- reset background/border/shadow on :not(.is-open) so hover/focus cannot leak the panel look
- return focus to the button only on Escape close, not on outside-click
- add a :focus-visible ring on the toggle button for keyboard users
- keep the info line visible in the popover
- namespace and unbind the toggle handlers to avoid stacking on re-init
When the cookie security stamp is refreshed during a /connect/authorize
request, OpenIddictClaimsPrincipalContributor stamps the ambient request's
client_id onto the principal that is written back to the interactive
authentication cookie. From then on ICurrentClient.Id resolves to that client
for every later cookie-authenticated request, corrupting audit-log client
attribution.
The contributor cannot tell whether the principal it contributes to is destined
for a token (correct) or for the cookie being refreshed (wrong), so strip
client_id at the only point where the cookie is actually re-written: the
security-stamp OnRefreshingPrincipal callback. This never runs for token
issuance, so the token path is untouched, and chaining the removal after the
existing AbpSecurityStampValidatorCallback.UpdatePrincipal lets already-corrupted
cookies self-heal on their next refresh.
Adds Volo.Abp.OpenIddict.AspNetCore.Tests covering the removal and the callback
composition order.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add an ITimezoneProvider.ConvertUnspecifiedToUtc helper that computes the
UTC ticks and keeps boundary values unchanged instead of throwing, then use
it in the System.Text.Json and Newtonsoft converters and the MVC model
binder. Normalize the Volo.Docs commit date filters to UTC for consistency.
AbpDateTimeConverterBase.Normalize converts an Unspecified DateTime to UTC via
`new DateTimeOffset(value, offset).UtcDateTime` when the clock is UTC and a user
timezone is set. For values within the timezone offset distance of
DateTime.MinValue/MaxValue (most notably the DateTime.MinValue placeholder), this
throws ArgumentOutOfRangeException. The exception was swallowed and logged as
"Could not convert DateTime with unspecified Kind using timezone '...'." on every
serialization, flooding logs for positive-offset users (e.g. Asia/Shanghai +08:00).
Catch the boundary ArgumentOutOfRangeException explicitly, keep the value unchanged,
and log it at Debug level instead of Warning so it stays traceable without polluting
production logs. Other unexpected failures still log a warning.
Also make Volo.Docs GitHubDocumentSource return a Utc-kind placeholder
(DateTime.SpecifyKind(DateTime.MinValue, Utc)) and use Author.Date.UtcDateTime, so it
no longer emits Unspecified placeholders in the first place.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- Close nested add/edit dialogs via Visible binding instead of @if
- Use Large dialog width to match the permission management modal
- Localize the provider key search label
- Bind the target radio group with Value/ValueChanged so the lookup service updates
- Sync the grant-all switch with permission checkboxes
When all setting groups are hidden by contributors or permissions
(e.g. tenant users in Shared user accounts mode), the Settings page
went completely blank. Show a small empty state across MVC, Blazor
and Angular, plus a localizable string in all locales.
Introduce AbpDefaultTokenProvider (10-min lifespan) replacing
DataProtectorTokenProvider under TokenOptions.DefaultProvider, so
challenge tokens (RequiresTwoFactor, ShouldChangePassword) become
single-active.
Document the token provider lineup and fix two factual errors in
the 2FA doc.
Replace 'has not compatible with' with 'is not compatible with' in FeatureManager, SettingManager and PermissionManager (the latter is the original phrasing this PR initially mirrored).
- SettingManager.GetAllAsync / FeatureManager.GetAllWithProviderAsync: drop top-level continue and rely on the provider chain filter so allowed upstream providers can still be read via inheritance (e.g. GetAllForUserAsync now returns a Global-only setting)
- FeatureAppService.GetAsync: switch includedFeatures to HashSet for O(1) parent lookup
- FeatureManager.SetAsync: throw when providerName is not in feature.AllowedProviders
- FeatureManager.GetAllWithProviderAsync / GetOrNullInternalAsync: filter providers chain by feature.AllowedProviders (aligning with FeatureChecker)
- FeatureAppService.GetAsync: filter features by AllowedProviders and add parent chain check to prevent orphan child entries (aligning with PermissionAppService)
- SettingManager.SetAsync: throw when providerName is not in setting.Providers
- SettingManager.GetAllAsync / GetOrNullInternalAsync: filter providers chain by setting.Providers (aligning with SettingProvider)
- SetLinkConsentAsync uses FindByIdAsync + null no-op, matching the
missing-user behaviour of Get/RemoveLinkConsentAsync.
- Decorate Set/Get/RemoveLinkConsentAsync with [UnitOfWork] so the
underlying IdentityUserStore.GetTokenAsync can EnsureCollectionLoaded
the user.Tokens collection (fixes the CI failure on
GetLinkConsentAsync_Should_Return_Null_When_No_Consent_Written).
- Clarify LinkUserTokenProvider XML doc to note that the single-active
policy is enforced per purpose (matches AbpSingleActiveTokenProvider).
- Rename LinkUserTokenProvider_Should_Be_Register to *_Registered for
consistency with sibling token-provider tests.
- Add tests covering: (a) RemoveLinkUserTokenAsync(purpose) only
invalidates the requested purpose, and (b) same-purpose GenerateLink
TokenAsync invalidates the previously issued token.
- Use UserManager.SetAuthenticationTokenAsync/GetAuthenticationTokenAsync/
RemoveAuthenticationTokenAsync so the Tokens collection is loaded via
IdentityUserStore.EnsureCollectionLoadedAsync instead of relying on the
GetByIdAsync(includeDetails) convention.
- Add a RemoveLinkUserTokenAsync(manager, user, purpose) overload to invalidate
tokens issued for purposes other than LinkUserTokenPurpose.
- Add a cross-UnitOfWork persistence test for SetLink/Get/Remove ConsentAsync.
- Drop the unused IdentityLinkUserRepository field from LinkUserTokenProvider_Tests.
- Make LinkUserTokenProvider derive from AbpSingleActiveTokenProvider
- Add AbpLinkUserTokenProviderOptions with 10 min default lifespan
- Add RemoveLinkUserTokenAsync extension on IdentityUserManager
- Add SetLinkConsentAsync/GetLinkConsentAsync/RemoveLinkConsentAsync on IdentityLinkUserManager backed by user.Tokens slot [AbpLinkUserConsent]/Consent
maliming
SALİH ÖZKARA
voloagent
gdlcf88
Ebicoglu
selman koc
selmankoc