In our notification use case, the email body is rendered from an ABP text template using runtime values such as tenant, user, and event-specific data.
Can the** email subject** also be managed dynamically through ABP Text Templates in ABP Pro?
We understand that ABP Commercial/Pro provides the Text Template Management module to view, edit, replace, and manage seeded text/email templates. However, our requirement is not only template management. What we seem to be missing is an event-driven notification management layer, where the Host admin can manage which system events generate email notifications.
Our business requirements are:
When attempting to delete an OU from the backend, the system does not perform proper validation to check whether any users or roles are still associated with it. As a result, the OU can be deleted even when dependencies exist, potentially causing data inconsistency and orphaned references.
Environment Details: ABP Version: ABP 10.0.1 Pro Reproducibility: Issue is reproducible via Swagger (not via UI) Tenant Resolution Strategy: Subdomain-based tenant resolution , different tenants have different URL and login credentials. Testing Context: Tenant context
Preconditions: A tenant exists and is in Active state An Organization Unit (OU) exists One or more Users and/or Roles are associated with the OU in different
Steps to Reproduce: Log in as a Tenant Admin Ensure the tenant is in Active state Open Swagger UI for the tenant Identify an OU that has: Assigned Users and/or Roles Invoke the API: DELETE /api/identity/organization-units/{id} Provide the ID of the OU with existing associations Execute the request
Expected Result: The system should validate whether the OU has dependent entities If users or roles are associated: Deletion should be blocked A validation error should be returned, such as: “Cannot delete OU with assigned users or roles” Alternatively, system should enforce safe handling (e.g., require reassignment or explicit cleanup)
Actual Result: The OU is deleted successfully No validation or warning is triggered Associated users/roles lose their linkage, resulting in orphaned references
Severity: High – Affects data integrity and authorization structure
The system permits the creation of Organizational Units (OUs) across different tenants, which should ideally be restricted. This could lead to data isolation and security concerns, as tenants are expected to operate within their own boundaries.
Environment Details: ABP Version: ABP 10.0.1 Pro Reproducibility: Issue is reproducible via Swagger (not via UI) with 2 tenants logged in different browser. Tenant Resolution Strategy: Subdomain-based tenant resolution( different tenants have different URL, Login credentials) Testing Context: Tenant context (Tenant A)
Preconditions: Tenant A exists and is Active Tenant B exists and is Active Tenant B has at least one existing Organization Unit (OU)
Steps to Reproduce: Log in as a Tenant Admin (Tenant A) Ensure Tenant A is in Active state Open Swagger UI for Tenant A Invoke the API: POST /api/identity/organization-units In the request payload: Provide a parentId that belongs to an Organization Unit from Tenant B Execute the API request
Expected Result: The system should enforce strict tenant boundaries Validation should fail when attempting to associate an OU with a parent from another tenant An appropriate error should be returned, such as: Authorization error OR Validation error indicating cross-tenant operation is not allowed
Actual Result: The API successfully creates the Organizational Unit The new OU (Tenant A) is incorrectly linked to a parent OU belonging to Tenant B No validation or authorization error is triggered Severity: High – Impacts multi-tenant data isolation and security guarantees
