Replace 'has not compatible with' with 'is not compatible with' in FeatureManager, SettingManager and PermissionManager (the latter is the original phrasing this PR initially mirrored).
- SettingManager.GetAllAsync / FeatureManager.GetAllWithProviderAsync: drop top-level continue and rely on the provider chain filter so allowed upstream providers can still be read via inheritance (e.g. GetAllForUserAsync now returns a Global-only setting)
- FeatureAppService.GetAsync: switch includedFeatures to HashSet for O(1) parent lookup
- FeatureManager.SetAsync: throw when providerName is not in feature.AllowedProviders
- FeatureManager.GetAllWithProviderAsync / GetOrNullInternalAsync: filter providers chain by feature.AllowedProviders (aligning with FeatureChecker)
- FeatureAppService.GetAsync: filter features by AllowedProviders and add parent chain check to prevent orphan child entries (aligning with PermissionAppService)
- SettingManager.SetAsync: throw when providerName is not in setting.Providers
- SettingManager.GetAllAsync / GetOrNullInternalAsync: filter providers chain by setting.Providers (aligning with SettingProvider)
- SetLinkConsentAsync uses FindByIdAsync + null no-op, matching the
missing-user behaviour of Get/RemoveLinkConsentAsync.
- Decorate Set/Get/RemoveLinkConsentAsync with [UnitOfWork] so the
underlying IdentityUserStore.GetTokenAsync can EnsureCollectionLoaded
the user.Tokens collection (fixes the CI failure on
GetLinkConsentAsync_Should_Return_Null_When_No_Consent_Written).
- Clarify LinkUserTokenProvider XML doc to note that the single-active
policy is enforced per purpose (matches AbpSingleActiveTokenProvider).
- Rename LinkUserTokenProvider_Should_Be_Register to *_Registered for
consistency with sibling token-provider tests.
- Add tests covering: (a) RemoveLinkUserTokenAsync(purpose) only
invalidates the requested purpose, and (b) same-purpose GenerateLink
TokenAsync invalidates the previously issued token.
- Use UserManager.SetAuthenticationTokenAsync/GetAuthenticationTokenAsync/
RemoveAuthenticationTokenAsync so the Tokens collection is loaded via
IdentityUserStore.EnsureCollectionLoadedAsync instead of relying on the
GetByIdAsync(includeDetails) convention.
- Add a RemoveLinkUserTokenAsync(manager, user, purpose) overload to invalidate
tokens issued for purposes other than LinkUserTokenPurpose.
- Add a cross-UnitOfWork persistence test for SetLink/Get/Remove ConsentAsync.
- Drop the unused IdentityLinkUserRepository field from LinkUserTokenProvider_Tests.
- Make LinkUserTokenProvider derive from AbpSingleActiveTokenProvider
- Add AbpLinkUserTokenProviderOptions with 10 min default lifespan
- Add RemoveLinkUserTokenAsync extension on IdentityUserManager
- Add SetLinkConsentAsync/GetLinkConsentAsync/RemoveLinkConsentAsync on IdentityLinkUserManager backed by user.Tokens slot [AbpLinkUserConsent]/Consent
- Add state-aware overload to ISimpleStateCheckerSerializer/Contributor
- Features and Permissions contributors recognise their batch checker and emit a per-state record
- PermissionDefinitionSerializer threads the owning permission through
- Pin equality semantics to match the batch runtime (default comparer)
Route template used {id} but the method parameter is named blogId, so
ASP.NET Core ApiExplorer emitted an orphan path parameter id, which made
ClientProxyBase.BuildHttpProxyClientProxyContext throw
ArgumentOutOfRangeException when deleting a blog from the MVC admin page.
The custom Style="max-height: 600px; overflow-y: auto;" on MudTabs produced an inner
scrollbar in addition to mud-dialog's own scrollbar, resulting in a double scrolling
experience inside the permissions modal. Let mud-dialog handle overflow natively.
- MudMenu: switch ActivatorContent to MenuContext.ToggleAsync pattern (v9 breaking)
- MudForm: rename Validate to ValidateAsync (v9.1 obsoletion)
- MudInput: replace AutoGrow with Sizing for textarea
- DataGrid: add white-space:nowrap on header to prevent CJK characters stacking vertically
- BlockUI: shrink loading spinner inside mud-dialog
- Search field: switch Label to Placeholder so the text shows next to the magnifier icon
Top-level "Select All in All Tabs" already used `Indeterminate` to show
a partial-grant state. The per-tab "Select All in This Tab" checkbox
was a plain two-state binding to `Permissions.All(x => x.IsGranted)`,
so a tab with some (but not all) permissions granted rendered as
unchecked - reading as "no permissions granted" to QA.
Bind `Indeterminate` to "any granted but not all granted" to match the
top-level behavior.
- Index.cshtml.cs: cache the rendered parameter name set so
IsParameterVisible doesn't allocate a HashSet per call inside the cshtml
loop; clarify per-rule semantics in comments (empty allow-list is an
explicit "never show", null/unknown-key rules fail-open)
- forms-validation.md: drop the inaccurate IValidationRule reference and
describe MudBlazor's actual validation surface (ValidationAttribute on
the Validation parameter, Func<T,string>/Func<T,IEnumerable<string>>,
optional FluentValidation)
- book-store/part-02.md: use {(int)context.Item.Type} for the BookType
localization key to stay consistent with the rest of the tutorial
- Introduce a new "BlazorUI" doc-params dimension (Blazorise / MudBlazor) so
Blazor docs can show MudBlazor variants of code samples next to the existing
Blazorise ones
- Cover framework/ui/blazor (overall, theming, basic-theme, forms-validation,
submit-button, page-layout, page-header, page-toolbar-extensions,
entity-action-extensions, data-table-column-extensions, error-handling,
customization-overriding-components)
- Cover ui-themes (index, basic-theme, lepton-x, lepton-x-lite)
- Cover tutorials (book-store part 02/03/09/10, todo single-layer/layered,
modular-crm part 03/05/06, book-store-with-abp-suite part-05)
- Add an optional "DependsOn" map to DocumentParameterDto so a parameter can
be hidden when dependencies aren't satisfied (e.g. only show BlazorUI when
UI is one of Blazor/BlazorServer/BlazorWebApp). Visibility is evaluated on
the server in the project document index page.
Replaces the TOTP-based Email/Phone 2FA providers under
TokenOptions.DefaultEmailProvider / DefaultPhoneProvider with
DataProtector-backed single-use equivalents.
- Encrypt the 6-digit code via IDataProtector (purpose chain isolated per
provider + token purpose), store ciphertext + absolute UTC expiration
(unix seconds) in the user token table
- Remove the stored entry on successful validation (true single-use)
- Concurrency race (ConcurrencyStamp failure) returns false instead of 500
- Configurable TokenLifespan (default 3 minutes) via Options
AbpSingleActiveTokenProvider.GenerateAsync now checks the IdentityResult
from UserManager.UpdateAsync so a silent persistence failure no longer
returns a token that was not saved.
Related to #25314.
maliming
voloagent