Make the store scope explicit on the category, brand and collection lists

src/Business/Grand.Business.Catalog/Services/Brands/BrandService.cs

@@ -57,8 +57,8 @@ public BrandService(ICacheBase cacheBase,
     /// <param name="pageSize">Page size</param>
     /// <param name="showHidden">A value that indicates if it should shows hidden records</param>
     /// <returns>Brands</returns>
-    public virtual async Task<IPagedList<Brand>> GetAllBrands(string brandName = "",
-        string storeId = "",
+    public virtual async Task<IPagedList<Brand>> GetAllBrands(string brandName,
+        string storeId,
         int pageIndex = 0,
         int pageSize = int.MaxValue,
         bool showHidden = false)

src/Business/Grand.Business.Catalog/Services/Categories/CategoryService.cs

@@ -74,8 +74,8 @@ public CategoryService(ICacheBase cacheBase,
     /// <param name="pageSize">Page size</param>
     /// <param name="showHidden">A value that indicates if it should shows hidden records</param>
     /// <returns>Categories</returns>
-    public virtual async Task<IPagedList<Category>> GetAllCategories(string parentId = null, string categoryName = "",
-        string storeId = "",
+    public virtual async Task<IPagedList<Category>> GetAllCategories(string parentId, string categoryName,
+        string storeId,
         int pageIndex = 0, int pageSize = int.MaxValue, bool showHidden = false)
     {
         var query = from c in _categoryRepository.Table

src/Business/Grand.Business.Catalog/Services/Collections/CollectionService.cs

@@ -61,8 +61,8 @@ public CollectionService(ICacheBase cacheBase,
     /// <param name="pageSize">Page size</param>
     /// <param name="showHidden">A value that indicates if it should shows hidden records</param>
     /// <returns>Collections</returns>
-    public virtual async Task<IPagedList<Collection>> GetAllCollections(string collectionName = "",
-        string storeId = "",
+    public virtual async Task<IPagedList<Collection>> GetAllCollections(string collectionName,
+        string storeId,
         int pageIndex = 0,
         int pageSize = int.MaxValue,
         bool showHidden = false)

src/Business/Grand.Business.Core/Interfaces/Catalog/Brands/IBrandService.cs

@@ -17,8 +17,8 @@ public interface IBrandService
     /// <param name="pageSize">Page size</param>
     /// <param name="showHidden">A value that indicates if it should shows hidden records</param>
     /// <returns>Brands</returns>
-    Task<IPagedList<Brand>> GetAllBrands(string brandName = "",
-        string storeId = "",
+    Task<IPagedList<Brand>> GetAllBrands(string brandName,
+        string storeId,
         int pageIndex = 0,
         int pageSize = int.MaxValue,
         bool showHidden = false);

src/Business/Grand.Business.Core/Interfaces/Catalog/Categories/ICategoryService.cs

@@ -15,7 +15,7 @@ public interface ICategoryService
     /// <param name="pageSize">Page size</param>
     /// <param name="showHidden">A value that indicates if it should shows hidden records</param>
     /// <returns>Categories</returns>
-    Task<IPagedList<Category>> GetAllCategories(string parentId = null, string categoryName = "", string storeId = "",
+    Task<IPagedList<Category>> GetAllCategories(string parentId, string categoryName, string storeId,
         int pageIndex = 0, int pageSize = int.MaxValue, bool showHidden = false);
 
     /// <summary>

src/Business/Grand.Business.Core/Interfaces/Catalog/Collections/ICollectionService.cs

@@ -17,8 +17,8 @@ public interface ICollectionService
     /// <param name="pageSize">Page size</param>
     /// <param name="showHidden">A value that indicates if it should shows hidden records</param>
     /// <returns>Collections</returns>
-    Task<IPagedList<Collection>> GetAllCollections(string collectionName = "",
-        string storeId = "",
+    Task<IPagedList<Collection>> GetAllCollections(string collectionName,
+        string storeId,
         int pageIndex = 0,
         int pageSize = int.MaxValue,
         bool showHidden = false);

src/Business/Grand.Business.Messages/Commands/Handlers/Common/GetSitemapXMLCommandHandler.cs

@@ -231,7 +231,7 @@ private async Task<IEnumerable<SitemapUrl>> GetCategoryUrls(string parentCategor
 
     private async Task<IEnumerable<SitemapUrl>> GetBrandUrls(Language language, Store store)
     {
-        var brands = await _brandService.GetAllBrands(storeId: store.Id);
+        var brands = await _brandService.GetAllBrands(brandName: "", storeId: store.Id);
         var brandUrls = new List<SitemapUrl>();
         var storeLocation = GetStoreLocation();
         foreach (var brand in brands)

src/Tests/Grand.Business.Catalog.Tests/Services/Brands/BrandServiceTests.cs

@@ -47,7 +47,7 @@ public async Task GetAllBrandsTest()
         await _brandService.InsertBrand(new Brand { Published = true });
 
         //Act
-        var brand = await _brandService.GetAllBrands();
+        var brand = await _brandService.GetAllBrands(brandName: "", storeId: "");
 
         //Assert
         Assert.HasCount(3, brand);

src/Tests/Grand.Business.Catalog.Tests/Services/Categories/CategoryServiceDbTests.cs

@@ -106,7 +106,7 @@ public async Task GetAllCategories()
     {
         var allCategory = GetMockCategoryList();
         allCategory.ToList().ForEach(x => _categoryService.InsertCategory(x).GetAwaiter().GetResult());
-        var result = await _categoryService.GetAllCategories();
+        var result = await _categoryService.GetAllCategories(parentId: null, categoryName: "", storeId: "");
         Assert.HasCount(5, result);
     }
 

src/Tests/Grand.Business.Common.Tests/Services/Security/AclServiceTest.cs

@@ -42,4 +42,22 @@ public void Authorize_ReturnTrue()
         _accessControlConfig.IgnoreStoreLimitations = true;
         Assert.IsTrue(_aclService.Authorize(product, "id"));
     }
+
+    /// <summary>
+    ///     Pins the fail-open: an empty store grants access even to an entity that is limited to other
+    ///     stores. Callers therefore carry the whole burden of supplying the store - which is why the
+    ///     list services no longer default that argument away.
+    /// </summary>
+    [TestMethod]
+    public void Authorize_WithoutAStore_GrantsAccessToAnEntityLimitedToOtherStores()
+    {
+        var product = new Product {
+            LimitedToStores = true,
+            Stores = { "another-store" }
+        };
+
+        Assert.IsFalse(_aclService.Authorize(product, "this-store"), "the store is not among the entity's stores");
+        Assert.IsTrue(_aclService.Authorize(product, ""), "fail-open: no store means no check");
+        Assert.IsTrue(_aclService.Authorize(product, (string)null), "fail-open: no store means no check");
+    }
 }

src/Tests/Grand.Web.Admin.Tests/Extensions/AclMappingExtensionTests.cs

@@ -0,0 +1,58 @@
+using Grand.Domain.Catalog;
+using Grand.Web.AdminShared.Extensions;
+using Microsoft.VisualStudio.TestTools.UnitTesting;
+using Assert = Microsoft.VisualStudio.TestTools.UnitTesting.Assert;
+
+namespace Grand.Web.Admin.Tests.Extensions;
+
+[TestClass]
+public class AclMappingExtensionTests
+{
+    /// <summary>
+    ///     Pins the fail-open: an empty store grants access even to an entity limited to another store.
+    /// </summary>
+    [TestMethod]
+    public void AccessToEntityByStore_WithoutAStore_GrantsAccessToAnEntityLimitedToOtherStores()
+    {
+        var product = new Product {
+            LimitedToStores = true,
+            Stores = { "another-store" }
+        };
+
+        Assert.IsFalse(product.AccessToEntityByStore("this-store"));
+        Assert.IsTrue(product.AccessToEntityByStore(""), "fail-open: no store means no check");
+    }
+
+    /// <summary>
+    ///     This check is stricter than AclService.Authorize on the same-sounding question: an entity
+    ///     shared with a second store is refused here, while AclService grants it. Anyone reaching for
+    ///     "does this store own the entity" has to pick deliberately between the two.
+    /// </summary>
+    [TestMethod]
+    public void AccessToEntityByStore_RefusesAnEntitySharedWithASecondStore()
+    {
+        var product = new Product {
+            LimitedToStores = true,
+            Stores = { "this-store", "another-store" }
+        };
+
+        Assert.IsFalse(product.AccessToEntityByStore("this-store"));
+    }
+
+    [TestMethod]
+    public void AccessToEntityByStore_AcceptsAnEntityOwnedByThatStoreAlone()
+    {
+        var product = new Product {
+            LimitedToStores = true,
+            Stores = { "this-store" }
+        };
+
+        Assert.IsTrue(product.AccessToEntityByStore("this-store"));
+    }
+
+    [TestMethod]
+    public void AccessToEntityByStore_RefusesAMissingEntity()
+    {
+        Assert.IsFalse(((Product)null).AccessToEntityByStore("this-store"));
+    }
+}

src/Web/Grand.Web.Admin/Controllers/BrandController.cs

@@ -273,7 +273,7 @@ public async Task<IActionResult> ExportXlsx([FromServices] IExportManager<Brand>
     {
         try
         {
-            var bytes = await exportManager.Export(await _brandService.GetAllBrands(showHidden: true));
+            var bytes = await exportManager.Export(await _brandService.GetAllBrands(brandName: "", storeId: "", showHidden: true));
             return File(bytes, "text/xls", "brands.xlsx");
         }
         catch (Exception exc)

src/Web/Grand.Web.Admin/Controllers/CategoryController.cs

@@ -230,7 +230,7 @@ public async Task<IActionResult> ExportXlsx([FromServices] IExportManager<Catego
     {
         try
         {
-            var bytes = await exportManager.Export(await _categoryService.GetAllCategories(showHidden: true));
+            var bytes = await exportManager.Export(await _categoryService.GetAllCategories(parentId: null, categoryName: "", storeId: "", showHidden: true));
             return File(bytes, "text/xls", "categories.xlsx");
         }
         catch (Exception exc)

src/Web/Grand.Web.Admin/Controllers/CollectionController.cs

@@ -268,7 +268,7 @@ public async Task<IActionResult> ExportXlsx([FromServices] IExportManager<Collec
     {
         try
         {
-            var bytes = await exportManager.Export(await _collectionService.GetAllCollections(showHidden: true));
+            var bytes = await exportManager.Export(await _collectionService.GetAllCollections(collectionName: "", storeId: "", showHidden: true));
             return File(bytes, "text/xls", "collections.xlsx");
         }
         catch (Exception exc)

src/Web/Grand.Web.Admin/Controllers/DiscountController.cs

@@ -513,7 +513,7 @@ public IActionResult CategoryAddPopup(string discountId)
     public async Task<IActionResult> CategoryAddPopupList(DataSourceRequest command,
         DiscountModel.AddCategoryToDiscountModel model, [FromServices] ICategoryService categoryService)
     {
-        var categories = await categoryService.GetAllCategories(categoryName: model.SearchCategoryName,
+        var categories = await categoryService.GetAllCategories(parentId: null, categoryName: model.SearchCategoryName, storeId: "",
             pageIndex: command.Page - 1, pageSize: command.PageSize, showHidden: true);
         var items = new List<CategoryModel>();
         foreach (var item in categories)

src/Web/Grand.Web.Admin/Controllers/SearchController.cs

@@ -90,7 +90,7 @@ public async Task<IActionResult> Index(string searchTerm, FoundMenuItem[] foundM
 
             if (result.Count < _adminSearchSettings.MaxSearchResultsCount && _adminSearchSettings.SearchInCategories)
             {
-                var categories = await _categoryService.GetAllCategories(categoryName: searchTerm,
+                var categories = await _categoryService.GetAllCategories(parentId: null, categoryName: searchTerm, storeId: "",
                     pageSize: _adminSearchSettings.MaxSearchResultsCount - result.Count, showHidden:
                     await _groupService.IsAdmin(_contextAccessor.WorkContext.CurrentCustomer));
                 foreach (var category in categories)
@@ -104,7 +104,7 @@ public async Task<IActionResult> Index(string searchTerm, FoundMenuItem[] foundM
 
             if (result.Count < _adminSearchSettings.MaxSearchResultsCount && _adminSearchSettings.SearchInCollections)
             {
-                var collections = await _collectionService.GetAllCollections(searchTerm,
+                var collections = await _collectionService.GetAllCollections(searchTerm, storeId: "",
                     pageSize: _adminSearchSettings.MaxSearchResultsCount - result.Count, showHidden: true);
                 foreach (var collection in collections)
                     result.Add(new Tuple<object, int>(new
@@ -300,6 +300,7 @@ public async Task<IActionResult> Brand(string brandId, DataSourceRequestFilter m
     {
         var brands = await _brandService.GetAllBrands(
             model.GetNameFilterValue(),
+            storeId: "",
             pageSize: _adminSearchSettings.BrandSizeLimit);
 
         var gridModel = await DataSourceResultHelper.GetSearchResult(brandId, brands, brand => Task.FromResult(brand.Name));

src/Web/Grand.Web.AdminShared/Services/CategoryViewModelService.cs

@@ -76,6 +76,7 @@ public virtual async Task<CategoryListModel> PrepareCategoryListModel(string sto
         CategoryListModel model, int pageIndex, int pageSize)
     {
         var categories = await _categoryService.GetAllCategories(
+            parentId: null,
             categoryName: model.SearchCategoryName,
             storeId: model.SearchStoreId,
             pageSize: pageSize,

src/Web/Grand.Web.AdminShared/Services/CollectionViewModelService.cs

@@ -181,7 +181,8 @@ public virtual async Task DeleteCollection(Collection collection)
         //collections
         model.AvailableCollections.Add(new SelectListItem
             { Text = _translationService.GetResource("Admin.Common.All"), Value = " " });
-        foreach (var m in await _collectionService.GetAllCollections(showHidden: true))
+        foreach (var m in await _collectionService.GetAllCollections(collectionName: "", storeId: "",
+                     showHidden: true))
             model.AvailableCollections.Add(new SelectListItem { Text = m.Name, Value = m.Id });
 
         //stores

src/Web/Grand.Web.Store/Controllers/DiscountController.cs

@@ -1,4 +1,4 @@
-using Grand.Business.Core.Interfaces.Catalog.Brands;
+using Grand.Business.Core.Interfaces.Catalog.Brands;
 using Grand.Business.Core.Interfaces.Catalog.Categories;
 using Grand.Business.Core.Interfaces.Catalog.Collections;
 using Grand.Business.Core.Interfaces.Catalog.Discounts;
@@ -515,7 +515,7 @@ public IActionResult CategoryAddPopup(string discountId)
     public async Task<IActionResult> CategoryAddPopupList(DataSourceRequest command,
         DiscountModel.AddCategoryToDiscountModel model, [FromServices] ICategoryService categoryService)
     {
-        var categories = await categoryService.GetAllCategories(categoryName: model.SearchCategoryName,
+        var categories = await categoryService.GetAllCategories(parentId: null, categoryName: model.SearchCategoryName,
             storeId: CurrentStoreId, pageIndex: command.Page - 1, pageSize: command.PageSize, showHidden: true);
         var items = new List<CategoryModel>();
         foreach (var item in categories)

src/Web/Grand.Web/Features/Handlers/Catalog/GetBrandAllHandler.cs

@@ -47,7 +47,7 @@ private async Task<List<BrandModel>> PrepareBrands(GetBrandAll request, BrandLis
             request.Command.PageSize = _catalogSettings.MaxCatalogPageSize;
 
         var model = new List<BrandModel>();
-        var brands = await _brandService.GetAllBrands(storeId: request.Store.Id,
+        var brands = await _brandService.GetAllBrands(brandName: "", storeId: request.Store.Id,
             pageIndex: request.Command.PageNumber - 1,
             pageSize: request.Command.PageSize
         );

src/Web/Grand.Web/Features/Handlers/Catalog/GetCategoryAllHandler.cs

@@ -48,7 +48,7 @@ private async Task<List<CategoryModel>> PrepareCategories(GetCategoryAll request
             request.Command.PageSize = _catalogSettings.MaxCatalogPageSize;
 
         var model = new List<CategoryModel>();
-        var categories = await _categoryService.GetAllCategories(storeId: request.Store.Id,
+        var categories = await _categoryService.GetAllCategories(parentId: null, categoryName: "", storeId: request.Store.Id,
             pageIndex: request.Command.PageNumber - 1,
             pageSize: request.Command.PageSize
         );

src/Web/Grand.Web/Features/Handlers/Catalog/GetCategorySimpleHandler.cs

@@ -65,7 +65,7 @@ private async Task<List<CategorySimpleModel>> PrepareCategorySimpleModels(GetCat
 
             async Task PrepareCategories(string categoryId)
             {
-                var parentCategories = await _categoryService.GetAllCategories(categoryId, storeId: request.Store.Id);
+                var parentCategories = await _categoryService.GetAllCategories(categoryId, categoryName: "", storeId: request.Store.Id);
                 if (parentCategories.Any())
                 {
                     categories.AddRange(parentCategories);
@@ -79,7 +79,7 @@ async Task PrepareCategories(string categoryId)
             if (currentCategory != null)
             {
                 var currentCategories =
-                    await _categoryService.GetAllCategories(currentCategory.Id, storeId: request.Store.Id);
+                    await _categoryService.GetAllCategories(currentCategory.Id, categoryName: "", storeId: request.Store.Id);
                 categories.AddRange(currentCategories);
                 await PrepareCategories(currentCategory.ParentCategoryId);
             }

src/Web/Grand.Web/Features/Handlers/Catalog/GetCollectionAllHandler.cs

@@ -48,7 +48,7 @@ private async Task<List<CollectionModel>> PrepareCollectionAll(GetCollectionAll
             request.Command.PageSize = _catalogSettings.MaxCatalogPageSize;
 
         var model = new List<CollectionModel>();
-        var collections = await _collectionService.GetAllCollections(storeId: request.Store.Id,
+        var collections = await _collectionService.GetAllCollections(collectionName: "", storeId: request.Store.Id,
             pageIndex: request.Command.PageNumber - 1,
             pageSize: request.Command.PageSize);
 

src/Web/Grand.Web/Features/Handlers/Catalog/GetCollectionNavigationHandler.cs

@@ -35,7 +35,7 @@ public async Task<CollectionNavigationModel> Handle(GetCollectionNavigation requ
         {
             var currentCollection = await _collectionService.GetCollectionById(request.CurrentCollectionId);
             var collections =
-                await _collectionService.GetAllCollections(pageSize: _catalogSettings.CollectionsBlockItemsToDisplay,
+                await _collectionService.GetAllCollections(collectionName: "", pageSize: _catalogSettings.CollectionsBlockItemsToDisplay,
                     storeId: request.Store.Id);
             var model = new CollectionNavigationModel {
                 TotalCollections = collections.TotalCount

src/Web/Grand.Web/Features/Handlers/Catalog/GetHomepageBrandsHandler.cs

@@ -41,7 +41,7 @@ public async Task<IList<BrandModel>> Handle(GetHomepageBrands request, Cancellat
         var model = await _cacheBase.GetAsync(brandsCacheKey, async () =>
         {
             var modelBrands = new List<BrandModel>();
-            var allBrands = await _brandService.GetAllBrands(storeId: request.Store.Id);
+            var allBrands = await _brandService.GetAllBrands(brandName: "", storeId: request.Store.Id);
             foreach (var x in allBrands.Where(x => x.ShowOnHomePage))
             {
                 var brandModel = x.ToModel(request.Language);

src/Web/Grand.Web/Features/Handlers/Catalog/GetHomepageCollectionsHandler.cs

@@ -43,7 +43,7 @@ public async Task<IList<CollectionModel>> Handle(GetHomepageCollections request,
         var model = await _cacheBase.GetAsync(collectionsCacheKey, async () =>
         {
             var modelCollect = new List<CollectionModel>();
-            var allcollections = await _collectionService.GetAllCollections(storeId: request.Store.Id);
+            var allcollections = await _collectionService.GetAllCollections(collectionName: "", storeId: request.Store.Id);
             foreach (var x in allcollections.Where(x => x.ShowOnHomePage))
             {
                 var _model = x.ToModel(request.Language);

src/Web/Grand.Web/Features/Handlers/Catalog/GetMenuHandler.cs

@@ -79,7 +79,7 @@ public async Task<MenuModel> Handle(GetMenu request, CancellationToken cancellat
             request.Language.Id, request.Store.Id);
 
         var cachedBrandModel = await _cacheBase.GetAsync(brandCacheKey, async () =>
-            (await _brandService.GetAllBrands(storeId: request.Store.Id))
+            (await _brandService.GetAllBrands(brandName: "", storeId: request.Store.Id))
             .Where(x => x.IncludeInMenu)
             .Select(t => new MenuModel.MenuBrandModel {
                 Id = t.Id,
@@ -94,7 +94,7 @@ public async Task<MenuModel> Handle(GetMenu request, CancellationToken cancellat
             request.Language.Id, request.Store.Id);
 
         var cachedCollectionModel = await _cacheBase.GetAsync(collectionCacheKey, async () =>
-            (await _collectionService.GetAllCollections(storeId: request.Store.Id))
+            (await _collectionService.GetAllCollections(collectionName: "", storeId: request.Store.Id))
             .Where(x => x.IncludeInMenu)
             .Select(t => new MenuModel.MenuCollectionModel {
                 Id = t.Id,