Repository navigation
Follow-ups to the explicit checkout context (#932 review items 7-10) - #933
Merged
KrzysztofPajak merged 8 commits intoOct 17, 2026
Merged
KrzysztofPajak merged 8 commits into
KrzysztofPajak merged 8 commits into
Conversation
added 4 commits
October 16, 2026 23:12
ExternalAuthenticationService read the request customer and store from IContextAccessor in Authenticate, in the registration and login paths (CustomerLoggedInEvent, RegistrationRequest) and in the provider availability checks. LoadActiveAuthenticationProviders took a customer and a store but ignored both. The callers (Facebook, Google and OpenID Connect controllers, the sign-out provider, the panel login page and the customer info handler) now pass them, and the service no longer depends on the ambient context.
GetCustomerGroupIds returned the groups in the order they are stored, and about 30 cache keys (checkout attributes, categories, product mappings, menus, search, home page blocks) join that list. The same set of groups in another order therefore made a separate cache entry. Sorting once in GetCustomerGroupIds fixes every key; the ACL filters only test membership.
GetShoppingCartHandler took the customer, store, language and currency from the request, but read the host for checkout attribute download links from IContextAccessor. The host is now a property of GetShoppingCart, set by every sender, and the handler no longer depends on the ambient context.
About 40 call sites in controllers, view components, a validator, a Razor partial and the BrainTree plugin repeated GetShoppingCart(contextAccessor.WorkContext.CurrentCustomer, contextAccessor.StoreContext.CurrentStore.Id, ...). The Grand.Web.Common extension GetCurrentCart(contextAccessor, ...) reads both from the request, next to CalculationContext(). Behavior is unchanged.
added 4 commits
October 17, 2026 06:30
LoadActiveAuthenticationProviders and AuthenticationProviderIsAvailable treated a null customer or store as allowed by every group and store limit. GetShoppingCartHandler formatted checkout attribute download links with a host nothing required. All three now throw on null, as Authenticate already does.
The nine senders in ShoppingCartController repeated the customer, currency, language, tax display, store and host lines; ShoppingCartRequest fills them once.
SidebarWishlist and Index filtered the wishlist by hand, keeping items of deleted products that every other wishlist read drops. The header partial loaded the cart twice to count cart and wishlist items; it loads both types once and sums them in memory.
UpdateQuantityValidator picked the permission from the cart type in the request, not from the item it found. It now checks the wishlist or shopping cart permission of the item itself.
KrzysztofPajak
deleted the
refactor/business-explicit-context-checkout-followups
branch
October 17, 2026 04:46
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Resolves review items 7-10 of #932
Type: feature
Issue
The #932 review left four items for a separate PR:
ExternalAuthenticationServicestill readIContextAccessorfor the request customer and store: inAuthenticate, in the login path (CustomerLoggedInEvent), in registration (RegistrationRequest,CustomerRegisteredEvent) and in the provider availability checks.LoadActiveAuthenticationProviders(customer, store)took both values but ignored them.GetShoppingCartHandlertook everything from the request except the host, which it read fromIContextAccessor.GetShoppingCart(contextAccessor.WorkContext.CurrentCustomer, contextAccessor.StoreContext.CurrentStore.Id, ...).Solution
One commit per item:
Authenticate,LoadActiveAuthenticationProvidersandAuthenticationProviderIsAvailabletake the customer and store. The service no longer injectsIContextAccessor. Facebook, Google, OpenID Connect (controller and sign-out provider), the panel login page andGetInfoHandlerpass the request values.GetCustomerGroupIds()returns the ids sorted (ordinal). Every key built from it is fixed in one place; the ACL filters only test membership.GetShoppingCart.Host, set by the nine senders inShoppingCartController. The handler no longer injectsIContextAccessor.shoppingCartService.GetCurrentCart(contextAccessor, params ShoppingCartType[])inGrand.Web.Common.Extensions, next toCalculationContext(), used at all 40 call sites (controllers, view components,UpdateQuantityValidator,ShoppingCartLinks.cshtml, BrainTree).Breaking changes
IExternalAuthenticationService.Authenticate(parameters, customer, store, returnUrl),LoadActiveAuthenticationProviders(customer, store)(no defaults) andAuthenticationProviderIsAvailable(systemName, customer, store). External-auth plugins outside this repository must pass the request customer and store.ExternalAuthenticationService,GetShoppingCartHandlerandOidcSignOutProviderconstructors changed.GetCustomerGroupIds()now returns the ids sorted;Customer.Groupsitself is not reordered.Testing
Automated: the solution builds; Authentication, Catalog, Checkout, Domain, Web.Common, Web, Web.Admin and Modules test projects pass. New tests cover the login event and registration using the passed customer and store, the same cache key for groups in another order (checkout attributes, categories), the sort itself, and
GetCurrentCart.Manual: