Feature/ab#34582 tighten api security

applications/Unity.GrantManager/common.props

@@ -9,6 +9,7 @@
   <Target Name="NoWarnOnRazorViewImportedTypeConflicts" BeforeTargets="RazorCoreCompile">
     <PropertyGroup>
       <NoWarn>$(NoWarn);0436</NoWarn>
+      <NoWarn>$(NoWarn);NU1510</NoWarn>
     </PropertyGroup>
   </Target>
 
@@ -24,7 +25,7 @@
     <!-- System.Security.Cryptography.Xml 8.0.2 (pulled in transitively) has several known high
          severity vulnerabilities; pin to the same patched version already used directly by
          Unity.AI.Application so every project importing common.props gets the safe version. -->
-    <PackageReference Include="System.Security.Cryptography.Xml" Version="10.0.10" />
+    <PackageReference Include="System.Security.Cryptography.Xml" Version="10.0.13" />
   </ItemGroup>
 
 </Project>

applications/Unity.GrantManager/global.json

@@ -0,0 +1,7 @@
+{
+  "sdk": {
+    "version": "10.0.303",
+    "rollForward": "latestPatch",
+    "allowPrerelease": false
+  }
+}

applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Application/Unity.AI.Application.csproj

@@ -1,4 +1,4 @@
-<Project Sdk="Microsoft.NET.Sdk">
+<Project Sdk="Microsoft.NET.Sdk">
   <Import Project="..\..\common.props" />
   <PropertyGroup>
     <TargetFramework>net10.0</TargetFramework>
@@ -10,7 +10,7 @@
     <PackageReference Include="Azure.AI.OpenAI" Version="2.1.0" />
     <PackageReference Include="Newtonsoft.Json" Version="13.0.4" />
     <PackageReference Include="NPOI" Version="2.7.5" />
-    <PackageReference Include="SixLabors.ImageSharp" Version="2.1.13" />
+    <PackageReference Include="SixLabors.ImageSharp" Version="4.1.2" />
     <PackageReference Include="PdfPig" Version="0.1.15" />
     <PackageReference Include="Volo.Abp.AspNetCore.Mvc" Version="10.5.0" />
     <PackageReference Include="Volo.Abp.Mapperly" Version="10.5.0" />

applications/Unity.GrantManager/modules/Unity.Flex/src/Unity.Flex.Web/Pages/Components/DataGrid/DataGridWriteService.cs

@@ -279,7 +279,7 @@ internal async Task<WriteDataRowResponse> UpdateRowAsync(RowInputData rowInputDa
             };
         }
 
-        internal async Task DeleteRowAsync(Guid valueId, uint row, Guid worksheetInstanceId)
+        public async Task DeleteRowAsync(Guid valueId, uint row, Guid worksheetInstanceId)
         {
             var currentValue = await customFieldValueAppService.GetAsync(valueId);
             var dataGridValue = DataGridServiceUtils.DeserializeDataGridValue(currentValue.CurrentValue);

applications/Unity.GrantManager/modules/Unity.Flex/src/Unity.Flex.Web/Views/Shared/Components/QuestionSelectListWidget/QuestionSelectListViewModel.cs

@@ -7,7 +7,7 @@ public class QuestionSelectListViewModel : RequiredFieldViewModel
         public Guid QuestionId { get; set; }
         public bool IsDisabled { get; set; }
         public string Answer { get; set; } = string.Empty;
-        public string Definition { get; set; } = "{}";
+        public new string Definition { get; set; } = "{}";
         public bool IsHumanConfirmed { get; set; } = true;
         public string? AICitation { get; set; }
         public int? AIConfidence { get; set; }

applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Application/Templates/TemplatesService.cs

@@ -1,38 +1,37 @@
-using System;
+using System;
 using System.Collections.Generic;
 using System.Linq;
 using System.Threading.Tasks;
 using Microsoft.AspNetCore.Authorization;
+using Microsoft.EntityFrameworkCore;
 using Volo.Abp.Application.Services;
 using Volo.Abp.DependencyInjection;
 using Volo.Abp.MultiTenancy;
+using Volo.Abp.Uow;
+using Unity.Notifications.Permissions;
 
 namespace Unity.Notifications.Templates;
 
 
 [Dependency(ReplaceServices = false)]
 [ExposeServices(typeof(TemplateService), typeof(ITemplateService))]
-public class TemplateService : ApplicationService, ITemplateService
+public class TemplateService(
+     ITemplatesRepository templatesRepository,
+     ICurrentTenant currentTenant,
+     ITemplateVariablesRepository templateVariablesRepository,
+     IUnitOfWorkManager unitOfWorkManager,
+     Volo.Abp.Domain.Repositories.IRepository<GrantManager.Notifications.ScheduledNotification, Guid> scheduledNotificationsRepository
+
+        ) : ApplicationService, ITemplateService
 {
 
-    private readonly ITemplatesRepository _templatesRepository;
-    private readonly ICurrentTenant _currentTenant;
-    private readonly ITemplateVariablesRepository _templateVariablesRepository;
+    private readonly ITemplatesRepository _templatesRepository = templatesRepository;
+    private readonly ICurrentTenant _currentTenant = currentTenant;
+    private readonly ITemplateVariablesRepository _templateVariablesRepository = templateVariablesRepository;
+    private readonly IUnitOfWorkManager _unitOfWorkManager = unitOfWorkManager;
+    private readonly Volo.Abp.Domain.Repositories.IRepository<GrantManager.Notifications.ScheduledNotification, Guid> _scheduledNotificationsRepository = scheduledNotificationsRepository;
 
-
-    public TemplateService(
-         ITemplatesRepository templatesRepository,
-        ICurrentTenant currentTenant,
-         ITemplateVariablesRepository templateVariablesRepository
-
-        )
-    {
-        _templatesRepository = templatesRepository;
-        _currentTenant = currentTenant;
-        _templateVariablesRepository = templateVariablesRepository;
-    }
-
-    [Authorize]
+    [Authorize(NotificationsPermissions.Email.Default)]
     public async Task<EmailTemplate?> CreateAsync(EmailTempateDto templateDto)
     {
         var templateType = NormalizeTemplateType(templateDto.TemplateType);
@@ -51,16 +50,16 @@ ITemplateVariablesRepository templateVariablesRepository
             templateType));
     }
 
-    [Authorize]
+    [Authorize(NotificationsPermissions.Email.Send)]
     public async Task<EmailTemplate?> UpdateTemplate(Guid id, EmailTempateDto templateDto)
     {
-        
+
         EmailTemplate template = await _templatesRepository.GetAsync(id);
 
         template.Description = templateDto.Description;
         template.Subject = templateDto.Subject;
         template.BodyText = templateDto.BodyText;
-        template.BodyHTML = templateDto.BodyHTML != null ? templateDto.BodyHTML : "";
+        template.BodyHTML = templateDto.BodyHTML ?? "";
         template.Name = templateDto.Name;
         template.SendFrom = templateDto.SendFrom;
         template.RecipientCategory = templateDto.RecipientCategory;
@@ -72,31 +71,46 @@ ITemplateVariablesRepository templateVariablesRepository
         return updatedTemplate;
     }
 
-    [Authorize]
+    [Authorize(NotificationsPermissions.Email.Default)]
     public async Task<List<EmailTemplate>> GetTemplatesByTenant()
     {
         var tenentId = _currentTenant.Id;
         return await _templatesRepository.GetByTenentIdAsync(tenentId);
     }
-    [Authorize]
+
+    // Shared lookup endpoint: accessible to anyone with email/notification access (lookup, schedule, send)
+    [Authorize(NotificationsPermissions.Email.Default)]
     public async Task<EmailTemplate?> GetTemplateById(Guid id)
     {
         return await _templatesRepository.GetAsync(id);
     }
 
-    [Authorize]
+    [Authorize(NotificationsPermissions.Email.Send)]
     public async Task DeleteTemplate(Guid id)
     {
-        await _templatesRepository.DeleteAsync(id);
+        using var uow = _unitOfWorkManager.Begin(requiresNew: true, isTransactional: true);
+        var template = await _templatesRepository.LockActiveAsync(id)
+            ?? throw new Volo.Abp.Domain.Entities.EntityNotFoundException(typeof(EmailTemplate), id);
+
+        var scheduledQuery = await _scheduledNotificationsRepository.GetQueryableAsync();
+        var inUse = await scheduledQuery.AnyAsync(x => x.EmailTemplateId == id);
+        if (inUse)
+        {
+            throw new Volo.Abp.BusinessException("Notifications:TemplateInUse", "Template is referenced by scheduled notifications and cannot be deleted.");
+        }
+
+        await _templatesRepository.DeleteAsync(template);
+        await uow.CompleteAsync();
     }
-    [Authorize]
+    [Authorize(NotificationsPermissions.Email.Send)]
     public async Task<EmailTemplate?> GetTemplateByName(string name)
     {
         var data =  await _templatesRepository.GetByNameAsync(name);
         return data;
-    } 
-
-    [Authorize]
+    }
+
+    // Shared lookup endpoint: accessible to anyone with email/notification access
+    [Authorize(NotificationsPermissions.Email.Default)]
     public Task<List<string>> GetTemplateTypes()
     {
         return Task.FromResult(new List<string>
@@ -106,15 +120,15 @@ public Task<List<string>> GetTemplateTypes()
         });
     }
 
-    [Authorize]
+    // Shared lookup endpoint: accessible to anyone with email/notification access (forms, templates, scheduling)
+    [Authorize(NotificationsPermissions.Email.Default)]
     public async Task<List<TemplateVariable>> GetTemplateVariables(string? templateType = null)
     {
         var selectedType = NormalizeTemplateType(templateType);
         var templateVariables = await _templateVariablesRepository.GetQueryableAsync();
-        return templateVariables
+        return [.. templateVariables
             .Where(x => x.TemplateType == selectedType)
-            .OrderBy(x => x.Name)
-            .ToList();
+            .OrderBy(x => x.Name)];
     }
 
     private static string NormalizeTemplateType(string? templateType)

applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Domain/Templates/ITemplatesRepository.cs

@@ -8,6 +8,7 @@ namespace Unity.Notifications.Templates
     public interface ITemplatesRepository : IBasicRepository<EmailTemplate, Guid>
     {
         Task<EmailTemplate?> GetByIdAsync(Guid id, bool includeDetails = false);
+        Task<EmailTemplate?> LockActiveAsync(Guid id);
         Task<List<EmailTemplate>> GetByTenentIdAsync(Guid? tenentId);
         Task<EmailTemplate?> GetByNameAsync(string name);
     }

applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.EntityFrameworkCore/EntityFrameworkCore/NotificationsDbContextModelCreatingExtensions.cs

@@ -147,7 +147,7 @@ public static void ConfigureNotifications(
             b.ConfigureByConvention();
             b.Property(x => x.TemplateType)
                 .HasMaxLength(64)
-                .HasDefaultValue(TemplateTypes.Applicant)
+                .HasDefaultValue(TemplateTypes.Application)
                 .IsRequired();
         });
         modelBuilder.Entity<EmailGroup>(b =>

applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.EntityFrameworkCore/Repositories/TemplatesRepository.cs

@@ -13,18 +13,40 @@
 
 namespace Unity.Notifications.Repositories
 {
-    public class TemplatesRepository : EfCoreRepository<NotificationsDbContext,EmailTemplate, Guid>, ITemplatesRepository
+    public class TemplatesRepository(IDbContextProvider<NotificationsDbContext> dbContextProvider) : EfCoreRepository<NotificationsDbContext,EmailTemplate, Guid>(dbContextProvider), ITemplatesRepository
     {
-        public TemplatesRepository(IDbContextProvider<NotificationsDbContext> dbContextProvider) : base(dbContextProvider)
-        {
-        }
-
         public async Task<EmailTemplate?> GetByIdAsync(Guid id, bool includeDetails = false)
         {
             var dbSet = await GetDbSetAsync();
             return await dbSet.FirstOrDefaultAsync(s => s.Id == id);
         }
 
+        public async Task<EmailTemplate?> LockActiveAsync(Guid id)
+        {
+            var dbContext = await GetDbContextAsync();
+            if (dbContext.Database.ProviderName == "Npgsql.EntityFrameworkCore.PostgreSQL")
+            {
+                if (dbContext.Database.CurrentTransaction == null)
+                {
+                    throw new InvalidOperationException("Template row locking requires a database transaction.");
+                }
+
+                return await dbContext.EmailTemplates
+                    .FromSqlInterpolated($"""SELECT * FROM "Notifications"."EmailTemplates" WHERE "Id" = {id} FOR UPDATE""")
+                    .SingleOrDefaultAsync();
+            }
+
+            if (dbContext.Database.ProviderName == "Microsoft.EntityFrameworkCore.Sqlite")
+            {
+                // SQLite has no SELECT FOR UPDATE; a write serializes access inside a transaction.
+                await dbContext.Database.ExecuteSqlInterpolatedAsync(
+                    $"""UPDATE "EmailTemplates" SET "IsDeleted" = "IsDeleted" WHERE "Id" = {id}""");
+                return await dbContext.EmailTemplates.SingleOrDefaultAsync(x => x.Id == id);
+            }
+
+            throw new NotSupportedException("Template row locking requires PostgreSQL or SQLite.");
+        }
+
         public async Task<List<EmailTemplate>> GetByTenentIdAsync(Guid? tenentId)
         {
             var dbSet = await GetDbSetAsync();

applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Web/Pages/Notifications/Index.js

@@ -247,7 +247,7 @@ $(function () {
         setDateRangeFilters(selectedRange, range);
         setDateRangeLocalStorage(selectedRange, range);
         updateDateInputsVisibility();
-        notificationsTable.ajax.reload(null, true);
+        dataTable.ajax.reload(null, true);
     }
 
     function handleInputFilterChange() {
@@ -261,8 +261,7 @@ $(function () {
         localStorage.setItem(STORAGE_KEYS.quickRange, 'custom');
         localStorage.setItem(STORAGE_KEYS.fromDate, notificationTableFilters.dateFrom || '');
         localStorage.setItem(STORAGE_KEYS.toDate, notificationTableFilters.dateTo || '');
-
-        notificationsTable.ajax.reload(null, true);
+        dataTable.ajax.reload(null, true);
     }
 
     function setDateRangeFilters(quickDateRange, range) {

applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Web/Views/Settings/NotificationsSettingGroup/Default.js

@@ -844,10 +844,8 @@ $(function () {
     }
 
     function handleDeleteCanCheckError(templateId) {
-        // If check fails, proceed with deletion
-        proceedWithDelete(templateId, function () {
-            PubSub.publish('reload_templates_table_with_close');
-        });
+        // If check fails, do not proceed with deletion. Let the user know the preflight check failed.
+        abp.notify.error('Unable to verify whether this template can be safely deleted. Deletion has been cancelled.');
     }
 
     function checkCanDeleteTemplate(templateId) {

applications/Unity.GrantManager/modules/Unity.Notifications/test/Unity.Notifications.Application.Tests/ScheduledNotificationHelperTests.cs

@@ -63,6 +63,35 @@ public void BuildTokenValues_ForApplicationTemplate_PreservesApplicationValues()
         values["unity_application_id"].ShouldBe("UNITY-456");
     }
 
+    [Fact]
+    public void BuildTokenValues_ForDeclinedApplication_MapsDisplayDeclineRationale()
+    {
+        var application = new Application
+        {
+            Applicant = new Applicant { ApplicantName = "VelangTest2", OrgName = "DEC DESIGN" },
+            ApplicationStatus = new ApplicationStatus { InternalStatus = "Declined" },
+            ApplicationForm = new ApplicationForm { Category = "Community" },
+            ReferenceNo = "SUB-123",
+            DeclineRational = "INELIGIBLE_PROJECT",
+            ProjectName = "Test project",
+            RequestedAmount = 1000m,
+            UnityApplicationId = "UNITY-123"
+        };
+        var applicantAgent = new ApplicantAgent { Name = "Test Contact", Title = "Director" };
+
+        var values = ScheduledNotificationHelper.BuildTokenValues(application, applicantAgent);
+
+        values["applicant_name"].ShouldBe("VelangTest2");
+        values["organization_name"].ShouldBe("DEC DESIGN");
+        values["decline_rationale"].ShouldBe("Ineligible Project");
+        values["status"].ShouldBe("Declined");
+        values["contact_full_name"].ShouldBe("Test Contact");
+        values["contact_title"].ShouldBe("Director");
+        values["category"].ShouldBe("Community");
+        values["submission_number"].ShouldBe("SUB-123");
+        values["unity_application_id"].ShouldBe("UNITY-123");
+    }
+
     [Fact]
     public void BuildTokenValues_ForApplicantTemplate_RendersMissingOptionalValuesAsEmpty()
     {

applications/Unity.GrantManager/modules/Unity.Notifications/test/Unity.Notifications.Application.Tests/TemplatesServiceTests.cs

@@ -1,4 +1,4 @@
-using System.Collections.Generic;
+using System.Collections.Generic;
 using System.Linq;
 using System.Threading.Tasks;
 using NSubstitute;
@@ -52,6 +52,8 @@ private static TemplateService CreateService(IEnumerable<TemplateVariable> varia
         return new TemplateService(
             Substitute.For<ITemplatesRepository>(),
             Substitute.For<ICurrentTenant>(),
-            variablesRepository);
+            variablesRepository,
+            Substitute.For<Volo.Abp.Uow.IUnitOfWorkManager>(),
+Substitute.For<Volo.Abp.Domain.Repositories.IRepository<Unity.GrantManager.Notifications.ScheduledNotification, System.Guid>>());
     }
 }