Update Examine to 3.8.0.

Bumped version to 13.15.0-rc
Merge branch 'release/13.14.0' into v13/dev
2026-06-07 21:17:09 +02:00 · 2026-04-30 08:07:45 +02:00 · 2026-04-30 08:06:57 +02:00 · 2026-04-30 06:36:08 +02:00 · 2026-04-23 16:40:12 +02:00 · 2026-04-23 16:39:31 +02:00
6446 changed files with 407801 additions and 158646 deletions
@@ -1,4 +1,3 @@
 **/*
 !tests/Umbraco.Tests.Integration/bin/**
 !tests/Umbraco.Tests.UnitTests/bin/**
-**/node_modules
@@ -13,16 +13,6 @@ If the answer is yes, please read on. Otherwise, make sure to head on over [to t

 ↖️ You can jump to any section by using the "table of contents" button ( ![Table of contents icon](img/tableofcontentsicon.svg) ) above.

-## Getting Started:
-To run umbraco, we first need to initialize the client git submodule:
-* Execute `git submodule update --init` to get the files into Umbraco.Web.UI.Client project
-* If you are going to work on the Backoffice, you can either go to the Umbraco.Web.UI.Client folder and check out a new branch or set it up in your IDE, which will allow you to commit to each repository simultaneously:
-  * **Rider**: Preferences -> Version Control -> Directory Mappings -> Click the '+' sign
-* If you get a white page delete Umbraco.Cms.StaticAssets\wwwroot\umbraco folder and run `npm ci && npm run build:for:cms` inside Umbraco.Web.UI.Client folder to clear out any leftover files from older versions.
-
-### Latest version
-* If you want to get the latest changes from the client repository, run `git submodule update` again which will pull the latest main branch.
-

 ## Debugging source locally

@@ -0,0 +1,18 @@
+# New backoffice
+
+> **Warning**:
+> This is an early WIP and is set not to be packable since we don't want to release this yet. There will be breaking changes in these projects.
+
+This solution folder contains the projects for the new backoffice. If you're looking to fix or improve the existing CMS, this is not the place to do it, although we do very much appreciate your efforts.
+
+### Project structure
+
+Since the new backoffice API is still very much a work in progress, we've created new projects for the new backoffice API:
+
+* Umbrao.Cms.ManagementApi - The "presentation layer" for the management API
+* "New" versions of existing projects, should be merged with the existing projects when the new API is released:
+    * Umbraco.New.Cms.Core
+    * Umbraco.New.Cms.Infrastructure
+    * Umbraco.New.Cms.Web.Common
+
+This also means that we have to use "InternalsVisibleTo" for the new projects since these should be able to access the internal classes since they will when they get merged.
@@ -2,52 +2,47 @@

 [![GitHub license](https://img.shields.io/badge/license-MIT-blue.svg)](../LICENSE.md) 
 [![PRs Welcome](https://img.shields.io/badge/PRs-welcome-brightgreen.svg)](CONTRIBUTING.md) 
-![Mastodon Follow](https://img.shields.io/mastodon/follow/110661369750014952?domain=https%3A%2F%2Fumbracocommunity.social)
+[![Follow Umbraco on Twitter](https://img.shields.io/badge/Follow-blue?logo=twitter&logoColor=fff)](https://twitter.com/intent/follow?screen_name=umbraco) 
 [![Chat about Umbraco on Discord](https://img.shields.io/discord/869656431308189746?logo=discord&logoColor=fff)](https://discord.gg/umbraco) 
 [![Read what's going on in the Umbraco Discord chat now](https://img.shields.io/badge/read-discord-blue)](https://discord-chats.umbraco.com) 
 [![Build status](https://img.shields.io/azure-devops/build/umbraco/Umbraco%2520Cms/301?logo=azurepipelines&label=Azure%20Pipelines)](https://umbraco.visualstudio.com/Umbraco%20Cms/_build?definitionId=301) 
+[![Open in GitHub Codespaces](https://img.shields.io/badge/Open%20in%20GitHub%20Codespaces-525252?logo=github)](https://github.com/codespaces/new?hide_repo_select=true&ref=contrib&repo=10601208&machine=basicLinux32gb&devcontainer_path=.devcontainer%2Fdevcontainer.json&location=WestEurope)

-
-### Umbraco is a free and open source .NET content management system. Our mission is to help you deliver delightful digital experiences by making Umbraco friendly, simpler and social. 
+Umbraco is the friendliest, most flexible and fastest growing ASP.NET CMS, and used by more than 500,000 websites worldwide. Our mission is to help you deliver delightful digital experiences by making Umbraco friendly, simpler and social.

 Learn more at [umbraco.com](https://umbraco.com)

 <p align="center">
-    <img src="img/logo.png" alt="Umbraco Logo" />
+  <img src="img/logo.png" alt="Umbraco Logo" />
 </p>

-## <a name="install"></a>Looking to install Umbraco?
+See the official [Umbraco website](https://umbraco.com) for an introduction, core mission and values of the product and team behind it.

-You can get started using the following commands on Windows, Linux and MacOS (after installing the [.NET Runtime and SDK](https://docs.umbraco.com/umbraco-cms/fundamentals/setup/requirements)):
+- [Getting Started](#getting-started)
+- [Documentation](#documentation)
+- [Community](#join-the-umbraco-community)
+- [Contributing](#contributing)

-```
-dotnet new install Umbraco.Templates
-dotnet new umbraco --name MyProject
-cd MyProject
-dotnet run
-```
+Please also see our [Code of Conduct](https://github.com/umbraco/.github/blob/main/.github/CODE_OF_CONDUCT.md).
+
+## Getting Started
+
+[Umbraco Cloud](https://umbraco.com/cloud) is the easiest and fastest way to use Umbraco yet, with full support for all your custom .NET code and integrations. You're up and running in less than a minute, and your life will be made easier with automated upgrades and a built-in deployment engine. We offer a free 14-day trial, no credit card needed.
+
+If you want to DIY, then you can [download Umbraco]((https://our.umbraco.com/download)) either as a ZIP file or via NuGet. It's the same version of Umbraco CMS that powers Umbraco Cloud, but you'll need to find a place to host it yourself, and handling deployments and upgrades will be all up to you.

 ## Documentation

-Our [comprehensive documentation](https://docs.umbraco.com/umbraco-cms) takes you from the fundamentals on how to start with Umbraco to deploying it to production.
+The documentation for Umbraco CMS can be found [on Our Umbraco](https://docs.umbraco.com/). The source for the Umbraco docs is [open source as well](https://github.com/umbraco/UmbracoDocs) and we're happy to look at your documentation contributions.

-Some important documentation links to get you started: 
+## Join the Umbraco community

- [Installing Umbraco CMS](https://docs.umbraco.com/umbraco-cms/fundamentals/setup/install)
- [Getting to know Umbraco](https://docs.umbraco.com/umbraco-cms/fundamentals/get-to-know-umbraco)
- [Tutorials for creating a basic website and customizing the editing experience](https://docs.umbraco.com/umbraco-cms/tutorials/overview)
+Our friendly community is available 24/7 at the community hub, we call ["Our Umbraco"](https://our.umbraco.com/). Our Umbraco features forums for questions and answers, documentation, downloadable plugins for Umbraco, and a rich collection of community resources.

-## Get help
+Besides "Our", we all support each other in our [Community Discord Server](https://discord.gg/umbraco) and on Twitter: [Umbraco HQ](https://twitter.com/umbraco), [Release Updates](https://twitter.com/umbracoproject), [#umbraco](https://twitter.com/hashtag/umbraco)

-If you need a bit of feedback while building your Umbraco projects, we are [chatty on Discord](https://discord.umbraco.com). Our Discord server serves both a social space but also has channels for questions and answers. Feel free to lurk or join in with your own questions. Or just post your daily Wordle score, up to you!

-## Looking to contribute back to Umbraco?

-You came to the right place! Our GitHub repository is available for all kinds of contributions:
-
- [Create a bug report](https://github.com/umbraco/Umbraco-CMS/issues)
- [Create a feature request](https://github.com/umbraco/Umbraco-CMS/discussions)
+## Contributing

 Umbraco is contribution-focused and community-driven. If you want to contribute back to the Umbraco source code, please check out our [guide to contributing](CONTRIBUTING.md).
-
-### Tip: You should not run Umbraco from source code found here. Umbraco is extremely extensible and can do whatever you need. Instead, [install Umbraco as noted above](#looking-to-install-umbraco) and then [extend it any way you want to](https://docs.umbraco.com/umbraco-cms/extending/).
@@ -1,34 +0,0 @@
-# .github/release.yml
-
-changelog:
-  exclude:
-    labels:
-      - ignore-for-release
-      - duplicate
-      - wontfix
-  categories:
-    - title: 🙌 Notable Changes
-      labels:
-        - category/notable
-    - title: 💥 Breaking Changes
-      labels:
-        - category/breaking
-    - title: 🐛 Bug Fixes
-      labels:
-        - type/bug
-        - category/bug
-    - title: 📄 Documentation
-      labels:
-        - category/documentation
-    - title: 🏠 Internal
-      labels:
-        - internal
-    - title: 📦 Dependencies
-      labels:
-        - dependencies
-    - title: 🌈 A11Y
-      labels:
-        - category/accessibility
-    - title: 🚀 New Features
-      labels:
-        - '*'
@@ -23,7 +23,6 @@ env:
  DOTNET_GENERATE_ASPNET_CERTIFICATE: false
  DOTNET_SKIP_FIRST_TIME_EXPERIENCE: true
  DOTNET_CLI_TELEMETRY_OPTOUT: true
-  NODE_OPTIONS: --max_old_space_size=16384

 jobs:
  CodeQL-Build:
@@ -38,7 +37,6 @@ jobs:
      uses: actions/checkout@v3
      with:
        fetch-depth: 0
-        submodules: true

    # Initializes the CodeQL tools for scanning.
    - name: Initialize CodeQL
@@ -50,6 +50,10 @@ tools/docfx/
 # Ignore rule for clearing out Belle (avoid rebuilding all the time)
 preserve.belle

+# Ignore rule for output of generated documentation files from grunt docserve
+/src/Umbraco.Web.UI.Docs/api/
+/src/Umbraco.Web.UI.Docs/package-lock.json
+
 # csharp-docs
 /build/csharp-docs/api/
 /build/csharp-docs/_site/
@@ -64,13 +68,7 @@ preserve.belle
 /build/docs.zip
 /build/ui-docs.zip
 /build/csharp-docs.zip
-/src/Umbraco.Cms.StaticAssets/wwwroot/umbraco/auth
-/src/Umbraco.Cms.StaticAssets/wwwroot/umbraco/backoffice
-/src/Umbraco.Cms.StaticAssets/wwwroot/umbraco/assets
-/src/Umbraco.Cms.StaticAssets/wwwroot/umbraco/js
-/src/Umbraco.Cms.StaticAssets/wwwroot/umbraco/lib
-/src/Umbraco.Cms.StaticAssets/wwwroot/umbraco/views
-/src/Umbraco.Cms.StaticAssets/wwwroot/umbraco/login
+/src/Umbraco.Cms.StaticAssets/wwwroot/umbraco/

 # Environment specific data
 /src/Umbraco.Web.UI.Client/[Bb]uild/
@@ -93,7 +91,6 @@ preserve.belle

 # Tests
 /tests/Umbraco.Tests.AcceptanceTest/.env
-/tests/Umbraco.Tests.AcceptanceTest/playwright/.auth
 /tests/Umbraco.Tests.Integration.SqlCe/DatabaseContextTests.sdf
 /tests/Umbraco.Tests.Integration.SqlCe/[Uu]mbraco/[Dd]ata/TEMP/
 /tests/Umbraco.Tests.Integration/appsettings.Tests.Local.json
@@ -106,13 +103,10 @@ preserve.belle
 # Ignore auto-generated schema
 /src/Umbraco.Cms.Targets/tasks/
 /src/Umbraco.Cms.Targets/appsettings-schema.*.json
-/src/Umbraco.Cms.Targets/umbraco-package-schema.json
 /src/Umbraco.Web.UI/appsettings-schema.json
 /src/Umbraco.Web.UI/appsettings-schema.*.json
-/src/Umbraco.Web.UI/umbraco-package-schema.json
 /tests/Umbraco.Tests.Integration/appsettings-schema.json
 /tests/Umbraco.Tests.Integration/appsettings-schema.*.json
-/tests/Umbraco.Tests.Integration/umbraco-package-schema.json
 /src/Umbraco.Cms/appsettings-schema.json
 playwright-report
 trace.zip
@@ -1,3 +0,0 @@
-[submodule "src/Umbraco.Web.UI.Client"]
-	path = src/Umbraco.Web.UI.Client
-	url = https://github.com/umbraco/Umbraco.CMS.Backoffice.git
@@ -28,14 +28,14 @@

  <!-- Package Validation -->
  <PropertyGroup>
-    <GenerateCompatibilitySuppressionFile>true</GenerateCompatibilitySuppressionFile>
+    <GenerateCompatibilitySuppressionFile>false</GenerateCompatibilitySuppressionFile>
    <EnablePackageValidation>true</EnablePackageValidation>
-    <PackageValidationBaselineVersion>14.0.0</PackageValidationBaselineVersion>
+    <PackageValidationBaselineVersion>13.0.0</PackageValidationBaselineVersion>
    <EnableStrictModeForCompatibleFrameworksInPackage>true</EnableStrictModeForCompatibleFrameworksInPackage>
    <EnableStrictModeForCompatibleTfms>true</EnableStrictModeForCompatibleTfms>
  </PropertyGroup>

-  <!-- Calculate version only once for the whole repository -->
+  <!-- Calculate version only once for the whole repository --> 
  <PropertyGroup>
    <GitVersionBaseDirectory>$(MSBuildThisFileDirectory)</GitVersionBaseDirectory>
  </PropertyGroup>
@@ -6,34 +6,35 @@
  <!-- Global packages (private, build-time packages for all projects) -->
  <ItemGroup>
    <GlobalPackageReference Include="Nerdbank.GitVersioning" Version="3.6.139" />
-    <GlobalPackageReference Include="StyleCop.Analyzers" Version="1.2.0-beta.556" />
+    <GlobalPackageReference Include="StyleCop.Analyzers" Version="1.2.0-beta.507" />
    <GlobalPackageReference Include="Umbraco.Code" Version="2.2.0" />
    <GlobalPackageReference Include="Umbraco.GitVersioning.Extensions" Version="0.2.0" />
  </ItemGroup>
  <!-- Microsoft packages -->
  <ItemGroup>
-    <PackageVersion Include="Microsoft.AspNetCore.Mvc.NewtonsoftJson" Version="8.0.6" />
-    <PackageVersion Include="Microsoft.AspNetCore.Mvc.Razor.RuntimeCompilation" Version="8.0.6" />
+    <PackageVersion Include="Microsoft.AspNetCore.Mvc.NewtonsoftJson" Version="8.0.22" />
+    <PackageVersion Include="Microsoft.AspNetCore.Mvc.Razor.RuntimeCompilation" Version="8.0.22" />
    <PackageVersion Include="Microsoft.CodeAnalysis.CSharp" Version="4.10.0" />
-    <PackageVersion Include="Microsoft.Data.Sqlite" Version="8.0.6" />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore.Sqlite" Version="8.0.6" />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore.SqlServer" Version="8.0.6" />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore.Design" Version="8.0.6" />
+    <PackageVersion Include="Microsoft.CodeAnalysis.CSharp.Workspaces" Version="4.10.0" />
+    <PackageVersion Include="Microsoft.CodeAnalysis.Workspaces.MSBuild" Version="4.10.0" />
+    <PackageVersion Include="Microsoft.Data.Sqlite" Version="8.0.11" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.Sqlite" Version="8.0.22" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.SqlServer" Version="8.0.22" />
    <PackageVersion Include="Microsoft.Extensions.Caching.Abstractions" Version="8.0.0" />
-    <PackageVersion Include="Microsoft.Extensions.Caching.Memory" Version="8.0.0" />
    <PackageVersion Include="Microsoft.Extensions.Configuration.Abstractions" Version="8.0.0" />
    <PackageVersion Include="Microsoft.Extensions.Configuration.Json" Version="8.0.0" />
-    <PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="8.0.0" />
-    <PackageVersion Include="Microsoft.Extensions.FileProviders.Embedded" Version="8.0.6" />
+    <PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="8.0.1" />
+    <PackageVersion Include="Microsoft.Extensions.FileProviders.Embedded" Version="8.0.22" />
    <PackageVersion Include="Microsoft.Extensions.FileProviders.Physical" Version="8.0.0" />
    <PackageVersion Include="Microsoft.Extensions.Hosting.Abstractions" Version="8.0.0" />
-    <PackageVersion Include="Microsoft.Extensions.Http" Version="8.0.0" />
-    <PackageVersion Include="Microsoft.Extensions.Identity.Core" Version="8.0.6" />
-    <PackageVersion Include="Microsoft.Extensions.Identity.Stores" Version="8.0.6" />
-    <PackageVersion Include="Microsoft.Extensions.Logging" Version="8.0.0" />
+    <PackageVersion Include="Microsoft.Extensions.Http" Version="8.0.1" />
+    <PackageVersion Include="Microsoft.Extensions.Identity.Core" Version="8.0.22" />
+    <PackageVersion Include="Microsoft.Extensions.Identity.Stores" Version="8.0.22" />
+    <PackageVersion Include="Microsoft.Extensions.Logging" Version="8.0.1" />
    <PackageVersion Include="Microsoft.Extensions.Options" Version="8.0.2" />
    <PackageVersion Include="Microsoft.Extensions.Options.ConfigurationExtensions" Version="8.0.0" />
    <PackageVersion Include="Microsoft.Extensions.Options.DataAnnotations" Version="8.0.0" />
+    <PackageVersion Include="System.Runtime.Caching" Version="8.0.1" />
  </ItemGroup>
  <!-- Umbraco packages -->
  <ItemGroup>
@@ -42,50 +43,62 @@
  </ItemGroup>
  <!-- Third-party packages -->
  <ItemGroup>
-    <PackageVersion Include="Asp.Versioning.Mvc" Version="8.1.0" />
-    <PackageVersion Include="Asp.Versioning.Mvc.ApiExplorer" Version="8.1.0" />
+    <PackageVersion Include="Asp.Versioning.Mvc" Version="7.1.1" />
+    <PackageVersion Include="Asp.Versioning.Mvc.ApiExplorer" Version="7.1.0" />
    <PackageVersion Include="Dazinator.Extensions.FileProviders" Version="2.0.0" />
-    <PackageVersion Include="Examine" Version="3.2.1" />
-    <PackageVersion Include="Examine.Core" Version="3.2.1" />
-    <PackageVersion Include="HtmlAgilityPack" Version="1.11.61" />
-    <PackageVersion Include="JsonPatch.Net" Version="3.1.0" />
+    <PackageVersion Include="Examine" Version="3.8.0" />
+    <PackageVersion Include="Examine.Core" Version="3.8.0" />
+    <PackageVersion Include="HtmlAgilityPack" Version="1.11.74" />
    <PackageVersion Include="K4os.Compression.LZ4" Version="1.3.8" />
-    <PackageVersion Include="MailKit" Version="4.6.0" />
+    <PackageVersion Include="MailKit" Version="4.8.0" />
    <PackageVersion Include="Markdown" Version="2.2.1" />
-    <PackageVersion Include="MessagePack" Version="2.5.168" />
+    <PackageVersion Include="MessagePack" Version="2.5.192" />
    <PackageVersion Include="MiniProfiler.AspNetCore.Mvc" Version="4.3.8" />
    <PackageVersion Include="MiniProfiler.Shared" Version="4.3.8" />
    <PackageVersion Include="ncrontab" Version="3.3.3" />
+    <PackageVersion Include="Newtonsoft.Json" Version="13.0.4" />
    <PackageVersion Include="NPoco" Version="5.7.1" />
    <PackageVersion Include="NPoco.SqlServer" Version="5.7.1" />
-    <PackageVersion Include="OpenIddict.Abstractions" Version="5.7.0" />
-    <PackageVersion Include="OpenIddict.AspNetCore" Version="5.7.0" />
-    <PackageVersion Include="OpenIddict.EntityFrameworkCore" Version="5.7.0" />
+    <PackageVersion Include="OpenIddict.Abstractions" Version="4.10.1" />
+    <PackageVersion Include="OpenIddict.AspNetCore" Version="4.10.1" />
+    <PackageVersion Include="OpenIddict.EntityFrameworkCore" Version="4.10.1" />
    <PackageVersion Include="Serilog" Version="3.1.1" />
-    <PackageVersion Include="Serilog.AspNetCore" Version="8.0.1" />
+    <PackageVersion Include="Serilog.AspNetCore" Version="8.0.3" />
    <PackageVersion Include="Serilog.Enrichers.Process" Version="2.0.2" />
    <PackageVersion Include="Serilog.Enrichers.Thread" Version="3.1.0" />
    <PackageVersion Include="Serilog.Expressions" Version="4.0.0" />
    <PackageVersion Include="Serilog.Extensions.Hosting" Version="8.0.0" />
    <PackageVersion Include="Serilog.Formatting.Compact" Version="2.0.0" />
    <PackageVersion Include="Serilog.Formatting.Compact.Reader" Version="3.0.0" />
-    <PackageVersion Include="Serilog.Settings.Configuration" Version="8.0.1" />
+    <PackageVersion Include="Serilog.Settings.Configuration" Version="8.0.4" />
    <PackageVersion Include="Serilog.Sinks.Async" Version="1.5.0" />
    <PackageVersion Include="Serilog.Sinks.File" Version="5.0.0" />
    <PackageVersion Include="Serilog.Sinks.Map" Version="1.0.2" />
-    <PackageVersion Include="SixLabors.ImageSharp" Version="3.1.4" />
-    <PackageVersion Include="SixLabors.ImageSharp.Web" Version="3.1.2" />
-    <PackageVersion Include="Swashbuckle.AspNetCore" Version="6.6.2" />
+    <PackageVersion Include="SixLabors.ImageSharp" Version="3.1.12" />
+    <PackageVersion Include="SixLabors.ImageSharp.Web" Version="3.1.5" />
+    <PackageVersion Include="Smidge.InMemory" Version="4.6.0" />
+    <PackageVersion Include="Smidge.Nuglify" Version="4.6.0" />
+    <PackageVersion Include="Swashbuckle.AspNetCore" Version="6.9.0" />
  </ItemGroup>
  <!-- Transitive pinned versions (only required because our direct dependencies have vulnerable versions of transitive dependencies) -->
  <ItemGroup>
    <!-- Both Microsoft.EntityFrameworkCore.SqlServer and NPoco.SqlServer bring in a vulnerable version of Azure.Identity -->
-    <PackageVersion Include="Azure.Identity" Version="1.12.0" />
+    <PackageVersion Include="Azure.Identity" Version="1.13.2" />
    <!-- Dazinator.Extensions.FileProviders brings in a vulnerable version of System.Net.Http -->
    <PackageVersion Include="System.Net.Http" Version="4.3.4" />
    <!-- Examine brings in a vulnerable version of System.Security.Cryptography.Xml -->
-    <PackageVersion Include="System.Security.Cryptography.Xml" Version="8.0.1" />
+    <PackageVersion Include="System.Security.Cryptography.Xml" Version="8.0.3" />
    <!-- Both Dazinator.Extensions.FileProviders and MiniProfiler.AspNetCore.Mvc bring in a vulnerable version of System.Text.RegularExpressions -->
    <PackageVersion Include="System.Text.RegularExpressions" Version="4.3.1" />
+    <!-- Both OpenIddict.AspNetCore, Npoco.SqlServer and Microsoft.EntityFrameworkCore.SqlServer bring in a vulnerable version of Microsoft.IdentityModel.JsonWebTokens -->
+    <PackageVersion Include="Microsoft.IdentityModel.JsonWebTokens" Version="7.7.1" />
+    <!-- Examine.Lucene bring in a vulnerable version of Lucene.Net.Replicator -->
+    <PackageVersion Include="Lucene.Net.Replicator" Version="4.8.0-beta00017" />
+    <!-- Both OpenIddict.AspNetCore, Microsoft.EntityFrameworkCore.* bring in a vulnerable version of Microsoft.Extensions.Caching.Memory -->
+    <PackageVersion Include="Microsoft.Extensions.Caching.Memory" Version="8.0.1" />
+    <!-- Both Azure.Identity, Microsoft.EntityFrameworkCore.SqlServer,NPoco.SqlServer, and more bring in a vulnerable version of System.Text.Json -->
+    <PackageVersion Include="System.Text.Json" Version="8.0.6" />
+    <!-- Both Microsoft.EntityFrameworkCore.SqlServer and NPoco.SqlServer bring in a vulnerable version of Microsoft.Data.SqlClient -->
+    <PackageVersion Include="Microsoft.Data.SqlClient" Version="5.2.3" />
  </ItemGroup>
-</Project>
+</Project>
@@ -17,10 +17,6 @@ parameters:
    displayName: Deploy to NuGet
    type: boolean
    default: false
-  - name: npmDeploy
-    displayName: Deploy to Npm
-    type: boolean
-    default: false
  - name: buildApiDocs
    displayName: Build API docs
    type: boolean
@@ -29,6 +25,10 @@ parameters:
    displayName: Upload API docs
    type: boolean
    default: false
+  - name: uploadDependencyTrack
+    displayName: Upload BOMs to Dependency Track
+    type: boolean
+    default: false
  - name: forceReleaseTestFilter
    displayName: Force to use the release test filters
    type: boolean
@@ -63,36 +63,73 @@ variables:
  DOTNET_GENERATE_ASPNET_CERTIFICATE: false
  DOTNET_SKIP_FIRST_TIME_EXPERIENCE: true
  DOTNET_CLI_TELEMETRY_OPTOUT: true
-  npm_config_cache: $(Pipeline.Workspace)/.npm_client
-  NODE_OPTIONS: --max_old_space_size=16384

 stages:
  ###############################################
  ## Build
  ###############################################
  - stage: Build
+    variables:
+      npm_config_cache: $(Pipeline.Workspace)/.npm_client
    jobs:
      - job: A
        displayName: Build Umbraco CMS
        pool:
-          vmImage: 'ubuntu-latest'
+          vmImage: 'windows-latest'
        steps:
          - checkout: self
-            submodules: true
+            submodules: false
+            lfs: false,
+            fetchDepth: 500
+          - task: NodeTool@0
+            displayName: Use Node.js $(nodeVersion)
+            retryCountOnTaskFailure: 3
+            inputs:
+              versionSpec: $(nodeVersion)
+          - task: Cache@2
+            displayName: Cache node_modules
+            inputs:
+              key: '"npm_client" | "$(Agent.OS)" | $(Build.SourcesDirectory)/src/Umbraco.Web.UI.Client/package-lock.json'
+              restoreKeys: |
+                "npm_client" | "$(Agent.OS)"
+                "npm_client"
+              path: $(npm_config_cache)
+          - script: npm ci --no-fund --no-audit --prefer-offline
+            workingDirectory:  src/Umbraco.Web.UI.Client
+            displayName: Run npm ci (Backoffice)
+          - powershell: |
+              npm install --global @cyclonedx/cyclonedx-npm
+              cyclonedx-npm -o $(Build.ArtifactStagingDirectory)\bom\bom-backoffice.xml --ignore-npm-errors --verbose
+            displayName: Generate Backoffice UI BOM
+            workingDirectory: src/Umbraco.Web.UI.Client
+          - task: gulp@0
+            displayName: Run gulp build (Backoffice)
+            inputs:
+              gulpFile: src/Umbraco.Web.UI.Client/gulpfile.js
+              targets: coreBuild
+              workingDirectory: src/Umbraco.Web.UI.Client
+          - task: npm@1
+            displayName: Run npm ci (Login)
+            inputs:
+              command: custom
+              workingDir: src/Umbraco.Web.UI.Login
+              verbose: false
+              customCommand: ci
+          - powershell: |
+              cyclonedx-npm -o $(Build.ArtifactStagingDirectory)\bom\bom-login.xml --ignore-npm-errors --verbose
+            displayName: Generate Login UI BOM
+            workingDirectory: src/Umbraco.Web.UI.Login
+          - task: npm@1
+            displayName: Run npm build (Login)
+            inputs:
+              command: custom
+              workingDir: src/Umbraco.Web.UI.Login
+              verbose: false
+              customCommand: run build
          - task: UseDotNet@2
            displayName: Use .NET SDK from global.json
            inputs:
              useGlobalJson: true
-          - template: templates/backoffice-install.yml
-          - script: npm run build:for:cms
-            displayName: Run build (Bellissima)
-            workingDirectory: src/Umbraco.Web.UI.Client
-          - script: npm ci --no-fund --no-audit --prefer-offline
-            displayName: Run npm ci (Login)
-            workingDirectory: src/Umbraco.Web.UI.Login
-          - script: npm run build
-            displayName: Run npm build (Login)
-            workingDirectory: src/Umbraco.Web.UI.Login
          - task: DotNetCoreCLI@2
            displayName: Run dotnet restore
            inputs:
@@ -105,6 +142,10 @@ stages:
              command: build
              projects: $(solution)
              arguments: '--configuration $(buildConfiguration) --no-restore --property:ContinuousIntegrationBuild=true --property:GeneratePackageOnBuild=true --property:PackageOutputPath=$(Build.ArtifactStagingDirectory)/nupkg'
+          - powershell: |
+              dotnet tool install --global CycloneDX
+              dotnet-CycloneDX $(solution) --output $(Build.ArtifactStagingDirectory)/bom --filename bom-dotnet.xml
+            displayName: 'Generate Backend BOM'
          - task: PublishPipelineArtifact@1
            displayName: Publish nupkg
            inputs:
@@ -115,31 +156,35 @@ stages:
            inputs:
              targetPath: $(Build.SourcesDirectory)
              artifactName: build_output
-
-      - job: B
-        displayName: Build Bellissima Package
-        pool:
-          vmImage: 'ubuntu-latest'
-        steps:
-          - checkout: self
-            submodules: true
-          - template: templates/backoffice-install.yml
-          - script: npm run build:for:npm
-            displayName: Run build:for:npm
-            workingDirectory: src/Umbraco.Web.UI.Client
-          - bash: |
-              echo "##[command]Running npm pack"
-              echo "##[debug]Output directory: $(Build.ArtifactStagingDirectory)"
-              mkdir $(Build.ArtifactStagingDirectory)/npm
-              npm pack --pack-destination $(Build.ArtifactStagingDirectory)/npm
-              mv .npmrc $(Build.ArtifactStagingDirectory)/npm/
-            displayName: Run npm pack
-            workingDirectory: src/Umbraco.Web.UI.Client
          - task: PublishPipelineArtifact@1
-            displayName: Publish Bellissima npm artifact
+            displayName: Publish Backend BOM
            inputs:
-              targetPath: $(Build.ArtifactStagingDirectory)/npm
-              artifactName: npm
+              targetPath: $(Build.ArtifactStagingDirectory)/bom
+              artifactName: bom-build
+
+  - stage: E2E_BOM
+    displayName: E2E Tests BOM Generation
+    dependsOn: []
+    jobs:
+    - job:
+      displayName: E2E Generate BOM
+      pool:
+        vmImage: "ubuntu-latest"
+      steps:
+        - checkout: self
+          fetchDepth: 500
+        - template: templates/e2e-install.yml
+          parameters:
+            nodeVersion: ${{ variables.nodeVersion }}
+            npm_config_cache: ${{ variables.npm_config_cache }}
+        - powershell: |
+            npm install --global @cyclonedx/cyclonedx-npm
+            cyclonedx-npm -o $(Build.ArtifactStagingDirectory)/bom/bom-e2e.xml --ignore-npm-errors --verbose
+          displayName: Generate E2E Tests BOM
+          workingDirectory: tests/Umbraco.Tests.AcceptanceTest
+        - publish: $(Build.ArtifactStagingDirectory)/bom
+          artifact: bom-e2e
+          displayName: 'Publish E2E BOM'

  - stage: Build_Docs
    condition: and(succeeded(), or(eq(dependencies.Build.outputs['A.build.NBGV_PublicRelease'], 'True'), ${{parameters.buildApiDocs}}))
@@ -202,45 +247,41 @@ stages:
        displayName: Build js API Reference
        pool:
          vmImage: 'ubuntu-latest'
-        variables:
-          BASE_PATH: /v$(umbracoMajorVersion)/ui
        steps:
          - checkout: self
-            submodules: true
-          - template: templates/backoffice-install.yml
-          - script: npm run storybook:build
-            displayName: Build Storybook
-            env:
-              VITE_BASE_PATH: $(BASE_PATH)/
-            workingDirectory: $(Build.SourcesDirectory)/src/Umbraco.Web.UI.Client
-          - script: sed -i "s|/umbraco/backoffice|$(BASE_PATH)/umbraco/backoffice|" assets/*.js
-            displayName: Replace BASE_PATH on assets
-            workingDirectory: $(Build.SourcesDirectory)/src/Umbraco.Web.UI.Client/storybook-static
-          - task: ArchiveFiles@2
-            displayName: Archive Storybook
+            submodules: false
+            lfs: false,
+            fetchDepth: 1
+            fetchFilter: tree:0
+          - task: NodeTool@0
+            displayName: Use Node.js 10.15.x
+            retryCountOnTaskFailure: 3
            inputs:
-              rootFolderOrFile: $(Build.SourcesDirectory)/src/Umbraco.Web.UI.Client/storybook-static
+              versionSpec: 10.15.x # Won't work with higher versions
+          - script: |
+              npm ci --no-fund --no-audit --prefer-offline
+              npx gulp docs
+
+              major="$(umbracoMajorVersion)"
+              echo "major version: $major"
+
+              baseUrl="https://apidocs.umbraco.com/v$major/ui/"
+              echo "baseUrl: $baseUrl"
+
+              sed -i "s|baseUrl = .*|baseUrl = '$baseUrl',|" api/index.html
+            displayName: Generate js Docs
+            workingDirectory:  $(Build.SourcesDirectory)/src/Umbraco.Web.UI.Docs
+          - task: ArchiveFiles@2
+            displayName: Archive js Docs
+            inputs:
+              rootFolderOrFile: $(Build.SourcesDirectory)/src/Umbraco.Web.UI.Docs/api
              includeRootFolder: false
              archiveFile: $(Build.ArtifactStagingDirectory)/ui-docs.zip
          - task: PublishPipelineArtifact@1
-            displayName: Publish Storybook
+            displayName: Publish js Docs
            inputs:
              targetPath: $(Build.ArtifactStagingDirectory)/ui-docs.zip
              artifact: ui-docs
-          - script: npm run generate:ui-api-docs
-            displayName: Generate API Docs
-            workingDirectory: $(Build.SourcesDirectory)/src/Umbraco.Web.UI.Client
-          - task: ArchiveFiles@2
-            displayName: Archive UI API Docs
-            inputs:
-              rootFolderOrFile: $(Build.SourcesDirectory)/src/Umbraco.Web.UI.Client/ui-api
-              includeRootFolder: false
-              archiveFile: $(Build.ArtifactStagingDirectory)/ui-api-docs.zip
-          - task: PublishPipelineArtifact@1
-            displayName: Publish UI API Docs
-            inputs:
-              targetPath: $(Build.ArtifactStagingDirectory)/ui-api-docs.zip
-              artifact: ui-api-docs

  ###############################################
  ## Test
@@ -263,6 +304,11 @@ stages:
        pool:
          vmImage: $(vmImage)
        steps:
+          - checkout: self
+            submodules: false
+            lfs: false,
+            fetchDepth: 1
+            fetchFilter: tree:0
          - task: DownloadPipelineArtifact@2
            displayName: Download build artifacts
            inputs:
@@ -302,6 +348,11 @@ stages:
        variables:
          Tests__Database__DatabaseType: 'Sqlite'
        steps:
+          - checkout: self
+            submodules: false
+            lfs: false,
+            fetchDepth: 1
+            fetchFilter: tree:0
          # Setup test environment
          - task: DownloadPipelineArtifact@2
            displayName: Download build artifacts
@@ -332,8 +383,9 @@ stages:

      # Integration Tests (SQL Server)
      - job:
-        timeoutInMinutes: 180
-        # condition: or(eq(stageDependencies.Build.A.outputs['build.NBGV_PublicRelease'], 'True'), ${{parameters.sqlServerIntegrationTests}}) # Outcommented due to timeouts
+        timeoutInMinutes: 120
+        # We are currently encountering issues when running SQL Server Linux tests Microsoft.Data.SqlClient.SqlException (0x80131904)
+        # condition: or(eq(stageDependencies.Build.A.outputs['build.NBGV_PublicRelease'], 'True'), ${{parameters.sqlServerIntegrationTests}})
        condition: eq(${{parameters.sqlServerIntegrationTests}}, True)
        displayName: Integration Tests (SQL Server)
        strategy:
@@ -430,10 +482,24 @@ stages:
          CONNECTIONSTRINGS__UMBRACODBDSN_PROVIDERNAME: Microsoft.Data.Sqlite
        strategy:
          matrix:
-            Linux:
-              vmImage: 'ubuntu-latest'
-            Windows:
-              vmImage: 'windows-latest'
+            LinuxPart1Of3:
+              vmImage: "ubuntu-latest"
+              testCommand: "npm run test -- --shard=1/3"
+            LinuxPart2Of3:
+              vmImage: "ubuntu-latest"
+              testCommand: "npm run test -- --shard=2/3"
+            LinuxPart3Of3:
+              vmImage: "ubuntu-latest"
+              testCommand: "npm run test -- --shard=3/3"
+            WindowsPart1Of3:
+              vmImage: "windows-latest"
+              testCommand: "npm run test -- --shard=1/3"
+            WindowsPart2Of3:
+              vmImage: "windows-latest"
+              testCommand: "npm run test -- --shard=2/3"
+            WindowsPart3Of3:
+              vmImage: "windows-latest"
+              testCommand: "npm run test -- --shard=3/3"
        pool:
          vmImage: $(vmImage)
        steps:
@@ -444,38 +510,18 @@ stages:
              artifact: nupkg
              path: $(Agent.BuildDirectory)/app/nupkg

-          - task: NodeTool@0
-            displayName: Use Node.js $(nodeVersion)
-            retryCountOnTaskFailure: 3
-            inputs:
-              versionSpec: $(nodeVersion)
-
          - task: UseDotNet@2
            displayName: Use .NET SDK from global.json
            inputs:
              useGlobalJson: true

-          - pwsh: |
-              "UMBRACO_USER_LOGIN=$(UMBRACO__CMS__UNATTENDED__UNATTENDEDUSEREMAIL)
-              UMBRACO_USER_PASSWORD=$(UMBRACO__CMS__UNATTENDED__UNATTENDEDUSERPASSWORD)
-              URL=$(ASPNETCORE_URLS)
-              STORAGE_STAGE_PATH=$(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/playwright/.auth/user.json" | Out-File .env
-            displayName: Generate .env
-            workingDirectory: $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest
-
-          # Cache and restore NPM packages
-          - task: Cache@2
-            displayName: Cache NPM packages
-            inputs:
-              key: 'npm_e2e | "$(Agent.OS)" | $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/package-lock.json'
-              restoreKeys: |
-                npm_e2e | "$(Agent.OS)"
-                npm_e2e
-              path: $(npm_config_cache)
-
-          - script: npm ci --no-fund --no-audit --prefer-offline
-            workingDirectory: $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest
-            displayName: Restore NPM packages
+          - template: templates/e2e-install.yml
+            parameters:
+              nodeVersion: $(nodeVersion)
+              npm_config_cache: $(npm_config_cache)
+              PlaywrightUserEmail: $(UMBRACO__CMS__UNATTENDED__UNATTENDEDUSEREMAIL)
+              PlaywrightPassword: $(UMBRACO__CMS__UNATTENDED__UNATTENDEDUSERPASSWORD)
+              ASPNETCORE_URLS: $(ASPNETCORE_URLS)

          # Build application
          - pwsh: |
@@ -512,15 +558,12 @@ stages:
            workingDirectory: tests/Umbraco.Tests.AcceptanceTest

          # Install Playwright and dependencies
-          - pwsh: npx playwright install --with-deps
-            displayName: Install Playwright
+          - pwsh: npx playwright install chromium
+            displayName: Install Playwright only with Chromium browser
            workingDirectory: tests/Umbraco.Tests.AcceptanceTest

          # Test
-          - ${{ if eq(parameters.isNightly, true) }}:
-              pwsh: npm run test --ignore-certificate-errors
-            ${{ else }}:
-              pwsh: npm run smokeTest --ignore-certificate-errors
+          - pwsh: $(testCommand)
            displayName: Run Playwright tests
            continueOnError: true
            workingDirectory: tests/Umbraco.Tests.AcceptanceTest
@@ -541,35 +584,62 @@ stages:
          # Copy artifacts
          - pwsh: |
              if (Test-Path tests/Umbraco.Tests.AcceptanceTest/results/*) {
-                Copy-Item tests/Umbraco.Tests.AcceptanceTest/results $(Build.ArtifactStagingDirectory) -Recurse
+                Copy-Item tests/Umbraco.Tests.AcceptanceTest/results/* $(Build.ArtifactStagingDirectory) -Recurse
              }
            displayName: Copy Playwright results
            condition: succeededOrFailed()

-          # Publish
+          # Publish test artifacts
          - task: PublishPipelineArtifact@1
            displayName: Publish test artifacts
            condition: succeededOrFailed()
            inputs:
              targetPath: $(Build.ArtifactStagingDirectory)
-              artifact: 'Acceptance Tests - $(Agent.JobName) - Attempt #$(System.JobAttempt)'
+              artifact: "Acceptance Test Results - $(Agent.JobName) - Attempt #$(System.JobAttempt)"
+
+          # Publish test results
+          - task: PublishTestResults@2
+            displayName: "Publish test results"
+            condition: succeededOrFailed()
+            inputs:
+              testResultsFormat: 'JUnit'
+              testResultsFiles: '*.xml'
+              searchFolder: "tests/Umbraco.Tests.AcceptanceTest/results"
+              testRunTitle: "$(Agent.JobName)"

      - job:
        displayName: E2E Tests (SQL Server)
-        # condition: or(eq(stageDependencies.Build.A.outputs['build.NBGV_PublicRelease'], 'True'), ${{parameters.sqlServerAcceptanceTests}}) # Outcommented due to timeouts
-        condition: eq(${{parameters.sqlServerAcceptanceTests}}, True)
+        condition: or(eq(stageDependencies.Build.A.outputs['build.NBGV_PublicRelease'], 'True'), ${{parameters.sqlServerAcceptanceTests}})
        variables:
          # Connection string
          CONNECTIONSTRINGS__UMBRACODBDSN: Data Source=(localdb)\MSSQLLocalDB;AttachDbFilename=|DataDirectory|\Umbraco.mdf;Integrated Security=True
          CONNECTIONSTRINGS__UMBRACODBDSN_PROVIDERNAME: Microsoft.Data.SqlClient
        strategy:
          matrix:
-            Linux:
-              vmImage: 'ubuntu-latest'
+            LinuxPart1Of3:
+              testCommand: "npm run testSqlite -- --shard=1/3"
+              vmImage: "ubuntu-latest"
              SA_PASSWORD: $(UMBRACO__CMS__UNATTENDED__UNATTENDEDUSERPASSWORD)
-              CONNECTIONSTRINGS__UMBRACODBDSN: 'Server=(local);Database=Umbraco;User Id=sa;Password=$(SA_PASSWORD);TrustServerCertificate=True'
-            Windows:
-              vmImage: 'windows-latest'
+              CONNECTIONSTRINGS__UMBRACODBDSN: "Server=(local);Database=Umbraco;User Id=sa;Password=$(SA_PASSWORD);TrustServerCertificate=True"
+            LinuxPart2Of3:
+              testCommand: "npm run testSqlite -- --shard=2/3"
+              vmImage: "ubuntu-latest"
+              SA_PASSWORD: $(UMBRACO__CMS__UNATTENDED__UNATTENDEDUSERPASSWORD)
+              CONNECTIONSTRINGS__UMBRACODBDSN: "Server=(local);Database=Umbraco;User Id=sa;Password=$(SA_PASSWORD);TrustServerCertificate=True"
+            LinuxPart3Of3:
+              testCommand: "npm run testSqlite -- --shard=3/3"
+              vmImage: "ubuntu-latest"
+              SA_PASSWORD: $(UMBRACO__CMS__UNATTENDED__UNATTENDEDUSERPASSWORD)
+              CONNECTIONSTRINGS__UMBRACODBDSN: "Server=(local);Database=Umbraco;User Id=sa;Password=$(SA_PASSWORD);TrustServerCertificate=True"
+            WindowsPart1Of3:
+              vmImage: "windows-latest"
+              testCommand: "npm run testSqlite -- --shard=1/3"
+            WindowsPart2Of3:
+              vmImage: "windows-latest"
+              testCommand: "npm run testSqlite -- --shard=2/3"
+            WindowsPart3Of3:
+              vmImage: "windows-latest"
+              testCommand: "npm run testSqlite -- --shard=3/3"
        pool:
          vmImage: $(vmImage)
        steps:
@@ -655,17 +725,13 @@ stages:
            workingDirectory: tests/Umbraco.Tests.AcceptanceTest

          # Install Playwright and dependencies
-          - pwsh: npx playwright install --with-deps
-            displayName: Install Playwright
+          - pwsh: npx playwright install chromium
+            displayName: Install Playwright only with Chromium browser
            workingDirectory: tests/Umbraco.Tests.AcceptanceTest

          # Test
-          - ${{ if eq(parameters.isNightly, true) }}:
-              pwsh: npm run test --ignore-certificate-errors
-            ${{ else }}:
-              pwsh: npm run smokeTest --ignore-certificate-errors
+          - pwsh: $(testCommand)
            displayName: Run Playwright tests
-            continueOnError: true
            workingDirectory: tests/Umbraco.Tests.AcceptanceTest
            env:
              CI: true
@@ -693,18 +759,56 @@ stages:
          # Copy artifacts
          - pwsh: |
              if (Test-Path tests/Umbraco.Tests.AcceptanceTest/results/*) {
-                Copy-Item tests/Umbraco.Tests.AcceptanceTest/results $(Build.ArtifactStagingDirectory) -Recurse
+                Copy-Item tests/Umbraco.Tests.AcceptanceTest/results/* $(Build.ArtifactStagingDirectory) -Recurse
              }
            displayName: Copy Playwright results
            condition: succeededOrFailed()

-          # Publish
+          # Publish test artifacts
          - task: PublishPipelineArtifact@1
            displayName: Publish test artifacts
            condition: succeededOrFailed()
            inputs:
              targetPath: $(Build.ArtifactStagingDirectory)
-              artifact: 'Acceptance Tests - $(Agent.JobName) - Attempt #$(System.JobAttempt)'
+              artifact: "Acceptance Test Results - $(Agent.JobName) - Attempt #$(System.JobAttempt)"
+
+          # Publish test results
+          - task: PublishTestResults@2
+            displayName: "Publish test results"
+            condition: succeededOrFailed()
+            inputs:
+              testResultsFormat: 'JUnit'
+              testResultsFiles: '*.xml'
+              searchFolder: "tests/Umbraco.Tests.AcceptanceTest/results"
+              testRunTitle: "$(Agent.JobName)"
+
+  - stage: Dependency_Track
+    displayName: Dependency Track
+    dependsOn:
+      - Build
+      - E2E_BOM
+    condition: and(succeeded(), or(eq(dependencies.Build.outputs['A.build.NBGV_PublicRelease'], 'True'), ${{parameters.uploadDependencyTrack}}))
+    variables:
+      # Determine Umbraco version based on whether it's a public release or not. If public release, use major version, else use full NuGet package version.
+      umbracoVersion: $[ iif(eq(stageDependencies.Build.A.outputs['build.NBGV_PublicRelease'], 'True'), stageDependencies.Build.A.outputs['build.NBGV_VersionMajor'], stageDependencies.Build.A.outputs['build.NBGV_NuGetPackageVersion']) ]
+    jobs:
+      - template: templates/dependency-track.yml
+        parameters:
+          projectName: "Umbraco-CMS"
+          umbracoVersion: $(umbracoVersion)
+          projects:
+            - name: "Backend"
+              artifact: "bom-build"
+              bomFilePath: "bom-dotnet.xml"
+            - name: "Login"
+              artifact: "bom-build"
+              bomFilePath: "bom-login.xml"
+            - name: "Backoffice"
+              artifact: "bom-build"
+              bomFilePath: "bom-backoffice.xml"
+            - name: "E2E"
+              artifact: "bom-e2e"
+              bomFilePath: "bom-e2e.xml"

  ###############################################
  ## Release
@@ -714,10 +818,12 @@ stages:
    dependsOn:
      - Unit
      - Integration
-#      - E2E
+      # - E2E # TODO: Enable when stable.
    condition: and(succeeded(), or(eq(dependencies.Build.outputs['A.build.NBGV_PublicRelease'], 'True'), ${{parameters.myGetDeploy}}))
    jobs:
      - job:
+        pool:
+          vmImage: "windows-latest" # NuGetCommand@2 is no longer supported on Ubuntu 24.04 so we'll use windows until an alternative is available.
        displayName: Push to pre-release feed
        steps:
          - checkout: none
@@ -736,41 +842,6 @@ stages:
                publishFeedCredentials: 'MyGet - Umbraco Nightly'
              ${{ else }}:
                publishFeedCredentials: 'MyGet - Pre-releases'
-      - job:
-        displayName: Push to pre-release feed (npm)
-        steps:
-          - checkout: none
-          - download: current
-            artifact: npm
-          - bash: |
-              # Check if we are on a nightly build
-              if [ $isNightly = "False" ]; then
-                  echo "##[debug]Prerelease build detected"
-                  registry="https://www.myget.org/F/umbracoprereleases/npm/"
-              else
-                  echo "##[debug]Nightly build detected"
-                  registry="https://www.myget.org/F/umbraconightly/npm/"
-              fi
-              echo "@umbraco-cms:registry=$registry" >> .npmrc
-            env:
-              isNightly: ${{parameters.isNightly}}
-            workingDirectory: $(Pipeline.Workspace)/npm
-            displayName: Add scoped registry to .npmrc
-          - task: npmAuthenticate@0
-            displayName: Authenticate with npm (MyGet)
-            inputs:
-              workingFile: '$(Pipeline.Workspace)/npm/.npmrc'
-              customEndpoint: 'MyGet (npm) - Umbracoprereleases, MyGet (npm) - Umbraconightly'
-          - bash: |
-              # Setup temp npm project to load in defaults from the local .npmrc
-              npm init -y
-
-              # Find the first .tgz file in the current directory and publish it
-              files=( ./*.tgz )
-              npm publish "${files[0]}"
-            displayName: Push to npm (MyGet)
-            workingDirectory: $(Pipeline.Workspace)/npm
-
  - stage: Deploy_NuGet
    displayName: NuGet release
    dependsOn:
@@ -779,6 +850,8 @@ stages:
    condition: and(succeeded(), or(eq(dependencies.Build.outputs['A.build.NBGV_PublicRelease'], 'True'), ${{parameters.nuGetDeploy}}))
    jobs:
      - job:
+        pool:
+          vmImage: "windows-latest" # NuGetCommand@2 is no longer supported on Ubuntu 24.04 so we'll use windows until an alternative is available.
        displayName: Push to NuGet
        steps:
          - checkout: none
@@ -795,42 +868,12 @@ stages:
              nuGetFeedType: 'external'
              publishFeedCredentials: 'NuGet - Umbraco.*'

-  - stage: Deploy_Npm
-    displayName: Npm release
-    condition: and(succeeded(), or(eq(dependencies.Build.outputs['A.build.NBGV_PublicRelease'], 'True'), ${{parameters.npmDeploy}}))
-    dependsOn:
-      - Deploy_NuGet
-    jobs:
-      - job: Publish
-        displayName: Push to NPM
-        steps:
-          - checkout: none
-          - download: current
-            artifact: npm
-          - bash: echo "@umbraco-cms:registry=https://registry.npmjs.org" >> .npmrc
-            workingDirectory: $(Pipeline.Workspace)/npm
-            displayName: Add scoped registry to .npmrc
-          - task: npmAuthenticate@0
-            displayName: Authenticate with npm
-            inputs:
-              workingFile: $(Pipeline.Workspace)/npm/.npmrc
-              customEndpoint: 'NPM - Umbraco Backoffice'
-          - script: |
-              # Setup temp npm project to load in defaults from the local .npmrc
-              npm init -y
-
-              # Find the first .tgz file in the current directory and publish it
-              files=( ./*.tgz )
-              npm publish "${files[0]}"
-            displayName: Push to npm
-            workingDirectory: $(Pipeline.Workspace)/npm
-
  - stage: Upload_API_Docs
    pool:
      vmImage: 'windows-latest' # Apparently AzureFileCopy is windows only :(
    variables:
      umbracoMajorVersion: $[ stageDependencies.Build.A.outputs['build.NBGV_VersionMajor'] ]
-    displayName: Upload API Documentation
+    displayName: Upload API Documention
    dependsOn:
      - Build
      - Deploy_NuGet
@@ -858,9 +901,8 @@ stages:
              storage: umbracoapidocs
              ContainerName: '$web'
              BlobPrefix: v$(umbracoMajorVersion)/csharp
-              CleanTargetBeforeCopy: true
      - job:
-        displayName: Upload Storybook
+        displayName: Upload js Docs
        steps:
          - checkout: none
          - task: DownloadPipelineArtifact@2
@@ -873,7 +915,7 @@ stages:
              archiveFilePatterns: $(Build.SourcesDirectory)/ui-docs.zip
              destinationFolder: $(Build.ArtifactStagingDirectory)/ui-docs
          - task: AzureFileCopy@4
-            displayName: 'Copy Storybook to blob storage'
+            displayName: 'Copy UI Docs to blob storage'
            inputs:
              SourcePath: '$(Build.ArtifactStagingDirectory)/ui-docs/*'
              azureSubscription: umbraco-storage
@@ -881,27 +923,3 @@ stages:
              storage: umbracoapidocs
              ContainerName: '$web'
              BlobPrefix: v$(umbracoMajorVersion)/ui
-              CleanTargetBeforeCopy: true
-      - job:
-        displayName: Upload UI API Docs
-        steps:
-          - checkout: none
-          - task: DownloadPipelineArtifact@2
-            displayName: Download artifact
-            inputs:
-              artifact: ui-api-docs
-              path: $(Build.SourcesDirectory)
-          - task: ExtractFiles@1
-            inputs:
-              archiveFilePatterns: $(Build.SourcesDirectory)/ui-api-docs.zip
-              destinationFolder: $(Build.ArtifactStagingDirectory)/ui-api-docs
-          - task: AzureFileCopy@4
-            displayName: 'Copy UI API Docs to blob storage'
-            inputs:
-              SourcePath: '$(Build.ArtifactStagingDirectory)/ui-api-docs/*'
-              azureSubscription: umbraco-storage
-              Destination: AzureBlob
-              storage: umbracoapidocs
-              ContainerName: '$web'
-              BlobPrefix: v$(umbracoMajorVersion)/ui-api
-              CleanTargetBeforeCopy: true
@@ -26,7 +26,7 @@ steps:
    useSameBranch: true
    waitForQueuedBuildsToFinish: false
    storeInEnvironmentVariable: false
-    templateParameters: 'sqlServerIntegrationTests: true, sqlServerAcceptanceTests: true, forceReleaseTestFilter: true, myGetDeploy: true, isNightly: true'
+    templateParameters: 'sqlServerIntegrationTests: true, forceReleaseTestFilter: true, myGetDeploy: true, isNightly: true'
    authenticationMethod: 'OAuth Token'
    enableBuildInQueueCondition: false
    dependentOnSuccessfulBuildCondition: false
@@ -1,31 +0,0 @@
-steps:
-  - task: NodeTool@0
-    displayName: Use Node.js
-    retryCountOnTaskFailure: 3
-    inputs:
-      versionSource: 'fromFile'
-      versionFilePath: src/Umbraco.Web.UI.Client/.nvmrc
-
-  - bash: |
-      echo "##[command]Install nbgv"
-      dotnet tool install --tool-path . nbgv
-      echo "##[command]Running nbgv get-version"
-      PACKAGE_VERSION=$(nbgv get-version -v NpmPackageVersion)
-      echo "##[command]Running npm version"
-      echo "##[debug]Version: $PACKAGE_VERSION"
-      cd src/Umbraco.Web.UI.Client
-      npm version $PACKAGE_VERSION --allow-same-version --no-git-tag-version
-    displayName: Set NPM Version
-
-  - task: Cache@2
-    displayName: Cache node_modules
-    inputs:
-      key: '"npm_client" | "$(Agent.OS)"| $(Build.SourcesDirectory)/src/Umbraco.Web.UI.Client/package-lock.json'
-      restoreKeys: |
-        "npm_client" | "$(Agent.OS)"
-        "npm_client"
-      path: $(npm_config_cache)
-
-  - script: npm ci --no-fund --no-audit --prefer-offline
-    displayName: Run npm ci (Bellissima)
-    workingDirectory: src/Umbraco.Web.UI.Client
@@ -0,0 +1,56 @@
+parameters:
+  - name: projectName
+    type: string
+  - name: umbracoVersion
+    type: string
+  - name: projects
+    type: object
+
+jobs:
+- job: Create_DT_Project
+  displayName: Create Dependency Track Project
+  steps:
+    - checkout: none
+
+    - bash: |
+        project_id=$(curl --no-progress-meter -H "X-Api-Key: $(DT_API_KEY)" "$(DT_API_URL)/v1/project/lookup?name=${{ parameters.projectName }}&version=${{ parameters.umbracoVersion }}" | jq -r '.uuid')
+        if [ "$project_id" != "null" ] && [ -n "$project_id" ]; then
+          echo "Project '${{ parameters.projectName }}' with version '${{ parameters.umbracoVersion }}' already exists (ID: $project_id)."
+        else
+          project_id=$(curl --no-progress-meter \
+            -X PUT "$(DT_API_URL)/v1/project" \
+            -H "X-Api-Key: $(DT_API_KEY)" \
+            -H "Content-Type: application/json" \
+            -d '{"name": "${{ parameters.projectName }}", "version": "${{ parameters.umbracoVersion }}", "collectionLogic": "AGGREGATE_DIRECT_CHILDREN"}' \
+            | jq -r '.uuid')
+          if [ -z "$project_id" ] || [ "$project_id" == "null" ]; then
+            echo "Failed to create project '${{ parameters.projectName }}' version '${{ parameters.umbracoVersion }}'."
+            exit 1
+          fi
+          echo "Created project '${{ parameters.projectName }}' with version '${{ parameters.umbracoVersion }}' (ID: $project_id)."
+        fi
+      displayName: Ensure main project exists in Dependency Track
+
+- ${{ each project in parameters.projects }}:
+  - job:
+    displayName: Upload ${{ project.name }} BOM
+    dependsOn: Create_DT_Project
+    steps:
+      - checkout: none
+
+      - download: current
+        artifact: ${{ project.artifact }}
+        displayName: Download ${{ project.artifact }} artifact
+
+      - script: |
+          curl --no-progress-meter --fail-with-body \
+            -X POST "$(DT_API_URL)/v1/bom" \
+            -H "X-Api-Key: $(DT_API_KEY)" \
+            -H "Content-Type: multipart/form-data" \
+            -F "autoCreate=true" \
+            -F "projectName=${{ parameters.projectName }}-${{ project.name }}" \
+            -F "projectVersion=${{ parameters.umbracoVersion }}" \
+            -F "parentName=${{ parameters.projectName }}" \
+            -F "parentVersion=${{ parameters.umbracoVersion }}" \
+            -F "bom=@$(Pipeline.Workspace)/${{ project.artifact }}/${{ project.bomFilePath }}"
+        displayName: Upload ${{ project.name }} BOM to Dependency Track
@@ -0,0 +1,47 @@
+parameters:
+  - name: nodeVersion
+    type: string
+    default: ''
+
+  - name: npm_config_cache
+    type: string
+    default: ''
+
+  - name: PlaywrightUserEmail
+    type: string
+    default: ''
+
+  - name: PlaywrightPassword
+    type: string
+    default: ''
+
+  - name: ASPNETCORE_URLS
+    type: string
+    default: ''
+
+steps:
+  - task: NodeTool@0
+    displayName: Use Node.js $(nodeVersion)
+    inputs:
+      versionSpec: $(nodeVersion)
+
+  - pwsh: |
+      "UMBRACO_USER_LOGIN=${{ parameters.PlaywrightUserEmail }}
+      UMBRACO_USER_PASSWORD=${{ parameters.PlaywrightPassword }}
+      URL=${{ parameters.ASPNETCORE_URLS }}" | Out-File .env
+    displayName: Generate .env
+    workingDirectory: $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest
+
+  # Cache and restore NPM packages
+  - task: Cache@2
+    displayName: Cache NPM packages
+    inputs:
+      key: 'npm_e2e | "$(Agent.OS)" | $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/package-lock.json'
+      restoreKeys: |
+        npm_e2e | "$(Agent.OS)"
+        npm_e2e
+      path: ${{ parameters.npm_config_cache }}
+
+  - script: npm ci --no-fund --no-audit --prefer-offline
+    workingDirectory: $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest
+    displayName: Restore NPM packages
@@ -1,6 +1,6 @@
 {
  "sdk": {
-    "version": "8.0.100",
+    "version": "8.0.415",
    "rollForward": "latestFeature"
  }
 }
@@ -1,6 +1,5 @@
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
-using Umbraco.Extensions;

 namespace Umbraco.Cms.Api.Common.Builders;

@@ -9,8 +8,6 @@ public class ProblemDetailsBuilder
    private string? _title;
    private string? _detail;
    private string? _type;
-    private string? _operationStatus;
-    private IDictionary<string, object>? _extensions;

    public ProblemDetailsBuilder WithTitle(string title)
    {
@@ -30,45 +27,11 @@ public class ProblemDetailsBuilder
        return this;
    }

-    public ProblemDetailsBuilder WithOperationStatus<TEnum>(TEnum operationStatus)
-        where TEnum : Enum
-    {
-        _operationStatus = operationStatus.ToString();
-        return this;
-    }
-
-    public ProblemDetailsBuilder WithRequestModelErrors(IDictionary<string, string[]> errors)
-        => WithExtension(nameof(HttpValidationProblemDetails.Errors).ToFirstLowerInvariant(), errors);
-
-    public ProblemDetailsBuilder WithExtension(string key, object value)
-    {
-        _extensions ??= new Dictionary<string, object>();
-        _extensions[key] = value;
-        return this;
-    }
-
-    public ProblemDetails Build()
-    {
-        var problemDetails = new ProblemDetails
+    public ProblemDetails Build() =>
+        new()
        {
            Title = _title,
            Detail = _detail,
            Type = _type ?? "Error",
        };
-
-        if (_operationStatus is not null)
-        {
-            problemDetails.Extensions["operationStatus"] = _operationStatus;
-        }
-
-        if (_extensions is not null)
-        {
-            foreach (KeyValuePair<string, object> extension in _extensions)
-            {
-                problemDetails.Extensions[extension.Key] = extension.Value;
-            }
-        }
-
-        return problemDetails;
-    }
 }
@@ -1,15 +0,0 @@
-using Microsoft.Extensions.Options;
-using OpenIddict.Server.AspNetCore;
-using Umbraco.Cms.Core.Configuration.Models;
-
-namespace Umbraco.Cms.Api.Common.Configuration;
-
-internal class ConfigureOpenIddict : IConfigureOptions<OpenIddictServerAspNetCoreOptions>
-{
-    private readonly IOptions<GlobalSettings> _globalSettings;
-
-    public ConfigureOpenIddict(IOptions<GlobalSettings> globalSettings) => _globalSettings = globalSettings;
-
-    public void Configure(OpenIddictServerAspNetCoreOptions options)
-        => options.DisableTransportSecurityRequirement = _globalSettings.Value.UseHttps is false;
-}
@@ -12,22 +12,16 @@ namespace Umbraco.Cms.Api.Common.Configuration;

 public class ConfigureUmbracoSwaggerGenOptions : IConfigureOptions<SwaggerGenOptions>
 {
+    private readonly IOptions<ApiVersioningOptions> _apiVersioningOptions;
    private readonly IOperationIdSelector _operationIdSelector;
    private readonly ISchemaIdSelector _schemaIdSelector;

-    [Obsolete("Use non-obsolete constructor. This will be removed in Umbraco 15.")]
    public ConfigureUmbracoSwaggerGenOptions(
        IOptions<ApiVersioningOptions> apiVersioningOptions,
        IOperationIdSelector operationIdSelector,
        ISchemaIdSelector schemaIdSelector)
-        : this(operationIdSelector, schemaIdSelector)
-    {
-    }
-
-    public ConfigureUmbracoSwaggerGenOptions(
-        IOperationIdSelector operationIdSelector,
-        ISchemaIdSelector schemaIdSelector)
    {
+        _apiVersioningOptions = apiVersioningOptions;
        _operationIdSelector = operationIdSelector;
        _schemaIdSelector = schemaIdSelector;
    }
@@ -40,10 +34,10 @@ public class ConfigureUmbracoSwaggerGenOptions : IConfigureOptions<SwaggerGenOpt
            {
                Title = "Default API",
                Version = "Latest",
-                Description = "All endpoints not defined under specific APIs",
+                Description = "All endpoints not defined under specific APIs"
            });

-        swaggerGenOptions.CustomOperationIds(description => _operationIdSelector.OperationId(description));
+        swaggerGenOptions.CustomOperationIds(description => _operationIdSelector.OperationId(description, _apiVersioningOptions.Value));
        swaggerGenOptions.DocInclusionPredicate((name, api) =>
        {
            if (string.IsNullOrWhiteSpace(api.GroupName))
@@ -1,53 +0,0 @@
-using Microsoft.AspNetCore.Http;
-using OpenIddict.Server;
-using OpenIddict.Validation;
-using Umbraco.Cms.Core;
-using Umbraco.Extensions;
-
-namespace Umbraco.Cms.Api.Common.DependencyInjection;
-
-public class ProcessRequestContextHandler
-    : IOpenIddictServerHandler<OpenIddictServerEvents.ProcessRequestContext>, IOpenIddictValidationHandler<OpenIddictValidationEvents.ProcessRequestContext>
-{
-    private readonly IHttpContextAccessor _httpContextAccessor;
-    private readonly string _backOfficePathSegment;
-
-    public ProcessRequestContextHandler(IHttpContextAccessor httpContextAccessor)
-    {
-        _httpContextAccessor = httpContextAccessor;
-        _backOfficePathSegment = Constants.System.DefaultUmbracoPath.TrimStart(Constants.CharArrays.Tilde)
-            .EnsureStartsWith('/')
-            .EnsureEndsWith('/');
-    }
-
-    public ValueTask HandleAsync(OpenIddictServerEvents.ProcessRequestContext context)
-    {
-        if (SkipOpenIddictHandlingForRequest())
-        {
-            context.SkipRequest();
-        }
-
-        return ValueTask.CompletedTask;
-    }
-
-    public ValueTask HandleAsync(OpenIddictValidationEvents.ProcessRequestContext context)
-    {
-        if (SkipOpenIddictHandlingForRequest())
-        {
-            context.SkipRequest();
-        }
-
-        return ValueTask.CompletedTask;
-    }
-
-    private bool SkipOpenIddictHandlingForRequest()
-    {
-        var requestPath = _httpContextAccessor.HttpContext?.Request.Path.Value;
-        if (requestPath.IsNullOrWhiteSpace())
-        {
-            return false;
-        }
-
-        return requestPath.StartsWith(_backOfficePathSegment) is false;
-    }
-}
@@ -11,18 +11,11 @@ public static class UmbracoBuilderApiExtensions
 {
    public static IUmbracoBuilder AddUmbracoApiOpenApiUI(this IUmbracoBuilder builder)
    {
-        if (builder.Services.Any(x => !x.IsKeyedService && x.ImplementationType == typeof(OperationIdSelector)))
-        {
-            return builder;
-        }
-
        builder.Services.AddSwaggerGen();
        builder.Services.ConfigureOptions<ConfigureUmbracoSwaggerGenOptions>();
        builder.Services.AddSingleton<IUmbracoJsonTypeInfoResolver, UmbracoJsonTypeInfoResolver>();
        builder.Services.AddSingleton<IOperationIdSelector, OperationIdSelector>();
-        builder.Services.AddSingleton<IOperationIdHandler, OperationIdHandler>();
        builder.Services.AddSingleton<ISchemaIdSelector, SchemaIdSelector>();
-        builder.Services.AddSingleton<ISchemaIdHandler, SchemaIdHandler>();
        builder.Services.Configure<UmbracoPipelineOptions>(options => options.AddFilter(new SwaggerRouteTemplatePipelineFilter("UmbracoApiCommon")));

        return builder;
@@ -1,26 +1,23 @@
-using System.Security.Cryptography;
-using Microsoft.Extensions.Configuration;
+using System.Security.Cryptography;
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.IdentityModel.Tokens;
-using OpenIddict.Server;
-using OpenIddict.Validation;
-using Umbraco.Cms.Api.Common.Configuration;
 using Umbraco.Cms.Api.Common.Security;
 using Umbraco.Cms.Core;
-using Umbraco.Cms.Core.Configuration.Models;
 using Umbraco.Cms.Core.DependencyInjection;
-using Umbraco.Cms.Infrastructure.BackgroundJobs.Jobs;
-using Umbraco.Extensions;
+using Umbraco.Cms.Infrastructure.HostedServices;

 namespace Umbraco.Cms.Api.Common.DependencyInjection;

 public static class UmbracoBuilderAuthExtensions
 {
+    private static bool _initialized;
+
    public static IUmbracoBuilder AddUmbracoOpenIddict(this IUmbracoBuilder builder)
    {
-        if (builder.Services.Any(x => !x.IsKeyedService && x.ImplementationType == typeof(OpenIddictCleanupJob)) is false)
+        if (_initialized is false)
        {
            ConfigureOpenIddict(builder);
+            _initialized = true;
        }

        return builder;
@@ -34,19 +31,18 @@ public static class UmbracoBuilderAuthExtensions
            {
                // Enable the authorization and token endpoints.
                // - important: member endpoints MUST be added before backoffice endpoints to ensure that auto-discovery works for members
+                // FIXME: swap paths here so member API is first (see comment above)
                options
                    .SetAuthorizationEndpointUris(
-                        Paths.MemberApi.AuthorizationEndpoint.TrimStart(Constants.CharArrays.ForwardSlash),
-                        Paths.BackOfficeApi.AuthorizationEndpoint.TrimStart(Constants.CharArrays.ForwardSlash))
+                        Paths.MemberApi.AuthorizationEndpoint.TrimStart(Constants.CharArrays.ForwardSlash))
                    .SetTokenEndpointUris(
-                        Paths.MemberApi.TokenEndpoint.TrimStart(Constants.CharArrays.ForwardSlash),
-                        Paths.BackOfficeApi.TokenEndpoint.TrimStart(Constants.CharArrays.ForwardSlash))
+                        Paths.MemberApi.TokenEndpoint.TrimStart(Constants.CharArrays.ForwardSlash))
                    .SetLogoutEndpointUris(
-                        Paths.MemberApi.LogoutEndpoint.TrimStart(Constants.CharArrays.ForwardSlash),
-                        Paths.BackOfficeApi.LogoutEndpoint.TrimStart(Constants.CharArrays.ForwardSlash))
+                        Paths.MemberApi.LogoutEndpoint.TrimStart(Constants.CharArrays.ForwardSlash))
                    .SetRevocationEndpointUris(
-                        Paths.MemberApi.RevokeEndpoint.TrimStart(Constants.CharArrays.ForwardSlash),
-                        Paths.BackOfficeApi.RevokeEndpoint.TrimStart(Constants.CharArrays.ForwardSlash));
+                        Paths.MemberApi.RevokeEndpoint.TrimStart(Constants.CharArrays.ForwardSlash))
+                    .SetUserinfoEndpointUris(
+                        Paths.MemberApi.UserinfoEndpoint.TrimStart(Constants.CharArrays.ForwardSlash));

                // Enable authorization code flow with PKCE
                options
@@ -58,7 +54,8 @@ public static class UmbracoBuilderAuthExtensions
                options
                    .UseAspNetCore()
                    .EnableAuthorizationEndpointPassthrough()
-                    .EnableLogoutEndpointPassthrough();
+                    .EnableLogoutEndpointPassthrough()
+                    .EnableUserinfoEndpointPassthrough();

                // Enable reference tokens
                // - see https://documentation.openiddict.com/configuration/token-storage.html
@@ -66,17 +63,6 @@ public static class UmbracoBuilderAuthExtensions
                    .UseReferenceAccessTokens()
                    .UseReferenceRefreshTokens();

-                // Apply sliding window expiry based on the configured max login lifetime
-                GlobalSettings globalSettings = builder.Config
-                    .GetSection(Constants.Configuration.ConfigGlobal)
-                    .Get<GlobalSettings>() ?? new GlobalSettings();
-                TimeSpan timeOut = globalSettings.TimeOut;
-
-                // Make the access token lifetime 25% of the refresh token lifetime, to help ensure that new access tokens
-                // are obtained by the client before the refresh token expires.
-                options.SetAccessTokenLifetime(new TimeSpan(timeOut.Ticks / 4));
-                options.SetRefreshTokenLifetime(timeOut);
-
                // Use ASP.NET Core Data Protection for tokens instead of JWT.
                // This is more secure, and has the added benefit of having a high throughput
                // but means that all servers (such as in a load balanced setup)
@@ -99,13 +85,6 @@ public static class UmbracoBuilderAuthExtensions
                options
                    .AddEncryptionKey(new SymmetricSecurityKey(RandomNumberGenerator.GetBytes(32))) // generate a cryptographically secure random 256-bits key
                    .AddSigningKey(new RsaSecurityKey(RSA.Create(keySizeInBits: 2048))); // generate RSA key with recommended size of 2048-bits
-
-                // Add custom handler for the "ProcessRequestContext" server event, to stop OpenIddict from handling
-                // every last request to the server (including front-end requests).
-                options.AddEventHandler<OpenIddictServerEvents.ProcessRequestContext>(configuration =>
-                {
-                    configuration.UseSingletonHandler<ProcessRequestContextHandler>().SetOrder(OpenIddict.Server.AspNetCore.OpenIddictServerAspNetCoreHandlers.ResolveRequestUri.Descriptor.Order - 1);
-                });
            })

            // Register the OpenIddict validation components.
@@ -123,16 +102,8 @@ public static class UmbracoBuilderAuthExtensions

                // Use ASP.NET Core Data Protection for tokens instead of JWT. (see note in AddServer)
                options.UseDataProtection();
-
-                // Add custom handler for the "ProcessRequestContext" validation event, to stop OpenIddict from handling
-                // every last request to the server (including front-end requests).
-                options.AddEventHandler<OpenIddictValidationEvents.ProcessRequestContext>(configuration =>
-                {
-                    configuration.UseSingletonHandler<ProcessRequestContextHandler>().SetOrder(OpenIddict.Validation.AspNetCore.OpenIddictValidationAspNetCoreHandlers.ResolveRequestUri.Descriptor.Order - 1);
-                });
            });

-        builder.Services.AddRecurringBackgroundJob<OpenIddictCleanupJob>();
-        builder.Services.ConfigureOptions<ConfigureOpenIddict>();
+        builder.Services.AddHostedService<OpenIddictCleanup>();
    }
 }
@@ -1,50 +0,0 @@
-using Microsoft.AspNetCore.Http;
-using Microsoft.AspNetCore.Mvc;
-using Microsoft.AspNetCore.Mvc.Routing;
-using Microsoft.Extensions.DependencyInjection;
-using Umbraco.Cms.Core;
-
-namespace Umbraco.Cms.Api.Common.Mvc.ActionResults;
-
-/// <summary>
-/// A "created at" action result with no response body.
-/// </summary>
-public sealed class EmptyCreatedAtActionResult : ActionResult
-{
-    private readonly string _actionName;
-    private readonly string _controllerName;
-    private readonly object _routeValues;
-    private readonly string _resourceIdentifier;
-
-    public EmptyCreatedAtActionResult(string actionName, string controllerName, object routeValues, string resourceIdentifier)
-    {
-        _actionName = actionName;
-        _controllerName = controllerName;
-        _routeValues = routeValues;
-        _resourceIdentifier = resourceIdentifier;
-    }
-
-    public override void ExecuteResult(ActionContext context)
-    {
-        ArgumentNullException.ThrowIfNull(context);
-
-        HttpRequest request = context.HttpContext.Request;
-        IUrlHelper urlHelper = context.HttpContext.RequestServices.GetRequiredService<IUrlHelperFactory>().GetUrlHelper(context);
-
-        var url = urlHelper.Action(
-            _actionName,
-            _controllerName,
-            _routeValues,
-            request.Scheme,
-            request.Host.ToUriComponent());
-
-        if (string.IsNullOrEmpty(url))
-        {
-            throw new InvalidOperationException("No routes could be found that matched the provided route components");
-        }
-
-        context.HttpContext.Response.StatusCode = StatusCodes.Status201Created;
-        context.HttpContext.Response.Headers.Location = url;
-        context.HttpContext.Response.Headers[Constants.Headers.GeneratedResource] = _resourceIdentifier;
-    }
-}
@@ -1,11 +0,0 @@
-namespace Umbraco.Cms.Api.Common.OpenApi;
-
-/// <summary>
-/// Marker interface that ensure the type have a "$type" discriminator in the open api schema.
-/// </summary>
-/// <remarks>
-/// This is required when an endpoint can receive different types, to ensure the correct type is deserialized.
-/// </remarks>
-public interface IOpenApiDiscriminator
-{
-}
@@ -1,10 +0,0 @@
-using Microsoft.AspNetCore.Mvc.ApiExplorer;
-
-namespace Umbraco.Cms.Api.Common.OpenApi;
-
-public interface IOperationIdHandler
-{
-     bool CanHandle(ApiDescription apiDescription);
-
-     string Handle(ApiDescription apiDescription);
-}
@@ -5,8 +5,5 @@ namespace Umbraco.Cms.Api.Common.OpenApi;

 public interface IOperationIdSelector
 {
-    [Obsolete("Use overload that only takes ApiDescription instead. This will be removed in Umbraco 15.")]
    string? OperationId(ApiDescription apiDescription, ApiVersioningOptions apiVersioningOptions);
-
-    string? OperationId(ApiDescription apiDescription);
 }
@@ -1,8 +0,0 @@
-namespace Umbraco.Cms.Api.Common.OpenApi;
-
-public interface ISchemaIdHandler
-{
-    bool CanHandle(Type type);
-
-    string Handle(Type type);
-}
@@ -1,94 +0,0 @@
-using Asp.Versioning;
-using Microsoft.AspNetCore.Mvc.ApiExplorer;
-using Microsoft.AspNetCore.Mvc.Controllers;
-using Microsoft.Extensions.Options;
-using Umbraco.Extensions;
-
-namespace Umbraco.Cms.Api.Common.OpenApi;
-
-// NOTE: Left unsealed on purpose, so it is extendable.
-public class OperationIdHandler : IOperationIdHandler
-{
-    private readonly ApiVersioningOptions _apiVersioningOptions;
-
-    public OperationIdHandler(IOptions<ApiVersioningOptions> apiVersioningOptions)
-        => _apiVersioningOptions = apiVersioningOptions.Value;
-
-    public bool CanHandle(ApiDescription apiDescription)
-    {
-        if (apiDescription.ActionDescriptor is not ControllerActionDescriptor controllerActionDescriptor)
-        {
-            return false;
-        }
-
-        return CanHandle(apiDescription, controllerActionDescriptor);
-    }
-
-    protected virtual bool CanHandle(ApiDescription apiDescription, ControllerActionDescriptor controllerActionDescriptor)
-        => controllerActionDescriptor.ControllerTypeInfo.Namespace?.StartsWith("Umbraco.Cms.Api") is true;
-
-    public virtual string Handle(ApiDescription apiDescription)
-        => UmbracoOperationId(apiDescription);
-
-    /// <summary>
-    ///     Generates a unique operation identifier for a given API following Umbraco's operation id naming conventions.
-    /// </summary>
-    protected string UmbracoOperationId(ApiDescription apiDescription)
-    {
-        if (apiDescription.ActionDescriptor is not ControllerActionDescriptor controllerActionDescriptor)
-        {
-            throw new ArgumentException($"This handler operates only on {nameof(ControllerActionDescriptor)}.");
-        }
-
-        ApiVersion defaultVersion = _apiVersioningOptions.DefaultApiVersion;
-        var httpMethod = apiDescription.HttpMethod?.ToLower().ToFirstUpper() ?? "Get";
-
-        // if the route info "Name" is supplied we'll use this explicitly as the operation ID
-        // - usage example: [HttpGet("my-api/route}", Name = "MyCustomRoute")]
-        if (string.IsNullOrWhiteSpace(apiDescription.ActionDescriptor.AttributeRouteInfo?.Name) == false)
-        {
-            var explicitOperationId = apiDescription.ActionDescriptor.AttributeRouteInfo!.Name;
-            return explicitOperationId.InvariantStartsWith(httpMethod)
-                ? explicitOperationId
-                : $"{httpMethod}{explicitOperationId}";
-        }
-
-        var relativePath = apiDescription.RelativePath;
-
-        if (string.IsNullOrWhiteSpace(relativePath))
-        {
-            throw new InvalidOperationException(
-                $"There is no relative path for controller action {apiDescription.ActionDescriptor.RouteValues["controller"]}");
-        }
-
-        // Remove the prefixed base path with version, e.g. /umbraco/management/api/v1/tracked-reference/{id} => tracked-reference/{id}
-        var unprefixedRelativePath = OperationIdRegexes
-            .VersionPrefixRegex()
-            .Replace(relativePath, string.Empty);
-
-        // Remove template placeholders, e.g. tracked-reference/{id} => tracked-reference/Id
-        var formattedOperationId = OperationIdRegexes
-            .TemplatePlaceholdersRegex()
-            .Replace(unprefixedRelativePath, m => $"By{m.Groups[1].Value.ToFirstUpper()}");
-
-        // Remove dashes (-) and slashes (/) and convert the following letter to uppercase with
-        // the word "By" in front, e.g. tracked-reference/Id => TrackedReferenceById
-        formattedOperationId = OperationIdRegexes
-            .ToCamelCaseRegex()
-            .Replace(formattedOperationId, m => m.Groups[1].Value.ToUpper());
-
-        // Get map to version attribute
-        string? version = null;
-
-        var versionAttributeValue = controllerActionDescriptor.MethodInfo.GetMapToApiVersionAttributeValue();
-
-        // We only want to add a version, if it is not the default one.
-        if (string.Equals(versionAttributeValue, defaultVersion.ToString()) == false)
-        {
-            version = versionAttributeValue;
-        }
-
-        // Return the operation ID with the formatted http method verb in front, e.g. GetTrackedReferenceById
-        return $"{httpMethod}{formattedOperationId.ToFirstUpper()}{version}";
-    }
-}
@@ -1,27 +1,79 @@
 using Asp.Versioning;
 using Microsoft.AspNetCore.Mvc.ApiExplorer;
+using Microsoft.AspNetCore.Mvc.Controllers;
+using Umbraco.Extensions;

 namespace Umbraco.Cms.Api.Common.OpenApi;

 public class OperationIdSelector : IOperationIdSelector
 {
-    private readonly IEnumerable<IOperationIdHandler> _operationIdHandlers;
-
-    [Obsolete("Use non-obsolete constructor. This will be removed in Umbraco 15.")]
-    public OperationIdSelector()
-        : this(Enumerable.Empty<IOperationIdHandler>())
+    public virtual string? OperationId(ApiDescription apiDescription, ApiVersioningOptions apiVersioningOptions)
    {
+        if (apiDescription.ActionDescriptor is not ControllerActionDescriptor controllerActionDescriptor
+            || controllerActionDescriptor.ControllerTypeInfo.Namespace?.StartsWith("Umbraco.Cms.Api") is not true)
+        {
+            return null;
+        }
+
+        return UmbracoOperationId(apiDescription, apiVersioningOptions);
    }

-    public OperationIdSelector(IEnumerable<IOperationIdHandler> operationIdHandlers)
-        => _operationIdHandlers = operationIdHandlers;
-
-    [Obsolete("Use overload that only takes ApiDescription instead. This will be removed in Umbraco 15.")]
-    public virtual string? OperationId(ApiDescription apiDescription, ApiVersioningOptions apiVersioningOptions) => OperationId(apiDescription);
-
-    public virtual string? OperationId(ApiDescription apiDescription)
+    protected string? UmbracoOperationId(ApiDescription apiDescription, ApiVersioningOptions apiVersioningOptions)
    {
-        IOperationIdHandler? handler = _operationIdHandlers.FirstOrDefault(h => h.CanHandle(apiDescription));
-        return handler?.Handle(apiDescription);
+        if (apiDescription.ActionDescriptor is not ControllerActionDescriptor controllerActionDescriptor)
+        {
+            return null;
+        }
+
+        ApiVersion defaultVersion = apiVersioningOptions.DefaultApiVersion;
+        var httpMethod = apiDescription.HttpMethod?.ToLower().ToFirstUpper() ?? "Get";
+
+        // if the route info "Name" is supplied we'll use this explicitly as the operation ID
+        // - usage example: [HttpGet("my-api/route}", Name = "MyCustomRoute")]
+        if (string.IsNullOrWhiteSpace(apiDescription.ActionDescriptor.AttributeRouteInfo?.Name) == false)
+        {
+            var explicitOperationId = apiDescription.ActionDescriptor.AttributeRouteInfo!.Name;
+            return explicitOperationId.InvariantStartsWith(httpMethod)
+                ? explicitOperationId
+                : $"{httpMethod}{explicitOperationId}";
+        }
+
+        var relativePath = apiDescription.RelativePath;
+
+        if (string.IsNullOrWhiteSpace(relativePath))
+        {
+            throw new Exception(
+                $"There is no relative path for controller action {apiDescription.ActionDescriptor.RouteValues["controller"]}");
+        }
+
+        // Remove the prefixed base path with version, e.g. /umbraco/management/api/v1/tracked-reference/{id} => tracked-reference/{id}
+        var unprefixedRelativePath = OperationIdRegexes
+            .VersionPrefixRegex()
+            .Replace(relativePath, string.Empty);
+
+        // Remove template placeholders, e.g. tracked-reference/{id} => tracked-reference/Id
+        var formattedOperationId = OperationIdRegexes
+            .TemplatePlaceholdersRegex()
+            .Replace(unprefixedRelativePath, m => $"By{m.Groups[1].Value.ToFirstUpper()}");
+
+        // Remove dashes (-) and slashes (/) and convert the following letter to uppercase with
+        // the word "By" in front, e.g. tracked-reference/Id => TrackedReferenceById
+        formattedOperationId = OperationIdRegexes
+            .ToCamelCaseRegex()
+            .Replace(formattedOperationId, m => m.Groups[1].Value.ToUpper());
+
+        //Get map to version attribute
+        string? version = null;
+
+        var versionAttributeValue = controllerActionDescriptor.MethodInfo.GetMapToApiVersionAttributeValue();
+
+        // We only wanna add a version, if it is not the default one.
+        if (string.Equals(versionAttributeValue, defaultVersion.ToString()) == false)
+        {
+            version = versionAttributeValue;
+        }
+
+        // Return the operation ID with the formatted http method verb in front, e.g. GetTrackedReferenceById
+        return $"{httpMethod}{formattedOperationId.ToFirstUpper()}{version}";
    }
 }
@@ -1,51 +0,0 @@
-using System.Text.RegularExpressions;
-using Umbraco.Extensions;
-
-namespace Umbraco.Cms.Api.Common.OpenApi;
-
-// NOTE: Left unsealed on purpose, so it is extendable.
-public class SchemaIdHandler : ISchemaIdHandler
-{
-    public virtual bool CanHandle(Type type)
-        => type.Namespace?.StartsWith("Umbraco.Cms") is true;
-
-    public virtual string Handle(Type type)
-        => UmbracoSchemaId(type);
-
-    /// <summary>
-    ///     Generates a sanitized and consistent schema identifier for a given type following Umbraco's schema id naming conventions.
-    /// </summary>
-    protected string UmbracoSchemaId(Type type)
-    {
-        var name = SanitizedTypeName(type);
-
-        name = HandleGenerics(name, type);
-
-        if (name.EndsWith("Model") == false)
-        {
-            // because some models names clash with common classes in TypeScript (i.e. Document),
-            // we need to add a "Model" postfix to all models
-            name = $"{name}Model";
-        }
-
-        // make absolutely sure we don't pass any invalid named by removing all non-word chars
-        return Regex.Replace(name, @"[^\w]", string.Empty);
-    }
-
-    private string SanitizedTypeName(Type t) => t.Name
-        // first grab the "non-generic" part of any generic type name (i.e. "PagedViewModel`1" becomes "PagedViewModel")
-        .Split('`').First()
-        // then remove the "ViewModel" postfix from type names
-        .TrimEnd("ViewModel");
-
-    private string HandleGenerics(string name, Type type)
-    {
-        if (!type.IsGenericType)
-        {
-            return name;
-        }
-
-        // use attribute custom name or append the generic type names, ultimately turning i.e. "PagedViewModel<RelationItemViewModel>" into "PagedRelationItem"
-        return $"{name}{string.Join(string.Empty, type.GenericTypeArguments.Select(SanitizedTypeName))}";
-    }
-}
@@ -1,15 +1,36 @@
-namespace Umbraco.Cms.Api.Common.OpenApi;
+using System.Text.RegularExpressions;
+using Umbraco.Extensions;
+
+namespace Umbraco.Cms.Api.Common.OpenApi;

 public class SchemaIdSelector : ISchemaIdSelector
 {
-    private readonly IEnumerable<ISchemaIdHandler> _schemaIdHandlers;
-
-    public SchemaIdSelector(IEnumerable<ISchemaIdHandler> schemaIdHandlers)
-        => _schemaIdHandlers = schemaIdHandlers;
-
    public virtual string SchemaId(Type type)
+        => type.Namespace?.StartsWith("Umbraco.Cms") is true ? UmbracoSchemaId(type) : type.Name;
+
+    protected string UmbracoSchemaId(Type type)
    {
-        ISchemaIdHandler? handler = _schemaIdHandlers.FirstOrDefault(h => h.CanHandle(type));
-        return handler?.Handle(type) ?? type.Name;
+        string SanitizedTypeName(Type t) => t.Name
+            // first grab the "non generic" part of any generic type name (i.e. "PagedViewModel`1" becomes "PagedViewModel")
+            .Split('`').First()
+            // then remove the "ViewModel" postfix from type names
+            .TrimEnd("ViewModel");
+
+        var name = SanitizedTypeName(type);
+        if (type.IsGenericType)
+        {
+            // append the generic type names, ultimately turning i.e. "PagedViewModel<RelationItemViewModel>" into "PagedRelationItem"
+            name = $"{name}{string.Join(string.Empty, type.GenericTypeArguments.Select(SanitizedTypeName))}";
+        }
+
+        if (name.EndsWith("Model") == false)
+        {
+            // because some models names clash with common classes in TypeScript (i.e. Document),
+            // we need to add a "Model" postfix to all models
+            name = $"{name}Model";
+        }
+
+        // make absolutely sure we don't pass any invalid named by removing all non-word chars
+        return Regex.Replace(name, @"[^\w]", string.Empty);
    }
 }
@@ -62,11 +62,6 @@ public class SwaggerRouteTemplatePipelineFilter : UmbracoPipelineFilter
            swaggerUiOptions.SwaggerEndpoint($"{name}/swagger.json", $"{apiInfo.Title}");
        }

-        // Add custom configuration from https://swagger.io/docs/open-source-tools/swagger-ui/usage/configuration/
-        swaggerUiOptions.ConfigObject.PersistAuthorization = true; // persists authorization data so it would not be lost on browser close/refresh
-        swaggerUiOptions.ConfigObject.Filter = string.Empty; // Enable the filter with an empty string as default filter.
-
-        swaggerUiOptions.OAuthClientId(Constants.OAuthClientIds.Swagger);
        swaggerUiOptions.OAuthUsePkce();
    }

@@ -1,24 +1,7 @@
-using Umbraco.Cms.Core;
-
-namespace Umbraco.Cms.Api.Common.Security;
+namespace Umbraco.Cms.Api.Common.Security;

 public static class Paths
 {
-    public static class BackOfficeApi
-    {
-        public const string EndpointTemplate = "security/back-office";
-
-        public static readonly string AuthorizationEndpoint = EndpointPath($"{EndpointTemplate}/authorize");
-
-        public static readonly string TokenEndpoint = EndpointPath($"{EndpointTemplate}/token");
-
-        public static readonly string LogoutEndpoint = EndpointPath($"{EndpointTemplate}/signout");
-
-        public static readonly string RevokeEndpoint = EndpointPath($"{EndpointTemplate}/revoke");
-
-        private static string EndpointPath(string relativePath) => $"/umbraco{Constants.Web.ManagementApiPath}v1/{relativePath}";
-    }
-
    public static class MemberApi
    {
        public const string EndpointTemplate = "security/member";
@@ -31,6 +14,8 @@ public static class Paths

        public static readonly string RevokeEndpoint = EndpointPath($"{EndpointTemplate}/revoke");

+        public static readonly string UserinfoEndpoint = EndpointPath($"{EndpointTemplate}/userinfo");
+
        // NOTE: we're NOT using /api/v1.0/ here because it will clash with the Delivery API docs
        private static string EndpointPath(string relativePath) => $"/umbraco/delivery/api/v1/{relativePath}";
    }
@@ -5,6 +5,4 @@ namespace Umbraco.Cms.Api.Common.Serialization;
 public interface IUmbracoJsonTypeInfoResolver : IJsonTypeInfoResolver
 {
    IEnumerable<Type> FindSubTypes(Type type);
-
-    string? GetTypeDiscriminatorValue(Type type);
 }
@@ -1,10 +1,7 @@
 using System.Collections.Concurrent;
 using System.Text.Json;
-using System.Text.Json.Serialization;
 using System.Text.Json.Serialization.Metadata;
-using Umbraco.Cms.Api.Common.OpenApi;
 using Umbraco.Cms.Core.Composing;
-using Umbraco.Extensions;

 namespace Umbraco.Cms.Api.Common.Serialization;

@@ -14,60 +11,51 @@ public sealed class UmbracoJsonTypeInfoResolver : DefaultJsonTypeInfoResolver, I
    private readonly ConcurrentDictionary<Type, ISet<Type>> _subTypesCache = new ConcurrentDictionary<Type, ISet<Type>>();

    public UmbracoJsonTypeInfoResolver(ITypeFinder typeFinder)
-        => _typeFinder = typeFinder;
+    {
+        _typeFinder = typeFinder;
+    }

    public IEnumerable<Type> FindSubTypes(Type type)
    {
-        JsonDerivedTypeAttribute[] explicitJsonDerivedTypes = type
-            .GetCustomAttributes<JsonDerivedTypeAttribute>(false)
-            .ToArray();
-        if (explicitJsonDerivedTypes.Any())
-        {
-            return explicitJsonDerivedTypes.Select(a => a.DerivedType);
-        }
-
-        if (type.IsInterface is false)
-        {
-            // IMPORTANT: do NOT return an empty enumerable here. it will cause nullability to fail on reference
-            //            properties, because "$ref" does not mix and match well with "nullable" in OpenAPI.
-            //            see also https://github.com/OAI/OpenAPI-Specification/issues/1368
-            return new[] { type };
-        }
-
        if (_subTypesCache.TryGetValue(type, out ISet<Type>? cachedResult))
        {
            return cachedResult;
        }

-        var result = _typeFinder.FindClassesOfType(type).OrderBy(x => x.Name).ToHashSet();
+        var result = _typeFinder.FindClassesOfType(type).ToHashSet();
        _subTypesCache.TryAdd(type, result);
        return result;
    }

-    public string? GetTypeDiscriminatorValue(Type type)
-    {
-        JsonDerivedTypeAttribute? jsonDerivedTypeAttribute = type
-            .GetBaseTypes(false)
-            .WhereNotNull()
-            .SelectMany(baseType => baseType.GetCustomAttributes<JsonDerivedTypeAttribute>(false))
-            .FirstOrDefault(attr => attr.DerivedType == type);
-
-        if (jsonDerivedTypeAttribute is not null)
-        {
-            // IMPORTANT: do NOT perform fallback to type.Name here - it will work for the schema generation,
-            //            but not for the actual serialization, and then it's only going to cause confusion.
-            return jsonDerivedTypeAttribute.TypeDiscriminator?.ToString();
-        }
-
-        return typeof(IOpenApiDiscriminator).IsAssignableFrom(type) ? type.Name : null;
-    }
-
    public override JsonTypeInfo GetTypeInfo(Type type, JsonSerializerOptions options)
    {
        JsonTypeInfo result = base.GetTypeInfo(type, options);
-        return type.IsInterface
-            ? GetTypeInfoForInterface(result, type, options)
-            : result;
+
+        if (type.IsInterface)
+        {
+            return GetTypeInfoForInterface(result, type, options);
+        }
+        else
+        {
+            return GetTypeInfoForClass(result, type, options);
+        }
+
+    }
+
+    private JsonTypeInfo GetTypeInfoForClass(JsonTypeInfo result, Type type, JsonSerializerOptions options)
+    {
+        if (result.Kind != JsonTypeInfoKind.Object || !type.GetInterfaces().Any())
+        {
+            return result;
+        }
+
+        JsonPolymorphismOptions jsonPolymorphismOptions = result.PolymorphismOptions ?? new JsonPolymorphismOptions();
+
+        jsonPolymorphismOptions.DerivedTypes.Add(new JsonDerivedType(type, type.Name));
+
+        result.PolymorphismOptions = jsonPolymorphismOptions;
+
+        return result;
    }

    private JsonTypeInfo GetTypeInfoForInterface(JsonTypeInfo result, Type type, JsonSerializerOptions options)
@@ -9,16 +9,19 @@
  </ItemGroup>

  <ItemGroup>
-    <PackageReference Include="Asp.Versioning.Mvc "/>
-    <PackageReference Include="Asp.Versioning.Mvc.ApiExplorer" />
    <PackageReference Include="Swashbuckle.AspNetCore" />
    <PackageReference Include="OpenIddict.Abstractions" />
    <PackageReference Include="OpenIddict.AspNetCore" />
+
+    <!-- Both OpenIddict.AspNetCore, Npoco.SqlServer and Microsoft.EntityFrameworkCore.SqlServer bring in a vulnerable version of Microsoft.IdentityModel.JsonWebTokens -->
+    <PackageReference Include="Microsoft.IdentityModel.JsonWebTokens"/>
+
+    <!-- Take top-level depedendency on OpenIddict.AspNetCore depends on a vulnerable version -->
+    <PackageReference Include="Microsoft.Extensions.Caching.Memory" />
  </ItemGroup>

  <ItemGroup>
    <ProjectReference Include="..\Umbraco.Core\Umbraco.Core.csproj" />
    <ProjectReference Include="..\Umbraco.Web.Common\Umbraco.Web.Common.csproj" />
-
  </ItemGroup>
 </Project>
@@ -1,5 +1,6 @@
-using Microsoft.AspNetCore.OutputCaching;
+using Microsoft.AspNetCore.OutputCaching;
 using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Primitives;
 using Umbraco.Cms.Core.DeliveryApi;

 namespace Umbraco.Cms.Api.Delivery.Caching;
@@ -7,9 +8,13 @@ namespace Umbraco.Cms.Api.Delivery.Caching;
 internal sealed class DeliveryApiOutputCachePolicy : IOutputCachePolicy
 {
    private readonly TimeSpan _duration;
+    private readonly StringValues _varyByHeaderNames;

-    public DeliveryApiOutputCachePolicy(TimeSpan duration)
-        => _duration = duration;
+    public DeliveryApiOutputCachePolicy(TimeSpan duration, StringValues varyByHeaderNames)
+    {
+        _duration = duration;
+        _varyByHeaderNames = varyByHeaderNames;
+    }

    ValueTask IOutputCachePolicy.CacheRequestAsync(OutputCacheContext context, CancellationToken cancellationToken)
    {
@@ -18,8 +23,14 @@ internal sealed class DeliveryApiOutputCachePolicy : IOutputCachePolicy
            .RequestServices
            .GetRequiredService<IRequestPreviewService>();

-        context.EnableOutputCaching = requestPreviewService.IsPreview() is false;
+        IApiAccessService apiAccessService = context
+            .HttpContext
+            .RequestServices
+            .GetRequiredService<IApiAccessService>();
+
+        context.EnableOutputCaching = requestPreviewService.IsPreview() is false && apiAccessService.HasPublicAccess();
        context.ResponseExpirationTimeSpan = _duration;
+        context.CacheVaryByRules.HeaderNames = _varyByHeaderNames;

        return ValueTask.CompletedTask;
    }
@@ -1,9 +1,12 @@
 using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Core.DeliveryApi;
+using Umbraco.Cms.Core.DependencyInjection;
 using Umbraco.Cms.Core.Models.DeliveryApi;
 using Umbraco.Cms.Core.Models.PublishedContent;
+using Umbraco.Cms.Core.Services;

 namespace Umbraco.Cms.Api.Delivery.Controllers.Content;

@@ -13,6 +16,32 @@ public class ByIdContentApiController : ContentApiItemControllerBase
 {
    private readonly IRequestMemberAccessService _requestMemberAccessService;

+    [Obsolete($"Please use the constructor that does not accept {nameof(IPublicAccessService)}. Will be removed in V14.")]
+    public ByIdContentApiController(
+        IApiPublishedContentCache apiPublishedContentCache,
+        IApiContentResponseBuilder apiContentResponseBuilder,
+        IPublicAccessService publicAccessService)
+        : this(
+            apiPublishedContentCache,
+            apiContentResponseBuilder,
+            StaticServiceProvider.Instance.GetRequiredService<IRequestMemberAccessService>())
+    {
+    }
+
+    [Obsolete($"Please use the constructor that does not accept {nameof(IPublicAccessService)}. Will be removed in V14.")]
+    public ByIdContentApiController(
+        IApiPublishedContentCache apiPublishedContentCache,
+        IApiContentResponseBuilder apiContentResponseBuilder,
+        IPublicAccessService publicAccessService,
+        IRequestMemberAccessService requestMemberAccessService)
+        : this(
+            apiPublishedContentCache,
+            apiContentResponseBuilder,
+            requestMemberAccessService)
+    {
+    }
+
+    [ActivatorUtilitiesConstructor]
    public ByIdContentApiController(
        IApiPublishedContentCache apiPublishedContentCache,
        IApiContentResponseBuilder apiContentResponseBuilder,
@@ -1,9 +1,12 @@
 using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Core.DeliveryApi;
+using Umbraco.Cms.Core.DependencyInjection;
 using Umbraco.Cms.Core.Models.DeliveryApi;
 using Umbraco.Cms.Core.Models.PublishedContent;
+using Umbraco.Cms.Core.Services;
 using Umbraco.Extensions;

 namespace Umbraco.Cms.Api.Delivery.Controllers.Content;
@@ -14,6 +17,32 @@ public class ByIdsContentApiController : ContentApiItemControllerBase
 {
    private readonly IRequestMemberAccessService _requestMemberAccessService;

+    [Obsolete($"Please use the constructor that does not accept {nameof(IPublicAccessService)}. Will be removed in V14.")]
+    public ByIdsContentApiController(
+        IApiPublishedContentCache apiPublishedContentCache,
+        IApiContentResponseBuilder apiContentResponseBuilder,
+        IPublicAccessService publicAccessService)
+        : this(
+            apiPublishedContentCache,
+            apiContentResponseBuilder,
+            StaticServiceProvider.Instance.GetRequiredService<IRequestMemberAccessService>())
+    {
+    }
+
+    [Obsolete($"Please use the constructor that does not accept {nameof(IPublicAccessService)}. Will be removed in V14.")]
+    public ByIdsContentApiController(
+        IApiPublishedContentCache apiPublishedContentCache,
+        IApiContentResponseBuilder apiContentResponseBuilder,
+        IPublicAccessService publicAccessService,
+        IRequestMemberAccessService requestMemberAccessService)
+        : this(
+            apiPublishedContentCache,
+            apiContentResponseBuilder,
+            requestMemberAccessService)
+    {
+    }
+
+    [ActivatorUtilitiesConstructor]
    public ByIdsContentApiController(
        IApiPublishedContentCache apiPublishedContentCache,
        IApiContentResponseBuilder apiContentResponseBuilder,
@@ -19,7 +19,44 @@ public class ByRouteContentApiController : ContentApiItemControllerBase
    private readonly IRequestRedirectService _requestRedirectService;
    private readonly IRequestPreviewService _requestPreviewService;
    private readonly IRequestMemberAccessService _requestMemberAccessService;
-    private const string PreviewContentRequestPathPrefix = $"/{Constants.DeliveryApi.Routing.PreviewContentPathPrefix}";
+    private const string PreviewContentRequestPathPrefix = $"/{Umbraco.Cms.Core.Constants.DeliveryApi.Routing.PreviewContentPathPrefix}";
+
+    [Obsolete($"Please use the constructor that does not accept {nameof(IPublicAccessService)}. Will be removed in V14.")]
+    public ByRouteContentApiController(
+        IApiPublishedContentCache apiPublishedContentCache,
+        IApiContentResponseBuilder apiContentResponseBuilder,
+        IPublicAccessService publicAccessService,
+        IRequestRoutingService requestRoutingService,
+        IRequestRedirectService requestRedirectService,
+        IRequestPreviewService requestPreviewService)
+        : this(
+            apiPublishedContentCache,
+            apiContentResponseBuilder,
+            requestRoutingService,
+            requestRedirectService,
+            requestPreviewService,
+            StaticServiceProvider.Instance.GetRequiredService<IRequestMemberAccessService>())
+    {
+    }
+
+    [Obsolete($"Please use the constructor that does not accept {nameof(IPublicAccessService)}. Will be removed in V14.")]
+    public ByRouteContentApiController(
+        IApiPublishedContentCache apiPublishedContentCache,
+        IApiContentResponseBuilder apiContentResponseBuilder,
+        IPublicAccessService publicAccessService,
+        IRequestRoutingService requestRoutingService,
+        IRequestRedirectService requestRedirectService,
+        IRequestPreviewService requestPreviewService,
+        IRequestMemberAccessService requestMemberAccessService)
+        : this(
+            apiPublishedContentCache,
+            apiContentResponseBuilder,
+            requestRoutingService,
+            requestRedirectService,
+            requestPreviewService,
+            requestMemberAccessService)
+    {
+    }

    [Obsolete($"Please use the constructor that accepts {nameof(IApiContentPathResolver)}. Will be removed in V15.")]
    public ByRouteContentApiController(
@@ -108,6 +145,11 @@ public class ByRouteContentApiController : ContentApiItemControllerBase
        path = DecodePath(path);
        path = path.Length == 0 ? "/" : path;

+        if (_apiContentPathResolver.IsResolvablePath(path) is false)
+        {
+            return NotFound();
+        }
+
        IPublishedContent? contentItem = GetContent(path);
        if (contentItem is not null)
        {
@@ -15,6 +15,7 @@ namespace Umbraco.Cms.Api.Delivery.Controllers.Content;
 [ApiExplorerSettings(GroupName = "Content")]
 [LocalizeFromAcceptLanguageHeader]
 [ValidateStartItem]
+[AddVaryHeader]
 [OutputCache(PolicyName = Constants.DeliveryApi.OutputCache.ContentCachePolicy)]
 public abstract class ContentApiControllerBase : DeliveryApiControllerBase
 {
@@ -1,18 +1,35 @@
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Core.DeliveryApi;
+using Umbraco.Cms.Core.DependencyInjection;
 using Umbraco.Cms.Core.Models.PublishedContent;
 using Umbraco.Cms.Core.Security;
+using Umbraco.Cms.Core.Services;

 namespace Umbraco.Cms.Api.Delivery.Controllers.Content;

 public abstract class ContentApiItemControllerBase : ContentApiControllerBase
 {
+    // TODO: Remove this in V14 when the obsolete constructors have been removed
+    private readonly IPublicAccessService _publicAccessService;
+
+    [Obsolete($"Please use the constructor that does not accept {nameof(IPublicAccessService)}. Will be removed in V14.")]
+    protected ContentApiItemControllerBase(
+        IApiPublishedContentCache apiPublishedContentCache,
+        IApiContentResponseBuilder apiContentResponseBuilder,
+        IPublicAccessService publicAccessService)
+        : this(apiPublishedContentCache, apiContentResponseBuilder)
+    {
+    }
+
    protected ContentApiItemControllerBase(
        IApiPublishedContentCache apiPublishedContentCache,
        IApiContentResponseBuilder apiContentResponseBuilder)
        : base(apiPublishedContentCache, apiContentResponseBuilder)
-    {
-    }
+        => _publicAccessService = StaticServiceProvider.Instance.GetRequiredService<IPublicAccessService>();
+
+    [Obsolete($"Please use {nameof(IPublicAccessService)} to test for content protection. Will be removed in V14.")]
+    protected bool IsProtected(IPublishedContent content) => _publicAccessService.IsProtected(content.Path);

    protected async Task<IActionResult?> HandleMemberAccessAsync(IPublishedContent contentItem, IRequestMemberAccessService requestMemberAccessService)
    {
@@ -1,9 +1,11 @@
 using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Api.Common.ViewModels.Pagination;
 using Umbraco.Cms.Core;
 using Umbraco.Cms.Core.DeliveryApi;
+using Umbraco.Cms.Core.DependencyInjection;
 using Umbraco.Cms.Core.Models;
 using Umbraco.Cms.Core.Models.DeliveryApi;
 using Umbraco.Cms.Core.Models.PublishedContent;
@@ -19,6 +21,20 @@ public class QueryContentApiController : ContentApiControllerBase
    private readonly IRequestMemberAccessService _requestMemberAccessService;
    private readonly IApiContentQueryService _apiContentQueryService;

+    [Obsolete($"Please use the constructor that accepts {nameof(IRequestMemberAccessService)}. Will be removed in V14.")]
+    public QueryContentApiController(
+        IApiPublishedContentCache apiPublishedContentCache,
+        IApiContentResponseBuilder apiContentResponseBuilderBuilder,
+        IApiContentQueryService apiContentQueryService)
+        : this(
+            apiPublishedContentCache,
+            apiContentResponseBuilderBuilder,
+            apiContentQueryService,
+            StaticServiceProvider.Instance.GetRequiredService<IRequestMemberAccessService>())
+    {
+    }
+
+    [ActivatorUtilitiesConstructor]
    public QueryContentApiController(
        IApiPublishedContentCache apiPublishedContentCache,
        IApiContentResponseBuilder apiContentResponseBuilderBuilder,
@@ -1,20 +1,16 @@
 using System.Net;
-using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Umbraco.Cms.Api.Common.Attributes;
 using Umbraco.Cms.Api.Common.Filters;
 using Umbraco.Cms.Api.Delivery.Configuration;
 using Umbraco.Cms.Core;
-using Umbraco.Cms.Core.Features;
-using Umbraco.Cms.Web.Common.Authorization;

 namespace Umbraco.Cms.Api.Delivery.Controllers;

 [ApiController]
 [JsonOptionsName(Constants.JsonOptionsNames.DeliveryApi)]
 [MapToApi(DeliveryApiConfiguration.ApiName)]
-[Authorize(Policy = AuthorizationPolicies.UmbracoFeatureEnabled)]
-public abstract class DeliveryApiControllerBase : Controller, IUmbracoFeature
+public abstract class DeliveryApiControllerBase : Controller
 {
    protected string DecodePath(string path)
    {
@@ -0,0 +1,28 @@
+using Asp.Versioning;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using OpenIddict.Server.AspNetCore;
+using Umbraco.Cms.Api.Delivery.Routing;
+using Umbraco.Cms.Core.DeliveryApi;
+
+namespace Umbraco.Cms.Api.Delivery.Controllers.Security;
+
+[ApiVersion("1.0")]
+[ApiController]
+[VersionedDeliveryApiRoute(Common.Security.Paths.MemberApi.EndpointTemplate)]
+[ApiExplorerSettings(IgnoreApi = true)]
+[Authorize(AuthenticationSchemes = OpenIddictServerAspNetCoreDefaults.AuthenticationScheme)]
+public class CurrentMemberController : DeliveryApiControllerBase
+{
+    private readonly ICurrentMemberClaimsProvider _currentMemberClaimsProvider;
+
+    public CurrentMemberController(ICurrentMemberClaimsProvider currentMemberClaimsProvider)
+        => _currentMemberClaimsProvider = currentMemberClaimsProvider;
+
+    [HttpGet("userinfo")]
+    public async Task<IActionResult> Userinfo()
+    {
+        Dictionary<string, object> claims = await _currentMemberClaimsProvider.GetClaimsAsync();
+        return Ok(claims);
+    }
+}
@@ -1,4 +1,4 @@
-using System.Security.Claims;
+using System.Security.Claims;
 using Asp.Versioning;
 using Microsoft.AspNetCore;
 using Microsoft.AspNetCore.Authentication;
@@ -15,12 +15,13 @@ using Umbraco.Cms.Core.Configuration.Models;
 using Umbraco.Cms.Core.Security;
 using Umbraco.Cms.Web.Common.Security;
 using Umbraco.Extensions;
-using IdentitySignInResult = Microsoft.AspNetCore.Identity.SignInResult;
 using SignInResult = Microsoft.AspNetCore.Mvc.SignInResult;
+using IdentitySignInResult = Microsoft.AspNetCore.Identity.SignInResult;

 namespace Umbraco.Cms.Api.Delivery.Controllers.Security;

 [ApiVersion("1.0")]
+[ApiController]
 [VersionedDeliveryApiRoute(Common.Security.Paths.MemberApi.EndpointTemplate)]
 [ApiExplorerSettings(IgnoreApi = true)]
 public class MemberController : DeliveryApiControllerBase
@@ -159,11 +160,12 @@ public class MemberController : DeliveryApiControllerBase
            claim.SetDestinations(OpenIddictConstants.Destinations.AccessToken);
        }

-        if (request.GetScopes().Contains(OpenIddictConstants.Scopes.OfflineAccess))
-        {
-            // "offline_access" scope is required to use refresh tokens
-            memberPrincipal.SetScopes(OpenIddictConstants.Scopes.OfflineAccess);
-        }
+        // "openid" and "offline_access" are the only scopes allowed for members; explicitly ensure we only add those
+        // NOTE: the "offline_access" scope is required to use refresh tokens
+        IEnumerable<string> allowedScopes = request
+            .GetScopes()
+            .Intersect(new[] { OpenIddictConstants.Scopes.OpenId, OpenIddictConstants.Scopes.OfflineAccess });
+        memberPrincipal.SetScopes(allowedScopes);

        return new SignInResult(OpenIddictServerAspNetCoreDefaults.AuthenticationScheme, memberPrincipal);
    }
@@ -5,6 +5,7 @@ using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Routing;
 using Microsoft.Extensions.Configuration;
 using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Primitives;
 using Umbraco.Cms.Api.Common.DependencyInjection;
 using Umbraco.Cms.Api.Delivery.Accessors;
 using Umbraco.Cms.Api.Delivery.Caching;
@@ -33,26 +34,33 @@ public static class UmbracoBuilderExtensions
        builder.Services.AddScoped<IRequestStartItemProvider, RequestStartItemProvider>();
        builder.Services.AddScoped<RequestContextOutputExpansionStrategy>();
        builder.Services.AddScoped<RequestContextOutputExpansionStrategyV2>();
-        builder.Services.AddScoped<IOutputExpansionStrategy>(provider =>
-        {
-            HttpContext? httpContext = provider.GetRequiredService<IHttpContextAccessor>().HttpContext;
-            ApiVersion? apiVersion = httpContext?.GetRequestedApiVersion();
-            if (apiVersion is null)
-            {
-                return provider.GetRequiredService<RequestContextOutputExpansionStrategyV2>();
-            }

-            // V1 of the Delivery API uses a different expansion strategy than V2+
-            return apiVersion.MajorVersion == 1
-                ? provider.GetRequiredService<RequestContextOutputExpansionStrategy>()
-                : provider.GetRequiredService<RequestContextOutputExpansionStrategyV2>();
-        });
+        builder.Services.AddUnique<IOutputExpansionStrategy>(
+            provider =>
+            {
+                HttpContext? httpContext = provider.GetRequiredService<IHttpContextAccessor>().HttpContext;
+                ApiVersion? apiVersion = httpContext?.GetRequestedApiVersion();
+                if (apiVersion is null)
+                {
+                    return provider.GetRequiredService<RequestContextOutputExpansionStrategyV2>();
+                }
+
+                // V1 of the Delivery API uses a different expansion strategy than V2+
+                return apiVersion.MajorVersion == 1
+                    ? provider.GetRequiredService<RequestContextOutputExpansionStrategy>()
+                    : provider.GetRequiredService<RequestContextOutputExpansionStrategyV2>();
+            },
+            ServiceLifetime.Scoped);
+
        builder.Services.AddSingleton<IRequestCultureService, RequestCultureService>();
        builder.Services.AddSingleton<IRequestRoutingService, RequestRoutingService>();
        builder.Services.AddSingleton<IRequestRedirectService, RequestRedirectService>();
        builder.Services.AddSingleton<IRequestPreviewService, RequestPreviewService>();
-        builder.Services.AddSingleton<IOutputExpansionStrategyAccessor, RequestContextOutputExpansionStrategyAccessor>();
+
+        // Webooks register a more basic implementation, remove it.
+        builder.Services.AddUnique<IOutputExpansionStrategyAccessor, RequestContextOutputExpansionStrategyAccessor>(ServiceLifetime.Singleton);
        builder.Services.AddSingleton<IRequestStartItemProviderAccessor, RequestContextRequestStartItemProviderAccessor>();
+
        builder.Services.AddSingleton<IApiAccessService, ApiAccessService>();
        builder.Services.AddSingleton<IApiContentQueryService, ApiContentQueryService>();
        builder.Services.AddSingleton<IApiContentQueryProvider, ApiContentQueryProvider>();
@@ -60,6 +68,7 @@ public static class UmbracoBuilderExtensions
        builder.Services.AddSingleton<IApiMediaQueryService, ApiMediaQueryService>();
        builder.Services.AddTransient<IMemberApplicationManager, MemberApplicationManager>();
        builder.Services.AddTransient<IRequestMemberAccessService, RequestMemberAccessService>();
+        builder.Services.AddTransient<ICurrentMemberClaimsProvider, CurrentMemberClaimsProvider>();

        builder.Services.ConfigureOptions<ConfigureUmbracoDeliveryApiSwaggerGenOptions>();
        builder.AddUmbracoApiOpenApiUI();
@@ -107,12 +116,20 @@ public static class UmbracoBuilderExtensions

            if (outputCacheSettings.ContentDuration.TotalSeconds > 0)
            {
-                options.AddPolicy(Constants.DeliveryApi.OutputCache.ContentCachePolicy, new DeliveryApiOutputCachePolicy(outputCacheSettings.ContentDuration));
+                options.AddPolicy(
+                    Constants.DeliveryApi.OutputCache.ContentCachePolicy,
+                    new DeliveryApiOutputCachePolicy(
+                        outputCacheSettings.ContentDuration,
+                        new StringValues([Constants.DeliveryApi.HeaderNames.AcceptLanguage, Constants.DeliveryApi.HeaderNames.StartItem])));
            }

            if (outputCacheSettings.MediaDuration.TotalSeconds > 0)
            {
-                options.AddPolicy(Constants.DeliveryApi.OutputCache.MediaCachePolicy, new DeliveryApiOutputCachePolicy(outputCacheSettings.MediaDuration));
+                options.AddPolicy(
+                    Constants.DeliveryApi.OutputCache.MediaCachePolicy,
+                    new DeliveryApiOutputCachePolicy(
+                        outputCacheSettings.MediaDuration,
+                        Constants.DeliveryApi.HeaderNames.StartItem));
            }
        });

@@ -0,0 +1,13 @@
+using Microsoft.AspNetCore.Mvc.Filters;
+
+namespace Umbraco.Cms.Api.Delivery.Filters;
+
+public sealed class AddVaryHeaderAttribute : ActionFilterAttribute
+{
+    private const string Vary = "Accept-Language, Preview, Start-Item";
+
+    public override void OnResultExecuting(ResultExecutingContext context)
+        => context.HttpContext.Response.Headers.Vary = context.HttpContext.Response.Headers.Vary.Count > 0
+            ? $"{context.HttpContext.Response.Headers.Vary}, {Vary}"
+            : Vary;
+}
@@ -1,4 +1,4 @@
-using Microsoft.OpenApi.Any;
+using Microsoft.OpenApi.Any;
 using Microsoft.OpenApi.Models;
 using Swashbuckle.AspNetCore.SwaggerGen;
 using Umbraco.Cms.Api.Delivery.Configuration;
@@ -21,7 +21,7 @@ internal sealed class SwaggerContentDocumentationFilter : SwaggerDocumentationFi

        operation.Parameters.Add(new OpenApiParameter
        {
-            Name = "Accept-Language",
+            Name = Core.Constants.DeliveryApi.HeaderNames.AcceptLanguage,
            In = ParameterLocation.Header,
            Required = false,
            Description = "Defines the language to return. Use this when querying language variant content items.",
@@ -37,7 +37,7 @@ internal sealed class SwaggerContentDocumentationFilter : SwaggerDocumentationFi

        operation.Parameters.Add(new OpenApiParameter
        {
-            Name = "Preview",
+            Name = Core.Constants.DeliveryApi.HeaderNames.Preview,
            In = ParameterLocation.Header,
            Required = false,
            Description = "Whether to request draft content.",
@@ -46,7 +46,7 @@ internal sealed class SwaggerContentDocumentationFilter : SwaggerDocumentationFi

        operation.Parameters.Add(new OpenApiParameter
        {
-            Name = "Start-Item",
+            Name = Core.Constants.DeliveryApi.HeaderNames.StartItem,
            In = ParameterLocation.Header,
            Required = false,
            Description = "URL segment or GUID of a root content item.",
@@ -0,0 +1,18 @@
+using Microsoft.OpenApi.Models;
+using Swashbuckle.AspNetCore.SwaggerGen;
+
+namespace Umbraco.Cms.Api.Delivery.Filters;
+
+[Obsolete($"Superseded by {nameof(SwaggerContentDocumentationFilter)} and {nameof(SwaggerMediaDocumentationFilter)}. Will be removed in V14.")]
+public class SwaggerDocumentationFilter : IOperationFilter, IParameterFilter
+{
+    public void Apply(OpenApiOperation operation, OperationFilterContext context)
+    {
+        // retained for backwards compat
+    }
+
+    public void Apply(OpenApiParameter parameter, ParameterFilterContext context)
+    {
+        // retained for backwards compat
+    }
+}
@@ -1,4 +1,4 @@
-using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc;
 using Microsoft.OpenApi.Any;
 using Microsoft.OpenApi.Models;
 using Swashbuckle.AspNetCore.SwaggerGen;
@@ -63,7 +63,7 @@ internal abstract class SwaggerDocumentationFilterBase<TBaseController>
    protected void AddApiKey(OpenApiOperation operation) =>
        operation.Parameters.Add(new OpenApiParameter
        {
-            Name = "Api-Key",
+            Name = Core.Constants.DeliveryApi.HeaderNames.ApiKey,
            In = ParameterLocation.Header,
            Required = false,
            Description = "API key specified through configuration to authorize access to the API.",
@@ -1,4 +1,4 @@
-using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Logging;
 using Microsoft.Extensions.Options;
 using Umbraco.Cms.Core;
@@ -6,6 +6,7 @@ using Umbraco.Cms.Core.Configuration.Models;
 using Umbraco.Cms.Core.Events;
 using Umbraco.Cms.Core.Notifications;
 using Umbraco.Cms.Core.Services;
+using Umbraco.Cms.Core.Sync;
 using Umbraco.Cms.Infrastructure.Security;

 namespace Umbraco.Cms.Api.Delivery.Handlers;
@@ -16,16 +17,21 @@ internal sealed class InitializeMemberApplicationNotificationHandler : INotifica
    private readonly ILogger<InitializeMemberApplicationNotificationHandler> _logger;
    private readonly DeliveryApiSettings _deliveryApiSettings;
    private readonly IServiceScopeFactory _serviceScopeFactory;
+    private readonly IServerRoleAccessor _serverRoleAccessor;
+    private static readonly SemaphoreSlim _locker = new(1);
+    private static bool _isInitialized = false;

    public InitializeMemberApplicationNotificationHandler(
        IRuntimeState runtimeState,
        IOptions<DeliveryApiSettings> deliveryApiSettings,
        ILogger<InitializeMemberApplicationNotificationHandler> logger,
-        IServiceScopeFactory serviceScopeFactory)
+        IServiceScopeFactory serviceScopeFactory,
+        IServerRoleAccessor serverRoleAccessor)
    {
        _runtimeState = runtimeState;
        _logger = logger;
        _serviceScopeFactory = serviceScopeFactory;
+        _serverRoleAccessor = serverRoleAccessor;
        _deliveryApiSettings = deliveryApiSettings.Value;
    }

@@ -36,34 +42,55 @@ internal sealed class InitializeMemberApplicationNotificationHandler : INotifica
            return;
        }

-        // we cannot inject the IMemberApplicationManager because it ultimately takes a dependency on the DbContext ... and during
-        // install that is not allowed (no connection string means no DbContext)
-        using IServiceScope scope = _serviceScopeFactory.CreateScope();
-        IMemberApplicationManager memberApplicationManager = scope.ServiceProvider.GetRequiredService<IMemberApplicationManager>();
-
-        if (_deliveryApiSettings.MemberAuthorization?.AuthorizationCodeFlow?.Enabled is not true)
+        if (_serverRoleAccessor.CurrentServerRole is ServerRole.Subscriber)
        {
-            await memberApplicationManager.DeleteMemberApplicationAsync(cancellationToken);
+            // subscriber instances should not alter the member application
            return;
        }

-        if (ValidateRedirectUrls(_deliveryApiSettings.MemberAuthorization.AuthorizationCodeFlow.LoginRedirectUrls) is false)
+        try
        {
-            await memberApplicationManager.DeleteMemberApplicationAsync(cancellationToken);
-            return;
-        }
+            await _locker.WaitAsync(cancellationToken);
+            if (_isInitialized)
+            {
+                return;
+            }

-        if (_deliveryApiSettings.MemberAuthorization.AuthorizationCodeFlow.LogoutRedirectUrls.Any()
-            && ValidateRedirectUrls(_deliveryApiSettings.MemberAuthorization.AuthorizationCodeFlow.LogoutRedirectUrls) is false)
+            _isInitialized = true;
+
+            // we cannot inject the IMemberApplicationManager because it ultimately takes a dependency on the DbContext ... and during
+            // install that is not allowed (no connection string means no DbContext)
+            using IServiceScope scope = _serviceScopeFactory.CreateScope();
+            IMemberApplicationManager memberApplicationManager = scope.ServiceProvider.GetRequiredService<IMemberApplicationManager>();
+
+            if (_deliveryApiSettings.MemberAuthorization?.AuthorizationCodeFlow?.Enabled is not true)
+            {
+                await memberApplicationManager.DeleteMemberApplicationAsync(cancellationToken);
+                return;
+            }
+
+            if (ValidateRedirectUrls(_deliveryApiSettings.MemberAuthorization.AuthorizationCodeFlow.LoginRedirectUrls) is false)
+            {
+                await memberApplicationManager.DeleteMemberApplicationAsync(cancellationToken);
+                return;
+            }
+
+            if (_deliveryApiSettings.MemberAuthorization.AuthorizationCodeFlow.LogoutRedirectUrls.Any()
+                && ValidateRedirectUrls(_deliveryApiSettings.MemberAuthorization.AuthorizationCodeFlow.LogoutRedirectUrls) is false)
+            {
+                await memberApplicationManager.DeleteMemberApplicationAsync(cancellationToken);
+                return;
+            }
+
+            await memberApplicationManager.EnsureMemberApplicationAsync(
+                _deliveryApiSettings.MemberAuthorization.AuthorizationCodeFlow.LoginRedirectUrls,
+                _deliveryApiSettings.MemberAuthorization.AuthorizationCodeFlow.LogoutRedirectUrls,
+                cancellationToken);
+        }
+        finally
        {
-            await memberApplicationManager.DeleteMemberApplicationAsync(cancellationToken);
-            return;
+            _locker.Release();
        }
-
-        await memberApplicationManager.EnsureMemberApplicationAsync(
-            _deliveryApiSettings.MemberAuthorization.AuthorizationCodeFlow.LoginRedirectUrls,
-            _deliveryApiSettings.MemberAuthorization.AuthorizationCodeFlow.LogoutRedirectUrls,
-            cancellationToken);
    }

    private bool ValidateRedirectUrls(Uri[] redirectUrls)
@@ -1,4 +1,4 @@
-using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Logging;
 using Microsoft.Extensions.Options;
 using OpenIddict.Abstractions;
 using Umbraco.Cms.Core.Configuration.Models;
@@ -73,7 +73,7 @@ internal sealed class RevokeMemberAuthenticationTokensNotificationHandler
            return;
        }

-        _logger.LogInformation("Revoking {count} active tokens for member with ID {id}", tokens.Length, member.Id);
+        _logger.LogInformation("Deleting {count} active tokens for member with ID {id}", tokens.Length, member.Id);
        foreach (var token in tokens)
        {
            await _tokenManager.DeleteAsync(token);
@@ -1,6 +1,5 @@
 using Umbraco.Cms.Api.Delivery.Indexing.Filters;
 using Umbraco.Cms.Core.DeliveryApi;
-using Umbraco.Extensions;

 namespace Umbraco.Cms.Api.Delivery.Querying.Filters;

@@ -15,15 +14,15 @@ public sealed class ContentTypeFilter : IFilterHandler
    /// <inheritdoc/>
    public FilterOption BuildFilterOption(string filter)
    {
-        var alias = filter.Substring(ContentTypeSpecifier.Length);
+        var filterValue = filter.Substring(ContentTypeSpecifier.Length);
+        var negate = filterValue.StartsWith('!');
+        var aliases = filterValue.TrimStart('!').Split(',', StringSplitOptions.TrimEntries | StringSplitOptions.RemoveEmptyEntries);

        return new FilterOption
        {
            FieldName = ContentTypeFilterIndexer.FieldName,
-            Values = alias.IsNullOrWhiteSpace() == false
-                ? new[] { alias.TrimStart('!') }
-                : Array.Empty<string>(),
-            Operator = alias.StartsWith('!')
+            Values = aliases,
+            Operator = negate
                ? FilterOperation.IsNot
                : FilterOperation.Is
        };
@@ -1,5 +1,7 @@
+using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Api.Delivery.Indexing.Selectors;
 using Umbraco.Cms.Core.DeliveryApi;
+using Umbraco.Cms.Core.DependencyInjection;
 using Umbraco.Cms.Core.Models.PublishedContent;
 using Umbraco.Cms.Core.PublishedCache;
 using Umbraco.Extensions;
@@ -10,10 +12,21 @@ public sealed class AncestorsSelector : QueryOptionBase, ISelectorHandler
 {
    private const string AncestorsSpecifier = "ancestors:";
    private readonly IPublishedSnapshotAccessor _publishedSnapshotAccessor;
+    private readonly IRequestPreviewService _requestPreviewService;

-    public AncestorsSelector(IPublishedSnapshotAccessor publishedSnapshotAccessor, IRequestRoutingService requestRoutingService)
-        : base(publishedSnapshotAccessor, requestRoutingService) =>
+    [Obsolete("Please use the non-obsolete constructor. Will be removed in V17.")]
+    public AncestorsSelector(IPublishedSnapshotAccessor publishedSnapshotAccessor,
+        IRequestRoutingService requestRoutingService)
+        : this(publishedSnapshotAccessor, requestRoutingService, StaticServiceProvider.Instance.GetRequiredService<IRequestPreviewService>())
+    {
+    }
+
+    public AncestorsSelector(IPublishedSnapshotAccessor publishedSnapshotAccessor, IRequestRoutingService requestRoutingService, IRequestPreviewService requestPreviewService)
+        : base(publishedSnapshotAccessor, requestRoutingService)
+    {
        _publishedSnapshotAccessor = publishedSnapshotAccessor;
+        _requestPreviewService = requestPreviewService;
+    }

    /// <inheritdoc />
    public bool CanHandle(string query)
@@ -37,10 +50,20 @@ public sealed class AncestorsSelector : QueryOptionBase, ISelectorHandler
            };
        }

-        IPublishedSnapshot publishedSnapshot = _publishedSnapshotAccessor.GetRequiredPublishedSnapshot();
+        IPublishedContentCache contentCache = _publishedSnapshotAccessor.GetRequiredPublishedSnapshot()?.Content
+                                         ?? throw new InvalidOperationException("Could not obtain the content cache");

-        IPublishedContent contentItem = publishedSnapshot.Content?.GetById((Guid)id)
-                                        ?? throw new InvalidOperationException("Could not obtain the content cache");
+        IPublishedContent? contentItem = contentCache.GetById(_requestPreviewService.IsPreview(), id.Value);
+
+        if (contentItem is null)
+        {
+            // no such content item, make sure the selector does not yield any results
+            return new SelectorOption
+            {
+                FieldName = AncestorsSelectorIndexer.FieldName,
+                Values = Array.Empty<string>()
+            };
+        }

        var ancestorKeys = contentItem.Ancestors().Select(a => a.Key.ToString("D")).ToArray();

@@ -1,62 +1,24 @@
 using Microsoft.AspNetCore.Http;
 using Microsoft.Extensions.Logging;
 using Umbraco.Cms.Core.DeliveryApi;
-using Umbraco.Cms.Core.Models.PublishedContent;
-using Umbraco.Extensions;
+using Umbraco.Cms.Web.Common.Rendering;

 namespace Umbraco.Cms.Api.Delivery.Rendering;

-internal sealed class RequestContextOutputExpansionStrategyV2 : IOutputExpansionStrategy
+internal sealed class RequestContextOutputExpansionStrategyV2 : ElementOnlyOutputExpansionStrategy, IOutputExpansionStrategy
 {
-    private const string All = "$all";
-    private const string None = "";
-    private const string ExpandParameterName = "expand";
-    private const string FieldsParameterName = "fields";
-
-    private readonly IApiPropertyRenderer _propertyRenderer;
    private readonly ILogger<RequestContextOutputExpansionStrategyV2> _logger;

-    private readonly Stack<Node?> _expandProperties;
-    private readonly Stack<Node?> _includeProperties;
-
    public RequestContextOutputExpansionStrategyV2(
        IHttpContextAccessor httpContextAccessor,
        IApiPropertyRenderer propertyRenderer,
        ILogger<RequestContextOutputExpansionStrategyV2> logger)
+        : base(propertyRenderer)
    {
-        _propertyRenderer = propertyRenderer;
        _logger = logger;
-        _expandProperties = new Stack<Node?>();
-        _includeProperties = new Stack<Node?>();
-
        InitializeExpandAndInclude(httpContextAccessor);
    }

-    public IDictionary<string, object?> MapContentProperties(IPublishedContent content)
-        => content.ItemType == PublishedItemType.Content
-            ? MapProperties(content.Properties)
-            : throw new ArgumentException($"Invalid item type. This method can only be used with item type {nameof(PublishedItemType.Content)}, got: {content.ItemType}");
-
-    public IDictionary<string, object?> MapMediaProperties(IPublishedContent media, bool skipUmbracoProperties = true)
-    {
-        if (media.ItemType != PublishedItemType.Media)
-        {
-            throw new ArgumentException($"Invalid item type. This method can only be used with item type {PublishedItemType.Media}, got: {media.ItemType}");
-        }
-
-        IPublishedProperty[] properties = media
-            .Properties
-            .Where(p => skipUmbracoProperties is false || p.Alias.StartsWith("umbraco") is false)
-            .ToArray();
-
-        return properties.Any()
-            ? MapProperties(properties)
-            : new Dictionary<string, object?>();
-    }
-
-    public IDictionary<string, object?> MapElementProperties(IPublishedElement element)
-        => MapProperties(element.Properties, true);
-
    private void InitializeExpandAndInclude(IHttpContextAccessor httpContextAccessor)
    {
        string? QueryValue(string key) => httpContextAccessor.HttpContext?.Request.Query[key];
@@ -66,7 +28,7 @@ internal sealed class RequestContextOutputExpansionStrategyV2 : IOutputExpansion

        try
        {
-            _expandProperties.Push(Node.Parse(toExpand));
+            ExpandProperties.Push(Node.Parse(toExpand));
        }
        catch (ArgumentException ex)
        {
@@ -76,7 +38,7 @@ internal sealed class RequestContextOutputExpansionStrategyV2 : IOutputExpansion

        try
        {
-            _includeProperties.Push(Node.Parse(toInclude));
+            IncludeProperties.Push(Node.Parse(toInclude));
        }
        catch (ArgumentException ex)
        {
@@ -84,102 +46,4 @@ internal sealed class RequestContextOutputExpansionStrategyV2 : IOutputExpansion
            throw new ArgumentException($"Could not parse the '{FieldsParameterName}' parameter: {ex.Message}");
        }
    }
-
-    private IDictionary<string, object?> MapProperties(IEnumerable<IPublishedProperty> properties, bool forceExpandProperties = false)
-    {
-        Node? currentExpandProperties = _expandProperties.Peek();
-        if (_expandProperties.Count > 1 && currentExpandProperties is null && forceExpandProperties is false)
-        {
-            return new Dictionary<string, object?>();
-        }
-
-        Node? currentIncludeProperties = _includeProperties.Peek();
-        var result = new Dictionary<string, object?>();
-        foreach (IPublishedProperty property in properties)
-        {
-            Node? nextIncludeProperties = GetNextProperties(currentIncludeProperties, property.Alias);
-            if (currentIncludeProperties is not null && currentIncludeProperties.Items.Any() && nextIncludeProperties is null)
-            {
-                continue;
-            }
-
-            Node? nextExpandProperties = GetNextProperties(currentExpandProperties, property.Alias);
-
-            _includeProperties.Push(nextIncludeProperties);
-            _expandProperties.Push(nextExpandProperties);
-
-            result[property.Alias] = GetPropertyValue(property);
-
-            _expandProperties.Pop();
-            _includeProperties.Pop();
-        }
-
-        return result;
-    }
-
-    private Node? GetNextProperties(Node? currentProperties, string propertyAlias)
-        => currentProperties?.Items.FirstOrDefault(i => i.Key == All)
-           ?? currentProperties?.Items.FirstOrDefault(i => i.Key == "properties")?.Items.FirstOrDefault(i => i.Key == All || i.Key == propertyAlias);
-
-    private object? GetPropertyValue(IPublishedProperty property)
-        => _propertyRenderer.GetPropertyValue(property, _expandProperties.Peek() is not null);
-
-    private class Node
-    {
-        public string Key { get; private set; } = string.Empty;
-
-        public List<Node> Items { get; } = new();
-
-        public static Node Parse(string value)
-        {
-            // verify that there are as many start brackets as there are end brackets
-            if (value.CountOccurrences("[") != value.CountOccurrences("]"))
-            {
-                throw new ArgumentException("Value did not contain an equal number of start and end brackets");
-            }
-
-            // verify that the value does not start with a start bracket
-            if (value.StartsWith("["))
-            {
-                throw new ArgumentException("Value cannot start with a bracket");
-            }
-
-            // verify that there are no empty brackets
-            if (value.Contains("[]"))
-            {
-                throw new ArgumentException("Value cannot contain empty brackets");
-            }
-
-            var stack = new Stack<Node>();
-            var root = new Node { Key = "root" };
-            stack.Push(root);
-
-            var currentNode = new Node();
-            root.Items.Add(currentNode);
-
-            foreach (char c in value)
-            {
-                switch (c)
-                {
-                    case '[': // Start a new node, child of the current node
-                        stack.Push(currentNode);
-                        currentNode = new Node();
-                        stack.Peek().Items.Add(currentNode);
-                        break;
-                    case ',': // Start a new node, but at the same level of the current node
-                        currentNode = new Node();
-                        stack.Peek().Items.Add(currentNode);
-                        break;
-                    case ']': // Back to parent of the current node
-                        currentNode = stack.Pop();
-                        break;
-                    default: // Add char to current node key
-                        currentNode.Key += c;
-                        break;
-                }
-            }
-
-            return root;
-        }
-    }
 }
@@ -1,4 +1,4 @@
-using OpenIddict.Abstractions;
+using OpenIddict.Abstractions;
 using Umbraco.Cms.Core;
 using Umbraco.Cms.Core.Services;
 using Umbraco.Cms.Infrastructure.Security;
@@ -36,7 +36,7 @@ public class MemberApplicationManager : OpenIdDictApplicationManagerBase, IMembe
        {
            DisplayName = "Umbraco member access",
            ClientId = Constants.OAuthClientIds.Member,
-            ClientType = OpenIddictConstants.ClientTypes.Public,
+            Type = OpenIddictConstants.ClientTypes.Public,
            Permissions =
            {
                OpenIddictConstants.Permissions.Endpoints.Authorization,
@@ -1,4 +1,4 @@
-using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Http;
 using Microsoft.Extensions.Options;
 using Umbraco.Cms.Core.Configuration.Models;
 using Umbraco.Cms.Core.DeliveryApi;
@@ -29,7 +29,7 @@ internal sealed class ApiAccessService : RequestHeaderHandler, IApiAccessService
    private bool IfEnabled(Func<bool> condition) => _deliveryApiSettings.Enabled && condition();

    private bool HasValidApiKey() => _deliveryApiSettings.ApiKey.IsNullOrWhiteSpace() == false
-                                     && _deliveryApiSettings.ApiKey.Equals(GetHeaderValue("Api-Key"));
+                                     && _deliveryApiSettings.ApiKey.Equals(GetHeaderValue(Core.Constants.DeliveryApi.HeaderNames.ApiKey));

    private bool IfMediaEnabled(Func<bool> condition) => _deliveryApiSettings is { Enabled: true, Media.Enabled: true } && condition();
 }
@@ -48,6 +48,17 @@ internal sealed class ApiContentQueryProvider : IApiContentQueryProvider

    }

+    [Obsolete($"Use the {nameof(ExecuteQuery)} method that accepts {nameof(ProtectedAccess)}. Will be removed in V14.")]
+    public PagedModel<Guid> ExecuteQuery(
+        SelectorOption selectorOption,
+        IList<FilterOption> filterOptions,
+        IList<SortOption> sortOptions,
+        string culture,
+        bool preview,
+        int skip,
+        int take)
+        => ExecuteQuery(selectorOption, filterOptions, sortOptions, culture, ProtectedAccess.None, preview, skip, take);
+
    /// <inheritdoc/>
    public PagedModel<Guid> ExecuteQuery(
        SelectorOption selectorOption,
@@ -37,6 +37,15 @@ internal sealed class ApiContentQueryService : IApiContentQueryService
        _requestPreviewService = requestPreviewService;
    }

+    [Obsolete($"Use the {nameof(ExecuteQuery)} method that accepts {nameof(ProtectedAccess)}. Will be removed in V14.")]
+    public Attempt<PagedModel<Guid>, ApiContentQueryOperationStatus> ExecuteQuery(
+        string? fetch,
+        IEnumerable<string> filters,
+        IEnumerable<string> sorts,
+        int skip,
+        int take)
+        => ExecuteQuery(fetch, filters, sorts, ProtectedAccess.None, skip, take);
+
    /// <inheritdoc/>
    public Attempt<PagedModel<Guid>, ApiContentQueryOperationStatus> ExecuteQuery(
        string? fetch,
@@ -0,0 +1,44 @@
+using OpenIddict.Abstractions;
+using Umbraco.Cms.Core.DeliveryApi;
+using Umbraco.Cms.Core.Security;
+
+namespace Umbraco.Cms.Api.Delivery.Services;
+
+// NOTE: this is public and unsealed to allow overriding the default claims with minimal effort.
+public class CurrentMemberClaimsProvider : ICurrentMemberClaimsProvider
+{
+    private readonly IMemberManager _memberManager;
+
+    public CurrentMemberClaimsProvider(IMemberManager memberManager)
+        => _memberManager = memberManager;
+
+    public virtual async Task<Dictionary<string, object>> GetClaimsAsync()
+    {
+        MemberIdentityUser? memberIdentityUser = await _memberManager.GetCurrentMemberAsync();
+        return memberIdentityUser is not null
+            ? await GetClaimsForMemberIdentityAsync(memberIdentityUser)
+            : throw new InvalidOperationException("Could not retrieve the current member. This method should only ever be invoked when a member has been authorized.");
+    }
+
+    protected virtual async Task<Dictionary<string, object>> GetClaimsForMemberIdentityAsync(MemberIdentityUser memberIdentityUser)
+    {
+        var claims = new Dictionary<string, object>
+        {
+            [OpenIddictConstants.Claims.Subject] = memberIdentityUser.Key
+        };
+
+        if (memberIdentityUser.Name is not null)
+        {
+            claims[OpenIddictConstants.Claims.Name] = memberIdentityUser.Name;
+        }
+
+        if (memberIdentityUser.Email is not null)
+        {
+            claims[OpenIddictConstants.Claims.Email] = memberIdentityUser.Email;
+        }
+
+        claims[OpenIddictConstants.Claims.Role] = await _memberManager.GetRolesAsync(memberIdentityUser);
+
+        return claims;
+    }
+}
@@ -1,4 +1,4 @@
-using System.Security.Claims;
+using System.Security.Claims;
 using Microsoft.AspNetCore.Authentication;
 using Microsoft.AspNetCore.Http;
 using Microsoft.Extensions.Options;
@@ -1,4 +1,4 @@
-using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Http;
 using Umbraco.Cms.Core.DeliveryApi;

 namespace Umbraco.Cms.Api.Delivery.Services;
@@ -11,5 +11,5 @@ internal sealed class RequestPreviewService : RequestHeaderHandler, IRequestPrev
    }

    /// <inheritdoc />
-    public bool IsPreview() => GetHeaderValue("Preview") == "true";
+    public bool IsPreview() => string.Equals(GetHeaderValue(Core.Constants.DeliveryApi.HeaderNames.Preview), "true", StringComparison.OrdinalIgnoreCase);
 }
@@ -42,31 +42,42 @@ internal sealed class RequestRedirectService : RoutingServiceBase, IRequestRedir
    {
        requestedPath = requestedPath.EnsureStartsWith("/");

+        IPublishedContent? startItem = GetStartItem();
+
        // must append the root content url segment if it is not hidden by config, because
        // the URL tracking is based on the actual URL, including the root content url segment
-        if (_globalSettings.HideTopLevelNodeFromPath == false)
+        if (_globalSettings.HideTopLevelNodeFromPath == false && startItem?.UrlSegment != null)
        {
-            IPublishedContent? startItem = GetStartItem();
-            if (startItem?.UrlSegment != null)
-            {
-                requestedPath = $"{startItem.UrlSegment.EnsureStartsWith("/")}{requestedPath}";
-            }
+            requestedPath = $"{startItem.UrlSegment.EnsureStartsWith("/")}{requestedPath}";
        }

        var culture = _requestCultureService.GetRequestedCulture();

-        // append the configured domain content ID to the path if we have a domain bound request,
-        // because URL tracking registers the tracked url like "{domain content ID}/{content path}"
-        Uri contentRoute = GetDefaultRequestUri(requestedPath);
-        DomainAndUri? domainAndUri = GetDomainAndUriForRoute(contentRoute);
-        if (domainAndUri != null)
+        // important: redirect URLs are always tracked without trailing slashes
+        requestedPath = requestedPath.TrimEnd("/");
+        IRedirectUrl? redirectUrl = _redirectUrlService.GetMostRecentRedirectUrl(requestedPath, culture);
+
+        // if a redirect URL was not found, try by appending the start item ID because URL tracking might have tracked
+        // a redirect with "{root content ID}/{content path}"
+        if (redirectUrl is null && startItem is not null)
        {
-            requestedPath = GetContentRoute(domainAndUri, contentRoute);
-            culture ??= domainAndUri.Culture;
+            redirectUrl = _redirectUrlService.GetMostRecentRedirectUrl($"{startItem.Id}{requestedPath}", culture);
+        }
+
+        // still no redirect URL found - try looking for a configured domain if we have a domain bound request,
+        // because URL tracking might have tracked a redirect with "{domain content ID}/{content path}"
+        if (redirectUrl is null)
+        {
+            Uri contentRoute = GetDefaultRequestUri(requestedPath);
+            DomainAndUri? domainAndUri = GetDomainAndUriForRoute(contentRoute);
+            if (domainAndUri is not null)
+            {
+                requestedPath = GetContentRoute(domainAndUri, contentRoute);
+                culture ??= domainAndUri.Culture;
+                redirectUrl = _redirectUrlService.GetMostRecentRedirectUrl(requestedPath, culture);
+            }
        }

-        // important: redirect URLs are always tracked without trailing slashes
-        IRedirectUrl? redirectUrl = _redirectUrlService.GetMostRecentRedirectUrl(requestedPath.TrimEnd("/"), culture);
        IPublishedContent? content = redirectUrl != null
            ? _apiPublishedContentCache.GetById(redirectUrl.ContentKey)
            : null;
@@ -58,5 +58,5 @@ internal sealed class RequestStartItemProvider : RequestHeaderHandler, IRequestS
    }

    /// <inheritdoc/>
-    public string? RequestedStartItem() => GetHeaderValue("Start-Item");
+    public string? RequestedStartItem() => GetHeaderValue(Constants.DeliveryApi.HeaderNames.StartItem);
 }
@@ -36,7 +36,7 @@ internal abstract class RoutingServiceBase
    }

    protected static string GetContentRoute(DomainAndUri domainAndUri, Uri contentRoute)
-        => $"{domainAndUri.ContentId}{DomainUtilities.PathRelativeToDomain(domainAndUri.Uri, contentRoute.AbsolutePath)}";
+        => $"{domainAndUri.ContentId}{DomainUtilities.PathRelativeToDomain(domainAndUri.Uri, contentRoute.LocalPath)}"; // Use LocalPath over AbsolutePath to keep the path decoded.

    protected DomainAndUri? GetDomainAndUriForRoute(Uri contentUrl)
    {
@@ -13,6 +13,9 @@
    <AssemblyAttribute Include="System.Runtime.CompilerServices.InternalsVisibleTo">
      <_Parameter1>Umbraco.Tests.UnitTests</_Parameter1>
    </AssemblyAttribute>
+    <AssemblyAttribute Include="System.Runtime.CompilerServices.InternalsVisibleTo">
+      <_Parameter1>Umbraco.Tests.Integration</_Parameter1>
+    </AssemblyAttribute>
    <AssemblyAttribute Include="System.Runtime.CompilerServices.InternalsVisibleTo">
      <_Parameter1>DynamicProxyGenAssembly2</_Parameter1>
    </AssemblyAttribute>
@@ -1,254 +0,0 @@
-using System.Security.Claims;
-using Microsoft.AspNetCore.Authentication;
-using Microsoft.AspNetCore.Authentication.Cookies;
-using Microsoft.AspNetCore.DataProtection;
-using Microsoft.AspNetCore.Http;
-using Microsoft.Extensions.DependencyInjection;
-using Microsoft.Extensions.Options;
-using Umbraco.Cms.Api.Management.Security;
-using Umbraco.Cms.Core;
-using Umbraco.Cms.Core.Configuration.Models;
-using Umbraco.Cms.Core.Net;
-using Umbraco.Cms.Core.Services;
-using Umbraco.Cms.Web.Common.Security;
-using Umbraco.Extensions;
-
-namespace Umbraco.Cms.Api.Management.Configuration;
-
-/// <summary>
-///     Used to configure <see cref="CookieAuthenticationOptions" /> for the back office authentication type
-/// </summary>
-public class ConfigureBackOfficeCookieOptions : IConfigureNamedOptions<CookieAuthenticationOptions>
-{
-    private readonly IDataProtectionProvider _dataProtection;
-    private readonly GlobalSettings _globalSettings;
-    private readonly IIpResolver _ipResolver;
-    private readonly IRuntimeState _runtimeState;
-    private readonly SecuritySettings _securitySettings;
-    private readonly IUserService _userService;
-    private readonly TimeProvider _timeProvider;
-
-    /// <summary>
-    ///     Initializes a new instance of the <see cref="ConfigureBackOfficeCookieOptions" /> class.
-    /// </summary>
-    /// <param name="securitySettings">The <see cref="SecuritySettings" /> options</param>
-    /// <param name="globalSettings">The <see cref="GlobalSettings" /> options</param>
-    /// <param name="runtimeState">The <see cref="IRuntimeState" /></param>
-    /// <param name="dataProtection">The <see cref="IDataProtectionProvider" /></param>
-    /// <param name="userService">The <see cref="IUserService" /></param>
-    /// <param name="ipResolver">The <see cref="IIpResolver" /></param>
-    /// <param name="timeProvider">The <see cref="TimeProvider" /></param>
-    public ConfigureBackOfficeCookieOptions(
-        IOptions<SecuritySettings> securitySettings,
-        IOptions<GlobalSettings> globalSettings,
-        IRuntimeState runtimeState,
-        IDataProtectionProvider dataProtection,
-        IUserService userService,
-        IIpResolver ipResolver,
-        TimeProvider timeProvider)
-    {
-        _securitySettings = securitySettings.Value;
-        _globalSettings = globalSettings.Value;
-        _runtimeState = runtimeState;
-        _dataProtection = dataProtection;
-        _userService = userService;
-        _ipResolver = ipResolver;
-        _timeProvider = timeProvider;
-    }
-
-    /// <inheritdoc />
-    public void Configure(string? name, CookieAuthenticationOptions options)
-    {
-        if (name != Constants.Security.BackOfficeAuthenticationType)
-        {
-            return;
-        }
-
-        Configure(options);
-    }
-
-    /// <inheritdoc />
-    public void Configure(CookieAuthenticationOptions options)
-    {
-        options.SlidingExpiration = false;
-        options.ExpireTimeSpan = _globalSettings.TimeOut;
-        options.Cookie.Domain = _securitySettings.AuthCookieDomain;
-        options.Cookie.Name = _securitySettings.AuthCookieName;
-        options.Cookie.HttpOnly = true;
-        options.Cookie.SecurePolicy =
-            _globalSettings.UseHttps ? CookieSecurePolicy.Always : CookieSecurePolicy.SameAsRequest;
-        options.Cookie.Path = "/";
-
-        // NOTE: matches route in BackOfficeLoginController
-        const string backOfficeLoginPath = "/umbraco/login";
-        options.LoginPath = backOfficeLoginPath;
-        options.LogoutPath = backOfficeLoginPath;
-        options.AccessDeniedPath = backOfficeLoginPath;
-
-        options.DataProtectionProvider = _dataProtection;
-
-        // NOTE: This is borrowed directly from aspnetcore source
-        // Note: the purpose for the data protector must remain fixed for interop to work.
-        IDataProtector dataProtector = options.DataProtectionProvider.CreateProtector(
-            "Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationMiddleware",
-            Constants.Security.BackOfficeAuthenticationType,
-            "v2");
-        var ticketDataFormat = new TicketDataFormat(dataProtector);
-
-        options.TicketDataFormat = new BackOfficeSecureDataFormat(_globalSettings.TimeOut, ticketDataFormat);
-
-        options.Events = new CookieAuthenticationEvents
-        {
-            // IMPORTANT! If you set any of OnRedirectToLogin, OnRedirectToAccessDenied, OnRedirectToLogout, OnRedirectToReturnUrl
-            // you need to be aware that this will bypass the default behavior of returning the correct status codes for ajax requests and
-            // not redirecting for non-ajax requests. This is because the default behavior is baked into this class here:
-            // https://github.com/dotnet/aspnetcore/blob/master/src/Security/Authentication/Cookies/src/CookieAuthenticationEvents.cs#L58
-            // It would be possible to re-use the default behavior if any of these need to be set but that must be taken into account else
-            // our back office requests will not function correctly. For now we don't need to set/configure any of these callbacks because
-            // the defaults work fine with our setup.
-            OnValidatePrincipal = async ctx =>
-            {
-                // We need to resolve the BackOfficeSecurityStampValidator per request as a requirement (even in aspnetcore they do this)
-                BackOfficeSecurityStampValidator securityStampValidator =
-                    ctx.HttpContext.RequestServices.GetRequiredService<BackOfficeSecurityStampValidator>();
-
-                // Same goes for the signinmanager
-                IBackOfficeSignInManager signInManager =
-                    ctx.HttpContext.RequestServices.GetRequiredService<IBackOfficeSignInManager>();
-
-                ClaimsIdentity? backOfficeIdentity = ctx.Principal?.GetUmbracoIdentity();
-                if (backOfficeIdentity == null)
-                {
-                    ctx.RejectPrincipal();
-                    await signInManager.SignOutAsync();
-                }
-
-                // ensure the thread culture is set
-                backOfficeIdentity?.EnsureCulture();
-
-                EnsureTicketRenewalIfKeepUserLoggedIn(ctx);
-
-                // add or update a claim to track when the cookie expires, we use this to track time remaining
-                backOfficeIdentity?.AddOrUpdateClaim(new Claim(
-                    Constants.Security.TicketExpiresClaimType,
-                    ctx.Properties.ExpiresUtc!.Value.ToString("o"),
-                    ClaimValueTypes.DateTime,
-                    Constants.Security.BackOfficeAuthenticationType,
-                    Constants.Security.BackOfficeAuthenticationType,
-                    backOfficeIdentity));
-
-                await securityStampValidator.ValidateAsync(ctx);
-
-                // We have to manually specify Issued and Expires,
-                // because the SecurityStampValidator refreshes the principal every 30 minutes,
-                // When the principal is refreshed the Issued is update to time of refresh, however, the Expires remains unchanged
-                // When we then try and renew, the difference of issued and expires effectively becomes the new ExpireTimeSpan
-                // meaning we effectively lose 30 minutes of our ExpireTimeSpan for EVERY principal refresh if we don't
-                // https://github.com/dotnet/aspnetcore/blob/main/src/Security/Authentication/Cookies/src/CookieAuthenticationHandler.cs#L115
-                ctx.Properties.IssuedUtc = _timeProvider.GetUtcNow();
-                ctx.Properties.ExpiresUtc = _timeProvider.GetUtcNow().Add(_globalSettings.TimeOut);
-                ctx.ShouldRenew = true;
-            },
-            OnSigningIn = ctx =>
-            {
-                // occurs when sign in is successful but before the ticket is written to the outbound cookie
-                ClaimsIdentity? backOfficeIdentity = ctx.Principal?.GetUmbracoIdentity();
-                if (backOfficeIdentity != null)
-                {
-                    // generate a session id and assign it
-                    // create a session token - if we are configured and not in an upgrade state then use the db, otherwise just generate one
-                    Guid session = _runtimeState.Level == RuntimeLevel.Run
-                        ? _userService.CreateLoginSession(
-                            backOfficeIdentity.GetId()!.Value,
-                            _ipResolver.GetCurrentRequestIpAddress())
-                        : Guid.NewGuid();
-
-                    // add our session claim
-                    backOfficeIdentity.AddClaim(new Claim(
-                        Constants.Security.SessionIdClaimType,
-                        session.ToString(),
-                        ClaimValueTypes.String,
-                        Constants.Security.BackOfficeAuthenticationType,
-                        Constants.Security.BackOfficeAuthenticationType,
-                        backOfficeIdentity));
-
-                    // since it is a cookie-based authentication add that claim
-                    backOfficeIdentity.AddClaim(new Claim(
-                        ClaimTypes.CookiePath,
-                        "/",
-                        ClaimValueTypes.String,
-                        Constants.Security.BackOfficeAuthenticationType,
-                        Constants.Security.BackOfficeAuthenticationType,
-                        backOfficeIdentity));
-                }
-
-                return Task.CompletedTask;
-            },
-            OnSignedIn = ctx =>
-            {
-                // occurs when sign in is successful and after the ticket is written to the outbound cookie
-
-                // When we are signed in with the cookie, assign the principal to the current HttpContext
-                ctx.HttpContext.SetPrincipalForRequest(ctx.Principal);
-
-                return Task.CompletedTask;
-            },
-            OnSigningOut = ctx =>
-            {
-                // Clear the user's session on sign out
-                if (ctx.HttpContext?.User?.Identity != null)
-                {
-                    var claimsIdentity = ctx.HttpContext.User.Identity as ClaimsIdentity;
-                    var sessionId = claimsIdentity?.FindFirstValue(Constants.Security.SessionIdClaimType);
-                    if (sessionId.IsNullOrWhiteSpace() == false && Guid.TryParse(sessionId, out Guid guidSession))
-                    {
-                        _userService.ClearLoginSession(guidSession);
-                    }
-                }
-
-                // Remove all of our cookies
-                var cookies = new[]
-                {
-                    _securitySettings.AuthCookieName,
-                    Constants.Web.PreviewCookieName, Constants.Security.BackOfficeExternalCookieName,
-                    Constants.Web.CsrfValidationCookieName
-                };
-                foreach (var cookie in cookies)
-                {
-                    ctx.Options.CookieManager.DeleteCookie(ctx.HttpContext!, cookie, new CookieOptions { Path = "/" });
-                }
-
-                return Task.CompletedTask;
-            }
-        };
-    }
-
-    /// <summary>
-    ///     Ensures the ticket is renewed if the <see cref="SecuritySettings.KeepUserLoggedIn" /> is set to true
-    ///     and the current request is for the get user seconds endpoint
-    /// </summary>
-    /// <param name="context">The <see cref="CookieValidatePrincipalContext" /></param>
-    private void EnsureTicketRenewalIfKeepUserLoggedIn(CookieValidatePrincipalContext context)
-    {
-        if (!_securitySettings.KeepUserLoggedIn)
-        {
-            return;
-        }
-
-        DateTimeOffset currentUtc = _timeProvider.GetUtcNow();
-        DateTimeOffset? issuedUtc = context.Properties.IssuedUtc;
-        DateTimeOffset? expiresUtc = context.Properties.ExpiresUtc;
-
-        if (expiresUtc.HasValue && issuedUtc.HasValue)
-        {
-            TimeSpan timeElapsed = currentUtc.Subtract(issuedUtc.Value);
-            TimeSpan timeRemaining = expiresUtc.Value.Subtract(currentUtc);
-
-            // if it's time to renew, then do it
-            if (timeRemaining < timeElapsed)
-            {
-                context.ShouldRenew = true;
-            }
-        }
-    }
-}
@@ -1,28 +0,0 @@
-using Microsoft.Extensions.Options;
-using Umbraco.Cms.Api.Management.Security;
-using Umbraco.Cms.Core.Configuration.Models;
-using Umbraco.Cms.Web.Common.Security;
-
-namespace Umbraco.Cms.Api.Management.Configuration;
-
-/// <summary>
-///     Configures the back office security stamp options.
-/// </summary>
-public class ConfigureBackOfficeSecurityStampValidatorOptions : IConfigureOptions<BackOfficeSecurityStampValidatorOptions>
-{
-    private readonly SecuritySettings _securitySettings;
-    private readonly TimeProvider _timeProvider;
-
-    public ConfigureBackOfficeSecurityStampValidatorOptions(IOptions<SecuritySettings> securitySettings, TimeProvider timeProvider)
-    {
-        _timeProvider = timeProvider;
-        _securitySettings = securitySettings.Value;
-    }
-
-    /// <inheritdoc />
-    public void Configure(BackOfficeSecurityStampValidatorOptions options)
-    {
-        options.TimeProvider = _timeProvider;
-        ConfigureSecurityStampOptions.ConfigureOptions(options, _securitySettings);
-    }
-}
@@ -1,66 +0,0 @@
-using Microsoft.Extensions.DependencyInjection;
-using Microsoft.Extensions.Options;
-using Microsoft.OpenApi.Models;
-using Swashbuckle.AspNetCore.SwaggerGen;
-using Umbraco.Cms.Api.Common.OpenApi;
-using Umbraco.Cms.Api.Common.Serialization;
-using Umbraco.Cms.Api.Management.DependencyInjection;
-using Umbraco.Cms.Api.Management.OpenApi;
-
-namespace Umbraco.Cms.Api.Management.Configuration;
-
-public class ConfigureUmbracoManagementApiSwaggerGenOptions : IConfigureOptions<SwaggerGenOptions>
-{
-    private IUmbracoJsonTypeInfoResolver _umbracoJsonTypeInfoResolver;
-
-    public ConfigureUmbracoManagementApiSwaggerGenOptions(IUmbracoJsonTypeInfoResolver umbracoJsonTypeInfoResolver)
-    {
-        _umbracoJsonTypeInfoResolver = umbracoJsonTypeInfoResolver;
-    }
-
-    public void Configure(SwaggerGenOptions swaggerGenOptions)
-    {
-
-        swaggerGenOptions.SwaggerDoc(
-            ManagementApiConfiguration.ApiName,
-            new OpenApiInfo
-            {
-                Title = ManagementApiConfiguration.ApiTitle,
-                Version = "Latest",
-                Description = "This shows all APIs available in this version of Umbraco - including all the legacy apis that are available for backward compatibility",
-            });
-
-        swaggerGenOptions.OperationFilter<ResponseHeaderOperationFilter>();
-        swaggerGenOptions.SelectSubTypesUsing(_umbracoJsonTypeInfoResolver.FindSubTypes);
-        swaggerGenOptions.UseOneOfForPolymorphism();
-
-        // Ensure all types that implements the IOpenApiDiscriminator have a $type property in the OpenApi schema with the default value (The class name) that is expected by the server
-        swaggerGenOptions.SelectDiscriminatorNameUsing(type => _umbracoJsonTypeInfoResolver.GetTypeDiscriminatorValue(type) is not null ? "$type" : null);
-        swaggerGenOptions.SelectDiscriminatorValueUsing(_umbracoJsonTypeInfoResolver.GetTypeDiscriminatorValue);
-
-
-        swaggerGenOptions.AddSecurityDefinition(
-            ManagementApiConfiguration.ApiSecurityName,
-            new OpenApiSecurityScheme
-             {
-                 In = ParameterLocation.Header,
-                 Name = "Umbraco",
-                 Type = SecuritySchemeType.OAuth2,
-                 Description = "Umbraco Authentication",
-                 Flows = new OpenApiOAuthFlows
-                 {
-                     AuthorizationCode = new OpenApiOAuthFlow
-                     {
-                         AuthorizationUrl =
-                             new Uri(Common.Security.Paths.BackOfficeApi.AuthorizationEndpoint, UriKind.Relative),
-                         TokenUrl = new Uri(Common.Security.Paths.BackOfficeApi.TokenEndpoint, UriKind.Relative)
-                     }
-                 }
-             });
-
-        // Sets Security requirement on backoffice apis
-        swaggerGenOptions.OperationFilter<BackOfficeSecurityRequirementsOperationFilter>();
-        swaggerGenOptions.OperationFilter<NotificationHeaderFilter>();
-        swaggerGenOptions.SchemaFilter<RequireNonNullablePropertiesSchemaFilter>();
-    }
-}
@@ -1,69 +0,0 @@
-using Microsoft.AspNetCore.Authentication;
-using Microsoft.AspNetCore.Mvc;
-using Microsoft.Extensions.Options;
-using Umbraco.Cms.Core;
-using Umbraco.Cms.Core.Configuration.Models;
-using Umbraco.Cms.Core.Hosting;
-
-namespace Umbraco.Cms.Api.Management;
-
-[BindProperties]
-public class BackOfficeLoginModel
-{
-    /// <summary>
-    /// Gets or sets the value of the "ReturnUrl" query parameter or defaults to the configured Umbraco directory.
-    /// </summary>
-    [FromQuery(Name = "ReturnUrl")]
-    public string? ReturnUrl { get; set; }
-
-    /// <summary>
-    /// The configured Umbraco directory.
-    /// </summary>
-    public string? UmbracoUrl { get; set; }
-
-    public bool UserIsAlreadyLoggedIn { get; set; }
-}
-
-[ApiExplorerSettings(IgnoreApi=true)]
-[Route(LoginPath)]
-public class BackOfficeLoginController : Controller
-{
-    public const string LoginPath = "/umbraco/login";
-    private readonly IHostingEnvironment _hostingEnvironment;
-    private readonly GlobalSettings _globalSettings;
-
-    public BackOfficeLoginController(
-        IOptionsSnapshot<GlobalSettings> globalSettings,
-        IHostingEnvironment hostingEnvironment)
-    {
-        _hostingEnvironment = hostingEnvironment;
-        _globalSettings = globalSettings.Value ?? throw new ArgumentNullException(nameof(globalSettings));
-    }
-
-    // GET
-    public async Task<IActionResult> Index(CancellationToken cancellationToken, BackOfficeLoginModel model)
-    {
-        AuthenticateResult cookieAuthResult = await HttpContext.AuthenticateAsync(Constants.Security.BackOfficeAuthenticationType);
-        if (cookieAuthResult.Succeeded)
-        {
-            model.UserIsAlreadyLoggedIn = true;
-        }
-
-        if (string.IsNullOrEmpty(model.UmbracoUrl))
-        {
-            model.UmbracoUrl = _hostingEnvironment.ToAbsolute(_globalSettings.UmbracoPath);
-        }
-
-        if (string.IsNullOrEmpty(model.ReturnUrl))
-        {
-            model.ReturnUrl = model.UmbracoUrl;
-        }
-
-        if ( Uri.TryCreate(model.ReturnUrl, UriKind.Relative, out _) is false) // Needs to test for relative and not absolute, as /whatever/ is an absolute path on linux
-        {
-            return BadRequest("ReturnUrl must be a relative path.");
-        }
-
-        return View("/umbraco/UmbracoLogin/Index.cshtml", model);
-    }
-}
@@ -1,95 +0,0 @@
-using Microsoft.AspNetCore.Http;
-using Microsoft.AspNetCore.Mvc;
-using Umbraco.Cms.Api.Common.ViewModels.Pagination;
-using Umbraco.Cms.Api.Management.ViewModels.Content;
-using Umbraco.Cms.Core.Mapping;
-using Umbraco.Cms.Core.Models;
-using Umbraco.Cms.Core.Models.ContentEditing;
-using Umbraco.Cms.Core.PropertyEditors;
-using Umbraco.Cms.Core.Services.OperationStatus;
-using Umbraco.Extensions;
-
-namespace Umbraco.Cms.Api.Management.Controllers.Content;
-
-public abstract class ContentCollectionControllerBase<TContent, TCollectionResponseModel, TValueResponseModelBase, TVariantResponseModel> : ManagementApiControllerBase
-    where TContent : class, IContentBase
-    where TCollectionResponseModel : ContentResponseModelBase<TValueResponseModelBase, TVariantResponseModel>
-    where TValueResponseModelBase : ValueModelBase
-    where TVariantResponseModel : VariantResponseModelBase
-{
-    private readonly IUmbracoMapper _mapper;
-
-    protected ContentCollectionControllerBase(IUmbracoMapper mapper) => _mapper = mapper;
-
-    protected IActionResult CollectionResult(ListViewPagedModel<TContent> result)
-    {
-        PagedModel<TContent> collectionItemsResult = result.Items;
-        ListViewConfiguration collectionConfiguration = result.ListViewConfiguration;
-
-        var collectionPropertyAliases = collectionConfiguration
-            .IncludeProperties
-            .Select(p => p.Alias)
-            .WhereNotNull()
-            .ToArray();
-
-        List<TCollectionResponseModel> collectionResponseModels =
-            _mapper.MapEnumerable<TContent, TCollectionResponseModel>(collectionItemsResult.Items, context =>
-            {
-                context.SetIncludedProperties(collectionPropertyAliases);
-            });
-
-        var pageViewModel = new PagedViewModel<TCollectionResponseModel>
-        {
-            Items = collectionResponseModels,
-            Total = collectionItemsResult.Total,
-        };
-
-        return Ok(pageViewModel);
-    }
-
-    protected IActionResult ContentCollectionOperationStatusResult(ContentCollectionOperationStatus status, string type) =>
-        OperationStatusResult(status, problemDetailsBuilder => status switch
-        {
-            ContentCollectionOperationStatus.CollectionNotFound => new NotFoundObjectResult(problemDetailsBuilder
-                .WithTitle("Collection data type could not be found")
-                .WithDetail($"No collection data type was found for the corresponding {type} type. Ensure that the default and/or a custom collection data types exists")
-                .Build()),
-            ContentCollectionOperationStatus.ContentNotCollection => new BadRequestObjectResult(problemDetailsBuilder
-                .WithTitle($"The {type} item is not configured as a collection")
-                .WithDetail($"The specified {type} is not configured as a collection")
-                .Build()),
-            ContentCollectionOperationStatus.ContentNotFound => new NotFoundObjectResult(problemDetailsBuilder
-                .WithTitle($"The specified {type} could not be found")
-                .Build()),
-            ContentCollectionOperationStatus.ContentTypeNotFound => new BadRequestObjectResult(problemDetailsBuilder
-                .WithTitle($"The related {type} type could not be found")
-                .Build()),
-            ContentCollectionOperationStatus.DataTypeNotCollection => new BadRequestObjectResult(problemDetailsBuilder
-                .WithTitle("Data type id does not belong to a collection")
-                .WithDetail("The specified data type does not represent a collection")
-                .Build()),
-            ContentCollectionOperationStatus.DataTypeNotContentProperty => new BadRequestObjectResult(problemDetailsBuilder
-                .WithTitle($"Data type id is not a {type} property")
-                .WithDetail($"The specified data type is not part of the {type} properties")
-                .Build()),
-            ContentCollectionOperationStatus.DataTypeNotFound => new NotFoundObjectResult(problemDetailsBuilder
-                .WithTitle("The specified collection data type could not be found")
-                .Build()),
-            ContentCollectionOperationStatus.DataTypeWithoutContentType => new BadRequestObjectResult(problemDetailsBuilder
-                .WithTitle($"Missing {type} when specifying a collection data type")
-                .WithDetail($"The specified collection data type needs to be used in conjunction with a {type} item.")
-                .Build()),
-            ContentCollectionOperationStatus.MissingPropertiesInCollectionConfiguration => new BadRequestObjectResult(problemDetailsBuilder
-                .WithTitle("Missing properties in collection configuration")
-                .WithDetail("No properties are configured to display in the collection configuration")
-                .Build()),
-            ContentCollectionOperationStatus.OrderByNotPartOfCollectionConfiguration => new BadRequestObjectResult(problemDetailsBuilder
-                .WithTitle("Order by value is not a property on the configured collection")
-                .WithDetail("The specified orderBy property is not part of the collection configuration")
-                .Build()),
-            _ => new ObjectResult("Unknown content collection operation status")
-            {
-                StatusCode = StatusCodes.Status500InternalServerError,
-            },
-        });
-}
@@ -1,125 +0,0 @@
-using Microsoft.AspNetCore.Http;
-using Microsoft.AspNetCore.Mvc;
-using Umbraco.Cms.Core.Models.ContentEditing;
-using Umbraco.Cms.Core.Models.ContentEditing.Validation;
-using Umbraco.Cms.Core.Services.OperationStatus;
-using Umbraco.Extensions;
-
-namespace Umbraco.Cms.Api.Management.Controllers.Content;
-
-public abstract class ContentControllerBase : ManagementApiControllerBase
-{
-    protected IActionResult ContentEditingOperationStatusResult(ContentEditingOperationStatus status)
-        => OperationStatusResult(status, problemDetailsBuilder => status switch
-        {
-            ContentEditingOperationStatus.CancelledByNotification => BadRequest(problemDetailsBuilder
-                .WithTitle("Cancelled by notification")
-                .WithDetail("A notification handler prevented the content operation.")
-                .Build()),
-            ContentEditingOperationStatus.ContentTypeNotFound => NotFound(problemDetailsBuilder
-                .WithTitle("The requested content type could not be found")
-                .Build()),
-            ContentEditingOperationStatus.ContentTypeCultureVarianceMismatch => BadRequest(problemDetailsBuilder
-                .WithTitle("Content type culture variance mismatch")
-                .WithDetail("The content type variance did not match that of the passed content data.")
-                .Build()),
-            ContentEditingOperationStatus.NotFound => NotFound(problemDetailsBuilder
-                .WithTitle("The content could not be found")
-                .Build()),
-            ContentEditingOperationStatus.ParentNotFound => NotFound(problemDetailsBuilder
-                .WithTitle("The targeted content parent could not be found")
-                .Build()),
-            ContentEditingOperationStatus.ParentInvalid => BadRequest(problemDetailsBuilder
-                .WithTitle("Invalid parent")
-                .WithDetail("The targeted parent was not valid for the operation.")
-                .Build()),
-            ContentEditingOperationStatus.NotAllowed => BadRequest(problemDetailsBuilder
-                .WithTitle("Operation not permitted")
-                .WithDetail(
-                    "The attempted operation was not permitted, likely due to a permission/configuration mismatch with the operation.")
-                .Build()),
-            ContentEditingOperationStatus.TemplateNotFound => NotFound(problemDetailsBuilder
-                .WithTitle("The template could not be found")
-                .Build()),
-            ContentEditingOperationStatus.TemplateNotAllowed => BadRequest(problemDetailsBuilder
-                .WithTitle("Template not allowed")
-                .WithDetail("The selected template was not allowed for the operation.")
-                .Build()),
-            ContentEditingOperationStatus.PropertyTypeNotFound => NotFound(problemDetailsBuilder
-                .WithTitle("One or more property types could not be found")
-                .Build()),
-            ContentEditingOperationStatus.InTrash => BadRequest(problemDetailsBuilder
-                .WithTitle("Content is in the recycle bin")
-                .WithDetail("Could not perform the operation because the targeted content was in the recycle bin.")
-                .Build()),
-            ContentEditingOperationStatus.NotInTrash => BadRequest(problemDetailsBuilder
-                .WithTitle("Content is not in the recycle bin")
-                .WithDetail("The attempted operation requires the targeted content to be in the recycle bin.")
-                .Build()),
-            ContentEditingOperationStatus.SortingInvalid => BadRequest(problemDetailsBuilder
-                .WithTitle("Invalid sorting options")
-                .WithDetail("The supplied sorting operations were invalid. Additional details can be found in the log.")
-                .Build()),
-            ContentEditingOperationStatus.InvalidCulture => BadRequest(problemDetailsBuilder
-                .WithTitle("Invalid culture")
-                .WithDetail("One or more of the supplied culture codes did not match the configured languages.")
-                .Build()),
-            ContentEditingOperationStatus.DuplicateKey => BadRequest(problemDetailsBuilder
-                .WithTitle("Invalid Id")
-                .WithDetail("The supplied id is already in use.")
-                .Build()),
-            ContentEditingOperationStatus.DuplicateName => BadRequest(problemDetailsBuilder
-                .WithTitle("Duplicate name")
-                .WithDetail("The supplied name is already in use for the same content type.")
-                .Build()),
-            ContentEditingOperationStatus.Unknown => StatusCode(
-                StatusCodes.Status500InternalServerError,
-                problemDetailsBuilder
-                    .WithTitle("Unknown error. Please see the log for more details.")
-                    .Build()),
-            _ => StatusCode(StatusCodes.Status500InternalServerError, problemDetailsBuilder
-                .WithTitle("Unknown content operation status.")
-                .Build()),
-        });
-
-    protected IActionResult ContentEditingOperationStatusResult<TContentModelBase, TValueModel, TVariantModel>(
-        ContentEditingOperationStatus status,
-        TContentModelBase requestModel,
-        ContentValidationResult validationResult)
-        where TContentModelBase : ContentModelBase<TValueModel, TVariantModel>
-        where TValueModel : ValueModelBase
-        where TVariantModel : VariantModelBase
-    {
-        if (status is not ContentEditingOperationStatus.PropertyValidationError)
-        {
-            return ContentEditingOperationStatusResult(status);
-        }
-
-        var errors = new SortedDictionary<string, string[]>();
-        var missingPropertyAliases = new List<string>();
-        foreach (PropertyValidationError validationError in validationResult.ValidationErrors)
-        {
-            TValueModel? requestValue = requestModel.Values.FirstOrDefault(value =>
-                value.Alias == validationError.Alias
-                && value.Culture == validationError.Culture
-                && value.Segment == validationError.Segment);
-            if (requestValue is null)
-            {
-                missingPropertyAliases.Add(validationError.Alias);
-                continue;
-            }
-
-            var index = requestModel.Values.IndexOf(requestValue);
-            var key = $"$.{nameof(ContentModelBase<TValueModel, TVariantModel>.Values).ToFirstLowerInvariant()}[{index}].{nameof(ValueModelBase.Value).ToFirstLowerInvariant()}{validationError.JsonPath}";
-            errors.Add(key, validationError.ErrorMessages);
-        }
-
-        return OperationStatusResult(status, problemDetailsBuilder
-            => BadRequest(problemDetailsBuilder
-                .WithTitle("Validation failed")
-                .WithDetail("One or more properties did not pass validation")
-                .WithRequestModelErrors(errors)
-                .WithExtension("missingProperties", missingPropertyAliases.ToArray())
-                .Build()));
-    }
-}
@@ -1,43 +0,0 @@
-using System.Globalization;
-using Asp.Versioning;
-using Microsoft.AspNetCore.Http;
-using Microsoft.AspNetCore.Mvc;
-using Umbraco.Cms.Core.Mapping;
-using Umbraco.Cms.Api.Management.ViewModels.Culture;
-using Umbraco.Cms.Api.Common.ViewModels.Pagination;
-using Umbraco.Cms.Core.Services;
-
-namespace Umbraco.Cms.Api.Management.Controllers.Culture;
-
-[ApiVersion("1.0")]
-public class AllCultureController : CultureControllerBase
-{
-    private readonly IUmbracoMapper _umbracoMapper;
-    private readonly ICultureService _cultureService;
-
-    public AllCultureController(IUmbracoMapper umbracoMapper, ICultureService cultureService)
-    {
-        _umbracoMapper = umbracoMapper;
-        _cultureService = cultureService;
-    }
-
-    /// <summary>
-    ///     Returns all cultures available for creating languages.
-    /// </summary>
-    /// <returns></returns>
-    [HttpGet]
-    [MapToApiVersion("1.0")]
-    [ProducesResponseType(typeof(PagedViewModel<CultureReponseModel>), StatusCodes.Status200OK)]
-    public async Task<PagedViewModel<CultureReponseModel>> GetAll(CancellationToken cancellationToken, int skip = 0, int take = 100)
-    {
-        CultureInfo[] all = _cultureService.GetValidCultureInfos();
-
-        var viewModel = new PagedViewModel<CultureReponseModel>
-        {
-            Items = _umbracoMapper.MapEnumerable<CultureInfo, CultureReponseModel>(all.Skip(skip).Take(take)),
-            Total = all.Length
-        };
-
-        return await Task.FromResult(viewModel);
-    }
-}
@@ -1,10 +0,0 @@
-using Microsoft.AspNetCore.Mvc;
-using Umbraco.Cms.Api.Management.Routing;
-
-namespace Umbraco.Cms.Api.Management.Controllers.Culture;
-
-[VersionedApiBackOfficeRoute("culture")]
-[ApiExplorerSettings(GroupName = "Culture")]
-public abstract class CultureControllerBase : ManagementApiControllerBase
-{
-}
@@ -1,37 +0,0 @@
-using Asp.Versioning;
-using Microsoft.AspNetCore.Http;
-using Microsoft.AspNetCore.Mvc;
-using Umbraco.Cms.Api.Management.ViewModels.DataType;
-using Umbraco.Cms.Core.Mapping;
-using Umbraco.Cms.Core.Models;
-using Umbraco.Cms.Core.Services;
-
-namespace Umbraco.Cms.Api.Management.Controllers.DataType;
-
-[ApiVersion("1.0")]
-public class ByKeyDataTypeController : DataTypeControllerBase
-{
-    private readonly IDataTypeService _dataTypeService;
-    private readonly IUmbracoMapper _umbracoMapper;
-
-    public ByKeyDataTypeController(IDataTypeService dataTypeService, IUmbracoMapper umbracoMapper)
-    {
-        _dataTypeService = dataTypeService;
-        _umbracoMapper = umbracoMapper;
-    }
-
-    [HttpGet("{id:guid}")]
-    [MapToApiVersion("1.0")]
-    [ProducesResponseType(typeof(DataTypeResponseModel), StatusCodes.Status200OK)]
-    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status404NotFound)]
-    public async Task<IActionResult> ByKey(CancellationToken cancellationToken, Guid id)
-    {
-        IDataType? dataType = await _dataTypeService.GetAsync(id);
-        if (dataType == null)
-        {
-            return DataTypeNotFound();
-        }
-
-        return Ok(_umbracoMapper.Map<DataTypeResponseModel>(dataType));
-    }
-}
@@ -1,31 +0,0 @@
-using Asp.Versioning;
-using Microsoft.AspNetCore.Http;
-using Microsoft.AspNetCore.Mvc;
-using Microsoft.Extensions.Options;
-using Umbraco.Cms.Api.Management.ViewModels.DataType;
-using Umbraco.Cms.Core;
-using Umbraco.Cms.Core.Configuration.Models;
-
-namespace Umbraco.Cms.Api.Management.Controllers.DataType;
-
-[ApiVersion("1.0")]
-public class ConfigurationDataTypeController : DataTypeControllerBase
-{
-    private readonly DataTypesSettings _dataTypesSettings;
-
-    public ConfigurationDataTypeController(IOptionsSnapshot<DataTypesSettings> dataTypesSettings) => _dataTypesSettings = dataTypesSettings.Value;
-
-    [HttpGet("configuration")]
-    [MapToApiVersion("1.0")]
-    [ProducesResponseType(typeof(DatatypeConfigurationResponseModel), StatusCodes.Status200OK)]
-    public Task<IActionResult> Configuration(CancellationToken cancellationToken)
-    {
-        var responseModel = new DatatypeConfigurationResponseModel
-        {
-            CanBeChanged = _dataTypesSettings.CanBeChanged,
-            DocumentListViewId = Constants.DataTypes.Guids.ListViewContentGuid,
-            MediaListViewId = Constants.DataTypes.Guids.ListViewMediaGuid,
-        };
-        return Task.FromResult<IActionResult>(Ok(responseModel));
-    }
-}
@@ -1,43 +0,0 @@
-using Asp.Versioning;
-using Microsoft.AspNetCore.Http;
-using Microsoft.AspNetCore.Mvc;
-using Umbraco.Cms.Api.Management.ViewModels.DataType;
-using Umbraco.Cms.Core;
-using Umbraco.Cms.Core.Models;
-using Umbraco.Cms.Core.Security;
-using Umbraco.Cms.Core.Services;
-using Umbraco.Cms.Core.Services.OperationStatus;
-
-namespace Umbraco.Cms.Api.Management.Controllers.DataType;
-
-[ApiVersion("1.0")]
-public class CopyDataTypeController : DataTypeControllerBase
-{
-    private readonly IDataTypeService _dataTypeService;
-    private readonly IBackOfficeSecurityAccessor _backOfficeSecurityAccessor;
-
-    public CopyDataTypeController(IDataTypeService dataTypeService, IBackOfficeSecurityAccessor backOfficeSecurityAccessor)
-    {
-        _dataTypeService = dataTypeService;
-        _backOfficeSecurityAccessor = backOfficeSecurityAccessor;
-    }
-
-    [HttpPost("{id:guid}/copy")]
-    [MapToApiVersion("1.0")]
-    [ProducesResponseType(StatusCodes.Status201Created)]
-    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status404NotFound)]
-    public async Task<IActionResult> Copy(CancellationToken cancellationToken, Guid id, CopyDataTypeRequestModel copyDataTypeRequestModel)
-    {
-        IDataType? source = await _dataTypeService.GetAsync(id);
-        if (source is null)
-        {
-            return DataTypeNotFound();
-        }
-
-        Attempt<IDataType, DataTypeOperationStatus> result = await _dataTypeService.CopyAsync(source, copyDataTypeRequestModel.Target?.Id, CurrentUserKey(_backOfficeSecurityAccessor));
-
-        return result.Success
-            ? CreatedAtId<ByKeyDataTypeController>(controller => nameof(controller.ByKey), result.Result.Key)
-            : DataTypeOperationStatusResult(result.Status);
-    }
-}
@@ -1,47 +0,0 @@
-using Asp.Versioning;
-using Microsoft.AspNetCore.Http;
-using Microsoft.AspNetCore.Mvc;
-using Umbraco.Cms.Api.Management.Factories;
-using Umbraco.Cms.Api.Management.ViewModels.DataType;
-using Umbraco.Cms.Core;
-using Umbraco.Cms.Core.Models;
-using Umbraco.Cms.Core.Security;
-using Umbraco.Cms.Core.Services;
-using Umbraco.Cms.Core.Services.OperationStatus;
-
-namespace Umbraco.Cms.Api.Management.Controllers.DataType;
-
-[ApiVersion("1.0")]
-public class CreateDataTypeController : DataTypeControllerBase
-{
-    private readonly IDataTypeService _dataTypeService;
-    private readonly IDataTypePresentationFactory _dataTypePresentationFactory;
-    private readonly IBackOfficeSecurityAccessor _backOfficeSecurityAccessor;
-
-    public CreateDataTypeController(IDataTypeService dataTypeService, IDataTypePresentationFactory dataTypePresentationFactory, IBackOfficeSecurityAccessor backOfficeSecurityAccessor)
-    {
-        _dataTypeService = dataTypeService;
-        _dataTypePresentationFactory = dataTypePresentationFactory;
-        _backOfficeSecurityAccessor = backOfficeSecurityAccessor;
-    }
-
-    [HttpPost]
-    [MapToApiVersion("1.0")]
-    [ProducesResponseType(StatusCodes.Status201Created)]
-    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status400BadRequest)]
-    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status404NotFound)]
-    public async Task<IActionResult> Create(CancellationToken cancellationToken, CreateDataTypeRequestModel createDataTypeRequestModel)
-    {
-        var attempt = await _dataTypePresentationFactory.CreateAsync(createDataTypeRequestModel);
-        if (!attempt.Success)
-        {
-            return DataTypeOperationStatusResult(attempt.Status);
-        }
-
-        Attempt<IDataType, DataTypeOperationStatus> result = await _dataTypeService.CreateAsync(attempt.Result, CurrentUserKey(_backOfficeSecurityAccessor));
-
-        return result.Success
-            ? CreatedAtId<ByKeyDataTypeController>(controller => nameof(controller.ByKey), result.Result.Key)
-            : DataTypeOperationStatusResult(result.Status);
-    }
-}
@@ -1,62 +0,0 @@
-using Microsoft.AspNetCore.Authorization;
-using Microsoft.AspNetCore.Http;
-using Microsoft.AspNetCore.Mvc;
-using Umbraco.Cms.Api.Common.Builders;
-using Umbraco.Cms.Api.Management.Routing;
-using Umbraco.Cms.Core;
-using Umbraco.Cms.Core.Services.OperationStatus;
-using Umbraco.Cms.Web.Common.Authorization;
-
-namespace Umbraco.Cms.Api.Management.Controllers.DataType;
-
-[VersionedApiBackOfficeRoute(Constants.UdiEntityType.DataType)]
-[ApiExplorerSettings(GroupName = "Data Type")]
-[Authorize(Policy = AuthorizationPolicies.TreeAccessDocumentsOrDocumentTypes)]
-public abstract class DataTypeControllerBase : ManagementApiControllerBase
-{
-    protected IActionResult DataTypeOperationStatusResult(DataTypeOperationStatus status) =>
-        OperationStatusResult(status, problemDetailsBuilder => status switch
-        {
-            DataTypeOperationStatus.InvalidConfiguration => BadRequest(problemDetailsBuilder
-                .WithTitle("Invalid data type configuration")
-                .WithDetail("The supplied data type configuration was not valid. Please see the log for more details.")
-                .Build()),
-            DataTypeOperationStatus.NotFound => DataTypeNotFound(problemDetailsBuilder),
-            DataTypeOperationStatus.InvalidName => BadRequest(problemDetailsBuilder
-                .WithTitle("Invalid data type name")
-                .WithDetail("The data type name must be non-empty and no longer than 255 characters.")
-                .Build()),
-            DataTypeOperationStatus.ParentNotContainer => BadRequest(problemDetailsBuilder
-                .WithTitle("parent id is not a container")
-                .WithDetail("The parent id does not represent a container.")
-                .Build()),
-            DataTypeOperationStatus.DuplicateKey => BadRequest(problemDetailsBuilder
-                .WithTitle("The id is already used")
-                .WithDetail("The data type id must be unique.")
-                .Build()),
-            DataTypeOperationStatus.CancelledByNotification => BadRequest(problemDetailsBuilder
-                .WithTitle("Cancelled by notification")
-                .WithDetail("A notification handler prevented the data type operation.")
-                .Build()),
-            DataTypeOperationStatus.PropertyEditorNotFound => NotFound(problemDetailsBuilder
-                .WithTitle("The targeted property editor was not found.")
-                .Build()),
-            DataTypeOperationStatus.ParentNotFound => NotFound(problemDetailsBuilder
-                .WithTitle("The targeted parent for the data type operation was not found.")
-                .Build()),
-            DataTypeOperationStatus.NonDeletable => BadRequest(problemDetailsBuilder
-                .WithTitle("The data type is non-deletable")
-                .WithDetail("The specified data type is required by the system and cannot be deleted.")
-                .Build()),
-            _ => StatusCode(StatusCodes.Status500InternalServerError, problemDetailsBuilder
-                .WithTitle("Unknown data type operation status.")
-                .Build()),
-        });
-
-    protected IActionResult DataTypeNotFound() => OperationStatusResult(DataTypeOperationStatus.NotFound, DataTypeNotFound);
-
-    private IActionResult DataTypeNotFound(ProblemDetailsBuilder problemDetailsBuilder)
-        => NotFound(problemDetailsBuilder
-            .WithTitle("The data type could not be found")
-            .Build());
-}
@@ -1,37 +0,0 @@
-using Asp.Versioning;
-using Microsoft.AspNetCore.Http;
-using Microsoft.AspNetCore.Mvc;
-using Umbraco.Cms.Core;
-using Umbraco.Cms.Core.Models;
-using Umbraco.Cms.Core.Security;
-using Umbraco.Cms.Core.Services;
-using Umbraco.Cms.Core.Services.OperationStatus;
-
-namespace Umbraco.Cms.Api.Management.Controllers.DataType;
-
-[ApiVersion("1.0")]
-public class DeleteDataTypeController : DataTypeControllerBase
-{
-    private readonly IDataTypeService _dataTypeService;
-    private readonly IBackOfficeSecurityAccessor _backOfficeSecurityAccessor;
-
-    public DeleteDataTypeController(IDataTypeService dataTypeService, IBackOfficeSecurityAccessor backOfficeSecurityAccessor)
-    {
-        _dataTypeService = dataTypeService;
-        _backOfficeSecurityAccessor = backOfficeSecurityAccessor;
-    }
-
-    [HttpDelete("{id:guid}")]
-    [MapToApiVersion("1.0")]
-    [ProducesResponseType(StatusCodes.Status200OK)]
-    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status400BadRequest)]
-    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status404NotFound)]
-    public async Task<IActionResult> Delete(CancellationToken cancellationToken, Guid id)
-    {
-        Attempt<IDataType?, DataTypeOperationStatus> result = await _dataTypeService.DeleteAsync(id, CurrentUserKey(_backOfficeSecurityAccessor));
-
-        return result.Success
-            ? Ok()
-            : DataTypeOperationStatusResult(result.Status);
-    }
-}
@@ -1,15 +0,0 @@
-using Microsoft.AspNetCore.Authorization;
-using Microsoft.AspNetCore.Mvc;
-using Umbraco.Cms.Api.Management.Routing;
-using Umbraco.Cms.Core;
-using Umbraco.Cms.Web.Common.Authorization;
-
-namespace Umbraco.Cms.Api.Management.Controllers.DataType.Filter;
-
-[ApiExplorerSettings(GroupName = "Data Type")]
-[VersionedApiBackOfficeRoute($"{Constants.Web.RoutePath.Filter}/{Constants.UdiEntityType.DataType}")]
-// This auth policy might become problematic, as when getting DataTypes on Media types, you don't need access to the document tree.
-[Authorize(Policy = AuthorizationPolicies.TreeAccessDocumentsOrDocumentTypes)]
-public abstract class DataTypeFilterControllerBase : ManagementApiControllerBase
-{
-}
@@ -1,46 +0,0 @@
-using Asp.Versioning;
-using Microsoft.AspNetCore.Http;
-using Microsoft.AspNetCore.Mvc;
-using Umbraco.Cms.Api.Common.ViewModels.Pagination;
-using Umbraco.Cms.Api.Management.ViewModels.DataType.Item;
-using Umbraco.Cms.Api.Management.ViewModels.Language;
-using Umbraco.Cms.Core;
-using Umbraco.Cms.Core.Mapping;
-using Umbraco.Cms.Core.Models;
-using Umbraco.Cms.Core.Services;
-
-namespace Umbraco.Cms.Api.Management.Controllers.DataType.Filter;
-
-[ApiVersion("1.0")]
-public class FilterDataTypeFilterController : DataTypeFilterControllerBase
-{
-    private readonly IDataTypeService _dataTypeService;
-    private readonly IUmbracoMapper _mapper;
-
-    public FilterDataTypeFilterController(IDataTypeService dataTypeService, IUmbracoMapper mapper)
-    {
-        _dataTypeService = dataTypeService;
-        _mapper = mapper;
-    }
-
-    [HttpGet]
-    [MapToApiVersion("1.0")]
-    [ProducesResponseType(typeof(PagedViewModel<DataTypeItemResponseModel>), StatusCodes.Status200OK)]
-    public async Task<IActionResult> Filter(
-        CancellationToken cancellationToken,
-        int skip = 0,
-        int take = 100,
-        string name = "",
-        string? editorUiAlias = null,
-        string? editorAlias = null)
-    {
-        PagedModel<IDataType> dataTypes = await _dataTypeService.FilterAsync(name, editorUiAlias, editorAlias, skip, take);
-        List<DataTypeItemResponseModel> responseModels = _mapper.MapEnumerable<IDataType, DataTypeItemResponseModel>(dataTypes.Items);
-        var viewModel = new PagedViewModel<DataTypeItemResponseModel>
-        {
-            Total = dataTypes.Total,
-            Items = responseModels,
-        };
-        return Ok(viewModel);
-    }
-}
@@ -1,25 +0,0 @@
-using Asp.Versioning;
-using Microsoft.AspNetCore.Http;
-using Microsoft.AspNetCore.Mvc;
-using Umbraco.Cms.Api.Management.ViewModels.Folder;
-using Umbraco.Cms.Core.Security;
-using Umbraco.Cms.Core.Services;
-
-namespace Umbraco.Cms.Api.Management.Controllers.DataType.Folder;
-
-[ApiVersion("1.0")]
-public class ByKeyDataTypeFolderController : DataTypeFolderControllerBase
-{
-    public ByKeyDataTypeFolderController(
-        IBackOfficeSecurityAccessor backOfficeSecurityAccessor,
-        IDataTypeContainerService dataTypeContainerService)
-        : base(backOfficeSecurityAccessor, dataTypeContainerService)
-    {
-    }
-
-    [HttpGet("{id:guid}")]
-    [MapToApiVersion("1.0")]
-    [ProducesResponseType(typeof(FolderResponseModel), StatusCodes.Status200OK)]
-    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status404NotFound)]
-    public async Task<IActionResult> ByKey(CancellationToken cancellationToken, Guid id) => await GetFolderAsync(id);
-}
@@ -1,29 +0,0 @@
-using Asp.Versioning;
-using Microsoft.AspNetCore.Http;
-using Microsoft.AspNetCore.Mvc;
-using Umbraco.Cms.Api.Management.ViewModels.Folder;
-using Umbraco.Cms.Core.Security;
-using Umbraco.Cms.Core.Services;
-
-namespace Umbraco.Cms.Api.Management.Controllers.DataType.Folder;
-
-[ApiVersion("1.0")]
-public class CreateDataTypeFolderController : DataTypeFolderControllerBase
-{
-    public CreateDataTypeFolderController(
-        IBackOfficeSecurityAccessor backOfficeSecurityAccessor,
-        IDataTypeContainerService dataTypeContainerService)
-        : base(backOfficeSecurityAccessor, dataTypeContainerService)
-    {
-    }
-
-    [HttpPost]
-    [MapToApiVersion("1.0")]
-    [ProducesResponseType(StatusCodes.Status201Created)]
-    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status400BadRequest)]
-    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status404NotFound)]
-    public async Task<IActionResult> Create(CancellationToken cancellationToken, CreateFolderRequestModel createFolderRequestModel)
-        => await CreateFolderAsync<ByKeyDataTypeFolderController>(
-            createFolderRequestModel,
-            controller => nameof(controller.ByKey));
-}
@@ -1,23 +0,0 @@
-using Microsoft.AspNetCore.Authorization;
-using Microsoft.AspNetCore.Mvc;
-using Umbraco.Cms.Api.Management.Routing;
-using Umbraco.Cms.Core;
-using Umbraco.Cms.Core.Models;
-using Umbraco.Cms.Core.Security;
-using Umbraco.Cms.Core.Services;
-using Umbraco.Cms.Web.Common.Authorization;
-
-namespace Umbraco.Cms.Api.Management.Controllers.DataType.Folder;
-
-[VersionedApiBackOfficeRoute($"{Constants.UdiEntityType.DataType}/folder")]
-[ApiExplorerSettings(GroupName = "Data Type")]
-[Authorize(Policy = AuthorizationPolicies.TreeAccessDocumentTypes)]
-public abstract class DataTypeFolderControllerBase : FolderManagementControllerBase<IDataType>
-{
-    protected DataTypeFolderControllerBase(
-        IBackOfficeSecurityAccessor backOfficeSecurityAccessor,
-        IDataTypeContainerService dataTypeContainerService)
-        : base(backOfficeSecurityAccessor, dataTypeContainerService)
-    {
-    }
-}
@@ -1,25 +0,0 @@
-using Asp.Versioning;
-using Microsoft.AspNetCore.Http;
-using Microsoft.AspNetCore.Mvc;
-using Umbraco.Cms.Core.Security;
-using Umbraco.Cms.Core.Services;
-
-namespace Umbraco.Cms.Api.Management.Controllers.DataType.Folder;
-
-[ApiVersion("1.0")]
-public class DeleteDataTypeFolderController : DataTypeFolderControllerBase
-{
-    public DeleteDataTypeFolderController(
-        IBackOfficeSecurityAccessor backOfficeSecurityAccessor,
-        IDataTypeContainerService dataTypeContainerService)
-        : base(backOfficeSecurityAccessor, dataTypeContainerService)
-    {
-    }
-
-    [HttpDelete("{id:guid}")]
-    [MapToApiVersion("1.0")]
-    [ProducesResponseType(StatusCodes.Status200OK)]
-    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status400BadRequest)]
-    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status404NotFound)]
-    public async Task<IActionResult> Delete(CancellationToken cancellationToken, Guid id) => await DeleteFolderAsync(id);
-}
@@ -1,30 +0,0 @@
-using Asp.Versioning;
-using Microsoft.AspNetCore.Http;
-using Microsoft.AspNetCore.Mvc;
-using Umbraco.Cms.Api.Management.ViewModels.Folder;
-using Umbraco.Cms.Core.Security;
-using Umbraco.Cms.Core.Services;
-
-namespace Umbraco.Cms.Api.Management.Controllers.DataType.Folder;
-
-[ApiVersion("1.0")]
-public class UpdateDataTypeFolderController : DataTypeFolderControllerBase
-{
-    public UpdateDataTypeFolderController(
-        IBackOfficeSecurityAccessor backOfficeSecurityAccessor,
-        IDataTypeContainerService dataTypeContainerService)
-        : base(backOfficeSecurityAccessor, dataTypeContainerService)
-    {
-    }
-
-    [HttpPut("{id:guid}")]
-    [MapToApiVersion("1.0")]
-    [ProducesResponseType(StatusCodes.Status200OK)]
-    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status400BadRequest)]
-    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status404NotFound)]
-    public async Task<IActionResult> Update(
-        CancellationToken cancellationToken,
-        Guid id,
-        UpdateFolderResponseModel updateFolderResponseModel)
-        => await UpdateFolderAsync(id, updateFolderResponseModel);
-}
@@ -1,32 +0,0 @@
-using Asp.Versioning;
-using Microsoft.AspNetCore.Http;
-using Microsoft.AspNetCore.Mvc;
-using Umbraco.Cms.Core;
-using Umbraco.Cms.Core.Services;
-using Umbraco.Cms.Core.Services.OperationStatus;
-
-namespace Umbraco.Cms.Api.Management.Controllers.DataType;
-
-[ApiVersion("1.0")]
-public class IsUsedDataTypeController : DataTypeControllerBase
-{
-    private readonly IDataTypeUsageService _dataTypeUsageService;
-
-    public IsUsedDataTypeController(IDataTypeUsageService dataTypeUsageService)
-    {
-        _dataTypeUsageService = dataTypeUsageService;
-    }
-
-    [HttpGet("{id:guid}/is-used")]
-    [MapToApiVersion("1.0")]
-    [ProducesResponseType(typeof(bool), StatusCodes.Status200OK)]
-    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status404NotFound)]
-    public async Task<IActionResult> IsUsed(CancellationToken cancellationToken, Guid id)
-    {
-        Attempt<bool, DataTypeOperationStatus> result = await _dataTypeUsageService.HasSavedValuesAsync(id);
-
-        return result.Success
-            ? Ok(result.Result)
-            : DataTypeOperationStatusResult(result.Status);
-    }
-}
@@ -1,11 +0,0 @@
-using Microsoft.AspNetCore.Mvc;
-using Umbraco.Cms.Api.Management.Routing;
-using Umbraco.Cms.Core;
-
-namespace Umbraco.Cms.Api.Management.Controllers.DataType.Item;
-
-[VersionedApiBackOfficeRoute($"{Constants.Web.RoutePath.Item}/{Constants.UdiEntityType.DataType}")]
-[ApiExplorerSettings(GroupName = "Data Type")]
-public class DatatypeItemControllerBase : ManagementApiControllerBase
-{
-}
@@ -1,48 +0,0 @@
-using Asp.Versioning;
-using Microsoft.AspNetCore.Http;
-using Microsoft.AspNetCore.Mvc;
-using Umbraco.Cms.Api.Management.ViewModels.DataType.Item;
-using Umbraco.Cms.Core.Mapping;
-using Umbraco.Cms.Core.Models;
-using Umbraco.Cms.Core.Services;
-
-namespace Umbraco.Cms.Api.Management.Controllers.DataType.Item;
-
-[ApiVersion("1.0")]
-public class ItemDatatypeItemController : DatatypeItemControllerBase
-{
-    private readonly IDataTypeService _dataTypeService;
-    private readonly IUmbracoMapper _mapper;
-
-    public ItemDatatypeItemController(IDataTypeService dataTypeService, IUmbracoMapper mapper)
-    {
-        _dataTypeService = dataTypeService;
-        _mapper = mapper;
-    }
-
-    [HttpGet]
-    [MapToApiVersion("1.0")]
-    [ProducesResponseType(typeof(IEnumerable<DataTypeItemResponseModel>), StatusCodes.Status200OK)]
-    public async Task<IActionResult> Item(
-        CancellationToken cancellationToken,
-        [FromQuery(Name = "id")] HashSet<Guid> ids)
-    {
-        if (ids.Count is 0)
-        {
-            return Ok(Enumerable.Empty<DataTypeItemResponseModel>());
-        }
-
-        var dataTypes = new List<IDataType>();
-        foreach (Guid id in ids)
-        {
-            IDataType? dataType = await _dataTypeService.GetAsync(id);
-            if (dataType is not null)
-            {
-                dataTypes.Add(dataType);
-            }
-        }
-
-        List<DataTypeItemResponseModel> responseModels = _mapper.MapEnumerable<IDataType, DataTypeItemResponseModel>(dataTypes);
-        return Ok(responseModels);
-    }
-}
@@ -1,46 +0,0 @@
-using Asp.Versioning;
-using Microsoft.AspNetCore.Http;
-using Microsoft.AspNetCore.Mvc;
-using Umbraco.Cms.Api.Management.ViewModels.DataType.Item;
-using Umbraco.Cms.Core.Mapping;
-using Umbraco.Cms.Core.Models;
-using Umbraco.Cms.Core.Models.Entities;
-using Umbraco.Cms.Core.Services;
-
-namespace Umbraco.Cms.Api.Management.Controllers.DataType.Item;
-
-[ApiVersion("1.0")]
-public class SearchDataTypeItemController : DatatypeItemControllerBase
-{
-    private readonly IEntitySearchService _entitySearchService;
-    private readonly IDataTypeService _dataTypeService;
-    private readonly IUmbracoMapper _mapper;
-
-    public SearchDataTypeItemController(IEntitySearchService entitySearchService, IDataTypeService dataTypeService, IUmbracoMapper mapper)
-    {
-        _entitySearchService = entitySearchService;
-        _dataTypeService = dataTypeService;
-        _mapper = mapper;
-    }
-
-    [HttpGet("search")]
-    [MapToApiVersion("1.0")]
-    [ProducesResponseType(typeof(PagedModel<DataTypeItemResponseModel>), StatusCodes.Status200OK)]
-    public async Task<IActionResult> Search(CancellationToken cancellationToken, string query, int skip = 0, int take = 100)
-    {
-        PagedModel<IEntitySlim> searchResult = _entitySearchService.Search(UmbracoObjectTypes.DataType, query, skip, take);
-        if (searchResult.Items.Any() is false)
-        {
-            return Ok(new PagedModel<DataTypeItemResponseModel> { Total = searchResult.Total });
-        }
-
-        IEnumerable<IDataType> dataTypes = await _dataTypeService.GetAllAsync(searchResult.Items.Select(item => item.Key).ToArray());
-        var result = new PagedModel<DataTypeItemResponseModel>
-        {
-            Items = _mapper.MapEnumerable<IDataType, DataTypeItemResponseModel>(dataTypes),
-            Total = searchResult.Total
-        };
-
-        return Ok(result);
-    }
-}
@@ -1,43 +0,0 @@
-using Asp.Versioning;
-using Microsoft.AspNetCore.Http;
-using Microsoft.AspNetCore.Mvc;
-using Umbraco.Cms.Api.Management.ViewModels.DataType;
-using Umbraco.Cms.Core;
-using Umbraco.Cms.Core.Models;
-using Umbraco.Cms.Core.Security;
-using Umbraco.Cms.Core.Services;
-using Umbraco.Cms.Core.Services.OperationStatus;
-
-namespace Umbraco.Cms.Api.Management.Controllers.DataType;
-
-[ApiVersion("1.0")]
-public class MoveDataTypeController : DataTypeControllerBase
-{
-    private readonly IDataTypeService _dataTypeService;
-    private readonly IBackOfficeSecurityAccessor _backOfficeSecurityAccessor;
-
-    public MoveDataTypeController(IDataTypeService dataTypeService, IBackOfficeSecurityAccessor backOfficeSecurityAccessor)
-    {
-        _dataTypeService = dataTypeService;
-        _backOfficeSecurityAccessor = backOfficeSecurityAccessor;
-    }
-
-    [HttpPut("{id:guid}/move")]
-    [MapToApiVersion("1.0")]
-    [ProducesResponseType(StatusCodes.Status200OK)]
-    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status404NotFound)]
-    public async Task<IActionResult> Move(CancellationToken cancellationToken, Guid id, MoveDataTypeRequestModel moveDataTypeRequestModel)
-    {
-        IDataType? source = await _dataTypeService.GetAsync(id);
-        if (source is null)
-        {
-            return DataTypeNotFound();
-        }
-
-        Attempt<IDataType, DataTypeOperationStatus> result = await _dataTypeService.MoveAsync(source, moveDataTypeRequestModel.Target?.Id, CurrentUserKey(_backOfficeSecurityAccessor));
-
-        return result.Success
-            ? Ok()
-            : DataTypeOperationStatusResult(result.Status);
-    }
-}
@@ -1,39 +0,0 @@
-using Asp.Versioning;
-using Microsoft.AspNetCore.Http;
-using Microsoft.AspNetCore.Mvc;
-using Umbraco.Cms.Api.Management.Factories;
-using Umbraco.Cms.Api.Management.ViewModels.DataType;
-using Umbraco.Cms.Core;
-using Umbraco.Cms.Core.Services;
-using Umbraco.Cms.Core.Services.OperationStatus;
-
-namespace Umbraco.Cms.Api.Management.Controllers.DataType;
-
-[ApiVersion("1.0")]
-public class ReferencesDataTypeController : DataTypeControllerBase
-{
-    private readonly IDataTypeService _dataTypeService;
-    private readonly IDataTypeReferencePresentationFactory _dataTypeReferencePresentationFactory;
-
-    public ReferencesDataTypeController(IDataTypeService dataTypeService, IDataTypeReferencePresentationFactory dataTypeReferencePresentationFactory)
-    {
-        _dataTypeService = dataTypeService;
-        _dataTypeReferencePresentationFactory = dataTypeReferencePresentationFactory;
-    }
-
-    [HttpGet("{id:guid}/references")]
-    [MapToApiVersion("1.0")]
-    [ProducesResponseType(typeof(DataTypeReferenceResponseModel[]), StatusCodes.Status200OK)]
-    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status404NotFound)]
-    public async Task<IActionResult> References(CancellationToken cancellationToken, Guid id)
-    {
-        Attempt<IReadOnlyDictionary<Udi, IEnumerable<string>>, DataTypeOperationStatus> result = await _dataTypeService.GetReferencesAsync(id);
-        if (result.Success == false)
-        {
-            return DataTypeOperationStatusResult(result.Status);
-        }
-
-        DataTypeReferenceResponseModel[] viewModels = _dataTypeReferencePresentationFactory.CreateDataTypeReferenceViewModels(result.Result).ToArray();
-        return Ok(viewModels);
-    }
-}
@@ -1,22 +0,0 @@
-using Asp.Versioning;
-using Microsoft.AspNetCore.Http;
-using Microsoft.AspNetCore.Mvc;
-using Umbraco.Cms.Api.Management.ViewModels.Tree;
-using Umbraco.Cms.Core.Services;
-
-namespace Umbraco.Cms.Api.Management.Controllers.DataType.Tree;
-
-[ApiVersion("1.0")]
-public class AncestorsDataTypeTreeController : DataTypeTreeControllerBase
-{
-    public AncestorsDataTypeTreeController(IEntityService entityService, IDataTypeService dataTypeService)
-        : base(entityService, dataTypeService)
-    {
-    }
-
-    [HttpGet("ancestors")]
-    [MapToApiVersion("1.0")]
-    [ProducesResponseType(typeof(IEnumerable<DataTypeTreeItemResponseModel>), StatusCodes.Status200OK)]
-    public async Task<ActionResult<IEnumerable<DataTypeTreeItemResponseModel>>> Ancestors(CancellationToken cancellationToken, Guid descendantId)
-        => await GetAncestors(descendantId);
-}
@@ -1,26 +0,0 @@
-using Asp.Versioning;
-using Microsoft.AspNetCore.Http;
-using Microsoft.AspNetCore.Mvc;
-using Umbraco.Cms.Core.Services;
-using Umbraco.Cms.Api.Common.ViewModels.Pagination;
-using Umbraco.Cms.Api.Management.ViewModels.Tree;
-
-namespace Umbraco.Cms.Api.Management.Controllers.DataType.Tree;
-
-[ApiVersion("1.0")]
-public class ChildrenDataTypeTreeController : DataTypeTreeControllerBase
-{
-    public ChildrenDataTypeTreeController(IEntityService entityService, IDataTypeService dataTypeService)
-        : base(entityService, dataTypeService)
-    {
-    }
-
-    [HttpGet("children")]
-    [MapToApiVersion("1.0")]
-    [ProducesResponseType(typeof(PagedViewModel<DataTypeTreeItemResponseModel>), StatusCodes.Status200OK)]
-    public async Task<ActionResult<PagedViewModel<DataTypeTreeItemResponseModel>>> Children(CancellationToken cancellationToken, Guid parentId, int skip = 0, int take = 100, bool foldersOnly = false)
-    {
-        RenderFoldersOnly(foldersOnly);
-        return await GetChildren(parentId, skip, take);
-    }
-}
@@ -1,61 +0,0 @@
-using Microsoft.AspNetCore.Authorization;
-using Microsoft.AspNetCore.Mvc;
-using Umbraco.Cms.Api.Management.Controllers.Tree;
-using Umbraco.Cms.Api.Management.Routing;
-using Umbraco.Cms.Api.Management.ViewModels.Tree;
-using Umbraco.Cms.Core;
-using Umbraco.Cms.Core.Models;
-using Umbraco.Cms.Core.Models.Entities;
-using Umbraco.Cms.Core.Services;
-using Umbraco.Cms.Web.Common.Authorization;
-using Umbraco.Extensions;
-
-namespace Umbraco.Cms.Api.Management.Controllers.DataType.Tree;
-
-[VersionedApiBackOfficeRoute($"{Constants.Web.RoutePath.Tree}/{Constants.UdiEntityType.DataType}")]
-[ApiExplorerSettings(GroupName = "Data Type")]
-[Authorize(Policy = AuthorizationPolicies.TreeAccessDataTypes)]
-public class DataTypeTreeControllerBase : FolderTreeControllerBase<DataTypeTreeItemResponseModel>
-{
-    private readonly IDataTypeService _dataTypeService;
-
-    public DataTypeTreeControllerBase(IEntityService entityService, IDataTypeService dataTypeService)
-        : base(entityService) =>
-        _dataTypeService = dataTypeService;
-
-    protected override UmbracoObjectTypes ItemObjectType => UmbracoObjectTypes.DataType;
-
-    protected override UmbracoObjectTypes FolderObjectType => UmbracoObjectTypes.DataTypeContainer;
-
-    protected override Ordering ItemOrdering
-    {
-        get
-        {
-            var ordering = Ordering.By(nameof(Infrastructure.Persistence.Dtos.NodeDto.NodeObjectType), Direction.Descending); // We need to override to change direction
-            ordering.Next = Ordering.By(nameof(Infrastructure.Persistence.Dtos.NodeDto.Text));
-
-            return ordering;
-        }
-    }
-
-    protected override DataTypeTreeItemResponseModel[] MapTreeItemViewModels(Guid? parentId, IEntitySlim[] entities)
-    {
-        Dictionary<int, IDataType> dataTypes = entities.Any()
-            ? _dataTypeService
-                .GetAllAsync(entities.Select(entity => entity.Key).ToArray()).GetAwaiter().GetResult()
-                .ToDictionary(contentType => contentType.Id)
-            : new Dictionary<int, IDataType>();
-
-        return entities.Select(entity =>
-        {
-            DataTypeTreeItemResponseModel responseModel = MapTreeItemViewModel(parentId, entity);
-            if (dataTypes.TryGetValue(entity.Id, out IDataType? dataType))
-            {
-                responseModel.EditorUiAlias = dataType.EditorUiAlias;
-                responseModel.IsDeletable = dataType.IsDeletableDataType();
-            }
-
-            return responseModel;
-        }).ToArray();
-    }
-}
@@ -1,27 +0,0 @@
-using Asp.Versioning;
-using Microsoft.AspNetCore.Http;
-using Microsoft.AspNetCore.Mvc;
-using Umbraco.Cms.Core.Services;
-using Umbraco.Cms.Api.Common.ViewModels.Pagination;
-using Umbraco.Cms.Api.Management.ViewModels.DataType.Item;
-using Umbraco.Cms.Api.Management.ViewModels.Tree;
-
-namespace Umbraco.Cms.Api.Management.Controllers.DataType.Tree;
-
-[ApiVersion("1.0")]
-public class RootDataTypeTreeController : DataTypeTreeControllerBase
-{
-    public RootDataTypeTreeController(IEntityService entityService, IDataTypeService dataTypeService)
-        : base(entityService, dataTypeService)
-    {
-    }
-
-    [HttpGet("root")]
-    [MapToApiVersion("1.0")]
-    [ProducesResponseType(typeof(PagedViewModel<DataTypeTreeItemResponseModel>), StatusCodes.Status200OK)]
-    public async Task<ActionResult<PagedViewModel<DataTypeTreeItemResponseModel>>> Root(CancellationToken cancellationToken, int skip = 0, int take = 100, bool foldersOnly = false)
-    {
-        RenderFoldersOnly(foldersOnly);
-        return await GetRoot(skip, take);
-    }
-}
@@ -1,52 +0,0 @@
-using Asp.Versioning;
-using Microsoft.AspNetCore.Http;
-using Microsoft.AspNetCore.Mvc;
-using Umbraco.Cms.Api.Management.Factories;
-using Umbraco.Cms.Api.Management.ViewModels.DataType;
-using Umbraco.Cms.Core;
-using Umbraco.Cms.Core.Models;
-using Umbraco.Cms.Core.Security;
-using Umbraco.Cms.Core.Services;
-using Umbraco.Cms.Core.Services.OperationStatus;
-
-namespace Umbraco.Cms.Api.Management.Controllers.DataType;
-
-[ApiVersion("1.0")]
-public class UpdateDataTypeController : DataTypeControllerBase
-{
-    private readonly IDataTypeService _dataTypeService;
-    private readonly IBackOfficeSecurityAccessor _backOfficeSecurityAccessor;
-    private IDataTypePresentationFactory _dataTypePresentationFactory;
-
-    public UpdateDataTypeController(IDataTypeService dataTypeService, IBackOfficeSecurityAccessor backOfficeSecurityAccessor, IDataTypePresentationFactory dataTypePresentationFactory)
-    {
-        _dataTypeService = dataTypeService;
-        _backOfficeSecurityAccessor = backOfficeSecurityAccessor;
-        _dataTypePresentationFactory = dataTypePresentationFactory;
-    }
-
-    [HttpPut("{id:guid}")]
-    [MapToApiVersion("1.0")]
-    [ProducesResponseType(StatusCodes.Status200OK)]
-    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status400BadRequest)]
-    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status404NotFound)]
-    public async Task<IActionResult> Update(CancellationToken cancellationToken, Guid id, UpdateDataTypeRequestModel updateDataTypeViewModel)
-    {
-        IDataType? current = await _dataTypeService.GetAsync(id);
-        if (current == null)
-        {
-            return DataTypeNotFound();
-        }
-
-        Attempt<IDataType, DataTypeOperationStatus> attempt = await _dataTypePresentationFactory.CreateAsync(updateDataTypeViewModel, current);
-        if (!attempt.Success)
-        {
-            return DataTypeOperationStatusResult(attempt.Status);
-        }
-
-        Attempt<IDataType, DataTypeOperationStatus> result = await _dataTypeService.UpdateAsync(attempt.Result, CurrentUserKey(_backOfficeSecurityAccessor));
-        return result.Success
-            ? Ok()
-            : DataTypeOperationStatusResult(result.Status);
-    }
-}
@@ -1,43 +0,0 @@
-using Asp.Versioning;
-using Microsoft.AspNetCore.Http;
-using Microsoft.AspNetCore.Mvc;
-using Umbraco.Cms.Core.Mapping;
-using Umbraco.Cms.Core.Models;
-using Umbraco.Cms.Core.Services;
-using Umbraco.Cms.Api.Management.ViewModels.Dictionary;
-using Umbraco.Cms.Api.Common.ViewModels.Pagination;
-using Umbraco.Cms.Core;
-
-namespace Umbraco.Cms.Api.Management.Controllers.Dictionary;
-
-[ApiVersion("1.0")]
-public class AllDictionaryController : DictionaryControllerBase
-{
-    private readonly IDictionaryItemService _dictionaryItemService;
-    private readonly IUmbracoMapper _umbracoMapper;
-
-    public AllDictionaryController(IDictionaryItemService dictionaryItemService, IUmbracoMapper umbracoMapper)
-    {
-        _dictionaryItemService = dictionaryItemService;
-        _umbracoMapper = umbracoMapper;
-    }
-
-    [HttpGet]
-    [MapToApiVersion("1.0")]
-    [ProducesResponseType(typeof(PagedViewModel<DictionaryOverviewResponseModel>), StatusCodes.Status200OK)]
-    public async Task<ActionResult<PagedViewModel<DictionaryOverviewResponseModel>>> All(
-        CancellationToken cancellationToken,
-        string? filter = null,
-        int skip = 0,
-        int take = 100)
-    {
-        // unfortunately we can't paginate here...we'll have to get all and paginate in memory
-        IDictionaryItem[] items = (await _dictionaryItemService.GetDescendantsAsync(Constants.System.RootKey, filter)).ToArray();
-        var model = new PagedViewModel<DictionaryOverviewResponseModel>
-        {
-            Total = items.Length,
-            Items = _umbracoMapper.MapEnumerable<IDictionaryItem, DictionaryOverviewResponseModel>(items.Skip(skip).Take(take))
-        };
-        return await Task.FromResult(model);
-    }
-}
--- a/Show More
+++ b/Show More