Activities of "maliming"

Hi,

Yes, configuring AppUrlOptions is the correct and supported way to make Account email links (forgot password, email confirmation, change email, user invitation, etc.) tenant-aware. It's not a hack, and there are no hidden side effects. Your config is exactly right:

Configure<AppUrlOptions>(options =>
{
    options.Applications["MVC"].RootUrl = "https://{0}.example.com";
});

A few things worth knowing so you can rely on it with confidence:

Why the "MVC" key is correct on Blazor Server. In a Blazor Server app, the Account pages that send these emails (login / forgot-password / register) are served by server-side MVC Razor Pages. They submit the request with AppName = "MVC", and the password reset / email confirmation URLs are registered under Applications["MVC"] by default. So Applications["MVC"].RootUrl is exactly the value ABP uses to build those links.

The {0} placeholder. It's replaced with the current tenant's name. This is the same placeholder semantics used by AddDomainTenantResolver("{0}.example.com"), so as long as your subdomains map to the tenant name (the common case), the outbound email links line up perfectly with your inbound resolution. If your subdomains are based on the tenant id instead, use https://{{tenantId}}.example.com (there's also {{tenantName}} if you prefer to be explicit).

No side effect for host (no tenant). When there is no current tenant, ABP removes the {0}. part entirely, so https://{0}.example.com becomes https://example.com. Host-side links keep working.

This single setting covers all Account emails (not just password reset), so you don't need to configure them one by one.

You're right that this isn't spelled out in the docs. The closest related reference is the subdomain resolver section, which confirms the {0} = tenant name placeholder: https://abp.io/docs/latest/framework/architecture/multi-tenancy#domainsubdomain-tenant-resolver

And a runnable sample of the subdomain setup: https://github.com/abpframework/abp-samples/tree/master/DomainTenantResolver

Thanks

Hi,

No, there's no built-in "per-tenant AI Workspace" feature. AI Management is a host-level module — workspaces (and their data sources, MCP servers and indexed documents) aren't multi-tenant entities, so they're global records managed from the host and shared across tenants. This is by design, not a configuration you can switch on.

Thanks

hi

Is your problem solved? If not, you can continue sharing the logs. https://abp.io/support/questions/10659/Shared-User-Accounts---sent-email-format#answer-3a213270-a9ea-58ca-2111-9b161116c3a1

Because when I try to implement this middleware now it can bypass and the switch tenant now show as expected. But I don't know if it will cause other error

You can remove your middleware to troubleshoot the problem.

Thanks

: )

: )

Your current ticket has been refunded.

Thanks.

Hi,

Thanks for the report — we've confirmed this is a bug in ABP Studio and will ship a fix in the next release.

Thanks

Hi,

A quick note on this topic — ABP framework itself doesn't ship a built-in module for blob/file encryption or entity field-level encryption. Both need to be implemented by the developer, combining ABP's primitives with platform or library features. Below are a few common directions people typically take, which may help you choose what fits your project best.

File encryption (S3/MinIO): Most teams rely on the storage layer's own server-side encryption (SSE-KMS / SSE-C). MinIO and S3 both support this. Master keys live in an external KMS (AWS KMS, Azure Key Vault, HashiCorp Vault), and encryption happens transparently. This is generally simpler and performs better than wrapping IBlobContainer with custom streaming AES in the application layer.

If you really need application-level encryption, you can wrap IBlobContainer with a streaming AES-GCM layer (per-file DEK + master key wrap pattern), but rolling your own envelope encryption is non-trivial.

Field-level encryption (PostgreSQL): A few options worth considering:

• Database-level TDE with customer-managed keys — Azure Database for PostgreSQL Flexible Server and AWS RDS for PostgreSQL both support this. The DB handles everything; the app stays unchanged. Usually the simplest path for compliance.
• EF Core ValueConverter + IStringEncryptionService — works for basic column-level encryption. The EF Core docs do include a caution about rolling your own encryption here, and ValueConverter can't access DbContext or session state, which makes per-tenant key derivation tricky.
• PostgreSQL pgcrypto extension — SQL-level encryption/decryption functions.

Encrypted columns aren't directly searchable by plaintext. The common pattern is a separate blind-index column (HMAC of the value) for equality lookups.

Key management: ABP doesn't ship a dedicated KMS abstraction, but AbpStringEncryptionOptions reads from IConfiguration, so AWS Secrets Manager / Azure Key Vault / HashiCorp Vault can be plugged in via the standard .NET configuration providers. ASP.NET Core Data Protection APIs are mainly designed for short-lived secrets (cookies, tokens), so I wouldn't recommend them for long-term storage of medical data.

Related ABP article: I wrote a piece some time ago covering the encryption mechanisms ABP uses internally — IStringEncryptionService (AES), Identity password hashing (PBKDF2 / HMAC-SHA512), and OpenIddict signing/encryption credentials. It may help as background: https://abp.io/community/articles/encryption-and-decryption-in-abp-framework-37uqhdwz

Thanks

ok

Hi,

I tried to reproduce this locally on a freshly generated 9.2.2 Angular template (Identity Roles and Users pages). The ExtensibleTable component code in 9.1.x and 9.2.x is the same, so it's a useful comparison but not proof your exact setup is unaffected. On my side both pages render correctly after data load, no resize needed — so this doesn't look like a generic 9.1.2 framework defect; it's more likely related to project-specific layout, theme customization, browser state, or timing in your environment.

Could you share a bit more so we can narrow it down:

1. A short GIF or screen recording showing the issue (enter the page → empty table → resize → data appears). The video helps a lot more than a text description — we want to see what the empty state actually looks like (header rendered? loading spinner stuck? rows present but blank cells?).
2. Versions of @abp/ng.components, @abp/ng.theme.lepton-x, and @swimlane/ngx-datatable from your package.json.
3. Browser, version, screen resolution, and zoom level.
4. Any custom CSS or theme overrides on top of LeptonX.
5. While the table is in the "empty" state, open browser DevTools → check console for errors/warnings, and inspect the ngx-datatable host element's computed width / height (often this kind of issue comes from the container being 0×0 at first render due to a hidden/flex parent).
6. Does the issue still happen in an incognito window (rules out extensions / cached service worker), and on a fresh 9.1.2 template with no customizations (rules out something specific to your project).

In the meantime, inside your existing root AppComponent you can add this to force a recalculate after every navigation:

import { NgZone, OnInit, inject } from '@angular/core';
import { NavigationEnd, Router } from '@angular/router';
import { filter } from 'rxjs/operators';

export class AppComponent implements OnInit {
  private router = inject(Router);
  private zone = inject(NgZone);

  ngOnInit() {
    this.router.events
      .pipe(filter(e => e instanceof NavigationEnd))
      .subscribe(() => {
        this.zone.runOutsideAngular(() => {
          setTimeout(() => window.dispatchEvent(new Event('resize')), 0);
          setTimeout(() => window.dispatchEvent(new Event('resize')), 100);
        });
      });
  }
}

This is the same mechanism your manual window resize is triggering today, dispatched programmatically. It's a temporary workaround while we narrow down the root cause from the details above.

Thanks