elsa-workflows
diff --git a/‎Directory.Packages.props‎
Lines changed: 10 additions & 4 deletions b/‎Directory.Packages.props‎
Lines changed: 10 additions & 4 deletions
diff --git a/‎Elsa.Studio.sln‎
Lines changed: 381 additions & 16 deletions b/‎Elsa.Studio.sln‎
Lines changed: 381 additions & 16 deletions
diff --git a/‎doc/AUTHENTICATION_ARCHITECTURE.md‎
Lines changed: 428 additions & 0 deletions b/‎doc/AUTHENTICATION_ARCHITECTURE.md‎
Lines changed: 428 additions & 0 deletions
diff --git a/‎src/framework/Elsa.Studio.Core/Contracts/IAnonymousBackendApiClientProvider.cs‎
Lines changed: 24 additions & 0 deletions b/‎src/framework/Elsa.Studio.Core/Contracts/IAnonymousBackendApiClientProvider.cs‎
Lines changed: 24 additions & 0 deletions
diff --git a/‎src/framework/Elsa.Studio.Core/Contracts/IBackendApiClientProvider.cs‎
Lines changed: 3 additions & 1 deletion b/‎src/framework/Elsa.Studio.Core/Contracts/IBackendApiClientProvider.cs‎
Lines changed: 3 additions & 1 deletion
diff --git a/‎src/framework/Elsa.Studio.Core/Contracts/IContentVisualizer.cs‎
Lines changed: 29 additions & 28 deletions b/‎src/framework/Elsa.Studio.Core/Contracts/IContentVisualizer.cs‎
Lines changed: 29 additions & 28 deletions
diff --git a/‎src/framework/Elsa.Studio.Core/Contracts/IContentVisualizerProvider.cs‎
Lines changed: 15 additions & 16 deletions b/‎src/framework/Elsa.Studio.Core/Contracts/IContentVisualizerProvider.cs‎
Lines changed: 15 additions & 16 deletions
diff --git a/‎src/framework/Elsa.Studio.Core/Contracts/ISingleFlightCoordinator.cs‎
Lines changed: 12 additions & 0 deletions b/‎src/framework/Elsa.Studio.Core/Contracts/ISingleFlightCoordinator.cs‎
Lines changed: 12 additions & 0 deletions
diff --git a/‎src/framework/Elsa.Studio.Core/Contracts/IUIFieldExtensionHandler.cs‎
Lines changed: 44 additions & 45 deletions b/‎src/framework/Elsa.Studio.Core/Contracts/IUIFieldExtensionHandler.cs‎
Lines changed: 44 additions & 45 deletions
diff --git a/‎src/framework/Elsa.Studio.Core/Extensions/ServiceCollectionExtensions.cs‎
Lines changed: 6 additions & 2 deletions b/‎src/framework/Elsa.Studio.Core/Extensions/ServiceCollectionExtensions.cs‎
Lines changed: 6 additions & 2 deletions
@@ -4,7 +4,7 @@
     <CentralPackageTransitivePinningEnabled>false</CentralPackageTransitivePinningEnabled>
   </PropertyGroup>
   <ItemGroup Label="Elsa">
-    <PackageVersion Include="Elsa.Api.Client" Version="3.6.0-preview.4162" />
+    <PackageVersion Include="Elsa.Api.Client" Version="3.6.0-rc2" />
   </ItemGroup>
   <ItemGroup>
     <PackageVersion Include="Blazored.FluentValidation" Version="2.2.0" />
@@ -26,6 +26,7 @@
   </ItemGroup>
   <ItemGroup Condition="'$(TargetFramework)' == 'net8.0'">
     <PackageVersion Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="8.0.22" />
+    <PackageVersion Include="Microsoft.AspNetCore.Authentication.OpenIdConnect" Version="8.0.22" />
     <PackageVersion Include="Microsoft.AspNetCore.Components" Version="8.0.22" />
     <PackageVersion Include="Microsoft.AspNetCore.Components.Authorization" Version="8.0.22" />
     <PackageVersion Include="Microsoft.AspNetCore.Components.CustomElements" Version="8.0.22" />
@@ -34,13 +35,15 @@
     <PackageVersion Include="Microsoft.AspNetCore.Components.WebAssembly.Authentication" Version="8.0.22" />
     <PackageVersion Include="Microsoft.AspNetCore.Components.WebAssembly.DevServer" Version="8.0.22" PrivateAssets="all" />
     <PackageVersion Include="Microsoft.AspNetCore.Components.WebAssembly.Server" Version="8.0.22" />
-    <PackageVersion Include="Microsoft.AspNetCore.SignalR.Client" Version="8.0.22" />
-    <PackageVersion Include="Microsoft.AspNetCore.WebUtilities" Version="8.0.22" />
     <PackageVersion Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="9.0.11" />
     <PackageVersion Include="Microsoft.JSInterop" Version="8.0.22" />
+    <PackageVersion Include="Microsoft.AspNetCore.WebUtilities" Version="8.0.22" />
+    <PackageVersion Include="Microsoft.AspNetCore.SignalR.Client" Version="8.0.22" />
+    <PackageVersion Include="Microsoft.Extensions.Http.Polly" Version="9.0.11" />
   </ItemGroup>
   <ItemGroup Condition="'$(TargetFramework)' == 'net9.0'">
     <PackageVersion Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="9.0.11" />
+    <PackageVersion Include="Microsoft.AspNetCore.Authentication.OpenIdConnect" Version="9.0.11" />
     <PackageVersion Include="Microsoft.AspNetCore.Components" Version="9.0.11" />
     <PackageVersion Include="Microsoft.AspNetCore.Components.Authorization" Version="9.0.11" />
     <PackageVersion Include="Microsoft.AspNetCore.Components.CustomElements" Version="9.0.11" />
@@ -49,13 +52,15 @@
     <PackageVersion Include="Microsoft.AspNetCore.Components.WebAssembly.Authentication" Version="9.0.11" />
     <PackageVersion Include="Microsoft.AspNetCore.Components.WebAssembly.DevServer" Version="9.0.11" PrivateAssets="all" />
     <PackageVersion Include="Microsoft.AspNetCore.Components.WebAssembly.Server" Version="9.0.11" />
-    <PackageVersion Include="Microsoft.AspNetCore.SignalR.Client" Version="9.0.11" />
     <PackageVersion Include="Microsoft.AspNetCore.WebUtilities" Version="9.0.11" />
+    <PackageVersion Include="Microsoft.AspNetCore.SignalR.Client" Version="9.0.11" />
     <PackageVersion Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="9.0.11" />
     <PackageVersion Include="Microsoft.JSInterop" Version="9.0.11" />
+    <PackageVersion Include="Microsoft.Extensions.Http.Polly" Version="9.0.11" />
   </ItemGroup>
   <ItemGroup Condition="'$(TargetFramework)' == 'net10.0'">
     <PackageVersion Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.1" />
+    <PackageVersion Include="Microsoft.AspNetCore.Authentication.OpenIdConnect" Version="10.0.1" />
     <PackageVersion Include="Microsoft.AspNetCore.Components" Version="10.0.1" />
     <PackageVersion Include="Microsoft.AspNetCore.Components.Authorization" Version="10.0.1" />
     <PackageVersion Include="Microsoft.AspNetCore.Components.CustomElements" Version="10.0.1" />
@@ -68,5 +73,6 @@
     <PackageVersion Include="Microsoft.AspNetCore.WebUtilities" Version="10.0.1" />
     <PackageVersion Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="10.0.1" />
     <PackageVersion Include="Microsoft.JSInterop" Version="10.0.1" />
+    <PackageVersion Include="Microsoft.Extensions.Http.Polly" Version="10.0.1" />
   </ItemGroup>
 </Project>
@@ -0,0 +1,24 @@
+using System.Diagnostics.CodeAnalysis;
+
+namespace Elsa.Studio.Contracts;
+
+/// <summary>
+/// Provides API clients to the backend for anonymous (non-authenticated) calls.
+/// </summary>
+/// <remarks>
+/// This provider is intended for endpoints like <c>/identity/login</c> where attaching an access token is not required
+/// and can even be harmful (e.g., stale tokens, circular dependencies during sign-in).
+/// </remarks>
+public interface IAnonymousBackendApiClientProvider
+{
+    /// <summary>
+    /// Gets the URL to the backend.
+    /// </summary>
+    Uri Url { get; }
+
+    /// <summary>
+    /// Gets an API client that does not attach access tokens.
+    /// </summary>
+    /// <typeparam name="T">The API client type.</typeparam>
+    ValueTask<T> GetApiAsync<[DynamicallyAccessedMembers(DynamicallyAccessedMemberTypes.All)] T>(CancellationToken cancellationToken = default) where T : class;
+}
@@ -1,3 +1,5 @@
+using System.Diagnostics.CodeAnalysis;
+
 namespace Elsa.Studio.Contracts;
 
 /// <summary>
@@ -15,5 +17,5 @@ public interface IBackendApiClientProvider
     /// </summary>
     /// <typeparam name="T">The API client type.</typeparam>
     /// <returns>The API client.</returns>
-    ValueTask<T> GetApiAsync<T>(CancellationToken cancellationToken = default) where T : class;
+    ValueTask<T> GetApiAsync<[DynamicallyAccessedMembers(DynamicallyAccessedMemberTypes.All)] T>(CancellationToken cancellationToken = default) where T : class;
 }
@@ -1,36 +1,37 @@
-namespace Elsa.Studio.Contracts
+using Elsa.Studio.Models;
+
+namespace Elsa.Studio.Contracts;
+
+/// <summary>
+/// Defines a contract for visualizing objects into Visualized representations.
+/// </summary>
+public interface IContentVisualizer
 {
     /// <summary>
-    /// Defines a contract for visualizing objects into Visualized representations.
+    /// Gets the name of the content visualizer.
     /// </summary>
-    public interface IContentVisualizer
-    {
-        /// <summary>
-        /// Gets the name of the content visualizer.
-        /// </summary>
-        string Name { get; }
+    string Name { get; }
 
-        /// <summary>
-        /// Returns the syntax used by this visualizer.
-        /// </summary>
-        string Syntax { get; }
+    /// <summary>
+    /// Returns the syntax used by this visualizer.
+    /// </summary>
+    string Syntax { get; }
 
-        /// <summary>
-        /// Determines whether the content can be visualized with this visualizer.
-        /// </summary>
-        /// <param name="input">The object to evaluate for visualizing capability. Cannot be <see langword="null"/>.</param>
-        /// <returns><see langword="true"/> if the input can be visualized; otherwise, <see langword="false"/>.</returns>
-        bool CanVisualize(object input);
+    /// <summary>
+    /// Determines whether the content can be visualized with this visualizer.
+    /// </summary>
+    /// <param name="input">The object to evaluate for visualizing capability. Cannot be <see langword="null"/>.</param>
+    /// <returns><see langword="true"/> if the input can be visualized; otherwise, <see langword="false"/>.</returns>
+    bool CanVisualize(object input);
 
-        /// <summary>
-        /// Returns a prettified text version of the input.
-        /// </summary>
-        string? ToPretty(object input);
+    /// <summary>
+    /// Returns a prettified text version of the input.
+    /// </summary>
+    string? ToPretty(object input);
 
-        /// <summary>
-        /// Returns tabular representation of the input.
-        /// Returns <see langword="null"/> if not supported.
-        /// </summary>
-        TabulatedContentVisualizer? ToTable(object input);
-    }
+    /// <summary>
+    /// Returns tabular representation of the input.
+    /// Returns <see langword="null"/> if not supported.
+    /// </summary>
+    TabulatedContentVisualizer? ToTable(object input);
 }
@@ -1,21 +1,20 @@
-namespace Elsa.Studio.Contracts
+namespace Elsa.Studio.Contracts;
+
+/// <summary>
+/// Provides content visualizers.
+/// </summary>
+public interface IContentVisualizerProvider
 {
     /// <summary>
-    /// Provides content visualizers.
+    /// Attempts to resolve the best matching visualizer for the input.
     /// </summary>
-    public interface IContentVisualizerProvider
-    {
-        /// <summary>
-        /// Attempts to resolve the best matching visualizer for the input.
-        /// </summary>
-        /// <param name="content">The content to check visualizers against.</param>
-        /// <returns></returns>
-        IContentVisualizer MatchOrDefault(object content);
+    /// <param name="content">The content to check visualizers against.</param>
+    /// <returns></returns>
+    IContentVisualizer MatchOrDefault(object content);
 
-        /// <summary>
-        /// Returns all content visualizers.
-        /// </summary>
-        /// <returns></returns>
-        IEnumerable<IContentVisualizer> GetAll();
-    }
+    /// <summary>
+    /// Returns all content visualizers.
+    /// </summary>
+    /// <returns></returns>
+    IEnumerable<IContentVisualizer> GetAll();
 }
@@ -0,0 +1,12 @@
+namespace Elsa.Studio.Contracts;
+
+/// <summary>
+/// Coordinates operations to prevent multiple concurrent executions.
+/// </summary>
+public interface ISingleFlightCoordinator
+{
+    /// <summary>
+    /// Ensures only one operation runs at a time for the current scope.
+    /// </summary>
+    Task<T> RunAsync<T>(Func<CancellationToken, Task<T>> action, CancellationToken cancellationToken);
+}
@@ -2,51 +2,50 @@
 using Elsa.Studio.Models;
 using Microsoft.AspNetCore.Components;
 
-namespace Elsa.Studio.Contracts
+namespace Elsa.Studio.Contracts;
+
+/// <summary>
+/// Provides a contract for UI field extension handlers.
+/// </summary>
+public interface IUIFieldExtensionHandler
 {
     /// <summary>
-    /// Provides a contract for UI field extension handlers.
-    /// </summary>
-    public interface IUIFieldExtensionHandler
-    {
-        /// <summary>
-        /// The order in which the extensions should be displayed.
-        /// </summary>
-        int DisplayOrder { get; set; }
-
-        /// <summary>
-        /// If set to true and no restricting types are set, either with <c>UIHintComponent</c>, <c>ActivityTypes</c> or <c>Syntaxes</c>, this extension will be rendered for in all field types.
-        /// </summary>
-        bool IncludeForAll { get; set; }
-
-        /// <summary>
-        /// The position to render the extension within the field.
-        /// </summary>
-        FieldExtensionPosition Position { get; set; }
-
-        /// <summary>
-        /// The UIHint component this extension should be rendered for.
-        /// </summary>
-        string UIHintComponent { get; set; }
-
-        /// <summary>
-        /// The activities this extension should be rendered for.
-        /// </summary>
-        List<string> ActivityTypes { get; set; }
-
-        /// <summary>
-        /// The syntaxes this extension should be rendered for.
-        /// </summary>
-        List<string> Syntaxes { get; set; }
-
-        /// <summary>
-        /// Returns true if the handler extension the specified or is empty.
-        /// </summary>
-        bool GetExtensionForInputComponent(string componentName);
-
-        /// <summary>
-        /// Returns a <see cref="RenderFragment"/> of the added extension.
-        /// </summary>
-        RenderFragment DisplayExtension(DisplayInputEditorContext context);
-    }
+    /// The order in which the extensions should be displayed.
+    /// </summary>
+    int DisplayOrder { get; set; }
+
+    /// <summary>
+    /// If set to true and no restricting types are set, either with <c>UIHintComponent</c>, <c>ActivityTypes</c> or <c>Syntaxes</c>, this extension will be rendered for in all field types.
+    /// </summary>
+    bool IncludeForAll { get; set; }
+
+    /// <summary>
+    /// The position to render the extension within the field.
+    /// </summary>
+    FieldExtensionPosition Position { get; set; }
+
+    /// <summary>
+    /// The UIHint component this extension should be rendered for.
+    /// </summary>
+    string UIHintComponent { get; set; }
+
+    /// <summary>
+    /// The activities this extension should be rendered for.
+    /// </summary>
+    List<string> ActivityTypes { get; set; }
+
+    /// <summary>
+    /// The syntaxes this extension should be rendered for.
+    /// </summary>
+    List<string> Syntaxes { get; set; }
+
+    /// <summary>
+    /// Returns true if the handler extension the specified or is empty.
+    /// </summary>
+    bool GetExtensionForInputComponent(string componentName);
+
+    /// <summary>
+    /// Returns a <see cref="RenderFragment"/> of the added extension.
+    /// </summary>
+    RenderFragment DisplayExtension(DisplayInputEditorContext context);
 }
@@ -1,6 +1,5 @@
 using Elsa.Api.Client.Extensions;
 using Elsa.Studio.Contracts;
-using Elsa.Studio.Core.Services;
 using Elsa.Studio.Localization;
 using Elsa.Studio.Models;
 using Elsa.Studio.Services;
@@ -41,13 +40,17 @@ public static IServiceCollection AddCoreInternal(this IServiceCollection service
 
         // Content visualizers
         services.AddContentVisualizer<JsonContentVisualizer>();
-        
+
         // Mediator.
         services.AddScoped<IMediator, DefaultMediator>();
 
         //Localization
         services.AddSingleton<ILocalizationProvider, DefaultLocalizationProvider>();
         services.AddSingleton<ILocalizer, DefaultLocalizer>();
+
+        // Single-flight coordinator for preventing concurrent operations.
+        services.TryAddScoped<ISingleFlightCoordinator, SingleFlightCoordinator>();
+
         return services;
     }
 
@@ -60,6 +63,7 @@ public static IServiceCollection AddRemoteBackend(this IServiceCollection servic
         services.AddDefaultApiClients(config?.ConfigureHttpClientBuilder);
         services.TryAddScoped<IRemoteBackendAccessor, DefaultRemoteBackendAccessor>();
         services.TryAddScoped<IBackendApiClientProvider, DefaultBackendApiClientProvider>();
+        services.TryAddScoped<IAnonymousBackendApiClientProvider, DefaultAnonymousBackendApiClientProvider>();
         return services;
     }