From d183a1ec9ecdbc839352cefcaf023ae643772d97 Mon Sep 17 00:00:00 2001 From: maliming Date: Sat, 2 May 2026 15:52:37 +0800 Subject: [PATCH] Validate parent organization unit tenant on create and move --- .../Volo/Abp/Identity/IdentityErrorCodes.cs | 1 + .../Volo/Abp/Identity/Localization/ar.json | 1 + .../Volo/Abp/Identity/Localization/cs.json | 1 + .../Volo/Abp/Identity/Localization/de.json | 1 + .../Volo/Abp/Identity/Localization/el.json | 1 + .../Volo/Abp/Identity/Localization/en-GB.json | 1 + .../Volo/Abp/Identity/Localization/en.json | 1 + .../Volo/Abp/Identity/Localization/es.json | 1 + .../Volo/Abp/Identity/Localization/fa.json | 1 + .../Volo/Abp/Identity/Localization/fi.json | 1 + .../Volo/Abp/Identity/Localization/fr.json | 1 + .../Volo/Abp/Identity/Localization/hi.json | 1 + .../Volo/Abp/Identity/Localization/hr.json | 1 + .../Volo/Abp/Identity/Localization/hu.json | 1 + .../Volo/Abp/Identity/Localization/is.json | 1 + .../Volo/Abp/Identity/Localization/it.json | 1 + .../Volo/Abp/Identity/Localization/nl.json | 1 + .../Volo/Abp/Identity/Localization/pl-PL.json | 1 + .../Volo/Abp/Identity/Localization/pt-BR.json | 1 + .../Volo/Abp/Identity/Localization/ro-RO.json | 1 + .../Volo/Abp/Identity/Localization/ru.json | 1 + .../Volo/Abp/Identity/Localization/sk.json | 1 + .../Volo/Abp/Identity/Localization/sl.json | 1 + .../Volo/Abp/Identity/Localization/sv.json | 1 + .../Volo/Abp/Identity/Localization/tr.json | 1 + .../Volo/Abp/Identity/Localization/vi.json | 1 + .../Abp/Identity/Localization/zh-Hans.json | 1 + .../Abp/Identity/Localization/zh-Hant.json | 1 + .../Abp/Identity/OrganizationUnitManager.cs | 19 +++++++ .../Identity/OrganizationUnitManager_Tests.cs | 55 ++++++++++++++++--- 30 files changed, 94 insertions(+), 8 deletions(-) diff --git a/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/IdentityErrorCodes.cs b/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/IdentityErrorCodes.cs index 4710c62f90..0495679a5f 100644 --- a/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/IdentityErrorCodes.cs +++ b/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/IdentityErrorCodes.cs @@ -11,6 +11,7 @@ public static class IdentityErrorCodes public const string UsersCanNotChangeTwoFactor = "Volo.Abp.Identity:010007"; public const string CanNotChangeTwoFactor = "Volo.Abp.Identity:010008"; public const string YouCannotDelegateYourself = "Volo.Abp.Identity:010009"; + public const string OrganizationUnitParentTenantMismatch = "Volo.Abp.Identity:010010"; public const string ClaimNameExist = "Volo.Abp.Identity:010021"; public const string CanNotUpdateStaticClaimType = "Volo.Abp.Identity:010022"; public const string CanNotDeleteStaticClaimType = "Volo.Abp.Identity:010023"; diff --git a/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/ar.json b/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/ar.json index 71b858f834..d2780ea0ca 100644 --- a/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/ar.json +++ b/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/ar.json @@ -77,6 +77,7 @@ "Volo.Abp.Identity:010007": "لا يمكنك تغيير إعداد العاملين.", "Volo.Abp.Identity:010008": "لا يجوز تغيير إعداد عاملين.", "Volo.Abp.Identity:010009": "لا يمكنك تفويض نفسك.", + "Volo.Abp.Identity:010010": "The parent organization unit ('{ParentId}') does not exist in the current tenant.", "Volo.Abp.Identity:010021": "الاسم {0} موجود بالفعل.", "Volo.Abp.Identity:010022": "لا يمكن تحديث نوع المطابقة.", "Volo.Abp.Identity:010023": "لا يمكن حذف نوع المطابقة.", diff --git a/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/cs.json b/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/cs.json index e84320059e..102b2e8d73 100644 --- a/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/cs.json +++ b/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/cs.json @@ -77,6 +77,7 @@ "Volo.Abp.Identity:010007": "Nastavení dvou faktorů nemůžete změnit.", "Volo.Abp.Identity:010008": "Není povoleno měnit nastavení dvou faktorů.", "Volo.Abp.Identity:010009": "Nemůžete delegovat své vlastní oprávnění.", + "Volo.Abp.Identity:010010": "The parent organization unit ('{ParentId}') does not exist in the current tenant.", "Volo.Abp.Identity:010021": "Název '{0}' již existuje.", "Volo.Abp.Identity:010022": "Nelze aktualizovat statický typ deklarace.", "Volo.Abp.Identity:010023": "Nelze smazat statický typ deklarace.", diff --git a/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/de.json b/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/de.json index 4064866f00..27db13f3a5 100644 --- a/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/de.json +++ b/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/de.json @@ -77,6 +77,7 @@ "Volo.Abp.Identity:010007": "Sie können Ihre Zwei-Faktor-Einstellung nicht ändern.", "Volo.Abp.Identity:010008": "Die Zwei-Faktor-Einstellung dürfen nicht geändert werden.", "Volo.Abp.Identity:010009": "Sie können sich nicht selbst delegieren.", + "Volo.Abp.Identity:010010": "The parent organization unit ('{ParentId}') does not exist in the current tenant.", "Volo.Abp.Identity:010021": "Der Name existiert bereits {0}", "Volo.Abp.Identity:010022": "Der Name kann nicht aktualisiert werden.", "Volo.Abp.Identity:010023": "Der Name kann nicht gelöscht werden.", diff --git a/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/el.json b/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/el.json index ba610a993a..26aa51d173 100644 --- a/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/el.json +++ b/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/el.json @@ -76,6 +76,7 @@ "Volo.Abp.Identity:010007": "Δεν μπορείτε να αλλάξετε τη ρύθμιση δύο παραγόντων.", "Volo.Abp.Identity:010008": "Δεν επιτρέπεται η αλλαγή της ρύθμισης δύο παραγόντων.", "Volo.Abp.Identity:010009": "Δεν μπορείτε να αναθέσετε την εξουσιοδότησή σας σε εσάς ίδιο.", + "Volo.Abp.Identity:010010": "The parent organization unit ('{ParentId}') does not exist in the current tenant.", "Volo.Abp.Identity:010021": "Το όνομα '{0}' υπάρχει ήδη.", "Volo.Abp.Identity:010022": "Δεν μπορείτε να ενημερώσετε ένα στατικό τύπο δήλωσης.", "Volo.Abp.Identity:010023": "Δεν μπορείτε να διαγράψετε ένα στατικό τύπο δήλωσης.", diff --git a/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/en-GB.json b/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/en-GB.json index 9f10e1f188..979fe764c0 100644 --- a/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/en-GB.json +++ b/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/en-GB.json @@ -76,6 +76,7 @@ "Volo.Abp.Identity:010007": "You can't change your two factor setting.", "Volo.Abp.Identity:010008": "Changing the two factor setting is not allowed.", "Volo.Abp.Identity:010009": "You cannot delegate yourself!", + "Volo.Abp.Identity:010010": "The parent organization unit ('{ParentId}') does not exist in the current tenant.", "Volo.Abp.Identity:010021": "Name exist: '{0}'", "Volo.Abp.Identity:010022": "Can not update a static ClaimType.", "Volo.Abp.Identity:010023": "Can not delete a static ClaimType.", diff --git a/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/en.json b/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/en.json index 0deb6a4b56..90e7ba3a95 100644 --- a/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/en.json +++ b/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/en.json @@ -77,6 +77,7 @@ "Volo.Abp.Identity:010007": "You can't change your two factor setting.", "Volo.Abp.Identity:010008": "It's not allowed to change two factor setting.", "Volo.Abp.Identity:010009": "You can not delegate yourself.", + "Volo.Abp.Identity:010010": "The parent organization unit ('{ParentId}') does not exist in the current tenant.", "Volo.Abp.Identity:010021": "Name exist: '{0}'.", "Volo.Abp.Identity:010022": "Can not update a static ClaimType.", "Volo.Abp.Identity:010023": "Can not delete a static ClaimType.", diff --git a/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/es.json b/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/es.json index a2a9414214..810c39fc52 100644 --- a/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/es.json +++ b/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/es.json @@ -77,6 +77,7 @@ "Volo.Abp.Identity:010007": "No puedes cambiar tu configuración de autentificación de dos pasos.", "Volo.Abp.Identity:010008": "No está permitido cambiar la configuración de autenticación de dos pasos.", "Volo.Abp.Identity:010009": "No puedes delegar tu propia cuenta!", + "Volo.Abp.Identity:010010": "The parent organization unit ('{ParentId}') does not exist in the current tenant.", "Volo.Abp.Identity:010021": "Ya existe un con el nombre '{0}'", "Volo.Abp.Identity:010022": "No se puede actualizar un tipo de reclamación estática.", "Volo.Abp.Identity:010023": "No se puede borrar un tipo de reclamación estática.", diff --git a/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/fa.json b/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/fa.json index e9a1911b52..9629ec9150 100644 --- a/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/fa.json +++ b/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/fa.json @@ -77,6 +77,7 @@ "Volo.Abp.Identity:010007": "شما نمی توانید تنظیمات دو مرحله ای خود را تغییر دهید.", "Volo.Abp.Identity:010008": "تغییر دادن تنظیمات دو مرحله ای مجاز نمی باشد.", "Volo.Abp.Identity:010009": "شما نمی توانید خودتان را معرفی کنید.", + "Volo.Abp.Identity:010010": "The parent organization unit ('{ParentId}') does not exist in the current tenant.", "Volo.Abp.Identity:010021": "نام {0} قبلاً استفاده گردیده است.", "Volo.Abp.Identity:010022": "نمی توان نام نقش/وظیفه را تغییر داد.", "Volo.Abp.Identity:010023": "نمی توان نقش/وظیفه را حذف کرد.", diff --git a/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/fi.json b/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/fi.json index 2a37974cbb..debbf8bef9 100644 --- a/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/fi.json +++ b/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/fi.json @@ -77,6 +77,7 @@ "Volo.Abp.Identity:010007": "Et voi muuttaa kahden tekijän asetusta.", "Volo.Abp.Identity:010008": "Kahden tekijän asetusta ei saa muuttaa.", "Volo.Abp.Identity:010009": "Et voi delegoida itseäsi.", + "Volo.Abp.Identity:010010": "The parent organization unit ('{ParentId}') does not exist in the current tenant.", "Volo.Abp.Identity:010021": "{0} on jo olemassa.", "Volo.Abp.Identity:010022": "Staattista väittämätunnusta ei voi päivittää.", "Volo.Abp.Identity:010023": "Staattista väittämätunnusta ei voi poistaa.", diff --git a/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/fr.json b/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/fr.json index 323bb5927a..05881c1bf8 100644 --- a/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/fr.json +++ b/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/fr.json @@ -77,6 +77,7 @@ "Volo.Abp.Identity:010007": "Vous ne pouvez pas modifier votre paramètre à deux facteurs.", "Volo.Abp.Identity:010008": "Il n’est pas permis de changer deux facteurs de réglage.", "Volo.Abp.Identity:010009": "Vous ne pouvez pas vous déléguer vous-même.", + "Volo.Abp.Identity:010010": "The parent organization unit ('{ParentId}') does not exist in the current tenant.", "Volo.Abp.Identity:010021": "Le nom '{0}' existe déjà.", "Volo.Abp.Identity:010022": "Vous ne pouvez pas modifier un type de revendication statique.", "Volo.Abp.Identity:010023": "Vous ne pouvez pas supprimer un type de revendication statique.", diff --git a/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/hi.json b/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/hi.json index 0d5fca3dde..ea6cda8b8a 100644 --- a/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/hi.json +++ b/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/hi.json @@ -77,6 +77,7 @@ "Volo.Abp.Identity:010007": "आप अपनी दो कारक सेटिंग नहीं बदल सकते।", "Volo.Abp.Identity:010008": "इसे दो कारक सेटिंग बदलने की अनुमति नहीं है।", "Volo.Abp.Identity:010009": "आप अपने आप को अधिकृत नहीं कर सकते हैं!", + "Volo.Abp.Identity:010010": "The parent organization unit ('{ParentId}') does not exist in the current tenant.", "Volo.Abp.Identity:010021": "नाम '{0}' पहले से ही लिया गया है।", "Volo.Abp.Identity:010022": "स्थैतिक भूमिकाओं का नाम नहीं बदला जा सकता है।", "Volo.Abp.Identity:010023": "स्थैतिक भूमिकाओं को हटाया नहीं जा सकता।", diff --git a/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/hr.json b/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/hr.json index 0e73aa5f1e..b61c583f72 100644 --- a/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/hr.json +++ b/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/hr.json @@ -77,6 +77,7 @@ "Volo.Abp.Identity:010007": "Ne možete promijeniti postavku dva faktora.", "Volo.Abp.Identity:010008": "Nije dopušteno mijenjati postavke dvofaktorske autentifikacije.", "Volo.Abp.Identity:010009": "Ne možete delegirati sami sebi.", + "Volo.Abp.Identity:010010": "The parent organization unit ('{ParentId}') does not exist in the current tenant.", "Volo.Abp.Identity:010021": "Naziv '{0}' već postoji.", "Volo.Abp.Identity:010022": "Ne možete ažurirati statički tip deklaracije.", "Volo.Abp.Identity:010023": "Ne možete izbrisati statički tip deklaracije.", diff --git a/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/hu.json b/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/hu.json index 730a831d23..ae178175a4 100644 --- a/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/hu.json +++ b/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/hu.json @@ -77,6 +77,7 @@ "Volo.Abp.Identity:010007": "Nem változtathatja meg a kétlépcsős bejelentkezés beállítását.", "Volo.Abp.Identity:010008": "Kétlépcsős bejelentkezés beállítás megváltoztatása nem megengedett.", "Volo.Abp.Identity:010009": "Nem adhatja át a saját jogosultságait.", + "Volo.Abp.Identity:010010": "The parent organization unit ('{ParentId}') does not exist in the current tenant.", "Volo.Abp.Identity:010021": "'{0}' nevű már létezik.", "Volo.Abp.Identity:010022": "Nem lehet frissíteni a statikus jogosultság típusát.", "Volo.Abp.Identity:010023": "Nem lehet törölni a statikus jogosultság típusát.", diff --git a/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/is.json b/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/is.json index da53a10657..466155a4dd 100644 --- a/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/is.json +++ b/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/is.json @@ -77,6 +77,7 @@ "Volo.Abp.Identity:010007": "Þú getur ekki breytt tveggja þátta stillingu þinni.", "Volo.Abp.Identity:010008": "Það er ekki leyfilegt að breyta tvíþátta stillingu.", "Volo.Abp.Identity:010009": "Þú getur ekki delegað þér sjálfum.", + "Volo.Abp.Identity:010010": "The parent organization unit ('{ParentId}') does not exist in the current tenant.", "Volo.Abp.Identity:010021": "Nafnið '{0}' er þegar í notkun.", "Volo.Abp.Identity:010022": "Ekki er hægt að breyta static hlutverk.", "Volo.Abp.Identity:010023": "Ekki er hægt að eyða static hlutverkum.", diff --git a/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/it.json b/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/it.json index 163ff98754..85da4fb003 100644 --- a/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/it.json +++ b/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/it.json @@ -77,6 +77,7 @@ "Volo.Abp.Identity:010007": "Non puoi modificare l'impostazione dei due fattori.", "Volo.Abp.Identity:010008": "Non è consentito modificare l'impostazione a due fattori.", "Volo.Abp.Identity:010009": "Non puoi delegare te stesso.", + "Volo.Abp.Identity:010010": "The parent organization unit ('{ParentId}') does not exist in the current tenant.", "Volo.Abp.Identity:010021": "Il nome '{0}' è già in uso.", "Volo.Abp.Identity:010022": "Non puoi modificare il tipo di richiesta statica.", "Volo.Abp.Identity:010023": "Non puoi eliminare il tipo di richiesta statica.", diff --git a/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/nl.json b/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/nl.json index 9836137c80..f374ccf994 100644 --- a/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/nl.json +++ b/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/nl.json @@ -77,6 +77,7 @@ "Volo.Abp.Identity:010007": "U kunt uw instelling voor tweefactor authenticatie niet wijzigen.", "Volo.Abp.Identity:010008": "Het is niet toegestaan om de instelling van tweefactor authenticatie te wijzigen.", "Volo.Abp.Identity:010009": "U kunt uzelf niet delegeren.", + "Volo.Abp.Identity:010010": "The parent organization unit ('{ParentId}') does not exist in the current tenant.", "Volo.Abp.Identity:010021": "Er bestaat al een met de naam '{0}'.", "Volo.Abp.Identity:010022": "Kan de naam van een statische claim niet wijzigen.", "Volo.Abp.Identity:010023": "Kan de naam van een statische claim niet verwijderen.", diff --git a/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/pl-PL.json b/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/pl-PL.json index 18f33d89c1..0ea625b9f7 100644 --- a/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/pl-PL.json +++ b/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/pl-PL.json @@ -77,6 +77,7 @@ "Volo.Abp.Identity:010007": "Nie możesz zmienić ustawienia dwóch czynników.", "Volo.Abp.Identity:010008": "Nie wolno zmieniać ustawienia dwuczynnikowego.", "Volo.Abp.Identity:010009": "Nie możesz delegować swoich uprawnień.", + "Volo.Abp.Identity:010010": "The parent organization unit ('{ParentId}') does not exist in the current tenant.", "Volo.Abp.Identity:010021": "Nazwa '{0}' już istnieje.", "Volo.Abp.Identity:010022": "Nie można zmienić typu statycznej deklaracji.", "Volo.Abp.Identity:010023": "Nie można usunąć typu statycznej deklaracji.", diff --git a/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/pt-BR.json b/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/pt-BR.json index cd796edbde..c595db3535 100644 --- a/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/pt-BR.json +++ b/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/pt-BR.json @@ -77,6 +77,7 @@ "Volo.Abp.Identity:010007": "Você não pode alterar sua configuração de dois fatores.", "Volo.Abp.Identity:010008": "Não é permitido alterar a configuração de dois fatores.", "Volo.Abp.Identity:010009": "Você não pode delegar a si mesmo.", + "Volo.Abp.Identity:010010": "The parent organization unit ('{ParentId}') does not exist in the current tenant.", "Volo.Abp.Identity:010021": "Já existe um(a) {0} com o nome.", "Volo.Abp.Identity:010022": "Não é possível alterar o tipo de declaração estática.", "Volo.Abp.Identity:010023": "Não é possível excluir o tipo de declaração estática.", diff --git a/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/ro-RO.json b/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/ro-RO.json index 3ebc98d179..aaf02bb0ff 100644 --- a/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/ro-RO.json +++ b/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/ro-RO.json @@ -77,6 +77,7 @@ "Volo.Abp.Identity:010007": "Nu vă puteţi schimba setările de autentificare în doi paşi.", "Volo.Abp.Identity:010008": "Nu este permisă modificarea setărilor autentificării în doi paşi.", "Volo.Abp.Identity:010009": "Nu vă puteţi delega singur.", + "Volo.Abp.Identity:010010": "The parent organization unit ('{ParentId}') does not exist in the current tenant.", "Volo.Abp.Identity:010021": "Numele '{0}' este deja luat.", "Volo.Abp.Identity:010022": "Nu poate fi schimbată tipul de declaraţie statică.", "Volo.Abp.Identity:010023": "Nu poate fi ştersă declaraţia statică.", diff --git a/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/ru.json b/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/ru.json index f9ddb814d4..2ff2cc064c 100644 --- a/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/ru.json +++ b/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/ru.json @@ -77,6 +77,7 @@ "Volo.Abp.Identity:010007": "Вы не можете изменить настройку двух факторов.", "Volo.Abp.Identity:010008": "Изменение двухфакторной настройки не допускается.", "Volo.Abp.Identity:010009": "Вы не можете делегировать свои собственные права.", + "Volo.Abp.Identity:010010": "The parent organization unit ('{ParentId}') does not exist in the current tenant.", "Volo.Abp.Identity:010021": "Имя '{0}' уже существует.", "Volo.Abp.Identity:010022": "Невозможно изменить тип статической декларации.", "Volo.Abp.Identity:010023": "Невозможно удалить тип статической декларации.", diff --git a/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/sk.json b/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/sk.json index 26486aa6ab..1e9cd97d56 100644 --- a/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/sk.json +++ b/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/sk.json @@ -77,6 +77,7 @@ "Volo.Abp.Identity:010007": "Dvojfaktorové nastavenie nie je možné zmeniť.", "Volo.Abp.Identity:010008": "Dvojfaktorové nastavenie nie je povolené zmeniť.", "Volo.Abp.Identity:010009": "Nemôžete delegovať svoje vlastné oprávnenia.", + "Volo.Abp.Identity:010010": "The parent organization unit ('{ParentId}') does not exist in the current tenant.", "Volo.Abp.Identity:010021": "Názov '{0}' sa už používa.", "Volo.Abp.Identity:010022": "Nie je možné zmeniť typ statického oprávnenia.", "Volo.Abp.Identity:010023": "Nie je možné odstrániť typ statického oprávnenia.", diff --git a/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/sl.json b/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/sl.json index 8ae2a2f81b..00cb1aa7e4 100644 --- a/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/sl.json +++ b/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/sl.json @@ -77,6 +77,7 @@ "Volo.Abp.Identity:010007": "Nastavitve dveh faktorjev ne morete spremeniti.", "Volo.Abp.Identity:010008": "Ni dovoljeno spreminjati nastavitve dveh faktorjev.", "Volo.Abp.Identity:010009": "Ne morete delegirati svojih pravic.", + "Volo.Abp.Identity:010010": "The parent organization unit ('{ParentId}') does not exist in the current tenant.", "Volo.Abp.Identity:010021": "Naziv '{0}' že obstaja.", "Volo.Abp.Identity:010022": "Ne morete spremeniti tipa statične deklaracije.", "Volo.Abp.Identity:010023": "Ne morete izbrisati tipa statične deklaracije.", diff --git a/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/sv.json b/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/sv.json index aef65e2b11..0f8ebf9f80 100644 --- a/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/sv.json +++ b/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/sv.json @@ -77,6 +77,7 @@ "Volo.Abp.Identity:010007": "Du kan inte ändra din tvåfaktorsinställning.", "Volo.Abp.Identity:010008": "Det är inte tillåtet att ändra inställningen för två faktorer.", "Volo.Abp.Identity:010009": "Du kan inte delegera dig själv.", + "Volo.Abp.Identity:010010": "The parent organization unit ('{ParentId}') does not exist in the current tenant.", "Volo.Abp.Identity:010021": "Namn finns: '{0}'.", "Volo.Abp.Identity:010022": "Kan inte ändra statiskt område.", "Volo.Abp.Identity:010023": "Kan inte ta bort statiskt område.", diff --git a/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/tr.json b/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/tr.json index 0a6e4d393c..3ba2d0efb6 100644 --- a/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/tr.json +++ b/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/tr.json @@ -77,6 +77,7 @@ "Volo.Abp.Identity:010007": "İki faktörlü ayarınızı değiştiremezsiniz.", "Volo.Abp.Identity:010008": "İki faktörlü ayarın değiştirilmesine izin verilmez.", "Volo.Abp.Identity:010009": "Kendinizi yetkilendiremezsiniz.", + "Volo.Abp.Identity:010010": "The parent organization unit ('{ParentId}') does not exist in the current tenant.", "Volo.Abp.Identity:010021": "{0} isminde bir birim zaten var.", "Volo.Abp.Identity:010022": "Bir statik izin tipi değiştirilemez.", "Volo.Abp.Identity:010023": "Bir statik izin tipi silinemez.", diff --git a/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/vi.json b/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/vi.json index 32c1dfe008..8767f36253 100644 --- a/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/vi.json +++ b/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/vi.json @@ -77,6 +77,7 @@ "Volo.Abp.Identity:010007": "Bạn không thể thay đổi cài đặt hai yếu tố của mình.", "Volo.Abp.Identity:010008": "Không được phép thay đổi cài đặt hai yếu tố.", "Volo.Abp.Identity:010009": "Bạn không thể ủy quyền cho chính mình.", + "Volo.Abp.Identity:010010": "The parent organization unit ('{ParentId}') does not exist in the current tenant.", "Volo.Abp.Identity:010021": "Tên '{0}' đã tồn tại.", "Volo.Abp.Identity:010022": "Không thể thay đổi kiểu của phát biểu tĩnh.", "Volo.Abp.Identity:010023": "Không thể xóa phát biểu tĩnh.", diff --git a/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/zh-Hans.json b/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/zh-Hans.json index 3a1239ddc7..d905d26290 100644 --- a/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/zh-Hans.json +++ b/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/zh-Hans.json @@ -77,6 +77,7 @@ "Volo.Abp.Identity:010007": "你不能修改你的双因素身份验证设置", "Volo.Abp.Identity:010008": "不允许修改双因素身份验证设置。", "Volo.Abp.Identity:010009": "你不能委托给自己。", + "Volo.Abp.Identity:010010": "父组织单元 ('{ParentId}') 在当前租户中不存在.", "Volo.Abp.Identity:010021": "名称：'{0}' 已存在", "Volo.Abp.Identity:010022": "不能更改静态声明的类型。", "Volo.Abp.Identity:010023": "不能删除静态声明的类型。", diff --git a/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/zh-Hant.json b/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/zh-Hant.json index a28cc6c7d4..a26b23cbc0 100644 --- a/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/zh-Hant.json +++ b/modules/identity/src/Volo.Abp.Identity.Domain.Shared/Volo/Abp/Identity/Localization/zh-Hant.json @@ -77,6 +77,7 @@ "Volo.Abp.Identity:010007": "你不能修改你的雙因素身份驗證設置", "Volo.Abp.Identity:010008": "不允許修改雙因素身份驗證設置.", "Volo.Abp.Identity:010009": "你不能委派給自己", + "Volo.Abp.Identity:010010": "父組織單元 ('{ParentId}') 在目前的租戶中不存在.", "Volo.Abp.Identity:010021": "名稱 '{0}' 已存在.", "Volo.Abp.Identity:010022": "無法更改靜態宣告的類型.", "Volo.Abp.Identity:010023": "無法刪除靜態宣告的類型.", diff --git a/modules/identity/src/Volo.Abp.Identity.Domain/Volo/Abp/Identity/OrganizationUnitManager.cs b/modules/identity/src/Volo.Abp.Identity.Domain/Volo/Abp/Identity/OrganizationUnitManager.cs index 160e37c900..cb8fa17a77 100644 --- a/modules/identity/src/Volo.Abp.Identity.Domain/Volo/Abp/Identity/OrganizationUnitManager.cs +++ b/modules/identity/src/Volo.Abp.Identity.Domain/Volo/Abp/Identity/OrganizationUnitManager.cs @@ -41,6 +41,8 @@ public class OrganizationUnitManager : DomainService [UnitOfWork] public virtual async Task CreateAsync(OrganizationUnit organizationUnit) { + await ValidateParentTenantAsync(organizationUnit.ParentId, organizationUnit.TenantId); + organizationUnit.Code = await GetNextChildCodeAsync(organizationUnit.ParentId); await ValidateOrganizationUnitAsync(organizationUnit); await OrganizationUnitRepository.InsertAsync(organizationUnit); @@ -107,6 +109,8 @@ public class OrganizationUnitManager : DomainService return; } + await ValidateParentTenantAsync(parentId, organizationUnit.TenantId); + //Should find children before Code change var children = await FindChildrenAsync(id, true); @@ -148,6 +152,21 @@ public class OrganizationUnitManager : DomainService } } + protected virtual async Task ValidateParentTenantAsync(Guid? parentId, Guid? tenantId) + { + if (!parentId.HasValue) + { + return; + } + + var parent = await OrganizationUnitRepository.FindAsync(parentId.Value); + if (parent == null || parent.TenantId != tenantId) + { + throw new BusinessException(IdentityErrorCodes.OrganizationUnitParentTenantMismatch) + .WithData("ParentId", parentId); + } + } + public virtual async Task> FindChildrenAsync(Guid? parentId, bool recursive = false) { if (!recursive) diff --git a/modules/identity/test/Volo.Abp.Identity.Domain.Tests/Volo/Abp/Identity/OrganizationUnitManager_Tests.cs b/modules/identity/test/Volo.Abp.Identity.Domain.Tests/Volo/Abp/Identity/OrganizationUnitManager_Tests.cs index 5b6ed9af27..b3a24928f5 100644 --- a/modules/identity/test/Volo.Abp.Identity.Domain.Tests/Volo/Abp/Identity/OrganizationUnitManager_Tests.cs +++ b/modules/identity/test/Volo.Abp.Identity.Domain.Tests/Volo/Abp/Identity/OrganizationUnitManager_Tests.cs @@ -1,11 +1,13 @@ -using Microsoft.AspNetCore.Identity; -using Shouldly; -using System.Linq; -using System.Threading.Tasks; +using Microsoft.AspNetCore.Identity; +using Shouldly; +using System; +using System.Linq; +using System.Threading.Tasks; using Volo.Abp.Guids; -using Volo.Abp.Uow; -using Xunit; - +using Volo.Abp.MultiTenancy; +using Volo.Abp.Uow; +using Xunit; + namespace Volo.Abp.Identity; public class OrganizationUnitManager_Tests : AbpIdentityDomainTestBase @@ -17,6 +19,7 @@ public class OrganizationUnitManager_Tests : AbpIdentityDomainTestBase private readonly ILookupNormalizer _lookupNormalizer; private readonly IUnitOfWorkManager _unitOfWorkManager; private readonly IGuidGenerator _guidGenerator; + private readonly ICurrentTenant _currentTenant; public OrganizationUnitManager_Tests() { _organizationUnitManager = GetRequiredService(); @@ -26,6 +29,7 @@ public class OrganizationUnitManager_Tests : AbpIdentityDomainTestBase _testData = GetRequiredService(); _unitOfWorkManager = GetRequiredService(); _guidGenerator = GetService(); + _currentTenant = GetRequiredService(); } [Fact] @@ -117,4 +121,39 @@ public class OrganizationUnitManager_Tests : AbpIdentityDomainTestBase ou = await _organizationUnitRepository.GetAsync("OU1", includeDetails: true); ou.Roles.FirstOrDefault(r => r.RoleId == adminRole.Id).ShouldBeNull(); } -} + + [Fact] + public async Task Should_Not_Create_Organization_Unit_With_Cross_Tenant_Parent() + { + var hostOu = await _organizationUnitRepository.GetAsync("OU1"); + + using (_currentTenant.Change(Guid.NewGuid())) + { + var newOu = new OrganizationUnit(_guidGenerator.Create(), "Cross", hostOu.Id, _currentTenant.Id); + + var ex = await Assert.ThrowsAsync( + async () => await _organizationUnitManager.CreateAsync(newOu)); + + ex.Code.ShouldBe(IdentityErrorCodes.OrganizationUnitParentTenantMismatch); + } + } + + [Fact] + public async Task Should_Not_Move_Organization_Unit_To_Cross_Tenant_Parent() + { + var hostOu1 = await _organizationUnitRepository.GetAsync("OU1"); + + OrganizationUnit tenantOu; + var tenantId = Guid.NewGuid(); + using (_currentTenant.Change(tenantId)) + { + tenantOu = new OrganizationUnit(_guidGenerator.Create(), "TenantRoot", null, tenantId); + await _organizationUnitManager.CreateAsync(tenantOu); + + var ex = await Assert.ThrowsAsync( + async () => await _organizationUnitManager.MoveAsync(tenantOu.Id, hostOu1.Id)); + + ex.Code.ShouldBe(IdentityErrorCodes.OrganizationUnitParentTenantMismatch); + } + } +}