Sipke Schoorstra e2e00ff235

* Add secrets module

* Address Greptile feedback for secrets module

* Handle unavailable secrets in provider adapter

* Address path combine review comments

* Address additional Greptile secrets review

* Address final Greptile secrets feedback

* Handle secrets test payload failures

* address greptile feedback on secrets rotation

* fix secret recreation concurrency

* address greptile secrets followups

* address greptile secrets reliability feedback

* align secret store capabilities

2026-05-20 11:48:01 +02:00

2.2 KiB

Raw Blame History

Quickstart: Secrets Module

Configure the module

services.AddElsa(elsa =>
{
    elsa.UseSecrets(secrets =>
    {
        secrets.ConfigureOptions = options => options.ConfigurationSectionName = "Elsa:Secrets";
    });
});

The v1 Core/server feature provides:

Elsa-managed encrypted store.
Configuration-backed read-only store.
Metadata-only management APIs.
Runtime latest-active resolution by immutable technical name.
Studio management and picker UX in the paired elsa-studio module.

Reference a secret from workflow or module settings

Workflow definitions and module settings store a secret reference, not a value:

{
  "technicalName": "orders-db-connection",
  "requiredType": "Text",
  "requiredScope": "ConnectionString"
}

At runtime, callers resolve the latest active version:

var secret = await secretResolver.ResolveAsync(new SecretReference
{
    TechnicalName = "orders-db-connection",
    RequiredType = "Text",
    RequiredScope = "ConnectionString"
}, cancellationToken);

Configure read-only secrets

{
  "Elsa": {
    "Secrets": {
      "orders-db-connection": "Host=localhost;Database=orders;Username=elsa;Password=..."
    }
  }
}

Configuration-backed secrets can be selected and resolved, but not rotated or deleted through Elsa.

Security rules

Technical names are immutable.
Current cleartext values cannot be revealed after creation.
General API responses are metadata-only.
Tests and audit events never contain raw values.
Import conflicts require explicit create-new, update/rotate, or skip behavior.

Studio

services.AddSecretsModule(backendApiConfig);

The Studio module adds /security/secrets for management plus a reusable SecretPicker component for sensitive editors.

Validation

Run targeted checks after implementation:

dotnet build src/modules/Elsa.Secrets/Elsa.Secrets.csproj
dotnet test test/unit/Elsa.Secrets.UnitTests/Elsa.Secrets.UnitTests.csproj
dotnet build /Users/sipke/.codex/worktrees/ae40/elsa-studio/src/modules/Elsa.Studio.Secrets/Elsa.Studio.Secrets.csproj

2.2 KiB Raw Blame History