Update Examine to 3.8.0.

* Fix: prevent open redirect in public surface controllers by validating RedirectUrl with Url.IsLocalUrl

* Fixed spacing in comment.

---------

Co-authored-by: Lan Nguyen Thuy <lnt@umbraco.dk>
Co-authored-by: Andy Butland <abutland73@gmail.com>

.artifactignore

@@ -1,3 +1,3 @@
 **/*
-!**/bin/**
-!**/obj/**
+!tests/Umbraco.Tests.Integration/bin/**
+!tests/Umbraco.Tests.UnitTests/bin/**

.github/BUILD.md

@@ -40,18 +40,22 @@ You can also run the tasks manually on the command line:
 
 ```
 cd src\Umbraco.Web.UI.Client
-npm install
+npm i
 npm run dev
 ```
 
-or
+If you just want to build the UI Client to `Umbraco.Web.UI` then instead of running `dev`, you can do: `npm run build`.
+
+The login screen is a different frontend build, for that one you can run it as follows:
 
 ```
-cd src\Umbraco.Web.UI.Client
-npm install
-gulp dev
+cd src\Umbraco.Web.UI.Login
+npm i
+npm run dev
 ```
 
+If you just want to build the Login screen to `Umbraco.Web.UI` then instead of running `dev`, you can do: `npm run build`.
+
 **The initial Gulp build might take a long time - don't worry, this will be faster on subsequent runs.**
 
 You might run into [Gulp quirks](#gulp-quirks).

.github/CONTRIBUTING.md

@@ -4,248 +4,56 @@
 
 These contribution guidelines are mostly just that - guidelines, not rules. This is what we've found to work best over the years, but if you choose to ignore them, we still love you! 💖 Use your best judgement, and feel free to propose changes to this document in a pull request.
 
-## Coding not your thing? Or want more ways to contribute?
+## Getting Started
+We have a guide on [what to consider before you start](contributing-before-you-start.md) and more detailed guides at the end of this article.
 
-This document covers contributing to the codebase of the CMS but [the community site has plenty of inspiration for other ways to get involved.][get involved]
-
-If you don't feel you'd like to make code changes here, you can visit our [documentation repository][docs repo] and use your experience to contribute to making the docs we have, even better.
-
-We also encourage community members to feel free to comment on others' pull requests and issues - the expertise we have is not limited to the Core Collaborators and HQ. So, if you see something on the issue tracker or pull requests you feel you can add to, please don't be shy.
-
-## Table of contents
-
-- [Before you start](#before-you-start)
-  * [Code of Conduct](#code-of-conduct)
-  * [What can I contribute?](#what-can-i-contribute)
-    + [Making larger changes](#making-larger-changes)
-    + [Pull request or package?](#pull-request-or-package)
-    + [Ownership and copyright](#ownership-and-copyright)
-- [Finding your first issue: Up for grabs](#finding-your-first-issue-up-for-grabs)
-- [Making your changes](#making-your-changes)
-    + [Keeping your Umbraco fork in sync with the main repository](#keeping-your-umbraco-fork-in-sync-with-the-main-repository)
-    + [Style guide](#style-guide)
-    + [Questions?](#questions)
-- [Creating a pull request](#creating-a-pull-request)
-- [The review process](#the-review-process)
-  * [Dealing with requested changes](#dealing-with-requested-changes)
-    + [No longer available?](#no-longer-available)
-  * [The Core Collaborators team](#the-core-collaborators-team)
-
-## Before you start
-
-
-### Code of Conduct
-
-This project and everyone participating in it, is governed by the [our Code of Conduct][code of conduct].
-
-### What can I contribute?
-
-We categorise pull requests (PRs) into two categories:
-
-| PR type   | Definition                                                   |
-| --------- | ------------------------------------------------------------ |
-| Small PRs | Bug fixes and small improvements - can be recognized by seeing a small number of changes and possibly a small number of new files. |
-| Large PRs | New features and large refactorings - can be recognized by seeing a large number of changes, plenty of new files, updates to package manager files (NuGet’s packages.config, NPM’s packages.json, etc.). |
-
-We’re usually able to handle small PRs pretty quickly. A community volunteer will do the initial review and flag it for Umbraco HQ as “community tested”. If everything looks good, it will be merged pretty quickly [as per the described process][review process].
-
-We would love to follow the same process for larger PRs but this is not always possible due to time limitations and priorities that need to be aligned. We don’t want to put up any barriers, but this document should set the correct expectations. 
-
-Not all changes are wanted, so on occasion we might close a PR without merging it but if we do, we will give you feedback why we can't accept your changes. **So make sure to [talk to us before making large changes][making larger changes]**, so we can ensure that you don't put all your hard work into something we would not be able to merge.
-
-#### Making larger changes
-
-[making larger changes]: #making-larger-changes
-
-Please make sure to describe your larger ideas in an [issue (bugs)][issues] or [discussion (new features)][discussions], it helps to put in mock up screenshots or videos. If the change makes sense for HQ to include in Umbraco CMS we will leave you some feedback on how we’d like to see it being implemented. 
-
-If a larger pull request is encouraged by Umbraco HQ, the process will be similar to what is described in the small PRs process above, we strive to feedback within 14 days. Finalizing and merging the PR might take longer though as it will likely need to be picked up by the development team to make sure everything is in order. We’ll keep you posted on the progress.
-
-#### Pull request or package?
-
-[pr or package]: #pull-request-or-package
-
-If you're unsure about whether your changes belong in the core Umbraco CMS or if you should turn your idea into a package instead, make sure to [talk to us][making larger changes].
-
-If it doesn’t fit in CMS right now, we will likely encourage you to make it into a package instead. A package is a great way to check out popularity of a feature, learn how people use it, validate good usability and fix bugs. Eventually, a package could "graduate" to be included in the CMS.
-
-#### Ownership and copyright
-
-It is your responsibility to make sure that you're allowed to share the code you're providing us. For example, you should have permission from your employer or customer to share code.
-
-Similarly, if your contribution is copied or adapted from somewhere else, make sure that the license allows you to reuse that for a contribution to Umbraco-CMS.
-
-If you're not sure, leave a note on your contribution and we will be happy to guide you.
-
-When your contribution has been accepted, it will be [MIT licensed][MIT license] from that time onwards.
-
-## Finding your first issue: Up for grabs
-
-Umbraco HQ will regularly mark newly created issues on the issue tracker with [the `community/up-for-grabs` tag][up for grabs issues]. This means that the proposed changes are wanted in Umbraco but the HQ does not have the time to make them at this time. We encourage anyone to pick them up and help out.
-
-If you do start working on something, make sure to leave a small comment on the issue saying something like: "I'm working on this". That way other people stumbling upon the issue know they don't need to pick it up, someone already has.
-
-## Making your changes
-
-Great question! The short version goes like this:
+The following steps are a quick-start guide:
 
 1. **Fork**
 
-    Create a fork of [`Umbraco-CMS` on GitHub][Umbraco CMS repo]
+    Create a fork of [`Umbraco-CMS` on GitHub](https://github.com/umbraco/Umbraco-CMS)
     
     ![Fork the repository](img/forkrepository.png)
     
-1. **Clone**
+2. **Clone**
 
-    When GitHub has created your fork, you can clone it in your favorite Git tool
+    When GitHub has created your fork, you can clone it in your favorite Git tool or on the command line with `git clone https://github.com/[YourUsername]/Umbraco-CMS`.
     
     ![Clone the fork](img/clonefork.png) 
     
-1. **Switch to the correct branch**
+3. **Switch to the correct branch**
 
     Switch to the `contrib` branch
 
-1. **Build**
+4. **Build**
 
-    Build your fork of Umbraco locally as described in the build documentation: you can [debug with Visual Studio Code][build - debugging with code] or [with Visual Studio][build - debugging with vs].
+    Build your fork of Umbraco locally [as described in the build documentation](BUILD.md), you can build with any IDE that supports dotnet or the command line.
 
-1. **Branch**
+5. **Branch**
 
-    Create a new branch now and name it after the issue you're fixing, we usually follow the format: `temp-12345`. This means it's a temporary branch for the particular issue you're working on, in this case issue number `12345`.  Don't commit to `contrib`, create a new branch first.
+    Create a new branch now and name it after the issue you're fixing, we usually follow the format: `temp/12345`. This means it's a temporary branch for the particular issue you're working on, in this case issue number `12345`.  Don't commit to `contrib`, create a new branch first.
 
-1. **Change**
+6. **Change**
 
-    Make your changes, experiment, have fun, explore and learn, and don't be afraid. We welcome all contributions and will [happily give feedback][questions].
+    Make your changes, experiment, have fun, explore and learn, and don't be afraid. We welcome all contributions and will [happily give feedback](contributing-first-issue.md#questions).
 
-1. **Commit and push**
+7. **Commit and push**
 
     Done? Yay! 🎉
 
     Remember to commit to your new `temp` branch, and don't commit to `contrib`. Then you can push the changes up to your fork on GitHub.
 
-#### Keeping your Umbraco fork in sync with the main repository
-[sync fork]: #keeping-your-umbraco-fork-in-sync-with-the-main-repository
+8. **Create pull request**
 
-Once you've already got a fork and cloned your fork locally, you can skip steps 1 and 2 going forward. Just remember to keep your fork up to date before making further changes.
+    On GitHub, in your forked repository (`https://github.com/[YourUsername]/Umbraco-CMS`) you will see a banner saying that you pushed a new branch and a button to make a pull request. Tap the button and follow the instuctions.
 
-To sync your fork with this original one, you'll have to add the upstream url. You only have to do this once:
+    Want to read further? [Creating a pull request and what happens next](contributing-creating-a-pr.md).
 
-```
-git remote add upstream https://github.com/umbraco/Umbraco-CMS.git
-```
+## Further contribution guides
 
-Then when you want to get the changes from the main repository:
+- [Before you start](contributing-before-you-start.md)
+- [Finding your first issue: Up for grabs](contributing-before-you-start.md)
+- [Contributing to the new backoffice](https://docs.umbraco.com/umbraco-backoffice/)
+- [Unwanted changes](contributing-unwanted-changes.md)
+- [Other ways to contribute](contributing-other-ways-to-contribute.md)
 
-```
-git fetch upstream
-git rebase upstream/contrib
-```
-
-In this command we're syncing with the `contrib` branch, but you can of course choose another one if needed.
-
-[More information on how this works can be found on the thoughtbot blog.][sync fork ext]
-
-#### Style guide
-
-To be honest, we don't like rules very much. We trust you have the best of intentions and we encourage you to create working code. If it doesn't look perfect then we'll happily help clean it up.
-
-That said, the Umbraco development team likes to follow the hints that ReSharper gives us (no problem if you don't have this installed) and we've added a `.editorconfig` file so that Visual Studio knows what to do with whitespace, line endings, etc.
-
-#### Questions?
-[questions]: #questions
-
-You can get in touch with [the core contributors team][core collabs] in multiple ways; we love open conversations and we are a friendly bunch. No question you have is stupid. Any question you have usually helps out multiple people with the same question. Ask away:
-
-- If there's an existing issue on the issue tracker then that's a good place to leave questions and discuss how to start or move forward.
-- If you want to ask questions on some code you've already written you can create a draft pull request, [detailed in a GitHub blog post][draft prs].
-- Unsure where to start? Did something not work as expected? Try leaving a note in the ["Contributing to Umbraco"][contrib forum] forum. The team monitors that one closely, so one of us will be on hand and ready to point you in the right direction.
-
-## Creating a pull request
-
-Exciting! You're ready to show us your changes.
-
-We recommend you to [sync with our repository][sync fork] before you submit your pull request. That way, you can fix any potential merge conflicts and make our lives a little bit easier.
-
-GitHub will have picked up on the new branch you've pushed and will offer to create a Pull Request. Click that green button and away you go.
-![Create a pull request](img/createpullrequest.png)
-
-We like to use [git flow][git flow] as much as possible, but don't worry if you are not familiar with it. The most important thing you need to know is that when you fork the Umbraco repository, the default branch is set to `contrib`. This is the branch you should be targeting.
-
-Please note: we are no longer accepting features for v8 and below but will continue to merge security fixes as and when they arise.
-
-## The review process
-[review process]: #the-review-process
-
-You've sent us your first contribution - congratulations! Now what?
-
-The [Core Collaborators team][Core collabs] can now start reviewing your proposed changes and give you feedback on them. If it's not perfect, we'll either fix up what we need or we can request that you make some additional changes.
-
-You will get an initial automated reply from our [Friendly Umbraco Robot, Umbrabot][Umbrabot], to acknowledge that we’ve seen your PR and we’ll pick it up as soon as we can. You can take this opportunity to double check everything is in order based off the handy checklist Umbrabot provides.
-
-You will get feedback as soon as the [Core Collaborators team][Core collabs] can after opening the PR. You’ll most likely get feedback within a couple of weeks. Then there are a few possible outcomes:
-
-- Your proposed change is awesome! We merge it in and it will be included in the next minor release of Umbraco
-- If the change is a high priority bug fix, we will cherry-pick it into the next patch release as well so that we can release it as soon as possible
-- Your proposed change is awesome but needs a bit more work, we’ll give you feedback on the changes we’d like to see
-- Your proposed change is awesome but... not something we’re looking to include at this point. We’ll close your PR and the related issue (we’ll be nice about it!). See [making larger changes][making larger changes] and [pull request or package?][pr or package]
-
-### Dealing with requested changes
-
-If you make the corrections we ask for in the same branch and push them to your fork again, the pull request automatically updates with the additional commit(s) so we can review it again. If all is well, we'll merge the code and your commits are forever part of Umbraco!
-
-#### No longer available?
-
-We understand you have other things to do and can't just drop everything to help us out.
-
-So if we’re asking for your help to improve the PR we’ll wait for two weeks to give you a fair chance to make changes. We’ll ask for an update if we don’t hear back from you after that time.  
-
-If we don’t hear back from you for 4 weeks, we’ll close the PR so that it doesn’t just hang around forever. You’re very welcome to re-open it once you have some more time to spend on it.  
-
-There will be times that we really like your proposed changes and we’ll finish the final improvements we’d like to see ourselves. You still get the credits and your commits will live on in the git repository.
-
-### The Core Collaborators team
-[Core collabs]: #the-core-collaborators-team
-
-The Core Contributors team consists of one member of Umbraco HQ, [Sebastiaan][Sebastiaan], who gets assistance from the following community members who have committed to volunteering their free time:
-
-- [Busra Sengul][Busra Sengul]
-- [Emma Garland][Emma Garland]
-- [George Bidder][George Bidder]
-- [Jason Elkin][Jason Elkin]
-- [Laura Neto][Laura Neto]
-- [Michael Latouche][Michael Latouche]
-- [Sebastiaan][Sebastiaan]
-
-
-These wonderful people aim to provide you with a reply to your PR, review and test out your changes and on occasions, they might ask more questions. If they are happy with your work, they'll let Umbraco HQ know by approving the PR. HQ will have final sign-off and will check the work again before it is merged.
-
-<!-- Reference links for easy updating -->
-
-<!-- Local -->
-
-[MIT license]: ../LICENSE.md	"Umbraco's license declaration"
-[build - debugging with vs]: BUILD.md#debugging-with-visual-studio	"Details on building and debugging Umbraco with Visual Studio"
-[build - debugging with code]: BUILD.md#debugging-with-vs-code	"Details on building and debugging Umbraco with Visual Studio Code"
-
-<!-- External -->
-
-[Busra Sengul]: https://github.com/busrasengul "Busra's GitHub profile"
-[Emma Garland]: https://github.com/emmagarland	"Emma's GitHub profile"
-[George Bidder]: https://github.com/georgebid	"George's GitHub profile"
-[Jason Elkin]: https://github.com/jasonelkin "Jason's GitHub profile"
-[Kyle Eck]: https://github.com/teckspeed	"Kyle's GitHub profile"
-[Laura Neto]: https://github.com/lauraneto	"Laura's GitHub profile"
-[Michael Latouche]: https://github.com/mikecp	"Michael's GitHub profile"
-[Sebastiaan]: https://github.com/nul800sebastiaan "Sebastiaan's GitHub profile"
-[ Umbrabot ]: https://github.com/umbrabot
-[git flow]: https://jeffkreeftmeijer.com/git-flow/	"An explanation of git flow"
-[sync fork ext]: http://robots.thoughtbot.com/post/5133345960/keeping-a-git-fork-updated	"Details on keeping a git fork updated"
-[draft prs]: https://github.blog/2019-02-14-introducing-draft-pull-requests/	"Github's blog post providing details on draft pull requests"
-[contrib forum]: https://our.umbraco.com/forum/contributing-to-umbraco-cms/
-[get involved]: https://community.umbraco.com/get-involved/
-[docs repo]: https://github.com/umbraco/UmbracoDocs
-[code of conduct]: https://github.com/umbraco/.github/blob/main/.github/CODE_OF_CONDUCT.md
-[up for grabs issues]: https://github.com/umbraco/Umbraco-CMS/issues?q=is%3Aissue+is%3Aopen+label%3Acommunity%2Fup-for-grabs
-[Umbraco CMS repo]: https://github.com/umbraco/Umbraco-CMS
-[issues]: https://github.com/umbraco/Umbraco-CMS/issues
-[discussions]: https://github.com/umbraco/Umbraco-CMS/discussions

.github/README.md

@@ -1,4 +1,12 @@
-# [Umbraco CMS](https://umbraco.com) · [![GitHub license](https://img.shields.io/badge/license-MIT-blue.svg)](../LICENSE.md) [![Build status](https://umbraco.visualstudio.com/Umbraco%20Cms/_apis/build/status/Cms%208%20Continuous?branchName=v8/contrib)](https://umbraco.visualstudio.com/Umbraco%20Cms/_build?definitionId=75) [![PRs Welcome](https://img.shields.io/badge/PRs-welcome-brightgreen.svg)](CONTRIBUTING.md) [![Twitter](https://img.shields.io/twitter/follow/umbraco.svg?style=social&label=Follow)](https://twitter.com/intent/follow?screen_name=umbraco) [![Discord](https://img.shields.io/discord/869656431308189746)](https://discord.gg/umbraco) [![Open in GitHub Codespaces](https://github.com/codespaces/badge.svg)](https://github.com/codespaces/new?hide_repo_select=true&ref=v11%2Fcontrib&repo=10601208&machine=basicLinux32gb&devcontainer_path=.devcontainer%2Fdevcontainer.json&location=WestEurope)
+# [Umbraco CMS](https://umbraco.com)
+
+[![GitHub license](https://img.shields.io/badge/license-MIT-blue.svg)](../LICENSE.md) 
+[![PRs Welcome](https://img.shields.io/badge/PRs-welcome-brightgreen.svg)](CONTRIBUTING.md) 
+[![Follow Umbraco on Twitter](https://img.shields.io/badge/Follow-blue?logo=twitter&logoColor=fff)](https://twitter.com/intent/follow?screen_name=umbraco) 
+[![Chat about Umbraco on Discord](https://img.shields.io/discord/869656431308189746?logo=discord&logoColor=fff)](https://discord.gg/umbraco) 
+[![Read what's going on in the Umbraco Discord chat now](https://img.shields.io/badge/read-discord-blue)](https://discord-chats.umbraco.com) 
+[![Build status](https://img.shields.io/azure-devops/build/umbraco/Umbraco%2520Cms/301?logo=azurepipelines&label=Azure%20Pipelines)](https://umbraco.visualstudio.com/Umbraco%20Cms/_build?definitionId=301) 
+[![Open in GitHub Codespaces](https://img.shields.io/badge/Open%20in%20GitHub%20Codespaces-525252?logo=github)](https://github.com/codespaces/new?hide_repo_select=true&ref=contrib&repo=10601208&machine=basicLinux32gb&devcontainer_path=.devcontainer%2Fdevcontainer.json&location=WestEurope)
 
 Umbraco is the friendliest, most flexible and fastest growing ASP.NET CMS, and used by more than 500,000 websites worldwide. Our mission is to help you deliver delightful digital experiences by making Umbraco friendly, simpler and social.
 

.github/contributing-before-you-start.md

@@ -0,0 +1,54 @@
+## Before you start
+
+
+### Code of Conduct
+
+This project and everyone participating in it, is governed by the [our Code of Conduct][code of conduct].
+
+### What can I contribute?
+
+We categorise pull requests (PRs) into two categories:
+
+| PR type   | Definition                                                   |
+| --------- | ------------------------------------------------------------ |
+| Small PRs | Bug fixes and small improvements - can be recognized by seeing a small number of changes and possibly a small number of new files. |
+| Large PRs | New features and large refactorings - can be recognized by seeing a large number of changes, plenty of new files, updates to package manager files (NuGet’s packages.config, NPM’s packages.json, etc.). |
+
+We’re usually able to handle small PRs pretty quickly. A community volunteer will do the initial review and flag it for Umbraco HQ as “community tested”. If everything looks good, it will be merged pretty quickly [as per the described process][review process].
+
+We would love to follow the same process for larger PRs but this is not always possible due to time limitations and priorities that need to be aligned. We don’t want to put up any barriers, but this document should set the correct expectations. 
+
+Not all changes are wanted, so on occasion we might close a PR without merging it but if we do, we will give you feedback why we can't accept your changes. **So make sure to [talk to us before making large changes][making larger changes]**, so we can ensure that you don't put all your hard work into something we would not be able to merge.
+
+#### Making larger changes
+
+[making larger changes]: #making-larger-changes
+
+Please make sure to describe your larger ideas in an [issue (bugs)][issues] or [discussion (new features)][discussions], it helps to put in mock up screenshots or videos. If the change makes sense for HQ to include in Umbraco CMS we will leave you some feedback on how we’d like to see it being implemented. 
+
+If a larger pull request is encouraged by Umbraco HQ, the process will be similar to what is described in the small PRs process above, we strive to feedback within 14 days. Finalizing and merging the PR might take longer though as it will likely need to be picked up by the development team to make sure everything is in order. We’ll keep you posted on the progress.
+
+#### Pull request or package?
+
+[pr or package]: #pull-request-or-package
+
+If you're unsure about whether your changes belong in the core Umbraco CMS or if you should turn your idea into a package instead, make sure to [talk to us][making larger changes].
+
+If it doesn’t fit in CMS right now, we will likely encourage you to make it into a package instead. A package is a great way to check out popularity of a feature, learn how people use it, validate good usability and fix bugs. Eventually, a package could "graduate" to be included in the CMS.
+
+#### Ownership and copyright
+
+It is your responsibility to make sure that you're allowed to share the code you're providing us. For example, you should have permission from your employer or customer to share code.
+
+Similarly, if your contribution is copied or adapted from somewhere else, make sure that the license allows you to reuse that for a contribution to Umbraco-CMS.
+
+If you're not sure, leave a note on your contribution and we will be happy to guide you.
+
+When your contribution has been accepted, it will be [MIT licensed][MIT license] from that time onwards.
+
+
+[MIT license]: ../LICENSE.md	"Umbraco's license declaration"
+
+
+[issues]: https://github.com/umbraco/Umbraco-CMS/issues
+[discussions]: https://github.com/umbraco/Umbraco-CMS/discussions

.github/contributing-core-collabs-team.md

@@ -0,0 +1,28 @@
+### The Core Collaborators team
+[Core collabs]: #the-core-collaborators-team
+
+The Core Contributors team consists of one member of Umbraco HQ, [Sebastiaan][Sebastiaan], who gets assistance from the following community members who have committed to volunteering their free time:
+
+- [Busra Sengul][Busra Sengul]
+- [Emma Garland][Emma Garland]
+- [George Bidder][George Bidder]
+- [Jason Elkin][Jason Elkin]
+- [Laura Neto][Laura Neto]
+- [Kyle Eck][Kyle Eck]
+- [Michael Latouche][Michael Latouche]
+- [Sebastiaan][Sebastiaan]
+
+
+These wonderful people aim to provide you with a reply to your PR, review and test out your changes and on occasions, they might ask more questions. If they are happy with your work, they'll let Umbraco HQ know by approving the PR. HQ will have final sign-off and will check the work again before it is merged.
+
+
+<!-- External -->
+
+[Busra Sengul]: https://github.com/busrasengul "Busra's GitHub profile"
+[Emma Garland]: https://github.com/emmagarland	"Emma's GitHub profile"
+[George Bidder]: https://github.com/georgebid	"George's GitHub profile"
+[Jason Elkin]: https://github.com/jasonelkin "Jason's GitHub profile"
+[Kyle Eck]: https://github.com/teckspeed	"Kyle's GitHub profile"
+[Laura Neto]: https://github.com/lauraneto	"Laura's GitHub profile"
+[Michael Latouche]: https://github.com/mikecp	"Michael's GitHub profile"
+[Sebastiaan]: https://github.com/nul800sebastiaan "Sebastiaan's GitHub profile"

.github/contributing-creating-a-pr.md

@@ -0,0 +1,51 @@
+## Creating a pull request
+
+Exciting! You're ready to show us your changes.
+
+We recommend you to [sync with our repository][sync fork] before you submit your pull request. That way, you can fix any potential merge conflicts and make our lives a little bit easier.
+
+GitHub will have picked up on the new branch you've pushed and will offer to create a Pull Request. Click that green button and away you go.
+![Create a pull request](img/createpullrequest.png)
+
+We like to use [git flow][git flow] as much as possible, but don't worry if you are not familiar with it. The most important thing you need to know is that when you fork the Umbraco repository, the default branch is set to `contrib`. This is the branch you should be targeting.
+
+Please note: we are no longer accepting features for v8 and below but will continue to merge security fixes as and when they arise.
+  
+## The review process
+[review process]: #the-review-process
+
+You've sent us your contribution - congratulations! Now what?
+
+The [Core Collaborators team][Core collabs] can now start reviewing your proposed changes and give you feedback on them. If it's not perfect, we'll either fix up what we need or we can request that you make some additional changes.
+
+You will get an initial automated reply from our [Friendly Umbraco Robot, Umbrabot][Umbrabot], to acknowledge that we’ve seen your PR and we’ll pick it up as soon as we can. You can take this opportunity to double check everything is in order based off the handy checklist Umbrabot provides.
+
+You will get feedback as soon as the [Core Collaborators team][Core collabs] can after opening the PR. You’ll most likely get feedback within a couple of weeks. Then there are a few possible outcomes:
+
+- Your proposed change is awesome! We merge it in and it will be included in the next minor release of Umbraco
+- If the change is a high priority bug fix, we will cherry-pick it into the next patch release as well so that we can release it as soon as possible
+- Your proposed change is awesome but needs a bit more work, we’ll give you feedback on the changes we’d like to see
+- Your proposed change is awesome but... not something we’re looking to include at this point. We’ll close your PR and the related issue (we’ll be nice about it!). See [making larger changes][making larger changes] and [pull request or package?][pr or package]
+
+### Dealing with requested changes
+
+If you make the corrections we ask for in the same branch and push them to your fork again, the pull request automatically updates with the additional commit(s) so we can review it again. If all is well, we'll merge the code and your commits are forever part of Umbraco!
+
+#### No longer available?
+
+We understand you have other things to do and can't just drop everything to help us out.
+
+So if we’re asking for your help to improve the PR we’ll wait for two weeks to give you a fair chance to make changes. We’ll ask for an update if we don’t hear back from you after that time.  
+
+If we don’t hear back from you for 4 weeks, we’ll close the PR so that it doesn’t just hang around forever. You’re very welcome to re-open it once you have some more time to spend on it.  
+
+There will be times that we really like your proposed changes and we’ll finish the final improvements we’d like to see ourselves. You still get the credits and your commits will live on in the git repository.
+
+
+[ Umbrabot ]: https://github.com/umbrabot
+[git flow]: https://jeffkreeftmeijer.com/git-flow/	"An explanation of git flow"
+
+
+[making larger changes]: contributing-before-you-start.md#making-large-changes
+[pr or package]: contributing-before-you-start.md#pull-request-or-package
+[Core collabs]: contributing-core-collabs-team.md

.github/contributing-first-issue.md

@@ -0,0 +1,93 @@
+## Finding your first issue: Up for grabs
+
+Umbraco HQ will regularly mark newly created issues on the issue tracker with [the `community/up-for-grabs` tag][up for grabs issues]. This means that the proposed changes are wanted in Umbraco but the HQ does not have the time to make them at this time. We encourage anyone to pick them up and help out.
+
+If you do start working on something, make sure to leave a small comment on the issue saying something like: "I'm working on this". That way other people stumbling upon the issue know they don't need to pick it up, someone already has.
+
+## Making your changes
+
+Great question! The short version goes like this:
+
+1. **Fork**
+
+    Create a fork of [`Umbraco-CMS` on GitHub][Umbraco CMS repo]
+    
+    ![Fork the repository](img/forkrepository.png)
+    
+1. **Clone**
+
+    When GitHub has created your fork, you can clone it in your favorite Git tool
+    
+    ![Clone the fork](img/clonefork.png) 
+    
+1. **Switch to the correct branch**
+
+    Switch to the `contrib` branch
+
+1. **Build**
+
+    Build your fork of Umbraco locally as described in the build documentation: you can [debug with Visual Studio Code][build - debugging with code] or [with Visual Studio][build - debugging with vs].
+
+1. **Branch**
+
+    Create a new branch now and name it after the issue you're fixing, we usually follow the format: `temp-12345`. This means it's a temporary branch for the particular issue you're working on, in this case issue number `12345`.  Don't commit to `contrib`, create a new branch first.
+
+1. **Change**
+
+    Make your changes, experiment, have fun, explore and learn, and don't be afraid. We welcome all contributions and will [happily give feedback][questions].
+
+1. **Commit and push**
+
+    Done? Yay! 🎉
+
+    Remember to commit to your new `temp` branch, and don't commit to `contrib`. Then you can push the changes up to your fork on GitHub.
+
+#### Keeping your Umbraco fork in sync with the main repository
+[sync fork]: #keeping-your-umbraco-fork-in-sync-with-the-main-repository
+
+Once you've already got a fork and cloned your fork locally, you can skip steps 1 and 2 going forward. Just remember to keep your fork up to date before making further changes.
+
+To sync your fork with this original one, you'll have to add the upstream url. You only have to do this once:
+
+```
+git remote add upstream https://github.com/umbraco/Umbraco-CMS.git
+```
+
+Then when you want to get the changes from the main repository:
+
+```
+git fetch upstream
+git rebase upstream/contrib
+```
+
+In this command we're syncing with the `contrib` branch, but you can of course choose another one if needed.
+
+[More information on how this works can be found on the thoughtbot blog.][sync fork ext]
+
+#### Style guide
+
+To be honest, we don't like rules very much. We trust you have the best of intentions and we encourage you to create working code. If it doesn't look perfect then we'll happily help clean it up.
+
+That said, the Umbraco development team likes to follow the hints that ReSharper gives us (no problem if you don't have this installed) and we've added a `.editorconfig` file so that Visual Studio knows what to do with whitespace, line endings, etc.
+
+#### Questions?
+[questions]: #questions
+
+You can get in touch with [the core contributors team][core collabs] in multiple ways; we love open conversations and we are a friendly bunch. No question you have is stupid. Any question you have usually helps out multiple people with the same question. Ask away:
+
+- If there's an existing issue on the issue tracker then that's a good place to leave questions and discuss how to start or move forward.
+- If you want to ask questions on some code you've already written you can create a draft pull request, [detailed in a GitHub blog post][draft prs].
+- Unsure where to start? Did something not work as expected? Try leaving a note in the ["Contributing to Umbraco"][contrib forum] forum. The team monitors that one closely, so one of us will be on hand and ready to point you in the right direction.
+
+
+  <!-- Local -->
+
+[build - debugging with vs]: BUILD.md#debugging-with-visual-studio	"Details on building and debugging Umbraco with Visual Studio"
+[build - debugging with code]: BUILD.md#debugging-with-vs-code	"Details on building and debugging Umbraco with Visual Studio Code"
+
+
+[sync fork ext]: http://robots.thoughtbot.com/post/5133345960/keeping-a-git-fork-updated	"Details on keeping a git fork updated"
+[draft prs]: https://github.blog/2019-02-14-introducing-draft-pull-requests/	"Github's blog post providing details on draft pull requests"
+[contrib forum]: https://our.umbraco.com/forum/contributing-to-umbraco-cms/
+[Umbraco CMS repo]: https://github.com/umbraco/Umbraco-CMS
+[up for grabs issues]: https://github.com/umbraco/Umbraco-CMS/issues?q=is%3Aissue+is%3Aopen+label%3Acommunity%2Fup-for-grabs

.github/contributing-other-ways-to-contribute.md

@@ -0,0 +1,10 @@
+## Coding not your thing? Or want more ways to contribute?
+
+This document covers contributing to the codebase of the CMS but [the community site has plenty of inspiration for other ways to get involved.][get involved]
+
+If you don't feel you'd like to make code changes here, you can visit our [documentation repository][docs repo] and use your experience to contribute to making the docs we have, even better.
+
+We also encourage community members to feel free to comment on others' pull requests and issues - the expertise we have is not limited to the Core Collaborators and HQ. So, if you see something on the issue tracker or pull requests you feel you can add to, please don't be shy.
+
+[get involved]: https://community.umbraco.com/get-involved/
+[docs repo]: https://github.com/umbraco/UmbracoDocs

.github/contributing-unwanted-changes.md

@@ -0,0 +1,18 @@
+## Unwanted changes
+While most changes are welcome, there are certain types of changes that are discouraged and might get your pull request refused.
+Of course this will depend heavily on the specific change, but please take the following examples in mind.
+
+- **Breaking changes (code and/or behavioral) 💥** - sometimes it can be a bit hard to know if a change is breaking or not. Fortunately, if it relates to code, the build will fail and warn you.
+- **Large refactors 🤯** - the larger the refactor, the larger the probability of introducing new bugs/issues.  
+- **Changes to obsolete code and/or property editors ✍️**
+- **Adding new config options 🦾** - while having more flexibility is (most of the times) better, having too many options can also become overwhelming/confusing, especially if there are other (good/simple) ways to achieve it.
+- **Whitespace changes 🫥** - while some of our files might not follow the formatting/whitespace rules (mostly old ones), changing several of them in one go would cause major merge conflicts with open pull requests or other work in progress. Do feel free to fix these when you are working on another issue/feature and end up "touching" those files!
+- **Adding new extension/helper methods ✋** - keep in mind that more code also means more to maintain, so if a helper is only meaningful for a few, it might not be worth adding it to the core.
+
+While these are only a few examples, it is important to ask yourself these questions before making a pull request:
+
+- How many will benefit from this change?
+- Are there other ways to achieve this? And if so, how do they compare?
+- How maintainable is the change?
+- What would be the effort to test it properly?
+- Do the benefits outweigh the risks?

.github/workflows/add-issues-to-review-project.yml

@@ -1,58 +0,0 @@
-name: Add issues to review project
-
-on:
-  issues:
-    types:
-      - opened
-
-permissions:
-  contents: read
-
-jobs:
-  get-user-type:
-    runs-on: ubuntu-latest
-    outputs:
-      ignored: ${{ steps.set-output.outputs.ignored }}
-    steps:
-      - name: Install dependencies
-        run: |
-          npm install node-fetch@2
-      - uses: actions/github-script@v5
-        name: "Determing HQ user or not"
-        id: set-output
-        with:
-          script: |
-            const fetch = require('node-fetch');
-            const response = await fetch('https://collaboratorsv2.euwest01.umbraco.io/umbraco/api/users/IsIgnoredUser', {
-              method: 'post',
-              body: JSON.stringify('${{ github.event.issue.user.login }}'),
-              headers: {
-                'Authorization': 'Bearer ${{ secrets.OUR_BOT_API_TOKEN }}',
-                'Content-Type': 'application/json'
-              }
-            });
-
-            var isIgnoredUser = true;
-            try {                
-                if(response.status === 200) {
-                    const data = await response.text();
-                    isIgnoredUser = data === "true";
-                } else {
-                    console.log("Returned data not indicate success:", response.status);
-                }
-            } catch(error) {
-                console.log(error);
-            };
-            core.setOutput("ignored", isIgnoredUser);
-            console.log("Ignored is", isIgnoredUser);
-  add-to-project:
-    permissions:
-      repository-projects: write # for actions/add-to-project
-    if: needs.get-user-type.outputs.ignored == 'false'
-    runs-on: ubuntu-latest
-    needs: [get-user-type]
-    steps:
-      - uses: actions/add-to-project@main
-        with:
-          project-url: https://github.com/orgs/${{ github.repository_owner }}/projects/21
-          github-token: ${{ secrets.ADD_TO_PROJECT_PAT }}

.github/workflows/codeql-analysis.yml

@@ -15,7 +15,7 @@ permissions:
   contents: read
 
 env:
-  dotnetVersion: 7.x
+  dotnetVersion: 8.x
   dotnetIncludePreviewVersions: true
   solution: umbraco.sln
   buildConfiguration: SkipTests

.github/workflows/pr-first-response.yml

@@ -11,9 +11,6 @@ jobs:
       issues: write
       pull-requests: write
     steps:
-      - name: Install dependencies
-        run: |
-          npm install node-fetch@2
       - name: Fetch random comment 🗣️ and add it to the PR
         uses: actions/github-script@v6
         with:
@@ -44,13 +41,13 @@ jobs:
                     });
                 } else {
                     console.log("Returned data not indicate success.");
-                    
+
                     if(response.status !== 200) {
                       console.log("Status code:", response.status)
                     }
 
                     console.log("Returned data:", data);
-                    
+
                     if(data === '') {
                       console.log("An empty response usually indicates that either no comment was found or the actor user was not eligible for getting an automated response (HQ users are not getting auto-responses).")
                     }

Directory.Build.props

@@ -1,8 +1,7 @@
 <?xml version="1.0" encoding="utf-8"?>
 <Project>
   <PropertyGroup>
-    <TargetFramework>net7.0</TargetFramework>
-    <LangVersion>latest</LangVersion>
+    <TargetFramework>net8.0</TargetFramework>
     <Company>Umbraco HQ</Company>
     <Authors>Umbraco</Authors>
     <Copyright>Copyright © Umbraco $([System.DateTime]::Today.ToString('yyyy'))</Copyright>
@@ -17,12 +16,12 @@
     <WarningsAsErrors>nullable</WarningsAsErrors>
     <ImplicitUsings>enable</ImplicitUsings>
     <GenerateDocumentationFile>true</GenerateDocumentationFile>
+    <WarnOnPackingNonPackableProject>false</WarnOnPackingNonPackableProject>
   </PropertyGroup>
 
   <!-- SourceLink -->
   <PropertyGroup>
     <PublishRepositoryUrl>true</PublishRepositoryUrl>
-    <EmbedUntrackedSources>true</EmbedUntrackedSources>
     <IncludeSymbols>true</IncludeSymbols>
     <SymbolPackageFormat>snupkg</SymbolPackageFormat>
   </PropertyGroup>
@@ -31,24 +30,27 @@
   <PropertyGroup>
     <GenerateCompatibilitySuppressionFile>false</GenerateCompatibilitySuppressionFile>
     <EnablePackageValidation>true</EnablePackageValidation>
-    <PackageValidationBaselineVersion>11.0.0</PackageValidationBaselineVersion>
+    <PackageValidationBaselineVersion>13.0.0</PackageValidationBaselineVersion>
     <EnableStrictModeForCompatibleFrameworksInPackage>true</EnableStrictModeForCompatibleFrameworksInPackage>
     <EnableStrictModeForCompatibleTfms>true</EnableStrictModeForCompatibleTfms>
   </PropertyGroup>
 
-  <ItemGroup>
-    <PackageReference Include="Microsoft.SourceLink.GitHub" Version="1.1.1" PrivateAssets="all" IsImplicitlyDefined="true" />
-    <PackageReference Include="Nerdbank.GitVersioning" Version="3.5.113" PrivateAssets="all" IsImplicitlyDefined="true" />
-    <PackageReference Include="StyleCop.Analyzers" Version="1.2.0-beta.406" PrivateAssets="all" IsImplicitlyDefined="true" />
-    <PackageReference Include="Umbraco.Code" Version="2.0.0" PrivateAssets="all" IsImplicitlyDefined="true" />
-    <PackageReference Include="Umbraco.GitVersioning.Extensions" Version="0.2.0" PrivateAssets="all" IsImplicitlyDefined="true" />
-  </ItemGroup>
+  <!-- Calculate version only once for the whole repository --> 
+  <PropertyGroup>
+    <GitVersionBaseDirectory>$(MSBuildThisFileDirectory)</GitVersionBaseDirectory>
+  </PropertyGroup>
 
+  <!-- Include icon in generated NuGet packages -->
   <ItemGroup>
     <Content Include="$(MSBuildThisFileDirectory)icon.png" Pack="true" PackagePath="" Visible="false" />
   </ItemGroup>
 
-  <PropertyGroup>
-    <GitVersionBaseDirectory>$(MSBuildThisFileDirectory)</GitVersionBaseDirectory>
-  </PropertyGroup>
+  <!-- Use version range on project references (to limit on major version in generated packages) -->
+  <Target Name="_GetProjectReferenceVersionRanges" AfterTargets="_GetProjectReferenceVersions">
+    <ItemGroup>
+      <_ProjectReferencesWithVersions Condition="'%(ProjectVersion)' != ''">
+        <ProjectVersion>[%(ProjectVersion), $([MSBuild]::Add($([System.Text.RegularExpressions.Regex]::Match('%(ProjectVersion)', '^\d+').Value), 1)))</ProjectVersion>
+      </_ProjectReferencesWithVersions>
+    </ItemGroup>
+  </Target>
 </Project>

Directory.Packages.props

@@ -0,0 +1,104 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project>
+  <PropertyGroup>
+    <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
+  </PropertyGroup>
+  <!-- Global packages (private, build-time packages for all projects) -->
+  <ItemGroup>
+    <GlobalPackageReference Include="Nerdbank.GitVersioning" Version="3.6.139" />
+    <GlobalPackageReference Include="StyleCop.Analyzers" Version="1.2.0-beta.507" />
+    <GlobalPackageReference Include="Umbraco.Code" Version="2.2.0" />
+    <GlobalPackageReference Include="Umbraco.GitVersioning.Extensions" Version="0.2.0" />
+  </ItemGroup>
+  <!-- Microsoft packages -->
+  <ItemGroup>
+    <PackageVersion Include="Microsoft.AspNetCore.Mvc.NewtonsoftJson" Version="8.0.22" />
+    <PackageVersion Include="Microsoft.AspNetCore.Mvc.Razor.RuntimeCompilation" Version="8.0.22" />
+    <PackageVersion Include="Microsoft.CodeAnalysis.CSharp" Version="4.10.0" />
+    <PackageVersion Include="Microsoft.CodeAnalysis.CSharp.Workspaces" Version="4.10.0" />
+    <PackageVersion Include="Microsoft.CodeAnalysis.Workspaces.MSBuild" Version="4.10.0" />
+    <PackageVersion Include="Microsoft.Data.Sqlite" Version="8.0.11" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.Sqlite" Version="8.0.22" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.SqlServer" Version="8.0.22" />
+    <PackageVersion Include="Microsoft.Extensions.Caching.Abstractions" Version="8.0.0" />
+    <PackageVersion Include="Microsoft.Extensions.Configuration.Abstractions" Version="8.0.0" />
+    <PackageVersion Include="Microsoft.Extensions.Configuration.Json" Version="8.0.0" />
+    <PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="8.0.1" />
+    <PackageVersion Include="Microsoft.Extensions.FileProviders.Embedded" Version="8.0.22" />
+    <PackageVersion Include="Microsoft.Extensions.FileProviders.Physical" Version="8.0.0" />
+    <PackageVersion Include="Microsoft.Extensions.Hosting.Abstractions" Version="8.0.0" />
+    <PackageVersion Include="Microsoft.Extensions.Http" Version="8.0.1" />
+    <PackageVersion Include="Microsoft.Extensions.Identity.Core" Version="8.0.22" />
+    <PackageVersion Include="Microsoft.Extensions.Identity.Stores" Version="8.0.22" />
+    <PackageVersion Include="Microsoft.Extensions.Logging" Version="8.0.1" />
+    <PackageVersion Include="Microsoft.Extensions.Options" Version="8.0.2" />
+    <PackageVersion Include="Microsoft.Extensions.Options.ConfigurationExtensions" Version="8.0.0" />
+    <PackageVersion Include="Microsoft.Extensions.Options.DataAnnotations" Version="8.0.0" />
+    <PackageVersion Include="System.Runtime.Caching" Version="8.0.1" />
+  </ItemGroup>
+  <!-- Umbraco packages -->
+  <ItemGroup>
+    <PackageVersion Include="Umbraco.JsonSchema.Extensions" Version="0.3.0" />
+    <PackageVersion Include="Umbraco.CSharpTest.Net.Collections" Version="15.0.0" />
+  </ItemGroup>
+  <!-- Third-party packages -->
+  <ItemGroup>
+    <PackageVersion Include="Asp.Versioning.Mvc" Version="7.1.1" />
+    <PackageVersion Include="Asp.Versioning.Mvc.ApiExplorer" Version="7.1.0" />
+    <PackageVersion Include="Dazinator.Extensions.FileProviders" Version="2.0.0" />
+    <PackageVersion Include="Examine" Version="3.8.0" />
+    <PackageVersion Include="Examine.Core" Version="3.8.0" />
+    <PackageVersion Include="HtmlAgilityPack" Version="1.11.74" />
+    <PackageVersion Include="K4os.Compression.LZ4" Version="1.3.8" />
+    <PackageVersion Include="MailKit" Version="4.8.0" />
+    <PackageVersion Include="Markdown" Version="2.2.1" />
+    <PackageVersion Include="MessagePack" Version="2.5.192" />
+    <PackageVersion Include="MiniProfiler.AspNetCore.Mvc" Version="4.3.8" />
+    <PackageVersion Include="MiniProfiler.Shared" Version="4.3.8" />
+    <PackageVersion Include="ncrontab" Version="3.3.3" />
+    <PackageVersion Include="Newtonsoft.Json" Version="13.0.4" />
+    <PackageVersion Include="NPoco" Version="5.7.1" />
+    <PackageVersion Include="NPoco.SqlServer" Version="5.7.1" />
+    <PackageVersion Include="OpenIddict.Abstractions" Version="4.10.1" />
+    <PackageVersion Include="OpenIddict.AspNetCore" Version="4.10.1" />
+    <PackageVersion Include="OpenIddict.EntityFrameworkCore" Version="4.10.1" />
+    <PackageVersion Include="Serilog" Version="3.1.1" />
+    <PackageVersion Include="Serilog.AspNetCore" Version="8.0.3" />
+    <PackageVersion Include="Serilog.Enrichers.Process" Version="2.0.2" />
+    <PackageVersion Include="Serilog.Enrichers.Thread" Version="3.1.0" />
+    <PackageVersion Include="Serilog.Expressions" Version="4.0.0" />
+    <PackageVersion Include="Serilog.Extensions.Hosting" Version="8.0.0" />
+    <PackageVersion Include="Serilog.Formatting.Compact" Version="2.0.0" />
+    <PackageVersion Include="Serilog.Formatting.Compact.Reader" Version="3.0.0" />
+    <PackageVersion Include="Serilog.Settings.Configuration" Version="8.0.4" />
+    <PackageVersion Include="Serilog.Sinks.Async" Version="1.5.0" />
+    <PackageVersion Include="Serilog.Sinks.File" Version="5.0.0" />
+    <PackageVersion Include="Serilog.Sinks.Map" Version="1.0.2" />
+    <PackageVersion Include="SixLabors.ImageSharp" Version="3.1.12" />
+    <PackageVersion Include="SixLabors.ImageSharp.Web" Version="3.1.5" />
+    <PackageVersion Include="Smidge.InMemory" Version="4.6.0" />
+    <PackageVersion Include="Smidge.Nuglify" Version="4.6.0" />
+    <PackageVersion Include="Swashbuckle.AspNetCore" Version="6.9.0" />
+  </ItemGroup>
+  <!-- Transitive pinned versions (only required because our direct dependencies have vulnerable versions of transitive dependencies) -->
+  <ItemGroup>
+    <!-- Both Microsoft.EntityFrameworkCore.SqlServer and NPoco.SqlServer bring in a vulnerable version of Azure.Identity -->
+    <PackageVersion Include="Azure.Identity" Version="1.13.2" />
+    <!-- Dazinator.Extensions.FileProviders brings in a vulnerable version of System.Net.Http -->
+    <PackageVersion Include="System.Net.Http" Version="4.3.4" />
+    <!-- Examine brings in a vulnerable version of System.Security.Cryptography.Xml -->
+    <PackageVersion Include="System.Security.Cryptography.Xml" Version="8.0.3" />
+    <!-- Both Dazinator.Extensions.FileProviders and MiniProfiler.AspNetCore.Mvc bring in a vulnerable version of System.Text.RegularExpressions -->
+    <PackageVersion Include="System.Text.RegularExpressions" Version="4.3.1" />
+    <!-- Both OpenIddict.AspNetCore, Npoco.SqlServer and Microsoft.EntityFrameworkCore.SqlServer bring in a vulnerable version of Microsoft.IdentityModel.JsonWebTokens -->
+    <PackageVersion Include="Microsoft.IdentityModel.JsonWebTokens" Version="7.7.1" />
+    <!-- Examine.Lucene bring in a vulnerable version of Lucene.Net.Replicator -->
+    <PackageVersion Include="Lucene.Net.Replicator" Version="4.8.0-beta00017" />
+    <!-- Both OpenIddict.AspNetCore, Microsoft.EntityFrameworkCore.* bring in a vulnerable version of Microsoft.Extensions.Caching.Memory -->
+    <PackageVersion Include="Microsoft.Extensions.Caching.Memory" Version="8.0.1" />
+    <!-- Both Azure.Identity, Microsoft.EntityFrameworkCore.SqlServer,NPoco.SqlServer, and more bring in a vulnerable version of System.Text.Json -->
+    <PackageVersion Include="System.Text.Json" Version="8.0.6" />
+    <!-- Both Microsoft.EntityFrameworkCore.SqlServer and NPoco.SqlServer bring in a vulnerable version of Microsoft.Data.SqlClient -->
+    <PackageVersion Include="Microsoft.Data.SqlClient" Version="5.2.3" />
+  </ItemGroup>
+</Project>

build/azure-pipelines.yml

@@ -5,6 +5,10 @@ parameters:
     displayName: Run SQL Server Integration Tests
     type: boolean
     default: false
+  - name: sqlServerAcceptanceTests
+    displayName: Run SQL Server Acceptance Tests
+    type: boolean
+    default: false
   - name: myGetDeploy
     displayName: Deploy to MyGet
     type: boolean
@@ -21,11 +25,37 @@ parameters:
     displayName: Upload API docs
     type: boolean
     default: false
+  - name: uploadDependencyTrack
+    displayName: Upload BOMs to Dependency Track
+    type: boolean
+    default: false
+  - name: forceReleaseTestFilter
+    displayName: Force to use the release test filters
+    type: boolean
+    default: false
+  - name: integrationNonReleaseTestFilter
+    displayName: TestFilter used for non-release type builds
+    type: string
+    default: '--filter TestCategory!=LongRunning&TestCategory!=NonCritical'
+  - name: integrationReleaseTestFilter
+    displayName: TestFilter used for release type builds
+    type: string
+    default: ' '
+  - name: nonWindowsIntegrationNonReleaseTestFilter
+    displayName: TestFilter used for non-release type builds on non Windows agents
+    type: string
+    default: '--filter TestCategory!=LongRunning&TestCategory!=NonCritical'
+  - name: nonWindowsIntegrationReleaseTestFilter
+    displayName: TestFilter used for release type builds on non Windows agents
+    type: string
+    default: ' '
+  - name: isNightly
+    displayName: 'Is nightly build (used for MyGet feed)'
+    type: boolean
+    default: false
 
 variables:
-  nodeVersion: 16.17.0
-  dotnetVersion: 7.x
-  dotnetIncludePreviewVersions: true
+  nodeVersion: 20
   solution: umbraco.sln
   buildConfiguration: Release
   UMBRACO__CMS__GLOBAL__ID: 00000000-0000-0000-0000-000000000042
@@ -45,10 +75,15 @@ stages:
       - job: A
         displayName: Build Umbraco CMS
         pool:
-          vmImage: 'ubuntu-latest'
+          vmImage: 'windows-latest'
         steps:
+          - checkout: self
+            submodules: false
+            lfs: false,
+            fetchDepth: 500
           - task: NodeTool@0
             displayName: Use Node.js $(nodeVersion)
+            retryCountOnTaskFailure: 3
             inputs:
               versionSpec: $(nodeVersion)
           - task: Cache@2
@@ -61,47 +96,56 @@ stages:
               path: $(npm_config_cache)
           - script: npm ci --no-fund --no-audit --prefer-offline
             workingDirectory:  src/Umbraco.Web.UI.Client
-            displayName: Run npm ci
+            displayName: Run npm ci (Backoffice)
+          - powershell: |
+              npm install --global @cyclonedx/cyclonedx-npm
+              cyclonedx-npm -o $(Build.ArtifactStagingDirectory)\bom\bom-backoffice.xml --ignore-npm-errors --verbose
+            displayName: Generate Backoffice UI BOM
+            workingDirectory: src/Umbraco.Web.UI.Client
           - task: gulp@0
-            displayName: Run gulp build
+            displayName: Run gulp build (Backoffice)
             inputs:
               gulpFile: src/Umbraco.Web.UI.Client/gulpfile.js
               targets: coreBuild
               workingDirectory: src/Umbraco.Web.UI.Client
-          - task: UseDotNet@2
-            displayName: Use .NET $(dotnetVersion)
+          - task: npm@1
+            displayName: Run npm ci (Login)
             inputs:
-              version: $(dotnetVersion)
-              includePreviewVersions: $(dotnetIncludePreviewVersions)
+              command: custom
+              workingDir: src/Umbraco.Web.UI.Login
+              verbose: false
+              customCommand: ci
+          - powershell: |
+              cyclonedx-npm -o $(Build.ArtifactStagingDirectory)\bom\bom-login.xml --ignore-npm-errors --verbose
+            displayName: Generate Login UI BOM
+            workingDirectory: src/Umbraco.Web.UI.Login
+          - task: npm@1
+            displayName: Run npm build (Login)
+            inputs:
+              command: custom
+              workingDir: src/Umbraco.Web.UI.Login
+              verbose: false
+              customCommand: run build
+          - task: UseDotNet@2
+            displayName: Use .NET SDK from global.json
+            inputs:
+              useGlobalJson: true
           - task: DotNetCoreCLI@2
             displayName: Run dotnet restore
             inputs:
               command: restore
               projects: $(solution)
           - task: DotNetCoreCLI@2
-            displayName: Run dotnet build
+            name: build
+            displayName: Run dotnet build and generate NuGet packages
             inputs:
               command: build
               projects: $(solution)
-              arguments: '--configuration $(buildConfiguration) --no-restore -p:ContinuousIntegrationBuild=true'
-          - script: |
-              version="$(Build.BuildNumber)"
-              echo "Version: $version"
-
-              major="$(echo $version | cut -d '.' -f 1)"
-              echo "Major version: $major"
-
-              echo "##vso[task.setvariable variable=majorVersion;isOutput=true]$major"
-            displayName: Set major version
-            name: determineMajorVersion
-          - script: dotnet pack $(solution) --configuration $(buildConfiguration) --no-build --property:PackageOutputPath=$(Build.ArtifactStagingDirectory)/nupkg
-            displayName: Run dotnet pack
-          - script: |
-              sha="$(Build.SourceVersion)"
-              sha=${sha:0:7}
-              buildnumber="$(Build.BuildNumber)_$(Build.BuildId)_$sha"
-              echo "##vso[build.updatebuildnumber]$buildnumber"
-            displayName: Update build number
+              arguments: '--configuration $(buildConfiguration) --no-restore --property:ContinuousIntegrationBuild=true --property:GeneratePackageOnBuild=true --property:PackageOutputPath=$(Build.ArtifactStagingDirectory)/nupkg'
+          - powershell: |
+              dotnet tool install --global CycloneDX
+              dotnet-CycloneDX $(solution) --output $(Build.ArtifactStagingDirectory)/bom --filename bom-dotnet.xml
+            displayName: 'Generate Backend BOM'
           - task: PublishPipelineArtifact@1
             displayName: Publish nupkg
             inputs:
@@ -112,13 +156,42 @@ stages:
             inputs:
               targetPath: $(Build.SourcesDirectory)
               artifactName: build_output
+          - task: PublishPipelineArtifact@1
+            displayName: Publish Backend BOM
+            inputs:
+              targetPath: $(Build.ArtifactStagingDirectory)/bom
+              artifactName: bom-build
+
+  - stage: E2E_BOM
+    displayName: E2E Tests BOM Generation
+    dependsOn: []
+    jobs:
+    - job:
+      displayName: E2E Generate BOM
+      pool:
+        vmImage: "ubuntu-latest"
+      steps:
+        - checkout: self
+          fetchDepth: 500
+        - template: templates/e2e-install.yml
+          parameters:
+            nodeVersion: ${{ variables.nodeVersion }}
+            npm_config_cache: ${{ variables.npm_config_cache }}
+        - powershell: |
+            npm install --global @cyclonedx/cyclonedx-npm
+            cyclonedx-npm -o $(Build.ArtifactStagingDirectory)/bom/bom-e2e.xml --ignore-npm-errors --verbose
+          displayName: Generate E2E Tests BOM
+          workingDirectory: tests/Umbraco.Tests.AcceptanceTest
+        - publish: $(Build.ArtifactStagingDirectory)/bom
+          artifact: bom-e2e
+          displayName: 'Publish E2E BOM'
 
   - stage: Build_Docs
-    condition: and(succeeded(), or(startsWith(variables['Build.SourceBranch'], 'refs/heads/release/'), ${{parameters.buildApiDocs}}))
+    condition: and(succeeded(), or(eq(dependencies.Build.outputs['A.build.NBGV_PublicRelease'], 'True'), ${{parameters.buildApiDocs}}))
     displayName: Prepare API Documentation
     dependsOn: Build
     variables:
-      umbracoMajorVersion: $[ stageDependencies.Build.A.outputs['determineMajorVersion.majorVersion'] ]
+      umbracoMajorVersion: $[ stageDependencies.Build.A.outputs['build.NBGV_VersionMajor'] ]
     jobs:
       # C# API Reference
       - job:
@@ -126,6 +199,10 @@ stages:
         pool:
           vmImage: 'windows-latest'
         steps:
+          - task: UseDotNet@2
+            displayName: Use .NET SDK from global.json
+            inputs:
+              useGlobalJson: true
           - task: PowerShell@2
             displayName: Install DocFX
             inputs:
@@ -171,10 +248,16 @@ stages:
         pool:
           vmImage: 'ubuntu-latest'
         steps:
+          - checkout: self
+            submodules: false
+            lfs: false,
+            fetchDepth: 1
+            fetchFilter: tree:0
           - task: NodeTool@0
-            displayName: Use Node.js 10.15.0
+            displayName: Use Node.js 10.15.x
+            retryCountOnTaskFailure: 3
             inputs:
-              versionSpec: 10.15.0 # Won't work with higher versions
+              versionSpec: 10.15.x # Won't work with higher versions
           - script: |
               npm ci --no-fund --no-audit --prefer-offline
               npx gulp docs
@@ -221,27 +304,33 @@ stages:
         pool:
           vmImage: $(vmImage)
         steps:
+          - checkout: self
+            submodules: false
+            lfs: false,
+            fetchDepth: 1
+            fetchFilter: tree:0
           - task: DownloadPipelineArtifact@2
             displayName: Download build artifacts
             inputs:
               artifact: build_output
               path: $(Build.SourcesDirectory)
           - task: UseDotNet@2
-            displayName: Use .NET $(dotnetVersion)
+            displayName: Use .NET SDK from global.json
             inputs:
-              version: $(dotnetVersion)
-              includePreviewVersions: $(dotnetIncludePreviewVersions)
+              useGlobalJson: true
           - task: DotNetCoreCLI@2
             displayName: Run dotnet test
             inputs:
               command: test
-              projects: '**/*.Tests.UnitTests.csproj'
+              projects: 'tests/Umbraco.Tests.UnitTests/Umbraco.Tests.UnitTests.csproj'
               arguments: '--configuration $(buildConfiguration) --no-build'
               testRunTitle: Unit Tests - $(Agent.OS)
 
   - stage: Integration
     displayName: Integration Tests
     dependsOn: Build
+    variables:
+      releaseTestFilter: eq(dependencies.Build.outputs['A.build.NBGV_PublicRelease'], 'True')
     jobs:
       # Integration Tests (SQLite)
       - job:
@@ -256,217 +345,470 @@ stages:
               vmImage: 'macOS-latest'
         pool:
           vmImage: $(vmImage)
+        variables:
+          Tests__Database__DatabaseType: 'Sqlite'
         steps:
+          - checkout: self
+            submodules: false
+            lfs: false,
+            fetchDepth: 1
+            fetchFilter: tree:0
+          # Setup test environment
           - task: DownloadPipelineArtifact@2
             displayName: Download build artifacts
             inputs:
               artifact: build_output
               path: $(Build.SourcesDirectory)
+
           - task: UseDotNet@2
-            displayName: Use .NET $(dotnetVersion)
+            displayName: Use .NET SDK from global.json
             inputs:
-              version: $(dotnetVersion)
-              includePreviewVersions: $(dotnetIncludePreviewVersions)
+              useGlobalJson: true
+
+          # Test
           - task: DotNetCoreCLI@2
             displayName: Run dotnet test
             inputs:
               command: test
-              projects: '**/*.Tests.Integration.csproj'
-              arguments: '--configuration $(buildConfiguration) --no-build'
+              projects: 'tests/Umbraco.Tests.Integration/Umbraco.Tests.Integration.csproj'
               testRunTitle: Integration Tests SQLite - $(Agent.OS)
-            env:
-              Tests__Database__DatabaseType: 'Sqlite'
-              Umbraco__CMS__Global__MainDomLock: 'FileSystemMainDomLock'
+              ${{ if and(eq(variables['Agent.OS'],'Windows_NT'), or(variables.releaseTestFilter, parameters.forceReleaseTestFilter)) }}:
+                arguments: '--configuration $(buildConfiguration) --no-build ${{parameters.integrationReleaseTestFilter}}'
+              ${{ elseif eq(variables['Agent.OS'],'Windows_NT') }}:
+                arguments: '--configuration $(buildConfiguration) --no-build ${{parameters.integrationNonReleaseTestFilter}}'
+              ${{ elseif or(variables.releaseTestFilter, parameters.forceReleaseTestFilter) }}:
+                arguments: '--configuration $(buildConfiguration) --no-build ${{parameters.nonWindowsIntegrationReleaseTestFilter}}'
+              ${{ else }}:
+                arguments: '--configuration $(buildConfiguration) --no-build ${{parameters.nonWindowsIntegrationNonReleaseTestFilter}}'
 
       # Integration Tests (SQL Server)
       - job:
         timeoutInMinutes: 120
-        condition: or(startsWith(variables['Build.SourceBranch'], 'refs/heads/release/'), ${{parameters.sqlServerIntegrationTests}})
+        # We are currently encountering issues when running SQL Server Linux tests Microsoft.Data.SqlClient.SqlException (0x80131904)
+        # condition: or(eq(stageDependencies.Build.A.outputs['build.NBGV_PublicRelease'], 'True'), ${{parameters.sqlServerIntegrationTests}})
+        condition: eq(${{parameters.sqlServerIntegrationTests}}, True)
         displayName: Integration Tests (SQL Server)
         strategy:
           matrix:
             Windows:
               vmImage: 'windows-latest'
-              testDb: LocalDb
-              connectionString: N/A
+              Tests__Database__DatabaseType: LocalDb
+              Tests__Database__SQLServerMasterConnectionString: N/A
             Linux:
               vmImage: 'ubuntu-latest'
-              testDb: SqlServer
-              connectionString: 'Server=localhost,1433;User Id=sa;Password=$(SA_PASSWORD);TrustServerCertificate=true'
+              SA_PASSWORD: UmbracoIntegration123!
+              Tests__Database__DatabaseType: SqlServer
+              Tests__Database__SQLServerMasterConnectionString: 'Server=(local);User Id=sa;Password=$(SA_PASSWORD);TrustServerCertificate=True'
         pool:
           vmImage: $(vmImage)
-        variables:
-          SA_PASSWORD: UmbracoIntegration123!
         steps:
+          # Setup test environment
           - task: DownloadPipelineArtifact@2
             displayName: Download build artifacts
             inputs:
               artifact: build_output
               path: $(Build.SourcesDirectory)
+
           - task: UseDotNet@2
-            displayName: Use .NET $(dotnetVersion)
+            displayName: Use .NET SDK from global.json
             inputs:
-              version: $(dotnetVersion)
-              includePreviewVersions: $(dotnetIncludePreviewVersions)
-          - powershell: sqllocaldb start mssqllocaldb
-            displayName: Start localdb (Windows only)
-            condition: and(succeeded(), eq(variables['Agent.OS'], 'Windows_NT'))
-          - powershell: docker run --name mssql -d -p 1433:1433 -e ACCEPT_EULA=Y -e SA_PASSWORD=$(SA_PASSWORD) -e MSSQL_PID=Developer mcr.microsoft.com/mssql/server:2019-latest
-            displayName: Start SQL Server (Linux only)
+              useGlobalJson: true
+
+          # Start SQL Server
+          - powershell: docker run --name mssql -d -p 1433:1433 -e "ACCEPT_EULA=Y" -e "MSSQL_SA_PASSWORD=$(SA_PASSWORD)" mcr.microsoft.com/mssql/server:2022-latest
+            displayName: Start SQL Server Docker image (Linux)
             condition: and(succeeded(), eq(variables['Agent.OS'], 'Linux'))
+
+          - pwsh: SqlLocalDB start MSSQLLocalDB
+            displayName: Start SQL Server LocalDB (Windows)
+            condition: and(succeeded(), eq(variables['Agent.OS'], 'Windows_NT'))
+
+          # Test
           - task: DotNetCoreCLI@2
             displayName: Run dotnet test
             inputs:
               command: test
-              projects: '**/*.Tests.Integration.csproj'
-              arguments: '--configuration $(buildConfiguration) --no-build'
+              projects: 'tests/Umbraco.Tests.Integration/Umbraco.Tests.Integration.csproj'
               testRunTitle: Integration Tests SQL Server - $(Agent.OS)
-            env:
-              Tests__Database__DatabaseType: $(testDb)
-              Tests__Database__SQLServerMasterConnectionString: $(connectionString)
-              Umbraco__CMS__Global__MainDomLock: 'SqlMainDomLock'
+              ${{ if and(eq(variables['Agent.OS'],'Windows_NT'), or(variables.releaseTestFilter, parameters.forceReleaseTestFilter)) }}:
+                arguments: '--configuration $(buildConfiguration) --no-build ${{parameters.integrationReleaseTestFilter}}'
+              ${{ elseif eq(variables['Agent.OS'],'Windows_NT') }}:
+                arguments: '--configuration $(buildConfiguration) --no-build ${{parameters.integrationNonReleaseTestFilter}}'
+              ${{ elseif or(variables.releaseTestFilter, parameters.forceReleaseTestFilter) }}:
+                arguments: '--configuration $(buildConfiguration) --no-build ${{parameters.nonWindowsIntegrationReleaseTestFilter}}'
+              ${{ else }}:
+                arguments: '--configuration $(buildConfiguration) --no-build ${{parameters.nonWindowsIntegrationNonReleaseTestFilter}}'
+
+          # Stop SQL Server
+          - pwsh: docker stop mssql
+            displayName: Stop SQL Server Docker image (Linux)
+            condition: and(succeeded(), eq(variables['Agent.OS'], 'Linux'))
+
+          - pwsh: SqlLocalDB stop MSSQLLocalDB
+            displayName: Stop SQL Server LocalDB (Windows)
+            condition: and(succeeded(), eq(variables['Agent.OS'], 'Windows_NT'))
 
   - stage: E2E
-    variables:
-      npm_config_cache: $(Pipeline.Workspace)/.npm_e2e
     displayName: E2E Tests
     dependsOn: Build
+    variables:
+      npm_config_cache: $(Pipeline.Workspace)/.npm_e2e
+      # Enable console logging in Release mode
+      SERILOG__WRITETO__0__NAME: Async
+      SERILOG__WRITETO__0__ARGS__CONFIGURE__0__NAME: Console
+      # Set unattended install settings
+      UMBRACO__CMS__UNATTENDED__INSTALLUNATTENDED: true
+      UMBRACO__CMS__UNATTENDED__UNATTENDEDUSERNAME: Playwright Test
+      UMBRACO__CMS__UNATTENDED__UNATTENDEDUSERPASSWORD: UmbracoAcceptance123!
+      UMBRACO__CMS__UNATTENDED__UNATTENDEDUSEREMAIL: playwright@umbraco.com
+      # Custom Umbraco settings
+      UMBRACO__CMS__CONTENT__CONTENTVERSIONCLEANUPPOLICY__ENABLECLEANUP: false
+      UMBRACO__CMS__GLOBAL__DISABLEELECTIONFORSINGLESERVER: true
+      UMBRACO__CMS__GLOBAL__INSTALLMISSINGDATABASE: true
+      UMBRACO__CMS__GLOBAL__ID: 00000000-0000-0000-0000-000000000042
+      UMBRACO__CMS__GLOBAL__VERSIONCHECKPERIOD: 0
+      UMBRACO__CMS__GLOBAL__USEHTTPS: true
+      UMBRACO__CMS__HEALTHCHECKS__NOTIFICATION__ENABLED: false
+      UMBRACO__CMS__KEEPALIVE__DISABLEKEEPALIVETASK: true
+      UMBRACO__CMS__WEBROUTING__UMBRACOAPPLICATIONURL: https://localhost:44331/
+      ASPNETCORE_URLS: https://localhost:44331
     jobs:
       # E2E Tests
       - job:
-        displayName: E2E Tests
+        displayName: E2E Tests (SQLite)
         variables:
-          Umbraco__CMS__Unattended__UnattendedUserName: Playwright Test
-          Umbraco__CMS__Unattended__UnattendedUserPassword: UmbracoAcceptance123!
-          Umbraco__CMS__Unattended__UnattendedUserEmail: playwright@umbraco.com
-          ASPNETCORE_URLS: https://localhost:8443
+          # Connection string
+          CONNECTIONSTRINGS__UMBRACODBDSN: Data Source=Umbraco;Mode=Memory;Cache=Shared;Foreign Keys=True;Pooling=True
+          CONNECTIONSTRINGS__UMBRACODBDSN_PROVIDERNAME: Microsoft.Data.Sqlite
         strategy:
           matrix:
-            Linux:
-              vmImage: 'ubuntu-latest'
-              dockerfile: umbraco-linux.docker
-              dockerImageName: umbraco-linux
-            Windows:
-              vmImage: 'windows-latest'
-              DOTNET_GENERATE_ASPNET_CERTIFICATE: true # Automatically generate HTTPS development certificate on Windows
-              # Enable console logging in Release mode
-              Serilog__WriteTo__0__Name: Async
-              Serilog__WriteTo__0__Args__configure__0__Name: Console
-              # Set unattended install settings
-              Umbraco__CMS__Unattended__InstallUnattended: true
-              Umbraco__CMS__Global__InstallMissingDatabase: true
-              UmbracoDatabaseServer: (LocalDB)\MSSQLLocalDB
-              UmbracoDatabaseName: Playwright
-              ConnectionStrings__umbracoDbDSN: Server=$(UmbracoDatabaseServer);Database=$(UmbracoDatabaseName);Integrated Security=true;
-              # Custom Umbraco settings
-              Umbraco__CMS__Global__VersionCheckPeriod: 0
-              Umbraco__CMS__Global__UseHttps: true
-              Umbraco__CMS__HealthChecks__Notification__Enabled: false
-              Umbraco__CMS__KeepAlive__DisableKeepAliveTask: true
+            LinuxPart1Of3:
+              vmImage: "ubuntu-latest"
+              testCommand: "npm run test -- --shard=1/3"
+            LinuxPart2Of3:
+              vmImage: "ubuntu-latest"
+              testCommand: "npm run test -- --shard=2/3"
+            LinuxPart3Of3:
+              vmImage: "ubuntu-latest"
+              testCommand: "npm run test -- --shard=3/3"
+            WindowsPart1Of3:
+              vmImage: "windows-latest"
+              testCommand: "npm run test -- --shard=1/3"
+            WindowsPart2Of3:
+              vmImage: "windows-latest"
+              testCommand: "npm run test -- --shard=2/3"
+            WindowsPart3Of3:
+              vmImage: "windows-latest"
+              testCommand: "npm run test -- --shard=3/3"
         pool:
           vmImage: $(vmImage)
         steps:
+          # Setup test environment
           - task: DownloadPipelineArtifact@2
-            displayName: Download nupkg
+            displayName: Download NuGet artifacts
             inputs:
               artifact: nupkg
-              path: $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/misc/nupkg
-          - task: NodeTool@0
-            displayName: Use Node.js $(nodeVersion)
-            inputs:
-              versionSpec: $(nodeVersion)
-          - task: Cache@2
-            displayName: Cache node_modules
-            inputs:
-              key: '"npm_e2e" | "$(Agent.OS)" | $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/package-lock.json'
-              restoreKeys: |
-                "npm_e2e" | "$(Agent.OS)"
-                "npm_e2e"
-              path: $(npm_config_cache)
-          - pwsh: |
-              New-Item -Path "." -Name ".env" -ItemType "file" -Value "UMBRACO_USER_LOGIN=$(Umbraco__CMS__Unattended__UnattendedUserEmail)
-              UMBRACO_USER_PASSWORD=$(Umbraco__CMS__Unattended__UnattendedUserPassword)
-              URL=$(ASPNETCORE_URLS)"
-            displayName: Generate .env
-            workingDirectory: $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/
-          - script: npm ci --no-fund --no-audit --prefer-offline
-            workingDirectory: $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/
-            displayName: Run npm ci
-          - pwsh: sqllocaldb start mssqllocaldb
-            displayName: Start localdb (Windows only)
-            condition: and(succeeded(), eq(variables['Agent.OS'], 'Windows_NT'))
-          - pwsh: Invoke-Sqlcmd -Query "CREATE DATABASE $env:UmbracoDatabaseName" -ServerInstance $env:UmbracoDatabaseServer
-            displayName: Create database (Windows only)
-            condition: and(succeeded(), eq(variables['Agent.OS'], 'Windows_NT'))
+              path: $(Agent.BuildDirectory)/app/nupkg
+
           - task: UseDotNet@2
-            displayName: Use .NET $(dotnetVersion)
+            displayName: Use .NET SDK from global.json
             inputs:
-              version: $(dotnetVersion)
-              includePreviewVersions: $(dotnetIncludePreviewVersions)
+              useGlobalJson: true
+
+          - template: templates/e2e-install.yml
+            parameters:
+              nodeVersion: $(nodeVersion)
+              npm_config_cache: $(npm_config_cache)
+              PlaywrightUserEmail: $(UMBRACO__CMS__UNATTENDED__UNATTENDEDUSEREMAIL)
+              PlaywrightPassword: $(UMBRACO__CMS__UNATTENDED__UNATTENDEDUSERPASSWORD)
+              ASPNETCORE_URLS: $(ASPNETCORE_URLS)
+
+          # Build application
           - pwsh: |
-              $sha = 'g$(Build.SourceVersion)'.substring(0, 8)
-              docker build -t $(dockerImageName):$sha -f $(dockerfile) .
-              mkdir -p $(Build.ArtifactStagingDirectory)/docker-images
-              docker save -o $(Build.ArtifactStagingDirectory)/docker-images/$(dockerImageName).$sha.tar $(dockerImageName):$sha
-              dotnet dev-certs https -ep ${HOME}/.aspnet/https/aspnetapp.pfx -p $(Umbraco__CMS__Unattended__UnattendedUserPassword)
-              docker run --name $(dockerImageName) -dp 8080:5000 -dp 8443:5001 -e UMBRACO__CMS__GLOBAL__ID=$(UMBRACO__CMS__GLOBAL__ID) -e ASPNETCORE_Kestrel__Certificates__Default__Password="$(Umbraco__CMS__Unattended__UnattendedUserPassword)" -e ASPNETCORE_Kestrel__Certificates__Default__Path=/https/aspnetapp.pfx -v ${HOME}/.aspnet/https:/https/ $(dockerImageName):$sha
-              docker ps
-            condition: and(succeeded(), eq(variables['Agent.OS'], 'Linux'))
-            displayName: Build and run container (Linux only)
-            workingDirectory: tests/Umbraco.Tests.AcceptanceTest/misc
-          - pwsh: |
-              dotnet new --install ./nupkg/Umbraco.Templates.*.nupkg
-              dotnet new umbraco --name Playwright --no-restore --output .
-              dotnet restore --configfile ./nuget.config
-              dotnet build --configuration $(buildConfiguration) --no-restore
+              $cmsVersion = "$(Build.BuildNumber)" -replace "\+",".g"
+              dotnet new nugetconfig
+              dotnet nuget add source ./nupkg --name Local
+              dotnet new install Umbraco.Templates::$cmsVersion
+              dotnet new umbraco --name UmbracoProject --version $cmsVersion --exclude-gitignore --no-restore --no-update-check
+              dotnet restore UmbracoProject
+              cp $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest.UmbracoProject/*.cs UmbracoProject
+              dotnet build UmbracoProject --configuration $(buildConfiguration) --no-restore
               dotnet dev-certs https
-              $process = Start-Process -FilePath "dotnet" -ArgumentList "run --configuration $(buildConfiguration) --no-build --no-launch-profile 2>&1" -PassThru -RedirectStandardOutput $(Build.ArtifactStagingDirectory)/playwright.log
+            displayName: Build application
+            workingDirectory: $(Agent.BuildDirectory)/app
+
+          # Run application
+          - bash: |
+              nohup dotnet run --project UmbracoProject --configuration $(buildConfiguration) --no-build --no-launch-profile > $(Build.ArtifactStagingDirectory)/playwright.log 2>&1 &
+              echo "##vso[task.setvariable variable=AcceptanceTestProcessId]$!"
+            displayName: Run application (Linux)
+            condition: and(succeeded(), eq(variables['Agent.OS'], 'Linux'))
+            workingDirectory: $(Agent.BuildDirectory)/app
+
+          - pwsh: |
+              $process = Start-Process dotnet "run --project UmbracoProject --configuration $(buildConfiguration) --no-build --no-launch-profile 2>&1" -PassThru -NoNewWindow -RedirectStandardOutput $(Build.ArtifactStagingDirectory)/playwright.log
               Write-Host "##vso[task.setvariable variable=AcceptanceTestProcessId]$($process.Id)"
+            displayName: Run application (Windows)
             condition: and(succeeded(), eq(variables['Agent.OS'], 'Windows_NT'))
-            displayName: Build and run app (Windows only)
-            workingDirectory: tests/Umbraco.Tests.AcceptanceTest/misc
+            workingDirectory: $(Agent.BuildDirectory)/app
+
+          # Wait for application to start responding to requests
           - pwsh: npx wait-on -v --interval 1000 --timeout 120000 $(ASPNETCORE_URLS)
-            displayName: Wait for app
+            displayName: Wait for application
             workingDirectory: tests/Umbraco.Tests.AcceptanceTest
-          - pwsh: npx playwright install --with-deps
-            displayName: Install Playwright
+
+          # Install Playwright and dependencies
+          - pwsh: npx playwright install chromium
+            displayName: Install Playwright only with Chromium browser
             workingDirectory: tests/Umbraco.Tests.AcceptanceTest
-          - pwsh: npm run test --ignore-certificate-errors
-            displayName: Run Playwright (Desktop)
+
+          # Test
+          - pwsh: $(testCommand)
+            displayName: Run Playwright tests
             continueOnError: true
             workingDirectory: tests/Umbraco.Tests.AcceptanceTest
             env:
               CI: true
               CommitId: $(Build.SourceVersion)
               AgentOs: $(Agent.OS)
+
+          # Stop application
+          - bash: kill -15 $(AcceptanceTestProcessId)
+            displayName: Stop application (Linux)
+            condition: and(succeeded(), ne(variables.AcceptanceTestProcessId, ''), eq(variables['Agent.OS'], 'Linux'))
+
+          - pwsh: Stop-Process -Id $(AcceptanceTestProcessId)
+            displayName: Stop application (Windows)
+            condition: and(succeeded(), ne(variables.AcceptanceTestProcessId, ''), eq(variables['Agent.OS'], 'Windows_NT'))
+
+          # Copy artifacts
           - pwsh: |
-              docker logs $(dockerImageName) > $(Build.ArtifactStagingDirectory)/playwright.log 2>&1
-              docker stop $(dockerImageName)
-            condition: eq(variables['Agent.OS'], 'Linux')
-            displayName: Stop app (Linux only)
-          - pwsh: Stop-Process $env:AcceptanceTestProcessId
-            condition: eq(variables['Agent.OS'], 'Windows_NT')
-            displayName: Stop app (Windows only)
-          - task: PowerShell@2
-            displayName: Check if artifacts folder exists
-            inputs:
-              targetType: inline
-              script: |
-                $MyVariable = Test-Path -Path $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/results
-                Write-Host "##vso[task.setvariable variable=resultFolderExists;]$MyVariable"
-          - task: CopyFiles@2
-            displayName: Prepare artifacts
-            condition: eq(variables.resultFolderExists, 'True')
-            inputs:
-              sourceFolder: $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/results/
-              targetFolder: $(Build.ArtifactStagingDirectory)/playwright
+              if (Test-Path tests/Umbraco.Tests.AcceptanceTest/results/*) {
+                Copy-Item tests/Umbraco.Tests.AcceptanceTest/results/* $(Build.ArtifactStagingDirectory) -Recurse
+              }
+            displayName: Copy Playwright results
+            condition: succeededOrFailed()
+
+          # Publish test artifacts
           - task: PublishPipelineArtifact@1
-            condition: always()
             displayName: Publish test artifacts
+            condition: succeededOrFailed()
             inputs:
               targetPath: $(Build.ArtifactStagingDirectory)
-              artifact: 'E2E artifacts - $(Agent.OS) - Attempt #$(System.JobAttempt)'
+              artifact: "Acceptance Test Results - $(Agent.JobName) - Attempt #$(System.JobAttempt)"
 
+          # Publish test results
+          - task: PublishTestResults@2
+            displayName: "Publish test results"
+            condition: succeededOrFailed()
+            inputs:
+              testResultsFormat: 'JUnit'
+              testResultsFiles: '*.xml'
+              searchFolder: "tests/Umbraco.Tests.AcceptanceTest/results"
+              testRunTitle: "$(Agent.JobName)"
+
+      - job:
+        displayName: E2E Tests (SQL Server)
+        condition: or(eq(stageDependencies.Build.A.outputs['build.NBGV_PublicRelease'], 'True'), ${{parameters.sqlServerAcceptanceTests}})
+        variables:
+          # Connection string
+          CONNECTIONSTRINGS__UMBRACODBDSN: Data Source=(localdb)\MSSQLLocalDB;AttachDbFilename=|DataDirectory|\Umbraco.mdf;Integrated Security=True
+          CONNECTIONSTRINGS__UMBRACODBDSN_PROVIDERNAME: Microsoft.Data.SqlClient
+        strategy:
+          matrix:
+            LinuxPart1Of3:
+              testCommand: "npm run testSqlite -- --shard=1/3"
+              vmImage: "ubuntu-latest"
+              SA_PASSWORD: $(UMBRACO__CMS__UNATTENDED__UNATTENDEDUSERPASSWORD)
+              CONNECTIONSTRINGS__UMBRACODBDSN: "Server=(local);Database=Umbraco;User Id=sa;Password=$(SA_PASSWORD);TrustServerCertificate=True"
+            LinuxPart2Of3:
+              testCommand: "npm run testSqlite -- --shard=2/3"
+              vmImage: "ubuntu-latest"
+              SA_PASSWORD: $(UMBRACO__CMS__UNATTENDED__UNATTENDEDUSERPASSWORD)
+              CONNECTIONSTRINGS__UMBRACODBDSN: "Server=(local);Database=Umbraco;User Id=sa;Password=$(SA_PASSWORD);TrustServerCertificate=True"
+            LinuxPart3Of3:
+              testCommand: "npm run testSqlite -- --shard=3/3"
+              vmImage: "ubuntu-latest"
+              SA_PASSWORD: $(UMBRACO__CMS__UNATTENDED__UNATTENDEDUSERPASSWORD)
+              CONNECTIONSTRINGS__UMBRACODBDSN: "Server=(local);Database=Umbraco;User Id=sa;Password=$(SA_PASSWORD);TrustServerCertificate=True"
+            WindowsPart1Of3:
+              vmImage: "windows-latest"
+              testCommand: "npm run testSqlite -- --shard=1/3"
+            WindowsPart2Of3:
+              vmImage: "windows-latest"
+              testCommand: "npm run testSqlite -- --shard=2/3"
+            WindowsPart3Of3:
+              vmImage: "windows-latest"
+              testCommand: "npm run testSqlite -- --shard=3/3"
+        pool:
+          vmImage: $(vmImage)
+        steps:
+          # Setup test environment
+          - task: DownloadPipelineArtifact@2
+            displayName: Download NuGet artifacts
+            inputs:
+              artifact: nupkg
+              path: $(Agent.BuildDirectory)/app/nupkg
+
+          - task: NodeTool@0
+            displayName: Use Node.js $(nodeVersion)
+            inputs:
+              versionSpec: $(nodeVersion)
+
+          - task: UseDotNet@2
+            displayName: Use .NET SDK from global.json
+            inputs:
+              useGlobalJson: true
+
+          - pwsh: |
+              "UMBRACO_USER_LOGIN=$(UMBRACO__CMS__UNATTENDED__UNATTENDEDUSEREMAIL)
+              UMBRACO_USER_PASSWORD=$(UMBRACO__CMS__UNATTENDED__UNATTENDEDUSERPASSWORD)
+              URL=$(ASPNETCORE_URLS)" | Out-File .env
+            displayName: Generate .env
+            workingDirectory: $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest
+
+          # Cache and restore NPM packages
+          - task: Cache@2
+            displayName: Cache NPM packages
+            inputs:
+              key: 'npm_e2e | "$(Agent.OS)" | $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/package-lock.json'
+              restoreKeys: |
+                npm_e2e | "$(Agent.OS)"
+                npm_e2e
+              path: $(npm_config_cache)
+
+          - script: npm ci --no-fund --no-audit --prefer-offline
+            workingDirectory: $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest
+            displayName: Restore NPM packages
+
+          # Build application
+          - pwsh: |
+              $cmsVersion = "$(Build.BuildNumber)" -replace "\+",".g"
+              dotnet new nugetconfig
+              dotnet nuget add source ./nupkg --name Local
+              dotnet new install Umbraco.Templates::$cmsVersion
+              dotnet new umbraco --name UmbracoProject --version $cmsVersion --exclude-gitignore --no-restore --no-update-check
+              dotnet restore UmbracoProject
+              cp $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest.UmbracoProject/*.cs UmbracoProject
+              dotnet build UmbracoProject --configuration $(buildConfiguration) --no-restore
+              dotnet dev-certs https
+            displayName: Build application
+            workingDirectory: $(Agent.BuildDirectory)/app
+
+          # Start SQL Server
+          - powershell: docker run --name mssql -d -p 1433:1433 -e "ACCEPT_EULA=Y" -e "MSSQL_SA_PASSWORD=$(SA_PASSWORD)" mcr.microsoft.com/mssql/server:2022-latest
+            displayName: Start SQL Server Docker image (Linux)
+            condition: and(succeeded(), eq(variables['Agent.OS'], 'Linux'))
+
+          - pwsh: SqlLocalDB start MSSQLLocalDB
+            displayName: Start SQL Server LocalDB (Windows)
+            condition: and(succeeded(), eq(variables['Agent.OS'], 'Windows_NT'))
+
+          # Run application
+          - bash: |
+              nohup dotnet run --project UmbracoProject --configuration $(buildConfiguration) --no-build --no-launch-profile > $(Build.ArtifactStagingDirectory)/playwright.log 2>&1 &
+              echo "##vso[task.setvariable variable=AcceptanceTestProcessId]$!"
+            displayName: Run application (Linux)
+            condition: and(succeeded(), eq(variables['Agent.OS'], 'Linux'))
+            workingDirectory: $(Agent.BuildDirectory)/app
+
+          - pwsh: |
+              $process = Start-Process dotnet "run --project UmbracoProject --configuration $(buildConfiguration) --no-build --no-launch-profile 2>&1" -PassThru -NoNewWindow -RedirectStandardOutput $(Build.ArtifactStagingDirectory)/playwright.log
+              Write-Host "##vso[task.setvariable variable=AcceptanceTestProcessId]$($process.Id)"
+            displayName: Run application (Windows)
+            condition: and(succeeded(), eq(variables['Agent.OS'], 'Windows_NT'))
+            workingDirectory: $(Agent.BuildDirectory)/app
+
+          # Wait for application to start responding to requests
+          - pwsh: npx wait-on -v --interval 1000 --timeout 120000 $(ASPNETCORE_URLS)
+            displayName: Wait for application
+            workingDirectory: tests/Umbraco.Tests.AcceptanceTest
+
+          # Install Playwright and dependencies
+          - pwsh: npx playwright install chromium
+            displayName: Install Playwright only with Chromium browser
+            workingDirectory: tests/Umbraco.Tests.AcceptanceTest
+
+          # Test
+          - pwsh: $(testCommand)
+            displayName: Run Playwright tests
+            workingDirectory: tests/Umbraco.Tests.AcceptanceTest
+            env:
+              CI: true
+              CommitId: $(Build.SourceVersion)
+              AgentOs: $(Agent.OS)
+
+          # Stop application
+          - bash: kill -15 $(AcceptanceTestProcessId)
+            displayName: Stop application (Linux)
+            condition: and(succeeded(), ne(variables.AcceptanceTestProcessId, ''), eq(variables['Agent.OS'], 'Linux'))
+
+          - pwsh: Stop-Process -Id $(AcceptanceTestProcessId)
+            displayName: Stop application (Windows)
+            condition: and(succeeded(), ne(variables.AcceptanceTestProcessId, ''), eq(variables['Agent.OS'], 'Windows_NT'))
+
+          # Stop SQL Server
+          - pwsh: docker stop mssql
+            displayName: Stop SQL Server Docker image (Linux)
+            condition: and(succeeded(), eq(variables['Agent.OS'], 'Linux'))
+
+          - pwsh: SqlLocalDB stop MSSQLLocalDB
+            displayName: Stop SQL Server LocalDB (Windows)
+            condition: and(succeeded(), eq(variables['Agent.OS'], 'Windows_NT'))
+
+          # Copy artifacts
+          - pwsh: |
+              if (Test-Path tests/Umbraco.Tests.AcceptanceTest/results/*) {
+                Copy-Item tests/Umbraco.Tests.AcceptanceTest/results/* $(Build.ArtifactStagingDirectory) -Recurse
+              }
+            displayName: Copy Playwright results
+            condition: succeededOrFailed()
+
+          # Publish test artifacts
+          - task: PublishPipelineArtifact@1
+            displayName: Publish test artifacts
+            condition: succeededOrFailed()
+            inputs:
+              targetPath: $(Build.ArtifactStagingDirectory)
+              artifact: "Acceptance Test Results - $(Agent.JobName) - Attempt #$(System.JobAttempt)"
+
+          # Publish test results
+          - task: PublishTestResults@2
+            displayName: "Publish test results"
+            condition: succeededOrFailed()
+            inputs:
+              testResultsFormat: 'JUnit'
+              testResultsFiles: '*.xml'
+              searchFolder: "tests/Umbraco.Tests.AcceptanceTest/results"
+              testRunTitle: "$(Agent.JobName)"
+
+  - stage: Dependency_Track
+    displayName: Dependency Track
+    dependsOn:
+      - Build
+      - E2E_BOM
+    condition: and(succeeded(), or(eq(dependencies.Build.outputs['A.build.NBGV_PublicRelease'], 'True'), ${{parameters.uploadDependencyTrack}}))
+    variables:
+      # Determine Umbraco version based on whether it's a public release or not. If public release, use major version, else use full NuGet package version.
+      umbracoVersion: $[ iif(eq(stageDependencies.Build.A.outputs['build.NBGV_PublicRelease'], 'True'), stageDependencies.Build.A.outputs['build.NBGV_VersionMajor'], stageDependencies.Build.A.outputs['build.NBGV_NuGetPackageVersion']) ]
+    jobs:
+      - template: templates/dependency-track.yml
+        parameters:
+          projectName: "Umbraco-CMS"
+          umbracoVersion: $(umbracoVersion)
+          projects:
+            - name: "Backend"
+              artifact: "bom-build"
+              bomFilePath: "bom-dotnet.xml"
+            - name: "Login"
+              artifact: "bom-build"
+              bomFilePath: "bom-login.xml"
+            - name: "Backoffice"
+              artifact: "bom-build"
+              bomFilePath: "bom-backoffice.xml"
+            - name: "E2E"
+              artifact: "bom-e2e"
+              bomFilePath: "bom-e2e.xml"
 
   ###############################################
   ## Release
@@ -477,9 +819,11 @@ stages:
       - Unit
       - Integration
       # - E2E # TODO: Enable when stable.
-    condition: and(succeeded(), or(startsWith(variables['Build.SourceBranch'], 'refs/heads/release/'), ${{parameters.myGetDeploy}}))
+    condition: and(succeeded(), or(eq(dependencies.Build.outputs['A.build.NBGV_PublicRelease'], 'True'), ${{parameters.myGetDeploy}}))
     jobs:
       - job:
+        pool:
+          vmImage: "windows-latest" # NuGetCommand@2 is no longer supported on Ubuntu 24.04 so we'll use windows until an alternative is available.
         displayName: Push to pre-release feed
         steps:
           - checkout: none
@@ -494,15 +838,20 @@ stages:
               command: 'push'
               packagesToPush: $(Build.ArtifactStagingDirectory)/**/*.nupkg
               nuGetFeedType: 'external'
-              publishFeedCredentials: 'MyGet - Pre-releases'
+              ${{ if eq(parameters.isNightly, true) }}:
+                publishFeedCredentials: 'MyGet - Umbraco Nightly'
+              ${{ else }}:
+                publishFeedCredentials: 'MyGet - Pre-releases'
   - stage: Deploy_NuGet
     displayName: NuGet release
     dependsOn:
       - Deploy_MyGet
       - Build_Docs
-    condition: and(succeeded(), or(startsWith(variables['Build.SourceBranch'], 'refs/heads/release/'), ${{parameters.nuGetDeploy}}))
+    condition: and(succeeded(), or(eq(dependencies.Build.outputs['A.build.NBGV_PublicRelease'], 'True'), ${{parameters.nuGetDeploy}}))
     jobs:
       - job:
+        pool:
+          vmImage: "windows-latest" # NuGetCommand@2 is no longer supported on Ubuntu 24.04 so we'll use windows until an alternative is available.
         displayName: Push to NuGet
         steps:
           - checkout: none
@@ -523,12 +872,12 @@ stages:
     pool:
       vmImage: 'windows-latest' # Apparently AzureFileCopy is windows only :(
     variables:
-      umbracoMajorVersion:  $[ stageDependencies.Build.A.outputs['determineMajorVersion.majorVersion'] ]
+      umbracoMajorVersion: $[ stageDependencies.Build.A.outputs['build.NBGV_VersionMajor'] ]
     displayName: Upload API Documention
     dependsOn:
       - Build
       - Deploy_NuGet
-    condition: and(succeeded(), or(startsWith(variables['Build.SourceBranch'], 'refs/heads/release/'), ${{parameters.uploadApiDocs}}))
+    condition: and(succeeded(), or(eq(dependencies.Build.outputs['A.build.NBGV_PublicRelease'], 'True'), ${{parameters.uploadApiDocs}}))
     jobs:
       - job:
         displayName: Upload C# Docs

build/nightly-build-trigger.yml

@@ -0,0 +1,35 @@
+name: Nightly_$(TeamProject)_$(Build.DefinitionName)_$(SourceBranchName)_$(Date:yyyyMMdd)$(Rev:.r)
+
+pr: none
+trigger: none
+
+schedules:
+- cron: '0 0 * * *'
+  displayName: Daily midnight build
+  branches:
+    include:
+    - v10/dev
+    - v12/dev
+    - v13/dev
+    - v14/dev
+
+steps:
+- checkout: none
+- task: TriggerBuild@4
+  inputs:
+    definitionIsInCurrentTeamProject: true
+    buildDefinition: '301'
+    queueBuildForUserThatTriggeredBuild: true
+    ignoreSslCertificateErrors: false
+    useSameSourceVersion: false
+    useCustomSourceVersion: false
+    useSameBranch: true
+    waitForQueuedBuildsToFinish: false
+    storeInEnvironmentVariable: false
+    templateParameters: 'sqlServerIntegrationTests: true, forceReleaseTestFilter: true, myGetDeploy: true, isNightly: true'
+    authenticationMethod: 'OAuth Token'
+    enableBuildInQueueCondition: false
+    dependentOnSuccessfulBuildCondition: false
+    dependentOnFailedBuildCondition: false
+    checkbuildsoncurrentbranch: false
+    failTaskIfConditionsAreNotFulfilled: false

build/templates/dependency-track.yml

@@ -0,0 +1,56 @@
+parameters:
+  - name: projectName
+    type: string
+  - name: umbracoVersion
+    type: string
+  - name: projects
+    type: object
+
+jobs:
+- job: Create_DT_Project
+  displayName: Create Dependency Track Project
+  steps:
+    - checkout: none
+
+    - bash: |
+        project_id=$(curl --no-progress-meter -H "X-Api-Key: $(DT_API_KEY)" "$(DT_API_URL)/v1/project/lookup?name=${{ parameters.projectName }}&version=${{ parameters.umbracoVersion }}" | jq -r '.uuid')
+        if [ "$project_id" != "null" ] && [ -n "$project_id" ]; then
+          echo "Project '${{ parameters.projectName }}' with version '${{ parameters.umbracoVersion }}' already exists (ID: $project_id)."
+        else
+          project_id=$(curl --no-progress-meter \
+            -X PUT "$(DT_API_URL)/v1/project" \
+            -H "X-Api-Key: $(DT_API_KEY)" \
+            -H "Content-Type: application/json" \
+            -d '{"name": "${{ parameters.projectName }}", "version": "${{ parameters.umbracoVersion }}", "collectionLogic": "AGGREGATE_DIRECT_CHILDREN"}' \
+            | jq -r '.uuid')
+          if [ -z "$project_id" ] || [ "$project_id" == "null" ]; then
+            echo "Failed to create project '${{ parameters.projectName }}' version '${{ parameters.umbracoVersion }}'."
+            exit 1
+          fi
+          echo "Created project '${{ parameters.projectName }}' with version '${{ parameters.umbracoVersion }}' (ID: $project_id)."
+        fi
+      displayName: Ensure main project exists in Dependency Track
+
+- ${{ each project in parameters.projects }}:
+  - job:
+    displayName: Upload ${{ project.name }} BOM
+    dependsOn: Create_DT_Project
+    steps:
+      - checkout: none
+
+      - download: current
+        artifact: ${{ project.artifact }}
+        displayName: Download ${{ project.artifact }} artifact
+
+      - script: |
+          curl --no-progress-meter --fail-with-body \
+            -X POST "$(DT_API_URL)/v1/bom" \
+            -H "X-Api-Key: $(DT_API_KEY)" \
+            -H "Content-Type: multipart/form-data" \
+            -F "autoCreate=true" \
+            -F "projectName=${{ parameters.projectName }}-${{ project.name }}" \
+            -F "projectVersion=${{ parameters.umbracoVersion }}" \
+            -F "parentName=${{ parameters.projectName }}" \
+            -F "parentVersion=${{ parameters.umbracoVersion }}" \
+            -F "bom=@$(Pipeline.Workspace)/${{ project.artifact }}/${{ project.bomFilePath }}"
+        displayName: Upload ${{ project.name }} BOM to Dependency Track

build/templates/e2e-install.yml

@@ -0,0 +1,47 @@
+parameters:
+  - name: nodeVersion
+    type: string
+    default: ''
+
+  - name: npm_config_cache
+    type: string
+    default: ''
+
+  - name: PlaywrightUserEmail
+    type: string
+    default: ''
+
+  - name: PlaywrightPassword
+    type: string
+    default: ''
+
+  - name: ASPNETCORE_URLS
+    type: string
+    default: ''
+
+steps:
+  - task: NodeTool@0
+    displayName: Use Node.js $(nodeVersion)
+    inputs:
+      versionSpec: $(nodeVersion)
+
+  - pwsh: |
+      "UMBRACO_USER_LOGIN=${{ parameters.PlaywrightUserEmail }}
+      UMBRACO_USER_PASSWORD=${{ parameters.PlaywrightPassword }}
+      URL=${{ parameters.ASPNETCORE_URLS }}" | Out-File .env
+    displayName: Generate .env
+    workingDirectory: $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest
+
+  # Cache and restore NPM packages
+  - task: Cache@2
+    displayName: Cache NPM packages
+    inputs:
+      key: 'npm_e2e | "$(Agent.OS)" | $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/package-lock.json'
+      restoreKeys: |
+        npm_e2e | "$(Agent.OS)"
+        npm_e2e
+      path: ${{ parameters.npm_config_cache }}
+
+  - script: npm ci --no-fund --no-audit --prefer-offline
+    workingDirectory: $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest
+    displayName: Restore NPM packages

global.json

@@ -0,0 +1,6 @@
+{
+  "sdk": {
+    "version": "8.0.415",
+    "rollForward": "latestFeature"
+  }
+}

legacy/Umbraco.Tests/App.config

@@ -1,119 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<configuration>
-    <configSections>
-    </configSections>
-
-    <appSettings>
-        <add key="Umbraco.Core.ConfigurationStatus" value="6.0.0"/>
-        <add key="Umbraco.Core.ReservedUrls" value="~/config/splashes/booting.aspx,~/install/default.aspx,~/config/splashes/noNodes.aspx,~/VSEnterpriseHelper.axd,~/.well-known" />
-        <add key="Umbraco.Core.ReservedPaths" value="~/install/"/>
-        <add key="Umbraco.Core.Path" value="~/umbraco"/>
-        <add key="Umbraco.Core.HideTopLevelNodeFromPath" value="true"/>
-        <add key="Umbraco.Core.TimeOutInMinutes" value="20"/>
-        <add key="Umbraco.Core.DefaultUILanguage" value="en"/>
-        <add key="Umbraco.Core.UseHttps" value="false"/>
-        <add key="dataAnnotations:dataTypeAttribute:disableRegEx" value="false"/>
-    </appSettings>
-
-    <connectionStrings>
-        <add name="umbracoDbDSN" connectionString="Datasource=|DataDirectory|UmbracoNPocoTests.sdf;Flush Interval=1;" providerName="System.Data.SqlServerCe.4.0"/>
-    </connectionStrings>
-
-    <system.data>
-        <DbProviderFactories>
-            <remove invariant="System.Data.SqlServerCe.4.0"/>
-            <add name="Microsoft SQL Server Compact Data Provider 4.0" invariant="System.Data.SqlServerCe.4.0" description=".NET Framework Data Provider for Microsoft SQL Server Compact" type="System.Data.SqlServerCe.SqlCeProviderFactory, System.Data.SqlServerCe, Version=4.0.0.1, Culture=neutral, PublicKeyToken=89845dcd8080cc91"/>
-        </DbProviderFactories>
-    </system.data>
-
-    <system.web>
-        <httpRuntime targetFramework="4.5"/>
-        <compilation defaultLanguage="c#" debug="true" batch="false" targetFramework="4.0"></compilation>
-        <machineKey validationKey="5E7B955FCE36F5F2A867C2A0D85DC61E7FEA9E15F1561E8386F78BFE9EE23FF18B21E6A44AA17300B3B9D5DBEB37AA61A2C73884A5BBEDA6D3B14BA408A7A8CD" decryptionKey="116B853D031219E404E088FCA0986D6CF2DFA77E1957B59FCC9404B8CA3909A1" validation="SHA1" decryption="AES"/>
-        <!--<trust level="Medium" originUrl=".*"/>-->
-        <!-- Sitemap provider-->
-        <siteMap defaultProvider="UmbracoSiteMapProvider" enabled="true">
-            <providers>
-                <clear/>
-                <add name="UmbracoSiteMapProvider" type="umbraco.presentation.nodeFactory.UmbracoSiteMapProvider" defaultDescriptionAlias="description" securityTrimmingEnabled="true"/>
-            </providers>
-        </siteMap>
-        <!-- Membership Provider -->
-        <membership defaultProvider="UmbracoMembershipProvider" userIsOnlineTimeWindow="15">
-            <providers>
-                <clear/>
-                <add name="UmbracoMembershipProvider" type="Umbraco.Web.Security.Providers.MembersMembershipProvider, Umbraco.Web" minRequiredNonalphanumericCharacters="0" minRequiredPasswordLength="4" useLegacyEncoding="false" enablePasswordRetrieval="false" enablePasswordReset="true" requiresQuestionAndAnswer="false" defaultMemberTypeAlias="Member" passwordFormat="Hashed"/>
-            </providers>
-        </membership>
-    </system.web>
-
-    <startup>
-        <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.7.2"/>
-    </startup>
-
-    <runtime>
-        <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">
-            <dependentAssembly>
-                <assemblyIdentity name="Microsoft.Owin" publicKeyToken="31bf3856ad364e35" culture="neutral" />
-                <bindingRedirect oldVersion="0.0.0.0-4.0.1.0" newVersion="4.0.1.0" />
-            </dependentAssembly>
-            <dependentAssembly>
-                <assemblyIdentity name="Microsoft.Owin.Security" publicKeyToken="31bf3856ad364e35" culture="neutral" />
-                <bindingRedirect oldVersion="0.0.0.0-4.0.1.0" newVersion="4.0.1.0" />
-            </dependentAssembly>
-            <dependentAssembly>
-                <assemblyIdentity name="Microsoft.Owin.Security.Cookies" publicKeyToken="31bf3856ad364e35" culture="neutral" />
-                <bindingRedirect oldVersion="0.0.0.0-4.0.1.0" newVersion="4.0.1.0" />
-            </dependentAssembly>
-            <dependentAssembly>
-                <assemblyIdentity name="Microsoft.Owin.Security.OAuth" publicKeyToken="31bf3856ad364e35" culture="neutral" />
-                <bindingRedirect oldVersion="0.0.0.0-4.0.1.0" newVersion="4.0.1.0" />
-            </dependentAssembly>
-            <dependentAssembly>
-                <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral" />
-                <bindingRedirect oldVersion="0.0.0.0-12.0.0.0" newVersion="12.0.0.0" />
-            </dependentAssembly>
-            <dependentAssembly>
-                <assemblyIdentity name="System.Collections.Immutable" publicKeyToken="b03f5f7f11d50a3a" culture="neutral" />
-                <bindingRedirect oldVersion="0.0.0.0-1.2.5.0" newVersion="1.2.5.0" />
-            </dependentAssembly>
-            <dependentAssembly>
-                <assemblyIdentity name="System.Web.Http" publicKeyToken="31bf3856ad364e35" culture="neutral" />
-                <bindingRedirect oldVersion="0.0.0.0-5.2.7.0" newVersion="5.2.7.0" />
-            </dependentAssembly>
-            <dependentAssembly>
-                <assemblyIdentity name="System.Web.Mvc" publicKeyToken="31bf3856ad364e35" culture="neutral" />
-                <bindingRedirect oldVersion="0.0.0.0-5.2.7.0" newVersion="5.2.7.0" />
-            </dependentAssembly>
-            <dependentAssembly>
-                <assemblyIdentity name="System.ValueTuple" publicKeyToken="cc7b13ffcd2ddd51" culture="neutral" />
-                <bindingRedirect oldVersion="0.0.0.0-4.0.3.0" newVersion="4.0.3.0" />
-            </dependentAssembly>
-            <dependentAssembly>
-                <assemblyIdentity name="System.Net.Http.Formatting" publicKeyToken="31bf3856ad364e35"/>
-                <bindingRedirect oldVersion="0.0.0.0-5.2.7.0" newVersion="5.2.7.0"/>
-            </dependentAssembly>
-          <dependentAssembly>
-              <assemblyIdentity name="System.ComponentModel.Annotations" publicKeyToken="b03f5f7f11d50a3a" culture="neutral" />
-              <bindingRedirect oldVersion="0.0.0.0-4.2.1.0" newVersion="4.2.1.0" />
-          </dependentAssembly>
-          <dependentAssembly>
-                <assemblyIdentity name="System.Threading.Tasks.Extensions" publicKeyToken="cc7b13ffcd2ddd51" culture="neutral" />
-                <bindingRedirect oldVersion="0.0.0.0-4.2.0.1" newVersion="4.2.0.1" />
-            </dependentAssembly>
-            <dependentAssembly>
-                <assemblyIdentity name="System.Buffers" publicKeyToken="cc7b13ffcd2ddd51" culture="neutral"/>
-                <bindingRedirect oldVersion="4.0.0.0-4.0.3.0" newVersion="4.0.3.0"/>
-            </dependentAssembly>
-            <dependentAssembly>
-                <assemblyIdentity name="System.Memory" publicKeyToken="cc7b13ffcd2ddd51" culture="neutral"/>
-                <bindingRedirect oldVersion="4.0.0.0-4.0.1.1" newVersion="4.0.1.1"/>
-            </dependentAssembly>
-            <dependentAssembly>
-                <assemblyIdentity name="System.Numerics.Vectors" publicKeyToken="b03f5f7f11d50a3a" culture="neutral"/>
-                <bindingRedirect oldVersion="4.0.0.0-4.1.4.0" newVersion="4.1.4.0"/>
-            </dependentAssembly>
-        </assemblyBinding>
-    </runtime>
-
-</configuration>

legacy/Umbraco.Tests/Properties/AssemblyInfo.cs

@@ -1,41 +0,0 @@
-using System.Reflection;
-using System.Runtime.CompilerServices;
-using System.Runtime.InteropServices;
-
-// General Information about an assembly is controlled through the following
-// set of attributes. Change these attribute values to modify the information
-// associated with an assembly.
-[assembly: AssemblyTitle("Umbraco.Tests")]
-[assembly: AssemblyDescription("")]
-[assembly: AssemblyConfiguration("")]
-[assembly: AssemblyCompany("")]
-[assembly: AssemblyProduct("Umbraco.Tests")]
-[assembly: AssemblyCopyright("Copyright ©  2012")]
-[assembly: AssemblyTrademark("")]
-[assembly: AssemblyCulture("")]
-
-// Setting ComVisible to false makes the types in this assembly not visible
-// to COM components.  If you need to access a type in this assembly from
-// COM, set the ComVisible attribute to true on that type.
-[assembly: ComVisible(false)]
-
-// The following GUID is for the ID of the typelib if this project is exposed to COM
-[assembly: Guid("33ddf9b7-505c-4a12-8370-7fee9de5df6d")]
-
-// Version information for an assembly consists of the following four values:
-//
-//      Major Version
-//      Minor Version
-//      Build Number
-//      Revision
-//
-// You can specify all the values or you can default the Build and Revision Numbers
-// by using the '*' as shown below:
-// [assembly: AssemblyVersion("1.0.*")]
-[assembly: AssemblyVersion("1.0.0.0")]
-[assembly: AssemblyFileVersion("1.0.0.0")]
-
-// Internals must be visible to DynamicProxyGenAssembly2
-// in order to mock loggers loggers with types from the assembly
-// I.E. Mock.Of<ILogger<TestControllerFactory>>()
-[assembly: InternalsVisibleTo("DynamicProxyGenAssembly2")]

legacy/Umbraco.Tests/Published/ModelTypeTests.cs

@@ -1,43 +0,0 @@
-using System;
-using System.Collections.Generic;
-using NUnit.Framework;
-using Umbraco.Cms.Core.Models.PublishedContent;
-
-namespace Umbraco.Tests.Published
-{
-    [TestFixture]
-    public class ModelTypeTests
-    {
-
-            //TODO these is not easy to move to the Unittest project due to underlysing NotImplementedException of Type.IsSZArray
-        [Test]
-        public void ModelTypeToStringTests()
-        {
-            var modelType = ModelType.For("alias1");
-            var modelTypeArray = modelType.MakeArrayType();
-
-            Assert.AreEqual("{alias1}", modelType.ToString());
-
-            // there's an "*" there because the arrays are not true SZArray - but that changes when we map
-
-            Assert.AreEqual("{alias1}[*]", modelTypeArray.ToString());
-            var enumArray = typeof(IEnumerable<>).MakeGenericType(modelTypeArray);
-            Assert.AreEqual("System.Collections.Generic.IEnumerable`1[{alias1}[*]]", enumArray.ToString());
-        }
-
-        [Test]
-        public void ModelTypeFullNameTests()
-        {
-            Assert.AreEqual("{alias1}", ModelType.For("alias1").FullName);
-
-            Type type = ModelType.For("alias1");
-            Assert.AreEqual("{alias1}", type.FullName);
-
-            // there's an "*" there because the arrays are not true SZArray - but that changes when we map
-            Assert.AreEqual("{alias1}[*]", ModelType.For("alias1").MakeArrayType().FullName);
-            // note the inner assembly qualified name
-            Assert.AreEqual("System.Collections.Generic.IEnumerable`1[[{alias1}[*], Umbraco.Core, Version=0.5.0.0, Culture=neutral, PublicKeyToken=null]]", typeof(IEnumerable<>).MakeGenericType(ModelType.For("alias1").MakeArrayType()).FullName);
-        }
-
-    }
-}

legacy/Umbraco.Tests/Routing/BaseUrlProviderTest.cs

@@ -1,45 +0,0 @@
-using System.Linq;
-using Microsoft.Extensions.DependencyInjection;
-using Moq;
-using Umbraco.Cms.Core.Configuration.Models;
-using Umbraco.Cms.Core.Models.PublishedContent;
-using Umbraco.Cms.Core.Routing;
-using Umbraco.Cms.Core.Web;
-using Umbraco.Cms.Tests.Common;
-using Umbraco.Tests.TestHelpers;
-
-namespace Umbraco.Tests.Routing
-{
-    public abstract class BaseUrlProviderTest : BaseWebTest
-    {
-        protected IUmbracoContextAccessor UmbracoContextAccessor { get; } = new TestUmbracoContextAccessor();
-
-        protected abstract bool HideTopLevelNodeFromPath { get; }
-
-        protected override void Compose()
-        {
-            base.Compose();
-            Builder.Services.AddTransient<ISiteDomainMapper, SiteDomainMapper>();
-        }
-
-        protected override void ComposeSettings()
-        {
-            var contentSettings = new ContentSettings();
-            var userPasswordConfigurationSettings = new UserPasswordConfigurationSettings();
-
-            Builder.Services.AddTransient(x => Microsoft.Extensions.Options.Options.Create(contentSettings));
-            Builder.Services.AddTransient(x => Microsoft.Extensions.Options.Options.Create(userPasswordConfigurationSettings));
-        }
-
-        protected IPublishedUrlProvider GetPublishedUrlProvider(IUmbracoContext umbracoContext, DefaultUrlProvider urlProvider)
-        {
-            var webRoutingSettings = new WebRoutingSettings();
-            return new UrlProvider(
-                new TestUmbracoContextAccessor(umbracoContext),
-                Microsoft.Extensions.Options.Options.Create(webRoutingSettings),
-                new UrlProviderCollection(new[] { urlProvider }),
-                new MediaUrlProviderCollection(Enumerable.Empty<IMediaUrlProvider>()),
-                Mock.Of<IVariationContextAccessor>());
-        }
-    }
-}

legacy/Umbraco.Tests/Routing/MediaUrlProviderTests.cs

@@ -1,206 +0,0 @@
-using System;
-using System.Linq;
-using Microsoft.Extensions.Logging;
-using Microsoft.Extensions.Logging.Abstractions;
-using Moq;
-using Newtonsoft.Json;
-using NUnit.Framework;
-using Umbraco.Cms.Core.Configuration.Models;
-using Umbraco.Cms.Core.IO;
-using Umbraco.Cms.Core.Models;
-using Umbraco.Cms.Core.Models.PublishedContent;
-using Umbraco.Cms.Core.PropertyEditors;
-using Umbraco.Cms.Core.PropertyEditors.ValueConverters;
-using Umbraco.Cms.Core.Routing;
-using Umbraco.Cms.Core.Services;
-using Umbraco.Cms.Core.Strings;
-using Umbraco.Cms.Core.Web;
-using Umbraco.Cms.Tests.Common;
-using Umbraco.Cms.Tests.Common.Testing;
-using Umbraco.Tests.PublishedContent;
-using Umbraco.Tests.TestHelpers;
-using Constants = Umbraco.Cms.Core.Constants;
-
-namespace Umbraco.Tests.Routing
-{
-    [TestFixture]
-    [UmbracoTest(Database = UmbracoTestOptions.Database.NewSchemaPerFixture)]
-    public class MediaUrlProviderTests : BaseWebTest
-    {
-        private DefaultMediaUrlProvider _mediaUrlProvider;
-
-        public override void SetUp()
-        {
-            base.SetUp();
-
-            var loggerFactory = NullLoggerFactory.Instance;
-            var mediaFileManager = new MediaFileManager(Mock.Of<IFileSystem>(), Mock.Of<IMediaPathScheme>(),
-                loggerFactory.CreateLogger<MediaFileManager>(), Mock.Of<IShortStringHelper>());
-            var contentSettings = new ContentSettings();
-            var dataTypeService = Mock.Of<IDataTypeService>();
-            var propertyEditors = new MediaUrlGeneratorCollection(new IMediaUrlGenerator[]
-            {
-                new FileUploadPropertyEditor(DataValueEditorFactory, mediaFileManager, Microsoft.Extensions.Options.Options.Create(contentSettings), dataTypeService, LocalizationService, LocalizedTextService,  UploadAutoFillProperties, ContentService),
-                new ImageCropperPropertyEditor(DataValueEditorFactory, loggerFactory, mediaFileManager, Microsoft.Extensions.Options.Options.Create(contentSettings), dataTypeService, IOHelper, UploadAutoFillProperties, ContentService),
-            });
-            _mediaUrlProvider = new DefaultMediaUrlProvider(propertyEditors, UriUtility);
-        }
-
-        public override void TearDown()
-        {
-            base.TearDown();
-
-            _mediaUrlProvider = null;
-        }
-
-        [Test]
-        public void Get_Media_Url_Resolves_Url_From_Upload_Property_Editor()
-        {
-            const string expected = "/media/rfeiw584/test.jpg";
-
-            var umbracoContext = GetUmbracoContext("/");
-            var publishedContent = CreatePublishedContent(Constants.PropertyEditors.Aliases.UploadField, expected, null);
-
-            var resolvedUrl = GetPublishedUrlProvider(umbracoContext).GetMediaUrl(publishedContent, UrlMode.Auto);
-
-            Assert.AreEqual(expected, resolvedUrl);
-        }
-
-        [Test]
-        public void Get_Media_Url_Resolves_Url_From_Image_Cropper_Property_Editor()
-        {
-            const string expected = "/media/rfeiw584/test.jpg";
-
-            var configuration = new ImageCropperConfiguration();
-            var imageCropperValue = JsonConvert.SerializeObject(new ImageCropperValue
-            {
-                Src = expected
-            });
-
-            var umbracoContext = GetUmbracoContext("/");
-            var publishedContent = CreatePublishedContent(Constants.PropertyEditors.Aliases.ImageCropper, imageCropperValue, configuration);
-
-            var resolvedUrl = GetPublishedUrlProvider(umbracoContext).GetMediaUrl(publishedContent, UrlMode.Auto);
-
-            Assert.AreEqual(expected, resolvedUrl);
-        }
-
-        [Test]
-        public void Get_Media_Url_Can_Resolve_Absolute_Url()
-        {
-            const string mediaUrl = "/media/rfeiw584/test.jpg";
-            var expected = $"http://localhost{mediaUrl}";
-
-            var umbracoContext = GetUmbracoContext("http://localhost");
-            var publishedContent = CreatePublishedContent(Constants.PropertyEditors.Aliases.UploadField, mediaUrl, null);
-
-            var resolvedUrl = GetPublishedUrlProvider(umbracoContext).GetMediaUrl(publishedContent, UrlMode.Absolute);
-
-            Assert.AreEqual(expected, resolvedUrl);
-        }
-
-        [Test]
-        public void Get_Media_Url_Returns_Absolute_Url_If_Stored_Url_Is_Absolute()
-        {
-            const string expected = "http://localhost/media/rfeiw584/test.jpg";
-
-            var umbracoContext = GetUmbracoContext("http://localhost");
-            var publishedContent = CreatePublishedContent(Constants.PropertyEditors.Aliases.UploadField, expected, null);
-
-            var resolvedUrl = GetPublishedUrlProvider(umbracoContext).GetMediaUrl(publishedContent, UrlMode.Relative);
-
-            Assert.AreEqual(expected, resolvedUrl);
-        }
-
-        [Test]
-        public void Get_Media_Url_Returns_Empty_String_When_PropertyType_Is_Not_Supported()
-        {
-            var umbracoContext = GetUmbracoContext("/");
-            var publishedContent = CreatePublishedContent(Constants.PropertyEditors.Aliases.Boolean, "0", null);
-
-            var resolvedUrl = GetPublishedUrlProvider(umbracoContext).GetMediaUrl(publishedContent, UrlMode.Absolute, propertyAlias: "test");
-
-            Assert.AreEqual(string.Empty, resolvedUrl);
-        }
-
-        [Test]
-        public void Get_Media_Url_Can_Resolve_Variant_Property_Url()
-        {
-            var umbracoContext = GetUmbracoContext("http://localhost");
-
-            var umbracoFilePropertyType = CreatePropertyType(Constants.PropertyEditors.Aliases.UploadField, null, ContentVariation.Culture);
-
-            const string enMediaUrl = "/media/rfeiw584/en.jpg";
-            const string daMediaUrl = "/media/uf8ewud2/da.jpg";
-
-            var property = new SolidPublishedPropertyWithLanguageVariants
-            {
-                Alias = "umbracoFile",
-                PropertyType = umbracoFilePropertyType,
-            };
-
-            property.SetSourceValue("en", enMediaUrl, true);
-            property.SetSourceValue("da", daMediaUrl);
-
-            var contentType = new PublishedContentType(Guid.NewGuid(), 666, "alias", PublishedItemType.Content, Enumerable.Empty<string>(), new [] { umbracoFilePropertyType }, ContentVariation.Culture);
-            var publishedContent = new SolidPublishedContent(contentType) {Properties = new[] {property}};
-
-            var resolvedUrl = GetPublishedUrlProvider(umbracoContext).GetMediaUrl(publishedContent, UrlMode.Auto, "da");
-            Assert.AreEqual(daMediaUrl, resolvedUrl);
-        }
-
-        private IPublishedUrlProvider GetPublishedUrlProvider(IUmbracoContext umbracoContext)
-        {
-            var webRoutingSettings = new WebRoutingSettings();
-            return new UrlProvider(
-                new TestUmbracoContextAccessor(umbracoContext),
-                Microsoft.Extensions.Options.Options.Create(webRoutingSettings),
-                new UrlProviderCollection(Enumerable.Empty<IUrlProvider>()),
-                new MediaUrlProviderCollection(new []{_mediaUrlProvider}),
-                Mock.Of<IVariationContextAccessor>()
-            );
-        }
-
-        private static IPublishedContent CreatePublishedContent(string propertyEditorAlias, string propertyValue, object dataTypeConfiguration)
-        {
-            var umbracoFilePropertyType = CreatePropertyType(propertyEditorAlias, dataTypeConfiguration, ContentVariation.Nothing);
-
-            var contentType = new PublishedContentType(Guid.NewGuid(), 666, "alias", PublishedItemType.Content, Enumerable.Empty<string>(),
-                new[] {umbracoFilePropertyType}, ContentVariation.Nothing);
-
-            return new SolidPublishedContent(contentType)
-            {
-                Id = 1234,
-                Key = Guid.NewGuid(),
-                Properties = new[]
-                {
-                    new SolidPublishedProperty
-                    {
-                        Alias = "umbracoFile",
-                        SolidSourceValue = propertyValue,
-                        SolidHasValue = true,
-                        PropertyType = umbracoFilePropertyType
-                    }
-                }
-            };
-        }
-
-        private static PublishedPropertyType CreatePropertyType(string propertyEditorAlias, object dataTypeConfiguration, ContentVariation variation)
-        {
-            var uploadDataType = new PublishedDataType(1234, propertyEditorAlias, new Lazy<object>(() => dataTypeConfiguration));
-
-            var propertyValueConverters = new PropertyValueConverterCollection(new IPropertyValueConverter[]
-            {
-                new UploadPropertyConverter(),
-                new ImageCropperValueConverter(Mock.Of<ILogger<ImageCropperValueConverter>>()),
-            });
-
-            var publishedModelFactory = Mock.Of<IPublishedModelFactory>();
-            var publishedContentTypeFactory = new Mock<IPublishedContentTypeFactory>();
-            publishedContentTypeFactory.Setup(x => x.GetDataType(It.IsAny<int>()))
-                .Returns(uploadDataType);
-
-            return new PublishedPropertyType("umbracoFile", 42, true, variation, propertyValueConverters, publishedModelFactory, publishedContentTypeFactory.Object);
-        }
-    }
-}

legacy/Umbraco.Tests/Umbraco.Tests.csproj

@@ -1,199 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<Project ToolsVersion="15.0">
-  <Import Project="$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props" Condition="Exists('$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props')" />
-  <PropertyGroup>
-    <Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
-    <Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
-    <ProductVersion>8.0.30703</ProductVersion>
-    <SchemaVersion>2.0</SchemaVersion>
-    <ProjectGuid>{5D3B8245-ADA6-453F-A008-50ED04BFE770}</ProjectGuid>
-    <OutputType>Library</OutputType>
-    <AppDesignerFolder>Properties</AppDesignerFolder>
-    <RootNamespace>Umbraco.Tests</RootNamespace>
-    <AssemblyName>Umbraco.Tests</AssemblyName>
-    <TargetFrameworkVersion>v4.7.2</TargetFrameworkVersion>
-    <FileAlignment>512</FileAlignment>
-    <SolutionDir Condition="$(SolutionDir) == '' Or $(SolutionDir) == '*Undefined*'">..\</SolutionDir>
-    <PublishUrl>publish\</PublishUrl>
-    <Install>true</Install>
-    <InstallFrom>Disk</InstallFrom>
-    <UpdateEnabled>false</UpdateEnabled>
-    <UpdateMode>Foreground</UpdateMode>
-    <UpdateInterval>7</UpdateInterval>
-    <UpdateIntervalUnits>Days</UpdateIntervalUnits>
-    <UpdatePeriodically>false</UpdatePeriodically>
-    <UpdateRequired>false</UpdateRequired>
-    <MapFileExtensions>true</MapFileExtensions>
-    <ApplicationRevision>0</ApplicationRevision>
-    <ApplicationVersion>1.0.0.%2a</ApplicationVersion>
-    <IsWebBootstrapper>false</IsWebBootstrapper>
-    <UseApplicationTrust>false</UseApplicationTrust>
-    <BootstrapperEnabled>true</BootstrapperEnabled>
-    <TargetFrameworkProfile />
-    <NuGetPackageImportStamp>
-    </NuGetPackageImportStamp>
-  </PropertyGroup>
-  <PropertyGroup>
-    <AutoGenerateBindingRedirects>true</AutoGenerateBindingRedirects>
-    <GenerateBindingRedirectsOutputType>true</GenerateBindingRedirectsOutputType>
-  </PropertyGroup>
-  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
-    <DebugSymbols>true</DebugSymbols>
-    <DebugType>full</DebugType>
-    <Optimize>false</Optimize>
-    <OutputPath>bin\Debug\</OutputPath>
-    <DefineConstants>DEBUG;TRACE</DefineConstants>
-    <ErrorReport>prompt</ErrorReport>
-    <WarningLevel>4</WarningLevel>
-    <Prefer32Bit>false</Prefer32Bit>
-    <LangVersion>8</LangVersion>
-  </PropertyGroup>
-  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
-    <DebugType>pdbonly</DebugType>
-    <Optimize>true</Optimize>
-    <OutputPath>bin\Release\</OutputPath>
-    <DefineConstants>TRACE</DefineConstants>
-    <ErrorReport>prompt</ErrorReport>
-    <WarningLevel>4</WarningLevel>
-    <Prefer32Bit>false</Prefer32Bit>
-    <LangVersion>latest</LangVersion>
-  </PropertyGroup>
-  <ItemGroup>
-    <Reference Include="System" />
-    <Reference Include="System.configuration" />
-    <Reference Include="System.Core" />
-    <Reference Include="System.Data.Entity.Design" />
-    <Reference Include="System.Drawing" />
-    <Reference Include="System.IO" />
-    <Reference Include="System.IO.Compression" />
-    <Reference Include="System.IO.Compression.FileSystem" />
-    <Reference Include="System.Runtime.Caching" />
-    <Reference Include="System.Runtime.Serialization" />
-    <Reference Include="System.Text.Encoding" />
-    <Reference Include="System.Web" />
-    <Reference Include="System.Web.ApplicationServices" />
-    <Reference Include="System.Web.Extensions" />
-    <Reference Include="System.Web.Services" />
-    <Reference Include="System.Xml.Linq" />
-    <Reference Include="System.Data.DataSetExtensions" />
-    <Reference Include="Microsoft.CSharp" />
-    <Reference Include="System.Data" />
-    <Reference Include="System.Xml" />
-  </ItemGroup>
-  <ItemGroup>
-    <PackageReference Include="Castle.Core" Version="4.4.1" />
-    <PackageReference Include="Examine.Core">
-      <Version>2.0.0</Version>
-    </PackageReference>
-    <PackageReference Include="Castle.Core" Version="4.3.1" />
-    <PackageReference Include="Examine" Version="2.0.0" />
-    <PackageReference Include="HtmlAgilityPack">
-      <Version>1.11.31</Version>
-    </PackageReference>
-    <PackageReference Include="Lucene.Net.Contrib" Version="3.0.3" />
-    <PackageReference Include="Microsoft.AspNet.Identity.Core" Version="2.2.3" />
-    <PackageReference Include="Microsoft.AspNet.Mvc" Version="5.2.7" />
-    <PackageReference Include="Microsoft.AspNet.WebApi" Version="5.2.7" />
-    <PackageReference Include="Microsoft.AspNet.WebApi.Client" Version="5.2.7" />
-    <PackageReference Include="Microsoft.AspNet.WebApi.Owin" Version="5.2.7" />
-    <PackageReference Include="Microsoft.AspNet.WebApi.SelfHost" Version="5.2.7" />
-    <PackageReference Include="Microsoft.AspNet.WebApi.Tracing" Version="5.2.7" />
-    <PackageReference Include="Microsoft.AspNet.WebApi.WebHost" Version="5.2.7" />
-    <PackageReference Include="Microsoft.Extensions.Configuration.Abstractions">
-      <Version>5.0.0</Version>
-    </PackageReference>
-    <PackageReference Include="Microsoft.Extensions.Logging" Version="5.0.0" />
-    <PackageReference Include="Microsoft.Extensions.Logging.Abstractions" Version="5.0.0" />
-    <PackageReference Include="Microsoft.Extensions.Logging.Console">
-      <Version>5.0.0</Version>
-    </PackageReference>
-    <PackageReference Include="Microsoft.Extensions.Logging.Debug" Version="5.0.0" />
-    <PackageReference Include="Microsoft.Owin" Version="4.1.1" />
-    <PackageReference Include="Microsoft.Owin.Hosting" Version="4.1.1" />
-    <PackageReference Include="Microsoft.Owin.Security" Version="4.1.1" />
-    <PackageReference Include="Microsoft.Owin.Testing" Version="4.1.1" />
-    <PackageReference Include="Microsoft.Web.Infrastructure" Version="1.0.0.0" />
-    <PackageReference Include="MiniProfiler" Version="4.2.22" />
-    <PackageReference Include="Moq" Version="4.16.1" />
-    <PackageReference Include="NUnit" Version="3.13.1" />
-    <PackageReference Include="NUnit3TestAdapter" Version="3.17.0" />
-    <PackageReference Include="Newtonsoft.Json" Version="12.0.3" />
-    <PackageReference Include="MiniProfiler" Version="4.0.138" />
-    <PackageReference Include="Moq" Version="4.10.1" />
-    <PackageReference Include="Moq" Version="4.14.5" />
-    <PackageReference Include="NPoco" Version="3.9.4" />
-    <PackageReference Include="NUnit" Version="3.11.0" />
-    <PackageReference Include="NUnit3TestAdapter" Version="3.12.0" />
-    <PackageReference Include="NPoco" Version="4.0.3" />
-    <PackageReference Include="Newtonsoft.Json" Version="12.0.1" />
-    <PackageReference Include="Owin" Version="1.0" />
-    <PackageReference Include="Selenium.WebDriver" Version="3.141.0" />
-    <PackageReference Include="System.Configuration.ConfigurationManager" Version="5.0.0" />
-    <PackageReference Include="System.ComponentModel.Annotations" Version="5.0.0" />
-    <PackageReference Include="System.Data.SqlClient" Version="4.8.2" />
-    <PackageReference Include="System.Threading.Tasks.Extensions" Version="4.5.4" />
-    <PackageReference Include="Umbraco.SqlServerCE" Version="4.0.0.1" />
-  </ItemGroup>
-  <ItemGroup>
-    <Compile Include="Published\ModelTypeTests.cs" />
-    <Compile Include="Routing\BaseUrlProviderTest.cs" />
-    <Compile Include="Routing\MediaUrlProviderTests.cs" />
-    <Compile Include="Scoping\ScopedNuCacheTests.cs" />
-    <Compile Include="Web\Controllers\AuthenticationControllerTests.cs" />
-    <Compile Include="Properties\AssemblyInfo.cs" />
-  </ItemGroup>
-  <ItemGroup>
-    <None Include="App.config">
-      <SubType>Designer</SubType>
-    </None>
-    <None Include="unit-test-logger.config">
-      <CopyToOutputDirectory>Always</CopyToOutputDirectory>
-    </None>
-  </ItemGroup>
-  <ItemGroup>
-    <ProjectReference Include="..\..\src\Umbraco.Core\Umbraco.Core.csproj">
-      <Project>{29aa69d9-b597-4395-8d42-43b1263c240a}</Project>
-      <Name>Umbraco.Core</Name>
-    </ProjectReference>
-    <ProjectReference Include="..\..\src\Umbraco.Examine.Lucene\Umbraco.Examine.Lucene.csproj">
-      <Project>{0fad7d2a-d7dd-45b1-91fd-488bb6cdacea}</Project>
-      <Name>Umbraco.Examine.Lucene</Name>
-    </ProjectReference>
-    <ProjectReference Include="...\..\srcUmbraco.Infrastructure\Umbraco.Infrastructure.csproj">
-      <Project>{3ae7bf57-966b-45a5-910a-954d7c554441}</Project>
-      <Name>Umbraco.Infrastructure</Name>
-    </ProjectReference>
-    <ProjectReference Include="..\..\src\Umbraco.Persistence.SqlCe\Umbraco.Persistence.SqlCe.csproj">
-      <Project>{33085570-9bf2-4065-a9b0-a29d920d13ba}</Project>
-      <Name>Umbraco.Persistence.SqlCe</Name>
-    </ProjectReference>
-    <ProjectReference Include="..\..\src\Umbraco.PublishedCache.NuCache\Umbraco.PublishedCache.NuCache.csproj">
-      <Project>{f6de8da0-07cc-4ef2-8a59-2bc81dbb3830}</Project>
-      <Name>Umbraco.PublishedCache.NuCache</Name>
-    </ProjectReference>
-    <ProjectReference Include="..\Umbraco.Tests.Common\Umbraco.Tests.Common.csproj">
-      <Project>{a499779c-1b3b-48a8-b551-458e582e6e96}</Project>
-      <Name>Umbraco.Tests.Common</Name>
-    </ProjectReference>
-    <ProjectReference Include="..\..\src\Umbraco.Web\Umbraco.Web.csproj">
-      <Project>{651E1350-91B6-44B7-BD60-7207006D7003}</Project>
-      <Name>Umbraco.Web</Name>
-    </ProjectReference>
-  </ItemGroup>
-  <ItemGroup>
-    <Service Include="{82A7F48D-3B50-4B1E-B82E-3ADA8210C358}" />
-  </ItemGroup>
-  <ItemGroup />
-  <!-- get NuGet packages directory -->
-  <PropertyGroup>
-    <NuGetPackages>$(NuGetPackageFolders.Split(';')[0])</NuGetPackages>
-  </PropertyGroup>
-  <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
-  <Target Name="BeforeBuild">
-    <Message Text="-BeforeBuild-" Importance="high" />
-    <Message Text="MSBuildExtensionsPath: $(MSBuildExtensionsPath)" Importance="high" />
-    <Message Text="WebPublishingTasks:    $(WebPublishingTasks)" Importance="high" />
-    <Message Text="NuGetPackageFolders:   $(NuGetPackageFolders)" Importance="high" />
-    <Message Text="NuGetPackages:         $(NuGetPackages)" Importance="high" />
-  </Target>
-</Project>

legacy/Umbraco.Tests/Web/Controllers/AuthenticationControllerTests.cs

@@ -1,122 +0,0 @@
-using Moq;
-using NUnit.Framework;
-using Umbraco.Cms.Core.Features;
-using Umbraco.Cms.Core.Services;
-using Umbraco.Cms.Tests.Common.Testing;
-using Umbraco.Extensions;
-using Umbraco.Tests.TestHelpers;
-using Umbraco.Tests.Testing;
-
-namespace Umbraco.Tests.Web.Controllers
-{
-    [TestFixture]
-    [UmbracoTest(Database = UmbracoTestOptions.Database.None)]
-    public class AuthenticationControllerTests : TestWithDatabaseBase
-    {
-        protected override void ComposeApplication(bool withApplication)
-        {
-            base.ComposeApplication(withApplication);
-            //if (!withApplication) return;
-
-            // replace the true IUserService implementation with a mock
-            // so that each test can configure the service to their liking
-            Builder.Services.AddUnique(f => Mock.Of<IUserService>());
-
-            // kill the true IEntityService too
-            Builder.Services.AddUnique(f => Mock.Of<IEntityService>());
-
-            Builder.Services.AddUnique<UmbracoFeatures>();
-        }
-
-
-        // TODO Reintroduce when moved to .NET Core
-        // [Test]
-        // public async System.Threading.Tasks.Task GetCurrentUser_Fips()
-        // {
-        //     ApiController CtrlFactory(HttpRequestMessage message, IUmbracoContextAccessor umbracoContextAccessor)
-        //     {
-        //         //setup some mocks
-        //         var userServiceMock = Mock.Get(ServiceContext.UserService);
-        //         userServiceMock.Setup(service => service.GetUserById(It.IsAny<int>()))
-        //             .Returns(() => null);
-        //
-        //         if (Thread.GetDomain().GetData(".appPath") != null)
-        //         {
-        //             HttpContext.Current = new HttpContext(new SimpleWorkerRequest("", "", new StringWriter()));
-        //         }
-        //         else
-        //         {
-        //             var baseDir = IOHelper.MapPath("").TrimEnd(Path.DirectorySeparatorChar);
-        //             HttpContext.Current = new HttpContext(new SimpleWorkerRequest("/", baseDir, "", "", new StringWriter()));
-        //         }
-        //
-        //         var usersController = new AuthenticationController(
-        //             new TestUserPasswordConfig(),
-        //             Factory.GetInstance<IGlobalSettings>(),
-        //             Factory.GetInstance<IHostingEnvironment>(),
-        //             umbracoContextAccessor,
-        //             Factory.GetInstance<ISqlContext>(),
-        //             Factory.GetInstance<ServiceContext>(),
-        //             Factory.GetInstance<AppCaches>(),
-        //             Factory.GetInstance<IProfilingLogger>(),
-        //             Factory.GetInstance<IRuntimeState>(),
-        //             Factory.GetInstance<UmbracoMapper>(),
-        //             Factory.GetInstance<ISecuritySettings>(),
-        //             Factory.GetInstance<IPublishedUrlProvider>(),
-        //             Factory.GetInstance<IRequestAccessor>(),
-        //             Factory.GetInstance<IEmailSender>()
-        //         );
-        //         return usersController;
-        //     }
-        //
-        //     Mock.Get(Current.SqlContext)
-        //         .Setup(x => x.Query<IUser>())
-        //         .Returns(new Query<IUser>(Current.SqlContext));
-        //
-        //     var syntax = new SqlCeSyntaxProvider();
-        //
-        //     Mock.Get(Current.SqlContext)
-        //         .Setup(x => x.SqlSyntax)
-        //         .Returns(syntax);
-        //
-        //     var mappers = new MapperCollection(new[]
-        //     {
-        //         new UserMapper(new Lazy<ISqlContext>(() => Current.SqlContext), new ConcurrentDictionary<Type, ConcurrentDictionary<string, string>>())
-        //     });
-        //
-        //     Mock.Get(Current.SqlContext)
-        //         .Setup(x => x.Mappers)
-        //         .Returns(mappers);
-        //
-        //     // Testing what happens if the system were configured to only use FIPS-compliant algorithms
-        //     var typ = typeof(CryptoConfig);
-        //     var flds = typ.GetFields(BindingFlags.Static | BindingFlags.NonPublic);
-        //     var haveFld = flds.FirstOrDefault(f => f.Name == "s_haveFipsAlgorithmPolicy");
-        //     var isFld = flds.FirstOrDefault(f => f.Name == "s_fipsAlgorithmPolicy");
-        //     var originalFipsValue = CryptoConfig.AllowOnlyFipsAlgorithms;
-        //
-        //     try
-        //     {
-        //         if (!originalFipsValue)
-        //         {
-        //             haveFld.SetValue(null, true);
-        //             isFld.SetValue(null, true);
-        //         }
-        //
-        //         var runner = new TestRunner(CtrlFactory);
-        //         var response = await runner.Execute("Authentication", "GetCurrentUser", HttpMethod.Get);
-        //
-        //         var obj = JsonConvert.DeserializeObject<UserDetail>(response.Item2);
-        //         Assert.AreEqual(-1, obj.UserId);
-        //     }
-        //     finally
-        //     {
-        //         if (!originalFipsValue)
-        //         {
-        //             haveFld.SetValue(null, false);
-        //             isFld.SetValue(null, false);
-        //         }
-        //     }
-        // }
-    }
-}

legacy/Umbraco.Tests/unit-test-log4net.CI.config

@@ -1,6 +0,0 @@
-<?xml version="1.0"?>
-<log4net>
-  <root>
-    <priority value="OFF"/>
-  </root>
-</log4net>

legacy/Umbraco.Tests/unit-test-logger.config

@@ -1,20 +0,0 @@
-<?xml version="1.0" encoding="utf-8" ?>
-<configuration>
-    <appSettings>
-        <!-- Global Log Level event -->
-        <add key="serilog:minimum-level" value="Warning" />
-
-        <!-- Write to console -->
-        <add key="serilog:using:Console" value="Serilog.Sinks.Console" />
-        <add key="serilog:write-to:Console.theme" value="Serilog.Sinks.SystemConsole.Themes.AnsiConsoleTheme::Code, Serilog.Sinks.Console" />
-        <add key="serilog:write-to:Console.outputTemplate" value="[{Timestamp:HH:mm:ss} {Level:u3}] {Message:lj} &lt;s:{SourceContext}&gt;{NewLine}{Exception}" />
-
-        <!-- Namespace log levels -->
-        <add key="serilog:minimum-level:override:Umbraco.Core.Publishing.PublishingStrategy" value="Warning" />
-        <add key="serilog:minimum-level:override:Umbraco.Core.TypeLoader" value="Warning" />
-        <add key="serilog:minimum-level:override:Umbraco.Core.Persistence.UmbracoDatabase" value="Debug" />
-        <add key="serilog:minimum-level:override:Umbraco.Core.Persistence.Migrations.Initial.DatabaseSchemaCreation" value="Warning" />
-        <add key="serilog:minimum-level:override:Umbraco.Core.Persistence.Migrations.Initial.BaseDataCreation" value="Warning" />
-
-    </appSettings>
-</configuration>

nuget.config

@@ -2,7 +2,12 @@
 <configuration>
   <packageSources>
     <clear />
-    <add key="local" value="./nupkg" />
     <add key="nuget" value="https://api.nuget.org/v3/index.json" />
   </packageSources>
+  <packageSourceMapping>
+    <!-- Ensure all packages are pulled from NuGet -->
+    <packageSource key="nuget">
+      <package pattern="*" />
+    </packageSource>
+  </packageSourceMapping>
 </configuration>

src/Umbraco.Cms.Api.Common/Configuration/ConfigureUmbracoSwaggerGenOptions.cs

@@ -6,18 +6,25 @@ using Microsoft.Extensions.Options;
 using Microsoft.OpenApi.Models;
 using Swashbuckle.AspNetCore.SwaggerGen;
 using Umbraco.Cms.Api.Common.OpenApi;
-using Umbraco.Cms.Core.Models.DeliveryApi;
 using Umbraco.Extensions;
-using OperationIdRegexes = Umbraco.Cms.Api.Common.OpenApi.OperationIdRegexes;
 
 namespace Umbraco.Cms.Api.Common.Configuration;
 
 public class ConfigureUmbracoSwaggerGenOptions : IConfigureOptions<SwaggerGenOptions>
 {
     private readonly IOptions<ApiVersioningOptions> _apiVersioningOptions;
+    private readonly IOperationIdSelector _operationIdSelector;
+    private readonly ISchemaIdSelector _schemaIdSelector;
 
-    public ConfigureUmbracoSwaggerGenOptions(IOptions<ApiVersioningOptions> apiVersioningOptions)
-        => _apiVersioningOptions = apiVersioningOptions;
+    public ConfigureUmbracoSwaggerGenOptions(
+        IOptions<ApiVersioningOptions> apiVersioningOptions,
+        IOperationIdSelector operationIdSelector,
+        ISchemaIdSelector schemaIdSelector)
+    {
+        _apiVersioningOptions = apiVersioningOptions;
+        _operationIdSelector = operationIdSelector;
+        _schemaIdSelector = schemaIdSelector;
+    }
 
     public void Configure(SwaggerGenOptions swaggerGenOptions)
     {
@@ -30,9 +37,7 @@ public class ConfigureUmbracoSwaggerGenOptions : IConfigureOptions<SwaggerGenOpt
                 Description = "All endpoints not defined under specific APIs"
             });
 
-        swaggerGenOptions.CustomOperationIds(description =>
-            CustomOperationId(description, _apiVersioningOptions.Value));
-
+        swaggerGenOptions.CustomOperationIds(description => _operationIdSelector.OperationId(description, _apiVersioningOptions.Value));
         swaggerGenOptions.DocInclusionPredicate((name, api) =>
         {
             if (string.IsNullOrWhiteSpace(api.GroupName))
@@ -43,97 +48,18 @@ public class ConfigureUmbracoSwaggerGenOptions : IConfigureOptions<SwaggerGenOpt
             if (api.ActionDescriptor is ControllerActionDescriptor controllerActionDescriptor)
             {
                 return controllerActionDescriptor.MethodInfo.HasMapToApiAttribute(name);
-
             }
 
             return false;
         });
         swaggerGenOptions.TagActionsBy(api => new[] { api.GroupName });
         swaggerGenOptions.OrderActionsBy(ActionOrderBy);
-        swaggerGenOptions.DocumentFilter<MimeTypeDocumentFilter>();
         swaggerGenOptions.SchemaFilter<EnumSchemaFilter>();
-        swaggerGenOptions.CustomSchemaIds(SchemaIdGenerator.Generate);
+        swaggerGenOptions.CustomSchemaIds(_schemaIdSelector.SchemaId);
         swaggerGenOptions.SupportNonNullableReferenceTypes();
-        swaggerGenOptions.UseOneOfForPolymorphism();
-        swaggerGenOptions.UseAllOfForInheritance();
-        var cachedApiElementNamespace = typeof(ApiElement).Namespace ?? string.Empty;
-        swaggerGenOptions.SelectDiscriminatorNameUsing(type =>
-        {
-            if (type.Namespace != null && type.Namespace.StartsWith(cachedApiElementNamespace))
-            {
-                // We do not show type on delivery, as it is read only.
-                return null;
-            }
-
-            if (type.GetInterfaces().Any())
-            {
-                return "$type";
-            }
-
-            return null;
-        });
-        swaggerGenOptions.SelectDiscriminatorValueUsing(x => x.Name);
-    }
-
-    private static string CustomOperationId(ApiDescription api, ApiVersioningOptions apiVersioningOptions)
-    {
-        ApiVersion defaultVersion = apiVersioningOptions.DefaultApiVersion;
-        var httpMethod = api.HttpMethod?.ToLower().ToFirstUpper() ?? "Get";
-
-        // if the route info "Name" is supplied we'll use this explicitly as the operation ID
-        // - usage example: [HttpGet("my-api/route}", Name = "MyCustomRoute")]
-        if (string.IsNullOrWhiteSpace(api.ActionDescriptor.AttributeRouteInfo?.Name) == false)
-        {
-            var explicitOperationId = api.ActionDescriptor.AttributeRouteInfo!.Name;
-            return explicitOperationId.InvariantStartsWith(httpMethod)
-                ? explicitOperationId
-                : $"{httpMethod}{explicitOperationId}";
-        }
-
-        var relativePath = api.RelativePath;
-
-        if (string.IsNullOrWhiteSpace(relativePath))
-        {
-            throw new Exception(
-                $"There is no relative path for controller action {api.ActionDescriptor.RouteValues["controller"]}");
-        }
-
-        // Remove the prefixed base path with version, e.g. /umbraco/management/api/v1/tracked-reference/{id} => tracked-reference/{id}
-        var unprefixedRelativePath = OperationIdRegexes
-            .VersionPrefixRegex()
-            .Replace(relativePath, string.Empty);
-
-        // Remove template placeholders, e.g. tracked-reference/{id} => tracked-reference/Id
-        var formattedOperationId = OperationIdRegexes
-            .TemplatePlaceholdersRegex()
-            .Replace(unprefixedRelativePath, m => $"By{m.Groups[1].Value.ToFirstUpper()}");
-
-        // Remove dashes (-) and slashes (/) and convert the following letter to uppercase with
-        // the word "By" in front, e.g. tracked-reference/Id => TrackedReferenceById
-        formattedOperationId = OperationIdRegexes
-            .ToCamelCaseRegex()
-            .Replace(formattedOperationId, m => m.Groups[1].Value.ToUpper());
-
-        //Get map to version attribute
-        string? version = null;
-
-        if (api.ActionDescriptor is ControllerActionDescriptor controllerActionDescriptor)
-        {
-            var versionAttributeValue = controllerActionDescriptor.MethodInfo.GetMapToApiVersionAttributeValue();
-
-            // We only wanna add a version, if it is not the default one.
-            if (string.Equals(versionAttributeValue, defaultVersion.ToString()) == false)
-            {
-                version = versionAttributeValue;
-            }
-        }
-
-        // Return the operation ID with the formatted http method verb in front, e.g. GetTrackedReferenceById
-        return $"{httpMethod}{formattedOperationId.ToFirstUpper()}{version}";
     }
 
     // see https://github.com/domaindrivendev/Swashbuckle.AspNetCore#change-operation-sort-order-eg-for-ui-sorting
     private static string ActionOrderBy(ApiDescription apiDesc)
         => $"{apiDesc.GroupName}_{apiDesc.ActionDescriptor.AttributeRouteInfo?.Template ?? apiDesc.ActionDescriptor.RouteValues["controller"]}_{apiDesc.ActionDescriptor.RouteValues["action"]}_{apiDesc.HttpMethod}";
-
 }

src/Umbraco.Cms.Api.Common/DependencyInjection/UmbracoBuilderApiExtensions.cs

@@ -1,20 +1,9 @@
-using Microsoft.AspNetCore.Builder;
-using Microsoft.AspNetCore.Hosting;
-using Microsoft.AspNetCore.Http;
 using Microsoft.Extensions.DependencyInjection;
-using Microsoft.Extensions.FileProviders;
-using Microsoft.Extensions.Hosting;
-using Microsoft.Extensions.Options;
-using Microsoft.OpenApi.Models;
-using Swashbuckle.AspNetCore.SwaggerGen;
 using Umbraco.Cms.Api.Common.Configuration;
+using Umbraco.Cms.Api.Common.OpenApi;
 using Umbraco.Cms.Api.Common.Serialization;
-using Umbraco.Cms.Core;
-using Umbraco.Cms.Core.Configuration.Models;
 using Umbraco.Cms.Core.DependencyInjection;
 using Umbraco.Cms.Web.Common.ApplicationBuilder;
-using Umbraco.Extensions;
-using IHostingEnvironment = Umbraco.Cms.Core.Hosting.IHostingEnvironment;
 
 namespace Umbraco.Cms.Api.Common.DependencyInjection;
 
@@ -25,50 +14,9 @@ public static class UmbracoBuilderApiExtensions
         builder.Services.AddSwaggerGen();
         builder.Services.ConfigureOptions<ConfigureUmbracoSwaggerGenOptions>();
         builder.Services.AddSingleton<IUmbracoJsonTypeInfoResolver, UmbracoJsonTypeInfoResolver>();
-
-        builder.Services.Configure<UmbracoPipelineOptions>(options =>
-        {
-            options.AddFilter(new UmbracoPipelineFilter(
-                "UmbracoApiCommon",
-                applicationBuilder =>
-                {
-
-                },
-                applicationBuilder =>
-                {
-                    IServiceProvider provider = applicationBuilder.ApplicationServices;
-                    IWebHostEnvironment webHostEnvironment = provider.GetRequiredService<IWebHostEnvironment>();
-                    IOptions<SwaggerGenOptions> swaggerGenOptions = provider.GetRequiredService<IOptions<SwaggerGenOptions>>();
-
-
-                    if (!webHostEnvironment.IsProduction())
-                    {
-                        GlobalSettings? settings = provider.GetRequiredService<IOptions<GlobalSettings>>().Value;
-                        IHostingEnvironment hostingEnvironment = provider.GetRequiredService<IHostingEnvironment>();
-                        var umbracoPath = settings.GetBackOfficePath(hostingEnvironment);
-
-                        applicationBuilder.UseSwagger(swaggerOptions =>
-                        {
-                            swaggerOptions.RouteTemplate =
-                                $"{umbracoPath.TrimStart(Constants.CharArrays.ForwardSlash)}/swagger/{{documentName}}/swagger.json";
-                        });
-                        applicationBuilder.UseSwaggerUI(
-                            swaggerUiOptions =>
-                            {
-                                swaggerUiOptions.RoutePrefix = $"{umbracoPath.TrimStart(Constants.CharArrays.ForwardSlash)}/swagger";
-
-                                foreach ((var name, OpenApiInfo? apiInfo) in swaggerGenOptions.Value.SwaggerGeneratorOptions.SwaggerDocs.OrderBy(x=>x.Value.Title))
-                                {
-                                    swaggerUiOptions.SwaggerEndpoint($"{name}/swagger.json", $"{apiInfo.Title}");
-                                }
-                            });
-                    }
-                },
-                applicationBuilder =>
-                {
-
-                }));
-        });
+        builder.Services.AddSingleton<IOperationIdSelector, OperationIdSelector>();
+        builder.Services.AddSingleton<ISchemaIdSelector, SchemaIdSelector>();
+        builder.Services.Configure<UmbracoPipelineOptions>(options => options.AddFilter(new SwaggerRouteTemplatePipelineFilter("UmbracoApiCommon")));
 
         return builder;
     }

src/Umbraco.Cms.Api.Common/DependencyInjection/UmbracoBuilderAuthExtensions.cs

@@ -0,0 +1,109 @@
+using System.Security.Cryptography;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.IdentityModel.Tokens;
+using Umbraco.Cms.Api.Common.Security;
+using Umbraco.Cms.Core;
+using Umbraco.Cms.Core.DependencyInjection;
+using Umbraco.Cms.Infrastructure.HostedServices;
+
+namespace Umbraco.Cms.Api.Common.DependencyInjection;
+
+public static class UmbracoBuilderAuthExtensions
+{
+    private static bool _initialized;
+
+    public static IUmbracoBuilder AddUmbracoOpenIddict(this IUmbracoBuilder builder)
+    {
+        if (_initialized is false)
+        {
+            ConfigureOpenIddict(builder);
+            _initialized = true;
+        }
+
+        return builder;
+    }
+
+    private static void ConfigureOpenIddict(IUmbracoBuilder builder)
+    {
+        builder.Services.AddOpenIddict()
+            // Register the OpenIddict server components.
+            .AddServer(options =>
+            {
+                // Enable the authorization and token endpoints.
+                // - important: member endpoints MUST be added before backoffice endpoints to ensure that auto-discovery works for members
+                // FIXME: swap paths here so member API is first (see comment above)
+                options
+                    .SetAuthorizationEndpointUris(
+                        Paths.MemberApi.AuthorizationEndpoint.TrimStart(Constants.CharArrays.ForwardSlash))
+                    .SetTokenEndpointUris(
+                        Paths.MemberApi.TokenEndpoint.TrimStart(Constants.CharArrays.ForwardSlash))
+                    .SetLogoutEndpointUris(
+                        Paths.MemberApi.LogoutEndpoint.TrimStart(Constants.CharArrays.ForwardSlash))
+                    .SetRevocationEndpointUris(
+                        Paths.MemberApi.RevokeEndpoint.TrimStart(Constants.CharArrays.ForwardSlash))
+                    .SetUserinfoEndpointUris(
+                        Paths.MemberApi.UserinfoEndpoint.TrimStart(Constants.CharArrays.ForwardSlash));
+
+                // Enable authorization code flow with PKCE
+                options
+                    .AllowAuthorizationCodeFlow()
+                    .RequireProofKeyForCodeExchange()
+                    .AllowRefreshTokenFlow();
+
+                // Register the ASP.NET Core host and configure for custom authentication endpoint.
+                options
+                    .UseAspNetCore()
+                    .EnableAuthorizationEndpointPassthrough()
+                    .EnableLogoutEndpointPassthrough()
+                    .EnableUserinfoEndpointPassthrough();
+
+                // Enable reference tokens
+                // - see https://documentation.openiddict.com/configuration/token-storage.html
+                options
+                    .UseReferenceAccessTokens()
+                    .UseReferenceRefreshTokens();
+
+                // Use ASP.NET Core Data Protection for tokens instead of JWT.
+                // This is more secure, and has the added benefit of having a high throughput
+                // but means that all servers (such as in a load balanced setup)
+                // needs to use the same application name and key ring,
+                // however this is already recommended for load balancing, so should be fine.
+                // See https://documentation.openiddict.com/configuration/token-formats.html#switching-to-data-protection-tokens
+                // and https://learn.microsoft.com/en-us/aspnet/core/security/data-protection/configuration/overview?view=aspnetcore-7.0
+                // for more information
+                options.UseDataProtection();
+
+                // Register encryption and signing credentials to protect tokens.
+                // Note that for tokens generated/validated using ASP.NET Core Data Protection,
+                // a separate key ring is used, distinct from the credentials discussed in
+                // https://documentation.openiddict.com/configuration/encryption-and-signing-credentials.html
+                // More details can be found here: https://github.com/openiddict/openiddict-core/issues/1892#issuecomment-1737308506
+                // "When using ASP.NET Core Data Protection to generate opaque tokens, the signing and encryption credentials
+                // registered via Add*Key/Certificate() are not used". But since OpenIddict requires the registration of such,
+                // we can generate random keys per instance without them taking effect.
+                // - see also https://github.com/openiddict/openiddict-core/issues/1231
+                options
+                    .AddEncryptionKey(new SymmetricSecurityKey(RandomNumberGenerator.GetBytes(32))) // generate a cryptographically secure random 256-bits key
+                    .AddSigningKey(new RsaSecurityKey(RSA.Create(keySizeInBits: 2048))); // generate RSA key with recommended size of 2048-bits
+            })
+
+            // Register the OpenIddict validation components.
+            .AddValidation(options =>
+            {
+                // Import the configuration from the local OpenIddict server instance.
+                options.UseLocalServer();
+
+                // Register the ASP.NET Core host.
+                options.UseAspNetCore();
+
+                // Enable token entry validation
+                // - see https://documentation.openiddict.com/configuration/token-storage.html#enabling-token-entry-validation-at-the-api-level
+                options.EnableTokenEntryValidation();
+
+                // Use ASP.NET Core Data Protection for tokens instead of JWT. (see note in AddServer)
+                options.UseDataProtection();
+            });
+
+        builder.Services.AddHostedService<OpenIddictCleanup>();
+    }
+}

src/Umbraco.Cms.Api.Common/OpenApi/EnumSchemaFilter.cs

@@ -12,6 +12,8 @@ public class EnumSchemaFilter : ISchemaFilter
     {
         if (context.Type.IsEnum)
         {
+            model.Type = "string";
+            model.Format = null;
             model.Enum.Clear();
             foreach (var name in Enum.GetNames(context.Type))
             {

src/Umbraco.Cms.Api.Common/OpenApi/IOperationIdSelector.cs

@@ -0,0 +1,9 @@
+using Asp.Versioning;
+using Microsoft.AspNetCore.Mvc.ApiExplorer;
+
+namespace Umbraco.Cms.Api.Common.OpenApi;
+
+public interface IOperationIdSelector
+{
+    string? OperationId(ApiDescription apiDescription, ApiVersioningOptions apiVersioningOptions);
+}

src/Umbraco.Cms.Api.Common/OpenApi/ISchemaIdSelector.cs

@@ -0,0 +1,6 @@
+namespace Umbraco.Cms.Api.Common.OpenApi;
+
+public interface ISchemaIdSelector
+{
+    string SchemaId(Type type);
+}

src/Umbraco.Cms.Api.Common/OpenApi/MimeTypeDocumentFilter.cs

@@ -5,12 +5,21 @@ using Umbraco.Extensions;
 namespace Umbraco.Cms.Api.Common.OpenApi;
 
 /// <summary>
-/// This filter explicitly removes all other mime types than application/json from the produced OpenAPI document when application/json is accepted.
+/// This filter explicitly removes all other mime types than application/json from a named OpenAPI document when application/json is accepted.
 /// </summary>
 public class MimeTypeDocumentFilter : IDocumentFilter
 {
+    private readonly string _documentName;
+
+    public MimeTypeDocumentFilter(string documentName) => _documentName = documentName;
+
     public void Apply(OpenApiDocument swaggerDoc, DocumentFilterContext context)
     {
+        if (context.DocumentName != _documentName)
+        {
+            return;
+        }
+
         OpenApiOperation[] operations = swaggerDoc.Paths
             .SelectMany(path => path.Value.Operations.Values)
             .ToArray();

src/Umbraco.Cms.Api.Common/OpenApi/OperationIdSelector.cs

@@ -0,0 +1,79 @@
+using Asp.Versioning;
+using Microsoft.AspNetCore.Mvc.ApiExplorer;
+using Microsoft.AspNetCore.Mvc.Controllers;
+using Umbraco.Extensions;
+
+namespace Umbraco.Cms.Api.Common.OpenApi;
+
+public class OperationIdSelector : IOperationIdSelector
+{
+    public virtual string? OperationId(ApiDescription apiDescription, ApiVersioningOptions apiVersioningOptions)
+    {
+        if (apiDescription.ActionDescriptor is not ControllerActionDescriptor controllerActionDescriptor
+            || controllerActionDescriptor.ControllerTypeInfo.Namespace?.StartsWith("Umbraco.Cms.Api") is not true)
+        {
+            return null;
+        }
+
+        return UmbracoOperationId(apiDescription, apiVersioningOptions);
+    }
+
+    protected string? UmbracoOperationId(ApiDescription apiDescription, ApiVersioningOptions apiVersioningOptions)
+    {
+        if (apiDescription.ActionDescriptor is not ControllerActionDescriptor controllerActionDescriptor)
+        {
+            return null;
+        }
+
+        ApiVersion defaultVersion = apiVersioningOptions.DefaultApiVersion;
+        var httpMethod = apiDescription.HttpMethod?.ToLower().ToFirstUpper() ?? "Get";
+
+        // if the route info "Name" is supplied we'll use this explicitly as the operation ID
+        // - usage example: [HttpGet("my-api/route}", Name = "MyCustomRoute")]
+        if (string.IsNullOrWhiteSpace(apiDescription.ActionDescriptor.AttributeRouteInfo?.Name) == false)
+        {
+            var explicitOperationId = apiDescription.ActionDescriptor.AttributeRouteInfo!.Name;
+            return explicitOperationId.InvariantStartsWith(httpMethod)
+                ? explicitOperationId
+                : $"{httpMethod}{explicitOperationId}";
+        }
+
+        var relativePath = apiDescription.RelativePath;
+
+        if (string.IsNullOrWhiteSpace(relativePath))
+        {
+            throw new Exception(
+                $"There is no relative path for controller action {apiDescription.ActionDescriptor.RouteValues["controller"]}");
+        }
+
+        // Remove the prefixed base path with version, e.g. /umbraco/management/api/v1/tracked-reference/{id} => tracked-reference/{id}
+        var unprefixedRelativePath = OperationIdRegexes
+            .VersionPrefixRegex()
+            .Replace(relativePath, string.Empty);
+
+        // Remove template placeholders, e.g. tracked-reference/{id} => tracked-reference/Id
+        var formattedOperationId = OperationIdRegexes
+            .TemplatePlaceholdersRegex()
+            .Replace(unprefixedRelativePath, m => $"By{m.Groups[1].Value.ToFirstUpper()}");
+
+        // Remove dashes (-) and slashes (/) and convert the following letter to uppercase with
+        // the word "By" in front, e.g. tracked-reference/Id => TrackedReferenceById
+        formattedOperationId = OperationIdRegexes
+            .ToCamelCaseRegex()
+            .Replace(formattedOperationId, m => m.Groups[1].Value.ToUpper());
+
+        //Get map to version attribute
+        string? version = null;
+
+        var versionAttributeValue = controllerActionDescriptor.MethodInfo.GetMapToApiVersionAttributeValue();
+
+        // We only wanna add a version, if it is not the default one.
+        if (string.Equals(versionAttributeValue, defaultVersion.ToString()) == false)
+        {
+            version = versionAttributeValue;
+        }
+
+        // Return the operation ID with the formatted http method verb in front, e.g. GetTrackedReferenceById
+        return $"{httpMethod}{formattedOperationId.ToFirstUpper()}{version}";
+    }
+}

src/Umbraco.Cms.Api.Common/OpenApi/SchemaIdSelector.cs

@@ -3,9 +3,12 @@ using Umbraco.Extensions;
 
 namespace Umbraco.Cms.Api.Common.OpenApi;
 
-internal static class SchemaIdGenerator
+public class SchemaIdSelector : ISchemaIdSelector
 {
-    public static string Generate(Type type)
+    public virtual string SchemaId(Type type)
+        => type.Namespace?.StartsWith("Umbraco.Cms") is true ? UmbracoSchemaId(type) : type.Name;
+
+    protected string UmbracoSchemaId(Type type)
     {
         string SanitizedTypeName(Type t) => t.Name
             // first grab the "non generic" part of any generic type name (i.e. "PagedViewModel`1" becomes "PagedViewModel")

src/Umbraco.Cms.Api.Common/OpenApi/SwaggerRouteTemplatePipelineFilter.cs

@@ -0,0 +1,75 @@
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Hosting;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Hosting;
+using Microsoft.Extensions.Options;
+using Microsoft.OpenApi.Models;
+using Swashbuckle.AspNetCore.SwaggerGen;
+using Swashbuckle.AspNetCore.SwaggerUI;
+using Umbraco.Cms.Core;
+using Umbraco.Cms.Core.Configuration.Models;
+using Umbraco.Cms.Web.Common.ApplicationBuilder;
+using Umbraco.Extensions;
+using IHostingEnvironment = Umbraco.Cms.Core.Hosting.IHostingEnvironment;
+
+namespace Umbraco.Cms.Api.Common.OpenApi;
+
+public class SwaggerRouteTemplatePipelineFilter : UmbracoPipelineFilter
+{
+    public SwaggerRouteTemplatePipelineFilter(string name)
+        : base(name)
+        => PostPipeline = PostPipelineAction;
+
+    private void PostPipelineAction(IApplicationBuilder applicationBuilder)
+    {
+        if (SwaggerIsEnabled(applicationBuilder) is false)
+        {
+            return;
+        }
+
+        IOptions<SwaggerGenOptions> swaggerGenOptions = applicationBuilder.ApplicationServices.GetRequiredService<IOptions<SwaggerGenOptions>>();
+
+        applicationBuilder.UseSwagger(swaggerOptions =>
+            {
+                swaggerOptions.RouteTemplate = SwaggerRouteTemplate(applicationBuilder);
+            });
+
+        applicationBuilder.UseSwaggerUI(swaggerUiOptions => SwaggerUiConfiguration(swaggerUiOptions, swaggerGenOptions.Value, applicationBuilder));
+    }
+
+    protected virtual bool SwaggerIsEnabled(IApplicationBuilder applicationBuilder)
+    {
+        IWebHostEnvironment webHostEnvironment = applicationBuilder.ApplicationServices.GetRequiredService<IWebHostEnvironment>();
+        return webHostEnvironment.IsProduction() is false;
+    }
+
+    protected virtual string SwaggerRouteTemplate(IApplicationBuilder applicationBuilder)
+        => $"{GetUmbracoPath(applicationBuilder).TrimStart(Constants.CharArrays.ForwardSlash)}/swagger/{{documentName}}/swagger.json";
+
+    protected virtual string SwaggerUiRoutePrefix(IApplicationBuilder applicationBuilder)
+        => $"{GetUmbracoPath(applicationBuilder).TrimStart(Constants.CharArrays.ForwardSlash)}/swagger";
+
+    protected virtual void SwaggerUiConfiguration(
+        SwaggerUIOptions swaggerUiOptions,
+        SwaggerGenOptions swaggerGenOptions,
+        IApplicationBuilder applicationBuilder)
+    {
+        swaggerUiOptions.RoutePrefix = SwaggerUiRoutePrefix(applicationBuilder);
+
+        foreach ((var name, OpenApiInfo? apiInfo) in swaggerGenOptions.SwaggerGeneratorOptions.SwaggerDocs
+                     .OrderBy(x => x.Value.Title))
+        {
+            swaggerUiOptions.SwaggerEndpoint($"{name}/swagger.json", $"{apiInfo.Title}");
+        }
+
+        swaggerUiOptions.OAuthUsePkce();
+    }
+
+    private string GetUmbracoPath(IApplicationBuilder applicationBuilder)
+    {
+        GlobalSettings settings = applicationBuilder.ApplicationServices.GetRequiredService<IOptions<GlobalSettings>>().Value;
+        IHostingEnvironment hostingEnvironment = applicationBuilder.ApplicationServices.GetRequiredService<IHostingEnvironment>();
+
+        return settings.GetBackOfficePath(hostingEnvironment);
+    }
+}

src/Umbraco.Cms.Api.Common/Security/Paths.cs

@@ -0,0 +1,22 @@
+namespace Umbraco.Cms.Api.Common.Security;
+
+public static class Paths
+{
+    public static class MemberApi
+    {
+        public const string EndpointTemplate = "security/member";
+
+        public static readonly string AuthorizationEndpoint = EndpointPath($"{EndpointTemplate}/authorize");
+
+        public static readonly string TokenEndpoint = EndpointPath($"{EndpointTemplate}/token");
+
+        public static readonly string LogoutEndpoint = EndpointPath($"{EndpointTemplate}/signout");
+
+        public static readonly string RevokeEndpoint = EndpointPath($"{EndpointTemplate}/revoke");
+
+        public static readonly string UserinfoEndpoint = EndpointPath($"{EndpointTemplate}/userinfo");
+
+        // NOTE: we're NOT using /api/v1.0/ here because it will clash with the Delivery API docs
+        private static string EndpointPath(string relativePath) => $"/umbraco/delivery/api/v1/{relativePath}";
+    }
+}

src/Umbraco.Cms.Api.Common/Umbraco.Cms.Api.Common.csproj

@@ -2,17 +2,24 @@
   <PropertyGroup>
     <Title>Umbraco CMS - API Common</Title>
     <Description>Contains the bits and pieces that are shared between the Umbraco CMS APIs.</Description>
-    <IsPackable>true</IsPackable>
-    <EnablePackageValidation>false</EnablePackageValidation>
-    <AssemblyName>Umbraco.Cms.Api.Common</AssemblyName>
-    <RootNamespace>Umbraco.Cms.Api.Common</RootNamespace>
   </PropertyGroup>
+
   <ItemGroup>
-    <PackageReference Include="Microsoft.AspNetCore.App" Version="2.2.8" />
-    <PackageReference Include="Swashbuckle.AspNetCore" Version="6.5.0" />
-    <PackageReference Include="OpenIddict.Abstractions" Version="4.2.0" />
-    <PackageReference Include="OpenIddict.AspNetCore" Version="4.2.0" />
+    <FrameworkReference Include="Microsoft.AspNetCore.App" />
   </ItemGroup>
+
+  <ItemGroup>
+    <PackageReference Include="Swashbuckle.AspNetCore" />
+    <PackageReference Include="OpenIddict.Abstractions" />
+    <PackageReference Include="OpenIddict.AspNetCore" />
+
+    <!-- Both OpenIddict.AspNetCore, Npoco.SqlServer and Microsoft.EntityFrameworkCore.SqlServer bring in a vulnerable version of Microsoft.IdentityModel.JsonWebTokens -->
+    <PackageReference Include="Microsoft.IdentityModel.JsonWebTokens"/>
+
+    <!-- Take top-level depedendency on OpenIddict.AspNetCore depends on a vulnerable version -->
+    <PackageReference Include="Microsoft.Extensions.Caching.Memory" />
+  </ItemGroup>
+
   <ItemGroup>
     <ProjectReference Include="..\Umbraco.Core\Umbraco.Core.csproj" />
     <ProjectReference Include="..\Umbraco.Web.Common\Umbraco.Web.Common.csproj" />

src/Umbraco.Cms.Api.Delivery/Caching/DeliveryApiOutputCachePolicy.cs

@@ -0,0 +1,43 @@
+using Microsoft.AspNetCore.OutputCaching;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Primitives;
+using Umbraco.Cms.Core.DeliveryApi;
+
+namespace Umbraco.Cms.Api.Delivery.Caching;
+
+internal sealed class DeliveryApiOutputCachePolicy : IOutputCachePolicy
+{
+    private readonly TimeSpan _duration;
+    private readonly StringValues _varyByHeaderNames;
+
+    public DeliveryApiOutputCachePolicy(TimeSpan duration, StringValues varyByHeaderNames)
+    {
+        _duration = duration;
+        _varyByHeaderNames = varyByHeaderNames;
+    }
+
+    ValueTask IOutputCachePolicy.CacheRequestAsync(OutputCacheContext context, CancellationToken cancellationToken)
+    {
+        IRequestPreviewService requestPreviewService = context
+            .HttpContext
+            .RequestServices
+            .GetRequiredService<IRequestPreviewService>();
+
+        IApiAccessService apiAccessService = context
+            .HttpContext
+            .RequestServices
+            .GetRequiredService<IApiAccessService>();
+
+        context.EnableOutputCaching = requestPreviewService.IsPreview() is false && apiAccessService.HasPublicAccess();
+        context.ResponseExpirationTimeSpan = _duration;
+        context.CacheVaryByRules.HeaderNames = _varyByHeaderNames;
+
+        return ValueTask.CompletedTask;
+    }
+
+    ValueTask IOutputCachePolicy.ServeFromCacheAsync(OutputCacheContext context, CancellationToken cancellationToken)
+        => ValueTask.CompletedTask;
+
+    ValueTask IOutputCachePolicy.ServeResponseAsync(OutputCacheContext context, CancellationToken cancellationToken)
+        => ValueTask.CompletedTask;
+}

src/Umbraco.Cms.Api.Delivery/Caching/OutputCachePipelineFilter.cs

@@ -0,0 +1,14 @@
+using Microsoft.AspNetCore.Builder;
+using Umbraco.Cms.Web.Common.ApplicationBuilder;
+
+namespace Umbraco.Cms.Api.Delivery.Caching;
+
+internal sealed class OutputCachePipelineFilter : UmbracoPipelineFilter
+{
+    public OutputCachePipelineFilter(string name)
+        : base(name)
+        => PostPipeline = PostPipelineAction;
+
+    private void PostPipelineAction(IApplicationBuilder applicationBuilder)
+        => applicationBuilder.UseOutputCache();
+}

src/Umbraco.Cms.Api.Delivery/Configuration/ConfigureUmbracoDeliveryApiSwaggerGenOptions.cs

@@ -2,6 +2,8 @@ using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Options;
 using Microsoft.OpenApi.Models;
 using Swashbuckle.AspNetCore.SwaggerGen;
+using Umbraco.Cms.Api.Common.OpenApi;
+using Umbraco.Cms.Api.Delivery.Filters;
 
 namespace Umbraco.Cms.Api.Delivery.Configuration;
 
@@ -15,6 +17,14 @@ public class ConfigureUmbracoDeliveryApiSwaggerGenOptions: IConfigureOptions<Swa
             {
                 Title = DeliveryApiConfiguration.ApiTitle,
                 Version = "Latest",
+                Description = $"You can find out more about the {DeliveryApiConfiguration.ApiTitle} in [the documentation]({DeliveryApiConfiguration.ApiDocumentationContentArticleLink})."
             });
+
+        swaggerGenOptions.DocumentFilter<MimeTypeDocumentFilter>(DeliveryApiConfiguration.ApiName);
+
+        swaggerGenOptions.OperationFilter<SwaggerContentDocumentationFilter>();
+        swaggerGenOptions.OperationFilter<SwaggerMediaDocumentationFilter>();
+        swaggerGenOptions.ParameterFilter<SwaggerContentDocumentationFilter>();
+        swaggerGenOptions.ParameterFilter<SwaggerMediaDocumentationFilter>();
     }
 }

src/Umbraco.Cms.Api.Delivery/Configuration/ConfigureUmbracoMemberAuthenticationDeliveryApiSwaggerGenOptions.cs

@@ -0,0 +1,74 @@
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Options;
+using Microsoft.OpenApi.Models;
+using Swashbuckle.AspNetCore.SwaggerGen;
+using Umbraco.Cms.Api.Common.Security;
+using Umbraco.Cms.Api.Delivery.Controllers.Content;
+using Umbraco.Cms.Api.Delivery.Filters;
+
+namespace Umbraco.Cms.Api.Delivery.Configuration;
+
+/// <summary>
+/// This configures member authentication for the Delivery API in Swagger. Consult the docs for
+/// member authentication within the Delivery API for instructions on how to use this.
+/// </summary>
+/// <remarks>
+/// This class is not used by the core CMS due to the required installation dependencies (local login page among other things).
+/// </remarks>
+public class ConfigureUmbracoMemberAuthenticationDeliveryApiSwaggerGenOptions : IConfigureOptions<SwaggerGenOptions>
+{
+    private const string AuthSchemeName = "Umbraco Member";
+
+    public void Configure(SwaggerGenOptions options)
+    {
+        options.AddSecurityDefinition(
+            AuthSchemeName,
+            new OpenApiSecurityScheme
+            {
+                In = ParameterLocation.Header,
+                Name = AuthSchemeName,
+                Type = SecuritySchemeType.OAuth2,
+                Description = "Umbraco Member Authentication",
+                Flows = new OpenApiOAuthFlows
+                {
+                    AuthorizationCode = new OpenApiOAuthFlow
+                    {
+                        AuthorizationUrl = new Uri(Paths.MemberApi.AuthorizationEndpoint, UriKind.Relative),
+                        TokenUrl = new Uri(Paths.MemberApi.TokenEndpoint, UriKind.Relative)
+                    }
+                }
+            });
+
+        // add security requirements for content API operations
+        options.OperationFilter<DeliveryApiSecurityFilter>();
+    }
+
+    private class DeliveryApiSecurityFilter : SwaggerFilterBase<ContentApiControllerBase>, IOperationFilter
+    {
+        public void Apply(OpenApiOperation operation, OperationFilterContext context)
+        {
+            if (CanApply(context) is false)
+            {
+                return;
+            }
+
+            operation.Security = new List<OpenApiSecurityRequirement>
+            {
+                new OpenApiSecurityRequirement
+                {
+                    {
+                        new OpenApiSecurityScheme
+                        {
+                            Reference = new OpenApiReference
+                            {
+                                Type = ReferenceType.SecurityScheme,
+                                Id = AuthSchemeName,
+                            }
+                        },
+                        new string[] { }
+                    }
+                }
+            };
+        }
+    }
+}

src/Umbraco.Cms.Api.Delivery/Configuration/DeliveryApiConfiguration.cs

@@ -5,4 +5,8 @@ internal static class DeliveryApiConfiguration
     internal const string ApiTitle = "Umbraco Delivery API";
 
     internal const string ApiName = "delivery";
+
+    internal const string ApiDocumentationContentArticleLink = "https://docs.umbraco.com/umbraco-cms/reference/content-delivery-api";
+
+    internal const string ApiDocumentationMediaArticleLink = "https://docs.umbraco.com/umbraco-cms/reference/content-delivery-api/media-delivery-api";
 }

src/Umbraco.Cms.Api.Delivery/Controllers/ByIdContentApiController.cs

@@ -1,54 +0,0 @@
-using Asp.Versioning;
-using Microsoft.AspNetCore.Http;
-using Microsoft.AspNetCore.Mvc;
-using Umbraco.Cms.Core.DeliveryApi;
-using Umbraco.Cms.Core.Models.DeliveryApi;
-using Umbraco.Cms.Core.Models.PublishedContent;
-using Umbraco.Cms.Core.Services;
-
-namespace Umbraco.Cms.Api.Delivery.Controllers;
-
-[ApiVersion("1.0")]
-public class ByIdContentApiController : ContentApiItemControllerBase
-{
-    public ByIdContentApiController(
-        IApiPublishedContentCache apiPublishedContentCache,
-        IApiContentResponseBuilder apiContentResponseBuilder,
-        IPublicAccessService publicAccessService)
-        : base(apiPublishedContentCache, apiContentResponseBuilder, publicAccessService)
-    {
-    }
-
-    /// <summary>
-    ///     Gets a content item by id.
-    /// </summary>
-    /// <param name="id">The unique identifier of the content item.</param>
-    /// <returns>The content item or not found result.</returns>
-    [HttpGet("item/{id:guid}")]
-    [MapToApiVersion("1.0")]
-    [ProducesResponseType(typeof(IApiContentResponse), StatusCodes.Status200OK)]
-    [ProducesResponseType(StatusCodes.Status401Unauthorized)]
-    [ProducesResponseType(StatusCodes.Status404NotFound)]
-    public async Task<IActionResult> ById(Guid id)
-    {
-        IPublishedContent? contentItem = ApiPublishedContentCache.GetById(id);
-
-        if (contentItem is null)
-        {
-            return NotFound();
-        }
-
-        if (IsProtected(contentItem))
-        {
-            return Unauthorized();
-        }
-
-        IApiContentResponse? apiContentResponse = ApiContentResponseBuilder.Build(contentItem);
-        if (apiContentResponse is null)
-        {
-            return NotFound();
-        }
-
-        return await Task.FromResult(Ok(apiContentResponse));
-    }
-}

src/Umbraco.Cms.Api.Delivery/Controllers/ByRouteContentApiController.cs

@@ -1,70 +0,0 @@
-using Asp.Versioning;
-using Microsoft.AspNetCore.Http;
-using Microsoft.AspNetCore.Mvc;
-using Umbraco.Cms.Core.DeliveryApi;
-using Umbraco.Cms.Core.Models.DeliveryApi;
-using Umbraco.Cms.Core.Models.PublishedContent;
-using Umbraco.Cms.Core.Services;
-
-namespace Umbraco.Cms.Api.Delivery.Controllers;
-
-[ApiVersion("1.0")]
-public class ByRouteContentApiController : ContentApiItemControllerBase
-{
-    private readonly IRequestRoutingService _requestRoutingService;
-    private readonly IRequestRedirectService _requestRedirectService;
-
-    public ByRouteContentApiController(
-        IApiPublishedContentCache apiPublishedContentCache,
-        IApiContentResponseBuilder apiContentResponseBuilder,
-        IPublicAccessService publicAccessService,
-        IRequestRoutingService requestRoutingService,
-        IRequestRedirectService requestRedirectService)
-        : base(apiPublishedContentCache, apiContentResponseBuilder, publicAccessService)
-    {
-        _requestRoutingService = requestRoutingService;
-        _requestRedirectService = requestRedirectService;
-    }
-
-    /// <summary>
-    ///     Gets a content item by route.
-    /// </summary>
-    /// <param name="path">The path to the content item.</param>
-    /// <remarks>
-    ///     Optional URL segment for the root content item
-    ///     can be added through the "start-item" header.
-    /// </remarks>
-    /// <returns>The content item or not found result.</returns>
-    [HttpGet("item/{*path}")]
-    [MapToApiVersion("1.0")]
-    [ProducesResponseType(typeof(IApiContentResponse), StatusCodes.Status200OK)]
-    [ProducesResponseType(StatusCodes.Status401Unauthorized)]
-    [ProducesResponseType(StatusCodes.Status404NotFound)]
-    public async Task<IActionResult> ByRoute(string path = "/")
-    {
-        var contentRoute = _requestRoutingService.GetContentRoute(path);
-
-        IPublishedContent? contentItem = ApiPublishedContentCache.GetByRoute(contentRoute);
-        if (contentItem is not null)
-        {
-            if (IsProtected(contentItem))
-            {
-                return Unauthorized();
-            }
-
-            return await Task.FromResult(Ok(ApiContentResponseBuilder.Build(contentItem)));
-        }
-
-        IApiContentRoute? redirectRoute = _requestRedirectService.GetRedirectRoute(path);
-        return redirectRoute != null
-            ? RedirectTo(redirectRoute)
-            : NotFound();
-    }
-
-    private IActionResult RedirectTo(IApiContentRoute redirectRoute)
-    {
-        Response.Headers.Add("Location-Start-Item-Path", redirectRoute.StartItem.Path);
-        Response.Headers.Add("Location-Start-Item-Id", redirectRoute.StartItem.Id.ToString("D"));
-        return RedirectPermanent(redirectRoute.Path);
-    }
-}

src/Umbraco.Cms.Api.Delivery/Controllers/Content/ByIdContentApiController.cs

@@ -0,0 +1,99 @@
+using Asp.Versioning;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
+using Umbraco.Cms.Core.DeliveryApi;
+using Umbraco.Cms.Core.DependencyInjection;
+using Umbraco.Cms.Core.Models.DeliveryApi;
+using Umbraco.Cms.Core.Models.PublishedContent;
+using Umbraco.Cms.Core.Services;
+
+namespace Umbraco.Cms.Api.Delivery.Controllers.Content;
+
+[ApiVersion("1.0")]
+[ApiVersion("2.0")]
+public class ByIdContentApiController : ContentApiItemControllerBase
+{
+    private readonly IRequestMemberAccessService _requestMemberAccessService;
+
+    [Obsolete($"Please use the constructor that does not accept {nameof(IPublicAccessService)}. Will be removed in V14.")]
+    public ByIdContentApiController(
+        IApiPublishedContentCache apiPublishedContentCache,
+        IApiContentResponseBuilder apiContentResponseBuilder,
+        IPublicAccessService publicAccessService)
+        : this(
+            apiPublishedContentCache,
+            apiContentResponseBuilder,
+            StaticServiceProvider.Instance.GetRequiredService<IRequestMemberAccessService>())
+    {
+    }
+
+    [Obsolete($"Please use the constructor that does not accept {nameof(IPublicAccessService)}. Will be removed in V14.")]
+    public ByIdContentApiController(
+        IApiPublishedContentCache apiPublishedContentCache,
+        IApiContentResponseBuilder apiContentResponseBuilder,
+        IPublicAccessService publicAccessService,
+        IRequestMemberAccessService requestMemberAccessService)
+        : this(
+            apiPublishedContentCache,
+            apiContentResponseBuilder,
+            requestMemberAccessService)
+    {
+    }
+
+    [ActivatorUtilitiesConstructor]
+    public ByIdContentApiController(
+        IApiPublishedContentCache apiPublishedContentCache,
+        IApiContentResponseBuilder apiContentResponseBuilder,
+        IRequestMemberAccessService requestMemberAccessService)
+        : base(apiPublishedContentCache, apiContentResponseBuilder)
+        => _requestMemberAccessService = requestMemberAccessService;
+
+    [HttpGet("item/{id:guid}")]
+    [MapToApiVersion("1.0")]
+    [ProducesResponseType(typeof(IApiContentResponse), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status401Unauthorized)]
+    [ProducesResponseType(StatusCodes.Status403Forbidden)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [Obsolete("Please use version 2 of this API. Will be removed in V15.")]
+    public async Task<IActionResult> ById(Guid id)
+        => await HandleRequest(id);
+
+    /// <summary>
+    ///     Gets a content item by id.
+    /// </summary>
+    /// <param name="id">The unique identifier of the content item.</param>
+    /// <returns>The content item or not found result.</returns>
+    [HttpGet("item/{id:guid}")]
+    [MapToApiVersion("2.0")]
+    [ProducesResponseType(typeof(IApiContentResponse), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status401Unauthorized)]
+    [ProducesResponseType(StatusCodes.Status403Forbidden)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<IActionResult> ByIdV20(Guid id)
+        => await HandleRequest(id);
+
+    private async Task<IActionResult> HandleRequest(Guid id)
+    {
+        IPublishedContent? contentItem = ApiPublishedContentCache.GetById(id);
+
+        if (contentItem is null)
+        {
+            return NotFound();
+        }
+
+        IActionResult? deniedAccessResult = await HandleMemberAccessAsync(contentItem, _requestMemberAccessService);
+        if (deniedAccessResult is not null)
+        {
+            return deniedAccessResult;
+        }
+
+        IApiContentResponse? apiContentResponse = ApiContentResponseBuilder.Build(contentItem);
+        if (apiContentResponse is null)
+        {
+            return NotFound();
+        }
+
+        return Ok(apiContentResponse);
+    }
+}

src/Umbraco.Cms.Api.Delivery/Controllers/Content/ByIdsContentApiController.cs

@@ -0,0 +1,92 @@
+using Asp.Versioning;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
+using Umbraco.Cms.Core.DeliveryApi;
+using Umbraco.Cms.Core.DependencyInjection;
+using Umbraco.Cms.Core.Models.DeliveryApi;
+using Umbraco.Cms.Core.Models.PublishedContent;
+using Umbraco.Cms.Core.Services;
+using Umbraco.Extensions;
+
+namespace Umbraco.Cms.Api.Delivery.Controllers.Content;
+
+[ApiVersion("1.0")]
+[ApiVersion("2.0")]
+public class ByIdsContentApiController : ContentApiItemControllerBase
+{
+    private readonly IRequestMemberAccessService _requestMemberAccessService;
+
+    [Obsolete($"Please use the constructor that does not accept {nameof(IPublicAccessService)}. Will be removed in V14.")]
+    public ByIdsContentApiController(
+        IApiPublishedContentCache apiPublishedContentCache,
+        IApiContentResponseBuilder apiContentResponseBuilder,
+        IPublicAccessService publicAccessService)
+        : this(
+            apiPublishedContentCache,
+            apiContentResponseBuilder,
+            StaticServiceProvider.Instance.GetRequiredService<IRequestMemberAccessService>())
+    {
+    }
+
+    [Obsolete($"Please use the constructor that does not accept {nameof(IPublicAccessService)}. Will be removed in V14.")]
+    public ByIdsContentApiController(
+        IApiPublishedContentCache apiPublishedContentCache,
+        IApiContentResponseBuilder apiContentResponseBuilder,
+        IPublicAccessService publicAccessService,
+        IRequestMemberAccessService requestMemberAccessService)
+        : this(
+            apiPublishedContentCache,
+            apiContentResponseBuilder,
+            requestMemberAccessService)
+    {
+    }
+
+    [ActivatorUtilitiesConstructor]
+    public ByIdsContentApiController(
+        IApiPublishedContentCache apiPublishedContentCache,
+        IApiContentResponseBuilder apiContentResponseBuilder,
+        IRequestMemberAccessService requestMemberAccessService)
+        : base(apiPublishedContentCache, apiContentResponseBuilder)
+        => _requestMemberAccessService = requestMemberAccessService;
+
+    [HttpGet("item")]
+    [MapToApiVersion("1.0")]
+    [ProducesResponseType(typeof(IEnumerable<IApiContentResponse>), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status401Unauthorized)]
+    [ProducesResponseType(StatusCodes.Status403Forbidden)]
+    [Obsolete("Please use version 2 of this API. Will be removed in V15.")]
+    public async Task<IActionResult> Item([FromQuery(Name = "id")] HashSet<Guid> ids)
+        => await HandleRequest(ids);
+
+    /// <summary>
+    ///     Gets content items by ids.
+    /// </summary>
+    /// <param name="ids">The unique identifiers of the content items to retrieve.</param>
+    /// <returns>The content items.</returns>
+    [HttpGet("items")]
+    [MapToApiVersion("2.0")]
+    [ProducesResponseType(typeof(IEnumerable<IApiContentResponse>), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status401Unauthorized)]
+    [ProducesResponseType(StatusCodes.Status403Forbidden)]
+    public async Task<IActionResult> ItemsV20([FromQuery(Name = "id")] HashSet<Guid> ids)
+        => await HandleRequest(ids);
+
+    private async Task<IActionResult> HandleRequest(HashSet<Guid> ids)
+    {
+        IPublishedContent[] contentItems = ApiPublishedContentCache.GetByIds(ids).ToArray();
+
+        IActionResult? deniedAccessResult = await HandleMemberAccessAsync(contentItems, _requestMemberAccessService);
+        if (deniedAccessResult is not null)
+        {
+            return deniedAccessResult;
+        }
+
+        IApiContentResponse[] apiContentItems = contentItems
+            .Select(ApiContentResponseBuilder.Build)
+            .WhereNotNull()
+            .ToArray();
+
+        return await Task.FromResult(Ok(apiContentItems));
+    }
+}

src/Umbraco.Cms.Api.Delivery/Controllers/Content/ByRouteContentApiController.cs

@@ -0,0 +1,201 @@
+using Asp.Versioning;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
+using Umbraco.Cms.Core;
+using Umbraco.Cms.Core.DeliveryApi;
+using Umbraco.Cms.Core.DependencyInjection;
+using Umbraco.Cms.Core.Models.DeliveryApi;
+using Umbraco.Cms.Core.Models.PublishedContent;
+using Umbraco.Cms.Core.Services;
+
+namespace Umbraco.Cms.Api.Delivery.Controllers.Content;
+
+[ApiVersion("1.0")]
+[ApiVersion("2.0")]
+public class ByRouteContentApiController : ContentApiItemControllerBase
+{
+    private readonly IApiContentPathResolver _apiContentPathResolver;
+    private readonly IRequestRedirectService _requestRedirectService;
+    private readonly IRequestPreviewService _requestPreviewService;
+    private readonly IRequestMemberAccessService _requestMemberAccessService;
+    private const string PreviewContentRequestPathPrefix = $"/{Umbraco.Cms.Core.Constants.DeliveryApi.Routing.PreviewContentPathPrefix}";
+
+    [Obsolete($"Please use the constructor that does not accept {nameof(IPublicAccessService)}. Will be removed in V14.")]
+    public ByRouteContentApiController(
+        IApiPublishedContentCache apiPublishedContentCache,
+        IApiContentResponseBuilder apiContentResponseBuilder,
+        IPublicAccessService publicAccessService,
+        IRequestRoutingService requestRoutingService,
+        IRequestRedirectService requestRedirectService,
+        IRequestPreviewService requestPreviewService)
+        : this(
+            apiPublishedContentCache,
+            apiContentResponseBuilder,
+            requestRoutingService,
+            requestRedirectService,
+            requestPreviewService,
+            StaticServiceProvider.Instance.GetRequiredService<IRequestMemberAccessService>())
+    {
+    }
+
+    [Obsolete($"Please use the constructor that does not accept {nameof(IPublicAccessService)}. Will be removed in V14.")]
+    public ByRouteContentApiController(
+        IApiPublishedContentCache apiPublishedContentCache,
+        IApiContentResponseBuilder apiContentResponseBuilder,
+        IPublicAccessService publicAccessService,
+        IRequestRoutingService requestRoutingService,
+        IRequestRedirectService requestRedirectService,
+        IRequestPreviewService requestPreviewService,
+        IRequestMemberAccessService requestMemberAccessService)
+        : this(
+            apiPublishedContentCache,
+            apiContentResponseBuilder,
+            requestRoutingService,
+            requestRedirectService,
+            requestPreviewService,
+            requestMemberAccessService)
+    {
+    }
+
+    [Obsolete($"Please use the constructor that accepts {nameof(IApiContentPathResolver)}. Will be removed in V15.")]
+    public ByRouteContentApiController(
+        IApiPublishedContentCache apiPublishedContentCache,
+        IApiContentResponseBuilder apiContentResponseBuilder,
+        IRequestRoutingService requestRoutingService,
+        IRequestRedirectService requestRedirectService,
+        IRequestPreviewService requestPreviewService,
+        IRequestMemberAccessService requestMemberAccessService)
+        : this(
+            apiPublishedContentCache,
+            apiContentResponseBuilder,
+            requestRedirectService,
+            requestPreviewService,
+            requestMemberAccessService,
+            StaticServiceProvider.Instance.GetRequiredService<IApiContentPathResolver>())
+    {
+    }
+
+    [Obsolete($"Please use the non-obsolete constructor. Will be removed in V15.")]
+    public ByRouteContentApiController(
+        IApiPublishedContentCache apiPublishedContentCache,
+        IApiContentResponseBuilder apiContentResponseBuilder,
+        IPublicAccessService publicAccessService,
+        IRequestRoutingService requestRoutingService,
+        IRequestRedirectService requestRedirectService,
+        IRequestPreviewService requestPreviewService,
+        IRequestMemberAccessService requestMemberAccessService,
+        IApiContentPathResolver apiContentPathResolver)
+        : this(
+            apiPublishedContentCache,
+            apiContentResponseBuilder,
+            requestRedirectService,
+            requestPreviewService,
+            requestMemberAccessService,
+            apiContentPathResolver)
+    {
+    }
+
+    [ActivatorUtilitiesConstructor]
+    public ByRouteContentApiController(
+        IApiPublishedContentCache apiPublishedContentCache,
+        IApiContentResponseBuilder apiContentResponseBuilder,
+        IRequestRedirectService requestRedirectService,
+        IRequestPreviewService requestPreviewService,
+        IRequestMemberAccessService requestMemberAccessService,
+        IApiContentPathResolver apiContentPathResolver)
+        : base(apiPublishedContentCache, apiContentResponseBuilder)
+    {
+        _requestRedirectService = requestRedirectService;
+        _requestPreviewService = requestPreviewService;
+        _requestMemberAccessService = requestMemberAccessService;
+        _apiContentPathResolver = apiContentPathResolver;
+    }
+
+    [HttpGet("item/{*path}")]
+    [MapToApiVersion("1.0")]
+    [ProducesResponseType(typeof(IApiContentResponse), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status401Unauthorized)]
+    [ProducesResponseType(StatusCodes.Status403Forbidden)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [Obsolete("Please use version 2 of this API. Will be removed in V15.")]
+    public async Task<IActionResult> ByRoute(string path = "")
+        => await HandleRequest(path);
+
+    /// <summary>
+    ///     Gets a content item by route.
+    /// </summary>
+    /// <param name="path">The path to the content item.</param>
+    /// <remarks>
+    ///     Optional URL segment for the root content item
+    ///     can be added through the "start-item" header.
+    /// </remarks>
+    /// <returns>The content item or not found result.</returns>
+    [HttpGet("item/{*path}")]
+    [MapToApiVersion("2.0")]
+    [ProducesResponseType(typeof(IApiContentResponse), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status401Unauthorized)]
+    [ProducesResponseType(StatusCodes.Status403Forbidden)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<IActionResult> ByRouteV20(string path = "")
+        => await HandleRequest(path);
+
+    private async Task<IActionResult> HandleRequest(string path)
+    {
+        path = DecodePath(path);
+        path = path.Length == 0 ? "/" : path;
+
+        if (_apiContentPathResolver.IsResolvablePath(path) is false)
+        {
+            return NotFound();
+        }
+
+        IPublishedContent? contentItem = GetContent(path);
+        if (contentItem is not null)
+        {
+            IActionResult? deniedAccessResult = await HandleMemberAccessAsync(contentItem, _requestMemberAccessService);
+            if (deniedAccessResult is not null)
+            {
+                return deniedAccessResult;
+            }
+
+            return await Task.FromResult(Ok(ApiContentResponseBuilder.Build(contentItem)));
+        }
+
+        IApiContentRoute? redirectRoute = _requestRedirectService.GetRedirectRoute(path);
+        return redirectRoute != null
+            ? RedirectTo(redirectRoute)
+            : NotFound();
+    }
+
+    private IPublishedContent? GetContent(string path)
+        => path.StartsWith(PreviewContentRequestPathPrefix)
+            ? GetPreviewContent(path)
+            : GetPublishedContent(path);
+
+    private IPublishedContent? GetPublishedContent(string path)
+        => _apiContentPathResolver.ResolveContentPath(path);
+
+    private IPublishedContent? GetPreviewContent(string path)
+    {
+        if (_requestPreviewService.IsPreview() is false)
+        {
+            return null;
+        }
+
+        if (Guid.TryParse(path.AsSpan(PreviewContentRequestPathPrefix.Length).TrimEnd("/"), out Guid contentId) is false)
+        {
+            return null;
+        }
+
+        IPublishedContent? contentItem = ApiPublishedContentCache.GetById(contentId);
+        return contentItem;
+    }
+
+    private IActionResult RedirectTo(IApiContentRoute redirectRoute)
+    {
+        Response.Headers.Add("Location-Start-Item-Path", redirectRoute.StartItem.Path);
+        Response.Headers.Add("Location-Start-Item-Id", redirectRoute.StartItem.Id.ToString("D"));
+        return RedirectPermanent(redirectRoute.Path);
+    }
+}

src/Umbraco.Cms.Api.Delivery/Controllers/Content/ContentApiControllerBase.cs

@@ -1,4 +1,6 @@
-using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.OutputCaching;
 using Umbraco.Cms.Api.Common.Builders;
 using Umbraco.Cms.Api.Delivery.Filters;
 using Umbraco.Cms.Api.Delivery.Routing;
@@ -6,12 +8,15 @@ using Umbraco.Cms.Core;
 using Umbraco.Cms.Core.DeliveryApi;
 using Umbraco.Cms.Core.Services.OperationStatus;
 
-namespace Umbraco.Cms.Api.Delivery.Controllers;
+namespace Umbraco.Cms.Api.Delivery.Controllers.Content;
 
+[DeliveryApiAccess]
 [VersionedDeliveryApiRoute("content")]
 [ApiExplorerSettings(GroupName = "Content")]
 [LocalizeFromAcceptLanguageHeader]
 [ValidateStartItem]
+[AddVaryHeader]
+[OutputCache(PolicyName = Constants.DeliveryApi.OutputCache.ContentCachePolicy)]
 public abstract class ContentApiControllerBase : DeliveryApiControllerBase
 {
     protected IApiPublishedContentCache ApiPublishedContentCache { get; }
@@ -31,10 +36,6 @@ public abstract class ContentApiControllerBase : DeliveryApiControllerBase
                 .WithTitle("Filter option not found")
                 .WithDetail("One of the attempted 'filter' options does not exist")
                 .Build()),
-            ApiContentQueryOperationStatus.IndexNotFound => BadRequest(new ProblemDetailsBuilder()
-                .WithTitle("Examine index not found")
-                .WithDetail($"No index found with name {Constants.UmbracoIndexes.DeliveryApiContentIndexName}")
-                .Build()),
             ApiContentQueryOperationStatus.SelectorOptionNotFound => BadRequest(new ProblemDetailsBuilder()
                 .WithTitle("Selector option not found")
                 .WithDetail("The attempted 'fetch' option does not exist")
@@ -43,5 +44,19 @@ public abstract class ContentApiControllerBase : DeliveryApiControllerBase
                 .WithTitle("Sort option not found")
                 .WithDetail("One of the attempted 'sort' options does not exist")
                 .Build()),
+            _ => BadRequest(new ProblemDetailsBuilder()
+                .WithTitle("Unknown content query status")
+                .WithDetail($"Content query status \"{status}\" was not expected here")
+                .Build()),
         };
+
+    /// <summary>
+    ///     Creates a 403 Forbidden result.
+    /// </summary>
+    /// <remarks>
+    ///     Use this method instead of <see cref="ControllerBase.Forbid()"/> on the controller base. The latter will yield
+    ///     a redirect to an access denied URL because of the default cookie auth scheme. This method ensures that a proper
+    ///     403 Forbidden status code is returned to the client.
+    /// </remarks>
+    protected IActionResult Forbidden() => new StatusCodeResult(StatusCodes.Status403Forbidden);
 }

src/Umbraco.Cms.Api.Delivery/Controllers/Content/ContentApiItemControllerBase.cs

@@ -0,0 +1,58 @@
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
+using Umbraco.Cms.Core.DeliveryApi;
+using Umbraco.Cms.Core.DependencyInjection;
+using Umbraco.Cms.Core.Models.PublishedContent;
+using Umbraco.Cms.Core.Security;
+using Umbraco.Cms.Core.Services;
+
+namespace Umbraco.Cms.Api.Delivery.Controllers.Content;
+
+public abstract class ContentApiItemControllerBase : ContentApiControllerBase
+{
+    // TODO: Remove this in V14 when the obsolete constructors have been removed
+    private readonly IPublicAccessService _publicAccessService;
+
+    [Obsolete($"Please use the constructor that does not accept {nameof(IPublicAccessService)}. Will be removed in V14.")]
+    protected ContentApiItemControllerBase(
+        IApiPublishedContentCache apiPublishedContentCache,
+        IApiContentResponseBuilder apiContentResponseBuilder,
+        IPublicAccessService publicAccessService)
+        : this(apiPublishedContentCache, apiContentResponseBuilder)
+    {
+    }
+
+    protected ContentApiItemControllerBase(
+        IApiPublishedContentCache apiPublishedContentCache,
+        IApiContentResponseBuilder apiContentResponseBuilder)
+        : base(apiPublishedContentCache, apiContentResponseBuilder)
+        => _publicAccessService = StaticServiceProvider.Instance.GetRequiredService<IPublicAccessService>();
+
+    [Obsolete($"Please use {nameof(IPublicAccessService)} to test for content protection. Will be removed in V14.")]
+    protected bool IsProtected(IPublishedContent content) => _publicAccessService.IsProtected(content.Path);
+
+    protected async Task<IActionResult?> HandleMemberAccessAsync(IPublishedContent contentItem, IRequestMemberAccessService requestMemberAccessService)
+    {
+        PublicAccessStatus accessStatus = await requestMemberAccessService.MemberHasAccessToAsync(contentItem);
+        return accessStatus is PublicAccessStatus.AccessAccepted
+            ? null
+            : accessStatus is PublicAccessStatus.AccessDenied
+                ? Forbidden()
+                : Unauthorized();
+    }
+
+    protected async Task<IActionResult?> HandleMemberAccessAsync(IEnumerable<IPublishedContent> contentItems, IRequestMemberAccessService requestMemberAccessService)
+    {
+        foreach (IPublishedContent content in contentItems)
+        {
+            IActionResult? result = await HandleMemberAccessAsync(content, requestMemberAccessService);
+            // if any of the content items yield an error based on the current member access, return that error
+            if (result is not null)
+            {
+                return result;
+            }
+        }
+
+        return null;
+    }
+}

src/Umbraco.Cms.Api.Delivery/Controllers/Content/QueryContentApiController.cs

@@ -1,28 +1,64 @@
 using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Api.Common.ViewModels.Pagination;
 using Umbraco.Cms.Core;
 using Umbraco.Cms.Core.DeliveryApi;
+using Umbraco.Cms.Core.DependencyInjection;
+using Umbraco.Cms.Core.Models;
 using Umbraco.Cms.Core.Models.DeliveryApi;
 using Umbraco.Cms.Core.Models.PublishedContent;
 using Umbraco.Cms.Core.Services.OperationStatus;
 using Umbraco.Extensions;
-using Umbraco.New.Cms.Core.Models;
 
-namespace Umbraco.Cms.Api.Delivery.Controllers;
+namespace Umbraco.Cms.Api.Delivery.Controllers.Content;
 
 [ApiVersion("1.0")]
+[ApiVersion("2.0")]
 public class QueryContentApiController : ContentApiControllerBase
 {
+    private readonly IRequestMemberAccessService _requestMemberAccessService;
     private readonly IApiContentQueryService _apiContentQueryService;
 
+    [Obsolete($"Please use the constructor that accepts {nameof(IRequestMemberAccessService)}. Will be removed in V14.")]
     public QueryContentApiController(
         IApiPublishedContentCache apiPublishedContentCache,
         IApiContentResponseBuilder apiContentResponseBuilderBuilder,
         IApiContentQueryService apiContentQueryService)
+        : this(
+            apiPublishedContentCache,
+            apiContentResponseBuilderBuilder,
+            apiContentQueryService,
+            StaticServiceProvider.Instance.GetRequiredService<IRequestMemberAccessService>())
+    {
+    }
+
+    [ActivatorUtilitiesConstructor]
+    public QueryContentApiController(
+        IApiPublishedContentCache apiPublishedContentCache,
+        IApiContentResponseBuilder apiContentResponseBuilderBuilder,
+        IApiContentQueryService apiContentQueryService,
+        IRequestMemberAccessService requestMemberAccessService)
         : base(apiPublishedContentCache, apiContentResponseBuilderBuilder)
-        => _apiContentQueryService = apiContentQueryService;
+    {
+        _apiContentQueryService = apiContentQueryService;
+        _requestMemberAccessService = requestMemberAccessService;
+    }
+
+    [HttpGet]
+    [MapToApiVersion("1.0")]
+    [ProducesResponseType(typeof(PagedViewModel<IApiContentResponse>), StatusCodes.Status200OK)]
+    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status400BadRequest)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [Obsolete("Please use version 2 of this API. Will be removed in V15.")]
+    public async Task<IActionResult> Query(
+        string? fetch,
+        [FromQuery] string[] filter,
+        [FromQuery] string[] sort,
+        int skip = 0,
+        int take = 10)
+        => await HandleRequest(fetch, filter, sort, skip, take);
 
     /// <summary>
     ///     Gets a paginated list of content item(s) from query.
@@ -34,18 +70,22 @@ public class QueryContentApiController : ContentApiControllerBase
     /// <param name="take">The amount of items to take.</param>
     /// <returns>The paged result of the content item(s).</returns>
     [HttpGet]
-    [MapToApiVersion("1.0")]
+    [MapToApiVersion("2.0")]
     [ProducesResponseType(typeof(PagedViewModel<IApiContentResponse>), StatusCodes.Status200OK)]
     [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status400BadRequest)]
     [ProducesResponseType(StatusCodes.Status404NotFound)]
-    public async Task<IActionResult> Query(
+    public async Task<IActionResult> QueryV20(
         string? fetch,
         [FromQuery] string[] filter,
         [FromQuery] string[] sort,
         int skip = 0,
         int take = 10)
+        => await HandleRequest(fetch, filter, sort, skip, take);
+
+    private async Task<IActionResult> HandleRequest(string? fetch, string[] filter, string[] sort, int skip, int take)
     {
-        Attempt<PagedModel<Guid>, ApiContentQueryOperationStatus> queryAttempt = _apiContentQueryService.ExecuteQuery(fetch, filter, sort, skip, take);
+        ProtectedAccess protectedAccess = await _requestMemberAccessService.MemberAccessAsync();
+        Attempt<PagedModel<Guid>, ApiContentQueryOperationStatus> queryAttempt = _apiContentQueryService.ExecuteQuery(fetch, filter, sort, protectedAccess, skip, take);
 
         if (queryAttempt.Success is false)
         {
@@ -62,6 +102,6 @@ public class QueryContentApiController : ContentApiControllerBase
             Items = apiContentItems
         };
 
-        return await Task.FromResult(Ok(model));
+        return Ok(model);
     }
 }

src/Umbraco.Cms.Api.Delivery/Controllers/ContentApiItemControllerBase.cs

@@ -1,22 +0,0 @@
-using Umbraco.Cms.Core.DeliveryApi;
-using Umbraco.Cms.Core.Models.PublishedContent;
-using Umbraco.Cms.Core.Services;
-
-namespace Umbraco.Cms.Api.Delivery.Controllers;
-
-public abstract class ContentApiItemControllerBase : ContentApiControllerBase
-{
-    private readonly IPublicAccessService _publicAccessService;
-
-    protected ContentApiItemControllerBase(
-        IApiPublishedContentCache apiPublishedContentCache,
-        IApiContentResponseBuilder apiContentResponseBuilder,
-        IPublicAccessService publicAccessService)
-        : base(apiPublishedContentCache, apiContentResponseBuilder)
-        => _publicAccessService = publicAccessService;
-
-    // NOTE: we're going to test for protected content at item endpoint level, because the check has already been
-    //       performed at content index time for the query endpoint and we don't want that extra overhead when
-    //       returning multiple items.
-    protected bool IsProtected(IPublishedContent content) => _publicAccessService.IsProtected(content.Path);
-}

src/Umbraco.Cms.Api.Delivery/Controllers/DeliveryApiControllerBase.cs

@@ -1,17 +1,29 @@
-using Asp.Versioning;
+using System.Net;
 using Microsoft.AspNetCore.Mvc;
 using Umbraco.Cms.Api.Common.Attributes;
 using Umbraco.Cms.Api.Common.Filters;
 using Umbraco.Cms.Api.Delivery.Configuration;
-using Umbraco.Cms.Api.Delivery.Filters;
 using Umbraco.Cms.Core;
 
 namespace Umbraco.Cms.Api.Delivery.Controllers;
 
 [ApiController]
-[DeliveryApiAccess]
 [JsonOptionsName(Constants.JsonOptionsNames.DeliveryApi)]
 [MapToApi(DeliveryApiConfiguration.ApiName)]
 public abstract class DeliveryApiControllerBase : Controller
 {
+    protected string DecodePath(string path)
+    {
+        // OpenAPI does not allow reserved chars as "in:path" parameters, so clients based on the Swagger JSON will URL
+        // encode the path. Normally, ASP.NET Core handles that encoding with an automatic decoding - apparently just not
+        // for forward slashes, for whatever reason... so we need to deal with those. Hopefully this will be addressed in
+        // an upcoming version of ASP.NET Core.
+        // See also https://github.com/dotnet/aspnetcore/issues/11544
+        if (path.Contains("%2F", StringComparison.OrdinalIgnoreCase))
+        {
+            path = WebUtility.UrlDecode(path);
+        }
+
+        return path;
+    }
 }

src/Umbraco.Cms.Api.Delivery/Controllers/Media/ByIdMediaApiController.cs

@@ -0,0 +1,51 @@
+using Asp.Versioning;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Umbraco.Cms.Core.Models.DeliveryApi;
+using Umbraco.Cms.Core.Models.PublishedContent;
+using Umbraco.Cms.Core.PublishedCache;
+using Umbraco.Cms.Infrastructure.DeliveryApi;
+
+namespace Umbraco.Cms.Api.Delivery.Controllers.Media;
+
+[ApiVersion("1.0")]
+[ApiVersion("2.0")]
+public class ByIdMediaApiController : MediaApiControllerBase
+{
+    public ByIdMediaApiController(IPublishedSnapshotAccessor publishedSnapshotAccessor, IApiMediaWithCropsResponseBuilder apiMediaWithCropsResponseBuilder)
+        : base(publishedSnapshotAccessor, apiMediaWithCropsResponseBuilder)
+    {
+    }
+
+    [HttpGet("item/{id:guid}")]
+    [MapToApiVersion("1.0")]
+    [ProducesResponseType(typeof(IApiMediaWithCropsResponse), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [Obsolete("Please use version 2 of this API. Will be removed in V15.")]
+    public async Task<IActionResult> ById(Guid id)
+        => await HandleRequest(id);
+
+    /// <summary>
+    ///     Gets a media item by id.
+    /// </summary>
+    /// <param name="id">The unique identifier of the media item.</param>
+    /// <returns>The media item or not found result.</returns>
+    [HttpGet("item/{id:guid}")]
+    [MapToApiVersion("2.0")]
+    [ProducesResponseType(typeof(IApiMediaWithCropsResponse), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<IActionResult> ByIdV20(Guid id)
+        => await HandleRequest(id);
+
+    private async Task<IActionResult> HandleRequest(Guid id)
+    {
+        IPublishedContent? media = PublishedMediaCache.GetById(id);
+
+        if (media is null)
+        {
+            return await Task.FromResult(NotFound());
+        }
+
+        return Ok(BuildApiMediaWithCrops(media));
+    }
+}

src/Umbraco.Cms.Api.Delivery/Controllers/Media/ByIdsMediaApiController.cs

@@ -0,0 +1,52 @@
+using Asp.Versioning;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Umbraco.Cms.Core.Models.DeliveryApi;
+using Umbraco.Cms.Core.Models.PublishedContent;
+using Umbraco.Cms.Core.PublishedCache;
+using Umbraco.Cms.Infrastructure.DeliveryApi;
+using Umbraco.Extensions;
+
+namespace Umbraco.Cms.Api.Delivery.Controllers.Media;
+
+[ApiVersion("1.0")]
+[ApiVersion("2.0")]
+public class ByIdsMediaApiController : MediaApiControllerBase
+{
+    public ByIdsMediaApiController(IPublishedSnapshotAccessor publishedSnapshotAccessor, IApiMediaWithCropsResponseBuilder apiMediaWithCropsResponseBuilder)
+        : base(publishedSnapshotAccessor, apiMediaWithCropsResponseBuilder)
+    {
+    }
+
+    [HttpGet("item")]
+    [MapToApiVersion("1.0")]
+    [ProducesResponseType(typeof(IEnumerable<IApiMediaWithCropsResponse>), StatusCodes.Status200OK)]
+    [Obsolete("Please use version 2 of this API. Will be removed in V15.")]
+    public async Task<IActionResult> Item([FromQuery(Name = "id")] HashSet<Guid> ids)
+        => await HandleRequest(ids);
+
+    /// <summary>
+    ///     Gets media items by ids.
+    /// </summary>
+    /// <param name="ids">The unique identifiers of the media items to retrieve.</param>
+    /// <returns>The media items.</returns>
+    [HttpGet("items")]
+    [MapToApiVersion("2.0")]
+    [ProducesResponseType(typeof(IEnumerable<IApiMediaWithCropsResponse>), StatusCodes.Status200OK)]
+    public async Task<IActionResult> ItemsV20([FromQuery(Name = "id")] HashSet<Guid> ids)
+        => await HandleRequest(ids);
+
+    private async Task<IActionResult> HandleRequest(HashSet<Guid> ids)
+    {
+        IPublishedContent[] mediaItems = ids
+            .Select(PublishedMediaCache.GetById)
+            .WhereNotNull()
+            .ToArray();
+
+        IApiMediaWithCropsResponse[] apiMediaItems = mediaItems
+            .Select(BuildApiMediaWithCrops)
+            .ToArray();
+
+        return await Task.FromResult(Ok(apiMediaItems));
+    }
+}

src/Umbraco.Cms.Api.Delivery/Controllers/Media/ByPathMediaApiController.cs

@@ -0,0 +1,57 @@
+using Asp.Versioning;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Umbraco.Cms.Core.DeliveryApi;
+using Umbraco.Cms.Core.Models.DeliveryApi;
+using Umbraco.Cms.Core.Models.PublishedContent;
+using Umbraco.Cms.Core.PublishedCache;
+using Umbraco.Cms.Infrastructure.DeliveryApi;
+
+namespace Umbraco.Cms.Api.Delivery.Controllers.Media;
+
+[ApiVersion("1.0")]
+[ApiVersion("2.0")]
+public class ByPathMediaApiController : MediaApiControllerBase
+{
+    private readonly IApiMediaQueryService _apiMediaQueryService;
+
+    public ByPathMediaApiController(
+        IPublishedSnapshotAccessor publishedSnapshotAccessor,
+        IApiMediaWithCropsResponseBuilder apiMediaWithCropsResponseBuilder,
+        IApiMediaQueryService apiMediaQueryService)
+        : base(publishedSnapshotAccessor, apiMediaWithCropsResponseBuilder)
+        => _apiMediaQueryService = apiMediaQueryService;
+
+    [HttpGet("item/{*path}")]
+    [MapToApiVersion("1.0")]
+    [ProducesResponseType(typeof(IApiMediaWithCropsResponse), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [Obsolete("Please use version 2 of this API. Will be removed in V15.")]
+    public async Task<IActionResult> ByPath(string path)
+        => await HandleRequest(path);
+
+    /// <summary>
+    ///     Gets a media item by its path.
+    /// </summary>
+    /// <param name="path">The path of the media item.</param>
+    /// <returns>The media item or not found result.</returns>
+    [HttpGet("item/{*path}")]
+    [MapToApiVersion("2.0")]
+    [ProducesResponseType(typeof(IApiMediaWithCropsResponse), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<IActionResult> ByPathV20(string path)
+        => await HandleRequest(path);
+
+    private async Task<IActionResult> HandleRequest(string path)
+    {
+        path = DecodePath(path);
+
+        IPublishedContent? media = _apiMediaQueryService.GetByPath(path);
+        if (media is null)
+        {
+            return await Task.FromResult(NotFound());
+        }
+
+        return Ok(BuildApiMediaWithCrops(media));
+    }
+}

src/Umbraco.Cms.Api.Delivery/Controllers/Media/MediaApiControllerBase.cs

@@ -0,0 +1,59 @@
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.OutputCaching;
+using Umbraco.Cms.Api.Common.Builders;
+using Umbraco.Cms.Api.Delivery.Filters;
+using Umbraco.Cms.Api.Delivery.Routing;
+using Umbraco.Cms.Core;
+using Umbraco.Cms.Core.Models.DeliveryApi;
+using Umbraco.Cms.Core.Models.PublishedContent;
+using Umbraco.Cms.Core.PublishedCache;
+using Umbraco.Cms.Core.Services.OperationStatus;
+using Umbraco.Cms.Infrastructure.DeliveryApi;
+using Umbraco.Extensions;
+
+namespace Umbraco.Cms.Api.Delivery.Controllers.Media;
+
+[DeliveryApiMediaAccess]
+[VersionedDeliveryApiRoute("media")]
+[ApiExplorerSettings(GroupName = "Media")]
+[OutputCache(PolicyName = Constants.DeliveryApi.OutputCache.MediaCachePolicy)]
+public abstract class MediaApiControllerBase : DeliveryApiControllerBase
+{
+    private readonly IApiMediaWithCropsResponseBuilder _apiMediaWithCropsResponseBuilder;
+    private readonly IPublishedSnapshotAccessor _publishedSnapshotAccessor;
+    private IPublishedMediaCache? _publishedMediaCache;
+
+    protected MediaApiControllerBase(IPublishedSnapshotAccessor publishedSnapshotAccessor, IApiMediaWithCropsResponseBuilder apiMediaWithCropsResponseBuilder)
+    {
+        _publishedSnapshotAccessor = publishedSnapshotAccessor;
+        _apiMediaWithCropsResponseBuilder = apiMediaWithCropsResponseBuilder;
+    }
+
+    protected IPublishedMediaCache PublishedMediaCache => _publishedMediaCache
+        ??= _publishedSnapshotAccessor.GetRequiredPublishedSnapshot().Media
+            ?? throw new InvalidOperationException("Could not obtain the published media cache");
+
+    protected IApiMediaWithCropsResponse BuildApiMediaWithCrops(IPublishedContent media)
+        => _apiMediaWithCropsResponseBuilder.Build(media);
+
+    protected IActionResult ApiMediaQueryOperationStatusResult(ApiMediaQueryOperationStatus status) =>
+        status switch
+        {
+            ApiMediaQueryOperationStatus.FilterOptionNotFound => BadRequest(new ProblemDetailsBuilder()
+                .WithTitle("Filter option not found")
+                .WithDetail("One of the attempted 'filter' options does not exist")
+                .Build()),
+            ApiMediaQueryOperationStatus.SelectorOptionNotFound => BadRequest(new ProblemDetailsBuilder()
+                .WithTitle("Selector option not found")
+                .WithDetail("The attempted 'fetch' option does not exist")
+                .Build()),
+            ApiMediaQueryOperationStatus.SortOptionNotFound => BadRequest(new ProblemDetailsBuilder()
+                .WithTitle("Sort option not found")
+                .WithDetail("One of the attempted 'sort' options does not exist")
+                .Build()),
+            _ => BadRequest(new ProblemDetailsBuilder()
+                .WithTitle("Unknown media query status")
+                .WithDetail($"Media query status \"{status}\" was not expected here")
+                .Build()),
+        };
+}

src/Umbraco.Cms.Api.Delivery/Controllers/Media/QueryMediaApiController.cs

@@ -0,0 +1,84 @@
+using Asp.Versioning;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Umbraco.Cms.Api.Common.ViewModels.Pagination;
+using Umbraco.Cms.Core;
+using Umbraco.Cms.Core.DeliveryApi;
+using Umbraco.Cms.Core.Models;
+using Umbraco.Cms.Core.Models.DeliveryApi;
+using Umbraco.Cms.Core.Models.PublishedContent;
+using Umbraco.Cms.Core.PublishedCache;
+using Umbraco.Cms.Core.Services.OperationStatus;
+using Umbraco.Cms.Infrastructure.DeliveryApi;
+using Umbraco.Extensions;
+
+namespace Umbraco.Cms.Api.Delivery.Controllers.Media;
+
+[ApiVersion("1.0")]
+[ApiVersion("2.0")]
+public class QueryMediaApiController : MediaApiControllerBase
+{
+    private readonly IApiMediaQueryService _apiMediaQueryService;
+
+    public QueryMediaApiController(
+        IPublishedSnapshotAccessor publishedSnapshotAccessor,
+        IApiMediaWithCropsResponseBuilder apiMediaWithCropsResponseBuilder,
+        IApiMediaQueryService apiMediaQueryService)
+        : base(publishedSnapshotAccessor, apiMediaWithCropsResponseBuilder)
+        => _apiMediaQueryService = apiMediaQueryService;
+
+    [HttpGet]
+    [MapToApiVersion("1.0")]
+    [ProducesResponseType(typeof(PagedViewModel<IApiMediaWithCropsResponse>), StatusCodes.Status200OK)]
+    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status400BadRequest)]
+    [Obsolete("Please use version 2 of this API. Will be removed in V15.")]
+    public async Task<IActionResult> Query(
+        string? fetch,
+        [FromQuery] string[] filter,
+        [FromQuery] string[] sort,
+        int skip = 0,
+        int take = 10)
+        => await HandleRequest(fetch, filter, sort, skip, take);
+
+    /// <summary>
+    ///     Gets a paginated list of media item(s) from query.
+    /// </summary>
+    /// <param name="fetch">Optional fetch query parameter value.</param>
+    /// <param name="filter">Optional filter query parameters values.</param>
+    /// <param name="sort">Optional sort query parameters values.</param>
+    /// <param name="skip">The amount of items to skip.</param>
+    /// <param name="take">The amount of items to take.</param>
+    /// <returns>The paged result of the media item(s).</returns>
+    [HttpGet]
+    [MapToApiVersion("2.0")]
+    [ProducesResponseType(typeof(PagedViewModel<IApiMediaWithCropsResponse>), StatusCodes.Status200OK)]
+    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status400BadRequest)]
+    public async Task<IActionResult> QueryV20(
+        string? fetch,
+        [FromQuery] string[] filter,
+        [FromQuery] string[] sort,
+        int skip = 0,
+        int take = 10)
+        => await HandleRequest(fetch, filter, sort, skip, take);
+
+    private async Task<IActionResult> HandleRequest(string? fetch, string[] filter, string[] sort, int skip, int take)
+    {
+        Attempt<PagedModel<Guid>, ApiMediaQueryOperationStatus> queryAttempt = _apiMediaQueryService.ExecuteQuery(fetch, filter, sort, skip, take);
+
+        if (queryAttempt.Success is false)
+        {
+            return ApiMediaQueryOperationStatusResult(queryAttempt.Status);
+        }
+
+        PagedModel<Guid> pagedResult = queryAttempt.Result;
+        IPublishedContent[] mediaItems = pagedResult.Items.Select(PublishedMediaCache.GetById).WhereNotNull().ToArray();
+
+        var model = new PagedViewModel<IApiMediaWithCropsResponse>
+        {
+            Total = pagedResult.Total,
+            Items = mediaItems.Select(BuildApiMediaWithCrops)
+        };
+
+        return await Task.FromResult(Ok(model));
+    }
+}

src/Umbraco.Cms.Api.Delivery/Controllers/Security/CurrentMemberController.cs

@@ -0,0 +1,28 @@
+using Asp.Versioning;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using OpenIddict.Server.AspNetCore;
+using Umbraco.Cms.Api.Delivery.Routing;
+using Umbraco.Cms.Core.DeliveryApi;
+
+namespace Umbraco.Cms.Api.Delivery.Controllers.Security;
+
+[ApiVersion("1.0")]
+[ApiController]
+[VersionedDeliveryApiRoute(Common.Security.Paths.MemberApi.EndpointTemplate)]
+[ApiExplorerSettings(IgnoreApi = true)]
+[Authorize(AuthenticationSchemes = OpenIddictServerAspNetCoreDefaults.AuthenticationScheme)]
+public class CurrentMemberController : DeliveryApiControllerBase
+{
+    private readonly ICurrentMemberClaimsProvider _currentMemberClaimsProvider;
+
+    public CurrentMemberController(ICurrentMemberClaimsProvider currentMemberClaimsProvider)
+        => _currentMemberClaimsProvider = currentMemberClaimsProvider;
+
+    [HttpGet("userinfo")]
+    public async Task<IActionResult> Userinfo()
+    {
+        Dictionary<string, object> claims = await _currentMemberClaimsProvider.GetClaimsAsync();
+        return Ok(claims);
+    }
+}

src/Umbraco.Cms.Api.Delivery/Controllers/Security/MemberController.cs

@@ -0,0 +1,172 @@
+using System.Security.Claims;
+using Asp.Versioning;
+using Microsoft.AspNetCore;
+using Microsoft.AspNetCore.Authentication;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Identity;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Options;
+using OpenIddict.Abstractions;
+using OpenIddict.Server.AspNetCore;
+using Umbraco.Cms.Api.Delivery.Routing;
+using Umbraco.Cms.Core;
+using Umbraco.Cms.Core.Configuration.Models;
+using Umbraco.Cms.Core.Security;
+using Umbraco.Cms.Web.Common.Security;
+using Umbraco.Extensions;
+using SignInResult = Microsoft.AspNetCore.Mvc.SignInResult;
+using IdentitySignInResult = Microsoft.AspNetCore.Identity.SignInResult;
+
+namespace Umbraco.Cms.Api.Delivery.Controllers.Security;
+
+[ApiVersion("1.0")]
+[ApiController]
+[VersionedDeliveryApiRoute(Common.Security.Paths.MemberApi.EndpointTemplate)]
+[ApiExplorerSettings(IgnoreApi = true)]
+public class MemberController : DeliveryApiControllerBase
+{
+    private readonly IHttpContextAccessor _httpContextAccessor;
+    private readonly IMemberSignInManager _memberSignInManager;
+    private readonly IMemberManager _memberManager;
+    private readonly DeliveryApiSettings _deliveryApiSettings;
+    private readonly ILogger<MemberController> _logger;
+
+    public MemberController(
+        IHttpContextAccessor httpContextAccessor,
+        IMemberSignInManager memberSignInManager,
+        IMemberManager memberManager,
+        IOptions<DeliveryApiSettings> deliveryApiSettings,
+        ILogger<MemberController> logger)
+    {
+        _httpContextAccessor = httpContextAccessor;
+        _memberSignInManager = memberSignInManager;
+        _memberManager = memberManager;
+        _logger = logger;
+        _deliveryApiSettings = deliveryApiSettings.Value;
+    }
+
+    [HttpGet("authorize")]
+    [MapToApiVersion("1.0")]
+    public async Task<IActionResult> Authorize()
+    {
+        // in principle this is not necessary for now, since the member application has been removed, thus making
+        // the member client ID invalid for the authentication code flow. However, if we ever add additional flows
+        // to the API, we should perform this check, so we might as well include it upfront.
+        if (_deliveryApiSettings.MemberAuthorizationIsEnabled() is false)
+        {
+            return BadRequest("Member authorization is not allowed.");
+        }
+
+        HttpContext context = _httpContextAccessor.GetRequiredHttpContext();
+        OpenIddictRequest? request = context.GetOpenIddictServerRequest();
+        if (request is null)
+        {
+            return BadRequest("Unable to obtain OpenID data from the current request.");
+        }
+
+        // make sure this endpoint ONLY handles member authentication
+        if (request.ClientId is not Constants.OAuthClientIds.Member)
+        {
+            return BadRequest("The specified client ID cannot be used here.");
+        }
+
+        return request.IdentityProvider.IsNullOrWhiteSpace()
+            ? await AuthorizeInternal(request)
+            : await AuthorizeExternal(request);
+    }
+
+    [HttpGet("signout")]
+    [MapToApiVersion("1.0")]
+    public async Task<IActionResult> Signout()
+    {
+        await _memberSignInManager.SignOutAsync();
+        return SignOut(OpenIddictServerAspNetCoreDefaults.AuthenticationScheme);
+    }
+
+    private async Task<IActionResult> AuthorizeInternal(OpenIddictRequest request)
+    {
+        // retrieve the user principal stored in the authentication cookie.
+        AuthenticateResult cookieAuthResult = await HttpContext.AuthenticateAsync(IdentityConstants.ApplicationScheme);
+        var userName = cookieAuthResult.Succeeded
+            ? cookieAuthResult.Principal?.Identity?.Name
+            : null;
+
+        if (userName is null)
+        {
+            return Challenge(IdentityConstants.ApplicationScheme);
+        }
+
+        MemberIdentityUser? member = await _memberManager.FindByNameAsync(userName);
+        if (member is null)
+        {
+            _logger.LogError("The member with username {userName} was successfully authorized, but could not be retrieved by the member manager", userName);
+            return BadRequest("The member could not be found.");
+        }
+
+        return await SignInMember(member, request);
+    }
+
+    private async Task<IActionResult> AuthorizeExternal(OpenIddictRequest request)
+    {
+        var provider = request.IdentityProvider ?? throw new ArgumentException("No identity provider found in request", nameof(request));
+        ExternalLoginInfo? loginInfo = await _memberSignInManager.GetExternalLoginInfoAsync();
+
+        if (loginInfo?.Principal is null)
+        {
+            AuthenticationProperties properties = _memberSignInManager.ConfigureExternalAuthenticationProperties(provider, null);
+            return Challenge(properties, provider);
+        }
+
+        // NOTE: if we're going to support 2FA for members, we need to:
+        //       - use SecuritySettings.MemberBypassTwoFactorForExternalLogins instead of the hardcoded value (true) for "bypassTwoFactor".
+        //       - handle IdentitySignInResult.TwoFactorRequired
+        IdentitySignInResult result = await _memberSignInManager.ExternalLoginSignInAsync(loginInfo, false, true);
+        if (result == IdentitySignInResult.Success)
+        {
+            // get the member and perform sign-in
+            MemberIdentityUser? member = await _memberManager.FindByLoginAsync(loginInfo.LoginProvider, loginInfo.ProviderKey);
+            if (member is null)
+            {
+                _logger.LogError("A member was successfully authorized using external authentication, but could not be retrieved by the member manager");
+                return BadRequest("The member could not be found.");
+            }
+
+            // update member authentication tokens if succeeded
+            await _memberSignInManager.UpdateExternalAuthenticationTokensAsync(loginInfo);
+            return await SignInMember(member, request);
+        }
+
+        var errorProperties = new AuthenticationProperties(new Dictionary<string, string?>
+        {
+            [OpenIddictServerAspNetCoreConstants.Properties.Error] = OpenIddictConstants.Errors.AccessDenied,
+            [OpenIddictServerAspNetCoreConstants.Properties.ErrorDescription] = "The member is not allowed to access this resource."
+        });
+        return Forbid(errorProperties, provider);
+    }
+
+    private async Task<IActionResult> SignInMember(MemberIdentityUser member, OpenIddictRequest request)
+    {
+        ClaimsPrincipal memberPrincipal = await _memberSignInManager.CreateUserPrincipalAsync(member);
+        memberPrincipal.SetClaim(OpenIddictConstants.Claims.Subject, member.Key.ToString());
+
+        IList<string> roles = await _memberManager.GetRolesAsync(member);
+        memberPrincipal.SetClaim(Constants.OAuthClaims.MemberKey, member.Key.ToString());
+        memberPrincipal.SetClaim(Constants.OAuthClaims.MemberRoles, string.Join(",", roles));
+
+        Claim[] claims = memberPrincipal.Claims.ToArray();
+        foreach (Claim claim in claims.Where(claim => claim.Type is not Constants.Security.SecurityStampClaimType))
+        {
+            claim.SetDestinations(OpenIddictConstants.Destinations.AccessToken);
+        }
+
+        // "openid" and "offline_access" are the only scopes allowed for members; explicitly ensure we only add those
+        // NOTE: the "offline_access" scope is required to use refresh tokens
+        IEnumerable<string> allowedScopes = request
+            .GetScopes()
+            .Intersect(new[] { OpenIddictConstants.Scopes.OpenId, OpenIddictConstants.Scopes.OfflineAccess });
+        memberPrincipal.SetScopes(allowedScopes);
+
+        return new SignInResult(OpenIddictServerAspNetCoreDefaults.AuthenticationScheme, memberPrincipal);
+    }
+}

src/Umbraco.Cms.Api.Delivery/DependencyInjection/UmbracoBuilderExtensions.cs

@@ -1,16 +1,29 @@
 using System.Text.Json;
 using System.Text.Json.Serialization;
+using Asp.Versioning;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Routing;
+using Microsoft.Extensions.Configuration;
 using Microsoft.Extensions.DependencyInjection;
-using Umbraco.Cms.Api.Common.Configuration;
+using Microsoft.Extensions.Primitives;
 using Umbraco.Cms.Api.Common.DependencyInjection;
 using Umbraco.Cms.Api.Delivery.Accessors;
+using Umbraco.Cms.Api.Delivery.Caching;
 using Umbraco.Cms.Api.Delivery.Configuration;
+using Umbraco.Cms.Api.Delivery.Handlers;
 using Umbraco.Cms.Api.Delivery.Json;
 using Umbraco.Cms.Api.Delivery.Rendering;
+using Umbraco.Cms.Api.Delivery.Routing;
+using Umbraco.Cms.Api.Delivery.Security;
 using Umbraco.Cms.Api.Delivery.Services;
+using Umbraco.Cms.Api.Delivery.Services.QueryBuilders;
 using Umbraco.Cms.Core;
+using Umbraco.Cms.Core.Configuration.Models;
 using Umbraco.Cms.Core.DeliveryApi;
 using Umbraco.Cms.Core.DependencyInjection;
+using Umbraco.Cms.Core.Notifications;
+using Umbraco.Cms.Infrastructure.Security;
+using Umbraco.Cms.Web.Common.ApplicationBuilder;
 
 namespace Umbraco.Extensions;
 
@@ -19,15 +32,43 @@ public static class UmbracoBuilderExtensions
     public static IUmbracoBuilder AddDeliveryApi(this IUmbracoBuilder builder)
     {
         builder.Services.AddScoped<IRequestStartItemProvider, RequestStartItemProvider>();
-        builder.Services.AddScoped<IOutputExpansionStrategy, RequestContextOutputExpansionStrategy>();
+        builder.Services.AddScoped<RequestContextOutputExpansionStrategy>();
+        builder.Services.AddScoped<RequestContextOutputExpansionStrategyV2>();
+
+        builder.Services.AddUnique<IOutputExpansionStrategy>(
+            provider =>
+            {
+                HttpContext? httpContext = provider.GetRequiredService<IHttpContextAccessor>().HttpContext;
+                ApiVersion? apiVersion = httpContext?.GetRequestedApiVersion();
+                if (apiVersion is null)
+                {
+                    return provider.GetRequiredService<RequestContextOutputExpansionStrategyV2>();
+                }
+
+                // V1 of the Delivery API uses a different expansion strategy than V2+
+                return apiVersion.MajorVersion == 1
+                    ? provider.GetRequiredService<RequestContextOutputExpansionStrategy>()
+                    : provider.GetRequiredService<RequestContextOutputExpansionStrategyV2>();
+            },
+            ServiceLifetime.Scoped);
+
         builder.Services.AddSingleton<IRequestCultureService, RequestCultureService>();
         builder.Services.AddSingleton<IRequestRoutingService, RequestRoutingService>();
         builder.Services.AddSingleton<IRequestRedirectService, RequestRedirectService>();
         builder.Services.AddSingleton<IRequestPreviewService, RequestPreviewService>();
-        builder.Services.AddSingleton<IOutputExpansionStrategyAccessor, RequestContextOutputExpansionStrategyAccessor>();
+
+        // Webooks register a more basic implementation, remove it.
+        builder.Services.AddUnique<IOutputExpansionStrategyAccessor, RequestContextOutputExpansionStrategyAccessor>(ServiceLifetime.Singleton);
         builder.Services.AddSingleton<IRequestStartItemProviderAccessor, RequestContextRequestStartItemProviderAccessor>();
+
         builder.Services.AddSingleton<IApiAccessService, ApiAccessService>();
         builder.Services.AddSingleton<IApiContentQueryService, ApiContentQueryService>();
+        builder.Services.AddSingleton<IApiContentQueryProvider, ApiContentQueryProvider>();
+        builder.Services.AddSingleton<IApiContentQueryFactory, ApiContentQueryFactory>();
+        builder.Services.AddSingleton<IApiMediaQueryService, ApiMediaQueryService>();
+        builder.Services.AddTransient<IMemberApplicationManager, MemberApplicationManager>();
+        builder.Services.AddTransient<IRequestMemberAccessService, RequestMemberAccessService>();
+        builder.Services.AddTransient<ICurrentMemberClaimsProvider, CurrentMemberClaimsProvider>();
 
         builder.Services.ConfigureOptions<ConfigureUmbracoDeliveryApiSwaggerGenOptions>();
         builder.AddUmbracoApiOpenApiUI();
@@ -43,6 +84,56 @@ public static class UmbracoBuilderExtensions
                 options.JsonSerializerOptions.Converters.Add(new JsonStringEnumConverter());
             });
 
+        builder.Services.AddAuthentication();
+        builder.AddUmbracoOpenIddict();
+        builder.AddNotificationAsyncHandler<UmbracoApplicationStartingNotification, InitializeMemberApplicationNotificationHandler>();
+        builder.AddNotificationAsyncHandler<MemberSavedNotification, RevokeMemberAuthenticationTokensNotificationHandler>();
+        builder.AddNotificationAsyncHandler<MemberDeletedNotification, RevokeMemberAuthenticationTokensNotificationHandler>();
+        builder.AddNotificationAsyncHandler<AssignedMemberRolesNotification, RevokeMemberAuthenticationTokensNotificationHandler>();
+        builder.AddNotificationAsyncHandler<RemovedMemberRolesNotification, RevokeMemberAuthenticationTokensNotificationHandler>();
+
+        // FIXME: remove this when Delivery API V1 is removed
+        builder.Services.AddSingleton<MatcherPolicy, DeliveryApiItemsEndpointsMatcherPolicy>();
+
+        builder.AddOutputCache();
+        return builder;
+    }
+
+    private static IUmbracoBuilder AddOutputCache(this IUmbracoBuilder builder)
+    {
+        DeliveryApiSettings.OutputCacheSettings outputCacheSettings =
+            builder.Config.GetSection(Constants.Configuration.ConfigDeliveryApi).Get<DeliveryApiSettings>()?.OutputCache
+            ?? new DeliveryApiSettings.OutputCacheSettings();
+
+        if (outputCacheSettings.Enabled is false || outputCacheSettings is { ContentDuration.TotalSeconds: <= 0, MediaDuration.TotalSeconds: <= 0 })
+        {
+            return builder;
+        }
+
+        builder.Services.AddOutputCache(options =>
+        {
+            options.AddBasePolicy(_ => { });
+
+            if (outputCacheSettings.ContentDuration.TotalSeconds > 0)
+            {
+                options.AddPolicy(
+                    Constants.DeliveryApi.OutputCache.ContentCachePolicy,
+                    new DeliveryApiOutputCachePolicy(
+                        outputCacheSettings.ContentDuration,
+                        new StringValues([Constants.DeliveryApi.HeaderNames.AcceptLanguage, Constants.DeliveryApi.HeaderNames.StartItem])));
+            }
+
+            if (outputCacheSettings.MediaDuration.TotalSeconds > 0)
+            {
+                options.AddPolicy(
+                    Constants.DeliveryApi.OutputCache.MediaCachePolicy,
+                    new DeliveryApiOutputCachePolicy(
+                        outputCacheSettings.MediaDuration,
+                        Constants.DeliveryApi.HeaderNames.StartItem));
+            }
+        });
+
+        builder.Services.Configure<UmbracoPipelineOptions>(options => options.AddFilter(new OutputCachePipelineFilter("UmbracoDeliveryApiOutputCache")));
         return builder;
     }
 }

src/Umbraco.Cms.Api.Delivery/Filters/AddVaryHeaderAttribute.cs

@@ -0,0 +1,13 @@
+using Microsoft.AspNetCore.Mvc.Filters;
+
+namespace Umbraco.Cms.Api.Delivery.Filters;
+
+public sealed class AddVaryHeaderAttribute : ActionFilterAttribute
+{
+    private const string Vary = "Accept-Language, Preview, Start-Item";
+
+    public override void OnResultExecuting(ResultExecutingContext context)
+        => context.HttpContext.Response.Headers.Vary = context.HttpContext.Response.Headers.Vary.Count > 0
+            ? $"{context.HttpContext.Response.Headers.Vary}, {Vary}"
+            : Vary;
+}

src/Umbraco.Cms.Api.Delivery/Filters/DeliveryApiMediaAccessAttribute.cs

@@ -0,0 +1,35 @@
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc.Filters;
+using Umbraco.Cms.Core.DeliveryApi;
+
+namespace Umbraco.Cms.Api.Delivery.Filters;
+
+internal sealed class DeliveryApiMediaAccessAttribute : TypeFilterAttribute
+{
+    public DeliveryApiMediaAccessAttribute()
+        : base(typeof(DeliveryApiMediaAccessFilter))
+    {
+    }
+
+    private class DeliveryApiMediaAccessFilter : IActionFilter
+    {
+        private readonly IApiAccessService _apiAccessService;
+
+        public DeliveryApiMediaAccessFilter(IApiAccessService apiAccessService)
+            => _apiAccessService = apiAccessService;
+
+        public void OnActionExecuting(ActionExecutingContext context)
+        {
+            if (_apiAccessService.HasMediaAccess())
+            {
+                return;
+            }
+
+            context.Result = new UnauthorizedResult();
+        }
+
+        public void OnActionExecuted(ActionExecutedContext context)
+        {
+        }
+    }
+}

src/Umbraco.Cms.Api.Delivery/Filters/SwaggerContentDocumentationFilter.cs

@@ -0,0 +1,182 @@
+using Microsoft.OpenApi.Any;
+using Microsoft.OpenApi.Models;
+using Swashbuckle.AspNetCore.SwaggerGen;
+using Umbraco.Cms.Api.Delivery.Configuration;
+using Umbraco.Cms.Api.Delivery.Controllers;
+using Umbraco.Cms.Api.Delivery.Controllers.Content;
+
+namespace Umbraco.Cms.Api.Delivery.Filters;
+
+internal sealed class SwaggerContentDocumentationFilter : SwaggerDocumentationFilterBase<ContentApiControllerBase>
+{
+    protected override string DocumentationLink => DeliveryApiConfiguration.ApiDocumentationContentArticleLink;
+
+    protected override void ApplyOperation(OpenApiOperation operation, OperationFilterContext context)
+    {
+        operation.Parameters ??= new List<OpenApiParameter>();
+
+        AddExpand(operation, context);
+
+        AddFields(operation, context);
+
+        operation.Parameters.Add(new OpenApiParameter
+        {
+            Name = Core.Constants.DeliveryApi.HeaderNames.AcceptLanguage,
+            In = ParameterLocation.Header,
+            Required = false,
+            Description = "Defines the language to return. Use this when querying language variant content items.",
+            Schema = new OpenApiSchema { Type = "string" },
+            Examples = new Dictionary<string, OpenApiExample>
+            {
+                { "Default", new OpenApiExample { Value = new OpenApiString(string.Empty) } },
+                { "English culture", new OpenApiExample { Value = new OpenApiString("en-us") } }
+            }
+        });
+
+        AddApiKey(operation);
+
+        operation.Parameters.Add(new OpenApiParameter
+        {
+            Name = Core.Constants.DeliveryApi.HeaderNames.Preview,
+            In = ParameterLocation.Header,
+            Required = false,
+            Description = "Whether to request draft content.",
+            Schema = new OpenApiSchema { Type = "boolean" }
+        });
+
+        operation.Parameters.Add(new OpenApiParameter
+        {
+            Name = Core.Constants.DeliveryApi.HeaderNames.StartItem,
+            In = ParameterLocation.Header,
+            Required = false,
+            Description = "URL segment or GUID of a root content item.",
+            Schema = new OpenApiSchema { Type = "string" }
+        });
+    }
+
+    protected override void ApplyParameter(OpenApiParameter parameter, ParameterFilterContext context)
+    {
+        switch (parameter.Name)
+        {
+            case "fetch":
+                AddQueryParameterDocumentation(parameter, FetchQueryParameterExamples(), "Specifies the content items to fetch");
+                break;
+            case "filter":
+                AddQueryParameterDocumentation(parameter, FilterQueryParameterExamples(), "Defines how to filter the fetched content items");
+                break;
+            case "sort":
+                AddQueryParameterDocumentation(parameter, SortQueryParameterExamples(), "Defines how to sort the found content items");
+                break;
+            case "skip":
+                parameter.Description = PaginationDescription(true, "content");
+                break;
+            case "take":
+                parameter.Description = PaginationDescription(false, "content");
+                break;
+            default:
+                return;
+        }
+    }
+
+    private Dictionary<string, OpenApiExample> FetchQueryParameterExamples() =>
+        new()
+        {
+            { "Select all", new OpenApiExample { Value = new OpenApiString(string.Empty) } },
+            {
+                "Select all ancestors of a node by id",
+                new OpenApiExample { Value = new OpenApiString("ancestors:id") }
+            },
+            {
+                "Select all ancestors of a node by path",
+                new OpenApiExample { Value = new OpenApiString("ancestors:path") }
+            },
+            {
+                "Select all children of a node by id",
+                new OpenApiExample { Value = new OpenApiString("children:id") }
+            },
+            {
+                "Select all children of a node by path",
+                new OpenApiExample { Value = new OpenApiString("children:path") }
+            },
+            {
+                "Select all descendants of a node by id",
+                new OpenApiExample { Value = new OpenApiString("descendants:id") }
+            },
+            {
+                "Select all descendants of a node by path",
+                new OpenApiExample { Value = new OpenApiString("descendants:path") }
+            }
+        };
+
+    private Dictionary<string, OpenApiExample> FilterQueryParameterExamples() =>
+        new()
+        {
+            { "Default filter", new OpenApiExample { Value = new OpenApiString(string.Empty) } },
+            {
+                "Filter by content type (equals)",
+                new OpenApiExample { Value = new OpenApiArray { new OpenApiString("contentType:alias1") } }
+            },
+            {
+                "Filter by name (contains)",
+                new OpenApiExample { Value = new OpenApiArray { new OpenApiString("name:nodeName") } }
+            },
+            {
+                "Filter by creation date (less than)",
+                new OpenApiExample { Value = new OpenApiArray { new OpenApiString("createDate<2024-01-01") } }
+            },
+            {
+                "Filter by update date (greater than or equal)",
+                new OpenApiExample { Value = new OpenApiArray { new OpenApiString("updateDate>:2023-01-01") } }
+            }
+        };
+
+    private Dictionary<string, OpenApiExample> SortQueryParameterExamples() =>
+        new()
+        {
+            { "Default sort", new OpenApiExample { Value = new OpenApiString(string.Empty) } },
+            {
+                "Sort by create date",
+                new OpenApiExample
+                {
+                    Value = new OpenApiArray
+                    {
+                        new OpenApiString("createDate:asc"), new OpenApiString("createDate:desc")
+                    }
+                }
+            },
+            {
+                "Sort by level",
+                new OpenApiExample
+                {
+                    Value = new OpenApiArray { new OpenApiString("level:asc"), new OpenApiString("level:desc") }
+                }
+            },
+            {
+                "Sort by name",
+                new OpenApiExample
+                {
+                    Value = new OpenApiArray { new OpenApiString("name:asc"), new OpenApiString("name:desc") }
+                }
+            },
+            {
+                "Sort by sort order",
+                new OpenApiExample
+                {
+                    Value = new OpenApiArray
+                    {
+                        new OpenApiString("sortOrder:asc"), new OpenApiString("sortOrder:desc")
+                    }
+                }
+            },
+            {
+                "Sort by update date",
+                new OpenApiExample
+                {
+                    Value = new OpenApiArray
+                    {
+                        new OpenApiString("updateDate:asc"), new OpenApiString("updateDate:desc")
+                    }
+                }
+            }
+        };
+}

src/Umbraco.Cms.Api.Delivery/Filters/SwaggerDocumentationFilter.cs

@@ -0,0 +1,18 @@
+using Microsoft.OpenApi.Models;
+using Swashbuckle.AspNetCore.SwaggerGen;
+
+namespace Umbraco.Cms.Api.Delivery.Filters;
+
+[Obsolete($"Superseded by {nameof(SwaggerContentDocumentationFilter)} and {nameof(SwaggerMediaDocumentationFilter)}. Will be removed in V14.")]
+public class SwaggerDocumentationFilter : IOperationFilter, IParameterFilter
+{
+    public void Apply(OpenApiOperation operation, OperationFilterContext context)
+    {
+        // retained for backwards compat
+    }
+
+    public void Apply(OpenApiParameter parameter, ParameterFilterContext context)
+    {
+        // retained for backwards compat
+    }
+}

src/Umbraco.Cms.Api.Delivery/Filters/SwaggerDocumentationFilterBase.cs

@@ -0,0 +1,159 @@
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.OpenApi.Any;
+using Microsoft.OpenApi.Models;
+using Swashbuckle.AspNetCore.SwaggerGen;
+
+namespace Umbraco.Cms.Api.Delivery.Filters;
+
+internal abstract class SwaggerDocumentationFilterBase<TBaseController>
+    : SwaggerFilterBase<TBaseController>, IOperationFilter, IParameterFilter
+    where TBaseController : Controller
+{
+    public void Apply(OpenApiOperation operation, OperationFilterContext context)
+    {
+        if (CanApply(context))
+        {
+            ApplyOperation(operation, context);
+        }
+    }
+
+    public void Apply(OpenApiParameter parameter, ParameterFilterContext context)
+    {
+        if (CanApply(context))
+        {
+            ApplyParameter(parameter, context);
+        }
+    }
+
+    protected abstract string DocumentationLink { get; }
+
+    protected abstract void ApplyOperation(OpenApiOperation operation, OperationFilterContext context);
+
+    protected abstract void ApplyParameter(OpenApiParameter parameter, ParameterFilterContext context);
+
+    protected void AddQueryParameterDocumentation(OpenApiParameter parameter, Dictionary<string, OpenApiExample> examples, string description)
+    {
+        parameter.Description = QueryParameterDescription(description);
+        parameter.Examples = examples;
+    }
+
+    protected void AddExpand(OpenApiOperation operation, OperationFilterContext context)
+    {
+        if (IsApiV1(context))
+        {
+            AddExpandV1(operation);
+        }
+        else
+        {
+            AddExpand(operation);
+        }
+    }
+
+    protected void AddFields(OpenApiOperation operation, OperationFilterContext context)
+    {
+        if (IsApiV1(context))
+        {
+            // "fields" is not a thing in Delivery API V1
+            return;
+        }
+
+        AddFields(operation);
+    }
+
+    protected void AddApiKey(OpenApiOperation operation) =>
+        operation.Parameters.Add(new OpenApiParameter
+        {
+            Name = Core.Constants.DeliveryApi.HeaderNames.ApiKey,
+            In = ParameterLocation.Header,
+            Required = false,
+            Description = "API key specified through configuration to authorize access to the API.",
+            Schema = new OpenApiSchema { Type = "string" }
+        });
+
+    protected string PaginationDescription(bool skip, string itemType)
+        => $"Specifies the number of found {itemType} items to {(skip ? "skip" : "take")}. Use this to control pagination of the response.";
+
+    private string QueryParameterDescription(string description)
+        => $"{description}. Refer to [the documentation]({DocumentationLink}#query-parameters) for more details on this.";
+
+    // FIXME: remove this when Delivery API V1 has been removed (expectedly in V15)
+    private static bool IsApiV1(OperationFilterContext context)
+        => context.ApiDescription.RelativePath?.Contains("api/v1") is true;
+
+    // FIXME: remove this when Delivery API V1 has been removed (expectedly in V15)
+    private void AddExpandV1(OpenApiOperation operation)
+        => operation.Parameters.Add(new OpenApiParameter
+        {
+            Name = "expand",
+            In = ParameterLocation.Query,
+            Required = false,
+            Description = QueryParameterDescription("Defines the properties that should be expanded in the response"),
+            Schema = new OpenApiSchema { Type = "string" },
+            Examples = new Dictionary<string, OpenApiExample>
+            {
+                { "Expand none", new OpenApiExample { Value = new OpenApiString(string.Empty) } },
+                { "Expand all", new OpenApiExample { Value = new OpenApiString("all") } },
+                {
+                    "Expand specific property",
+                    new OpenApiExample { Value = new OpenApiString("property:alias1") }
+                },
+                {
+                    "Expand specific properties",
+                    new OpenApiExample { Value = new OpenApiString("property:alias1,alias2") }
+                }
+            }
+        });
+
+    private void AddExpand(OpenApiOperation operation)
+        => operation.Parameters.Add(new OpenApiParameter
+        {
+            Name = "expand",
+            In = ParameterLocation.Query,
+            Required = false,
+            Description = QueryParameterDescription("Defines the properties that should be expanded in the response"),
+            Schema = new OpenApiSchema { Type = "string" },
+            Examples = new Dictionary<string, OpenApiExample>
+            {
+                { "Expand none", new OpenApiExample { Value = new OpenApiString(string.Empty) } },
+                { "Expand all properties", new OpenApiExample { Value = new OpenApiString("properties[$all]") } },
+                {
+                    "Expand specific property",
+                    new OpenApiExample { Value = new OpenApiString("properties[alias1]") }
+                },
+                {
+                    "Expand specific properties",
+                    new OpenApiExample { Value = new OpenApiString("properties[alias1,alias2]") }
+                },
+                {
+                    "Expand nested properties",
+                    new OpenApiExample { Value = new OpenApiString("properties[alias1[properties[nestedAlias1,nestedAlias2]]]") }
+                }
+            }
+        });
+
+    private void AddFields(OpenApiOperation operation)
+        => operation.Parameters.Add(new OpenApiParameter
+        {
+            Name = "fields",
+            In = ParameterLocation.Query,
+            Required = false,
+            Description = QueryParameterDescription("Explicitly defines which properties should be included in the response (by default all properties are included)"),
+            Schema = new OpenApiSchema { Type = "string" },
+            Examples = new Dictionary<string, OpenApiExample>
+            {
+                { "Include all properties", new OpenApiExample { Value = new OpenApiString("properties[$all]") } },
+                {
+                    "Include only specific property",
+                    new OpenApiExample { Value = new OpenApiString("properties[alias1]") }
+                },
+                {
+                    "Include only specific properties",
+                    new OpenApiExample { Value = new OpenApiString("properties[alias1,alias2]") }
+                },
+                {
+                    "Include only specific nested properties",
+                    new OpenApiExample { Value = new OpenApiString("properties[alias1[properties[nestedAlias1,nestedAlias2]]]") }
+                }
+            }
+        });
+}

src/Umbraco.Cms.Api.Delivery/Filters/SwaggerFilterBase.cs

@@ -0,0 +1,19 @@
+using System.Reflection;
+using Microsoft.AspNetCore.Mvc;
+using Swashbuckle.AspNetCore.SwaggerGen;
+using Umbraco.Extensions;
+
+namespace Umbraco.Cms.Api.Delivery.Filters;
+
+internal abstract class SwaggerFilterBase<TBaseController>
+    where TBaseController : Controller
+{
+    protected bool CanApply(OperationFilterContext context)
+        => CanApply(context.MethodInfo);
+
+    protected bool CanApply(ParameterFilterContext context)
+        => CanApply(context.ParameterInfo.Member);
+
+    private bool CanApply(MemberInfo member)
+        => member.DeclaringType?.Implements<TBaseController>() is true;
+}

src/Umbraco.Cms.Api.Delivery/Filters/SwaggerMediaDocumentationFilter.cs

@@ -0,0 +1,122 @@
+using Microsoft.OpenApi.Any;
+using Microsoft.OpenApi.Models;
+using Swashbuckle.AspNetCore.SwaggerGen;
+using Umbraco.Cms.Api.Delivery.Configuration;
+using Umbraco.Cms.Api.Delivery.Controllers;
+using Umbraco.Cms.Api.Delivery.Controllers.Media;
+
+namespace Umbraco.Cms.Api.Delivery.Filters;
+
+internal sealed class SwaggerMediaDocumentationFilter : SwaggerDocumentationFilterBase<MediaApiControllerBase>
+{
+    protected override string DocumentationLink => DeliveryApiConfiguration.ApiDocumentationMediaArticleLink;
+
+    protected override void ApplyOperation(OpenApiOperation operation, OperationFilterContext context)
+    {
+        operation.Parameters ??= new List<OpenApiParameter>();
+
+        AddExpand(operation, context);
+
+        AddFields(operation, context);
+
+        AddApiKey(operation);
+    }
+
+    protected override void ApplyParameter(OpenApiParameter parameter, ParameterFilterContext context)
+    {
+        switch (parameter.Name)
+        {
+            case "fetch":
+                AddQueryParameterDocumentation(parameter, FetchQueryParameterExamples(), "Specifies the media items to fetch");
+                break;
+            case "filter":
+                AddQueryParameterDocumentation(parameter, FilterQueryParameterExamples(), "Defines how to filter the fetched media items");
+                break;
+            case "sort":
+                AddQueryParameterDocumentation(parameter, SortQueryParameterExamples(), "Defines how to sort the found media items");
+                break;
+            case "skip":
+                parameter.Description = PaginationDescription(true, "media");
+                break;
+            case "take":
+                parameter.Description = PaginationDescription(false, "media");
+                break;
+            default:
+                return;
+        }
+    }
+
+    private Dictionary<string, OpenApiExample> FetchQueryParameterExamples() =>
+        new()
+        {
+            {
+                "Select all children at root level",
+                new OpenApiExample { Value = new OpenApiString("children:/") }
+            },
+            {
+                "Select all children of a media item by id",
+                new OpenApiExample { Value = new OpenApiString("children:id") }
+            },
+            {
+                "Select all children of a media item by path",
+                new OpenApiExample { Value = new OpenApiString("children:path") }
+            }
+        };
+
+    private Dictionary<string, OpenApiExample> FilterQueryParameterExamples() =>
+        new()
+        {
+            { "Default filter", new OpenApiExample { Value = new OpenApiString(string.Empty) } },
+            {
+                "Filter by media type",
+                new OpenApiExample { Value = new OpenApiArray { new OpenApiString("mediaType:alias1") } }
+            },
+            {
+                "Filter by name",
+                new OpenApiExample { Value = new OpenApiArray { new OpenApiString("name:nodeName") } }
+            }
+        };
+
+    private Dictionary<string, OpenApiExample> SortQueryParameterExamples() =>
+        new()
+        {
+            { "Default sort", new OpenApiExample { Value = new OpenApiString(string.Empty) } },
+            {
+                "Sort by create date",
+                new OpenApiExample
+                {
+                    Value = new OpenApiArray
+                    {
+                        new OpenApiString("createDate:asc"), new OpenApiString("createDate:desc")
+                    }
+                }
+            },
+            {
+                "Sort by name",
+                new OpenApiExample
+                {
+                    Value = new OpenApiArray { new OpenApiString("name:asc"), new OpenApiString("name:desc") }
+                }
+            },
+            {
+                "Sort by sort order",
+                new OpenApiExample
+                {
+                    Value = new OpenApiArray
+                    {
+                        new OpenApiString("sortOrder:asc"), new OpenApiString("sortOrder:desc")
+                    }
+                }
+            },
+            {
+                "Sort by update date",
+                new OpenApiExample
+                {
+                    Value = new OpenApiArray
+                    {
+                        new OpenApiString("updateDate:asc"), new OpenApiString("updateDate:desc")
+                    }
+                }
+            }
+        };
+}

src/Umbraco.Cms.Api.Delivery/Handlers/InitializeMemberApplicationNotificationHandler.cs

@@ -0,0 +1,112 @@
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Options;
+using Umbraco.Cms.Core;
+using Umbraco.Cms.Core.Configuration.Models;
+using Umbraco.Cms.Core.Events;
+using Umbraco.Cms.Core.Notifications;
+using Umbraco.Cms.Core.Services;
+using Umbraco.Cms.Core.Sync;
+using Umbraco.Cms.Infrastructure.Security;
+
+namespace Umbraco.Cms.Api.Delivery.Handlers;
+
+internal sealed class InitializeMemberApplicationNotificationHandler : INotificationAsyncHandler<UmbracoApplicationStartingNotification>
+{
+    private readonly IRuntimeState _runtimeState;
+    private readonly ILogger<InitializeMemberApplicationNotificationHandler> _logger;
+    private readonly DeliveryApiSettings _deliveryApiSettings;
+    private readonly IServiceScopeFactory _serviceScopeFactory;
+    private readonly IServerRoleAccessor _serverRoleAccessor;
+    private static readonly SemaphoreSlim _locker = new(1);
+    private static bool _isInitialized = false;
+
+    public InitializeMemberApplicationNotificationHandler(
+        IRuntimeState runtimeState,
+        IOptions<DeliveryApiSettings> deliveryApiSettings,
+        ILogger<InitializeMemberApplicationNotificationHandler> logger,
+        IServiceScopeFactory serviceScopeFactory,
+        IServerRoleAccessor serverRoleAccessor)
+    {
+        _runtimeState = runtimeState;
+        _logger = logger;
+        _serviceScopeFactory = serviceScopeFactory;
+        _serverRoleAccessor = serverRoleAccessor;
+        _deliveryApiSettings = deliveryApiSettings.Value;
+    }
+
+    public async Task HandleAsync(UmbracoApplicationStartingNotification notification, CancellationToken cancellationToken)
+    {
+        if (_runtimeState.Level != RuntimeLevel.Run)
+        {
+            return;
+        }
+
+        if (_serverRoleAccessor.CurrentServerRole is ServerRole.Subscriber)
+        {
+            // subscriber instances should not alter the member application
+            return;
+        }
+
+        try
+        {
+            await _locker.WaitAsync(cancellationToken);
+            if (_isInitialized)
+            {
+                return;
+            }
+
+            _isInitialized = true;
+
+            // we cannot inject the IMemberApplicationManager because it ultimately takes a dependency on the DbContext ... and during
+            // install that is not allowed (no connection string means no DbContext)
+            using IServiceScope scope = _serviceScopeFactory.CreateScope();
+            IMemberApplicationManager memberApplicationManager = scope.ServiceProvider.GetRequiredService<IMemberApplicationManager>();
+
+            if (_deliveryApiSettings.MemberAuthorization?.AuthorizationCodeFlow?.Enabled is not true)
+            {
+                await memberApplicationManager.DeleteMemberApplicationAsync(cancellationToken);
+                return;
+            }
+
+            if (ValidateRedirectUrls(_deliveryApiSettings.MemberAuthorization.AuthorizationCodeFlow.LoginRedirectUrls) is false)
+            {
+                await memberApplicationManager.DeleteMemberApplicationAsync(cancellationToken);
+                return;
+            }
+
+            if (_deliveryApiSettings.MemberAuthorization.AuthorizationCodeFlow.LogoutRedirectUrls.Any()
+                && ValidateRedirectUrls(_deliveryApiSettings.MemberAuthorization.AuthorizationCodeFlow.LogoutRedirectUrls) is false)
+            {
+                await memberApplicationManager.DeleteMemberApplicationAsync(cancellationToken);
+                return;
+            }
+
+            await memberApplicationManager.EnsureMemberApplicationAsync(
+                _deliveryApiSettings.MemberAuthorization.AuthorizationCodeFlow.LoginRedirectUrls,
+                _deliveryApiSettings.MemberAuthorization.AuthorizationCodeFlow.LogoutRedirectUrls,
+                cancellationToken);
+        }
+        finally
+        {
+            _locker.Release();
+        }
+    }
+
+    private bool ValidateRedirectUrls(Uri[] redirectUrls)
+    {
+        if (redirectUrls.Any() is false)
+        {
+            _logger.LogWarning("No redirect URLs defined for Delivery API member authentication - cannot enable member authentication");
+            return false;
+        }
+
+        if (redirectUrls.All(url => url.IsAbsoluteUri) is false)
+        {
+            _logger.LogWarning("All redirect URLs defined for Delivery API member authentication must be absolute - cannot enable member authentication");
+            return false;
+        }
+
+        return true;
+    }
+}

src/Umbraco.Cms.Api.Delivery/Handlers/RevokeMemberAuthenticationTokensNotificationHandler.cs

@@ -0,0 +1,102 @@
+using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Options;
+using OpenIddict.Abstractions;
+using Umbraco.Cms.Core.Configuration.Models;
+using Umbraco.Cms.Core.Events;
+using Umbraco.Cms.Core.Models;
+using Umbraco.Cms.Core.Notifications;
+using Umbraco.Cms.Core.Services;
+
+namespace Umbraco.Cms.Api.Delivery.Handlers;
+
+internal sealed class RevokeMemberAuthenticationTokensNotificationHandler
+    : INotificationAsyncHandler<MemberSavedNotification>,
+        INotificationAsyncHandler<MemberDeletedNotification>,
+        INotificationAsyncHandler<AssignedMemberRolesNotification>,
+        INotificationAsyncHandler<RemovedMemberRolesNotification>
+{
+    private readonly IMemberService _memberService;
+    private readonly IOpenIddictTokenManager _tokenManager;
+    private readonly bool _enabled;
+    private readonly ILogger<RevokeMemberAuthenticationTokensNotificationHandler> _logger;
+
+    public RevokeMemberAuthenticationTokensNotificationHandler(
+        IMemberService memberService,
+        IOpenIddictTokenManager tokenManager,
+        IOptions<DeliveryApiSettings> deliveryApiSettings,
+        ILogger<RevokeMemberAuthenticationTokensNotificationHandler> logger)
+    {
+        _memberService = memberService;
+        _tokenManager = tokenManager;
+        _logger = logger;
+        _enabled = deliveryApiSettings.Value.MemberAuthorizationIsEnabled();
+    }
+
+    public async Task HandleAsync(MemberSavedNotification notification, CancellationToken cancellationToken)
+    {
+        if (_enabled is false)
+        {
+            return;
+        }
+
+        foreach (IMember member in notification.SavedEntities.Where(member => member.IsLockedOut || member.IsApproved is false))
+        {
+            // member is locked out and/or un-approved, make sure we revoke all tokens
+            await RevokeTokensAsync(member);
+        }
+    }
+
+    public async Task HandleAsync(MemberDeletedNotification notification, CancellationToken cancellationToken)
+    {
+        if (_enabled is false)
+        {
+            return;
+        }
+
+        foreach (IMember member in notification.DeletedEntities)
+        {
+            await RevokeTokensAsync(member);
+        }
+    }
+
+    public async Task HandleAsync(AssignedMemberRolesNotification notification, CancellationToken cancellationToken)
+        => await MemberRolesChangedAsync(notification);
+
+    public async Task HandleAsync(RemovedMemberRolesNotification notification, CancellationToken cancellationToken)
+        => await MemberRolesChangedAsync(notification);
+
+    private async Task RevokeTokensAsync(IMember member)
+    {
+        var tokens = await _tokenManager.FindBySubjectAsync(member.Key.ToString()).ToArrayAsync();
+        if (tokens.Any() is false)
+        {
+            return;
+        }
+
+        _logger.LogInformation("Deleting {count} active tokens for member with ID {id}", tokens.Length, member.Id);
+        foreach (var token in tokens)
+        {
+            await _tokenManager.DeleteAsync(token);
+        }
+    }
+
+    private async Task MemberRolesChangedAsync(MemberRolesNotification notification)
+    {
+        if (_enabled is false)
+        {
+            return;
+        }
+
+        foreach (var memberId in notification.MemberIds)
+        {
+            IMember? member = _memberService.GetById(memberId);
+            if (member is null)
+            {
+                _logger.LogWarning("Unable to find member with ID {id}", memberId);
+                continue;
+            }
+
+            await RevokeTokensAsync(member);
+        }
+    }
+}

src/Umbraco.Cms.Api.Delivery/Indexing/Filters/NameFilterIndexer.cs

@@ -0,0 +1,15 @@
+using Umbraco.Cms.Core.DeliveryApi;
+using Umbraco.Cms.Core.Models;
+
+namespace Umbraco.Cms.Api.Delivery.Indexing.Filters;
+
+public sealed class NameFilterIndexer : IContentIndexHandler
+{
+    internal const string FieldName = "name";
+
+    public IEnumerable<IndexFieldValue> GetFieldValues(IContent content, string? culture)
+        => new[] { new IndexFieldValue { FieldName = FieldName, Values = new object[] { content.GetCultureName(culture) ?? string.Empty } } };
+
+    public IEnumerable<IndexField> GetFields()
+        => new[] { new IndexField { FieldName = FieldName, FieldType = FieldType.StringAnalyzed, VariesByCulture = true } };
+}

src/Umbraco.Cms.Api.Delivery/Indexing/Sorts/NameSortIndexer.cs

@@ -5,7 +5,7 @@ namespace Umbraco.Cms.Api.Delivery.Indexing.Sorts;
 
 public sealed class NameSortIndexer : IContentIndexHandler
 {
-    internal const string FieldName = "name";
+    internal const string FieldName = "sortName";
 
     public IEnumerable<IndexFieldValue> GetFieldValues(IContent content, string? culture)
         => new[] { new IndexFieldValue { FieldName = FieldName, Values = new object[] { content.GetCultureName(culture) ?? string.Empty } } };

src/Umbraco.Cms.Api.Delivery/Json/DeliveryApiJsonTypeResolver.cs

@@ -6,30 +6,42 @@ using Umbraco.Cms.Core.Models.DeliveryApi;
 namespace Umbraco.Cms.Api.Delivery.Json;
 
 // see https://learn.microsoft.com/en-us/dotnet/standard/serialization/system-text-json/polymorphism?pivots=dotnet-7-0
-// TODO: if this type resolver is to be used for extendable content models (custom IApiContent implementations) we need to work out an extension model for known derived types
-internal sealed class DeliveryApiJsonTypeResolver : DefaultJsonTypeInfoResolver
+public class DeliveryApiJsonTypeResolver : DefaultJsonTypeInfoResolver
 {
     public override JsonTypeInfo GetTypeInfo(Type type, JsonSerializerOptions options)
     {
         JsonTypeInfo jsonTypeInfo = base.GetTypeInfo(type, options);
 
-        if (jsonTypeInfo.Type == typeof(IApiContent))
+        Type[] derivedTypes = GetDerivedTypes(jsonTypeInfo);
+        if (derivedTypes.Length > 0)
         {
-            ConfigureJsonPolymorphismOptions(jsonTypeInfo, typeof(ApiContent));
-        }
-        else if (jsonTypeInfo.Type == typeof(IApiContentResponse))
-        {
-            ConfigureJsonPolymorphismOptions(jsonTypeInfo, typeof(ApiContentResponse));
-        }
-        else if (jsonTypeInfo.Type == typeof(IRichTextElement))
-        {
-            ConfigureJsonPolymorphismOptions(jsonTypeInfo, typeof(RichTextGenericElement), typeof(RichTextTextElement));
+            ConfigureJsonPolymorphismOptions(jsonTypeInfo, derivedTypes);
         }
 
         return jsonTypeInfo;
     }
 
-    private void ConfigureJsonPolymorphismOptions(JsonTypeInfo jsonTypeInfo, params Type[] derivedTypes)
+    protected virtual Type[] GetDerivedTypes(JsonTypeInfo jsonTypeInfo)
+    {
+        if (jsonTypeInfo.Type == typeof(IApiContent))
+        {
+            return new[] { typeof(ApiContent) };
+        }
+
+        if (jsonTypeInfo.Type == typeof(IApiContentResponse))
+        {
+            return new[] { typeof(ApiContentResponse) };
+        }
+
+        if (jsonTypeInfo.Type == typeof(IRichTextElement))
+        {
+            return new[] { typeof(RichTextRootElement), typeof(RichTextGenericElement), typeof(RichTextTextElement) };
+        }
+
+        return Array.Empty<Type>();
+    }
+
+    protected void ConfigureJsonPolymorphismOptions(JsonTypeInfo jsonTypeInfo, params Type[] derivedTypes)
     {
         jsonTypeInfo.PolymorphismOptions = new JsonPolymorphismOptions
         {

src/Umbraco.Cms.Api.Delivery/Querying/Filters/ContainsFilterBase.cs

@@ -0,0 +1,78 @@
+using System.Text.RegularExpressions;
+using Umbraco.Cms.Core.DeliveryApi;
+
+namespace Umbraco.Cms.Api.Delivery.Querying.Filters;
+
+public abstract class ContainsFilterBase : IFilterHandler
+{
+    /// <summary>
+    /// The regex to parse the filter query. Must supply two match groups named "operator" and "value", where "operator"
+    /// contains the filter operator (i.e. ">") and "value" contains the value to filter on.
+    /// </summary>
+    /// <remarks>
+    /// Supported operators:
+    /// <list type="bullet">
+    /// <item>":" = Is (the filter value equals the index field value)</item>
+    /// <item>":!" = IsNot (the filter value does not equal the index field value)</item>
+    /// <item>"&gt;" = GreaterThan (the filter value is greater than the index field value)</item>
+    /// <item>"&gt;:" = GreaterThanOrEqual (the filter value is greater than or equal to the index field value)</item>
+    /// <item>"&lt;" = LessThan (the filter value is less than the index field value)</item>
+    /// <item>"&lt;:" = LessThanOrEqual (the filter value is less than or equal to the index field value)</item>
+    /// </list>
+    /// Range operators (greater than, less than) only work with numeric and date type filters.
+    /// </remarks>
+    protected abstract Regex QueryParserRegex { get; }
+
+    /// <summary>
+    /// The index field name to filter on.
+    /// </summary>
+    protected abstract string FieldName { get; }
+
+    /// <inheritdoc />
+    public bool CanHandle(string query)
+        => QueryParserRegex.IsMatch(query);
+
+    /// <inheritdoc/>
+    public FilterOption BuildFilterOption(string filter)
+    {
+        GroupCollection groups = QueryParserRegex.Match(filter).Groups;
+
+        if (groups.Count != 3 || groups.ContainsKey("operator") is false || groups.ContainsKey("value") is false)
+        {
+            return DefaultFilterOption();
+        }
+
+        FilterOperation? filterOperation = ParseFilterOperation(groups["operator"].Value);
+        if (filterOperation.HasValue is false)
+        {
+            return DefaultFilterOption();
+        }
+
+        return new FilterOption
+        {
+            FieldName = FieldName,
+            Values = new[] { groups["value"].Value },
+            Operator = filterOperation.Value
+        };
+
+        FilterOption DefaultFilterOption()
+            => new FilterOption
+            {
+                FieldName = FieldName,
+                Values = new[] { Guid.NewGuid().ToString() },
+                Operator = FilterOperation.Is
+            };
+    }
+
+    private FilterOperation? ParseFilterOperation(string filterOperation)
+        => filterOperation switch
+        {
+            ":" => FilterOperation.Is,
+            ":!" => FilterOperation.IsNot,
+            ">" => FilterOperation.GreaterThan,
+            ">:" => FilterOperation.GreaterThanOrEqual,
+            "<" => FilterOperation.LessThan,
+            "<:" => FilterOperation.LessThanOrEqual,
+            _ => null
+        };
+}

src/Umbraco.Cms.Api.Delivery/Querying/Filters/ContentTypeFilter.cs

@@ -1,6 +1,5 @@
 using Umbraco.Cms.Api.Delivery.Indexing.Filters;
 using Umbraco.Cms.Core.DeliveryApi;
-using Umbraco.Extensions;
 
 namespace Umbraco.Cms.Api.Delivery.Querying.Filters;
 
@@ -15,15 +14,15 @@ public sealed class ContentTypeFilter : IFilterHandler
     /// <inheritdoc/>
     public FilterOption BuildFilterOption(string filter)
     {
-        var alias = filter.Substring(ContentTypeSpecifier.Length);
+        var filterValue = filter.Substring(ContentTypeSpecifier.Length);
+        var negate = filterValue.StartsWith('!');
+        var aliases = filterValue.TrimStart('!').Split(',', StringSplitOptions.TrimEntries | StringSplitOptions.RemoveEmptyEntries);
 
         return new FilterOption
         {
             FieldName = ContentTypeFilterIndexer.FieldName,
-            Values = alias.IsNullOrWhiteSpace() == false
-                ? new[] { alias.TrimStart('!') }
-                : Array.Empty<string>(),
-            Operator = alias.StartsWith('!')
+            Values = aliases,
+            Operator = negate
                 ? FilterOperation.IsNot
                 : FilterOperation.Is
         };

src/Umbraco.Cms.Api.Delivery/Querying/Filters/CreateDateFilter.cs

@@ -0,0 +1,14 @@
+using System.Text.RegularExpressions;
+using Umbraco.Cms.Api.Delivery.Indexing.Sorts;
+
+namespace Umbraco.Cms.Api.Delivery.Querying.Filters;
+
+public sealed partial class CreateDateFilter : ContainsFilterBase
+{
+    protected override string FieldName => CreateDateSortIndexer.FieldName;
+
+    protected override Regex QueryParserRegex => CreateDateRegex();
+
+    [GeneratedRegex("createDate(?<operator>[><:]{1,2})(?<value>.*)", RegexOptions.IgnoreCase)]
+    public static partial Regex CreateDateRegex();
+}

src/Umbraco.Cms.Api.Delivery/Querying/Filters/NameFilter.cs

@@ -1,6 +1,6 @@
-using Umbraco.Cms.Api.Delivery.Indexing.Sorts;
+using Umbraco.Cms.Api.Delivery.Indexing.Filters;
+using Umbraco.Cms.Core;
 using Umbraco.Cms.Core.DeliveryApi;
-using Umbraco.Extensions;
 
 namespace Umbraco.Cms.Api.Delivery.Querying.Filters;
 
@@ -16,16 +16,16 @@ public sealed class NameFilter : IFilterHandler
     public FilterOption BuildFilterOption(string filter)
     {
         var value = filter.Substring(NameSpecifier.Length);
+        var negate = value.StartsWith('!');
+        var values = value.TrimStart('!').Split(Constants.CharArrays.Comma);
 
         return new FilterOption
         {
-            FieldName = NameSortIndexer.FieldName,
-            Values = value.IsNullOrWhiteSpace() == false
-                ? new[] { value.TrimStart('!') }
-                : Array.Empty<string>(),
-            Operator = value.StartsWith('!')
-                ? FilterOperation.IsNot
-                : FilterOperation.Is
+            FieldName = NameFilterIndexer.FieldName,
+            Values = values,
+            Operator = negate
+                ? FilterOperation.DoesNotContain
+                : FilterOperation.Contains
         };
     }
 }

src/Umbraco.Cms.Api.Delivery/Querying/Filters/UpdateDateFilter.cs

@@ -0,0 +1,14 @@
+using System.Text.RegularExpressions;
+using Umbraco.Cms.Api.Delivery.Indexing.Sorts;
+
+namespace Umbraco.Cms.Api.Delivery.Querying.Filters;
+
+public sealed partial class UpdateDateFilter : ContainsFilterBase
+{
+    protected override string FieldName => UpdateDateSortIndexer.FieldName;
+
+    protected override Regex QueryParserRegex => UpdateDateRegex();
+
+    [GeneratedRegex("updateDate(?<operator>[><:]{1,2})(?<value>.*)", RegexOptions.IgnoreCase)]
+    public static partial Regex UpdateDateRegex();
+}

src/Umbraco.Cms.Api.Delivery/Querying/QueryOptionBase.cs

@@ -10,7 +10,8 @@ public abstract class QueryOptionBase
     private readonly IPublishedSnapshotAccessor _publishedSnapshotAccessor;
     private readonly IRequestRoutingService _requestRoutingService;
 
-    public QueryOptionBase(IPublishedSnapshotAccessor publishedSnapshotAccessor,
+    public QueryOptionBase(
+        IPublishedSnapshotAccessor publishedSnapshotAccessor,
         IRequestRoutingService requestRoutingService)
     {
         _publishedSnapshotAccessor = publishedSnapshotAccessor;

src/Umbraco.Cms.Api.Delivery/Querying/Selectors/AncestorsSelector.cs

@@ -1,5 +1,7 @@
+using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Api.Delivery.Indexing.Selectors;
 using Umbraco.Cms.Core.DeliveryApi;
+using Umbraco.Cms.Core.DependencyInjection;
 using Umbraco.Cms.Core.Models.PublishedContent;
 using Umbraco.Cms.Core.PublishedCache;
 using Umbraco.Extensions;
@@ -10,10 +12,21 @@ public sealed class AncestorsSelector : QueryOptionBase, ISelectorHandler
 {
     private const string AncestorsSpecifier = "ancestors:";
     private readonly IPublishedSnapshotAccessor _publishedSnapshotAccessor;
+    private readonly IRequestPreviewService _requestPreviewService;
 
-    public AncestorsSelector(IPublishedSnapshotAccessor publishedSnapshotAccessor, IRequestRoutingService requestRoutingService)
-        : base(publishedSnapshotAccessor, requestRoutingService) =>
+    [Obsolete("Please use the non-obsolete constructor. Will be removed in V17.")]
+    public AncestorsSelector(IPublishedSnapshotAccessor publishedSnapshotAccessor,
+        IRequestRoutingService requestRoutingService)
+        : this(publishedSnapshotAccessor, requestRoutingService, StaticServiceProvider.Instance.GetRequiredService<IRequestPreviewService>())
+    {
+    }
+
+    public AncestorsSelector(IPublishedSnapshotAccessor publishedSnapshotAccessor, IRequestRoutingService requestRoutingService, IRequestPreviewService requestPreviewService)
+        : base(publishedSnapshotAccessor, requestRoutingService)
+    {
         _publishedSnapshotAccessor = publishedSnapshotAccessor;
+        _requestPreviewService = requestPreviewService;
+    }
 
     /// <inheritdoc />
     public bool CanHandle(string query)
@@ -37,10 +50,20 @@ public sealed class AncestorsSelector : QueryOptionBase, ISelectorHandler
             };
         }
 
-        IPublishedSnapshot publishedSnapshot = _publishedSnapshotAccessor.GetRequiredPublishedSnapshot();
+        IPublishedContentCache contentCache = _publishedSnapshotAccessor.GetRequiredPublishedSnapshot()?.Content
+                                         ?? throw new InvalidOperationException("Could not obtain the content cache");
 
-        IPublishedContent contentItem = publishedSnapshot.Content?.GetById((Guid)id)
-                                        ?? throw new InvalidOperationException("Could not obtain the content cache");
+        IPublishedContent? contentItem = contentCache.GetById(_requestPreviewService.IsPreview(), id.Value);
+
+        if (contentItem is null)
+        {
+            // no such content item, make sure the selector does not yield any results
+            return new SelectorOption
+            {
+                FieldName = AncestorsSelectorIndexer.FieldName,
+                Values = Array.Empty<string>()
+            };
+        }
 
         var ancestorKeys = contentItem.Ancestors().Select(a => a.Key.ToString("D")).ToArray();
 

src/Umbraco.Cms.Api.Delivery/Rendering/RequestContextOutputExpansionStrategy.cs

@@ -8,13 +8,15 @@ namespace Umbraco.Cms.Api.Delivery.Rendering;
 
 internal sealed class RequestContextOutputExpansionStrategy : IOutputExpansionStrategy
 {
+    private readonly IApiPropertyRenderer _propertyRenderer;
     private readonly bool _expandAll;
     private readonly string[] _expandAliases;
 
     private ExpansionState _state;
 
-    public RequestContextOutputExpansionStrategy(IHttpContextAccessor httpContextAccessor)
+    public RequestContextOutputExpansionStrategy(IHttpContextAccessor httpContextAccessor, IApiPropertyRenderer propertyRenderer)
     {
+        _propertyRenderer = propertyRenderer;
         (bool ExpandAll, string[] ExpanedAliases) initialState = InitialRequestState(httpContextAccessor);
         _expandAll = initialState.ExpandAll;
         _expandAliases = initialState.ExpanedAliases;
@@ -24,7 +26,7 @@ internal sealed class RequestContextOutputExpansionStrategy : IOutputExpansionSt
     public IDictionary<string, object?> MapElementProperties(IPublishedElement element)
         => element.Properties.ToDictionary(
             p => p.Alias,
-            p => p.GetDeliveryApiValue(_state == ExpansionState.Expanding));
+            p => GetPropertyValue(p, _state == ExpansionState.Expanding));
 
     public IDictionary<string, object?> MapContentProperties(IPublishedContent content)
         => content.ItemType == PublishedItemType.Content
@@ -66,7 +68,7 @@ internal sealed class RequestContextOutputExpansionStrategy : IOutputExpansionSt
                         _state = ExpansionState.Expanding;
                     }
 
-                    var value = property.GetDeliveryApiValue(_state == ExpansionState.Expanding);
+                    var value = GetPropertyValue(property, _state == ExpansionState.Expanding);
 
                     // always revert to pending after rendering the property value
                     _state = ExpansionState.Pending;
@@ -84,7 +86,7 @@ internal sealed class RequestContextOutputExpansionStrategy : IOutputExpansionSt
             _state = ExpansionState.Expanded;
             var rendered = properties.ToDictionary(
                 property => property.Alias,
-                property => property.GetDeliveryApiValue(false));
+                property => GetPropertyValue(property, false));
             _state = ExpansionState.Expanding;
             return rendered;
         }
@@ -108,6 +110,9 @@ internal sealed class RequestContextOutputExpansionStrategy : IOutputExpansionSt
                 : Array.Empty<string>());
     }
 
+    private object? GetPropertyValue(IPublishedProperty property, bool expanding)
+        => _propertyRenderer.GetPropertyValue(property, expanding);
+
     private enum ExpansionState
     {
         Initial,

src/Umbraco.Cms.Api.Delivery/Rendering/RequestContextOutputExpansionStrategyV2.cs

@@ -0,0 +1,49 @@
+using Microsoft.AspNetCore.Http;
+using Microsoft.Extensions.Logging;
+using Umbraco.Cms.Core.DeliveryApi;
+using Umbraco.Cms.Web.Common.Rendering;
+
+namespace Umbraco.Cms.Api.Delivery.Rendering;
+
+internal sealed class RequestContextOutputExpansionStrategyV2 : ElementOnlyOutputExpansionStrategy, IOutputExpansionStrategy
+{
+    private readonly ILogger<RequestContextOutputExpansionStrategyV2> _logger;
+
+    public RequestContextOutputExpansionStrategyV2(
+        IHttpContextAccessor httpContextAccessor,
+        IApiPropertyRenderer propertyRenderer,
+        ILogger<RequestContextOutputExpansionStrategyV2> logger)
+        : base(propertyRenderer)
+    {
+        _logger = logger;
+        InitializeExpandAndInclude(httpContextAccessor);
+    }
+
+    private void InitializeExpandAndInclude(IHttpContextAccessor httpContextAccessor)
+    {
+        string? QueryValue(string key) => httpContextAccessor.HttpContext?.Request.Query[key];
+
+        var toExpand = QueryValue(ExpandParameterName) ?? None;
+        var toInclude = QueryValue(FieldsParameterName) ?? All;
+
+        try
+        {
+            ExpandProperties.Push(Node.Parse(toExpand));
+        }
+        catch (ArgumentException ex)
+        {
+            _logger.LogError(ex, $"Could not parse the '{ExpandParameterName}' parameter. See exception for details.");
+            throw new ArgumentException($"Could not parse the '{ExpandParameterName}' parameter: {ex.Message}");
+        }
+
+        try
+        {
+            IncludeProperties.Push(Node.Parse(toInclude));
+        }
+        catch (ArgumentException ex)
+        {
+            _logger.LogError(ex, $"Could not parse the '{FieldsParameterName}' parameter. See exception for details.");
+            throw new ArgumentException($"Could not parse the '{FieldsParameterName}' parameter: {ex.Message}");
+        }
+    }
+}

src/Umbraco.Cms.Api.Delivery/Routing/DeliveryApiItemsEndpointsMatcherPolicy.cs

@@ -0,0 +1,82 @@
+using Asp.Versioning;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc.Controllers;
+using Microsoft.AspNetCore.Routing;
+using Microsoft.AspNetCore.Routing.Matching;
+using Umbraco.Cms.Api.Delivery.Controllers.Content;
+using Umbraco.Cms.Api.Delivery.Controllers.Media;
+
+namespace Umbraco.Cms.Api.Delivery.Routing;
+
+// FIXME: remove this when Delivery API V1 is removed
+internal sealed class DeliveryApiItemsEndpointsMatcherPolicy : MatcherPolicy, IEndpointSelectorPolicy
+{
+    public override int Order => 100;
+
+    public bool AppliesToEndpoints(IReadOnlyList<Endpoint> endpoints)
+    {
+        for (var i = 0; i < endpoints.Count; i++)
+        {
+            ControllerActionDescriptor? controllerActionDescriptor = endpoints[i].Metadata.GetMetadata<ControllerActionDescriptor>();
+            if (IsByIdsController(controllerActionDescriptor) || IsByRouteController(controllerActionDescriptor))
+            {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    public Task ApplyAsync(HttpContext httpContext, CandidateSet candidates)
+    {
+        var hasIdQueryParameter = httpContext.Request.Query.ContainsKey("id");
+        ApiVersion? requestedApiVersion = httpContext.GetRequestedApiVersion();
+        for (var i = 0; i < candidates.Count; i++)
+        {
+            CandidateState candidate = candidates[i];
+            Endpoint? endpoint = candidate.Endpoint;
+
+            // NOTE: nullability for the CandidateState.Endpoint property is not correct - it *can* be null
+            if (endpoint is null)
+            {
+                continue;
+            }
+
+            if (EndpointSupportsApiVersion(endpoint, requestedApiVersion) is false)
+            {
+                candidates.SetValidity(i, false);
+                continue;
+            }
+
+            ControllerActionDescriptor? controllerActionDescriptor = endpoint.Metadata.GetMetadata<ControllerActionDescriptor>();
+            if (IsByIdsController(controllerActionDescriptor))
+            {
+                candidates.SetValidity(i, hasIdQueryParameter);
+            }
+            else if (IsByRouteController(controllerActionDescriptor))
+            {
+                candidates.SetValidity(i, hasIdQueryParameter is false);
+            }
+        }
+
+        return Task.CompletedTask;
+    }
+
+    private static bool EndpointSupportsApiVersion(Endpoint endpoint, ApiVersion? requestedApiVersion)
+    {
+        ApiVersion[]? supportedApiVersions = endpoint.Metadata.GetMetadata<MapToApiVersionAttribute>()?.Versions.ToArray();
+
+        // if the endpoint is versioned, the requested API version must be among the API versions supported by the endpoint.
+        // if the endpoint is NOT versioned, it cannot be used with a requested API version
+        return supportedApiVersions?.Contains(requestedApiVersion) ?? requestedApiVersion is null;
+    }
+
+    private static bool IsByIdsController(ControllerActionDescriptor? controllerActionDescriptor)
+        => IsControllerType<ByIdsContentApiController>(controllerActionDescriptor) || IsControllerType<ByIdsMediaApiController>(controllerActionDescriptor);
+
+    private static bool IsByRouteController(ControllerActionDescriptor? controllerActionDescriptor)
+        => IsControllerType<ByRouteContentApiController>(controllerActionDescriptor) || IsControllerType<ByPathMediaApiController>(controllerActionDescriptor);
+
+    private static bool IsControllerType<T>(ControllerActionDescriptor? controllerActionDescriptor)
+        => controllerActionDescriptor?.MethodInfo.DeclaringType == typeof(T);
+}

src/Umbraco.Cms.Api.Delivery/Security/MemberApplicationManager.cs

@@ -0,0 +1,67 @@
+using OpenIddict.Abstractions;
+using Umbraco.Cms.Core;
+using Umbraco.Cms.Core.Services;
+using Umbraco.Cms.Infrastructure.Security;
+
+namespace Umbraco.Cms.Api.Delivery.Security;
+
+public class MemberApplicationManager : OpenIdDictApplicationManagerBase, IMemberApplicationManager
+{
+    private readonly IRuntimeState _runtimeState;
+
+    public MemberApplicationManager(IOpenIddictApplicationManager applicationManager, IRuntimeState runtimeState)
+        : base(applicationManager)
+        => _runtimeState = runtimeState;
+
+    public async Task EnsureMemberApplicationAsync(IEnumerable<Uri> loginRedirectUrls, IEnumerable<Uri> logoutRedirectUrls, CancellationToken cancellationToken = default)
+    {
+        if (_runtimeState.Level < RuntimeLevel.Run)
+        {
+            return;
+        }
+
+        Uri[] loginRedirectUrlsArray = loginRedirectUrls as Uri[] ?? loginRedirectUrls.ToArray();
+        if (loginRedirectUrlsArray.All(r => r.IsAbsoluteUri) is false)
+        {
+            throw new ArgumentException("Expected absolute login redirect URLs for Delivery API member authentication", nameof(loginRedirectUrls));
+        }
+
+        Uri[] logoutRedirectUrlsArray = logoutRedirectUrls as Uri[] ?? logoutRedirectUrls.ToArray();
+        if (logoutRedirectUrlsArray.All(r => r.IsAbsoluteUri) is false)
+        {
+            throw new ArgumentException("Expected absolute logout redirect URLs for Delivery API member authentication", nameof(logoutRedirectUrlsArray));
+        }
+
+        var applicationDescriptor = new OpenIddictApplicationDescriptor
+        {
+            DisplayName = "Umbraco member access",
+            ClientId = Constants.OAuthClientIds.Member,
+            Type = OpenIddictConstants.ClientTypes.Public,
+            Permissions =
+            {
+                OpenIddictConstants.Permissions.Endpoints.Authorization,
+                OpenIddictConstants.Permissions.Endpoints.Token,
+                OpenIddictConstants.Permissions.Endpoints.Logout,
+                OpenIddictConstants.Permissions.Endpoints.Revocation,
+                OpenIddictConstants.Permissions.GrantTypes.AuthorizationCode,
+                OpenIddictConstants.Permissions.GrantTypes.RefreshToken,
+                OpenIddictConstants.Permissions.ResponseTypes.Code
+            }
+        };
+
+        foreach (Uri redirectUrl in loginRedirectUrlsArray)
+        {
+            applicationDescriptor.RedirectUris.Add(redirectUrl);
+        }
+
+        foreach (Uri redirectUrl in logoutRedirectUrlsArray)
+        {
+            applicationDescriptor.PostLogoutRedirectUris.Add(redirectUrl);
+        }
+
+        await CreateOrUpdate(applicationDescriptor, cancellationToken);
+    }
+
+    public async Task DeleteMemberApplicationAsync(CancellationToken cancellationToken = default)
+        => await Delete(Constants.OAuthClientIds.Member, cancellationToken);
+}

src/Umbraco.Cms.Api.Delivery/Services/ApiAccessService.cs

@@ -1,4 +1,4 @@
-using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Http;
 using Microsoft.Extensions.Options;
 using Umbraco.Cms.Core.Configuration.Models;
 using Umbraco.Cms.Core.DeliveryApi;
@@ -23,8 +23,13 @@ internal sealed class ApiAccessService : RequestHeaderHandler, IApiAccessService
     /// <inheritdoc />
     public bool HasPreviewAccess() => IfEnabled(HasValidApiKey);
 
+    /// <inheritdoc />
+    public bool HasMediaAccess() => IfMediaEnabled(() => _deliveryApiSettings is { PublicAccess: true, Media.PublicAccess: true } || HasValidApiKey());
+
     private bool IfEnabled(Func<bool> condition) => _deliveryApiSettings.Enabled && condition();
 
     private bool HasValidApiKey() => _deliveryApiSettings.ApiKey.IsNullOrWhiteSpace() == false
-                                     && _deliveryApiSettings.ApiKey.Equals(GetHeaderValue("Api-Key"));
+                                     && _deliveryApiSettings.ApiKey.Equals(GetHeaderValue(Core.Constants.DeliveryApi.HeaderNames.ApiKey));
+
+    private bool IfMediaEnabled(Func<bool> condition) => _deliveryApiSettings is { Enabled: true, Media.Enabled: true } && condition();
 }

src/Umbraco.Cms.Api.Delivery/Services/ApiContentQueryProvider.cs

@@ -0,0 +1,105 @@
+using Examine;
+using Examine.Search;
+using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Options;
+using Umbraco.Cms.Api.Delivery.Services.QueryBuilders;
+using Umbraco.Cms.Core;
+using Umbraco.Cms.Core.Configuration.Models;
+using Umbraco.Cms.Core.DeliveryApi;
+using Umbraco.Cms.Core.Models;
+using Umbraco.Cms.Core.Models.DeliveryApi;
+using Umbraco.Cms.Infrastructure.Examine;
+
+namespace Umbraco.Cms.Api.Delivery.Services;
+
+/// <summary>
+/// This is the Examine implementation of content querying for the Delivery API.
+/// </summary>
+internal sealed class ApiContentQueryProvider : IApiContentQueryProvider
+{
+    private const string ItemIdFieldName = "itemId";
+    private readonly IExamineManager _examineManager;
+    private readonly ILogger<ApiContentQueryProvider> _logger;
+    private readonly ApiContentQuerySelectorBuilder _selectorBuilder;
+    private readonly ApiContentQueryFilterBuilder _filterBuilder;
+    private readonly ApiContentQuerySortBuilder _sortBuilder;
+
+    public ApiContentQueryProvider(
+        IExamineManager examineManager,
+        ContentIndexHandlerCollection indexHandlers,
+        IApiContentQueryFactory apiContentQueryFactory,
+        IOptions<DeliveryApiSettings> deliveryApiSettings,
+        ILogger<ApiContentQueryProvider> logger)
+    {
+        _examineManager = examineManager;
+        _logger = logger;
+
+        // build a look-up dictionary of field types by field name
+        var fieldTypes = indexHandlers
+            .SelectMany(handler => handler.GetFields())
+            .DistinctBy(field => field.FieldName)
+            .ToDictionary(field => field.FieldName, field => field.FieldType, StringComparer.InvariantCultureIgnoreCase);
+
+        // for the time being we're going to keep these as internal implementation details.
+        // perhaps later on it will make sense to expose them through the DI.
+        _selectorBuilder = new ApiContentQuerySelectorBuilder(deliveryApiSettings.Value, apiContentQueryFactory);
+        _filterBuilder = new ApiContentQueryFilterBuilder(fieldTypes, _logger);
+        _sortBuilder = new ApiContentQuerySortBuilder(fieldTypes, _logger);
+
+    }
+
+    [Obsolete($"Use the {nameof(ExecuteQuery)} method that accepts {nameof(ProtectedAccess)}. Will be removed in V14.")]
+    public PagedModel<Guid> ExecuteQuery(
+        SelectorOption selectorOption,
+        IList<FilterOption> filterOptions,
+        IList<SortOption> sortOptions,
+        string culture,
+        bool preview,
+        int skip,
+        int take)
+        => ExecuteQuery(selectorOption, filterOptions, sortOptions, culture, ProtectedAccess.None, preview, skip, take);
+
+    /// <inheritdoc/>
+    public PagedModel<Guid> ExecuteQuery(
+        SelectorOption selectorOption,
+        IList<FilterOption> filterOptions,
+        IList<SortOption> sortOptions,
+        string culture,
+        ProtectedAccess protectedAccess,
+        bool preview,
+        int skip,
+        int take)
+    {
+        if (!_examineManager.TryGetIndex(Constants.UmbracoIndexes.DeliveryApiContentIndexName, out IIndex? index))
+        {
+            _logger.LogError("Could not find the index {IndexName} when attempting to execute a query.", Constants.UmbracoIndexes.DeliveryApiContentIndexName);
+            return new PagedModel<Guid>();
+        }
+
+        IBooleanOperation queryOperation = _selectorBuilder.Build(selectorOption, index, culture, protectedAccess, preview);
+        _filterBuilder.Append(filterOptions, queryOperation);
+        _sortBuilder.Append(sortOptions, queryOperation);
+
+        ISearchResults? results = queryOperation
+            .SelectField(ItemIdFieldName)
+            .Execute(QueryOptions.SkipTake(skip, take));
+
+        if (results is null)
+        {
+            // The query yield no results
+            return new PagedModel<Guid>();
+        }
+
+        Guid[] items = results
+            .Where(r => r.Values.ContainsKey(ItemIdFieldName))
+            .Select(r => Guid.Parse(r.Values[ItemIdFieldName]))
+            .ToArray();
+
+        return new PagedModel<Guid>(results.TotalItemCount, items);
+    }
+
+    public SelectorOption AllContentSelectorOption() => new()
+    {
+        FieldName = UmbracoExamineFieldNames.CategoryFieldName, Values = new[] { "content" }
+    };
+}

src/Umbraco.Cms.Api.Delivery/Services/ApiContentQueryService.cs

@@ -1,256 +1,135 @@
-using Examine;
-using Examine.Search;
-using Microsoft.Extensions.Logging;
 using Umbraco.Cms.Api.Delivery.Indexing.Selectors;
 using Umbraco.Cms.Core;
 using Umbraco.Cms.Core.DeliveryApi;
+using Umbraco.Cms.Core.Models;
+using Umbraco.Cms.Core.Models.DeliveryApi;
 using Umbraco.Cms.Core.Models.PublishedContent;
 using Umbraco.Cms.Core.Services.OperationStatus;
-using Umbraco.Cms.Infrastructure.Examine;
 using Umbraco.Extensions;
-using Umbraco.New.Cms.Core.Models;
 
 namespace Umbraco.Cms.Api.Delivery.Services;
 
 internal sealed class ApiContentQueryService : IApiContentQueryService
 {
-    private const string ItemIdFieldName = "itemId";
-    private readonly IExamineManager _examineManager;
     private readonly IRequestStartItemProviderAccessor _requestStartItemProviderAccessor;
     private readonly SelectorHandlerCollection _selectorHandlers;
     private readonly FilterHandlerCollection _filterHandlers;
     private readonly SortHandlerCollection _sortHandlers;
     private readonly IVariationContextAccessor _variationContextAccessor;
-    private readonly ILogger<ApiContentQueryService> _logger;
-    private readonly string _fallbackGuidValue;
-    private readonly Dictionary<string, FieldType> _fieldTypes;
+    private readonly IApiContentQueryProvider _apiContentQueryProvider;
+    private readonly IRequestPreviewService _requestPreviewService;
 
     public ApiContentQueryService(
-        IExamineManager examineManager,
         IRequestStartItemProviderAccessor requestStartItemProviderAccessor,
         SelectorHandlerCollection selectorHandlers,
         FilterHandlerCollection filterHandlers,
         SortHandlerCollection sortHandlers,
-        ContentIndexHandlerCollection indexHandlers,
-        ILogger<ApiContentQueryService> logger,
-        IVariationContextAccessor variationContextAccessor)
+        IVariationContextAccessor variationContextAccessor,
+        IApiContentQueryProvider apiContentQueryProvider,
+        IRequestPreviewService requestPreviewService)
     {
-        _examineManager = examineManager;
         _requestStartItemProviderAccessor = requestStartItemProviderAccessor;
         _selectorHandlers = selectorHandlers;
         _filterHandlers = filterHandlers;
         _sortHandlers = sortHandlers;
         _variationContextAccessor = variationContextAccessor;
-        _logger = logger;
-
-        // A fallback value is needed for Examine queries in case we don't have a value - we can't pass null or empty string
-        // It is set to a random guid since this would be highly unlikely to yield any results
-        _fallbackGuidValue = Guid.NewGuid().ToString("D");
-
-        // build a look-up dictionary of field types by field name
-        _fieldTypes = indexHandlers
-            .SelectMany(handler => handler.GetFields())
-            .DistinctBy(field => field.FieldName)
-            .ToDictionary(field => field.FieldName, field => field.FieldType, StringComparer.InvariantCultureIgnoreCase);
+        _apiContentQueryProvider = apiContentQueryProvider;
+        _requestPreviewService = requestPreviewService;
     }
 
+    [Obsolete($"Use the {nameof(ExecuteQuery)} method that accepts {nameof(ProtectedAccess)}. Will be removed in V14.")]
+    public Attempt<PagedModel<Guid>, ApiContentQueryOperationStatus> ExecuteQuery(
+        string? fetch,
+        IEnumerable<string> filters,
+        IEnumerable<string> sorts,
+        int skip,
+        int take)
+        => ExecuteQuery(fetch, filters, sorts, ProtectedAccess.None, skip, take);
+
     /// <inheritdoc/>
-    public Attempt<PagedModel<Guid>, ApiContentQueryOperationStatus> ExecuteQuery(string? fetch, IEnumerable<string> filters, IEnumerable<string> sorts, int skip, int take)
+    public Attempt<PagedModel<Guid>, ApiContentQueryOperationStatus> ExecuteQuery(
+        string? fetch,
+        IEnumerable<string> filters,
+        IEnumerable<string> sorts,
+        ProtectedAccess protectedAccess,
+        int skip,
+        int take)
     {
         var emptyResult = new PagedModel<Guid>();
 
-        if (!_examineManager.TryGetIndex(Constants.UmbracoIndexes.DeliveryApiContentIndexName, out IIndex? apiIndex))
-        {
-            return Attempt.FailWithStatus(ApiContentQueryOperationStatus.IndexNotFound, emptyResult);
-        }
-
-        IQuery baseQuery = apiIndex.Searcher.CreateQuery();
-
-        // Handle Selecting
-        IBooleanOperation? queryOperation = HandleSelector(fetch, baseQuery);
-
-        // If no Selector could be found, we return no results
-        if (queryOperation is null)
+        SelectorOption? selectorOption = GetSelectorOption(fetch);
+        if (selectorOption is null)
         {
+            // If no Selector could be found, we return no results
             return Attempt.FailWithStatus(ApiContentQueryOperationStatus.SelectorOptionNotFound, emptyResult);
         }
 
-        // Item culture must be either the requested culture or "none"
-        var culture = CurrentCulture();
-        queryOperation.And().GroupedOr(new[] { UmbracoExamineFieldNames.DeliveryApiContentIndex.Culture }, culture.ToLowerInvariant().IfNullOrWhiteSpace(_fallbackGuidValue), "none");
-
-        // Handle Filtering
-        var canApplyFiltering = CanHandleFiltering(filters, queryOperation);
-
-        // If there is an invalid Filter option, we return no results
-        if (canApplyFiltering is false)
+        var filterOptions = new List<FilterOption>();
+        foreach (var filter in filters.Where(filter => filter.IsNullOrWhiteSpace() is false))
         {
-            return Attempt.FailWithStatus(ApiContentQueryOperationStatus.FilterOptionNotFound, emptyResult);
+            FilterOption? filterOption = GetFilterOption(filter);
+            if (filterOption is null)
+            {
+                // If there is an invalid Filter option, we return no results
+                return Attempt.FailWithStatus(ApiContentQueryOperationStatus.FilterOptionNotFound, emptyResult);
+            }
+
+            filterOptions.Add(filterOption);
         }
 
-        // Handle Sorting
-        IOrdering? sortQuery = HandleSorting(sorts, queryOperation);
-
-        // If there is an invalid Sort option, we return no results
-        if (sortQuery is null)
+        var sortOptions = new List<SortOption>();
+        foreach (var sort in sorts.Where(sort => sort.IsNullOrWhiteSpace() is false))
         {
-            return Attempt.FailWithStatus(ApiContentQueryOperationStatus.SortOptionNotFound, emptyResult);
+            SortOption? sortOption = GetSortOption(sort);
+            if (sortOption is null)
+            {
+                // If there is an invalid Sort option, we return no results
+                return Attempt.FailWithStatus(ApiContentQueryOperationStatus.SortOptionNotFound, emptyResult);
+            }
+
+            sortOptions.Add(sortOption);
         }
 
-        ISearchResults? results = sortQuery
-            .SelectField(ItemIdFieldName)
-            .Execute(QueryOptions.SkipTake(skip, take));
+        var culture = _variationContextAccessor.VariationContext?.Culture ?? string.Empty;
+        var isPreview = _requestPreviewService.IsPreview();
 
-        if (results is null)
-        {
-            // The query yield no results
-            return Attempt.SucceedWithStatus(ApiContentQueryOperationStatus.Success, emptyResult);
-        }
-
-        Guid[] items = results
-            .Where(r => r.Values.ContainsKey(ItemIdFieldName))
-            .Select(r => Guid.Parse(r.Values[ItemIdFieldName]))
-            .ToArray();
-
-        return Attempt.SucceedWithStatus(ApiContentQueryOperationStatus.Success, new PagedModel<Guid>(results.TotalItemCount, items));
+        PagedModel<Guid> result = _apiContentQueryProvider.ExecuteQuery(selectorOption, filterOptions, sortOptions, culture, protectedAccess, isPreview, skip, take);
+        return Attempt.SucceedWithStatus(ApiContentQueryOperationStatus.Success, result);
     }
 
-    private IBooleanOperation? HandleSelector(string? fetch, IQuery baseQuery)
+    private SelectorOption? GetSelectorOption(string? fetch)
     {
-        string? fieldName = null;
-        string[] fieldValues = Array.Empty<string>();
-
         if (fetch is not null)
         {
             ISelectorHandler? selectorHandler = _selectorHandlers.FirstOrDefault(h => h.CanHandle(fetch));
-            SelectorOption? selector = selectorHandler?.BuildSelectorOption(fetch);
-
-            if (selector is null)
-            {
-                return null;
-            }
-
-            fieldName = selector.FieldName;
-            fieldValues = selector.Values.Any()
-                ? selector.Values
-                : new[] { _fallbackGuidValue };
+            return selectorHandler?.BuildSelectorOption(fetch);
         }
 
-        // Take into account the "start-item" header if present, as it defines a starting root node to query from
-        if (fieldName is null && _requestStartItemProviderAccessor.TryGetValue(out IRequestStartItemProvider? requestStartItemProvider))
+        if (_requestStartItemProviderAccessor.TryGetValue(out IRequestStartItemProvider? requestStartItemProvider))
         {
             IPublishedContent? startItem = requestStartItemProvider.GetStartItem();
             if (startItem is not null)
             {
                 // Reusing the boolean operation of the "Descendants" selector, as we want to get all the nodes from the given starting point
-                fieldName = DescendantsSelectorIndexer.FieldName;
-                fieldValues = new [] { startItem.Key.ToString() };
+                return new SelectorOption
+                {
+                    FieldName = DescendantsSelectorIndexer.FieldName, Values = new[] { startItem.Key.ToString() }
+                };
             }
         }
 
-        // If no params or no fetch value, get everything from the index - this is a way to do that with Examine
-        fieldName ??= UmbracoExamineFieldNames.CategoryFieldName;
-        fieldValues = fieldValues.Any() ? fieldValues : new [] { "content" };
-
-        return fieldValues.Length == 1
-            ? baseQuery.Field(fieldName, fieldValues.First())
-            : baseQuery.GroupedOr(new[] { fieldName }, fieldValues);
+        return _apiContentQueryProvider.AllContentSelectorOption();
     }
 
-    private bool CanHandleFiltering(IEnumerable<string> filters, IBooleanOperation queryOperation)
+    private FilterOption? GetFilterOption(string filter)
     {
-        void HandleExact(IQuery query, string fieldName, string[] values)
-        {
-            if (values.Length == 1)
-            {
-                query.Field(fieldName, values[0]);
-            }
-            else
-            {
-                query.GroupedOr(new[] { fieldName }, values);
-            }
-        }
-
-        foreach (var filterValue in filters)
-        {
-            IFilterHandler? filterHandler = _filterHandlers.FirstOrDefault(h => h.CanHandle(filterValue));
-            FilterOption? filter = filterHandler?.BuildFilterOption(filterValue);
-
-            if (filter is null)
-            {
-                return false;
-            }
-
-            var values = filter.Values.Any()
-                ? filter.Values
-                : new[] { _fallbackGuidValue };
-
-            switch (filter.Operator)
-            {
-                case FilterOperation.Is:
-                    // TODO: test this for explicit word matching
-                    HandleExact(queryOperation.And(), filter.FieldName, values);
-                    break;
-                case FilterOperation.IsNot:
-                    // TODO: test this for explicit word matching
-                    HandleExact(queryOperation.Not(), filter.FieldName, values);
-                    break;
-                // TODO: Fix
-                case FilterOperation.Contains:
-                    break;
-                // TODO: Fix
-                case FilterOperation.DoesNotContain:
-                    break;
-                default:
-                    continue;
-            }
-        }
-
-        return true;
+        IFilterHandler? filterHandler = _filterHandlers.FirstOrDefault(h => h.CanHandle(filter));
+        return filterHandler?.BuildFilterOption(filter);
     }
 
-    private IOrdering? HandleSorting(IEnumerable<string> sorts, IBooleanOperation queryCriteria)
+    private SortOption? GetSortOption(string sort)
     {
-        IOrdering? orderingQuery = null;
-
-        foreach (var sortValue in sorts)
-        {
-            ISortHandler? sortHandler = _sortHandlers.FirstOrDefault(h => h.CanHandle(sortValue));
-            SortOption? sort = sortHandler?.BuildSortOption(sortValue);
-
-            if (sort is null)
-            {
-                return null;
-            }
-
-            if (_fieldTypes.TryGetValue(sort.FieldName, out FieldType fieldType) is false)
-            {
-                _logger.LogWarning("Sort implementation for field name {FieldName} does not match an index handler implementation, cannot resolve field type.", sort.FieldName);
-                continue;
-            }
-
-            SortType sortType = fieldType switch
-            {
-                FieldType.Number => SortType.Int,
-                FieldType.Date => SortType.Long,
-                FieldType.StringRaw => SortType.String,
-                FieldType.StringAnalyzed => SortType.String,
-                FieldType.StringSortable => SortType.String,
-                _ => throw new ArgumentOutOfRangeException(nameof(fieldType))
-            };
-
-            orderingQuery = sort.Direction switch
-            {
-                Direction.Ascending => queryCriteria.OrderBy(new SortableField(sort.FieldName, sortType)),
-                Direction.Descending => queryCriteria.OrderByDescending(new SortableField(sort.FieldName, sortType)),
-                _ => orderingQuery
-            };
-        }
-
-        // Keep the index sorting as default
-        return orderingQuery ?? queryCriteria.OrderBy();
+        ISortHandler? sortHandler = _sortHandlers.FirstOrDefault(h => h.CanHandle(sort));
+        return sortHandler?.BuildSortOption(sort);
     }
-
-    private string CurrentCulture()
-        => _variationContextAccessor.VariationContext?.Culture ?? string.Empty;
 }

src/Umbraco.Cms.Api.Delivery/Services/ApiMediaQueryService.cs

@@ -0,0 +1,191 @@
+using Microsoft.Extensions.Logging;
+using Umbraco.Cms.Core;
+using Umbraco.Cms.Core.DeliveryApi;
+using Umbraco.Cms.Core.Models;
+using Umbraco.Cms.Core.Models.PublishedContent;
+using Umbraco.Cms.Core.PublishedCache;
+using Umbraco.Cms.Core.Services.OperationStatus;
+using Umbraco.Extensions;
+
+namespace Umbraco.Cms.Api.Delivery.Services;
+
+/// <inheritdoc />
+internal sealed class ApiMediaQueryService : IApiMediaQueryService
+{
+    private readonly IPublishedSnapshotAccessor _publishedSnapshotAccessor;
+    private readonly ILogger<ApiMediaQueryService> _logger;
+
+    public ApiMediaQueryService(IPublishedSnapshotAccessor publishedSnapshotAccessor, ILogger<ApiMediaQueryService> logger)
+    {
+        _publishedSnapshotAccessor = publishedSnapshotAccessor;
+        _logger = logger;
+    }
+
+    /// <inheritdoc/>
+    public Attempt<PagedModel<Guid>, ApiMediaQueryOperationStatus> ExecuteQuery(string? fetch, IEnumerable<string> filters, IEnumerable<string> sorts, int skip, int take)
+    {
+        var emptyResult = new PagedModel<Guid>();
+
+        IEnumerable<IPublishedContent>? source = GetSource(fetch);
+        if (source is null)
+        {
+            return Attempt.FailWithStatus(ApiMediaQueryOperationStatus.SelectorOptionNotFound, emptyResult);
+        }
+
+        source = ApplyFilters(source, filters);
+        if (source is null)
+        {
+            return Attempt.FailWithStatus(ApiMediaQueryOperationStatus.FilterOptionNotFound, emptyResult);
+        }
+
+        source = ApplySorts(source, sorts);
+        if (source is null)
+        {
+            return Attempt.FailWithStatus(ApiMediaQueryOperationStatus.SortOptionNotFound, emptyResult);
+        }
+
+        return PagedResult(source, skip, take);
+    }
+
+    /// <inheritdoc/>
+    public IPublishedContent? GetByPath(string path)
+        => TryGetByPath(path, GetRequiredPublishedMediaCache());
+
+    private IPublishedMediaCache GetRequiredPublishedMediaCache()
+        => _publishedSnapshotAccessor.GetRequiredPublishedSnapshot().Media
+           ?? throw new InvalidOperationException("Could not obtain the published media cache");
+
+    private IPublishedContent? TryGetByPath(string path, IPublishedMediaCache mediaCache)
+    {
+        var segments = path.Split(Constants.CharArrays.ForwardSlash, StringSplitOptions.RemoveEmptyEntries);
+        IEnumerable<IPublishedContent> currentChildren = mediaCache.GetAtRoot();
+        IPublishedContent? resolvedMedia = null;
+
+        foreach (var segment in segments)
+        {
+            resolvedMedia = currentChildren.FirstOrDefault(c => segment.InvariantEquals(c.Name));
+            if (resolvedMedia is null)
+            {
+                break;
+            }
+
+            currentChildren = resolvedMedia.Children;
+        }
+
+        return resolvedMedia;
+    }
+
+    private IEnumerable<IPublishedContent>? GetSource(string? fetch)
+    {
+        const string childrenOfParameter = "children:";
+
+        if (fetch?.StartsWith(childrenOfParameter, StringComparison.OrdinalIgnoreCase) is not true)
+        {
+            _logger.LogInformation($"The current implementation of {nameof(IApiMediaQueryService)} expects \"{childrenOfParameter}[id/path]\" in the \"{nameof(fetch)}\" query option");
+            return null;
+        }
+
+        var childrenOf = fetch.TrimStart(childrenOfParameter);
+        if (childrenOf.IsNullOrWhiteSpace())
+        {
+            // this mirrors the current behavior of the Content Delivery API :-)
+            return Array.Empty<IPublishedContent>();
+        }
+
+        IPublishedMediaCache mediaCache = GetRequiredPublishedMediaCache();
+        if (childrenOf.Trim(Constants.CharArrays.ForwardSlash).Length == 0)
+        {
+            return mediaCache.GetAtRoot();
+        }
+
+        IPublishedContent? parent = Guid.TryParse(childrenOf, out Guid parentKey)
+            ? mediaCache.GetById(parentKey)
+            : TryGetByPath(childrenOf, mediaCache);
+
+        return parent?.Children ?? Array.Empty<IPublishedContent>();
+    }
+
+    private IEnumerable<IPublishedContent>? ApplyFilters(IEnumerable<IPublishedContent> source, IEnumerable<string> filters)
+    {
+        foreach (var filter in filters)
+        {
+            var parts = filter.Split(':');
+            if (parts.Length != 2)
+            {
+                // invalid filter
+                _logger.LogInformation("An invalid filter option was encountered. Please ensure that supplied filter options are two-part, separated by ':'.");
+                return null;
+            }
+
+            switch (parts[0])
+            {
+                case "mediaType":
+                    source = source.Where(c => c.ContentType.Alias == parts[1]);
+                    break;
+                case "name":
+                    source = source.Where(c => c.Name.InvariantContains(parts[1]));
+                    break;
+                default:
+                    // unknown filter
+                    _logger.LogInformation("An unsupported filter option was supplied for the query. Please use only valid filter options. See the documentation for details.");
+                    return null;
+            }
+        }
+
+        return source;
+    }
+
+    private IEnumerable<IPublishedContent>? ApplySorts(IEnumerable<IPublishedContent> source, IEnumerable<string> sorts)
+    {
+        foreach (var sort in sorts)
+        {
+            var parts = sort.Split(':');
+            if (parts.Length != 2)
+            {
+                // invalid sort
+                _logger.LogInformation("An invalid sort option was encountered. Please ensure that the supplied sort options are two-part, separated by ':'.");
+                return null;
+            }
+
+            Func<IPublishedContent, object> keySelector;
+            switch (parts[0])
+            {
+                case "createDate":
+                    keySelector = content => content.CreateDate;
+                    break;
+                case "updateDate":
+                    keySelector = content => content.UpdateDate;
+                    break;
+                case "name":
+                    keySelector = content => content.Name.ToLowerInvariant();
+                    break;
+                case "sortOrder":
+                    keySelector = content => content.SortOrder;
+                    break;
+                default:
+                    // unknown sort
+                    _logger.LogInformation("An unsupported sort option was supplied for the query. Please use only valid sort options. See the documentation for details.");
+                    return null;
+            }
+
+            source = parts[1].StartsWith("asc")
+                ? source.OrderBy(keySelector)
+                : source.OrderByDescending(keySelector);
+        }
+
+        return source;
+    }
+
+
+    private Attempt<PagedModel<Guid>, ApiMediaQueryOperationStatus> PagedResult(IEnumerable<IPublishedContent> children, int skip, int take)
+    {
+        IPublishedContent[] childrenAsArray = children as IPublishedContent[] ?? children.ToArray();
+        var result = new PagedModel<Guid>
+        {
+            Total = childrenAsArray.Length,
+            Items = childrenAsArray.Skip(skip).Take(take).Select(child => child.Key)
+        };
+
+        return Attempt.SucceedWithStatus(ApiMediaQueryOperationStatus.Success, result);
+    }
+}

src/Umbraco.Cms.Api.Delivery/Services/CurrentMemberClaimsProvider.cs

@@ -0,0 +1,44 @@
+using OpenIddict.Abstractions;
+using Umbraco.Cms.Core.DeliveryApi;
+using Umbraco.Cms.Core.Security;
+
+namespace Umbraco.Cms.Api.Delivery.Services;
+
+// NOTE: this is public and unsealed to allow overriding the default claims with minimal effort.
+public class CurrentMemberClaimsProvider : ICurrentMemberClaimsProvider
+{
+    private readonly IMemberManager _memberManager;
+
+    public CurrentMemberClaimsProvider(IMemberManager memberManager)
+        => _memberManager = memberManager;
+
+    public virtual async Task<Dictionary<string, object>> GetClaimsAsync()
+    {
+        MemberIdentityUser? memberIdentityUser = await _memberManager.GetCurrentMemberAsync();
+        return memberIdentityUser is not null
+            ? await GetClaimsForMemberIdentityAsync(memberIdentityUser)
+            : throw new InvalidOperationException("Could not retrieve the current member. This method should only ever be invoked when a member has been authorized.");
+    }
+
+    protected virtual async Task<Dictionary<string, object>> GetClaimsForMemberIdentityAsync(MemberIdentityUser memberIdentityUser)
+    {
+        var claims = new Dictionary<string, object>
+        {
+            [OpenIddictConstants.Claims.Subject] = memberIdentityUser.Key
+        };
+
+        if (memberIdentityUser.Name is not null)
+        {
+            claims[OpenIddictConstants.Claims.Name] = memberIdentityUser.Name;
+        }
+
+        if (memberIdentityUser.Email is not null)
+        {
+            claims[OpenIddictConstants.Claims.Email] = memberIdentityUser.Email;
+        }
+
+        claims[OpenIddictConstants.Claims.Role] = await _memberManager.GetRolesAsync(memberIdentityUser);
+
+        return claims;
+    }
+}

src/Umbraco.Cms.Api.Delivery/Services/QueryBuilders/ApiContentQueryFactory.cs

@@ -0,0 +1,26 @@
+using Examine;
+using Examine.Lucene.Providers;
+using Examine.Lucene.Search;
+using Examine.Search;
+using Umbraco.Cms.Infrastructure.Examine;
+
+namespace Umbraco.Cms.Api.Delivery.Services.QueryBuilders
+{
+    internal sealed class ApiContentQueryFactory : IApiContentQueryFactory
+    {
+        /// <inheritdoc/>
+        public IQuery CreateApiContentQuery(IIndex index)
+        {
+            // Needed for enabling leading wildcards searches
+            BaseLuceneSearcher searcher = index.Searcher as BaseLuceneSearcher ?? throw new InvalidOperationException($"Index searcher must be of type {nameof(BaseLuceneSearcher)}.");
+
+            IQuery query = searcher.CreateQuery(
+                IndexTypes.Content,
+                BooleanOperation.And,
+                searcher.LuceneAnalyzer,
+                new LuceneSearchOptions { AllowLeadingWildcard = true });
+
+            return query;
+        }
+    }
+}

src/Umbraco.Cms.Api.Delivery/Services/QueryBuilders/ApiContentQueryFilterBuilder.cs

@@ -0,0 +1,244 @@
+using Examine.Search;
+using Microsoft.Extensions.Logging;
+using Umbraco.Cms.Core.DeliveryApi;
+
+namespace Umbraco.Cms.Api.Delivery.Services.QueryBuilders;
+
+internal sealed class ApiContentQueryFilterBuilder
+{
+    private readonly IDictionary<string, FieldType> _fieldTypes;
+    private readonly ILogger _logger;
+    private readonly string _fallbackGuidValue;
+
+    public ApiContentQueryFilterBuilder(IDictionary<string, FieldType> fieldTypes, ILogger logger)
+    {
+        _fieldTypes = fieldTypes;
+        _logger = logger;
+
+        // A fallback value is needed for Examine queries in case we don't have a value - we can't pass null or empty string
+        // It is set to a random guid since this would be highly unlikely to yield any results
+        _fallbackGuidValue = Guid.NewGuid().ToString("D");
+    }
+
+    public void Append(IList<FilterOption> filterOptions, IBooleanOperation queryOperation)
+    {
+        foreach (FilterOption filterOption in filterOptions)
+        {
+            if (_fieldTypes.TryGetValue(filterOption.FieldName, out FieldType fieldType) is false)
+            {
+                _logger.LogWarning(
+                    "Filter implementation for field name {FieldName} does not match an index handler implementation, cannot resolve field type.",
+                    filterOption.FieldName);
+                continue;
+            }
+
+            var values = filterOption.Values.Any()
+                ? filterOption.Values
+                : new[] { _fallbackGuidValue };
+
+            switch (filterOption.Operator)
+            {
+                case FilterOperation.Is:
+                    ApplyExactFilter(queryOperation.And(), filterOption.FieldName, values, fieldType);
+                    break;
+                case FilterOperation.IsNot:
+                    ApplyExactFilter(queryOperation.Not(), filterOption.FieldName, values, fieldType);
+                    break;
+                case FilterOperation.Contains:
+                    ApplyContainsFilter(queryOperation.And(), filterOption.FieldName, values);
+                    break;
+                case FilterOperation.DoesNotContain:
+                    ApplyContainsFilter(queryOperation.Not(), filterOption.FieldName, values);
+                    break;
+                case FilterOperation.LessThan:
+                case FilterOperation.LessThanOrEqual:
+                case FilterOperation.GreaterThan:
+                case FilterOperation.GreaterThanOrEqual:
+                    ApplyRangeFilter(queryOperation.And(), filterOption.FieldName, values, fieldType, filterOption.Operator);
+                    break;
+                default:
+                    continue;
+            }
+        }
+    }
+
+    private void ApplyExactFilter(IQuery query, string fieldName, string[] values, FieldType fieldType)
+    {
+        switch (fieldType)
+        {
+            case FieldType.Number:
+                ApplyExactNumberFilter(query, fieldName, values);
+                break;
+            case FieldType.Date:
+                ApplyExactDateFilter(query, fieldName, values);
+                break;
+            default:
+                ApplyExactStringFilter(query, fieldName, values);
+                break;
+        }
+    }
+
+    private void ApplyExactNumberFilter(IQuery query, string fieldName, string[] values)
+    {
+        if (values.Length == 1)
+        {
+            if (TryParseIntFilterValue(values.First(), out int intValue))
+            {
+                query.Field(fieldName, intValue);
+            }
+        }
+        else
+        {
+            int[] intValues = values
+                .Select(value => TryParseIntFilterValue(value, out int intValue) ? intValue : (int?)null)
+                .Where(intValue => intValue.HasValue)
+                .Select(intValue => intValue!.Value)
+                .ToArray();
+
+            AddGroupedOrFilter(query, fieldName, intValues);
+        }
+    }
+
+    private void ApplyExactDateFilter(IQuery query, string fieldName, string[] values)
+    {
+        if (values.Length == 1)
+        {
+            if (TryParseDateTimeFilterValue(values.First(), out DateTime dateValue))
+            {
+                query.Field(fieldName, dateValue);
+            }
+        }
+        else
+        {
+            DateTime[] dateValues = values
+                .Select(value => TryParseDateTimeFilterValue(value, out DateTime dateValue) ? dateValue : (DateTime?)null)
+                .Where(dateValue => dateValue.HasValue)
+                .Select(dateValue => dateValue!.Value)
+                .ToArray();
+
+            AddGroupedOrFilter(query, fieldName, dateValues);
+        }
+    }
+
+    private void ApplyExactStringFilter(IQuery query, string fieldName, string[] values)
+    {
+        if (values.Length == 1)
+        {
+            query.Field(fieldName, values.First());
+        }
+        else
+        {
+            AddGroupedOrFilter(query, fieldName, values);
+        }
+    }
+
+    private void ApplyContainsFilter(IQuery query, string fieldName, string[] values)
+    {
+        if (values.Length == 1)
+        {
+            // The trailing wildcard is added automatically
+            query.Field(fieldName, (IExamineValue)new ExamineValue(Examineness.ComplexWildcard, $"*{values[0]}"));
+        }
+        else
+        {
+            // The trailing wildcard is added automatically
+            IExamineValue[] examineValues = values
+                .Select(value => (IExamineValue)new ExamineValue(Examineness.ComplexWildcard, $"*{value}"))
+                .ToArray();
+            query.GroupedOr(new[] { fieldName }, examineValues);
+        }
+    }
+
+    private void ApplyRangeFilter(IQuery query, string fieldName, string[] values, FieldType fieldType, FilterOperation filterOperation)
+    {
+        switch (fieldType)
+        {
+            case FieldType.Number:
+                ApplyRangeNumberFilter(query, fieldName, values, filterOperation);
+                break;
+            case FieldType.Date:
+                ApplyRangeDateFilter(query, fieldName, values, filterOperation);
+                break;
+            default:
+                _logger.LogWarning("Range filtering cannot be used with String fields. Only Number and Date fields support range filtering.");
+                break;
+        }
+    }
+
+    private void ApplyRangeNumberFilter(IQuery query, string fieldName, string[] values, FilterOperation filterOperation)
+    {
+        if (TryParseIntFilterValue(values.First(), out int intValue) is false)
+        {
+            return;
+        }
+
+        AddRangeFilter(query, fieldName, intValue, filterOperation);
+    }
+
+    private void ApplyRangeDateFilter(IQuery query, string fieldName, string[] values, FilterOperation filterOperation)
+    {
+        if (TryParseDateTimeFilterValue(values.First(), out DateTime dateValue) is false)
+        {
+            return;
+        }
+
+        AddRangeFilter(query, fieldName, dateValue, filterOperation);
+    }
+
+    private void AddRangeFilter<T>(IQuery query, string fieldName, T value, FilterOperation filterOperation)
+        where T : struct
+    {
+        T? min = null, max = null;
+        bool minInclusive = false, maxInclusive = false;
+
+        switch (filterOperation)
+        {
+            case FilterOperation.GreaterThan:
+            case FilterOperation.GreaterThanOrEqual:
+                min = value;
+                minInclusive = filterOperation is FilterOperation.GreaterThanOrEqual;
+                break;
+            case FilterOperation.LessThan:
+            case FilterOperation.LessThanOrEqual:
+                max = value;
+                maxInclusive = filterOperation is FilterOperation.LessThanOrEqual;
+                break;
+            default:
+                throw new ArgumentOutOfRangeException(nameof(filterOperation));
+        }
+
+        query.RangeQuery(new[] { fieldName }, min, max, minInclusive, maxInclusive);
+    }
+
+    private void AddGroupedOrFilter<T>(IQuery query, string fieldName, params T[] values)
+        where T : struct
+    {
+        if (values.Length == 0)
+        {
+            return;
+        }
+
+        var fields = new[] { fieldName };
+        query.Group(
+            nestedQuery =>
+            {
+                INestedBooleanOperation nestedQueryOperation =
+                    nestedQuery.RangeQuery<T>(fields, values[0], values[0]);
+                foreach (T value in values.Skip(1))
+                {
+                    nestedQueryOperation = nestedQueryOperation.Or().RangeQuery<T>(fields, value, value);
+                }
+
+                return nestedQueryOperation;
+            });
+    }
+
+    private void AddGroupedOrFilter(IQuery query, string fieldName, params string[] values)
+        => query.GroupedOr(new[] { fieldName }, values);
+
+    private bool TryParseIntFilterValue(string value, out int intValue)
+        => int.TryParse(value, out intValue);
+
+    private bool TryParseDateTimeFilterValue(string value, out DateTime dateValue)
+        => DateTime.TryParse(value, out dateValue);
+}

src/Umbraco.Cms.Api.Delivery/Services/QueryBuilders/ApiContentQuerySelectorBuilder.cs

@@ -0,0 +1,91 @@
+using Examine;
+using Examine.Search;
+using Umbraco.Cms.Core.Configuration.Models;
+using Umbraco.Cms.Core.DeliveryApi;
+using Umbraco.Cms.Core.Models.DeliveryApi;
+using Umbraco.Cms.Infrastructure.Examine;
+using Umbraco.Extensions;
+
+namespace Umbraco.Cms.Api.Delivery.Services.QueryBuilders;
+
+internal sealed class ApiContentQuerySelectorBuilder
+{
+    private readonly DeliveryApiSettings _deliveryApiSettings;
+    private readonly IApiContentQueryFactory _queryFactory;
+    private readonly string _fallbackGuidValue;
+
+    public ApiContentQuerySelectorBuilder(
+        DeliveryApiSettings deliveryApiSettings,
+        IApiContentQueryFactory queryFactory)
+    {
+        _deliveryApiSettings = deliveryApiSettings;
+        _queryFactory = queryFactory;
+
+        // A fallback value is needed for Examine queries in case we don't have a value - we can't pass null or empty string
+        // It is set to a random guid since this would be highly unlikely to yield any results
+        _fallbackGuidValue = Guid.NewGuid().ToString("D");
+    }
+
+    public IBooleanOperation Build(SelectorOption selectorOption, IIndex index, string culture, ProtectedAccess protectedAccess, bool preview)
+    {
+        IQuery query = _queryFactory.CreateApiContentQuery(index);
+
+        IBooleanOperation selectorOperation = selectorOption.Values.Length == 1
+            ? query.Field(selectorOption.FieldName, selectorOption.Values.First())
+            : query.GroupedOr(new[] { selectorOption.FieldName }, selectorOption.Values);
+
+        AddCultureQuery(culture, selectorOperation);
+
+        if (_deliveryApiSettings.MemberAuthorizationIsEnabled())
+        {
+            AddProtectedAccessQuery(protectedAccess, selectorOperation);
+        }
+
+        // when not fetching for preview, make sure the "published" field is "y"
+        if (preview is false)
+        {
+            selectorOperation.And().Field(UmbracoExamineFieldNames.DeliveryApiContentIndex.Published, "y");
+        }
+
+        return selectorOperation;
+    }
+
+    private void AddCultureQuery(string culture, IBooleanOperation selectorOperation) =>
+        selectorOperation
+            .And()
+            .GroupedOr(
+                // Item culture must be either the requested culture or "none"
+                new[] { UmbracoExamineFieldNames.DeliveryApiContentIndex.Culture },
+                culture.ToLowerInvariant().IfNullOrWhiteSpace(_fallbackGuidValue),
+                "none");
+
+    private void AddProtectedAccessQuery(ProtectedAccess protectedAccess, IBooleanOperation selectorOperation)
+    {
+        var protectedAccessValues = new List<string>();
+        if (protectedAccess.MemberKey is not null)
+        {
+            protectedAccessValues.Add($"u:{protectedAccess.MemberKey}");
+        }
+
+        if (protectedAccess.MemberRoles?.Any() is true)
+        {
+            protectedAccessValues.AddRange(protectedAccess.MemberRoles.Select(r => $"r:{r}"));
+        }
+
+        if (protectedAccessValues.Any())
+        {
+            selectorOperation.And(
+                inner => inner
+                    .Field(UmbracoExamineFieldNames.DeliveryApiContentIndex.Protected, "n")
+                    .Or(protectedAccessInner => protectedAccessInner
+                        .GroupedOr(
+                            new[] { UmbracoExamineFieldNames.DeliveryApiContentIndex.ProtectedAccess },
+                            protectedAccessValues.ToArray())),
+                BooleanOperation.Or);
+        }
+        else
+        {
+            selectorOperation.And().Field(UmbracoExamineFieldNames.DeliveryApiContentIndex.Protected, "n");
+        }
+    }
+}

src/Umbraco.Cms.Api.Delivery/Services/QueryBuilders/ApiContentQuerySortBuilder.cs

@@ -0,0 +1,49 @@
+using Examine.Search;
+using Microsoft.Extensions.Logging;
+using Umbraco.Cms.Core;
+using Umbraco.Cms.Core.DeliveryApi;
+
+namespace Umbraco.Cms.Api.Delivery.Services.QueryBuilders;
+
+internal sealed class ApiContentQuerySortBuilder
+{
+    private readonly Dictionary<string, FieldType> _fieldTypes;
+    private readonly ILogger _logger;
+
+    public ApiContentQuerySortBuilder(Dictionary<string, FieldType> fieldTypes, ILogger logger)
+    {
+        _fieldTypes = fieldTypes;
+        _logger = logger;
+    }
+
+    public void Append(IList<SortOption> sortOptions, IOrdering queryOperation)
+    {
+        foreach (SortOption sort in sortOptions)
+        {
+            if (_fieldTypes.TryGetValue(sort.FieldName, out FieldType fieldType) is false)
+            {
+                _logger.LogWarning(
+                    "Sort implementation for field name {FieldName} does not match an index handler implementation, cannot resolve field type.",
+                    sort.FieldName);
+                continue;
+            }
+
+            SortType sortType = fieldType switch
+            {
+                FieldType.Number => SortType.Int,
+                FieldType.Date => SortType.Long,
+                FieldType.StringRaw => SortType.String,
+                FieldType.StringAnalyzed => SortType.String,
+                FieldType.StringSortable => SortType.String,
+                _ => throw new ArgumentOutOfRangeException(nameof(fieldType))
+            };
+
+            queryOperation = sort.Direction switch
+            {
+                Direction.Ascending => queryOperation.OrderBy(new SortableField(sort.FieldName, sortType)),
+                Direction.Descending => queryOperation.OrderByDescending(new SortableField(sort.FieldName, sortType)),
+                _ => queryOperation
+            };
+        }
+    }
+}

src/Umbraco.Cms.Api.Delivery/Services/QueryBuilders/IApiContentQueryFactory.cs

@@ -0,0 +1,18 @@
+using Examine;
+using Examine.Search;
+
+namespace Umbraco.Cms.Api.Delivery.Services.QueryBuilders
+{
+    /// <summary>
+    /// Used to create an <see cref="IQuery"/> instance for content items for the content delivery api.
+    /// </summary>
+    public interface IApiContentQueryFactory
+    {
+        /// <summary>
+        /// Creates an <see cref="IQuery"/> for content items for the content delivery api.
+        /// </summary>
+        /// <param name="index">The <see cref="IIndex"/>.</param>
+        /// <returns>An <see cref="IQuery"/> instance.</returns>
+        IQuery CreateApiContentQuery(IIndex index);
+    }
+}

src/Umbraco.Cms.Api.Delivery/Services/RequestCultureService.cs

@@ -1,11 +1,12 @@
-using Microsoft.AspNetCore.Http;
+using System.Text.RegularExpressions;
+using Microsoft.AspNetCore.Http;
 using Microsoft.Net.Http.Headers;
 using Umbraco.Cms.Core.DeliveryApi;
 using Umbraco.Cms.Core.Models.PublishedContent;
 
 namespace Umbraco.Cms.Api.Delivery.Services;
 
-internal sealed class RequestCultureService : RequestHeaderHandler, IRequestCultureService
+internal sealed partial class RequestCultureService : RequestHeaderHandler, IRequestCultureService
 {
     private readonly IVariationContextAccessor _variationContextAccessor;
 
@@ -14,7 +15,11 @@ internal sealed class RequestCultureService : RequestHeaderHandler, IRequestCult
         _variationContextAccessor = variationContextAccessor;
 
     /// <inheritdoc />
-    public string? GetRequestedCulture() => GetHeaderValue(HeaderNames.AcceptLanguage);
+    public string? GetRequestedCulture()
+    {
+        var acceptLanguage = GetHeaderValue(HeaderNames.AcceptLanguage) ?? string.Empty;
+        return ValidLanguageHeaderRegex().IsMatch(acceptLanguage) ? acceptLanguage : null;
+    }
 
     /// <inheritdoc />
     public void SetRequestCulture(string culture)
@@ -26,4 +31,9 @@ internal sealed class RequestCultureService : RequestHeaderHandler, IRequestCult
 
         _variationContextAccessor.VariationContext = new VariationContext(culture);
     }
+
+    // at the time of writing we're introducing this to get rid of accept-language header values like "en-GB,en-US;q=0.9,en;q=0.8",
+    // so we don't want to be too restrictive in this regex - keep it simple for now.
+    [GeneratedRegex(@"^[\w-]*$")]
+    private static partial Regex ValidLanguageHeaderRegex();
 }

src/Umbraco.Cms.Api.Delivery/Services/RequestHeaderHandler.cs

@@ -8,11 +8,5 @@ internal abstract class RequestHeaderHandler
 
     protected RequestHeaderHandler(IHttpContextAccessor httpContextAccessor) => _httpContextAccessor = httpContextAccessor;
 
-    protected string? GetHeaderValue(string headerName)
-    {
-        HttpContext httpContext = _httpContextAccessor.HttpContext ??
-                                  throw new InvalidOperationException("Could not obtain an HTTP context");
-
-        return httpContext.Request.Headers[headerName];
-    }
+    protected string? GetHeaderValue(string headerName) => _httpContextAccessor.HttpContext?.Request.Headers[headerName];
 }