fix(workflows): pass pre-built request types to provider child workflows

The merge from main reintroduced the pattern where the authorize/revoke
child workflows expect a WorkflowRoleRequest and resolve it to an
AuthorizeRoleRequest inside the workflow via a local activity. The branch
design instead pre-builds the AuthorizeRoleRequest at execution-planning
time and stores it on ExecutionPlanEntry, and the thand task caller
already invokes the child workflow with the pre-built type.

That mismatch caused integration failures with:
  unable to decode the workflow function input payload: cannot unmarshal
  object into Go struct field WorkflowRoleRequest.identity of type string

Restore the branch's signatures so the workflows accept the materialized
request types directly. The BuildAuthorizeRoleRequest activity remains
registered for callers that still build via WorkflowRoleRequest, but the
provider child workflows themselves no longer depend on it.

Author: hughneale

internal/models/provider_workflows.go

@@ -332,49 +332,23 @@ func (r *WorkflowRoleRequest) GetDuration() *time.Duration {
 	return r.Duration
 }
 
-// CreateProviderAuthorizeRoleWorkflow returns a workflow function that captures the
-// live provider instance via closure. The child workflow receives the Temporal
-// workflow.Context, dispatches a local activity to resolve the AuthorizeRoleRequest
-// (config/identity/tenant lookups and composite-role construction), and then
-// delegates to provider.AuthorizeRole — allowing the provider to dispatch activities,
-// use workflow.Go, and manage state just as it does in the primary workflow.
-func CreateProviderAuthorizeRoleWorkflow(provider Provider) func(workflow.Context, WorkflowRoleRequest) (*AuthorizeRoleResponse, error) {
-	return func(ctx workflow.Context, req WorkflowRoleRequest) (*AuthorizeRoleResponse, error) {
+// CreateProviderAuthorizeRoleWorkflow returns a workflow function that captures
+// the live provider instance via closure. The child workflow receives a fully
+// materialized AuthorizeRoleRequest (built at execution-planning time) so it
+// can delegate directly to provider.AuthorizeRole without any workflow-side
+// config lookups.
+func CreateProviderAuthorizeRoleWorkflow(provider Provider) func(workflow.Context, AuthorizeRoleRequest) (*AuthorizeRoleResponse, error) {
+	return func(ctx workflow.Context, req AuthorizeRoleRequest) (*AuthorizeRoleResponse, error) {
 
 		log := workflow.GetLogger(ctx)
 		log.Info("Starting authorize role workflow", "provider", provider.GetIdentifier())
 
-		// Resolve config/provider state via a registered local activity rather than
-		// workflow.SideEffect. This keeps mutable config reads outside workflow code,
-		// records the resolved request in history with a stable activity type name,
-		// and enables retry on transient failure.
-		activityName := CreateTemporalProviderWorkflowName(
-			provider.GetIdentifier(),
-			TemporalBuildAuthorizeRoleRequestActivityName,
-		)
-		lao := workflow.LocalActivityOptions{
-			StartToCloseTimeout: 30 * time.Second,
-			RetryPolicy: &temporal.RetryPolicy{
-				InitialInterval:    1 * time.Second,
-				BackoffCoefficient: 2.0,
-				MaximumInterval:    30 * time.Second,
-				MaximumAttempts:    5,
-			},
-		}
-		lctx := workflow.WithLocalActivityOptions(ctx, lao)
-
-		var authReq AuthorizeRoleRequest
-		if err := workflow.ExecuteLocalActivity(lctx, activityName, &req).Get(ctx, &authReq); err != nil {
-			log.Error("Failed to build authorize role request", "error", err)
-			return nil, err
-		}
-
-		log.Debug("Constructed authorize role request, invoking provider",
+		log.Debug("Invoking provider authorize role",
 			"provider", provider.GetIdentifier(),
-			"authorizeReq", authReq,
+			"authorizeReq", req,
 		)
 
-		return provider.AuthorizeRole(ctx, &authReq)
+		return provider.AuthorizeRole(ctx, &req)
 	}
 }
 
@@ -384,51 +358,22 @@ type WorkflowRevokeRoleRequest struct {
 }
 
 // CreateProviderRevokeRoleWorkflow returns a workflow function that captures the
-// live provider instance via closure for revocation operations.
+// live provider instance via closure for revocation operations. The child
+// workflow receives a fully materialized RevokeRoleRequest (built at
+// execution-planning / hydration time) so it can delegate directly to
+// provider.RevokeRole without any workflow-side config lookups.
 func CreateProviderRevokeRoleWorkflow(provider Provider) func(workflow.Context, WorkflowRevokeRoleRequest) (*RevokeRoleResponse, error) {
 	return func(ctx workflow.Context, req WorkflowRevokeRoleRequest) (*RevokeRoleResponse, error) {
 
 		log := workflow.GetLogger(ctx)
 		log.Info("Starting revoke role workflow", "provider", provider.GetIdentifier())
 
-		var authReq *AuthorizeRoleRequest
-		if req.RevokeRoleRequest != nil {
-			// Resolve config/provider state via a registered local activity. See
-			// CreateProviderAuthorizeRoleWorkflow for the full rationale.
-			activityName := CreateTemporalProviderWorkflowName(
-				provider.GetIdentifier(),
-				TemporalBuildAuthorizeRoleRequestActivityName,
-			)
-			lao := workflow.LocalActivityOptions{
-				StartToCloseTimeout: 30 * time.Second,
-				RetryPolicy: &temporal.RetryPolicy{
-					InitialInterval:    1 * time.Second,
-					BackoffCoefficient: 2.0,
-					MaximumInterval:    30 * time.Second,
-					MaximumAttempts:    5,
-				},
-			}
-			lctx := workflow.WithLocalActivityOptions(ctx, lao)
-
-			var result AuthorizeRoleRequest
-			if err := workflow.ExecuteLocalActivity(lctx, activityName, req.RevokeRoleRequest).Get(ctx, &result); err != nil {
-				log.Error("Failed to build authorize role request for revocation", "error", err)
-				return nil, err
-			}
-			authReq = &result
-		}
-
-		revokeReq := &RevokeRoleRequest{
-			AuthorizeRoleRequest:  authReq,
-			AuthorizeRoleResponse: req.AuthorizeRoleResponse,
-		}
-
-		log.Debug("Constructed revoke role request, invoking provider",
+		log.Debug("Invoking provider revoke role",
 			"provider", provider.GetIdentifier(),
 			"revokeReq", req.RevokeRoleRequest,
 		)
 
-		return provider.RevokeRole(ctx, revokeReq)
+		return provider.RevokeRole(ctx, req.RevokeRoleRequest)
 	}
 }