SemianiakaVY/elsa-core
1
0
Fork 0
Code Issues Pull requests Actions 1 Packages Projects Releases Wiki Activity
elsa-core/src/modules
History
Sipke Schoorstra ae146a1765
fix(external-auth): make the upstream logout continuation reachable (#7979) 
ContinueLogout was unreachable and, once reached, produced no response.
Two independent defects, both of which had to be fixed for the endpoint
to work at all.

Authorization. The endpoint declared neither a permission nor
AllowAnonymous, so it inherited the FastEndpoints default and required an
authenticated caller. It cannot ever satisfy that: the broker revokes the
session before issuing the continuation handle, and the endpoint is
reached by a top-level browser navigation, which sends no Authorization
header -- the only transport Elsa authentication uses. Every other broker
endpoint the browser is navigated to is already AllowAnonymous for the
same reason. The single-use, hashed route handle carries the authority.

Response. The handler wrote to HttpContext.Response directly rather than
through the Send API, so the response never started and the FastEndpoints
auto-response overwrote the status with 204. Both branches were affected:
the redirect to the provider's end-session endpoint and the 400 for an
unknown handle were each discarded, so a caller received 204 No Content
either way. Now mirrors CompleteLogout, using Send.RedirectAsync and
BrokerEndpointSupport.SendErrorAsync.

Logout, in the same file, also relies on an inherited default, but there
the default is correct: it reads the external session id from the
principal, so it needs an identity and no permission. Left as-is with a
comment; an explicit authenticated-only declaration arrives with the
authorization model work.

Adds LogoutAuthorizationTests, which builds a host with authorization
enforced and no principal injected -- the existing broker fixture injects
one and disables endpoint security, so it could not catch either defect.
Verified failing before the change (401, then 204) and passing after.

Fixes #7976

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-23 23:53:40 +02:00
..
Elsa Remove PackageManifestCategories and update feature categories to inline strings 2026-06-08 09:48:55 +02:00
Elsa.AI.Abstractions Add Weaver grounding tools 2026-06-08 15:40:10 +02:00
Elsa.AI.Copilot Update safe dependency patch versions 2026-06-22 00:03:50 +02:00
Elsa.AI.Host Add Weaver grounding tools 2026-06-08 15:40:10 +02:00
Elsa.AI.Persistence.EFCore Move AI EF Core migrations to provider projects 2026-06-08 15:22:59 +02:00
Elsa.AI.Persistence.EFCore.MySql Move AI EF Core migrations to provider projects 2026-06-08 15:22:59 +02:00
Elsa.AI.Persistence.EFCore.Oracle Move AI EF Core migrations to provider projects 2026-06-08 15:22:59 +02:00
Elsa.AI.Persistence.EFCore.PostgreSql Move AI EF Core migrations to provider projects 2026-06-08 15:22:59 +02:00
Elsa.AI.Persistence.EFCore.Sqlite Move AI EF Core migrations to provider projects 2026-06-08 15:22:59 +02:00
Elsa.AI.Persistence.EFCore.SqlServer Move AI EF Core migrations to provider projects 2026-06-08 15:22:59 +02:00
Elsa.Alterations Remove PackageManifestCategories and update feature categories to inline strings 2026-06-08 09:48:55 +02:00
Elsa.Alterations.Core
Elsa.Bpmn feat(bpmn): adopt Bpmn.* 0.2.0, and start shipping the two BPMN modules (#7970) 2026-08-21 01:44:07 +02:00
Elsa.Bpmn.Interchange feat(bpmn): adopt Bpmn.* 0.2.0, and start shipping the two BPMN modules (#7970) 2026-08-21 01:44:07 +02:00
Elsa.Caching Remove PackageManifestCategories and update feature categories to inline strings 2026-06-08 09:48:55 +02:00
Elsa.Common Fix tenant service mutation race (#7898) 2026-07-30 02:47:44 +02:00
Elsa.Dashboard.Abstractions
Elsa.Dashboard.Api Remove PackageManifestCategories and update feature categories to inline strings 2026-06-08 09:48:55 +02:00
Elsa.Diagnostics.ConsoleLogs Remove PackageManifestCategories and update feature categories to inline strings 2026-06-08 09:48:55 +02:00
Elsa.Diagnostics.ConsoleLogs.Dashboard Remove PackageManifestCategories and update feature categories to inline strings 2026-06-08 09:48:55 +02:00
Elsa.Diagnostics.OpenTelemetry Remove PackageManifestCategories and update feature categories to inline strings 2026-06-08 09:48:55 +02:00
Elsa.Diagnostics.StructuredLogs Remove PackageManifestCategories and update feature categories to inline strings 2026-06-08 09:48:55 +02:00
Elsa.Diagnostics.StructuredLogs.Dashboard Remove PackageManifestCategories and update feature categories to inline strings 2026-06-08 09:48:55 +02:00
Elsa.Diagnostics.StructuredLogs.Persistence.Relational Remove PackageManifestCategories and update feature categories to inline strings 2026-06-08 09:48:55 +02:00
Elsa.Diagnostics.StructuredLogs.Persistence.Sqlite chore: apply safe dependency upgrades (#7896) 2026-07-26 21:42:27 +02:00
Elsa.Dsl.ElsaScript Remove PackageManifestCategories and update feature categories to inline strings 2026-06-08 09:48:55 +02:00
Elsa.Expressions Remove PackageManifestCategories and update feature categories to inline strings 2026-06-08 09:48:55 +02:00
Elsa.Expressions.CSharp Remove PackageManifestCategories and update feature categories to inline strings 2026-06-08 09:48:55 +02:00
Elsa.Expressions.JavaScript Adopt the Jint 4.15 host-integration surface: lazy type globals, enum names, and register-what-is-referenced (#7895) 2026-08-17 01:44:03 +02:00
Elsa.Expressions.JavaScript.Libraries Remove PackageManifestCategories and update feature categories to inline strings 2026-06-08 09:48:55 +02:00
Elsa.Expressions.Liquid Remove PackageManifestCategories and update feature categories to inline strings 2026-06-08 09:48:55 +02:00
Elsa.Expressions.Python Remove PackageManifestCategories and update feature categories to inline strings 2026-06-08 09:48:55 +02:00
Elsa.ExternalAuthentication fix(external-auth): make the upstream logout continuation reachable (#7979) 2026-08-23 23:53:40 +02:00
Elsa.ExternalAuthentication.OpenIdConnect Add OpenID Connect authentication features 2026-07-26 23:38:20 +02:00
Elsa.ExternalAuthentication.Persistence.EFCore Add architecture and practices documentation 2026-08-03 23:46:38 +02:00
Elsa.ExternalAuthentication.Persistence.EFCore.MySql Fix external authentication review findings 2026-08-02 03:35:39 +02:00
Elsa.ExternalAuthentication.Persistence.EFCore.Oracle Fix external authentication review findings 2026-08-02 03:35:39 +02:00
Elsa.ExternalAuthentication.Persistence.EFCore.PostgreSql Fix external authentication review findings 2026-08-02 03:35:39 +02:00
Elsa.ExternalAuthentication.Persistence.EFCore.Sqlite Fix external authentication review findings 2026-08-02 03:35:39 +02:00
Elsa.ExternalAuthentication.Persistence.EFCore.SqlServer Fix external authentication review findings 2026-08-02 03:35:39 +02:00
Elsa.ExternalAuthentication.Secrets Merge compact external authentication secret IDs 2026-08-02 00:22:29 +02:00
Elsa.Hosting.Management feat: introduce HTTP webhooks module 2026-08-03 02:08:15 +02:00
Elsa.Http Guard HTTP fault handling when workflow reload returns null (#7714) 2026-06-14 22:23:38 +02:00
Elsa.Http.Webhooks feat: introduce HTTP webhooks module 2026-08-03 02:08:15 +02:00
Elsa.Identity Harden external identity race compensation 2026-08-02 23:19:49 +02:00
Elsa.KeyValues Remove PackageManifestCategories and update feature categories to inline strings 2026-06-08 09:48:55 +02:00
Elsa.Labels Remove PackageManifestCategories and update feature categories to inline strings 2026-06-08 09:48:55 +02:00
Elsa.Persistence.EFCore Remove migration for external authentication in EFCore.Sqlite module 2026-07-31 14:31:18 +02:00
Elsa.Persistence.EFCore.Common test: cover Oracle bulk upsert SQL generation 2026-07-11 14:35:36 +02:00
Elsa.Persistence.EFCore.MySql Remove migration for external authentication in EFCore.Sqlite module 2026-07-31 14:31:18 +02:00
Elsa.Persistence.EFCore.Oracle Remove migration for external authentication in EFCore.Sqlite module 2026-07-31 14:31:18 +02:00
Elsa.Persistence.EFCore.PostgreSql Remove migration for external authentication in EFCore.Sqlite module 2026-07-31 14:31:18 +02:00
Elsa.Persistence.EFCore.Sqlite Remove migration for external authentication in EFCore.Sqlite module 2026-07-31 14:31:18 +02:00
Elsa.Persistence.EFCore.SqlServer Remove migration for external authentication in EFCore.Sqlite module 2026-07-31 14:31:18 +02:00
Elsa.Persistence.VNext
Elsa.Persistence.VNext.Extensions
Elsa.Persistence.VNext.MongoDb
Elsa.Persistence.VNext.PostgreSql
Elsa.Persistence.VNext.Relational
Elsa.Persistence.VNext.Runtime
Elsa.Persistence.VNext.Sqlite chore: apply safe dependency upgrades (#7896) 2026-07-26 21:42:27 +02:00
Elsa.Persistence.VNext.SqlServer
Elsa.Platform.Integration Add Platform integration 2026-06-18 18:27:27 +02:00
Elsa.Resilience Remove PackageManifestCategories and update feature categories to inline strings 2026-06-08 09:48:55 +02:00
Elsa.Resilience.Core
Elsa.SasTokens Remove PackageManifestCategories and update feature categories to inline strings 2026-06-08 09:48:55 +02:00
Elsa.Scheduling address greptile review feedback (greploop iteration 1) 2026-06-21 19:43:09 +02:00
Elsa.Secrets Remove PackageManifestCategories and update feature categories to inline strings 2026-06-08 09:48:55 +02:00
Elsa.Secrets.JavaScript Remove PackageManifestCategories and update feature categories to inline strings 2026-06-08 09:48:55 +02:00
Elsa.Secrets.Persistence.EFCore
Elsa.Secrets.Persistence.EFCore.MySql Remove PackageManifestCategories and update feature categories to inline strings 2026-06-08 09:48:55 +02:00
Elsa.Secrets.Persistence.EFCore.Oracle Remove PackageManifestCategories and update feature categories to inline strings 2026-06-08 09:48:55 +02:00
Elsa.Secrets.Persistence.EFCore.PostgreSql Remove PackageManifestCategories and update feature categories to inline strings 2026-06-08 09:48:55 +02:00
Elsa.Secrets.Persistence.EFCore.Sqlite Remove PackageManifestCategories and update feature categories to inline strings 2026-06-08 09:48:55 +02:00
Elsa.Secrets.Persistence.EFCore.SqlServer Remove PackageManifestCategories and update feature categories to inline strings 2026-06-08 09:48:55 +02:00
Elsa.Secrets.Persistence.VNext
Elsa.Shells.Api feat: introduce HTTP webhooks module 2026-08-03 02:08:15 +02:00
Elsa.Tenants Remove PackageManifestCategories and update feature categories to inline strings 2026-06-08 09:48:55 +02:00
Elsa.Tenants.AspNetCore Merge release/3.8.0 into bugfix/7900-tenant-request-services 2026-08-03 00:48:56 +02:00
Elsa.WorkflowProviders.BlobStorage Remove PackageManifestCategories and update feature categories to inline strings 2026-06-08 09:48:55 +02:00
Elsa.WorkflowProviders.BlobStorage.ElsaScript Remove PackageManifestCategories and update feature categories to inline strings 2026-06-08 09:48:55 +02:00
Elsa.Workflows.Api Merge release/3.8.0 into main 2026-08-14 11:59:35 +02:00
Elsa.Workflows.Core fix: stop two silent serialization and test-isolation traps (#7969) 2026-08-21 00:36:11 +02:00
Elsa.Workflows.Management Merge release/3.8.0 into main 2026-08-14 11:59:35 +02:00
Elsa.Workflows.Runtime fix: stop two silent serialization and test-isolation traps (#7969) 2026-08-21 00:36:11 +02:00
Elsa.Workflows.Runtime.Dashboard Remove PackageManifestCategories and update feature categories to inline strings 2026-06-08 09:48:55 +02:00
Elsa.Workflows.Runtime.Distributed Address workflow commit review feedback 2026-06-23 02:27:06 +02:00
Directory.Build.props Remove PackageManifestCategories and update feature categories to inline strings 2026-06-08 09:48:55 +02:00