* docs(013): reconcile RBAC and User Tasks task lists with the shipped code
The checkboxes in both task lists had gone stale: the authorization-model work
landed across many concurrent sessions without the lists being updated, leaving
specs/013-rbac-authorization-model/tasks.md reading 65 open / 6 done while the
migration was in fact complete across 17 modules and 155 endpoint files.
Every open task was re-verified against the working tree at origin/main. 56 were
confirmed complete and are now ticked; the 22 that remain open carry an inline
note naming the missing evidence, so the next reader can tell a real gap from
unticked bookkeeping. Two tasks landed in a different shape than specified
(the coverage gate as a shared per-assembly helper, the permission stamp as a
calculator rather than persisted state) and say so rather than being ticked
silently.
Verified by inspection, not by a full build; T063 stays open for that reason.
Docs only -- no code changes.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* docs(013): resolve contradictions between task ticks and verification notes
Greptile flagged two entries whose task status and verification note disagreed.
Both were real, and they needed opposite fixes.
T017 is reverted to unchecked: the reconciler exists, but no test exercises its
repair logic, and this list's stated bar is that a checked item is exercised by
an automated test. The earlier tick was verified against implementation alone.
T041 stays checked and its verification note is corrected instead. The note
claimed coverage was EF Core/SQLite only and the shared suite unwritten; the
suite in fact spans in-memory, EF Core (SQLite, SQL Server, PostgreSQL, Oracle)
and VNext, with ConformanceCoverageTests failing the run when a provider
silently skips. MySQL remains genuinely uncovered and is now named as such.
Also splits the combined T053/T055 note, since T053's suites were run on
2026-08-27 while the solution-wide build in T055 has not been.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* docs(013): narrow T041 to the coverage that actually exists
Greptile flagged that T041 names SQLite restart and index tests alongside the
shared conformance suite, and that the repository has neither. Confirmed: there
is no restart or reopen test anywhere in the User Tasks persistence suites, and
the only "index" match is a List.FindIndex call.
T041 is therefore reverted to unchecked and recorded as partially done. The
verification note now states precisely what exists -- shared conformance across
in-memory, EF Core (SQLite, SQL Server, PostgreSQL, Oracle) and VNext, plus
tenant and cursor coverage -- and what does not.
This is the same over-tick as T017 in the previous commit: both were verified
against part of the task's wording rather than all of it.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* docs(013): record T042 as partially done — localhost bootstrap still legacy
Third over-tick found in this reconciliation, and this one hides a live defect.
T042 names LocalHostPermissionRequirement among the sites to update. Its
BootstrapPermissions list still holds the legacy strings "create:application",
"create:user" and "create:role". All three endpoints it exists to unlock now
declare structured permissions (identity/applications:create,
identity/users:create, identity/roles:create), and a legacy string parses to a
different (resource, verb) pair entirely -- "create:user" reads as resource
"create", verb "user". So the localhost bootstrap grant injects claims that
authorize none of the endpoints it was meant to open.
Recorded here rather than fixed, because this list is documentation; the repair
belongs in its own change against Elsa.Api.Common.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Re-authors the nine User Tasks permissions as verbs on the user-tasks and
user-tasks/participants resources with a descriptor provider, replacing the
legacy verb:resource strings (UserTasksPermissions is removed along with the
other legacy constant classes). All 17 endpoints declare access through
RequirePermission, and UserTaskActor.HasPermission matches through
PermissionMatcher instead of string equality, so pattern grants reach these
endpoints for the first time. manage:user-tasks becomes user-tasks:supervise
to reflect that it grants oversight, not an aggregate. The migration guide
and contract specs carry the full mapping.
BREAKING CHANGE: legacy user-tasks permission strings no longer authorize
anything. Rewrite grants using the mapping table in
doc/migrations/authorization-model.md.
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Adds durable, identity-neutral, workflow-bound human tasks, and reconciles the
REST surface with the approved Studio contract.
- Flat summary/detail DTOs, a global capability descriptor, and workflow context
captured at activation.
- Scope is part of the list authorization predicate; manager decisions require
manage:user-tasks; a denied command answers 404 so it cannot prove a task exists.
- Guest sessions are task-scoped, action-allowlisted, and revoked when the task
closes. Invitations resolve by token hash through the repository, wait in a
Data Protection encrypted outbox, and are rate limited per caller.
- Masked form values are disclosed only through an audited reveal command.
- Store-specific concurrency failures are translated into a single
UserTaskRevisionConflictException, so a concurrent edit returns the documented
revision-conflict result behind any provider instead of a 500.
EF Core (SQLite, SQL Server, PostgreSQL, MySQL, Oracle) and VNext persistence,
hosted due/reconciliation/delivery workers, docs, and 49 tests.
Note: this branch also carries two commits inherited from its branch point that
are not part of User Tasks and are squashed in here — the revert-version
allocation change from #7917 (WorkflowDefinitionPublisher.RevertVersionAsync now
allocates from the last version rather than the latest) and an NU1903 package
pin. Merged deliberately rather than rebased out.
