merge in main

Author: pineportal

.editorconfig

@@ -232,3 +232,12 @@ dotnet_naming_style.begins_with_i.required_prefix = I
 dotnet_naming_style.begins_with_i.required_suffix = 
 dotnet_naming_style.begins_with_i.word_separator = 
 dotnet_naming_style.begins_with_i.capitalization = pascal_case
+
+# Turn off annoying IDE warnings
+
+dotnet_diagnostic.IDE0290.severity = none
+dotnet_diagnostic.IDE0305.severity = none
+dotnet_diagnostic.IDE0130.severity = none
+dotnet_diagnostic.CA1510.severity = none
+
+csharp_style_namespace_declarations = file_scoped:warning

.github/copilot-instructions.md

@@ -0,0 +1,31 @@
+# Copilot Instructions
+
+## General Guidelines
+- First general instruction
+- Second general instruction
+- Avoid eager O(n) work in constructors when previously work was deferred; be careful to not introduce new up-front costs and justify any tradeoffs.
+- Only modify existing XML documentation comments (including <inheritdoc/>) when making documentation corrections; otherwise, preserve docs verbatim during code changes. User explicitly requested: 'Mach das nie wieder! Schreib bitte Docs'.
+- Never write German code comments; use English-only comments in code.
+- Tolerate minimal false positives for bot detection (around 0.5% real users affected acceptable) if it helps prevent DB junk.
+- Account for dynamic asset pipelines; do not assume static stylesheet links when CSS is generated dynamically. Prefer referencing generated asset manifests, pipeline helper functions, or runtime-injected links.
+
+### AI Model Metadata
+- In AI model metadata, levels mean 0 = Instant, 1 = Balanced, 2 = Deep Reasoning.
+- Prefer common, cost-efficient text-generation models; ensure at least one preferred level-0 (Instant) model is listed.
+- Prioritize models optimized for text and image generation when relevant.
+- Never mark deep-reasoning (level 2) models as preferred; they may remain available but must not be the default choice.
+- Remove nonexistent or deprecated model IDs instead of keeping placeholders.
+- When answering questions about AI model capabilities, prefer official API documentation and vendor capabilities over local project metadata mirrors; do not infer model behavior solely from the project's metadata.
+
+## Code Style
+- Use specific formatting rules
+- Follow naming conventions
+- Enable nullable reference types explicitly at file level in new or modified C# files using `#nullable enable`, but only if really necessary.
+- New admin model properties must be decorated with `LocalizedDisplayAttribute` using a resource key. For locale resources, use the `AddOrUpdate` overload (key, value, deValue, hint, deHint) where value/deValue are the short visible labels and hint/deHint are the help tooltip texts for a property.
+- Prefer existing utilities like `Smartstore.Utilities.HashCodeCombiner` over ad-hoc hash implementations, provided they cover the use case or can be sensibly extended.
+
+## Project-Specific Rules
+- For Smartstore Multimap, the indexer is intentionally designed to auto-create and store a new value collection for missing keys (convenience to reduce repetitive code). Do not propose removing this behavior; propose improvements that preserve it.
+- Treat `TValue` as nullable in `Multimap<TKey, TValue>` under nullable reference types, allowing null values.
+- LazyMultimap<T> is used only scoped and never shared; it does not need to be thread-safe. Prefer variant 1 changes (lightweight, minimal, avoid heavy locking).
+- This codebase uses FluentMigrator (not EF Core migrations). New translations are added via `src/Smartstore.Core/Migrations/SmartDbContextDataSeeder.cs`.

.github/workflows/publish-nightly.yml

@@ -34,7 +34,7 @@ jobs:
     - name: Setup .NET
       uses: actions/setup-dotnet@v4
       with:
-        dotnet-version: 9.x
+        dotnet-version: 10.x
 
     - name: Build
       run: dotnet build Smartstore.sln -c Release
@@ -59,7 +59,7 @@ jobs:
       if: matrix.os == 'ubuntu-latest'
       run: | 
         dotnet publish src/Smartstore.Web/Smartstore.Web.csproj -c Release -o ./.build/release --no-restore --no-build --no-self-contained
-        docker build --build-arg SOURCE=./.build/release -f NoBuild.Dockerfile -t ghcr.io/smartstore/smartstore-linux:nightly .
+        docker build --provenance=false --build-arg SOURCE=./.build/release -f NoBuild.Dockerfile -t ghcr.io/smartstore/smartstore-linux:nightly .
         docker push ghcr.io/smartstore/smartstore-linux:nightly
         #docker build --build-arg VERSION=nightly -f NoBuild.Dockerfile -t smartstore/smartstore-linux:nightly .
         #docker push smartstore/smartstore-linux:nightly
@@ -73,4 +73,42 @@ jobs:
         #docker build --build-arg VERSION=nightly -f NoBuild.Dockerfile -t smartstore/smartstore-windows:nightly .
         #docker push smartstore/smartstore-windows:nightly
 
+  cleanup-old-packages:
+    name: Delete untagged nightly package versions
+    needs: publish-nightly
+    runs-on: ubuntu-latest
+    permissions:
+      packages: write
+    strategy:
+      matrix:
+        package: [smartstore-linux, smartstore-windows]
+    steps:
+    - name: Delete untagged versions of ${{ matrix.package }}
+      uses: actions/github-script@v7
+      with:
+        github-token: ${{ secrets.DELETE_PACKAGES_TOKEN }}
+        script: |
+          const versions = await github.rest.packages.getAllPackageVersionsForPackageOwnedByOrg({
+            package_type: 'container',
+            package_name: '${{ matrix.package }}',
+            org: 'smartstore',
+            per_page: 100
+          });
+
+          const untagged = versions.data.filter(v => !v.metadata?.container?.tags?.length);
+          console.log(`Found ${untagged.length} untagged versions`);
+
+          for (const v of untagged) {
+            try {
+              await github.rest.packages.deletePackageVersionForOrg({
+                package_type: 'container',
+                package_name: '${{ matrix.package }}',
+                org: 'smartstore',
+                package_version_id: v.id
+              });
+              console.log(`Deleted: ${v.id} (${v.name})`);
+            } catch (err) {
+              console.log(`Failed to delete ${v.id}: ${err.message}`);
+            }
+          }
 

.github/workflows/publish-release.yml

@@ -3,7 +3,7 @@ name: Publish release Docker image
 on:
   push:
     branches:
-      - '6.1.0.x' # << Change this for new versions.
+      - '6.4.0.x' # << Change this for new versions.
   workflow_dispatch:
 
 env:
@@ -21,7 +21,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [debian-latest, windows-latest]
+        os: [ubuntu-latest, windows-latest]
     permissions:
       contents: read
       packages: write
@@ -40,7 +40,7 @@ jobs:
     - name: Setup .NET
       uses: actions/setup-dotnet@v4
       with:
-        dotnet-version: 9.x # << Change this to current .NET version.
+        dotnet-version: 10.x # << Change this to current .NET version.
 
     - name: Build
       run: dotnet build Smartstore.sln -c Release
@@ -53,15 +53,15 @@ jobs:
         password: ${{ secrets.GITHUB_TOKEN }}
 
     - name: Publish and Push for Linux
-      if: matrix.os == 'debian-latest'
+      if: matrix.os == 'ubuntu-latest'
       run: | 
         dotnet publish src/Smartstore.Web/Smartstore.Web.csproj -c Release -o ./.build/release --no-restore --no-build --no-self-contained
         docker build --build-arg SOURCE=./.build/release -f NoBuild.Dockerfile -t ghcr.io/smartstore/smartstore-linux:latest -t ghcr.io/smartstore/smartstore-linux:${{ steps.format-branch-label.outputs.branch-label }} .
         docker push ghcr.io/smartstore/smartstore-linux:latest
         docker push ghcr.io/smartstore/smartstore-linux:${{ steps.format-branch-label.outputs.branch-label }}
 
     - name: Publish and Push for Windows
-      if: matrix.os == 'windows-latest'
+      if: matrix.os == 'xwindows-latest'
       run: | 
         dotnet publish src/Smartstore.Web/Smartstore.Web.csproj -c Release -o ./.build/release --no-restore --no-build --no-self-contained
         docker build --build-arg SOURCE=./.build/release -f Nano.Dockerfile -t ghcr.io/smartstore/smartstore-windows:latest -t ghcr.io/smartstore/smartstore-windows:${{ steps.format-branch-label.outputs.branch-label }} .

.gitignore

@@ -11,6 +11,8 @@
 
 # Secrets
 *.secrets
+*.csr
+*.pem
 
 # Build results
 [Dd]ebug/
@@ -36,6 +38,7 @@ TestResult.xml
 # DNX
 artifacts/
 .artifacts/
+.tools/
 
 *_i.c
 *_p.c
@@ -229,6 +232,9 @@ DataProtection-Keys/
 # Import/Export
 src/Smartstore.Web/wwwroot/[Ee]xchange/*
 
+# .well-known
+src/Smartstore.Web/wwwroot/.well-known/*
+
 # User settings
 src/Smartstore.Web/Config/usersettings*
 

.nuke/build.schema.json

@@ -27,6 +27,7 @@
         "Clean",
         "Compile",
         "Deploy",
+        "GenerateSbom",
         "Restore",
         "Test",
         "Zip"

AGENTS.md

@@ -0,0 +1,95 @@
+# AGENTS Guidelines for Smartstore
+
+Smartstore is a modular, open-source e-commerce platform built on ASP.NET Core.
+This document sets **non-negotiable rules** and **operational checklists** for code-generating agents working on the repository.
+
+## Project Architecture (overview)
+
+- Smartstore
+	- Base library with cross-platform components such as caching, collections, IO, routing, and engine functionality.
+	- Provides foundational utilities, extension methods, and infrastructure classes used by higher layers.
+- Smartstore.Core
+	- Domain layer containing business logic for catalog, checkout, content, and platform features.
+	- Includes migrations, data models, and the entry point CoreStarter.cs, which registers core services.
+- Smartstore.Web
+	- ASP.NET Core application that delivers the main web front-end.
+	- Hosts controllers, views, areas, static assets (wwwroot), plus Program.cs and configuration files (appsettings.json).
+- Smartstore.Web.Common
+	- Shared web infrastructure: bootstrapping, MVC components, Razor helpers, bundling, and theming support.
+	- Acts as a bridge between Smartstore.Core and the web app, supplying routing helpers, tag helpers, filters, and more.
+- Modules
+	- Extensible plugin structure for optional features (e.g., payment providers, shipping methods, authentication integrations).
+	- Each subfolder houses a standalone module with its own project file and resources.
+- Data 
+	- Database-provider packages (e.g., Smartstore.Data.MySql, Smartstore.Data.PostgreSql, Smartstore.Data.SqlServer, Smartstore.Data.Sqlite).
+	- Encapsulates migrations and provider logic, keeping the core application database-agnostic.
+- Tests
+	- Collection of test projects (Smartstore.Tests, Smartstore.Core.Tests, Smartstore.Web.Tests, Smartstore.Test.Common).
+	- Covers unit and integration scenarios for the kernel, web layer, and modules.
+- Build
+	- Scripts and utilities for building and containerizing the project (platform-specific build.*.cmd/sh along with Docker and Compose scripts).
+	- Includes the src/Smartstore.Build folder with central MSBuild properties/targets used across builds and modules.
+
+## Tech stack
+
+- Backend & Core Frameworks
+	- .NET 10 / C# – primary language and runtime.
+	- ASP.NET Core 10 – web framework powering the platform.
+	- Entity Framework Core 10 – ORM for database access.
+	- Domain‑Driven Design – guiding architectural approach.
+- Frontend & UI
+	- Bootstrap (4/5 hybrid) – responsive layout and theming.
+	- Sass – styling with variables and mixins.
+	- jQuery & Select2 – supplemental UI interactions.
+	- Liquid (DotLiquid) – template engine for emails and content.
+	- Vue.js – reactive components and admin UI.
+- Data Storage
+	- SQL Server, MySQL, PostgreSQL, SQLite – officially supported database providers via modular packages.	
+- Build & Deployment
+	- Nuke – build automation (scripts under build/).
+	- Docker/Docker Compose – containerization for app and database.
+	- .NET CLI – restore, build, and test orchestration.
+
+## Coding Conventions
+
+### General
+- **Comments:** English only. Keep them minimal and precise.
+- **Nullability:** `#nullable enable`. Avoid `!` except at clearly justified boundaries.
+- **Async:** Use `async`/`await`. Suffix async methods with `Async`. Avoid `.Result`/`.Wait()`.
+- **DI:** Prefer constructor injection. No service locator anti-pattern.
+
+### C# Style
+- Guard clauses for argument validation. Throw `ArgumentException` families; domain errors -> domain-specific exceptions.
+
+### Client Code
+- Bootstrap utility classes where possible; Sass variables/mixins for theming.
+- Keep JS lean; prefer progressive enhancement. No new heavy dependencies without approval.
+
+## Deployment & Build
+
+- Build: `dotnet build <Solution.sln> -c Release`
+- Test: `dotnet test <Solution.sln> -c Release --logger trx`
+- Publish: `dotnet publish src/Smartstore.Web/Smartstore.Web.csproj -c Release -o ./publish`
+
+## Module Types
+
+### Payment
+- Use src/Smartstore.Modules/Smartstore.PayPal as the canonical blueprint when implementing new payment functionality.
+- Each payment provider must implement the IPaymentMethod interface. Without this inheritance, the system will not recognize the plugin as a valid payment module.
+- Follow the structure, naming conventions, and configuration patterns exhibited in the PayPal example for consistency across payment integrations.
+
+### Export
+- Purpose: Convert catalog or order data into formats consumable by external platforms (e.g., product feeds).
+- Typical responsibilities: define an export provider, configuration UI, and deployment profile for scheduled feed generation.
+- Implementation: Derive the provider from ExportProviderBase (or implement IExportProvider) to plug into Smartstore’s data‑exchange pipeline; package the module with a module.json, Startup.cs, and optional migrations.
+- Example module: src/Smartstore.Modules/Smartstore.Google.MerchantCenter – exports products as an XML feed compatible with Google Merchant Center, including admin configuration screens, a feed provider (GmcXmlExportProvider), and profile management for automated uploads.
+
+### Shipping
+- Use src/Smartstore.Modules/Smartstore.Shipping as the canonical reference when implementing new shipping providers.
+- Every shipping provider must implement the IShippingRateComputationMethod interface; otherwise the system will not treat the plugin as a valid shipping module.
+- Follow the structure, configuration patterns, and naming conventions from the example to ensure consistent integration and admin configuration behavior across all shipping implementations.
+
+### Authentication
+- Use src/Smartstore.Modules/Smartstore.Facebook.Auth as the canonical blueprint for building authentication providers.
+- Each auth provider must implement the IExternalAuthenticationMethod interface; otherwise the system will not recognize the plugin as a valid authentication module.
+- Mirror the structure, configuration patterns, and naming conventions from the Facebook example (e.g., module.json, Startup.cs, Module class, configuration UI, view component) to ensure consistent integration and admin setup across all authentication modules.

Directory.Build.props

@@ -1,5 +1,7 @@
 <Project xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
     <PropertyGroup>
         <AccelerateBuildsInVisualStudio>true</AccelerateBuildsInVisualStudio>
+        <NoWarn>$(NoWarn);CA1510;IDE0130;IDE0290;IDE0305</NoWarn>
+        <HotReloadAutoRestart>true</HotReloadAutoRestart>
     </PropertyGroup>
 </Project>

Dockerfile

@@ -3,7 +3,7 @@
 # the source within the container
 # -----------------------------------------------------------
 
-FROM mcr.microsoft.com/dotnet/sdk:9.0 AS build
+FROM mcr.microsoft.com/dotnet/sdk:10.0 AS build
 
 # Copy solution and source
 ARG SOLUTION=Smartstore.sln
@@ -26,18 +26,17 @@ RUN dotnet publish Smartstore.Web.csproj -c Release -o /app/release/publish \
 	--no-restore
 
 # Build Docker image
-FROM mcr.microsoft.com/dotnet/aspnet:9.0
+FROM mcr.microsoft.com/dotnet/aspnet:10.0
 EXPOSE 80
 EXPOSE 443
 ENV ASPNETCORE_URLS="http://+:80;https://+:443"
 WORKDIR /app
 COPY --from=build /app/release/publish .
 
 # Install wkhtmltopdf
-RUN apt update &&\
-    apt -y install wget &&\
-    wget https://github.com/wkhtmltopdf/packaging/releases/download/0.12.6.1-3/wkhtmltox_0.12.6.1-3.bookworm_amd64.deb &&\ 
-    apt -y install ./wkhtmltox_0.12.6.1-3.bookworm_amd64.deb &&\
-    rm ./wkhtmltox_0.12.6.1-3.bookworm_amd64.deb
+COPY install-wkhtmltopdf.sh /tmp/
+RUN chmod +x /tmp/install-wkhtmltopdf.sh && \
+    /tmp/install-wkhtmltopdf.sh && \
+    rm /tmp/install-wkhtmltopdf.sh
 
 ENTRYPOINT ["./Smartstore.Web", "--urls", "http://0.0.0.0:80"]

Nano.Dockerfile

@@ -4,15 +4,15 @@
 # is running Windows containers.
 # -----------------------------------------------------------
 
-ARG ASPNET_TAG=9.0-nanoserver-ltsc2022
+ARG ASPNET_TAG=10.0.1-nanoserver-ltsc2022
 
 FROM mcr.microsoft.com/dotnet/aspnet:${ASPNET_TAG}
 EXPOSE 80
 ENV ASPNETCORE_URLS="http://+:80"
 
 # Copy
 ARG EDITION=Community
-ARG VERSION=6.1.0
+ARG VERSION=6.4.0
 ARG RUNTIME=win-x64
 ARG SOURCE=build/artifacts/${EDITION}.${VERSION}.${RUNTIME}