Update Examine to 3.8.0.

* Fix: prevent open redirect in public surface controllers by validating RedirectUrl with Url.IsLocalUrl

* Fixed spacing in comment.

---------

Co-authored-by: Lan Nguyen Thuy <lnt@umbraco.dk>
Co-authored-by: Andy Butland <abutland73@gmail.com>

.artifactignore

@@ -1,3 +1,3 @@
 **/*
-!**/bin/**
-!**/obj/**
+!tests/Umbraco.Tests.Integration/bin/**
+!tests/Umbraco.Tests.UnitTests/bin/**

.devcontainer/Dockerfile

@@ -1,36 +1,15 @@
-# [Choice] .NET Core version: 5.0, 3.1, 2.1
-ARG VARIANT=3.1
-FROM mcr.microsoft.com/vscode/devcontainers/dotnetcore:0-${VARIANT}
+# [Choice] .NET version: 6.0, 3.1, 6.0-bullseye, 3.1-bullseye, 6.0-focal, 3.1-focal
+ARG VARIANT=6.0-bullseye
+FROM mcr.microsoft.com/vscode/devcontainers/dotnet:0-${VARIANT}
 
-# [Option] Install Node.js
-ARG INSTALL_NODE="true"
-ARG NODE_VERSION="lts/*"
-RUN if [ "${INSTALL_NODE}" = "true" ]; then su vscode -c "umask 0002 && . /usr/local/share/nvm/nvm.sh && nvm install ${NODE_VERSION} 2>&1"; fi
-
-# [Option] Install Azure CLI
-ARG INSTALL_AZURE_CLI="false"
-COPY library-scripts/azcli-debian.sh /tmp/library-scripts/
-RUN if [ "$INSTALL_AZURE_CLI" = "true" ]; then bash /tmp/library-scripts/azcli-debian.sh; fi \
-    && apt-get clean -y && rm -rf /var/lib/apt/lists/* /tmp/library-scripts
-
-# Install SQL Tools: SQLPackage and sqlcmd
-COPY mssql/installSQLtools.sh installSQLtools.sh
-RUN bash ./installSQLtools.sh \
-     && apt-get clean -y && rm -rf /var/lib/apt/lists/* /tmp/library-scripts
-
-# Update args in docker-compose.yaml to set the UID/GID of the "vscode" user.
-ARG USER_UID=1000
-ARG USER_GID=$USER_UID
-RUN if [ "$USER_GID" != "1000" ] || [ "$USER_UID" != "1000" ]; then groupmod --gid $USER_GID vscode && usermod --uid $USER_UID --gid $USER_GID vscode; fi
+# [Choice] Node.js version: none, lts/*, 18, 16, 14
+ARG NODE_VERSION="none"
+RUN if [ "${NODE_VERSION}" != "none" ]; then su vscode -c "umask 0002 && . /usr/local/share/nvm/nvm.sh && nvm install ${NODE_VERSION} 2>&1"; fi
 
 
 # [Optional] Uncomment this section to install additional OS packages.
-# Following added by Warren...
-# Needed to add as Gifsicle used by gulp-imagemin does not ship a Linux binary and has to be compiled from source
-# And this Linux package is needed in order to build it
-# https://github.com/imagemin/imagemin-gifsicle/issues/40#issuecomment-616487214
-RUN apt-get update && export DEBIAN_FRONTEND=noninteractive \
-    && apt-get -y install --no-install-recommends dh-autoreconf chromium-browser
+# RUN apt-get update && export DEBIAN_FRONTEND=noninteractive \
+#     && apt-get -y install --no-install-recommends <your-package-list-here>
 
 # [Optional] Uncomment this line to install global node packages.
 # RUN su vscode -c "source /usr/local/share/nvm/nvm.sh && npm install -g <your-package-here>" 2>&1
@@ -42,8 +21,4 @@ RUN apt-get update && export DEBIAN_FRONTEND=noninteractive \
 # Needing to set unsafe-perm as root is the user setup
 # https://docs.npmjs.com/cli/v6/using-npm/config#unsafe-perm
 # Default: false if running as root, true otherwise (we are ROOT)
-RUN npm -g config set user vscode && npm -g config set unsafe-perm
-
-# Generate and trust a local developer certificate for Kestrel
-# This is needed for Kestrel to bind on https
-RUN dotnet dev-certs https --trust
+#RUN npm -g config set user vscode && npm -g config set unsafe-perm

.devcontainer/devcontainer.json

@@ -1,41 +1,75 @@
 // For format details, see https://aka.ms/devcontainer.json. For config options, see the README at:
-// https://github.com/microsoft/vscode-dev-containers/tree/v0.158.0/containers/dotnet-mssql
+// https://github.com/microsoft/vscode-dev-containers/tree/main/containers/dotnet
 {
-	"name": "C# (.NET) and MS SQL",
+	"name": "C# (.NET) Umbraco & SMTP4Dev",
 	"dockerComposeFile": "docker-compose.yml",
 	"service": "app",
 	"workspaceFolder": "/workspace",
-
+	
+	
 	// Set *default* container specific settings.json values on container create.
-	"settings": {
-		"terminal.integrated.shell.linux": "/bin/bash",
-		"mssql.connections": [
-			{
-				"server": "localhost,1433",
-				"database": "",
-				"authenticationType": "SqlLogin",
-				"user": "sa",
-				"password": "P@ssw0rd",
-				"emptyPasswordInput": false,
-				"savePassword": false,
-				"profileName": "mssql-container"
-			}
-		],
+	"settings": {		
 		"omnisharp.defaultLaunchSolution": "umbraco.sln",
 		"omnisharp.enableDecompilationSupport": true,
 		"omnisharp.enableRoslynAnalyzers": true
 	},
 
+	"features": {
+		// Workaround until the image is updated to include the latest version of .NET Core - .NET7
+		// https://github.com/devcontainers/templates/issues/38#issuecomment-1310803259		
+		"ghcr.io/devcontainers/features/dotnet:1": {
+			"version": "7"
+		},
+
+		// Adds SSH support to the container
+		// Allowing the Github CLI `gh codespace ssh` to work
+		"ghcr.io/devcontainers/features/sshd:1": {
+			"version": "latest"
+		},
+
+		// Adds SQLite feature from apt install
+		// Also adds the SQLite VSCode extension
+		"ghcr.io/warrenbuckley/codespace-features/sqlite:1": {}
+	},
+
 	// Add the IDs of extensions you want installed when the container is created.
 	"extensions": [
-		"ms-dotnettools.csharp",
-		"ms-mssql.mssql"
+		"ms-dotnettools.csharp"
+	],
+	
+	// This is used in the prebuilds - so dotnet build (nuget restore and node stuff) is done
+	"updateContentCommand": "dotnet build umbraco.sln && dotnet dev-certs https --trust",
+
+	// Use 'forwardPorts' to make a list of ports inside the container available locallAdd	"forwardPorts": [9000, 5000, 25],
+	// Port needed to help discover SMTP4Dev
+	"forwardPorts": [
+		5000
 	],
 
-	// Use 'forwardPorts' to make a list of ports inside the container available locally.
-	// 1433 for SQL if you want to connect from local into the one running inside the container
-	// Can connect to the SQL Server running in the image on local with 'host.docker.internal' as hostname
-	"forwardPorts": [1433, 9000, 5000, 25],
+	"portsAttributes": {
+		"5000": {
+			"label": "SMTP4Dev",
+			"protocol": "http",
+			"onAutoForward": "notify"
+		},
+		"9000": {
+			"label": "Umbraco HTTP",
+			"protocol": "http",
+			"onAutoForward": "notify"
+		},
+		"44331": {
+			"label": "Umbraco HTTPS",
+			"protocol": "https",
+			"onAutoForward": "notify"
+		}
+	},
+	"customizations": {
+		"codespaces": {
+		  "openFiles": [
+			".github/codespaces-readme.md"
+		  ]
+		}
+	}
 
 	// [Optional] To reuse of your local HTTPS dev cert:
 	//
@@ -56,6 +90,4 @@
 	//      2. Drag ~/.aspnet/https/aspnetapp.pfx into the root of the file explorer
 	//      3. Open a terminal in VS Code and run "mkdir -p /home/vscode/.aspnet/https && mv aspnetapp.pfx /home/vscode/.aspnet/https"
 
-	// postCreateCommand.sh parameters: $1=SA password, $2=dacpac path, $3=sql script(s) path
-	"postCreateCommand": "bash .devcontainer/mssql/postCreateCommand.sh 'P@ssw0rd' './bin/Debug/' './.devcontainer/mssql/'"	
 }

.devcontainer/docker-compose.yml

@@ -6,15 +6,10 @@ services:
       context: .
       dockerfile: Dockerfile
       args:
-        # [Choice] Update 'VARIANT' to pick a .NET Core version: 2.1, 3.1, 5.0
-        VARIANT: 5.0
+        # [Choice] .NET version: 6.0, 3.1, 6.0-bullseye, 3.1-bullseye, 6.0-focal, 3.1-focal
+        VARIANT: 6.0-bullseye
         # Options
-        INSTALL_NODE: "true"
         NODE_VERSION: "lts/*"
-        INSTALL_AZURE_CLI: "false"
-        # On Linux, you may need to update USER_UID and USER_GID below if not your local UID is not 1000.
-        USER_UID: 1000
-        USER_GID: 1000
 
     volumes:
       - ..:/workspace:cached
@@ -22,9 +17,6 @@ services:
     # Overrides default command so things don't shut down after the process ends.
     command: sleep infinity
 
-    # Runs app on the same network as the database container, allows "forwardPorts" in devcontainer.json function.
-    network_mode: service:db
-
     # Uncomment the next line to use a non-root user for all processes.
     # user: vscode
 
@@ -34,7 +26,8 @@ services:
     # DotNetCore ENV Variables
     # https://docs.microsoft.com/en-us/aspnet/core/fundamentals/configuration/?view=aspnetcore-5.0#environment-variables
     environment:
-    - ConnectionStrings__umbracoDbDSN=server=localhost;database=UmbracoUnicore;user id=sa;password='P@ssw0rd'
+    - ConnectionStrings__umbracoDbDSN=Data Source=|DataDirectory|/Umbraco.sqlite.db;Cache=Shared;Foreign Keys=True;Pooling=True
+    - ConnectionStrings__umbracoDbDSN_ProviderName=Microsoft.Data.Sqlite
     - Umbraco__CMS__Unattended__InstallUnattended=true
     - Umbraco__CMS__Unattended__UnattendedUserName=Admin
     - Umbraco__CMS__Unattended__UnattendedUserEmail=test@umbraco.com
@@ -43,16 +36,6 @@ services:
     - Umbraco__CMS__Global__Smtp__Port=25
     - Umbraco__CMS__Global__Smtp__From=noreply@umbraco.test
 
-  db:
-    image: mcr.microsoft.com/mssql/server:2019-latest
-    restart: unless-stopped
-    environment:
-      SA_PASSWORD: P@ssw0rd
-      ACCEPT_EULA: Y
-
-    # Add "forwardPorts": ["1433"] to **devcontainer.json** to forward MSSQL locally.
-    # (Adding the "ports" property to this file will not forward from a Codespace.)
-
   smtp4dev:
     image: rnwood/smtp4dev:v3
     restart: always

.devcontainer/library-scripts/azcli-debian.sh

@@ -1,33 +0,0 @@
-#!/usr/bin/env bash
-#-------------------------------------------------------------------------------------------------------------
-# Copyright (c) Microsoft Corporation. All rights reserved.
-# Licensed under the MIT License. See https://go.microsoft.com/fwlink/?linkid=2090316 for license information.
-#-------------------------------------------------------------------------------------------------------------
-#
-# Docs: https://github.com/microsoft/vscode-dev-containers/blob/master/script-library/docs/azcli.md
-#
-# Syntax: ./azcli-debian.sh
-
-set -e
-
-if [ "$(id -u)" -ne 0 ]; then
-    echo -e 'Script must be run as root. Use sudo, su, or add "USER root" to your Dockerfile before running this script.'
-    exit 1
-fi
-
-export DEBIAN_FRONTEND=noninteractive
-
-# Install curl, apt-transport-https, lsb-release, or gpg if missing
-if ! dpkg -s apt-transport-https curl ca-certificates lsb-release > /dev/null 2>&1 || ! type gpg > /dev/null 2>&1; then
-    if [ ! -d "/var/lib/apt/lists" ] || [ "$(ls /var/lib/apt/lists/ | wc -l)" = "0" ]; then
-        apt-get update
-    fi
-    apt-get -y install --no-install-recommends apt-transport-https curl ca-certificates lsb-release gnupg2 
-fi
-
-# Install the Azure CLI
-echo "deb [arch=amd64] https://packages.microsoft.com/repos/azure-cli/ $(lsb_release -cs) main" > /etc/apt/sources.list.d/azure-cli.list
-curl -sL https://packages.microsoft.com/keys/microsoft.asc | (OUT=$(apt-key add - 2>&1) || echo $OUT)
-apt-get update
-apt-get install -y azure-cli
-echo "Done!"

.devcontainer/mssql/BlankDb.sql

@@ -1,11 +0,0 @@
-/*
-    This will generate a blank database when the container is spun up
-    that you can use to connect to for the SQL configuration in the web installer flow
-
-    ---- NOTE ----
-    Any .sql files in this folder will be executed 
-    Along with any .dacpac will be restored as databases 
-    See postCreateCommand.sh for specifics 
-*/
-CREATE DATABASE UmbracoUnicore;
-GO

.devcontainer/mssql/installSQLtools.sh

@@ -1,16 +0,0 @@
-#!/bin/bash
-set -echo
-echo "Installing mssql-tools"
-curl -sSL https://packages.microsoft.com/keys/microsoft.asc | (OUT=$(apt-key add - 2>&1) || echo $OUT)
-DISTRO=$(lsb_release -is | tr '[:upper:]' '[:lower:]')
-CODENAME=$(lsb_release -cs)
-echo "deb [arch=amd64] https://packages.microsoft.com/repos/microsoft-${DISTRO}-${CODENAME}-prod ${CODENAME} main" > /etc/apt/sources.list.d/microsoft.list
-apt-get update
-ACCEPT_EULA=Y apt-get -y install unixodbc-dev msodbcsql17 libunwind8 mssql-tools
-
-echo "Installing sqlpackage"
-curl -sSL -o sqlpackage.zip "https://aka.ms/sqlpackage-linux"
-mkdir /opt/sqlpackage
-unzip sqlpackage.zip -d /opt/sqlpackage 
-rm sqlpackage.zip
-chmod a+x /opt/sqlpackage/sqlpackage

.devcontainer/mssql/postCreateCommand.sh

@@ -1,64 +0,0 @@
-#!/bin/bash
-dacpac="false"
-sqlfiles="false"
-SApassword=$1
-dacpath=$2
-sqlpath=$3
-
-echo "SELECT * FROM SYS.DATABASES" | dd of=testsqlconnection.sql
-for i in {1..60};
-do
-    /opt/mssql-tools/bin/sqlcmd -S localhost -U sa -P $SApassword -d master -i testsqlconnection.sql > /dev/null
-    if [ $? -eq 0 ]
-    then
-        echo "SQL server ready"
-        break
-    else
-        echo "Not ready yet..."
-        sleep 1
-    fi
-done
-rm testsqlconnection.sql
-
-for f in $dacpath/*
-do
-    if [ $f == $dacpath/*".dacpac" ]
-    then
-        dacpac="true"
-        echo "Found dacpac $f"
-    fi
-done
-
-for f in $sqlpath/*
-do
-    if [ $f == $sqlpath/*".sql" ]
-    then
-        sqlfiles="true"
-        echo "Found SQL file $f"
-    fi
-done
-
-if [ $sqlfiles == "true" ]
-then
-    for f in $sqlpath/*
-    do
-        if [ $f == $sqlpath/*".sql" ]
-        then
-            echo "Executing $f"
-            /opt/mssql-tools/bin/sqlcmd -S localhost -U sa -P $SApassword -d master -i $f
-        fi
-    done
-fi
-
-if [ $dacpac == "true" ] 
-then
-    for f in $dacpath/*
-    do
-        if [ $f == $dacpath/*".dacpac" ]
-        then
-            dbname=$(basename $f ".dacpac")
-            echo "Deploying dacpac $f"
-            /opt/sqlpackage/sqlpackage /Action:Publish /SourceFile:$f /TargetServerName:localhost /TargetDatabaseName:$dbname /TargetUser:sa /TargetPassword:$SApassword
-        fi
-    done
-fi

.editorconfig

@@ -248,6 +248,7 @@ csharp_preserve_single_line_blocks = true
 ##########################################
 
 [*.{cs,csx,cake,vb,vbx}]
+dotnet_diagnostic.CS1591.severity = suggestion
 
 ##########################################
 # Styles
@@ -282,7 +283,7 @@ dotnet_naming_style.internal_error_style.required_suffix = ____INTERNAL_ERROR___
 
 # All public/protected/protected_internal constant fields must be PascalCase
 # https://docs.microsoft.com/dotnet/standard/design-guidelines/field
-dotnet_naming_symbols.public_protected_constant_fields_group.applicable_accessibilities = public, protected, protected_internal
+dotnet_naming_symbols.public_protected_constant_fields_group.applicable_accessibilities = public, protected, protected_internal, internal, private
 dotnet_naming_symbols.public_protected_constant_fields_group.required_modifiers         = const
 dotnet_naming_symbols.public_protected_constant_fields_group.applicable_kinds           = field
 dotnet_naming_rule.public_protected_constant_fields_must_be_pascal_case_rule.symbols    = public_protected_constant_fields_group
@@ -356,24 +357,13 @@ dotnet_naming_rule.parameters_rule.symbols              = parameters_group
 dotnet_naming_rule.parameters_rule.style                = camel_case_style
 dotnet_naming_rule.parameters_rule.severity             = warning
 
-# Private static fields use camelCase and start with s_
-dotnet_naming_symbols.private_static_field_symbols.applicable_accessibilities                        = private
-dotnet_naming_symbols.private_static_field_symbols.required_modifiers                                = static, shared
-dotnet_naming_symbols.private_static_field_symbols.applicable_kinds                                  = field
-dotnet_naming_rule.private_static_fields_must_be_camel_cased_and_prefixed_with_s_underscore.symbols  = private_static_field_symbols
-dotnet_naming_rule.private_static_fields_must_be_camel_cased_and_prefixed_with_s_underscore.style    = camel_case_and_prefix_with_s_underscore_style
-dotnet_naming_rule.private_static_fields_must_be_camel_cased_and_prefixed_with_s_underscore.severity = warning
-dotnet_naming_style.camel_case_and_prefix_with_s_underscore_style.required_prefix                    = s_
-dotnet_naming_style.camel_case_and_prefix_with_s_underscore_style.capitalization                     = camel_case
-
 # Instance fields use camelCase and are prefixed with  '_'
-dotnet_naming_symbols.private_field_symbols.applicable_accessibilities                               = private
-dotnet_naming_symbols.private_field_symbols.applicable_kinds                                         = field
-dotnet_naming_rule.private_instance_fields_must_be_camel_cased_and_prefixed_with_underscore.symbols  = private_field_symbols
-dotnet_naming_rule.private_instance_fields_must_be_camel_cased_and_prefixed_with_underscore.style    = camel_case_and_prefix_with_underscore_style
-dotnet_naming_rule.private_instance_fields_must_be_camel_cased_and_prefixed_with_underscore.severity = warning
-dotnet_naming_style.camel_case_and_prefix_with_underscore_style.required_prefix                      = _
-dotnet_naming_style.camel_case_and_prefix_with_underscore_style.capitalization                       = camel_case
+dotnet_naming_rule.instance_fields_should_be_camel_case.severity = warning
+dotnet_naming_rule.instance_fields_should_be_camel_case.symbols = instance_fields
+dotnet_naming_rule.instance_fields_should_be_camel_case.style = instance_field_style
+dotnet_naming_symbols.instance_fields.applicable_kinds = field
+dotnet_naming_style.instance_field_style.capitalization = camel_case
+dotnet_naming_style.instance_field_style.required_prefix = _
 
 ##########################################
 # License
@@ -408,4 +398,4 @@ dotnet_naming_style.camel_case_and_prefix_with_underscore_style.capitalization
 # WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
 # FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
 # OTHER DEALINGS IN THE SOFTWARE.
-##########################################
+##########################################

.github/BUILD.md

@@ -4,139 +4,132 @@
 
 In order to use Umbraco as a CMS and build your website with it, you should not build it yourself. If you're reading this then you're trying to contribute to Umbraco or you're debugging a complex issue.
 
-- Are you about to create a pull request for Umbraco?
+- Are you about to [create a pull request for Umbraco][contribution guidelines]?
 - Are you trying to get to the bottom of a problem in your existing Umbraco installation?
 
 If the answer is yes, please read on. Otherwise, make sure to head on over [to the download page](https://our.umbraco.com/download) and start using Umbraco CMS as intended.
 
-**Table of contents**
+## Table of contents
 
-[Building from source](#building-from-source)
-  * [The quick build](#quick)
-  * [Build infrastructure](#build-infrastructure)
-    * [Properties](#properties)
-    * [GetUmbracoVersion](#getumbracoversion)
-    * [SetUmbracoVersion](#setumbracoversion)
-    * [Build](#build)
-    * [Build-UmbracoDocs](#build-umbracodocs)
-    * [Verify-NuGet](#verify-nuget)
-  * [Cleaning up](#cleaning-up)
+↖️ You can jump to any section by using the "table of contents" button ( ![Table of contents icon](img/tableofcontentsicon.svg) ) above.
 
-[Azure DevOps](#azure-devops)
 
-[Quirks](#quirks)
-  * [Powershell quirks](#powershell-quirks)
-  * [Git quirks](#git-quirks)
+## Debugging source locally
 
+Did you read ["Are you sure"](#are-you-sure)?
+
+[More details about contributing to Umbraco and how to use the GitHub tooling can be found in our guide to contributing.][contribution guidelines]
+
+If you want to run a build without debugging, see [Building from source](#building-from-source) below. This runs the build in the same way it is run on our build servers.
+
+#### Debugging with VS Code
+
+In order to build the Umbraco source code locally with Visual Studio Code, first make sure you have the following installed.
+
+  * [Visual Studio Code](https://code.visualstudio.com/)
+  * [dotnet SDK v7+](https://dotnet.microsoft.com/en-us/download)
+  * [Node.js v14+](https://nodejs.org/en/download/)
+  * npm v7+ (installed with Node.js)
+  * [Git command line](https://git-scm.com/download/)
+
+Open the root folder of the repository in Visual Studio Code.
+
+To build the front end you'll need to open the command pallet (<kbd>Ctrl</kbd> + <kbd>Shift</kbd> + <kbd>P</kbd>) and run `>Tasks: Run Task` followed by `Client Watch` and then run the `Client Build` task in the same way.
+
+You can also run the tasks manually on the command line:
+
+```
+cd src\Umbraco.Web.UI.Client
+npm i
+npm run dev
+```
+
+If you just want to build the UI Client to `Umbraco.Web.UI` then instead of running `dev`, you can do: `npm run build`.
+
+The login screen is a different frontend build, for that one you can run it as follows:
+
+```
+cd src\Umbraco.Web.UI.Login
+npm i
+npm run dev
+```
+
+If you just want to build the Login screen to `Umbraco.Web.UI` then instead of running `dev`, you can do: `npm run build`.
+
+**The initial Gulp build might take a long time - don't worry, this will be faster on subsequent runs.**
+
+You might run into [Gulp quirks](#gulp-quirks).
+
+The caching for the back office has been described as 'aggressive' so we often find it's best when making back office changes to [disable caching in the browser (check "Disable cache" on the "Network" tab of developer tools)][disable browser caching] to help you to see the changes you're making.
+
+To run the C# portion of the project, either hit <kbd>F5</kbd> to begin debugging, or manually using the command line:
+
+```
+dotnet watch --project .\src\Umbraco.Web.UI\Umbraco.Web.UI.csproj
+```
+
+**The initial C# build might take a _really_ long time (seriously, go and make a cup of coffee!) - but don't worry, this will be faster on subsequent runs.**
+
+When the page eventually loads in your web browser, you can follow the installer to set up a database for debugging. You may also wish to install a [starter kit][starter kits] to ease your debugging.
+
+#### Debugging with Visual Studio
+
+In order to build the Umbraco source code locally with Visual Studio, first make sure you have the following installed.
+
+  * [Visual Studio 2022 v17+ with .NET 7+](https://visualstudio.microsoft.com/vs/) ([the community edition is free](https://www.visualstudio.com/thank-you-downloading-visual-studio/?sku=Community&rel=15) for you to use to contribute to Open Source projects)
+  * [Node.js v14+](https://nodejs.org/en/download/)
+  * npm v7+ (installed with Node.js)
+  * [Git command line](https://git-scm.com/download/)
+
+The easiest way to get started is to open `umbraco.sln` in Visual Studio.
+
+To build the front end, you'll first need to run `cd src\Umbraco.Web.UI.Client && npm install`  in the command line (or `cd src\Umbraco.Web.UI.Client; npm install` in PowerShell). Then find the Task Runner Explorer (View → Other Windows → Task Runner Explorer) and run the `build` task under `Gulpfile.js`. You may need to refresh the Task Runner Explorer before the tasks load.
+
+If you're working on the backoffice, you may wish to run the `dev` command instead while you're working with it, so changes are copied over to the appropriate directories and you can refresh your browser to view the results of your changes.
+
+**The initial Gulp build might take a long time - don't worry, this will be faster on subsequent runs.**
+
+You might run into [Gulp quirks](#gulp-quirks).
+
+The caching for the back office has been described as 'aggressive' so we often find it's best when making back office changes to [disable caching in the browser (check "Disable cache" on the "Network" tab of developer tools)][disable browser caching] to help you to see the changes you're making.
+
+"The rest" is a C# based codebase, which is mostly ASP.NET Core MVC based. You can make changes, build them in Visual Studio, and hit <kbd>F5</kbd> to see the result.
+
+**The initial C# build might take a _really_ long time (seriously, go and make a cup of coffee!) - but don't worry, this will be faster on subsequent runs.**
+
+When the page eventually loads in your web browser, you can follow the installer to set up a database for debugging. You may also wish to install a [starter kit][starter kits] to ease your debugging.
 
 ## Building from source
 
 Did you read ["Are you sure"](#are-you-sure)?
 
-### Quick!
+Do note that this is only required if you want to test out your custom changes in a separate site (not the one in the Umbraco.Web.UI), if you just want to test your changes you can run the included test site using: `dotnet run` from `src/Umbraco.Web.UI/`
 
-To build Umbraco, fire up PowerShell and move to Umbraco's repository root (the directory that contains `src`, `build`, `LICENSE.md`...). There, trigger the build with the following command:
+You may want to build a set of NuGet packages with your changes, this can be done using the dotnet pack command. 
 
-    build/build.ps1
-    
-If you only see a build.bat-file, you're probably on the wrong branch. If you switch to the correct branch (v8/contrib) the file will appear and you can build it.
+First enter the root of the project in a command line environment, and then use the following command to build the NuGet packages:
 
-You might run into [Powershell quirks](#powershell-quirks).
+`dotnet pack -c Release -o Build.Out`
 
-If it runs without errors; Hooray! Now you can continue with [the next step](CONTRIBUTING.md#how-do-i-begin) and open the solution and build it.
+This will restore and build the project using the release configuration, and put all the outputted files in a folder called `Build.Out`
 
-### Build Infrastructure
+You can then add these as a local NuGet feed using the following command:
 
-The Umbraco Build infrastructure relies on a PowerShell object. The object can be retrieved with:
+`dotnet nuget add source <Path to Build.Out folder> -n MyLocalFeed`
 
-    $ubuild = build/build.ps1 -get
-
-The object exposes various properties and methods that can be used to fine-grain build Umbraco. Some, but not all, of them are detailed below.
-    
-#### Properties
-
-The object exposes the following properties:
-
-* `SolutionRoot`: the absolute path to the solution root
-* `VisualStudio`: a Visual Studio object (see below)
-* `NuGet`: the absolute path to the NuGet executable
-* `Zip`: the absolute path to the 7Zip executable
-* `VsWhere`: the absolute path to the VsWhere executable
-* `NodePath`: the absolute path to the Node install
-* `NpmPath`: the absolute path to the Npm install
-
-The Visual Studio object is `null` when Visual Studio has not been detected (eg on VSTS). When not null, the object exposes the following properties:
-
-* `Path`: Visual Studio installation path (eg some place under `Program Files`)
-* `Major`: Visual Studio major version (eg `15` for VS 2017)
-* `Minor`: Visual Studio minor version
-* `MsBuild`: the absolute path to the MsBuild executable
-
-#### GetUmbracoVersion
-
-Gets an object representing the current Umbraco version. Example:
-
-    $v = $ubuild.GetUmbracoVersion()
-    Write-Host $v.Semver
-
-The object exposes the following properties:
-
-* `Semver`: the semver object representing the version
-* `Release`: the main part of the version (eg `7.6.33`)
-* `Comment`: the pre release part of the version (eg `alpha02`)
-* `Build`: the build number part of the version (eg `1234`)
-
-#### SetUmbracoVersion
-
-Modifies Umbraco files with the new version.
-
->This entirely replaces the legacy `UmbracoVersion.txt` file. Do *not* edit version infos in files.
-
-The version must be a valid semver version. It can include a *pre release* part (eg `alpha02`) and/or a *build number* (eg `1234`). Examples:
-
-    $ubuild.SetUmbracoVersion("7.6.33")
-    $ubuild.SetUmbracoVersion("7.6.33-alpha.2")
-    $ubuild.SetUmbracoVersion("7.6.33+1234")
-    $ubuild.SetUmbracoVersion("7.6.33-beta.5+5678")
-
-#### Build
-
-Builds Umbraco. Temporary files are generated in `build.tmp` while the actual artifacts (zip files, NuGet packages...) are produced in `build.out`. Example:
-
-    $ubuild.Build()
-
-Some log files, such as MsBuild logs, are produced in `build.tmp` too. The `build` directory should remain clean during a build.
-
-**Note: web.config**
-
-Building Umbraco requires a clean `web.config` file in the `Umbraco.Web.UI` project. If a `web.config` file already exists, the `pre-build` task (see below) will save it as `web.config.temp-build` and replace it with a clean copy of `web.Template.config`. The original file is replaced once it is safe to do so, by the `pre-packages` task.
-
-#### Build-UmbracoDocs
-
-Builds umbraco documentation. Temporary files are generated in `build.tmp` while the actual artifacts (docs...) are produced in `build.out`. Example:
-
-    Build-UmbracoDocs
-
-Some log files, such as MsBuild logs, are produced in `build.tmp` too. The `build` directory should remain clean during a build.
-
-#### Verify-NuGet
-
-Verifies that projects all require the same version of their dependencies, and that NuSpec files require versions that are consistent with projects. Example:
-
-    Verify-NuGet
+This will add a local nuget feed with the name "MyLocalFeed" and you'll now be able to use your custom built NuGet packages. 
 
 ### Cleaning up
 
 Once the solution has been used to run a site, one may want to "reset" the solution in order to run a fresh new site again.
 
-At the very minimum, you want
+The easiest way to do this by deleting the following files and folders:
+* src/Umbraco.Web.UI/appsettings.json
+* src/Umbraco.Web.UI/umbraco/Data
 
-    git clean -Xdf src/Umbraco.Web.UI/App_Data
-    rm src/Umbraco.Web.UI/web.config
+You only have to remove the connection strings from the appsettings, but removing the data folder  ensures that the sqlite database gets deleted too.
 
-Then, a simple 'Rebuild All' in Visual Studio will recreate a fresh `web.config` but should be quite fast (since it does not really need to rebuild anything).
-
-The `clean` Git command force (`-f`) removes (`-X`, note the capital X) all files and directories (`-d`) that are ignored by Git.
+Next time you run a build the `appsettings.json` file will be re-created in its default state.
 
 This will leave media files and views around, but in most cases, it will be enough.
 
@@ -145,72 +138,35 @@ To perform a more complete clear, you will want to also delete the content of th
 The following command will force remove all untracked files and directories, whether they are ignored by Git or not. Combined with `git reset` it can recreate a pristine working directory. 
 
     git clean -xdf .
-    
+
 For git documentation see:
 * git [clean](<https://git-scm.com/docs/git-clean>)
 * git [reset](<https://git-scm.com/docs/git-reset>)
 
 ## Azure DevOps
 
-Umbraco uses Azure DevOps for continuous integration, nightly builds and release builds. The Umbraco CMS project on DevOps [is available for anonymous users](https://umbraco.visualstudio.com/Umbraco%20Cms).
+Umbraco uses Azure DevOps for continuous integration, nightly builds and release builds. The Umbraco CMS project on DevOps [is available for anonymous users](https://umbraco.visualstudio.com/Umbraco%20Cms)..
 
-DevOps uses the `Build-Umbraco` command several times, each time passing a different *target* parameter. The supported targets are:
-
-* `pre-build`: prepares the build
-* `compile-belle`: compiles Belle
-* `compile-umbraco`: compiles Umbraco
-* `pre-tests`: prepares the tests
-* `compile-tests`: compiles the tests
-* `pre-packages`: prepares the packages
-* `pkg-zip`: creates the zip files
-* `pre-nuget`: prepares NuGet packages
-* `pkg-nuget`: creates NuGet packages
-
-All these targets are executed when `Build-Umbraco` is invoked without a parameter (or with the `all` parameter). On VSTS, compilations (of Umbraco and tests) are performed by dedicated DevOps tasks. Similarly, creating the NuGet packages is also performed by dedicated DevOps tasks.
-
-Finally, the produced artifacts are published in two containers that can be downloaded from DevOps: `zips` contains the zip files while `nuget` contains the NuGet packages.
-
->During a DevOps build, some environment `UMBRACO_*` variables are exported by the `pre-build` target and can be reused in other targets *and* in DevOps tasks. The `UMBRACO_TMP` environment variable is used in `Umbraco.Tests` to disable some tests that have issues with DevOps at the moment.
+The produced artifacts are published in a container that can be downloaded from DevOps called "nupkg" which contains all the NuGet packages that got built.
 
 ## Quirks
 
-### PowerShell Quirks
-
-There is a good chance that running `build.ps1` ends up in error, with messages such as
-
->The file ...\build.ps1 is not digitally signed. You cannot run this script on the current system. For more information about running scripts and setting execution policy, see about_Execution_Policies.
-
-PowerShell has *Execution Policies* that may prevent the script from running. You can check the current policies with:
-
-    PS> Get-ExecutionPolicy -List
-    
-            Scope ExecutionPolicy
-            ----- ---------------
-    MachinePolicy       Undefined
-       UserPolicy       Undefined
-          Process       Undefined
-      CurrentUser       Undefined
-     LocalMachine    RemoteSigned
-
-Policies can be `Restricted`, `AllSigned`, `RemoteSigned`, `Unrestricted` and `Bypass`. Scopes can be `MachinePolicy`, `UserPolicy`, `Process`, `CurrentUser`, `LocalMachine`. You need the current policy to be `RemoteSigned`&mdash;as long as it is `Undefined`, the script cannot run. You can change the current user policy with:
-
-    PS> Set-ExecutionPolicy -Scope CurrentUser -ExecutionPolicy RemoteSigned
-
-Alternatively, you can do it at machine level, from within an elevated PowerShell session:
-
-    PS> Set-ExecutionPolicy -Scope LocalMachine -ExecutionPolicy RemoteSigned
-
-And *then* the script should run. It *might* however still complain about executing scripts, with messages such as:
-
->Security warning - Run only scripts that you trust. While scripts from the internet can be useful, this script can potentially harm your computer. If you trust this script, use the Unblock-File cmdlet to allow the script to run without this warning message. Do you want to run ...\build.ps1?
-[D] Do not run  [R] Run once  [S] Suspend  [?] Help (default is "D"):
-
-This is usually caused by the scripts being *blocked*. And that usually happens when the source code has been downloaded as a Zip file. When Windows downloads Zip files, they are marked as *blocked* (technically, they have a Zone.Identifier alternate data stream, with a value of "3" to indicate that they were downloaded from the Internet). And when such a Zip file is un-zipped, each and every single file is also marked as blocked.
-
-The best solution is to unblock the Zip file before un-zipping: right-click the files, open *Properties*, and there should be a *Unblock* checkbox at the bottom of the dialog. If, however, the Zip file has already been un-zipped, it is possible to recursively unblock all files from PowerShell with:
-
-    PS> Get-ChildItem -Recurse *.* | Unblock-File
-
 ### Git Quirks
 
 Git might have issues dealing with long file paths during build. You may want/need to enable `core.longpaths` support (see [this page](https://github.com/msysgit/msysgit/wiki/Git-cannot-create-a-file-or-directory-with-a-long-path) for details).
+
+### Gulp Quirks
+
+You may need to run the following commands to set up gulp properly:
+
+  ```
+npm cache clean --force
+npm ci
+npm run build
+  ```
+
+
+
+[ contribution guidelines]: CONTRIBUTING.md	"Read the guide to contributing for more details on contributing to Umbraco"
+[ starter kits ]: https://our.umbraco.com/packages/?category=Starter%20Kits&version=9	"Browse starter kits available for v9 on Our "
+[ disable browser caching ]: https://techwiser.com/disable-cache-google-chrome-firefox "Instructions on how to disable browser caching in Chrome and Firefox"

.github/CONTRIBUTING.md

@@ -2,210 +2,58 @@
 
 👍🎉 First off, thanks for taking the time to contribute! 🎉👍
 
-The following is a set of guidelines, for contributing to Umbraco CMS.
+These contribution guidelines are mostly just that - guidelines, not rules. This is what we've found to work best over the years, but if you choose to ignore them, we still love you! 💖 Use your best judgement, and feel free to propose changes to this document in a pull request.
 
-These are mostly guidelines, not rules. Use your best judgement, and feel free to propose changes to this document in a pull request.
+## Getting Started
+We have a guide on [what to consider before you start](contributing-before-you-start.md) and more detailed guides at the end of this article.
 
-Remember, we're a friendly bunch and are happy with whatever contribution you might provide. Below are guidelines for success that we've gathered over the years. If you choose to ignore them then we still love you 💖.
+The following steps are a quick-start guide:
 
-**Code of conduct**
+1. **Fork**
 
-This project and everyone participating in it, is governed by the [our Code of Conduct](https://github.com/umbraco/.github/blob/main/.github/CODE_OF_CONDUCT.md).
+    Create a fork of [`Umbraco-CMS` on GitHub](https://github.com/umbraco/Umbraco-CMS)
+    
+    ![Fork the repository](img/forkrepository.png)
+    
+2. **Clone**
 
-**Table of contents**
+    When GitHub has created your fork, you can clone it in your favorite Git tool or on the command line with `git clone https://github.com/[YourUsername]/Umbraco-CMS`.
+    
+    ![Clone the fork](img/clonefork.png) 
+    
+3. **Switch to the correct branch**
 
-[Contributing code changes](#contributing-code-changes)
-  * [Guidelines for contributions we welcome](#guidelines-for-contributions-we-welcome)
-    * [Ownership and copyright](#ownership-and-copyright)
-  * [What can I start with?](#what-can-i-start-with)
-  * [How do I begin?](#how-do-i-begin)
-  * [Pull requests](#pull-requests)
+    Switch to the `contrib` branch
 
-[Reviews](#reviews)
-  * [Styleguides](#styleguides)
-  * [The Core Contributors](#the-core-contributors-team)
-  * [Questions?](#questions)
+4. **Build**
 
-[Working with the code](#working-with-the-code)
-  * [Building Umbraco from source code](#building-umbraco-from-source-code)
-  * [Working with the source code](#working-with-the-source-code)
-  * [Making changes after the PR is open](#making-changes-after-the-pr-is-open)
-  * [Which branch should I target for my contributions?](#which-branch-should-i-target-for-my-contributions)
-  * [Keeping your Umbraco fork in sync with the main repository](#keeping-your-umbraco-fork-in-sync-with-the-main-repository)
+    Build your fork of Umbraco locally [as described in the build documentation](BUILD.md), you can build with any IDE that supports dotnet or the command line.
 
-## Contributing code changes
+5. **Branch**
 
-This document gives you a quick overview on how to get started.
+    Create a new branch now and name it after the issue you're fixing, we usually follow the format: `temp/12345`. This means it's a temporary branch for the particular issue you're working on, in this case issue number `12345`.  Don't commit to `contrib`, create a new branch first.
 
-### Guidelines for contributions we welcome
+6. **Change**
 
-Not all changes are wanted, so on occasion we might close a PR without merging it. We will give you feedback why we can't accept your changes and we'll be nice about it, thanking you for spending your valuable time.
+    Make your changes, experiment, have fun, explore and learn, and don't be afraid. We welcome all contributions and will [happily give feedback](contributing-first-issue.md#questions).
 
-We have [documented what we consider small and large changes](CONTRIBUTION_GUIDELINES.md). Make sure to talk to us before making large changes, so we can ensure that you don't put all your hard work into something we would not be able to merge.
+7. **Commit and push**
 
-Remember, it is always worth working on an issue from the `Up for grabs` list or even asking for some feedback before you send us a PR. This way, your PR will not be closed as unwanted.
+    Done? Yay! 🎉
 
-#### Ownership and copyright
+    Remember to commit to your new `temp` branch, and don't commit to `contrib`. Then you can push the changes up to your fork on GitHub.
 
-It is your responsibility to make sure that you're allowed to share the code you're providing us.
-For example, you should have permission from your employer or customer to share code.
+8. **Create pull request**
 
-Similarly, if your contribution is copied or adapted from somewhere else, make sure that the license allows you to reuse that for a contribution to Umbraco-CMS.
+    On GitHub, in your forked repository (`https://github.com/[YourUsername]/Umbraco-CMS`) you will see a banner saying that you pushed a new branch and a button to make a pull request. Tap the button and follow the instuctions.
 
-If you're not sure, leave a note on your contribution and we will be happy to guide you.
+    Want to read further? [Creating a pull request and what happens next](contributing-creating-a-pr.md).
 
-When your contribution has been accepted, it will be [MIT licensed](https://github.com/umbraco/Umbraco-CMS/blob/v8/contrib/LICENSE.md) from that time onwards.
+## Further contribution guides
 
-### What can I start with?
+- [Before you start](contributing-before-you-start.md)
+- [Finding your first issue: Up for grabs](contributing-before-you-start.md)
+- [Contributing to the new backoffice](https://docs.umbraco.com/umbraco-backoffice/)
+- [Unwanted changes](contributing-unwanted-changes.md)
+- [Other ways to contribute](contributing-other-ways-to-contribute.md)
 
-Unsure where to begin contributing to Umbraco? You can start by looking through [these `Up for grabs` issues](https://github.com/umbraco/Umbraco-CMS/issues?utf8=%E2%9C%93&q=is%3Aissue+is%3Aopen+label%3Acommunity%2Fup-for-grabs+)
-
-### How do I begin?
-
-Great question! The short version goes like this:
-
-  * **Fork** - create a fork of [`Umbraco-CMS` on GitHub](https://github.com/umbraco/Umbraco-CMS)
-
-  ![Fork the repository](img/forkrepository.png)
-
-  * **Clone** - when GitHub has created your fork, you can clone it in your favorite Git tool
-
-  ![Clone the fork](img/clonefork.png)
-
-  * **Switch to the correct branch** - switch to the `v9/contrib` branch
-  * **Build** - build your fork of Umbraco locally as described in [building Umbraco from source code](BUILD.md)
-  * **Change** - make your changes, experiment, have fun, explore and learn, and don't be afraid. We welcome all contributions and will [happily give feedback](#questions)
-  * **Commit** - done? Yay! 🎉 **Important:** create a new branch now and name it after the issue you're fixing, we usually follow the format: `temp-12345`. This means it's a temporary branch for the particular issue you're working on, in this case `12345`. When you have a branch, commit your changes. Don't commit to `v9/contrib`, create a new branch first.
-  * **Push** - great, now you can push the changes up to your fork on GitHub
-  * **Create pull request** - exciting! You're ready to show us your changes (or not quite ready, you just need some feedback to progress - you can now make use of GitHub's draft pull request status, detailed [here](https://github.blog/2019-02-14-introducing-draft-pull-requests/)). GitHub has picked up on the new branch you've pushed and will offer to create a Pull Request. Click that green button and away you go.
-
-  ![Create a pull request](img/createpullrequest.png)
-
-### Pull requests
-The most successful pull requests usually look a like this:
-
-  * Fill in the required template (shown when starting a PR on GitHub), and link your pull request to an issue on the [issue tracker,](https://github.com/umbraco/Umbraco-CMS/issues) if applicable.
-  * Include screenshots and animated GIFs in your pull request whenever possible.
-  * Unit tests, while optional, are awesome. Thank you!
-  * New code is commented with documentation from which [the reference documentation](https://our.umbraco.com/documentation/Reference/) is generated.
-
-Again, these are guidelines, not strict requirements. However, the more information that you give to us, the more we have to work with when considering your contributions. Good documentation of a pull request can really speed up the time it takes to review and merge your work!
-
-## Reviews
-
-You've sent us your first contribution - congratulations! Now what?
-
-The [pull request team](#the-pr-team) can now start reviewing your proposed changes and give you feedback on them. If it's not perfect, we'll either fix up what we need or we can request that you make some additional changes.
-
-We have [a process in place which you can read all about](REVIEW_PROCESS.md). The very abbreviated version is:
-
-- Your PR will get a reply within 48 hours
-- An in-depth reply will be added within at most 2 weeks
-- The PR will be either merged or rejected within at most 4 weeks
-- Sometimes it is difficult to meet these timelines and we'll talk to you if this is the case.
-
-### Styleguides
-
-To be honest, we don't like rules very much. We trust you have the best of intentions and we encourage you to create working code. If it doesn't look perfect then we'll happily help clean it up.
-
-That said, the Umbraco development team likes to follow the hints that ReSharper gives us (no problem if you don't have this installed) and we've added a `.editorconfig` file so that Visual Studio knows what to do with whitespace, line endings, etc.
-
-### The Core Contributors team
-
-The Core Contributors team consists of one member of Umbraco HQ, [Sebastiaan](https://github.com/nul800sebastiaan), who gets assistance from the following community members who have comitted to volunteering their free time:
-
-- [Nathan Woulfe](https://github.com/nathanwoulfe)
-- [Joe Glombek](https://github.com/glombek)
-- [Laura Weatherhead](https://github.com/lssweatherhead)
-- [Michael Latouche](https://github.com/mikecp)
-- [Owain Williams](https://github.com/OwainWilliams)
-
-
-These wonderful people aim to provide you with a first reply to your PR, review and test out your changes and on occasions, they might ask more questions. If they are happy with your work, they'll let Umbraco HQ know by approving the PR. Hq will have final sign-off and will check the work again before it is merged.
-
-### Questions?
-
-You can get in touch with [the core contributors team](#the-core-contributors-team) in multiple ways; we love open conversations and we are a friendly bunch. No question you have is stupid. Any question you have usually helps out multiple people with the same question. Ask away:
-
-- If there's an existing issue on the issue tracker then that's a good place to leave questions and discuss how to start or move forward.
-- Unsure where to start? Did something not work as expected? Try leaving a note in the ["Contributing to Umbraco"](https://our.umbraco.com/forum/contributing-to-umbraco-cms/) forum. The team monitors that one closely, so one of us will be on hand and ready to point you in the right direction.
-
-## Working with the code
-
-### Building Umbraco from source code
-
-In order to build the Umbraco source code locally, first make sure you have the following installed.
-
-  * [Visual Studio 2019 v16.8+ (with .NET Core 3.0)](https://visualstudio.microsoft.com/vs/)
-  * [Node.js v10+](https://nodejs.org/en/download/)
-  * npm v6.4.1+ (installed with Node.js)
-  * [Git command line](https://git-scm.com/download/)
-
-The easiest way to get started is to open `src\umbraco.sln` in Visual Studio 2019 (version 16.3 or higher, [the community edition is free](https://www.visualstudio.com/thank-you-downloading-visual-studio/?sku=Community&rel=15) for you to use to contribute to Open Source projects). In Visual Studio, find the Task Runner Explorer (in the View menu under Other Windows) and run the build task under the gulpfile.
-
-Alternatively, you can run `build.ps1` from the Powershell command line, which will build both the backoffice (also known as "Belle") and the Umbraco core. You can then easily start debugging from Visual Studio, or if you need to debug Belle you can run `gulp dev` in `src\Umbraco.Web.UI.Client`. See [this page](BUILD.md) for more details.
-
-![Gulp build in Visual Studio](img/gulpbuild.png)
-
-After this build completes, you should be able to hit `F5` in Visual Studio to build and run the project. A IISExpress webserver will start and the Umbraco installer will pop up in your browser. Follow the directions there to get a working Umbraco install up and running.
-
-### Working with the source code
-
-Some parts of our source code are over 10 years old now. And when we say "old", we mean "mature" of course!
-
-There are two big areas that you should know about:
-
-  1. The Umbraco backoffice is a extensible AngularJS app and requires you to run a `gulp dev` command while you're working with it, so changes are copied over to the appropriate directories and you can refresh your browser to view the results of your changes.
-  You may need to run the following commands to set up gulp properly:
-  ```
-  npm cache clean --force
-  npm ci
-  npm run build
-  ```
-  The caching for the back office has been described as 'aggressive' so we often find it's best when making back office changes to disable caching in the browser to help you to see the changes you're making.
-
-  2. "The rest" is a C# based codebase, which is mostly ASP.NET MVC based. You can make changes, build them in Visual Studio, and hit `F5` to see the result.
-
-To find the general areas for something you're looking to fix or improve, have a look at the following two parts of the API documentation.
-
-  * [The AngularJS based backoffice files](https://apidocs.umbraco.com/v9/ui#/api) (to be found  in `src\Umbraco.Web.UI.Client\src`)
-  * [The C# application](https://apidocs.umbraco.com/v9/csharp/)
-
-### Which branch should I target for my contributions?
-
-We like to use [Gitflow as much as possible](https://jeffkreeftmeijer.com/git-flow/), but don't worry if you are not familiar with it. The most important thing you need to know is that when you fork the Umbraco repository, the default branch is set to something, usually `v9/contrib`. If you are working on v9, this is the branch you should be targetting. For v8 contributions, please target 'v8/contrib'
-
-Please note: we are no longer accepting features for v7 but will continue to merge bug fixes as and when they arise.
-
-![Which branch should I target?](img/defaultbranch.png)
-
-### Making changes after the PR is open
-
-If you make the corrections we ask for in the same branch and push them to your fork again, the pull request automatically updates with the additional commit(s) so we can review it again. If all is well, we'll merge the code and your commits are forever part of Umbraco!
-
-### Keeping your Umbraco fork in sync with the main repository
-
-We recommend you to sync with our repository before you submit your pull request. That way, you can fix any potential merge conflicts and make our lives a little bit easier.
-
-Also, if you have submitted a pull request three weeks ago and want to work on something new, you'll want to get the latest code to build against of course.
-
-To sync your fork with this original one, you'll have to add the upstream url. You only have to do this once:
-
-```
-git remote add upstream https://github.com/umbraco/Umbraco-CMS.git
-```
-
-Then when you want to get the changes from the main repository:
-
-```
-git fetch upstream
-git rebase upstream/v9/contrib
-```
-
-In this command we're syncing with the `v9/contrib` branch, but you can of course choose another one if needed.
-
-(More info on how this works: [http://robots.thoughtbot.com/post/5133345960/keeping-a-git-fork-updated](http://robots.thoughtbot.com/post/5133345960/keeping-a-git-fork-updated))
-
-### And finally
-
-We welcome all kinds of contributions to this repository. If you don't feel you'd like to make code changes here, you can visit our [documentation repository](https://github.com/umbraco/UmbracoDocs) and use your experience to contribute to making the docs we have, even better. We also encourage community members to feel free to comment on others' pull requests and issues - the expertise we have is not limited to the Core Contributors and HQ. So, if you see something on the issue tracker or pull requests you feel you can add to, please don't be shy.

.github/CONTRIBUTION_GUIDELINES.md

@@ -1,35 +0,0 @@
-# Contributing to Umbraco CMS
-
-When you’re considering creating a pull request for Umbraco CMS, we will categorize them in two different sizes, small and large.
-
-The process for both sizes is very similar, as [explained in the contribution document](CONTRIBUTING.md#how-do-i-begin).
-
-## Small PRs
-Bug fixes and small improvements - can be recognized by seeing a small number of changes and possibly a small number of new files.
-
-We’re usually able to handle small PRs pretty quickly. A community volunteer will do the initial review and flag it for Umbraco HQ as “community tested”. If everything looks good, it will be merged pretty quickly [as per the described process](REVIEW_PROCESS.md).
-
-### Up for grabs
-
-Umbraco HQ will regularly mark newly created issues on the issue tracker with the `Up for grabs` tag. This means that the proposed changes are wanted in Umbraco but the HQ does not have the time to make them at this time. We encourage anyone to pick them up and help out.
-
-If you do start working on something, make sure to leave a small comment on the issue saying something like: "I'm working on this". That way other people stumbling upon the issue know they don't need to pick it up, someone already has.
-
-## Large PRs
-New features and large refactorings - can be recognized by seeing a large number of changes, plenty of new files, updates to package manager files (NuGet’s packages.config, NPM’s packages.json, etc.).  
-
-We would love to follow the same process for larger PRs but this is not always possible due to time limitations and priorities that need to be aligned. We don’t want to put up any barriers, but this document should set the correct expectations.  
-
-Please make sure to describe your idea in an issue, it helps to put in mockup screenshots or videos.  
-
-If the change makes sense for HQ to include in Umbraco CMS we will leave you some feedback on how we’d like to see it being implemented. 
-
-If a larger pull request is encouraged by Umbraco HQ, the process will be similar to what is described in the [small PRs process](#small-prs) above, we strive to feedback within 14 days. Finalizing and merging the PR might take longer though as it will likely need to be picked up by the development team to make sure everything is in order. We’ll keep you posted on the progress.
-
-It is highly recommended that you speak to the HQ before making large, complex changes. 
-
-### Pull request or package?
-
-If it doesn’t fit in CMS right now, we will likely encourage you to make it into a package instead. A package is a great way to check out popularity of a feature, learn how people use it, validate good usability and fix bugs.  
-
-Eventually, a package could "graduate" to be included in the CMS.  

.github/ISSUE_TEMPLATE/01_bug_report.yml

@@ -6,7 +6,7 @@ body:
 - type: input
   id: "version"
   attributes:
-    label: "Which *exact* Umbraco version are you using? For example: 9.0.1 - don't just write v9"
+    label: "Which Umbraco version are you using? (Please write the *exact* version, example: 10.1.0)"
     description: "Use the help icon in the Umbraco backoffice to find the version you're using"
   validations:
     required: true

.github/New BackOffice - README.md

@@ -0,0 +1,18 @@
+# New backoffice
+
+> **Warning**:
+> This is an early WIP and is set not to be packable since we don't want to release this yet. There will be breaking changes in these projects.
+
+This solution folder contains the projects for the new backoffice. If you're looking to fix or improve the existing CMS, this is not the place to do it, although we do very much appreciate your efforts.
+
+### Project structure
+
+Since the new backoffice API is still very much a work in progress, we've created new projects for the new backoffice API:
+
+* Umbrao.Cms.ManagementApi - The "presentation layer" for the management API
+* "New" versions of existing projects, should be merged with the existing projects when the new API is released:
+    * Umbraco.New.Cms.Core
+    * Umbraco.New.Cms.Infrastructure
+    * Umbraco.New.Cms.Web.Common
+
+This also means that we have to use "InternalsVisibleTo" for the new projects since these should be able to access the internal classes since they will when they get merged.

.github/README.md

@@ -1,4 +1,12 @@
-# [Umbraco CMS](https://umbraco.com) · [![GitHub license](https://img.shields.io/badge/license-MIT-blue.svg)](../LICENSE.md) [![Build status](https://umbraco.visualstudio.com/Umbraco%20Cms/_apis/build/status/Cms%208%20Continuous?branchName=v8/contrib)](https://umbraco.visualstudio.com/Umbraco%20Cms/_build?definitionId=75) [![PRs Welcome](https://img.shields.io/badge/PRs-welcome-brightgreen.svg)](CONTRIBUTING.md) [![Twitter](https://img.shields.io/twitter/follow/umbraco.svg?style=social&label=Follow)](https://twitter.com/intent/follow?screen_name=umbraco) [![Discord](https://img.shields.io/discord/869656431308189746)](https://discord.gg/umbraco)
+# [Umbraco CMS](https://umbraco.com)
+
+[![GitHub license](https://img.shields.io/badge/license-MIT-blue.svg)](../LICENSE.md) 
+[![PRs Welcome](https://img.shields.io/badge/PRs-welcome-brightgreen.svg)](CONTRIBUTING.md) 
+[![Follow Umbraco on Twitter](https://img.shields.io/badge/Follow-blue?logo=twitter&logoColor=fff)](https://twitter.com/intent/follow?screen_name=umbraco) 
+[![Chat about Umbraco on Discord](https://img.shields.io/discord/869656431308189746?logo=discord&logoColor=fff)](https://discord.gg/umbraco) 
+[![Read what's going on in the Umbraco Discord chat now](https://img.shields.io/badge/read-discord-blue)](https://discord-chats.umbraco.com) 
+[![Build status](https://img.shields.io/azure-devops/build/umbraco/Umbraco%2520Cms/301?logo=azurepipelines&label=Azure%20Pipelines)](https://umbraco.visualstudio.com/Umbraco%20Cms/_build?definitionId=301) 
+[![Open in GitHub Codespaces](https://img.shields.io/badge/Open%20in%20GitHub%20Codespaces-525252?logo=github)](https://github.com/codespaces/new?hide_repo_select=true&ref=contrib&repo=10601208&machine=basicLinux32gb&devcontainer_path=.devcontainer%2Fdevcontainer.json&location=WestEurope)
 
 Umbraco is the friendliest, most flexible and fastest growing ASP.NET CMS, and used by more than 500,000 websites worldwide. Our mission is to help you deliver delightful digital experiences by making Umbraco friendly, simpler and social.
 
@@ -25,13 +33,14 @@ If you want to DIY, then you can [download Umbraco]((https://our.umbraco.com/dow
 
 ## Documentation
 
-The documentation for Umbraco CMS can be found [on Our Umbraco](https://our.umbraco.com/documentation/). The source for the Umbraco docs is [open source as well](https://github.com/umbraco/UmbracoDocs) and we're happy to look at your documentation contributions.
+The documentation for Umbraco CMS can be found [on Our Umbraco](https://docs.umbraco.com/). The source for the Umbraco docs is [open source as well](https://github.com/umbraco/UmbracoDocs) and we're happy to look at your documentation contributions.
 
 ## Join the Umbraco community
 
 Our friendly community is available 24/7 at the community hub, we call ["Our Umbraco"](https://our.umbraco.com/). Our Umbraco features forums for questions and answers, documentation, downloadable plugins for Umbraco, and a rich collection of community resources.
 
-Besides "Our", we all support each other also via Twitter: [Umbraco HQ](https://twitter.com/umbraco), [Release Updates](https://twitter.com/umbracoproject), [#umbraco](https://twitter.com/hashtag/umbraco)
+Besides "Our", we all support each other in our [Community Discord Server](https://discord.gg/umbraco) and on Twitter: [Umbraco HQ](https://twitter.com/umbraco), [Release Updates](https://twitter.com/umbracoproject), [#umbraco](https://twitter.com/hashtag/umbraco)
+
 
 
 ## Contributing

.github/REVIEW_PROCESS.md

@@ -1,25 +0,0 @@
-# Review process
-
-You're an awesome person and have sent us your contribution in the form of a pull request! It's now time to relax for a bit and wait for our response. 
-
-In order to set some expectations, here's what happens next.
-
-## Review process
-
-You will get an initial reply within 48 hours (workdays) to acknowledge that we’ve seen your PR and we’ll pick it up as soon as we can.
-
-You will get feedback within at most 14 days after opening the PR. You’ll most likely get feedback sooner though. Then there are a few possible outcomes:
-
-- Your proposed change is awesome! We merge it in and it will be included in the next minor release of Umbraco
-- If the change is a high priority bug fix, we will cherry-pick it into the next patch release as well so that we can release it as soon as possible
-- Your proposed change is awesome but needs a bit more work, we’ll give you feedback on the changes we’d like to see
-- Your proposed change is awesome but.. not something we’re looking to include at this point. We’ll close your PR and the related issue (we’ll be nice about it!)
-
-## Are you still available?
-
-We understand you have other things to do and can't just drop everything to help us out.   
-So if we’re asking for your help to improve the PR we’ll wait for two weeks to give you a fair chance to make changes. We’ll ask for an update if we don’t hear back from you after that time.  
-
-If we don’t hear back from you for 4 weeks, we’ll close the PR so that it doesn’t just hang around forever. You’re very welcome to re-open it once you have some more time to spend on it.  
-
-There will be times that we really like your proposed changes and we’ll finish the final improvements we’d like to see ourselves. You still get the credits and your commits will live on in the git repository.

.github/codespaces-readme.md

@@ -0,0 +1,21 @@
+# GitHub CodeSpaces
+Umbraco source code can be edited inside the browser with VSCode and CodeSpaces.
+
+This development environment comes with all the tools you need to build Umbraco source code.
+
+
+## Debugging and Running
+From VSCode browse to the Run and Debug section and then click the green button. This will build the Umbraco source code and attach a debugger and launch the site.
+
+## Default Umbraco credentials
+Username: test@umbraco.com
+Password: password1234
+
+## Test Email Server
+ A SMTP4Dev instance for testing email is available on port 5000.
+
+## SQLite Database
+The SQLite extension is preinstalled and allows you to open, query, edit the data inside the Umbraco SQLite database for ease of use.
+
+
+

.github/config/codeql-config.yml

@@ -5,4 +5,5 @@ paths:
 
 paths-ignore:
   - '**/node_modules'
-  - 'src/Umbraco.Web.UI/wwwroot'
+  - 'src/Umbraco.Web.UI/wwwroot'
+  - 'src/Umbraco.Cms.StaticAssets/wwwroot'

.github/contributing-before-you-start.md

@@ -0,0 +1,54 @@
+## Before you start
+
+
+### Code of Conduct
+
+This project and everyone participating in it, is governed by the [our Code of Conduct][code of conduct].
+
+### What can I contribute?
+
+We categorise pull requests (PRs) into two categories:
+
+| PR type   | Definition                                                   |
+| --------- | ------------------------------------------------------------ |
+| Small PRs | Bug fixes and small improvements - can be recognized by seeing a small number of changes and possibly a small number of new files. |
+| Large PRs | New features and large refactorings - can be recognized by seeing a large number of changes, plenty of new files, updates to package manager files (NuGet’s packages.config, NPM’s packages.json, etc.). |
+
+We’re usually able to handle small PRs pretty quickly. A community volunteer will do the initial review and flag it for Umbraco HQ as “community tested”. If everything looks good, it will be merged pretty quickly [as per the described process][review process].
+
+We would love to follow the same process for larger PRs but this is not always possible due to time limitations and priorities that need to be aligned. We don’t want to put up any barriers, but this document should set the correct expectations. 
+
+Not all changes are wanted, so on occasion we might close a PR without merging it but if we do, we will give you feedback why we can't accept your changes. **So make sure to [talk to us before making large changes][making larger changes]**, so we can ensure that you don't put all your hard work into something we would not be able to merge.
+
+#### Making larger changes
+
+[making larger changes]: #making-larger-changes
+
+Please make sure to describe your larger ideas in an [issue (bugs)][issues] or [discussion (new features)][discussions], it helps to put in mock up screenshots or videos. If the change makes sense for HQ to include in Umbraco CMS we will leave you some feedback on how we’d like to see it being implemented. 
+
+If a larger pull request is encouraged by Umbraco HQ, the process will be similar to what is described in the small PRs process above, we strive to feedback within 14 days. Finalizing and merging the PR might take longer though as it will likely need to be picked up by the development team to make sure everything is in order. We’ll keep you posted on the progress.
+
+#### Pull request or package?
+
+[pr or package]: #pull-request-or-package
+
+If you're unsure about whether your changes belong in the core Umbraco CMS or if you should turn your idea into a package instead, make sure to [talk to us][making larger changes].
+
+If it doesn’t fit in CMS right now, we will likely encourage you to make it into a package instead. A package is a great way to check out popularity of a feature, learn how people use it, validate good usability and fix bugs. Eventually, a package could "graduate" to be included in the CMS.
+
+#### Ownership and copyright
+
+It is your responsibility to make sure that you're allowed to share the code you're providing us. For example, you should have permission from your employer or customer to share code.
+
+Similarly, if your contribution is copied or adapted from somewhere else, make sure that the license allows you to reuse that for a contribution to Umbraco-CMS.
+
+If you're not sure, leave a note on your contribution and we will be happy to guide you.
+
+When your contribution has been accepted, it will be [MIT licensed][MIT license] from that time onwards.
+
+
+[MIT license]: ../LICENSE.md	"Umbraco's license declaration"
+
+
+[issues]: https://github.com/umbraco/Umbraco-CMS/issues
+[discussions]: https://github.com/umbraco/Umbraco-CMS/discussions

.github/contributing-core-collabs-team.md

@@ -0,0 +1,28 @@
+### The Core Collaborators team
+[Core collabs]: #the-core-collaborators-team
+
+The Core Contributors team consists of one member of Umbraco HQ, [Sebastiaan][Sebastiaan], who gets assistance from the following community members who have committed to volunteering their free time:
+
+- [Busra Sengul][Busra Sengul]
+- [Emma Garland][Emma Garland]
+- [George Bidder][George Bidder]
+- [Jason Elkin][Jason Elkin]
+- [Laura Neto][Laura Neto]
+- [Kyle Eck][Kyle Eck]
+- [Michael Latouche][Michael Latouche]
+- [Sebastiaan][Sebastiaan]
+
+
+These wonderful people aim to provide you with a reply to your PR, review and test out your changes and on occasions, they might ask more questions. If they are happy with your work, they'll let Umbraco HQ know by approving the PR. HQ will have final sign-off and will check the work again before it is merged.
+
+
+<!-- External -->
+
+[Busra Sengul]: https://github.com/busrasengul "Busra's GitHub profile"
+[Emma Garland]: https://github.com/emmagarland	"Emma's GitHub profile"
+[George Bidder]: https://github.com/georgebid	"George's GitHub profile"
+[Jason Elkin]: https://github.com/jasonelkin "Jason's GitHub profile"
+[Kyle Eck]: https://github.com/teckspeed	"Kyle's GitHub profile"
+[Laura Neto]: https://github.com/lauraneto	"Laura's GitHub profile"
+[Michael Latouche]: https://github.com/mikecp	"Michael's GitHub profile"
+[Sebastiaan]: https://github.com/nul800sebastiaan "Sebastiaan's GitHub profile"

.github/contributing-creating-a-pr.md

@@ -0,0 +1,51 @@
+## Creating a pull request
+
+Exciting! You're ready to show us your changes.
+
+We recommend you to [sync with our repository][sync fork] before you submit your pull request. That way, you can fix any potential merge conflicts and make our lives a little bit easier.
+
+GitHub will have picked up on the new branch you've pushed and will offer to create a Pull Request. Click that green button and away you go.
+![Create a pull request](img/createpullrequest.png)
+
+We like to use [git flow][git flow] as much as possible, but don't worry if you are not familiar with it. The most important thing you need to know is that when you fork the Umbraco repository, the default branch is set to `contrib`. This is the branch you should be targeting.
+
+Please note: we are no longer accepting features for v8 and below but will continue to merge security fixes as and when they arise.
+  
+## The review process
+[review process]: #the-review-process
+
+You've sent us your contribution - congratulations! Now what?
+
+The [Core Collaborators team][Core collabs] can now start reviewing your proposed changes and give you feedback on them. If it's not perfect, we'll either fix up what we need or we can request that you make some additional changes.
+
+You will get an initial automated reply from our [Friendly Umbraco Robot, Umbrabot][Umbrabot], to acknowledge that we’ve seen your PR and we’ll pick it up as soon as we can. You can take this opportunity to double check everything is in order based off the handy checklist Umbrabot provides.
+
+You will get feedback as soon as the [Core Collaborators team][Core collabs] can after opening the PR. You’ll most likely get feedback within a couple of weeks. Then there are a few possible outcomes:
+
+- Your proposed change is awesome! We merge it in and it will be included in the next minor release of Umbraco
+- If the change is a high priority bug fix, we will cherry-pick it into the next patch release as well so that we can release it as soon as possible
+- Your proposed change is awesome but needs a bit more work, we’ll give you feedback on the changes we’d like to see
+- Your proposed change is awesome but... not something we’re looking to include at this point. We’ll close your PR and the related issue (we’ll be nice about it!). See [making larger changes][making larger changes] and [pull request or package?][pr or package]
+
+### Dealing with requested changes
+
+If you make the corrections we ask for in the same branch and push them to your fork again, the pull request automatically updates with the additional commit(s) so we can review it again. If all is well, we'll merge the code and your commits are forever part of Umbraco!
+
+#### No longer available?
+
+We understand you have other things to do and can't just drop everything to help us out.
+
+So if we’re asking for your help to improve the PR we’ll wait for two weeks to give you a fair chance to make changes. We’ll ask for an update if we don’t hear back from you after that time.  
+
+If we don’t hear back from you for 4 weeks, we’ll close the PR so that it doesn’t just hang around forever. You’re very welcome to re-open it once you have some more time to spend on it.  
+
+There will be times that we really like your proposed changes and we’ll finish the final improvements we’d like to see ourselves. You still get the credits and your commits will live on in the git repository.
+
+
+[ Umbrabot ]: https://github.com/umbrabot
+[git flow]: https://jeffkreeftmeijer.com/git-flow/	"An explanation of git flow"
+
+
+[making larger changes]: contributing-before-you-start.md#making-large-changes
+[pr or package]: contributing-before-you-start.md#pull-request-or-package
+[Core collabs]: contributing-core-collabs-team.md

.github/contributing-first-issue.md

@@ -0,0 +1,93 @@
+## Finding your first issue: Up for grabs
+
+Umbraco HQ will regularly mark newly created issues on the issue tracker with [the `community/up-for-grabs` tag][up for grabs issues]. This means that the proposed changes are wanted in Umbraco but the HQ does not have the time to make them at this time. We encourage anyone to pick them up and help out.
+
+If you do start working on something, make sure to leave a small comment on the issue saying something like: "I'm working on this". That way other people stumbling upon the issue know they don't need to pick it up, someone already has.
+
+## Making your changes
+
+Great question! The short version goes like this:
+
+1. **Fork**
+
+    Create a fork of [`Umbraco-CMS` on GitHub][Umbraco CMS repo]
+    
+    ![Fork the repository](img/forkrepository.png)
+    
+1. **Clone**
+
+    When GitHub has created your fork, you can clone it in your favorite Git tool
+    
+    ![Clone the fork](img/clonefork.png) 
+    
+1. **Switch to the correct branch**
+
+    Switch to the `contrib` branch
+
+1. **Build**
+
+    Build your fork of Umbraco locally as described in the build documentation: you can [debug with Visual Studio Code][build - debugging with code] or [with Visual Studio][build - debugging with vs].
+
+1. **Branch**
+
+    Create a new branch now and name it after the issue you're fixing, we usually follow the format: `temp-12345`. This means it's a temporary branch for the particular issue you're working on, in this case issue number `12345`.  Don't commit to `contrib`, create a new branch first.
+
+1. **Change**
+
+    Make your changes, experiment, have fun, explore and learn, and don't be afraid. We welcome all contributions and will [happily give feedback][questions].
+
+1. **Commit and push**
+
+    Done? Yay! 🎉
+
+    Remember to commit to your new `temp` branch, and don't commit to `contrib`. Then you can push the changes up to your fork on GitHub.
+
+#### Keeping your Umbraco fork in sync with the main repository
+[sync fork]: #keeping-your-umbraco-fork-in-sync-with-the-main-repository
+
+Once you've already got a fork and cloned your fork locally, you can skip steps 1 and 2 going forward. Just remember to keep your fork up to date before making further changes.
+
+To sync your fork with this original one, you'll have to add the upstream url. You only have to do this once:
+
+```
+git remote add upstream https://github.com/umbraco/Umbraco-CMS.git
+```
+
+Then when you want to get the changes from the main repository:
+
+```
+git fetch upstream
+git rebase upstream/contrib
+```
+
+In this command we're syncing with the `contrib` branch, but you can of course choose another one if needed.
+
+[More information on how this works can be found on the thoughtbot blog.][sync fork ext]
+
+#### Style guide
+
+To be honest, we don't like rules very much. We trust you have the best of intentions and we encourage you to create working code. If it doesn't look perfect then we'll happily help clean it up.
+
+That said, the Umbraco development team likes to follow the hints that ReSharper gives us (no problem if you don't have this installed) and we've added a `.editorconfig` file so that Visual Studio knows what to do with whitespace, line endings, etc.
+
+#### Questions?
+[questions]: #questions
+
+You can get in touch with [the core contributors team][core collabs] in multiple ways; we love open conversations and we are a friendly bunch. No question you have is stupid. Any question you have usually helps out multiple people with the same question. Ask away:
+
+- If there's an existing issue on the issue tracker then that's a good place to leave questions and discuss how to start or move forward.
+- If you want to ask questions on some code you've already written you can create a draft pull request, [detailed in a GitHub blog post][draft prs].
+- Unsure where to start? Did something not work as expected? Try leaving a note in the ["Contributing to Umbraco"][contrib forum] forum. The team monitors that one closely, so one of us will be on hand and ready to point you in the right direction.
+
+
+  <!-- Local -->
+
+[build - debugging with vs]: BUILD.md#debugging-with-visual-studio	"Details on building and debugging Umbraco with Visual Studio"
+[build - debugging with code]: BUILD.md#debugging-with-vs-code	"Details on building and debugging Umbraco with Visual Studio Code"
+
+
+[sync fork ext]: http://robots.thoughtbot.com/post/5133345960/keeping-a-git-fork-updated	"Details on keeping a git fork updated"
+[draft prs]: https://github.blog/2019-02-14-introducing-draft-pull-requests/	"Github's blog post providing details on draft pull requests"
+[contrib forum]: https://our.umbraco.com/forum/contributing-to-umbraco-cms/
+[Umbraco CMS repo]: https://github.com/umbraco/Umbraco-CMS
+[up for grabs issues]: https://github.com/umbraco/Umbraco-CMS/issues?q=is%3Aissue+is%3Aopen+label%3Acommunity%2Fup-for-grabs

.github/contributing-other-ways-to-contribute.md

@@ -0,0 +1,10 @@
+## Coding not your thing? Or want more ways to contribute?
+
+This document covers contributing to the codebase of the CMS but [the community site has plenty of inspiration for other ways to get involved.][get involved]
+
+If you don't feel you'd like to make code changes here, you can visit our [documentation repository][docs repo] and use your experience to contribute to making the docs we have, even better.
+
+We also encourage community members to feel free to comment on others' pull requests and issues - the expertise we have is not limited to the Core Collaborators and HQ. So, if you see something on the issue tracker or pull requests you feel you can add to, please don't be shy.
+
+[get involved]: https://community.umbraco.com/get-involved/
+[docs repo]: https://github.com/umbraco/UmbracoDocs

.github/contributing-unwanted-changes.md

@@ -0,0 +1,18 @@
+## Unwanted changes
+While most changes are welcome, there are certain types of changes that are discouraged and might get your pull request refused.
+Of course this will depend heavily on the specific change, but please take the following examples in mind.
+
+- **Breaking changes (code and/or behavioral) 💥** - sometimes it can be a bit hard to know if a change is breaking or not. Fortunately, if it relates to code, the build will fail and warn you.
+- **Large refactors 🤯** - the larger the refactor, the larger the probability of introducing new bugs/issues.  
+- **Changes to obsolete code and/or property editors ✍️**
+- **Adding new config options 🦾** - while having more flexibility is (most of the times) better, having too many options can also become overwhelming/confusing, especially if there are other (good/simple) ways to achieve it.
+- **Whitespace changes 🫥** - while some of our files might not follow the formatting/whitespace rules (mostly old ones), changing several of them in one go would cause major merge conflicts with open pull requests or other work in progress. Do feel free to fix these when you are working on another issue/feature and end up "touching" those files!
+- **Adding new extension/helper methods ✋** - keep in mind that more code also means more to maintain, so if a helper is only meaningful for a few, it might not be worth adding it to the core.
+
+While these are only a few examples, it is important to ask yourself these questions before making a pull request:
+
+- How many will benefit from this change?
+- Are there other ways to achieve this? And if so, how do they compare?
+- How maintainable is the change?
+- What would be the effort to test it properly?
+- Do the benefits outweigh the risks?

.github/img/tableofcontentsicon.svg

@@ -0,0 +1,3 @@
+<svg xmlns:xlink="http://www.w3.org/1999/xlink" xmlns="http://www.w3.org/2000/svg" aria-hidden="true" height="16" viewBox="0 0 16 16" version="1.1" width="16">
+    <path fill-rule="evenodd" d="M2 4a1 1 0 100-2 1 1 0 000 2zm3.75-1.5a.75.75 0 000 1.5h8.5a.75.75 0 000-1.5h-8.5zm0 5a.75.75 0 000 1.5h8.5a.75.75 0 000-1.5h-8.5zm0 5a.75.75 0 000 1.5h8.5a.75.75 0 000-1.5h-8.5zM3 8a1 1 0 11-2 0 1 1 0 012 0zm-1 6a1 1 0 100-2 1 1 0 000 2z" fill="#57606A"></path>
+</svg>

.github/workflows/codeql-analysis.yml

@@ -2,33 +2,59 @@ name: "Code scanning - action"
 
 on:
   push:
-    branches: ['*/dev','*/contrib']
+    branches:
+    - '*/dev'
+    - '*/contrib'
   pull_request:
     # The branches below must be a subset of the branches above
-    branches: ['*/dev','*/contrib']
+    branches:
+    - '*/dev'
+    - '*/contrib'
+
+permissions:
+  contents: read
+
+env:
+  dotnetVersion: 8.x
+  dotnetIncludePreviewVersions: true
+  solution: umbraco.sln
+  buildConfiguration: SkipTests
+  DOTNET_NOLOGO: true
+  DOTNET_GENERATE_ASPNET_CERTIFICATE: false
+  DOTNET_SKIP_FIRST_TIME_EXPERIENCE: true
+  DOTNET_CLI_TELEMETRY_OPTOUT: true
 
 jobs:
   CodeQL-Build:
-
+    permissions:
+      actions: read # for github/codeql-action/init to get workflow details
+      contents: read # for actions/checkout to fetch code
+      security-events: write # for github/codeql-action/analyze to upload SARIF results
     runs-on: ubuntu-latest
 
     steps:
-    - name: Checkout repository
-      uses: actions/checkout@v2
+    - name: Checkout
+      uses: actions/checkout@v3
+      with:
+        fetch-depth: 0
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v1
+      uses: github/codeql-action/init@v2
       with:
         config-file: ./.github/config/codeql-config.yml
 
-    - name: Setup dotnet
-      uses: actions/setup-dotnet@v1
+    - name: Use .NET ${{ env.dotnetVersion }}
+      uses: actions/setup-dotnet@v2
       with:
-        dotnet-version: '6.0.x'
+        dotnet-version: ${{ env.dotnetVersion }}
+        include-prerelease: ${{ env.dotnetIncludePreviewVersions }}
 
-    - name: dotnet build
-      run: dotnet build umbraco.sln -c SkipTests
+    - name: Run dotnet restore
+      run: dotnet restore ${{ env.solution }}
+
+    - name: Run dotnet build
+      run: dotnet build ${{ env.solution }} --configuration ${{ env.buildConfiguration }} --no-restore -p:ContinuousIntegrationBuild=true
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v1
+      uses: github/codeql-action/analyze@v2

.github/workflows/issues-first-response.yml

@@ -0,0 +1,51 @@
+name: issue-first-response
+
+on:
+  issues:
+    types: [opened]
+
+jobs: 
+  send-response:
+    runs-on: ubuntu-latest
+    permissions:
+      issues: write
+      pull-requests: write    
+    steps:
+      - name: Install dependencies
+        run: |
+          npm install node-fetch@2
+      - name: Fetch random comment 🗣️ and add it to the issue
+        uses: actions/github-script@v6
+        with:
+          script: |
+            const response = await fetch('https://collaboratorsv2.euwest01.umbraco.io/umbraco/api/comments/PostComment', {
+              method: 'post',
+              body: JSON.stringify({
+                repo: '${{ github.repository }}',
+                number: '${{ github.event.number }}',
+                actor: '${{ github.actor }}',
+                commentType: 'opened-issue-first-comment'
+              }),
+              headers: {
+                'Authorization': 'Bearer ${{ secrets.OUR_BOT_API_TOKEN }}',
+                'Content-Type': 'application/json'
+              }
+            });
+
+            try {
+                const data = await response.text();
+
+                if(response.status === 200 && data !== '') {
+                    github.rest.issues.createComment({
+                        issue_number: context.issue.number,
+                        owner: context.repo.owner,
+                        repo: context.repo.repo,
+                        body: data
+                    });
+                } else {
+                    console.log("Status code did not indicate success:", response.status);
+                    console.log("Returned data:", data);
+                }
+            } catch(error) {
+                console.log(error);
+            }

.github/workflows/pr-first-response.yml

@@ -4,22 +4,17 @@ on:
   pull_request_target:
     types: [opened]
 
-jobs: 
+jobs:
   send-response:
     runs-on: ubuntu-latest
     permissions:
       issues: write
-      pull-requests: write    
+      pull-requests: write
     steps:
-      - name: Install dependencies
-        run: |
-          npm install node-fetch@2
       - name: Fetch random comment 🗣️ and add it to the PR
         uses: actions/github-script@v6
         with:
           script: |
-            const fetch = require('node-fetch')
-
             const response = await fetch('https://collaboratorsv2.euwest01.umbraco.io/umbraco/api/comments/PostComment', {
               method: 'post',
               body: JSON.stringify({
@@ -45,8 +40,17 @@ jobs:
                         body: data
                     });
                 } else {
-                    console.log("Status code did not indicate success:", response.status);
+                    console.log("Returned data not indicate success.");
+
+                    if(response.status !== 200) {
+                      console.log("Status code:", response.status)
+                    }
+
                     console.log("Returned data:", data);
+
+                    if(data === '') {
+                      console.log("An empty response usually indicates that either no comment was found or the actor user was not eligible for getting an automated response (HQ users are not getting auto-responses).")
+                    }
                 }
             } catch(error) {
                 console.log(error);

.github/workflows/up-for-grabs-response.yml

@@ -0,0 +1,62 @@
+name: labeled-up-for-grabs-first-comment
+
+on:
+  issues:
+    types:
+      - labeled
+
+jobs:
+  send-response:
+    if: github.event.label.name == 'community/up-for-grabs'
+    runs-on: ubuntu-latest
+    permissions:
+      issues: write
+      pull-requests: write
+    steps:
+      - name: Install dependencies
+        run: |
+          npm install node-fetch@2
+      - name: Fetch comment 🗣️ and add it to the issue
+        uses: actions/github-script@v6
+        with:
+          script: |
+            const response = await fetch('https://collaboratorsv2.euwest01.umbraco.io/umbraco/api/comments/PostComment', {
+              method: 'post',
+              body: JSON.stringify({
+                repo: '${{ github.repository }}',
+                number: '${{ github.event.issue.number }}',
+                actor: '${{ github.event.issue.user.login }}',
+                commentType: 'labeled-up-for-grabs-first-comment'
+              }),
+              headers: {
+                'Authorization': 'Bearer ${{ secrets.OUR_BOT_API_TOKEN }}',
+                'Content-Type': 'application/json'
+              }
+            });
+
+            try {
+                const data = await response.text();
+
+                if(response.status === 200 && data !== '') {
+                    github.rest.issues.createComment({
+                        issue_number: context.issue.number,
+                        owner: context.repo.owner,
+                        repo: context.repo.repo,
+                        body: data
+                    });
+                } else {
+                    console.log("Returned data not indicate success.");
+
+                    if(response.status !== 200) {
+                      console.log("Status code:", response.status)
+                    }
+
+                    console.log("Returned data:", data);
+                    
+                    if(data === '') {
+                      console.log("An empty response usually indicates that either no comment was found or the actor user was not eligible for getting an automated response (HQ users are not getting auto-responses).")
+                    }
+                }
+            } catch(error) {
+                console.log(error);
+            };

.gitignore

@@ -90,10 +90,7 @@ preserve.belle
 /src/Umbraco.Web.UI/appsettings.Local.json
 
 # Tests
-cypress.env.json
-/tests/Umbraco.Tests.AcceptanceTest/cypress/screenshots/
-/tests/Umbraco.Tests.AcceptanceTest/cypress/support/chainable.ts
-/tests/Umbraco.Tests.AcceptanceTest/cypress/videos/
+/tests/Umbraco.Tests.AcceptanceTest/.env
 /tests/Umbraco.Tests.Integration.SqlCe/DatabaseContextTests.sdf
 /tests/Umbraco.Tests.Integration.SqlCe/[Uu]mbraco/[Dd]ata/TEMP/
 /tests/Umbraco.Tests.Integration/appsettings.Tests.Local.json
@@ -104,5 +101,12 @@ cypress.env.json
 /tests/Umbraco.Tests.UnitTests/[Uu]mbraco/[Dd]ata/TEMP/
 
 # Ignore auto-generated schema
+/src/Umbraco.Cms.Targets/tasks/
+/src/Umbraco.Cms.Targets/appsettings-schema.*.json
 /src/Umbraco.Web.UI/appsettings-schema.json
+/src/Umbraco.Web.UI/appsettings-schema.*.json
+/tests/Umbraco.Tests.Integration/appsettings-schema.json
+/tests/Umbraco.Tests.Integration/appsettings-schema.*.json
 /src/Umbraco.Cms/appsettings-schema.json
+playwright-report
+trace.zip

.vscode/launch.json

@@ -8,10 +8,8 @@
             "name": ".NET Core Launch (web)",
             "type": "coreclr",
             "request": "launch",
-            "preLaunchTask": "Dotnet build",
-            // If you have changed target frameworks, make sure to update the program path.
-            "program": "${workspaceFolder}/src/Umbraco.Web.UI/bin/Debug/net5.0/Umbraco.Web.UI.dll",
-            "args": [],
+            "program": "dotnet",
+            "args": ["run"],
             "cwd": "${workspaceFolder}/src/Umbraco.Web.UI",
             "stopAtEntry": false,
             "requireExactSource": false,

.vscode/tasks.json

@@ -33,6 +33,18 @@
                 "$gulp-tsc"
             ]
         },
+        {
+            "label": "Client Watch",
+            "detail": "runs npm run dev for Umbraco.Web.UI.Client",
+            "promptOnClose": true,
+            "group": "build",
+            "type": "npm",
+            "script": "dev",
+            "path": "src/Umbraco.Web.UI.Client/",
+            "problemMatcher": [
+                "$gulp-tsc"
+            ]
+        },
         {
             "label": "Dotnet build",
             "detail": "Dotnet build of SLN",
@@ -42,7 +54,7 @@
             "type": "process",
             "args": [
                 "build",
-                "${workspaceFolder}/src/umbraco.sln",
+                "${workspaceFolder}/umbraco.sln",
                 "/property:GenerateFullPaths=true",
                 "/consoleloggerparameters:NoSummary"
             ],
@@ -57,6 +69,7 @@
             "args": [
                 "watch",
                 "run",
+                "--project",
                 "${workspaceFolder}/src/Umbraco.Web.UI/Umbraco.Web.UI.csproj",
                 "/property:GenerateFullPaths=true",
                 "/consoleloggerparameters:NoSummary"

Directory.Build.props

@@ -1,18 +1,56 @@
 <?xml version="1.0" encoding="utf-8"?>
 <Project>
-    <!-- Package references and additional files which are consumed by all projects -->
-    <ItemGroup>
-        <PackageReference Include="StyleCop.Analyzers" Version="1.2.0-beta.406" PrivateAssets="all" IsImplicitlyDefined="true" />
-    </ItemGroup>
+  <PropertyGroup>
+    <TargetFramework>net8.0</TargetFramework>
+    <Company>Umbraco HQ</Company>
+    <Authors>Umbraco</Authors>
+    <Copyright>Copyright © Umbraco $([System.DateTime]::Today.ToString('yyyy'))</Copyright>
+    <Product>Umbraco CMS</Product>
+    <PackageProjectUrl>https://umbraco.com/</PackageProjectUrl>
+    <PackageIconUrl>https://umbraco.com/dist/nuget/logo-small.png</PackageIconUrl>
+    <PackageIcon>icon.png</PackageIcon>
+    <PackageLicenseExpression>MIT</PackageLicenseExpression>
+    <PackageTags>umbraco</PackageTags>
+    <NeutralLanguage>en-US</NeutralLanguage>
+    <Nullable>enable</Nullable>
+    <WarningsAsErrors>nullable</WarningsAsErrors>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <GenerateDocumentationFile>true</GenerateDocumentationFile>
+    <WarnOnPackingNonPackableProject>false</WarnOnPackingNonPackableProject>
+  </PropertyGroup>
 
+  <!-- SourceLink -->
+  <PropertyGroup>
+    <PublishRepositoryUrl>true</PublishRepositoryUrl>
+    <IncludeSymbols>true</IncludeSymbols>
+    <SymbolPackageFormat>snupkg</SymbolPackageFormat>
+  </PropertyGroup>
+
+  <!-- Package Validation -->
+  <PropertyGroup>
+    <GenerateCompatibilitySuppressionFile>false</GenerateCompatibilitySuppressionFile>
+    <EnablePackageValidation>true</EnablePackageValidation>
+    <PackageValidationBaselineVersion>13.0.0</PackageValidationBaselineVersion>
+    <EnableStrictModeForCompatibleFrameworksInPackage>true</EnableStrictModeForCompatibleFrameworksInPackage>
+    <EnableStrictModeForCompatibleTfms>true</EnableStrictModeForCompatibleTfms>
+  </PropertyGroup>
+
+  <!-- Calculate version only once for the whole repository --> 
+  <PropertyGroup>
+    <GitVersionBaseDirectory>$(MSBuildThisFileDirectory)</GitVersionBaseDirectory>
+  </PropertyGroup>
+
+  <!-- Include icon in generated NuGet packages -->
   <ItemGroup>
-    <PackageReference Include="Nerdbank.GitVersioning" Condition="!Exists('packages.config')">
-      <PrivateAssets>all</PrivateAssets>
-      <Version>3.5.107</Version>
-    </PackageReference>
-
-    <PackageReference Include="Umbraco.GitVersioning.Extensions" Version="0.1.1">
-      <PrivateAssets>all</PrivateAssets>
-    </PackageReference>
+    <Content Include="$(MSBuildThisFileDirectory)icon.png" Pack="true" PackagePath="" Visible="false" />
   </ItemGroup>
+
+  <!-- Use version range on project references (to limit on major version in generated packages) -->
+  <Target Name="_GetProjectReferenceVersionRanges" AfterTargets="_GetProjectReferenceVersions">
+    <ItemGroup>
+      <_ProjectReferencesWithVersions Condition="'%(ProjectVersion)' != ''">
+        <ProjectVersion>[%(ProjectVersion), $([MSBuild]::Add($([System.Text.RegularExpressions.Regex]::Match('%(ProjectVersion)', '^\d+').Value), 1)))</ProjectVersion>
+      </_ProjectReferencesWithVersions>
+    </ItemGroup>
+  </Target>
 </Project>

Directory.Packages.props

@@ -0,0 +1,104 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project>
+  <PropertyGroup>
+    <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
+  </PropertyGroup>
+  <!-- Global packages (private, build-time packages for all projects) -->
+  <ItemGroup>
+    <GlobalPackageReference Include="Nerdbank.GitVersioning" Version="3.6.139" />
+    <GlobalPackageReference Include="StyleCop.Analyzers" Version="1.2.0-beta.507" />
+    <GlobalPackageReference Include="Umbraco.Code" Version="2.2.0" />
+    <GlobalPackageReference Include="Umbraco.GitVersioning.Extensions" Version="0.2.0" />
+  </ItemGroup>
+  <!-- Microsoft packages -->
+  <ItemGroup>
+    <PackageVersion Include="Microsoft.AspNetCore.Mvc.NewtonsoftJson" Version="8.0.22" />
+    <PackageVersion Include="Microsoft.AspNetCore.Mvc.Razor.RuntimeCompilation" Version="8.0.22" />
+    <PackageVersion Include="Microsoft.CodeAnalysis.CSharp" Version="4.10.0" />
+    <PackageVersion Include="Microsoft.CodeAnalysis.CSharp.Workspaces" Version="4.10.0" />
+    <PackageVersion Include="Microsoft.CodeAnalysis.Workspaces.MSBuild" Version="4.10.0" />
+    <PackageVersion Include="Microsoft.Data.Sqlite" Version="8.0.11" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.Sqlite" Version="8.0.22" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.SqlServer" Version="8.0.22" />
+    <PackageVersion Include="Microsoft.Extensions.Caching.Abstractions" Version="8.0.0" />
+    <PackageVersion Include="Microsoft.Extensions.Configuration.Abstractions" Version="8.0.0" />
+    <PackageVersion Include="Microsoft.Extensions.Configuration.Json" Version="8.0.0" />
+    <PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="8.0.1" />
+    <PackageVersion Include="Microsoft.Extensions.FileProviders.Embedded" Version="8.0.22" />
+    <PackageVersion Include="Microsoft.Extensions.FileProviders.Physical" Version="8.0.0" />
+    <PackageVersion Include="Microsoft.Extensions.Hosting.Abstractions" Version="8.0.0" />
+    <PackageVersion Include="Microsoft.Extensions.Http" Version="8.0.1" />
+    <PackageVersion Include="Microsoft.Extensions.Identity.Core" Version="8.0.22" />
+    <PackageVersion Include="Microsoft.Extensions.Identity.Stores" Version="8.0.22" />
+    <PackageVersion Include="Microsoft.Extensions.Logging" Version="8.0.1" />
+    <PackageVersion Include="Microsoft.Extensions.Options" Version="8.0.2" />
+    <PackageVersion Include="Microsoft.Extensions.Options.ConfigurationExtensions" Version="8.0.0" />
+    <PackageVersion Include="Microsoft.Extensions.Options.DataAnnotations" Version="8.0.0" />
+    <PackageVersion Include="System.Runtime.Caching" Version="8.0.1" />
+  </ItemGroup>
+  <!-- Umbraco packages -->
+  <ItemGroup>
+    <PackageVersion Include="Umbraco.JsonSchema.Extensions" Version="0.3.0" />
+    <PackageVersion Include="Umbraco.CSharpTest.Net.Collections" Version="15.0.0" />
+  </ItemGroup>
+  <!-- Third-party packages -->
+  <ItemGroup>
+    <PackageVersion Include="Asp.Versioning.Mvc" Version="7.1.1" />
+    <PackageVersion Include="Asp.Versioning.Mvc.ApiExplorer" Version="7.1.0" />
+    <PackageVersion Include="Dazinator.Extensions.FileProviders" Version="2.0.0" />
+    <PackageVersion Include="Examine" Version="3.8.0" />
+    <PackageVersion Include="Examine.Core" Version="3.8.0" />
+    <PackageVersion Include="HtmlAgilityPack" Version="1.11.74" />
+    <PackageVersion Include="K4os.Compression.LZ4" Version="1.3.8" />
+    <PackageVersion Include="MailKit" Version="4.8.0" />
+    <PackageVersion Include="Markdown" Version="2.2.1" />
+    <PackageVersion Include="MessagePack" Version="2.5.192" />
+    <PackageVersion Include="MiniProfiler.AspNetCore.Mvc" Version="4.3.8" />
+    <PackageVersion Include="MiniProfiler.Shared" Version="4.3.8" />
+    <PackageVersion Include="ncrontab" Version="3.3.3" />
+    <PackageVersion Include="Newtonsoft.Json" Version="13.0.4" />
+    <PackageVersion Include="NPoco" Version="5.7.1" />
+    <PackageVersion Include="NPoco.SqlServer" Version="5.7.1" />
+    <PackageVersion Include="OpenIddict.Abstractions" Version="4.10.1" />
+    <PackageVersion Include="OpenIddict.AspNetCore" Version="4.10.1" />
+    <PackageVersion Include="OpenIddict.EntityFrameworkCore" Version="4.10.1" />
+    <PackageVersion Include="Serilog" Version="3.1.1" />
+    <PackageVersion Include="Serilog.AspNetCore" Version="8.0.3" />
+    <PackageVersion Include="Serilog.Enrichers.Process" Version="2.0.2" />
+    <PackageVersion Include="Serilog.Enrichers.Thread" Version="3.1.0" />
+    <PackageVersion Include="Serilog.Expressions" Version="4.0.0" />
+    <PackageVersion Include="Serilog.Extensions.Hosting" Version="8.0.0" />
+    <PackageVersion Include="Serilog.Formatting.Compact" Version="2.0.0" />
+    <PackageVersion Include="Serilog.Formatting.Compact.Reader" Version="3.0.0" />
+    <PackageVersion Include="Serilog.Settings.Configuration" Version="8.0.4" />
+    <PackageVersion Include="Serilog.Sinks.Async" Version="1.5.0" />
+    <PackageVersion Include="Serilog.Sinks.File" Version="5.0.0" />
+    <PackageVersion Include="Serilog.Sinks.Map" Version="1.0.2" />
+    <PackageVersion Include="SixLabors.ImageSharp" Version="3.1.12" />
+    <PackageVersion Include="SixLabors.ImageSharp.Web" Version="3.1.5" />
+    <PackageVersion Include="Smidge.InMemory" Version="4.6.0" />
+    <PackageVersion Include="Smidge.Nuglify" Version="4.6.0" />
+    <PackageVersion Include="Swashbuckle.AspNetCore" Version="6.9.0" />
+  </ItemGroup>
+  <!-- Transitive pinned versions (only required because our direct dependencies have vulnerable versions of transitive dependencies) -->
+  <ItemGroup>
+    <!-- Both Microsoft.EntityFrameworkCore.SqlServer and NPoco.SqlServer bring in a vulnerable version of Azure.Identity -->
+    <PackageVersion Include="Azure.Identity" Version="1.13.2" />
+    <!-- Dazinator.Extensions.FileProviders brings in a vulnerable version of System.Net.Http -->
+    <PackageVersion Include="System.Net.Http" Version="4.3.4" />
+    <!-- Examine brings in a vulnerable version of System.Security.Cryptography.Xml -->
+    <PackageVersion Include="System.Security.Cryptography.Xml" Version="8.0.3" />
+    <!-- Both Dazinator.Extensions.FileProviders and MiniProfiler.AspNetCore.Mvc bring in a vulnerable version of System.Text.RegularExpressions -->
+    <PackageVersion Include="System.Text.RegularExpressions" Version="4.3.1" />
+    <!-- Both OpenIddict.AspNetCore, Npoco.SqlServer and Microsoft.EntityFrameworkCore.SqlServer bring in a vulnerable version of Microsoft.IdentityModel.JsonWebTokens -->
+    <PackageVersion Include="Microsoft.IdentityModel.JsonWebTokens" Version="7.7.1" />
+    <!-- Examine.Lucene bring in a vulnerable version of Lucene.Net.Replicator -->
+    <PackageVersion Include="Lucene.Net.Replicator" Version="4.8.0-beta00017" />
+    <!-- Both OpenIddict.AspNetCore, Microsoft.EntityFrameworkCore.* bring in a vulnerable version of Microsoft.Extensions.Caching.Memory -->
+    <PackageVersion Include="Microsoft.Extensions.Caching.Memory" Version="8.0.1" />
+    <!-- Both Azure.Identity, Microsoft.EntityFrameworkCore.SqlServer,NPoco.SqlServer, and more bring in a vulnerable version of System.Text.Json -->
+    <PackageVersion Include="System.Text.Json" Version="8.0.6" />
+    <!-- Both Microsoft.EntityFrameworkCore.SqlServer and NPoco.SqlServer bring in a vulnerable version of Microsoft.Data.SqlClient -->
+    <PackageVersion Include="Microsoft.Data.SqlClient" Version="5.2.3" />
+  </ItemGroup>
+</Project>

build/nightly-build-trigger.yml

@@ -0,0 +1,35 @@
+name: Nightly_$(TeamProject)_$(Build.DefinitionName)_$(SourceBranchName)_$(Date:yyyyMMdd)$(Rev:.r)
+
+pr: none
+trigger: none
+
+schedules:
+- cron: '0 0 * * *'
+  displayName: Daily midnight build
+  branches:
+    include:
+    - v10/dev
+    - v12/dev
+    - v13/dev
+    - v14/dev
+
+steps:
+- checkout: none
+- task: TriggerBuild@4
+  inputs:
+    definitionIsInCurrentTeamProject: true
+    buildDefinition: '301'
+    queueBuildForUserThatTriggeredBuild: true
+    ignoreSslCertificateErrors: false
+    useSameSourceVersion: false
+    useCustomSourceVersion: false
+    useSameBranch: true
+    waitForQueuedBuildsToFinish: false
+    storeInEnvironmentVariable: false
+    templateParameters: 'sqlServerIntegrationTests: true, forceReleaseTestFilter: true, myGetDeploy: true, isNightly: true'
+    authenticationMethod: 'OAuth Token'
+    enableBuildInQueueCondition: false
+    dependentOnSuccessfulBuildCondition: false
+    dependentOnFailedBuildCondition: false
+    checkbuildsoncurrentbranch: false
+    failTaskIfConditionsAreNotFulfilled: false

build/templates/dependency-track.yml

@@ -0,0 +1,56 @@
+parameters:
+  - name: projectName
+    type: string
+  - name: umbracoVersion
+    type: string
+  - name: projects
+    type: object
+
+jobs:
+- job: Create_DT_Project
+  displayName: Create Dependency Track Project
+  steps:
+    - checkout: none
+
+    - bash: |
+        project_id=$(curl --no-progress-meter -H "X-Api-Key: $(DT_API_KEY)" "$(DT_API_URL)/v1/project/lookup?name=${{ parameters.projectName }}&version=${{ parameters.umbracoVersion }}" | jq -r '.uuid')
+        if [ "$project_id" != "null" ] && [ -n "$project_id" ]; then
+          echo "Project '${{ parameters.projectName }}' with version '${{ parameters.umbracoVersion }}' already exists (ID: $project_id)."
+        else
+          project_id=$(curl --no-progress-meter \
+            -X PUT "$(DT_API_URL)/v1/project" \
+            -H "X-Api-Key: $(DT_API_KEY)" \
+            -H "Content-Type: application/json" \
+            -d '{"name": "${{ parameters.projectName }}", "version": "${{ parameters.umbracoVersion }}", "collectionLogic": "AGGREGATE_DIRECT_CHILDREN"}' \
+            | jq -r '.uuid')
+          if [ -z "$project_id" ] || [ "$project_id" == "null" ]; then
+            echo "Failed to create project '${{ parameters.projectName }}' version '${{ parameters.umbracoVersion }}'."
+            exit 1
+          fi
+          echo "Created project '${{ parameters.projectName }}' with version '${{ parameters.umbracoVersion }}' (ID: $project_id)."
+        fi
+      displayName: Ensure main project exists in Dependency Track
+
+- ${{ each project in parameters.projects }}:
+  - job:
+    displayName: Upload ${{ project.name }} BOM
+    dependsOn: Create_DT_Project
+    steps:
+      - checkout: none
+
+      - download: current
+        artifact: ${{ project.artifact }}
+        displayName: Download ${{ project.artifact }} artifact
+
+      - script: |
+          curl --no-progress-meter --fail-with-body \
+            -X POST "$(DT_API_URL)/v1/bom" \
+            -H "X-Api-Key: $(DT_API_KEY)" \
+            -H "Content-Type: multipart/form-data" \
+            -F "autoCreate=true" \
+            -F "projectName=${{ parameters.projectName }}-${{ project.name }}" \
+            -F "projectVersion=${{ parameters.umbracoVersion }}" \
+            -F "parentName=${{ parameters.projectName }}" \
+            -F "parentVersion=${{ parameters.umbracoVersion }}" \
+            -F "bom=@$(Pipeline.Workspace)/${{ project.artifact }}/${{ project.bomFilePath }}"
+        displayName: Upload ${{ project.name }} BOM to Dependency Track

build/templates/e2e-install.yml

@@ -0,0 +1,47 @@
+parameters:
+  - name: nodeVersion
+    type: string
+    default: ''
+
+  - name: npm_config_cache
+    type: string
+    default: ''
+
+  - name: PlaywrightUserEmail
+    type: string
+    default: ''
+
+  - name: PlaywrightPassword
+    type: string
+    default: ''
+
+  - name: ASPNETCORE_URLS
+    type: string
+    default: ''
+
+steps:
+  - task: NodeTool@0
+    displayName: Use Node.js $(nodeVersion)
+    inputs:
+      versionSpec: $(nodeVersion)
+
+  - pwsh: |
+      "UMBRACO_USER_LOGIN=${{ parameters.PlaywrightUserEmail }}
+      UMBRACO_USER_PASSWORD=${{ parameters.PlaywrightPassword }}
+      URL=${{ parameters.ASPNETCORE_URLS }}" | Out-File .env
+    displayName: Generate .env
+    workingDirectory: $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest
+
+  # Cache and restore NPM packages
+  - task: Cache@2
+    displayName: Cache NPM packages
+    inputs:
+      key: 'npm_e2e | "$(Agent.OS)" | $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/package-lock.json'
+      restoreKeys: |
+        npm_e2e | "$(Agent.OS)"
+        npm_e2e
+      path: ${{ parameters.npm_config_cache }}
+
+  - script: npm ci --no-fund --no-audit --prefer-offline
+    workingDirectory: $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest
+    displayName: Restore NPM packages

global.json

@@ -0,0 +1,6 @@
+{
+  "sdk": {
+    "version": "8.0.415",
+    "rollForward": "latestFeature"
+  }
+}

legacy/Umbraco.Tests/App.config

@@ -1,119 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<configuration>
-    <configSections>
-    </configSections>
-
-    <appSettings>
-        <add key="Umbraco.Core.ConfigurationStatus" value="6.0.0"/>
-        <add key="Umbraco.Core.ReservedUrls" value="~/config/splashes/booting.aspx,~/install/default.aspx,~/config/splashes/noNodes.aspx,~/VSEnterpriseHelper.axd,~/.well-known" />
-        <add key="Umbraco.Core.ReservedPaths" value="~/install/"/>
-        <add key="Umbraco.Core.Path" value="~/umbraco"/>
-        <add key="Umbraco.Core.HideTopLevelNodeFromPath" value="true"/>
-        <add key="Umbraco.Core.TimeOutInMinutes" value="20"/>
-        <add key="Umbraco.Core.DefaultUILanguage" value="en"/>
-        <add key="Umbraco.Core.UseHttps" value="false"/>
-        <add key="dataAnnotations:dataTypeAttribute:disableRegEx" value="false"/>
-    </appSettings>
-
-    <connectionStrings>
-        <add name="umbracoDbDSN" connectionString="Datasource=|DataDirectory|UmbracoNPocoTests.sdf;Flush Interval=1;" providerName="System.Data.SqlServerCe.4.0"/>
-    </connectionStrings>
-
-    <system.data>
-        <DbProviderFactories>
-            <remove invariant="System.Data.SqlServerCe.4.0"/>
-            <add name="Microsoft SQL Server Compact Data Provider 4.0" invariant="System.Data.SqlServerCe.4.0" description=".NET Framework Data Provider for Microsoft SQL Server Compact" type="System.Data.SqlServerCe.SqlCeProviderFactory, System.Data.SqlServerCe, Version=4.0.0.1, Culture=neutral, PublicKeyToken=89845dcd8080cc91"/>
-        </DbProviderFactories>
-    </system.data>
-
-    <system.web>
-        <httpRuntime targetFramework="4.5"/>
-        <compilation defaultLanguage="c#" debug="true" batch="false" targetFramework="4.0"></compilation>
-        <machineKey validationKey="5E7B955FCE36F5F2A867C2A0D85DC61E7FEA9E15F1561E8386F78BFE9EE23FF18B21E6A44AA17300B3B9D5DBEB37AA61A2C73884A5BBEDA6D3B14BA408A7A8CD" decryptionKey="116B853D031219E404E088FCA0986D6CF2DFA77E1957B59FCC9404B8CA3909A1" validation="SHA1" decryption="AES"/>
-        <!--<trust level="Medium" originUrl=".*"/>-->
-        <!-- Sitemap provider-->
-        <siteMap defaultProvider="UmbracoSiteMapProvider" enabled="true">
-            <providers>
-                <clear/>
-                <add name="UmbracoSiteMapProvider" type="umbraco.presentation.nodeFactory.UmbracoSiteMapProvider" defaultDescriptionAlias="description" securityTrimmingEnabled="true"/>
-            </providers>
-        </siteMap>
-        <!-- Membership Provider -->
-        <membership defaultProvider="UmbracoMembershipProvider" userIsOnlineTimeWindow="15">
-            <providers>
-                <clear/>
-                <add name="UmbracoMembershipProvider" type="Umbraco.Web.Security.Providers.MembersMembershipProvider, Umbraco.Web" minRequiredNonalphanumericCharacters="0" minRequiredPasswordLength="4" useLegacyEncoding="false" enablePasswordRetrieval="false" enablePasswordReset="true" requiresQuestionAndAnswer="false" defaultMemberTypeAlias="Member" passwordFormat="Hashed"/>
-            </providers>
-        </membership>
-    </system.web>
-
-    <startup>
-        <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.7.2"/>
-    </startup>
-
-    <runtime>
-        <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">
-            <dependentAssembly>
-                <assemblyIdentity name="Microsoft.Owin" publicKeyToken="31bf3856ad364e35" culture="neutral" />
-                <bindingRedirect oldVersion="0.0.0.0-4.0.1.0" newVersion="4.0.1.0" />
-            </dependentAssembly>
-            <dependentAssembly>
-                <assemblyIdentity name="Microsoft.Owin.Security" publicKeyToken="31bf3856ad364e35" culture="neutral" />
-                <bindingRedirect oldVersion="0.0.0.0-4.0.1.0" newVersion="4.0.1.0" />
-            </dependentAssembly>
-            <dependentAssembly>
-                <assemblyIdentity name="Microsoft.Owin.Security.Cookies" publicKeyToken="31bf3856ad364e35" culture="neutral" />
-                <bindingRedirect oldVersion="0.0.0.0-4.0.1.0" newVersion="4.0.1.0" />
-            </dependentAssembly>
-            <dependentAssembly>
-                <assemblyIdentity name="Microsoft.Owin.Security.OAuth" publicKeyToken="31bf3856ad364e35" culture="neutral" />
-                <bindingRedirect oldVersion="0.0.0.0-4.0.1.0" newVersion="4.0.1.0" />
-            </dependentAssembly>
-            <dependentAssembly>
-                <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral" />
-                <bindingRedirect oldVersion="0.0.0.0-12.0.0.0" newVersion="12.0.0.0" />
-            </dependentAssembly>
-            <dependentAssembly>
-                <assemblyIdentity name="System.Collections.Immutable" publicKeyToken="b03f5f7f11d50a3a" culture="neutral" />
-                <bindingRedirect oldVersion="0.0.0.0-1.2.5.0" newVersion="1.2.5.0" />
-            </dependentAssembly>
-            <dependentAssembly>
-                <assemblyIdentity name="System.Web.Http" publicKeyToken="31bf3856ad364e35" culture="neutral" />
-                <bindingRedirect oldVersion="0.0.0.0-5.2.7.0" newVersion="5.2.7.0" />
-            </dependentAssembly>
-            <dependentAssembly>
-                <assemblyIdentity name="System.Web.Mvc" publicKeyToken="31bf3856ad364e35" culture="neutral" />
-                <bindingRedirect oldVersion="0.0.0.0-5.2.7.0" newVersion="5.2.7.0" />
-            </dependentAssembly>
-            <dependentAssembly>
-                <assemblyIdentity name="System.ValueTuple" publicKeyToken="cc7b13ffcd2ddd51" culture="neutral" />
-                <bindingRedirect oldVersion="0.0.0.0-4.0.3.0" newVersion="4.0.3.0" />
-            </dependentAssembly>
-            <dependentAssembly>
-                <assemblyIdentity name="System.Net.Http.Formatting" publicKeyToken="31bf3856ad364e35"/>
-                <bindingRedirect oldVersion="0.0.0.0-5.2.7.0" newVersion="5.2.7.0"/>
-            </dependentAssembly>
-          <dependentAssembly>
-              <assemblyIdentity name="System.ComponentModel.Annotations" publicKeyToken="b03f5f7f11d50a3a" culture="neutral" />
-              <bindingRedirect oldVersion="0.0.0.0-4.2.1.0" newVersion="4.2.1.0" />
-          </dependentAssembly>
-          <dependentAssembly>
-                <assemblyIdentity name="System.Threading.Tasks.Extensions" publicKeyToken="cc7b13ffcd2ddd51" culture="neutral" />
-                <bindingRedirect oldVersion="0.0.0.0-4.2.0.1" newVersion="4.2.0.1" />
-            </dependentAssembly>
-            <dependentAssembly>
-                <assemblyIdentity name="System.Buffers" publicKeyToken="cc7b13ffcd2ddd51" culture="neutral"/>
-                <bindingRedirect oldVersion="4.0.0.0-4.0.3.0" newVersion="4.0.3.0"/>
-            </dependentAssembly>
-            <dependentAssembly>
-                <assemblyIdentity name="System.Memory" publicKeyToken="cc7b13ffcd2ddd51" culture="neutral"/>
-                <bindingRedirect oldVersion="4.0.0.0-4.0.1.1" newVersion="4.0.1.1"/>
-            </dependentAssembly>
-            <dependentAssembly>
-                <assemblyIdentity name="System.Numerics.Vectors" publicKeyToken="b03f5f7f11d50a3a" culture="neutral"/>
-                <bindingRedirect oldVersion="4.0.0.0-4.1.4.0" newVersion="4.1.4.0"/>
-            </dependentAssembly>
-        </assemblyBinding>
-    </runtime>
-
-</configuration>

legacy/Umbraco.Tests/Properties/AssemblyInfo.cs

@@ -1,41 +0,0 @@
-using System.Reflection;
-using System.Runtime.CompilerServices;
-using System.Runtime.InteropServices;
-
-// General Information about an assembly is controlled through the following
-// set of attributes. Change these attribute values to modify the information
-// associated with an assembly.
-[assembly: AssemblyTitle("Umbraco.Tests")]
-[assembly: AssemblyDescription("")]
-[assembly: AssemblyConfiguration("")]
-[assembly: AssemblyCompany("")]
-[assembly: AssemblyProduct("Umbraco.Tests")]
-[assembly: AssemblyCopyright("Copyright ©  2012")]
-[assembly: AssemblyTrademark("")]
-[assembly: AssemblyCulture("")]
-
-// Setting ComVisible to false makes the types in this assembly not visible
-// to COM components.  If you need to access a type in this assembly from
-// COM, set the ComVisible attribute to true on that type.
-[assembly: ComVisible(false)]
-
-// The following GUID is for the ID of the typelib if this project is exposed to COM
-[assembly: Guid("33ddf9b7-505c-4a12-8370-7fee9de5df6d")]
-
-// Version information for an assembly consists of the following four values:
-//
-//      Major Version
-//      Minor Version
-//      Build Number
-//      Revision
-//
-// You can specify all the values or you can default the Build and Revision Numbers
-// by using the '*' as shown below:
-// [assembly: AssemblyVersion("1.0.*")]
-[assembly: AssemblyVersion("1.0.0.0")]
-[assembly: AssemblyFileVersion("1.0.0.0")]
-
-// Internals must be visible to DynamicProxyGenAssembly2
-// in order to mock loggers loggers with types from the assembly
-// I.E. Mock.Of<ILogger<TestControllerFactory>>()
-[assembly: InternalsVisibleTo("DynamicProxyGenAssembly2")]

legacy/Umbraco.Tests/Published/ModelTypeTests.cs

@@ -1,43 +0,0 @@
-using System;
-using System.Collections.Generic;
-using NUnit.Framework;
-using Umbraco.Cms.Core.Models.PublishedContent;
-
-namespace Umbraco.Tests.Published
-{
-    [TestFixture]
-    public class ModelTypeTests
-    {
-
-            //TODO these is not easy to move to the Unittest project due to underlysing NotImplementedException of Type.IsSZArray
-        [Test]
-        public void ModelTypeToStringTests()
-        {
-            var modelType = ModelType.For("alias1");
-            var modelTypeArray = modelType.MakeArrayType();
-
-            Assert.AreEqual("{alias1}", modelType.ToString());
-
-            // there's an "*" there because the arrays are not true SZArray - but that changes when we map
-
-            Assert.AreEqual("{alias1}[*]", modelTypeArray.ToString());
-            var enumArray = typeof(IEnumerable<>).MakeGenericType(modelTypeArray);
-            Assert.AreEqual("System.Collections.Generic.IEnumerable`1[{alias1}[*]]", enumArray.ToString());
-        }
-
-        [Test]
-        public void ModelTypeFullNameTests()
-        {
-            Assert.AreEqual("{alias1}", ModelType.For("alias1").FullName);
-
-            Type type = ModelType.For("alias1");
-            Assert.AreEqual("{alias1}", type.FullName);
-
-            // there's an "*" there because the arrays are not true SZArray - but that changes when we map
-            Assert.AreEqual("{alias1}[*]", ModelType.For("alias1").MakeArrayType().FullName);
-            // note the inner assembly qualified name
-            Assert.AreEqual("System.Collections.Generic.IEnumerable`1[[{alias1}[*], Umbraco.Core, Version=0.5.0.0, Culture=neutral, PublicKeyToken=null]]", typeof(IEnumerable<>).MakeGenericType(ModelType.For("alias1").MakeArrayType()).FullName);
-        }
-
-    }
-}

legacy/Umbraco.Tests/Routing/BaseUrlProviderTest.cs

@@ -1,45 +0,0 @@
-using System.Linq;
-using Microsoft.Extensions.DependencyInjection;
-using Moq;
-using Umbraco.Cms.Core.Configuration.Models;
-using Umbraco.Cms.Core.Models.PublishedContent;
-using Umbraco.Cms.Core.Routing;
-using Umbraco.Cms.Core.Web;
-using Umbraco.Cms.Tests.Common;
-using Umbraco.Tests.TestHelpers;
-
-namespace Umbraco.Tests.Routing
-{
-    public abstract class BaseUrlProviderTest : BaseWebTest
-    {
-        protected IUmbracoContextAccessor UmbracoContextAccessor { get; } = new TestUmbracoContextAccessor();
-
-        protected abstract bool HideTopLevelNodeFromPath { get; }
-
-        protected override void Compose()
-        {
-            base.Compose();
-            Builder.Services.AddTransient<ISiteDomainMapper, SiteDomainMapper>();
-        }
-
-        protected override void ComposeSettings()
-        {
-            var contentSettings = new ContentSettings();
-            var userPasswordConfigurationSettings = new UserPasswordConfigurationSettings();
-
-            Builder.Services.AddTransient(x => Microsoft.Extensions.Options.Options.Create(contentSettings));
-            Builder.Services.AddTransient(x => Microsoft.Extensions.Options.Options.Create(userPasswordConfigurationSettings));
-        }
-
-        protected IPublishedUrlProvider GetPublishedUrlProvider(IUmbracoContext umbracoContext, DefaultUrlProvider urlProvider)
-        {
-            var webRoutingSettings = new WebRoutingSettings();
-            return new UrlProvider(
-                new TestUmbracoContextAccessor(umbracoContext),
-                Microsoft.Extensions.Options.Options.Create(webRoutingSettings),
-                new UrlProviderCollection(new[] { urlProvider }),
-                new MediaUrlProviderCollection(Enumerable.Empty<IMediaUrlProvider>()),
-                Mock.Of<IVariationContextAccessor>());
-        }
-    }
-}

legacy/Umbraco.Tests/Routing/MediaUrlProviderTests.cs

@@ -1,206 +0,0 @@
-using System;
-using System.Linq;
-using Microsoft.Extensions.Logging;
-using Microsoft.Extensions.Logging.Abstractions;
-using Moq;
-using Newtonsoft.Json;
-using NUnit.Framework;
-using Umbraco.Cms.Core.Configuration.Models;
-using Umbraco.Cms.Core.IO;
-using Umbraco.Cms.Core.Models;
-using Umbraco.Cms.Core.Models.PublishedContent;
-using Umbraco.Cms.Core.PropertyEditors;
-using Umbraco.Cms.Core.PropertyEditors.ValueConverters;
-using Umbraco.Cms.Core.Routing;
-using Umbraco.Cms.Core.Services;
-using Umbraco.Cms.Core.Strings;
-using Umbraco.Cms.Core.Web;
-using Umbraco.Cms.Tests.Common;
-using Umbraco.Cms.Tests.Common.Testing;
-using Umbraco.Tests.PublishedContent;
-using Umbraco.Tests.TestHelpers;
-using Constants = Umbraco.Cms.Core.Constants;
-
-namespace Umbraco.Tests.Routing
-{
-    [TestFixture]
-    [UmbracoTest(Database = UmbracoTestOptions.Database.NewSchemaPerFixture)]
-    public class MediaUrlProviderTests : BaseWebTest
-    {
-        private DefaultMediaUrlProvider _mediaUrlProvider;
-
-        public override void SetUp()
-        {
-            base.SetUp();
-
-            var loggerFactory = NullLoggerFactory.Instance;
-            var mediaFileManager = new MediaFileManager(Mock.Of<IFileSystem>(), Mock.Of<IMediaPathScheme>(),
-                loggerFactory.CreateLogger<MediaFileManager>(), Mock.Of<IShortStringHelper>());
-            var contentSettings = new ContentSettings();
-            var dataTypeService = Mock.Of<IDataTypeService>();
-            var propertyEditors = new MediaUrlGeneratorCollection(new IMediaUrlGenerator[]
-            {
-                new FileUploadPropertyEditor(DataValueEditorFactory, mediaFileManager, Microsoft.Extensions.Options.Options.Create(contentSettings), dataTypeService, LocalizationService, LocalizedTextService,  UploadAutoFillProperties, ContentService),
-                new ImageCropperPropertyEditor(DataValueEditorFactory, loggerFactory, mediaFileManager, Microsoft.Extensions.Options.Options.Create(contentSettings), dataTypeService, IOHelper, UploadAutoFillProperties, ContentService),
-            });
-            _mediaUrlProvider = new DefaultMediaUrlProvider(propertyEditors, UriUtility);
-        }
-
-        public override void TearDown()
-        {
-            base.TearDown();
-
-            _mediaUrlProvider = null;
-        }
-
-        [Test]
-        public void Get_Media_Url_Resolves_Url_From_Upload_Property_Editor()
-        {
-            const string expected = "/media/rfeiw584/test.jpg";
-
-            var umbracoContext = GetUmbracoContext("/");
-            var publishedContent = CreatePublishedContent(Constants.PropertyEditors.Aliases.UploadField, expected, null);
-
-            var resolvedUrl = GetPublishedUrlProvider(umbracoContext).GetMediaUrl(publishedContent, UrlMode.Auto);
-
-            Assert.AreEqual(expected, resolvedUrl);
-        }
-
-        [Test]
-        public void Get_Media_Url_Resolves_Url_From_Image_Cropper_Property_Editor()
-        {
-            const string expected = "/media/rfeiw584/test.jpg";
-
-            var configuration = new ImageCropperConfiguration();
-            var imageCropperValue = JsonConvert.SerializeObject(new ImageCropperValue
-            {
-                Src = expected
-            });
-
-            var umbracoContext = GetUmbracoContext("/");
-            var publishedContent = CreatePublishedContent(Constants.PropertyEditors.Aliases.ImageCropper, imageCropperValue, configuration);
-
-            var resolvedUrl = GetPublishedUrlProvider(umbracoContext).GetMediaUrl(publishedContent, UrlMode.Auto);
-
-            Assert.AreEqual(expected, resolvedUrl);
-        }
-
-        [Test]
-        public void Get_Media_Url_Can_Resolve_Absolute_Url()
-        {
-            const string mediaUrl = "/media/rfeiw584/test.jpg";
-            var expected = $"http://localhost{mediaUrl}";
-
-            var umbracoContext = GetUmbracoContext("http://localhost");
-            var publishedContent = CreatePublishedContent(Constants.PropertyEditors.Aliases.UploadField, mediaUrl, null);
-
-            var resolvedUrl = GetPublishedUrlProvider(umbracoContext).GetMediaUrl(publishedContent, UrlMode.Absolute);
-
-            Assert.AreEqual(expected, resolvedUrl);
-        }
-
-        [Test]
-        public void Get_Media_Url_Returns_Absolute_Url_If_Stored_Url_Is_Absolute()
-        {
-            const string expected = "http://localhost/media/rfeiw584/test.jpg";
-
-            var umbracoContext = GetUmbracoContext("http://localhost");
-            var publishedContent = CreatePublishedContent(Constants.PropertyEditors.Aliases.UploadField, expected, null);
-
-            var resolvedUrl = GetPublishedUrlProvider(umbracoContext).GetMediaUrl(publishedContent, UrlMode.Relative);
-
-            Assert.AreEqual(expected, resolvedUrl);
-        }
-
-        [Test]
-        public void Get_Media_Url_Returns_Empty_String_When_PropertyType_Is_Not_Supported()
-        {
-            var umbracoContext = GetUmbracoContext("/");
-            var publishedContent = CreatePublishedContent(Constants.PropertyEditors.Aliases.Boolean, "0", null);
-
-            var resolvedUrl = GetPublishedUrlProvider(umbracoContext).GetMediaUrl(publishedContent, UrlMode.Absolute, propertyAlias: "test");
-
-            Assert.AreEqual(string.Empty, resolvedUrl);
-        }
-
-        [Test]
-        public void Get_Media_Url_Can_Resolve_Variant_Property_Url()
-        {
-            var umbracoContext = GetUmbracoContext("http://localhost");
-
-            var umbracoFilePropertyType = CreatePropertyType(Constants.PropertyEditors.Aliases.UploadField, null, ContentVariation.Culture);
-
-            const string enMediaUrl = "/media/rfeiw584/en.jpg";
-            const string daMediaUrl = "/media/uf8ewud2/da.jpg";
-
-            var property = new SolidPublishedPropertyWithLanguageVariants
-            {
-                Alias = "umbracoFile",
-                PropertyType = umbracoFilePropertyType,
-            };
-
-            property.SetSourceValue("en", enMediaUrl, true);
-            property.SetSourceValue("da", daMediaUrl);
-
-            var contentType = new PublishedContentType(Guid.NewGuid(), 666, "alias", PublishedItemType.Content, Enumerable.Empty<string>(), new [] { umbracoFilePropertyType }, ContentVariation.Culture);
-            var publishedContent = new SolidPublishedContent(contentType) {Properties = new[] {property}};
-
-            var resolvedUrl = GetPublishedUrlProvider(umbracoContext).GetMediaUrl(publishedContent, UrlMode.Auto, "da");
-            Assert.AreEqual(daMediaUrl, resolvedUrl);
-        }
-
-        private IPublishedUrlProvider GetPublishedUrlProvider(IUmbracoContext umbracoContext)
-        {
-            var webRoutingSettings = new WebRoutingSettings();
-            return new UrlProvider(
-                new TestUmbracoContextAccessor(umbracoContext),
-                Microsoft.Extensions.Options.Options.Create(webRoutingSettings),
-                new UrlProviderCollection(Enumerable.Empty<IUrlProvider>()),
-                new MediaUrlProviderCollection(new []{_mediaUrlProvider}),
-                Mock.Of<IVariationContextAccessor>()
-            );
-        }
-
-        private static IPublishedContent CreatePublishedContent(string propertyEditorAlias, string propertyValue, object dataTypeConfiguration)
-        {
-            var umbracoFilePropertyType = CreatePropertyType(propertyEditorAlias, dataTypeConfiguration, ContentVariation.Nothing);
-
-            var contentType = new PublishedContentType(Guid.NewGuid(), 666, "alias", PublishedItemType.Content, Enumerable.Empty<string>(),
-                new[] {umbracoFilePropertyType}, ContentVariation.Nothing);
-
-            return new SolidPublishedContent(contentType)
-            {
-                Id = 1234,
-                Key = Guid.NewGuid(),
-                Properties = new[]
-                {
-                    new SolidPublishedProperty
-                    {
-                        Alias = "umbracoFile",
-                        SolidSourceValue = propertyValue,
-                        SolidHasValue = true,
-                        PropertyType = umbracoFilePropertyType
-                    }
-                }
-            };
-        }
-
-        private static PublishedPropertyType CreatePropertyType(string propertyEditorAlias, object dataTypeConfiguration, ContentVariation variation)
-        {
-            var uploadDataType = new PublishedDataType(1234, propertyEditorAlias, new Lazy<object>(() => dataTypeConfiguration));
-
-            var propertyValueConverters = new PropertyValueConverterCollection(new IPropertyValueConverter[]
-            {
-                new UploadPropertyConverter(),
-                new ImageCropperValueConverter(Mock.Of<ILogger<ImageCropperValueConverter>>()),
-            });
-
-            var publishedModelFactory = Mock.Of<IPublishedModelFactory>();
-            var publishedContentTypeFactory = new Mock<IPublishedContentTypeFactory>();
-            publishedContentTypeFactory.Setup(x => x.GetDataType(It.IsAny<int>()))
-                .Returns(uploadDataType);
-
-            return new PublishedPropertyType("umbracoFile", 42, true, variation, propertyValueConverters, publishedModelFactory, publishedContentTypeFactory.Object);
-        }
-    }
-}

legacy/Umbraco.Tests/Umbraco.Tests.csproj

@@ -1,199 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<Project ToolsVersion="15.0">
-  <Import Project="$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props" Condition="Exists('$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props')" />
-  <PropertyGroup>
-    <Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
-    <Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
-    <ProductVersion>8.0.30703</ProductVersion>
-    <SchemaVersion>2.0</SchemaVersion>
-    <ProjectGuid>{5D3B8245-ADA6-453F-A008-50ED04BFE770}</ProjectGuid>
-    <OutputType>Library</OutputType>
-    <AppDesignerFolder>Properties</AppDesignerFolder>
-    <RootNamespace>Umbraco.Tests</RootNamespace>
-    <AssemblyName>Umbraco.Tests</AssemblyName>
-    <TargetFrameworkVersion>v4.7.2</TargetFrameworkVersion>
-    <FileAlignment>512</FileAlignment>
-    <SolutionDir Condition="$(SolutionDir) == '' Or $(SolutionDir) == '*Undefined*'">..\</SolutionDir>
-    <PublishUrl>publish\</PublishUrl>
-    <Install>true</Install>
-    <InstallFrom>Disk</InstallFrom>
-    <UpdateEnabled>false</UpdateEnabled>
-    <UpdateMode>Foreground</UpdateMode>
-    <UpdateInterval>7</UpdateInterval>
-    <UpdateIntervalUnits>Days</UpdateIntervalUnits>
-    <UpdatePeriodically>false</UpdatePeriodically>
-    <UpdateRequired>false</UpdateRequired>
-    <MapFileExtensions>true</MapFileExtensions>
-    <ApplicationRevision>0</ApplicationRevision>
-    <ApplicationVersion>1.0.0.%2a</ApplicationVersion>
-    <IsWebBootstrapper>false</IsWebBootstrapper>
-    <UseApplicationTrust>false</UseApplicationTrust>
-    <BootstrapperEnabled>true</BootstrapperEnabled>
-    <TargetFrameworkProfile />
-    <NuGetPackageImportStamp>
-    </NuGetPackageImportStamp>
-  </PropertyGroup>
-  <PropertyGroup>
-    <AutoGenerateBindingRedirects>true</AutoGenerateBindingRedirects>
-    <GenerateBindingRedirectsOutputType>true</GenerateBindingRedirectsOutputType>
-  </PropertyGroup>
-  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
-    <DebugSymbols>true</DebugSymbols>
-    <DebugType>full</DebugType>
-    <Optimize>false</Optimize>
-    <OutputPath>bin\Debug\</OutputPath>
-    <DefineConstants>DEBUG;TRACE</DefineConstants>
-    <ErrorReport>prompt</ErrorReport>
-    <WarningLevel>4</WarningLevel>
-    <Prefer32Bit>false</Prefer32Bit>
-    <LangVersion>8</LangVersion>
-  </PropertyGroup>
-  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
-    <DebugType>pdbonly</DebugType>
-    <Optimize>true</Optimize>
-    <OutputPath>bin\Release\</OutputPath>
-    <DefineConstants>TRACE</DefineConstants>
-    <ErrorReport>prompt</ErrorReport>
-    <WarningLevel>4</WarningLevel>
-    <Prefer32Bit>false</Prefer32Bit>
-    <LangVersion>latest</LangVersion>
-  </PropertyGroup>
-  <ItemGroup>
-    <Reference Include="System" />
-    <Reference Include="System.configuration" />
-    <Reference Include="System.Core" />
-    <Reference Include="System.Data.Entity.Design" />
-    <Reference Include="System.Drawing" />
-    <Reference Include="System.IO" />
-    <Reference Include="System.IO.Compression" />
-    <Reference Include="System.IO.Compression.FileSystem" />
-    <Reference Include="System.Runtime.Caching" />
-    <Reference Include="System.Runtime.Serialization" />
-    <Reference Include="System.Text.Encoding" />
-    <Reference Include="System.Web" />
-    <Reference Include="System.Web.ApplicationServices" />
-    <Reference Include="System.Web.Extensions" />
-    <Reference Include="System.Web.Services" />
-    <Reference Include="System.Xml.Linq" />
-    <Reference Include="System.Data.DataSetExtensions" />
-    <Reference Include="Microsoft.CSharp" />
-    <Reference Include="System.Data" />
-    <Reference Include="System.Xml" />
-  </ItemGroup>
-  <ItemGroup>
-    <PackageReference Include="Castle.Core" Version="4.4.1" />
-    <PackageReference Include="Examine.Core">
-      <Version>2.0.0</Version>
-    </PackageReference>
-    <PackageReference Include="Castle.Core" Version="4.3.1" />
-    <PackageReference Include="Examine" Version="2.0.0" />
-    <PackageReference Include="HtmlAgilityPack">
-      <Version>1.11.31</Version>
-    </PackageReference>
-    <PackageReference Include="Lucene.Net.Contrib" Version="3.0.3" />
-    <PackageReference Include="Microsoft.AspNet.Identity.Core" Version="2.2.3" />
-    <PackageReference Include="Microsoft.AspNet.Mvc" Version="5.2.7" />
-    <PackageReference Include="Microsoft.AspNet.WebApi" Version="5.2.7" />
-    <PackageReference Include="Microsoft.AspNet.WebApi.Client" Version="5.2.7" />
-    <PackageReference Include="Microsoft.AspNet.WebApi.Owin" Version="5.2.7" />
-    <PackageReference Include="Microsoft.AspNet.WebApi.SelfHost" Version="5.2.7" />
-    <PackageReference Include="Microsoft.AspNet.WebApi.Tracing" Version="5.2.7" />
-    <PackageReference Include="Microsoft.AspNet.WebApi.WebHost" Version="5.2.7" />
-    <PackageReference Include="Microsoft.Extensions.Configuration.Abstractions">
-      <Version>5.0.0</Version>
-    </PackageReference>
-    <PackageReference Include="Microsoft.Extensions.Logging" Version="5.0.0" />
-    <PackageReference Include="Microsoft.Extensions.Logging.Abstractions" Version="5.0.0" />
-    <PackageReference Include="Microsoft.Extensions.Logging.Console">
-      <Version>5.0.0</Version>
-    </PackageReference>
-    <PackageReference Include="Microsoft.Extensions.Logging.Debug" Version="5.0.0" />
-    <PackageReference Include="Microsoft.Owin" Version="4.1.1" />
-    <PackageReference Include="Microsoft.Owin.Hosting" Version="4.1.1" />
-    <PackageReference Include="Microsoft.Owin.Security" Version="4.1.1" />
-    <PackageReference Include="Microsoft.Owin.Testing" Version="4.1.1" />
-    <PackageReference Include="Microsoft.Web.Infrastructure" Version="1.0.0.0" />
-    <PackageReference Include="MiniProfiler" Version="4.2.22" />
-    <PackageReference Include="Moq" Version="4.16.1" />
-    <PackageReference Include="NUnit" Version="3.13.1" />
-    <PackageReference Include="NUnit3TestAdapter" Version="3.17.0" />
-    <PackageReference Include="Newtonsoft.Json" Version="12.0.3" />
-    <PackageReference Include="MiniProfiler" Version="4.0.138" />
-    <PackageReference Include="Moq" Version="4.10.1" />
-    <PackageReference Include="Moq" Version="4.14.5" />
-    <PackageReference Include="NPoco" Version="3.9.4" />
-    <PackageReference Include="NUnit" Version="3.11.0" />
-    <PackageReference Include="NUnit3TestAdapter" Version="3.12.0" />
-    <PackageReference Include="NPoco" Version="4.0.3" />
-    <PackageReference Include="Newtonsoft.Json" Version="12.0.1" />
-    <PackageReference Include="Owin" Version="1.0" />
-    <PackageReference Include="Selenium.WebDriver" Version="3.141.0" />
-    <PackageReference Include="System.Configuration.ConfigurationManager" Version="5.0.0" />
-    <PackageReference Include="System.ComponentModel.Annotations" Version="5.0.0" />
-    <PackageReference Include="System.Data.SqlClient" Version="4.8.2" />
-    <PackageReference Include="System.Threading.Tasks.Extensions" Version="4.5.4" />
-    <PackageReference Include="Umbraco.SqlServerCE" Version="4.0.0.1" />
-  </ItemGroup>
-  <ItemGroup>
-    <Compile Include="Published\ModelTypeTests.cs" />
-    <Compile Include="Routing\BaseUrlProviderTest.cs" />
-    <Compile Include="Routing\MediaUrlProviderTests.cs" />
-    <Compile Include="Scoping\ScopedNuCacheTests.cs" />
-    <Compile Include="Web\Controllers\AuthenticationControllerTests.cs" />
-    <Compile Include="Properties\AssemblyInfo.cs" />
-  </ItemGroup>
-  <ItemGroup>
-    <None Include="App.config">
-      <SubType>Designer</SubType>
-    </None>
-    <None Include="unit-test-logger.config">
-      <CopyToOutputDirectory>Always</CopyToOutputDirectory>
-    </None>
-  </ItemGroup>
-  <ItemGroup>
-    <ProjectReference Include="..\..\src\Umbraco.Core\Umbraco.Core.csproj">
-      <Project>{29aa69d9-b597-4395-8d42-43b1263c240a}</Project>
-      <Name>Umbraco.Core</Name>
-    </ProjectReference>
-    <ProjectReference Include="..\..\src\Umbraco.Examine.Lucene\Umbraco.Examine.Lucene.csproj">
-      <Project>{0fad7d2a-d7dd-45b1-91fd-488bb6cdacea}</Project>
-      <Name>Umbraco.Examine.Lucene</Name>
-    </ProjectReference>
-    <ProjectReference Include="...\..\srcUmbraco.Infrastructure\Umbraco.Infrastructure.csproj">
-      <Project>{3ae7bf57-966b-45a5-910a-954d7c554441}</Project>
-      <Name>Umbraco.Infrastructure</Name>
-    </ProjectReference>
-    <ProjectReference Include="..\..\src\Umbraco.Persistence.SqlCe\Umbraco.Persistence.SqlCe.csproj">
-      <Project>{33085570-9bf2-4065-a9b0-a29d920d13ba}</Project>
-      <Name>Umbraco.Persistence.SqlCe</Name>
-    </ProjectReference>
-    <ProjectReference Include="..\..\src\Umbraco.PublishedCache.NuCache\Umbraco.PublishedCache.NuCache.csproj">
-      <Project>{f6de8da0-07cc-4ef2-8a59-2bc81dbb3830}</Project>
-      <Name>Umbraco.PublishedCache.NuCache</Name>
-    </ProjectReference>
-    <ProjectReference Include="..\Umbraco.Tests.Common\Umbraco.Tests.Common.csproj">
-      <Project>{a499779c-1b3b-48a8-b551-458e582e6e96}</Project>
-      <Name>Umbraco.Tests.Common</Name>
-    </ProjectReference>
-    <ProjectReference Include="..\..\src\Umbraco.Web\Umbraco.Web.csproj">
-      <Project>{651E1350-91B6-44B7-BD60-7207006D7003}</Project>
-      <Name>Umbraco.Web</Name>
-    </ProjectReference>
-  </ItemGroup>
-  <ItemGroup>
-    <Service Include="{82A7F48D-3B50-4B1E-B82E-3ADA8210C358}" />
-  </ItemGroup>
-  <ItemGroup />
-  <!-- get NuGet packages directory -->
-  <PropertyGroup>
-    <NuGetPackages>$(NuGetPackageFolders.Split(';')[0])</NuGetPackages>
-  </PropertyGroup>
-  <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
-  <Target Name="BeforeBuild">
-    <Message Text="-BeforeBuild-" Importance="high" />
-    <Message Text="MSBuildExtensionsPath: $(MSBuildExtensionsPath)" Importance="high" />
-    <Message Text="WebPublishingTasks:    $(WebPublishingTasks)" Importance="high" />
-    <Message Text="NuGetPackageFolders:   $(NuGetPackageFolders)" Importance="high" />
-    <Message Text="NuGetPackages:         $(NuGetPackages)" Importance="high" />
-  </Target>
-</Project>

legacy/Umbraco.Tests/Web/Controllers/AuthenticationControllerTests.cs

@@ -1,122 +0,0 @@
-using Moq;
-using NUnit.Framework;
-using Umbraco.Cms.Core.Features;
-using Umbraco.Cms.Core.Services;
-using Umbraco.Cms.Tests.Common.Testing;
-using Umbraco.Extensions;
-using Umbraco.Tests.TestHelpers;
-using Umbraco.Tests.Testing;
-
-namespace Umbraco.Tests.Web.Controllers
-{
-    [TestFixture]
-    [UmbracoTest(Database = UmbracoTestOptions.Database.None)]
-    public class AuthenticationControllerTests : TestWithDatabaseBase
-    {
-        protected override void ComposeApplication(bool withApplication)
-        {
-            base.ComposeApplication(withApplication);
-            //if (!withApplication) return;
-
-            // replace the true IUserService implementation with a mock
-            // so that each test can configure the service to their liking
-            Builder.Services.AddUnique(f => Mock.Of<IUserService>());
-
-            // kill the true IEntityService too
-            Builder.Services.AddUnique(f => Mock.Of<IEntityService>());
-
-            Builder.Services.AddUnique<UmbracoFeatures>();
-        }
-
-
-        // TODO Reintroduce when moved to .NET Core
-        // [Test]
-        // public async System.Threading.Tasks.Task GetCurrentUser_Fips()
-        // {
-        //     ApiController CtrlFactory(HttpRequestMessage message, IUmbracoContextAccessor umbracoContextAccessor)
-        //     {
-        //         //setup some mocks
-        //         var userServiceMock = Mock.Get(ServiceContext.UserService);
-        //         userServiceMock.Setup(service => service.GetUserById(It.IsAny<int>()))
-        //             .Returns(() => null);
-        //
-        //         if (Thread.GetDomain().GetData(".appPath") != null)
-        //         {
-        //             HttpContext.Current = new HttpContext(new SimpleWorkerRequest("", "", new StringWriter()));
-        //         }
-        //         else
-        //         {
-        //             var baseDir = IOHelper.MapPath("").TrimEnd(Path.DirectorySeparatorChar);
-        //             HttpContext.Current = new HttpContext(new SimpleWorkerRequest("/", baseDir, "", "", new StringWriter()));
-        //         }
-        //
-        //         var usersController = new AuthenticationController(
-        //             new TestUserPasswordConfig(),
-        //             Factory.GetInstance<IGlobalSettings>(),
-        //             Factory.GetInstance<IHostingEnvironment>(),
-        //             umbracoContextAccessor,
-        //             Factory.GetInstance<ISqlContext>(),
-        //             Factory.GetInstance<ServiceContext>(),
-        //             Factory.GetInstance<AppCaches>(),
-        //             Factory.GetInstance<IProfilingLogger>(),
-        //             Factory.GetInstance<IRuntimeState>(),
-        //             Factory.GetInstance<UmbracoMapper>(),
-        //             Factory.GetInstance<ISecuritySettings>(),
-        //             Factory.GetInstance<IPublishedUrlProvider>(),
-        //             Factory.GetInstance<IRequestAccessor>(),
-        //             Factory.GetInstance<IEmailSender>()
-        //         );
-        //         return usersController;
-        //     }
-        //
-        //     Mock.Get(Current.SqlContext)
-        //         .Setup(x => x.Query<IUser>())
-        //         .Returns(new Query<IUser>(Current.SqlContext));
-        //
-        //     var syntax = new SqlCeSyntaxProvider();
-        //
-        //     Mock.Get(Current.SqlContext)
-        //         .Setup(x => x.SqlSyntax)
-        //         .Returns(syntax);
-        //
-        //     var mappers = new MapperCollection(new[]
-        //     {
-        //         new UserMapper(new Lazy<ISqlContext>(() => Current.SqlContext), new ConcurrentDictionary<Type, ConcurrentDictionary<string, string>>())
-        //     });
-        //
-        //     Mock.Get(Current.SqlContext)
-        //         .Setup(x => x.Mappers)
-        //         .Returns(mappers);
-        //
-        //     // Testing what happens if the system were configured to only use FIPS-compliant algorithms
-        //     var typ = typeof(CryptoConfig);
-        //     var flds = typ.GetFields(BindingFlags.Static | BindingFlags.NonPublic);
-        //     var haveFld = flds.FirstOrDefault(f => f.Name == "s_haveFipsAlgorithmPolicy");
-        //     var isFld = flds.FirstOrDefault(f => f.Name == "s_fipsAlgorithmPolicy");
-        //     var originalFipsValue = CryptoConfig.AllowOnlyFipsAlgorithms;
-        //
-        //     try
-        //     {
-        //         if (!originalFipsValue)
-        //         {
-        //             haveFld.SetValue(null, true);
-        //             isFld.SetValue(null, true);
-        //         }
-        //
-        //         var runner = new TestRunner(CtrlFactory);
-        //         var response = await runner.Execute("Authentication", "GetCurrentUser", HttpMethod.Get);
-        //
-        //         var obj = JsonConvert.DeserializeObject<UserDetail>(response.Item2);
-        //         Assert.AreEqual(-1, obj.UserId);
-        //     }
-        //     finally
-        //     {
-        //         if (!originalFipsValue)
-        //         {
-        //             haveFld.SetValue(null, false);
-        //             isFld.SetValue(null, false);
-        //         }
-        //     }
-        // }
-    }
-}

legacy/Umbraco.Tests/unit-test-log4net.CI.config

@@ -1,6 +0,0 @@
-<?xml version="1.0"?>
-<log4net>
-  <root>
-    <priority value="OFF"/>
-  </root>
-</log4net>

legacy/Umbraco.Tests/unit-test-logger.config

@@ -1,20 +0,0 @@
-<?xml version="1.0" encoding="utf-8" ?>
-<configuration>
-    <appSettings>
-        <!-- Global Log Level event -->
-        <add key="serilog:minimum-level" value="Warning" />
-
-        <!-- Write to console -->
-        <add key="serilog:using:Console" value="Serilog.Sinks.Console" />
-        <add key="serilog:write-to:Console.theme" value="Serilog.Sinks.SystemConsole.Themes.AnsiConsoleTheme::Code, Serilog.Sinks.Console" />
-        <add key="serilog:write-to:Console.outputTemplate" value="[{Timestamp:HH:mm:ss} {Level:u3}] {Message:lj} &lt;s:{SourceContext}&gt;{NewLine}{Exception}" />
-
-        <!-- Namespace log levels -->
-        <add key="serilog:minimum-level:override:Umbraco.Core.Publishing.PublishingStrategy" value="Warning" />
-        <add key="serilog:minimum-level:override:Umbraco.Core.TypeLoader" value="Warning" />
-        <add key="serilog:minimum-level:override:Umbraco.Core.Persistence.UmbracoDatabase" value="Debug" />
-        <add key="serilog:minimum-level:override:Umbraco.Core.Persistence.Migrations.Initial.DatabaseSchemaCreation" value="Warning" />
-        <add key="serilog:minimum-level:override:Umbraco.Core.Persistence.Migrations.Initial.BaseDataCreation" value="Warning" />
-
-    </appSettings>
-</configuration>

nuget.config

@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="utf-8"?>
+<configuration>
+  <packageSources>
+    <clear />
+    <add key="nuget" value="https://api.nuget.org/v3/index.json" />
+  </packageSources>
+  <packageSourceMapping>
+    <!-- Ensure all packages are pulled from NuGet -->
+    <packageSource key="nuget">
+      <package pattern="*" />
+    </packageSource>
+  </packageSourceMapping>
+</configuration>

src/Directory.Build.props

@@ -1,45 +0,0 @@
-<Project>
-  <!-- Enable multi-level merging -->
-  <Import Project="$([MSBuild]::GetPathOfFileAbove('Directory.Build.props', '$(MSBuildThisFileDirectory)../'))" />
-
-  <PropertyGroup>
-    <Version>10.0.0</Version>
-    <AssemblyVersion>10.0.0</AssemblyVersion>
-    <InformationalVersion>10.0.0-rc1</InformationalVersion>
-    <FileVersion>10.0.0</FileVersion>
-    <LangVersion Condition="'$(LangVersion)' == ''">10.0</LangVersion>
-    <NeutralLanguage>en-US</NeutralLanguage>
-    <Company>Umbraco CMS</Company>
-    <Copyright>Copyright © Umbraco 2021</Copyright>
-    <Authors>Umbraco HQ</Authors>
-    <PackageProjectUrl>https://umbraco.com/</PackageProjectUrl>
-    <PackageIconUrl>https://umbraco.com/dist/nuget/logo-small.png</PackageIconUrl>
-    <PackageLicenseUrl>https://opensource.org/licenses/MIT</PackageLicenseUrl>
-    <PackageRequireLicenseAcceptance>false</PackageRequireLicenseAcceptance>
-    <PackageTags>umbraco</PackageTags>
-    <RepositoryType>git</RepositoryType>
-    <RepositoryUrl>https://github.com/umbraco/umbraco-cms</RepositoryUrl>
-    <Nullable>enable</Nullable>
-    <WarningsAsErrors>Nullable</WarningsAsErrors>
-    <ImplicitUsings>enable</ImplicitUsings>
-  </PropertyGroup>
-
-  <PropertyGroup>
-    <!-- SourceLink: Publish the repository URL in the built .nupkg (in the NuSpec <Repository> element)-->
-    <PublishRepositoryUrl>true</PublishRepositoryUrl>
-
-    <!-- SourceLink: Embed source files that are not tracked by the source control manager in the PDB -->
-    <EmbedUntrackedSources>true</EmbedUntrackedSources>
-
-    <!-- SourceLink: Build symbol package (.snupkg) to distribute the PDB containing Source Link -->
-    <IncludeSymbols>true</IncludeSymbols>
-    <SymbolPackageFormat>snupkg</SymbolPackageFormat>
-  </PropertyGroup>
-
-  <!-- SourceLink: Deterministic -->
-  <!-- https://github.com/clairernovotny/DeterministicBuilds -->
-  <!-- Only for Azure Pipelines CI Build -->
-  <PropertyGroup Condition="'$(TF_BUILD)' == 'true'">
-    <ContinuousIntegrationBuild>true</ContinuousIntegrationBuild>
-  </PropertyGroup>
-</Project>

src/JsonSchema/AppSettings.cs

@@ -1,137 +0,0 @@
-// Copyright (c) Umbraco.
-// See LICENSE for more details.
-
-using Umbraco.Cms.Core.Configuration;
-using Umbraco.Cms.Core.Configuration.Models;
-using Umbraco.Deploy.Core.Configuration.DebugConfiguration;
-using Umbraco.Deploy.Core.Configuration.DeployConfiguration;
-using Umbraco.Deploy.Core.Configuration.DeployProjectConfiguration;
-using Umbraco.Forms.Core.Configuration;
-using SecuritySettings = Umbraco.Cms.Core.Configuration.Models.SecuritySettings;
-
-namespace JsonSchema
-{
-    internal class AppSettings
-    {
-        /// <summary>
-        ///     Gets or sets the Umbraco
-        /// </summary>
-        public UmbracoDefinition? Umbraco { get; set; }
-
-        /// <summary>
-        ///     Configuration of Umbraco CMS and packages
-        /// </summary>
-        internal class UmbracoDefinition
-        {
-            // ReSharper disable once InconsistentNaming
-            public CmsDefinition? CMS { get; set; }
-
-            public FormsDefinition? Forms { get; set; }
-
-            public DeployDefinition? Deploy { get; set; }
-
-            /// <summary>
-            ///     Configurations for the Umbraco CMS
-            /// </summary>
-            public class CmsDefinition
-            {
-                public ContentSettings? Content { get; set; }
-                public CoreDebugSettings? Debug { get; set; }
-
-                public ExceptionFilterSettings? ExceptionFilter { get; set; }
-
-                public ModelsBuilderSettings? ModelsBuilder { get; set; }
-
-                public GlobalSettings? Global { get; set; }
-
-                public HealthChecksSettings? HealthChecks { get; set; }
-
-                public HostingSettings? Hosting { get; set; }
-
-                public ImagingSettings? Imaging { get; set; }
-
-                public IndexCreatorSettings? Examine { get; set; }
-
-                public KeepAliveSettings? KeepAlive { get; set; }
-
-                public LoggingSettings? Logging { get; set; }
-
-                public MemberPasswordConfigurationSettings? MemberPassword { get; set; }
-
-                public NuCacheSettings? NuCache { get; set; }
-
-                public RequestHandlerSettings? RequestHandler { get; set; }
-
-                public RuntimeSettings? Runtime { get; set; }
-
-                public SecuritySettings? Security { get; set; }
-
-                public TourSettings? Tours { get; set; }
-
-                public TypeFinderSettings? TypeFinder { get; set; }
-
-                public UserPasswordConfigurationSettings? UserPassword { get; set; }
-
-                public WebRoutingSettings? WebRouting { get; set; }
-
-                public UmbracoPluginSettings? Plugins { get; set; }
-
-                public UnattendedSettings? Unattended { get; set; }
-
-                public RichTextEditorSettings? RichTextEditor { get; set; }
-
-                public RuntimeMinificationSettings? RuntimeMinification { get; set; }
-
-                public BasicAuthSettings? BasicAuth { get; set; }
-
-                public PackageMigrationSettings? PackageMigration { get; set; }
-
-                public LegacyPasswordMigrationSettings? LegacyPasswordMigration { get; set; }
-
-                public ContentDashboardSettings? ContentDashboard { get; set; }
-
-                public HelpPageSettings? HelpPage { get; set; }
-
-                public InstallDefaultDataSettings? DefaultDataCreation { get; set; }
-            }
-
-            /// <summary>
-            ///     Configurations for the Umbraco Forms package to Umbraco CMS
-            /// </summary>
-            public class FormsDefinition
-            {
-                public FormDesignSettings? FormDesign { get; set; }
-
-                public PackageOptionSettings? Options { get; set; }
-
-                public Umbraco.Forms.Core.Configuration.SecuritySettings? Security { get; set; }
-
-                public FieldTypesDefinition? FieldTypes { get; set; }
-
-                /// <summary>
-                ///     Configurations for the Umbraco Forms Field Types
-                /// </summary>
-                public class FieldTypesDefinition
-                {
-                    public DatePickerSettings? DatePicker { get; set; }
-
-                    public Recaptcha2Settings? Recaptcha2 { get; set; }
-
-                    public Recaptcha3Settings? Recaptcha3 { get; set; }
-                }
-            }
-
-            /// <summary>
-            ///     Configurations for the Umbraco Deploy package to Umbraco CMS
-            /// </summary>
-            public class DeployDefinition
-            {
-                public DeploySettings? Settings { get; set; }
-
-                public DeployProjectConfig? Project { get; set; }
-
-                public DebugSettings? Debug { get; set; }
-            }
-        }
-    }
-}

src/JsonSchema/JsonSchema.csproj

@@ -1,38 +0,0 @@
-<Project Sdk="Microsoft.NET.Sdk">
-  <PropertyGroup>
-    <OutputType>Exe</OutputType>
-    <TargetFramework>net6.0</TargetFramework>
-    <GenerateDocumentationFile>true</GenerateDocumentationFile>
-    <IsPackable>false</IsPackable>
-  </PropertyGroup>
-
-    <ItemGroup>
-      <PackageReference Include="CommandLineParser" Version="2.9.1" />
-      <PackageReference Include="NJsonSchema" Version="10.7.2" />
-      <PackageReference Include="System.Xml.XPath.XmlDocument" Version="4.3.0" />
-      <PackageReference Include="Umbraco.Deploy.Core" Version="9.3.1" />
-      <PackageReference Include="Umbraco.Forms.Core" Version="10.0.0-rc1" />
-      <PackageReference Include="Umbraco.Deploy.Core" Version="9.4.0" />
-      <PackageReference Include="Umbraco.Forms.Core" Version="9.4.0" />
-      <PackageReference Update="Nerdbank.GitVersioning">
-        <Version>3.5.107</Version>
-      </PackageReference>
-    </ItemGroup>
-
-  <ItemGroup>
-    <ProjectReference Include="..\Umbraco.Core\Umbraco.Core.csproj" />
-  </ItemGroup>
-
-  <!--  Copy Forms XML docs-->
-  <PropertyGroup>
-    <NuGetPackageRoot Condition=" '$(NuGetPackageRoot)' == '' ">$(UserProfile)\.nuget\packages\</NuGetPackageRoot>
-  </PropertyGroup>
-
-  <Target Name="CopyPackagesXml" BeforeTargets="Build">
-    <ItemGroup>
-      <PackageReferenceFiles Include="$(NugetPackageRoot)%(PackageReference.Identity)\%(PackageReference.Version)%(PackageReference.CopyToOutputDirectory)\lib\**\*.xml" />
-    </ItemGroup>
-    <Copy SourceFiles="@(PackageReferenceFiles)" DestinationFolder="$(OutDir)" />
-  </Target>
-
-</Project>

src/JsonSchema/NamespacePrefixedSchemaNameGenerator.cs

@@ -1,13 +0,0 @@
-// Copyright (c) Umbraco.
-// See LICENSE for more details.
-
-using System;
-using NJsonSchema.Generation;
-
-namespace JsonSchema
-{
-    internal class NamespacePrefixedSchemaNameGenerator : DefaultSchemaNameGenerator
-    {
-        public override string Generate(Type type) => type.Namespace?.Replace(".", string.Empty) + base.Generate(type);
-    }
-}

src/JsonSchema/Options.cs

@@ -1,13 +0,0 @@
-// Copyright (c) Umbraco.
-// See LICENSE for more details.
-
-using CommandLine;
-
-namespace JsonSchema
-{
-    internal class Options
-    {
-        [Option('o', "outputFile", Required = false, HelpText = "Set path of the output file.", Default = "../../../../Umbraco.Web.UI/appsettings-schema.json")]
-        public string OutputFile { get; set; } = null!;
-    }
-}

src/JsonSchema/Program.cs

@@ -1,41 +0,0 @@
-// Copyright (c) Umbraco.
-// See LICENSE for more details.
-
-using System;
-using System.IO;
-using System.Threading.Tasks;
-using CommandLine;
-
-namespace JsonSchema
-{
-    internal class Program
-    {
-        public static async Task Main(string[] args)
-        {
-            try
-            {
-                await Parser.Default.ParseArguments<Options>(args)
-                    .WithParsedAsync(Execute);
-            }
-            catch (Exception e)
-            {
-                Console.WriteLine(e);
-                throw;
-            }
-        }
-
-        private static async Task Execute(Options options)
-        {
-            var generator = new UmbracoJsonSchemaGenerator();
-            var schema = await generator.Generate();
-
-            var path = Path.GetFullPath(Path.Combine(Environment.CurrentDirectory, options.OutputFile));
-            Console.WriteLine("Path to use {0}", path);
-            Directory.CreateDirectory(Path.GetDirectoryName(path)!);
-            Console.WriteLine("Ensured directory exists");
-            await File.WriteAllTextAsync(path, schema);
-
-            Console.WriteLine("File written at {0}", path);
-        }
-    }
-}

src/JsonSchema/UmbracoJsonSchemaGenerator.cs

@@ -1,56 +0,0 @@
-// Copyright (c) Umbraco.
-// See LICENSE for more details.
-
-using System.Net.Http;
-using System.Threading.Tasks;
-using Newtonsoft.Json;
-using Newtonsoft.Json.Linq;
-using NJsonSchema.Generation;
-
-namespace JsonSchema
-{
-    /// <summary>
-    ///     Generator of the JsonSchema for AppSettings.json including A specific Umbraco version.
-    /// </summary>
-    public class UmbracoJsonSchemaGenerator
-    {
-        private static readonly HttpClient s_client = new ();
-        private readonly JsonSchemaGenerator _innerGenerator;
-
-        /// <summary>
-        ///     Initializes a new instance of the <see cref="UmbracoJsonSchemaGenerator" /> class.
-        /// </summary>
-        public UmbracoJsonSchemaGenerator()
-            => _innerGenerator = new JsonSchemaGenerator(new UmbracoJsonSchemaGeneratorSettings());
-
-        /// <summary>
-        ///     Generates a json representing the JsonSchema for AppSettings.json including A specific Umbraco version..
-        /// </summary>
-        public async Task<string> Generate()
-        {
-            JObject umbracoSchema = GenerateUmbracoSchema();
-            JObject officialSchema = await GetOfficialAppSettingsSchema();
-
-            officialSchema.Merge(umbracoSchema);
-
-            return officialSchema.ToString();
-        }
-
-        private async Task<JObject> GetOfficialAppSettingsSchema()
-        {
-            HttpResponseMessage response = await s_client.GetAsync("https://json.schemastore.org/appsettings.json")
-                .ConfigureAwait(false);
-
-            var result = await response.Content.ReadAsStringAsync();
-
-            return JsonConvert.DeserializeObject<JObject>(result)!;
-        }
-
-        private JObject GenerateUmbracoSchema()
-        {
-            NJsonSchema.JsonSchema schema = _innerGenerator.Generate(typeof(AppSettings));
-
-            return JsonConvert.DeserializeObject<JObject>(schema.ToJson())!;
-        }
-    }
-}

src/JsonSchema/UmbracoJsonSchemaGeneratorSettings.cs

@@ -1,43 +0,0 @@
-// Copyright (c) Umbraco.
-// See LICENSE for more details.
-
-using System;
-using System.Collections.Generic;
-using System.Linq;
-using Newtonsoft.Json;
-using Newtonsoft.Json.Converters;
-using Newtonsoft.Json.Serialization;
-using NJsonSchema.Generation;
-
-namespace JsonSchema
-{
-    /// <inheritdoc />
-    public class UmbracoJsonSchemaGeneratorSettings : JsonSchemaGeneratorSettings
-    {
-        /// <summary>
-        /// Initializes a new instance of the <see cref="UmbracoJsonSchemaGeneratorSettings"/> class.
-        /// </summary>
-        public UmbracoJsonSchemaGeneratorSettings()
-        {
-            AlwaysAllowAdditionalObjectProperties = true;
-            SerializerSettings = new JsonSerializerSettings()
-            {
-                ContractResolver = new WritablePropertiesOnlyResolver()
-            };
-            DefaultReferenceTypeNullHandling = ReferenceTypeNullHandling.NotNull;
-            SchemaNameGenerator = new NamespacePrefixedSchemaNameGenerator();
-            SerializerSettings.Converters.Add(new StringEnumConverter());
-            IgnoreObsoleteProperties = true;
-            GenerateExamples = true;
-        }
-
-        private class WritablePropertiesOnlyResolver : DefaultContractResolver
-        {
-            protected override IList<JsonProperty> CreateProperties(Type type, MemberSerialization memberSerialization)
-            {
-                IList<JsonProperty> props = base.CreateProperties(type, memberSerialization);
-                return props.Where(p => p.Writable).ToList();
-            }
-        }
-    }
-}

src/Umbraco.Cms.Api.Common/Attributes/MapToApiAttribute.cs

@@ -0,0 +1,9 @@
+namespace Umbraco.Cms.Api.Common.Attributes;
+
+[AttributeUsage(AttributeTargets.Class, AllowMultiple = false)]
+public class MapToApiAttribute : Attribute
+{
+    public MapToApiAttribute(string apiName) => ApiName = apiName;
+
+    public string ApiName { get; }
+}

src/Umbraco.Cms.Api.Common/Builders/ProblemDetailsBuilder.cs

@@ -0,0 +1,37 @@
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+
+namespace Umbraco.Cms.Api.Common.Builders;
+
+public class ProblemDetailsBuilder
+{
+    private string? _title;
+    private string? _detail;
+    private string? _type;
+
+    public ProblemDetailsBuilder WithTitle(string title)
+    {
+        _title = title;
+        return this;
+    }
+
+    public ProblemDetailsBuilder WithDetail(string detail)
+    {
+        _detail = detail;
+        return this;
+    }
+
+    public ProblemDetailsBuilder WithType(string type)
+    {
+        _type = type;
+        return this;
+    }
+
+    public ProblemDetails Build() =>
+        new()
+        {
+            Title = _title,
+            Detail = _detail,
+            Type = _type ?? "Error",
+        };
+}

src/Umbraco.Cms.Api.Common/Configuration/ConfigureApiBehaviorOptions.cs

@@ -0,0 +1,12 @@
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.Options;
+
+namespace Umbraco.Cms.Api.Common.Configuration;
+
+public class ConfigureApiBehaviorOptions : IConfigureOptions<ApiBehaviorOptions>
+{
+    public void Configure(ApiBehaviorOptions options) =>
+        // disable ProblemDetails as default result type for every non-success response (i.e. 404)
+        // - see https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.mvc.apibehavioroptions.suppressmapclienterrors
+        options.SuppressMapClientErrors = true;
+}

src/Umbraco.Cms.Api.Common/Configuration/ConfigureMvcJsonOptions.cs

@@ -0,0 +1,31 @@
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Options;
+using Umbraco.Cms.Api.Common.Json;
+
+namespace Umbraco.Cms.Api.Common.Configuration;
+
+public class ConfigureMvcJsonOptions : IConfigureOptions<MvcOptions>
+{
+    private readonly string _jsonOptionsName;
+    private readonly IOptionsMonitor<JsonOptions> _jsonOptions;
+    private readonly ILoggerFactory _loggerFactory;
+
+    public ConfigureMvcJsonOptions(
+        string jsonOptionsName,
+        IOptionsMonitor<JsonOptions> jsonOptions,
+        ILoggerFactory loggerFactory)
+    {
+        _jsonOptionsName = jsonOptionsName;
+        _jsonOptions = jsonOptions;
+        _loggerFactory = loggerFactory;
+    }
+
+    public void Configure(MvcOptions options)
+    {
+        JsonOptions jsonOptions = _jsonOptions.Get(_jsonOptionsName);
+        ILogger<NamedSystemTextJsonInputFormatter> logger = _loggerFactory.CreateLogger<NamedSystemTextJsonInputFormatter>();
+        options.InputFormatters.Insert(0, new NamedSystemTextJsonInputFormatter(_jsonOptionsName, jsonOptions, logger));
+        options.OutputFormatters.Insert(0, new NamedSystemTextJsonOutputFormatter(_jsonOptionsName, jsonOptions.JsonSerializerOptions));
+    }
+}

src/Umbraco.Cms.Api.Common/Configuration/ConfigureUmbracoSwaggerGenOptions.cs

@@ -0,0 +1,65 @@
+using Asp.Versioning;
+using Microsoft.AspNetCore.Mvc.ApiExplorer;
+using Microsoft.AspNetCore.Mvc.Controllers;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Options;
+using Microsoft.OpenApi.Models;
+using Swashbuckle.AspNetCore.SwaggerGen;
+using Umbraco.Cms.Api.Common.OpenApi;
+using Umbraco.Extensions;
+
+namespace Umbraco.Cms.Api.Common.Configuration;
+
+public class ConfigureUmbracoSwaggerGenOptions : IConfigureOptions<SwaggerGenOptions>
+{
+    private readonly IOptions<ApiVersioningOptions> _apiVersioningOptions;
+    private readonly IOperationIdSelector _operationIdSelector;
+    private readonly ISchemaIdSelector _schemaIdSelector;
+
+    public ConfigureUmbracoSwaggerGenOptions(
+        IOptions<ApiVersioningOptions> apiVersioningOptions,
+        IOperationIdSelector operationIdSelector,
+        ISchemaIdSelector schemaIdSelector)
+    {
+        _apiVersioningOptions = apiVersioningOptions;
+        _operationIdSelector = operationIdSelector;
+        _schemaIdSelector = schemaIdSelector;
+    }
+
+    public void Configure(SwaggerGenOptions swaggerGenOptions)
+    {
+        swaggerGenOptions.SwaggerDoc(
+            DefaultApiConfiguration.ApiName,
+            new OpenApiInfo
+            {
+                Title = "Default API",
+                Version = "Latest",
+                Description = "All endpoints not defined under specific APIs"
+            });
+
+        swaggerGenOptions.CustomOperationIds(description => _operationIdSelector.OperationId(description, _apiVersioningOptions.Value));
+        swaggerGenOptions.DocInclusionPredicate((name, api) =>
+        {
+            if (string.IsNullOrWhiteSpace(api.GroupName))
+            {
+                return false;
+            }
+
+            if (api.ActionDescriptor is ControllerActionDescriptor controllerActionDescriptor)
+            {
+                return controllerActionDescriptor.MethodInfo.HasMapToApiAttribute(name);
+            }
+
+            return false;
+        });
+        swaggerGenOptions.TagActionsBy(api => new[] { api.GroupName });
+        swaggerGenOptions.OrderActionsBy(ActionOrderBy);
+        swaggerGenOptions.SchemaFilter<EnumSchemaFilter>();
+        swaggerGenOptions.CustomSchemaIds(_schemaIdSelector.SchemaId);
+        swaggerGenOptions.SupportNonNullableReferenceTypes();
+    }
+
+    // see https://github.com/domaindrivendev/Swashbuckle.AspNetCore#change-operation-sort-order-eg-for-ui-sorting
+    private static string ActionOrderBy(ApiDescription apiDesc)
+        => $"{apiDesc.GroupName}_{apiDesc.ActionDescriptor.AttributeRouteInfo?.Template ?? apiDesc.ActionDescriptor.RouteValues["controller"]}_{apiDesc.ActionDescriptor.RouteValues["action"]}_{apiDesc.HttpMethod}";
+}

src/Umbraco.Cms.Api.Common/Configuration/DefaultApiConfiguration.cs

@@ -0,0 +1,6 @@
+namespace Umbraco.Cms.Api.Common.Configuration;
+
+internal static class DefaultApiConfiguration
+{
+    public const string ApiName = "default";
+}

src/Umbraco.Cms.Api.Common/DependencyInjection/MvcBuilderExtensions.cs

@@ -0,0 +1,22 @@
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Options;
+using Umbraco.Cms.Api.Common.Configuration;
+
+namespace Umbraco.Cms.Api.Common.DependencyInjection;
+
+public static class MvcBuilderExtensions
+{
+    public static IMvcBuilder AddJsonOptions(this IMvcBuilder builder, string settingsName, Action<JsonOptions> configure)
+    {
+        builder.Services.Configure(settingsName, configure);
+        builder.Services.AddSingleton<IConfigureOptions<MvcOptions>>(provider =>
+        {
+            IOptionsMonitor<JsonOptions> options = provider.GetRequiredService<IOptionsMonitor<JsonOptions>>();
+            ILoggerFactory loggerFactory = provider.GetRequiredService<ILoggerFactory>();
+            return new ConfigureMvcJsonOptions(settingsName, options, loggerFactory);
+        });
+        return builder;
+    }
+}

src/Umbraco.Cms.Api.Common/DependencyInjection/UmbracoBuilderApiExtensions.cs

@@ -0,0 +1,23 @@
+using Microsoft.Extensions.DependencyInjection;
+using Umbraco.Cms.Api.Common.Configuration;
+using Umbraco.Cms.Api.Common.OpenApi;
+using Umbraco.Cms.Api.Common.Serialization;
+using Umbraco.Cms.Core.DependencyInjection;
+using Umbraco.Cms.Web.Common.ApplicationBuilder;
+
+namespace Umbraco.Cms.Api.Common.DependencyInjection;
+
+public static class UmbracoBuilderApiExtensions
+{
+    public static IUmbracoBuilder AddUmbracoApiOpenApiUI(this IUmbracoBuilder builder)
+    {
+        builder.Services.AddSwaggerGen();
+        builder.Services.ConfigureOptions<ConfigureUmbracoSwaggerGenOptions>();
+        builder.Services.AddSingleton<IUmbracoJsonTypeInfoResolver, UmbracoJsonTypeInfoResolver>();
+        builder.Services.AddSingleton<IOperationIdSelector, OperationIdSelector>();
+        builder.Services.AddSingleton<ISchemaIdSelector, SchemaIdSelector>();
+        builder.Services.Configure<UmbracoPipelineOptions>(options => options.AddFilter(new SwaggerRouteTemplatePipelineFilter("UmbracoApiCommon")));
+
+        return builder;
+    }
+}

src/Umbraco.Cms.Api.Common/DependencyInjection/UmbracoBuilderAuthExtensions.cs

@@ -0,0 +1,109 @@
+using System.Security.Cryptography;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.IdentityModel.Tokens;
+using Umbraco.Cms.Api.Common.Security;
+using Umbraco.Cms.Core;
+using Umbraco.Cms.Core.DependencyInjection;
+using Umbraco.Cms.Infrastructure.HostedServices;
+
+namespace Umbraco.Cms.Api.Common.DependencyInjection;
+
+public static class UmbracoBuilderAuthExtensions
+{
+    private static bool _initialized;
+
+    public static IUmbracoBuilder AddUmbracoOpenIddict(this IUmbracoBuilder builder)
+    {
+        if (_initialized is false)
+        {
+            ConfigureOpenIddict(builder);
+            _initialized = true;
+        }
+
+        return builder;
+    }
+
+    private static void ConfigureOpenIddict(IUmbracoBuilder builder)
+    {
+        builder.Services.AddOpenIddict()
+            // Register the OpenIddict server components.
+            .AddServer(options =>
+            {
+                // Enable the authorization and token endpoints.
+                // - important: member endpoints MUST be added before backoffice endpoints to ensure that auto-discovery works for members
+                // FIXME: swap paths here so member API is first (see comment above)
+                options
+                    .SetAuthorizationEndpointUris(
+                        Paths.MemberApi.AuthorizationEndpoint.TrimStart(Constants.CharArrays.ForwardSlash))
+                    .SetTokenEndpointUris(
+                        Paths.MemberApi.TokenEndpoint.TrimStart(Constants.CharArrays.ForwardSlash))
+                    .SetLogoutEndpointUris(
+                        Paths.MemberApi.LogoutEndpoint.TrimStart(Constants.CharArrays.ForwardSlash))
+                    .SetRevocationEndpointUris(
+                        Paths.MemberApi.RevokeEndpoint.TrimStart(Constants.CharArrays.ForwardSlash))
+                    .SetUserinfoEndpointUris(
+                        Paths.MemberApi.UserinfoEndpoint.TrimStart(Constants.CharArrays.ForwardSlash));
+
+                // Enable authorization code flow with PKCE
+                options
+                    .AllowAuthorizationCodeFlow()
+                    .RequireProofKeyForCodeExchange()
+                    .AllowRefreshTokenFlow();
+
+                // Register the ASP.NET Core host and configure for custom authentication endpoint.
+                options
+                    .UseAspNetCore()
+                    .EnableAuthorizationEndpointPassthrough()
+                    .EnableLogoutEndpointPassthrough()
+                    .EnableUserinfoEndpointPassthrough();
+
+                // Enable reference tokens
+                // - see https://documentation.openiddict.com/configuration/token-storage.html
+                options
+                    .UseReferenceAccessTokens()
+                    .UseReferenceRefreshTokens();
+
+                // Use ASP.NET Core Data Protection for tokens instead of JWT.
+                // This is more secure, and has the added benefit of having a high throughput
+                // but means that all servers (such as in a load balanced setup)
+                // needs to use the same application name and key ring,
+                // however this is already recommended for load balancing, so should be fine.
+                // See https://documentation.openiddict.com/configuration/token-formats.html#switching-to-data-protection-tokens
+                // and https://learn.microsoft.com/en-us/aspnet/core/security/data-protection/configuration/overview?view=aspnetcore-7.0
+                // for more information
+                options.UseDataProtection();
+
+                // Register encryption and signing credentials to protect tokens.
+                // Note that for tokens generated/validated using ASP.NET Core Data Protection,
+                // a separate key ring is used, distinct from the credentials discussed in
+                // https://documentation.openiddict.com/configuration/encryption-and-signing-credentials.html
+                // More details can be found here: https://github.com/openiddict/openiddict-core/issues/1892#issuecomment-1737308506
+                // "When using ASP.NET Core Data Protection to generate opaque tokens, the signing and encryption credentials
+                // registered via Add*Key/Certificate() are not used". But since OpenIddict requires the registration of such,
+                // we can generate random keys per instance without them taking effect.
+                // - see also https://github.com/openiddict/openiddict-core/issues/1231
+                options
+                    .AddEncryptionKey(new SymmetricSecurityKey(RandomNumberGenerator.GetBytes(32))) // generate a cryptographically secure random 256-bits key
+                    .AddSigningKey(new RsaSecurityKey(RSA.Create(keySizeInBits: 2048))); // generate RSA key with recommended size of 2048-bits
+            })
+
+            // Register the OpenIddict validation components.
+            .AddValidation(options =>
+            {
+                // Import the configuration from the local OpenIddict server instance.
+                options.UseLocalServer();
+
+                // Register the ASP.NET Core host.
+                options.UseAspNetCore();
+
+                // Enable token entry validation
+                // - see https://documentation.openiddict.com/configuration/token-storage.html#enabling-token-entry-validation-at-the-api-level
+                options.EnableTokenEntryValidation();
+
+                // Use ASP.NET Core Data Protection for tokens instead of JWT. (see note in AddServer)
+                options.UseDataProtection();
+            });
+
+        builder.Services.AddHostedService<OpenIddictCleanup>();
+    }
+}

src/Umbraco.Cms.Api.Common/Extensions/MethodInfoApiCommonExtensions.cs

@@ -0,0 +1,32 @@
+using System.Reflection;
+using Asp.Versioning;
+using Umbraco.Cms.Api.Common.Attributes;
+using Umbraco.Cms.Api.Common.Configuration;
+
+namespace Umbraco.Extensions;
+
+public static class MethodInfoApiCommonExtensions
+{
+
+    public static string? GetMapToApiVersionAttributeValue(this MethodInfo methodInfo)
+    {
+        MapToApiVersionAttribute[] mapToApis = methodInfo.GetCustomAttributes(typeof(MapToApiVersionAttribute), inherit: true).Cast<MapToApiVersionAttribute>().ToArray();
+
+        return string.Join("|", mapToApis.SelectMany(x=>x.Versions));
+    }
+
+    public static string? GetMapToApiAttributeValue(this MethodInfo methodInfo)
+    {
+        MapToApiAttribute[] mapToApis = (methodInfo.DeclaringType?.GetCustomAttributes(typeof(MapToApiAttribute), inherit: true) ?? Array.Empty<object>()).Cast<MapToApiAttribute>().ToArray();
+
+        return mapToApis.SingleOrDefault()?.ApiName;
+    }
+
+    public static bool HasMapToApiAttribute(this MethodInfo methodInfo, string apiName)
+    {
+        var value = methodInfo.GetMapToApiAttributeValue();
+
+        return value == apiName
+               || (value is null && apiName == DefaultApiConfiguration.ApiName);
+    }
+}

src/Umbraco.Cms.Api.Common/Filters/JsonOptionsNameAttribute.cs

@@ -0,0 +1,9 @@
+namespace Umbraco.Cms.Api.Common.Filters;
+
+[AttributeUsage(AttributeTargets.Class)]
+public class JsonOptionsNameAttribute : Attribute
+{
+    public JsonOptionsNameAttribute(string jsonOptionsName) => JsonOptionsName = jsonOptionsName;
+
+    public string JsonOptionsName { get; }
+}

src/Umbraco.Cms.Api.Common/Json/HttpContextJsonExtensions.cs

@@ -0,0 +1,10 @@
+using Microsoft.AspNetCore.Http;
+using Umbraco.Cms.Api.Common.Filters;
+
+namespace Umbraco.Cms.Api.Common.Json;
+
+public static class HttpContextJsonExtensions
+{
+    public static string? CurrentJsonOptionsName(this HttpContext context)
+        => context.GetEndpoint()?.Metadata.GetMetadata<JsonOptionsNameAttribute>()?.JsonOptionsName;
+}

src/Umbraco.Cms.Api.Common/Json/NamedSystemTextJsonInputFormatter.cs

@@ -0,0 +1,31 @@
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc.Formatters;
+using Microsoft.Extensions.Logging;
+
+namespace Umbraco.Cms.Api.Common.Json;
+
+internal class NamedSystemTextJsonInputFormatter : SystemTextJsonInputFormatter
+{
+    private readonly string _jsonOptionsName;
+
+    public NamedSystemTextJsonInputFormatter(string jsonOptionsName, JsonOptions options, ILogger<NamedSystemTextJsonInputFormatter> logger)
+        : base(options, logger) =>
+        _jsonOptionsName = jsonOptionsName;
+
+    public override bool CanRead(InputFormatterContext context)
+        => context.HttpContext.CurrentJsonOptionsName() == _jsonOptionsName && base.CanRead(context);
+
+    public override async Task<InputFormatterResult> ReadAsync(InputFormatterContext context)
+    {
+        try
+        {
+            return await base.ReadAsync(context);
+        }
+        catch (NotSupportedException exception)
+        {
+            // This happens when trying to deserialize to an interface, without sending the $type as part of the request
+            context.ModelState.TryAddModelException(string.Empty, new InputFormatterException(exception.Message, exception));
+            return await InputFormatterResult.FailureAsync();
+        }
+    }
+}

src/Umbraco.Cms.Api.Common/Json/NamedSystemTextJsonOutputFormatter.cs

@@ -0,0 +1,18 @@
+using System.Text.Json;
+using Microsoft.AspNetCore.Mvc.Formatters;
+
+namespace Umbraco.Cms.Api.Common.Json;
+
+
+internal class NamedSystemTextJsonOutputFormatter : SystemTextJsonOutputFormatter
+{
+    private readonly string _jsonOptionsName;
+
+    public NamedSystemTextJsonOutputFormatter(string jsonOptionsName, JsonSerializerOptions jsonSerializerOptions) : base(jsonSerializerOptions)
+    {
+        _jsonOptionsName = jsonOptionsName;
+    }
+
+    public override bool CanWriteResult(OutputFormatterCanWriteContext context)
+        => context.HttpContext.CurrentJsonOptionsName() == _jsonOptionsName && base.CanWriteResult(context);
+}

src/Umbraco.Cms.Api.Common/OpenApi/EnumSchemaFilter.cs

@@ -0,0 +1,25 @@
+using System.Reflection;
+using System.Runtime.Serialization;
+using Microsoft.OpenApi.Any;
+using Microsoft.OpenApi.Models;
+using Swashbuckle.AspNetCore.SwaggerGen;
+
+namespace Umbraco.Cms.Api.Common.OpenApi;
+
+public class EnumSchemaFilter : ISchemaFilter
+{
+    public void Apply(OpenApiSchema model, SchemaFilterContext context)
+    {
+        if (context.Type.IsEnum)
+        {
+            model.Type = "string";
+            model.Format = null;
+            model.Enum.Clear();
+            foreach (var name in Enum.GetNames(context.Type))
+            {
+                var actualName = context.Type.GetField(name)?.GetCustomAttribute<EnumMemberAttribute>()?.Value ?? name;
+                model.Enum.Add(new OpenApiString(actualName));
+            }
+        }
+    }
+}

src/Umbraco.Cms.Api.Common/OpenApi/IOperationIdSelector.cs

@@ -0,0 +1,9 @@
+using Asp.Versioning;
+using Microsoft.AspNetCore.Mvc.ApiExplorer;
+
+namespace Umbraco.Cms.Api.Common.OpenApi;
+
+public interface IOperationIdSelector
+{
+    string? OperationId(ApiDescription apiDescription, ApiVersioningOptions apiVersioningOptions);
+}

src/Umbraco.Cms.Api.Common/OpenApi/ISchemaIdSelector.cs

@@ -0,0 +1,6 @@
+namespace Umbraco.Cms.Api.Common.OpenApi;
+
+public interface ISchemaIdSelector
+{
+    string SchemaId(Type type);
+}

src/Umbraco.Cms.Api.Common/OpenApi/MimeTypeDocumentFilter.cs

@@ -0,0 +1,48 @@
+using Microsoft.OpenApi.Models;
+using Swashbuckle.AspNetCore.SwaggerGen;
+using Umbraco.Extensions;
+
+namespace Umbraco.Cms.Api.Common.OpenApi;
+
+/// <summary>
+/// This filter explicitly removes all other mime types than application/json from a named OpenAPI document when application/json is accepted.
+/// </summary>
+public class MimeTypeDocumentFilter : IDocumentFilter
+{
+    private readonly string _documentName;
+
+    public MimeTypeDocumentFilter(string documentName) => _documentName = documentName;
+
+    public void Apply(OpenApiDocument swaggerDoc, DocumentFilterContext context)
+    {
+        if (context.DocumentName != _documentName)
+        {
+            return;
+        }
+
+        OpenApiOperation[] operations = swaggerDoc.Paths
+            .SelectMany(path => path.Value.Operations.Values)
+            .ToArray();
+
+        void RemoveUnwantedMimeTypes(IDictionary<string, OpenApiMediaType> content)
+        {
+            if (content.ContainsKey("application/json"))
+            {
+                content.RemoveAll(r => r.Key != "application/json");
+            }
+
+        }
+
+        OpenApiRequestBody[] requestBodies = operations.Select(operation => operation.RequestBody).WhereNotNull().ToArray();
+        foreach (OpenApiRequestBody requestBody in requestBodies)
+        {
+            RemoveUnwantedMimeTypes(requestBody.Content);
+        }
+
+        OpenApiResponse[] responses = operations.SelectMany(operation => operation.Responses.Values).WhereNotNull().ToArray();
+        foreach (OpenApiResponse response in responses)
+        {
+            RemoveUnwantedMimeTypes(response.Content);
+        }
+    }
+}

src/Umbraco.Cms.Api.Common/OpenApi/OperationIdRegexes.cs

@@ -0,0 +1,21 @@
+using System.Text.RegularExpressions;
+
+namespace Umbraco.Cms.Api.Common.OpenApi;
+
+/// <summary>
+/// This is the regexes used to generate the operation IDs, the benefit of this being partial with GeneratedRegex
+/// source generators is that it will be pre-compiled at startup
+/// See: https://devblogs.microsoft.com/dotnet/regular-expression-improvements-in-dotnet-7/#source-generation for more info.
+/// </summary>
+internal static partial class OperationIdRegexes
+{
+    // Your IDE may be showing errors here, this is because it's a new dotnet 7 feature (it's fixed in the EAP of Rider)
+    [GeneratedRegex(".*?\\/v[1-9]+/")]
+    public static partial Regex VersionPrefixRegex();
+
+    [GeneratedRegex("\\{(.*?)\\:?\\}")]
+    public static partial Regex TemplatePlaceholdersRegex();
+
+    [GeneratedRegex("[\\/\\-](\\w{1})")]
+    public static partial Regex ToCamelCaseRegex();
+}

src/Umbraco.Cms.Api.Common/OpenApi/OperationIdSelector.cs

@@ -0,0 +1,79 @@
+using Asp.Versioning;
+using Microsoft.AspNetCore.Mvc.ApiExplorer;
+using Microsoft.AspNetCore.Mvc.Controllers;
+using Umbraco.Extensions;
+
+namespace Umbraco.Cms.Api.Common.OpenApi;
+
+public class OperationIdSelector : IOperationIdSelector
+{
+    public virtual string? OperationId(ApiDescription apiDescription, ApiVersioningOptions apiVersioningOptions)
+    {
+        if (apiDescription.ActionDescriptor is not ControllerActionDescriptor controllerActionDescriptor
+            || controllerActionDescriptor.ControllerTypeInfo.Namespace?.StartsWith("Umbraco.Cms.Api") is not true)
+        {
+            return null;
+        }
+
+        return UmbracoOperationId(apiDescription, apiVersioningOptions);
+    }
+
+    protected string? UmbracoOperationId(ApiDescription apiDescription, ApiVersioningOptions apiVersioningOptions)
+    {
+        if (apiDescription.ActionDescriptor is not ControllerActionDescriptor controllerActionDescriptor)
+        {
+            return null;
+        }
+
+        ApiVersion defaultVersion = apiVersioningOptions.DefaultApiVersion;
+        var httpMethod = apiDescription.HttpMethod?.ToLower().ToFirstUpper() ?? "Get";
+
+        // if the route info "Name" is supplied we'll use this explicitly as the operation ID
+        // - usage example: [HttpGet("my-api/route}", Name = "MyCustomRoute")]
+        if (string.IsNullOrWhiteSpace(apiDescription.ActionDescriptor.AttributeRouteInfo?.Name) == false)
+        {
+            var explicitOperationId = apiDescription.ActionDescriptor.AttributeRouteInfo!.Name;
+            return explicitOperationId.InvariantStartsWith(httpMethod)
+                ? explicitOperationId
+                : $"{httpMethod}{explicitOperationId}";
+        }
+
+        var relativePath = apiDescription.RelativePath;
+
+        if (string.IsNullOrWhiteSpace(relativePath))
+        {
+            throw new Exception(
+                $"There is no relative path for controller action {apiDescription.ActionDescriptor.RouteValues["controller"]}");
+        }
+
+        // Remove the prefixed base path with version, e.g. /umbraco/management/api/v1/tracked-reference/{id} => tracked-reference/{id}
+        var unprefixedRelativePath = OperationIdRegexes
+            .VersionPrefixRegex()
+            .Replace(relativePath, string.Empty);
+
+        // Remove template placeholders, e.g. tracked-reference/{id} => tracked-reference/Id
+        var formattedOperationId = OperationIdRegexes
+            .TemplatePlaceholdersRegex()
+            .Replace(unprefixedRelativePath, m => $"By{m.Groups[1].Value.ToFirstUpper()}");
+
+        // Remove dashes (-) and slashes (/) and convert the following letter to uppercase with
+        // the word "By" in front, e.g. tracked-reference/Id => TrackedReferenceById
+        formattedOperationId = OperationIdRegexes
+            .ToCamelCaseRegex()
+            .Replace(formattedOperationId, m => m.Groups[1].Value.ToUpper());
+
+        //Get map to version attribute
+        string? version = null;
+
+        var versionAttributeValue = controllerActionDescriptor.MethodInfo.GetMapToApiVersionAttributeValue();
+
+        // We only wanna add a version, if it is not the default one.
+        if (string.Equals(versionAttributeValue, defaultVersion.ToString()) == false)
+        {
+            version = versionAttributeValue;
+        }
+
+        // Return the operation ID with the formatted http method verb in front, e.g. GetTrackedReferenceById
+        return $"{httpMethod}{formattedOperationId.ToFirstUpper()}{version}";
+    }
+}

src/Umbraco.Cms.Api.Common/OpenApi/SchemaIdSelector.cs

@@ -0,0 +1,36 @@
+using System.Text.RegularExpressions;
+using Umbraco.Extensions;
+
+namespace Umbraco.Cms.Api.Common.OpenApi;
+
+public class SchemaIdSelector : ISchemaIdSelector
+{
+    public virtual string SchemaId(Type type)
+        => type.Namespace?.StartsWith("Umbraco.Cms") is true ? UmbracoSchemaId(type) : type.Name;
+
+    protected string UmbracoSchemaId(Type type)
+    {
+        string SanitizedTypeName(Type t) => t.Name
+            // first grab the "non generic" part of any generic type name (i.e. "PagedViewModel`1" becomes "PagedViewModel")
+            .Split('`').First()
+            // then remove the "ViewModel" postfix from type names
+            .TrimEnd("ViewModel");
+
+        var name = SanitizedTypeName(type);
+        if (type.IsGenericType)
+        {
+            // append the generic type names, ultimately turning i.e. "PagedViewModel<RelationItemViewModel>" into "PagedRelationItem"
+            name = $"{name}{string.Join(string.Empty, type.GenericTypeArguments.Select(SanitizedTypeName))}";
+        }
+
+        if (name.EndsWith("Model") == false)
+        {
+            // because some models names clash with common classes in TypeScript (i.e. Document),
+            // we need to add a "Model" postfix to all models
+            name = $"{name}Model";
+        }
+
+        // make absolutely sure we don't pass any invalid named by removing all non-word chars
+        return Regex.Replace(name, @"[^\w]", string.Empty);
+    }
+}

src/Umbraco.Cms.Api.Common/OpenApi/SwaggerRouteTemplatePipelineFilter.cs

@@ -0,0 +1,75 @@
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Hosting;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Hosting;
+using Microsoft.Extensions.Options;
+using Microsoft.OpenApi.Models;
+using Swashbuckle.AspNetCore.SwaggerGen;
+using Swashbuckle.AspNetCore.SwaggerUI;
+using Umbraco.Cms.Core;
+using Umbraco.Cms.Core.Configuration.Models;
+using Umbraco.Cms.Web.Common.ApplicationBuilder;
+using Umbraco.Extensions;
+using IHostingEnvironment = Umbraco.Cms.Core.Hosting.IHostingEnvironment;
+
+namespace Umbraco.Cms.Api.Common.OpenApi;
+
+public class SwaggerRouteTemplatePipelineFilter : UmbracoPipelineFilter
+{
+    public SwaggerRouteTemplatePipelineFilter(string name)
+        : base(name)
+        => PostPipeline = PostPipelineAction;
+
+    private void PostPipelineAction(IApplicationBuilder applicationBuilder)
+    {
+        if (SwaggerIsEnabled(applicationBuilder) is false)
+        {
+            return;
+        }
+
+        IOptions<SwaggerGenOptions> swaggerGenOptions = applicationBuilder.ApplicationServices.GetRequiredService<IOptions<SwaggerGenOptions>>();
+
+        applicationBuilder.UseSwagger(swaggerOptions =>
+            {
+                swaggerOptions.RouteTemplate = SwaggerRouteTemplate(applicationBuilder);
+            });
+
+        applicationBuilder.UseSwaggerUI(swaggerUiOptions => SwaggerUiConfiguration(swaggerUiOptions, swaggerGenOptions.Value, applicationBuilder));
+    }
+
+    protected virtual bool SwaggerIsEnabled(IApplicationBuilder applicationBuilder)
+    {
+        IWebHostEnvironment webHostEnvironment = applicationBuilder.ApplicationServices.GetRequiredService<IWebHostEnvironment>();
+        return webHostEnvironment.IsProduction() is false;
+    }
+
+    protected virtual string SwaggerRouteTemplate(IApplicationBuilder applicationBuilder)
+        => $"{GetUmbracoPath(applicationBuilder).TrimStart(Constants.CharArrays.ForwardSlash)}/swagger/{{documentName}}/swagger.json";
+
+    protected virtual string SwaggerUiRoutePrefix(IApplicationBuilder applicationBuilder)
+        => $"{GetUmbracoPath(applicationBuilder).TrimStart(Constants.CharArrays.ForwardSlash)}/swagger";
+
+    protected virtual void SwaggerUiConfiguration(
+        SwaggerUIOptions swaggerUiOptions,
+        SwaggerGenOptions swaggerGenOptions,
+        IApplicationBuilder applicationBuilder)
+    {
+        swaggerUiOptions.RoutePrefix = SwaggerUiRoutePrefix(applicationBuilder);
+
+        foreach ((var name, OpenApiInfo? apiInfo) in swaggerGenOptions.SwaggerGeneratorOptions.SwaggerDocs
+                     .OrderBy(x => x.Value.Title))
+        {
+            swaggerUiOptions.SwaggerEndpoint($"{name}/swagger.json", $"{apiInfo.Title}");
+        }
+
+        swaggerUiOptions.OAuthUsePkce();
+    }
+
+    private string GetUmbracoPath(IApplicationBuilder applicationBuilder)
+    {
+        GlobalSettings settings = applicationBuilder.ApplicationServices.GetRequiredService<IOptions<GlobalSettings>>().Value;
+        IHostingEnvironment hostingEnvironment = applicationBuilder.ApplicationServices.GetRequiredService<IHostingEnvironment>();
+
+        return settings.GetBackOfficePath(hostingEnvironment);
+    }
+}

src/Umbraco.Cms.Api.Common/Security/Paths.cs

@@ -0,0 +1,22 @@
+namespace Umbraco.Cms.Api.Common.Security;
+
+public static class Paths
+{
+    public static class MemberApi
+    {
+        public const string EndpointTemplate = "security/member";
+
+        public static readonly string AuthorizationEndpoint = EndpointPath($"{EndpointTemplate}/authorize");
+
+        public static readonly string TokenEndpoint = EndpointPath($"{EndpointTemplate}/token");
+
+        public static readonly string LogoutEndpoint = EndpointPath($"{EndpointTemplate}/signout");
+
+        public static readonly string RevokeEndpoint = EndpointPath($"{EndpointTemplate}/revoke");
+
+        public static readonly string UserinfoEndpoint = EndpointPath($"{EndpointTemplate}/userinfo");
+
+        // NOTE: we're NOT using /api/v1.0/ here because it will clash with the Delivery API docs
+        private static string EndpointPath(string relativePath) => $"/umbraco/delivery/api/v1/{relativePath}";
+    }
+}

src/Umbraco.Cms.Api.Common/Serialization/IUmbracoJsonTypeInfoResolver.cs

@@ -0,0 +1,8 @@
+using System.Text.Json.Serialization.Metadata;
+
+namespace Umbraco.Cms.Api.Common.Serialization;
+
+public interface IUmbracoJsonTypeInfoResolver : IJsonTypeInfoResolver
+{
+    IEnumerable<Type> FindSubTypes(Type type);
+}

src/Umbraco.Cms.Api.Common/Serialization/UmbracoJsonTypeInfoResolver.cs

@@ -0,0 +1,86 @@
+using System.Collections.Concurrent;
+using System.Text.Json;
+using System.Text.Json.Serialization.Metadata;
+using Umbraco.Cms.Core.Composing;
+
+namespace Umbraco.Cms.Api.Common.Serialization;
+
+public sealed class UmbracoJsonTypeInfoResolver : DefaultJsonTypeInfoResolver, IUmbracoJsonTypeInfoResolver
+{
+    private readonly ITypeFinder _typeFinder;
+    private readonly ConcurrentDictionary<Type, ISet<Type>> _subTypesCache = new ConcurrentDictionary<Type, ISet<Type>>();
+
+    public UmbracoJsonTypeInfoResolver(ITypeFinder typeFinder)
+    {
+        _typeFinder = typeFinder;
+    }
+
+    public IEnumerable<Type> FindSubTypes(Type type)
+    {
+        if (_subTypesCache.TryGetValue(type, out ISet<Type>? cachedResult))
+        {
+            return cachedResult;
+        }
+
+        var result = _typeFinder.FindClassesOfType(type).ToHashSet();
+        _subTypesCache.TryAdd(type, result);
+        return result;
+    }
+
+    public override JsonTypeInfo GetTypeInfo(Type type, JsonSerializerOptions options)
+    {
+        JsonTypeInfo result = base.GetTypeInfo(type, options);
+
+        if (type.IsInterface)
+        {
+            return GetTypeInfoForInterface(result, type, options);
+        }
+        else
+        {
+            return GetTypeInfoForClass(result, type, options);
+        }
+
+    }
+
+    private JsonTypeInfo GetTypeInfoForClass(JsonTypeInfo result, Type type, JsonSerializerOptions options)
+    {
+        if (result.Kind != JsonTypeInfoKind.Object || !type.GetInterfaces().Any())
+        {
+            return result;
+        }
+
+        JsonPolymorphismOptions jsonPolymorphismOptions = result.PolymorphismOptions ?? new JsonPolymorphismOptions();
+
+        jsonPolymorphismOptions.DerivedTypes.Add(new JsonDerivedType(type, type.Name));
+
+        result.PolymorphismOptions = jsonPolymorphismOptions;
+
+        return result;
+    }
+
+    private JsonTypeInfo GetTypeInfoForInterface(JsonTypeInfo result, Type type, JsonSerializerOptions options)
+    {
+        IEnumerable<Type> subTypes = FindSubTypes(type);
+
+        if (!subTypes.Any())
+        {
+            return result;
+        }
+
+        JsonPolymorphismOptions jsonPolymorphismOptions = result.PolymorphismOptions ?? new JsonPolymorphismOptions();
+
+        IEnumerable<Type> knownSubTypes = jsonPolymorphismOptions.DerivedTypes.Select(x => x.DerivedType);
+        IEnumerable<Type> subTypesToAdd = subTypes.Except(knownSubTypes);
+        foreach (Type subType in subTypesToAdd)
+        {
+            jsonPolymorphismOptions.DerivedTypes.Add(new JsonDerivedType(
+                subType,
+                subType.Name ?? string.Empty));
+        }
+
+        result.PolymorphismOptions = jsonPolymorphismOptions;
+
+
+        return result;
+    }
+}

src/Umbraco.Cms.Api.Common/Umbraco.Cms.Api.Common.csproj

@@ -0,0 +1,27 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <Title>Umbraco CMS - API Common</Title>
+    <Description>Contains the bits and pieces that are shared between the Umbraco CMS APIs.</Description>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <FrameworkReference Include="Microsoft.AspNetCore.App" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <PackageReference Include="Swashbuckle.AspNetCore" />
+    <PackageReference Include="OpenIddict.Abstractions" />
+    <PackageReference Include="OpenIddict.AspNetCore" />
+
+    <!-- Both OpenIddict.AspNetCore, Npoco.SqlServer and Microsoft.EntityFrameworkCore.SqlServer bring in a vulnerable version of Microsoft.IdentityModel.JsonWebTokens -->
+    <PackageReference Include="Microsoft.IdentityModel.JsonWebTokens"/>
+
+    <!-- Take top-level depedendency on OpenIddict.AspNetCore depends on a vulnerable version -->
+    <PackageReference Include="Microsoft.Extensions.Caching.Memory" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="..\Umbraco.Core\Umbraco.Core.csproj" />
+    <ProjectReference Include="..\Umbraco.Web.Common\Umbraco.Web.Common.csproj" />
+  </ItemGroup>
+</Project>

src/Umbraco.Cms.Api.Common/ViewModels/Pagination/PagedViewModel.cs

@@ -0,0 +1,14 @@
+using System.ComponentModel.DataAnnotations;
+
+namespace Umbraco.Cms.Api.Common.ViewModels.Pagination;
+
+public class PagedViewModel<T>
+{
+    [Required]
+    public long Total { get; set; }
+
+    [Required]
+    public IEnumerable<T> Items { get; set; } = Enumerable.Empty<T>();
+
+    public static PagedViewModel<T> Empty() => new();
+}

src/Umbraco.Cms.Api.Delivery/Accessors/RequestContextOutputExpansionStrategyAccessor.cs

@@ -0,0 +1,12 @@
+using Microsoft.AspNetCore.Http;
+using Umbraco.Cms.Core.DeliveryApi;
+
+namespace Umbraco.Cms.Api.Delivery.Accessors;
+
+internal sealed class RequestContextOutputExpansionStrategyAccessor : RequestContextServiceAccessorBase<IOutputExpansionStrategy>, IOutputExpansionStrategyAccessor
+{
+    public RequestContextOutputExpansionStrategyAccessor(IHttpContextAccessor httpContextAccessor)
+        : base(httpContextAccessor)
+    {
+    }
+}

src/Umbraco.Cms.Api.Delivery/Accessors/RequestContextRequestStartItemProviderAccessor.cs

@@ -0,0 +1,12 @@
+using Microsoft.AspNetCore.Http;
+using Umbraco.Cms.Core.DeliveryApi;
+
+namespace Umbraco.Cms.Api.Delivery.Accessors;
+
+internal sealed class RequestContextRequestStartItemProviderAccessor : RequestContextServiceAccessorBase<IRequestStartItemProvider>, IRequestStartItemProviderAccessor
+{
+    public RequestContextRequestStartItemProviderAccessor(IHttpContextAccessor httpContextAccessor)
+        : base(httpContextAccessor)
+    {
+    }
+}

src/Umbraco.Cms.Api.Delivery/Accessors/RequestContextServiceAccessorBase.cs

@@ -0,0 +1,20 @@
+using System.Diagnostics.CodeAnalysis;
+using Microsoft.AspNetCore.Http;
+using Microsoft.Extensions.DependencyInjection;
+
+namespace Umbraco.Cms.Api.Delivery.Accessors;
+
+public abstract class RequestContextServiceAccessorBase<T>
+    where T : class
+{
+    private readonly IHttpContextAccessor _httpContextAccessor;
+
+    protected RequestContextServiceAccessorBase(IHttpContextAccessor httpContextAccessor)
+        => _httpContextAccessor = httpContextAccessor;
+
+    public bool TryGetValue([NotNullWhen(true)] out T? requestStartNodeService)
+    {
+        requestStartNodeService = _httpContextAccessor.HttpContext?.RequestServices.GetService<T>();
+        return requestStartNodeService is not null;
+    }
+}

src/Umbraco.Cms.Api.Delivery/Caching/DeliveryApiOutputCachePolicy.cs

@@ -0,0 +1,43 @@
+using Microsoft.AspNetCore.OutputCaching;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Primitives;
+using Umbraco.Cms.Core.DeliveryApi;
+
+namespace Umbraco.Cms.Api.Delivery.Caching;
+
+internal sealed class DeliveryApiOutputCachePolicy : IOutputCachePolicy
+{
+    private readonly TimeSpan _duration;
+    private readonly StringValues _varyByHeaderNames;
+
+    public DeliveryApiOutputCachePolicy(TimeSpan duration, StringValues varyByHeaderNames)
+    {
+        _duration = duration;
+        _varyByHeaderNames = varyByHeaderNames;
+    }
+
+    ValueTask IOutputCachePolicy.CacheRequestAsync(OutputCacheContext context, CancellationToken cancellationToken)
+    {
+        IRequestPreviewService requestPreviewService = context
+            .HttpContext
+            .RequestServices
+            .GetRequiredService<IRequestPreviewService>();
+
+        IApiAccessService apiAccessService = context
+            .HttpContext
+            .RequestServices
+            .GetRequiredService<IApiAccessService>();
+
+        context.EnableOutputCaching = requestPreviewService.IsPreview() is false && apiAccessService.HasPublicAccess();
+        context.ResponseExpirationTimeSpan = _duration;
+        context.CacheVaryByRules.HeaderNames = _varyByHeaderNames;
+
+        return ValueTask.CompletedTask;
+    }
+
+    ValueTask IOutputCachePolicy.ServeFromCacheAsync(OutputCacheContext context, CancellationToken cancellationToken)
+        => ValueTask.CompletedTask;
+
+    ValueTask IOutputCachePolicy.ServeResponseAsync(OutputCacheContext context, CancellationToken cancellationToken)
+        => ValueTask.CompletedTask;
+}

src/Umbraco.Cms.Api.Delivery/Caching/OutputCachePipelineFilter.cs

@@ -0,0 +1,14 @@
+using Microsoft.AspNetCore.Builder;
+using Umbraco.Cms.Web.Common.ApplicationBuilder;
+
+namespace Umbraco.Cms.Api.Delivery.Caching;
+
+internal sealed class OutputCachePipelineFilter : UmbracoPipelineFilter
+{
+    public OutputCachePipelineFilter(string name)
+        : base(name)
+        => PostPipeline = PostPipelineAction;
+
+    private void PostPipelineAction(IApplicationBuilder applicationBuilder)
+        => applicationBuilder.UseOutputCache();
+}

src/Umbraco.Cms.Api.Delivery/Configuration/ConfigureUmbracoDeliveryApiSwaggerGenOptions.cs

@@ -0,0 +1,30 @@
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Options;
+using Microsoft.OpenApi.Models;
+using Swashbuckle.AspNetCore.SwaggerGen;
+using Umbraco.Cms.Api.Common.OpenApi;
+using Umbraco.Cms.Api.Delivery.Filters;
+
+namespace Umbraco.Cms.Api.Delivery.Configuration;
+
+public class ConfigureUmbracoDeliveryApiSwaggerGenOptions: IConfigureOptions<SwaggerGenOptions>
+{
+    public void Configure(SwaggerGenOptions swaggerGenOptions)
+    {
+        swaggerGenOptions.SwaggerDoc(
+            DeliveryApiConfiguration.ApiName,
+            new OpenApiInfo
+            {
+                Title = DeliveryApiConfiguration.ApiTitle,
+                Version = "Latest",
+                Description = $"You can find out more about the {DeliveryApiConfiguration.ApiTitle} in [the documentation]({DeliveryApiConfiguration.ApiDocumentationContentArticleLink})."
+            });
+
+        swaggerGenOptions.DocumentFilter<MimeTypeDocumentFilter>(DeliveryApiConfiguration.ApiName);
+
+        swaggerGenOptions.OperationFilter<SwaggerContentDocumentationFilter>();
+        swaggerGenOptions.OperationFilter<SwaggerMediaDocumentationFilter>();
+        swaggerGenOptions.ParameterFilter<SwaggerContentDocumentationFilter>();
+        swaggerGenOptions.ParameterFilter<SwaggerMediaDocumentationFilter>();
+    }
+}

src/Umbraco.Cms.Api.Delivery/Configuration/ConfigureUmbracoMemberAuthenticationDeliveryApiSwaggerGenOptions.cs

@@ -0,0 +1,74 @@
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Options;
+using Microsoft.OpenApi.Models;
+using Swashbuckle.AspNetCore.SwaggerGen;
+using Umbraco.Cms.Api.Common.Security;
+using Umbraco.Cms.Api.Delivery.Controllers.Content;
+using Umbraco.Cms.Api.Delivery.Filters;
+
+namespace Umbraco.Cms.Api.Delivery.Configuration;
+
+/// <summary>
+/// This configures member authentication for the Delivery API in Swagger. Consult the docs for
+/// member authentication within the Delivery API for instructions on how to use this.
+/// </summary>
+/// <remarks>
+/// This class is not used by the core CMS due to the required installation dependencies (local login page among other things).
+/// </remarks>
+public class ConfigureUmbracoMemberAuthenticationDeliveryApiSwaggerGenOptions : IConfigureOptions<SwaggerGenOptions>
+{
+    private const string AuthSchemeName = "Umbraco Member";
+
+    public void Configure(SwaggerGenOptions options)
+    {
+        options.AddSecurityDefinition(
+            AuthSchemeName,
+            new OpenApiSecurityScheme
+            {
+                In = ParameterLocation.Header,
+                Name = AuthSchemeName,
+                Type = SecuritySchemeType.OAuth2,
+                Description = "Umbraco Member Authentication",
+                Flows = new OpenApiOAuthFlows
+                {
+                    AuthorizationCode = new OpenApiOAuthFlow
+                    {
+                        AuthorizationUrl = new Uri(Paths.MemberApi.AuthorizationEndpoint, UriKind.Relative),
+                        TokenUrl = new Uri(Paths.MemberApi.TokenEndpoint, UriKind.Relative)
+                    }
+                }
+            });
+
+        // add security requirements for content API operations
+        options.OperationFilter<DeliveryApiSecurityFilter>();
+    }
+
+    private class DeliveryApiSecurityFilter : SwaggerFilterBase<ContentApiControllerBase>, IOperationFilter
+    {
+        public void Apply(OpenApiOperation operation, OperationFilterContext context)
+        {
+            if (CanApply(context) is false)
+            {
+                return;
+            }
+
+            operation.Security = new List<OpenApiSecurityRequirement>
+            {
+                new OpenApiSecurityRequirement
+                {
+                    {
+                        new OpenApiSecurityScheme
+                        {
+                            Reference = new OpenApiReference
+                            {
+                                Type = ReferenceType.SecurityScheme,
+                                Id = AuthSchemeName,
+                            }
+                        },
+                        new string[] { }
+                    }
+                }
+            };
+        }
+    }
+}

src/Umbraco.Cms.Api.Delivery/Configuration/DeliveryApiConfiguration.cs

@@ -0,0 +1,12 @@
+namespace Umbraco.Cms.Api.Delivery.Configuration;
+
+internal static class DeliveryApiConfiguration
+{
+    internal const string ApiTitle = "Umbraco Delivery API";
+
+    internal const string ApiName = "delivery";
+
+    internal const string ApiDocumentationContentArticleLink = "https://docs.umbraco.com/umbraco-cms/reference/content-delivery-api";
+
+    internal const string ApiDocumentationMediaArticleLink = "https://docs.umbraco.com/umbraco-cms/reference/content-delivery-api/media-delivery-api";
+}

src/Umbraco.Cms.Api.Delivery/Controllers/Content/ByIdContentApiController.cs

@@ -0,0 +1,99 @@
+using Asp.Versioning;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
+using Umbraco.Cms.Core.DeliveryApi;
+using Umbraco.Cms.Core.DependencyInjection;
+using Umbraco.Cms.Core.Models.DeliveryApi;
+using Umbraco.Cms.Core.Models.PublishedContent;
+using Umbraco.Cms.Core.Services;
+
+namespace Umbraco.Cms.Api.Delivery.Controllers.Content;
+
+[ApiVersion("1.0")]
+[ApiVersion("2.0")]
+public class ByIdContentApiController : ContentApiItemControllerBase
+{
+    private readonly IRequestMemberAccessService _requestMemberAccessService;
+
+    [Obsolete($"Please use the constructor that does not accept {nameof(IPublicAccessService)}. Will be removed in V14.")]
+    public ByIdContentApiController(
+        IApiPublishedContentCache apiPublishedContentCache,
+        IApiContentResponseBuilder apiContentResponseBuilder,
+        IPublicAccessService publicAccessService)
+        : this(
+            apiPublishedContentCache,
+            apiContentResponseBuilder,
+            StaticServiceProvider.Instance.GetRequiredService<IRequestMemberAccessService>())
+    {
+    }
+
+    [Obsolete($"Please use the constructor that does not accept {nameof(IPublicAccessService)}. Will be removed in V14.")]
+    public ByIdContentApiController(
+        IApiPublishedContentCache apiPublishedContentCache,
+        IApiContentResponseBuilder apiContentResponseBuilder,
+        IPublicAccessService publicAccessService,
+        IRequestMemberAccessService requestMemberAccessService)
+        : this(
+            apiPublishedContentCache,
+            apiContentResponseBuilder,
+            requestMemberAccessService)
+    {
+    }
+
+    [ActivatorUtilitiesConstructor]
+    public ByIdContentApiController(
+        IApiPublishedContentCache apiPublishedContentCache,
+        IApiContentResponseBuilder apiContentResponseBuilder,
+        IRequestMemberAccessService requestMemberAccessService)
+        : base(apiPublishedContentCache, apiContentResponseBuilder)
+        => _requestMemberAccessService = requestMemberAccessService;
+
+    [HttpGet("item/{id:guid}")]
+    [MapToApiVersion("1.0")]
+    [ProducesResponseType(typeof(IApiContentResponse), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status401Unauthorized)]
+    [ProducesResponseType(StatusCodes.Status403Forbidden)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [Obsolete("Please use version 2 of this API. Will be removed in V15.")]
+    public async Task<IActionResult> ById(Guid id)
+        => await HandleRequest(id);
+
+    /// <summary>
+    ///     Gets a content item by id.
+    /// </summary>
+    /// <param name="id">The unique identifier of the content item.</param>
+    /// <returns>The content item or not found result.</returns>
+    [HttpGet("item/{id:guid}")]
+    [MapToApiVersion("2.0")]
+    [ProducesResponseType(typeof(IApiContentResponse), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status401Unauthorized)]
+    [ProducesResponseType(StatusCodes.Status403Forbidden)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<IActionResult> ByIdV20(Guid id)
+        => await HandleRequest(id);
+
+    private async Task<IActionResult> HandleRequest(Guid id)
+    {
+        IPublishedContent? contentItem = ApiPublishedContentCache.GetById(id);
+
+        if (contentItem is null)
+        {
+            return NotFound();
+        }
+
+        IActionResult? deniedAccessResult = await HandleMemberAccessAsync(contentItem, _requestMemberAccessService);
+        if (deniedAccessResult is not null)
+        {
+            return deniedAccessResult;
+        }
+
+        IApiContentResponse? apiContentResponse = ApiContentResponseBuilder.Build(contentItem);
+        if (apiContentResponse is null)
+        {
+            return NotFound();
+        }
+
+        return Ok(apiContentResponse);
+    }
+}

src/Umbraco.Cms.Api.Delivery/Controllers/Content/ByIdsContentApiController.cs

@@ -0,0 +1,92 @@
+using Asp.Versioning;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
+using Umbraco.Cms.Core.DeliveryApi;
+using Umbraco.Cms.Core.DependencyInjection;
+using Umbraco.Cms.Core.Models.DeliveryApi;
+using Umbraco.Cms.Core.Models.PublishedContent;
+using Umbraco.Cms.Core.Services;
+using Umbraco.Extensions;
+
+namespace Umbraco.Cms.Api.Delivery.Controllers.Content;
+
+[ApiVersion("1.0")]
+[ApiVersion("2.0")]
+public class ByIdsContentApiController : ContentApiItemControllerBase
+{
+    private readonly IRequestMemberAccessService _requestMemberAccessService;
+
+    [Obsolete($"Please use the constructor that does not accept {nameof(IPublicAccessService)}. Will be removed in V14.")]
+    public ByIdsContentApiController(
+        IApiPublishedContentCache apiPublishedContentCache,
+        IApiContentResponseBuilder apiContentResponseBuilder,
+        IPublicAccessService publicAccessService)
+        : this(
+            apiPublishedContentCache,
+            apiContentResponseBuilder,
+            StaticServiceProvider.Instance.GetRequiredService<IRequestMemberAccessService>())
+    {
+    }
+
+    [Obsolete($"Please use the constructor that does not accept {nameof(IPublicAccessService)}. Will be removed in V14.")]
+    public ByIdsContentApiController(
+        IApiPublishedContentCache apiPublishedContentCache,
+        IApiContentResponseBuilder apiContentResponseBuilder,
+        IPublicAccessService publicAccessService,
+        IRequestMemberAccessService requestMemberAccessService)
+        : this(
+            apiPublishedContentCache,
+            apiContentResponseBuilder,
+            requestMemberAccessService)
+    {
+    }
+
+    [ActivatorUtilitiesConstructor]
+    public ByIdsContentApiController(
+        IApiPublishedContentCache apiPublishedContentCache,
+        IApiContentResponseBuilder apiContentResponseBuilder,
+        IRequestMemberAccessService requestMemberAccessService)
+        : base(apiPublishedContentCache, apiContentResponseBuilder)
+        => _requestMemberAccessService = requestMemberAccessService;
+
+    [HttpGet("item")]
+    [MapToApiVersion("1.0")]
+    [ProducesResponseType(typeof(IEnumerable<IApiContentResponse>), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status401Unauthorized)]
+    [ProducesResponseType(StatusCodes.Status403Forbidden)]
+    [Obsolete("Please use version 2 of this API. Will be removed in V15.")]
+    public async Task<IActionResult> Item([FromQuery(Name = "id")] HashSet<Guid> ids)
+        => await HandleRequest(ids);
+
+    /// <summary>
+    ///     Gets content items by ids.
+    /// </summary>
+    /// <param name="ids">The unique identifiers of the content items to retrieve.</param>
+    /// <returns>The content items.</returns>
+    [HttpGet("items")]
+    [MapToApiVersion("2.0")]
+    [ProducesResponseType(typeof(IEnumerable<IApiContentResponse>), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status401Unauthorized)]
+    [ProducesResponseType(StatusCodes.Status403Forbidden)]
+    public async Task<IActionResult> ItemsV20([FromQuery(Name = "id")] HashSet<Guid> ids)
+        => await HandleRequest(ids);
+
+    private async Task<IActionResult> HandleRequest(HashSet<Guid> ids)
+    {
+        IPublishedContent[] contentItems = ApiPublishedContentCache.GetByIds(ids).ToArray();
+
+        IActionResult? deniedAccessResult = await HandleMemberAccessAsync(contentItems, _requestMemberAccessService);
+        if (deniedAccessResult is not null)
+        {
+            return deniedAccessResult;
+        }
+
+        IApiContentResponse[] apiContentItems = contentItems
+            .Select(ApiContentResponseBuilder.Build)
+            .WhereNotNull()
+            .ToArray();
+
+        return await Task.FromResult(Ok(apiContentItems));
+    }
+}

src/Umbraco.Cms.Api.Delivery/Controllers/Content/ByRouteContentApiController.cs

@@ -0,0 +1,201 @@
+using Asp.Versioning;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
+using Umbraco.Cms.Core;
+using Umbraco.Cms.Core.DeliveryApi;
+using Umbraco.Cms.Core.DependencyInjection;
+using Umbraco.Cms.Core.Models.DeliveryApi;
+using Umbraco.Cms.Core.Models.PublishedContent;
+using Umbraco.Cms.Core.Services;
+
+namespace Umbraco.Cms.Api.Delivery.Controllers.Content;
+
+[ApiVersion("1.0")]
+[ApiVersion("2.0")]
+public class ByRouteContentApiController : ContentApiItemControllerBase
+{
+    private readonly IApiContentPathResolver _apiContentPathResolver;
+    private readonly IRequestRedirectService _requestRedirectService;
+    private readonly IRequestPreviewService _requestPreviewService;
+    private readonly IRequestMemberAccessService _requestMemberAccessService;
+    private const string PreviewContentRequestPathPrefix = $"/{Umbraco.Cms.Core.Constants.DeliveryApi.Routing.PreviewContentPathPrefix}";
+
+    [Obsolete($"Please use the constructor that does not accept {nameof(IPublicAccessService)}. Will be removed in V14.")]
+    public ByRouteContentApiController(
+        IApiPublishedContentCache apiPublishedContentCache,
+        IApiContentResponseBuilder apiContentResponseBuilder,
+        IPublicAccessService publicAccessService,
+        IRequestRoutingService requestRoutingService,
+        IRequestRedirectService requestRedirectService,
+        IRequestPreviewService requestPreviewService)
+        : this(
+            apiPublishedContentCache,
+            apiContentResponseBuilder,
+            requestRoutingService,
+            requestRedirectService,
+            requestPreviewService,
+            StaticServiceProvider.Instance.GetRequiredService<IRequestMemberAccessService>())
+    {
+    }
+
+    [Obsolete($"Please use the constructor that does not accept {nameof(IPublicAccessService)}. Will be removed in V14.")]
+    public ByRouteContentApiController(
+        IApiPublishedContentCache apiPublishedContentCache,
+        IApiContentResponseBuilder apiContentResponseBuilder,
+        IPublicAccessService publicAccessService,
+        IRequestRoutingService requestRoutingService,
+        IRequestRedirectService requestRedirectService,
+        IRequestPreviewService requestPreviewService,
+        IRequestMemberAccessService requestMemberAccessService)
+        : this(
+            apiPublishedContentCache,
+            apiContentResponseBuilder,
+            requestRoutingService,
+            requestRedirectService,
+            requestPreviewService,
+            requestMemberAccessService)
+    {
+    }
+
+    [Obsolete($"Please use the constructor that accepts {nameof(IApiContentPathResolver)}. Will be removed in V15.")]
+    public ByRouteContentApiController(
+        IApiPublishedContentCache apiPublishedContentCache,
+        IApiContentResponseBuilder apiContentResponseBuilder,
+        IRequestRoutingService requestRoutingService,
+        IRequestRedirectService requestRedirectService,
+        IRequestPreviewService requestPreviewService,
+        IRequestMemberAccessService requestMemberAccessService)
+        : this(
+            apiPublishedContentCache,
+            apiContentResponseBuilder,
+            requestRedirectService,
+            requestPreviewService,
+            requestMemberAccessService,
+            StaticServiceProvider.Instance.GetRequiredService<IApiContentPathResolver>())
+    {
+    }
+
+    [Obsolete($"Please use the non-obsolete constructor. Will be removed in V15.")]
+    public ByRouteContentApiController(
+        IApiPublishedContentCache apiPublishedContentCache,
+        IApiContentResponseBuilder apiContentResponseBuilder,
+        IPublicAccessService publicAccessService,
+        IRequestRoutingService requestRoutingService,
+        IRequestRedirectService requestRedirectService,
+        IRequestPreviewService requestPreviewService,
+        IRequestMemberAccessService requestMemberAccessService,
+        IApiContentPathResolver apiContentPathResolver)
+        : this(
+            apiPublishedContentCache,
+            apiContentResponseBuilder,
+            requestRedirectService,
+            requestPreviewService,
+            requestMemberAccessService,
+            apiContentPathResolver)
+    {
+    }
+
+    [ActivatorUtilitiesConstructor]
+    public ByRouteContentApiController(
+        IApiPublishedContentCache apiPublishedContentCache,
+        IApiContentResponseBuilder apiContentResponseBuilder,
+        IRequestRedirectService requestRedirectService,
+        IRequestPreviewService requestPreviewService,
+        IRequestMemberAccessService requestMemberAccessService,
+        IApiContentPathResolver apiContentPathResolver)
+        : base(apiPublishedContentCache, apiContentResponseBuilder)
+    {
+        _requestRedirectService = requestRedirectService;
+        _requestPreviewService = requestPreviewService;
+        _requestMemberAccessService = requestMemberAccessService;
+        _apiContentPathResolver = apiContentPathResolver;
+    }
+
+    [HttpGet("item/{*path}")]
+    [MapToApiVersion("1.0")]
+    [ProducesResponseType(typeof(IApiContentResponse), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status401Unauthorized)]
+    [ProducesResponseType(StatusCodes.Status403Forbidden)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [Obsolete("Please use version 2 of this API. Will be removed in V15.")]
+    public async Task<IActionResult> ByRoute(string path = "")
+        => await HandleRequest(path);
+
+    /// <summary>
+    ///     Gets a content item by route.
+    /// </summary>
+    /// <param name="path">The path to the content item.</param>
+    /// <remarks>
+    ///     Optional URL segment for the root content item
+    ///     can be added through the "start-item" header.
+    /// </remarks>
+    /// <returns>The content item or not found result.</returns>
+    [HttpGet("item/{*path}")]
+    [MapToApiVersion("2.0")]
+    [ProducesResponseType(typeof(IApiContentResponse), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status401Unauthorized)]
+    [ProducesResponseType(StatusCodes.Status403Forbidden)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<IActionResult> ByRouteV20(string path = "")
+        => await HandleRequest(path);
+
+    private async Task<IActionResult> HandleRequest(string path)
+    {
+        path = DecodePath(path);
+        path = path.Length == 0 ? "/" : path;
+
+        if (_apiContentPathResolver.IsResolvablePath(path) is false)
+        {
+            return NotFound();
+        }
+
+        IPublishedContent? contentItem = GetContent(path);
+        if (contentItem is not null)
+        {
+            IActionResult? deniedAccessResult = await HandleMemberAccessAsync(contentItem, _requestMemberAccessService);
+            if (deniedAccessResult is not null)
+            {
+                return deniedAccessResult;
+            }
+
+            return await Task.FromResult(Ok(ApiContentResponseBuilder.Build(contentItem)));
+        }
+
+        IApiContentRoute? redirectRoute = _requestRedirectService.GetRedirectRoute(path);
+        return redirectRoute != null
+            ? RedirectTo(redirectRoute)
+            : NotFound();
+    }
+
+    private IPublishedContent? GetContent(string path)
+        => path.StartsWith(PreviewContentRequestPathPrefix)
+            ? GetPreviewContent(path)
+            : GetPublishedContent(path);
+
+    private IPublishedContent? GetPublishedContent(string path)
+        => _apiContentPathResolver.ResolveContentPath(path);
+
+    private IPublishedContent? GetPreviewContent(string path)
+    {
+        if (_requestPreviewService.IsPreview() is false)
+        {
+            return null;
+        }
+
+        if (Guid.TryParse(path.AsSpan(PreviewContentRequestPathPrefix.Length).TrimEnd("/"), out Guid contentId) is false)
+        {
+            return null;
+        }
+
+        IPublishedContent? contentItem = ApiPublishedContentCache.GetById(contentId);
+        return contentItem;
+    }
+
+    private IActionResult RedirectTo(IApiContentRoute redirectRoute)
+    {
+        Response.Headers.Add("Location-Start-Item-Path", redirectRoute.StartItem.Path);
+        Response.Headers.Add("Location-Start-Item-Id", redirectRoute.StartItem.Id.ToString("D"));
+        return RedirectPermanent(redirectRoute.Path);
+    }
+}

src/Umbraco.Cms.Api.Delivery/Controllers/Content/ContentApiControllerBase.cs

@@ -0,0 +1,62 @@
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.OutputCaching;
+using Umbraco.Cms.Api.Common.Builders;
+using Umbraco.Cms.Api.Delivery.Filters;
+using Umbraco.Cms.Api.Delivery.Routing;
+using Umbraco.Cms.Core;
+using Umbraco.Cms.Core.DeliveryApi;
+using Umbraco.Cms.Core.Services.OperationStatus;
+
+namespace Umbraco.Cms.Api.Delivery.Controllers.Content;
+
+[DeliveryApiAccess]
+[VersionedDeliveryApiRoute("content")]
+[ApiExplorerSettings(GroupName = "Content")]
+[LocalizeFromAcceptLanguageHeader]
+[ValidateStartItem]
+[AddVaryHeader]
+[OutputCache(PolicyName = Constants.DeliveryApi.OutputCache.ContentCachePolicy)]
+public abstract class ContentApiControllerBase : DeliveryApiControllerBase
+{
+    protected IApiPublishedContentCache ApiPublishedContentCache { get; }
+
+    protected IApiContentResponseBuilder ApiContentResponseBuilder { get; }
+
+    protected ContentApiControllerBase(IApiPublishedContentCache apiPublishedContentCache, IApiContentResponseBuilder apiContentResponseBuilder)
+    {
+        ApiPublishedContentCache = apiPublishedContentCache;
+        ApiContentResponseBuilder = apiContentResponseBuilder;
+    }
+
+    protected IActionResult ApiContentQueryOperationStatusResult(ApiContentQueryOperationStatus status) =>
+        status switch
+        {
+            ApiContentQueryOperationStatus.FilterOptionNotFound => BadRequest(new ProblemDetailsBuilder()
+                .WithTitle("Filter option not found")
+                .WithDetail("One of the attempted 'filter' options does not exist")
+                .Build()),
+            ApiContentQueryOperationStatus.SelectorOptionNotFound => BadRequest(new ProblemDetailsBuilder()
+                .WithTitle("Selector option not found")
+                .WithDetail("The attempted 'fetch' option does not exist")
+                .Build()),
+            ApiContentQueryOperationStatus.SortOptionNotFound => BadRequest(new ProblemDetailsBuilder()
+                .WithTitle("Sort option not found")
+                .WithDetail("One of the attempted 'sort' options does not exist")
+                .Build()),
+            _ => BadRequest(new ProblemDetailsBuilder()
+                .WithTitle("Unknown content query status")
+                .WithDetail($"Content query status \"{status}\" was not expected here")
+                .Build()),
+        };
+
+    /// <summary>
+    ///     Creates a 403 Forbidden result.
+    /// </summary>
+    /// <remarks>
+    ///     Use this method instead of <see cref="ControllerBase.Forbid()"/> on the controller base. The latter will yield
+    ///     a redirect to an access denied URL because of the default cookie auth scheme. This method ensures that a proper
+    ///     403 Forbidden status code is returned to the client.
+    /// </remarks>
+    protected IActionResult Forbidden() => new StatusCodeResult(StatusCodes.Status403Forbidden);
+}

src/Umbraco.Cms.Api.Delivery/Controllers/Content/ContentApiItemControllerBase.cs

@@ -0,0 +1,58 @@
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
+using Umbraco.Cms.Core.DeliveryApi;
+using Umbraco.Cms.Core.DependencyInjection;
+using Umbraco.Cms.Core.Models.PublishedContent;
+using Umbraco.Cms.Core.Security;
+using Umbraco.Cms.Core.Services;
+
+namespace Umbraco.Cms.Api.Delivery.Controllers.Content;
+
+public abstract class ContentApiItemControllerBase : ContentApiControllerBase
+{
+    // TODO: Remove this in V14 when the obsolete constructors have been removed
+    private readonly IPublicAccessService _publicAccessService;
+
+    [Obsolete($"Please use the constructor that does not accept {nameof(IPublicAccessService)}. Will be removed in V14.")]
+    protected ContentApiItemControllerBase(
+        IApiPublishedContentCache apiPublishedContentCache,
+        IApiContentResponseBuilder apiContentResponseBuilder,
+        IPublicAccessService publicAccessService)
+        : this(apiPublishedContentCache, apiContentResponseBuilder)
+    {
+    }
+
+    protected ContentApiItemControllerBase(
+        IApiPublishedContentCache apiPublishedContentCache,
+        IApiContentResponseBuilder apiContentResponseBuilder)
+        : base(apiPublishedContentCache, apiContentResponseBuilder)
+        => _publicAccessService = StaticServiceProvider.Instance.GetRequiredService<IPublicAccessService>();
+
+    [Obsolete($"Please use {nameof(IPublicAccessService)} to test for content protection. Will be removed in V14.")]
+    protected bool IsProtected(IPublishedContent content) => _publicAccessService.IsProtected(content.Path);
+
+    protected async Task<IActionResult?> HandleMemberAccessAsync(IPublishedContent contentItem, IRequestMemberAccessService requestMemberAccessService)
+    {
+        PublicAccessStatus accessStatus = await requestMemberAccessService.MemberHasAccessToAsync(contentItem);
+        return accessStatus is PublicAccessStatus.AccessAccepted
+            ? null
+            : accessStatus is PublicAccessStatus.AccessDenied
+                ? Forbidden()
+                : Unauthorized();
+    }
+
+    protected async Task<IActionResult?> HandleMemberAccessAsync(IEnumerable<IPublishedContent> contentItems, IRequestMemberAccessService requestMemberAccessService)
+    {
+        foreach (IPublishedContent content in contentItems)
+        {
+            IActionResult? result = await HandleMemberAccessAsync(content, requestMemberAccessService);
+            // if any of the content items yield an error based on the current member access, return that error
+            if (result is not null)
+            {
+                return result;
+            }
+        }
+
+        return null;
+    }
+}

src/Umbraco.Cms.Api.Delivery/Controllers/Content/QueryContentApiController.cs

@@ -0,0 +1,107 @@
+using Asp.Versioning;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
+using Umbraco.Cms.Api.Common.ViewModels.Pagination;
+using Umbraco.Cms.Core;
+using Umbraco.Cms.Core.DeliveryApi;
+using Umbraco.Cms.Core.DependencyInjection;
+using Umbraco.Cms.Core.Models;
+using Umbraco.Cms.Core.Models.DeliveryApi;
+using Umbraco.Cms.Core.Models.PublishedContent;
+using Umbraco.Cms.Core.Services.OperationStatus;
+using Umbraco.Extensions;
+
+namespace Umbraco.Cms.Api.Delivery.Controllers.Content;
+
+[ApiVersion("1.0")]
+[ApiVersion("2.0")]
+public class QueryContentApiController : ContentApiControllerBase
+{
+    private readonly IRequestMemberAccessService _requestMemberAccessService;
+    private readonly IApiContentQueryService _apiContentQueryService;
+
+    [Obsolete($"Please use the constructor that accepts {nameof(IRequestMemberAccessService)}. Will be removed in V14.")]
+    public QueryContentApiController(
+        IApiPublishedContentCache apiPublishedContentCache,
+        IApiContentResponseBuilder apiContentResponseBuilderBuilder,
+        IApiContentQueryService apiContentQueryService)
+        : this(
+            apiPublishedContentCache,
+            apiContentResponseBuilderBuilder,
+            apiContentQueryService,
+            StaticServiceProvider.Instance.GetRequiredService<IRequestMemberAccessService>())
+    {
+    }
+
+    [ActivatorUtilitiesConstructor]
+    public QueryContentApiController(
+        IApiPublishedContentCache apiPublishedContentCache,
+        IApiContentResponseBuilder apiContentResponseBuilderBuilder,
+        IApiContentQueryService apiContentQueryService,
+        IRequestMemberAccessService requestMemberAccessService)
+        : base(apiPublishedContentCache, apiContentResponseBuilderBuilder)
+    {
+        _apiContentQueryService = apiContentQueryService;
+        _requestMemberAccessService = requestMemberAccessService;
+    }
+
+    [HttpGet]
+    [MapToApiVersion("1.0")]
+    [ProducesResponseType(typeof(PagedViewModel<IApiContentResponse>), StatusCodes.Status200OK)]
+    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status400BadRequest)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [Obsolete("Please use version 2 of this API. Will be removed in V15.")]
+    public async Task<IActionResult> Query(
+        string? fetch,
+        [FromQuery] string[] filter,
+        [FromQuery] string[] sort,
+        int skip = 0,
+        int take = 10)
+        => await HandleRequest(fetch, filter, sort, skip, take);
+
+    /// <summary>
+    ///     Gets a paginated list of content item(s) from query.
+    /// </summary>
+    /// <param name="fetch">Optional fetch query parameter value.</param>
+    /// <param name="filter">Optional filter query parameters values.</param>
+    /// <param name="sort">Optional sort query parameters values.</param>
+    /// <param name="skip">The amount of items to skip.</param>
+    /// <param name="take">The amount of items to take.</param>
+    /// <returns>The paged result of the content item(s).</returns>
+    [HttpGet]
+    [MapToApiVersion("2.0")]
+    [ProducesResponseType(typeof(PagedViewModel<IApiContentResponse>), StatusCodes.Status200OK)]
+    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status400BadRequest)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<IActionResult> QueryV20(
+        string? fetch,
+        [FromQuery] string[] filter,
+        [FromQuery] string[] sort,
+        int skip = 0,
+        int take = 10)
+        => await HandleRequest(fetch, filter, sort, skip, take);
+
+    private async Task<IActionResult> HandleRequest(string? fetch, string[] filter, string[] sort, int skip, int take)
+    {
+        ProtectedAccess protectedAccess = await _requestMemberAccessService.MemberAccessAsync();
+        Attempt<PagedModel<Guid>, ApiContentQueryOperationStatus> queryAttempt = _apiContentQueryService.ExecuteQuery(fetch, filter, sort, protectedAccess, skip, take);
+
+        if (queryAttempt.Success is false)
+        {
+            return ApiContentQueryOperationStatusResult(queryAttempt.Status);
+        }
+
+        PagedModel<Guid> pagedResult = queryAttempt.Result;
+        IEnumerable<IPublishedContent> contentItems = ApiPublishedContentCache.GetByIds(pagedResult.Items);
+        IApiContentResponse[] apiContentItems = contentItems.Select(ApiContentResponseBuilder.Build).WhereNotNull().ToArray();
+
+        var model = new PagedViewModel<IApiContentResponse>
+        {
+            Total = pagedResult.Total,
+            Items = apiContentItems
+        };
+
+        return Ok(model);
+    }
+}

src/Umbraco.Cms.Api.Delivery/Controllers/DeliveryApiControllerBase.cs

@@ -0,0 +1,29 @@
+using System.Net;
+using Microsoft.AspNetCore.Mvc;
+using Umbraco.Cms.Api.Common.Attributes;
+using Umbraco.Cms.Api.Common.Filters;
+using Umbraco.Cms.Api.Delivery.Configuration;
+using Umbraco.Cms.Core;
+
+namespace Umbraco.Cms.Api.Delivery.Controllers;
+
+[ApiController]
+[JsonOptionsName(Constants.JsonOptionsNames.DeliveryApi)]
+[MapToApi(DeliveryApiConfiguration.ApiName)]
+public abstract class DeliveryApiControllerBase : Controller
+{
+    protected string DecodePath(string path)
+    {
+        // OpenAPI does not allow reserved chars as "in:path" parameters, so clients based on the Swagger JSON will URL
+        // encode the path. Normally, ASP.NET Core handles that encoding with an automatic decoding - apparently just not
+        // for forward slashes, for whatever reason... so we need to deal with those. Hopefully this will be addressed in
+        // an upcoming version of ASP.NET Core.
+        // See also https://github.com/dotnet/aspnetcore/issues/11544
+        if (path.Contains("%2F", StringComparison.OrdinalIgnoreCase))
+        {
+            path = WebUtility.UrlDecode(path);
+        }
+
+        return path;
+    }
+}