Sipke Schoorstra ffff359756

feat(user-tasks): add identity-neutral workflow-bound human tasks (#7955 )

Adds durable, identity-neutral, workflow-bound human tasks, and reconciles the
REST surface with the approved Studio contract.

- Flat summary/detail DTOs, a global capability descriptor, and workflow context
  captured at activation.
- Scope is part of the list authorization predicate; manager decisions require
  manage:user-tasks; a denied command answers 404 so it cannot prove a task exists.
- Guest sessions are task-scoped, action-allowlisted, and revoked when the task
  closes. Invitations resolve by token hash through the repository, wait in a
  Data Protection encrypted outbox, and are rate limited per caller.
- Masked form values are disclosed only through an audited reveal command.
- Store-specific concurrency failures are translated into a single
  UserTaskRevisionConflictException, so a concurrent edit returns the documented
  revision-conflict result behind any provider instead of a 500.

EF Core (SQLite, SQL Server, PostgreSQL, MySQL, Oracle) and VNext persistence,
hosted due/reconciliation/delivery workers, docs, and 49 tests.

Note: this branch also carries two commits inherited from its branch point that
are not part of User Tasks and are squashed in here — the revert-version
allocation change from #7917 (WorkflowDefinitionPublisher.RevertVersionAsync now
allocates from the last version rather than the latest) and an NU1903 package
pin. Merged deliberately rather than rebased out.

2026-08-25 00:09:06 +02:00

1.5 KiB

Raw Blame History

27. Project User Tasks from committed workflow bookmarks

Date: 2026-08-17

Status

Accepted

Context

A User Task must both suspend workflow execution durably and support efficient task-inbox queries. Writing a bookmark and a separate task store as an uncoordinated dual write can leave an invisible suspended workflow or an orphan task. Making the task table the workflow source of truth would bypass Elsa's established bookmark execution semantics.

Decision

The User Task activity creates a dedicated bookmark whose payload contains the materialized task definition. After the workflow commit succeeds, a projector idempotently creates the task record from the committed bookmark. Terminal task operations persist an idempotent transitional operation and asynchronously resume the bookmark with a dedicated stimulus. Bookmark removal finalizes the task.

A bounded, multi-node-safe reconciler scans committed User Task bookmarks and task operations to recreate missed projections, retry stale terminal delivery, and diagnose or finalize orphan records. Materialization key, bookmark ID, expected revision, and operation ID provide uniqueness and race control.

Consequences

Workflow state remains authoritative for suspension and resumption, while the task store can be indexed independently for secure queues. Task availability may be briefly eventually consistent after workflow commit, and the module must operate a projector, operation outbox, and reconciler. Every provider must preserve the same idempotency and compare-and-swap guarantees.

1.5 KiB Raw Blame History