From ba9fc291117a52c7b653c16d3a8a29e6e92c4bf8 Mon Sep 17 00:00:00 2001
From: KrzysztofPajak <krzysiek@grandnode.com>
Date: Sun, 9 Aug 2026 22:08:47 +0200
Subject: [PATCH] Move the business layer implementations to the hosts

Grand.Web.Common referenced all nine Grand.Business.* implementations
alongside the contracts in Grand.Business.Core, without using a single
type from any of them. Because Grand.Web is built on Grand.Web.Common,
and Grand.Plugin.props points every plugin at it too, the shared web
layer and each plugin compiled against the whole business layer for no
reason.

The references were never about code. Each implementation carries a
Startup/StartupApplication.cs, and TypeSearcher discovers
IStartupApplication by walking the assemblies present in the AppDomain -
so an implementation the host does not reference is never registered.
That makes the host, as the composition root, the place they belong.
src/Build/Grand.Host.props holds the list once, the way
Grand.Plugin.props already does for plugins, and says why removing an
entry costs an entire area's DI registration with nothing failing at
build time.

Each host's dependency closure is unchanged: the same nine assemblies are
still referenced, copied and written to deps.json. Only the compile-time
graph of Grand.Web.Common shrinks, from twelve project references to
three.

One consequence was not obvious. Those references were also an implicit
version floor for Grand.Web.AdminShared: the Scryber.Core graph outvoted
elFinder.Net.* 1.5.0, and without them elFinder won with Newtonsoft.Json
11.0.2 (GHSA-5crp-9r3c-p9vr) and SixLabors.ImageSharp 2.0.0
(GHSA-2cmq-823j-5qj8 and six more). The floor is now stated explicitly
next to the existing Microsoft.AspNetCore.Http pin, which exists for the
same package graph and the same reason, and resolves back to the
13.0.3 and 3.1.12 that the accident used to produce.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 Directory.Packages.props                      |  2 +
 src/Build/Grand.Host.props                    | 41 +++++++++++++++++++
 .../Grand.Web.Admin/Grand.Web.Admin.csproj    |  1 +
 .../Grand.Web.AdminShared.csproj              | 11 +++++
 .../Grand.Web.Common/Grand.Web.Common.csproj  | 13 ------
 .../Grand.Web.Store/Grand.Web.Store.csproj    |  1 +
 .../Grand.Web.Vendor/Grand.Web.Vendor.csproj  |  1 +
 src/Web/Grand.Web/Grand.Web.csproj            |  1 +
 8 files changed, 58 insertions(+), 13 deletions(-)
 create mode 100644 src/Build/Grand.Host.props

diff --git a/Directory.Packages.props b/Directory.Packages.props
index 6fdf625a4..7159cbd14 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -7,6 +7,8 @@
     <PackageVersion Include="ExcelMapper" Version="6.0.641" />
     <PackageVersion Include="MessagePack" Version="3.1.8" />
     <PackageVersion Include="Microsoft.AspNetCore.Http" Version="2.3.11" />
+    <PackageVersion Include="Newtonsoft.Json" Version="13.0.3" />
+    <PackageVersion Include="SixLabors.ImageSharp" Version="3.1.12" />
     <PackageVersion Include="Microsoft.AspNetCore.OpenApi" Version="10.0.10" />
     <PackageVersion Include="Microsoft.FeatureManagement.AspNetCore" Version="4.6.0" />
     <PackageVersion Include="Microsoft.OpenApi" Version="2.11.0" />
diff --git a/src/Build/Grand.Host.props b/src/Build/Grand.Host.props
new file mode 100644
index 000000000..372c61877
--- /dev/null
+++ b/src/Build/Grand.Host.props
@@ -0,0 +1,41 @@
+<Project>
+
+    <!--
+        The business layer implementations, referenced by the hosts - and only by the hosts.
+
+        Nothing in the web layer links a type from these assemblies: the whole solution compiles
+        against the contracts in Grand.Business.Core. What these references are for is presence.
+        Each of the nine projects carries a Startup/StartupApplication.cs, and TypeSearcher finds
+        IStartupApplication by walking the assemblies loaded in the AppDomain
+        (Grand.Infrastructure/TypeSearch/TypeSearcher.cs). An implementation that is not referenced
+        by the host never reaches the host's output, is never loaded, and its services are never
+        registered.
+
+        So this list looks removable and is not. Dropping an entry costs an entire business area's
+        DI registration, and nothing fails at build time - the first sign is a resolution failure
+        on a request at runtime.
+
+        These belong to the host because the host is the composition root. They used to sit in
+        Grand.Web.Common, which meant the shared web layer - and through it every plugin, since
+        Grand.Plugin.props references it - compiled against the entire business layer for no
+        reason at all.
+
+        Private is left at its default: unlike a plugin, the host is exactly where these
+        assemblies are supposed to be copied.
+
+        Paths are anchored to this file so a host can sit at any depth.
+    -->
+
+    <ItemGroup>
+        <ProjectReference Include="$(MSBuildThisFileDirectory)..\Business\Grand.Business.Authentication\Grand.Business.Authentication.csproj" />
+        <ProjectReference Include="$(MSBuildThisFileDirectory)..\Business\Grand.Business.Catalog\Grand.Business.Catalog.csproj" />
+        <ProjectReference Include="$(MSBuildThisFileDirectory)..\Business\Grand.Business.Checkout\Grand.Business.Checkout.csproj" />
+        <ProjectReference Include="$(MSBuildThisFileDirectory)..\Business\Grand.Business.Cms\Grand.Business.Cms.csproj" />
+        <ProjectReference Include="$(MSBuildThisFileDirectory)..\Business\Grand.Business.Common\Grand.Business.Common.csproj" />
+        <ProjectReference Include="$(MSBuildThisFileDirectory)..\Business\Grand.Business.Customers\Grand.Business.Customers.csproj" />
+        <ProjectReference Include="$(MSBuildThisFileDirectory)..\Business\Grand.Business.Marketing\Grand.Business.Marketing.csproj" />
+        <ProjectReference Include="$(MSBuildThisFileDirectory)..\Business\Grand.Business.Messages\Grand.Business.Messages.csproj" />
+        <ProjectReference Include="$(MSBuildThisFileDirectory)..\Business\Grand.Business.Storage\Grand.Business.Storage.csproj" />
+    </ItemGroup>
+
+</Project>
diff --git a/src/Web/Grand.Web.Admin/Grand.Web.Admin.csproj b/src/Web/Grand.Web.Admin/Grand.Web.Admin.csproj
index 618afe4d5..8bf8d66b7 100644
--- a/src/Web/Grand.Web.Admin/Grand.Web.Admin.csproj
+++ b/src/Web/Grand.Web.Admin/Grand.Web.Admin.csproj
@@ -1,5 +1,6 @@
 <Project Sdk="Microsoft.NET.Sdk.Web">
 	<Import Project="..\..\Build\Grand.Common.props" />
+	<Import Project="..\..\Build\Grand.Host.props" />
 	<PropertyGroup>
 		<AddRazorSupportForMvc>true</AddRazorSupportForMvc>
 		<ServerGarbageCollection>true</ServerGarbageCollection>
diff --git a/src/Web/Grand.Web.AdminShared/Grand.Web.AdminShared.csproj b/src/Web/Grand.Web.AdminShared/Grand.Web.AdminShared.csproj
index 8f965a46f..3543d02a4 100644
--- a/src/Web/Grand.Web.AdminShared/Grand.Web.AdminShared.csproj
+++ b/src/Web/Grand.Web.AdminShared/Grand.Web.AdminShared.csproj
@@ -17,5 +17,16 @@
 		     Microsoft.AspNetCore.Http 2.1.1 has a known high severity advisory (GHSA-hxrm-9w7p-39cc).
 		     This reference lifts it to a patched 2.x. Remove only together with elFinder. -->
 		<PackageReference Include="Microsoft.AspNetCore.Http" />
+		<!-- Same story, same package graph. elFinder.Net.Core 1.5.0 brings Newtonsoft.Json 11.0.2
+		     (GHSA-5crp-9r3c-p9vr) and SixLabors.ImageSharp 2.0.0 (GHSA-2cmq-823j-5qj8 and six more),
+		     and neither is used from this project's code.
+
+		     Until Grand.Web.Common referenced the whole business layer, these floors arrived by
+		     accident: Scryber.Core and the rest of that graph outvoted elFinder and the versions
+		     below are exactly what resolved then. Moving those references to the hosts, where they
+		     belong, took the accident away and the vulnerable versions surfaced - so the floor is
+		     stated here on purpose. Remove only together with elFinder. -->
+		<PackageReference Include="Newtonsoft.Json" />
+		<PackageReference Include="SixLabors.ImageSharp" />
 	</ItemGroup>
 </Project>
diff --git a/src/Web/Grand.Web.Common/Grand.Web.Common.csproj b/src/Web/Grand.Web.Common/Grand.Web.Common.csproj
index 607719f89..e021874b4 100644
--- a/src/Web/Grand.Web.Common/Grand.Web.Common.csproj
+++ b/src/Web/Grand.Web.Common/Grand.Web.Common.csproj
@@ -17,18 +17,5 @@
 		<ProjectReference Include="..\..\Core\Grand.Infrastructure\Grand.Infrastructure.csproj" />
 		<ProjectReference Include="..\..\Core\Grand.SharedKernel\Grand.SharedKernel.csproj" />
 	</ItemGroup>
-	
-	<ItemGroup>
-		<ProjectReference Include="..\..\Business\Grand.Business.Authentication\Grand.Business.Authentication.csproj" />
-		<ProjectReference Include="..\..\Business\Grand.Business.Catalog\Grand.Business.Catalog.csproj" />
-		<ProjectReference Include="..\..\Business\Grand.Business.Checkout\Grand.Business.Checkout.csproj" />
-		<ProjectReference Include="..\..\Business\Grand.Business.Cms\Grand.Business.Cms.csproj" />
-		<ProjectReference Include="..\..\Business\Grand.Business.Common\Grand.Business.Common.csproj" />
-		<ProjectReference Include="..\..\Business\Grand.Business.Customers\Grand.Business.Customers.csproj" />
-		<ProjectReference Include="..\..\Business\Grand.Business.Marketing\Grand.Business.Marketing.csproj" />
-		<ProjectReference Include="..\..\Business\Grand.Business.Messages\Grand.Business.Messages.csproj" />
-		<ProjectReference Include="..\..\Business\Grand.Business.Storage\Grand.Business.Storage.csproj" />
-	</ItemGroup>
-
 
 </Project>
\ No newline at end of file
diff --git a/src/Web/Grand.Web.Store/Grand.Web.Store.csproj b/src/Web/Grand.Web.Store/Grand.Web.Store.csproj
index 3031821f6..ad0a7be75 100644
--- a/src/Web/Grand.Web.Store/Grand.Web.Store.csproj
+++ b/src/Web/Grand.Web.Store/Grand.Web.Store.csproj
@@ -1,6 +1,7 @@
 <Project Sdk="Microsoft.NET.Sdk.Web">
 
   <Import Project="..\..\Build\Grand.Common.props" />
+  <Import Project="..\..\Build\Grand.Host.props" />
 	<PropertyGroup>
 		<AddRazorSupportForMvc>true</AddRazorSupportForMvc>
 		<ServerGarbageCollection>true</ServerGarbageCollection>
diff --git a/src/Web/Grand.Web.Vendor/Grand.Web.Vendor.csproj b/src/Web/Grand.Web.Vendor/Grand.Web.Vendor.csproj
index 0e082d854..5ba2f8eab 100644
--- a/src/Web/Grand.Web.Vendor/Grand.Web.Vendor.csproj
+++ b/src/Web/Grand.Web.Vendor/Grand.Web.Vendor.csproj
@@ -1,5 +1,6 @@
 <Project Sdk="Microsoft.NET.Sdk.Web">
     <Import Project="..\..\Build\Grand.Common.props" />
+    <Import Project="..\..\Build\Grand.Host.props" />
     <PropertyGroup>
         <AddRazorSupportForMvc>true</AddRazorSupportForMvc>
         <ServerGarbageCollection>false</ServerGarbageCollection>
diff --git a/src/Web/Grand.Web/Grand.Web.csproj b/src/Web/Grand.Web/Grand.Web.csproj
index f0c2420e1..394818e8d 100644
--- a/src/Web/Grand.Web/Grand.Web.csproj
+++ b/src/Web/Grand.Web/Grand.Web.csproj
@@ -1,5 +1,6 @@
 <Project Sdk="Microsoft.NET.Sdk.Web">
 	<Import Project="..\..\Build\Grand.Common.props" />
+	<Import Project="..\..\Build\Grand.Host.props" />
 	<PropertyGroup>
 		<!--The common language runtime (CLR) supports two types of garbage collection:
 		workstation garbage collection, which is available on all systems, and server garbage collection,