Update Logto to 1.41 and fix local Admin Console connectivity

[axies20]

Summary

• update the Logto container integration from 1.39 to 1.41
• configure CORS-safe local Admin Console URLs for Aspire proxy endpoints
• automatically populate the public Logto and Admin endpoint URLs after Aspire allocates ports
• run database seeding and required schema alterations in a one-shot setup container before Logto starts
• preserve the complete Logto OIDC option set and validate connection endpoint schemes
• add JWT bearer, OIDC, connection string, endpoint, migration, and resource model tests
• document Logto 1.41 upgrade requirements, local CORS behavior, air-gapped setup, and deprecated username configuration

Root cause

Aspire exposes the Logto API and Admin Console through separate dynamically allocated localhost proxy ports. Logto 1.41 production CORS handling removes localhost from the allowlist when both its internal Admin URL and an external Admin endpoint are present. As a result, Admin Console requests to Management API endpoints failed preflight without Access-Control-Allow-Origin, preventing resources such as Applications from being created.

Starting the container in development mode was not a viable workaround because the packaged Admin Console then proxies to an unavailable Vite development server and returns 503 Service Unavailable.

For local Aspire runs, the integration now publishes the Admin endpoint through the equivalent 127.0.0.1 loopback address and updates the dashboard link to match. This keeps the normal production container startup, serves the compiled Admin Console, and provides an origin accepted by Logto's production CORS policy.

Database upgrade

Logto 1.40 and later require database alterations during an upgrade. WithDatabaseSeeding() now creates an excluded one-shot setup container that:

1. waits for PostgreSQL
2. seeds the Logto database
3. deploys alterations through latest
4. exits successfully before the main Logto resource starts

The setup also supports Logto's --dapc option for air-gapped environments where the initial pwned-password check is unavailable.

Client changes

• preserve all configured LogtoOptions when registering OIDC authentication
• validate that configured endpoints use HTTP or HTTPS
• cover JWT bearer authority, audience, metadata and custom configuration behavior

Validation

• Logto client tests: 26 passed
• Logto AppHost build: succeeded with 0 warnings and 0 errors
• Logto 1.41 setup container: exited with code 0
• Logto resource: healthy
• Admin Console request: HTTP 200
• Management API CORS preflight: HTTP 204
• Access-Control-Allow-Origin matched the allocated 127.0.0.1 Admin Console origin
• git diff --check: passed

Notes

WithSensitiveUsername(...) is marked obsolete because CASE_SENSITIVE_USERNAME is deprecated in Logto 1.41 in favor of per-tenant username policy configuration.

[github-actions]

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/CommunityToolkit/Aspire/main/eng/scripts/dogfood-pr.sh | bash -s -- 1473

Or

• Run remotely in PowerShell:

iex "& { $(irm https://raw.githubusercontent.com/CommunityToolkit/Aspire/main/eng/scripts/dogfood-pr.ps1) } 1473"