Apply a default sign-out flow automatically instead of an enable toggle#4332
Merged
ThaminduDilshan merged 1 commit intoJul 24, 2026
Merged
Conversation
madurangasiriwardena
requested review from
DonOmalVindula,
ThaminduDilshan,
ayeshajay,
brionmario,
darshanasbg,
jeradrutnam,
rajithacharith and
thiva-k
as code owners
July 24, 2026 12:29
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (31)
💤 Files with no reviewable changes (11)
🚧 Files skipped from review as they are similar to previous changes (17)
📝 WalkthroughWalkthroughThe sign-out enablement boolean is replaced with explicit sign-out flow identifiers. Default sign-out flow resolution, database persistence, application mappings, deployment configuration, flow execution, integration payloads, and Console flow selection are updated. ChangesSign-out flow migration
Estimated code review effort: 3 (Moderate) | ~30 minutes Sequence Diagram(s)sequenceDiagram
participant Application
participant InboundClientService
participant FlowMetaService
participant FlowExecutor
Application->>InboundClientService: Submit application with SignOutFlowID or handle
InboundClientService->>FlowMetaService: Resolve configured default handle when needed
FlowMetaService-->>InboundClientService: Return sign-out flow ID
InboundClientService-->>Application: Store and return sign-out flow configuration
Application->>FlowExecutor: Request sign-out flow graph
FlowExecutor-->>Application: Return configured graph or configuration error
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 Trivy (0.72.0)Trivy execution failed: 2026-07-24T16:54:07Z FATAL Fatal error run error: fs scan error: scan error: scan failed: failed analysis: post analysis error: post analysis error: helm scan error: fs filter error: fs filter error: walk error range error: stat frontend/apps/console/doctor.config.json: no such file or directory: range error: stat frontend/apps/console/doctor.config.json: no such file or directory 🔧 ESLint
docs/content/deployment/configuration.mdxESLint skipped: missing config or dependency (missing-dependency). The ESLint configuration references a package that is not available in the sandbox. frontend/apps/console/src/features/applications/components/edit-application/flows-settings/SignOutFlowSection.tsxESLint skipped: missing config or dependency (missing-dependency). The ESLint configuration references a package that is not available in the sandbox. frontend/apps/console/src/features/applications/components/edit-application/flows-settings/__tests__/SignOutFlowSection.test.tsxESLint skipped: the ESLint configuration for this file references a package that is not available in the sandbox.
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
madurangasiriwardena
added
the
trigger-pr-builder
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
backend/cmd/server/bootstrap/01-default-resources.yaml (1)
4990-4991: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winRemove the obsolete sign-out enablement field.
The PR removes
isSignOutFlowEnabledfrom declarative resources, but this change keeps it and sets it tofalse. Remove the field entirely; otherwise bootstrap import may reject the removed attribute or preserve the old disabled behavior instead of resolvingdefault-flow.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@backend/cmd/server/bootstrap/01-default-resources.yaml` around lines 4990 - 4991, Remove the obsolete sign-out enablement field from the default resource definition near signOutFlowId and recoveryFlowId. Do not retain it with a false value; leave signOutFlowId and recoveryFlowId unchanged so bootstrap uses the current default-flow behavior.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@backend/internal/flow/flowexec/service.go`:
- Around line 683-687: Update the sign-out handling in the flow execution path
so a missing client.SignOutFlowID is resolved through DefaultSignOutFlowHandle,
using the shared read-path resolver if available, before returning an error.
Preserve the existing error response only when neither the persisted sign-out
flow nor the configured default can be resolved.
In
`@install/openchoreo/thunderid-oc-resourcetype/templates/thunderid-resourcetype.yaml`:
- Around line 191-195: Update the defaultSignOutFlowHandle schema definition and
its corresponding occurrences so omitting the property preserves the server
default instead of rendering an empty default_signout_flow_handle value. Remove
the empty-string schema default while keeping the property optional and
retaining the existing behavior for explicitly provided handles.
---
Outside diff comments:
In `@backend/cmd/server/bootstrap/01-default-resources.yaml`:
- Around line 4990-4991: Remove the obsolete sign-out enablement field from the
default resource definition near signOutFlowId and recoveryFlowId. Do not retain
it with a false value; leave signOutFlowId and recoveryFlowId unchanged so
bootstrap uses the current default-flow behavior.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: d39518c9-6472-4a8a-93bd-90d156982498
📒 Files selected for processing (30)
backend/cmd/server/bootstrap/01-default-resources.yamlbackend/cmd/server/config/default.jsonbackend/dbscripts/configdb/postgres.sqlbackend/dbscripts/configdb/sqlite.sqlbackend/internal/actorprovider/utils.gobackend/internal/actorprovider/utils_test.gobackend/internal/application/declarative_resource.gobackend/internal/application/handler.gobackend/internal/application/model/application.gobackend/internal/application/service.gobackend/internal/flow/flowexec/error_constants.gobackend/internal/flow/flowexec/service.gobackend/internal/inboundclient/service.gobackend/internal/inboundclient/service_test.gobackend/internal/inboundclient/store.gobackend/internal/inboundclient/store_constants.gobackend/internal/system/i18n/core/defaults.gobackend/internal/system/importer/service.gobackend/pkg/thunderidengine/config/config.gobackend/pkg/thunderidengine/providers/model.godocs/content/deployment/configuration.mdxfrontend/apps/console/src/features/applications/components/edit-application/flows-settings/SignOutFlowSection.tsxfrontend/apps/console/src/features/applications/components/edit-application/flows-settings/__tests__/SignOutFlowSection.test.tsxfrontend/apps/console/src/features/applications/models/application.tsfrontend/packages/i18n/src/locales/en-US.tsinstall/helm/conf/deployment.yamlinstall/helm/values.yamlinstall/openchoreo/thunderid-oc-resourcetype/samples/resource.yamlinstall/openchoreo/thunderid-oc-resourcetype/templates/thunderid-resourcetype.yamltests/integration/oauth/sso/suite_test.go
💤 Files with no reviewable changes (12)
- backend/dbscripts/configdb/sqlite.sql
- frontend/apps/console/src/features/applications/models/application.ts
- tests/integration/oauth/sso/suite_test.go
- backend/dbscripts/configdb/postgres.sql
- backend/internal/system/importer/service.go
- backend/internal/flow/flowexec/error_constants.go
- backend/internal/application/declarative_resource.go
- backend/internal/system/i18n/core/defaults.go
- backend/internal/application/handler.go
- backend/internal/application/service.go
- backend/internal/application/model/application.go
- backend/pkg/thunderidengine/providers/model.go
Comment on lines
+191
to
+195
| # Handle of the flow used when an application does not pin its | ||
| # own signOutFlowId. Empty inherits the server default. | ||
| defaultSignOutFlowHandle: | ||
| type: string | ||
| default: "" |
Contributor
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Preserve the default sign-out flow handle.
The empty schema default is rendered as default_signout_flow_handle: "", overriding the server default of default-flow. Default OpenChoreo deployments will therefore look up an empty handle when an application has no explicit sign-out flow.
Proposed fix
defaultSignOutFlowHandle:
type: string
- default: ""
+ default: "default-flow"Also applies to: 474-474, 594-594
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@install/openchoreo/thunderid-oc-resourcetype/templates/thunderid-resourcetype.yaml`
around lines 191 - 195, Update the defaultSignOutFlowHandle schema definition
and its corresponding occurrences so omitting the property preserves the server
default instead of rendering an empty default_signout_flow_handle value. Remove
the empty-string schema default while keeping the property optional and
retaining the existing behavior for explicitly provided handles.
Member
There was a problem hiding this comment.
Is this true? default auth flow also follows the same pattern right?
Contributor
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '%s\n' '== Candidate configuration and resolution files =='
fd -t f -a 'config\.go|default\.json|service\.go' backend | sed -n '1,160p'
printf '%s\n' '== Flow-handle declarations, assignments, and defaults =='
rg -n -C 4 'Default(Auth|SignOut)FlowHandle|default_(auth|signout)_flow_handle' \
backend install/openchoreo/thunderid-oc-resourcetype/templates/thunderid-resourcetype.yaml
printf '%s\n' '== Configuration unmarshalling/merge paths =='
rg -n -C 5 'Unmarshal|Merge|default\.json|deployment\.yaml|ReadInConfig|LoadConfig|Load.*Config' \
backend --glob '*.go' --glob '!**/*_test.go' | sed -n '1,260p'Length of output: 42578
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '%s\n' '== Locate LoadConfig implementation =='
rg -n -C 8 'func LoadConfig\s*\(' backend --glob '*.go'
printf '%s\n' '== Configuration-loader tests and deployment/default precedence assertions =='
rg -n -C 6 'LoadConfig\s*\(|defaultConfigPath|configFilePath|deployment\.yaml|default\.json' \
backend --glob '*_test.go' | sed -n '1,260p'Length of output: 24200
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '%s\n' '== LoadConfig implementation =='
sed -n '612,700p' backend/internal/system/config/config.go
printf '%s\n' '== Merge helper definitions and use sites =='
rg -n -C 8 'func .*([Mm]erge|[Oo]verride)|[Mm]erge[A-Za-z]*\(' \
backend/internal/system/config --glob '*.go' | sed -n '1,320p'
printf '%s\n' '== FlowConfig merge-specific tests =='
rg -n -C 8 'DefaultAuthFlowHandle|DefaultSignOutFlowHandle|default_auth_flow_handle|default_signout_flow_handle' \
backend/internal/system/config --glob '*_test.go'Length of output: 30305
@ThaminduDilshan Yes, defaultAuthFlowHandle follows the same pattern, and that shows the finding is not valid.
Although the OpenChoreo template renders both parameters as "", LoadConfig merges only non-zero user values over default.json. Since "" is the zero value for these string fields, both retain the server defaults:
"default_auth_flow_handle": "default-flow",
"default_signout_flow_handle": "default-flow"So omitting runtime.defaultSignOutFlowHandle still results in default-flow; no schema-default change is needed. I’m withdrawing the review comment.
rajithacharith
added
trigger-pr-builder
Codecov Report❌ Patch coverage is
📢 Thoughts on this report? Let us know! |
madurangasiriwardena
force-pushed
the
default-signout-flow
branch
from
July 24, 2026 13:23
27ea0c9 to
bc1f7a2
Compare
madurangasiriwardena
removed
the
trigger-pr-builder
madurangasiriwardena
force-pushed
the
default-signout-flow
branch
from
July 24, 2026 13:34
bc1f7a2 to
4d7e0f4
Compare
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@backend/internal/inboundclient/service_test.go`:
- Line 1564: Restore the shared configuration mutated by the tests at each
affected assignment of DefaultSignOutFlowHandle. In each test, capture the
original value from
sysconfig.GetServerRuntime().Config.Flow.DefaultSignOutFlowHandle before setting
it, then register suite.T().Cleanup to restore that value after the test; apply
this consistently to all three affected tests.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 111b155c-fc7b-417d-9ea2-929220d4d94d
📒 Files selected for processing (36)
backend/cmd/server/bootstrap/01-default-resources.yamlbackend/cmd/server/config/default.jsonbackend/dbscripts/configdb/postgres.sqlbackend/dbscripts/configdb/sqlite.sqlbackend/internal/actorprovider/utils.gobackend/internal/actorprovider/utils_test.gobackend/internal/application/declarative_resource.gobackend/internal/application/handler.gobackend/internal/application/model/application.gobackend/internal/application/service.gobackend/internal/flow/flowexec/error_constants.gobackend/internal/flow/flowexec/service.gobackend/internal/flow/flowexec/service_test.gobackend/internal/inboundclient/service.gobackend/internal/inboundclient/service_test.gobackend/internal/inboundclient/store.gobackend/internal/inboundclient/store_constants.gobackend/internal/system/i18n/core/defaults.gobackend/internal/system/importer/service.gobackend/pkg/thunderidengine/config/config.gobackend/pkg/thunderidengine/providers/model.godocs/content/deployment/configuration.mdxfrontend/apps/console/src/features/applications/components/edit-application/flows-settings/SignOutFlowSection.tsxfrontend/apps/console/src/features/applications/components/edit-application/flows-settings/__tests__/SignOutFlowSection.test.tsxfrontend/apps/console/src/features/applications/models/application.tsfrontend/packages/i18n/src/locales/en-US.tsinstall/helm/conf/deployment.yamlinstall/helm/values.yamlinstall/openchoreo/thunderid-oc-resourcetype/samples/resource.yamlinstall/openchoreo/thunderid-oc-resourcetype/templates/thunderid-resourcetype.yamltests/integration/oauth/sso/suite_test.gotests/integration/resources/declarative_resources/agents/agent-declarative-1.yamltests/integration/resources/declarative_resources/agents/agent-declarative-confidential.yamltests/integration/resources/declarative_resources/applications/app-declarative-1.yamltests/integration/resources/declarative_resources/applications/app-declarative-confidential.yamltests/integration/resources/declarative_resources/flows/flow-declarative-signout-1.yaml
💤 Files with no reviewable changes (12)
- frontend/apps/console/src/features/applications/models/application.ts
- backend/internal/system/i18n/core/defaults.go
- backend/internal/application/declarative_resource.go
- backend/internal/application/model/application.go
- backend/dbscripts/configdb/postgres.sql
- backend/internal/flow/flowexec/error_constants.go
- tests/integration/oauth/sso/suite_test.go
- backend/internal/system/importer/service.go
- backend/dbscripts/configdb/sqlite.sql
- backend/internal/application/handler.go
- backend/pkg/thunderidengine/providers/model.go
- backend/internal/application/service.go
🚧 Files skipped from review as they are similar to previous changes (16)
- frontend/packages/i18n/src/locales/en-US.ts
- install/openchoreo/thunderid-oc-resourcetype/samples/resource.yaml
- install/helm/values.yaml
- install/helm/conf/deployment.yaml
- docs/content/deployment/configuration.mdx
- backend/cmd/server/config/default.json
- backend/internal/flow/flowexec/service.go
- backend/internal/inboundclient/store_constants.go
- install/openchoreo/thunderid-oc-resourcetype/templates/thunderid-resourcetype.yaml
- backend/internal/actorprovider/utils.go
- backend/internal/actorprovider/utils_test.go
- backend/cmd/server/bootstrap/01-default-resources.yaml
- backend/internal/inboundclient/service.go
- backend/internal/inboundclient/store.go
- frontend/apps/console/src/features/applications/components/edit-application/flows-settings/SignOutFlowSection.tsx
- frontend/apps/console/src/features/applications/components/edit-application/flows-settings/tests/SignOutFlowSection.test.tsx
madurangasiriwardena
force-pushed
the
default-signout-flow
branch
2 times, most recently
from
July 24, 2026 13:59
f93a3f6 to
ad36092
Compare
madurangasiriwardena
added
the
trigger-pr-builder
madurangasiriwardena
force-pushed
the
default-signout-flow
branch
2 times, most recently
from
July 24, 2026 14:15
909bb81 to
accdfa1
Compare
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
backend/internal/inboundclient/service.go (1)
1666-1667: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winUpdate the stale reconciliation comment.
The comment above this branch still says sign-out forces the enable flag to false, but that flag is no longer modified here. Restrict the comment to registration and recovery, or remove the obsolete sign-out wording.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@backend/internal/inboundclient/service.go` around lines 1666 - 1667, Update the comment above the branch assigning SignOutFlowID in the reconciliation logic to remove the obsolete claim that sign-out forces the enable flag to false; limit the comment to registration and recovery behavior, or remove it if no longer needed.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@backend/internal/inboundclient/service.go`:
- Around line 628-640: Update the GetFlowByHandle error handling in the default
sign-out flow lookup to ignore only NOT_FOUND errors, while continuing to map
server errors to ErrFKFlowServerError. Return ErrFKFlowDefinitionRetrievalFailed
for all other retrieval errors, and preserve the existing successful flow.ID
assignment and optional missing-flow behavior.
---
Outside diff comments:
In `@backend/internal/inboundclient/service.go`:
- Around line 1666-1667: Update the comment above the branch assigning
SignOutFlowID in the reconciliation logic to remove the obsolete claim that
sign-out forces the enable flag to false; limit the comment to registration and
recovery behavior, or remove it if no longer needed.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 574224ad-e9cf-4747-bff7-8806fae9c78c
📒 Files selected for processing (31)
backend/cmd/server/bootstrap/01-default-resources.yamlbackend/cmd/server/config/default.jsonbackend/dbscripts/configdb/postgres.sqlbackend/dbscripts/configdb/sqlite.sqlbackend/internal/actorprovider/utils.gobackend/internal/actorprovider/utils_test.gobackend/internal/application/declarative_resource.gobackend/internal/application/handler.gobackend/internal/application/model/application.gobackend/internal/application/service.gobackend/internal/flow/flowexec/error_constants.gobackend/internal/flow/flowexec/service.gobackend/internal/flow/flowexec/service_test.gobackend/internal/inboundclient/service.gobackend/internal/inboundclient/service_test.gobackend/internal/inboundclient/store.gobackend/internal/inboundclient/store_constants.gobackend/internal/system/i18n/core/defaults.gobackend/internal/system/importer/service.gobackend/pkg/thunderidengine/config/config.gobackend/pkg/thunderidengine/providers/model.godocs/content/deployment/configuration.mdxfrontend/apps/console/src/features/applications/components/edit-application/flows-settings/SignOutFlowSection.tsxfrontend/apps/console/src/features/applications/components/edit-application/flows-settings/__tests__/SignOutFlowSection.test.tsxfrontend/apps/console/src/features/applications/models/application.tsfrontend/packages/i18n/src/locales/en-US.tsinstall/helm/conf/deployment.yamlinstall/helm/values.yamlinstall/openchoreo/thunderid-oc-resourcetype/samples/resource.yamlinstall/openchoreo/thunderid-oc-resourcetype/templates/thunderid-resourcetype.yamltests/integration/oauth/sso/suite_test.go
💤 Files with no reviewable changes (12)
- frontend/apps/console/src/features/applications/models/application.ts
- backend/dbscripts/configdb/sqlite.sql
- backend/internal/system/i18n/core/defaults.go
- backend/internal/application/declarative_resource.go
- backend/internal/flow/flowexec/error_constants.go
- backend/dbscripts/configdb/postgres.sql
- tests/integration/oauth/sso/suite_test.go
- backend/pkg/thunderidengine/providers/model.go
- backend/internal/application/service.go
- backend/internal/application/model/application.go
- backend/internal/application/handler.go
- backend/internal/system/importer/service.go
🚧 Files skipped from review as they are similar to previous changes (18)
- install/helm/values.yaml
- backend/cmd/server/config/default.json
- backend/pkg/thunderidengine/config/config.go
- docs/content/deployment/configuration.mdx
- install/helm/conf/deployment.yaml
- install/openchoreo/thunderid-oc-resourcetype/templates/thunderid-resourcetype.yaml
- install/openchoreo/thunderid-oc-resourcetype/samples/resource.yaml
- backend/internal/flow/flowexec/service_test.go
- backend/internal/actorprovider/utils.go
- frontend/packages/i18n/src/locales/en-US.ts
- frontend/apps/console/src/features/applications/components/edit-application/flows-settings/SignOutFlowSection.tsx
- backend/internal/flow/flowexec/service.go
- backend/cmd/server/bootstrap/01-default-resources.yaml
- backend/internal/inboundclient/store_constants.go
- frontend/apps/console/src/features/applications/components/edit-application/flows-settings/tests/SignOutFlowSection.test.tsx
- backend/internal/actorprovider/utils_test.go
- backend/internal/inboundclient/service_test.go
- backend/internal/inboundclient/store.go
ThaminduDilshan
added
the
breaking change
madurangasiriwardena
force-pushed
the
default-signout-flow
branch
from
July 24, 2026 16:49
accdfa1 to
e634f4f
Compare
Remove the per-application sign-out enable option and apply a server-level default sign-out flow when an application does not pin its own, mirroring how the default authentication flow works. - Add flow.default_signout_flow_handle config (default "default-flow") - Resolve the default sign-out flow in resolveFlowDefaults and drop the IsSignOutFlowEnabled gate in getFlowGraph - Remove IsSignOutFlowEnabled from models, store, and the IS_SIGNOUT_FLOW_ENABLED config DB column - Rename the bundled sign-out flow handle console-signout-flow to default-flow - Drop the enable toggle from the console SignOutFlowSection and fix its i18n keys (signoutFlow -> signOutFlow) so the section title reads "Sign Out Flow" like the other flow sections
madurangasiriwardena
force-pushed
the
default-signout-flow
branch
from
July 24, 2026 16:51
e634f4f to
0dbe44e
Compare
ThaminduDilshan
approved these changes
Jul 24, 2026
madurangasiriwardena
enabled auto-merge
July 24, 2026 17:00
github-merge-queue
Bot
removed this pull request from the merge queue due to failed status checks
Jul 24, 2026
12 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
Applications currently expose an enable sign-out flow toggle (isSignOutFlowEnabled), and sign-out is disabled when no flow is configured. This makes sign-out inconsistent with sign-in, where a server-level default flow is applied automatically whenever an application does not pin its own.
This PR removes the enable toggle and instead applies a server-level default sign-out flow automatically, so every application gets sign-out out of the box, exactly like authentication. The bundled sign-out flow's handle is renamed from console-signout-flow to default-flow so it is picked up by the same handle-based default resolution.
🔧 Summary of Breaking Changes
💥 Impact
🔄 Migration Guide
Approach
Sign-out now mirrors the existing authentication-flow default mechanism:
Related Issues
Related PRs
Checklist
breaking changelabel added.Security checks
Summary by CodeRabbit
New Features
signOutFlowId.Changes
signOutFlowIdinstead of the prior enablement flag.Documentation
flow.default_signout_flow_handlein deployment configuration references.