ *
+ * No curl/wget — `node:*-slim` only needs Node `fetch`.
+ */
+const DEFAULT_PORT = 3000
+const HEALTH_PATH = '/health'
+/** Match `src/health.js` / deployment-tools `HEALTHCHECK_FETCH_TIMEOUT_MS`. */
+const HEALTHCHECK_FETCH_TIMEOUT_MS = 4000
+
+function resolveProbePort () {
+  const parsed = Number.parseInt(String(process.env.PORT ?? ''), 10)
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : DEFAULT_PORT
+}
+
+const port = resolveProbePort()
+const url = `http://127.0.0.1:${port}${HEALTH_PATH}`
+
+try {
+  const response = await fetch(url, {
+    signal: AbortSignal.timeout(HEALTHCHECK_FETCH_TIMEOUT_MS),
+  })
+  process.exit(response.ok ? 0 : 1)
+} catch {
+  process.exit(1)
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ossy/platform",
-  "version": "3.4.0",
+  "version": "3.5.1",
   "description": "Ossy application server runtime",
   "repository": {
     "type": "git",
@@ -32,7 +32,7 @@
   },
   "scripts": {
     "start": "PORT=3003 node -e \"import('./src/server.js').then(m => m.startServer())\"",
-    "test": "NODE_OPTIONS=--experimental-vm-modules jest --verbose"
+    "test": "NODE_OPTIONS=--experimental-vm-modules jest --verbose && node --test docker-healthcheck.test.js"
   },
   "keywords": [],
   "author": "Ossy <yourfriends@ossy.se> (https://ossy.se)",
@@ -47,14 +47,14 @@
     "@ossy/config": "^3.0.9",
     "@ossy/event-store": "^3.4.0",
     "@ossy/locale": "^3.4.0",
-    "@ossy/manifest": "^3.4.0",
+    "@ossy/manifest": "^3.5.1",
     "@ossy/observability": "^3.0.9",
     "@ossy/policies": "^3.0.9",
-    "@ossy/schema": "^3.4.0",
-    "@ossy/sdk": "^3.4.0",
-    "@ossy/tokens": "^3.0.9",
-    "@ossy/users": "^3.4.0",
-    "@ossy/workspaces": "^3.4.0",
+    "@ossy/schema": "^3.5.1",
+    "@ossy/sdk": "^3.5.0",
+    "@ossy/tokens": "^3.5.0",
+    "@ossy/users": "^3.5.1",
+    "@ossy/workspaces": "^3.5.1",
     "cookie-parser": "^1.4.7",
     "dotenv": ">=16.0.0 <18.0.0",
     "express": ">=5.0.0 <6.0.0",
@@ -72,7 +72,8 @@
   },
   "files": [
     "src",
-    "Dockerfile"
+    "Dockerfile",
+    "docker-healthcheck.js"
   ],
-  "gitHead": "d36b69444268d172bc3e8e1dc77e67afc63f8650"
+  "gitHead": "cafa2d72ae9c4f6197ebec0b5b857919a062ceff"
 }

package/src/mcp/create-ossy-mcp-server.js

@@ -1,11 +1,15 @@
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js'
-import { jsonSchemaToZodShape } from './json-schema-to-zod.js'
+import { jsonSchemaToZod } from './json-schema-to-zod.js'
 import {
   TASK_TOPOLOGY_RESOURCE_URI,
   capabilitiesTaskTopologyResource,
 } from '@ossy/manifest/build-capabilities'
 
 /**
+ * Pass a full Zod object (with passthrough / record semantics) — not a raw shape.
+ * The MCP SDK wraps raw shapes with `z.object(shape)`, which strips unknown keys and
+ * defeats JSON Schema `additionalProperties: true` (e.g. timesheets `year` / `monthIndex`).
+ *
  * @param {{
  *   capabilities: { tools: Array<object>, tasks?: object[], graph?: object },
  *   invokeAction: (actionId: string, payload: object, req?: object) => Promise<unknown>,
@@ -44,12 +48,12 @@ export function createOssyMcpServer ({ capabilities, invokeAction, customTools =
   }
 
   for (const tool of capabilities.tools || []) {
-    const inputShape = jsonSchemaToZodShape(tool.inputSchema || { type: 'object' })
+    const inputSchema = jsonSchemaToZod(tool.inputSchema || { type: 'object' })
     server.registerTool(
       tool.name,
       {
         description: tool.description || tool.title || tool.actionId,
-        inputSchema: inputShape,
+        inputSchema,
       },
       async (args, extra) => {
         try {
@@ -68,14 +72,14 @@ export function createOssyMcpServer ({ capabilities, invokeAction, customTools =
   }
 
   for (const tool of customTools) {
-    const inputShape = tool.inputSchema
-      ? jsonSchemaToZodShape(tool.inputSchema)
+    const inputSchema = tool.inputSchema
+      ? jsonSchemaToZod(tool.inputSchema)
       : undefined
     server.registerTool(
       tool.name,
       {
         description: tool.description,
-        ...(inputShape ? { inputSchema: inputShape } : {}),
+        ...(inputSchema ? { inputSchema } : {}),
       },
       async (args, extra) => {
         try {

package/src/mcp/json-schema-to-zod.js

@@ -4,6 +4,11 @@ import { z } from 'zod'
  * Minimal JSON Schema → Zod conversion for MCP tool registration.
  * Supports the subset produced by build-capabilities.
  *
+ * JSON Schema default for `additionalProperties` is **true** (open objects).
+ * We only strip unknown keys when `additionalProperties` is explicitly `false`.
+ * That matters for envelopes like `import-schemas` (`items: { type: 'object' }`),
+ * which otherwise became `z.object({})` and dropped `id` / `fields`.
+ *
  * @param {object} schema
  * @returns {import('zod').ZodTypeAny}
  */
@@ -26,7 +31,14 @@ export function jsonSchemaToZod (schema) {
       shape[key] = field
     }
     const objectSchema = z.object(shape)
-    return schema.additionalProperties ? objectSchema.passthrough() : objectSchema
+    if (schema.additionalProperties === false) {
+      return objectSchema
+    }
+    // Open object with no declared properties → accept any keys.
+    if (Object.keys(shape).length === 0) {
+      return z.record(z.unknown())
+    }
+    return objectSchema.passthrough()
   }
 
   if (schema.type === 'array') {
@@ -52,6 +64,10 @@ export function jsonSchemaToZod (schema) {
 }
 
 /**
+ * Raw shape for callers that need ZodRawShape. Prefer {@link jsonSchemaToZod} when
+ * registering MCP tools — the MCP SDK rebuilds `z.object(shape)` without passthrough,
+ * which strips open-object fields.
+ *
  * @param {object} inputSchema JSON Schema object
  * @returns {import('zod').ZodRawShape}
  */

package/src/mcp/json-schema-to-zod.spec.js

@@ -0,0 +1,103 @@
+import { describe, expect, it } from '@jest/globals'
+import { z } from 'zod'
+import { jsonSchemaToZod, jsonSchemaToZodShape } from './json-schema-to-zod.js'
+import { normalizeMcpActionArgs } from './normalize-mcp-action-args.js'
+
+describe('jsonSchemaToZod', () => {
+  it('keeps unknown keys on open objects (JSON Schema default)', () => {
+    const schema = jsonSchemaToZod({ type: 'object' })
+    const parsed = schema.parse({
+      id: '@ossy/demo/schema/author',
+      fields: [{ name: 'n', type: 'text' }],
+    })
+    expect(parsed).toEqual({
+      id: '@ossy/demo/schema/author',
+      fields: [{ name: 'n', type: 'text' }],
+    })
+  })
+
+  it('strips unknown keys only when additionalProperties is false', () => {
+    const schema = jsonSchemaToZod({
+      type: 'object',
+      properties: { name: { type: 'string' } },
+      required: ['name'],
+      additionalProperties: false,
+    })
+    expect(schema.parse({ name: 'Ada', extra: true })).toEqual({ name: 'Ada' })
+  })
+
+  it('preserves schema items inside import-schemas-style arrays', () => {
+    const envelope = jsonSchemaToZod({
+      type: 'object',
+      required: ['schemas'],
+      properties: {
+        schemas: {
+          type: 'array',
+          items: { type: 'object' },
+        },
+      },
+    })
+    const input = {
+      schemas: [
+        {
+          id: '@ossy/demo/schema/author',
+          name: 'Author',
+          fields: [{ name: 'name', type: 'text', required: true }],
+        },
+      ],
+    }
+    expect(envelope.parse(input)).toEqual(input)
+  })
+
+  it('keeps timesheet generate fields when using the full Zod schema (MCP registration)', () => {
+    const capabilitySchema = {
+      type: 'object',
+      properties: {
+        workspaceId: { type: 'string' },
+        payload: { type: 'object', description: 'Action-specific payload' },
+      },
+      additionalProperties: true,
+    }
+    const full = jsonSchemaToZod(capabilitySchema)
+    expect(full.parse({ year: 2026, monthIndex: 7 })).toEqual({
+      year: 2026,
+      monthIndex: 7,
+    })
+
+    // MCP SDK wraps raw shapes with z.object(shape) — that path strips extras.
+    const stripped = z.object(jsonSchemaToZodShape(capabilitySchema)).parse({
+      year: 2026,
+      monthIndex: 7,
+      payload: {},
+    })
+    expect(stripped).toEqual({ payload: {} })
+    expect(stripped.year).toBeUndefined()
+  })
+})
+
+describe('normalizeMcpActionArgs', () => {
+  it('flattens nested payload bags used by default MCP envelopes', () => {
+    expect(normalizeMcpActionArgs(
+      { payload: { year: 2026, monthIndex: 7 } },
+      { workspaceId: 'ws-1', userId: 'u-1' },
+    )).toEqual({
+      workspaceId: 'ws-1',
+      user: undefined,
+      userId: 'u-1',
+      year: 2026,
+      monthIndex: 7,
+    })
+  })
+
+  it('keeps flat tool args (resources create style)', () => {
+    expect(normalizeMcpActionArgs(
+      { location: '/demo/', name: 'Ada', type: '@ossy/demo/schema/author' },
+      { workspaceId: 'ws-1' },
+    )).toMatchObject({
+      workspaceId: 'ws-1',
+      location: '/demo/',
+      name: 'Ada',
+      type: '@ossy/demo/schema/author',
+    })
+  })
+})

package/src/mcp/mount-platform-mcp.js

@@ -1,6 +1,7 @@
 import { buildCapabilities } from '@ossy/manifest/build-capabilities'
 import { mountOssyMcp } from './mount-ossy-mcp.js'
 import { uploadFileToolHandler, UPLOAD_FILE_TOOL } from './upload-file-tool.js'
+import { normalizeMcpActionArgs } from './normalize-mcp-action-args.js'
 import { ActionService } from '../actions/action.service.js'
 import { TaskService } from '../tasks/task-service.js'
 import { IntegrationService } from '../integration.service.js'
@@ -68,12 +69,7 @@ export function mountPlatformMcp (app, {
 
     const actionLog = createLogger(actionId)
     return ActionService.invoke(actionId, {
-      payload: {
-        workspaceId: payload?.workspaceId ?? req?.workspaceId,
-        user: req?.user,
-        userId: req?.userId,
-        ...payload,
-      },
+      payload: normalizeMcpActionArgs(payload, req),
       sdk: req?.sdk ?? null,
       log: actionLog,
       integrations: IntegrationService,

package/src/mcp/normalize-mcp-action-args.js

@@ -0,0 +1,30 @@
+/**
+ * Flatten MCP tool args into the action payload shape tasks expect.
+ *
+ * Default capability envelopes expose a nested `payload` bag. Agents often send
+ * `{ payload: { year, monthIndex } }`, but tasks read `payload.year` after
+ * ActionService spreads the tool args — without flattening that becomes
+ * `payload.payload.year`.
+ *
+ * @param {object} [args]
+ * @param {{ workspaceId?: string, user?: object, userId?: string }} [req]
+ * @returns {object}
+ */
+export function normalizeMcpActionArgs (args = {}, req = {}) {
+  const { workspaceId, payload: nestedPayload, ...rest } = args ?? {}
+  const fromNested = (
+    nestedPayload
+    && typeof nestedPayload === 'object'
+    && !Array.isArray(nestedPayload)
+  )
+    ? nestedPayload
+    : {}
+
+  return {
+    workspaceId: workspaceId ?? req?.workspaceId,
+    user: req?.user,
+    userId: req?.userId,
+    ...fromNested,
+    ...rest,
+  }
+}

package/src/mcp/upload-file-tool.js

@@ -1,4 +1,5 @@
 import { readFile, stat } from 'node:fs/promises'
+import { isLocalStorageUploadUrl } from '../storage/local-storage-url.js'
 
 /**
  * Composite upload: create binary resource + PUT file bytes.
@@ -29,11 +30,18 @@ export async function uploadFileToolHandler (invokeAction, args, req) {
     throw new Error('Storage is not configured or create did not return uploadUrl')
   }
 
-  const response = await fetch(uploadUrl, {
-    method: 'PUT',
-    headers: { 'Content-Type': type },
-    body,
-  })
+  /** @type {Record<string, string>} */
+  const headers = { 'Content-Type': type }
+  const init = { method: 'PUT', headers, body }
+  if (isLocalStorageUploadUrl(uploadUrl)) {
+    init.credentials = 'include'
+    const workspaceId = args.workspaceId || req?.workspaceId
+    if (workspaceId) headers.workspaceId = workspaceId
+    const auth = req?.get?.('Authorization') || req?.signedCookies?.auth
+    if (auth) headers.Authorization = auth
+  }
+
+  const response = await fetch(uploadUrl, init)
 
   if (!response.ok) {
     throw new Error(`Upload failed: HTTP ${response.status}`)

package/src/resources/schema.registry.js

@@ -1 +1 @@
-export { registerSchema, getSystemSchemas } from '@ossy/schema'
+export { registerSchema, getSystemSchemas } from '@ossy/schema/system-schemas'

package/src/server.js

@@ -664,6 +664,7 @@ export { ActionService } from './actions/action.service.js'
 export { IntegrationService } from './integration.service.js'
 export { StorageClient } from './storage/storage.client.js'
 export { originalObjectKey, derivativeObjectKey, assertStorageKey } from './storage/storage-keys.js'
+export { isLocalStorageUploadUrl } from './storage/local-storage-url.js'
 export { S3Client } from './storage/s3.client.js'
 export { LocalStorageClient } from './storage/local-storage.client.js'
 export { getSystemSchemas } from './resources/schema.registry.js'

package/src/storage/local-storage-url.js

@@ -0,0 +1,16 @@
+/**
+ * Detect filesystem-backend upload URLs (`/local-storage?key=…`).
+ * S3 presigned URLs must not receive session cookies or Authorization headers.
+ *
+ * @param {string} url
+ * @returns {boolean}
+ */
+export function isLocalStorageUploadUrl (url) {
+  if (!url || typeof url !== 'string') return false
+  try {
+    const parsed = new URL(url, 'http://localhost')
+    return parsed.pathname === '/local-storage' || parsed.pathname.endsWith('/local-storage')
+  } catch {
+    return false
+  }
+}

package/src/storage/local-storage-url.spec.js

@@ -0,0 +1,17 @@
+import { describe, expect, it } from '@jest/globals'
+import { isLocalStorageUploadUrl } from './local-storage-url.js'
+
+describe('isLocalStorageUploadUrl', () => {
+  it('matches relative and absolute local-storage paths', () => {
+    expect(isLocalStorageUploadUrl('/local-storage?key=abc')).toBe(true)
+    expect(isLocalStorageUploadUrl('http://localhost:3006/local-storage?key=abc')).toBe(true)
+    expect(isLocalStorageUploadUrl('https://app.example.com/local-storage?key=id%3Athumb')).toBe(true)
+  })
+
+  it('rejects S3 and unrelated URLs', () => {
+    expect(isLocalStorageUploadUrl('https://bucket.s3.amazonaws.com/key?X-Amz-Signature=abc')).toBe(false)
+    expect(isLocalStorageUploadUrl('/r/abc')).toBe(false)
+    expect(isLocalStorageUploadUrl('')).toBe(false)
+    expect(isLocalStorageUploadUrl(null)).toBe(false)
+  })
+})

package/src/users.middleware.js

@@ -26,21 +26,31 @@ function normalizeAuthToken (token) {
  */
 export class UsersMiddleware {
 
-  /** Reject revoked API tokens (JWT alone stays valid until expiry). */
-  static assertApiTokenActive(payload) {
-    if (payload.type !== 'Api' || !payload.jti) {
+  /**
+   * Reject revoked session/API tokens (JWT alone stays valid until expiry).
+   * WebAuth tokens with `jti` are checked after sign-out (#359); API tokens
+   * keep the same revoke path. Legacy WebAuth JWTs without `jti` skip this.
+   */
+  static assertAuthTokenActive(payload) {
+    if ((payload.type !== 'Api' && payload.type !== 'WebAuth') || !payload.jti) {
       return Promise.resolve(payload)
     }
     return Aggregate.Of(Token, payload.jti)
       .then(aggregate => {
         const view = Token.View(aggregate.events, aggregate.state)
         if (view.status === 'Revoked') {
-          return Promise.reject(new Error('Api token revoked'))
+          const label = payload.type === 'Api' ? 'Api token revoked' : 'Auth token revoked'
+          return Promise.reject(Object.assign(new Error(label), { status: 401 }))
         }
         return payload
       })
   }
 
+  /** @deprecated Use assertAuthTokenActive — kept for callers that still import the old name. */
+  static assertApiTokenActive(payload) {
+    return UsersMiddleware.assertAuthTokenActive(payload)
+  }
+
   /**
    * Resolves the caller to a real user (with workspaces and policies attached)
    * or to the anonymous principal. Authorization / role checks belong in a separate step.
@@ -74,7 +84,7 @@ export class UsersMiddleware {
 
     withTimeout(
       TokenService.verify(authToken)
-        .then(UsersMiddleware.assertApiTokenActive)
+        .then(UsersMiddleware.assertAuthTokenActive)
         .then(payload => {
           req.authPayload = payload
           req.tokenScopes = payload?.type === 'Api' ? (payload.scopes ?? ['*']) : null

package/src/users.middleware.spec.js

@@ -0,0 +1,123 @@
+import { beforeEach, describe, expect, it, jest } from '@jest/globals'
+
+const ofMock = jest.fn()
+
+jest.unstable_mockModule('@ossy/event-store', () => ({
+  Aggregate: {
+    Of: ofMock,
+  },
+}))
+
+jest.unstable_mockModule('@ossy/observability', () => ({
+  createLogger: () => ({
+    debug () {},
+    info () {},
+    warn () {},
+    error () {},
+  }),
+}))
+
+jest.unstable_mockModule('@ossy/users/server', () => ({
+  User: { name: 'User' },
+}))
+
+jest.unstable_mockModule('@ossy/tokens/server', () => ({
+  Token: {
+    View (events, state = {}) {
+      return events.reduce((token, event) => {
+        if (event.event === 'Created') {
+          return { ...event.payload, status: 'Active', id: event.resourceId }
+        }
+        if (event.event === 'Revoked') {
+          return { ...token, status: 'Revoked' }
+        }
+        return token
+      }, state)
+    },
+  },
+}))
+
+jest.unstable_mockModule('@ossy/policies/server', () => ({
+  PoliciesQueries: { GetPoliciesForUser: async () => [] },
+}))
+
+jest.unstable_mockModule('./config.service.js', () => ({
+  ConfigService: { AnonymousUserId: 'anonymous' },
+}))
+
+jest.unstable_mockModule('./token.service.js', () => ({
+  TokenService: { verify: async () => ({}) },
+}))
+
+jest.unstable_mockModule('./request-diagnostics.js', () => ({
+  OperationTimeoutError: class OperationTimeoutError extends Error {},
+  resolveTimeoutMs: () => 10_000,
+  withTimeout: (promise) => promise,
+}))
+
+const { UsersMiddleware } = await import('./users.middleware.js')
+
+describe('UsersMiddleware.assertAuthTokenActive', () => {
+  beforeEach(() => {
+    ofMock.mockReset()
+  })
+
+  it('allows payloads without jti (legacy WebAuth)', async () => {
+    await expect(UsersMiddleware.assertAuthTokenActive({
+      type: 'WebAuth',
+      sub: 'user-1',
+    })).resolves.toEqual({ type: 'WebAuth', sub: 'user-1' })
+    expect(ofMock).not.toHaveBeenCalled()
+  })
+
+  it('allows active WebAuth tokens', async () => {
+    ofMock.mockResolvedValue({
+      events: [{ event: 'Created', resourceId: 'sess-1', payload: { type: 'WebAuth' } }],
+      state: {},
+    })
+
+    await expect(UsersMiddleware.assertAuthTokenActive({
+      type: 'WebAuth',
+      jti: 'sess-1',
+      sub: 'user-1',
+    })).resolves.toMatchObject({ jti: 'sess-1' })
+  })
+
+  it('rejects revoked WebAuth tokens with status 401', async () => {
+    ofMock.mockResolvedValue({
+      events: [
+        { event: 'Created', resourceId: 'sess-2', payload: { type: 'WebAuth' } },
+        { event: 'Revoked', payload: {} },
+      ],
+      state: {},
+    })
+
+    await expect(UsersMiddleware.assertAuthTokenActive({
+      type: 'WebAuth',
+      jti: 'sess-2',
+      sub: 'user-1',
+    })).rejects.toMatchObject({
+      message: 'Auth token revoked',
+      status: 401,
+    })
+  })
+
+  it('rejects revoked API tokens', async () => {
+    ofMock.mockResolvedValue({
+      events: [
+        { event: 'Created', resourceId: 'api-1', payload: { type: 'Api' } },
+        { event: 'Revoked', payload: {} },
+      ],
+      state: {},
+    })
+
+    await expect(UsersMiddleware.assertAuthTokenActive({
+      type: 'Api',
+      jti: 'api-1',
+      sub: 'user-1',
+    })).rejects.toMatchObject({
+      message: 'Api token revoked',
+      status: 401,
+    })
+  })
+})