grandnode · Copilot · May 31, 2026 · May 31, 2026 · May 31, 2026 · May 31, 2026
diff --git a/Directory.Packages.props b/Directory.Packages.props
@@ -11,16 +11,16 @@
     <PackageVersion Include="Scalar.AspNetCore" Version="2.14.14" />
     <PackageVersion Include="Scryber.Core" Version="9.5.0" />
     <PackageVersion Include="Scryber.Core.OpenType" Version="9.2.0" />
-    <PackageVersion Include="MailKit" Version="4.16.0" />
-    <PackageVersion Include="AWSSDK.Core" Version="4.0.7.1" />
-    <PackageVersion Include="AWSSDK.S3" Version="4.0.23.3" />
+    <PackageVersion Include="MailKit" Version="4.17.0" />
+    <PackageVersion Include="AWSSDK.Core" Version="4.0.7.5" />
+    <PackageVersion Include="AWSSDK.S3" Version="4.0.24" />
     <PackageVersion Include="Azure.Storage.Blobs" Version="12.28.0" />
     <PackageVersion Include="SixLabors.ImageSharp" Version="3.1.12" />
-    <PackageVersion Include="SkiaSharp" Version="3.119.2" />
-    <PackageVersion Include="SkiaSharp.NativeAssets.Linux.NoDependencies" Version="3.119.2" />
+    <PackageVersion Include="SkiaSharp" Version="3.119.4" />
+    <PackageVersion Include="SkiaSharp.NativeAssets.Linux.NoDependencies" Version="3.119.4" />
     <PackageVersion Include="LiteDB" Version="5.0.21" />
-    <PackageVersion Include="MongoDB.Bson" Version="3.8.1" />
-    <PackageVersion Include="MongoDB.Driver" Version="3.8.1" />
+    <PackageVersion Include="MongoDB.Bson" Version="3.9.0" />
+    <PackageVersion Include="MongoDB.Driver" Version="3.9.0" />
     <PackageVersion Include="DotLiquid" Version="2.3.197" />
     <PackageVersion Include="FluentValidation.DependencyInjectionExtensions" Version="12.1.1" />
     <PackageVersion Include="GoogleAuthenticator" Version="3.2.0" />
@@ -33,7 +33,7 @@
     <PackageVersion Include="Microsoft.CodeAnalysis.CSharp.Scripting" Version="5.3.0" />
     <PackageVersion Include="MediatR" Version="12.5.0" />
     <PackageVersion Include="Scrutor" Version="7.0.0" />
-    <PackageVersion Include="StackExchange.Redis" Version="2.13.1" />
+    <PackageVersion Include="StackExchange.Redis" Version="2.13.17" />
     <PackageVersion Include="FluentValidation" Version="12.1.1" />
     <PackageVersion Include="Microsoft.AspNetCore.JsonPatch.SystemTextJson" Version="10.0.8" />
     <PackageVersion Include="Microsoft.AspNetCore.Authentication.Facebook" Version="10.0.8" />
@@ -55,15 +55,15 @@
     <PackageVersion Include="NetEscapades.AspNetCore.SecurityHeaders" Version="1.3.1" />
     <PackageVersion Include="Wangkanai.Detection" Version="8.20.0" />
     <PackageVersion Include="Microsoft.AspNetCore.Mvc.Razor.RuntimeCompilation" Version="10.0.8" />
-    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="18.5.1" />
+    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="18.6.0" />
     <PackageVersion Include="Moq" Version="4.20.72" />
     <PackageVersion Include="MSTest.TestAdapter" Version="4.2.3" />
     <PackageVersion Include="MSTest.TestFramework" Version="4.2.3" />
-    <PackageVersion Include="coverlet.collector" Version="10.0.0" />
-    <PackageVersion Include="NUnit" Version="4.6.0" />
-    <PackageVersion Include="Verify.MSTest" Version="31.16.3" />
-    <PackageVersion Include="Aspire.Hosting.AppHost" Version="13.3.3" />
-    <PackageVersion Include="Aspire.Hosting.MongoDB" Version="13.3.3" />
+    <PackageVersion Include="coverlet.collector" Version="10.0.1" />
+    <PackageVersion Include="NUnit" Version="4.6.1" />
+    <PackageVersion Include="Verify.MSTest" Version="31.19.0" />
+    <PackageVersion Include="Aspire.Hosting.AppHost" Version="13.4.1" />
+    <PackageVersion Include="Aspire.Hosting.MongoDB" Version="13.4.1" />
     <PackageVersion Include="Microsoft.Extensions.Http.Resilience" Version="10.6.0" />
     <PackageVersion Include="Microsoft.Extensions.ServiceDiscovery" Version="10.6.0" />
     <PackageVersion Include="OpenTelemetry.Exporter.OpenTelemetryProtocol" Version="1.15.3" />
@@ -75,7 +75,7 @@
     <PackageVersion Include="Aspire.Hosting.Orchestration.$(NETCoreSdkRuntimeIdentifier)" Version="9.0.0" />
   </ItemGroup>
   <ItemGroup>
-    <PackageVersion Update="Aspire.Dashboard.Sdk.win-x64" Version="13.3.3" />
-    <PackageVersion Update="Aspire.Hosting.Orchestration.win-x64" Version="13.3.3" />
+    <PackageVersion Update="Aspire.Dashboard.Sdk.win-x64" Version="13.4.1" />
+    <PackageVersion Update="Aspire.Hosting.Orchestration.win-x64" Version="13.4.1" />
   </ItemGroup>
 </Project>
diff --git a/src/Plugins/DiscountRules.Standard/Controllers/BaseDiscountRulePluginController.cs b/src/Plugins/DiscountRules.Standard/Controllers/BaseDiscountRulePluginController.cs
@@ -0,0 +1,9 @@
+using Grand.Web.Common.Controllers;
+using Grand.Web.Common.Filters;
+using Microsoft.AspNetCore.Mvc;
+
+namespace DiscountRules.Standard.Controllers;
+
+[AuthorizeAdminOrStore]
+[AutoValidateAntiforgeryToken]
+public abstract class BaseDiscountRulePluginController : BaseController;
diff --git a/...n/Controllers/CustomerGroupsController.cs → .../DiscountRulesCustomerGroupsController.cs b/...n/Controllers/CustomerGroupsController.cs → .../DiscountRulesCustomerGroupsController.cs
@@ -1,22 +1,21 @@
-using DiscountRules.Standard.Models;
+using DiscountRules.Standard.Models;
 using Grand.Business.Core.Interfaces.Catalog.Discounts;
 using Grand.Business.Core.Interfaces.Common.Directory;
 using Grand.Business.Core.Interfaces.Common.Security;
 using Grand.Domain.Permissions;
 using Grand.Domain.Discounts;
-using Grand.Web.Common.Controllers;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.AspNetCore.Mvc.Rendering;
 
-namespace DiscountRules.Standard.Areas.Admin.Controllers;
+namespace DiscountRules.Standard.Controllers;
 
-public class CustomerGroupsController : BaseAdminPluginController
+public class DiscountRulesCustomerGroupsController : BaseDiscountRulePluginController
 {
     private readonly IDiscountService _discountService;
     private readonly IGroupService _groupService;
     private readonly IPermissionService _permissionService;
 
-    public CustomerGroupsController(
+    public DiscountRulesCustomerGroupsController(
         IDiscountService discountService,
         IGroupService groupService,
         IPermissionService permissionService)

diff --git a/...n/Controllers/HadSpentAmountController.cs → .../DiscountRulesHadSpentAmountController.cs b/...n/Controllers/HadSpentAmountController.cs → .../DiscountRulesHadSpentAmountController.cs
@@ -1,20 +1,19 @@
-using DiscountRules.Standard.Models;
+using DiscountRules.Standard.Models;
 using Grand.Business.Core.Interfaces.Catalog.Discounts;
 using Grand.Business.Core.Interfaces.Common.Security;
 using Grand.Domain.Permissions;
 using Grand.Domain.Discounts;
-using Grand.Web.Common.Controllers;
 using Microsoft.AspNetCore.Mvc;
 using System.Globalization;
 
-namespace DiscountRules.Standard.Areas.Admin.Controllers;
+namespace DiscountRules.Standard.Controllers;
 
-public class HadSpentAmountController : BaseAdminPluginController
+public class DiscountRulesHadSpentAmountController : BaseDiscountRulePluginController
 {
     private readonly IDiscountService _discountService;
     private readonly IPermissionService _permissionService;
 
-    public HadSpentAmountController(
+    public DiscountRulesHadSpentAmountController(
         IDiscountService discountService,
         IPermissionService permissionService)
     {

diff --git a/...n/Controllers/HasAllProductsController.cs → .../DiscountRulesHasAllProductsController.cs b/...n/Controllers/HasAllProductsController.cs → .../DiscountRulesHasAllProductsController.cs
@@ -1,4 +1,4 @@
-using DiscountRules.Standard.Models;
+using DiscountRules.Standard.Models;
 using Grand.Business.Core.Interfaces.Catalog.Discounts;
 using Grand.Business.Core.Interfaces.Catalog.Products;
 using Grand.Business.Core.Interfaces.Common.Localization;
@@ -9,15 +9,14 @@
 using Grand.Domain.Discounts;
 using Grand.Domain.Permissions;
 using Grand.Infrastructure;
-using Grand.Web.Common.Controllers;
 using Grand.Web.Common.DataSource;
 using Grand.Web.Common.Localization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.AspNetCore.Mvc.Rendering;
 
-namespace DiscountRules.Standard.Areas.Admin.Controllers;
+namespace DiscountRules.Standard.Controllers;
 
-public class HasAllProductsController : BaseAdminPluginController
+public class DiscountRulesHasAllProductsController : BaseDiscountRulePluginController
 {
     private readonly IDiscountService _discountService;
     private readonly IPermissionService _permissionService;
@@ -28,8 +27,8 @@ public class HasAllProductsController : BaseAdminPluginController
     private readonly IContextAccessor _contextAccessor;
     private readonly IEnumTranslationService _enumTranslationService;
 
-
-    public HasAllProductsController(IDiscountService discountService,
+    private string CurrentStoreId => _contextAccessor.WorkContext.CurrentCustomer.StaffStoreId;
+    public DiscountRulesHasAllProductsController(IDiscountService discountService,
         IPermissionService permissionService,
         IContextAccessor contextAccessor,
         ITranslationService translationService,
@@ -127,22 +126,30 @@ public async Task<IActionResult> ProductAddPopup(string btnId, string productIds
             IsLoggedInAsVendor = _contextAccessor.WorkContext.CurrentVendor != null
         };
 
-        //stores
-        model.AvailableStores.Add(new SelectListItem { Text = _translationService.GetResource("Admin.Common.All"), Value = "" });
-        foreach (var s in await _storeService.GetAllStores())
-            model.AvailableStores.Add(new SelectListItem { Text = s.Shortcut, Value = s.Id });
-
-        //vendors
-        model.AvailableVendors.Add(new SelectListItem { Text = _translationService.GetResource("Admin.Common.All"), Value = "" });
-        foreach (var v in await _vendorService.GetAllVendors(showHidden: true))
-            model.AvailableVendors.Add(new SelectListItem { Text = v.Name, Value = v.Id });
+        //stores - when acting as a store manager, scope to their store
+        if (!string.IsNullOrEmpty(CurrentStoreId))
+        {
+            var store = await _storeService.GetStoreById(CurrentStoreId);
+            if (store != null)
+                model.AvailableStores.Add(new SelectListItem { Text = store.Shortcut, Value = store.Id });
+        }
+        else
+        {
+            model.AvailableStores.Add(new SelectListItem { Text = _translationService.GetResource("Admin.Common.All"), Value = "" });
+            foreach (var s in await _storeService.GetAllStores())
+                model.AvailableStores.Add(new SelectListItem { Text = s.Shortcut, Value = s.Id });
+
+            //vendors (only shown to admins)
+            model.AvailableVendors.Add(new SelectListItem { Text = _translationService.GetResource("Admin.Common.All"), Value = "" });
+            foreach (var v in await _vendorService.GetAllVendors(showHidden: true))
+                model.AvailableVendors.Add(new SelectListItem { Text = v.Name, Value = v.Id });
+        }
 
         //product types
         model.AvailableProductTypes = _enumTranslationService.ToSelectList(ProductType.SimpleProduct, false).ToList();
         model.AvailableProductTypes.Insert(0,
             new SelectListItem { Text = _translationService.GetResource("Admin.Common.All"), Value = "" });
 
-
         ViewBag.productIdsInput = productIdsInput;
         ViewBag.btnId = btnId;
 
@@ -159,6 +166,9 @@ public async Task<IActionResult> ProductAddPopupList(DataSourceRequest command,
 
         //a vendor should have access only to his products
         if (_contextAccessor.WorkContext.CurrentVendor != null) model.SearchVendorId = _contextAccessor.WorkContext.CurrentVendor.Id;
+        //a store manager should only search within their store
+        if (!string.IsNullOrEmpty(CurrentStoreId)) model.SearchStoreId = CurrentStoreId;
+
         var searchCategoryIds = new List<string>();
         if (!string.IsNullOrEmpty(model.SearchCategoryId))
             searchCategoryIds.Add(model.SearchCategoryId);

diff --git a/...in/Controllers/HasOneProductController.cs → ...s/DiscountRulesHasOneProductController.cs b/...in/Controllers/HasOneProductController.cs → ...s/DiscountRulesHasOneProductController.cs
@@ -1,4 +1,4 @@
-using DiscountRules.Standard.Models;
+using DiscountRules.Standard.Models;
 using Grand.Business.Core.Interfaces.Catalog.Discounts;
 using Grand.Business.Core.Interfaces.Catalog.Products;
 using Grand.Business.Core.Interfaces.Common.Localization;
@@ -10,15 +10,14 @@
 using Grand.Domain.Permissions;
 using Grand.Domain.Vendors;
 using Grand.Infrastructure;
-using Grand.Web.Common.Controllers;
 using Grand.Web.Common.DataSource;
 using Grand.Web.Common.Localization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.AspNetCore.Mvc.Rendering;
 
-namespace DiscountRules.Standard.Areas.Admin.Controllers;
+namespace DiscountRules.Standard.Controllers;
 
-public class HasOneProductController : BaseAdminPluginController
+public class DiscountRulesHasOneProductController : BaseDiscountRulePluginController
 {
     private readonly IDiscountService _discountService;
     private readonly IPermissionService _permissionService;
@@ -30,8 +29,9 @@ public class HasOneProductController : BaseAdminPluginController
     private readonly IEnumTranslationService _enumTranslationService;
 
     private Vendor CurrentVendor => _contextAccessor.WorkContext.CurrentVendor;
+    private string CurrentStoreId => _contextAccessor.WorkContext.CurrentCustomer.StaffStoreId;
 
-    public HasOneProductController(IDiscountService discountService,
+    public DiscountRulesHasOneProductController(IDiscountService discountService,
         IPermissionService permissionService,
         IContextAccessor contextAccessor,
         ITranslationService translationService,
@@ -138,15 +138,24 @@ public async Task<IActionResult> ProductAddPopup(string btnId, string productIds
             IsLoggedInAsVendor = CurrentVendor != null
         };
 
-        //stores
-        model.AvailableStores.Add(new SelectListItem { Text = _translationService.GetResource("Admin.Common.All"), Value = "" });
-        foreach (var s in await _storeService.GetAllStores())
-            model.AvailableStores.Add(new SelectListItem { Text = s.Shortcut, Value = s.Id });
-
-        //vendors
-        model.AvailableVendors.Add(new SelectListItem { Text = _translationService.GetResource("Admin.Common.All"), Value = "" });
-        foreach (var v in await _vendorService.GetAllVendors(showHidden: true))
-            model.AvailableVendors.Add(new SelectListItem { Text = v.Name, Value = v.Id });
+        //stores - when acting as a store manager, scope to their store
+        if (!string.IsNullOrEmpty(CurrentStoreId))
+        {
+            var store = await _storeService.GetStoreById(CurrentStoreId);
+            if (store != null)
+                model.AvailableStores.Add(new SelectListItem { Text = store.Shortcut, Value = store.Id });
+        }
+        else
+        {
+            model.AvailableStores.Add(new SelectListItem { Text = _translationService.GetResource("Admin.Common.All"), Value = "" });
+            foreach (var s in await _storeService.GetAllStores())
+                model.AvailableStores.Add(new SelectListItem { Text = s.Shortcut, Value = s.Id });
+
+            //vendors (only shown to admins)
+            model.AvailableVendors.Add(new SelectListItem { Text = _translationService.GetResource("Admin.Common.All"), Value = "" });
+            foreach (var v in await _vendorService.GetAllVendors(showHidden: true))
+                model.AvailableVendors.Add(new SelectListItem { Text = v.Name, Value = v.Id });
+        }
 
         //product types
         model.AvailableProductTypes = _enumTranslationService.ToSelectList(ProductType.SimpleProduct, false).ToList();
@@ -169,6 +178,8 @@ public async Task<IActionResult> ProductAddPopupList(DataSourceRequest command,
 
         //a vendor should have access only to his products
         if (CurrentVendor != null) model.SearchVendorId = CurrentVendor.Id;
+        //a store manager should only search within their store
+        if (!string.IsNullOrEmpty(CurrentStoreId)) model.SearchStoreId = CurrentStoreId;
 
         var searchCategoryIds = new List<string>();
         if (!string.IsNullOrEmpty(model.SearchCategoryId))

diff --git a/...ntrollers/ShoppingCartAmountController.cs → ...countRulesShoppingCartAmountController.cs b/...ntrollers/ShoppingCartAmountController.cs → ...countRulesShoppingCartAmountController.cs
@@ -1,20 +1,19 @@
-using DiscountRules.Standard.Models;
+using DiscountRules.Standard.Models;
 using Grand.Business.Core.Interfaces.Catalog.Discounts;
 using Grand.Business.Core.Interfaces.Common.Security;
 using Grand.Domain.Permissions;
 using Grand.Domain.Discounts;
-using Grand.Web.Common.Controllers;
 using Microsoft.AspNetCore.Mvc;
 using System.Globalization;
 
-namespace DiscountRules.Standard.Areas.Admin.Controllers;
+namespace DiscountRules.Standard.Controllers;
 
-public class ShoppingCartAmountController : BaseAdminPluginController
+public class DiscountRulesShoppingCartAmountController : BaseDiscountRulePluginController
 {
     private readonly IDiscountService _discountService;
     private readonly IPermissionService _permissionService;
 
-    public ShoppingCartAmountController(IDiscountService discountService,
+    public DiscountRulesShoppingCartAmountController(IDiscountService discountService,
         IPermissionService permissionService)
     {
         _discountService = discountService;

diff --git a/src/Plugins/DiscountRules.Standard/DiscountRules.Standard.csproj b/src/Plugins/DiscountRules.Standard/DiscountRules.Standard.csproj
@@ -44,5 +44,5 @@
 			<CopyToOutputDirectory>Always</CopyToOutputDirectory>
 		</None>
 	</ItemGroup>
-
+	
 </Project>