Skip to content

Update return code to 400 when invalid activity ids are provided #4182

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
filiphr merged 1 commit into from
Mar 11, 2026
Merged

Update return code to 400 when invalid activity ids are provided #4182

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions ...le-engine/src/main/java/org/flowable/engine/impl/dynamic/AbstractDynamicStateManager.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,6 +56,7 @@
import org.flowable.bpmn.model.ValuedDataObject;
import org.flowable.common.engine.api.FlowableException;
import org.flowable.common.engine.impl.el.DefinitionVariableContainer;
import org.flowable.common.engine.api.FlowableIllegalArgumentException;
import org.flowable.common.engine.api.delegate.Expression;
import org.flowable.common.engine.api.delegate.event.FlowableEngineEventType;
import org.flowable.common.engine.api.delegate.event.FlowableEventDispatcher;
Expand Down Expand Up @@ -325,7 +326,7 @@ protected List<ExecutionEntity> resolveActiveExecutions(String processInstanceId
.collect(Collectors.toList());

if (executions.isEmpty()) {
throw new FlowableException("Active execution could not be found with activity id " + activityId);
throw new FlowableIllegalArgumentException("Active execution could not be found with activity id " + activityId);
}

return executions;
Expand Down Expand Up @@ -447,7 +448,7 @@ protected void prepareMoveExecutionEntityContainer(MoveExecutionEntityContainer
protected FlowElement resolveFlowElementFromBpmnModel(BpmnModel bpmnModel, String activityId) {
FlowElement flowElement = bpmnModel.getFlowElement(activityId);
if (flowElement == null) {
throw new FlowableException("Cannot find activity '" + activityId + "' in process definition with id '" + bpmnModel.getMainProcess().getId() + "'");
throw new FlowableIllegalArgumentException("Cannot find activity '" + activityId + "' in process definition with id '" + bpmnModel.getMainProcess().getId() + "'");
}
return flowElement;
}
Expand Down
7 changes: 4 additions & 3 deletions ...java/org/flowable/engine/test/api/runtime/changestate/ChangeStateForCallActivityTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,7 @@
import java.util.List;

import org.flowable.common.engine.api.FlowableException;
import org.flowable.common.engine.api.FlowableIllegalArgumentException;
import org.flowable.common.engine.api.scope.ScopeTypes;
import org.flowable.common.engine.impl.history.HistoryLevel;
import org.flowable.engine.impl.test.HistoryTestHelper;
Expand Down Expand Up @@ -355,15 +356,15 @@ public void testSetCurrentActivityInSubProcessInstanceSpecificVersion() {
.processInstanceId(processInstance.getId())
.moveActivityIdToSubProcessInstanceActivityId("firstTask", "theTask", "callActivity")
.changeState())
.isExactlyInstanceOf(FlowableException.class)
.isExactlyInstanceOf(FlowableIllegalArgumentException.class)
.hasMessage("Cannot find activity 'theTask' in process definition with id 'oneTaskProcess'");

//Invalid "unExistent" process definition version
assertThatThrownBy(() -> runtimeService.createChangeActivityStateBuilder()
.processInstanceId(processInstance.getId())
.moveActivityIdToSubProcessInstanceActivityId("firstTask", "theTask", "callActivity", 5)
.changeState())
.isExactlyInstanceOf(FlowableException.class)
.isExactlyInstanceOf(FlowableIllegalArgumentException.class)
.hasMessage("Cannot find activity 'theTask' in process definition with id 'oneTaskProcess'");

//Change state specifying the first version
Expand Down
9 changes: 5 additions & 4 deletions .../flowable/engine/test/api/runtime/migration/ProcessInstanceMigrationCallActivityTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,7 @@

import org.assertj.core.api.Condition;
import org.flowable.common.engine.api.FlowableException;
import org.flowable.common.engine.api.FlowableIllegalArgumentException;
import org.flowable.engine.impl.persistence.entity.ExecutionEntity;
import org.flowable.engine.impl.test.PluggableFlowableTestCase;
import org.flowable.engine.migration.ActivityMigrationMapping;
Expand Down Expand Up @@ -274,7 +275,7 @@ public void testValidationOfInvalidActivityInMigrationMappingToCallActivitySubPr
"Invalid mapping for 'userTask1Id' to 'wrongActivityId', cannot be found in the process definition with id 'oneTaskProcess'"));

assertThatThrownBy(() -> processInstanceMigrationBuilder.migrate(processInstance.getId()))
.isExactlyInstanceOf(FlowableException.class)
.isExactlyInstanceOf(FlowableIllegalArgumentException.class)
.hasMessage("Cannot find activity 'wrongActivityId' in process definition with id 'oneTaskProcess'");

completeProcessInstanceTasks(processInstance.getId());
Expand Down Expand Up @@ -318,7 +319,7 @@ public void testValidationOfInvalidCallActivityInMigrateMappingToCallActivitySub
"There's no call activity element with id 'wrongCallActivity' in the process definition with id 'twoTasksParentProcess'"));

assertThatThrownBy(() -> processInstanceMigrationBuilder.migrate(processInstance.getId()))
.isExactlyInstanceOf(FlowableException.class)
.isExactlyInstanceOf(FlowableIllegalArgumentException.class)
.hasMessage("Cannot find activity 'wrongCallActivity' in process definition with id 'twoTasksParentProcess'");

completeProcessInstanceTasks(processInstance.getId());
Expand Down Expand Up @@ -357,7 +358,7 @@ public void testMigrateMovingActivityIntoCallActivitySubProcessSpecificVersion()
.isEqualTo(Collections.singletonList("Invalid mapping for 'theTask' to 'userTask1Id', cannot be found in the process definition with id 'MP'"));

assertThatThrownBy(() -> processInstanceMigrationBuilder.migrate(processInstance.getId()))
.isExactlyInstanceOf(FlowableException.class)
.isExactlyInstanceOf(FlowableIllegalArgumentException.class)
.hasMessage("Cannot find activity 'userTask1Id' in process definition with id 'MP'");

//Second migration attempt using and invalid "unExistent" version
Expand All @@ -371,7 +372,7 @@ public void testMigrateMovingActivityIntoCallActivitySubProcessSpecificVersion()
.isEqualTo(Collections.singletonList("Invalid mapping for 'theTask' to 'userTask1Id', cannot be found in the process definition with id 'MP'"));

assertThatThrownBy(() -> processInstanceMigrationBuilder2.migrate(processInstance.getId()))
.isExactlyInstanceOf(FlowableException.class)
.isExactlyInstanceOf(FlowableIllegalArgumentException.class)
.hasMessage("Cannot find activity 'userTask1Id' in process definition with id 'MP'");

//Second migration attempt specifies the version of the call activity subProcess
Expand Down
18 changes: 18 additions & 0 deletions ...wable-rest/src/test/java/org/flowable/rest/service/api/runtime/ExecutionResourceTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,7 @@
import org.apache.http.HttpStatus;
import org.apache.http.client.methods.CloseableHttpResponse;
import org.apache.http.client.methods.HttpGet;
import org.apache.http.client.methods.HttpPost;
import org.apache.http.client.methods.HttpPut;
import org.apache.http.entity.StringEntity;
import org.flowable.engine.runtime.Execution;
Expand Down Expand Up @@ -308,4 +309,21 @@ public void testIllegalExecutionAction() throws Exception {
CloseableHttpResponse response = executeRequest(httpPut, HttpStatus.SC_BAD_REQUEST);
closeResponse(response);
}

@Test
@Deployment(resources = { "org/flowable/rest/service/api/runtime/ExecutionResourceTest.process-with-subprocess.bpmn20.xml" })
public void testChangeExecutionActivityStateWithInvalidStartActivity() throws Exception {
runtimeService.startProcessInstanceByKey("processOne");
Execution execution = runtimeService.createExecutionQuery().activityId("processTask").singleResult();
assertThat(execution).isNotNull();

ObjectNode requestNode = objectMapper.createObjectNode();
ArrayNode startActivityArray = requestNode.putArray("startActivityIds");
startActivityArray.add("doesNotExist");

HttpPost httpPost = new HttpPost(SERVER_URL_PREFIX + RestUrls.createRelativeResourceUrl(RestUrls.URL_EXECUTION, execution.getId()) + "/change-state");
httpPost.setEntity(new StringEntity(requestNode.toString()));
CloseableHttpResponse response = executeRequest(httpPost, HttpStatus.SC_BAD_REQUEST);
closeResponse(response);
}
}
48 changes: 48 additions & 0 deletions ...org/flowable/rest/service/api/runtime/ProcessInstanceChangeActivityStateResourceTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -143,4 +143,52 @@ public void testChangeActivityStateManyToOneWithMI() throws Exception {

assertProcessEnded(processInstance.getId());
}

@Test
@Deployment(resources = { "org/flowable/rest/service/api/runtime/parallelTask.bpmn20.xml" })
public void testChangeActivityStateManyToOneWithInvalidStartActivity() throws Exception {
Authentication.setAuthenticatedUserId("testUser");
ProcessInstance processInstance = runtimeService.createProcessInstanceBuilder()
.processDefinitionKey("startParallelProcess")
.start();
Task task = taskService.createTaskQuery().processInstanceId(processInstance.getId()).singleResult();
taskService.complete(task.getId());
Authentication.setAuthenticatedUserId(null);

ObjectNode requestNode = objectMapper.createObjectNode();
ArrayNode cancelActivityArray = requestNode.putArray("cancelActivityIds");
cancelActivityArray.add("task1");
cancelActivityArray.add("task2");

ArrayNode startActivityArray = requestNode.putArray("startActivityIds");
startActivityArray.add("doesNotExist");

HttpPost httpPost = new HttpPost(buildUrl(RestUrls.URL_PROCESS_INSTANCE_CHANGE_STATE, processInstance.getId()));
httpPost.setEntity(new StringEntity(requestNode.toString()));
CloseableHttpResponse response = executeRequest(httpPost, HttpStatus.SC_BAD_REQUEST);
closeResponse(response);
}

@Test
@Deployment(resources = { "org/flowable/rest/service/api/runtime/parallelTask.bpmn20.xml" })
public void testChangeActivityStateOneToManyWithInvalidCancelActivity() throws Exception {
Authentication.setAuthenticatedUserId("testUser");
ProcessInstance processInstance = runtimeService.createProcessInstanceBuilder()
.processDefinitionKey("startParallelProcess")
.start();
Authentication.setAuthenticatedUserId(null);

ObjectNode requestNode = objectMapper.createObjectNode();
ArrayNode cancelActivityArray = requestNode.putArray("cancelActivityIds");
cancelActivityArray.add("doesNotExist");

ArrayNode startActivityArray = requestNode.putArray("startActivityIds");
startActivityArray.add("task1");
startActivityArray.add("task2");

HttpPost httpPost = new HttpPost(buildUrl(RestUrls.URL_PROCESS_INSTANCE_CHANGE_STATE, processInstance.getId()));
httpPost.setEntity(new StringEntity(requestNode.toString()));
CloseableHttpResponse response = executeRequest(httpPost, HttpStatus.SC_BAD_REQUEST);
closeResponse(response);
}
}