abp-skills

Configure CORS (browser cross-origin access) for an ABP HTTP API host. USE FOR: the App:CorsOrigins setting (comma-separated, trailing-slash trimming), AddCors + WithOrigins, WithAbpExposedHeaders, SetIsOriginAllowedToAllowWildcardSubdomains for wildcard subdomains, the AllowCredentials vs any-origin conflict, UseCors middleware ordering, and which host/gateway to configure in tiered/microservice solutions. DO NOT USE FOR: OpenIddict client redirect / post-logout URIs (registered on the OpenIddict client application at creation/seeding, not a CORS or auth-config setting); RedirectAllowedUrls and named app URLs (configure-app-urls); CSRF/antiforgery and security response headers (secure-web-requests); calling a remote API from C# (consume-remote-services).

Wire up Swagger/OpenAPI for an ABP host with the Volo.Abp.Swashbuckle helpers, including OAuth/OIDC authorize flows and hiding framework endpoints. USE FOR: AddAbpSwaggerGen + UseAbpSwaggerUI setup, AddAbpSwaggerGenWithOAuth / AddAbpSwaggerGenWithOidc for interactive auth on the Swagger UI, AbpSwaggerOidcFlows, HideAbpEndpoints, a metadata/discovery address that differs from the issuer (k8s/docker), versioned SwaggerDoc definitions. DO NOT USE FOR: exposing application services as HTTP controllers (use expose-http-apis); generating C# client proxies for remote APIs (use consume-remote-services); choosing an API versioning strategy (use version-http-apis); configuring the OpenIddict token/authorization server or JWT validation itself (use configure-openiddict-authentication / configure-openiddict-validation).

Call a remote ABP HTTP API from C# through generated client proxies instead of raw HttpClient. USE FOR: setting up dynamic (runtime) or static (build-time) client proxies, configuring AbpRemoteServiceOptions (BaseUrl / named endpoints), wiring tiered / microservice calls, authenticating proxy calls (forward the current user token with AbpHttpClientIdentityModelWebModule, or client credentials with AbpHttpClientIdentityModelModule + IdentityClients), adding Polly retry to proxy clients. DO NOT USE FOR: exposing your own services as HTTP APIs or auto controllers (use expose-http-apis); choosing sync HTTP vs async events between services or the outbox/inbox (use design-module-and-service-communication); routing proxies through Dapr service invocation (use integrate-dapr-services).

Expose ABP application services as REST endpoints through Auto/Conventional API Controllers. USE FOR: publishing application services as HTTP controllers, route/verb conventions, [RemoteService] toggles, integration services and [IntegrationService]. DO NOT USE FOR: calling a remote ABP HTTP API from C# with client proxies (use consume-remote-services); designing sync-vs-async inter-service communication or the outbox/inbox (use design-module-and-service-communication); building UI pages (use angular-ui / blazor-ui / mvc-razor-ui).

Use ABP's built-in application-configuration and application-localization HTTP endpoints, and extend them with an IApplicationConfigurationContributor. USE FOR: reading /api/abp/application-configuration (current user, granted policies, settings, features, multi-tenancy, timing) and /api/abp/application-localization from a custom client; extending the config with IApplicationConfigurationContributor and AbpApplicationConfigurationOptions. DO NOT USE FOR: publishing your own application services as controllers (use expose-http-apis); calling remote ABP APIs with C# client proxies (use consume-remote-services); consuming the config in Angular/Blazor/MVC startup (use the per-stack UI skill: angular-ui / blazor-ui / mvc-razor-ui); defining settings/features themselves (use manage-settings-and-features); defining permissions (use permissions-and-authorization).

Add API versioning to ABP HTTP APIs so multiple versions of the same service coexist behind static client proxies. USE FOR: AddAbpApiVersioning, query/header/media-type version readers, attaching ApiVersions to conventional controllers, ICurrentApiVersionInfo runtime version switching, the versioned API explorer. DO NOT USE FOR: exposing services as controllers in the first place (use expose-http-apis); Swagger UI / OpenAPI doc setup (use configure-swagger-openapi); generating or calling C# client proxies (use consume-remote-services).

Refresh a user's claims (roles, profile claims, and custom claims added to DynamicClaims) mid-session without re-login — enabling ABP dynamic claims, wiring the middleware, and adding a custom claims contributor in monolith or tiered/microservice setups. (Permissions are not part of the default dynamic-claims set.) USE FOR: IsDynamicClaimsEnabled on AbpClaimsPrincipalFactoryOptions, UseDynamicClaims middleware, RemoteRefreshUrl in tiered apps, IAbpDynamicClaimsPrincipalContributor, IsRemoteRefreshEnabled / WebRemoteDynamicClaimsPrincipalContributorOptions, choosing which DynamicClaims types refresh. DO NOT USE FOR: configuring the auth server itself (token lifetimes, certificates, refresh tokens) — use the configure-openiddict-authentication skill; defining/checking permissions — use the permissions-and-authorization skill; per-entity resource access — use the authorize-resources skill.

Configure the ABP OpenIddict auth server — token lifetimes, refresh tokens, PKCE, disabling the HTTPS requirement in dev, and production signing/encryption certificates. USE FOR: OpenIddictServerBuilder / AbpOpenIddictAspNetCoreOptions setup, SetAccessTokenLifetime/SetRefreshTokenLifetime, enabling refresh_token + offline_access, DisableTransportSecurityRequirement, AddProductionEncryptionAndSigningCertificate, access-token encryption, TokenCleanupOptions. DO NOT USE FOR: defining/checking app permissions — use the permissions-and-authorization skill; per-entity resource access — use the authorize-resources skill; refreshing role/profile/custom claims mid-session without re-login — use the configure-dynamic-claims skill.

Configure the ABP OpenIddict validation (resource-server / API token-validation) side — how an API host validates incoming access tokens, distinct from the auth server that issues them. USE FOR: PreConfigure the OpenIddict builder then .AddValidation(...), or PreConfigure the OpenIddictValidationBuilder, options.AddAudiences, options.UseLocalServer (same-process auth server) vs a remote issuer (options.SetIssuer / AddAbpJwtBearer Authority+Audience), options.UseAspNetCore, ForwardIdentityAuthenticationForBearer, app.UseAbpOpenIddictValidation, introspection (UseIntrospection / SetClientId / SetClientSecret), EnableTokenEntryValidation. DO NOT USE FOR: issuing tokens / configuring the OpenIddict server, token lifetimes, signing/encryption certificates — use configure-openiddict-authentication; refreshing role/profile/custom claims mid-session — use configure-dynamic-claims; Swagger OAuth wiring — use configure-swagger-openapi.

Grant access to a specific entity instance ("edit this document") rather than a global permission — using ABP resource permissions or a standard ASP.NET Core AuthorizationHandler with a resource. USE FOR: per-owner or per-instance access (this project, this document), AddResourcePermission, IAuthorizationService.IsGrantedAsync(resource, name), IResourcePermissionChecker/IResourcePermissionManager, a custom resource-based AuthorizationHandler. DO NOT USE FOR: global named permissions ("can edit documents" for everyone) — use the permissions-and-authorization skill; configuring the auth server (OpenIddict) — use the configure-openiddict-authentication skill; refreshing claims mid-session — use the configure-dynamic-claims skill.

Define and check global named permissions in an ABP app (PermissionDefinitionProvider), protect app services/controllers with [Authorize], check grants via IAuthorizationService / IPermissionChecker, and read the current user through ICurrentUser. USE FOR: defining permissions and groups, granting to roles/users/clients, [Authorize] on services or controllers, programmatic IsGrantedAsync/CheckAsync checks, reading the current user / current principal (ICurrentUser, ICurrentPrincipalAccessor) — id, tenant, roles, claims, and temporarily changing the ambient principal. DO NOT USE FOR: access that depends on a specific entity instance ("this document") — use the authorize-resources skill; configuring the login/token server (OpenIddict) — use the configure-openiddict-authentication skill; refreshing claims mid-session — use the configure-dynamic-claims skill.

Command-line workflow for the ABP Framework abp CLI — creating/scaffolding solutions, updating packages, installing client libs, generating proxies, adding packages/modules, bundling Blazor WASM, logging into abp.io, and switching to local ABP source. USE FOR: running `abp new`, `abp update`, `abp install-libs`, `abp generate-proxy`, `abp add-package`, `abp add-module`, `abp bundle`, `abp login`/`logout`, `abp switch-to-local`; choosing between the classic and ABP Studio CLIs; resolving the "Libs folder is missing" error. DO NOT USE FOR: upgrading an existing solution across a minor/major version and aligning package versions (use version-upgrade); using the CLI-created solution structure itself (use layered-architecture); consuming the generated Angular proxy services in components (use angular-ui).

Decide which ABP solution architecture and template to create before running abp new. USE FOR: choosing between single-layer (app-nolayers), layered (app), modular monolith, and microservice; modern vs classic templates; tiered vs non-tiered; how UI / database / auth-server / license affect template availability; reserving Contracts + integration services + distributed events so a modular monolith can later split into microservices; then routing to abp-cli-commands for the actual command. DO NOT USE FOR: the abp new command syntax, template names, and parameters (abp-cli-commands); DDD project layers and dependency direction within a solution (layered-architecture); designing module/service communication once boundaries exist (design-module-and-service-communication); upgrading an existing solution (version-upgrade).

Work with ABP data filters — the built-in ISoftDelete and IMultiTenant filters, toggling them via IDataFilter scopes, changing default states, and defining custom global query filters for EF Core or MongoDB. USE FOR: reading/writing soft-deleted or cross-tenant data with IDataFilter.Disable/Enable, checking IsEnabled, HardDeleteAsync, changing AbpDataFilterOptions defaults, defining a custom marker-interface filter, wiring it in EF Core (ShouldFilterEntity/CreateFilterExpression/HasAbpQueryFilter) or MongoDB (MongoDbRepositoryFilterer/FilterQueryable). DO NOT USE FOR: switching the active tenant context via ICurrentTenant.Change (that is the multi-tenancy concern); defining a DbContext/repositories or EF Core migrations (use ef-core-integration); MongoDB DbContext/repository setup (use mongodb-integration); transaction/UOW boundaries (use manage-units-of-work); optimistic concurrency (use handle-optimistic-concurrency).

Configure ABP connection strings for modular and multi-tenant apps — the Default connection, per-module databases, grouping modules into one database, and per-tenant database routing. USE FOR: setting the Default connection, giving a module its own database with a named entry, binding a DbContext via [ConnectionStringName], mapping several modules to one DB with AbpDbConnectionOptions.Databases, routing a tenant to its own database, customizing IConnectionStringResolver. DO NOT USE FOR: EF Core DbContext registration/model config (use ef-core-integration), MongoDB client/database setup (use mongodb-integration), creating tenants or the tenant store (use configure-multi-tenancy), unit-of-work/transaction handling (use manage-units-of-work).

Integrate Entity Framework Core into an ABP application: AbpDbContext, AddAbpDbContext registration, default/custom repositories, and code-first migrations with DbMigrator. USE FOR: defining an AbpDbContext with ConfigureByConvention, registering it via AddAbpDbContext, wiring AddDefaultRepositories/AddRepository, writing custom EfCoreRepository classes, resolving the active DbContext via IDbContextProvider, adding dotnet ef migrations, running the DbMigrator. DO NOT USE FOR: consuming the standard IRepository method surface — Get/Find/WithDetails/queryable/bulk (use-abp-repositories); MongoDB integration (use mongodb-integration); controlling transaction/UOW boundaries (use manage-units-of-work); soft-delete/multi-tenant/custom query filters (use apply-data-filters); optimistic concurrency stamps (use handle-optimistic-concurrency); Dapper queries (use query-with-dapper); connection-string resolution/config (use configure-connection-strings); seeding data via IDataSeeder (use seed-application-data).

Enable and handle ABP optimistic concurrency control so concurrent updates to the same record are detected and rejected. USE FOR: enabling concurrency with IHasConcurrencyStamp/ConcurrencyStamp, deriving from aggregate root base classes to get it for free, flowing the stamp through output and update DTOs, handling AbpDbConcurrencyException when two users update the same record. DO NOT USE FOR: EF-Core-specific mapping/change tracking (use ef-core-integration), MongoDB provider setup (use mongodb-integration), unit-of-work flush/transaction control (use manage-units-of-work), general validation/error surfacing (use handle-validation-and-errors).

Control ABP's Unit of Work — transaction and connection scope, explicit UOW scopes, the [UnitOfWork] attribute, and mid-scope SaveChangesAsync. USE FOR: starting explicit scopes with IUnitOfWorkManager.Begin, applying [UnitOfWork], choosing transactional vs non-transactional boundaries, calling SaveChangesAsync mid-scope, working with nested/RequiresNew/reserved scopes, reading IUnitOfWorkManager.Current, using OnCompleted/CompleteAsync/RollbackAsync. DO NOT USE FOR: defining a DbContext or repositories, or EF Core migrations (use ef-core-integration); MongoDB DbContext/repositories (use mongodb-integration); soft-delete/multi-tenant/custom query filters (use apply-data-filters); optimistic concurrency stamps (use handle-optimistic-concurrency); connection-string resolution (use configure-connection-strings).

Integrate MongoDB into an ABP application: AbpMongoDbContext, collection mapping, AddMongoDbContext registration, and custom Mongo repositories. USE FOR: defining an AbpMongoDbContext, mapping collections with [MongoCollection]/CreateModel, registering via AddMongoDbContext, wiring AddDefaultRepositories/AddRepository, writing custom MongoDbRepository classes, reaching the DbContext via IMongoDbContextProvider, using GetCollectionAsync/GetAggregateAsync. DO NOT USE FOR: consuming standard IRepository methods (use-abp-repositories); Entity Framework Core integration, DbContext model builder, or code-first migrations (use ef-core-integration); controlling transaction/UOW boundaries (use manage-units-of-work); soft-delete/multi-tenant/custom query filters or MongoDbRepositoryFilterer (use apply-data-filters); optimistic concurrency (use handle-optimistic-concurrency); connection-string configuration (use configure-connection-strings); seeding data via IDataSeeder (use seed-application-data).

Run raw SQL via Dapper inside an ABP repository for hot-path read/aggregate queries while sharing ABP's unit of work, connection, and transaction. USE FOR: complex or slow queries where EF Core's generated SQL is too slow, hand-written SQL you want full control over, deriving from a DbContext-based DapperRepository and using GetDbConnectionAsync/GetDbTransactionAsync to stay in the current unit of work. DO NOT USE FOR: standard CRUD/LINQ/change tracking/migrations (use ef-core-integration), MongoDB queries (use mongodb-integration), unit-of-work configuration itself (use manage-units-of-work), connection string routing (use configure-connection-strings).

Seed initial or default data into an ABP app or module using ABP's provider-independent data seed system (IDataSeedContributor + IDataSeeder). USE FOR: adding admin user/roles/lookup tables/demo records, seeding per tenant via DataSeedContext.TenantId, running seeding from the .DbMigrator project, seeding data for automated tests. DO NOT USE FOR: schema migrations or EF Core HasData seeding (use ef-core-integration), MongoDB collection setup (use mongodb-integration), tenant creation/routing itself (use configure-multi-tenancy), unit-of-work sizing beyond SeedInSeparateUowAsync (use manage-units-of-work).

Consume ABP's IRepository from application/domain code — the standard method surface, eager loading, provider-neutral querying, tracking, and bulk/direct operations. USE FOR: choosing IRepository / IBasicRepository / IReadOnlyRepository / keyless repositories, GetAsync vs FindAsync not-found semantics, GetListAsync / GetPagedListAsync / GetCountAsync, WithDetailsAsync eager loading (templates don't rely on lazy loading), GetQueryableAsync + IAsyncQueryableExecuter for provider-neutral async LINQ, DisableTracking / [DisableEntityChangeTracking], bulk InsertMany/UpdateMany/DeleteManyAsync, DeleteDirectAsync, HardDeleteAsync, not leaking IQueryable to remote callers. DO NOT USE FOR: defining a custom repository interface + its EF Core / MongoDB implementation (ef-core-integration / mongodb-integration); where repo interfaces live across layers (layered-architecture); data filters / soft-delete (apply-data-filters); optimistic concurrency (handle-optimistic-concurrency).

Embed static assets into assemblies and read/override them at runtime through the ABP Virtual File System. USE FOR: embedding js/css/image/localization files as Embedded Resources, registering them with AbpVirtualFileSystemOptions.FileSets, reading embedded files via IVirtualFileProvider, overriding an embedded file shipped by a depended-on module, dev-time live editing with ReplaceEmbeddedByPhysical. DO NOT USE FOR: storing user uploads / profile pictures / large binary objects in a pluggable storage backend (use store-blobs); the resource/key/translation semantics of localization files (use localize-applications for resources and fallback; menus-and-localization for menu display text).

Save, read and delete named binary objects (BLOBs) in an ABP app through the storage-agnostic IBlobContainer abstraction. USE FOR: storing/reading profile pictures, uploads, attachments or other binary data via IBlobContainer (default or typed), defining typed containers, configuring providers (file system, database, Azure, AWS/S3, MinIO), per-tenant BLOB isolation. DO NOT USE FOR: embedding static js/css/image/localization assets into an assembly or overriding a module's embedded files (use manage-virtual-files); building a full file-management UI with folders/permissions/sharing (blob storing is intentionally not that).

Composable ABP simple-state conditions on definitions and UI state objects. USE FOR: ISimpleStateChecker, ISimpleStateCheckerManager, permission/feature/authentication conditions on IHasSimpleStateCheckers. DO NOT USE FOR: tenant/edition feature values (manage-settings-and-features); permission authorization of a service call (permissions-and-authorization); startup-time module capabilities (toggle-global-features).

ABP audit logging: per-request log of requests, actions, entity change history, exceptions. USE FOR: enabling/disabling auditing, GET request logging, entity change history, AuditLogContributors, ignoring types, [Audited]/[DisableAuditing], manual scopes with IAuditingManager. DO NOT USE FOR: general application/UI logging or Serilog (configure-logging); setting/feature values (manage-settings-and-features); background jobs/workers/handlers (background-jobs-and-events).

ABP startup, runtime, exception logging, and the startup-template Serilog bridge. USE FOR: typed ILogger in ABP services; IInitLoggerFactory/GetInitLogger startup buffering; ABP exceptions via LogException; Serilog via UseSerilog. DO NOT USE FOR: audit-log persistence and entity history (configure-audit-logging); distributed traces and metrics (out of scope, wire the OpenTelemetry .NET SDK directly); exception-to-HTTP response details (handle-validation-and-errors).

ABP IStringEncryptionService with compatible passphrase, salt, IV, key-size options. USE FOR: reversible encryption used by ABP infra; AbpStringEncryptionOptions defaults and config keys; Encrypt/Decrypt null behavior; encrypted setting values. DO NOT USE FOR: password hashing, signing, token generation, or crypto protocol design; defining encrypted ABP settings (manage-settings-and-features).

ABP IGuidGenerator entity IDs and sequential GUID layout for the active database provider. USE FOR: IGuidGenerator.Create; SequentialGuidGenerator; SimpleGuidGenerator; AbpSequentialGuidGeneratorOptions.DefaultSequentialGuidType; SequentialAtEnd / SequentialAsString / SequentialAsBinary. DO NOT USE FOR: cache keys and invalidation (cache-entities); cryptographic tokens or secrets (encrypt-strings); schema and repository design.

ABP DateTime, UTC normalization, time zones, persistence. USE FOR: IClock and AbpClockOptions; Utc/Local/Unspecified; Clock.Normalize; EF Core DateTime converters and DisableDateTimeNormalization; per-request tenant/user timezone; ITimezoneProvider Windows/IANA. DO NOT USE FOR: timezone settings (manage-settings-and-features); audit-log persistence (configure-audit-logging); multi-tenancy resolution (configure-multi-tenancy).

ABP AI workspaces with Microsoft.Extensions.AI, Microsoft Agent Framework, or Microsoft.SemanticKernel. USE FOR: choosing an ABP AI abstraction, AbpAIModule, AbpAIWorkspaceOptions, resolving IChatClient/IChatClientAccessor/IKernelAccessor, per-workspace provider/model config. DO NOT USE FOR: general .NET AI/ML outside ABP's workspace integration (out of scope); AI-call observability (out of scope); tenant-editable AI providers via the commercial AI Management module.

Replace the default Microsoft DI provider with ABP's Autofac integration. USE FOR: AbpAutofacModule, UseAutofac on IHostBuilder / AbpApplicationCreationOptions, property injection and Castle interception. DO NOT USE FOR: implementing/debugging interceptors (use-interceptors-and-dynamic-proxy); registering/replacing/decorating services (register-and-replace-services); module lifecycle config (define-application-modules).

ABP settings (config values) and features (tenant/edition on/off or valued capabilities). USE FOR: SettingDefinitionProvider / ISettingProvider, FeatureDefinitionProvider / IFeatureChecker / [RequiresFeature], custom value providers, ISettingManager and IFeatureManager. DO NOT USE FOR: typed distributed caching or locking (distributed-caching-and-locking); user/role authorization (permissions-and-authorization); multi-tenant resolution (configure-multi-tenancy).

Compress/resize image streams or byte arrays via ABP IImageCompressor and IImageResizer with a separate provider. USE FOR: ImageCompressResult and ImageResizeResult; ImageResizeArgs and ImageResizeMode; stream/byte-array overloads; ImageSharp, MagickNet, or SkiaSharp. DO NOT USE FOR: upload authorization (permissions-and-authorization); CSRF on uploads (secure-web-requests); caching images (distributed-caching-and-locking); background jobs (background-jobs-and-events).

ABP correlation IDs through ASP.NET Core requests and ABP HTTP client proxies. USE FOR: AbpCorrelationIdOptions, UseCorrelationId, ICorrelationIdProvider, X-Correlation-Id propagation between services. DO NOT USE FOR: tracing exporters or OpenTelemetry spans (out of scope); general HTTP security middleware (secure-web-requests); distributed event transport (background-jobs-and-events).

Read and bootstrap Microsoft.Extensions.Configuration in ABP apps and modules. USE FOR: IConfiguration in AbpModule/services, ServiceConfigurationContext.Configuration, IServiceCollection.GetConfiguration, AbpApplicationCreationOptions.Configuration, ConfigurationHelper. DO NOT USE FOR: dynamic settings or tenant/user overrides (manage-settings-and-features); typed options binding (define-application-modules); connection strings (configure-connection-strings).

ABP IJsonSerializer and its default System.Text.Json provider. USE FOR: Serialize/Deserialize overloads; camelCase and indented flags; AbpSystemTextJsonSerializerOptions.JsonSerializerOptions; AbpJsonOptions date formats; ABP converters and JSON contract modifiers. DO NOT USE FOR: ASP.NET Core MVC response JSON (out of scope); distributed cache entry serialization (distributed-caching-and-locking); encrypting serialized values (encrypt-strings).

ABP Global Features toggled before startup to include/remove whole module capabilities. USE FOR: GlobalFeatureManager, GlobalFeature/GlobalModuleFeatures, GlobalFeatureConfigurator, [RequiresGlobalFeature], startup-time controller/page/database-model gating. DO NOT USE FOR: tenant/edition feature values or [RequiresFeature] (manage-settings-and-features); user/role permissions (permissions-and-authorization); runtime configuration flags (read-configuration).

Cooperative cancellation across ABP services/repositories/UOW via ICancellationTokenProvider. USE FOR: ICancellationTokenProvider.Token and Use; NullCancellationTokenProvider; HttpContextCancellationTokenProvider and RequestAborted; FallbackToProvider precedence; passing CancellationToken through methods. DO NOT USE FOR: background job retry (background-jobs-and-events); generic async performance (out of scope); HTTP auth (configure-openiddict-authentication).

ABP cross-cutting behavior via Castle dynamic proxies and IAbpInterceptor. USE FOR: how validation, unit of work, authorization, auditing, feature interceptors are selected; interceptor not running; custom interceptor via Services.OnRegistered. DO NOT USE FOR: module lifecycle (define-application-modules); audit-log persistence (configure-audit-logging); feature values (manage-settings-and-features); services without interception (register-and-replace-services).