Merge branch 'dev' into auto-merge/rel-10-6/4731

common.props

@@ -1,8 +1,8 @@
 <Project>
   <PropertyGroup>
     <LangVersion>latest</LangVersion>
-    <Version>10.6.0</Version>
+    <Version>10.7.0-preview</Version>
-    <LeptonXVersion>5.6.0</LeptonXVersion>
+    <LeptonXVersion>5.7.0-preview</LeptonXVersion>
     <NoWarn>$(NoWarn);CS1591;CS0436</NoWarn>
     <PackageIconUrl>https://abp.io/assets/abp_nupkg.png</PackageIconUrl>
     <PackageProjectUrl>https://abp.io/</PackageProjectUrl>

docs/en/Community-Articles/2026-07-07-building-a-vendor-onboarding-workflow-with-abp-low-code/post.md

@@ -0,0 +1,394 @@
+# Building a Vendor Onboarding Workflow with ABP Low-Code
+
+Vendor onboarding usually starts with a few familiar steps.
+
+A company sends its details, someone checks the documents, another person reviews the score, and the team either approves the vendor or asks for more information. After a while, the process turns into a mix of spreadsheets, uploaded files, status notes, and "who is waiting on this one?" messages.
+
+In this article, we'll build that workflow with the [Low-Code System](https://abp.io/docs/latest/low-code/index). We'll model the data in the [Low-Code Designer](https://abp.io/docs/latest/low-code/designer), let the [React runtime](https://abp.io/docs/latest/low-code/react-runtime) render the page, and then add one [custom endpoint](https://abp.io/docs/latest/low-code/custom-endpoints) for a summary that does not belong to normal CRUD.
+
+The example is an internal operations page where a team receives vendor applications, reviews compliance documents, tracks deadlines, and follows rejected or priority vendors from one place.
+
+That is a good place to try ABP Low-Code, because the first version of the workflow is mostly data, screens, validation rules, and a few process-specific actions. You do not need to hand-write a React page only to list vendor applications, upload a compliance document, or show a rejection reason when the status is rejected.
+
+We will start from an already running ABP React + EF Core application with Low-Code enabled, so the article can stay focused on the Admin Console, the Designer, and the runtime flow.
+
+## What We Are Building
+
+The workflow has one main record: `VendorApplication`.
+
+A reviewer should be able to:
+
+- Create a vendor application with company and contact details.
+- Track whether the vendor is `Submitted`, `InReview`, `Approved`, or `Rejected`.
+- Set the requested date and approval deadline.
+- Mark priority vendors.
+- Assign a category such as `Software`, `Services`, or `Hardware`.
+- Upload a logo and a compliance document.
+- Fill in a rejection reason only when the application is rejected.
+- Filter the generated grid by status, requested date, priority, and category.
+- Call a summary endpoint that returns counts for dashboard-like use.
+
+We'll also touch two extra pieces around that main record. `VendorReviewTemplate` comes from C# so you can see how code-defined metadata appears in the Designer. Later, a `VendorEscalation` model is added while the Designer is switched to `Runtime JSON`. You could build the whole workflow with one entry point, but using these three entry points makes the hybrid model visible without turning the article into three separate implementations.
+
+## A Quick Note on How Low-Code Fits Together
+
+The Low-Code Designer is where you describe the model and the UI metadata. In this article we use four areas:
+
+- `Data` for enums and entities.
+- `Pages` for the generated grid route.
+- `Forms` for the create/edit form layout.
+- `Actions` for the custom HTTP endpoint.
+
+The Designer stores metadata. The React runtime reads that metadata and renders the page at runtime. That is the important mental model: when we add a field to the entity, the field can become a grid column, a filter, a validation rule, or a form input depending on how we configure the metadata around it.
+
+There is also one database detail to keep in mind. Metadata that comes from C# code or from `Dev JSON` is source-controlled application metadata. When it introduces or changes a persisted entity, run the normal EF Core migration and database update flow before using the generated runtime page. In the validated demo for this article I used SQLite, so the migration updated the local SQLite database. `Runtime JSON` is different: it is authored at runtime, so I do not run a C# migration in that section.
+
+## Add a Code-Defined Review Template
+
+Let's start with one model that does not come from the Designer.
+
+In this workflow, vendor reviewers can use review templates. The template itself is not the center of the workflow, so I kept it focused on the review rules:
+
+```csharp
+[DynamicEnum]
+public enum VendorReviewTemplateType
+{
+    Standard = 0,
+    Security = 1,
+    Finance = 2
+}
+
+[DynamicEntity(DefaultDisplayPropertyName = nameof(Name))]
+[DynamicEntityUI(DisplayName = "Vendor Review Templates")]
+public class VendorReviewTemplate : DynamicEntityBase
+{
+    [Required]
+    [StringLength(128)]
+    [DynamicPropertyUnique]
+    public string Name { get; set; }
+
+    public VendorReviewTemplateType TemplateType { get; set; }
+    public int MinimumComplianceScore { get; set; }
+    public bool RequiresDocumentReview { get; set; }
+    public string? Notes { get; set; }
+}
+```
+
+Then include the entity in your EF Core DbContext. This is the part that makes the migration create a real backing table for the code-defined model:
+
+```csharp
+public DbSet<VendorReviewTemplate> VendorReviewTemplates { get; set; }
+
+builder.Entity<VendorReviewTemplate>(b =>
+{
+    b.ToTable(
+        VendorOnboardingLowCodeConsts.DbTablePrefix + "VendorReviewTemplates",
+        VendorOnboardingLowCodeConsts.DbSchema
+    );
+    b.ConfigureByConvention();
+    b.Property(x => x.Name).IsRequired().HasMaxLength(128);
+    b.Property(x => x.Notes).HasMaxLength(512);
+    b.HasIndex(x => x.Name).IsUnique();
+});
+```
+
+Because this model is defined in C#, treat it like the rest of your application schema changes: add the entity, add the DbSet/mapping, create/apply the EF Core migration, and then start the application.
+
+After the app starts, open **Admin Console > Low-Code Designer > Data**. The model is visible there, but it is read-only because it was defined in code.
+
+![Code-defined VendorReviewTemplate shown as read-only in the Low-Code Designer](assets/screenshots/designer-code-layer.png)
+
+Open the **Properties** tab and you can see the fields that came from the C# class. They are available to the Low-Code System, but the Designer marks them as code-owned.
+
+![The Properties tab for the code-defined VendorReviewTemplate entity](assets/screenshots/designer-review-template-properties.png)
+
+That is useful in real projects. Some metadata can be shipped with the application, while the rest of the workflow can still be designed through the Admin Console.
+
+## Create the Vendor Enums
+
+Now move to the part we actually build in the Designer.
+
+The animation below shows the Designer path in one pass. The next sections slow it down and explain the enum, entity, page, and form steps.
+
+![Creating the Designer metadata for the vendor onboarding workflow](assets/gifs/designer-hybrid-flow.gif)
+
+Open `Data > Enums` and create the status enum:
+
+```text
+VendorApplicationStatus
+Submitted
+InReview
+Approved
+Rejected
+```
+
+Before saving, the enum modal should contain the name and the four values:
+
+![The VendorApplicationStatus enum creation modal before saving](assets/screenshots/designer-enum-status-modal.png)
+
+Then create the category enum:
+
+```text
+VendorCategory
+Software
+Services
+Hardware
+```
+
+The order of the status values matters for the custom endpoint later, because the script checks the enum values by their numeric indexes. In this example `Submitted` is `0`, `Approved` is `2`, and `Rejected` is `3`.
+
+After saving, the enum detail page shows the numeric values that the runtime and scripts will use:
+
+![The saved VendorApplicationStatus enum values in the Designer](assets/screenshots/designer-enum-status-saved.png)
+
+## Create the VendorApplication Entity
+
+Go to `Data > Entities` and create `VendorApplication`.
+
+This is the model that drives the rest of the article. Add these fields:
+
+| Field | Type | Configuration |
+| --- | --- | --- |
+| `CompanyName` | `String` | Required and unique |
+| `ContactEmail` | `String` | Required, email validation |
+| `Status` | `Enum` | `VendorApplicationStatus` |
+| `RequestedOn` | `Date` | Application date |
+| `ApprovalDeadline` | `Date` | Review deadline |
+| `IsPriority` | `Boolean` | Priority flag |
+| `Category` | `Enum` | `VendorCategory` |
+| `ComplianceScore` | `Int` | Review score |
+| `Logo` | `Image` | Logo upload |
+| `ComplianceDocument` | `File` | Document upload |
+| `RejectionReason` | `String` | Optional |
+
+![VendorApplication entity definition in the Designer](assets/screenshots/designer-devjson-entity.png)
+
+The **Properties** tab is where the entity becomes more than a name. The table shows the field types, enum bindings, and source layer. Scroll down and the upload-related fields are visible with their `Image` and `File` types:
+
+![The VendorApplication properties table in the Designer](assets/screenshots/designer-vendor-application-properties.png)
+
+There is no React code yet, but we already have a lot of behavior described: required fields, uniqueness, email validation, enum fields, upload fields, and the data shape that the runtime will use.
+
+The `Image` and `File` types are worth calling out. They are not plain strings with a path. In the generated form they become upload controls, which is exactly what we need for vendor logos and compliance documents.
+
+Since `VendorApplication` is authored in the `Dev JSON` layer, it also belongs to the source-controlled model. After saving the entity metadata, create/apply the EF Core migration before you open the generated page in the runtime. This is the step that creates the backing table for the low-code entity in the database.
+
+## Generate a Grid Page
+
+The reviewers need a page where they can work with applications, so go to `Pages` and create a `dataGrid` page named `vendor-onboarding`.
+
+Bind it to `VendorApplication`.
+
+Before saving the page, the modal connects the route name, title, icon, and entity:
+
+![The vendor-onboarding data grid page modal before saving](assets/screenshots/designer-page-create-before-save.png)
+
+After the page is created, set `RequestedOn` as the default sort field, keep it descending, adjust the icon if you want, and assign `vendor-application-form` as the create/edit form:
+
+![The vendor-onboarding data grid page bound to VendorApplication](assets/screenshots/designer-devjson-page.png)
+
+For the review workflow, keep the configured columns focused on the fields reviewers use most:
+
+- Company name
+- Status
+- Requested date
+- Priority
+- Category
+
+Then configure the filters you want reviewers to use most often. In this workflow, the important filters are company, status, requested date, priority, and category. Depending on the runtime defaults, the generated grid may still expose additional fields such as contact email; the workflow is still driven by the focused page metadata above.
+
+Once the page is saved, the React runtime can resolve the route from the page metadata. The grid is generated from the entity and page configuration rather than from a hand-written React component.
+
+## Build the Create/Edit Form
+
+A grid is not enough. We also need a form that feels like the workflow.
+
+Go to `Forms` and create `vendor-application-form` for `VendorApplication`. Split the fields into three tabs:
+
+![The vendor-application-form creation modal before saving](assets/screenshots/designer-form-create-modal.png)
+
+- **Company**: `CompanyName`, `ContactEmail`, `Category`, `IsPriority`
+- **Review**: `Status`, `RequestedOn`, `ApprovalDeadline`, `ComplianceScore`, `RejectionReason`
+- **Documents**: `Logo`, `ComplianceDocument`
+
+Now add the conditional behavior for `RejectionReason`. In this demo I used two complementary rules: one rule shows the field when `Status = Rejected`, and the other hides it for non-rejected statuses.
+
+![The vendor-application-form with tabs and a conditional rule](assets/screenshots/designer-devjson-form.png)
+
+This is one of the places where Low-Code becomes more than "generate a CRUD page". The runtime does more than render a static form; it evaluates the rule while the user edits the record.
+
+## Apply the Migration Before Opening the Runtime
+
+Before opening the generated page, apply the database migration for the `Dev JSON` changes. We used `Dev JSON` for `VendorApplication`, so the Designer wrote source-controlled descriptor files under `_Dynamic`. The entity shape is now part of the application model, and the database needs the matching backing table before the React runtime can save records.
+
+That is why `Dev JSON` is a good fit during development: the metadata files and the EF Core migration can be reviewed, committed, and reproduced in another environment. If the same entity had been created in the `Runtime JSON` layer, you would not create a C# migration for that runtime edit; the metadata change would be stored in the database instead. In practice, use `Dev JSON` for development-time, source-controlled changes, and use `Runtime JSON` when you want production-time changes to be managed from the Admin Console and persisted in the database.
+
+## Try It in the React Runtime
+
+Open the generated `vendor-onboarding` page in the React runtime and create a vendor application.
+
+On the `Documents` tab, the `Logo` and `ComplianceDocument` fields are rendered as upload fields:
+
+![The generated Documents tab rendering image and file upload fields](assets/screenshots/runtime-form-documents.png)
+
+Now edit a record and change the status to `Rejected`. The `RejectionReason` field becomes available on the `Review` tab:
+
+![The Review tab showing the conditional RejectionReason field](assets/screenshots/runtime-review-rejected.png)
+
+After saving a few records, use the generated filters to narrow the list to rejected vendors. Depending on the runtime configuration, the filter panel can expose more fields than the small set you configured for the workflow; here we only use the `Status = Rejected` filter:
+
+![The generated grid filtered by Status = Rejected](assets/screenshots/runtime-grid-filtered.png)
+
+The short animation below gives a quick pass through the same runtime states: upload fields, the conditional rejection reason, and the filtered grid.
+
+![Generated upload fields, conditional review field, and grid filters in the React runtime](assets/gifs/runtime-workflow.gif)
+
+At this point we have a working page, form, validation, uploads, and filters. The important part is that all of it came from the metadata we configured in the Designer.
+
+## Add a Custom Summary Endpoint
+
+Generated CRUD is enough for day-to-day record editing, but teams often need one operation that is specific to their process.
+
+For vendor onboarding, a summary endpoint is a good example:
+
+```text
+GET /api/custom/vendor-onboarding/summary
+```
+
+In the Designer, open `Actions` and create a custom HTTP action with that route. The script can use the [Scripting API](https://abp.io/docs/latest/low-code/scripting-api) to query the same `VendorApplication` data that the generated grid uses.
+
+![The custom HTTP action configured under Actions in the Designer](assets/screenshots/designer-devjson-endpoint.png)
+
+Here is the script used in the demo:
+
+```js
+var entityName = 'Acme.VendorOnboardingLowCode.Procurement.VendorApplication';
+var vendorQuery = await db.query(entityName);
+var totalVendors = await db.count(entityName);
+var submittedVendors = await vendorQuery.where(x => x.Status === 0).count();
+var approvedVendors = await vendorQuery.where(x => x.Status === 2).count();
+var today = query.today || new Date().toISOString().slice(0, 10);
+var overdueReviews = await vendorQuery
+  .where(x => x.ApprovalDeadline != null && x.ApprovalDeadline < today && x.Status !== 2)
+  .count();
+
+return ok({
+  totalVendors: totalVendors,
+  submittedVendors: submittedVendors,
+  approvedVendors: approvedVendors,
+  overdueReviews: overdueReviews,
+  evaluatedOn: today
+});
+```
+
+Use the entity name shown in your Designer. In the screenshots, it is `Acme.VendorOnboardingLowCode.Procurement.VendorApplication`.
+
+When the endpoint runs, it returns the current counts from the low-code records:
+
+![The JSON response of the custom summary endpoint](assets/screenshots/custom-endpoint-summary.png)
+
+That is the bridge I like here. The page and form stay metadata-driven, but the process-specific summary is a short script exposed as a custom endpoint.
+
+## Add One Runtime Model
+
+Now switch the Designer layer to `Runtime JSON` and add one more entity: `VendorEscalation`.
+
+This model represents the items that need extra attention. It could have been created in the same place as `VendorApplication`; I am adding it here only to show that runtime-authored metadata participates in the same Low-Code System.
+
+Unlike the code and `Dev JSON` examples above, this runtime-authored model is not part of the source-controlled migration flow in this walkthrough.
+
+The create modal is the same Designer experience, but the selected layer is now `Runtime JSON`:
+
+![The VendorEscalation entity creation modal in the Runtime JSON layer](assets/screenshots/designer-vendor-escalation-save-modal.png)
+
+![The VendorEscalation entity authored in the Runtime JSON layer](assets/screenshots/designer-runtime-entity.png)
+
+Create a data grid page for it and open it in the React runtime:
+
+![The runtime-generated Vendor Escalations page](assets/screenshots/runtime-vendor-escalations.png)
+
+From the user's point of view, it behaves like the first generated page. From the metadata point of view, we have now seen code-defined metadata, Designer-authored metadata, and runtime-authored metadata in the same application.
+
+## Read the Same Data from ABP Code
+
+The last bridge is application code.
+
+Sometimes the generated page is not the only consumer. You may want a typed application service, a scheduled job, or another API to read the same low-code records. The code below shows the idea by returning a backlog summary:
+
+```csharp
+private readonly IRepository<DynamicEntity, Guid> _vendorApplicationRepository;
+private readonly IAsyncQueryableExecuter _queryableExecuter;
+
+public async Task<VendorBacklogDto> GetBacklogAsync()
+{
+    var entityDescriptor = DynamicModelManager.Instance.Find(
+        "Acme.VendorOnboardingLowCode.Procurement.VendorApplication"
+    );
+
+    if (entityDescriptor == null)
+    {
+        throw new UserFriendlyException("VendorApplication model was not found.");
+    }
+
+    var query = await _vendorApplicationRepository
+        .SetEntityName(entityDescriptor.Name)
+        .GetQueryableAsync();
+    var today = DateOnly.FromDateTime(Clock.Now);
+    var priorityQuery = query.Where(vendor =>
+        vendor.Data["IsPriority"] != null &&
+        (bool?)vendor.Data["IsPriority"] == true);
+
+    var nextPriorityVendor = await _queryableExecuter.FirstOrDefaultAsync(
+        priorityQuery.OrderByDescending(vendor =>
+            (DateOnly?)vendor.Data["RequestedOn"]));
+
+    return new VendorBacklogDto
+    {
+        TotalVendors = checked((int)await _queryableExecuter.LongCountAsync(query)),
+        PriorityVendors = checked((int)await _queryableExecuter.LongCountAsync(priorityQuery)),
+        RejectedVendors = checked((int)await _queryableExecuter.LongCountAsync(
+            query.Where(vendor =>
+                vendor.Data["Status"] != null &&
+                (int?)vendor.Data["Status"] == 3))),
+        OverdueReviews = checked((int)await _queryableExecuter.LongCountAsync(
+            query.Where(vendor =>
+                vendor.Data["ApprovalDeadline"] != null &&
+                (DateOnly?)vendor.Data["ApprovalDeadline"] < today &&
+                vendor.Data["Status"] != null &&
+                (int?)vendor.Data["Status"] != 2))),
+        NextPriorityVendor = nextPriorityVendor?.GetData<string>("CompanyName")
+    };
+}
+```
+
+![The typed backlog summary returned by the application service](assets/screenshots/code-backlog-summary.png)
+
+The important detail is that the aggregate operations stay on `IQueryable`; the code does not load every vendor into memory just to count them. This is not a replacement for the generated page. It is the other direction: use the generated page for the admin experience, then read the same records from normal ABP code when another part of the application needs them.
+
+## Going Further
+
+The workflow we built is intentionally focused, but the same shape can grow in a few directions:
+
+- Add permissions around the generated pages and custom endpoint.
+- Add more form rules for review-specific fields.
+- Add an approval notification after a vendor is accepted.
+- Add a scheduled job that checks overdue applications.
+- Build a dashboard widget on top of the summary endpoint.
+
+The main pattern stays the same: model the data in the Low-Code Designer, let the React runtime render the operational page, and add code or scripting only for the parts that are specific to your business process.
+
+## Conclusion
+
+ABP Low-Code is useful when the first version of a business workflow is mostly metadata: entities, fields, filters, forms, validation, uploads, and a few custom actions.
+
+In this vendor onboarding example, the `VendorApplication` model gave us a generated grid and form, the runtime handled upload fields and conditional UI, and a custom endpoint added the summary that CRUD would not provide by itself. We also saw that low-code metadata can come from the Designer, from runtime JSON, or from C# code when you need that bridge.
+
+That is the part worth remembering: you can start with a working admin experience quickly, then extend the workflow where the generated behavior stops being enough.
+
+### Further Reading
+
+- [Low-Code System Overview](https://abp.io/docs/latest/low-code/index)
+- [Low-Code Designer](https://abp.io/docs/latest/low-code/designer)
+- [React Runtime](https://abp.io/docs/latest/low-code/react-runtime)
+- [Custom Endpoints](https://abp.io/docs/latest/low-code/custom-endpoints)
+- [Scripting API](https://abp.io/docs/latest/low-code/scripting-api)

docs/en/Community-Articles/2026-07-07-building-a-vendor-onboarding-workflow-with-abp-low-code/summary.md

@@ -0,0 +1 @@
+Build a vendor onboarding workflow with ABP Low-Code: model vendor applications in the Designer, let the React runtime render the grid and form, then add a custom endpoint and a typed ABP code bridge for process-level counts.

docs/en/Community-Articles/2026-07-07-introducing-abp-low-code/post.md

@@ -0,0 +1,243 @@
+# Introducing ABP Low-Code: Build Real ABP Apps in Minutes
+
+**Create runtime-managed pages, generated React screens, code-first C# entities, and Script API extensions without leaving the ABP application model.**
+
+The opening loop below is the outcome this article is proving: one ABP application moving from runtime editing to generated operational screens and then into code-backed extension points.
+
+![ABP Low-Code runtime loop — grids, forms, calendars, and pipelines inside one ABP app](assets/gifs/eventflow-hero-loop.gif)
+
+> **Want to try the same path?** Start from ABP Studio, enable the Low-Code runtime and designer, define pages in the Admin Console, and see them resolve inside the running ABP app.
+
+---
+
+## ABP Low-Code at a glance
+
+| Runtime authoring | Generated screens | ABP-native extensibility | One application model |
+| :---: | :---: | :---: | :---: |
+| Define and update pages in the Admin Console | Grid, Form, Calendar, Kanban, Gallery, Dashboard | Code-first entities, Script API actions, and C# query paths | Runtime metadata, generated UI, and application code stay together |
+
+---
+
+## Built into the ABP Platform
+
+Low-code is most useful when speed does not create a separate stack to maintain later.
+
+That is where many low-code products start to strain. They move quickly at the beginning, then force a second implementation track when the app needs permissions, auditability, custom logic, or tighter integration with existing application code.
+
+ABP Low-Code takes a different path. It runs **inside the ABP Platform**, so runtime-managed pages are part of an application foundation that already includes identity, permissions, audit logging, APIs, and code-level extensibility.
+
+---
+
+## Edit at runtime. See it in the app.
+
+In the Low-Code Designer inside the Admin Console, you update a runtime-managed page. A few seconds later, the same application surface is visible in the live app. No rebuild loop. No parallel front-end implementation. No "we will wire it later" gap between authoring and runtime.
+
+ABP Low-Code shortens the cycle from model change to running screen while keeping the output grounded in the same ABP application.
+
+The screenshot below shows that authoring step directly: a runtime page is being configured in the Admin Console's Low-Code Designer, where low-code defines the grid, form, actions, and view composition that the live application will resolve.
+
+![ABP Low-Code designer workspace for a runtime page](assets/screenshots/admin-console-lowcode.png)
+
+> **What this shows:** authoring and runtime are connected. Pages are defined in the designer and resolved in the running application.
+
+---
+
+## CRUD is table stakes
+
+If low-code only saves you from drawing a table and a form, it is not enough. Business applications need richer operational surfaces.
+
+In the generated app, the `Events` screen ships with search, actions, filters, and form-driven editing. The form structure already understands tabs, relations, validation, and business-shaped input instead of leaving you with a blank shell to finish by hand.
+
+The next GIF shows the actual runtime page produced from that model: first the generated `Events` grid with operational actions, then the generated form with structured inputs instead of a blank CRUD shell.
+
+![Generated event grid and generated event form](assets/gifs/eventflow-grid-form-flow.gif)
+
+The point is not just generated CRUD. It is generated CRUD that already looks like the operational screens teams maintain in real applications.
+
+---
+
+## One model, multiple operational screens
+
+Business users do not think in one view. Operators want a calendar for scheduling, a kanban board for workflow, a grid for bulk operations, a gallery when media matters, and a dashboard when they need the state of the business at a glance.
+
+ABP Low-Code keeps those surfaces attached to the same underlying model. The same `Session` model can appear as a **calendar** for planning and a **kanban pipeline** for operational flow. The same generated app can also include a **speaker gallery** and an **overview dashboard** for metrics.
+
+The next GIF keeps the same `Session` model but changes how the team works with it: calendar for planning, then kanban for operational flow, without rebuilding a second screen by hand.
+
+![The same runtime model shown as calendar and kanban views](assets/gifs/eventflow-calendar-kanban-flow.gif)
+
+The dashboard screenshot below continues that same application story. It is another surface generated around the same underlying data, this time optimized for KPIs, counts, and current operational status.
+
+![Overview dashboard in the live runtime app](assets/screenshots/overview-dashboard.png)
+
+This is where ABP Low-Code starts to feel less like a form generator and more like a runtime application layer: one model, many working screens, no second implementation track for each view type.
+
+---
+
+## When low-code needs code
+
+The real differentiator is not that ABP Low-Code can go fast. It is that **speed does not require isolation from the application foundation**.
+
+When generated CRUD is not enough, you extend the same app instead of throwing the low-code layer away.
+
+ABP Low-Code exposes a server-side **Script API** inside the same application model. That scripting surface can back:
+
+- **Custom endpoints** when the UI needs an API-shaped response.
+- **Interceptors** when create or update commands need validation or mutation.
+- **Event handlers** when logic should react to runtime events.
+- **Background jobs** when work should continue asynchronously.
+- **Background workers** when operational logic should run on a schedule.
+
+In this article, the visible proof happens to be `GET /api/custom/eventflow/highlights`. The next GIF focuses on an endpoint because it is the easiest proof surface to read. But the broader point is that endpoints are only one consumer of the same low-code scripting layer.
+
+That hybrid model matters in both directions:
+
+- **Code-first ABP entities can be surfaced in low-code flows and runtime pages.**
+- **Low-code-managed data and screens stay reachable from Script API actions, application services, repository queries, and custom endpoints.**
+- **Teams do not lose architectural control just because they gained a faster authoring layer.**
+
+The next GIF steps into that Script API surface. In the same Admin Console, a script-backed low-code endpoint is opened, executed from the built-in test area, and its returned payload is shown immediately below so you can see runtime data flowing through an API-shaped contract.
+
+![Script API endpoint definition and executed dry-run result inside the Admin Console](assets/gifs/eventflow-custom-endpoint-flow.gif)
+
+The actual capability is the shared ABP application model behind it: script when runtime logic is enough, C# when typed application services and repository queries are the better fit.
+
+This is the difference between "low-code as a shortcut" and "low-code as part of your application platform."
+
+---
+
+## From code-first entity to generated page
+
+The first direction is code-first to low-code. A **code-first** `SponsorActivation` entity checked into the ASP.NET Core project can still become a working runtime page without forking into a separate low-code-only model.
+
+The code-first entity carries the same metadata that ABP Low-Code uses to generate the page:
+
+```csharp
+[DynamicEntity(DefaultDisplayPropertyName = nameof(CompanyName))]
+[DynamicEntityUI("Sponsor Activations")]
+[DynamicEntityAttachments("application/pdf", "image/*", MaxFileCount = 4)]
+public class SponsorActivation : DynamicEntityBase
+{
+    [Required]
+    [DynamicPropertyUI(DisplayName = "Sponsor")]
+    public string CompanyName { get; private set; }
+
+    [Required]
+    [EmailAddress]
+    [DynamicPropertyUI(DisplayName = "Contact Email")]
+    public string ContactEmail { get; private set; }
+
+    public SponsorActivationStatus Status { get; set; }
+
+    [DynamicForeignKey("EventFlow.Events.Event", "Title")]
+    public Guid? EventId { get; set; }
+
+    [DynamicForeignKey("Volo.Abp.Identity.IdentityUser", nameof(IdentityUser.UserName), ForeignAccess.View)]
+    public Guid? OwnerUserId { get; set; }
+
+    [DynamicPropertyType(EntityPropertyType.Money)]
+    public decimal ActivationBudget { get; set; }
+
+    [DynamicPropertyImageOptions("image/png", "image/jpeg")]
+    public string? BrandLogo { get; set; }
+
+    [DynamicPropertyFileOptions("application/pdf", ".pptx", ".docx")]
+    public string? ActivationBrief { get; set; }
+}
+```
+
+That class lives as normal C# source, gets migrated like the rest of the application, and is seeded with real records so the runtime page does not open as an empty shell.
+
+Inside the designer, selecting the `SponsorActivation` entity auto-generates the page identity, binds the grid to the entity, and lands on a real runtime route at `/dynamic/sponsor-activation`. The generated surface includes sponsor, email, event lookup, owner lookup, budget, image, and file fields directly from the C# model.
+
+The next GIF shows that bridge in action: a new code-first `SponsorActivation` entity is selected inside low-code, a page is generated from its metadata, and the resulting runtime route opens with the modeled fields already wired in.
+
+![ABP Low-Code selecting the SponsorActivation C# entity, generating the page, and opening the resulting runtime surface](assets/gifs/eventflow-page-builder.gif)
+
+The screenshot after that is the resulting page, not a placeholder. You are looking at the generated form that came from the C# entity definition, including lookups, budget handling, image upload, and file upload fields.
+
+![Generated SponsorActivation form showing lookups, budget, image, and file fields coming directly from the C# entity](assets/screenshots/sponsor-activation-form.png)
+
+That is the distinction that matters: code-first ABP entities can move through low-code without becoming throwaway artifacts, and low-code-generated surfaces remain part of the same application story.
+
+---
+
+## Low-code data stays reachable from C#
+
+The bridge also works in the other direction. A normal ABP application service can query a low-code model through `IRepository<DynamicEntity, Guid>`, apply real filters, and combine that result with code-first aggregates.
+
+The service behind the endpoint in the previous section looks like this:
+
+```csharp
+public async Task<EventFlowLowCodeProofDto> GetHybridSummaryAsync()
+{
+    var liveSessionQuery = (await _dynamicEntityRepository
+            .SetEntityName("EventFlow.Events.Session")
+            .GetQueryableAsync())
+        .Where("int(it[\"Status\"]) == @0", 2);
+
+    var publicSessionQuery = liveSessionQuery
+        .Where("bool(it[\"IsPublic\"]) == @0", true);
+
+    var sponsorQuery = (await _sponsorActivationRepository.GetQueryableAsync())
+        .Where(activation =>
+            activation.Status == SponsorActivationStatus.Approved ||
+            activation.Status == SponsorActivationStatus.Live);
+
+    var liveSessionCount = await AsyncExecuter.CountAsync(liveSessionQuery);
+    var publicSessionCount = await AsyncExecuter.CountAsync(publicSessionQuery);
+    var activeSponsorActivationCount = await AsyncExecuter.CountAsync(sponsorQuery);
+
+    return new EventFlowLowCodeProofDto
+    {
+        LiveSessionCount = liveSessionCount,
+        PublicSessionCount = publicSessionCount,
+        ActiveSponsorActivationCount = activeSponsorActivationCount
+    };
+}
+```
+
+Here, low-code-managed `Session` rows are filtered from C# with real `Where(...)` clauses, then combined with the typed `SponsorActivation` repository. The endpoint and dashboard are just one presentation surface for that shared ABP query path.
+
+That is the ABP difference: low-code data stays reachable from code, and code-first entities stay reachable from low-code.
+
+---
+
+## Why ABP Low-Code matters
+
+The value is not novelty. It is a faster way to build real business applications without separating speed from the application foundation.
+
+- **Speed without replatforming.** Runtime-managed screens reduce delivery time without moving the team onto a separate application stack.
+- **Governance without friction.** Permissions, identity, auditability, and ABP platform foundations stay part of the story from day one.
+- **Extensibility without rewrite pressure.** When custom behavior shows up, the same application can be extended instead of replacing the low-code output.
+
+That is the core ABP Low-Code promise: faster delivery, still inside the application model you can extend.
+
+---
+
+## Try it yourself
+
+The public starting point for ABP Low-Code is **ABP Studio**.
+
+The screenshot below is the exact toggle in the ABP Studio solution wizard where low-code runtime and designer support are enabled for a new ABP solution.
+
+![ABP Studio new solution wizard with the Low-Code runtime and designer option enabled](assets/screenshots/abp-studio-lowcode-system.png)
+
+1. Open **ABP Studio** and create a new solution.
+2. In the solution wizard, enable **Include Low-Code runtime and designer**.
+3. Complete the wizard, then run the generated backend and React UI from the solution.
+4. Sign in with the administrator account created for that solution.
+5. Open **Admin Console** to define runtime-managed entities, forms, pages, permissions, endpoints, and script actions.
+6. Switch to the application side to see those changes resolve live in the running app.
+
+---
+
+## Further reading
+
+- [ABP Low-Code Designer Documentation](https://abp.io/docs/latest/low-code/designer)
+- [ABP Low-Code Configuration & Fluent API](https://abp.io/docs/latest/low-code/fluent-api)
+- [ABP Low-Code Scripting API](https://abp.io/docs/latest/low-code/scripting-api)
+- [ABP Low-Code Script Actions](https://abp.io/docs/latest/low-code/script-actions)
+- [ABP Low-Code Interceptors](https://abp.io/docs/latest/low-code/interceptors)
+- [ABP Studio Documentation](https://abp.io/docs/latest/studio)
+- [Get Started with ABP: Creating a Layered Web Application](https://abp.io/docs/latest/get-started/layered-web-application)

docs/en/Community-Articles/2026-07-07-introducing-abp-low-code/summary.md

@@ -0,0 +1 @@
+Discover how ABP Low-Code blends runtime page building with code-first entities, C# queries, and extensible application logic.

docs/en/Community-Articles/2026-07-17-Empathy-At-Work/Post.md

@@ -0,0 +1,186 @@
+# Empathy in the Workplace for Software Companies
+
+My articles are mostly technical but this time I want to mention about a very important soft-skill in workplaces.
+That's empathy! This is an emotional skill (EQ) which is important like IQ but without this skill you cannot have charisma at your workspace. 
+For those who don't know what's charisma at workspace check out my previous article section 👉 [whats-charisma-at-work](https://abp.io/community/articles/my-speakers-view-of-convex-summit-2026-3uk6ln1l#so-lets-think-whats-charisma-at-work).
+Even though empathy comes out of the box with your character, if you realize you lack of it you can improve this level.
+
+![hero](images/hero.png)
+
+## What's Empathy?
+
+**It's a discipline which puts behaviors to human-centered practices.** 
+**Why we do it?** For understanding users’ goals, restrictions, emotions, mentality and tradeoffs. Then using that understanding to improve what teams build, sell, market and support.
+**Why do we need it?** Simple! If you don't know other's mentality, you most probably go by chance.
+
+**Empathy means making an effort to understand how another person sees a feature, message, workflow or pricing decision.**
+
+>  Great software is not created only with clean code, attractive designs, marketing campaigns or polished sales demos.
+
+It is created when teams understand the people behind the requirements:
+
+- What are users trying to achieve?
+- What do they already know?
+- What confuses or slows them down?
+- What makes them trust the product?
+- What do they see as valuable?
+
+For a software company, empathy should not be treated only as a soft skill or company value. It should be a practical way to replace internal assumptions with real evidence about users, buyers, administrators, developers and other people affected by the product.
+
+Empathy needs to be a cross-functional responsibility. Developers, designers, product managers, sales, marketing, support and leaders all have visibility into different aspects of the customer experience.
+ 
+
+## What Empathy Means in a Software Company
+
+There are two components of empathy:
+
+* **Affective empathy**:  is experiencing the same emotions as another person.
+
+* **Cognitive empathy**: is the ability to understand another person's perspective, intentions, needs, desires, concerns and constraints.
+
+Both are important. However, cognitive empathy is usually more useful when teams review a feature, workflow, message, onboarding process or pricing decision.
+
+It encourages the team to ask what a specific person would understand and experience.
+
+> **The useful question is not:**
+> “Would I like this?”
+>
+> **It is:**
+> “Would this specific user, in this situation, with this knowledge and these limitations, understand the value and complete the task?”
+
+This difference is important because employees know much more about the product than customers do.
+
+> A workflow that is easy to the developer who implemented it, **may be confusing to a first time user**.
+> A msg that sounds clear to a software engineer **can be a technical jargon to a buyer**.
+> A feature that seems simple in a sales demo **can still be hard to use in a real company.**
+
+Affective empathy also matters because it encourages people to care about customers and take community-minded actions. But emotion is not always a good guide for assessment. 
+A great customer story can recieve too much attention, even when it does not represent most users.Emotional pressure may cause stress or wrong decisions. 
+
+
+
+---
+
+
+
+A better approach is to combine emotional concern with structured questions:
+
+- What kind of disappointment or confusion might this situation cause?
+- What is the user trying to achieve?
+- What information can the user see?
+- What would the user reasonably understand?
+- What could stop the user from continuing?
+- What would make the user trust the product?
+
+In simple terms:
+
+> Empathy means testing our assumptions and learning how real users actually think, feel and use the product or feature.
+
+ALWAYS ASK YOURSELF:
+
+> **If I were using this feature / app, what would I criticize?**
+
+I know *we can easily criticize other people's work* but when it comes to criticize our own work we just can't do it. Because you know the difficulties of your work and you don't know about other people's difficulties. That's why you cannot truly criticize yourself. But the real success comes after you improve your own critizing skills. 
+
+**Sit on the other side of the desk for a minute please**
+
+---
+
+![Why empathy matters in software development?](images/why-empathy.png)
+
+---
+
+## Empathy Is a Cross-Functional Responsibility
+
+![Empathy questions for developers, designers, sales, marketing and the wider team](images/roles.png)
+
+Each team member should see a different part of the customer reality.
+
+| Team             | Ask your self this question                                  | Inspect these things...                                      |
+| ---------------- | ------------------------------------------------------------ | ------------------------------------------------------------ |
+| Developers       | Where might a new user get lost, stuck or confused by the system? If users wait on this screen so much, will they close the app? | Defaults, errors, performance, learnability, edge cases and technical friction |
+| Designers        | Does the interface match the user’s language, expectations, abilities and situation? Is it understandable? | Navigation, accessibility, cognitive load, interaction flow and error recovery |
+| Product managers | Are we solving a real and important user problem?            | User goals, priorities, evidence, value and expected outcomes |
+| Sales            | What would make a buyer question the value, risk, effort or credibility? | Demo flow, objections, trust signals, implementation concerns and time to value |
+| Marketing        | Would the intended customer recognize the problem and believe the promise? | Positioning, jargon, calls to action, expectation-setting and message-market fit |
+| Support          | Where does the product repeatedly cause confusion or extra work? | Ticket themes, escalations, documentation gaps and common workarounds |
+| Leaders          | What in our process makes customer understanding difficult or optional? | Incentives, priorities, team structure, review habits, tech trends and psychological safety |
+
+---
+
+## ISO Standard of Empathy Loop
+
+And yes! There is even a standard for what I'm talking about. That is 9241-210, the ISO standard.
+Its full name is ***Ergonomics of human-system interaction***. It covers all the works which has interactivity. 
+So our application screens, APIs are all included in this standard. 
+The main idea is simple: teams should design software around real users, their goals and their working environment. 
+Not only around technical requirements. 
+These 6 steps about how to design a better system, puts customers in the center.
+
+ ![iso-9241-210](images/iso-9241-210.png)
+
+Let me adjust these to a software developing team:
+
+1. Decide how user experience work will be managed, who is responsible and what risks or limitations exist. 
+   The below are the different areas to understand the feature/app/requirements:
+   - User interviews
+   - Customer calls
+   - Support quetions
+   - Sales notes
+   - Product analytics
+   - Surveys
+   - Session recordings
+   - Contextual observation
+   - Customer feedback
+   - Win-loss analysis
+2. Learn your  users, what they want to do, where they use the product and what problems they face. 
+   In this section you really do empathy. Understand your user’s:
+   - Goals
+   - Concerns
+   - Knowledge level
+   - Mental model
+   - Limitations
+   - Expectations
+   - Work environment
+   - Emotional state
+3. Turn user needs into clear and testable requirements.
+   - For example imagine there's a problem like Users don't use the reporting module. 
+     We need to open an issue for this as "*New users can't easily find the information they need to prepare a weekly performance report.*"
+4. Build ideas, wireframes, prototypes or simulations. 
+   It is better to test simple versions early before spending too much time on development. 
+   You can do the followings:
+   - Prototypes
+   - New workflows
+   - Updated copy
+   - Better defaults
+   - Simplified onboarding
+   - Improved documentation
+   - Pricing changes
+   - Sales and marketing materials
+5. Test the product with users or UX experts. Check whether it is easy to use and whether it meets user requirements. And be open to the discussions. 
+   You can test via the following methods:
+   - Usability testing
+   - Customer interviews
+   - Prototype testing
+   - Cognitive walkthroughs
+   - Heuristic reviews
+   - A/B tests
+   - Product analytics
+   - Write feedback forms
+6. If there're still problems, improve the design and test again. 
+   The process is complete, once the critical user requirements are fulfilled.
+   Empathy isn’t a one-day workshop. 
+
+---
+
+
+
+## Better Empathy, Better Software
+
+![quote](images/quote.png)
+
+It is used by developers to predict failure, designers to decrease cognitive dissonance, sales teams to quantify buyer risk, marketers to speak in the language of the customer and leaders to desgn systems that encourage learning rather than assumptions.
+
+**When teams regularly inquire about how their work will be understood, used, trusted and valued by the users on the other side of the screen, they create products they take pride in using, recommending and standing behind.** 
+
+Thanks for reading ...

docs/en/Community-Articles/2026-07-17-WAD-RECAP/post.md

@@ -0,0 +1,64 @@
+<span style="background-color: transparent;"><span style="color: rgb(0, 0, 0);"><span style="font-family: Poppins, sans-serif;"><span style="font-size: 11pt;">WeAreDevelopers World Congress 2026 has come to an end, and we'd like to thank everyone who stopped by the ABP booth in Berlin!</span></span></span></span>
+
+<span style="background-color: transparent;"><span style="color: rgb(0, 0, 0);"><span style="font-family: Poppins, sans-serif;"><span style="font-size: 11pt;">We had the opportunity to meet developers, architects, engineering leaders, and technology enthusiasts from around the world. It was a pleasure connecting with so many members of the developer community, hearing about the projects you're building, and discussing the challenges and opportunities shaping modern software development.</span></span></span></span>
+
+![ABP team at WeAreDevelopers World Congress 2026.1](https://abp.io/api/file-management/file-descriptor/share?shareToken=CfDJ8BFJWl%2BAUE9Cj%2FpQ216BBS4zHy%2BR4dF3%2BYf%2FtQCpm6USG%2BPfkEFUE0giWmqZzA%2FqHbedsADTkW5jxPZVxyJjD1ZxYkCFVpgySB8KSYBTBAdDql%2FEFmCA8GZ7%2F1p0W2Y5V2ob%2F5I77rotPvY3K2lPaKkH4WPQnNbou02%2BJVW6wPxN)
+
+![ABP team at WeAreDevelopers World Congress 2026.2](https://abp.io/api/file-management/file-descriptor/share?shareToken=CfDJ8BFJWl%2BAUE9Cj%2FpQ216BBS69OYPeQbcVnawHZSL4ohAgZW3zQ%2BLnKM2ZJcj3mVMXlqXqyI7JQNCfbjJODmfRzdEaEyjXI2Afgx4q9gnOTM%2F8jfISltQ%2FhJIlLt8cyKzG4t%2FLWhjP4K0olwpw2AxU1FHx30pKKKb03NCGPF%2BXoq67)
+
+## **<span style="background-color: transparent;"><span style="color: rgb(0, 0, 0);"><span style="font-family: Lexend, sans-serif;"><span style="font-size: 17pt;">Great Conversations and Product Demos</span></span></span></span>**
+
+<span style="background-color: transparent;"><span style="color: rgb(0, 0, 0);"><span style="font-family: Poppins, sans-serif;"><span style="font-size: 11pt;">Throughout the event, our team showcased the latest developments across the ABP ecosystem, including ABP Framework, ABP Studio, and our AI-powered development capabilities.</span></span></span></span>
+
+<span style="background-color: transparent;"><span style="color: rgb(0, 0, 0);"><span style="font-family: Poppins, sans-serif;"><span style="font-size: 11pt;">We had countless conversations about modular application development, clean architecture, microservices, AI-assisted development, and how teams can build enterprise applications faster while maintaining long-term quality and maintainability.</span></span></span></span>
+
+<span style="background-color: transparent;"><span style="color: rgb(0, 0, 0);"><span style="font-family: Poppins, sans-serif;"><span style="font-size: 11pt;">Thank you to everyone who shared feedback, asked questions, and explored how ABP can support your development journey.</span></span></span></span>
+
+![ABP team at WeAreDevelopers World Congress 2026.3](https://abp.io/api/file-management/file-descriptor/share?shareToken=CfDJ8BFJWl%2BAUE9Cj%2FpQ216BBS5Lh7%2Fs%2BJm9dBfa89UIM8DtdlERFkfiUAx2DzqxE0v8z5hf%2BDWpFiiYVOjWq5NTdFxaqqzM079kwIYLEGcL7LljvWtjm5EZtbFYBlqXt8P4stnEmMSclaZocHZp4OgS%2BfN0caba4RQpLQgjIESBICFU)
+
+![ABP team at WeAreDevelopers World Congress 2026.4](https://abp.io/api/file-management/file-descriptor/share?shareToken=CfDJ8BFJWl%2BAUE9Cj%2FpQ216BBS4MxSzQqrl5ZNL%2BYgzHUxeTjm0uv%2B68PDOkP8P%2BwVJeSiVYFwsyumyB2tI85Ik5nJMbWt5zzaOHUUhYKKSHFZMRg4uAcAVSyT9hIdF3G3DeN6lfzCraFeA7SOvbgPTSiho6VxgzIndricFCd6bfMleD)
+
+## **<span style="background-color: transparent;"><span style="color: rgb(0, 0, 0);"><span style="font-family: Lexend, sans-serif;"><span style="font-size: 17pt;">Sharing Our Experience on Stage</span></span></span></span>**
+
+In addition to connecting with attendees at our booth, we were proud to see our Co-founder, **Halil İbrahim Kalkan**, speak at WeAreDevelopers World Congress 2026.
+
+His session, **"Dynamic Entities in .NET: Building Low-Code Systems on Top of Entity Framework Core"** explored how developers can build flexible, dynamic applications while leveraging the power of Entity Framework Core and the .NET ecosystem.
+
+It was a great opportunity to share the engineering practices and ideas behind ABP with the wider developer community. Thank you to everyone who attended the session and joined the discussion.
+
+![ABP team at WeAreDevelopers World Congress 2026.5](https://abp.io/api/file-management/file-descriptor/share?shareToken=CfDJ8BFJWl%2BAUE9Cj%2FpQ216BBS6o2J%2FNrkCu8kKnfIGPt4h9zpeS61T2EHZ76ICCnBJlBMiQbXHWjHfPa7ZrWWmSA8om%2F5%2FPGUtcVR9yeGXj7jckumTHqSk1hTDQLDrs8pyYs4K1hz3FOpDmsNo8DBxaf8BDBtYY8RnfSMjUuhTiTMVn)
+
+## **<span style="background-color: transparent;"><span style="color: rgb(0, 0, 0);"><span style="font-family: Lexend, sans-serif;"><span style="font-size: 17pt;">More Than Just a Conference</span></span></span></span>**
+
+<span style="background-color: transparent;"><span style="color: rgb(0, 0, 0);"><span style="font-family: Poppins, sans-serif;"><span style="font-size: 11pt;">WeAreDevelopers World Congress wasn't only about technical sessions. The event also featured interactive experiences, including a lively arcade gaming area, creating plenty of opportunities for attendees to relax, connect, and enjoy the conference between talks.</span></span></span></span>
+
+<span style="background-color: transparent;"><span style="color: rgb(0, 0, 0);"><span style="font-family: Poppins, sans-serif;"><span style="font-size: 11pt;">This is the approach I'd recommend. It keeps the ABP story focused while giving you a natural place to include photos or videos of the arcade area.</span></span></span></span>
+
+[![Watch the Gaming Area video on YouTube](https://abp.io/api/file-management/file-descriptor/share?shareToken=CfDJ8BFJWl%2BAUE9Cj%2FpQ216BBS7Zcq8bydK7%2BRRT0moIRkCgYSX6gkXffggpSCpS7%2B%2BZQuC42apGawV4nYr%2FKDuY7UHtlw7AbIFV5cIIevx2UqQ1IPG%2Bp4IWeYKH0isSwi0Jk36jBkH21UQiNlUFnif38Cd8copX22EX1eGV0DGpwjId)](https://youtu.be/K2WzoMfO76k)
+
+![ABP team at WeAreDevelopers World Congress 2026.7](https://abp.io/api/file-management/file-descriptor/share?shareToken=CfDJ8BFJWl%2BAUE9Cj%2FpQ216BBS5E2azupUQeKZCFpz8uOxJfDT%2BoD%2B6sKWEDVrQZLKPgwWauQman6CjAA35QPNHDPaR89CJNnOaqAr%2BDVZNUF5LLpqtkkbhDxL8cs19hRvOozR%2B%2FEMDMLQv05ZicCEswkaH68pIi8Htau91x2j%2B%2FZUNY)
+
+## **<span style="background-color: transparent;"><span style="color: rgb(0, 0, 0);"><span style="font-family: Lexend, sans-serif;"><span style="font-size: 17pt;">Meeting The Developer Community</span></span></span></span>**
+
+<span style="background-color: transparent;"><span style="color: rgb(0, 0, 0);"><span style="font-family: Poppins, sans-serif;"><span style="font-size: 11pt;">One of the best parts of WeAreDevelopers World Congress is bringing together developers, architects, engineering leaders, and technology experts from around the world. The conference featured inspiring keynotes and technical sessions covering AI, software architecture, cloud, developer productivity, and many other topics that are shaping the future of software development.</span></span></span></span>
+
+![ABP team at WeAreDevelopers World Congress 2026.8](https://abp.io/api/file-management/file-descriptor/share?shareToken=CfDJ8BFJWl%2BAUE9Cj%2FpQ216BBS4sS8dtDS3uz8BQ08GHrJhfYezTNm7iIPkGxmwSzAdqu3I5Xm83qEuWbyZyrkz%2FexjK%2BqWZ%2BwC2eUpOcjNJPk7a4RM97Es6Yy1SVC1k08fcpqmbF22enrV9%2FCRwLRaA0693i9TAlo1NBOcQAGDDLgfx)
+
+![ABP team at WeAreDevelopers World Congress 2026.10](https://abp.io/api/file-management/file-descriptor/share?shareToken=CfDJ8BFJWl%2BAUE9Cj%2FpQ216BBS6R8ZtcNmxyjBlV%2Fqiov6VfF0%2Fz9bl4VCdmSDfkDK%2Bmx8dmbrxOiiw8bIfymVWjEbIw9wzujp0R90K%2FgC7s3n7UaPSROiKcLwOBms3JB8To9G3wywNHRC3uKOLiFdszXLwNyZmqRemsUm5%2FTXTfAzy5)
+
+![ABP team at WeAreDevelopers World Congress 2026.11](https://abp.io/api/file-management/file-descriptor/share?shareToken=CfDJ8BFJWl%2BAUE9Cj%2FpQ216BBS7FG5qcTtOkfnSg7C9sq9zTrhQ%2FlW5Qe3YPb1WUnp6Yg%2BSXIPdg8B7L%2BiAtW7wqVK6%2FLU3EFpxIlEA1zYa23xwlggpo6V8%2BWFppT88NGxQ5Kn6vBV8S2vX1rytjS7RUjBHVXxJR8X5Vk49WYv5kCER9)
+
+## **<span style="background-color: transparent;"><span style="color: rgb(0, 0, 0);"><span style="font-family: Lexend, sans-serif;"><span style="font-size: 17pt;">Until Next Time</span></span></span></span>**
+
+<span style="background-color: transparent;"><span style="color: rgb(0, 0, 0);"><span style="font-family: Poppins, sans-serif;"><span style="font-size: 11pt;">A big thank you to the WeAreDevelopers team for organizing another fantastic event and to everyone who visited us at Hall A, Booth A-41.</span></span></span></span>
+
+<span style="background-color: transparent;"><span style="color: rgb(0, 0, 0);"><span style="font-family: Poppins, sans-serif;"><span style="font-size: 11pt;">If we didn't get the chance to meet in Berlin, you can always explore ABP online, join our community, or reach out to us with your questions and feedback.</span></span></span></span>
+
+<span style="background-color: transparent;"><span style="color: rgb(0, 0, 0);"><span style="font-family: Poppins, sans-serif;"><span style="font-size: 11pt;">We appreciate everyone who made WeAreDevelopers World Congress 2026 such a memorable experience, and we look forward to seeing you again at future events!</span></span></span></span>
+
+​
+![ABP team at WeAreDevelopers World Congress 2026.12](https://abp.io/api/file-management/file-descriptor/share?shareToken=CfDJ8BFJWl%2BAUE9Cj%2FpQ216BBS60ifxXi0WKAOMXk3uWgymwuMfSRR441sbaecJaHrzvlKokwVAQHsFtcr%2ByT9WJlUME5VTvE3iny0Rx9tVmSqlKRfKrAgvsEsyl1ACFjqjUvzqlXvswIpLWXNxoqIm%2BGylB6JFSA1cASNXNIs21tq9P)
+
+![ABP team at WeAreDevelopers World Congress 2026.13](https://abp.io/api/file-management/file-descriptor/share?shareToken=CfDJ8BFJWl%2BAUE9Cj%2FpQ216BBS734IO%2BudVyD2%2FGzg7qP1XkRTg7ZT5zZ2pLv5%2FoDqvo8sB%2FGEfkshjTmD0YBjDCeWKrpTHI6pK1TEIg%2FQoMX6SGoudWzymr2pQMFpzF2ATCE%2FdB3XRNSITLSaS6L40V8UfryzP8DBjDwlNizxPI5tGw)
+
+​

docs/en/cli/index.md

@@ -809,14 +809,15 @@ abp generate-proxy -t csharp -url https://localhost:44302/
   - `csharp`: C#, work in the `*.HttpApi.Client` project directory. There are some additional options for this client:
     - `--without-contracts`: Avoid generating the application service interface, class, enum and dto types.
     - `--folder`: Folder name to place generated CSharp code in. Default value: `ClientProxies`.
-  - `ng`: Angular. There are some additional options for this client:
+   - `ng`: Angular. There are some additional options for this client:
-    - `--api-name` or `-a`: The name of the API endpoint defined in the `/src/environments/environment.ts`. Default value: `default`.
+     - `--api-name` or `-a`: The name of the API endpoint defined in the `/src/environments/environment.ts`. Default value: `default`.
-    - `--source` or `-s`: Specifies the Angular project name to resolve the root namespace & API definition URL from. Default value: `defaultProject`.
+     - `--source` or `-s`: Specifies the Angular project name to resolve the root namespace & API definition URL from. Default value: `defaultProject`.
-    - `--target`: Specifies the Angular project name to place generated code in. Default value: `defaultProject`.
+     - `--target`: Specifies the Angular project name to place generated code in. Default value: `defaultProject`.
-    - `--module`:  Backend module name. Default value: `app`.
+     - `--module`:  Backend module name. Default value: `app`.
-    - `--entry-point`: Targets the Angular project to place the generated code.
+     - `--entry-point`: Targets the Angular project to place the generated code.
-    - `--url`: Specifies api definition url. Default value is API Name's url in environment file.
+     - `--url`: Specifies api definition url. Default value is API Name's url in environment file.
-    - `--prompt` or `-p`: Asks the options from the command line prompt (for the unspecified options).
+     - `--resource-api`: Adds optional Resource API helpers for `GET` endpoints while keeping the generated Observable services. This parameter requires Angular v22 or later.
+     - `--prompt` or `-p`: Asks the options from the command line prompt (for the unspecified options).
   - `js`: JavaScript. work in the `*.Web` project directory. There are some additional options for this client:
     - `--output` or `-o`: JavaScript file path or folder to place generated code in.
 - `--module` or `-m`: Specifies the name of the backend module you wish to generate proxies for. Default value: `app`.
@@ -1314,4 +1315,3 @@ var tokenResponse = await httpClient.RequestClientCredentialsTokenAsync(
 
 - [Examples for the new command](./new-command-samples.md)
 - [Video tutorial](https://abp.io/video-courses/essentials/abp-cli)
-

docs/en/docs-nav.json

@@ -716,6 +716,14 @@
                       "path": "framework/infrastructure/blob-storing/custom-provider.md"
                     }
                   ]
+                },
+                {
+                  "text": "Content Pipeline",
+                  "path": "framework/infrastructure/blob-storing/pipeline.md"
+                },
+                {
+                  "text": "Encryption",
+                  "path": "framework/infrastructure/blob-storing/encryption.md"
                 }
               ]
             },

docs/en/framework/api-development/auto-controllers.md

@@ -62,6 +62,8 @@ ABP uses a naming convention while determining the HTTP method for a service met
 
 If you need to customize HTTP method for a particular method, then you can use one of the standard ASP.NET Core attributes ([HttpPost], [HttpGet], [HttpPut]... etc.). This requires to add [Microsoft.AspNetCore.Mvc.Core](https://www.nuget.org/packages/Microsoft.AspNetCore.Mvc.Core) nuget package to your project that contains the service.
 
+The naming convention doesn't map the HTTP QUERY method (a safe method that carries its parameters in the request body, useful when a GET request would have too many query string parameters). If you want to expose an action as a QUERY endpoint, use the `[AcceptVerbs("QUERY")]` attribute explicitly. Such an action is treated as a safe method, so it is not audited and doesn't start a transactional unit of work by default, just like a GET request. However, unlike a GET request, a QUERY request still requires the anti-forgery token because it carries a request body. This is consistent with ASP.NET Core, which doesn't treat QUERY as an anti-forgery exempt method.
+
 ### Route
 
 Route is calculated based on some conventions:

docs/en/framework/architecture/domain-driven-design/unit-of-work.md

@@ -38,10 +38,10 @@ All of these are automatically handled by the ABP.
 
 While the section above explains the UOW as it is database transaction, actually a UOW doesn't have to be transactional. By default;
 
-* **HTTP GET** requests don't start a transactional UOW. They still starts a UOW, but **doesn't create a database transaction**.
+* **HTTP GET** and **HTTP QUERY** requests don't start a transactional UOW. They still start a UOW, but **don't create a database transaction**.
 * All other HTTP request types start a UOW with a database transaction, if database level transactions are supported by the underlying database provider.
 
-This is because an HTTP GET request doesn't (and shouldn't) make any change in the database. You can change this behavior using the options explained below.
+This is because they are safe HTTP methods that don't (and shouldn't) make any change in the database. You can change this behavior using the options explained below.
 
 ## Default Options
 

docs/en/framework/infrastructure/audit-logging.md

@@ -48,7 +48,7 @@ Here, a list of the options you can configure:
 * `IsEnabledForAnonymousUsers` (default: `true`): If you want to write audit logs only for the authenticated users, set this to `false`. If you save audit logs for anonymous users, you will see `null` for `UserId` values for these users.
 * `AlwaysLogOnException` (default: `true`): If you set to true, it always saves the audit log on an exception/error case without checking other options (except `IsEnabled`, which completely disables the audit logging).
 * `IsEnabledForIntegrationServices` (default: `false`): Audit Logging is disabled for [integration services](../api-development/integration-services.md) by default. Set this property as `true` to enable it.
-* `IsEnabledForGetRequests` (default: `false`): HTTP GET requests should not make any change in the database normally and audit log system doesn't save audit log objects for GET request. Set this to `true` to enable it also for the GET requests.
+* `IsEnabledForGetRequests` (default: `false`): Safe HTTP methods (GET, HEAD and QUERY) should not make any change in the database normally and the audit log system doesn't save audit log objects for these requests. Set this to `true` to enable it also for the safe requests.
 * `DisableLogActionInfo` (default: `false`):If you set to true, Will no longer log `AuditLogActionInfo`.
 * `ApplicationName`: If multiple applications are saving audit logs into a single database, set this property to your application name, so you can distinguish the logs of different applications. If you don't set, it will set from the `IApplicationInfoAccessor.ApplicationName` value, which is the entry assembly name by default.
 * `IgnoredTypes`: A list of `Type`s to be ignored for audit logging. If this is an entity type, changes for this type of entities will not be saved. This list is also used while serializing the action parameters.

docs/en/framework/infrastructure/blob-storing/aws.md

@@ -67,7 +67,7 @@ Configure<AbpBlobStoringOptions>(options =>
 * **ProfilesLocation** (string): The path to the aws credentials file to look at.
 * **Region** (string): The system name of the AWS region (e.g., `us-east-1`). **Required** for real AWS S3. Optional when `ServiceURL` is configured for an S3-compatible service; some services accept any value (or `auto` for Cloudflare R2).
 * **ServiceURL** (string): Custom service URL for S3-compatible APIs (e.g., MinIO, DigitalOcean Spaces, Cloudflare R2). If not specified, the default AWS S3 service URL will be used based on the region. When using S3-compatible services, this should point to your service endpoint (e.g., `https://minio.example.com:9000`). The AWS SDK automatically appends a trailing slash to the configured value.
-* **DisablePayloadSigning** (bool): Default `false`. When set to `true`, the provider sends `x-amz-content-sha256: UNSIGNED-PAYLOAD` on `PutObject` requests instead of the streaming chunked signature (`STREAMING-AWS4-HMAC-SHA256-PAYLOAD`) that the AWS SDK v4 uses by default. Required for Cloudflare R2 and other S3-compatible services that do not implement streaming signing. The endpoint must be HTTPS when this option is enabled. Leave as `false` for real AWS S3.
+* **DisablePayloadSigning** (bool): Default `false`. When set to `true`, the provider sends `x-amz-content-sha256: UNSIGNED-PAYLOAD` on `PutObject` and multipart `UploadPart` requests instead of the streaming chunked signature (`STREAMING-AWS4-HMAC-SHA256-PAYLOAD`) that the AWS SDK v4 uses by default. Required for Cloudflare R2 and other S3-compatible services that do not implement streaming signing. The endpoint must be HTTPS when this option is enabled. Leave as `false` for real AWS S3.
 * **Policy** (string): An IAM policy in JSON format that you want to use as an inline session policy.
 * **DurationSeconds** (int): Validity period(s) of a temporary access certificate,minimum is 900 and the maximum is 3600. **note**: Using sub-accounts operated OSS,if the value is 0.
 * **ContainerName** (string): You can specify the container name in Aws. If this is not specified, it uses the name of the BLOB container defined with the `BlobContainerName` attribute (see the [BLOB storing document](../blob-storing)). Please note that Aws has some **rules for naming containers**. A container name must be a valid DNS name, conforming to the [following naming rules](https://docs.aws.amazon.com/AmazonS3/latest/dev/BucketRestrictions.html):
@@ -147,7 +147,21 @@ Configure<AbpBlobStoringOptions>(options =>
 
 > **Note**: When using S3-compatible services, the provider automatically enables path-style requests which are required by most S3-compatible implementations.
 
-> **Note on `DisablePayloadSigning`**: AWS SDK v4 sends `PutObject` requests with `x-amz-content-sha256: STREAMING-AWS4-HMAC-SHA256-PAYLOAD`. Cloudflare R2 (and some other S3-compatible services) return `501 NotImplemented` for this signing mode. Setting `DisablePayloadSigning = true` switches to `UNSIGNED-PAYLOAD`, which these services accept. The endpoint must be HTTPS. Leave it `false` for real AWS S3.
+> **Note on `DisablePayloadSigning`**: AWS SDK v4 sends `PutObject` and multipart `UploadPart` requests with `x-amz-content-sha256: STREAMING-AWS4-HMAC-SHA256-PAYLOAD`. Cloudflare R2 (and some other S3-compatible services) return `501 NotImplemented` for this signing mode. Setting `DisablePayloadSigning = true` switches to `UNSIGNED-PAYLOAD` (for the multipart parts too), which these services accept. The endpoint must be HTTPS. Leave it `false` for real AWS S3.
+
+## Non-Seekable Uploads
+
+The AWS SDK can not rewind a non-seekable stream to retry a failed upload. For the containers using the [encryption](./encryption.md) or the [content pipeline](./pipeline.md) (which produce non-seekable streams), the provider compensates for that; containers without these features keep the plain `PutObject` upload they always had, also for non-seekable streams:
+
+* A source with a known length of up to 16 MB is buffered in memory and uploaded as a regular, retryable `PutObject` request.
+* A larger (or unknown-length) source is uploaded as a **multipart upload** (`TransferUtility`), which buffers and retries the upload part by part with constant memory usage.
+
+Notes on the multipart path:
+
+* The `ETag` of a multipart object is not the MD5 of the content.
+* The SDK aborts a failed multipart upload, but an abort can also fail (network cut, process exit); when it does, the abort error is what surfaces (the original upload error is replaced). Configure an [AbortIncompleteMultipartUpload lifecycle rule](https://docs.aws.amazon.com/AmazonS3/latest/userguide/mpu-abort-incomplete-mpu-lifecycle-config.html) on the bucket, so incomplete parts do not accumulate storage costs.
+* A non-seekable multipart upload uses 5 MB parts, which limits a single BLOB to about 48.8 GB (the 10,000 parts limit of S3).
+* Some S3-compatible services do not implement multipart uploads completely; validate your service before enabling encryption or pipeline contributors on large BLOBs. (With a custom `ServiceURL`, the client requests checksums only when required, so no default CRC part checksums are sent.)
 
 ## Aws Blob Name Calculator
 

docs/en/framework/infrastructure/blob-storing/encryption.md

@@ -0,0 +1,249 @@
+```json
+//[doc-seo]
+{
+    "Description": "Learn how to encrypt BLOBs at rest in ABP Framework, using container-specific, tenant-specific or global passphrases."
+}
+```
+
+# BLOB Encryption
+
+The BLOB Storing system can **encrypt BLOBs at rest**, transparently, on top of the configured [storage provider](../blob-storing): the BLOB stream is encrypted (AES-256-GCM, authenticated) before it reaches the provider and decrypted while it is read back. The `IBlobProvider` interface stays unchanged, but a provider must handle non-seekable, non-replayable input streams correctly (the built-in providers were adjusted where needed; the MinIO provider still requires a known content length — see the behavioral notes below). The combination is covered by automated tests for the File System provider; other providers consume the same standard stream contract, but validate your provider setup before relying on it in production.
+
+> Read the [BLOB Storing document](../blob-storing) to understand how to use the BLOB storing system. The encryption is part of the [Volo.Abp.BlobStoring](https://www.nuget.org/packages/Volo.Abp.BlobStoring) package; no additional package is needed. It requires a platform with AES-GCM support; it is not available on .NET Standard 2.0 targets (like .NET Framework).
+
+## Enabling Encryption
+
+Encryption is enabled **per container**, with the `UseEncryption` extension method:
+
+**Example: Encrypt the BLOBs of a specific container**
+
+````csharp
+Configure<AbpBlobStoringOptions>(options =>
+{
+    options.Containers.Configure<ProfilePictureContainer>(container =>
+    {
+        container.UseEncryption();
+    });
+});
+
+// A passphrase must be configured (here globally); see "Resolving the Passphrase" below
+Configure<AbpBlobStoringEncryptionOptions>(options =>
+{
+    options.DefaultPassPhrase = context.Configuration["MyApp:BlobPassPhrase"];
+});
+````
+
+**Example: Encrypt all containers by default**
+
+````csharp
+Configure<AbpBlobStoringOptions>(options =>
+{
+    options.Containers.ConfigureDefault(container =>
+    {
+        container.UseEncryption();
+    });
+
+    // A single container can still opt out:
+    options.Containers.Configure<PublicPictureContainer>(container =>
+    {
+        container.DisableEncryption();
+    });
+});
+````
+
+Containers that don't enable encryption are not affected at all.
+
+> `DisableEncryption()` turns the transparent decryption off and also clears this container's **own** passphrase and legacy option. Re-enabling it later with a parameterless `UseEncryption()` restores any values still inherited from the default container configuration; a container-specific passphrase that was cleared has to be passed again. BLOBs that were already stored encrypted are then returned **as stored** (raw `ABPE` ciphertext) while reading, without an error (when the container also uses [pipeline contributors](./pipeline.md), they still run and typically fail on the ciphertext). Re-saving under the old configuration does not help, since the save encrypts again: read the BLOBs **while encryption is still enabled**, export the plain content to a temporary location, apply the configuration change and write the content back.
+
+## Resolving the Passphrase
+
+When encryption is enabled, the passphrase for a **new** BLOB is resolved in the following order:
+
+1. **Container-specific passphrase**: If a passphrase is passed to the `UseEncryption` method, it is always used for that container. Calling `UseEncryption()` again without parameters keeps the configured values, so multiple modules can safely compose the configuration; use `ClearEncryptionPassPhrase()` to remove a configured or inherited container passphrase:
+
+````csharp
+options.Containers.Configure<ProfilePictureContainer>(container =>
+{
+    container.UseEncryption("my-container-passphrase");
+});
+````
+
+2. **Global passphrase**: The `AbpBlobStoringEncryptionOptions.DefaultPassPhrase` is used as the fallback:
+
+````csharp
+Configure<AbpBlobStoringEncryptionOptions>(options =>
+{
+    options.DefaultPassPhrase = "my-global-passphrase";
+});
+````
+
+If encryption is enabled but no passphrase can be resolved, saving and reading encrypted BLOBs fails with an `AbpException` (on .NET Standard 2.0 targets a `PlatformNotSupportedException` is thrown before that, see above).
+
+> Treat passphrases as production secrets: read them from your configuration/secret store instead of hard-coding them, and prefer long, machine-generated values.
+
+The **source** of the passphrase is recorded in the encrypted BLOB, and only that source is used while decrypting it. So, for example, a BLOB written with the global passphrase stays readable after a container-specific passphrase is configured later.
+
+> Keep your passphrases safe. If the passphrase a BLOB was encrypted with is lost or changed, that BLOB can not be decrypted anymore.
+
+### Customizing the Passphrase Resolution
+
+The passphrase resolution is implemented by the `IBlobEncryptionKeyProvider` service. The default implementation (`DefaultBlobEncryptionKeyProvider`) applies the rules above. You can [replace](../../fundamentals/dependency-injection.md) it with your own implementation to read the passphrases from another source, like a vault or another secret store (the provider must be able to return the passphrase itself; hardware-backed non-exportable keys are not supported).
+
+A custom provider can also supply **tenant-specific** passphrases: return `BlobEncryptionKeySource.Tenant` while encrypting and resolve the same tenant's passphrase when it is requested for decryption. The key source recorded in the BLOB header routes each BLOB back to the provider that can decrypt it. The following implementation gives every tenant its own passphrase and keeps the standard rules for the host side:
+
+````csharp
+[Dependency(ReplaceServices = true)]
+public class MyTenantBlobEncryptionKeyProvider : DefaultBlobEncryptionKeyProvider
+{
+    public MyTenantBlobEncryptionKeyProvider(
+        IOptions<AbpBlobStoringEncryptionOptions> options)
+        : base(options)
+    {
+    }
+
+    public override async Task<BlobEncryptionKey> ResolveForEncryptionAsync(
+        BlobEncryptionKeyContext context,
+        CancellationToken cancellationToken = default)
+    {
+        // Keep a container-specific passphrase as the highest-priority source
+        var containerPassPhrase = GetContainerPassPhraseOrNull(context.Configuration);
+        if (string.IsNullOrWhiteSpace(containerPassPhrase) && context.TenantId.HasValue)
+        {
+            return new BlobEncryptionKey(
+                BlobEncryptionKeySource.Tenant,
+                await GetTenantPassPhraseAsync(context.TenantId.Value, cancellationToken)
+            );
+        }
+
+        return await base.ResolveForEncryptionAsync(context, cancellationToken);
+    }
+
+    public override async Task<string> ResolveForDecryptionAsync(
+        BlobEncryptionKeySource keySource,
+        BlobEncryptionKeyContext context,
+        CancellationToken cancellationToken = default)
+    {
+        if (keySource == BlobEncryptionKeySource.Tenant)
+        {
+            if (!context.TenantId.HasValue)
+            {
+                throw new AbpException(
+                    "The BLOB was encrypted with a tenant-specific passphrase, " +
+                    "but there is no current tenant!");
+            }
+
+            return await GetTenantPassPhraseAsync(context.TenantId.Value, cancellationToken);
+        }
+
+        return await base.ResolveForDecryptionAsync(keySource, context, cancellationToken);
+    }
+
+    private Task<string> GetTenantPassPhraseAsync(
+        Guid tenantId, CancellationToken cancellationToken)
+    {
+        // Read the tenant's passphrase from your secret store. It must return
+        // the same value for the lifetime of the tenant's BLOBs.
+        throw new NotImplementedException();
+    }
+}
+````
+
+Notes on this pattern:
+
+* The multi-tenant BLOB containers already isolate tenants physically (see the [BLOB Storing document](../blob-storing)); tenant-specific passphrases add **cryptographic** isolation on top: one tenant's BLOBs can not be decrypted with another tenant's (or the host's) passphrase, and the tenant identity is part of the authenticated data.
+* The tenant is taken from `context.TenantId` (the tenant the BLOB belongs to), which is correct for both saving and reading — no ambient `ICurrentTenant` lookup is needed.
+* Tenant passphrases only apply to containers with `IsMultiTenant = true` (the default). A shared (`IsMultiTenant = false`) container runs its BLOB operations in the host context (`context.TenantId` is null there), so the sample never selects the tenant source on such a container and falls back to the container/global passphrase.
+
+## BLOBs Stored Before Enabling Encryption
+
+By default, reading a BLOB that does not have the encrypted format fails, so a tampered or corrupted BLOB can not silently bypass the authenticity check. If a container already has plaintext BLOBs from before encryption was enabled, allow reading them explicitly:
+
+````csharp
+options.Containers.Configure<ProfilePictureContainer>(container =>
+{
+    container.UseEncryption(allowLegacyPlainText: true);
+});
+````
+
+With this option, content that does not start with the recognized encrypted format magic is returned as-is, **without any authenticity check** — including an encrypted BLOB whose leading magic bytes were corrupted or stripped. (A BLOB that still starts with the format magic but has a corrupted header is *not* returned as plaintext; it fails as an invalid encrypted format.) Treat it as a short-term migration switch: new BLOBs are always encrypted, and the option should be disabled once the existing BLOBs are migrated (re-saved).
+
+A typical migration of an existing container:
+
+1. Enable encryption with `UseEncryption(allowLegacyPlainText: true)` and deploy. New and updated BLOBs are written encrypted; the existing plaintext BLOBs stay readable.
+2. Re-save the existing BLOBs (the BLOB storing system has no list operation, so iterate the BLOB names from your own application data):
+
+````csharp
+var bytes = await container.GetAllBytesAsync(blobName);
+await container.SaveAsync(blobName, bytes, overrideExisting: true);
+````
+
+3. Remove the `allowLegacyPlainText` option, so reading fails closed again for any content that does not have the encrypted format.
+
+> Legacy plaintext content that itself starts with the `ABPE` format magic can not be distinguished from an encrypted BLOB and fails to be read through the encrypted container. Read it with encryption disabled (or from the raw storage) and re-save it once through the encrypted container to encrypt it. Also note that legacy BLOBs are returned over a non-seekable wrapper stream while this option is enabled (the `Length` stays available when the provider stream knows it).
+
+## Changing a Passphrase
+
+The format does not support key rotation: a BLOB is only readable with the exact passphrase it was written with, and there is no way to keep an old and a new passphrase of the **same source** active at the same time. So changing a passphrase in place makes the BLOBs written with the old one permanently unreadable — migrate the content **before** the change:
+
+* **From the global to a container-specific passphrase**: this direction works without downtime, because the two are different key sources. Configure the new container passphrase; BLOBs recorded with the `Global` source keep decrypting with `DefaultPassPhrase`, while new saves use the container passphrase. Re-save the existing BLOBs (as in the migration steps above) to move them to the new passphrase; the global one can be retired once no BLOB uses it anymore.
+* **Any other change**: while the old passphrase is still configured, read the BLOBs and re-save them into a container using a different key source (or export them to a safe location), then apply the change and save them back. Verify the migrated BLOBs are readable before deleting anything.
+
+## Behavioral Changes for Encrypted Containers
+
+* The stream returned for an encrypted BLOB (from `GetAsync`) is read-only and non-seekable, and its `Length` is not available; read it sequentially (for example with `CopyToAsync`). (The **encrypting** stream that is uploaded does expose its length when the source exposes both its length and position — that is a save-side detail for providers that need the object size; see the format section.)
+* Opening a BLOB throws an `AbpException` when the content does not have a valid encrypted format. **While reading**, a `CryptographicException` is thrown when the content fails authentication (tampered data or a wrong passphrase), and an `AbpException` when a structural corruption is detected (like a missing end-of-stream record on a truncated BLOB).
+* Each returned chunk is individually authenticated as it is read; the completeness of the whole BLOB (the authenticated terminal record, and that nothing was truncated or appended at the end) is verified only when the decryption stream is read to its end. When [content-pipeline contributors](./pipeline.md) are enabled, the framework runs this end verification when the composed stream returned by `GetAsync` reaches EOF, so a contributor that stops at its own length or end marker can not hide a truncated terminal record. (This relies on the decrypting stream implementing `IBlobAuthenticatedEndStream`, which the built-in one does; a custom `CreateDecryptingStreamAsync` override that wraps the stream must forward that interface, or the check is skipped.) A caller that intentionally reads only a prefix (and disposes) gets authentication for the chunks it consumed, not a completeness guarantee for the whole BLOB.
+* The file system provider retries a failed save only while it is replayable: before the target file was opened, or for a seekable overwrite (where it rewinds the source and truncates the target again). A non-replayable encrypting stream that fails after the target was opened throws, and any partially written content fails closed while reading instead of being returned as damaged data (except with `allowLegacyPlainText`, where a fragment shorter than the format magic is returned as legacy plaintext — see above).
+* Some storage providers consume the stream **synchronously** (like the Aliyun provider); they require a source stream that also supports synchronous reads, exactly like they do without encryption.
+* The MinIO provider needs the object size before uploading. It works with encrypted content when the source stream exposes its length (and position); a source whose length can not be determined must be materialized (for example, saved as a byte array) first.
+
+## Performance and Cost
+
+Deriving the encryption key from the passphrase is intentionally expensive (PBKDF2-SHA256), so leaked storage can not be brute-forced cheaply. Understand the cost profile before enabling encryption on hot containers:
+
+* One key derivation runs on **every BLOB save** and on **every encrypted BLOB open** (before the stream is returned). The cost does not depend on the BLOB size — it scales with the number of operations, so many small, frequently read BLOBs amplify it the most.
+* Every BLOB uses its own random salt, so derivation results can not be cached or reused; reading the same BLOB again derives the key again.
+* The default iteration count is 100,000 (tens of milliseconds of CPU per operation, hardware dependent). Measure on your target hardware and concurrency before enabling encryption on high-frequency containers — it is not a microsecond-level transparent overhead.
+* Use a long, machine-generated (at least 128 bits of entropy) value from your secret store as the passphrase in production. For low-entropy, human-chosen passphrases you can raise the iteration count — this increases the offline guessing cost and the per-operation CPU cost by the same factor:
+
+````csharp
+Configure<AbpBlobStoringEncryptionOptions>(options =>
+{
+    options.KdfIterations = 600_000; // allowed range: 100,000 - 600,000
+});
+````
+
+Changing the iteration count only affects newly written BLOBs; existing BLOBs are decrypted with the count recorded in their own header.
+
+## The Encryption Format
+
+* Encryption is authenticated (AES-256-GCM): modified, re-ordered, corrupted or truncated content of a BLOB is detected while reading.
+* Every encrypted BLOB is bound to its storage identity (the *normalized* container name, BLOB name and tenant). Copying or renaming an encrypted BLOB at the storage level makes it unreadable at the new location, which also makes substituting one (validly encrypted) BLOB for another detectable. Re-writing an older version of the same BLOB back to its own location is not detectable at this layer.
+* Because of the identity binding, the following otherwise-legal operations make the affected encrypted BLOBs permanently unreadable: changing the `IsMultiTenant` value of the container (this affects the BLOBs that were saved under a tenant; BLOBs saved in the host context keep the same null tenant identity and stay readable), moving BLOBs between tenants or containers, and switching to a storage provider that normalizes container/BLOB names differently (for example, providers that lowercase container names). The binding is the **logical** identity (the normalized names and the tenant), not the physical location of the provider. Before such a change, read the affected BLOBs under the old configuration and export the plain content — re-saving in place does not help, since the save encrypts again with the old identity — then apply the change and write the content back.
+* The container and BLOB names are part of the authenticated identity, so on an encrypted container they must be valid UTF-16 (a name with unpaired surrogates is rejected with an `AbpException`). Normal names are unaffected.
+* The data is processed in chunks with **constant memory usage**, independent from the BLOB size.
+* Every BLOB is encrypted with its own key, derived (PBKDF2-SHA256) from the passphrase and a random per-BLOB salt.
+* When the source stream exposes both its length and position, the encrypted stream exposes its exact resulting length for providers that require the object size before uploading.
+
+### What Is (Not) Protected
+
+* Only the BLOB **content** is encrypted. Container names, BLOB names and any provider-level metadata stay in plaintext, so the existence of a BLOB is visible in the storage. The size overhead is deterministic (see below), so the exact plaintext length can be recovered from the stored object size.
+* The size overhead is small and deterministic: a 39-byte prefix, plus 20 bytes per 64 KB chunk, plus a 20-byte end-of-stream record (about 0.03% for large BLOBs).
+* Server-side encryption offered by the storage provider (like S3 or Azure Storage encryption) is complementary, not redundant: it uses provider-managed keys at the storage layer, while this feature encrypts with application-managed passphrases before the content leaves your application. They can be combined for defense in depth.
+
+## Troubleshooting
+
+| Error | Cause and solution |
+|---|---|
+| `AbpException`: *The BLOB does not have the encrypted BLOB format...* | The BLOB was saved before encryption was enabled (or by an application without encryption). Use `allowLegacyPlainText: true` during the migration. |
+| `AbpException`: *...no passphrase could be resolved* | Encryption is enabled, but neither a container passphrase nor `DefaultPassPhrase` is configured. |
+| `AbpException`: *...the default key provider does not supply tenant keys* | The BLOB was encrypted by a custom key provider with a tenant-specific passphrase; the same provider must be registered to read it back. |
+| `AbpException`: *...that passphrase is not available anymore* | The passphrase of the key source recorded in the BLOB was removed or cleared from the configuration. Restore it. |
+| `CryptographicException` while reading | Wrong passphrase, tampered/corrupted content, or the BLOB was copied, renamed or moved across containers/tenants at the storage level (see the identity binding above). |
+| `PlatformNotSupportedException` | The application runs on .NET Standard 2.0 (like .NET Framework) or on a platform without AES-GCM support. |
+
+## See Also
+
+* [BLOB Storing](../blob-storing)
+* [BLOB Content Pipeline](./pipeline.md)
+* [Creating a custom BLOB storage provider](./custom-provider.md)

docs/en/framework/infrastructure/blob-storing/index.md

@@ -313,6 +313,44 @@ Configure<AbpBlobStoringOptions>(options =>
 
 > If your application is not multi-tenant, no worry, it works as expected. You don't need to configure the `IsMultiTenant` option.
 
+## Encrypting BLOBs
+
+The BLOB Storing system can **encrypt BLOBs at rest**, transparently, on top of the configured storage provider:
+
+````csharp
+Configure<AbpBlobStoringOptions>(options =>
+{
+    options.Containers.Configure<ProfilePictureContainer>(container =>
+    {
+        container.UseEncryption();
+    });
+});
+
+// A passphrase must be configured; see the encryption document
+Configure<AbpBlobStoringEncryptionOptions>(options =>
+{
+    options.DefaultPassPhrase = context.Configuration["MyApp:BlobPassPhrase"];
+});
+````
+
+The encryption passphrase can be container-specific or **global**, and per-tenant passphrases can be plugged in over the key provider; every BLOB derives its own encryption key from the passphrase. See the [BLOB Encryption document](./encryption.md) for details.
+
+## Transforming BLOB Content
+
+The BLOB content can be passed through a **pipeline of contributors** (compression, watermarking, content validation...) while it is saved and read, without changing the storage provider:
+
+````csharp
+Configure<AbpBlobStoringOptions>(options =>
+{
+    options.Containers.Configure<ProfilePictureContainer>(container =>
+    {
+        container.PipelineContributors.Add<GZipBlobPipelineContributor>();
+    });
+});
+````
+
+See the [BLOB Content Pipeline document](./pipeline.md) for details.
+
 ## Extending the BLOB Storing System
 
 Most of the times, you won't need to customize the BLOB storage system except [creating a custom BLOB storage provider](./custom-provider.md). However, you can replace any service (injected via [dependency injection](../../fundamentals/dependency-injection.md)), if you need. Here, some other services not mentioned above, but you may want to know:
@@ -328,4 +366,6 @@ If you want to create folders and move files between folders, assign permissions
 
 ## See Also
 
+* [BLOB Content Pipeline](./pipeline.md)
+* [BLOB Encryption](./encryption.md)
 * [Creating a custom BLOB storage provider](./custom-provider.md)

docs/en/framework/infrastructure/blob-storing/pipeline.md

@@ -0,0 +1,122 @@
+```json
+//[doc-seo]
+{
+    "Description": "Learn how to transform BLOB content transparently (compression, validation, watermarking...) with pipeline contributors in ABP Framework."
+}
+```
+
+# BLOB Content Pipeline
+
+The BLOB Storing system can pass the BLOB content through a **pipeline of contributors** while it is saved and read. A contributor transforms the content stream transparently, on top of the configured [storage provider](../blob-storing): compression, watermarking, content validation or any other stream transformation can be implemented without changing the storage provider or the application code that works with `IBlobContainer`.
+
+> Read the [BLOB Storing document](../blob-storing) to understand how to use the BLOB storing system. The pipeline is part of the [Volo.Abp.BlobStoring](https://www.nuget.org/packages/Volo.Abp.BlobStoring) package; no additional package is needed.
+
+## Creating a Pipeline Contributor
+
+A pipeline contributor implements the `IBlobPipelineContributor` interface. The following example compresses the BLOBs with GZip:
+
+````csharp
+public class GZipBlobPipelineContributor : IBlobPipelineContributor, ITransientDependency
+{
+    public async Task OnSavingAsync(BlobPipelineContext context)
+    {
+        var compressedStream = new MemoryStream();
+        try
+        {
+            using (var gzipStream = new GZipStream(compressedStream, CompressionLevel.Fastest, leaveOpen: true))
+            {
+                await context.BlobStream.CopyToAsync(gzipStream, context.CancellationToken);
+            }
+        }
+        catch
+        {
+            // A stream is only tracked for disposal by the pipeline once it is assigned
+            // to context.BlobStream, so dispose it here if the eager work fails first
+            compressedStream.Dispose();
+            throw;
+        }
+
+        compressedStream.Position = 0;
+        context.BlobStream = compressedStream;
+    }
+
+    public Task OnGettingAsync(BlobPipelineContext context)
+    {
+        context.BlobStream = new GZipStream(context.BlobStream, CompressionMode.Decompress);
+        return Task.CompletedTask;
+    }
+}
+````
+
+* `OnSavingAsync` is called before the BLOB reaches the storage provider. Replace `context.BlobStream` with the transformed content; it is also allowed to materialize the content eagerly, like the example does (a lazily transforming, read-only wrapper keeps the memory usage constant instead, which is preferable for large BLOBs).
+* `OnGettingAsync` is called after the BLOB was read from the storage provider, in the reverse direction of `OnSavingAsync`.
+* The `BlobPipelineContext` also provides the normalized container/BLOB names, the container configuration, the tenant id and a scoped `ServiceProvider`. Contributors are resolved from the [dependency injection](../../fundamentals/dependency-injection.md) system (register them like any other service, for example with `ITransientDependency`). While saving, the scope stays alive until the save operation completes; while getting, until the stream returned to the caller is disposed.
+
+### The Stream Ownership Contract
+
+* If a stream (or the DI scope) fails to dispose **after** the storage provider already saved the BLOB, `SaveAsync` still throws that cleanup error even though the data is committed — a retry with the default `overrideExisting: false` would then get a `BlobAlreadyExistsException`.
+* **While saving**, do not dispose the stream you received (notice the `leaveOpen: true` in the example): every stream you assign to `context.BlobStream` is disposed after the save, while the original stream stays owned by the caller. A stream is only tracked from the moment it is assigned, so if you create a stream and then do work that may fail (like the eager copy above) before assigning it, dispose it yourself on the failure path.
+* **While getting**, the stream you set must dispose the stream you received when it is disposed (a `GZipStream` already does that by default), because the composed stream is returned to the caller as a whole.
+
+## Configuring Containers
+
+Contributors are configured **per container**, like the other container options:
+
+````csharp
+Configure<AbpBlobStoringOptions>(options =>
+{
+    options.Containers.Configure<ProfilePictureContainer>(container =>
+    {
+        container.PipelineContributors.Add<GZipBlobPipelineContributor>();
+    });
+});
+````
+
+Configuring the default container applies the contributor to all containers; a named container can add its own contributors on top of them:
+
+````csharp
+Configure<AbpBlobStoringOptions>(options =>
+{
+    options.Containers.ConfigureDefault(container =>
+    {
+        container.PipelineContributors.Add<GZipBlobPipelineContributor>();
+    });
+
+    options.Containers.Configure<ProfilePictureContainer>(container =>
+    {
+        // Runs after the GZip contributor while saving
+        container.PipelineContributors.Add<WatermarkPipelineContributor>();
+    });
+});
+````
+
+Think of the composition as **global stages plus container stages**: the contributors of the default container run first while saving, then the own ones of the container (each contributor type runs once). The inherited contributors are kept even when a container overrides its storage provider; set `InheritPipelineContributors` to `false` on a container to opt out of the global stages completely:
+
+````csharp
+options.Containers.Configure<PublicPictureContainer>(container =>
+{
+    container.InheritPipelineContributors = false;
+});
+````
+
+## Execution Order and Encryption
+
+* While **saving**, the contributors run in the configuration order, and the built-in [encryption](./encryption.md) always runs **after** them (immediately before the storage provider).
+* While **getting**, the decryption runs first and the contributors run in the **reverse** order.
+
+So, contributors always work on the plain content, a compressing contributor always compresses before the encryption (encrypted data can not be compressed), and the stored form is always ciphertext when the encryption is enabled.
+
+## Behavioral Notes
+
+* The stream returned for a container with contributors is generally read-only and non-seekable, and its `Length` is only available when the transformation can provide it. See the behavioral notes of the [BLOB Encryption document](./encryption.md) — the same stream semantics apply to the pipeline.
+* When a contributor changes the content size lazily, the final length is unknown to the storage provider; providers that require the object size before uploading need an eagerly materialized (or length-aware) stream.
+* Some storage providers consume the stream **synchronously** (like the Aliyun provider); they require contributor streams that also support synchronous reads, exactly like they do without the pipeline.
+* Containers without contributors are not affected at all.
+
+> **A contributor that transforms the content is part of the persisted data format.** A BLOB is only readable with the same transforming contributors, in the same order, it was saved with: adding, removing or re-ordering **transforming** contributors on a container that already has BLOBs makes the existing content fail to be read (or, for transformations without an own format check, silently return wrong content). A **metadata-only** contributor that neither consumes nor replaces `context.BlobStream` does not change the stored format, so it can be added to a container with existing BLOBs. A contributor that reads the content to validate it must return a pass-through wrapper (it still counts as consuming the stream); not replacing the stream after reading it would leave an empty/truncated stream for the provider. To change transforming contributors, migrate by reading the BLOBs **with the old configuration** and exporting the plain content, applying the change, and then writing the content back; re-saving in place under the old configuration does not change the stored form.
+
+## See Also
+
+* [BLOB Storing](../blob-storing)
+* [BLOB Encryption](./encryption.md)
+* [Creating a custom BLOB storage provider](./custom-provider.md)

docs/en/framework/ui/angular/service-proxies.md

@@ -88,12 +88,15 @@ export const environment: Config.Environment = {
 - **target:** Target for the Angular project to place the generated code. For example, if it's `permission-management`, it'll look like this (npm/ng-packs/packages/*permission-management*).
 - **entryPoint:** To create the generated proxy folder in the target. The directory is `permission-management/proxy/src/lib/proxy` and the `permission-management` is the value of target. If you want to create a folder for the generated proxy, there are two options, you should either set the value `proxy` as the entryPoint or go to project.json and change the `sourceRoot` from `packages/permission-management/src` to `packages/permission-management/proxy/src`. No need to change the sourceRoot of project with the property. if you keep it empty, the proxy will be generated into the folder defined in the sourceRoot property.
 - **serviceType:** The service type of the generated proxy. The options are `application`, `integration` and `all`. The default value is `application`. A developer can mark a service "integration service". If you want to skip proxy generation for the service, then this is the correct setting. More info about [Integration Services](../../api-development/integration-services.md) 
+- **resourceApi:** Generates optional `rxResource` helpers for `GET` endpoints. This is off by default and keeps the current Observable-based services unchanged. This parameter requires Angular v22 or later
 
 
 ### Services
 
 The `generate-proxy` command generates one service per back-end controller and a method (property with a function value actually) for each action in the controller. These methods call backend APIs via [RestService](./http-requests#restservice).
 
+If you pass `--resource-api`, the generator keeps those methods and adds matching `rxResource` helpers for read operations.
+
 A variable named `apiName` (available as of v2.4) is defined in each service. `apiName` matches the module's `RemoteServiceName`. This variable passes to the `RestService` as a parameter at each request. If there is no microservice API defined in the environment, `RestService` uses the default. See [getting a specific API endpoint from application config](./http-requests#how-to-get-a-specific-api-endpoint-from-application-config)
 
 The `providedIn` property of the services is defined as `'root'`. Therefore there is no need to provide them in a module. You can use them directly by injecting as shown below:
@@ -188,4 +191,4 @@ When you run a project on Visual Studio using IIS Express as the web server, the
 
 ## See Also
 
-* [Video tutorial](https://abp.io/video-courses/essentials/generating-client-proxies)
+* [Video tutorial](https://abp.io/video-courses/essentials/generating-client-proxies)

docs/en/suite/create-solution.md

@@ -23,8 +23,8 @@
 
 ## Create a new solution
 
-From ABP Suite v8.3, **create a new solution** option has been removed. Instead, it's suggessted to use [ABP Studio](../studio/index.md) or [ABP CLI](../cli/index.md) to create a new solution. After, creating an ABP Solution, then you can generate CRUD pages via ABP Suite as always.
+From ABP Suite v8.3, **create a new solution** option has been removed. Instead, it's suggested to use [ABP Studio](../studio/index.md) or [ABP CLI](../cli/index.md) to create a new solution. After creating an ABP solution, you can generate CRUD pages via ABP Suite as usual.
 
-> **Note:** ABP Suite does not generate React UI pages. If you create a modern React solution, use Suite where applicable for backend and application-layer generation, and develop the React UI in the source-owned [React UI](../framework/ui/react/index.md) application. ABP license holders can use [ABP Studio AI Agent](https://abp.io/studio/ai-agent) with predefined AI credits to generate React pages more easily.
+> **Note:** For modern React UI solutions, ABP Suite generates the backend, the application layer and the React CRUD UI. Develop any React UI that generation does not cover in the source-owned [React UI](../framework/ui/react/index.md) application. ABP license holders can also use the [ABP Studio AI Agent](https://abp.io/studio/ai-agent) with predefined AI credits for React pages.
 
 > ABP Studio has a shortcut for running [ABP Suite](./index.md) to allow using it without starting it externally and using it on a browser, which means you can create, manage, deploy your applications in a single desktop application and also generate CRUD pages via Suite as a pre-integrated application to ABP Studio. 

docs/en/suite/creating-many-to-many-relationship.md

@@ -75,6 +75,6 @@ Click the **Navigations** tab. Then click the **Add navigation collection** butt
 
 The below image is the final page created by ABP Suite. The **new book** dialog has a **Categories** tab which lists all categories of the book and allows add/remove categories.
 
-> **Note:** ABP Suite does not generate React UI for this page. The generated UI applies to Suite-supported UI stacks such as MVC, Blazor and Angular. ABP license holders can use [ABP Studio AI Agent](https://abp.io/studio/ai-agent) with predefined AI credits to generate React pages more easily.
+> **Note:** For modern React UI solutions, ABP Suite generates the navigation collection as an inline multi-select on the entity's create/edit dialog — add or remove connected records, pre-selected when editing an existing record, and available as a list filter — alongside the MVC, Blazor and Angular UI stacks.
 
 ![navigation-collection-books-page](../images/navigation-collection-books-page.8.1.png)

docs/en/suite/creating-master-detail-relationship.md

@@ -39,7 +39,7 @@ You need to specify the **Entity type** as _Master_ (default). Then, provide the
 
 Create a child entity, specify the **Entity type** as _Child_, and associate it with a master entity. In the figure above, you can see an example of, a child entity **OrderLine** with the associated master entity **Order**. When you specify the **Entity type** as _Child_, then the UI and tests will not be generated for the child entity and instead, all of the orchestration of the entity will be delegated to its master entity.
 
-> **Note:** ABP Suite does not generate React UI for master-detail pages. The generated UI applies to Suite-supported UI stacks such as MVC, Blazor and Angular. ABP license holders can use [ABP Studio AI Agent](https://abp.io/studio/ai-agent) with predefined AI credits to generate React pages more easily.
+> **Note:** For modern React UI solutions, ABP Suite generates the master-detail UI: once the master record exists, each child entity renders as a sub-grid on its own tab inside the master edit dialog, with its own add/edit/delete dialog. This is generated in addition to the MVC, Blazor and Angular UI stacks.
 
 Application services will be generated for the child entity, so it's possible for you to consume its endpoints and create-update-list or delete the child entity specifically. Suite also respects your multi-tenancy selection and sets the child entity as a multi-tenant entity, if the master entity has multi-tenancy enabled.
 

docs/en/suite/customizing-the-generated-code.md

@@ -58,7 +58,7 @@ You can see the example below, which demonstrates defining a new method in the `
 
 For the UI side, ABP Suite provides convenient comment placeholders within pages for MVC, Blazor, and Angular UIs. These comment sections serve as hook points where you can add your custom code. By placing your custom logic with these hook points, you can enhance the UI to your needs without the fear of losing your changes during the next CRUD page generation.
 
-> **Note:** ABP Suite does not generate React UI pages or React customization hook points. React UI is part of ABP's modern template system and is customized directly in the source-owned [React UI](../framework/ui/react/index.md) application. ABP license holders can use [ABP Studio AI Agent](https://abp.io/studio/ai-agent) with predefined AI credits to generate React pages and customize them more easily.
+> **Note:** These comment-based hook points are available for the MVC, Blazor and Angular UIs. ABP Suite also generates React CRUD pages for modern React UI solutions, but the React pages do not provide the same in-page custom-code hook points yet, so re-generating an entity overwrites its React page. Keep customizations to the React UI in the source-owned [React UI](../framework/ui/react/index.md) application, outside the generated pages. ABP license holders can also use the [ABP Studio AI Agent](https://abp.io/studio/ai-agent) with predefined AI credits to evolve the React UI.
 
 ### Customizations on MVC UI
 

docs/en/suite/editing-templates.md

@@ -11,12 +11,12 @@ ABP Suite uses templates to generate the code files. You can see the template fi
 
 ![Suite template list](../images/suite-templates-8.1.png)
 
-The are 2 template filters:
+There are 2 template filters:
 
-1. **UI**:  You can switch between `Angular`, `MVC` and `Blazor` templates.
+1. **UI**:  You can switch between `Angular`, `MVC`, `Blazor` and `React` templates.
 2. **Database provider:** You can switch between `EF Core` and `MongoDb` templates.
 
-> **Note:** ABP Suite does not include React UI templates or generate React client-side code. React UI belongs to the modern template system and should be developed in the source-owned [React UI](../framework/ui/react/index.md) application. ABP license holders can use [ABP Studio AI Agent](https://abp.io/studio/ai-agent) with predefined AI credits to generate React pages more easily.
+> **Note:** For modern React UI solutions, the React templates are listed here as well. Customizing one makes ABP Suite generate the React pages from your version instead of the built-in template, the same way as for the Angular, MVC and Blazor UI stacks.
 
 These filters are automatically selected based on your ABP solution. The selected solution is shown on the top right of the page. In the current screenshot it is "Acme.BookStore". 
 
@@ -33,6 +33,7 @@ There's a naming convention for the template files.
 * If the template name has `Frontend.Mvc`  prefix, it's used for razor pages, menus, JavaScript, CSS files.
 * If the template name has `Frontend.Blazor` prefix (no `.MudBlazor` segment), it's used for Blazorise-based razor components.
 * If the template name has `Frontend.Blazor.MudBlazor` prefix, it's used for [MudBlazor](https://mudblazor.com)-based razor components.
+* If the template name has `Frontend.React` prefix, it's used for the modern React UI code generation.
 
 > The template list only shows the variant that matches your solution's [Blazor UI library](index.md#blazor-ui-library) (Blazorise or MudBlazor), so you never see both trees side-by-side and the "outdated" check only flags the active set.
 

docs/en/suite/generating-crud-page.md

@@ -110,7 +110,7 @@ To create a new entity, make sure the *-New entity-* is selected in the **Entity
 
 * **Create user interface:** Creates pages, modals, components, `JavaScript`, `CSS` files and adds the new page to the main menu. If you don't have a requirement to manage the entity via user interface, you can uncheck this option.
 
-  > **Note:** This option does not generate React UI pages. ABP Suite's UI generation targets Suite-supported UI stacks such as MVC, Blazor and Angular. For React-based solutions, build the UI in the source-owned [React UI](../framework/ui/react/index.md) application. ABP license holders can use [ABP Studio AI Agent](https://abp.io/studio/ai-agent) with predefined AI credits to generate React pages more easily.
+  > **Note:** For modern React UI solutions, this option also generates and registers React CRUD pages, alongside the MVC, Blazor and Angular UI stacks. React generation is template-based and does not use AI.
 
   > **Blazor UI library:** For Blazor solutions, the generated UI matches the underlying Blazor component library. Solutions that reference `Volo.Abp.MudBlazorUI` produce pages built around `MudDataGrid`, `MudDialog`, `MudForm` and the rest of the [MudBlazor](https://mudblazor.com) controls; Blazorise-based solutions keep emitting the original `DataGrid` / `Modal` / `Validations` markup. ABP Suite picks the variant automatically by scanning the Blazor project `.csproj` and shows the resolved value in the solution info tooltip — no extra switch is required. See the [Blazor UI library](index.md#blazor-ui-library) section for details.
 

docs/en/suite/index.md

@@ -21,7 +21,7 @@
 
 ABP Suite is a complementary tool to the ABP Platform. ABP Suite allows you to build web pages in a matter of minutes. 
 
-> **Important:** ABP Suite does not generate React UI pages or client-side React code. Its CRUD UI generation is designed for the established Suite-supported UI stacks, such as MVC, Blazor and Angular. The new [React UI](../framework/ui/react/index.md) belongs to ABP's modern template system and is designed for an AI-first, AI-oriented development flow with a modern frontend stack such as React, TypeScript, Vite, TanStack Router, TanStack Query, shadcn/ui, Zod and React Hook Form. In React UI solutions, ABP Suite can still be useful for the backend and application layers where applicable, but the React UI side is expected to be developed in the source-owned React application. ABP license holders can use [ABP Studio AI Agent](https://abp.io/studio/ai-agent) with predefined AI credits to generate React pages and evolve the UI more easily.
+> **Note:** ABP Suite also generates React CRUD pages for modern React UI solutions, in addition to the MVC, Blazor and Angular UI stacks. The generator is template-based and does not use AI. It covers the standard CRUD scenarios — navigation-property lookups, many-to-many navigation collections, master-detail child grids, file upload, enums, filtering, Excel export and bulk delete — and registers each page in the React app's route configuration and menu.
 
 It's a .NET Core Global tool that can be installed from the command line. If you are using [ABP Studio](../studio/index.md), you don't even need to install it because it should already be installed, when you first installed the [ABP Studio](../studio/index.md).
 

framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/Uow/AbpUowActionFilter.cs

@@ -1,5 +1,4 @@
 using System;
-using System.Net.Http;
 using System.Threading;
 using System.Threading.Tasks;
 using Microsoft.AspNetCore.Mvc.Abstractions;
@@ -7,6 +6,7 @@ using Microsoft.AspNetCore.Mvc.Filters;
 using Microsoft.Extensions.Options;
 using Volo.Abp.AspNetCore.Filters;
 using Volo.Abp.DependencyInjection;
+using Volo.Abp.Http;
 using Volo.Abp.Threading;
 using Volo.Abp.Uow;
 
@@ -81,7 +81,8 @@ public class AbpUowActionFilter : IAsyncActionFilter, IAbpFilter, ITransientDepe
         {
             var abpUnitOfWorkDefaultOptions = context.GetRequiredService<IOptions<AbpUnitOfWorkDefaultOptions>>().Value;
             options.IsTransactional = abpUnitOfWorkDefaultOptions.CalculateIsTransactional(
-                autoValue: !string.Equals(context.HttpContext.Request.Method, HttpMethod.Get.Method, StringComparison.OrdinalIgnoreCase)
+                autoValue: !(HttpMethodHelper.IsGet(context.HttpContext.Request.Method)
+                             || HttpMethodHelper.IsQuery(context.HttpContext.Request.Method))
             );
         }
 

framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/Uow/AbpUowPageFilter.cs

@@ -1,5 +1,4 @@
 using System;
-using System.Net.Http;
 using System.Threading;
 using System.Threading.Tasks;
 using Microsoft.AspNetCore.Mvc.Abstractions;
@@ -7,6 +6,7 @@ using Microsoft.AspNetCore.Mvc.Filters;
 using Microsoft.Extensions.Options;
 using Volo.Abp.AspNetCore.Filters;
 using Volo.Abp.DependencyInjection;
+using Volo.Abp.Http;
 using Volo.Abp.Threading;
 using Volo.Abp.Uow;
 
@@ -86,7 +86,8 @@ public class AbpUowPageFilter : IAsyncPageFilter, IAbpFilter, ITransientDependen
         {
             var abpUnitOfWorkDefaultOptions = context.GetRequiredService<IOptions<AbpUnitOfWorkDefaultOptions>>().Value;
             options.IsTransactional = abpUnitOfWorkDefaultOptions.CalculateIsTransactional(
-                autoValue: !string.Equals(context.HttpContext.Request.Method, HttpMethod.Get.Method, StringComparison.OrdinalIgnoreCase)
+                autoValue: !(HttpMethodHelper.IsGet(context.HttpContext.Request.Method)
+                             || HttpMethodHelper.IsQuery(context.HttpContext.Request.Method))
             );
         }
 

framework/src/Volo.Abp.AspNetCore/Volo/Abp/AspNetCore/Auditing/AbpAuditingMiddleware.cs

@@ -7,6 +7,7 @@ using Microsoft.Extensions.Options;
 using Volo.Abp.AspNetCore.Middleware;
 using Volo.Abp.Auditing;
 using Volo.Abp.DependencyInjection;
+using Volo.Abp.Http;
 using Volo.Abp.Uow;
 using Volo.Abp.Users;
 
@@ -135,8 +136,9 @@ public class AbpAuditingMiddleware : AbpMiddlewareBase, ITransientDependency
         }
 
         if (!AuditingOptions.IsEnabledForGetRequests &&
-            (string.Equals(httpContext.Request.Method, HttpMethods.Get, StringComparison.OrdinalIgnoreCase) ||
+            (HttpMethodHelper.IsGet(httpContext.Request.Method) ||
-             string.Equals(httpContext.Request.Method, HttpMethods.Head, StringComparison.OrdinalIgnoreCase)))
+             HttpMethodHelper.IsHead(httpContext.Request.Method) ||
+             HttpMethodHelper.IsQuery(httpContext.Request.Method)))
         {
             return false;
         }

framework/src/Volo.Abp.AspNetCore/Volo/Abp/AspNetCore/Uow/AspNetCoreUnitOfWorkTransactionBehaviourProvider.cs

@@ -1,8 +1,8 @@
 using System;
-using System.Net.Http;
 using Microsoft.AspNetCore.Http;
 using Microsoft.Extensions.Options;
 using Volo.Abp.DependencyInjection;
+using Volo.Abp.Http;
 using Volo.Abp.Uow;
 
 namespace Volo.Abp.AspNetCore.Uow;
@@ -37,10 +37,8 @@ public class AspNetCoreUnitOfWorkTransactionBehaviourProvider : IUnitOfWorkTrans
                 }
             }
 
-            return !string.Equals(
+            var method = httpContext.Request.Method;
-                httpContext.Request.Method,
+            return !(HttpMethodHelper.IsGet(method) || HttpMethodHelper.IsQuery(method));
-                HttpMethod.Get.Method, StringComparison.OrdinalIgnoreCase
-            );
         }
     }
 

framework/src/Volo.Abp.Auditing/Volo/Abp/Auditing/AbpAuditingOptions.cs

@@ -62,6 +62,7 @@ public class AbpAuditingOptions
     //TODO: Move this to asp.net core layer or convert it to a more dynamic strategy?
     /// <summary>
     /// Default: false.
+    /// When false, safe methods (GET, HEAD and QUERY) are excluded from audit logging.
     /// </summary>
     public bool IsEnabledForGetRequests { get; set; }
 

framework/src/Volo.Abp.Auditing/Volo/Abp/Auditing/AuditingInterceptor.cs

@@ -193,6 +193,7 @@ public class AuditingInterceptor : AbpInterceptor, ITransientDependency
         if (!options.IsEnabledForGetRequests &&
             (string.Equals(auditLogInfo.HttpMethod, "Get", StringComparison.OrdinalIgnoreCase) ||
              string.Equals(auditLogInfo.HttpMethod, "Head", StringComparison.OrdinalIgnoreCase) ||
+             string.Equals(auditLogInfo.HttpMethod, "Query", StringComparison.OrdinalIgnoreCase) ||
              invocation.Method.Name.StartsWith("Get", StringComparison.OrdinalIgnoreCase)))
         {
             return false;

framework/src/Volo.Abp.BlobStoring.Aws/Properties/AssemblyInfo.cs

@@ -0,0 +1,3 @@
+using System.Runtime.CompilerServices;
+
+[assembly: InternalsVisibleTo("Volo.Abp.BlobStoring.Aws.Tests")]

framework/src/Volo.Abp.BlobStoring.Aws/Volo/Abp/BlobStoring/Aws/AwsBlobProvider.cs

@@ -1,8 +1,11 @@
 using System;
 using System.IO;
+using System.Linq;
+using System.Threading;
 using System.Threading.Tasks;
 using Amazon.S3;
 using Amazon.S3.Model;
+using Amazon.S3.Transfer;
 using Amazon.S3.Util;
 using Volo.Abp.DependencyInjection;
 
@@ -10,6 +13,10 @@ namespace Volo.Abp.BlobStoring.Aws;
 
 public class AwsBlobProvider : BlobProviderBase, ITransientDependency
 {
+    // Aligned with the TransferUtility threshold under which a non-seekable upload
+    // would be sent as a single (non-retryable) request instead of multipart
+    protected const long MaxBufferedUploadLength = 16 * 1024 * 1024;
+
     protected IAwsBlobNameCalculator AwsBlobNameCalculator { get; }
     protected IAmazonS3ClientFactory AmazonS3ClientFactory { get; }
     protected IBlobNormalizeNamingService BlobNormalizeNamingService { get; }
@@ -43,13 +50,30 @@ public class AwsBlobProvider : BlobProviderBase, ITransientDependency
                 await CreateContainerIfNotExists(amazonS3Client, containerName);
             }
 
-            await amazonS3Client.PutObjectAsync(new PutObjectRequest
+            if (!RequiresRetrySafeUpload(args))
             {
-                BucketName = containerName,
+                await PutObjectAsync(amazonS3Client, containerName, blobName, args.BlobStream, configuration, args.CancellationToken);
-                Key = blobName,
+                return;
-                InputStream = args.BlobStream,
+            }
-                DisablePayloadSigning = configuration.DisablePayloadSigning
+
-            });
+            // The SDK can not retry the upload of a non-seekable stream (like an encrypting
+            // stream). A small source with a known length is buffered in memory and uploaded
+            // as a retryable PutObject; anything larger (or with an unknown length) goes
+            // through a TransferUtility multipart upload, which buffers and retries part by part
+            var remainingLength = GetRemainingLengthOrNull(args.BlobStream);
+            if (remainingLength != null && remainingLength <= MaxBufferedUploadLength)
+            {
+                using (var bufferedStream = new MemoryStream((int)remainingLength.Value))
+                {
+                    await args.BlobStream.CopyToAsync(bufferedStream, 81920, args.CancellationToken);
+                    bufferedStream.Position = 0;
+                    await PutObjectAsync(amazonS3Client, containerName, blobName, bufferedStream, configuration, args.CancellationToken);
+                }
+
+                return;
+            }
+
+            await UploadMultipartAsync(amazonS3Client, containerName, blobName, args.BlobStream, configuration, args.CancellationToken);
         }
     }
 
@@ -108,6 +132,95 @@ public class AwsBlobProvider : BlobProviderBase, ITransientDependency
         }
     }
 
+    /// <summary>
+    /// The retry-safe (buffered/multipart) upload only applies to non-seekable streams
+    /// of containers using the encryption or the content pipeline; other containers
+    /// keep the plain PutObject behavior they always had.
+    /// </summary>
+    protected virtual bool RequiresRetrySafeUpload(BlobProviderSaveArgs args)
+    {
+        if (args.BlobStream.CanSeek)
+        {
+            return false;
+        }
+
+        return args.Configuration.IsEncryptionEnabled() ||
+               args.Configuration.GetEffectivePipelineContributors().Any();
+    }
+
+    protected virtual long? GetRemainingLengthOrNull(Stream stream)
+    {
+        try
+        {
+            var remainingLength = stream.Length - stream.Position;
+            return remainingLength >= 0 ? remainingLength : null;
+        }
+        catch (Exception ex) when (ex is NotSupportedException || ex is IOException)
+        {
+            // The length is optional; a probe failure must not fail the save
+            return null;
+        }
+    }
+
+    protected virtual async Task PutObjectAsync(
+        AmazonS3Client amazonS3Client,
+        string containerName,
+        string blobName,
+        Stream blobStream,
+        AwsBlobProviderConfiguration configuration,
+        CancellationToken cancellationToken)
+    {
+        await amazonS3Client.PutObjectAsync(CreatePutObjectRequest(containerName, blobName, blobStream, configuration), cancellationToken);
+    }
+
+    protected virtual PutObjectRequest CreatePutObjectRequest(
+        string containerName,
+        string blobName,
+        Stream blobStream,
+        AwsBlobProviderConfiguration configuration)
+    {
+        return new PutObjectRequest
+        {
+            BucketName = containerName,
+            Key = blobName,
+            InputStream = blobStream,
+            AutoCloseStream = false,
+            DisablePayloadSigning = configuration.DisablePayloadSigning
+        };
+    }
+
+    protected virtual async Task UploadMultipartAsync(
+        AmazonS3Client amazonS3Client,
+        string containerName,
+        string blobName,
+        Stream blobStream,
+        AwsBlobProviderConfiguration configuration,
+        CancellationToken cancellationToken)
+    {
+        using (var transferUtility = new TransferUtility(amazonS3Client))
+        {
+            await transferUtility.UploadAsync(CreateMultipartUploadRequest(containerName, blobName, blobStream, configuration), cancellationToken);
+        }
+    }
+
+    protected virtual TransferUtilityUploadRequest CreateMultipartUploadRequest(
+        string containerName,
+        string blobName,
+        Stream blobStream,
+        AwsBlobProviderConfiguration configuration)
+    {
+        return new TransferUtilityUploadRequest
+        {
+            BucketName = containerName,
+            Key = blobName,
+            // The unseekable multipart path of the SDK ignores AutoCloseStream
+            // and disposes the input, so the ownership is protected by a wrapper
+            InputStream = new LeaveOpenStreamWrapper(blobStream),
+            AutoCloseStream = false,
+            DisablePayloadSigning = configuration.DisablePayloadSigning
+        };
+    }
+
     protected virtual async Task<AmazonS3Client> GetAmazonS3Client(BlobProviderArgs args)
     {
         var configuration = args.Configuration.GetAwsConfiguration();

framework/src/Volo.Abp.BlobStoring.Aws/Volo/Abp/BlobStoring/Aws/AwsBlobProviderConfiguration.cs

@@ -94,7 +94,7 @@ public class AwsBlobProviderConfiguration
     }
 
     /// <summary>
-    /// When true, payload signing is disabled on PutObject upload requests so the SDK sends
+    /// When true, payload signing is disabled on PutObject and UploadPart upload requests so the SDK sends
     /// <c>x-amz-content-sha256: UNSIGNED-PAYLOAD</c> instead of the streaming chunked signature
     /// (<c>STREAMING-AWS4-HMAC-SHA256-PAYLOAD</c>) that AWS SDK v4 uses by default. Required for
     /// Cloudflare R2 and other S3-compatible services that do not implement streaming signing.

framework/src/Volo.Abp.BlobStoring.Aws/Volo/Abp/BlobStoring/Aws/LeaveOpenStreamWrapper.cs

@@ -0,0 +1,90 @@
+using System;
+using System.IO;
+using System.Threading;
+using System.Threading.Tasks;
+
+namespace Volo.Abp.BlobStoring.Aws;
+
+/// <summary>
+/// The unseekable multipart path of the AWS SDK ignores AutoCloseStream and
+/// disposes its input; this wrapper protects the ownership of the wrapped stream.
+/// </summary>
+internal sealed class LeaveOpenStreamWrapper : Stream
+{
+    private readonly Stream _inner;
+
+    public LeaveOpenStreamWrapper(Stream inner)
+    {
+        _inner = inner;
+    }
+
+    public override bool CanRead => _inner.CanRead;
+    public override bool CanSeek => _inner.CanSeek;
+    public override bool CanWrite => false;
+
+    // The SDK computes the optional content length from Length/Position, but only
+    // handles NotSupportedException; translate an IOException of a probe, so an
+    // unknown length stays "unknown" instead of failing the upload
+    public override long Length
+    {
+        get
+        {
+            try
+            {
+                return _inner.Length;
+            }
+            catch (IOException ex)
+            {
+                throw new NotSupportedException("The length of the stream is not available!", ex);
+            }
+        }
+    }
+
+    public override long Position
+    {
+        get
+        {
+            try
+            {
+                return _inner.Position;
+            }
+            catch (IOException ex)
+            {
+                throw new NotSupportedException("The position of the stream is not available!", ex);
+            }
+        }
+        set => _inner.Position = value;
+    }
+
+    public override void Flush()
+    {
+    }
+
+    public override int Read(byte[] buffer, int offset, int count) => _inner.Read(buffer, offset, count);
+
+    public override Task<int> ReadAsync(byte[] buffer, int offset, int count, CancellationToken cancellationToken)
+    {
+#if NETSTANDARD2_0
+        return _inner.ReadAsync(buffer, offset, count, cancellationToken);
+#else
+        // The SDK reads over this (old) overload; dispatch it over the modern one,
+        // so a source that only implements ReadAsync(Memory<byte>) keeps working
+        return _inner.ReadAsync(buffer.AsMemory(offset, count), cancellationToken).AsTask();
+#endif
+    }
+
+#if !NETSTANDARD2_0
+    public override int Read(Span<byte> buffer) => _inner.Read(buffer);
+
+    public override ValueTask<int> ReadAsync(Memory<byte> buffer, CancellationToken cancellationToken = default)
+    {
+        return _inner.ReadAsync(buffer, cancellationToken);
+    }
+#endif
+
+    public override long Seek(long offset, SeekOrigin origin) => _inner.Seek(offset, origin);
+    public override void SetLength(long value) => throw new NotSupportedException();
+    public override void Write(byte[] buffer, int offset, int count) => throw new NotSupportedException();
+
+    // Disposing the wrapper must not dispose the wrapped stream
+}

framework/src/Volo.Abp.BlobStoring.FileSystem/Volo/Abp/BlobStoring/FileSystem/FileSystemBlobProvider.cs

@@ -31,12 +31,36 @@ public class FileSystemBlobProvider : BlobProviderBase, ITransientDependency
             ? FileMode.Create
             : FileMode.CreateNew;
 
-        await Policy.Handle<IOException>()
+        // A failure is only retried while it is replayable: before OpenFileStream returns
+        // (the source is untouched), or for a seekable overwrite (the source can seek back
+        // and FileMode.Create truncates the partial content). Otherwise a retry would
+        // replay a half-consumed source or hit the file a failed CreateNew attempt left behind.
+        long sourcePosition;
+        try
+        {
+            sourcePosition = args.BlobStream.CanSeek && fileMode == FileMode.Create ? args.BlobStream.Position : -1;
+        }
+        catch (Exception ex) when (ex is NotSupportedException || ex is IOException)
+        {
+            // A failing position probe degrades to a single, non-replayable attempt
+            sourcePosition = -1;
+        }
+
+        var targetOpened = false;
+
+        await Policy.Handle<IOException>(_ => sourcePosition >= 0 || !targetOpened)
             .WaitAndRetryAsync(2, retryCount => TimeSpan.FromSeconds(retryCount))
             .ExecuteAsync(async () =>
             {
-                using (var fileStream = File.Open(filePath, fileMode, FileAccess.Write))
+                if (sourcePosition >= 0)
                 {
+                    args.BlobStream.Seek(sourcePosition, SeekOrigin.Begin);
+                }
+
+                using (var fileStream = OpenFileStream(filePath, fileMode))
+                {
+                    targetOpened = true;
+
                     await args.BlobStream.CopyToAsync(
                         fileStream,
                         args.CancellationToken
@@ -73,6 +97,11 @@ public class FileSystemBlobProvider : BlobProviderBase, ITransientDependency
             .ExecuteAsync(() => Task.FromResult(File.OpenRead(filePath)));
     }
 
+    protected virtual Stream OpenFileStream(string filePath, FileMode fileMode)
+    {
+        return File.Open(filePath, fileMode, FileAccess.Write);
+    }
+
     protected virtual Task<bool> ExistsAsync(string filePath)
     {
         return Task.FromResult(File.Exists(filePath));

framework/src/Volo.Abp.BlobStoring/Properties/AssemblyInfo.cs

@@ -0,0 +1,3 @@
+using System.Runtime.CompilerServices;
+
+[assembly: InternalsVisibleTo("Volo.Abp.BlobStoring.Tests")]

framework/src/Volo.Abp.BlobStoring/Volo/Abp/BlobStoring/AbpBlobStoringEncryptionOptions.cs

@@ -0,0 +1,21 @@
+namespace Volo.Abp.BlobStoring;
+
+/// <summary>
+/// Global options of the BLOB encryption; enable it per container with the
+/// <see cref="BlobContainerConfigurationEncryptionExtensions.UseEncryption"/> extension method.
+/// </summary>
+public class AbpBlobStoringEncryptionOptions
+{
+    /// <summary>
+    /// The global passphrase, used when no container-specific passphrase is available.
+    /// Default: null (encryption must be explicitly keyed).
+    /// </summary>
+    public string? DefaultPassPhrase { get; set; }
+
+    /// <summary>
+    /// PBKDF2 iteration count for newly encrypted BLOBs (existing BLOBs use the count
+    /// in their own header). Higher values raise both the offline guessing cost and
+    /// the CPU cost of every save/read. Allowed: 100,000 - 600,000. Default: 100,000.
+    /// </summary>
+    public int KdfIterations { get; set; } = 100_000;
+}

framework/src/Volo.Abp.BlobStoring/Volo/Abp/BlobStoring/BlobContainer.cs

@@ -1,7 +1,11 @@
-using System;
+using System;
+using System.Collections.Generic;
 using System.IO;
+using System.Linq;
+using System.Runtime.ExceptionServices;
 using System.Threading;
 using System.Threading.Tasks;
+using Microsoft.Extensions.DependencyInjection;
 using Volo.Abp.MultiTenancy;
 using Volo.Abp.Threading;
 
@@ -116,16 +120,87 @@ public class BlobContainer : IBlobContainer
         {
             var blobNormalizeNaming = BlobNormalizeNamingService.NormalizeNaming(Configuration, ContainerName, name);
 
-            await Provider.SaveAsync(
+            var fallbackCancellationToken = CancellationTokenProvider.FallbackToProvider(cancellationToken);
-                new BlobProviderSaveArgs(
+            var contributorTypes = Configuration.GetEffectivePipelineContributors().ToList();
-                    blobNormalizeNaming.ContainerName!,
+
-                    Configuration,
+            // Every stream the pipeline creates is disposed after the save (disposing the
-                    blobNormalizeNaming.BlobName!,
+            // encrypting wrapper also zeroes the derived key); the caller keeps the original
-                    stream,
+            var pipelineStreams = new List<Stream>();
-                    overrideExisting,
+            AsyncServiceScope? contributorScope = null;
-                    CancellationTokenProvider.FallbackToProvider(cancellationToken)
+            var completed = false;
-                )
+            try
-            );
+            {
+                if (contributorTypes.Count > 0)
+                {
+                    contributorScope = ServiceProvider.CreateAsyncScope();
+                    var context = new BlobPipelineContext(
+                        contributorScope.Value.ServiceProvider,
+                        blobNormalizeNaming.ContainerName!,
+                        blobNormalizeNaming.BlobName!,
+                        Configuration,
+                        GetTenantIdOrNull(),
+                        stream,
+                        fallbackCancellationToken
+                    );
+
+                    context.CreatedStreams = pipelineStreams;
+                    await RunPipelineAsync(context, contributorTypes, saving: true);
+                    stream = context.BlobStream;
+                }
+
+                if (BlobEncryptionConfiguration.IsEnabled(Configuration))
+                {
+                    stream = await CreateEncryptingStreamAsync(blobNormalizeNaming, stream, fallbackCancellationToken);
+                    pipelineStreams.Add(stream);
+                }
+
+                await Provider.SaveAsync(
+                    new BlobProviderSaveArgs(
+                        blobNormalizeNaming.ContainerName!,
+                        Configuration,
+                        blobNormalizeNaming.BlobName!,
+                        stream,
+                        overrideExisting,
+                        fallbackCancellationToken
+                    )
+                );
+
+                completed = true;
+            }
+            finally
+            {
+                // Best-effort cleanup: a failing Dispose must not prevent releasing the
+                // remaining streams/scope or hide the exception that is already propagating
+                Exception? disposeException = null;
+                for (var i = pipelineStreams.Count - 1; i >= 0; i--)
+                {
+                    try
+                    {
+                        await DisposeStreamAsync(pipelineStreams[i]);
+                    }
+                    catch (Exception ex)
+                    {
+                        disposeException ??= ex;
+                    }
+                }
+
+                if (contributorScope != null)
+                {
+                    try
+                    {
+                        await contributorScope.Value.DisposeAsync();
+                    }
+                    catch (Exception ex)
+                    {
+                        disposeException ??= ex;
+                    }
+                }
+
+                if (completed && disposeException != null)
+                {
+                    ExceptionDispatchInfo.Capture(disposeException).Throw();
+                }
+            }
         }
     }
 
@@ -194,14 +269,296 @@ public class BlobContainer : IBlobContainer
             var blobNormalizeNaming =
                 BlobNormalizeNamingService.NormalizeNaming(Configuration, ContainerName, name);
 
-            return await Provider.GetOrNullAsync(
+            var fallbackCancellationToken = CancellationTokenProvider.FallbackToProvider(cancellationToken);
+
+            var stream = await Provider.GetOrNullAsync(
                 new BlobProviderGetArgs(
                     blobNormalizeNaming.ContainerName!,
                     Configuration,
                     blobNormalizeNaming.BlobName!,
-                    CancellationTokenProvider.FallbackToProvider(cancellationToken)
+                    fallbackCancellationToken
                 )
             );
+
+            if (stream == null)
+            {
+                return null;
+            }
+
+            // The provider stream is now owned by the container: reading the configuration
+            // (a mis-typed value can throw) must not leak it
+            List<Type> contributorTypes;
+            bool encryptionEnabled;
+            try
+            {
+                contributorTypes = Configuration.GetEffectivePipelineContributors().ToList();
+                encryptionEnabled = BlobEncryptionConfiguration.IsEnabled(Configuration);
+            }
+            catch
+            {
+                await TryDisposeStreamAsync(stream);
+                throw;
+            }
+
+            // Captured so the pipeline can verify the decryption reached its authenticated
+            // end (the terminal record) when the composed stream reaches EOF, even if a
+            // contributor stops reading the decrypted content early. A custom
+            // CreateDecryptingStreamAsync override that wraps the stream should implement
+            // IBlobAuthenticatedEndStream (and forward), or this verification is skipped.
+            IBlobAuthenticatedEndStream? authenticatedEndSource = null;
+            if (encryptionEnabled)
+            {
+                // The method owns the provider stream: it is disposed there on any failure
+                stream = await CreateDecryptingStreamAsync(blobNormalizeNaming, stream, fallbackCancellationToken);
+                authenticatedEndSource = stream as IBlobAuthenticatedEndStream;
+            }
+
+            if (contributorTypes.Count == 0)
+            {
+                // Without contributors the caller reads the decrypting stream directly, so
+                // reading it to its end verifies the terminal record on its own
+                return stream;
+            }
+
+            // Contributors run in the reverse order after the decryption; the scope stays
+            // alive until the returned (lazily transforming) stream is disposed. Resolve the
+            // tenant id once, before the scope is created, so nothing between scope creation
+            // and the successful return can throw and leak the scope or the provider stream
+            Guid? tenantId;
+            try
+            {
+                tenantId = GetTenantIdOrNull();
+            }
+            catch
+            {
+                await TryDisposeStreamAsync(stream);
+                throw;
+            }
+
+            contributorTypes.Reverse();
+            AsyncServiceScope contributorScope;
+            try
+            {
+                contributorScope = ServiceProvider.CreateAsyncScope();
+            }
+            catch
+            {
+                await TryDisposeStreamAsync(stream);
+                throw;
+            }
+
+            var context = new BlobPipelineContext(
+                contributorScope.ServiceProvider,
+                blobNormalizeNaming.ContainerName!,
+                blobNormalizeNaming.BlobName!,
+                Configuration,
+                tenantId,
+                stream,
+                fallbackCancellationToken
+            );
+
+            try
+            {
+                await RunPipelineAsync(context, contributorTypes, saving: false);
+
+                return new BlobPipelineScopeStream(context.BlobStream, contributorScope, CurrentTenant, tenantId, authenticatedEndSource);
+            }
+            catch
+            {
+                // Best-effort cleanup that keeps the original exception: the current
+                // context stream owns the whole chain down to the provider stream
+                await TryDisposeStreamAsync(context.BlobStream);
+
+                try
+                {
+                    await contributorScope.DisposeAsync();
+                }
+                catch
+                {
+                    // ignored
+                }
+
+                throw;
+            }
+        }
+    }
+
+    /// <summary>
+    /// Runs the pipeline contributors on the context stream. While saving, the context
+    /// collects every stream a contributor creates (at assignment, so intermediate
+    /// replacements within one contributor call are not lost) to be disposed by the
+    /// caller; while reading, the composed stream is returned to the caller as a whole,
+    /// so each wrapper owns the stream it received.
+    /// </summary>
+    protected virtual async Task RunPipelineAsync(
+        BlobPipelineContext context,
+        IReadOnlyList<Type> contributorTypes,
+        bool saving)
+    {
+        foreach (var contributorType in contributorTypes)
+        {
+            var contributor = (IBlobPipelineContributor)context.ServiceProvider.GetRequiredService(contributorType);
+
+            if (saving)
+            {
+                await contributor.OnSavingAsync(context);
+            }
+            else
+            {
+                await contributor.OnGettingAsync(context);
+            }
+        }
+    }
+
+    /// <summary>
+    /// Wraps the stream for encryption. The caller keeps the ownership of
+    /// <paramref name="stream"/>; the wrapper is disposed after the provider call.
+    /// </summary>
+    protected virtual async Task<Stream> CreateEncryptingStreamAsync(BlobNormalizeNaming blobNormalizeNaming, Stream stream, CancellationToken cancellationToken)
+    {
+        // The key is fully resolved before returning, so the scope can be released here
+        var scope = ServiceProvider.CreateAsyncScope();
+        Stream? encryptingStream = null;
+        var completed = false;
+        try
+        {
+            encryptingStream = await scope.ServiceProvider
+                .GetRequiredService<IBlobEncryptionCodec>()
+                .CreateEncryptingStreamAsync(
+                    Configuration,
+                    blobNormalizeNaming.ContainerName!,
+                    blobNormalizeNaming.BlobName!,
+                    GetTenantIdOrNull(),
+                    stream,
+                    cancellationToken
+                );
+            completed = true;
+        }
+        finally
+        {
+            try
+            {
+                await scope.DisposeAsync();
+            }
+            catch
+            {
+                // A failing scope dispose must not leak the created stream (it zeroes
+                // the key) and must not replace an exception already propagating
+                if (encryptingStream != null)
+                {
+                    await TryDisposeStreamAsync(encryptingStream);
+                }
+
+                if (completed)
+                {
+                    throw;
+                }
+            }
+        }
+
+        return encryptingStream!;
+    }
+
+    /// <summary>
+    /// Wraps the provider stream for decryption. The method owns <paramref name="stream"/>:
+    /// the returned stream disposes it, and it is also disposed when this method fails.
+    /// Opening throws <see cref="AbpException"/> for format violations; reading throws
+    /// <see cref="System.Security.Cryptography.CryptographicException"/> on failed authentication.
+    /// The returned stream implements <see cref="IBlobAuthenticatedEndStream"/>, which the
+    /// content pipeline uses to verify the authenticated end on EOF. An override that wraps
+    /// the returned stream should implement that interface too (and forward), otherwise the
+    /// pipeline can not run the end verification for this container.
+    /// </summary>
+    protected virtual async Task<Stream> CreateDecryptingStreamAsync(BlobNormalizeNaming blobNormalizeNaming, Stream stream, CancellationToken cancellationToken)
+    {
+        AsyncServiceScope scope;
+        try
+        {
+            scope = ServiceProvider.CreateAsyncScope();
+        }
+        catch
+        {
+            await TryDisposeStreamAsync(stream);
+            throw;
+        }
+
+        Stream? decryptingStream = null;
+        var completed = false;
+        try
+        {
+            decryptingStream = await scope.ServiceProvider
+                .GetRequiredService<IBlobEncryptionCodec>()
+                .CreateDecryptingStreamAsync(
+                    Configuration,
+                    blobNormalizeNaming.ContainerName!,
+                    blobNormalizeNaming.BlobName!,
+                    GetTenantIdOrNull(),
+                    stream,
+                    cancellationToken
+                );
+            completed = true;
+        }
+        catch
+        {
+            // Best-effort cleanup that keeps the original exception
+            await TryDisposeStreamAsync(stream);
+            throw;
+        }
+        finally
+        {
+            try
+            {
+                await scope.DisposeAsync();
+            }
+            catch
+            {
+                // A failing scope dispose must not leak the created stream (it zeroes
+                // the key and disposes the provider stream — exactly once, since the
+                // caller does not dispose after this method) and must not replace an
+                // exception already propagating
+                if (decryptingStream != null)
+                {
+                    await TryDisposeStreamAsync(decryptingStream);
+                }
+
+                if (completed)
+                {
+                    throw;
+                }
+            }
+        }
+
+        return decryptingStream!;
+    }
+
+    protected virtual async Task DisposeStreamAsync(Stream stream)
+    {
+#if NETSTANDARD2_0
+        // Stream has no DisposeAsync on netstandard2.0, but a stream may still implement
+        // IAsyncDisposable (via Microsoft.Bcl.AsyncInterfaces) for its async-only cleanup
+        if (stream is IAsyncDisposable asyncDisposable)
+        {
+            await asyncDisposable.DisposeAsync();
+        }
+        else
+        {
+            stream.Dispose();
+        }
+#else
+        // Also covers wrappers that only implement DisposeAsync
+        await stream.DisposeAsync();
+#endif
+    }
+
+    protected virtual async Task TryDisposeStreamAsync(Stream stream)
+    {
+        try
+        {
+            await DisposeStreamAsync(stream);
+        }
+        catch
+        {
+            // ignored: best-effort cleanup during exception handling
         }
     }
 

framework/src/Volo.Abp.BlobStoring/Volo/Abp/BlobStoring/BlobContainerConfiguration.cs

@@ -1,5 +1,6 @@
 using System;
 using System.Collections.Generic;
+using System.Linq;
 using JetBrains.Annotations;
 using Volo.Abp.Collections;
 
@@ -32,6 +33,19 @@ public class BlobContainerConfiguration
 
     public ITypeList<IBlobNamingNormalizer> NamingNormalizers { get; }
 
+    /// <summary>
+    /// The <see cref="IBlobPipelineContributor"/> implementations transforming
+    /// the content of this container while it is saved and read.
+    /// </summary>
+    public ITypeList<IBlobPipelineContributor> PipelineContributors { get; }
+
+    /// <summary>
+    /// Set false to stop inheriting the pipeline contributors of the default
+    /// container configuration, so only the own <see cref="PipelineContributors"/>
+    /// of this container run. Default: true.
+    /// </summary>
+    public bool InheritPipelineContributors { get; set; } = true;
+
     [NotNull] private readonly Dictionary<string, object?> _properties;
 
     private readonly BlobContainerConfiguration? _fallbackConfiguration;
@@ -39,6 +53,7 @@ public class BlobContainerConfiguration
     public BlobContainerConfiguration(BlobContainerConfiguration? fallbackConfiguration = null)
     {
         NamingNormalizers = new TypeList<IBlobNamingNormalizer>();
+        PipelineContributors = new TypeList<IBlobPipelineContributor>();
         _fallbackConfiguration = fallbackConfiguration;
         _properties = new Dictionary<string, object?>();
     }
@@ -57,6 +72,26 @@ public class BlobContainerConfiguration
         return NamingNormalizers;
     }
 
+    /// <summary>
+    /// Returns the pipeline contributors in effect for this container: the contributors
+    /// of the fallback (default) configuration first, then the own ones (each contributor
+    /// type runs once). Contributors are provider-independent content transformations,
+    /// so overriding <see cref="ProviderType"/> does not reset the inherited ones; use
+    /// <see cref="InheritPipelineContributors"/> to opt out of the inherited ones.
+    /// </summary>
+    public IEnumerable<Type> GetEffectivePipelineContributors()
+    {
+        if (_fallbackConfiguration == null || !InheritPipelineContributors)
+        {
+            return PipelineContributors.Distinct();
+        }
+
+        return _fallbackConfiguration
+            .GetEffectivePipelineContributors()
+            .Concat(PipelineContributors)
+            .Distinct();
+    }
+
     public T? GetConfigurationOrDefault<T>(string name, T? defaultValue = default)
     {
         return (T?)GetConfigurationOrNull(name, defaultValue);

framework/src/Volo.Abp.BlobStoring/Volo/Abp/BlobStoring/BlobContainerConfigurationEncryptionExtensions.cs

@@ -0,0 +1,99 @@
+using JetBrains.Annotations;
+
+namespace Volo.Abp.BlobStoring;
+
+public static class BlobContainerConfigurationEncryptionExtensions
+{
+    /// <summary>
+    /// Enables encryption for the BLOBs of this container. Calling it again is safe:
+    /// omitted parameters keep the already configured (or inherited) values,
+    /// so multiple modules can compose the configuration.
+    /// </summary>
+    /// <param name="containerConfiguration">The container configuration.</param>
+    /// <param name="passPhrase">
+    /// Optional container-specific passphrase. Without one, the passphrase is resolved
+    /// by the <see cref="IBlobEncryptionKeyProvider"/>. Use
+    /// <see cref="ClearEncryptionPassPhrase"/> to remove a configured passphrase.
+    /// </param>
+    /// <param name="allowLegacyPlainText">
+    /// Allows reading BLOBs stored as plaintext before encryption was enabled:
+    /// content without the encrypted format header is then returned as-is,
+    /// <b>without any authenticity check</b>. Keep it disabled (default) unless
+    /// the container really has such BLOBs.
+    /// </param>
+    public static BlobContainerConfiguration UseEncryption(
+        [NotNull] this BlobContainerConfiguration containerConfiguration,
+        string? passPhrase = null,
+        bool? allowLegacyPlainText = null)
+    {
+        Check.NotNull(containerConfiguration, nameof(containerConfiguration));
+
+        // Validate all arguments before touching the configuration, so a failed
+        // call does not leave it partially modified
+        if (passPhrase != null)
+        {
+            Check.NotNullOrWhiteSpace(passPhrase, nameof(passPhrase));
+        }
+
+        containerConfiguration.SetConfiguration(BlobEncryptionConfigurationNames.Enabled, true);
+
+        if (allowLegacyPlainText.HasValue)
+        {
+            containerConfiguration.SetConfiguration(BlobEncryptionConfigurationNames.AllowLegacyPlainText, allowLegacyPlainText.Value);
+        }
+
+        if (passPhrase != null)
+        {
+            containerConfiguration.SetConfiguration(BlobEncryptionConfigurationNames.PassPhrase, passPhrase);
+        }
+
+        return containerConfiguration;
+    }
+
+    /// <summary>
+    /// Indicates whether encryption is enabled for this container (own or inherited
+    /// configuration). Storage providers can use it to detect a transformed content stream.
+    /// </summary>
+    public static bool IsEncryptionEnabled([NotNull] this BlobContainerConfiguration containerConfiguration)
+    {
+        Check.NotNull(containerConfiguration, nameof(containerConfiguration));
+
+        return BlobEncryptionConfiguration.IsEnabled(containerConfiguration);
+    }
+
+    /// <summary>
+    /// Removes the container passphrase (including an inherited one), so the
+    /// <see cref="IBlobEncryptionKeyProvider"/> resolves the passphrase again.
+    /// BLOBs encrypted with the removed passphrase can not be read anymore.
+    /// </summary>
+    public static BlobContainerConfiguration ClearEncryptionPassPhrase(
+        [NotNull] this BlobContainerConfiguration containerConfiguration)
+    {
+        Check.NotNull(containerConfiguration, nameof(containerConfiguration));
+
+        // An explicit empty value shadows a passphrase inherited from the
+        // default (fallback) container configuration.
+        containerConfiguration.SetConfiguration(BlobEncryptionConfigurationNames.PassPhrase, string.Empty);
+
+        return containerConfiguration;
+    }
+
+    /// <summary>
+    /// Disables encryption for this container (even when inherited from the default
+    /// configuration) and removes its own passphrase/legacy options. Existing encrypted
+    /// BLOBs are then returned as stored (still encrypted bytes) while reading — unless
+    /// the container also has pipeline contributors, which still run and typically fail
+    /// on the ciphertext.
+    /// </summary>
+    public static BlobContainerConfiguration DisableEncryption(
+        [NotNull] this BlobContainerConfiguration containerConfiguration)
+    {
+        Check.NotNull(containerConfiguration, nameof(containerConfiguration));
+
+        containerConfiguration.SetConfiguration(BlobEncryptionConfigurationNames.Enabled, false);
+        containerConfiguration.ClearConfiguration(BlobEncryptionConfigurationNames.PassPhrase);
+        containerConfiguration.ClearConfiguration(BlobEncryptionConfigurationNames.AllowLegacyPlainText);
+
+        return containerConfiguration;
+    }
+}

framework/src/Volo.Abp.BlobStoring/Volo/Abp/BlobStoring/BlobEncryptionCodec.cs

@@ -0,0 +1,693 @@
+using System;
+using System.IO;
+using System.Security.Cryptography;
+using System.Text;
+using System.Threading;
+using System.Threading.Tasks;
+using JetBrains.Annotations;
+using Microsoft.Extensions.Options;
+using Volo.Abp.DependencyInjection;
+
+namespace Volo.Abp.BlobStoring;
+
+/// <summary>
+/// Implements the encrypted BLOB format (version 1) using AES-256-GCM.
+/// Not available on .NET Standard 2.0 (no AES-GCM).
+/// <para>
+/// Format: "ABPE" magic (4) + format version (1) + header (34: algorithm 1,
+/// key source 1, KDF iterations 4, random per-BLOB KDF salt 16, chunk size 4,
+/// base nonce 8), followed by authenticated chunk records (4-byte big-endian
+/// cipher length, cipher chunk, 16-byte tag) and an authenticated zero-length
+/// terminal record. The whole prefix, the storage identity (container, BLOB
+/// name, tenant) and the chunk index are bound to every chunk as associated
+/// data; the per-BLOB salt gives every BLOB its own derived key.
+/// </para>
+/// </summary>
+public class BlobEncryptionCodec : IBlobEncryptionCodec, ITransientDependency
+{
+    internal static readonly byte[] Magic = { (byte)'A', (byte)'B', (byte)'P', (byte)'E' };
+
+    internal const byte FormatVersion = 1;
+    internal const byte AlgorithmAesGcm = 1;
+    internal const int MinKdfIterations = 100_000;
+    internal const int MaxKdfIterations = 600_000; // reader cap: bounded headroom above the writer constant
+    internal const int KdfSaltSize = 16;
+    internal const int ChunkSize = 64 * 1024;
+    internal const int MaxChunkSize = 1024 * 1024; // reader cap: bounds allocations driven by the (pre-authentication) header
+    internal const int BaseNonceSize = 8;
+    internal const int HeaderSize = 34; // algorithm(1) + keySource(1) + iterations(4) + salt(16) + chunkSize(4) + baseNonce(8)
+    internal const int ChunkLengthPrefixSize = 4;
+    internal const int GcmNonceSize = 12;
+    internal const int GcmTagSize = 16;
+
+    // Rejects invalid UTF-16 instead of silently replacing it: the default encoder
+    // folds different unpaired surrogates into the same replacement bytes, which
+    // would let two different names produce the same authenticated identity
+    private static readonly Encoding StrictUtf8 = new UTF8Encoding(encoderShouldEmitUTF8Identifier: false, throwOnInvalidBytes: true);
+
+    protected IBlobEncryptionKeyProvider KeyProvider { get; }
+
+    protected AbpBlobStoringEncryptionOptions Options { get; }
+
+    public BlobEncryptionCodec(
+        IBlobEncryptionKeyProvider keyProvider,
+        IOptions<AbpBlobStoringEncryptionOptions> options)
+    {
+        KeyProvider = keyProvider;
+        Options = options.Value;
+    }
+
+    /// <inheritdoc />
+    // The key is fully resolved before the stream is returned, so the resolution scope can be released.
+    public virtual async Task<Stream> CreateEncryptingStreamAsync(
+        [NotNull] BlobContainerConfiguration configuration,
+        [NotNull] string containerName,
+        [NotNull] string blobName,
+        Guid? tenantId,
+        [NotNull] Stream plainStream,
+        CancellationToken cancellationToken = default)
+    {
+        Check.NotNull(configuration, nameof(configuration));
+        Check.NotNullOrWhiteSpace(containerName, nameof(containerName));
+        Check.NotNullOrWhiteSpace(blobName, nameof(blobName));
+        Check.NotNull(plainStream, nameof(plainStream));
+
+#if NETSTANDARD2_0
+        // Fail before any output is produced, so no partial (corrupted) data is ever written.
+        throw new PlatformNotSupportedException("BLOB encryption requires AES-GCM, which is not available on .NET Standard 2.0!");
+#else
+#if NET8_0_OR_GREATER
+        if (!AesGcm.IsSupported)
+        {
+            throw new PlatformNotSupportedException("AES-GCM is not supported on this platform!");
+        }
+#else
+        // netstandard2.1 has no AesGcm.IsSupported; constructing an instance is the only
+        // probe that fails here instead of after the provider has opened the target
+        using (CreateAesGcm(new byte[32]))
+        {
+        }
+#endif
+        var kdfIterations = Options.KdfIterations;
+        if (kdfIterations < MinKdfIterations || kdfIterations > MaxKdfIterations)
+        {
+            throw new AbpException(
+                $"{nameof(AbpBlobStoringEncryptionOptions)}.{nameof(AbpBlobStoringEncryptionOptions.KdfIterations)} " +
+                $"must be between {MinKdfIterations} and {MaxKdfIterations}!");
+        }
+
+        var key = await KeyProvider.ResolveForEncryptionAsync(
+            new BlobEncryptionKeyContext(configuration, containerName, blobName, tenantId),
+            cancellationToken);
+
+        var salt = new byte[KdfSaltSize];
+        var baseNonce = new byte[BaseNonceSize];
+        using (var random = RandomNumberGenerator.Create())
+        {
+            random.GetBytes(salt);
+            random.GetBytes(baseNonce);
+        }
+
+        var header = BuildHeader(key.Source, kdfIterations, salt, ChunkSize, baseNonce);
+        var blobPrefix = CreateBlobPrefix(header);
+        // The AAD can reject invalid names; build it before deriving the key, so
+        // no derived key is left un-zeroed on the rejection path
+        var associatedDataPrefix = BuildAssociatedDataPrefix(blobPrefix, containerName, blobName, tenantId);
+        var encryptedLength = TryCalculateEncryptedLength(plainStream, ChunkSize);
+        var keyBytes = DeriveKeyBytesOrThrowIfCancelled(key.PassPhrase, salt, kdfIterations, cancellationToken);
+
+        return new ChunkedEncryptingReadStream(
+            plainStream,
+            blobPrefix,
+            associatedDataPrefix,
+            keyBytes,
+            baseNonce,
+            ChunkSize,
+            encryptedLength
+        );
+#endif
+    }
+
+    /// <inheritdoc />
+    public virtual async Task<Stream> CreateDecryptingStreamAsync(
+        [NotNull] BlobContainerConfiguration configuration,
+        [NotNull] string containerName,
+        [NotNull] string blobName,
+        Guid? tenantId,
+        [NotNull] Stream cipherStream,
+        CancellationToken cancellationToken = default)
+    {
+        Check.NotNull(configuration, nameof(configuration));
+        Check.NotNullOrWhiteSpace(containerName, nameof(containerName));
+        Check.NotNullOrWhiteSpace(blobName, nameof(blobName));
+        Check.NotNull(cipherStream, nameof(cipherStream));
+
+        var prefix = await ReadUpToAsync(cipherStream, Magic.Length + 1, cancellationToken);
+        if (!StartsWithMagic(prefix))
+        {
+            if (BlobEncryptionConfiguration.IsLegacyPlainTextAllowed(configuration))
+            {
+                return new PrefixingReadStream(prefix, cipherStream);
+            }
+
+            throw new AbpException(
+                "The BLOB does not have the encrypted BLOB format. If it was stored before encryption " +
+                "was enabled for the container, enable reading legacy plaintext BLOBs explicitly " +
+                "(see the UseEncryption extension method). Otherwise the BLOB is corrupted or tampered."
+            );
+        }
+
+        // The full magic already identifies the encrypted format: content truncated
+        // right after it must fail as corrupted, not fall back to legacy plaintext
+        if (prefix.Length < Magic.Length + 1)
+        {
+            throw new AbpException("The encrypted BLOB is corrupted or has an invalid format: missing format version!");
+        }
+
+        if (prefix[Magic.Length] != FormatVersion)
+        {
+            throw new AbpException($"Unsupported encrypted BLOB format version: {prefix[Magic.Length]}!");
+        }
+
+#if NETSTANDARD2_0
+        throw new PlatformNotSupportedException("BLOB decryption requires AES-GCM, which is not available on .NET Standard 2.0!");
+#else
+#if NET8_0_OR_GREATER
+        if (!AesGcm.IsSupported)
+        {
+            throw new PlatformNotSupportedException("AES-GCM is not supported on this platform!");
+        }
+#else
+        // netstandard2.1 has no AesGcm.IsSupported; constructing an instance is the only
+        // probe that fails here instead of after the key is resolved and derived
+        using (CreateAesGcm(new byte[32]))
+        {
+        }
+#endif
+        var header = await ReadExactlyAsync(cipherStream, HeaderSize, cancellationToken);
+        if (header == null)
+        {
+            throw new AbpException("The encrypted BLOB is corrupted or has an invalid format: missing header!");
+        }
+
+        if (header[0] != AlgorithmAesGcm)
+        {
+            throw new AbpException($"Unsupported encrypted BLOB algorithm: {header[0]}!");
+        }
+
+        var keySource = header[1];
+        if (keySource < (byte)BlobEncryptionKeySource.Container || keySource > (byte)BlobEncryptionKeySource.Global)
+        {
+            throw new AbpException($"Unknown BLOB encryption key source: {keySource}!");
+        }
+
+        var iterations = ReadInt32BigEndian(header, 2);
+        if (iterations < MinKdfIterations || iterations > MaxKdfIterations)
+        {
+            // Accepting fewer iterations than any legitimate writer ever used would let
+            // attacker-crafted content turn reads into a cheap passphrase-guessing oracle
+            throw new AbpException("The encrypted BLOB is corrupted or has an invalid format: invalid KDF iteration count!");
+        }
+
+        var salt = new byte[KdfSaltSize];
+        Array.Copy(header, 6, salt, 0, KdfSaltSize);
+
+        var chunkSize = ReadInt32BigEndian(header, 22);
+        if (chunkSize <= 0 || chunkSize > MaxChunkSize)
+        {
+            throw new AbpException("The encrypted BLOB is corrupted or has an invalid format: invalid chunk size!");
+        }
+
+        var baseNonce = new byte[BaseNonceSize];
+        Array.Copy(header, 26, baseNonce, 0, BaseNonceSize);
+
+        var blobPrefix = new byte[Magic.Length + 1 + HeaderSize];
+        Array.Copy(prefix, 0, blobPrefix, 0, Magic.Length + 1);
+        Array.Copy(header, 0, blobPrefix, Magic.Length + 1, HeaderSize);
+        // The AAD can reject invalid names; build it before deriving the key, so
+        // no derived key is left un-zeroed on the rejection path
+        var associatedDataPrefix = BuildAssociatedDataPrefix(blobPrefix, containerName, blobName, tenantId);
+
+        var passPhrase = await KeyProvider.ResolveForDecryptionAsync(
+            (BlobEncryptionKeySource)keySource,
+            new BlobEncryptionKeyContext(configuration, containerName, blobName, tenantId),
+            cancellationToken
+        );
+        var keyBytes = DeriveKeyBytesOrThrowIfCancelled(passPhrase, salt, iterations, cancellationToken);
+
+        return new ChunkedDecryptingReadStream(
+            cipherStream,
+            associatedDataPrefix,
+            keyBytes,
+            baseNonce,
+            chunkSize
+        );
+#endif
+    }
+
+    internal static byte[] BuildHeader(BlobEncryptionKeySource keySource, int iterations, byte[] salt, int chunkSize, byte[] baseNonce)
+    {
+        var header = new byte[HeaderSize];
+        header[0] = AlgorithmAesGcm;
+        header[1] = (byte)keySource;
+        WriteInt32BigEndian(header, 2, iterations);
+        Array.Copy(salt, 0, header, 6, KdfSaltSize);
+        WriteInt32BigEndian(header, 22, chunkSize);
+        Array.Copy(baseNonce, 0, header, 26, BaseNonceSize);
+        return header;
+    }
+
+    // Length-prefixed identity fields: a validly encrypted BLOB can not be read
+    // from another BLOB name, container or tenant.
+    internal static byte[] BuildAssociatedDataPrefix(byte[] blobPrefix, string containerName, string blobName, Guid? tenantId)
+    {
+        byte[] containerNameBytes;
+        byte[] blobNameBytes;
+        try
+        {
+            containerNameBytes = StrictUtf8.GetBytes(containerName);
+            blobNameBytes = StrictUtf8.GetBytes(blobName);
+        }
+        catch (EncoderFallbackException ex)
+        {
+            throw new AbpException("The container/BLOB name contains invalid characters (unpaired surrogates), so it can not be bound to the encrypted content!", ex);
+        }
+        var tenantIdBytes = tenantId?.ToByteArray() ?? Array.Empty<byte>();
+
+        var prefix = new byte[blobPrefix.Length + 4 + containerNameBytes.Length + 4 + blobNameBytes.Length + 4 + tenantIdBytes.Length];
+        var offset = 0;
+
+        Array.Copy(blobPrefix, 0, prefix, offset, blobPrefix.Length);
+        offset += blobPrefix.Length;
+
+        offset = WriteLengthPrefixed(prefix, offset, containerNameBytes);
+        offset = WriteLengthPrefixed(prefix, offset, blobNameBytes);
+        WriteLengthPrefixed(prefix, offset, tenantIdBytes);
+
+        return prefix;
+    }
+
+    private static int WriteLengthPrefixed(byte[] buffer, int offset, byte[] bytes)
+    {
+        WriteInt32BigEndian(buffer, offset, bytes.Length);
+        Array.Copy(bytes, 0, buffer, offset + 4, bytes.Length);
+        return offset + 4 + bytes.Length;
+    }
+
+    internal static byte[] CreateBlobPrefix(byte[] header)
+    {
+        var prefix = new byte[Magic.Length + 1 + header.Length];
+        Magic.CopyTo(prefix, 0);
+        prefix[Magic.Length] = FormatVersion;
+        Array.Copy(header, 0, prefix, Magic.Length + 1, header.Length);
+        return prefix;
+    }
+
+    // The synchronous PBKDF2 can not observe the token itself; check before the
+    // (expensive) derivation and once more after it, so a cancellation during the
+    // derivation is not lost
+    private static byte[] DeriveKeyBytesOrThrowIfCancelled(string passPhrase, byte[] salt, int iterations, CancellationToken cancellationToken)
+    {
+        cancellationToken.ThrowIfCancellationRequested();
+        var keyBytes = DeriveKeyBytes(passPhrase, salt, iterations);
+
+        if (cancellationToken.IsCancellationRequested)
+        {
+#if !NETSTANDARD2_0
+            CryptographicOperations.ZeroMemory(keyBytes);
+#endif
+            cancellationToken.ThrowIfCancellationRequested();
+        }
+
+        return keyBytes;
+    }
+
+    internal static byte[] DeriveKeyBytes(string passPhrase, byte[] salt, int iterations)
+    {
+#if NETSTANDARD2_0
+        throw new PlatformNotSupportedException("BLOB encryption requires AES-GCM, which is not available on .NET Standard 2.0!");
+#else
+        // Encode the passphrase to bytes with strict UTF-8 explicitly, so every target
+        // framework derives the same key and an invalid passphrase (unpaired surrogates)
+        // is rejected the same way — the string overloads differ across frameworks (net8+
+        // throws on invalid UTF-16, netstandard2.1 silently replaces it)
+        byte[] passwordBytes;
+        try
+        {
+            passwordBytes = StrictUtf8.GetBytes(passPhrase);
+        }
+        catch (EncoderFallbackException ex)
+        {
+            throw new AbpException("The BLOB encryption passphrase contains invalid characters (unpaired surrogates)!", ex);
+        }
+
+        try
+        {
+#if NET8_0_OR_GREATER
+            return Rfc2898DeriveBytes.Pbkdf2(passwordBytes, salt, iterations, HashAlgorithmName.SHA256, 32);
+#else
+            using var password = new Rfc2898DeriveBytes(passwordBytes, salt, iterations, HashAlgorithmName.SHA256);
+            return password.GetBytes(32);
+#endif
+        }
+        finally
+        {
+            CryptographicOperations.ZeroMemory(passwordBytes);
+        }
+#endif
+    }
+
+    // One AES-GCM instance is bound to the per-BLOB key and reused for every chunk, so a
+    // stream sets up the key schedule once instead of per chunk. Typed as IDisposable so the
+    // streams that hold it still compile on netstandard2.0 (where creation throws first).
+    internal static IDisposable CreateChunkCipher(byte[] keyBytes)
+    {
+#if NETSTANDARD2_0
+        throw new PlatformNotSupportedException("AES-GCM is not available on .NET Standard 2.0!");
+#else
+        return CreateAesGcm(keyBytes);
+#endif
+    }
+
+    internal static byte[] EncryptChunk(byte[] keyBytes, byte[] associatedDataPrefix, byte[] baseNonce, int chunkIndex, byte[] plainChunk, int plainChunkLength)
+    {
+        using (var cipher = CreateChunkCipher(keyBytes))
+        {
+            return EncryptChunkCore(cipher, CreateChunkAssociatedData(associatedDataPrefix, chunkIndex), CreateChunkNonce(baseNonce, chunkIndex), plainChunk, plainChunkLength);
+        }
+    }
+
+    // The cipher, associated data and nonce are passed in fully built so the streams can reuse
+    // one of each and only rewrite the trailing chunk index, instead of reconstructing the
+    // AES-GCM key schedule and reallocating the whole identity (which grows with the
+    // container/BLOB name) for every chunk
+    internal static byte[] EncryptChunkCore(IDisposable cipher, byte[] associatedData, byte[] nonce, byte[] plainChunk, int plainChunkLength)
+    {
+#if NETSTANDARD2_0
+        throw new PlatformNotSupportedException("AES-GCM is not available on .NET Standard 2.0!");
+#else
+        var record = new byte[ChunkLengthPrefixSize + plainChunkLength + GcmTagSize];
+        WriteInt32BigEndian(record, 0, plainChunkLength);
+
+        ((AesGcm)cipher).Encrypt(
+            nonce,
+            plainChunk.AsSpan(0, plainChunkLength),
+            record.AsSpan(ChunkLengthPrefixSize, plainChunkLength),
+            record.AsSpan(ChunkLengthPrefixSize + plainChunkLength, GcmTagSize),
+            associatedData
+        );
+
+        return record;
+#endif
+    }
+
+    internal static byte[] DecryptChunk(byte[] keyBytes, byte[] associatedDataPrefix, byte[] baseNonce, int chunkIndex, byte[] cipherChunk, byte[] tag)
+    {
+        using (var cipher = CreateChunkCipher(keyBytes))
+        {
+            return DecryptChunkCore(cipher, CreateChunkAssociatedData(associatedDataPrefix, chunkIndex), CreateChunkNonce(baseNonce, chunkIndex), cipherChunk, tag);
+        }
+    }
+
+    internal static byte[] DecryptChunkCore(IDisposable cipher, byte[] associatedData, byte[] nonce, byte[] cipherChunk, byte[] tag)
+    {
+#if NETSTANDARD2_0
+        throw new PlatformNotSupportedException("AES-GCM is not available on .NET Standard 2.0!");
+#else
+        var plainChunk = new byte[cipherChunk.Length];
+        // Throws CryptographicException if the authentication tag is invalid.
+        ((AesGcm)cipher).Decrypt(nonce, cipherChunk, tag, plainChunk, associatedData);
+
+        return plainChunk;
+#endif
+    }
+
+    // The authenticated terminal record makes truncation of complete chunks detectable
+    internal static byte[] CreateTerminalRecord(byte[] keyBytes, byte[] associatedDataPrefix, byte[] baseNonce, int chunkIndex)
+    {
+        using (var cipher = CreateChunkCipher(keyBytes))
+        {
+            return CreateTerminalRecordCore(cipher, CreateChunkAssociatedData(associatedDataPrefix, chunkIndex), CreateChunkNonce(baseNonce, chunkIndex));
+        }
+    }
+
+    internal static byte[] CreateTerminalRecordCore(IDisposable cipher, byte[] associatedData, byte[] nonce)
+    {
+#if NETSTANDARD2_0
+        throw new PlatformNotSupportedException("AES-GCM is not available on .NET Standard 2.0!");
+#else
+        var record = new byte[ChunkLengthPrefixSize + GcmTagSize];
+        ((AesGcm)cipher).Encrypt(
+            nonce,
+            Array.Empty<byte>(),
+            Array.Empty<byte>(),
+            record.AsSpan(ChunkLengthPrefixSize, GcmTagSize),
+            associatedData
+        );
+
+        return record;
+#endif
+    }
+
+    internal static void VerifyTerminalRecord(byte[] keyBytes, byte[] associatedDataPrefix, byte[] baseNonce, int chunkIndex, byte[] tag)
+    {
+        using (var cipher = CreateChunkCipher(keyBytes))
+        {
+            VerifyTerminalRecordCore(cipher, CreateChunkAssociatedData(associatedDataPrefix, chunkIndex), CreateChunkNonce(baseNonce, chunkIndex), tag);
+        }
+    }
+
+    internal static void VerifyTerminalRecordCore(IDisposable cipher, byte[] associatedData, byte[] nonce, byte[] tag)
+    {
+#if NETSTANDARD2_0
+        throw new PlatformNotSupportedException("AES-GCM is not available on .NET Standard 2.0!");
+#else
+        // Throws CryptographicException if the tag is invalid.
+        ((AesGcm)cipher).Decrypt(nonce, Array.Empty<byte>(), tag, Array.Empty<byte>(), associatedData);
+#endif
+    }
+
+    // Nonce = 8-byte random base + 4-byte chunk index; the per-BLOB key (random salt)
+    // makes cross-BLOB reuse harmless and the index keeps it unique within the BLOB.
+    internal static byte[] CreateChunkNonce(byte[] baseNonce, int chunkIndex)
+    {
+        if (chunkIndex < 0)
+        {
+            // A wrapped chunk index would repeat a nonce for the same key, which breaks AES-GCM.
+            throw new AbpException("The data is too large: the maximum chunk count has been exceeded!");
+        }
+
+        var nonce = new byte[GcmNonceSize];
+        Array.Copy(baseNonce, 0, nonce, 0, BaseNonceSize);
+        WriteInt32BigEndian(nonce, BaseNonceSize, chunkIndex);
+        return nonce;
+    }
+
+    internal static byte[] CreateChunkAssociatedData(byte[] associatedDataPrefix, int chunkIndex)
+    {
+        var associatedData = new byte[associatedDataPrefix.Length + 4];
+        Array.Copy(associatedDataPrefix, 0, associatedData, 0, associatedDataPrefix.Length);
+        WriteInt32BigEndian(associatedData, associatedDataPrefix.Length, chunkIndex);
+        return associatedData;
+    }
+
+    // A stream builds one nonce and one associated-data buffer with these, then rewrites only
+    // the trailing chunk index per chunk with WriteChunkIndex; both hold the index as their
+    // last 4 bytes, so the fixed prefix is copied once instead of once per chunk
+    internal static byte[] CreateReusableChunkNonce(byte[] baseNonce)
+    {
+        var nonce = new byte[GcmNonceSize];
+        Array.Copy(baseNonce, 0, nonce, 0, BaseNonceSize);
+        return nonce;
+    }
+
+    internal static byte[] CreateReusableAssociatedData(byte[] associatedDataPrefix)
+    {
+        var associatedData = new byte[associatedDataPrefix.Length + 4];
+        Array.Copy(associatedDataPrefix, 0, associatedData, 0, associatedDataPrefix.Length);
+        return associatedData;
+    }
+
+    internal static void WriteChunkIndex(byte[] nonceOrAssociatedData, int chunkIndex)
+    {
+        if (chunkIndex < 0)
+        {
+            // A wrapped chunk index would repeat a nonce for the same key, which breaks AES-GCM.
+            throw new AbpException("The data is too large: the maximum chunk count has been exceeded!");
+        }
+
+        WriteInt32BigEndian(nonceOrAssociatedData, nonceOrAssociatedData.Length - 4, chunkIndex);
+    }
+
+    internal static int GetCipherChunkSize(byte[] lengthPrefix, int maxCipherChunkSize)
+    {
+        if (lengthPrefix.Length == 0)
+        {
+            throw new AbpException("The encrypted BLOB is corrupted or has an invalid format: missing terminal record!");
+        }
+
+        if (lengthPrefix.Length < ChunkLengthPrefixSize)
+        {
+            throw new AbpException("The encrypted BLOB is corrupted or has an invalid format: truncated chunk!");
+        }
+
+        var cipherChunkSize = ReadInt32BigEndian(lengthPrefix, 0);
+        if (cipherChunkSize < 0 || cipherChunkSize > maxCipherChunkSize)
+        {
+            throw new AbpException("The encrypted BLOB is corrupted or has an invalid format: invalid chunk length!");
+        }
+
+        return cipherChunkSize;
+    }
+
+    internal static byte[]? ReadExactly(Stream stream, int count)
+    {
+        var buffer = ReadUpTo(stream, count);
+        return buffer.Length == count ? buffer : null;
+    }
+
+    internal static byte[] ReadUpTo(Stream stream, int count)
+    {
+        var buffer = new byte[count];
+        var totalReadCount = 0;
+        while (totalReadCount < count)
+        {
+            var readCount = stream.Read(buffer, totalReadCount, count - totalReadCount);
+            if (readCount == 0)
+            {
+                break;
+            }
+
+            totalReadCount += readCount;
+        }
+
+        if (totalReadCount == count)
+        {
+            return buffer;
+        }
+
+        var result = new byte[totalReadCount];
+        Array.Copy(buffer, 0, result, 0, totalReadCount);
+        return result;
+    }
+
+    internal static async Task<byte[]?> ReadExactlyAsync(Stream stream, int count, CancellationToken cancellationToken = default)
+    {
+        var buffer = await ReadUpToAsync(stream, count, cancellationToken);
+        return buffer.Length == count ? buffer : null;
+    }
+
+    internal static async Task<byte[]> ReadUpToAsync(Stream stream, int count, CancellationToken cancellationToken = default)
+    {
+        var buffer = new byte[count];
+        var totalReadCount = 0;
+        while (totalReadCount < count)
+        {
+#if NETSTANDARD2_0
+            var readCount = await stream.ReadAsync(buffer, totalReadCount, count - totalReadCount, cancellationToken);
+#else
+            // The modern overload dispatches correctly for streams that only
+            // implement ReadAsync(Memory<byte>)
+            var readCount = await stream.ReadAsync(buffer.AsMemory(totalReadCount, count - totalReadCount), cancellationToken);
+#endif
+            if (readCount == 0)
+            {
+                break;
+            }
+
+            totalReadCount += readCount;
+        }
+
+        if (totalReadCount == count)
+        {
+            return buffer;
+        }
+
+        var result = new byte[totalReadCount];
+        Array.Copy(buffer, 0, result, 0, totalReadCount);
+        return result;
+    }
+
+    private static bool StartsWithMagic(byte[] prefix)
+    {
+        if (prefix.Length < Magic.Length)
+        {
+            return false;
+        }
+
+        for (var i = 0; i < Magic.Length; i++)
+        {
+            if (prefix[i] != Magic[i])
+            {
+                return false;
+            }
+        }
+
+        return true;
+    }
+
+    private static long? TryCalculateEncryptedLength(Stream plainStream, int chunkSize)
+    {
+        // Not gated on CanSeek: a forward-only stream can still report Length/Position.
+        // Both are required: without Position the remaining length is unknown (the stream
+        // may already be partially consumed), and guessing it would report a wrong
+        // ciphertext length and cause a short write on length-strict providers.
+        try
+        {
+            var plainLength = plainStream.Length - plainStream.Position;
+            if (plainLength < 0)
+            {
+                return null;
+            }
+
+            var fullChunkCount = plainLength / chunkSize;
+            var chunkRecordCount = fullChunkCount + (plainLength % chunkSize > 0 ? 1 : 0) + 1; // +1: terminal record
+
+            // The chunk index (including the terminal record) is a 32-bit value; fail
+            // before any output instead of after writing terabytes of ciphertext
+            if (chunkRecordCount - 1 > int.MaxValue)
+            {
+                throw new AbpException("The content is too large for the encrypted BLOB format (chunk index overflow)!");
+            }
+
+            checked
+            {
+                return Magic.Length + 1L + HeaderSize + plainLength +
+                       chunkRecordCount * (ChunkLengthPrefixSize + GcmTagSize);
+            }
+        }
+        catch (Exception ex) when (ex is NotSupportedException || ex is IOException)
+        {
+            // The length is optional; a probe failure must not fail the save
+            return null;
+        }
+        catch (OverflowException)
+        {
+            return null;
+        }
+    }
+
+#if !NETSTANDARD2_0
+    private static AesGcm CreateAesGcm(byte[] keyBytes)
+    {
+#if NET8_0_OR_GREATER
+        return new AesGcm(keyBytes, GcmTagSize);
+#else
+        return new AesGcm(keyBytes);
+#endif
+    }
+#endif
+
+    private static void WriteInt32BigEndian(byte[] buffer, int offset, int value)
+    {
+        buffer[offset] = (byte)(value >> 24);
+        buffer[offset + 1] = (byte)(value >> 16);
+        buffer[offset + 2] = (byte)(value >> 8);
+        buffer[offset + 3] = (byte)value;
+    }
+
+    private static int ReadInt32BigEndian(byte[] buffer, int offset)
+    {
+        return (buffer[offset] << 24) | (buffer[offset + 1] << 16) | (buffer[offset + 2] << 8) | buffer[offset + 3];
+    }
+}

framework/src/Volo.Abp.BlobStoring/Volo/Abp/BlobStoring/BlobEncryptionConfiguration.cs

@@ -0,0 +1,25 @@
+namespace Volo.Abp.BlobStoring;
+
+/// <summary>
+/// Reads the encryption values of a container configuration (set by the
+/// UseEncryption/DisableEncryption extension methods, inherited over the fallback chain).
+/// </summary>
+internal static class BlobEncryptionConfiguration
+{
+    public static bool IsEnabled(BlobContainerConfiguration configuration)
+    {
+        return configuration.GetConfigurationOrDefault(BlobEncryptionConfigurationNames.Enabled, false);
+    }
+
+    public static string? GetPassPhraseOrNull(BlobContainerConfiguration configuration)
+    {
+        // An explicit empty value shadows an inherited passphrase (see UseEncryption).
+        var passPhrase = configuration.GetConfigurationOrDefault<string?>(BlobEncryptionConfigurationNames.PassPhrase);
+        return string.IsNullOrWhiteSpace(passPhrase) ? null : passPhrase;
+    }
+
+    public static bool IsLegacyPlainTextAllowed(BlobContainerConfiguration configuration)
+    {
+        return configuration.GetConfigurationOrDefault(BlobEncryptionConfigurationNames.AllowLegacyPlainText, false);
+    }
+}

framework/src/Volo.Abp.BlobStoring/Volo/Abp/BlobStoring/BlobEncryptionConfigurationNames.cs

@@ -0,0 +1,8 @@
+namespace Volo.Abp.BlobStoring;
+
+public static class BlobEncryptionConfigurationNames
+{
+    public const string Enabled = "BlobEncryption.Enabled";
+    public const string PassPhrase = "BlobEncryption.PassPhrase";
+    public const string AllowLegacyPlainText = "BlobEncryption.AllowLegacyPlainText";
+}

framework/src/Volo.Abp.BlobStoring/Volo/Abp/BlobStoring/BlobEncryptionKey.cs

@@ -0,0 +1,39 @@
+using System;
+using JetBrains.Annotations;
+
+namespace Volo.Abp.BlobStoring;
+
+/// <summary>
+/// The passphrase resolved for encrypting a BLOB, together with its source.
+/// </summary>
+public class BlobEncryptionKey
+{
+    /// <summary>
+    /// The source the passphrase was resolved from; it is recorded in the encrypted
+    /// BLOB and routes the BLOB back to the same source while decrypting.
+    /// </summary>
+    public BlobEncryptionKeySource Source { get; }
+
+    /// <summary>
+    /// The passphrase the encryption key of the BLOB is derived from.
+    /// </summary>
+    [NotNull]
+    public string PassPhrase { get; }
+
+    /// <summary>
+    /// Creates the resolved key; <paramref name="source"/> must be a defined
+    /// <see cref="BlobEncryptionKeySource"/> value and the passphrase non-empty.
+    /// </summary>
+    public BlobEncryptionKey(BlobEncryptionKeySource source, [NotNull] string passPhrase)
+    {
+        if (source < BlobEncryptionKeySource.Container || source > BlobEncryptionKeySource.Global)
+        {
+            // The source is stored in the BLOB header and validated while reading;
+            // an unknown value would make the BLOB permanently unreadable.
+            throw new ArgumentException($"Unknown BLOB encryption key source: {source}!", nameof(source));
+        }
+
+        Source = source;
+        PassPhrase = Check.NotNullOrWhiteSpace(passPhrase, nameof(passPhrase));
+    }
+}

framework/src/Volo.Abp.BlobStoring/Volo/Abp/BlobStoring/BlobEncryptionKeyContext.cs

@@ -0,0 +1,51 @@
+using System;
+using JetBrains.Annotations;
+
+namespace Volo.Abp.BlobStoring;
+
+/// <summary>
+/// The identity of the BLOB an encryption key is resolved for. It lets a custom
+/// <see cref="IBlobEncryptionKeyProvider"/> select the key by the container, the
+/// BLOB name or the tenant — not only by the container configuration.
+/// </summary>
+public class BlobEncryptionKeyContext
+{
+    /// <summary>
+    /// The configuration of the container the BLOB belongs to (with the container
+    /// passphrase, if one was set with <c>UseEncryption</c>).
+    /// </summary>
+    [NotNull]
+    public BlobContainerConfiguration Configuration { get; }
+
+    /// <summary>
+    /// The normalized container name.
+    /// </summary>
+    [NotNull]
+    public string ContainerName { get; }
+
+    /// <summary>
+    /// The normalized BLOB name.
+    /// </summary>
+    [NotNull]
+    public string BlobName { get; }
+
+    /// <summary>
+    /// The tenant of the BLOB operation (null for the host or a shared container).
+    /// </summary>
+    public Guid? TenantId { get; }
+
+    /// <summary>
+    /// Creates the context; the names are expected in their normalized form.
+    /// </summary>
+    public BlobEncryptionKeyContext(
+        [NotNull] BlobContainerConfiguration configuration,
+        [NotNull] string containerName,
+        [NotNull] string blobName,
+        Guid? tenantId)
+    {
+        Configuration = Check.NotNull(configuration, nameof(configuration));
+        ContainerName = Check.NotNullOrWhiteSpace(containerName, nameof(containerName));
+        BlobName = Check.NotNullOrWhiteSpace(blobName, nameof(blobName));
+        TenantId = tenantId;
+    }
+}

framework/src/Volo.Abp.BlobStoring/Volo/Abp/BlobStoring/BlobEncryptionKeySource.cs

@@ -0,0 +1,27 @@
+namespace Volo.Abp.BlobStoring;
+
+/// <summary>
+/// Identifies where the encryption passphrase of a BLOB comes from. The value is
+/// stored in the BLOB header, so decryption uses the same source again even if
+/// other sources are configured later.
+/// </summary>
+public enum BlobEncryptionKeySource : byte
+{
+    /// <summary>
+    /// The container-specific passphrase, set with
+    /// <see cref="BlobContainerConfigurationEncryptionExtensions.UseEncryption"/>.
+    /// </summary>
+    Container = 1,
+
+    /// <summary>
+    /// A tenant-specific passphrase, provided by a custom
+    /// <see cref="IBlobEncryptionKeyProvider"/>; unused by the default provider.
+    /// </summary>
+    Tenant = 2,
+
+    /// <summary>
+    /// The global passphrase, from
+    /// <see cref="AbpBlobStoringEncryptionOptions.DefaultPassPhrase"/>.
+    /// </summary>
+    Global = 3
+}

framework/src/Volo.Abp.BlobStoring/Volo/Abp/BlobStoring/BlobPipelineContext.cs

@@ -0,0 +1,121 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Threading;
+using JetBrains.Annotations;
+using Volo.Abp.DependencyInjection;
+
+namespace Volo.Abp.BlobStoring;
+
+/// <summary>
+/// The context an <see cref="IBlobPipelineContributor"/> works on. A contributor
+/// transforms the content by replacing <see cref="BlobStream"/> with a wrapper;
+/// see <see cref="IBlobPipelineContributor"/> for the stream ownership contract.
+/// </summary>
+public class BlobPipelineContext : IServiceProviderAccessor
+{
+    /// <summary>
+    /// The scoped service provider of the pipeline. While saving, the scope stays
+    /// alive until the save operation completes; while getting, until the stream
+    /// returned to the caller is disposed — so lazily transforming wrappers can
+    /// keep using their scoped services.
+    /// </summary>
+    [NotNull]
+    public IServiceProvider ServiceProvider { get; }
+
+    /// <summary>
+    /// The normalized container name.
+    /// </summary>
+    [NotNull]
+    public string ContainerName { get; }
+
+    /// <summary>
+    /// The normalized BLOB name.
+    /// </summary>
+    [NotNull]
+    public string BlobName { get; }
+
+    /// <summary>
+    /// The configuration of the container the BLOB belongs to.
+    /// </summary>
+    [NotNull]
+    public BlobContainerConfiguration Configuration { get; }
+
+    /// <summary>
+    /// The tenant of the BLOB operation (null for the host or a shared container).
+    /// </summary>
+    public Guid? TenantId { get; }
+
+    /// <summary>
+    /// The cancellation token of the BLOB operation. Pass it to any I/O the contributor
+    /// performs while <see cref="IBlobPipelineContributor.OnSavingAsync"/> /
+    /// <see cref="IBlobPipelineContributor.OnGettingAsync"/> runs. A lazy read wrapper
+    /// returned from <c>OnGettingAsync</c> must instead honor the token passed to each of
+    /// its own <c>Read</c>/<c>ReadAsync</c> calls (this token is captured once at
+    /// <c>GetAsync</c> time and is not updated per read).
+    /// </summary>
+    public CancellationToken CancellationToken { get; }
+
+    /// <summary>
+    /// The content stream. Replace it with a (typically lazily transforming,
+    /// read-only) wrapper to transform the content.
+    /// </summary>
+    [NotNull]
+    public Stream BlobStream {
+        get => _blobStream;
+        set
+        {
+            _blobStream = Check.NotNull(value, nameof(value));
+            TrackCreatedStream(value);
+        }
+    }
+    private Stream _blobStream;
+
+    private readonly Stream _initialStream;
+
+    // While saving, every stream the pipeline creates is collected here (at
+    // assignment, so intermediate replacements within one contributor call are
+    // not lost) to be disposed after the save; the initial (caller-owned)
+    // stream is never collected. Null while getting.
+    internal List<Stream>? CreatedStreams { get; set; }
+
+    /// <summary>
+    /// Creates the context; the names are expected in their normalized form and
+    /// <paramref name="blobStream"/> is the initial (untransformed) content.
+    /// </summary>
+    public BlobPipelineContext(
+        [NotNull] IServiceProvider serviceProvider,
+        [NotNull] string containerName,
+        [NotNull] string blobName,
+        [NotNull] BlobContainerConfiguration configuration,
+        Guid? tenantId,
+        [NotNull] Stream blobStream,
+        CancellationToken cancellationToken = default)
+    {
+        ServiceProvider = Check.NotNull(serviceProvider, nameof(serviceProvider));
+        ContainerName = Check.NotNullOrWhiteSpace(containerName, nameof(containerName));
+        BlobName = Check.NotNullOrWhiteSpace(blobName, nameof(blobName));
+        Configuration = Check.NotNull(configuration, nameof(configuration));
+        TenantId = tenantId;
+        _initialStream = _blobStream = Check.NotNull(blobStream, nameof(blobStream));
+        CancellationToken = cancellationToken;
+    }
+
+    private void TrackCreatedStream(Stream stream)
+    {
+        if (CreatedStreams == null || ReferenceEquals(stream, _initialStream))
+        {
+            return;
+        }
+
+        foreach (var existingStream in CreatedStreams)
+        {
+            if (ReferenceEquals(existingStream, stream))
+            {
+                return;
+            }
+        }
+
+        CreatedStreams.Add(stream);
+    }
+}

framework/src/Volo.Abp.BlobStoring/Volo/Abp/BlobStoring/BlobPipelineScopeStream.cs

@@ -0,0 +1,488 @@
+using System;
+using System.IO;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.DependencyInjection;
+using Volo.Abp.MultiTenancy;
+using Volo.Abp.Threading;
+
+namespace Volo.Abp.BlobStoring;
+
+/// <summary>
+/// Keeps the service scope and the tenant context of the pipeline contributors
+/// until the returned (lazily transforming) stream is disposed: every member the
+/// wrappers may run work in — including the disposal of the scope itself — executes
+/// in the tenant the BLOB belongs to, not in the ambient tenant of the caller.
+/// </summary>
+internal sealed class BlobPipelineScopeStream : Stream
+{
+    private readonly Stream _inner;
+    private readonly AsyncServiceScope _scope;
+    private readonly ICurrentTenant _currentTenant;
+    private readonly Guid? _tenantId;
+    private readonly IBlobAuthenticatedEndStream? _authenticatedEndSource;
+    private bool _authenticatedEndChecked;
+    private bool _faulted;
+    private bool _disposed;
+
+    public BlobPipelineScopeStream(
+        Stream inner,
+        AsyncServiceScope scope,
+        ICurrentTenant currentTenant,
+        Guid? tenantId,
+        IBlobAuthenticatedEndStream? authenticatedEndSource = null)
+    {
+        _inner = inner;
+        _scope = scope;
+        _currentTenant = currentTenant;
+        _tenantId = tenantId;
+        // When encryption is enabled, this is the innermost decrypting stream. Its
+        // terminal record is verified when this composed stream reaches EOF, so a
+        // contributor that stops before the content ends can not hide a truncation.
+        _authenticatedEndSource = authenticatedEndSource;
+    }
+
+    public override bool CanRead
+    {
+        get
+        {
+            if (_disposed)
+            {
+                return false;
+            }
+
+            using (_currentTenant.Change(_tenantId))
+            {
+                return _inner.CanRead;
+            }
+        }
+    }
+
+    private void EnsureNotDisposed()
+    {
+        if (_disposed)
+        {
+            throw new ObjectDisposedException(GetType().FullName);
+        }
+    }
+
+    public override bool CanSeek
+    {
+        get
+        {
+            if (_disposed)
+            {
+                return false;
+            }
+
+            using (_currentTenant.Change(_tenantId))
+            {
+                return _inner.CanSeek;
+            }
+        }
+    }
+
+    public override bool CanWrite => false;
+
+    public override bool CanTimeout
+    {
+        get
+        {
+            if (_disposed)
+            {
+                return false;
+            }
+
+            using (_currentTenant.Change(_tenantId))
+            {
+                return _inner.CanTimeout;
+            }
+        }
+    }
+
+    public override int ReadTimeout
+    {
+        get
+        {
+            EnsureNotDisposed();
+            using (_currentTenant.Change(_tenantId))
+            {
+                return _inner.ReadTimeout;
+            }
+        }
+        set
+        {
+            EnsureNotDisposed();
+            using (_currentTenant.Change(_tenantId))
+            {
+                _inner.ReadTimeout = value;
+            }
+        }
+    }
+
+    public override long Length
+    {
+        get
+        {
+            EnsureNotDisposed();
+            using (_currentTenant.Change(_tenantId))
+            {
+                return _inner.Length;
+            }
+        }
+    }
+
+    public override long Position
+    {
+        get
+        {
+            EnsureNotDisposed();
+            using (_currentTenant.Change(_tenantId))
+            {
+                return _inner.Position;
+            }
+        }
+        set
+        {
+            EnsureNotDisposed();
+            using (_currentTenant.Change(_tenantId))
+            {
+                _inner.Position = value;
+            }
+        }
+    }
+
+    public override void Flush()
+    {
+        EnsureNotDisposed();
+        using (_currentTenant.Change(_tenantId))
+        {
+            _inner.Flush();
+        }
+    }
+
+    public override async Task FlushAsync(CancellationToken cancellationToken)
+    {
+        EnsureNotDisposed();
+        using (_currentTenant.Change(_tenantId))
+        {
+            await _inner.FlushAsync(cancellationToken);
+        }
+    }
+
+    public override int Read(byte[] buffer, int offset, int count)
+    {
+        EnsureNotDisposed();
+        EnsureNotFaulted();
+        using (_currentTenant.Change(_tenantId))
+        {
+            int read;
+            try
+            {
+                read = _inner.Read(buffer, offset, count);
+            }
+            catch
+            {
+                // A failed read faults permanently, so a retry layer can not silently continue
+                // from a position where an inner contributor already consumed bytes
+                _faulted = true;
+                throw;
+            }
+
+            VerifyAuthenticatedEndIfNeeded(read, count);
+            return read;
+        }
+    }
+
+    public override async Task<int> ReadAsync(byte[] buffer, int offset, int count, CancellationToken cancellationToken)
+    {
+        EnsureNotDisposed();
+        EnsureNotFaulted();
+        // A token cancelled before any I/O leaves the stream untouched (and healthy for a
+        // retry); once a read has started, any failure faults it permanently
+        cancellationToken.ThrowIfCancellationRequested();
+        using (_currentTenant.Change(_tenantId))
+        {
+            int read;
+            try
+            {
+#if NETSTANDARD2_0
+                read = await _inner.ReadAsync(buffer, offset, count, cancellationToken);
+#else
+                // Dispatch over the modern overload, so a wrapper that only implements
+                // ReadAsync(Memory<byte>) also works for callers of the old overload
+                read = await _inner.ReadAsync(buffer.AsMemory(offset, count), cancellationToken);
+#endif
+            }
+            catch
+            {
+                _faulted = true;
+                throw;
+            }
+
+            await VerifyAuthenticatedEndIfNeededAsync(read, count, cancellationToken);
+            return read;
+        }
+    }
+
+    // Runs when the composed stream reaches EOF on a real (non-zero-count) read. A
+    // legitimate partial read (stopping early and disposing) never reaches EOF, so it
+    // is not affected. A failed check faults the stream permanently, so a read-retry
+    // layer can not swallow the integrity error and later see a normal EOF.
+    private void VerifyAuthenticatedEndIfNeeded(int read, int count)
+    {
+        if (read != 0 || count == 0 || _authenticatedEndChecked || _authenticatedEndSource == null)
+        {
+            return;
+        }
+
+        try
+        {
+            _authenticatedEndSource.EnsureReadToAuthenticatedEnd();
+            _authenticatedEndChecked = true;
+        }
+        catch
+        {
+            // The check ran and failed on integrity: mark it done and fault permanently
+            _authenticatedEndChecked = true;
+            _faulted = true;
+            throw;
+        }
+    }
+
+    private async ValueTask VerifyAuthenticatedEndIfNeededAsync(int read, int count, CancellationToken cancellationToken)
+    {
+        if (read != 0 || count == 0 || _authenticatedEndChecked || _authenticatedEndSource == null)
+        {
+            return;
+        }
+
+        // A token cancelled before the check runs leaves it un-run and the stream healthy, so
+        // a retry with a live token can still verify the end
+        cancellationToken.ThrowIfCancellationRequested();
+        try
+        {
+            await _authenticatedEndSource.EnsureReadToAuthenticatedEndAsync(cancellationToken);
+            _authenticatedEndChecked = true;
+        }
+        catch (OperationCanceledException)
+        {
+            // The decrypting stream owns the consumption state and faults itself on a mid-read
+            // cancellation; a cancellation it lets through without faulting (for example the
+            // token trips in the gap after the check above) leaves it healthy, so the outer
+            // must not fault either — a retry with a live token can still verify the end
+            throw;
+        }
+        catch
+        {
+            // A real integrity failure is permanent, so a read-retry layer can not swallow it
+            // and later see a normal EOF
+            _authenticatedEndChecked = true;
+            _faulted = true;
+            throw;
+        }
+    }
+
+    private void EnsureNotFaulted()
+    {
+        if (_faulted)
+        {
+            throw new AbpException("The stream can not be read anymore, because a previous read operation has failed!");
+        }
+    }
+
+#if !NETSTANDARD2_0
+    // Forwarded so a wrapper that only implements the modern overloads is not
+    // degraded to the byte[] fallback of the base class
+    public override int Read(Span<byte> buffer)
+    {
+        EnsureNotDisposed();
+        EnsureNotFaulted();
+        using (_currentTenant.Change(_tenantId))
+        {
+            int read;
+            try
+            {
+                read = _inner.Read(buffer);
+            }
+            catch
+            {
+                _faulted = true;
+                throw;
+            }
+
+            VerifyAuthenticatedEndIfNeeded(read, buffer.Length);
+            return read;
+        }
+    }
+
+    public override async ValueTask<int> ReadAsync(Memory<byte> buffer, CancellationToken cancellationToken = default)
+    {
+        EnsureNotDisposed();
+        EnsureNotFaulted();
+        cancellationToken.ThrowIfCancellationRequested();
+        using (_currentTenant.Change(_tenantId))
+        {
+            int read;
+            try
+            {
+                read = await _inner.ReadAsync(buffer, cancellationToken);
+            }
+            catch
+            {
+                _faulted = true;
+                throw;
+            }
+
+            await VerifyAuthenticatedEndIfNeededAsync(read, buffer.Length, cancellationToken);
+            return read;
+        }
+    }
+#endif
+
+    public override long Seek(long offset, SeekOrigin origin)
+    {
+        EnsureNotDisposed();
+        using (_currentTenant.Change(_tenantId))
+        {
+            return _inner.Seek(offset, origin);
+        }
+    }
+
+    public override void SetLength(long value)
+    {
+        throw new NotSupportedException();
+    }
+
+    public override void Write(byte[] buffer, int offset, int count)
+    {
+        throw new NotSupportedException();
+    }
+
+    protected override void Dispose(bool disposing)
+    {
+        if (disposing && !_disposed)
+        {
+            _disposed = true;
+
+            // The tenant context is best-effort: failing to enter it must not skip the
+            // resource release (which would leak the provider stream, the scope and the
+            // derived key), and a later dispose can not recover it since _disposed is set
+            IDisposable? tenantChange = null;
+            try
+            {
+                tenantChange = _currentTenant.Change(_tenantId);
+            }
+            catch
+            {
+                // ignored: release the resources below without the tenant context
+            }
+
+            try
+            {
+                DisposeInnerAndScope();
+            }
+            finally
+            {
+                tenantChange?.Dispose();
+            }
+        }
+
+        base.Dispose(disposing);
+    }
+
+    private void DisposeInnerAndScope()
+    {
+        try
+        {
+#if NETSTANDARD2_0
+            // Stream has no DisposeAsync on netstandard2.0, but the inner stream
+            // may still implement IAsyncDisposable for its async-only cleanup
+            if (_inner is IAsyncDisposable innerAsyncDisposable)
+            {
+                AsyncHelper.RunSync(() => innerAsyncDisposable.DisposeAsync().AsTask());
+            }
+            else
+            {
+                _inner.Dispose();
+            }
+#else
+            // Also covers wrappers that only implement DisposeAsync
+            AsyncHelper.RunSync(() => _inner.DisposeAsync().AsTask());
+#endif
+        }
+        catch
+        {
+            // The stream failure is the root cause; a scope dispose
+            // failure on top of it must not replace it
+            try
+            {
+                AsyncHelper.RunSync(() => _scope.DisposeAsync().AsTask());
+            }
+            catch
+            {
+                // ignored
+            }
+
+            throw;
+        }
+
+        // A synchronous scope dispose throws when a scoped service only
+        // implements IAsyncDisposable, so always release it asynchronously
+        AsyncHelper.RunSync(() => _scope.DisposeAsync().AsTask());
+    }
+
+#if !NETSTANDARD2_0
+    public override async ValueTask DisposeAsync()
+    {
+        if (!_disposed)
+        {
+            _disposed = true;
+
+            IDisposable? tenantChange = null;
+            try
+            {
+                tenantChange = _currentTenant.Change(_tenantId);
+            }
+            catch
+            {
+                // ignored: release the resources below without the tenant context
+            }
+
+            try
+            {
+                await DisposeInnerAndScopeAsync();
+            }
+            finally
+            {
+                tenantChange?.Dispose();
+            }
+        }
+
+        await base.DisposeAsync();
+    }
+
+    private async ValueTask DisposeInnerAndScopeAsync()
+    {
+        try
+        {
+            await _inner.DisposeAsync();
+        }
+        catch
+        {
+            try
+            {
+                await _scope.DisposeAsync();
+            }
+            catch
+            {
+                // ignored: the stream failure is the root cause
+            }
+
+            throw;
+        }
+
+        await _scope.DisposeAsync();
+    }
+#endif
+}

framework/src/Volo.Abp.BlobStoring/Volo/Abp/BlobStoring/ChunkedCryptoReadStream.cs

@@ -0,0 +1,181 @@
+using System;
+using System.Threading;
+using System.Threading.Tasks;
+
+namespace Volo.Abp.BlobStoring;
+
+/// <summary>
+/// A read-only, non-seekable stream that serves output produced chunk by chunk.
+/// </summary>
+internal abstract class ChunkedCryptoReadStream : SequentialReadStream
+{
+    private readonly long? _length;
+    private byte[]? _outputBuffer;
+    private int _outputBufferPosition;
+    private long _position;
+    private bool _finished;
+
+    protected ChunkedCryptoReadStream(long? length = null)
+    {
+        _length = length;
+    }
+
+    public override long Length => _length ?? throw new NotSupportedException();
+
+    // Some storage SDKs (like AWS S3) compute the upload size as Length - Position,
+    // so the getter reports the number of bytes served so far instead of throwing.
+    public override long Position
+    {
+        get => _position;
+        set => throw new NotSupportedException();
+    }
+
+    protected sealed override int ReadCore(byte[] buffer, int offset, int count)
+    {
+        while (true)
+        {
+            var copiedCount = TryCopyFromOutputBuffer(buffer, offset, count);
+            if (copiedCount > 0 || _finished)
+            {
+                return copiedCount;
+            }
+
+            SetOutputBuffer(ProduceNext());
+        }
+    }
+
+    protected sealed override async Task<int> ReadCoreAsync(byte[] buffer, int offset, int count, CancellationToken cancellationToken)
+    {
+        while (true)
+        {
+            var copiedCount = TryCopyFromOutputBuffer(buffer, offset, count);
+            if (copiedCount > 0 || _finished)
+            {
+                return copiedCount;
+            }
+
+            SetOutputBuffer(await ProduceNextAsync(cancellationToken));
+        }
+    }
+
+    /// <summary>
+    /// Produces the next output bytes, or null when there is no more output.
+    /// </summary>
+    protected abstract byte[]? ProduceNext();
+
+    protected abstract Task<byte[]?> ProduceNextAsync(CancellationToken cancellationToken);
+
+    internal void EnsureReadToAuthenticatedEndCore()
+    {
+        // A previous read that faulted the stream (for example an authentication failure
+        // a contributor swallowed) must not be recovered by re-entering ProduceNext here
+        EnsureCanServe();
+        try
+        {
+            if (IsAtAuthenticatedEnd())
+            {
+                return;
+            }
+
+            // Producing the next record either verifies the terminal record (null) or
+            // returns another content chunk, which means the consumer stopped early
+            ThrowIfMoreContent(ProduceNext());
+        }
+        catch
+        {
+            // Fault the stream so the failure can not be swallowed by reading again
+            MarkFaulted();
+            throw;
+        }
+    }
+
+    internal async ValueTask EnsureReadToAuthenticatedEndCoreAsync(CancellationToken cancellationToken)
+    {
+        EnsureCanServe();
+        // A token cancelled before any I/O leaves the stream untouched, so it can stay
+        // healthy for a retry (the same rule the normal read path applies). Once a read has
+        // started, any failure must fault: a mid-read cancellation already consumed and
+        // discarded bytes of the non-seekable cipher stream, so a retry that resumed from the
+        // middle of the terminal record would misreport a valid BLOB as corrupt
+        cancellationToken.ThrowIfCancellationRequested();
+        try
+        {
+            if (IsAtAuthenticatedEnd())
+            {
+                return;
+            }
+
+            ThrowIfMoreContent(await ProduceNextAsync(cancellationToken));
+        }
+        catch
+        {
+            MarkFaulted();
+            throw;
+        }
+    }
+
+    private bool IsAtAuthenticatedEnd()
+    {
+        if (_finished)
+        {
+            return true;
+        }
+
+        if (_outputBuffer != null && _outputBufferPosition < _outputBuffer.Length)
+        {
+            throw new AbpException(
+                "The encrypted BLOB was not read to its authenticated end, so its completeness can not be verified " +
+                "(a content-pipeline contributor stopped reading the content before the end).");
+        }
+
+        return false;
+    }
+
+    private void ThrowIfMoreContent(byte[]? next)
+    {
+        if (next != null)
+        {
+            throw new AbpException(
+                "The encrypted BLOB was not read to its authenticated end, so its completeness can not be verified " +
+                "(a content-pipeline contributor stopped reading the content before the end).");
+        }
+
+        SetOutputBuffer(null);
+    }
+
+    protected override void Dispose(bool disposing)
+    {
+        if (disposing && _outputBuffer != null)
+        {
+            Array.Clear(_outputBuffer, 0, _outputBuffer.Length);
+            _outputBuffer = null;
+        }
+
+        base.Dispose(disposing);
+    }
+
+    private int TryCopyFromOutputBuffer(byte[] buffer, int offset, int count)
+    {
+        if (_outputBuffer == null || _outputBufferPosition >= _outputBuffer.Length)
+        {
+            return 0;
+        }
+
+        var toCopy = Math.Min(count, _outputBuffer.Length - _outputBufferPosition);
+        Array.Copy(_outputBuffer, _outputBufferPosition, buffer, offset, toCopy);
+        _outputBufferPosition += toCopy;
+        _position += toCopy;
+        return toCopy;
+    }
+
+    private void SetOutputBuffer(byte[]? outputBuffer)
+    {
+        _outputBuffer = outputBuffer;
+        _outputBufferPosition = 0;
+
+        if (outputBuffer == null)
+        {
+            _finished = true;
+        }
+    }
+}

framework/src/Volo.Abp.BlobStoring/Volo/Abp/BlobStoring/ChunkedDecryptingReadStream.cs

@@ -0,0 +1,180 @@
+using System;
+using System.IO;
+using System.Security.Cryptography;
+using System.Threading;
+using System.Threading.Tasks;
+using Volo.Abp.Threading;
+
+namespace Volo.Abp.BlobStoring;
+
+/// <summary>
+/// Decrypts the cipher stream chunk by chunk while being read. It is the only stream
+/// with an authenticated terminal record, so it is the one implementing
+/// <see cref="IBlobAuthenticatedEndStream"/>.
+/// </summary>
+internal class ChunkedDecryptingReadStream : ChunkedCryptoReadStream, IBlobAuthenticatedEndStream
+{
+    private readonly Stream _cipherStream;
+    private readonly byte[] _associatedData;
+    private readonly byte[] _keyBytes;
+    private readonly IDisposable _chunkCipher;
+    private readonly byte[] _nonce;
+    private readonly int _chunkSize;
+    private int _chunkIndex;
+    private bool _disposed;
+
+    public ChunkedDecryptingReadStream(
+        Stream cipherStream,
+        byte[] associatedDataPrefix,
+        byte[] keyBytes,
+        byte[] baseNonce,
+        int chunkSize)
+    {
+        _cipherStream = cipherStream;
+        // One reusable cipher and buffer each; only the trailing chunk index changes per chunk
+        _associatedData = BlobEncryptionCodec.CreateReusableAssociatedData(associatedDataPrefix);
+        _keyBytes = keyBytes;
+        _chunkCipher = BlobEncryptionCodec.CreateChunkCipher(keyBytes);
+        _nonce = BlobEncryptionCodec.CreateReusableChunkNonce(baseNonce);
+        _chunkSize = chunkSize;
+    }
+
+    public void EnsureReadToAuthenticatedEnd()
+    {
+        EnsureReadToAuthenticatedEndCore();
+    }
+
+    public ValueTask EnsureReadToAuthenticatedEndAsync(CancellationToken cancellationToken = default)
+    {
+        return EnsureReadToAuthenticatedEndCoreAsync(cancellationToken);
+    }
+
+    protected override byte[]? ProduceNext()
+    {
+        var cipherChunkSize = BlobEncryptionCodec.GetCipherChunkSize(
+            BlobEncryptionCodec.ReadUpTo(_cipherStream, BlobEncryptionCodec.ChunkLengthPrefixSize),
+            _chunkSize
+        );
+        if (cipherChunkSize == 0)
+        {
+            var terminalTag = BlobEncryptionCodec.ReadExactly(_cipherStream, BlobEncryptionCodec.GcmTagSize);
+            if (terminalTag == null || BlobEncryptionCodec.ReadUpTo(_cipherStream, 1).Length != 0)
+            {
+                throw new AbpException("The encrypted BLOB is corrupted or has an invalid format: invalid terminal record!");
+            }
+
+            SetChunkIndex(_chunkIndex);
+            BlobEncryptionCodec.VerifyTerminalRecordCore(_chunkCipher, _associatedData, _nonce, terminalTag);
+            return null;
+        }
+
+        return DecryptPayload(
+            BlobEncryptionCodec.ReadExactly(_cipherStream, cipherChunkSize),
+            BlobEncryptionCodec.ReadExactly(_cipherStream, BlobEncryptionCodec.GcmTagSize)
+        );
+    }
+
+    protected override async Task<byte[]?> ProduceNextAsync(CancellationToken cancellationToken)
+    {
+        var cipherChunkSize = BlobEncryptionCodec.GetCipherChunkSize(
+            await BlobEncryptionCodec.ReadUpToAsync(_cipherStream, BlobEncryptionCodec.ChunkLengthPrefixSize, cancellationToken),
+            _chunkSize
+        );
+        if (cipherChunkSize == 0)
+        {
+            var terminalTag = await BlobEncryptionCodec.ReadExactlyAsync(_cipherStream, BlobEncryptionCodec.GcmTagSize, cancellationToken);
+            if (terminalTag == null || (await BlobEncryptionCodec.ReadUpToAsync(_cipherStream, 1, cancellationToken)).Length != 0)
+            {
+                throw new AbpException("The encrypted BLOB is corrupted or has an invalid format: invalid terminal record!");
+            }
+
+            SetChunkIndex(_chunkIndex);
+            BlobEncryptionCodec.VerifyTerminalRecordCore(_chunkCipher, _associatedData, _nonce, terminalTag);
+            return null;
+        }
+
+        return DecryptPayload(
+            await BlobEncryptionCodec.ReadExactlyAsync(_cipherStream, cipherChunkSize, cancellationToken),
+            await BlobEncryptionCodec.ReadExactlyAsync(_cipherStream, BlobEncryptionCodec.GcmTagSize, cancellationToken)
+        );
+    }
+
+    private byte[] DecryptPayload(byte[]? cipherChunk, byte[]? tag)
+    {
+        if (cipherChunk == null || tag == null)
+        {
+            throw new AbpException("The encrypted BLOB is corrupted or has an invalid format: truncated chunk!");
+        }
+
+        SetChunkIndex(_chunkIndex);
+        var plainChunk = BlobEncryptionCodec.DecryptChunkCore(_chunkCipher, _associatedData, _nonce, cipherChunk, tag);
+        _chunkIndex++;
+        return plainChunk;
+    }
+
+    private void SetChunkIndex(int chunkIndex)
+    {
+        BlobEncryptionCodec.WriteChunkIndex(_nonce, chunkIndex);
+        BlobEncryptionCodec.WriteChunkIndex(_associatedData, chunkIndex);
+    }
+
+    protected override void Dispose(bool disposing)
+    {
+        if (disposing && !_disposed)
+        {
+            _disposed = true;
+            _chunkCipher.Dispose();
+            ClearKeyBytes();
+            try
+            {
+#if NETSTANDARD2_0
+                _cipherStream.Dispose();
+#else
+                // Also covers a provider stream that only implements DisposeAsync
+                AsyncHelper.RunSync(() => _cipherStream.DisposeAsync().AsTask());
+#endif
+            }
+            finally
+            {
+                base.Dispose(disposing);
+            }
+
+            return;
+        }
+
+        base.Dispose(disposing);
+    }
+
+#if !NETSTANDARD2_0
+    public override async ValueTask DisposeAsync()
+    {
+        if (!_disposed)
+        {
+            _disposed = true;
+            _chunkCipher.Dispose();
+            ClearKeyBytes();
+            try
+            {
+                await _cipherStream.DisposeAsync();
+            }
+            finally
+            {
+                await base.DisposeAsync();
+            }
+
+            return;
+        }
+
+        await base.DisposeAsync();
+    }
+#endif
+
+    private void ClearKeyBytes()
+    {
+#if NETSTANDARD2_0
+        Array.Clear(_keyBytes, 0, _keyBytes.Length);
+#else
+        CryptographicOperations.ZeroMemory(_keyBytes);
+#endif
+    }
+}

framework/src/Volo.Abp.BlobStoring/Volo/Abp/BlobStoring/ChunkedEncryptingReadStream.cs

@@ -0,0 +1,124 @@
+using System;
+using System.IO;
+using System.Security.Cryptography;
+using System.Threading;
+using System.Threading.Tasks;
+
+namespace Volo.Abp.BlobStoring;
+
+/// <summary>
+/// Encrypts the source stream chunk by chunk while being read.
+/// </summary>
+internal class ChunkedEncryptingReadStream : ChunkedCryptoReadStream
+{
+    private readonly Stream _plainStream;
+    private readonly byte[] _prefix;
+    private readonly byte[] _associatedData;
+    private readonly byte[] _keyBytes;
+    private readonly IDisposable _chunkCipher;
+    private readonly byte[] _nonce;
+    private readonly int _chunkSize;
+    private bool _prefixEmitted;
+    private bool _terminalEmitted;
+    private int _chunkIndex;
+
+    public ChunkedEncryptingReadStream(
+        Stream plainStream,
+        byte[] prefix,
+        byte[] associatedDataPrefix,
+        byte[] keyBytes,
+        byte[] baseNonce,
+        int chunkSize,
+        long? encryptedLength)
+        : base(encryptedLength)
+    {
+        _plainStream = plainStream;
+        _prefix = prefix;
+        // One reusable cipher and buffer each; only the trailing chunk index changes per chunk
+        _associatedData = BlobEncryptionCodec.CreateReusableAssociatedData(associatedDataPrefix);
+        _keyBytes = keyBytes;
+        _chunkCipher = BlobEncryptionCodec.CreateChunkCipher(keyBytes);
+        _nonce = BlobEncryptionCodec.CreateReusableChunkNonce(baseNonce);
+        _chunkSize = chunkSize;
+    }
+
+    protected override byte[]? ProduceNext()
+    {
+        var prefix = TryProducePrefix();
+        if (prefix != null)
+        {
+            return prefix;
+        }
+
+        return ProducePayload(BlobEncryptionCodec.ReadUpTo(_plainStream, _chunkSize));
+    }
+
+    protected override async Task<byte[]?> ProduceNextAsync(CancellationToken cancellationToken)
+    {
+        var prefix = TryProducePrefix();
+        if (prefix != null)
+        {
+            return prefix;
+        }
+
+        return ProducePayload(await BlobEncryptionCodec.ReadUpToAsync(_plainStream, _chunkSize, cancellationToken));
+    }
+
+    private byte[]? TryProducePrefix()
+    {
+        if (_prefixEmitted)
+        {
+            return null;
+        }
+
+        _prefixEmitted = true;
+        return _prefix;
+    }
+
+    private byte[]? ProducePayload(byte[] plainChunk)
+    {
+        if (plainChunk.Length == 0)
+        {
+            if (_terminalEmitted)
+            {
+                return null;
+            }
+
+            _terminalEmitted = true;
+            SetChunkIndex(_chunkIndex);
+            return BlobEncryptionCodec.CreateTerminalRecordCore(_chunkCipher, _associatedData, _nonce);
+        }
+
+        SetChunkIndex(_chunkIndex);
+        var chunkBytes = BlobEncryptionCodec.EncryptChunkCore(_chunkCipher, _associatedData, _nonce, plainChunk, plainChunk.Length);
+        _chunkIndex++;
+        return chunkBytes;
+    }
+
+    private void SetChunkIndex(int chunkIndex)
+    {
+        BlobEncryptionCodec.WriteChunkIndex(_nonce, chunkIndex);
+        BlobEncryptionCodec.WriteChunkIndex(_associatedData, chunkIndex);
+    }
+
+    protected override void Dispose(bool disposing)
+    {
+        // Do not dispose the plain stream; it is owned by the caller.
+        if (disposing)
+        {
+            _chunkCipher.Dispose();
+            ClearKeyBytes();
+        }
+
+        base.Dispose(disposing);
+    }
+
+    private void ClearKeyBytes()
+    {
+#if NETSTANDARD2_0
+        Array.Clear(_keyBytes, 0, _keyBytes.Length);
+#else
+        CryptographicOperations.ZeroMemory(_keyBytes);
+#endif
+    }
+}

framework/src/Volo.Abp.BlobStoring/Volo/Abp/BlobStoring/DefaultBlobEncryptionKeyProvider.cs

@@ -0,0 +1,97 @@
+using System.Threading;
+using System.Threading.Tasks;
+using JetBrains.Annotations;
+using Microsoft.Extensions.Options;
+using Volo.Abp.DependencyInjection;
+
+namespace Volo.Abp.BlobStoring;
+
+/// <summary>
+/// Resolves the container passphrase first, then the global
+/// <see cref="AbpBlobStoringEncryptionOptions.DefaultPassPhrase"/>; decryption uses
+/// only the source recorded in the BLOB header. Replace this service for
+/// tenant-specific or externally stored passphrases.
+/// </summary>
+public class DefaultBlobEncryptionKeyProvider : IBlobEncryptionKeyProvider, ITransientDependency
+{
+    protected AbpBlobStoringEncryptionOptions Options { get; }
+
+    public DefaultBlobEncryptionKeyProvider(IOptions<AbpBlobStoringEncryptionOptions> options)
+    {
+        Options = options.Value;
+    }
+
+    /// <inheritdoc />
+    public virtual Task<BlobEncryptionKey> ResolveForEncryptionAsync(
+        [NotNull] BlobEncryptionKeyContext context,
+        CancellationToken cancellationToken = default)
+    {
+        Check.NotNull(context, nameof(context));
+        cancellationToken.ThrowIfCancellationRequested();
+
+        var containerPassPhrase = GetContainerPassPhraseOrNull(context.Configuration);
+        if (!string.IsNullOrWhiteSpace(containerPassPhrase))
+        {
+            return Task.FromResult(new BlobEncryptionKey(BlobEncryptionKeySource.Container, containerPassPhrase!));
+        }
+
+        if (!string.IsNullOrWhiteSpace(Options.DefaultPassPhrase))
+        {
+            return Task.FromResult(new BlobEncryptionKey(BlobEncryptionKeySource.Global, Options.DefaultPassPhrase!));
+        }
+
+        throw new AbpException(
+            "BLOB encryption is enabled, but no passphrase could be resolved. " +
+            "Pass a passphrase to the UseEncryption extension method or configure " +
+            $"{nameof(AbpBlobStoringEncryptionOptions)}.{nameof(AbpBlobStoringEncryptionOptions.DefaultPassPhrase)}."
+        );
+    }
+
+    /// <inheritdoc />
+    public virtual Task<string> ResolveForDecryptionAsync(
+        BlobEncryptionKeySource keySource,
+        [NotNull] BlobEncryptionKeyContext context,
+        CancellationToken cancellationToken = default)
+    {
+        Check.NotNull(context, nameof(context));
+        cancellationToken.ThrowIfCancellationRequested();
+
+        string? passPhrase;
+        switch (keySource)
+        {
+            case BlobEncryptionKeySource.Container:
+                passPhrase = GetContainerPassPhraseOrNull(context.Configuration);
+                break;
+            case BlobEncryptionKeySource.Tenant:
+                throw new AbpException(
+                    "The BLOB was encrypted with a tenant-specific passphrase, but the default " +
+                    $"key provider does not supply tenant keys. Replace the {nameof(IBlobEncryptionKeyProvider)} " +
+                    "service with the implementation that was used to encrypt the BLOB."
+                );
+            case BlobEncryptionKeySource.Global:
+                passPhrase = Options.DefaultPassPhrase;
+                break;
+            default:
+                throw new AbpException($"Unknown BLOB encryption key source: {keySource}!");
+        }
+
+        if (string.IsNullOrWhiteSpace(passPhrase))
+        {
+            throw new AbpException(
+                $"The BLOB was encrypted with the '{keySource}' passphrase, " +
+                "but that passphrase is not available anymore, so the BLOB can not be decrypted."
+            );
+        }
+
+        return Task.FromResult(passPhrase!);
+    }
+
+    /// <summary>
+    /// Returns the container-specific passphrase, so derived providers can keep it
+    /// as the highest-priority source.
+    /// </summary>
+    protected virtual string? GetContainerPassPhraseOrNull(BlobContainerConfiguration configuration)
+    {
+        return BlobEncryptionConfiguration.GetPassPhraseOrNull(configuration);
+    }
+}

framework/src/Volo.Abp.BlobStoring/Volo/Abp/BlobStoring/IBlobAuthenticatedEndStream.cs

@@ -0,0 +1,26 @@
+using System.Threading;
+using System.Threading.Tasks;
+
+namespace Volo.Abp.BlobStoring;
+
+/// <summary>
+/// Implemented by a read stream (like the decrypting stream) that can verify it was
+/// read to an authenticated end. The content pipeline calls it when the composed
+/// stream returned by <c>GetAsync</c> reaches EOF, so a contributor stopping before
+/// the end can not hide a truncation. A stream that wraps such a stream (for example
+/// a custom <c>CreateDecryptingStreamAsync</c> override) should implement this
+/// interface too and forward the calls to the wrapped stream, or the end verification
+/// is skipped for pipeline reads.
+/// </summary>
+public interface IBlobAuthenticatedEndStream
+{
+    /// <summary>
+    /// Throws if the stream has not been consumed up to its authenticated end.
+    /// </summary>
+    void EnsureReadToAuthenticatedEnd();
+
+    /// <summary>
+    /// Throws if the stream has not been consumed up to its authenticated end.
+    /// </summary>
+    ValueTask EnsureReadToAuthenticatedEndAsync(CancellationToken cancellationToken = default);
+}

framework/src/Volo.Abp.BlobStoring/Volo/Abp/BlobStoring/IBlobEncryptionCodec.cs

@@ -0,0 +1,41 @@
+using System;
+using System.IO;
+using System.Threading;
+using System.Threading.Tasks;
+using JetBrains.Annotations;
+
+namespace Volo.Abp.BlobStoring;
+
+/// <summary>
+/// Encrypts and decrypts the BLOB content stream (authenticated, chunked AES-256-GCM).
+/// Replace this service to change the encryption format or algorithm; the built-in
+/// <see cref="BlobEncryptionCodec"/> implements version 1 of the format.
+/// </summary>
+public interface IBlobEncryptionCodec
+{
+    /// <summary>
+    /// Wraps <paramref name="plainStream"/> in a read-only stream that encrypts the
+    /// content while it is read. The container and BLOB names are expected in their
+    /// normalized form.
+    /// </summary>
+    Task<Stream> CreateEncryptingStreamAsync(
+        [NotNull] BlobContainerConfiguration configuration,
+        [NotNull] string containerName,
+        [NotNull] string blobName,
+        Guid? tenantId,
+        [NotNull] Stream plainStream,
+        CancellationToken cancellationToken = default);
+
+    /// <summary>
+    /// Wraps <paramref name="cipherStream"/> in a read-only stream that decrypts the
+    /// content while it is read. The container and BLOB names are expected in their
+    /// normalized form.
+    /// </summary>
+    Task<Stream> CreateDecryptingStreamAsync(
+        [NotNull] BlobContainerConfiguration configuration,
+        [NotNull] string containerName,
+        [NotNull] string blobName,
+        Guid? tenantId,
+        [NotNull] Stream cipherStream,
+        CancellationToken cancellationToken = default);
+}

framework/src/Volo.Abp.BlobStoring/Volo/Abp/BlobStoring/IBlobEncryptionKeyProvider.cs

@@ -0,0 +1,32 @@
+using System.Threading;
+using System.Threading.Tasks;
+using JetBrains.Annotations;
+
+namespace Volo.Abp.BlobStoring;
+
+/// <summary>
+/// Resolves the passphrase used to encrypt/decrypt the BLOBs of a container.
+/// Replace this service to read the passphrases from another source, like a vault
+/// or another secret store (the provider must be able to return the passphrase
+/// itself; hardware-backed non-exportable keys are not supported). The
+/// <see cref="BlobEncryptionKeyContext"/> carries the container/BLOB name and the
+/// tenant, so the passphrase can be selected by the BLOB identity too.
+/// </summary>
+public interface IBlobEncryptionKeyProvider
+{
+    /// <summary>
+    /// Resolves the passphrase (and its source) to encrypt a new BLOB; throws if none is available.
+    /// </summary>
+    Task<BlobEncryptionKey> ResolveForEncryptionAsync(
+        [NotNull] BlobEncryptionKeyContext context,
+        CancellationToken cancellationToken = default);
+
+    /// <summary>
+    /// Resolves the passphrase for the key source recorded in the BLOB header;
+    /// throws if it is not available anymore.
+    /// </summary>
+    Task<string> ResolveForDecryptionAsync(
+        BlobEncryptionKeySource keySource,
+        [NotNull] BlobEncryptionKeyContext context,
+        CancellationToken cancellationToken = default);
+}

framework/src/Volo.Abp.BlobStoring/Volo/Abp/BlobStoring/IBlobPipelineContributor.cs

@@ -0,0 +1,41 @@
+using System.Threading.Tasks;
+using JetBrains.Annotations;
+
+namespace Volo.Abp.BlobStoring;
+
+/// <summary>
+/// Transforms the BLOB content stream (compression, watermarking, validation...)
+/// while it is saved and read. Contributors are configured per container with
+/// <see cref="BlobContainerConfiguration.PipelineContributors"/> and run in the
+/// configuration order while saving and in the reverse order while reading.
+/// The built-in encryption always runs after the contributors while saving (and
+/// before them while reading), so contributors always work on the plain content.
+/// </summary>
+public interface IBlobPipelineContributor
+{
+    /// <summary>
+    /// Transform the content by replacing <see cref="BlobPipelineContext.BlobStream"/>:
+    /// with a lazily transforming read-only wrapper (best for large content), or with an
+    /// eagerly materialized stream. A replacement must leave the stream it received open:
+    /// every stream <b>assigned</b> to <see cref="BlobPipelineContext.BlobStream"/> is disposed
+    /// after the save, while the original stream stays owned by the caller. A stream is only
+    /// tracked from the moment it is assigned, so if you create a stream and then do work
+    /// that may fail before assigning it, dispose it yourself on the failure path.
+    /// <para>
+    /// Not replacing the stream is only valid for a contributor that does not consume the
+    /// content (for example a metadata check). A contributor that reads the content to
+    /// validate it must return a pass-through wrapper that validates the bytes as they
+    /// flow (or an eagerly materialized replacement) — reading the content without
+    /// replacing the stream would leave an empty/truncated stream for the provider.
+    /// </para>
+    /// </summary>
+    Task OnSavingAsync([NotNull] BlobPipelineContext context);
+
+    /// <summary>
+    /// Reverse the save-time transformation by replacing
+    /// <see cref="BlobPipelineContext.BlobStream"/> the same way. Here a replacement
+    /// must dispose the stream it received when it is disposed, since the composed
+    /// stream is returned to the caller as a whole.
+    /// </summary>
+    Task OnGettingAsync([NotNull] BlobPipelineContext context);
+}

framework/src/Volo.Abp.BlobStoring/Volo/Abp/BlobStoring/PrefixingReadStream.cs

@@ -0,0 +1,155 @@
+using System;
+using System.IO;
+using System.Threading;
+using System.Threading.Tasks;
+using Volo.Abp.Threading;
+
+namespace Volo.Abp.BlobStoring;
+
+/// <summary>
+/// Serves the already-consumed prefix bytes first, then the rest of the underlying stream.
+/// </summary>
+internal sealed class PrefixingReadStream : SequentialReadStream
+{
+    private readonly byte[] _prefix;
+    private readonly Stream _stream;
+    private readonly long? _length;
+    private int _prefixPosition;
+
+    public PrefixingReadStream(byte[] prefix, Stream stream)
+    {
+        _prefix = prefix;
+        _stream = stream;
+
+        // What this stream serves is the prefix plus whatever remains of the underlying
+        // stream from its current position — not the underlying total length, which
+        // would overstate it when the provider stream did not start at position 0
+        try
+        {
+            _length = _prefix.Length + (_stream.Length - _stream.Position);
+        }
+        catch (Exception ex) when (ex is NotSupportedException || ex is IOException)
+        {
+            _length = null;
+        }
+    }
+
+    public override bool CanRead => !IsDisposed && _stream.CanRead;
+
+    // Legacy plaintext BLOBs had a usable Length before encryption was enabled; it is
+    // known when the underlying stream reports both its length and position. Position
+    // reports the bytes served, so Length - Position stays meaningful for length-aware
+    // consumers (like re-encrypting the legacy content)
+    public override long Length => _length ?? throw new NotSupportedException();
+
+    public override long Position
+    {
+        get => _position;
+        set => throw new NotSupportedException();
+    }
+
+    private long _position;
+
+    protected override int ReadCore(byte[] buffer, int offset, int count)
+    {
+        var prefixReadCount = TryCopyFromPrefix(buffer, offset, count);
+        if (prefixReadCount > 0)
+        {
+            _position += prefixReadCount;
+            return prefixReadCount;
+        }
+
+        var readCount = _stream.Read(buffer, offset, count);
+        _position += readCount;
+        return readCount;
+    }
+
+    protected override async Task<int> ReadCoreAsync(byte[] buffer, int offset, int count, CancellationToken cancellationToken)
+    {
+        var prefixReadCount = TryCopyFromPrefix(buffer, offset, count);
+        if (prefixReadCount > 0)
+        {
+            _position += prefixReadCount;
+            return prefixReadCount;
+        }
+
+#if NETSTANDARD2_0
+        var readCount = await _stream.ReadAsync(buffer, offset, count, cancellationToken);
+#else
+        // The modern overload dispatches correctly for streams that only
+        // implement ReadAsync(Memory<byte>)
+        var readCount = await _stream.ReadAsync(buffer.AsMemory(offset, count), cancellationToken);
+#endif
+        _position += readCount;
+        return readCount;
+    }
+
+    private int TryCopyFromPrefix(byte[] buffer, int offset, int count)
+    {
+        if (_prefixPosition >= _prefix.Length)
+        {
+            return 0;
+        }
+
+        var readCount = Math.Min(count, _prefix.Length - _prefixPosition);
+        Array.Copy(_prefix, _prefixPosition, buffer, offset, readCount);
+        _prefixPosition += readCount;
+        return readCount;
+    }
+
+    protected override void Dispose(bool disposing)
+    {
+        if (disposing && !IsDisposed)
+        {
+            IsDisposed = true;
+            try
+            {
+#if NETSTANDARD2_0
+                // Stream has no DisposeAsync on netstandard2.0, but the provider stream
+                // may still implement IAsyncDisposable for its async-only cleanup
+                if (_stream is IAsyncDisposable asyncDisposable)
+                {
+                    AsyncHelper.RunSync(() => asyncDisposable.DisposeAsync().AsTask());
+                }
+                else
+                {
+                    _stream.Dispose();
+                }
+#else
+                // Also covers a provider stream that only implements DisposeAsync
+                AsyncHelper.RunSync(() => _stream.DisposeAsync().AsTask());
+#endif
+            }
+            finally
+            {
+                base.Dispose(disposing);
+            }
+
+            return;
+        }
+
+        base.Dispose(disposing);
+    }
+
+#if !NETSTANDARD2_0
+    public override async ValueTask DisposeAsync()
+    {
+        if (!IsDisposed)
+        {
+            IsDisposed = true;
+            try
+            {
+                await _stream.DisposeAsync();
+            }
+            finally
+            {
+                await base.DisposeAsync();
+            }
+
+            return;
+        }
+
+        await base.DisposeAsync();
+    }
+#endif
+}

framework/src/Volo.Abp.BlobStoring/Volo/Abp/BlobStoring/SequentialReadStream.cs

@@ -0,0 +1,146 @@
+using System;
+using System.IO;
+using System.Threading;
+using System.Threading.Tasks;
+
+namespace Volo.Abp.BlobStoring;
+
+/// <summary>
+/// A read-only, non-seekable, forward-only stream; a failed read faults it permanently.
+/// </summary>
+internal abstract class SequentialReadStream : Stream
+{
+    private bool _faulted;
+
+    protected bool IsDisposed { get; set; }
+
+    // Once faulted, no further read can succeed; a failed authenticated-end check
+    // uses it so the failure can not be swallowed by a read-retry layer
+    protected void MarkFaulted()
+    {
+        _faulted = true;
+    }
+
+    // False once disposed, so it stays consistent with Read throwing ObjectDisposedException
+    public override bool CanRead => !IsDisposed;
+
+    public override bool CanSeek => false;
+
+    public override bool CanWrite => false;
+
+    public override long Length => throw new NotSupportedException();
+
+    public override long Position
+    {
+        get => throw new NotSupportedException();
+        set => throw new NotSupportedException();
+    }
+
+    public override void Flush()
+    {
+    }
+
+    public override int Read(byte[] buffer, int offset, int count)
+    {
+        ValidateReadArguments(buffer, offset, count);
+        EnsureCanServe();
+
+        if (count == 0)
+        {
+            return 0;
+        }
+
+        try
+        {
+            return ReadCore(buffer, offset, count);
+        }
+        catch
+        {
+            _faulted = true;
+            throw;
+        }
+    }
+
+    public override async Task<int> ReadAsync(byte[] buffer, int offset, int count, CancellationToken cancellationToken)
+    {
+        ValidateReadArguments(buffer, offset, count);
+        EnsureCanServe();
+        cancellationToken.ThrowIfCancellationRequested();
+
+        if (count == 0)
+        {
+            return 0;
+        }
+
+        try
+        {
+            return await ReadCoreAsync(buffer, offset, count, cancellationToken);
+        }
+        catch
+        {
+            _faulted = true;
+            throw;
+        }
+    }
+
+    protected abstract int ReadCore(byte[] buffer, int offset, int count);
+
+    protected abstract Task<int> ReadCoreAsync(byte[] buffer, int offset, int count, CancellationToken cancellationToken);
+
+    public override long Seek(long offset, SeekOrigin origin)
+    {
+        throw new NotSupportedException();
+    }
+
+    public override void SetLength(long value)
+    {
+        throw new NotSupportedException();
+    }
+
+    public override void Write(byte[] buffer, int offset, int count)
+    {
+        throw new NotSupportedException();
+    }
+
+    protected override void Dispose(bool disposing)
+    {
+        IsDisposed = true;
+        base.Dispose(disposing);
+    }
+
+    protected void EnsureCanServe()
+    {
+        if (IsDisposed)
+        {
+            throw new ObjectDisposedException(GetType().FullName);
+        }
+
+        if (_faulted)
+        {
+            throw new AbpException("The stream can not be read anymore, because a previous read operation has failed!");
+        }
+    }
+
+    private static void ValidateReadArguments(byte[] buffer, int offset, int count)
+    {
+        if (buffer == null)
+        {
+            throw new ArgumentNullException(nameof(buffer));
+        }
+
+        if (offset < 0)
+        {
+            throw new ArgumentOutOfRangeException(nameof(offset));
+        }
+
+        if (count < 0)
+        {
+            throw new ArgumentOutOfRangeException(nameof(count));
+        }
+
+        if (buffer.Length - offset < count)
+        {
+            throw new ArgumentException("The sum of offset and count is larger than the buffer length!");
+        }
+    }
+}

framework/src/Volo.Abp.Cli.Core/Volo/Abp/Cli/ProjectBuilding/Building/UiFramework.cs

@@ -9,5 +9,6 @@ public enum UiFramework
     Blazor = 4,
     BlazorServer = 5,
     MauiBlazor = 6,
-    BlazorWebApp = 7
+    BlazorWebApp = 7,
+    React = 8
 }

framework/src/Volo.Abp.Cli.Core/Volo/Abp/Cli/ProjectBuilding/Building/UiFrameworkExtensions.cs

@@ -12,6 +12,7 @@ public static class UiFrameworkExtensions
             case UiFramework.Blazor: return "blazor";
             case UiFramework.BlazorServer: return "blazor-server";
             case UiFramework.BlazorWebApp: return "blazor-webapp";
+            case UiFramework.React: return "react";
             case UiFramework.NotSpecified: return "NotSpecified";
             default: return "NotSpecified";
         }

framework/src/Volo.Abp.Cli.Core/Volo/Abp/Cli/ProjectBuilding/TemplateProjectBuilder.cs

@@ -59,6 +59,15 @@ public class TemplateProjectBuilder : IProjectBuilder, ITransientDependency
 
         NormalizeArgs(args, templateInfo);
 
+        // Checked after NormalizeArgs so a NotSpecified UI resolved to React is caught too. React is only
+        // produced by ABP Studio's modern solution templates; the classic builders below have no React
+        // handling, so fail fast instead of emitting a solution with an unconfigured UI.
+        if (args.UiFramework == UiFramework.React)
+        {
+            throw new UserFriendlyException(
+                "The React UI is generated by ABP Studio's modern solution templates and is not supported by the classic template builder.");
+        }
+
         await EventBus.PublishAsync(new ProjectCreationProgressEvent {
             Message = "Downloading the solution template"
         }, false);

framework/src/Volo.Abp.Http/Volo/Abp/Http/HttpMethodHelper.cs

@@ -1,4 +1,4 @@
-using System;
+using System;
 using System.Collections.Generic;
 using System.Linq;
 using System.Net.Http;
@@ -8,15 +8,25 @@ namespace Volo.Abp.Http;
 
 public static class HttpMethodHelper
 {
-    public const string DefaultHttpVerb = "POST";
+    public const string Get = "GET";
+    public const string Post = "POST";
+    public const string Put = "PUT";
+    public const string Delete = "DELETE";
+    public const string Patch = "PATCH";
+    public const string Head = "HEAD";
+    public const string Options = "OPTIONS";
+    public const string Trace = "TRACE";
+    public const string Query = "QUERY";
+
+    public const string DefaultHttpVerb = Post;
 
     public static Dictionary<string, string[]> ConventionalPrefixes { get; set; } = new Dictionary<string, string[]>
         {
-            {"GET", new[] {"GetList", "GetAll", "Get"}},
+            {Get, new[] {"GetList", "GetAll", "Get"}},
-            {"PUT", new[] {"Put", "Update"}},
+            {Put, new[] {"Put", "Update"}},
-            {"DELETE", new[] {"Delete", "Remove"}},
+            {Delete, new[] {"Delete", "Remove"}},
-            {"POST", new[] {"Create", "Add", "Insert", "Post"}},
+            {Post, new[] {"Create", "Add", "Insert", "Post"}},
-            {"PATCH", new[] {"Patch"}}
+            {Patch, new[] {"Patch"}}
         };
 
     public static string GetConventionalVerbForMethodName(string methodName)
@@ -50,24 +60,44 @@ public static class HttpMethodHelper
     {
         switch (httpMethod?.ToUpperInvariant())
         {
-            case "GET":
+            case Get:
                 return HttpMethod.Get;
-            case "POST":
+            case Post:
                 return HttpMethod.Post;
-            case "PUT":
+            case Put:
                 return HttpMethod.Put;
-            case "DELETE":
+            case Delete:
                 return HttpMethod.Delete;
-            case "OPTIONS":
+            case Options:
                 return HttpMethod.Options;
-            case "TRACE":
+            case Trace:
                 return HttpMethod.Trace;
-            case "HEAD":
+            case Head:
                 return HttpMethod.Head;
-            case "PATCH":
+            case Patch:
-                return new HttpMethod("PATCH");
+                return new HttpMethod(Patch);
+            case Query:
+                return new HttpMethod(Query);
             default:
                 throw new AbpException("Unknown HTTP METHOD: " + httpMethod);
         }
     }
+
+    public static bool IsGet(string? httpMethod) => string.Equals(httpMethod, Get, StringComparison.OrdinalIgnoreCase);
+
+    public static bool IsPost(string? httpMethod) => string.Equals(httpMethod, Post, StringComparison.OrdinalIgnoreCase);
+
+    public static bool IsPut(string? httpMethod) => string.Equals(httpMethod, Put, StringComparison.OrdinalIgnoreCase);
+
+    public static bool IsDelete(string? httpMethod) => string.Equals(httpMethod, Delete, StringComparison.OrdinalIgnoreCase);
+
+    public static bool IsPatch(string? httpMethod) => string.Equals(httpMethod, Patch, StringComparison.OrdinalIgnoreCase);
+
+    public static bool IsHead(string? httpMethod) => string.Equals(httpMethod, Head, StringComparison.OrdinalIgnoreCase);
+
+    public static bool IsOptions(string? httpMethod) => string.Equals(httpMethod, Options, StringComparison.OrdinalIgnoreCase);
+
+    public static bool IsTrace(string? httpMethod) => string.Equals(httpMethod, Trace, StringComparison.OrdinalIgnoreCase);
+
+    public static bool IsQuery(string? httpMethod) => string.Equals(httpMethod, Query, StringComparison.OrdinalIgnoreCase);
 }