Apply a default sign-out flow automatically instead of an enable toggle

backend/cmd/server/bootstrap/01-default-resources.yaml

@@ -602,7 +602,7 @@ nodes:
 resource_type: flow
 id: 01900000-0000-7000-8000-00000000006a
 name: Default Sign Out Flow
-handle: console-signout-flow
+handle: default-flow
 flowType: SIGNOUT
 nodes:
 - id: start
@@ -4988,7 +4988,6 @@ authFlowId: 01900000-0000-7000-8000-000000000068
 registrationFlowId: 01900000-0000-7000-8000-000000000069
 isRegistrationFlowEnabled: false
 signOutFlowId: 01900000-0000-7000-8000-00000000006a
-isSignOutFlowEnabled: true
 recoveryFlowId: 01900000-0000-7000-8000-000000000070
 isRecoveryFlowEnabled: false
 allowedUserTypes:

backend/cmd/server/config/default.json

@@ -170,6 +170,7 @@
   },
   "flow": {
     "default_auth_flow_handle": "default-flow",
+    "default_signout_flow_handle": "default-flow",
     "user_onboarding_flow_handle": "default-flow",
     "max_version_history": 10,
     "auto_infer_registration": false,

backend/dbscripts/configdb/postgres.sql

@@ -104,7 +104,6 @@ CREATE TABLE "INBOUND_CLIENT" (
     RECOVERY_FLOW_ID VARCHAR(100),
     IS_RECOVERY_FLOW_ENABLED CHAR(1) DEFAULT '0',
     SIGNOUT_FLOW_ID VARCHAR(100),
-    IS_SIGNOUT_FLOW_ENABLED CHAR(1) DEFAULT '0',
     THEME_ID VARCHAR(36),
     LAYOUT_ID VARCHAR(36),
     PROPERTIES JSONB,

backend/dbscripts/configdb/sqlite.sql

@@ -104,7 +104,6 @@ CREATE TABLE "INBOUND_CLIENT" (
     RECOVERY_FLOW_ID VARCHAR(100),
     IS_RECOVERY_FLOW_ENABLED CHAR(1) DEFAULT '0',
     SIGNOUT_FLOW_ID VARCHAR(100),
-    IS_SIGNOUT_FLOW_ENABLED CHAR(1) DEFAULT '0',
     THEME_ID VARCHAR(36),
     LAYOUT_ID VARCHAR(36),
     PROPERTIES TEXT,

backend/internal/actorprovider/utils.go

@@ -54,12 +54,11 @@ func assembleApplication(
 	app := &providers.Application{
 		ID: client.ID,
 		InboundAuthProfile: providers.InboundAuthProfile{
-			AuthFlowID:           client.AuthFlowID,
-			SignOutFlowID:        client.SignOutFlowID,
-			IsSignOutFlowEnabled: client.IsSignOutFlowEnabled,
-			Assertion:            client.Assertion,
-			LoginConsent:         client.LoginConsent,
-			AllowedUserTypes:     client.AllowedUserTypes,
+			AuthFlowID:       client.AuthFlowID,
+			SignOutFlowID:    client.SignOutFlowID,
+			Assertion:        client.Assertion,
+			LoginConsent:     client.LoginConsent,
+			AllowedUserTypes: client.AllowedUserTypes,
 		},
 	}
 

backend/internal/actorprovider/utils_test.go

@@ -142,17 +142,15 @@ func (s *UtilsTestSuite) TestAssembleApplication_NoClientID() {
 
 func (s *UtilsTestSuite) TestAssembleApplication_CarriesFlowIDs() {
 	client := &providers.InboundClient{
-		ID:                   "app-1",
-		AuthFlowID:           "auth-flow",
-		SignOutFlowID:        "signout-flow",
-		IsSignOutFlowEnabled: true,
+		ID:            "app-1",
+		AuthFlowID:    "auth-flow",
+		SignOutFlowID: "signout-flow",
 	}
 
 	app := assembleApplication(client, nil)
 
 	s.Equal("auth-flow", app.AuthFlowID)
 	s.Equal("signout-flow", app.SignOutFlowID)
-	s.True(app.IsSignOutFlowEnabled)
 }
 
 func (s *UtilsTestSuite) TestBuildApplication_NotFound() {

backend/internal/application/declarative_resource.go

@@ -185,7 +185,6 @@ func parseToApplicationDTO(data []byte) (*model.ApplicationDTO, error) {
 			IsRecoveryFlowEnabled:     appRequest.IsRecoveryFlowEnabled,
 			SignOutFlowID:             appRequest.SignOutFlowID,
 			SignOutFlowHandle:         appRequest.SignOutFlowHandle,
-			IsSignOutFlowEnabled:      appRequest.IsSignOutFlowEnabled,
 			ThemeID:                   appRequest.ThemeID,
 			LayoutID:                  appRequest.LayoutID,
 			Assertion:                 appRequest.Assertion,

backend/internal/application/handler.go

@@ -77,7 +77,6 @@ func (ah *applicationHandler) HandleApplicationPostRequest(w http.ResponseWriter
 			RecoveryFlowID:            appRequest.RecoveryFlowID,
 			IsRecoveryFlowEnabled:     appRequest.IsRecoveryFlowEnabled,
 			SignOutFlowID:             appRequest.SignOutFlowID,
-			IsSignOutFlowEnabled:      appRequest.IsSignOutFlowEnabled,
 			ThemeID:                   appRequest.ThemeID,
 			LayoutID:                  appRequest.LayoutID,
 			Assertion:                 appRequest.Assertion,
@@ -115,7 +114,6 @@ func (ah *applicationHandler) HandleApplicationPostRequest(w http.ResponseWriter
 			RecoveryFlowID:            createdAppDTO.RecoveryFlowID,
 			IsRecoveryFlowEnabled:     createdAppDTO.IsRecoveryFlowEnabled,
 			SignOutFlowID:             createdAppDTO.SignOutFlowID,
-			IsSignOutFlowEnabled:      createdAppDTO.IsSignOutFlowEnabled,
 			ThemeID:                   createdAppDTO.ThemeID,
 			LayoutID:                  createdAppDTO.LayoutID,
 			Assertion:                 createdAppDTO.Assertion,
@@ -196,7 +194,6 @@ func (ah *applicationHandler) HandleApplicationGetRequest(w http.ResponseWriter,
 			RecoveryFlowID:            appDTO.RecoveryFlowID,
 			IsRecoveryFlowEnabled:     appDTO.IsRecoveryFlowEnabled,
 			SignOutFlowID:             appDTO.SignOutFlowID,
-			IsSignOutFlowEnabled:      appDTO.IsSignOutFlowEnabled,
 			ThemeID:                   appDTO.ThemeID,
 			LayoutID:                  appDTO.LayoutID,
 			Assertion:                 appDTO.Assertion,
@@ -339,7 +336,6 @@ func (ah *applicationHandler) HandleApplicationPutRequest(w http.ResponseWriter,
 			RecoveryFlowID:            appRequest.RecoveryFlowID,
 			IsRecoveryFlowEnabled:     appRequest.IsRecoveryFlowEnabled,
 			SignOutFlowID:             appRequest.SignOutFlowID,
-			IsSignOutFlowEnabled:      appRequest.IsSignOutFlowEnabled,
 			ThemeID:                   appRequest.ThemeID,
 			LayoutID:                  appRequest.LayoutID,
 			Assertion:                 appRequest.Assertion,
@@ -377,7 +373,6 @@ func (ah *applicationHandler) HandleApplicationPutRequest(w http.ResponseWriter,
 			RecoveryFlowID:            updatedAppDTO.RecoveryFlowID,
 			IsRecoveryFlowEnabled:     updatedAppDTO.IsRecoveryFlowEnabled,
 			SignOutFlowID:             updatedAppDTO.SignOutFlowID,
-			IsSignOutFlowEnabled:      updatedAppDTO.IsSignOutFlowEnabled,
 			ThemeID:                   updatedAppDTO.ThemeID,
 			LayoutID:                  updatedAppDTO.LayoutID,
 			Assertion:                 updatedAppDTO.Assertion,

backend/internal/application/model/application.go

@@ -58,7 +58,6 @@ type BasicApplicationDTO struct {
 	RecoveryFlowID            string
 	IsRecoveryFlowEnabled     bool
 	SignOutFlowID             string
-	IsSignOutFlowEnabled      bool
 	ThemeID                   string
 	LayoutID                  string
 	Template                  string
@@ -178,7 +177,6 @@ type BasicApplicationResponse struct {
 	RecoveryFlowID            string `json:"recoveryFlowId,omitempty" jsonschema:"Recovery Flow ID."`
 	IsRecoveryFlowEnabled     bool   `json:"isRecoveryFlowEnabled" jsonschema:"Recovery enabled status."`
 	SignOutFlowID             string `json:"signOutFlowId,omitempty" jsonschema:"Sign-out flow ID."`
-	IsSignOutFlowEnabled      bool   `json:"isSignOutFlowEnabled" jsonschema:"Sign-out enabled status."`
 	ThemeID                   string `json:"themeId,omitempty" jsonschema:"Theme ID."`
 	LayoutID                  string `json:"layoutId,omitempty" jsonschema:"Layout ID."`
 	Template                  string `json:"template,omitempty" jsonschema:"Application Template."`

backend/internal/application/service.go

@@ -810,7 +810,6 @@ func toInboundClient(dto *model.ApplicationProcessedDTO) inboundmodel.InboundCli
 		RecoveryFlowID:            dto.RecoveryFlowID,
 		IsRecoveryFlowEnabled:     dto.IsRecoveryFlowEnabled,
 		SignOutFlowID:             dto.SignOutFlowID,
-		IsSignOutFlowEnabled:      dto.IsSignOutFlowEnabled,
 		ThemeID:                   dto.ThemeID,
 		LayoutID:                  dto.LayoutID,
 		Assertion:                 dto.Assertion,
@@ -863,7 +862,6 @@ func toProcessedDTO(
 			RecoveryFlowID:            dao.RecoveryFlowID,
 			IsRecoveryFlowEnabled:     dao.IsRecoveryFlowEnabled,
 			SignOutFlowID:             dao.SignOutFlowID,
-			IsSignOutFlowEnabled:      dao.IsSignOutFlowEnabled,
 			ThemeID:                   dao.ThemeID,
 			LayoutID:                  dao.LayoutID,
 			Assertion:                 dao.Assertion,
@@ -1783,7 +1781,6 @@ func buildApplicationResponse(dto *model.ApplicationProcessedDTO) *providers.App
 			RecoveryFlowID:            dto.RecoveryFlowID,
 			IsRecoveryFlowEnabled:     dto.IsRecoveryFlowEnabled,
 			SignOutFlowID:             dto.SignOutFlowID,
-			IsSignOutFlowEnabled:      dto.IsSignOutFlowEnabled,
 			ThemeID:                   dto.ThemeID,
 			LayoutID:                  dto.LayoutID,
 			Assertion:                 dto.Assertion,
@@ -1842,7 +1839,6 @@ func buildBasicApplicationResponse(
 		RecoveryFlowID:            cfg.RecoveryFlowID,
 		IsRecoveryFlowEnabled:     cfg.IsRecoveryFlowEnabled,
 		SignOutFlowID:             cfg.SignOutFlowID,
-		IsSignOutFlowEnabled:      cfg.IsSignOutFlowEnabled,
 		ThemeID:                   cfg.ThemeID,
 		LayoutID:                  cfg.LayoutID,
 		IsReadOnly:                cfg.IsReadOnly,
@@ -1892,7 +1888,6 @@ func buildBaseApplicationProcessedDTO(appID string, app *model.ApplicationDTO,
 			RecoveryFlowID:            app.RecoveryFlowID,
 			IsRecoveryFlowEnabled:     app.IsRecoveryFlowEnabled,
 			SignOutFlowID:             app.SignOutFlowID,
-			IsSignOutFlowEnabled:      app.IsSignOutFlowEnabled,
 			ThemeID:                   app.ThemeID,
 			LayoutID:                  app.LayoutID,
 			Assertion:                 assertion,
@@ -1976,7 +1971,6 @@ func buildReturnApplicationDTO(
 			RecoveryFlowID:            app.RecoveryFlowID,
 			IsRecoveryFlowEnabled:     app.IsRecoveryFlowEnabled,
 			SignOutFlowID:             app.SignOutFlowID,
-			IsSignOutFlowEnabled:      app.IsSignOutFlowEnabled,
 			ThemeID:                   app.ThemeID,
 			LayoutID:                  app.LayoutID,
 			Assertion:                 assertion,

backend/internal/flow/flowexec/error_constants.go

@@ -239,17 +239,3 @@ var ErrorAttestationInvalid = tidcommon.ServiceError{
 		DefaultValue: "The provided attestation token is invalid",
 	},
 }
-
-// ErrorSignOutFlowDisabled defines the error response for sign-out flow disabled errors.
-var ErrorSignOutFlowDisabled = tidcommon.ServiceError{
-	Code: "FES-1016",
-	Type: tidcommon.ClientErrorType,
-	Error: tidcommon.I18nMessage{
-		Key:          "error.flowexecservice.signout_not_allowed",
-		DefaultValue: "Sign out not allowed",
-	},
-	ErrorDescription: tidcommon.I18nMessage{
-		Key:          "error.flowexecservice.signout_not_allowed_description",
-		DefaultValue: "Sign out flow is disabled for the application",
-	},
-}

backend/internal/flow/flowexec/service.go

@@ -681,9 +681,7 @@ func (s *flowExecService) getFlowGraph(ctx context.Context, appID string, flowTy
 	}
 
 	if flowType == providers.FlowTypeSignOut {
-		if !client.IsSignOutFlowEnabled {
-			return "", &ErrorSignOutFlowDisabled
-		} else if client.SignOutFlowID == "" {
+		if client.SignOutFlowID == "" {
 			logger.Error(ctx, "Sign-out flow is not configured for the application",
 				log.String("appID", appID))
 			return "", &tidcommon.InternalServerError

backend/internal/flow/flowexec/service_test.go

@@ -2035,6 +2035,23 @@ func (s *ServiceTestSuite) TestGetFlowGraph_RegistrationAndRecovery() {
 			},
 			expectedCode: ErrorRecoveryFlowDisabled.Code,
 		},
+		{
+			name:     "signout flow configured",
+			flowType: providers.FlowTypeSignOut,
+			client: &inboundmodel.InboundClient{
+				ID:            appID,
+				SignOutFlowID: "signout-graph-1",
+			},
+			expectedGraph: "signout-graph-1",
+		},
+		{
+			name:     "signout flow not configured",
+			flowType: providers.FlowTypeSignOut,
+			client: &inboundmodel.InboundClient{
+				ID: appID,
+			},
+			expectedCode: tidcommon.InternalServerError.Code,
+		},
 		{
 			name:         "empty app id",
 			flowType:     providers.FlowTypeAuthentication,

backend/internal/inboundclient/service.go

@@ -586,7 +586,7 @@ func BuildOAuthClient(
 	return client
 }
 
-// resolveFlowDefaults fills AuthFlowID, RegistrationFlowID, and RecoveryFlowID with system
+// resolveFlowDefaults fills AuthFlowID, RegistrationFlowID, RecoveryFlowID, and SignOutFlowID with system
 // defaults when empty, using the auth flow's handle to locate matching flows of each type.
 func (s *inboundClientService) resolveFlowDefaults(ctx context.Context, c *inboundmodel.InboundClient) error {
 	if s.flowMgt == nil || c == nil {
@@ -625,8 +625,21 @@ func (s *inboundClientService) resolveFlowDefaults(ctx context.Context, c *inbou
 		c.IsRecoveryFlowEnabled = false
 	}
 	if c.SignOutFlowID == "" {
-		// If a sign-out flow is not defined, disable sign-out for the application.
-		c.IsSignOutFlowEnabled = false
+		defaultHandle := config.GetServerRuntime().Config.Flow.DefaultSignOutFlowHandle
+		if defaultHandle != "" {
+			flow, svcErr := s.flowMgt.GetFlowByHandle(ctx, defaultHandle, providers.FlowTypeSignOut)
+			switch {
+			case svcErr == nil:
+				c.SignOutFlowID = flow.ID
+			case svcErr.Type == tidcommon.ServerErrorType:
+				return ErrFKFlowServerError
+			case svcErr.Code == flowmgt.ErrorFlowNotFound.Code:
+				// Sign-out is optional; if the default sign-out flow does not exist, leave it
+				// unconfigured rather than failing.
+			default:
+				return ErrFKFlowDefinitionRetrievalFailed
+			}
+		}
 	}
 	return nil
 }
@@ -1653,7 +1666,6 @@ func (s *inboundClientService) walkReferencedFlows(
 					c.IsRecoveryFlowEnabled = false
 				case providers.FlowTypeSignOut:
 					c.SignOutFlowID = t.FlowID
-					c.IsSignOutFlowEnabled = false
 				}
 				continue
 			}

backend/internal/inboundclient/service_test.go

@@ -1560,6 +1560,81 @@ func (suite *InboundClientServiceTestSuite) TestResolveFlowDefaults_RecoveryFlow
 	assert.Equal(suite.T(), "recovery-1", c.RecoveryFlowID)
 }
 
+func (suite *InboundClientServiceTestSuite) TestResolveFlowDefaults_AppliesDefaultSignOutFlowWhenEmpty() {
+	originalSignOutHandle := sysconfig.GetServerRuntime().Config.Flow.DefaultSignOutFlowHandle
+	suite.T().Cleanup(func() {
+		sysconfig.GetServerRuntime().Config.Flow.DefaultSignOutFlowHandle = originalSignOutHandle
+	})
+	sysconfig.GetServerRuntime().Config.Flow.DefaultSignOutFlowHandle = testDefaultSignOutFlowHandle
+	flowMgt := flowmgtmock.NewFlowMgtServiceInterfaceMock(suite.T())
+	flowMgt.EXPECT().GetFlowByHandle(mock.Anything, testDefaultSignOutFlowHandle, providers.FlowTypeSignOut).
+		Return(&providers.CompleteFlowDefinition{ID: "signout-default"}, nil).Once()
+	svc := &inboundClientService{flowMgt: flowMgt}
+	c := &inboundmodel.InboundClient{ID: "p1", AuthFlowID: "auth-1"}
+	err := svc.resolveFlowDefaults(context.Background(), c)
+	assert.NoError(suite.T(), err)
+	assert.Equal(suite.T(), "signout-default", c.SignOutFlowID)
+}
+
+func (suite *InboundClientServiceTestSuite) TestResolveFlowDefaults_KeepsConfiguredSignOutFlow() {
+	svc := &inboundClientService{flowMgt: flowmgtmock.NewFlowMgtServiceInterfaceMock(suite.T())}
+	c := &inboundmodel.InboundClient{ID: "p1", AuthFlowID: "auth-1", SignOutFlowID: "signout-1"}
+	err := svc.resolveFlowDefaults(context.Background(), c)
+	assert.NoError(suite.T(), err)
+	assert.Equal(suite.T(), "signout-1", c.SignOutFlowID)
+}
+
+// The default sign-out flow lookup maps a server error to ErrFKFlowServerError, treats a
+// not-found flow as optional (skipped), and surfaces any other retrieval error.
+func (suite *InboundClientServiceTestSuite) TestResolveFlowDefaults_DefaultSignOutFlowLookupErrors() {
+	originalSignOutHandle := sysconfig.GetServerRuntime().Config.Flow.DefaultSignOutFlowHandle
+	suite.T().Cleanup(func() {
+		sysconfig.GetServerRuntime().Config.Flow.DefaultSignOutFlowHandle = originalSignOutHandle
+	})
+	sysconfig.GetServerRuntime().Config.Flow.DefaultSignOutFlowHandle = testDefaultSignOutFlowHandle
+
+	tests := []struct {
+		name        string
+		lookupErr   *tidcommon.ServiceError
+		expectedErr error
+	}{
+		{"server error", &tidcommon.ServiceError{Type: tidcommon.ServerErrorType, Code: "SRV"}, ErrFKFlowServerError},
+		{"not found is skipped", &flowmgt.ErrorFlowNotFound, nil},
+		{
+			"other retrieval error",
+			&tidcommon.ServiceError{Type: tidcommon.ClientErrorType, Code: "OTHER"},
+			ErrFKFlowDefinitionRetrievalFailed,
+		},
+	}
+
+	for _, tt := range tests {
+		suite.Run(tt.name, func() {
+			flowMgt := flowmgtmock.NewFlowMgtServiceInterfaceMock(suite.T())
+			flowMgt.EXPECT().GetFlowByHandle(mock.Anything, testDefaultSignOutFlowHandle, providers.FlowTypeSignOut).
+				Return(nil, tt.lookupErr).Once()
+			svc := &inboundClientService{flowMgt: flowMgt}
+			c := &inboundmodel.InboundClient{ID: "p1", AuthFlowID: "auth-1"}
+			err := svc.resolveFlowDefaults(context.Background(), c)
+			if tt.expectedErr != nil {
+				assert.ErrorIs(suite.T(), err, tt.expectedErr)
+			} else {
+				assert.NoError(suite.T(), err)
+			}
+			assert.Empty(suite.T(), c.SignOutFlowID)
+		})
+	}
+}
+
+// When no default sign-out flow handle is configured, resolution does not attempt a lookup.
+func (suite *InboundClientServiceTestSuite) TestResolveFlowDefaults_NoDefaultSignOutFlowHandleConfigured() {
+	sysconfig.GetServerRuntime().Config.Flow.DefaultSignOutFlowHandle = ""
+	svc := &inboundClientService{flowMgt: flowmgtmock.NewFlowMgtServiceInterfaceMock(suite.T())}
+	c := &inboundmodel.InboundClient{ID: "p1", AuthFlowID: "auth-1"}
+	err := svc.resolveFlowDefaults(context.Background(), c)
+	assert.NoError(suite.T(), err)
+	assert.Empty(suite.T(), c.SignOutFlowID)
+}
+
 // ----- ResolveInboundAuthProfileHandles -----
 
 func (suite *InboundClientServiceTestSuite) TestResolveInboundAuthProfileHandles_NilFlowMgtIsNoOp() {
@@ -2062,6 +2137,8 @@ func (suite *InboundClientServiceTestSuite) TestGetOAuthClientByClientID_NilEnti
 
 const testServiceEntityID = "ent-1"
 
+const testDefaultSignOutFlowHandle = "default-flow"
+
 func (suite *InboundClientServiceTestSuite) TestGetOAuthClientByClientID_GetEntityNotFound() {
 	id := testServiceEntityID
 	ep := entityprovidermock.NewEntityProviderInterfaceMock(suite.T())
@@ -2611,10 +2688,9 @@ func (suite *InboundClientServiceTestSuite) TestReconcileReferencedFlows_AutoFil
 	flowMgt.EXPECT().GetReachableCallTargets(mock.Anything, "auth").Return(
 		[]flowmgt.CallTarget{{FlowID: "so-b", FlowType: providers.FlowTypeSignOut}}, nil)
 	svc := &inboundClientService{flowMgt: flowMgt}
-	c := &inboundmodel.InboundClient{AuthFlowID: "auth", IsSignOutFlowEnabled: true}
+	c := &inboundmodel.InboundClient{AuthFlowID: "auth"}
 	suite.Require().NoError(svc.reconcileReferencedFlows(context.Background(), c))
 	assert.Equal(suite.T(), "so-b", c.SignOutFlowID)
-	assert.False(suite.T(), c.IsSignOutFlowEnabled)
 }
 
 func (suite *InboundClientServiceTestSuite) TestReconcileReferencedFlows_MatchingBindingPreservesEnableFlag() {