From bc41fa995726baa2a8287b0c35f82c4c486f9185 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Mon, 14 Sep 2026 03:45:23 +0200 Subject: [PATCH] Refresh codebase wiki (#7952) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> --- doc/wiki/diagnostics-console-logs.md | 4 ++-- doc/wiki/diagnostics-structured-logs.md | 2 +- doc/wiki/identity-tenancy-security.md | 2 +- doc/wiki/repository-map.md | 3 ++- doc/wiki/specs-and-adrs.md | 27 +++++++++++++++++++++++++ 5 files changed, 33 insertions(+), 5 deletions(-) diff --git a/doc/wiki/diagnostics-console-logs.md b/doc/wiki/diagnostics-console-logs.md index b4097fa70..1206dd4b6 100644 --- a/doc/wiki/diagnostics-console-logs.md +++ b/doc/wiki/diagnostics-console-logs.md @@ -72,14 +72,14 @@ Endpoint code is under [Endpoints/ConsoleLogs](../../src/modules/Elsa.Diagnostic SignalR: -- Hub: `ConsoleLogStream.SignalR.ConsoleLogsHub` +- Hub: `ElsaConsoleLogsHub` (`Elsa.Diagnostics.ConsoleLogs.RealTime`) - Route: `/elsa/hubs/diagnostics/console-logs` - Mapping: [MapConsoleLogsHub](../../src/modules/Elsa.Diagnostics.ConsoleLogs/Extensions/EndpointRouteBuilderExtensions.cs) - App extension: [UseConsoleLogs](../../src/modules/Elsa.Diagnostics.ConsoleLogs/Extensions/ApplicationBuilderExtensions.cs) ## Authorization -All endpoints and the SignalR hub require `read:diagnostics:console-logs`, defined in [ConsoleLogsPermissions](../../src/modules/Elsa.Diagnostics.ConsoleLogs/Permissions/ConsoleLogsPermissions.cs). +All endpoints and the SignalR hub require `read:diagnostics:console-logs`, defined in [ConsoleLogsResourcePermissions](../../src/modules/Elsa.Diagnostics.ConsoleLogs/Permissions/ConsoleLogsResourcePermissions.cs). ## Safety Boundaries diff --git a/doc/wiki/diagnostics-structured-logs.md b/doc/wiki/diagnostics-structured-logs.md index 8e9b9ffd2..2d211faf9 100644 --- a/doc/wiki/diagnostics-structured-logs.md +++ b/doc/wiki/diagnostics-structured-logs.md @@ -92,7 +92,7 @@ The README states the hub is mapped at `/elsa/hubs/diagnostics/structured-logs`. ## Authorization -The endpoints require `read:diagnostics:structured-logs`, defined in [StructuredLogsPermissions](../../src/modules/Elsa.Diagnostics.StructuredLogs/Permissions/StructuredLogsPermissions.cs). The SignalR hub requires an authenticated user. +The endpoints require `read:diagnostics:structured-logs`, defined in [StructuredLogsResourcePermissions](../../src/modules/Elsa.Diagnostics.StructuredLogs/Permissions/StructuredLogsResourcePermissions.cs). The SignalR hub requires an authenticated user. ## Redaction diff --git a/doc/wiki/identity-tenancy-security.md b/doc/wiki/identity-tenancy-security.md index be95f34d4..825deaee4 100644 --- a/doc/wiki/identity-tenancy-security.md +++ b/doc/wiki/identity-tenancy-security.md @@ -148,7 +148,7 @@ Routes under `/elsa/api` (Elsa route prefix applies): | `POST /secrets/picker` | `read:secrets` | | `GET /secrets/descriptors` | `read:secrets` | -Permission constants are in [SecretsPermissions](../../src/modules/Elsa.Secrets/Permissions/SecretsPermissions.cs). +Permission constants are in [SecretsResourcePermissions](../../src/modules/Elsa.Secrets/Permissions/SecretsResourcePermissions.cs). ### Using Secrets In Workflows diff --git a/doc/wiki/repository-map.md b/doc/wiki/repository-map.md index 193a46178..7636f68e0 100644 --- a/doc/wiki/repository-map.md +++ b/doc/wiki/repository-map.md @@ -40,7 +40,8 @@ Elsa Core is organized as a large multi-project .NET solution. The repo favors s | Security and tenancy | [Elsa.Identity](../../src/modules/Elsa.Identity), [Elsa.Tenants](../../src/modules/Elsa.Tenants), [Elsa.Tenants.AspNetCore](../../src/modules/Elsa.Tenants.AspNetCore), [Elsa.SasTokens](../../src/modules/Elsa.SasTokens) | Users, applications, roles, API keys, tenants, tenant-aware routing, SAS tokens. | | External authentication | [Elsa.ExternalAuthentication](../../src/modules/Elsa.ExternalAuthentication), [Elsa.ExternalAuthentication.OpenIdConnect](../../src/modules/Elsa.ExternalAuthentication.OpenIdConnect), [Elsa.ExternalAuthentication.Secrets](../../src/modules/Elsa.ExternalAuthentication.Secrets), and EF Core provider packages (`Sqlite`, `SqlServer`, `PostgreSql`, `MySql`, `Oracle`) | Server-brokered external identity providers: Identity Provider Connections, OpenID Connect adapter, linked identity resolution, configurable unlinked-identity policies, Elsa credential issuance, and EF Core persistence. See [specs/012-external-authentication/spec.md](../../specs/012-external-authentication/spec.md). | | Secrets | [Elsa.Secrets](../../src/modules/Elsa.Secrets), [Elsa.Secrets.Persistence.EFCore](../../src/modules/Elsa.Secrets.Persistence.EFCore), [Elsa.Secrets.Persistence.VNext](../../src/modules/Elsa.Secrets.Persistence.VNext), [Elsa.Secrets.JavaScript](../../src/modules/Elsa.Secrets.JavaScript) | Named secrets with pluggable stores, extensible secret types (text, RSA key, X.509 certificate), versioning, rotation, revocation, secret resolver, management endpoints, EF Core and vNext persistence, and JavaScript expression access. | -| Diagnostics | [Elsa.Diagnostics.StructuredLogs](../../src/modules/Elsa.Diagnostics.StructuredLogs), [Relational](../../src/modules/Elsa.Diagnostics.StructuredLogs.Persistence.Relational), [Sqlite](../../src/modules/Elsa.Diagnostics.StructuredLogs.Persistence.Sqlite), [Elsa.Diagnostics.ConsoleLogs](../../src/modules/Elsa.Diagnostics.ConsoleLogs) | Structured `ILogger` capture, raw console capture, live feed, REST/SignalR endpoints, in-memory and SQLite storage. | +| Diagnostics | [Elsa.Diagnostics.StructuredLogs](../../src/modules/Elsa.Diagnostics.StructuredLogs), [Relational](../../src/modules/Elsa.Diagnostics.StructuredLogs.Persistence.Relational), [Sqlite](../../src/modules/Elsa.Diagnostics.StructuredLogs.Persistence.Sqlite), [Elsa.Diagnostics.ConsoleLogs](../../src/modules/Elsa.Diagnostics.ConsoleLogs), [Elsa.Diagnostics.OpenTelemetry](../../src/modules/Elsa.Diagnostics.OpenTelemetry) | Structured `ILogger` capture, raw console capture, live feed, REST/SignalR endpoints, in-memory and SQLite storage; OTLP ingestion backend with trace/metric/log storage, query APIs, and live streaming. | +| User Tasks | [Elsa.UserTasks](../../src/modules/Elsa.UserTasks), EF Core provider packages (`Elsa.UserTasks.Persistence.EFCore.*`), [Elsa.UserTasks.Persistence.VNext](../../src/modules/Elsa.UserTasks.Persistence.VNext) | Identity-neutral durable human-task module: workflow pause/resume for human decisions, a secure task queue, typed outcomes, participant references independent of `Elsa.Identity`. See [specs/013-user-tasks/spec.md](../../specs/013-user-tasks/spec.md). | | Shells and modular hosting | [Elsa.Shells.Api](../../src/modules/Elsa.Shells.Api), CShells-facing shell feature classes throughout modules | Runtime-configurable feature loading for modular hosts. | | Operational dashboard | [Elsa.Dashboard.Api](../../src/modules/Elsa.Dashboard.Api) | Read-only aggregate endpoints for the Studio operational dashboard: overview, trends, needs-attention findings, recent activity, and workflow hotspots. | | Application clustering | [Elsa.Hosting.Management](../../src/modules/Elsa.Hosting.Management) | Application instance naming, heartbeat-based cluster membership, and instance-aware hosted service support for multi-node deployments. | diff --git a/doc/wiki/specs-and-adrs.md b/doc/wiki/specs-and-adrs.md index bcbf168b5..843d6dc18 100644 --- a/doc/wiki/specs-and-adrs.md +++ b/doc/wiki/specs-and-adrs.md @@ -28,6 +28,22 @@ Current ADRs: | [0011](../adr/0011-output-conversion-at-binding-is-synchronous.md) | Output conversion occurs synchronously at the binding boundary. | | [0012](../adr/0012-output-converters-use-explicit-stable-identities.md) | Output converters use explicit stable identities. | | [0013](../adr/0013-output-converter-discovery-is-server-owned.md) | Output converter discovery is server-owned. | +| [0014](../adr/0014-broker-external-sign-in-through-elsa-server.md) | Broker external sign-in through Elsa Server. | +| [0015](../adr/0015-compose-a-scoped-connection-registry.md) | Compose a scoped connection registry. (Partially superseded by 0021.) | +| [0016](../adr/0016-extend-authentication-through-deployed-descriptor-providers.md) | Extend authentication through deployed descriptor providers. (V1 permission portion superseded by 0022.) | +| [0017](../adr/0017-separate-external-identity-from-elsa-authorization.md) | Separate external identity from Elsa authorization. (V1 permission-mapping portion superseded by 0022.) | +| [0018](../adr/0018-separate-provider-trust-from-broker-invariants.md) | Separate provider trust from broker invariants. (Manual endpoint portion superseded by 0024.) | +| [0019](../adr/0019-bind-sessions-to-shared-state-and-connection-revisions.md) | Bind sessions to shared state and connection revisions. (Connection identity portion superseded by 0021.) | +| [0020](../adr/0020-publish-audit-ready-security-notifications.md) | Publish audit-ready security notifications through `INotificationSender`. | +| [0021](../adr/0021-identify-host-connections-by-logical-key-and-use-explicit-overrides.md) | Identify host connections by logical key and use explicit overrides. (Supersedes scope/source portions of 0015.) | +| [0022](../adr/0022-match-unlinked-identities-with-trusted-user-matchers.md) | Match unlinked identities with trusted user matchers. (Supersedes v1 permission-mapping from 0017.) | +| [0023](../adr/0023-separate-authentication-ui-composition-from-security-administration.md) | Separate authentication UI composition from security administration. | +| [0024](../adr/0024-use-exact-oidc-discovery-and-deployment-derived-callbacks.md) | Use exact OIDC discovery and deployment-derived callbacks. (Refines 0018.) | +| [0025](../adr/0025-two-axis-authorization-model.md) | Two-axis authorization model with open resources and open verbs. | +| [0026](../adr/0026-identity-neutral-user-task-participants.md) | Use identity-neutral participant references for User Tasks. | +| [0027](../adr/0027-project-user-tasks-from-committed-bookmarks.md) | Project User Tasks from committed workflow bookmarks. | + +> **Note on naming:** ADRs 0001–0027 use sequential integer prefixes. New ADRs added after 2026-08-25 use a `YYYY-MM-DD-` date prefix instead (see [2026-08-25-date-prefixed-adr-identifiers](../adr/2026-08-25-date-prefixed-adr-identifiers.md)) to avoid sequential numbering collisions on parallel branches. ## Active And Recent Specs @@ -49,6 +65,8 @@ Current ADRs: | [012 output converters](../../specs/012-output-converters/spec.md) | Workflow core | Extensible, explicitly-identified output converters that transform an activity's native output at the binding boundary before writing the destination variable or workflow output. | | [012 external authentication](../../specs/012-external-authentication/spec.md) | Security | Server-brokered external identity providers: Identity Provider Connections, OpenID Connect adapter, linked identity resolution, configurable unlinked-identity policies, and EF Core persistence across all providers. | | [012 weaver grounding tools](../../specs/012-weaver-grounding-tools/spec.md) | AI | Grounds Weaver in real Elsa server data: activity registry discovery, workflow definition inspection, instance and incident investigation, and proposal-based workflow authoring with validation. | +| [013 user tasks](../../specs/013-user-tasks/spec.md) | Workflow core | Identity-neutral durable human-task module: workflow pause/resume for human decisions, a secure task queue, typed outcomes, and a task workbench. No dependency on `Elsa.Identity`. | +| [013 RBAC authorization model](../../specs/013-rbac-authorization-model/spec.md) | Security | Structured role-based access-control model on top of the two-axis permission system (ADR 0025). Status: Draft — pending approval. | Each spec folder usually contains: @@ -131,6 +149,15 @@ For runtime behavior, read in this order: 5. `Elsa.ExternalAuthentication.OpenIdConnect` adapter 6. `Elsa.ExternalAuthentication.Persistence.EFCore` and provider packages +## Reading Order For User Tasks Work + +1. [specs/013-user-tasks/spec.md](../../specs/013-user-tasks/spec.md) +2. [specs/013-user-tasks/plan.md](../../specs/013-user-tasks/plan.md) +3. [ADR 0026](../adr/0026-identity-neutral-user-task-participants.md) — identity-neutral participant references +4. [ADR 0027](../adr/0027-project-user-tasks-from-committed-bookmarks.md) — bookmark-projection model +5. `Elsa.UserTasks` feature, contracts, and stores +6. `Elsa.UserTasks.Persistence.EFCore` and vNext persistence packages + ## Reading Order For BPMN Work 1. [bpmn-workflows.md](bpmn-workflows.md)