Nov 7, 2025 · Nov 10, 2025 · Nov 10, 2025 · Nov 10, 2025 · Nov 10, 2025 · Nov 10, 2025
diff --git a/...ity/Volo/Abp/PermissionManagement/Identity/AbpPermissionManagementDomainIdentityModule.cs b/...ity/Volo/Abp/PermissionManagement/Identity/AbpPermissionManagementDomainIdentityModule.cs
 using Volo.Abp.Authorization.Permissions;
 using Volo.Abp.Authorization.Permissions.Resources;
 using Volo.Abp.Identity;
 using Volo.Abp.Modularity;
 using Volo.Abp.Users;
        {
            options.ManagementProviders.Add<UserPermissionManagementProvider>();
            options.ManagementProviders.Add<RolePermissionManagementProvider>();
            options.ResourceManagementProviders.Add<UserResourcePermissionManagementProvider>();
            options.ResourceManagementProviders.Add<RoleResourcePermissionManagementProvider>();

            //TODO: Can we prevent duplication of permission names without breaking the design and making the system complicated
            options.ProviderPolicies[UserPermissionValueProvider.ProviderName] = "AbpIdentity.Users.ManagePermissions";
            options.ProviderPolicies[RolePermissionValueProvider.ProviderName] = "AbpIdentity.Roles.ManagePermissions";
            options.ProviderPolicies[UserResourcePermissionValueProvider.ProviderName] = "AbpIdentity.Users.ManagePermissions";
            options.ProviderPolicies[RoleResourcePermissionValueProvider.ProviderName] = "AbpIdentity.Roles.ManagePermissions";
        });
    }
 }
diff --git a/...entity/Volo/Abp/PermissionManagement/Identity/RoleResourcePermissionManagementProvider.cs b/...entity/Volo/Abp/PermissionManagement/Identity/RoleResourcePermissionManagementProvider.cs
 using System;
 using System.Collections.Generic;
 using System.Linq;
 using System.Threading.Tasks;
 using Volo.Abp.Authorization.Permissions.Resources;
 using Volo.Abp.Domain.Repositories;
 using Volo.Abp.Guids;
 using Volo.Abp.Identity;
 using Volo.Abp.MultiTenancy;

 namespace Volo.Abp.PermissionManagement.Identity;

 public class RoleResourcePermissionManagementProvider : ResourcePermissionManagementProvider
 {
    public override string Name => RoleResourcePermissionValueProvider.ProviderName;

    protected IUserRoleFinder UserRoleFinder { get; }

    public RoleResourcePermissionManagementProvider(
        IResourcePermissionGrantRepository resourcepPrmissionGrantRepository,
        IGuidGenerator guidGenerator,
        ICurrentTenant currentTenant,
        IUserRoleFinder userRoleFinder)
        : base(
            resourcepPrmissionGrantRepository,
            guidGenerator,
            currentTenant)
    {
        UserRoleFinder = userRoleFinder;
    }

    public override async Task<PermissionValueProviderGrantInfo> CheckAsync(string name, string resourceName, string resourceKey, string providerName, string providerKey)
    {
        var multipleGrantInfo = await CheckAsync(new[] { name }, resourceName, resourceKey, providerName, providerKey);

        return multipleGrantInfo.Result.Values.First();
    }

    public override async Task<MultiplePermissionValueProviderGrantInfo> CheckAsync(string[] names, string resourceName, string resourceKey, string providerName, string providerKey)
    {
        using (ResourcePermissionGrantRepository.DisableTracking())
        {
            var multiplePermissionValueProviderGrantInfo = new MultiplePermissionValueProviderGrantInfo(names);
            var resourcePermissionGrants = new List<ResourcePermissionGrant>();

            if (providerName == Name)
            {
                resourcePermissionGrants.AddRange(await ResourcePermissionGrantRepository.GetListAsync(names, resourceName, resourceKey, providerName, providerKey));
            }

            if (providerName == UserResourcePermissionValueProvider.ProviderName)
            {
                var userId = Guid.Parse(providerKey);
                var roleNames = await UserRoleFinder.GetRoleNamesAsync(userId);

                foreach (var roleName in roleNames)
                {
                    resourcePermissionGrants.AddRange(await ResourcePermissionGrantRepository.GetListAsync(names, resourceName, resourceKey, Name, roleName));
                }
            }

            resourcePermissionGrants = resourcePermissionGrants.Distinct().ToList();
            if (!resourcePermissionGrants.Any())
            {
                return multiplePermissionValueProviderGrantInfo;
            }

            foreach (var permissionName in names)
            {
                var resourcePermissionGrant = resourcePermissionGrants.FirstOrDefault(x => x.Name == permissionName);
                if (resourcePermissionGrant != null)
                {
                    multiplePermissionValueProviderGrantInfo.Result[permissionName] = new PermissionValueProviderGrantInfo(true, resourcePermissionGrant.ProviderKey);
                }
            }

            return multiplePermissionValueProviderGrantInfo;
        }
    }
 }
diff --git a/...entity/Volo/Abp/PermissionManagement/Identity/UserResourcePermissionManagementProvider.cs b/...entity/Volo/Abp/PermissionManagement/Identity/UserResourcePermissionManagementProvider.cs
 using Volo.Abp.Authorization.Permissions.Resources;
 using Volo.Abp.Guids;
 using Volo.Abp.MultiTenancy;

 namespace Volo.Abp.PermissionManagement.Identity;

 public class UserResourcePermissionManagementProvider : ResourcePermissionManagementProvider
 {
    public override string Name => UserResourcePermissionValueProvider.ProviderName;

    public UserResourcePermissionManagementProvider(
        IResourcePermissionGrantRepository resourcePermissionGrantRepository,
        IGuidGenerator guidGenerator,
        ICurrentTenant currentTenant)
        : base(
            resourcePermissionGrantRepository,
            guidGenerator,
            currentTenant)
    {

    }
 }
diff --git a/...nManagement.Domain/Volo/Abp/PermissionManagement/IResourcePermissionManagementProvider.cs b/...nManagement.Domain/Volo/Abp/PermissionManagement/IResourcePermissionManagementProvider.cs
 using System.Threading.Tasks;
 using JetBrains.Annotations;
 using Volo.Abp.DependencyInjection;

 namespace Volo.Abp.PermissionManagement;

 public interface IResourcePermissionManagementProvider : ISingletonDependency //TODO: Consider to remove this pre-assumption
 {
    string Name { get; }

    Task<PermissionValueProviderGrantInfo> CheckAsync(
        [NotNull] string name,
        [NotNull] string resourceName,
        [NotNull] string resourceKey,
        [NotNull] string providerName,
        [NotNull] string providerKey
    );

    Task<MultiplePermissionValueProviderGrantInfo> CheckAsync(
        [NotNull] string[] names,
        [NotNull] string resourceName,
        [NotNull] string resourceKey,
        [NotNull] string providerName,
        [NotNull] string providerKey
    );

    Task SetAsync(
        [NotNull] string name,
        [NotNull] string resourceName,
        [NotNull] string resourceKey,
        [NotNull] string providerKey,
        bool isGranted
    );
 }
diff --git a/...p.PermissionManagement.Domain/Volo/Abp/PermissionManagement/IResourcePermissionManager.cs b/...p.PermissionManagement.Domain/Volo/Abp/PermissionManagement/IResourcePermissionManager.cs
 {
    Task<PermissionWithGrantedProviders> GetAsync(
        string permissionName,
        string providerName,
        string providerKey,
        string resourceName,
        string resourceKey
        string resourceKey,
        string providerName,
        string providerKey
    );


    Task<MultiplePermissionWithGrantedProviders> GetAsync(
        string[] permissionNames,
        string provideName,
        string providerKey,
        string resourceName,
        string resourceKey
        string resourceKey,
        string providerName,
        string providerKey
    );


    Task<List<PermissionWithGrantedProviders>> GetAllAsync(
        string providerName,
        string providerKey,
        string resourceName,
        string resourceKey
        string resourceKey,
        string providerName,
        string providerKey
    );


    Task SetAsync(
        string permissionName,
        string providerName,
        string providerKey,
        string resourceName,
        string resourceKey,
        string providerName,
        string providerKey,
        bool isGranted
    );
 }
 }
diff --git a/....PermissionManagement.Domain/Volo/Abp/PermissionManagement/PermissionManagementOptions.cs b/....PermissionManagement.Domain/Volo/Abp/PermissionManagement/PermissionManagementOptions.cs
 {
    public ITypeList<IPermissionManagementProvider> ManagementProviders { get; }

    public ITypeList<IResourcePermissionManagementProvider> ResourceManagementProviders { get; }

    public Dictionary<string, string> ProviderPolicies { get; }

    /// <summary>
    public PermissionManagementOptions()
    {
        ManagementProviders = new TypeList<IPermissionManagementProvider>();
        ResourceManagementProviders = new TypeList<IResourcePermissionManagementProvider>();
        ProviderPolicies = new Dictionary<string, string>();
    }
 }
diff --git a/...onManagement.Domain/Volo/Abp/PermissionManagement/ResourcePermissionManagementProvider.cs b/...onManagement.Domain/Volo/Abp/PermissionManagement/ResourcePermissionManagementProvider.cs
 using System.Linq;
 using System.Threading.Tasks;
 using Volo.Abp.Domain.Repositories;
 using Volo.Abp.Guids;
 using Volo.Abp.MultiTenancy;

 namespace Volo.Abp.PermissionManagement;

 public abstract class ResourcePermissionManagementProvider : IResourcePermissionManagementProvider
 {
    public abstract string Name { get; }

    protected IResourcePermissionGrantRepository ResourcePermissionGrantRepository { get; }

    protected IGuidGenerator GuidGenerator { get; }

    protected ICurrentTenant CurrentTenant { get; }

    protected ResourcePermissionManagementProvider(
        IResourcePermissionGrantRepository resourcePermissionGrantRepository,
        IGuidGenerator guidGenerator,
        ICurrentTenant currentTenant)
    {
        ResourcePermissionGrantRepository = resourcePermissionGrantRepository;
        GuidGenerator = guidGenerator;
        CurrentTenant = currentTenant;
    }

    public virtual async Task<PermissionValueProviderGrantInfo> CheckAsync(string name, string resourceName,string resourceKey, string providerName, string providerKey)
    {
        var multiplePermissionValueProviderGrantInfo = await CheckAsync(new[] { name }, resourceName, resourceKey, providerName, providerKey);

        return multiplePermissionValueProviderGrantInfo.Result.First().Value;
    }

    public virtual async Task<MultiplePermissionValueProviderGrantInfo> CheckAsync(string[] names, string resourceName, string resourceKey, string providerName, string providerKey)
    {
        using (ResourcePermissionGrantRepository.DisableTracking())
        {
            var multiplePermissionValueProviderGrantInfo = new MultiplePermissionValueProviderGrantInfo(names);
            if (providerName != Name)
            {
                return multiplePermissionValueProviderGrantInfo;
            }

            var resourcePermissionGrants = await ResourcePermissionGrantRepository.GetListAsync(names, resourceName, resourceKey, providerName, providerKey);

            foreach (var permissionName in names)
            {
                var isGrant = resourcePermissionGrants.Any(x => x.Name == permissionName);
                multiplePermissionValueProviderGrantInfo.Result[permissionName] = new PermissionValueProviderGrantInfo(isGrant, providerKey);
            }

            return multiplePermissionValueProviderGrantInfo;
        }
    }

    public virtual Task SetAsync(string name,  string resourceName,string resourceKey, string providerKey, bool isGranted)
    {
        return isGranted
            ? GrantAsync(name, resourceName, resourceKey, providerKey)
            : RevokeAsync(name, resourceName, resourceKey, providerKey);
    }

    protected virtual async Task GrantAsync(string name, string resourceName, string resourceKey, string providerKey)
    {
        var resourcePermissionGrants = await ResourcePermissionGrantRepository.FindAsync(name, resourceName, resourceKey, Name, providerKey);
        if (resourcePermissionGrants != null)
        {
            return;
        }

        resourcePermissionGrants = new ResourcePermissionGrant(GuidGenerator.Create(), name, resourceName, resourceKey, Name, providerKey, CurrentTenant.Id);
        await ResourcePermissionGrantRepository.InsertAsync(resourcePermissionGrants, true);
    }

    protected virtual async Task RevokeAsync(string name, string resourceName,string resourceKey, string providerKey)
    {
        var resourcePermissionGrants = await ResourcePermissionGrantRepository.FindAsync(name, resourceName, resourceKey, Name, providerKey);
        if (resourcePermissionGrants == null)
        {
            return;
        }

        await ResourcePermissionGrantRepository.DeleteAsync(resourcePermissionGrants, true);
    }
 }
Original file line number	Diff line number	Diff line change
		@@ -1,4 +1,5 @@
		using Volo.Abp.Authorization.Permissions;
		using Volo.Abp.Authorization.Permissions.Resources;
		using Volo.Abp.Identity;
		using Volo.Abp.Modularity;
		using Volo.Abp.Users;
Expand All		@@ -18,10 +19,14 @@ public override void ConfigureServices(ServiceConfigurationContext context)
		{
		options.ManagementProviders.Add<UserPermissionManagementProvider>();
		options.ManagementProviders.Add<RolePermissionManagementProvider>();
		options.ResourceManagementProviders.Add<UserResourcePermissionManagementProvider>();
		options.ResourceManagementProviders.Add<RoleResourcePermissionManagementProvider>();

		//TODO: Can we prevent duplication of permission names without breaking the design and making the system complicated
		options.ProviderPolicies[UserPermissionValueProvider.ProviderName] = "AbpIdentity.Users.ManagePermissions";
		options.ProviderPolicies[RolePermissionValueProvider.ProviderName] = "AbpIdentity.Roles.ManagePermissions";
		options.ProviderPolicies[UserResourcePermissionValueProvider.ProviderName] = "AbpIdentity.Users.ManagePermissions";
		options.ProviderPolicies[RoleResourcePermissionValueProvider.ProviderName] = "AbpIdentity.Roles.ManagePermissions";
		});
		}
		}
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,80 @@
		using System;
		using System.Collections.Generic;
		using System.Linq;
		using System.Threading.Tasks;
		using Volo.Abp.Authorization.Permissions.Resources;
		using Volo.Abp.Domain.Repositories;
		using Volo.Abp.Guids;
		using Volo.Abp.Identity;
		using Volo.Abp.MultiTenancy;

		namespace Volo.Abp.PermissionManagement.Identity;

		public class RoleResourcePermissionManagementProvider : ResourcePermissionManagementProvider
		{
		public override string Name => RoleResourcePermissionValueProvider.ProviderName;

		protected IUserRoleFinder UserRoleFinder { get; }

		public RoleResourcePermissionManagementProvider(
		IResourcePermissionGrantRepository resourcepPrmissionGrantRepository,
		IGuidGenerator guidGenerator,
		ICurrentTenant currentTenant,
		IUserRoleFinder userRoleFinder)
		: base(
		resourcepPrmissionGrantRepository,
		guidGenerator,
		currentTenant)
		{
		UserRoleFinder = userRoleFinder;
		}

		public override async Task<PermissionValueProviderGrantInfo> CheckAsync(string name, string resourceName, string resourceKey, string providerName, string providerKey)
		{
		var multipleGrantInfo = await CheckAsync(new[] { name }, resourceName, resourceKey, providerName, providerKey);

		return multipleGrantInfo.Result.Values.First();
		}

		public override async Task<MultiplePermissionValueProviderGrantInfo> CheckAsync(string[] names, string resourceName, string resourceKey, string providerName, string providerKey)
		{
		using (ResourcePermissionGrantRepository.DisableTracking())
		{
		var multiplePermissionValueProviderGrantInfo = new MultiplePermissionValueProviderGrantInfo(names);
		var resourcePermissionGrants = new List<ResourcePermissionGrant>();

		if (providerName == Name)
		{
		resourcePermissionGrants.AddRange(await ResourcePermissionGrantRepository.GetListAsync(names, resourceName, resourceKey, providerName, providerKey));
		}

		if (providerName == UserResourcePermissionValueProvider.ProviderName)
		{
		var userId = Guid.Parse(providerKey);
		var roleNames = await UserRoleFinder.GetRoleNamesAsync(userId);

		foreach (var roleName in roleNames)
		{
		resourcePermissionGrants.AddRange(await ResourcePermissionGrantRepository.GetListAsync(names, resourceName, resourceKey, Name, roleName));
		}
		}

		resourcePermissionGrants = resourcePermissionGrants.Distinct().ToList();
		if (!resourcePermissionGrants.Any())
		{
		return multiplePermissionValueProviderGrantInfo;
		}

		foreach (var permissionName in names)
		{
		var resourcePermissionGrant = resourcePermissionGrants.FirstOrDefault(x => x.Name == permissionName);
		if (resourcePermissionGrant != null)
		{
		multiplePermissionValueProviderGrantInfo.Result[permissionName] = new PermissionValueProviderGrantInfo(true, resourcePermissionGrant.ProviderKey);
		}
		}

		return multiplePermissionValueProviderGrantInfo;
		}
		}
		}
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,22 @@
		using Volo.Abp.Authorization.Permissions.Resources;
		using Volo.Abp.Guids;
		using Volo.Abp.MultiTenancy;

		namespace Volo.Abp.PermissionManagement.Identity;

		public class UserResourcePermissionManagementProvider : ResourcePermissionManagementProvider
		{
		public override string Name => UserResourcePermissionValueProvider.ProviderName;

		public UserResourcePermissionManagementProvider(
		IResourcePermissionGrantRepository resourcePermissionGrantRepository,
		IGuidGenerator guidGenerator,
		ICurrentTenant currentTenant)
		: base(
		resourcePermissionGrantRepository,
		guidGenerator,
		currentTenant)
		{

		}
		}
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,34 @@
		using System.Threading.Tasks;
		using JetBrains.Annotations;
		using Volo.Abp.DependencyInjection;

		namespace Volo.Abp.PermissionManagement;

		public interface IResourcePermissionManagementProvider : ISingletonDependency //TODO: Consider to remove this pre-assumption
		{
		string Name { get; }

		Task<PermissionValueProviderGrantInfo> CheckAsync(
		[NotNull] string name,
		[NotNull] string resourceName,
		[NotNull] string resourceKey,
		[NotNull] string providerName,
		[NotNull] string providerKey
		);

		Task<MultiplePermissionValueProviderGrantInfo> CheckAsync(
		[NotNull] string[] names,
		[NotNull] string resourceName,
		[NotNull] string resourceKey,
		[NotNull] string providerName,
		[NotNull] string providerKey
		);

		Task SetAsync(
		[NotNull] string name,
		[NotNull] string resourceName,
		[NotNull] string resourceKey,
		[NotNull] string providerKey,
		bool isGranted
		);
		}
Original file line number	Diff line number	Diff line change
Expand Up		@@ -7,33 +7,33 @@ public interface IResourcePermissionManager
		{
		Task<PermissionWithGrantedProviders> GetAsync(
		string permissionName,
		string providerName,
		string providerKey,
		string resourceName,
		string resourceKey
		string resourceKey,
		string providerName,
		string providerKey
		);


		Task<MultiplePermissionWithGrantedProviders> GetAsync(
		string[] permissionNames,
		string provideName,
		string providerKey,
		string resourceName,
		string resourceKey
		string resourceKey,
		string providerName,
		string providerKey
		);


		Task<List<PermissionWithGrantedProviders>> GetAllAsync(
		string providerName,
		string providerKey,
		string resourceName,
		string resourceKey
		string resourceKey,
		string providerName,
		string providerKey
		);


		Task SetAsync(
		string permissionName,
		string providerName,
		string providerKey,
		string resourceName,
		string resourceKey,
		string providerName,
		string providerKey,
		bool isGranted
		);
		}
		}
Original file line number	Diff line number	Diff line change
Expand Up		@@ -7,6 +7,8 @@ public class PermissionManagementOptions
		{
		public ITypeList<IPermissionManagementProvider> ManagementProviders { get; }

		public ITypeList<IResourcePermissionManagementProvider> ResourceManagementProviders { get; }

		public Dictionary<string, string> ProviderPolicies { get; }

		/// <summary>
Expand All		@@ -22,6 +24,7 @@ public class PermissionManagementOptions
		public PermissionManagementOptions()
		{
		ManagementProviders = new TypeList<IPermissionManagementProvider>();
		ResourceManagementProviders = new TypeList<IResourcePermissionManagementProvider>();
		ProviderPolicies = new Dictionary<string, string>();
		}
		}
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,87 @@
		using System.Linq;
		using System.Threading.Tasks;
		using Volo.Abp.Domain.Repositories;
		using Volo.Abp.Guids;
		using Volo.Abp.MultiTenancy;

		namespace Volo.Abp.PermissionManagement;

		public abstract class ResourcePermissionManagementProvider : IResourcePermissionManagementProvider
		{
		public abstract string Name { get; }

		protected IResourcePermissionGrantRepository ResourcePermissionGrantRepository { get; }

		protected IGuidGenerator GuidGenerator { get; }

		protected ICurrentTenant CurrentTenant { get; }

		protected ResourcePermissionManagementProvider(
		IResourcePermissionGrantRepository resourcePermissionGrantRepository,
		IGuidGenerator guidGenerator,
		ICurrentTenant currentTenant)
		{
		ResourcePermissionGrantRepository = resourcePermissionGrantRepository;
		GuidGenerator = guidGenerator;
		CurrentTenant = currentTenant;
		}

		public virtual async Task<PermissionValueProviderGrantInfo> CheckAsync(string name, string resourceName,string resourceKey, string providerName, string providerKey)
		{
		var multiplePermissionValueProviderGrantInfo = await CheckAsync(new[] { name }, resourceName, resourceKey, providerName, providerKey);

		return multiplePermissionValueProviderGrantInfo.Result.First().Value;
		}

		public virtual async Task<MultiplePermissionValueProviderGrantInfo> CheckAsync(string[] names, string resourceName, string resourceKey, string providerName, string providerKey)
		{
		using (ResourcePermissionGrantRepository.DisableTracking())
		{
		var multiplePermissionValueProviderGrantInfo = new MultiplePermissionValueProviderGrantInfo(names);
		if (providerName != Name)
		{
		return multiplePermissionValueProviderGrantInfo;
		}

		var resourcePermissionGrants = await ResourcePermissionGrantRepository.GetListAsync(names, resourceName, resourceKey, providerName, providerKey);

		foreach (var permissionName in names)
		{
		var isGrant = resourcePermissionGrants.Any(x => x.Name == permissionName);
		multiplePermissionValueProviderGrantInfo.Result[permissionName] = new PermissionValueProviderGrantInfo(isGrant, providerKey);
		}

		return multiplePermissionValueProviderGrantInfo;
		}
		}

		public virtual Task SetAsync(string name, string resourceName,string resourceKey, string providerKey, bool isGranted)
		{
		return isGranted
		? GrantAsync(name, resourceName, resourceKey, providerKey)
		: RevokeAsync(name, resourceName, resourceKey, providerKey);
		}

		protected virtual async Task GrantAsync(string name, string resourceName, string resourceKey, string providerKey)
		{
		var resourcePermissionGrants = await ResourcePermissionGrantRepository.FindAsync(name, resourceName, resourceKey, Name, providerKey);
		if (resourcePermissionGrants != null)
		{
		return;
		}

		resourcePermissionGrants = new ResourcePermissionGrant(GuidGenerator.Create(), name, resourceName, resourceKey, Name, providerKey, CurrentTenant.Id);
		await ResourcePermissionGrantRepository.InsertAsync(resourcePermissionGrants, true);
		}

		protected virtual async Task RevokeAsync(string name, string resourceName,string resourceKey, string providerKey)
		{
		var resourcePermissionGrants = await ResourcePermissionGrantRepository.FindAsync(name, resourceName, resourceKey, Name, providerKey);
		if (resourcePermissionGrants == null)
		{
		return;
		}

		await ResourcePermissionGrantRepository.DeleteAsync(resourcePermissionGrants, true);
		}
		}