ffff359756
Adds durable, identity-neutral, workflow-bound human tasks, and reconciles the REST surface with the approved Studio contract. - Flat summary/detail DTOs, a global capability descriptor, and workflow context captured at activation. - Scope is part of the list authorization predicate; manager decisions require manage:user-tasks; a denied command answers 404 so it cannot prove a task exists. - Guest sessions are task-scoped, action-allowlisted, and revoked when the task closes. Invitations resolve by token hash through the repository, wait in a Data Protection encrypted outbox, and are rate limited per caller. - Masked form values are disclosed only through an audited reveal command. - Store-specific concurrency failures are translated into a single UserTaskRevisionConflictException, so a concurrent edit returns the documented revision-conflict result behind any provider instead of a 500. EF Core (SQLite, SQL Server, PostgreSQL, MySQL, Oracle) and VNext persistence, hosted due/reconciliation/delivery workers, docs, and 49 tests. Note: this branch also carries two commits inherited from its branch point that are not part of User Tasks and are squashed in here — the revert-version allocation change from #7917 (WorkflowDefinitionPublisher.RevertVersionAsync now allocates from the last version rather than the latest) and an NU1903 package pin. Merged deliberately rather than rebased out.
741 B
741 B
Accessibility Checklist
- A11Y001 Queue and detail actions are keyboard operable.
- A11Y002 Status, health, priority, and overdue state do not rely on color alone.
- A11Y003 Desktop split view has a route-equivalent narrow/mobile detail experience.
- A11Y004 Loading, empty, error, conflict, and asynchronous accepted states have announced text.
- A11Y005 Forms preserve provider labels, descriptions, validation messages, and focus management.
- A11Y006 Claim/release/complete/reassign controls expose names and disabled reasons.
- A11Y007 Realtime invalidations do not unexpectedly move focus or replace in-progress input.
- A11Y008 Guest verification reveals generic but actionable accessible feedback.