Build: Updated nightly E2E test pipeline schedule in v16 (#22805)

Updated nightly E2E test pipeline schedule

.github/BUILD.md

@@ -37,7 +37,7 @@ In order to work with the Umbraco source code locally, first make sure you have
 
 ### Familiarizing yourself with the code
 
-Umbraco is a .NET application using C#. The solution is broken down into multiple projects.  There are several class libraries. The `Umbraco.Web.UI` project is the main project that hosts the back office and login screen. This is the project you will want to run to see your changes.
+Umbraco is a .NET application using C#. The solution is broken down into multiple projects. There are several class libraries. The `Umbraco.Web.UI` project is the main project that hosts the back office and login screen. This is the project you will want to run to see your changes.
 
 There are two web projects in the solution with client-side assets based on TypeScript, `Umbraco.Web.UI.Client` and `Umbraco.Web.UI.Login`.
 
@@ -73,13 +73,20 @@ Just be careful not to include this change in your PR.
 
 Conversely, if you are working on front-end only, you want to build the back-end once and then run it. Before you do so, update the configuration in `appSettings.json` to add the following under `Umbraco:Cms:Security`:
 
-```
+```json
 "BackOfficeHost": "http://localhost:5173",
 "AuthorizeCallbackPathName": "/oauth_complete",
 "AuthorizeCallbackLogoutPathName": "/logout",
-"AuthorizeCallbackErrorPathName": "/error"
+"AuthorizeCallbackErrorPathName": "/error",
+"BackOfficeTokenCookie": {
+  "Enabled": true,
+  "SameSite": "None"
+}
 ```
 
+> [!NOTE]
+> If you get stuck in a login loop, try clearing your browser cookies for localhost, and make sure that the `BackOfficeTokenCookie` settings are correct. Namely, that `SameSite` should be set to `None` when running the front-end server separately.
+
 Then run Umbraco from the command line.
 
 ```

.github/CONTRIBUTING.md

@@ -61,7 +61,7 @@ This guide describes each step to make your first contribution:
 ## Further contribution guides
 
 - [Before you start](contributing-before-you-start.md)
-- [Finding your first issue: Up for grabs](contributing-first-issue.md)
+- [Finding your first issue](contributing-first-issue.md)
 - [Contributing to the new backoffice](https://docs.umbraco.com/umbraco-backoffice/)
 - [Unwanted changes](contributing-unwanted-changes.md)
 - [Other ways to contribute](contributing-other-ways-to-contribute.md)

.github/README.md

@@ -38,9 +38,17 @@ Some important documentation links to get you started:
 - [Getting to know Umbraco](https://docs.umbraco.com/umbraco-cms/fundamentals/get-to-know-umbraco)
 - [Tutorials for creating a basic website and customizing the editing experience](https://docs.umbraco.com/umbraco-cms/tutorials/overview)
 
+## Backoffice Preview
+
+Want to see the latest backoffice UI in action? Check out our live preview:
+
+**[backofficepreview.umbraco.com](https://backofficepreview.umbraco.com/)**
+
+This preview is automatically deployed from the main branch and showcases the latest backoffice features and improvements.  It runs from mock data and persistent edits are not supported.
+
 ## Get help
 
-If you need a bit of feedback while building your Umbraco projects, we are [chatty on Discord](https://discord.umbraco.com). Our Discord server serves both a social space but also has channels for questions and answers. Feel free to lurk or join in with your own questions. Or just post your daily Wordle score, up to you!
+If you need a bit of feedback while building your Umbraco projects, we are [chatty on Discord](https://discord.umbraco.com). Our Discord server serves as a social space for all Umbracians. If you have any questions or need some help with a problem, head over to our [dedicated forum](https://forum.umbraco.com/) where the Umbraco Community will be happy to help. 
 
 ## Looking to contribute back to Umbraco?
 
@@ -52,3 +60,4 @@ You came to the right place! Our GitHub repository is available for all kinds of
 Umbraco is contribution-focused and community-driven. If you want to contribute back to the Umbraco source code, please check out our [guide to contributing](CONTRIBUTING.md).
 
 ### Tip: You should not run Umbraco from source code found here. Umbraco is extremely extensible and can do whatever you need. Instead, [install Umbraco as noted above](#looking-to-install-umbraco) and then [extend it any way you want to](https://docs.umbraco.com/umbraco-cms/extending/).
+

.github/contributing-creating-a-pr.md

@@ -7,9 +7,26 @@ We recommend you to [sync with our repository][sync fork] before you submit your
 GitHub will have picked up on the new branch you've pushed and will offer to create a Pull Request. Click that green button and away you go.
 ![Create a pull request](img/createpullrequest.png)
 
-We like to use [git flow][git flow] as much as possible, but don't worry if you are not familiar with it. The most important thing you need to know is that when you fork the Umbraco repository, the default branch is set to `contrib`. This is the branch you should be targeting.
+We like to use [git flow][git flow] as much as possible, but don't worry if you are not familiar with it. The most important thing you need to know is that when you fork the Umbraco repository, the default branch is set to `main`. This is the branch you should be targeting.
 
-Please note: we are no longer accepting features for v8 and below but will continue to merge security fixes as and when they arise.
+We welcome PRs for features and bugfixes for different versions according to the [published support and EOL schedule][support-and-eol].
+
+We don't have rules for naming PRs - so name them as you prefer. At HQ we do have a best practice on clear and concise PR naming, so if you would like to use the format feel free to do so. 
+
+Our convention of doing it is:
+
+_Area: Description (closes #IssueID)_
+
+1. Start by specifying the area. Fx the feature name(UFM, Tiptap etc.) or specific section (migrations, relations, segmentation).
+
+2. In your description, where applicable, mention type of PR (Build, Bump, Fix, Refactor etc.).
+   
+4. Good practise is to make sure you describe specifically the change and/or impact of change.<br>
+   Example: Writing "Extension Insights: Fixes CSS alignment" instead of "Fixed issue".
+
+6. Add (closes #IssueID) behind description, if your PR resolves an issue. 
+
+That's it! 
   
 ## The review process
 [review process]: #the-review-process
@@ -48,4 +65,5 @@ There will be times that we really like your proposed changes and we’ll finish
 
 [making larger changes]: contributing-before-you-start.md#making-large-changes
 [pr or package]: contributing-before-you-start.md#pull-request-or-package
-[Core collabs]: contributing-core-collabs-team.md
+[Core collabs]: contributing-core-collabs-team.md
+[support-and-eol]: https://umbraco.com/products/knowledge-center/long-term-support-and-end-of-life/

.github/contributing-first-issue.md

@@ -1,6 +1,8 @@
-## Finding your first issue: Up for grabs
+## Finding your first issue
 
-Umbraco HQ will regularly mark newly created issues on the issue tracker with [the `community/up-for-grabs` tag][up for grabs issues]. This means that the proposed changes are wanted in Umbraco but the HQ does not have the time to make them at this time. We encourage anyone to pick them up and help out.
+Umbraco HQ will regularly mark newly created issues on the issue tracker with [the `community/up-for-grabs` tag][up for grabs issues]. This means that the proposed changes are wanted in Umbraco but the HQ does not have the time to make them at this time. In adding the label we will endeavour to provide some guidelines on how to go about the implementation, such that it aligns with the project. We encourage anyone to pick them up and help out.
+
+You don't need to restrict yourselves to issues that are specifically marked as "up for grabs" though. If you are running into a bug you have reported or found on the [issue tracker][issue tracker], it's not necessary to wait for HQ response. Feel free to dive in and try to provide a fix, raising questions as you need if you have concerns about the modifications necessary to resolve the problem.
 
 If you do start working on something, make sure to leave a small comment on the issue saying something like: "I'm working on this". That way other people stumbling upon the issue know they don't need to pick it up, someone already has.
 
@@ -11,15 +13,15 @@ Great question! The short version goes like this:
 1. **Fork**
 
     Create a fork of [`Umbraco-CMS` on GitHub][Umbraco CMS repo]
-    
+
     ![Fork the repository](img/forkrepository.png)
-    
+
 1. **Clone**
 
     When GitHub has created your fork, you can clone it in your favorite Git tool
-    
-    ![Clone the fork](img/clonefork.png) 
-    
+
+    ![Clone the fork](img/clonefork.png)
+
 1. **Switch to the correct branch**
 
     Switch to the `contrib` branch
@@ -90,4 +92,5 @@ You can get in touch with [the core contributors team][core collabs] in multiple
 [draft prs]: https://github.blog/2019-02-14-introducing-draft-pull-requests/	"Github's blog post providing details on draft pull requests"
 [contrib forum]: https://our.umbraco.com/forum/contributing-to-umbraco-cms/
 [Umbraco CMS repo]: https://github.com/umbraco/Umbraco-CMS
-[up for grabs issues]: https://github.com/umbraco/Umbraco-CMS/issues?q=is%3Aissue+is%3Aopen+label%3Acommunity%2Fup-for-grabs
+[up for grabs issues]: https://github.com/umbraco/Umbraco-CMS/issues?q=is%3Aissue+is%3Aopen+label%3Acommunity%2Fup-for-grabs
+[issue tracker]: https://github.com/umbraco/Umbraco-CMS/issues

.github/copilot-instructions.md

@@ -0,0 +1,198 @@
+# Umbraco CMS Development Guide
+
+Always reference these instructions first and fallback to search or bash commands only when you encounter unexpected information that does not match the info here.
+
+## Working Effectively
+
+Bootstrap, build, and test the repository:
+
+- Install .NET SDK (version specified in global.json):
+  - `curl -sSL https://dot.net/v1/dotnet-install.sh | bash /dev/stdin --version $(jq -r '.sdk.version' global.json)`
+  - `export PATH="/home/runner/.dotnet:$PATH"`
+- Install Node.js (version specified in src/Umbraco.Web.UI.Client/.nvmrc):
+  - `curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.0/install.sh | bash`
+  - `export NVM_DIR="$HOME/.nvm" && [ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh"`
+  - `nvm install $(cat src/Umbraco.Web.UI.Client/.nvmrc) && nvm use $(cat src/Umbraco.Web.UI.Client/.nvmrc)`
+- Fix shallow clone issue (required for GitVersioning):
+  - `git fetch --unshallow`
+- Restore packages:
+  - `dotnet restore` -- takes 50 seconds. NEVER CANCEL. Set timeout to 90+ seconds.
+- Build the solution:
+  - `dotnet build` -- takes 4.5 minutes. NEVER CANCEL. Set timeout to 10+ minutes.
+- Install and build frontend:
+  - `cd src/Umbraco.Web.UI.Client`
+  - `npm ci --no-fund --no-audit --prefer-offline` -- takes 11 seconds.
+  - `npm run build:for:cms` -- takes 1.25 minutes. NEVER CANCEL. Set timeout to 5+ minutes.
+- Install and build Login
+  - `cd src/Umbraco.Web.UI.Login`
+  - `npm ci --no-fund --no-audit --prefer-offline`
+  - `npm run build`
+- Run the application:
+  - `cd src/Umbraco.Web.UI`
+  - `dotnet run --no-build` -- Application runs on https://localhost:44339 and http://localhost:11000
+
+## Validation
+
+- ALWAYS run through at least one complete end-to-end scenario after making changes.
+- Build and unit tests must pass before committing changes.
+- Frontend build produces output in src/Umbraco.Web.UI.Client/dist-cms/ which gets copied to src/Umbraco.Web.UI/wwwroot/umbraco/backoffice/
+- Always run `dotnet build` and `npm run build:for:cms` before running the application to see your changes.
+- For login-only changes, you can run `npm run build` from src/Umbraco.Web.UI.Login and then `dotnet run --no-build` from src/Umbraco.Web.UI.
+- For frontend-only changes, you can run `npm run dev:server` from src/Umbraco.Web.UI.Client for hot reloading.
+- Frontend changes should be linted using `npm run lint:fix` which uses Eslint.
+
+## Testing
+
+### Unit Tests (.NET)
+- Location: tests/Umbraco.Tests.UnitTests/
+- Run: `dotnet test tests/Umbraco.Tests.UnitTests/Umbraco.Tests.UnitTests.csproj --configuration Release --verbosity minimal`
+- Duration: ~1 minute with 3,343 tests
+- NEVER CANCEL: Set timeout to 5+ minutes
+
+### Integration Tests (.NET)
+- Location: tests/Umbraco.Tests.Integration/
+- Run: `dotnet test tests/Umbraco.Tests.Integration/Umbraco.Tests.Integration.csproj --configuration Release --verbosity minimal`
+- NEVER CANCEL: Set timeout to 10+ minutes
+
+### Frontend Tests
+- Location: src/Umbraco.Web.UI.Client/
+- Run: `npm test` (requires `npx playwright install` first)
+- Frontend tests use Web Test Runner with Playwright
+
+### Acceptance Tests (E2E)
+- Location: tests/Umbraco.Tests.AcceptanceTest/
+- Requires running Umbraco application and configuration
+- See tests/Umbraco.Tests.AcceptanceTest/README.md for detailed setup (requires `npx playwright install` first)
+
+## Project Structure
+
+The solution contains 30 C# projects organized as follows:
+
+### Main Application Projects
+- **Umbraco.Web.UI**: Main web application project (startup project)
+- **Umbraco.Web.UI.Client**: TypeScript frontend (backoffice)
+- **Umbraco.Web.UI.Login**: Separate login screen frontend
+- **Umbraco.Core**: Core domain models and interfaces
+- **Umbraco.Infrastructure**: Data access and infrastructure
+- **Umbraco.Cms**: Main CMS package
+
+### API Projects
+- **Umbraco.Cms.Api.Management**: Management API
+- **Umbraco.Cms.Api.Delivery**: Content Delivery API
+- **Umbraco.Cms.Api.Common**: Shared API components
+
+### Persistence Projects
+- **Umbraco.Cms.Persistence.SqlServer**: SQL Server support
+- **Umbraco.Cms.Persistence.Sqlite**: SQLite support
+- **Umbraco.Cms.Persistence.EFCore**: Entity Framework Core abstractions
+
+### Test Projects
+- **Umbraco.Tests.UnitTests**: Unit tests
+- **Umbraco.Tests.Integration**: Integration tests
+- **Umbraco.Tests.AcceptanceTest**: End-to-end tests with Playwright
+- **Umbraco.Tests.Common**: Shared test utilities
+
+## Common Tasks
+
+### Running Umbraco in Different Modes
+
+**Production Mode (Standard Development)**
+Use this for backend development, testing full builds, or when you don't need hot reloading:
+1. Build frontend assets: `cd src/Umbraco.Web.UI.Client && npm run build:for:cms`
+2. Run backend: `cd src/Umbraco.Web.UI && dotnet run --no-build`
+3. Access backoffice: `https://localhost:44339/umbraco`
+4. Application uses compiled frontend from `wwwroot/umbraco/backoffice/`
+
+**Vite Dev Server Mode (Frontend Development with Hot Reload)**
+Use this for frontend-only development with hot module reloading:
+1. Configure backend for frontend development - Add to `src/Umbraco.Web.UI/appsettings.json` under `Umbraco:CMS:Security`:
+   ```json
+   "BackOfficeHost": "http://localhost:5173",
+   "AuthorizeCallbackPathName": "/oauth_complete",
+   "AuthorizeCallbackLogoutPathName": "/logout",
+   "AuthorizeCallbackErrorPathName": "/error",
+   "BackOfficeTokenCookie": {
+     "Enabled": true,
+     "SameSite": "None"
+   }
+   ```
+2. Run backend: `cd src/Umbraco.Web.UI && dotnet run --no-build`
+3. Run frontend dev server: `cd src/Umbraco.Web.UI.Client && npm run dev:server`
+4. Access backoffice: `http://localhost:5173/` (no `/umbraco` prefix)
+5. Changes to TypeScript/Lit files hot reload automatically
+
+**Important:** Remove the `BackOfficeHost` configuration before committing or switching back to production mode.
+
+### Backend-Only Development
+For backend-only changes, disable frontend builds:
+- Comment out the target named "BuildStaticAssetsPreconditions" in src/Umbraco.Cms.StaticAssets.csproj:
+  ```
+  <!--<Target Name="BuildStaticAssetsPreconditions" BeforeTargets="AssignTargetPaths">
+    [...]
+  </Target>-->
+  ```
+- Remember to uncomment before committing
+
+### Building NuGet Packages
+To build custom NuGet packages for testing:
+```bash
+dotnet pack -c Release -o Build.Out
+dotnet nuget add source [Path to Build.Out folder] -n MyLocalFeed
+```
+
+### Regenerating Frontend API Types
+When changing Management API:
+```bash
+cd src/Umbraco.Web.UI.Client
+npm run generate:server-api-dev
+```
+Also update OpenApi.json from /umbraco/swagger/management/swagger.json
+
+## Database Setup
+
+Default configuration supports SQLite for development. For production-like testing:
+- Use SQL Server/LocalDb for better performance
+- Configure connection string in src/Umbraco.Web.UI/appsettings.json
+
+## Clean Up / Reset
+
+To reset development environment:
+```bash
+# Remove configuration and database
+rm src/Umbraco.Web.UI/appsettings.json
+rm -rf src/Umbraco.Web.UI/umbraco/Data
+
+# Full clean (removes all untracked files)
+git clean -xdf .
+```
+
+## Version Information
+
+- Target Framework: .NET (version specified in global.json)
+- Current Version: (specified in version.json)
+- Node.js Requirement: (specified in src/Umbraco.Web.UI.Client/.nvmrc)
+- npm Requirement: Latest compatible version
+
+## Known Issues
+
+- Build requires full git history (not shallow clone) due to GitVersioning
+- Some NuGet package security warnings are expected (SixLabors.ImageSharp vulnerabilities)
+- Frontend tests require Playwright browser installation: `npx playwright install`
+- Older Node.js versions may show engine compatibility warnings (check .nvmrc for current requirement)
+
+## Timing Expectations
+
+**NEVER CANCEL** these operations - they are expected to take time:
+
+| Operation | Expected Time | Timeout Setting |
+|-----------|--------------|-----------------|
+| `dotnet restore` | 50 seconds | 90+ seconds |
+| `dotnet build` | 4.5 minutes | 10+ minutes |
+| `npm ci` | 11 seconds | 30+ seconds |
+| `npm run build:for:cms` | 1.25 minutes | 5+ minutes |
+| `npm test` | 2 minutes | 5+ minutes |
+| `npm run lint` | 1 minute | 5+ minutes |
+| Unit tests | 1 minute | 5+ minutes |
+| Integration tests | Variable | 10+ minutes |
+
+Always wait for commands to complete rather than canceling and retrying.

.github/release.yml

@@ -7,7 +7,7 @@ changelog:
       - duplicate
       - wontfix
   categories:
-    - title: 🙌 Notable Changes
+    - title: 🙌 Notable Changes 
       labels:
         - category/notable
     - title: 💥 Breaking Changes
@@ -23,7 +23,7 @@ changelog:
     - title: 📦 Dependencies
       labels:
         - dependencies
-    - title: 🌈 A11Y
+    - title: 🌈 Accessibility Improvements
       labels:
         - accessibility
         - category/accessibility

.github/workflows/azure-backoffice.yml

@@ -17,6 +17,7 @@ on:
       - main
       - v*/dev
       - v*/main
+  workflow_dispatch:
 
 jobs:
   build_and_deploy_job:

.github/workflows/azure-storybook.yml

@@ -17,6 +17,7 @@ on:
       - main
       - v*/dev
       - v*/main
+  workflow_dispatch:
 
 env:
   NODE_OPTIONS: --max_old_space_size=16384

.github/workflows/label-to-release-announcement.yml

@@ -0,0 +1,163 @@
+name: Create a release discussions for each new version label
+
+on:
+  schedule:
+    - cron: "0 * * * *" # every hour
+  workflow_dispatch:    # allow manual runs
+permissions:
+  contents: read
+  discussions: write
+  issues: read
+  pull-requests: read
+
+jobs:
+  reconcile:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Reconcile release/* labels → discussions
+        uses: actions/github-script@v7
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const owner = context.repo.owner;
+            const repo = context.repo.repo;
+            const categoryName = "Releases";
+
+            // 24h cutoff
+            const since = new Date(Date.now() - 24*60*60*1000).toISOString();
+            core.info(`Scanning issues/PRs updated since ${since}`);
+
+            // fetch repo + discussion categories
+            const repoData = await github.graphql(`
+              query($owner:String!, $repo:String!){
+                repository(owner:$owner, name:$repo){
+                  id
+                  discussionCategories(first:100){ nodes { id name } }
+                }
+              }
+            `, { owner, repo });
+            const repoId = repoData.repository.id;
+            const category = repoData.repository.discussionCategories.nodes.find(c => c.name === categoryName);
+            if (!category) {
+              core.setFailed(`Discussion category "${categoryName}" not found`);
+              return;
+            }
+            const categoryId = category.id;
+
+            // paginate issues/PRs updated in last 24h
+            for await (const { data: items } of github.paginate.iterator(
+              github.rest.issues.listForRepo,
+              { owner, repo, state: "all", since, per_page: 100 }
+            )) {
+              for (const item of items) {
+                const releaseLabels = (item.labels || [])
+                  .map(l => (typeof l === "string" ? l : l.name)) // always get the name
+                  .filter(n => typeof n === "string" && n.startsWith("release/") && n !== "release/no-notes");
+                if (releaseLabels.length === 0) continue;
+
+                core.info(`#${item.number}: ${releaseLabels.join(", ")}`);
+
+                for (const labelName of releaseLabels) {
+                  const version = labelName.substring("release/".length);
+                  const titleTarget = `Release: ${version}`;
+
+                  // search discussions
+                  let discussionId = null;
+                  let cursor = null;
+                  while (true) {
+                    const page = await github.graphql(`
+                      query($owner:String!, $repo:String!, $cursor:String){
+                        repository(owner:$owner, name:$repo){
+                          discussions(first:50, after:$cursor){
+                            nodes{
+                              id
+                              title
+                              url
+                              category{ name }
+                              labels(first:50){ nodes{ name } }
+                            }
+                            pageInfo{ hasNextPage endCursor }
+                          }
+                        }
+                      }
+                    `, { owner, repo, cursor });
+                    const nodes = page.repository.discussions.nodes;
+                    const byLabel = nodes.find(d =>
+                      d.category?.name === categoryName &&
+                      d.labels?.nodes?.some(l => l.name === labelName)
+                    );
+                    if (byLabel) { discussionId = byLabel.id; break; }
+                    const byTitle = nodes.find(d =>
+                      d.category?.name === categoryName &&
+                      d.title === titleTarget
+                    );
+                    if (byTitle) { discussionId = byTitle.id; break; }
+                    if (!page.repository.discussions.pageInfo.hasNextPage) break;
+                    cursor = page.repository.discussions.pageInfo.endCursor;
+                  }
+
+                  if (!discussionId) {
+                    core.info(`→ Creating discussion for ${labelName}`);
+                    const body =
+                      `**Release date:** TODO (YYYY-MM-DD)\n\n` +
+                      `### Links\n` +
+                      `- [Issues and pull requests marked for version ${version}](https://github.com/${owner}/${repo}/issues?q=label%3A${encodeURIComponent(labelName)})\n`;
+
+                    const created = await github.graphql(`
+                      mutation($repoId:ID!, $catId:ID!, $title:String!, $body:String!){
+                        createDiscussion(input:{
+                          repositoryId:$repoId,
+                          categoryId:$catId,
+                          title:$title,
+                          body:$body
+                        }){ discussion{ id url } }
+                      }
+                    `, { repoId, catId: categoryId, title: titleTarget, body });
+
+                    discussionId = created.createDiscussion.discussion.id;
+
+                    // lock the discussion to prevent replies
+                    await github.graphql(`
+                      mutation($id:ID!){
+                        lockLockable(input:{ lockableId:$id }) {
+                          clientMutationId
+                        }
+                      }
+                    `, { id: discussionId });
+                    core.info(`🔒 Locked discussion ${discussionId}`);
+                  } else {
+                    core.info(`→ Found existing discussion for ${labelName}`);
+                  }
+
+                  // ensure label exists
+                  let labelId;
+                  try {
+                    await github.rest.issues.getLabel({ owner, repo, name: labelName });
+                  } catch (e) {
+                    if (e.status === 404) {
+                      await github.rest.issues.createLabel({
+                        owner, repo, name: labelName, color: "0E8A16"
+                      });
+                    } else { throw e; }
+                  }
+                  const labelNode = await github.graphql(`
+                    query($owner:String!, $repo:String!, $name:String!){
+                      repository(owner:$owner, name:$repo){ label(name:$name){ id } }
+                    }
+                  `, { owner, repo, name: labelName });
+                  labelId = labelNode.repository.label?.id;
+                  if (!labelId) continue;
+
+                  // add label to discussion
+                  await github.graphql(`
+                    mutation($id:ID!, $labels:[ID!]!){
+                      addLabelsToLabelable(input:{ labelableId:$id, labelIds:$labels }) {
+                        clientMutationId
+                      }
+                    }
+                  `, { id: discussionId, labels: [labelId] });
+
+                  core.info(`✓ ${labelName} attached to discussion`);
+                }
+              }
+            }

.vscode/launch.json

@@ -101,10 +101,14 @@
       "env": {
         "ASPNETCORE_ENVIRONMENT": "Development",
         "ASPNETCORE_URLS": "https://localhost:44339",
+        "UMBRACO__CMS__WEBROUTING__UMBRACOAPPLICATIONURL": "https://localhost:44339",
         "UMBRACO__CMS__SECURITY__BACKOFFICEHOST": "http://localhost:5173",
         "UMBRACO__CMS__SECURITY__AUTHORIZECALLBACKPATHNAME": "/oauth_complete",
         "UMBRACO__CMS__SECURITY__AUTHORIZECALLBACKLOGOUTPATHNAME": "/logout",
-        "UMBRACO__CMS__SECURITY__AUTHORIZECALLBACKERRORPATHNAME": "/error"
+        "UMBRACO__CMS__SECURITY__AUTHORIZECALLBACKERRORPATHNAME": "/error",
+        "UMBRACO__CMS__SECURITY__KEEPUSERLOGGEDIN": "true",
+        "UMBRACO__CMS__SECURITY__BACKOFFICETOKENCOOKIE__ENABLED": "true",
+        "UMBRACO__CMS__SECURITY__BACKOFFICETOKENCOOKIE__SAMESITE": "None"
       },
       "sourceFileMap": {
         "/Views": "${workspaceFolder}/Umbraco.Web.UI/Views"

.vscode/settings.json

@@ -1,5 +1,8 @@
 {
-  "cSpell.words": ["unprovide"],
+  "cSpell.words": [
+    "unprovide",
+    "Unproviding"
+  ],
   "eslint.useFlatConfig": true,
   "eslint.workingDirectories": [
     "./src/Umbraco.Web.UI.Client/",

Directory.Packages.props

@@ -14,14 +14,11 @@
   <ItemGroup>
     <PackageVersion Include="Microsoft.AspNetCore.Mvc.Razor.RuntimeCompilation" Version="9.0.4" />
     <PackageVersion Include="Microsoft.CodeAnalysis.CSharp" Version="4.13.0" />
-    <PackageVersion Include="Microsoft.CodeAnalysis.Common" Version="4.13.0" />
     <PackageVersion Include="Microsoft.CodeAnalysis.CSharp.Workspaces" Version="4.13.0" />
-    <PackageVersion Include="Microsoft.CodeAnalysis.Workspaces.Common" Version="4.13.0" />
     <PackageVersion Include="Microsoft.CodeAnalysis.Workspaces.MSBuild" Version="4.13.0" />
     <PackageVersion Include="Microsoft.Data.Sqlite" Version="9.0.4" />
     <PackageVersion Include="Microsoft.EntityFrameworkCore.Sqlite" Version="9.0.4" />
     <PackageVersion Include="Microsoft.EntityFrameworkCore.SqlServer" Version="9.0.4" />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore.Design" Version="9.0.4" />
     <PackageVersion Include="Microsoft.Extensions.Caching.Abstractions" Version="9.0.4" />
     <PackageVersion Include="Microsoft.Extensions.Caching.Memory" Version="9.0.4" />
     <PackageVersion Include="Microsoft.Extensions.Configuration.Abstractions" Version="9.0.4" />
@@ -76,8 +73,8 @@
     <PackageVersion Include="Serilog.Sinks.Async" Version="2.1.0" />
     <PackageVersion Include="Serilog.Sinks.File" Version="6.0.0" />
     <PackageVersion Include="Serilog.Sinks.Map" Version="2.0.0" />
-    <PackageVersion Include="SixLabors.ImageSharp" Version="3.1.7" />
-    <PackageVersion Include="SixLabors.ImageSharp.Web" Version="3.1.4" />
+    <PackageVersion Include="SixLabors.ImageSharp" Version="3.1.11" />
+    <PackageVersion Include="SixLabors.ImageSharp.Web" Version="3.1.5" />
     <PackageVersion Include="Swashbuckle.AspNetCore" Version="8.1.1" />
   </ItemGroup>
   <!-- Transitive pinned versions (only required because our direct dependencies have vulnerable versions of transitive dependencies) -->

NOTICES.txt

@@ -3,7 +3,9 @@ Third-Party Notices
 
 This file contains notices and attributions for third-party software used in the Umbraco CMS project.
 
-It is not a license and does not grant any rights to use the third-party software.
+Third-party software may contain dependencies that are not explicitly listed here.
+
+This notice is not a license and does not grant any rights to use the third-party software.
 
 Umbraco CMS is licensed under the MIT License, which can be found in the LICENSE file.
 
@@ -113,14 +115,6 @@ Copyright: 2023 Shannon Deminick
 
 ---
 
-Glob: A library for matching file paths using glob patterns
-
-URL: https://github.com/isaacs/node-glob
-License: ISC License
-Copyright: 2009-2023 Isaac Z. Schlueter and Contributors
-
----
-
 Globals: A library for managing global variables in JavaScript
 
 URL: https://github.com/sindresorhus/globals
@@ -356,38 +350,6 @@ Copyright: Titus Wormer
 
 ---
 
-Rollup: A module bundler for JavaScript
-
-URL: https://rollupjs.org/
-License: MIT License
-Copyright: 2015-present Rollup contributors
-
----
-
-Rollup Plugins: A collection of Rollup plugins
-
-URL: https://github.com/rollup/plugins
-License: MIT License
-Copyright: 2019-present Rollup Plugins contributors
-
----
-
-Rollup-plugin-esbuild: A Rollup plugin for using esbuild
-
-URL: https://github.com/egoist/rollup-plugin-esbuild
-License: MIT License
-Copyright: 2020 EGOIST
-
----
-
-Rollup-plugin-import-css: A Rollup plugin for importing CSS files
-
-URL: https://github.com/jleeson/rollup-plugin-import-css
-License: MIT License
-Copyright: 2020 Jacob Leeson
-
----
-
 rxjs: Reactive Extensions for JavaScript
 
 URL: https://rxjs.dev/

build/azure-pipelines.yml

@@ -34,6 +34,10 @@ parameters:
     displayName: Upload API docs
     type: boolean
     default: false
+  - name: uploadDependencyTrack
+    displayName: Upload BOMs to Dependency Track
+    type: boolean
+    default: false
   - name: forceReleaseTestFilter
     displayName: Force to use the release test filters
     type: boolean
@@ -103,6 +107,15 @@ stages:
               command: build
               projects: $(solution)
               arguments: "--configuration $(buildConfiguration) --no-restore --property:ContinuousIntegrationBuild=true --property:GeneratePackageOnBuild=true --property:PackageOutputPath=$(Build.ArtifactStagingDirectory)/nupkg"
+          - powershell: |
+              dotnet tool install --global CycloneDX
+              dotnet-CycloneDX $(solution) --output $(Build.ArtifactStagingDirectory)/bom --filename bom-dotnet.xml
+            displayName: 'Generate Backend BOM'
+          - powershell: |
+              npm install --global @cyclonedx/cyclonedx-npm
+              cyclonedx-npm -o $(Build.ArtifactStagingDirectory)\bom\bom-login.xml --ignore-npm-errors --verbose
+            displayName: Generate Login UI BOM
+            workingDirectory: src/Umbraco.Web.UI.Login
           - task: PublishPipelineArtifact@1
             displayName: Publish nupkg
             inputs:
@@ -113,6 +126,11 @@ stages:
             inputs:
               targetPath: $(Build.SourcesDirectory)
               artifactName: build_output
+          - task: PublishPipelineArtifact@1
+            displayName: Publish Backend BOM
+            inputs:
+              targetPath: $(Build.ArtifactStagingDirectory)/bom
+              artifactName: bom-backend
 
       - job: B
         displayName: Build Bellissima Package
@@ -124,6 +142,11 @@ stages:
             lfs: false,
             fetchDepth: 500
           - template: templates/backoffice-install.yml
+          - powershell: |
+              npm install --global @cyclonedx/cyclonedx-npm
+              cyclonedx-npm -o $(Build.ArtifactStagingDirectory)/bom/bom-backoffice.xml --ignore-npm-errors --verbose
+            displayName: Generate Backoffice UI BOM
+            workingDirectory: src/Umbraco.Web.UI.Client
           - script: npm run build:for:npm
             displayName: Run build:for:npm
             workingDirectory: src/Umbraco.Web.UI.Client
@@ -140,6 +163,35 @@ stages:
             inputs:
               targetPath: $(Build.ArtifactStagingDirectory)/npm
               artifactName: npm
+          - publish: $(Build.ArtifactStagingDirectory)/bom
+            artifact: bom-frontend
+            displayName: 'Publish Frontend BOM'
+
+  - stage: E2E_BOM
+    displayName: E2E Tests BOM Generation
+    dependsOn: []
+    jobs:
+    - job:
+      displayName: E2E Generate BOM
+      pool:
+        vmImage: "ubuntu-latest"
+      steps:
+        - checkout: self
+          submodules: false
+          lfs: false,
+          fetchDepth: 500
+        - template: templates/e2e-install.yml
+          parameters:
+            nodeVersion: ${{ variables.nodeVersion }}
+            npm_config_cache: ${{ variables.npm_config_cache }}
+        - powershell: |
+            npm install --global @cyclonedx/cyclonedx-npm
+            cyclonedx-npm -o $(Build.ArtifactStagingDirectory)/bom/bom-e2e.xml --ignore-npm-errors --verbose
+          displayName: Generate E2E Tests BOM
+          workingDirectory: tests/Umbraco.Tests.AcceptanceTest
+        - publish: $(Build.ArtifactStagingDirectory)/bom
+          artifact: bom-e2e
+          displayName: 'Publish E2E BOM'
 
   - stage: Build_Docs
     condition: and(succeeded(), or(eq(dependencies.Build.outputs['A.build.NBGV_PublicRelease'], 'True'), ${{parameters.buildApiDocs}}))
@@ -522,160 +574,72 @@ stages:
           # Connection string
           CONNECTIONSTRINGS__UMBRACODBDSN: Data Source=Umbraco;Mode=Memory;Cache=Shared;Foreign Keys=True;Pooling=True
           CONNECTIONSTRINGS__UMBRACODBDSN_PROVIDERNAME: Microsoft.Data.Sqlite
+          DatabaseType: SQLite
+          additionalEnvironmentVariables: false
         strategy:
           matrix:
             LinuxPart1Of3:
               vmImage: "ubuntu-latest"
+              testFolder: "DefaultConfig"
               testCommand: "npm run smokeTestSqlite -- --shard=1/3"
             LinuxPart2Of3:
               vmImage: "ubuntu-latest"
+              testFolder: "DefaultConfig"
               testCommand: "npm run smokeTestSqlite -- --shard=2/3"
             LinuxPart3Of3:
               vmImage: "ubuntu-latest"
+              testFolder: "DefaultConfig"
               testCommand: "npm run smokeTestSqlite -- --shard=3/3"
             WindowsPart1Of3:
               vmImage: "windows-latest"
+              testFolder: "DefaultConfig"
               testCommand: "npm run smokeTestSqlite -- --shard=1/3"
             WindowsPart2Of3:
               vmImage: "windows-latest"
+              testFolder: "DefaultConfig"
               testCommand: "npm run smokeTestSqlite -- --shard=2/3"
             WindowsPart3Of3:
               vmImage: "windows-latest"
+              testFolder: "DefaultConfig"
               testCommand: "npm run smokeTestSqlite -- --shard=3/3"
         pool:
           vmImage: $(vmImage)
         steps:
-          # Setup test environment
-          - task: DownloadPipelineArtifact@2
-            displayName: Download NuGet artifacts
-            inputs:
-              artifact: nupkg
-              path: $(Agent.BuildDirectory)/app/nupkg
-
-          - task: NodeTool@0
-            displayName: Use Node.js $(nodeVersion)
-            retryCountOnTaskFailure: 3
-            inputs:
-              versionSpec: $(nodeVersion)
-
-          - task: UseDotNet@2
-            displayName: Use .NET SDK from global.json
-            inputs:
-              useGlobalJson: true
+          # Setup test environment Template
+          - template: nightly-E2E-setup-template.yml
+            parameters:
+              nodeVersion: ${{ variables.nodeVersion }}
+              PlaywrightUserEmail: ${{ variables.UMBRACO__CMS__UNATTENDED__UNATTENDEDUSEREMAIL }}
+              PlaywrightPassword: ${{ variables.UMBRACO__CMS__UNATTENDED__UNATTENDEDUSERPASSWORD }}
+              ASPNETCORE_URLS: ${{ variables.ASPNETCORE_URLS }}
+              npm_config_cache: ${{ variables.npm_config_cache }}
 
           - pwsh: |
-              "UMBRACO_USER_LOGIN=$(UMBRACO__CMS__UNATTENDED__UNATTENDEDUSEREMAIL)
-              UMBRACO_USER_PASSWORD=$(UMBRACO__CMS__UNATTENDED__UNATTENDEDUSERPASSWORD)
-              URL=$(ASPNETCORE_URLS)
-              STORAGE_STAGE_PATH=$(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/playwright/.auth/user.json
-              CONSOLE_ERRORS_PATH=$(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/console-errors.json" | Out-File .env
-            displayName: Generate .env
-            workingDirectory: $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest
-
-          # Cache and restore NPM packages
-          - task: Cache@2
-            displayName: Cache NPM packages
-            inputs:
-              key: 'npm_e2e | "$(Agent.OS)" | $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/package-lock.json'
-              restoreKeys: |
-                npm_e2e | "$(Agent.OS)"
-                npm_e2e
-              path: $(npm_config_cache)
-
-          - script: npm ci --no-fund --no-audit --prefer-offline
-            workingDirectory: $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest
-            displayName: Restore NPM packages
-
-          # Build application
-          - pwsh: |
-              $cmsVersion = "$(Build.BuildNumber)" -replace "\+",".g"
-              dotnet new nugetconfig
-              dotnet nuget add source ./nupkg --name Local
-              dotnet new install Umbraco.Templates::$cmsVersion
-              dotnet new umbraco --name UmbracoProject --version $cmsVersion --exclude-gitignore --no-restore --no-update-check
               dotnet restore UmbracoProject
               cp $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest.UmbracoProject/*.cs UmbracoProject
-              dotnet build UmbracoProject --configuration $(buildConfiguration) --no-restore
+            displayName: Restore project
+            workingDirectory: $(Agent.BuildDirectory)/app
+
+          - pwsh: |
+              dotnet build UmbracoProject --configuration ${{ variables.buildConfiguration }} --no-restore
               dotnet dev-certs https
             displayName: Build application
             workingDirectory: $(Agent.BuildDirectory)/app
+            condition: succeeded()
 
-          # Run application
-          - bash: |
-              nohup dotnet run --project UmbracoProject --configuration $(buildConfiguration) --no-build --no-launch-profile > $(Build.ArtifactStagingDirectory)/playwright.log 2>&1 &
-              echo "##vso[task.setvariable variable=AcceptanceTestProcessId]$!"
-            displayName: Run application (Linux)
-            condition: and(succeeded(), eq(variables['Agent.OS'], 'Linux'))
-            workingDirectory: $(Agent.BuildDirectory)/app
+          # Run application Template
+          - template: nightly-E2E-run-application-template.yml
+            parameters:
+              DatabaseType: ${{ variables.DatabaseType }}
+              buildConfiguration: ${{ variables.buildConfiguration }}
+              additionalEnvironmentVariables: ${{ variables.additionalEnvironmentVariables }}
 
-          - pwsh: |
-              $process = Start-Process dotnet "run --project UmbracoProject --configuration $(buildConfiguration) --no-build --no-launch-profile 2>&1" -PassThru -NoNewWindow -RedirectStandardOutput $(Build.ArtifactStagingDirectory)/playwright.log
-              Write-Host "##vso[task.setvariable variable=AcceptanceTestProcessId]$($process.Id)"
-            displayName: Run application (Windows)
-            condition: and(succeeded(), eq(variables['Agent.OS'], 'Windows_NT'))
-            workingDirectory: $(Agent.BuildDirectory)/app
-
-          # Wait for application to start responding to requests
-          - pwsh: npx wait-on -v --interval 1000 --timeout 120000 $(ASPNETCORE_URLS)
-            displayName: Wait for application
-            workingDirectory: tests/Umbraco.Tests.AcceptanceTest
-
-          # Install Playwright and dependencies
-          - pwsh: npx playwright install chromium
-            displayName: Install Playwright only with Chromium browser
-            workingDirectory: tests/Umbraco.Tests.AcceptanceTest
-
-          # Test
-          - pwsh: $(testCommand)
-            displayName: Run Playwright tests
-            workingDirectory: tests/Umbraco.Tests.AcceptanceTest
-            env:
-              CI: true
-              CommitId: $(Build.SourceVersion)
-              AgentOs: $(Agent.OS)
-
-          # Stop application
-          - bash: kill -15 $(AcceptanceTestProcessId)
-            displayName: Stop application (Linux)
-            condition: and(ne(variables.AcceptanceTestProcessId, ''), eq(variables['Agent.OS'], 'Linux'))
-
-          - pwsh: Stop-Process -Id $(AcceptanceTestProcessId)
-            displayName: Stop application (Windows)
-            condition: and(ne(variables.AcceptanceTestProcessId, ''), eq(variables['Agent.OS'], 'Windows_NT'))
-
-          # Copy artifacts
-          - pwsh: |
-              if (Test-Path tests/Umbraco.Tests.AcceptanceTest/results/*) {
-                Copy-Item tests/Umbraco.Tests.AcceptanceTest/results/* $(Build.ArtifactStagingDirectory) -Recurse
-              }
-            displayName: Copy Playwright results
-            condition: succeededOrFailed()
-
-          # Copy console error log
-          - pwsh: |
-              if (Test-Path tests/Umbraco.Tests.AcceptanceTest/console-errors.json) {
-                  Copy-Item tests/Umbraco.Tests.AcceptanceTest/console-errors.json $(Build.ArtifactStagingDirectory)
-              }
-            displayName: Copy console error log
-            condition: succeededOrFailed()
-
-          # Publish test artifacts
-          - task: PublishPipelineArtifact@1
-            displayName: Publish test artifacts
-            condition: succeededOrFailed()
-            inputs:
-              targetPath: $(Build.ArtifactStagingDirectory)
-              artifact: "Acceptance Test Results - $(Agent.JobName) - Attempt #$(System.JobAttempt)"
-
-          # Publish test results
-          - task: PublishTestResults@2
-            displayName: "Publish test results"
-            condition: succeededOrFailed()
-            inputs:
-              testResultsFormat: 'JUnit'
-              testResultsFiles: '*.xml'
-              searchFolder: "tests/Umbraco.Tests.AcceptanceTest/results"
-              testRunTitle: "$(Agent.JobName)"
+          # Run tests Template
+          - template: nightly-E2E-run-tests-template.yml
+            parameters:
+              testCommand: $(testCommand)
+              ASPNETCORE_URLS: ${{ variables.ASPNETCORE_URLS }}
+              DatabaseType: ${{ variables.DatabaseType }}
 
       - job:
         displayName: E2E Smoke Tests (SQL Server)
@@ -683,354 +647,106 @@ stages:
           # Connection string
           CONNECTIONSTRINGS__UMBRACODBDSN: Data Source=(localdb)\MSSQLLocalDB;AttachDbFilename=|DataDirectory|\Umbraco.mdf;Integrated Security=True
           CONNECTIONSTRINGS__UMBRACODBDSN_PROVIDERNAME: Microsoft.Data.SqlClient
+          SA_PASSWORD: $(UMBRACO__CMS__UNATTENDED__UNATTENDEDUSERPASSWORD)
+          DatabaseType: SQLServer
+          additionalEnvironmentVariables: false
         strategy:
           matrix:
             ${{ if eq(parameters.sqlServerLinuxAcceptanceTests, True) }}:
               LinuxPart1Of3:
                 testCommand: "npm run smokeTest -- --shard=1/3"
                 vmImage: "ubuntu-latest"
-                SA_PASSWORD: $(UMBRACO__CMS__UNATTENDED__UNATTENDEDUSERPASSWORD)
+                testFolder: "DefaultConfig"
                 CONNECTIONSTRINGS__UMBRACODBDSN: "Server=(local);Database=Umbraco;User Id=sa;Password=$(SA_PASSWORD);TrustServerCertificate=True"
               LinuxPart2Of3:
                 testCommand: "npm run smokeTest -- --shard=2/3"
                 vmImage: "ubuntu-latest"
-                SA_PASSWORD: $(UMBRACO__CMS__UNATTENDED__UNATTENDEDUSERPASSWORD)
+                testFolder: "DefaultConfig"
                 CONNECTIONSTRINGS__UMBRACODBDSN: "Server=(local);Database=Umbraco;User Id=sa;Password=$(SA_PASSWORD);TrustServerCertificate=True"
               LinuxPart3Of3:
                 testCommand: "npm run smokeTest -- --shard=3/3"
                 vmImage: "ubuntu-latest"
-                SA_PASSWORD: $(UMBRACO__CMS__UNATTENDED__UNATTENDEDUSERPASSWORD)
+                testFolder: "DefaultConfig"
                 CONNECTIONSTRINGS__UMBRACODBDSN: "Server=(local);Database=Umbraco;User Id=sa;Password=$(SA_PASSWORD);TrustServerCertificate=True"
             WindowsPart1Of3:
               vmImage: "windows-latest"
+              testFolder: "DefaultConfig"
               testCommand: "npm run smokeTest -- --shard=1/3"
             WindowsPart2Of3:
               vmImage: "windows-latest"
+              testFolder: "DefaultConfig"
               testCommand: "npm run smokeTest -- --shard=2/3"
             WindowsPart3Of3:
               vmImage: "windows-latest"
+              testFolder: "DefaultConfig"
               testCommand: "npm run smokeTest -- --shard=3/3"
         pool:
           vmImage: $(vmImage)
         steps:
-          # Setup test environment
-          - task: DownloadPipelineArtifact@2
-            displayName: Download NuGet artifacts
-            inputs:
-              artifact: nupkg
-              path: $(Agent.BuildDirectory)/app/nupkg
-
-          - task: NodeTool@0
-            displayName: Use Node.js $(nodeVersion)
-            inputs:
-              versionSpec: $(nodeVersion)
-
-          - task: UseDotNet@2
-            displayName: Use .NET SDK from global.json
-            inputs:
-              useGlobalJson: true
+          # Setup test environment Template
+          - template: nightly-E2E-setup-template.yml
+            parameters:
+              nodeVersion: ${{ variables.nodeVersion }}
+              PlaywrightUserEmail: ${{ variables.UMBRACO__CMS__UNATTENDED__UNATTENDEDUSEREMAIL }}
+              PlaywrightPassword: ${{ variables.UMBRACO__CMS__UNATTENDED__UNATTENDEDUSERPASSWORD }}
+              ASPNETCORE_URLS: ${{ variables.ASPNETCORE_URLS }}
+              npm_config_cache: ${{ variables.npm_config_cache }}
 
           - pwsh: |
-              "UMBRACO_USER_LOGIN=$(UMBRACO__CMS__UNATTENDED__UNATTENDEDUSEREMAIL)
-              UMBRACO_USER_PASSWORD=$(UMBRACO__CMS__UNATTENDED__UNATTENDEDUSERPASSWORD)
-              URL=$(ASPNETCORE_URLS)
-              STORAGE_STAGE_PATH=$(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/playwright/.auth/user.json
-              CONSOLE_ERRORS_PATH=$(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/console-errors.json" | Out-File .env
-            displayName: Generate .env
-            workingDirectory: $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest
-
-          # Cache and restore NPM packages
-          - task: Cache@2
-            displayName: Cache NPM packages
-            inputs:
-              key: 'npm_e2e | "$(Agent.OS)" | $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/package-lock.json'
-              restoreKeys: |
-                npm_e2e | "$(Agent.OS)"
-                npm_e2e
-              path: $(npm_config_cache)
-
-          - script: npm ci --no-fund --no-audit --prefer-offline
-            workingDirectory: $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest
-            displayName: Restore NPM packages
-
-          # Build application
-          - pwsh: |
-              $cmsVersion = "$(Build.BuildNumber)" -replace "\+",".g"
-              dotnet new nugetconfig
-              dotnet nuget add source ./nupkg --name Local
-              dotnet new install Umbraco.Templates::$cmsVersion
-              dotnet new umbraco --name UmbracoProject --version $cmsVersion --exclude-gitignore --no-restore --no-update-check
               dotnet restore UmbracoProject
               cp $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest.UmbracoProject/*.cs UmbracoProject
-              dotnet build UmbracoProject --configuration $(buildConfiguration) --no-restore
+            displayName: Restore project
+            workingDirectory: $(Agent.BuildDirectory)/app
+
+          - pwsh: |
+              dotnet build UmbracoProject --configuration ${{ variables.buildConfiguration }} --no-restore
               dotnet dev-certs https
             displayName: Build application
             workingDirectory: $(Agent.BuildDirectory)/app
+            condition: succeeded()
 
-          # Start SQL Server
-          - powershell: docker run --name mssql -d -p 1433:1433 -e "ACCEPT_EULA=Y" -e "MSSQL_SA_PASSWORD=$(SA_PASSWORD)" mcr.microsoft.com/mssql/server:2022-latest
-            displayName: Start SQL Server Docker image (Linux)
-            condition: and(succeeded(), eq(variables['Agent.OS'], 'Linux'))
+          # Run application Template
+          - template: nightly-E2E-run-application-template.yml
+            parameters:
+              SA_PASSWORD: ${{ variables.SA_PASSWORD }}
+              buildConfiguration: ${{ variables.buildConfiguration }}
+              DatabaseType: ${{ variables.DatabaseType }}
+              additionalEnvironmentVariables: ${{ variables.additionalEnvironmentVariables }}
 
-          - pwsh: SqlLocalDB start MSSQLLocalDB
-            displayName: Start SQL Server LocalDB (Windows)
-            condition: and(succeeded(), eq(variables['Agent.OS'], 'Windows_NT'))
+          # Run tests Template
+          - template: nightly-E2E-run-tests-template.yml
+            parameters:
+              testCommand: $(testCommand)
+              ASPNETCORE_URLS: ${{ variables.ASPNETCORE_URLS }}
+              DatabaseType: ${{ variables.DatabaseType }}
 
-          # Run application
-          - bash: |
-              nohup dotnet run --project UmbracoProject --configuration $(buildConfiguration) --no-build --no-launch-profile > $(Build.ArtifactStagingDirectory)/playwright.log 2>&1 &
-              echo "##vso[task.setvariable variable=AcceptanceTestProcessId]$!"
-            displayName: Run application (Linux)
-            condition: and(succeeded(), eq(variables['Agent.OS'], 'Linux'))
-            workingDirectory: $(Agent.BuildDirectory)/app
-
-          - pwsh: |
-              $process = Start-Process dotnet "run --project UmbracoProject --configuration $(buildConfiguration) --no-build --no-launch-profile 2>&1" -PassThru -NoNewWindow -RedirectStandardOutput $(Build.ArtifactStagingDirectory)/playwright.log
-              Write-Host "##vso[task.setvariable variable=AcceptanceTestProcessId]$($process.Id)"
-            displayName: Run application (Windows)
-            condition: and(succeeded(), eq(variables['Agent.OS'], 'Windows_NT'))
-            workingDirectory: $(Agent.BuildDirectory)/app
-
-          # Wait for application to start responding to requests
-          - pwsh: npx wait-on -v --interval 1000 --timeout 120000 $(ASPNETCORE_URLS)
-            displayName: Wait for application
-            workingDirectory: tests/Umbraco.Tests.AcceptanceTest
-
-          # Install Playwright and dependencies
-          - pwsh: npx playwright install chromium
-            displayName: Install Playwright only with Chromium browser
-            workingDirectory: tests/Umbraco.Tests.AcceptanceTest
-
-          # Test
-          - pwsh: $(testCommand)
-            displayName: Run Playwright tests
-            workingDirectory: tests/Umbraco.Tests.AcceptanceTest
-            env:
-              CI: true
-              CommitId: $(Build.SourceVersion)
-              AgentOs: $(Agent.OS)
-
-          # Stop application
-          - bash: kill -15 $(AcceptanceTestProcessId)
-            displayName: Stop application (Linux)
-            condition: and(ne(variables.AcceptanceTestProcessId, ''), eq(variables['Agent.OS'], 'Linux'))
-
-          - pwsh: Stop-Process -Id $(AcceptanceTestProcessId)
-            displayName: Stop application (Windows)
-            condition: and(ne(variables.AcceptanceTestProcessId, ''), eq(variables['Agent.OS'], 'Windows_NT'))
-
-          # Stop SQL Server
-          - pwsh: docker stop mssql
-            displayName: Stop SQL Server Docker image (Linux)
-            condition: eq(variables['Agent.OS'], 'Linux')
-
-          - pwsh: SqlLocalDB stop MSSQLLocalDB
-            displayName: Stop SQL Server LocalDB (Windows)
-            condition: eq(variables['Agent.OS'], 'Windows_NT')
-
-          # Copy artifacts
-          - pwsh: |
-              if (Test-Path tests/Umbraco.Tests.AcceptanceTest/results/*) {
-                Copy-Item tests/Umbraco.Tests.AcceptanceTest/results/* $(Build.ArtifactStagingDirectory) -Recurse
-              }
-            displayName: Copy Playwright results
-            condition: succeededOrFailed()
-
-          # Copy console error log
-          - pwsh: |
-              if (Test-Path tests/Umbraco.Tests.AcceptanceTest/console-errors.json) {
-                  Copy-Item tests/Umbraco.Tests.AcceptanceTest/console-errors.json $(Build.ArtifactStagingDirectory)
-              }
-            displayName: Copy console error log
-            condition: succeededOrFailed()
-
-          # Publish test artifacts
-          - task: PublishPipelineArtifact@1
-            displayName: Publish test artifacts
-            condition: succeededOrFailed()
-            inputs:
-              targetPath: $(Build.ArtifactStagingDirectory)
-              artifact: "Acceptance Test Results - $(Agent.JobName) - Attempt #$(System.JobAttempt)"
-
-          # Publish test results
-          - task: PublishTestResults@2
-            displayName: "Publish test results"
-            condition: succeededOrFailed()
-            inputs:
-              testResultsFormat: 'JUnit'
-              testResultsFiles: '*.xml'
-              searchFolder: "tests/Umbraco.Tests.AcceptanceTest/results"
-              testRunTitle: "$(Agent.JobName)"
-
-      - job:
-        displayName: E2E Release Tests (SQL Server)
-        variables:
-          # Connection string
-          CONNECTIONSTRINGS__UMBRACODBDSN: Data Source=(localdb)\MSSQLLocalDB;AttachDbFilename=|DataDirectory|\Umbraco.mdf;Integrated Security=True
-          CONNECTIONSTRINGS__UMBRACODBDSN_PROVIDERNAME: Microsoft.Data.SqlClient
-        condition: eq(dependencies.Build.outputs['A.build.NBGV_PublicRelease'], 'True')
-        strategy:
-          matrix:
-            WindowsPart1Of3:
-              vmImage: "windows-latest"
-              testCommand: "npm run releaseTest -- --shard=1/3"
-            WindowsPart2Of3:
-              vmImage: "windows-latest"
-              testCommand: "npm run releaseTest -- --shard=2/3"
-            WindowsPart3Of3:
-              vmImage: "windows-latest"
-              testCommand: "npm run releaseTest -- --shard=3/3"
-        pool:
-          vmImage: $(vmImage)
-        steps:
-          # Setup test environment
-          - task: DownloadPipelineArtifact@2
-            displayName: Download NuGet artifacts
-            inputs:
-              artifact: nupkg
-              path: $(Agent.BuildDirectory)/app/nupkg
-
-          - task: NodeTool@0
-            displayName: Use Node.js $(nodeVersion)
-            inputs:
-              versionSpec: $(nodeVersion)
-
-          - task: UseDotNet@2
-            displayName: Use .NET SDK from global.json
-            inputs:
-              useGlobalJson: true
-
-          - pwsh: |
-              "UMBRACO_USER_LOGIN=$(UMBRACO__CMS__UNATTENDED__UNATTENDEDUSEREMAIL)
-              UMBRACO_USER_PASSWORD=$(UMBRACO__CMS__UNATTENDED__UNATTENDEDUSERPASSWORD)
-              URL=$(ASPNETCORE_URLS)
-              STORAGE_STAGE_PATH=$(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/playwright/.auth/user.json
-              CONSOLE_ERRORS_PATH=$(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/console-errors.json" | Out-File .env
-            displayName: Generate .env
-            workingDirectory: $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest
-
-          # Cache and restore NPM packages
-          - task: Cache@2
-            displayName: Cache NPM packages
-            inputs:
-              key: 'npm_e2e | "$(Agent.OS)" | $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/package-lock.json'
-              restoreKeys: |
-                npm_e2e | "$(Agent.OS)"
-                npm_e2e
-              path: $(npm_config_cache)
-
-          - script: npm ci --no-fund --no-audit --prefer-offline
-            workingDirectory: $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest
-            displayName: Restore NPM packages
-
-          # Build application
-          - pwsh: |
-              $cmsVersion = "$(Build.BuildNumber)" -replace "\+",".g"
-              dotnet new nugetconfig
-              dotnet nuget add source ./nupkg --name Local
-              dotnet new install Umbraco.Templates::$cmsVersion
-              dotnet new umbraco --name UmbracoProject --version $cmsVersion --exclude-gitignore --no-restore --no-update-check
-              dotnet restore UmbracoProject
-              cp $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest.UmbracoProject/*.cs UmbracoProject
-              dotnet build UmbracoProject --configuration $(buildConfiguration) --no-restore
-              dotnet dev-certs https
-            displayName: Build application
-            workingDirectory: $(Agent.BuildDirectory)/app
-
-          # Start SQL Server
-          - powershell: docker run --name mssql -d -p 1433:1433 -e "ACCEPT_EULA=Y" -e "MSSQL_SA_PASSWORD=$(SA_PASSWORD)" mcr.microsoft.com/mssql/server:2022-latest
-            displayName: Start SQL Server Docker image (Linux)
-            condition: and(succeeded(), eq(variables['Agent.OS'], 'Linux'))
-
-          - pwsh: SqlLocalDB start MSSQLLocalDB
-            displayName: Start SQL Server LocalDB (Windows)
-            condition: and(succeeded(), eq(variables['Agent.OS'], 'Windows_NT'))
-
-          # Run application
-          - bash: |
-              nohup dotnet run --project UmbracoProject --configuration $(buildConfiguration) --no-build --no-launch-profile > $(Build.ArtifactStagingDirectory)/playwright.log 2>&1 &
-              echo "##vso[task.setvariable variable=AcceptanceTestProcessId]$!"
-            displayName: Run application (Linux)
-            condition: and(succeeded(), eq(variables['Agent.OS'], 'Linux'))
-            workingDirectory: $(Agent.BuildDirectory)/app
-
-          - pwsh: |
-              $process = Start-Process dotnet "run --project UmbracoProject --configuration $(buildConfiguration) --no-build --no-launch-profile 2>&1" -PassThru -NoNewWindow -RedirectStandardOutput $(Build.ArtifactStagingDirectory)/playwright.log
-              Write-Host "##vso[task.setvariable variable=AcceptanceTestProcessId]$($process.Id)"
-            displayName: Run application (Windows)
-            condition: and(succeeded(), eq(variables['Agent.OS'], 'Windows_NT'))
-            workingDirectory: $(Agent.BuildDirectory)/app
-
-          # Wait for application to start responding to requests
-          - pwsh: npx wait-on -v --interval 1000 --timeout 120000 $(ASPNETCORE_URLS)
-            displayName: Wait for application
-            workingDirectory: tests/Umbraco.Tests.AcceptanceTest
-
-          # Install Playwright and dependencies
-          - pwsh: npx playwright install chromium
-            displayName: Install Playwright only with Chromium browser
-            workingDirectory: tests/Umbraco.Tests.AcceptanceTest
-
-          # Test
-          - pwsh: $(testCommand)
-            displayName: Run Playwright tests
-            workingDirectory: tests/Umbraco.Tests.AcceptanceTest
-            env:
-              CI: true
-              CommitId: $(Build.SourceVersion)
-              AgentOs: $(Agent.OS)
-
-          # Stop application
-          - bash: kill -15 $(AcceptanceTestProcessId)
-            displayName: Stop application (Linux)
-            condition: and(ne(variables.AcceptanceTestProcessId, ''), eq(variables['Agent.OS'], 'Linux'))
-
-          - pwsh: Stop-Process -Id $(AcceptanceTestProcessId)
-            displayName: Stop application (Windows)
-            condition: and(ne(variables.AcceptanceTestProcessId, ''), eq(variables['Agent.OS'], 'Windows_NT'))
-
-          # Stop SQL Server
-          - pwsh: docker stop mssql
-            displayName: Stop SQL Server Docker image (Linux)
-            condition: eq(variables['Agent.OS'], 'Linux')
-
-          - pwsh: SqlLocalDB stop MSSQLLocalDB
-            displayName: Stop SQL Server LocalDB (Windows)
-            condition: eq(variables['Agent.OS'], 'Windows_NT')
-
-          # Copy artifacts
-          - pwsh: |
-              if (Test-Path tests/Umbraco.Tests.AcceptanceTest/results/*) {
-                Copy-Item tests/Umbraco.Tests.AcceptanceTest/results/* $(Build.ArtifactStagingDirectory) -Recurse
-              }
-            displayName: Copy Playwright results
-            condition: succeededOrFailed()
-
-          # Copy console error log
-          - pwsh: |
-              if (Test-Path tests/Umbraco.Tests.AcceptanceTest/console-errors.json) {
-                  Copy-Item tests/Umbraco.Tests.AcceptanceTest/console-errors.json $(Build.ArtifactStagingDirectory)
-              }
-            displayName: Copy console error log
-            condition: succeededOrFailed()
-
-          # Publish test artifacts
-          - task: PublishPipelineArtifact@1
-            displayName: Publish test artifacts
-            condition: succeededOrFailed()
-            inputs:
-              targetPath: $(Build.ArtifactStagingDirectory)
-              artifact: "Acceptance Test Results - $(Agent.JobName) - Attempt #$(System.JobAttempt)"
-
-          # Publish test results
-          - task: PublishTestResults@2
-            displayName: "Publish test results"
-            condition: succeededOrFailed()
-            inputs:
-              testResultsFormat: 'JUnit'
-              testResultsFiles: '*.xml'
-              searchFolder: "tests/Umbraco.Tests.AcceptanceTest/results"
-              testRunTitle: "$(Agent.JobName)"
+  - stage: Dependency_Track
+    displayName: Dependency Track
+    dependsOn:
+      - Build
+      - E2E_BOM
+    condition: and(succeeded(), or(eq(dependencies.Build.outputs['A.build.NBGV_PublicRelease'], 'True'), ${{parameters.uploadDependencyTrack}}))
+    variables:
+      # Determine Umbraco version based on whether it's a public release or not. If public release, use major version, else use full NuGet package version.
+      umbracoVersion: $[ iif(eq(stageDependencies.Build.A.outputs['build.NBGV_PublicRelease'], 'True'), stageDependencies.Build.A.outputs['build.NBGV_VersionMajor'], stageDependencies.Build.A.outputs['build.NBGV_NuGetPackageVersion']) ]
+    jobs:
+      - template: templates/dependency-track.yml
+        parameters:
+          projectName: "Umbraco-CMS"
+          umbracoVersion: $(umbracoVersion)
+          projects:
+            - name: "Backend"
+              artifact: "bom-backend"
+              bomFilePath: "bom-dotnet.xml"
+            - name: "Login"
+              artifact: "bom-backend"
+              bomFilePath: "bom-login.xml"
+            - name: "Backoffice"
+              artifact: "bom-frontend"
+              bomFilePath: "bom-backoffice.xml"
+            - name: "E2E"
+              artifact: "bom-e2e"
+              bomFilePath: "bom-e2e.xml"
 
   ###############################################
   ## Release
@@ -1237,4 +953,5 @@ stages:
               storage: umbracoapidocs
               ContainerName: "$web"
               BlobPrefix: v$(umbracoMajorVersion)/ui-api
-              CleanTargetBeforeCopy: true
+              CleanTargetBeforeCopy: true
+

build/nightly-E2E-build-template.yml

@@ -0,0 +1,74 @@
+parameters:
+  - name: testFolder
+    type: string
+    default: ''
+
+  - name: buildConfiguration
+    type: string
+    default: ''
+
+  - name: additionalEnvironmentVariables
+    type: string
+    default: 'false'
+
+steps:
+  - pwsh: |
+      dotnet restore UmbracoProject
+      cp $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest.UmbracoProject/*.cs UmbracoProject
+    displayName: Restore project
+    workingDirectory: $(Agent.BuildDirectory)/app
+
+  # Update application to use necessary app settings
+  - pwsh: |
+      $sourcePath = "$(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/tests/${{ parameters.testFolder }}/AdditionalSetup"
+      $destinationPath = "UmbracoProject"
+      $jsonFiles = Get-ChildItem -Path $sourcePath -Filter "*.json"
+      if ($jsonFiles) {
+      $jsonFiles | ForEach-Object {
+        Write-Host "Copying: $($_.FullName)"
+        Copy-Item -Path $_.FullName -Destination $destinationPath -Force
+      }
+      } else {
+      Write-Host "No JSON files found."
+      }
+    displayName: Update application to use necessary app settings
+    workingDirectory: $(Agent.BuildDirectory)/app
+
+  # Update application to use necessary App_Plugins
+  - pwsh: |
+      $sourcePath = "$(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/tests/${{ parameters.testFolder }}/AdditionalSetup"
+      $destinationPath = "UmbracoProject"
+      $appPluginsFolders = Get-ChildItem -Path $sourcePath -Directory -Filter "App_Plugins"
+      if ($appPluginsFolders) {
+        foreach ($folder in $appPluginsFolders) {
+          Write-Host "Copying folder: $($folder.FullName)"
+          Copy-Item -Path $folder.FullName -Destination $destinationPath -Recurse -Force
+          }
+      } else {
+        Write-Host "No App_Plugins found."
+      }
+    displayName: Update application to use necessary app plugins
+    workingDirectory: $(Agent.BuildDirectory)/app
+
+  # Update application to use necessary classes
+  - pwsh: |
+      $sourcePath = "$(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/tests/${{ parameters.testFolder }}/AdditionalSetup"
+      $destinationPath = "UmbracoProject"
+      $csharpFiles = Get-ChildItem -Path $sourcePath -Filter "*.cs"
+      if ($csharpFiles) {
+        $csharpFiles | ForEach-Object {
+          Write-Host "Copying: $($_.FullName)"
+          Copy-Item -Path $_.FullName -Destination $destinationPath -Force
+        }
+      } else {
+        Write-Host "No C# files found."
+      }
+    displayName: Update application to use necessary classes
+    workingDirectory: $(Agent.BuildDirectory)/app
+
+  - pwsh: |
+      dotnet build UmbracoProject --configuration ${{ parameters.buildConfiguration }} --no-restore
+      dotnet dev-certs https
+    displayName: Build application
+    workingDirectory: $(Agent.BuildDirectory)/app
+    condition: and(succeeded(), eq(variables['additionalEnvironmentVariables'], 'false'))

build/nightly-E2E-run-application-template.yml

@@ -0,0 +1,45 @@
+parameters:
+  - name: SA_PASSWORD
+    type: string
+    default: ''
+
+  - name: buildConfiguration
+    type: string
+    default: ''
+
+  - name: additionalEnvironmentVariables
+    type: string
+    default: 'false'
+
+  - name: DatabaseType
+    type: string
+    default: ''
+
+steps:
+  # Skips the SQLServer setup if the databaseType does not match
+  - ${{ if eq(parameters.DatabaseType, 'SQLServer') }}:
+      # Start SQL Server Linux
+      - powershell: docker run --name mssql -d -p 1433:1433 -e "ACCEPT_EULA=Y" -e "MSSQL_SA_PASSWORD=${{ parameters.SA_PASSWORD }}" mcr.microsoft.com/mssql/server:2022-latest
+        displayName: Start SQL Server Docker image (Linux)
+        condition: and(succeeded(), eq(variables['Agent.OS'], 'Linux'))
+
+      # Start SQL Server LocalDB Windows
+      - pwsh: SqlLocalDB start MSSQLLocalDB
+        displayName: Start SQL Server LocalDB (Windows)
+        condition: and(succeeded(), eq(variables['Agent.OS'], 'Windows_NT'))
+
+  # Run application for Linux
+  - bash: |
+      nohup dotnet run --project UmbracoProject --configuration ${{ parameters.buildConfiguration }} --no-build --no-launch-profile > $(Build.ArtifactStagingDirectory)/playwright.log 2>&1 &
+      echo "##vso[task.setvariable variable=AcceptanceTestProcessId]$!"
+    displayName: Run application (Linux)
+    condition: and(succeeded(), eq(variables['Agent.OS'], 'Linux'), eq(variables['additionalEnvironmentVariables'], 'false'))
+    workingDirectory: $(Agent.BuildDirectory)/app
+
+  # Run application for Windows
+  - pwsh: |
+      $process = Start-Process dotnet "run --project UmbracoProject --configuration ${{ parameters.buildConfiguration }} --no-build --no-launch-profile 2>&1" -PassThru -NoNewWindow -RedirectStandardOutput $(Build.ArtifactStagingDirectory)/playwright.log
+      Write-Host "##vso[task.setvariable variable=AcceptanceTestProcessId]$($process.Id)"
+    displayName: Run application (Windows)
+    condition: and(succeeded(), eq(variables['Agent.OS'], 'Windows_NT'), eq(variables['additionalEnvironmentVariables'], 'false'))
+    workingDirectory: $(Agent.BuildDirectory)/app

build/nightly-E2E-run-tests-template.yml

@@ -0,0 +1,105 @@
+parameters:
+  - name: ASPNETCORE_URLS
+    type: string
+    default: ''
+
+  - name: testCommand
+    type: string
+    default: ''
+
+  - name: port
+    type: string
+    default: ''
+
+  - name: AZUREB2CTESTUSEREMAIL
+    type: string
+    default: ''
+
+  - name: AZUREB2CTESTUSERPASSWORD
+    type: string
+    default: ''
+
+  - name: DatabaseType
+    type: string
+    default: ''
+
+steps:
+  # Ensures we have the package wait-on installed
+  - pwsh: npm install wait-on
+    displayName: Install wait-on package
+
+  # Wait for either the port of the aspnetcore url
+  - pwsh: |
+      $Port = "${{ parameters.port }}"
+      $Url  = "${{ parameters.ASPNETCORE_URLS }}"
+
+      if ($Port -ne "") {
+          Write-Host "Waiting on TCP port $Port"
+          npx wait-on -v --interval 1000 --timeout 120000 "tcp:$Port"
+      } else {
+          Write-Host "Waiting on URL $Url"
+          npx wait-on -v --interval 1000 --timeout 120000 "$Url"
+      }
+    displayName: Wait for application
+    workingDirectory: tests/Umbraco.Tests.AcceptanceTest
+
+  # Install Playwright and dependencies
+  - pwsh: npx playwright install chromium
+    displayName: Install Playwright only with Chromium browser
+    workingDirectory: tests/Umbraco.Tests.AcceptanceTest
+
+  # Test
+  - pwsh: ${{ parameters.testCommand }}
+    displayName: Run Playwright tests
+    workingDirectory: tests/Umbraco.Tests.AcceptanceTest
+    env:
+      CI: true
+      CommitId: $(Build.SourceVersion)
+      AgentOs: $(Agent.OS)
+      AZUREADB2CTESTUSEREMAIL: ${{ parameters.AZUREB2CTESTUSEREMAIL }}
+      AZUREADB2CTESTUSERPASSWORD: ${{ parameters.AZUREB2CTESTUSERPASSWORD }}
+
+  # Stop application
+  - bash: kill -15 $(AcceptanceTestProcessId)
+    displayName: Stop application (Linux)
+    condition: and(succeededOrFailed(), ne(variables.AcceptanceTestProcessId, ''), eq(variables['Agent.OS'], 'Linux'))
+
+  - pwsh: Stop-Process -Id $(AcceptanceTestProcessId)
+    displayName: Stop application (Windows)
+    condition: and(succeededOrFailed(), ne(variables.AcceptanceTestProcessId, ''), eq(variables['Agent.OS'], 'Windows_NT'))
+
+  - ${{ if eq(parameters.DatabaseType, 'SQLServer') }}:
+      # Stop SQL Server
+      - pwsh: docker stop mssql
+        displayName: Stop SQL Server Docker image (Linux)
+        condition: and(succeededOrFailed(), eq(variables['Agent.OS'], 'Linux'))
+
+      - pwsh: SqlLocalDB stop MSSQLLocalDB
+        displayName: Stop SQL Server LocalDB (Windows)
+        condition: and(succeededOrFailed(), eq(variables['Agent.OS'], 'Windows_NT'))
+
+  # Copy artifacts
+  - pwsh: |
+      if (Test-Path tests/Umbraco.Tests.AcceptanceTest/results/*) {
+        Copy-Item tests/Umbraco.Tests.AcceptanceTest/results/* $(Build.ArtifactStagingDirectory) -Recurse
+      }
+    displayName: Copy Playwright results
+    condition: succeededOrFailed()
+
+  # Publish
+  - task: PublishPipelineArtifact@1
+    displayName: Publish test artifacts
+    condition: succeededOrFailed()
+    inputs:
+      targetPath: $(Build.ArtifactStagingDirectory)
+      artifact: "Acceptance Test Results - $(Agent.JobName) - Attempt #$(System.JobAttempt)"
+
+  # Publish test results
+  - task: PublishTestResults@2
+    displayName: "Publish test results"
+    condition: succeededOrFailed()
+    inputs:
+      testResultsFormat: 'JUnit'
+      testResultsFiles: '*.xml'
+      searchFolder: "tests/Umbraco.Tests.AcceptanceTest/results"
+      testRunTitle: "$(Agent.JobName)"

build/nightly-E2E-setup-template.yml

@@ -0,0 +1,50 @@
+parameters:
+  - name: nodeVersion
+    type: string
+    default: ''
+
+  - name: PlaywrightUserEmail
+    type: string
+    default: ''
+
+  - name: PlaywrightPassword
+    type: string
+    default: ''
+
+  - name: ASPNETCORE_URLS
+    type: string
+    default: ''
+
+  - name: npm_config_cache
+    type: string
+    default: ''
+
+steps:
+  - task: DownloadPipelineArtifact@2
+    displayName: Download NuGet artifacts
+    inputs:
+      artifact: nupkg
+      path: $(Agent.BuildDirectory)/app/nupkg
+
+  - task: UseDotNet@2
+    displayName: Use .NET SDK from global.json
+    inputs:
+      useGlobalJson: true
+
+  - template: templates/e2e-install.yml
+    parameters:
+      nodeVersion: ${{ parameters.nodeVersion }}
+      npm_config_cache: ${{ parameters.npm_config_cache }}
+      PlaywrightUserEmail: ${{ parameters.PlaywrightUserEmail }}
+      PlaywrightPassword: ${{ parameters.PlaywrightPassword }}
+      ASPNETCORE_URLS: ${{ parameters.ASPNETCORE_URLS }}
+
+  # Install Template
+  - pwsh: |
+      $cmsVersion = "$(Build.BuildNumber)" -replace "\+",".g"
+      dotnet new nugetconfig
+      dotnet nuget add source ./nupkg --name Local
+      dotnet new install Umbraco.Templates::$cmsVersion
+      dotnet new umbraco --name UmbracoProject --version $cmsVersion --exclude-gitignore --no-restore --no-update-check
+    displayName: Install Template
+    workingDirectory: $(Agent.BuildDirectory)/app

build/nightly-E2E-test-pipelines.yml

@@ -4,17 +4,25 @@ pr: none
 trigger: none
 
 schedules:
-  - cron: '0 0 * * *'
-    displayName: Daily midnight build
+  - cron: '0 6 * * *'
+    displayName: Daily 6 AM build (v16/dev)
     branches:
       include:
-        - v15/dev
-        - main
+        - v16/dev
 
 parameters:
-  # Skipped due to DB locks
-  - name: sqliteAcceptanceTests
-    displayName: Run SQLite Acceptance Tests
+  - name: skipIntegrationTests
+    displayName: Skip integration tests
+    type: boolean
+    default: false
+
+  - name: differentAppSettingsAcceptanceTests
+    displayName: Run acceptance tests with different app settings
+    type: boolean
+    default: false
+
+  - name: skipDefaultConfigAcceptanceTests
+    displayName: Skip tests with DefaultConfig
     type: boolean
     default: false
 
@@ -100,9 +108,193 @@ stages:
               targetPath: $(Build.ArtifactStagingDirectory)/npm
               artifactName: npm
 
-  - stage: E2E
-    displayName: E2E Tests
+  - stage: Integration
+    displayName: Integration Tests
     dependsOn: Build
+    condition: ${{ eq(parameters.skipIntegrationTests, false) }}
+    jobs:
+      # Integration Tests (SQLite)
+      - job:
+        timeoutInMinutes: 180
+        displayName: Integration Tests (SQLite)
+        strategy:
+          matrix:
+            #            Windows:
+            #              vmImage: 'windows-latest'
+            # We split the tests into 3 parts for each OS to reduce the time it takes to run them on the pipeline
+            LinuxPart1Of3:
+              vmImage: "ubuntu-latest"
+              # Filter tests that are part of the Umbraco.Infrastructure namespace but not part of the Umbraco.Infrastructure.Service namespace
+              testFilter: "(FullyQualifiedName~Umbraco.Infrastructure) & (FullyQualifiedName!~Umbraco.Infrastructure.Service)"
+            LinuxPart2Of3:
+              vmImage: "ubuntu-latest"
+              # Filter tests that are part of the Umbraco.Infrastructure.Service namespace
+              testFilter: "(FullyQualifiedName~Umbraco.Infrastructure.Service)"
+            LinuxPart3Of3:
+              vmImage: "ubuntu-latest"
+              # Filter tests that are not part of the Umbraco.Infrastructure namespace. So this will run all tests that are not part of the Umbraco.Infrastructure namespace
+              testFilter: "(FullyQualifiedName!~Umbraco.Infrastructure)"
+            macOSPart1Of3:
+              vmImage: "macOS-latest"
+              # Filter tests that are part of the Umbraco.Infrastructure namespace but not part of the Umbraco.Infrastructure.Service namespace
+              testFilter: "(FullyQualifiedName~Umbraco.Infrastructure) & (FullyQualifiedName!~Umbraco.Infrastructure.Service)"
+            macOSPart2Of3:
+              vmImage: "macOS-latest"
+              # Filter tests that are part of the Umbraco.Infrastructure.Service namespace
+              testFilter: "(FullyQualifiedName~Umbraco.Infrastructure.Service)"
+            macOSPart3Of3:
+              vmImage: "macOS-latest"
+              # Filter tests that are not part of the Umbraco.Infrastructure namespace.
+              testFilter: "(FullyQualifiedName!~Umbraco.Infrastructure)"
+        pool:
+          vmImage: $(vmImage)
+        variables:
+          Tests__Database__DatabaseType: "Sqlite"
+        steps:
+          - checkout: self
+            submodules: false
+            lfs: false,
+            fetchDepth: 1
+            fetchFilter: tree:0
+          # Setup test environment
+          - task: DownloadPipelineArtifact@2
+            displayName: Download build artifacts
+            inputs:
+              artifact: build_output
+              path: $(Build.SourcesDirectory)
+
+          - task: UseDotNet@2
+            displayName: Use .NET SDK from global.json
+            inputs:
+              useGlobalJson: true
+
+          # Test
+          - task: DotNetCoreCLI@2
+            displayName: Run dotnet test
+            inputs:
+              command: test
+              projects: "tests/Umbraco.Tests.Integration/Umbraco.Tests.Integration.csproj"
+              testRunTitle: Integration Tests SQLite - $(Agent.OS)
+              arguments: '--filter "$(testFilter)" --configuration $(buildConfiguration) --no-build'
+
+      # Integration Tests (SQL Server)
+      - job:
+        timeoutInMinutes: 180
+        displayName: Integration Tests (SQL Server)
+        variables:
+          SA_PASSWORD: UmbracoAcceptance123!
+        strategy:
+          matrix:
+            # We split the tests into 3 parts for each OS to reduce the time it takes to run them on the pipeline
+            WindowsPart1Of3:
+              vmImage: "windows-latest"
+              Tests__Database__DatabaseType: LocalDb
+              Tests__Database__SQLServerMasterConnectionString: N/A
+              # Filter tests that are part of the Umbraco.Infrastructure namespace but not part of the Umbraco.Infrastructure.Service namespace
+              testFilter: "(FullyQualifiedName~Umbraco.Infrastructure) & (FullyQualifiedName!~Umbraco.Infrastructure.Service)"
+            WindowsPart2Of3:
+              vmImage: "windows-latest"
+              Tests__Database__DatabaseType: LocalDb
+              Tests__Database__SQLServerMasterConnectionString: N/A
+              # Filter tests that are part of the Umbraco.Infrastructure.Service namespace
+              testFilter: "(FullyQualifiedName~Umbraco.Infrastructure.Service)"
+            WindowsPart3Of3:
+              vmImage: "windows-latest"
+              Tests__Database__DatabaseType: LocalDb
+              Tests__Database__SQLServerMasterConnectionString: N/A
+              # Filter tests that are not part of the Umbraco.Infrastructure namespace. So this will run all tests that are not part of the Umbraco.Infrastructure namespace
+              testFilter: "(FullyQualifiedName!~Umbraco.Infrastructure)"
+            LinuxPart1Of3:
+              vmImage: "ubuntu-latest"
+              Tests__Database__DatabaseType: SqlServer
+              Tests__Database__SQLServerMasterConnectionString: "Server=(local);User Id=sa;Password=$(SA_PASSWORD);Encrypt=True;TrustServerCertificate=True"
+              # Filter tests that are part of the Umbraco.Infrastructure namespace but not part of the Umbraco.Infrastructure.Service namespace
+              testFilter: "(FullyQualifiedName~Umbraco.Infrastructure) & (FullyQualifiedName!~Umbraco.Infrastructure.Service)"
+            LinuxPart2Of3:
+              vmImage: "ubuntu-latest"
+              Tests__Database__DatabaseType: SqlServer
+              Tests__Database__SQLServerMasterConnectionString: "Server=(local);User Id=sa;Password=$(SA_PASSWORD);Encrypt=True;TrustServerCertificate=True"
+              # Filter tests that are part of the Umbraco.Infrastructure.Service namespace
+              testFilter: "(FullyQualifiedName~Umbraco.Infrastructure.Service)"
+            LinuxPart3Of3:
+              vmImage: "ubuntu-latest"
+              Tests__Database__DatabaseType: SqlServer
+              Tests__Database__SQLServerMasterConnectionString: "Server=(local);User Id=sa;Password=$(SA_PASSWORD);Encrypt=True;TrustServerCertificate=True"
+              # Filter tests that are not part of the Umbraco.Infrastructure namespace. So this will run all tests that are not part of the Umbraco.Infrastructure namespace
+              testFilter: "(FullyQualifiedName!~Umbraco.Infrastructure)"
+        pool:
+          vmImage: $(vmImage)
+        steps:
+          # Setup test environment
+          - task: DownloadPipelineArtifact@2
+            displayName: Download build artifacts
+            inputs:
+              artifact: build_output
+              path: $(Build.SourcesDirectory)
+
+          - task: UseDotNet@2
+            displayName: Use .NET SDK from global.json
+            inputs:
+              useGlobalJson: true
+
+          # Start SQL Server
+          - powershell: docker run --name mssql -d -p 1433:1433 -e "ACCEPT_EULA=Y" -e "MSSQL_SA_PASSWORD=$(SA_PASSWORD)" mcr.microsoft.com/mssql/server:2022-latest
+            displayName: Start SQL Server Docker image (Linux)
+            condition: and(succeeded(), eq(variables['Agent.OS'], 'Linux'))
+
+          - powershell: |
+              $maxAttempts = 12
+              $attempt = 0
+              $status = ""
+
+              while (($status -ne 'running') -and ($attempt -lt $maxAttempts)) {
+                Start-Sleep -Seconds 5
+                # We use the docker inspect command to check the status of the container. If the container is not running, we wait 5 seconds and try again. And if reaches 12 attempts, we fail the build.
+                $status = docker inspect -f '{{.State.Status}}' mssql
+
+                if ($status -ne 'running') {
+                  Write-Host "Waiting for SQL Server to be ready... Attempt $($attempt + 1)"
+                  $attempt++
+                }
+              }
+
+              if ($status -eq 'running') {
+                Write-Host "SQL Server container is running"
+                docker ps -a
+              } else {
+                Write-Host "SQL Server did not become ready in time. Last known status: $status"
+                docker logs mssql
+                exit 1
+              }
+            displayName: Wait for SQL Server to be ready (Linux)
+            condition: and(succeeded(), eq(variables['Agent.OS'], 'Linux'))
+
+          - pwsh: SqlLocalDB start MSSQLLocalDB
+            displayName: Start SQL Server LocalDB (Windows)
+            condition: and(succeeded(), eq(variables['Agent.OS'], 'Windows_NT'))
+
+          # Test
+          - task: DotNetCoreCLI@2
+            displayName: Run dotnet test
+            inputs:
+              command: test
+              projects: "tests/Umbraco.Tests.Integration/Umbraco.Tests.Integration.csproj"
+              testRunTitle: Integration Tests SQL Server - $(Agent.OS)
+              arguments: '--filter "$(testFilter)" --configuration $(buildConfiguration) --no-build'
+
+          # Stop SQL Server
+          - pwsh: docker stop mssql
+            displayName: Stop SQL Server Docker image (Linux)
+            condition: and(succeeded(), eq(variables['Agent.OS'], 'Linux'))
+
+          - pwsh: SqlLocalDB stop MSSQLLocalDB
+            displayName: Stop SQL Server LocalDB (Windows)
+            condition: and(succeeded(), eq(variables['Agent.OS'], 'Windows_NT'))
+
+  - stage: DefaultConfigE2E
+    displayName: Default Config E2E Tests
+    dependsOn: Integration
+    condition: always()
     variables:
       npm_config_cache: $(Pipeline.Workspace)/.npm_e2e
       # Enable console logging in Release mode
@@ -128,369 +320,322 @@ stages:
       # E2E Tests
       - job:
         displayName: E2E Tests (SQLite)
-        condition: eq(${{parameters.sqliteAcceptanceTests}}, True)
         timeoutInMinutes: 180
+        condition: ${{ eq(parameters.skipDefaultConfigAcceptanceTests, false) }}
         variables:
           # Connection string
           CONNECTIONSTRINGS__UMBRACODBDSN: Data Source=Umbraco;Mode=Memory;Cache=Shared;Foreign Keys=True;Pooling=True
           CONNECTIONSTRINGS__UMBRACODBDSN_PROVIDERNAME: Microsoft.Data.Sqlite
+          DatabaseType: SQLite
+          additionalEnvironmentVariables: false
         strategy:
           matrix:
             LinuxPart1Of3:
               vmImage: "ubuntu-latest"
+              testFolder: "DefaultConfig"
               testCommand: "npm run testSqlite -- --shard=1/3"
             LinuxPart2Of3:
               vmImage: "ubuntu-latest"
+              testFolder: "DefaultConfig"
               testCommand: "npm run testSqlite -- --shard=2/3"
             LinuxPart3Of3:
               vmImage: "ubuntu-latest"
+              testFolder: "DefaultConfig"
               testCommand: "npm run testSqlite -- --shard=3/3"
             WindowsPart1Of3:
               vmImage: "windows-latest"
+              testFolder: "DefaultConfig"
               testCommand: "npm run testSqlite -- --shard=1/3"
             WindowsPart2Of3:
               vmImage: "windows-latest"
+              testFolder: "DefaultConfig"
               testCommand: "npm run testSqlite -- --shard=2/3"
             WindowsPart3Of3:
               vmImage: "windows-latest"
+              testFolder: "DefaultConfig"
               testCommand: "npm run testSqlite -- --shard=3/3"
         pool:
           vmImage: $(vmImage)
         steps:
-          # Setup test environment
-          - task: DownloadPipelineArtifact@2
-            displayName: Download NuGet artifacts
-            inputs:
-              artifact: nupkg
-              path: $(Agent.BuildDirectory)/app/nupkg
-
-          - task: NodeTool@0
-            displayName: Use Node.js $(nodeVersion)
-            retryCountOnTaskFailure: 3
-            inputs:
-              versionSpec: $(nodeVersion)
-
-          - task: UseDotNet@2
-            displayName: Use .NET SDK from global.json
-            inputs:
-              useGlobalJson: true
+          # Setup test environment Template
+          - template: nightly-E2E-setup-template.yml
+            parameters:
+              nodeVersion: ${{ variables.nodeVersion }}
+              PlaywrightUserEmail: ${{ variables.UMBRACO__CMS__UNATTENDED__UNATTENDEDUSEREMAIL }}
+              PlaywrightPassword: ${{ variables.UMBRACO__CMS__UNATTENDED__UNATTENDEDUSERPASSWORD }}
+              ASPNETCORE_URLS: ${{ variables.ASPNETCORE_URLS }}
+              npm_config_cache: ${{ variables.npm_config_cache }}
 
           - pwsh: |
-              "UMBRACO_USER_LOGIN=$(UMBRACO__CMS__UNATTENDED__UNATTENDEDUSEREMAIL)
-              UMBRACO_USER_PASSWORD=$(UMBRACO__CMS__UNATTENDED__UNATTENDEDUSERPASSWORD)
-              URL=$(ASPNETCORE_URLS)
-              STORAGE_STAGE_PATH=$(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/playwright/.auth/user.json
-              CONSOLE_ERRORS_PATH=$(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/console-errors.json" | Out-File .env
-            displayName: Generate .env
-            workingDirectory: $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest
-
-          # Cache and restore NPM packages
-          - task: Cache@2
-            displayName: Cache NPM packages
-            inputs:
-              key: 'npm_e2e | "$(Agent.OS)" | $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/package-lock.json'
-              restoreKeys: |
-                npm_e2e | "$(Agent.OS)"
-                npm_e2e
-              path: $(npm_config_cache)
-
-          - script: npm ci --no-fund --no-audit --prefer-offline
-            workingDirectory: $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest
-            displayName: Restore NPM packages
-
-          # Build application
-          - pwsh: |
-              $cmsVersion = "$(Build.BuildNumber)" -replace "\+",".g"
-              dotnet new nugetconfig
-              dotnet nuget add source ./nupkg --name Local
-              dotnet new install Umbraco.Templates::$cmsVersion
-              dotnet new umbraco --name UmbracoProject --version $cmsVersion --exclude-gitignore --no-restore --no-update-check
               dotnet restore UmbracoProject
               cp $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest.UmbracoProject/*.cs UmbracoProject
-              dotnet build UmbracoProject --configuration $(buildConfiguration) --no-restore
+            displayName: Restore project
+            workingDirectory: $(Agent.BuildDirectory)/app
+
+          - pwsh: |
+              dotnet build UmbracoProject --configuration ${{ variables.buildConfiguration }} --no-restore
               dotnet dev-certs https
             displayName: Build application
             workingDirectory: $(Agent.BuildDirectory)/app
+            condition: succeeded()
 
-          # Run application
-          - bash: |
-              nohup dotnet run --project UmbracoProject --configuration $(buildConfiguration) --no-build --no-launch-profile > $(Build.ArtifactStagingDirectory)/playwright.log 2>&1 &
-              echo "##vso[task.setvariable variable=AcceptanceTestProcessId]$!"
-            displayName: Run application (Linux)
-            condition: and(succeeded(), eq(variables['Agent.OS'], 'Linux'))
-            workingDirectory: $(Agent.BuildDirectory)/app
+          # Run application Template
+          - template: nightly-E2E-run-application-template.yml
+            parameters:
+              DatabaseType: ${{ variables.DatabaseType }}
+              buildConfiguration: ${{ variables.buildConfiguration }}
+              additionalEnvironmentVariables: ${{ variables.additionalEnvironmentVariables }}
 
-          - pwsh: |
-              $process = Start-Process dotnet "run --project UmbracoProject --configuration $(buildConfiguration) --no-build --no-launch-profile 2>&1" -PassThru -NoNewWindow -RedirectStandardOutput $(Build.ArtifactStagingDirectory)/playwright.log
-              Write-Host "##vso[task.setvariable variable=AcceptanceTestProcessId]$($process.Id)"
-            displayName: Run application (Windows)
-            condition: and(succeeded(), eq(variables['Agent.OS'], 'Windows_NT'))
-            workingDirectory: $(Agent.BuildDirectory)/app
-
-          # Ensures we have the package wait-on installed
-          - pwsh: npm install wait-on
-            displayName: Install wait-on package
-
-          # Wait for application to start responding to requests
-          - pwsh: npx wait-on -v --interval 1000 --timeout 120000 $(ASPNETCORE_URLS)
-            displayName: Wait for application
-            workingDirectory: tests/Umbraco.Tests.AcceptanceTest
-
-            # Install Playwright and dependencies
-          - pwsh: npx playwright install chromium
-            displayName: Install Playwright only with Chromium browser
-            workingDirectory: tests/Umbraco.Tests.AcceptanceTest
-
-          # Test
-          - pwsh: $(testCommand)
-            displayName: Run Playwright tests
-            continueOnError: true
-            workingDirectory: tests/Umbraco.Tests.AcceptanceTest
-            env:
-              CI: true
-              CommitId: $(Build.SourceVersion)
-              AgentOs: $(Agent.OS)
-
-          # Stop application
-          - bash: kill -15 $(AcceptanceTestProcessId)
-            displayName: Stop application (Linux)
-            condition: and(succeeded(), ne(variables.AcceptanceTestProcessId, ''), eq(variables['Agent.OS'], 'Linux'))
-
-          - pwsh: Stop-Process -Id $(AcceptanceTestProcessId)
-            displayName: Stop application (Windows)
-            condition: and(succeeded(), ne(variables.AcceptanceTestProcessId, ''), eq(variables['Agent.OS'], 'Windows_NT'))
-
-          # Copy artifacts
-          - pwsh: |
-              if (Test-Path tests/Umbraco.Tests.AcceptanceTest/results/*) {
-                Copy-Item tests/Umbraco.Tests.AcceptanceTest/results/* $(Build.ArtifactStagingDirectory) -Recurse
-              }
-            displayName: Copy Playwright results
-            condition: succeededOrFailed()
-
-          # Copy console error log
-          - pwsh: |
-              if (Test-Path tests/Umbraco.Tests.AcceptanceTest/console-errors.json) {
-                  Copy-Item tests/Umbraco.Tests.AcceptanceTest/console-errors.json $(Build.ArtifactStagingDirectory)
-              }
-            displayName: Copy console error log
-            condition: succeededOrFailed()
-
-          # Publish
-          - task: PublishPipelineArtifact@1
-            displayName: Publish test artifacts
-            condition: succeededOrFailed()
-            inputs:
-              targetPath: $(Build.ArtifactStagingDirectory)
-              artifact: "Acceptance Test Results - $(Agent.JobName) - Attempt #$(System.JobAttempt)"
-
-          # Publish test results
-          - task: PublishTestResults@2
-            displayName: "Publish test results"
-            condition: succeededOrFailed()
-            inputs:
-              testResultsFormat: 'JUnit'
-              testResultsFiles: '*.xml'
-              searchFolder: "tests/Umbraco.Tests.AcceptanceTest/results"
-              testRunTitle: "$(Agent.JobName)"
+          # Run tests Template
+          - template: nightly-E2E-run-tests-template.yml
+            parameters:
+              testCommand: $(testCommand)
+              ASPNETCORE_URLS: ${{ variables.ASPNETCORE_URLS }}
+              DatabaseType: ${{ variables.DatabaseType }}
 
       - job:
         displayName: E2E Tests (SQL Server)
         timeoutInMinutes: 180
+        condition: ${{ eq(parameters.skipDefaultConfigAcceptanceTests, false) }}
         variables:
           # Connection string
           CONNECTIONSTRINGS__UMBRACODBDSN: Data Source=(localdb)\MSSQLLocalDB;AttachDbFilename=|DataDirectory|\Umbraco.mdf;Integrated Security=True
           CONNECTIONSTRINGS__UMBRACODBDSN_PROVIDERNAME: Microsoft.Data.SqlClient
+          DatabaseType: SQLServer
+          SA_PASSWORD: UmbracoAcceptance123!
+          additionalEnvironmentVariables: false
         strategy:
           matrix:
             LinuxPart1Of3:
               testCommand: "npm run test -- --shard=1/3"
+              testFolder: "DefaultConfig"
               vmImage: "ubuntu-latest"
-              SA_PASSWORD: $(UMBRACO__CMS__UNATTENDED__UNATTENDEDUSERPASSWORD)
               CONNECTIONSTRINGS__UMBRACODBDSN: "Server=(local);Database=Umbraco;User Id=sa;Password=$(SA_PASSWORD);Encrypt=True;TrustServerCertificate=True"
             LinuxPart2Of3:
               testCommand: "npm run test -- --shard=2/3"
+              testFolder: "DefaultConfig"
               vmImage: "ubuntu-latest"
-              SA_PASSWORD: $(UMBRACO__CMS__UNATTENDED__UNATTENDEDUSERPASSWORD)
               CONNECTIONSTRINGS__UMBRACODBDSN: "Server=(local);Database=Umbraco;User Id=sa;Password=$(SA_PASSWORD);Encrypt=True;TrustServerCertificate=True"
             LinuxPart3Of3:
               testCommand: "npm run test -- --shard=3/3"
+              testFolder: "DefaultConfig"
               vmImage: "ubuntu-latest"
-              SA_PASSWORD: $(UMBRACO__CMS__UNATTENDED__UNATTENDEDUSERPASSWORD)
               CONNECTIONSTRINGS__UMBRACODBDSN: "Server=(local);Database=Umbraco;User Id=sa;Password=$(SA_PASSWORD);Encrypt=True;TrustServerCertificate=True"
             WindowsPart1Of3:
-              vmImage: "windows-latest"
               testCommand: "npm run test -- --shard=1/3"
+              testFolder: "DefaultConfig"
+              vmImage: "windows-latest"
             WindowsPart2Of3:
-              vmImage: "windows-latest"
               testCommand: "npm run test -- --shard=2/3"
-            WindowsPart3Of3:
+              testFolder: "DefaultConfig"
               vmImage: "windows-latest"
+            WindowsPart3Of3:
               testCommand: "npm run test -- --shard=3/3"
+              testFolder: "DefaultConfig"
+              vmImage: "windows-latest"
         pool:
           vmImage: $(vmImage)
         steps:
-          # Setup test environment
-          - task: DownloadPipelineArtifact@2
-            displayName: Download NuGet artifacts
-            inputs:
-              artifact: nupkg
-              path: $(Agent.BuildDirectory)/app/nupkg
-
-          - task: NodeTool@0
-            displayName: Use Node.js $(nodeVersion)
-            inputs:
-              versionSpec: $(nodeVersion)
-
-          - task: UseDotNet@2
-            displayName: Use .NET SDK from global.json
-            inputs:
-              useGlobalJson: true
+          # Setup test environment Template
+          - template: nightly-E2E-setup-template.yml
+            parameters:
+              nodeVersion: ${{ variables.nodeVersion }}
+              PlaywrightUserEmail: ${{ variables.UMBRACO__CMS__UNATTENDED__UNATTENDEDUSEREMAIL }}
+              PlaywrightPassword: ${{ variables.UMBRACO__CMS__UNATTENDED__UNATTENDEDUSERPASSWORD }}
+              ASPNETCORE_URLS: ${{ variables.ASPNETCORE_URLS }}
+              npm_config_cache: ${{ variables.npm_config_cache }}
 
           - pwsh: |
-              "UMBRACO_USER_LOGIN=$(UMBRACO__CMS__UNATTENDED__UNATTENDEDUSEREMAIL)
-              UMBRACO_USER_PASSWORD=$(UMBRACO__CMS__UNATTENDED__UNATTENDEDUSERPASSWORD)
-              URL=$(ASPNETCORE_URLS)
-              STORAGE_STAGE_PATH=$(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/playwright/.auth/user.json
-              CONSOLE_ERRORS_PATH=$(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/console-errors.json" | Out-File .env
-            displayName: Generate .env
-            workingDirectory: $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest
-
-          # Cache and restore NPM packages
-          - task: Cache@2
-            displayName: Cache NPM packages
-            inputs:
-              key: 'npm_e2e | "$(Agent.OS)" | $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/package-lock.json'
-              restoreKeys: |
-                npm_e2e | "$(Agent.OS)"
-                npm_e2e
-              path: $(npm_config_cache)
-
-          - script: npm ci --no-fund --no-audit --prefer-offline
-            workingDirectory: $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest
-            displayName: Restore NPM packages
-
-          # Build application
-          - pwsh: |
-              $cmsVersion = "$(Build.BuildNumber)" -replace "\+",".g"
-              dotnet new nugetconfig
-              dotnet nuget add source ./nupkg --name Local
-              dotnet new install Umbraco.Templates::$cmsVersion
-              dotnet new umbraco --name UmbracoProject --version $cmsVersion --exclude-gitignore --no-restore --no-update-check
               dotnet restore UmbracoProject
               cp $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest.UmbracoProject/*.cs UmbracoProject
-              dotnet build UmbracoProject --configuration $(buildConfiguration) --no-restore
+            displayName: Restore project
+            workingDirectory: $(Agent.BuildDirectory)/app
+
+          - pwsh: |
+              dotnet build UmbracoProject --configuration ${{ variables.buildConfiguration }} --no-restore
               dotnet dev-certs https
             displayName: Build application
             workingDirectory: $(Agent.BuildDirectory)/app
+            condition: succeeded()
 
-          # Start SQL Server
-          - powershell: docker run --name mssql -d -p 1433:1433 -e "ACCEPT_EULA=Y" -e "MSSQL_SA_PASSWORD=$(SA_PASSWORD)" mcr.microsoft.com/mssql/server:2022-latest
-            displayName: Start SQL Server Docker image (Linux)
-            condition: and(succeeded(), eq(variables['Agent.OS'], 'Linux'))
+          # Run application Template
+          - template: nightly-E2E-run-application-template.yml
+            parameters:
+              SA_PASSWORD: ${{ variables.SA_PASSWORD }}
+              buildConfiguration: ${{ variables.buildConfiguration }}
+              DatabaseType: ${{ variables.DatabaseType }}
+              additionalEnvironmentVariables: ${{ variables.additionalEnvironmentVariables }}
 
-          - pwsh: SqlLocalDB start MSSQLLocalDB
-            displayName: Start SQL Server LocalDB (Windows)
-            condition: and(succeeded(), eq(variables['Agent.OS'], 'Windows_NT'))
+          # Run tests Template
+          - template: nightly-E2E-run-tests-template.yml
+            parameters:
+              testCommand: $(testCommand)
+              ASPNETCORE_URLS: ${{ variables.ASPNETCORE_URLS }}
+              DatabaseType: ${{ variables.DatabaseType }}
 
-          # Run application
+  - stage: AdditionalConfigE2E
+    displayName: Additional Config E2E Tests
+    dependsOn: DefaultConfigE2E
+    condition: always()
+    variables:
+      npm_config_cache: $(Pipeline.Workspace)/.npm_e2e
+      ASPNETCORE_URLS: https://localhost:44331
+      PlaywrightPassword: UmbracoAcceptance123!
+      PlaywrightUserEmail: playwright@umbraco.com
+    jobs:
+      - job:
+        displayName: E2E Tests with Different App settings (SQL Server)
+        condition: ${{ or(eq(parameters.differentAppSettingsAcceptanceTests, true), eq(parameters.skipDefaultConfigAcceptanceTests, true)) }}
+        timeoutInMinutes: 180
+        variables:
+          SA_PASSWORD: UmbracoAcceptance123!
+          DatabaseType: SQLServer
+        strategy:
+          matrix:
+            # UnattendedInstallConfig
+            WindowsUnattendedInstallConfig:
+              vmImage: "windows-latest"
+              testFolder: "UnattendedInstallConfig"
+              testCommand: "npx playwright test --project=unattendedInstallConfig --grep=InstallSQLServer"
+              port: 44331
+              additionalEnvironmentVariables: false
+            # DeliveryApiConfig
+            WindowsDeliveryApiConfig:
+              vmImage: "windows-latest"
+              testFolder: "DeliveryApi"
+              port: ''
+              testCommand: "npx playwright test --project=deliveryApi"
+              CONNECTIONSTRINGS__UMBRACODBDSN: Data Source=(localdb)\MSSQLLocalDB;AttachDbFilename=|DataDirectory|\Umbraco.mdf;Integrated Security=True
+              CONNECTIONSTRINGS__UMBRACODBDSN_PROVIDERNAME: Microsoft.Data.SqlClient
+              additionalEnvironmentVariables: false
+            LinuxDeliveryApiConfig:
+              vmImage: "ubuntu-latest"
+              testFolder: "DeliveryApi"
+              port: ''
+              testCommand: "npx playwright test --project=deliveryApi"
+              CONNECTIONSTRINGS__UMBRACODBDSN: Server=(local);Database=Umbraco;User Id=sa;Password=$(SA_PASSWORD);Encrypt=True;TrustServerCertificate=True
+              CONNECTIONSTRINGS__UMBRACODBDSN_PROVIDERNAME: Microsoft.Data.SqlClient
+              additionalEnvironmentVariables: false
+            # ExternalLogin AzureADB2C
+            WindowsExternalLoginAzureADB2C:
+              vmImage: "windows-latest"
+              testFolder: "ExternalLogin\\AzureADB2C"
+              testCommand: "npx playwright test --project=externalLoginAzureADB2C"
+              port: 44331
+              packageName: "Microsoft.AspNetCore.Authentication.OpenIdConnect"
+              packageVersion: "9.0.8"
+              CONNECTIONSTRINGS__UMBRACODBDSN: Data Source=(localdb)\MSSQLLocalDB;AttachDbFilename=|DataDirectory|\Umbraco.mdf;Integrated Security=True
+              CONNECTIONSTRINGS__UMBRACODBDSN_PROVIDERNAME: Microsoft.Data.SqlClient
+              additionalEnvironmentVariables: true
+            # ExtensionRegistry
+            WindowsExtensionRegistry:
+              vmImage: "windows-latest"
+              testFolder: "ExtensionRegistry"
+              port: ''
+              testCommand: "npx playwright test --project=extensionRegistry"
+              CONNECTIONSTRINGS__UMBRACODBDSN: Data Source=(localdb)\MSSQLLocalDB;AttachDbFilename=|DataDirectory|\Umbraco.mdf;Integrated Security=True
+              CONNECTIONSTRINGS__UMBRACODBDSN_PROVIDERNAME: Microsoft.Data.SqlClient
+              additionalEnvironmentVariables: false
+            LinuxExtensionRegistry:
+              vmImage: "ubuntu-latest"
+              testFolder: "ExtensionRegistry"
+              port: ''
+              testCommand: "npx playwright test --project=extensionRegistry"
+              CONNECTIONSTRINGS__UMBRACODBDSN: Server=(local);Database=Umbraco;User Id=sa;Password=$(SA_PASSWORD);Encrypt=True;TrustServerCertificate=True
+              CONNECTIONSTRINGS__UMBRACODBDSN_PROVIDERNAME: Microsoft.Data.SqlClient
+              additionalEnvironmentVariables: false
+        pool:
+          vmImage: $(vmImage)
+        steps:
+          # Setup test environment Template
+          - template: nightly-E2E-setup-template.yml
+            parameters:
+              nodeVersion: ${{ variables.nodeVersion }}
+              PlaywrightUserEmail: ${{ variables.PlaywrightUserEmail }}
+              PlaywrightPassword: ${{ variables.PlaywrightPassword }}
+              ASPNETCORE_URLS: ${{ variables.ASPNETCORE_URLS }}
+              npm_config_cache: ${{ variables.npm_config_cache }}
+
+          # Install NuGet package if specified in the matrix
+          - pwsh: |
+              Write-Host "Installing package $(packageName) version $(packageVersion)"
+              dotnet add package $(packageName) --version $(packageVersion)
+            displayName: "Install NuGet package: $(packageName)"
+            workingDirectory: $(Agent.BuildDirectory)/app/UmbracoProject
+            condition: and(succeeded(), ne(variables['packageName'], ''), ne(variables['packageVersion'], ''))
+
+          # Build application Template
+          - template: nightly-E2E-build-template.yml
+            parameters:
+              testFolder: $(testFolder)
+              buildConfiguration: ${{ variables.buildConfiguration }}
+              additionalEnvironmentVariables: $(additionalEnvironmentVariables)
+
+          # Build application for AzureADB2C
+          - pwsh: |
+              dotnet build UmbracoProject --configuration ${{ variables.buildConfiguration }} --no-restore
+              dotnet dev-certs https
+            displayName: Build application for AzureADB2C
+            workingDirectory: $(Agent.BuildDirectory)/app
+            env:
+              AZUREADB2CDOMAIN: $(AZUREB2CDOMAIN)
+              AZUREADB2CTENANT: $(AZUREB2CTENANT)
+              AZUREADB2CPOLICY: $(AZUREB2CPOLICY)
+              AZUREADB2CCLIENTID: $(AZUREB2CCLIENTID)
+              AZUREADB2CCLIENTSECRET: $(AZUREB2CCLIENTSECRET)
+            condition: and(succeeded(), eq(variables['testFolder'], 'ExternalLogin\AzureADB2C'))
+
+          # Run application Template
+          - template: nightly-E2E-run-application-template.yml
+            parameters:
+              SA_PASSWORD: ${{ variables.SA_PASSWORD }}
+              additionalEnvironmentVariables: $(additionalEnvironmentVariables)
+              buildConfiguration: ${{ variables.buildConfiguration }}
+              DatabaseType: ${{ variables.DatabaseType }}
+
+          # Run application for Linux with additional Environment Variables for Azure AD
           - bash: |
-              nohup dotnet run --project UmbracoProject --configuration $(buildConfiguration) --no-build --no-launch-profile > $(Build.ArtifactStagingDirectory)/playwright.log 2>&1 &
+              nohup dotnet run --project UmbracoProject --configuration ${{ variables.buildConfiguration }} --no-build --no-launch-profile > $(Build.ArtifactStagingDirectory)/playwright.log 2>&1 &
               echo "##vso[task.setvariable variable=AcceptanceTestProcessId]$!"
             displayName: Run application (Linux)
-            condition: and(succeeded(), eq(variables['Agent.OS'], 'Linux'))
+            condition: and(succeeded(), eq(variables['Agent.OS'], 'Linux'), eq(variables['testFolder'], 'ExternalLogin\AzureADB2C'))
             workingDirectory: $(Agent.BuildDirectory)/app
+            env:
+              AZUREADB2CDOMAIN: $(AZUREB2CDOMAIN)
+              AZUREADB2CTENANT: $(AZUREB2CTENANT)
+              AZUREADB2CPOLICY: $(AZUREB2CPOLICY)
+              AZUREADB2CCLIENTID: $(AZUREB2CCLIENTID)
+              AZUREADB2CCLIENTSECRET: $(AZUREB2CCLIENTSECRET)
 
+          # Run application for Windows with additional Environment Variables for Azure AD
           - pwsh: |
-              $process = Start-Process dotnet "run --project UmbracoProject --configuration $(buildConfiguration) --no-build --no-launch-profile 2>&1" -PassThru -NoNewWindow -RedirectStandardOutput $(Build.ArtifactStagingDirectory)/playwright.log
+              $process = Start-Process dotnet "run --project UmbracoProject --configuration ${{ variables.buildConfiguration }} --no-build --no-launch-profile 2>&1" -PassThru -NoNewWindow -RedirectStandardOutput $(Build.ArtifactStagingDirectory)/playwright.log
               Write-Host "##vso[task.setvariable variable=AcceptanceTestProcessId]$($process.Id)"
             displayName: Run application (Windows)
-            condition: and(succeeded(), eq(variables['Agent.OS'], 'Windows_NT'))
+            condition: and(succeeded(), eq(variables['Agent.OS'], 'Windows_NT'), eq(variables['testFolder'], 'ExternalLogin\AzureADB2C'))
             workingDirectory: $(Agent.BuildDirectory)/app
-
-          # Ensures we have the package wait-on installed
-          - pwsh: npm install wait-on
-            displayName: Install wait-on package
-
-          # Wait for application to start responding to requests
-          - pwsh: npx wait-on -v --interval 1000 --timeout 120000 $(ASPNETCORE_URLS)
-            displayName: Wait for application
-            workingDirectory: tests/Umbraco.Tests.AcceptanceTest
-
-          # Install Playwright and dependencies
-          - pwsh: npx playwright install chromium
-            displayName: Install Playwright only with Chromium browser
-            workingDirectory: tests/Umbraco.Tests.AcceptanceTest
-
-          # Test
-          - pwsh: $(testCommand)
-            displayName: Run Playwright tests
-            continueOnError: true
-            workingDirectory: tests/Umbraco.Tests.AcceptanceTest
             env:
-              CI: true
-              CommitId: $(Build.SourceVersion)
-              AgentOs: $(Agent.OS)
+              AZUREADB2CDOMAIN: $(AZUREB2CDOMAIN)
+              AZUREADB2CTENANT: $(AZUREB2CTENANT)
+              AZUREADB2CPOLICY: $(AZUREB2CPOLICY)
+              AZUREADB2CCLIENTID: $(AZUREB2CCLIENTID)
+              AZUREADB2CCLIENTSECRET: $(AZUREB2CCLIENTSECRET)
 
-          # Stop application
-          - bash: kill -15 $(AcceptanceTestProcessId)
-            displayName: Stop application (Linux)
-            condition: and(succeeded(), ne(variables.AcceptanceTestProcessId, ''), eq(variables['Agent.OS'], 'Linux'))
-
-          - pwsh: Stop-Process -Id $(AcceptanceTestProcessId)
-            displayName: Stop application (Windows)
-            condition: and(succeeded(), ne(variables.AcceptanceTestProcessId, ''), eq(variables['Agent.OS'], 'Windows_NT'))
-
-          # Stop SQL Server
-          - pwsh: docker stop mssql
-            displayName: Stop SQL Server Docker image (Linux)
-            condition: and(succeeded(), eq(variables['Agent.OS'], 'Linux'))
-
-          - pwsh: SqlLocalDB stop MSSQLLocalDB
-            displayName: Stop SQL Server LocalDB (Windows)
-            condition: and(succeeded(), eq(variables['Agent.OS'], 'Windows_NT'))
-
-          # Copy artifacts
-          - pwsh: |
-              if (Test-Path tests/Umbraco.Tests.AcceptanceTest/results/*) {
-                Copy-Item tests/Umbraco.Tests.AcceptanceTest/results/* $(Build.ArtifactStagingDirectory) -Recurse
-              }
-            displayName: Copy Playwright results
-            condition: succeededOrFailed()
-
-          # Copy console error log
-          - pwsh: |
-              if (Test-Path tests/Umbraco.Tests.AcceptanceTest/console-errors.json) {
-                  Copy-Item tests/Umbraco.Tests.AcceptanceTest/console-errors.json $(Build.ArtifactStagingDirectory)
-              }
-            displayName: Copy console error log
-            condition: succeededOrFailed()
-
-          # Publish
-          - task: PublishPipelineArtifact@1
-            displayName: Publish test artifacts
-            condition: succeededOrFailed()
-            inputs:
-              targetPath: $(Build.ArtifactStagingDirectory)
-              artifact: "Acceptance Test Results - $(Agent.JobName) - Attempt #$(System.JobAttempt)"
-
-          # Publish test results
-          - task: PublishTestResults@2
-            displayName: "Publish test results"
-            condition: succeededOrFailed()
-            inputs:
-              testResultsFormat: 'JUnit'
-              testResultsFiles: '*.xml'
-              searchFolder: "tests/Umbraco.Tests.AcceptanceTest/results"
-              testRunTitle: "$(Agent.JobName)"
+          # Run tests Template
+          - template: nightly-E2E-run-tests-template.yml
+            parameters:
+              testCommand: $(testCommand)
+              ASPNETCORE_URLS: ${{ variables.ASPNETCORE_URLS }}
+              port: $(port)
+              AZUREB2CTESTUSEREMAIL: $(AZUREB2CTESTUSEREMAIL)
+              AZUREB2CTESTUSERPASSWORD: $(AZUREB2CTESTUSERPASSWORD)
+              DatabaseType: ${{ variables.DatabaseType }}
 
   - stage: NotifySlackBot
     displayName: Notify Slack on Failure
-    dependsOn: E2E
+    dependsOn: DefaultConfigE2E
     # This stage will only run if the E2E tests fail or succeed with issues
-    condition: or(
-      eq(dependencies.E2E.result, 'failed'),
-      eq(dependencies.E2E.result, 'succeededWithIssues'))
+    condition: or(eq(dependencies.DefaultConfigE2E.result, 'failed'), eq(dependencies.DefaultConfigE2E.result, 'succeededWithIssues'))
     jobs:
       - job: PostToSlack
         displayName: Send Slack Notification

build/nightly-build-trigger.yml

@@ -8,8 +8,8 @@ schedules:
   displayName: Daily midnight build
   branches:
     include:
-    - v10/dev
     - v13/dev
+    - v17/dev
     - main
 
 steps:

build/templates/dependency-track.yml

@@ -0,0 +1,56 @@
+parameters:
+  - name: projectName
+    type: string
+  - name: umbracoVersion
+    type: string
+  - name: projects
+    type: object
+
+jobs:
+- job: Create_DT_Project
+  displayName: Create Dependency Track Project
+  steps:
+    - checkout: none
+
+    - bash: |
+        project_id=$(curl --no-progress-meter -H "X-Api-Key: $(DT_API_KEY)" "$(DT_API_URL)/v1/project/lookup?name=${{ parameters.projectName }}&version=${{ parameters.umbracoVersion }}" | jq -r '.uuid')
+        if [ "$project_id" != "null" ] && [ -n "$project_id" ]; then
+          echo "Project '${{ parameters.projectName }}' with version '${{ parameters.umbracoVersion }}' already exists (ID: $project_id)."
+        else
+          project_id=$(curl --no-progress-meter \
+            -X PUT "$(DT_API_URL)/v1/project" \
+            -H "X-Api-Key: $(DT_API_KEY)" \
+            -H "Content-Type: application/json" \
+            -d '{"name": "${{ parameters.projectName }}", "version": "${{ parameters.umbracoVersion }}", "collectionLogic": "AGGREGATE_DIRECT_CHILDREN"}' \
+            | jq -r '.uuid')
+          if [ -z "$project_id" ] || [ "$project_id" == "null" ]; then
+            echo "Failed to create project '${{ parameters.projectName }}' version '${{ parameters.umbracoVersion }}'."
+            exit 1
+          fi
+          echo "Created project '${{ parameters.projectName }}' with version '${{ parameters.umbracoVersion }}' (ID: $project_id)."
+        fi
+      displayName: Ensure main project exists in Dependency Track
+
+- ${{ each project in parameters.projects }}:
+  - job:
+    displayName: Upload ${{ project.name }} BOM
+    dependsOn: Create_DT_Project
+    steps:
+      - checkout: none
+
+      - download: current
+        artifact: ${{ project.artifact }}
+        displayName: Download ${{ project.artifact }} artifact
+
+      - script: |
+          curl --no-progress-meter --fail-with-body \
+            -X POST "$(DT_API_URL)/v1/bom" \
+            -H "X-Api-Key: $(DT_API_KEY)" \
+            -H "Content-Type: multipart/form-data" \
+            -F "autoCreate=true" \
+            -F "projectName=${{ parameters.projectName }}-${{ project.name }}" \
+            -F "projectVersion=${{ parameters.umbracoVersion }}" \
+            -F "parentName=${{ parameters.projectName }}" \
+            -F "parentVersion=${{ parameters.umbracoVersion }}" \
+            -F "bom=@$(Pipeline.Workspace)/${{ project.artifact }}/${{ project.bomFilePath }}"
+        displayName: Upload ${{ project.name }} BOM to Dependency Track

build/templates/e2e-install.yml

@@ -0,0 +1,49 @@
+parameters:
+  - name: nodeVersion
+    type: string
+    default: ''
+
+  - name: npm_config_cache
+    type: string
+    default: ''
+
+  - name: PlaywrightUserEmail
+    type: string
+    default: ''
+
+  - name: PlaywrightPassword
+    type: string
+    default: ''
+
+  - name: ASPNETCORE_URLS
+    type: string
+    default: ''
+
+steps:
+  - task: NodeTool@0
+    displayName: Use Node.js $(nodeVersion)
+    inputs:
+      versionSpec: $(nodeVersion)
+
+  - pwsh: |
+      "UMBRACO_USER_LOGIN=${{ parameters.PlaywrightUserEmail }}
+      UMBRACO_USER_PASSWORD=${{ parameters.PlaywrightPassword }}
+      URL=${{ parameters.ASPNETCORE_URLS }}
+      STORAGE_STAGE_PATH=$(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/playwright/.auth/user.json
+      CONSOLE_ERRORS_PATH=$(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/console-errors.json" | Out-File .env
+    displayName: Generate .env
+    workingDirectory: $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest
+
+  # Cache and restore NPM packages
+  - task: Cache@2
+    displayName: Cache NPM packages
+    inputs:
+      key: 'npm_e2e | "$(Agent.OS)" | $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest/package-lock.json'
+      restoreKeys: |
+        npm_e2e | "$(Agent.OS)"
+        npm_e2e
+      path: ${{ parameters.npm_config_cache }}
+
+  - script: npm ci --no-fund --no-audit --prefer-offline
+    workingDirectory: $(Build.SourcesDirectory)/tests/Umbraco.Tests.AcceptanceTest
+    displayName: Restore NPM packages

global.json

@@ -1,6 +1,6 @@
 {
   "sdk": {
-    "version": "9.0.100",
+    "version": "9.0.306",
     "rollForward": "latestFeature",
     "allowPrerelease": false
   }

src/Umbraco.Cms.Api.Common/Accessors/RequestContextOutputExpansionStrategyAccessor.cs

@@ -0,0 +1,12 @@
+using Microsoft.AspNetCore.Http;
+using Umbraco.Cms.Core.DeliveryApi;
+
+namespace Umbraco.Cms.Api.Common.Accessors;
+
+public sealed class RequestContextOutputExpansionStrategyAccessor : RequestContextServiceAccessorBase<IOutputExpansionStrategy>, IOutputExpansionStrategyAccessor
+{
+    public RequestContextOutputExpansionStrategyAccessor(IHttpContextAccessor httpContextAccessor)
+        : base(httpContextAccessor)
+    {
+    }
+}

src/Umbraco.Cms.Api.Common/Accessors/RequestContextServiceAccessorBase.cs

@@ -0,0 +1,20 @@
+using System.Diagnostics.CodeAnalysis;
+using Microsoft.AspNetCore.Http;
+using Microsoft.Extensions.DependencyInjection;
+
+namespace Umbraco.Cms.Api.Common.Accessors;
+
+public abstract class RequestContextServiceAccessorBase<T>
+    where T : class
+{
+    private readonly IHttpContextAccessor _httpContextAccessor;
+
+    protected RequestContextServiceAccessorBase(IHttpContextAccessor httpContextAccessor)
+        => _httpContextAccessor = httpContextAccessor;
+
+    public bool TryGetValue([NotNullWhen(true)] out T? requestStartNodeService)
+    {
+        requestStartNodeService = _httpContextAccessor.HttpContext?.RequestServices.GetService<T>();
+        return requestStartNodeService is not null;
+    }
+}

src/Umbraco.Cms.Api.Common/Configuration/ConfigureUmbracoSwaggerGenOptions.cs

@@ -42,7 +42,7 @@ public class ConfigureUmbracoSwaggerGenOptions : IConfigureOptions<SwaggerGenOpt
         swaggerGenOptions.DocInclusionPredicate((name, api) =>
         {
             if (api.ActionDescriptor is ControllerActionDescriptor controllerActionDescriptor
-                && controllerActionDescriptor.MethodInfo.HasMapToApiAttribute(name))
+                && controllerActionDescriptor.HasMapToApiAttribute(name))
             {
                 return true;
             }

src/Umbraco.Cms.Api.Common/DependencyInjection/HideBackOfficeTokensHandler.cs

@@ -0,0 +1,230 @@
+using System.Diagnostics.CodeAnalysis;
+using Microsoft.AspNetCore.DataProtection;
+using Microsoft.AspNetCore.Http;
+using Microsoft.Extensions.Options;
+using OpenIddict.Server;
+using OpenIddict.Validation;
+using Umbraco.Cms.Core;
+using Umbraco.Cms.Core.Configuration.Models;
+using Umbraco.Cms.Core.Events;
+using Umbraco.Cms.Core.Notifications;
+using Umbraco.Cms.Web.Common.Security;
+using Umbraco.Extensions;
+
+namespace Umbraco.Cms.Api.Common.DependencyInjection;
+
+internal sealed class HideBackOfficeTokensHandler
+    : IOpenIddictServerHandler<OpenIddictServerEvents.ApplyTokenResponseContext>,
+        IOpenIddictServerHandler<OpenIddictServerEvents.ApplyAuthorizationResponseContext>,
+        IOpenIddictServerHandler<OpenIddictServerEvents.ExtractTokenRequestContext>,
+        IOpenIddictValidationHandler<OpenIddictValidationEvents.ProcessAuthenticationContext>,
+        INotificationHandler<UserLogoutSuccessNotification>
+{
+    private const string RedactedTokenValue = "[redacted]";
+    private const string AccessTokenCookieKey = "__Host-umbAccessToken";
+    private const string RefreshTokenCookieKey = "__Host-umbRefreshToken";
+    private const string PkceCodeCookieKey = "__Host-umbPkceCode";
+
+    private readonly IHttpContextAccessor _httpContextAccessor;
+    private readonly IDataProtectionProvider _dataProtectionProvider;
+    private readonly BackOfficeTokenCookieSettings _backOfficeTokenCookieSettings;
+    private readonly GlobalSettings _globalSettings;
+
+    public HideBackOfficeTokensHandler(
+        IHttpContextAccessor httpContextAccessor,
+        IDataProtectionProvider dataProtectionProvider,
+        IOptions<BackOfficeTokenCookieSettings> backOfficeTokenCookieSettings,
+        IOptions<GlobalSettings> globalSettings)
+    {
+        _httpContextAccessor = httpContextAccessor;
+        _dataProtectionProvider = dataProtectionProvider;
+        _backOfficeTokenCookieSettings = backOfficeTokenCookieSettings.Value;
+        _globalSettings = globalSettings.Value;
+    }
+
+    /// <summary>
+    /// This is invoked when tokens (access and refresh tokens) are issued to a client. For the back-office client,
+    /// we will intercept the response, write the tokens from the response into HTTP-only cookies, and redact the
+    /// tokens from the response, so they are not exposed to the client.
+    /// </summary>
+    public ValueTask HandleAsync(OpenIddictServerEvents.ApplyTokenResponseContext context)
+    {
+        if (context.Request?.ClientId is not Constants.OAuthClientIds.BackOffice)
+        {
+            // Only ever handle the back-office client.
+            return ValueTask.CompletedTask;
+        }
+
+        HttpContext httpContext = GetHttpContext();
+
+        if (context.Response.AccessToken is not null)
+        {
+            SetCookie(httpContext, AccessTokenCookieKey, context.Response.AccessToken);
+            context.Response.AccessToken = RedactedTokenValue;
+        }
+
+        if (context.Response.RefreshToken is not null)
+        {
+            SetCookie(httpContext, RefreshTokenCookieKey, context.Response.RefreshToken);
+            context.Response.RefreshToken = RedactedTokenValue;
+        }
+
+        return ValueTask.CompletedTask;
+    }
+
+    /// <summary>
+    /// This is invoked when a PKCE code is issued to the client. For the back-office client, we will intercept the
+    /// response, write the PKCE code from the response into a HTTP-only cookie, and redact the code from the response,
+    /// so it's not exposed to the client.
+    /// </summary>
+    public ValueTask HandleAsync(OpenIddictServerEvents.ApplyAuthorizationResponseContext context)
+    {
+        if (context.Request?.ClientId is not Constants.OAuthClientIds.BackOffice)
+        {
+            // Only ever handle the back-office client.
+            return ValueTask.CompletedTask;
+        }
+
+        if (context.Response.Code is not null)
+        {
+            SetCookie(GetHttpContext(), PkceCodeCookieKey, context.Response.Code);
+            context.Response.Code = RedactedTokenValue;
+        }
+
+        return ValueTask.CompletedTask;
+    }
+
+    /// <summary>
+    /// This is invoked when requesting new tokens.
+    /// </summary>
+    public ValueTask HandleAsync(OpenIddictServerEvents.ExtractTokenRequestContext context)
+    {
+        if (context.Request?.ClientId != Constants.OAuthClientIds.BackOffice)
+        {
+            // Only ever handle the back-office client.
+            return ValueTask.CompletedTask;
+        }
+
+        // Handle when the PKCE code is being exchanged for an access token.
+        if (context.Request.Code == RedactedTokenValue
+            && TryGetCookie(PkceCodeCookieKey, out var code))
+        {
+            context.Request.Code = code;
+
+            // We won't need the PKCE cookie after this, let's remove it.
+            RemoveCookie(GetHttpContext(), PkceCodeCookieKey);
+        }
+        else
+        {
+            // PCKE codes should always be redacted. If we got here, someone might be trying to pass another PKCE
+            // code. For security reasons, explicitly discard the code (if any) to be on the safe side.
+            context.Request.Code = null;
+        }
+
+        // Handle when a refresh token is being exchanged for a new access token.
+        if (context.Request.RefreshToken == RedactedTokenValue
+            && TryGetCookie(RefreshTokenCookieKey, out var refreshToken))
+        {
+            context.Request.RefreshToken = refreshToken;
+        }
+        else
+        {
+            // If we got here, either the refresh token was not redacted, or nothing was found in the refresh token cookie.
+            // If OpenIddict found a refresh token, it could be an old token that is potentially still valid. For security
+            // reasons, we cannot accept that; at this point, we expect the refresh tokens to be explicitly redacted.
+            context.Request.RefreshToken = null;
+        }
+
+        return ValueTask.CompletedTask;
+    }
+
+    /// <summary>
+    /// This is invoked when extracting the auth context for a client request.
+    /// </summary>
+    public ValueTask HandleAsync(OpenIddictValidationEvents.ProcessAuthenticationContext context)
+    {
+        // For the back-office client, this only happens when an access token is sent to the API.
+        if (context.AccessToken != RedactedTokenValue)
+        {
+            return ValueTask.CompletedTask;
+        }
+
+        if (TryGetCookie(AccessTokenCookieKey, out var accessToken))
+        {
+            context.AccessToken = accessToken;
+        }
+
+        return ValueTask.CompletedTask;
+    }
+
+    public void Handle(UserLogoutSuccessNotification notification)
+    {
+        HttpContext? context = _httpContextAccessor.HttpContext;
+        if (context is null)
+        {
+            // For some reason there is no ambient HTTP context, so we can't clean up the cookies.
+            // This is OK, because the tokens in the cookies have already been revoked at user sign-out,
+            // so the cookie clean-up is mostly cosmetic.
+            return;
+        }
+
+        context.Response.Cookies.Delete(AccessTokenCookieKey);
+        context.Response.Cookies.Delete(RefreshTokenCookieKey);
+    }
+
+    private HttpContext GetHttpContext()
+        => _httpContextAccessor.GetRequiredHttpContext();
+
+    private void SetCookie(HttpContext httpContext, string key, string value)
+    {
+        var cookieValue = EncryptionHelper.Encrypt(value, _dataProtectionProvider);
+
+        RemoveCookie(httpContext, key);
+        httpContext.Response.Cookies.Append(key, cookieValue, GetCookieOptions(httpContext));
+    }
+
+    private void RemoveCookie(HttpContext httpContext, string key)
+        => httpContext.Response.Cookies.Delete(key, GetCookieOptions(httpContext));
+
+    private CookieOptions GetCookieOptions(HttpContext httpContext) =>
+        new()
+        {
+            // Prevent the client-side scripts from accessing the cookie.
+            HttpOnly = true,
+
+            // Mark the cookie as essential to the application, to enforce it despite any
+            // data collection consent options. This aligns with how ASP.NET Core Identity
+            // does when writing cookies for cookie authentication.
+            IsEssential = true,
+
+            // Cookie path must be root for optimal security.
+            Path = "/",
+
+            // For optimal security, the cooke must be secure. However, Umbraco allows for running development
+            // environments over HTTP, so we need to take that into account here.
+            // Thus, we will make the cookie secure if:
+            // - HTTPS is explicitly enabled by config (default for production environments), or
+            // - The current request is over HTTPS (meaning the environment supports it regardless of config).
+            Secure = _globalSettings.UseHttps || httpContext.Request.IsHttps,
+
+            // SameSite is configurable (see BackOfficeTokenCookieSettings for defaults):
+            SameSite = ParseSameSiteMode(_backOfficeTokenCookieSettings.SameSite),
+        };
+
+    private bool TryGetCookie(string key, [NotNullWhen(true)] out string? value)
+    {
+        if (GetHttpContext().Request.Cookies.TryGetValue(key, out var cookieValue))
+        {
+            value = EncryptionHelper.Decrypt(cookieValue, _dataProtectionProvider);
+            return true;
+        }
+
+        value = null;
+        return false;
+    }
+
+    private static SameSiteMode ParseSameSiteMode(string sameSiteMode) =>
+        Enum.TryParse(sameSiteMode, ignoreCase: true, out SameSiteMode result)
+            ? result
+            : throw new ArgumentException($"The provided {nameof(sameSiteMode)} value could not be parsed into as SameSiteMode value.", nameof(sameSiteMode));
+}

src/Umbraco.Cms.Api.Common/DependencyInjection/UmbracoBuilderAuthExtensions.cs

@@ -9,6 +9,7 @@ using Umbraco.Cms.Api.Common.Security;
 using Umbraco.Cms.Core;
 using Umbraco.Cms.Core.Configuration.Models;
 using Umbraco.Cms.Core.DependencyInjection;
+using Umbraco.Cms.Core.Notifications;
 using Umbraco.Cms.Infrastructure.BackgroundJobs.Jobs;
 using Umbraco.Extensions;
 
@@ -28,6 +29,11 @@ public static class UmbracoBuilderAuthExtensions
 
     private static void ConfigureOpenIddict(IUmbracoBuilder builder)
     {
+        // Optionally hide tokens from the back-office.
+        var hideBackOfficeTokens = (builder.Config
+            .GetSection(Constants.Configuration.ConfigBackOfficeTokenCookie)
+            .Get<BackOfficeTokenCookieSettings>() ?? new BackOfficeTokenCookieSettings()).Enabled;
+
         builder.Services.AddOpenIddict()
             // Register the OpenIddict server components.
             .AddServer(options =>
@@ -113,6 +119,28 @@ public static class UmbracoBuilderAuthExtensions
                 {
                     configuration.UseSingletonHandler<ProcessRequestContextHandler>().SetOrder(OpenIddict.Server.AspNetCore.OpenIddictServerAspNetCoreHandlers.ResolveRequestUri.Descriptor.Order - 1);
                 });
+
+                if (hideBackOfficeTokens)
+                {
+                    options.AddEventHandler<OpenIddictServerEvents.ApplyTokenResponseContext>(configuration =>
+                    {
+                        configuration
+                            .UseSingletonHandler<HideBackOfficeTokensHandler>()
+                            .SetOrder(OpenIddict.Server.AspNetCore.OpenIddictServerAspNetCoreHandlers.ProcessJsonResponse<OpenIddictServerEvents.ApplyTokenResponseContext>.Descriptor.Order - 1);
+                    });
+                    options.AddEventHandler<OpenIddictServerEvents.ApplyAuthorizationResponseContext>(configuration =>
+                    {
+                        configuration
+                            .UseSingletonHandler<HideBackOfficeTokensHandler>()
+                            .SetOrder(OpenIddict.Server.AspNetCore.OpenIddictServerAspNetCoreHandlers.Authentication.ProcessQueryResponse.Descriptor.Order - 1);
+                    });
+                    options.AddEventHandler<OpenIddictServerEvents.ExtractTokenRequestContext>(configuration =>
+                    {
+                        configuration
+                            .UseSingletonHandler<HideBackOfficeTokensHandler>()
+                            .SetOrder(OpenIddict.Server.AspNetCore.OpenIddictServerAspNetCoreHandlers.ExtractPostRequest<OpenIddictServerEvents.ExtractTokenRequestContext>.Descriptor.Order + 1);
+                    });
+                }
             })
 
             // Register the OpenIddict validation components.
@@ -137,9 +165,25 @@ public static class UmbracoBuilderAuthExtensions
                 {
                     configuration.UseSingletonHandler<ProcessRequestContextHandler>().SetOrder(OpenIddict.Validation.AspNetCore.OpenIddictValidationAspNetCoreHandlers.ResolveRequestUri.Descriptor.Order - 1);
                 });
+
+                if (hideBackOfficeTokens)
+                {
+                    options.AddEventHandler<OpenIddictValidationEvents.ProcessAuthenticationContext>(configuration =>
+                    {
+                        configuration
+                            .UseSingletonHandler<HideBackOfficeTokensHandler>()
+                            // IMPORTANT: the handler must be AFTER the built-in query string handler, because the client-side SignalR library sometimes appends access tokens to the query string.
+                            .SetOrder(OpenIddict.Validation.AspNetCore.OpenIddictValidationAspNetCoreHandlers.ExtractAccessTokenFromQueryString.Descriptor.Order + 1);
+                    });
+                }
             });
 
         builder.Services.AddRecurringBackgroundJob<OpenIddictCleanupJob>();
         builder.Services.ConfigureOptions<ConfigureOpenIddict>();
+
+        if (hideBackOfficeTokens)
+        {
+            builder.AddNotificationHandler<UserLogoutSuccessNotification, HideBackOfficeTokensHandler>();
+        }
     }
 }

src/Umbraco.Cms.Api.Common/Extensions/ActionDescriptorApiCommonExtensions.cs

@@ -0,0 +1,36 @@
+using Microsoft.AspNetCore.Mvc.Abstractions;
+using Umbraco.Cms.Api.Common.Attributes;
+using Umbraco.Cms.Api.Common.Configuration;
+
+namespace Umbraco.Extensions;
+
+/// <summary>
+/// Provides extension methods for <see cref="ActionDescriptor"/> to work with <see cref="MapToApiAttribute"/>.
+/// </summary>
+public static class ActionDescriptorApiCommonExtensions
+{
+    /// <summary>
+    /// Determines whether the <see cref="ActionDescriptor"/> has a <see cref="MapToApiAttribute"/> with the specified API name.
+    /// The check is made in runtime to support attributes added in runtime.
+    /// </summary>
+    /// <param name="actionDescriptor">The action descriptor to inspect.</param>
+    /// <param name="apiName">The API name to check for.</param>
+    /// <returns>
+    /// <c>true</c> if the <see cref="MapToApiAttribute"/> is present and matches the specified API name,
+    /// or if the attribute is not present and the API name matches the default API name; otherwise, <c>false</c>.
+    /// </returns>
+    public static bool HasMapToApiAttribute(this ActionDescriptor actionDescriptor, string apiName)
+    {
+        var value = actionDescriptor.GetMapToApiAttributeValue();
+
+        return value == apiName
+               || (value is null && apiName == DefaultApiConfiguration.ApiName);
+    }
+
+    private static string? GetMapToApiAttributeValue(this ActionDescriptor actionDescriptor)
+    {
+        IEnumerable<MapToApiAttribute> mapToApiAttributes = actionDescriptor?.EndpointMetadata?.OfType<MapToApiAttribute>() ?? [];
+
+        return mapToApiAttributes.SingleOrDefault()?.ApiName;
+    }
+}

src/Umbraco.Cms.Api.Common/Rendering/ElementOnlyOutputExpansionStrategy.cs

@@ -0,0 +1,148 @@
+using Umbraco.Cms.Core.DeliveryApi;
+using Umbraco.Cms.Core.Models.PublishedContent;
+using Umbraco.Extensions;
+
+namespace Umbraco.Cms.Api.Common.Rendering;
+
+public class ElementOnlyOutputExpansionStrategy : IOutputExpansionStrategy
+{
+    protected const string All = "$all";
+    protected const string None = "";
+    protected const string ExpandParameterName = "expand";
+    protected const string FieldsParameterName = "fields";
+
+    private readonly IApiPropertyRenderer _propertyRenderer;
+
+    protected Stack<Node?> ExpandProperties { get; } = new();
+
+    protected Stack<Node?> IncludeProperties { get; } = new();
+
+    public ElementOnlyOutputExpansionStrategy(
+        IApiPropertyRenderer propertyRenderer)
+    {
+        _propertyRenderer = propertyRenderer;
+    }
+
+    public virtual IDictionary<string, object?> MapContentProperties(IPublishedContent content)
+        => content.ItemType == PublishedItemType.Content
+            ? MapProperties(content.Properties)
+            : throw new ArgumentException($"Invalid item type. This method can only be used with item type {nameof(PublishedItemType.Content)}, got: {content.ItemType}");
+
+    public virtual IDictionary<string, object?> MapMediaProperties(IPublishedContent media, bool skipUmbracoProperties = true)
+    {
+        if (media.ItemType != PublishedItemType.Media)
+        {
+            throw new ArgumentException($"Invalid item type. This method can only be used with item type {PublishedItemType.Media}, got: {media.ItemType}");
+        }
+
+        IPublishedProperty[] properties = media
+            .Properties
+            .Where(p => skipUmbracoProperties is false || p.Alias.StartsWith("umbraco") is false)
+            .ToArray();
+
+        return properties.Any()
+            ? MapProperties(properties)
+            : new Dictionary<string, object?>();
+    }
+
+    public virtual IDictionary<string, object?> MapElementProperties(IPublishedElement element)
+        => MapProperties(element.Properties, true);
+
+    private IDictionary<string, object?> MapProperties(IEnumerable<IPublishedProperty> properties, bool forceExpandProperties = false)
+    {
+        Node? currentExpandProperties = ExpandProperties.Count > 0 ? ExpandProperties.Peek() : null;
+        if (ExpandProperties.Count > 1 && currentExpandProperties is null && forceExpandProperties is false)
+        {
+            return new Dictionary<string, object?>();
+        }
+
+        Node? currentIncludeProperties = IncludeProperties.Count > 0 ? IncludeProperties.Peek() : null;
+        var result = new Dictionary<string, object?>();
+        foreach (IPublishedProperty property in properties)
+        {
+            Node? nextIncludeProperties = GetNextProperties(currentIncludeProperties, property.Alias);
+            if (currentIncludeProperties is not null && currentIncludeProperties.Items.Any() && nextIncludeProperties is null)
+            {
+                continue;
+            }
+
+            Node? nextExpandProperties = GetNextProperties(currentExpandProperties, property.Alias);
+
+            IncludeProperties.Push(nextIncludeProperties);
+            ExpandProperties.Push(nextExpandProperties);
+
+            result[property.Alias] = GetPropertyValue(property);
+
+            ExpandProperties.Pop();
+            IncludeProperties.Pop();
+        }
+
+        return result;
+    }
+
+    private Node? GetNextProperties(Node? currentProperties, string propertyAlias)
+        => currentProperties?.Items.FirstOrDefault(i => i.Key == All)
+           ?? currentProperties?.Items.FirstOrDefault(i => i.Key == "properties")?.Items.FirstOrDefault(i => i.Key == All || i.Key == propertyAlias);
+
+    private object? GetPropertyValue(IPublishedProperty property)
+        => _propertyRenderer.GetPropertyValue(property, ExpandProperties.Peek() is not null);
+
+    protected sealed class Node
+    {
+        public string Key { get; private set; } = string.Empty;
+
+        public List<Node> Items { get; } = new();
+
+        public static Node Parse(string value)
+        {
+            // verify that there are as many start brackets as there are end brackets
+            if (value.CountOccurrences("[") != value.CountOccurrences("]"))
+            {
+                throw new ArgumentException("Value did not contain an equal number of start and end brackets");
+            }
+
+            // verify that the value does not start with a start bracket
+            if (value.StartsWith("["))
+            {
+                throw new ArgumentException("Value cannot start with a bracket");
+            }
+
+            // verify that there are no empty brackets
+            if (value.Contains("[]"))
+            {
+                throw new ArgumentException("Value cannot contain empty brackets");
+            }
+
+            var stack = new Stack<Node>();
+            var root = new Node { Key = "root" };
+            stack.Push(root);
+
+            var currentNode = new Node();
+            root.Items.Add(currentNode);
+
+            foreach (char c in value)
+            {
+                switch (c)
+                {
+                    case '[': // Start a new node, child of the current node
+                        stack.Push(currentNode);
+                        currentNode = new Node();
+                        stack.Peek().Items.Add(currentNode);
+                        break;
+                    case ',': // Start a new node, but at the same level of the current node
+                        currentNode = new Node();
+                        stack.Peek().Items.Add(currentNode);
+                        break;
+                    case ']': // Back to parent of the current node
+                        currentNode = stack.Pop();
+                        break;
+                    default: // Add char to current node key
+                        currentNode.Key += c;
+                        break;
+                }
+            }
+
+            return root;
+        }
+    }
+}

src/Umbraco.Cms.Api.Delivery/DependencyInjection/UmbracoBuilderExtensions.cs

@@ -35,27 +35,35 @@ public static class UmbracoBuilderExtensions
         builder.Services.AddScoped<IRequestStartItemProvider, RequestStartItemProvider>();
         builder.Services.AddScoped<RequestContextOutputExpansionStrategy>();
         builder.Services.AddScoped<RequestContextOutputExpansionStrategyV2>();
-        builder.Services.AddScoped<IOutputExpansionStrategy>(provider =>
-        {
-            HttpContext? httpContext = provider.GetRequiredService<IHttpContextAccessor>().HttpContext;
-            ApiVersion? apiVersion = httpContext?.GetRequestedApiVersion();
-            if (apiVersion is null)
-            {
-                return provider.GetRequiredService<RequestContextOutputExpansionStrategyV2>();
-            }
 
-            // V1 of the Delivery API uses a different expansion strategy than V2+
-            return apiVersion.MajorVersion == 1
-                ? provider.GetRequiredService<RequestContextOutputExpansionStrategy>()
-                : provider.GetRequiredService<RequestContextOutputExpansionStrategyV2>();
-        });
+        builder.Services.AddUnique<IOutputExpansionStrategy>(
+            provider =>
+            {
+                HttpContext? httpContext = provider.GetRequiredService<IHttpContextAccessor>().HttpContext;
+                ApiVersion? apiVersion = httpContext?.GetRequestedApiVersion();
+                if (apiVersion is null)
+                {
+                    return provider.GetRequiredService<RequestContextOutputExpansionStrategyV2>();
+                }
+
+                // V1 of the Delivery API uses a different expansion strategy than V2+
+                return apiVersion.MajorVersion == 1
+                    ? provider.GetRequiredService<RequestContextOutputExpansionStrategy>()
+                    : provider.GetRequiredService<RequestContextOutputExpansionStrategyV2>();
+            },
+            ServiceLifetime.Scoped);
+
         builder.Services.AddSingleton<IRequestCultureService, RequestCultureService>();
         builder.Services.AddSingleton<IRequestSegmmentService, RequestSegmentService>();
+        builder.Services.AddSingleton<IRequestSegmentService, RequestSegmentService>();
         builder.Services.AddSingleton<IRequestRoutingService, RequestRoutingService>();
         builder.Services.AddSingleton<IRequestRedirectService, RequestRedirectService>();
         builder.Services.AddSingleton<IRequestPreviewService, RequestPreviewService>();
-        builder.Services.AddSingleton<IOutputExpansionStrategyAccessor, RequestContextOutputExpansionStrategyAccessor>();
+
+        // Webooks register a more basic implementation, remove it.
+        builder.Services.AddUnique<IOutputExpansionStrategyAccessor, RequestContextOutputExpansionStrategyAccessor>(ServiceLifetime.Singleton);
         builder.Services.AddSingleton<IRequestStartItemProviderAccessor, RequestContextRequestStartItemProviderAccessor>();
+
         builder.Services.AddSingleton<IApiAccessService, ApiAccessService>();
         builder.Services.AddSingleton<IApiContentQueryService, ApiContentQueryService>();
         builder.Services.AddSingleton<IApiContentQueryProvider, ApiContentQueryProvider>();

src/Umbraco.Cms.Api.Delivery/Filters/ContextualizeFromAcceptHeadersAttribute.cs

@@ -1,4 +1,4 @@
-using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc;
 using Microsoft.AspNetCore.Mvc.Filters;
 using Umbraco.Cms.Core.DeliveryApi;
 using Umbraco.Cms.Core.Models.PublishedContent;
@@ -16,12 +16,12 @@ internal sealed class ContextualizeFromAcceptHeadersAttribute : TypeFilterAttrib
     private sealed class LocalizeFromAcceptLanguageHeaderAttributeFilter : IActionFilter
     {
         private readonly IRequestCultureService _requestCultureService;
-        private readonly IRequestSegmmentService _requestSegmentService;
+        private readonly IRequestSegmentService _requestSegmentService;
         private readonly IVariationContextAccessor _variationContextAccessor;
 
         public LocalizeFromAcceptLanguageHeaderAttributeFilter(
             IRequestCultureService requestCultureService,
-            IRequestSegmmentService requestSegmentService,
+            IRequestSegmentService requestSegmentService,
             IVariationContextAccessor variationContextAccessor)
         {
             _requestCultureService = requestCultureService;

src/Umbraco.Cms.Api.Delivery/Rendering/RequestContextOutputExpansionStrategyV2.cs

@@ -1,62 +1,25 @@
 using Microsoft.AspNetCore.Http;
 using Microsoft.Extensions.Logging;
+using Umbraco.Cms.Api.Common.Rendering;
 using Umbraco.Cms.Core.DeliveryApi;
-using Umbraco.Cms.Core.Models.PublishedContent;
-using Umbraco.Extensions;
 
 namespace Umbraco.Cms.Api.Delivery.Rendering;
 
-internal sealed class RequestContextOutputExpansionStrategyV2 : IOutputExpansionStrategy
+internal sealed class RequestContextOutputExpansionStrategyV2 : ElementOnlyOutputExpansionStrategy, IOutputExpansionStrategy
 {
-    private const string All = "$all";
-    private const string None = "";
-    private const string ExpandParameterName = "expand";
-    private const string FieldsParameterName = "fields";
-
-    private readonly IApiPropertyRenderer _propertyRenderer;
     private readonly ILogger<RequestContextOutputExpansionStrategyV2> _logger;
 
-    private readonly Stack<Node?> _expandProperties;
-    private readonly Stack<Node?> _includeProperties;
-
     public RequestContextOutputExpansionStrategyV2(
         IHttpContextAccessor httpContextAccessor,
         IApiPropertyRenderer propertyRenderer,
         ILogger<RequestContextOutputExpansionStrategyV2> logger)
+        : base(propertyRenderer)
     {
-        _propertyRenderer = propertyRenderer;
         _logger = logger;
-        _expandProperties = new Stack<Node?>();
-        _includeProperties = new Stack<Node?>();
 
         InitializeExpandAndInclude(httpContextAccessor);
     }
 
-    public IDictionary<string, object?> MapContentProperties(IPublishedContent content)
-        => content.ItemType == PublishedItemType.Content
-            ? MapProperties(content.Properties)
-            : throw new ArgumentException($"Invalid item type. This method can only be used with item type {nameof(PublishedItemType.Content)}, got: {content.ItemType}");
-
-    public IDictionary<string, object?> MapMediaProperties(IPublishedContent media, bool skipUmbracoProperties = true)
-    {
-        if (media.ItemType != PublishedItemType.Media)
-        {
-            throw new ArgumentException($"Invalid item type. This method can only be used with item type {PublishedItemType.Media}, got: {media.ItemType}");
-        }
-
-        IPublishedProperty[] properties = media
-            .Properties
-            .Where(p => skipUmbracoProperties is false || p.Alias.StartsWith("umbraco") is false)
-            .ToArray();
-
-        return properties.Any()
-            ? MapProperties(properties)
-            : new Dictionary<string, object?>();
-    }
-
-    public IDictionary<string, object?> MapElementProperties(IPublishedElement element)
-        => MapProperties(element.Properties, true);
-
     private void InitializeExpandAndInclude(IHttpContextAccessor httpContextAccessor)
     {
         string? QueryValue(string key) => httpContextAccessor.HttpContext?.Request.Query[key];
@@ -66,7 +29,7 @@ internal sealed class RequestContextOutputExpansionStrategyV2 : IOutputExpansion
 
         try
         {
-            _expandProperties.Push(Node.Parse(toExpand));
+            ExpandProperties.Push(Node.Parse(toExpand));
         }
         catch (ArgumentException ex)
         {
@@ -76,7 +39,7 @@ internal sealed class RequestContextOutputExpansionStrategyV2 : IOutputExpansion
 
         try
         {
-            _includeProperties.Push(Node.Parse(toInclude));
+            IncludeProperties.Push(Node.Parse(toInclude));
         }
         catch (ArgumentException ex)
         {
@@ -84,102 +47,4 @@ internal sealed class RequestContextOutputExpansionStrategyV2 : IOutputExpansion
             throw new ArgumentException($"Could not parse the '{FieldsParameterName}' parameter: {ex.Message}");
         }
     }
-
-    private IDictionary<string, object?> MapProperties(IEnumerable<IPublishedProperty> properties, bool forceExpandProperties = false)
-    {
-        Node? currentExpandProperties = _expandProperties.Peek();
-        if (_expandProperties.Count > 1 && currentExpandProperties is null && forceExpandProperties is false)
-        {
-            return new Dictionary<string, object?>();
-        }
-
-        Node? currentIncludeProperties = _includeProperties.Peek();
-        var result = new Dictionary<string, object?>();
-        foreach (IPublishedProperty property in properties)
-        {
-            Node? nextIncludeProperties = GetNextProperties(currentIncludeProperties, property.Alias);
-            if (currentIncludeProperties is not null && currentIncludeProperties.Items.Any() && nextIncludeProperties is null)
-            {
-                continue;
-            }
-
-            Node? nextExpandProperties = GetNextProperties(currentExpandProperties, property.Alias);
-
-            _includeProperties.Push(nextIncludeProperties);
-            _expandProperties.Push(nextExpandProperties);
-
-            result[property.Alias] = GetPropertyValue(property);
-
-            _expandProperties.Pop();
-            _includeProperties.Pop();
-        }
-
-        return result;
-    }
-
-    private Node? GetNextProperties(Node? currentProperties, string propertyAlias)
-        => currentProperties?.Items.FirstOrDefault(i => i.Key == All)
-           ?? currentProperties?.Items.FirstOrDefault(i => i.Key == "properties")?.Items.FirstOrDefault(i => i.Key == All || i.Key == propertyAlias);
-
-    private object? GetPropertyValue(IPublishedProperty property)
-        => _propertyRenderer.GetPropertyValue(property, _expandProperties.Peek() is not null);
-
-    private sealed class Node
-    {
-        public string Key { get; private set; } = string.Empty;
-
-        public List<Node> Items { get; } = new();
-
-        public static Node Parse(string value)
-        {
-            // verify that there are as many start brackets as there are end brackets
-            if (value.CountOccurrences("[") != value.CountOccurrences("]"))
-            {
-                throw new ArgumentException("Value did not contain an equal number of start and end brackets");
-            }
-
-            // verify that the value does not start with a start bracket
-            if (value.StartsWith("["))
-            {
-                throw new ArgumentException("Value cannot start with a bracket");
-            }
-
-            // verify that there are no empty brackets
-            if (value.Contains("[]"))
-            {
-                throw new ArgumentException("Value cannot contain empty brackets");
-            }
-
-            var stack = new Stack<Node>();
-            var root = new Node { Key = "root" };
-            stack.Push(root);
-
-            var currentNode = new Node();
-            root.Items.Add(currentNode);
-
-            foreach (char c in value)
-            {
-                switch (c)
-                {
-                    case '[': // Start a new node, child of the current node
-                        stack.Push(currentNode);
-                        currentNode = new Node();
-                        stack.Peek().Items.Add(currentNode);
-                        break;
-                    case ',': // Start a new node, but at the same level of the current node
-                        currentNode = new Node();
-                        stack.Peek().Items.Add(currentNode);
-                        break;
-                    case ']': // Back to parent of the current node
-                        currentNode = stack.Pop();
-                        break;
-                    default: // Add char to current node key
-                        currentNode.Key += c;
-                        break;
-                }
-            }
-
-            return root;
-        }
-    }
 }

src/Umbraco.Cms.Api.Delivery/Services/RequestSegmentService.cs

@@ -3,7 +3,7 @@ using Umbraco.Cms.Core.DeliveryApi;
 
 namespace Umbraco.Cms.Api.Delivery.Services;
 
-internal sealed class RequestSegmentService : RequestHeaderHandler, IRequestSegmmentService
+internal sealed class RequestSegmentService : RequestHeaderHandler, IRequestSegmentService, IRequestSegmmentService
 {
     public RequestSegmentService(IHttpContextAccessor httpContextAccessor)
         : base(httpContextAccessor)

src/Umbraco.Cms.Api.Delivery/Umbraco.Cms.Api.Delivery.csproj

@@ -1,9 +1,8 @@
-<Project Sdk="Microsoft.NET.Sdk">
+<Project Sdk="Microsoft.NET.Sdk">
   <PropertyGroup>
     <Title>Umbraco CMS - Delivery API</Title>
     <Description>Contains the presentation layer for the Umbraco CMS Delivery API.</Description>
   </PropertyGroup>
-  
   <PropertyGroup>
     <!--
       TODO: Fix and remove overrides:
@@ -12,7 +11,6 @@
     -->
     <WarningsNotAsErrors>$(WarningsNotAsErrors),ASP0019,CS0618,CS0612</WarningsNotAsErrors>
   </PropertyGroup>
-  
   <ItemGroup>
     <ProjectReference Include="..\Umbraco.Cms.Api.Common\Umbraco.Cms.Api.Common.csproj" />
     <ProjectReference Include="..\Umbraco.Web.Common\Umbraco.Web.Common.csproj" />

src/Umbraco.Cms.Api.Management/Controllers/Content/ContentCollectionControllerBase.cs

@@ -1,7 +1,10 @@
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Api.Common.ViewModels.Pagination;
+using Umbraco.Cms.Api.Management.Services.Flags;
 using Umbraco.Cms.Api.Management.ViewModels.Content;
+using Umbraco.Cms.Core.DependencyInjection;
 using Umbraco.Cms.Core.Mapping;
 using Umbraco.Cms.Core.Models;
 using Umbraco.Cms.Core.Models.ContentEditing;
@@ -18,8 +21,19 @@ public abstract class ContentCollectionControllerBase<TContent, TCollectionRespo
     where TVariantResponseModel : VariantResponseModelBase
 {
     private readonly IUmbracoMapper _mapper;
+    private readonly FlagProviderCollection _flagProviders;
 
-    protected ContentCollectionControllerBase(IUmbracoMapper mapper) => _mapper = mapper;
+    protected ContentCollectionControllerBase(IUmbracoMapper mapper, FlagProviderCollection flagProvider)
+    {
+        _mapper = mapper;
+        _flagProviders = flagProvider;
+    }
+
+    [Obsolete("Use the constructer with all parameters. To be removed in Umbraco 18")]
+    protected ContentCollectionControllerBase(IUmbracoMapper mapper)
+        : this(mapper, StaticServiceProvider.Instance.GetRequiredService<FlagProviderCollection>())
+    {
+    }
 
     [Obsolete("This method is no longer used and will be removed in Umbraco 17.")]
     protected IActionResult CollectionResult(ListViewPagedModel<TContent> result)
@@ -48,6 +62,9 @@ public abstract class ContentCollectionControllerBase<TContent, TCollectionRespo
         return Ok(pageViewModel);
     }
 
+    /// <summary>
+    /// Creates a collection result from the provided collection response models and total number of items.
+    /// </summary>
     protected IActionResult CollectionResult(List<TCollectionResponseModel> collectionResponseModels, long totalNumberOfItems)
     {
         var pageViewModel = new PagedViewModel<TCollectionResponseModel>

src/Umbraco.Cms.Api.Management/Controllers/DataType/Tree/AncestorsDataTypeTreeController.cs

@@ -1,6 +1,8 @@
 using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
+using Umbraco.Cms.Api.Management.Services.Flags;
 using Umbraco.Cms.Api.Management.ViewModels.Tree;
 using Umbraco.Cms.Core.Services;
 
@@ -9,11 +11,18 @@ namespace Umbraco.Cms.Api.Management.Controllers.DataType.Tree;
 [ApiVersion("1.0")]
 public class AncestorsDataTypeTreeController : DataTypeTreeControllerBase
 {
+    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 18.")]
     public AncestorsDataTypeTreeController(IEntityService entityService, IDataTypeService dataTypeService)
         : base(entityService, dataTypeService)
     {
     }
 
+    [ActivatorUtilitiesConstructor]
+    public AncestorsDataTypeTreeController(IEntityService entityService, FlagProviderCollection flagProviders, IDataTypeService dataTypeService)
+    : base(entityService, flagProviders, dataTypeService)
+    {
+    }
+
     [HttpGet("ancestors")]
     [MapToApiVersion("1.0")]
     [ProducesResponseType(typeof(IEnumerable<DataTypeTreeItemResponseModel>), StatusCodes.Status200OK)]

src/Umbraco.Cms.Api.Management/Controllers/DataType/Tree/ChildrenDataTypeTreeController.cs

@@ -1,20 +1,29 @@
-using Asp.Versioning;
+using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
 using Umbraco.Cms.Core.Services;
 using Umbraco.Cms.Api.Common.ViewModels.Pagination;
 using Umbraco.Cms.Api.Management.ViewModels.Tree;
+using Microsoft.Extensions.DependencyInjection;
+using Umbraco.Cms.Api.Management.Services.Flags;
 
 namespace Umbraco.Cms.Api.Management.Controllers.DataType.Tree;
 
 [ApiVersion("1.0")]
 public class ChildrenDataTypeTreeController : DataTypeTreeControllerBase
 {
+    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 18.")]
     public ChildrenDataTypeTreeController(IEntityService entityService, IDataTypeService dataTypeService)
         : base(entityService, dataTypeService)
     {
     }
 
+    [ActivatorUtilitiesConstructor]
+    public ChildrenDataTypeTreeController(IEntityService entityService, FlagProviderCollection flagProviders, IDataTypeService dataTypeService)
+        : base(entityService, flagProviders, dataTypeService)
+    {
+    }
+
     [HttpGet("children")]
     [MapToApiVersion("1.0")]
     [ProducesResponseType(typeof(PagedViewModel<DataTypeTreeItemResponseModel>), StatusCodes.Status200OK)]

src/Umbraco.Cms.Api.Management/Controllers/DataType/Tree/DataTypeTreeControllerBase.cs

@@ -1,9 +1,12 @@
-using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Api.Management.Controllers.Tree;
 using Umbraco.Cms.Api.Management.Routing;
+using Umbraco.Cms.Api.Management.Services.Flags;
 using Umbraco.Cms.Api.Management.ViewModels.Tree;
 using Umbraco.Cms.Core;
+using Umbraco.Cms.Core.DependencyInjection;
 using Umbraco.Cms.Core.Models;
 using Umbraco.Cms.Core.Models.Entities;
 using Umbraco.Cms.Core.Services;
@@ -19,8 +22,17 @@ public class DataTypeTreeControllerBase : FolderTreeControllerBase<DataTypeTreeI
 {
     private readonly IDataTypeService _dataTypeService;
 
+    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 18.")]
     public DataTypeTreeControllerBase(IEntityService entityService, IDataTypeService dataTypeService)
-        : base(entityService) =>
+        : this(
+              entityService,
+              StaticServiceProvider.Instance.GetRequiredService<FlagProviderCollection>(),
+              dataTypeService)
+    {
+    }
+
+    public DataTypeTreeControllerBase(IEntityService entityService, FlagProviderCollection flagProviders, IDataTypeService dataTypeService)
+        : base(entityService, flagProviders) =>
         _dataTypeService = dataTypeService;
 
     protected override UmbracoObjectTypes ItemObjectType => UmbracoObjectTypes.DataType;

src/Umbraco.Cms.Api.Management/Controllers/DataType/Tree/RootDataTypeTreeController.cs

@@ -1,21 +1,29 @@
-using Asp.Versioning;
+using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
 using Umbraco.Cms.Core.Services;
 using Umbraco.Cms.Api.Common.ViewModels.Pagination;
-using Umbraco.Cms.Api.Management.ViewModels.DataType.Item;
 using Umbraco.Cms.Api.Management.ViewModels.Tree;
+using Microsoft.Extensions.DependencyInjection;
+using Umbraco.Cms.Api.Management.Services.Flags;
 
 namespace Umbraco.Cms.Api.Management.Controllers.DataType.Tree;
 
 [ApiVersion("1.0")]
 public class RootDataTypeTreeController : DataTypeTreeControllerBase
 {
+    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 18.")]
     public RootDataTypeTreeController(IEntityService entityService, IDataTypeService dataTypeService)
         : base(entityService, dataTypeService)
     {
     }
 
+    [ActivatorUtilitiesConstructor]
+    public RootDataTypeTreeController(IEntityService entityService, FlagProviderCollection flagProviders, IDataTypeService dataTypeService)
+    : base(entityService, flagProviders, dataTypeService)
+    {
+    }
+
     [HttpGet("root")]
     [MapToApiVersion("1.0")]
     [ProducesResponseType(typeof(PagedViewModel<DataTypeTreeItemResponseModel>), StatusCodes.Status200OK)]

src/Umbraco.Cms.Api.Management/Controllers/DataType/Tree/SiblingsDataTypeTreeController.cs

@@ -1,6 +1,8 @@
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Api.Common.ViewModels.Pagination;
+using Umbraco.Cms.Api.Management.Services.Flags;
 using Umbraco.Cms.Api.Management.ViewModels.Tree;
 using Umbraco.Cms.Core.Services;
 
@@ -8,11 +10,18 @@ namespace Umbraco.Cms.Api.Management.Controllers.DataType.Tree;
 
 public class SiblingsDataTypeTreeController : DataTypeTreeControllerBase
 {
+    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 18.")]
     public SiblingsDataTypeTreeController(IEntityService entityService, IDataTypeService dataTypeService)
         : base(entityService, dataTypeService)
     {
     }
 
+    [ActivatorUtilitiesConstructor]
+    public SiblingsDataTypeTreeController(IEntityService entityService, FlagProviderCollection flagProviders, IDataTypeService dataTypeService)
+        : base(entityService, flagProviders, dataTypeService)
+    {
+    }
+
     [HttpGet("siblings")]
     [ProducesResponseType(typeof(SubsetViewModel<DataTypeTreeItemResponseModel>), StatusCodes.Status200OK)]
     public async Task<ActionResult<SubsetViewModel<DataTypeTreeItemResponseModel>>> Siblings(CancellationToken cancellationToken, Guid target, int before, int after, bool foldersOnly = false)

src/Umbraco.Cms.Api.Management/Controllers/Dictionary/Tree/AncestorsDictionaryTreeController.cs

@@ -1,6 +1,8 @@
-using Asp.Versioning;
+using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
+using Umbraco.Cms.Api.Management.Services.Flags;
 using Umbraco.Cms.Api.Management.ViewModels.Tree;
 using Umbraco.Cms.Core.Services;
 
@@ -9,11 +11,18 @@ namespace Umbraco.Cms.Api.Management.Controllers.Dictionary.Tree;
 [ApiVersion("1.0")]
 public class AncestorsDictionaryTreeController : DictionaryTreeControllerBase
 {
+    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 18.")]
     public AncestorsDictionaryTreeController(IEntityService entityService, IDictionaryItemService dictionaryItemService)
         : base(entityService, dictionaryItemService)
     {
     }
 
+    [ActivatorUtilitiesConstructor]
+    public AncestorsDictionaryTreeController(IEntityService entityService, FlagProviderCollection flagProviders, IDictionaryItemService dictionaryItemService)
+        : base(entityService, flagProviders, dictionaryItemService)
+    {
+    }
+
     [HttpGet("ancestors")]
     [MapToApiVersion("1.0")]
     [ProducesResponseType(typeof(IEnumerable<NamedEntityTreeItemResponseModel>), StatusCodes.Status200OK)]

src/Umbraco.Cms.Api.Management/Controllers/Dictionary/Tree/ChildrenDictionaryTreeController.cs

@@ -1,21 +1,30 @@
-using Asp.Versioning;
+using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
+using Umbraco.Cms.Api.Common.ViewModels.Pagination;
+using Umbraco.Cms.Api.Management.Services.Flags;
+using Umbraco.Cms.Api.Management.ViewModels.Tree;
 using Umbraco.Cms.Core.Models;
 using Umbraco.Cms.Core.Services;
-using Umbraco.Cms.Api.Common.ViewModels.Pagination;
-using Umbraco.Cms.Api.Management.ViewModels.Tree;
 
 namespace Umbraco.Cms.Api.Management.Controllers.Dictionary.Tree;
 
 [ApiVersion("1.0")]
 public class ChildrenDictionaryTreeController : DictionaryTreeControllerBase
 {
+    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 18.")]
     public ChildrenDictionaryTreeController(IEntityService entityService, IDictionaryItemService dictionaryItemService)
         : base(entityService, dictionaryItemService)
     {
     }
 
+    [ActivatorUtilitiesConstructor]
+    public ChildrenDictionaryTreeController(IEntityService entityService, FlagProviderCollection flagProviders, IDictionaryItemService dictionaryItemService)
+        : base(entityService, flagProviders, dictionaryItemService)
+    {
+    }
+
     [HttpGet("children")]
     [MapToApiVersion("1.0")]
     [ProducesResponseType(typeof(PagedViewModel<NamedEntityTreeItemResponseModel>), StatusCodes.Status200OK)]

src/Umbraco.Cms.Api.Management/Controllers/Dictionary/Tree/DictionaryTreeControllerBase.cs

@@ -1,10 +1,13 @@
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Api.Management.Controllers.Tree;
 using Umbraco.Cms.Api.Management.Routing;
+using Umbraco.Cms.Api.Management.Services.Flags;
 using Umbraco.Cms.Api.Management.ViewModels;
 using Umbraco.Cms.Api.Management.ViewModels.Tree;
 using Umbraco.Cms.Core;
+using Umbraco.Cms.Core.DependencyInjection;
 using Umbraco.Cms.Core.Models;
 using Umbraco.Cms.Core.Services;
 using Umbraco.Cms.Web.Common.Authorization;
@@ -18,8 +21,17 @@ namespace Umbraco.Cms.Api.Management.Controllers.Dictionary.Tree;
 // tree controller base. We'll keep it though, in the hope that we can mend EntityService.
 public class DictionaryTreeControllerBase : NamedEntityTreeControllerBase<NamedEntityTreeItemResponseModel>
 {
+    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 18.")]
     public DictionaryTreeControllerBase(IEntityService entityService, IDictionaryItemService dictionaryItemService)
-        : base(entityService) =>
+        : this(
+              entityService,
+              StaticServiceProvider.Instance.GetRequiredService<FlagProviderCollection>(),
+              dictionaryItemService)
+    {
+    }
+
+    public DictionaryTreeControllerBase(IEntityService entityService, FlagProviderCollection flagProviders, IDictionaryItemService dictionaryItemService)
+        : base(entityService, flagProviders) =>
         DictionaryItemService = dictionaryItemService;
 
     // dictionary items do not currently have a known UmbracoObjectType, so we'll settle with Unknown for now

src/Umbraco.Cms.Api.Management/Controllers/Dictionary/Tree/RootDictionaryTreeController.cs

@@ -1,10 +1,12 @@
-using Asp.Versioning;
+using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
+using Umbraco.Cms.Api.Common.ViewModels.Pagination;
+using Umbraco.Cms.Api.Management.Services.Flags;
+using Umbraco.Cms.Api.Management.ViewModels.Tree;
 using Umbraco.Cms.Core.Models;
 using Umbraco.Cms.Core.Services;
-using Umbraco.Cms.Api.Common.ViewModels.Pagination;
-using Umbraco.Cms.Api.Management.ViewModels.Tree;
 
 namespace Umbraco.Cms.Api.Management.Controllers.Dictionary.Tree;
 
@@ -16,6 +18,12 @@ public class RootDictionaryTreeController : DictionaryTreeControllerBase
     {
     }
 
+    [ActivatorUtilitiesConstructor]
+    public RootDictionaryTreeController(IEntityService entityService, FlagProviderCollection flagProviders, IDictionaryItemService dictionaryItemService)
+        : base(entityService, flagProviders, dictionaryItemService)
+    {
+    }
+
     [HttpGet("root")]
     [MapToApiVersion("1.0")]
     [ProducesResponseType(typeof(PagedViewModel<NamedEntityTreeItemResponseModel>), StatusCodes.Status200OK)]

src/Umbraco.Cms.Api.Management/Controllers/Document/AvailableSegmentsController.cs

@@ -0,0 +1,85 @@
+using Asp.Versioning;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Umbraco.Cms.Api.Common.ViewModels.Pagination;
+using Umbraco.Cms.Api.Management.ViewModels.Segment;
+using Umbraco.Cms.Core;
+using Umbraco.Cms.Core.Actions;
+using Umbraco.Cms.Core.Mapping;
+using Umbraco.Cms.Core.Models;
+using Umbraco.Cms.Core.Security.Authorization;
+using Umbraco.Cms.Core.Services;
+using Umbraco.Cms.Core.Services.OperationStatus;
+using Umbraco.Cms.Web.Common.Authorization;
+using Umbraco.Extensions;
+
+namespace Umbraco.Cms.Api.Management.Controllers.Document;
+
+[Obsolete("This controller is temporary and will be removed in a future release (planned for v20). A more permanent solution will follow.")]
+[ApiVersion("1.0")]
+public class AvailableSegmentsController : DocumentControllerBase
+{
+    private readonly IAuthorizationService _authorizationService;
+    private readonly ISegmentService _segmentService;
+    private readonly IUmbracoMapper _umbracoMapper;
+
+    public AvailableSegmentsController(
+        IAuthorizationService authorizationService,
+        ISegmentService segmentService,
+        IUmbracoMapper umbracoMapper)
+    {
+        _authorizationService = authorizationService;
+        _segmentService = segmentService;
+        _umbracoMapper = umbracoMapper;
+    }
+
+    [HttpGet("{id:guid}/available-segment-options")]
+    [MapToApiVersion("1.0")]
+    [ProducesResponseType(typeof(PagedViewModel<SegmentResponseModel>), StatusCodes.Status200OK)]
+    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status400BadRequest)]
+    public async Task<IActionResult> GetAvailableSegmentOptions(
+        Guid id,
+        CancellationToken cancellationToken,
+        int skip = 0,
+        int take = 100)
+    {
+        AuthorizationResult authorizationResult = await _authorizationService.AuthorizeResourceAsync(
+            User,
+            ContentPermissionResource.WithKeys(ActionBrowse.ActionLetter, id),
+            AuthorizationPolicies.ContentPermissionByResource);
+
+        if (!authorizationResult.Succeeded)
+        {
+            return Forbidden();
+        }
+
+        Attempt<PagedModel<Core.Models.Segment>?, SegmentOperationStatus> pagedAttempt =
+            await _segmentService.GetPagedSegmentsForDocumentAsync(id, skip, take);
+
+        if (pagedAttempt.Success is false)
+        {
+            return MapFailure(pagedAttempt.Status);
+        }
+
+        var viewModel = new PagedViewModel<SegmentResponseModel>
+        {
+            Items = _umbracoMapper.MapEnumerable<Core.Models.Segment, SegmentResponseModel>(pagedAttempt.Result!.Items),
+            Total = pagedAttempt.Result!.Total,
+        };
+
+        return Ok(viewModel);
+    }
+
+    private IActionResult MapFailure(SegmentOperationStatus status)
+        => OperationStatusResult(
+            status,
+            problemDetailsBuilder => status switch
+            {
+                _ => StatusCode(
+                    StatusCodes.Status500InternalServerError,
+                    problemDetailsBuilder
+                        .WithTitle("Unknown segment operation status.")
+                        .Build()),
+            });
+}

src/Umbraco.Cms.Api.Management/Controllers/Document/Collection/ByKeyDocumentCollectionController.cs

@@ -1,10 +1,13 @@
 using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Api.Common.ViewModels.Pagination;
 using Umbraco.Cms.Api.Management.Factories;
+using Umbraco.Cms.Api.Management.Services.Flags;
 using Umbraco.Cms.Api.Management.ViewModels.Document.Collection;
 using Umbraco.Cms.Core;
+using Umbraco.Cms.Core.DependencyInjection;
 using Umbraco.Cms.Core.Mapping;
 using Umbraco.Cms.Core.Models;
 using Umbraco.Cms.Core.Security;
@@ -20,16 +23,33 @@ public class ByKeyDocumentCollectionController : DocumentCollectionControllerBas
     private readonly IBackOfficeSecurityAccessor _backOfficeSecurityAccessor;
     private readonly IDocumentCollectionPresentationFactory _documentCollectionPresentationFactory;
 
+    [ActivatorUtilitiesConstructor]
+    public ByKeyDocumentCollectionController(
+        IContentListViewService contentListViewService,
+        IBackOfficeSecurityAccessor backOfficeSecurityAccessor,
+        IUmbracoMapper mapper,
+        IDocumentCollectionPresentationFactory documentCollectionPresentationFactory,
+        FlagProviderCollection flagProviders)
+        : base(mapper, flagProviders)
+    {
+        _contentListViewService = contentListViewService;
+        _backOfficeSecurityAccessor = backOfficeSecurityAccessor;
+        _documentCollectionPresentationFactory = documentCollectionPresentationFactory;
+    }
+
+    [Obsolete("Please use the constructor with all parameters. Scheduled to be removed in V18")]
     public ByKeyDocumentCollectionController(
         IContentListViewService contentListViewService,
         IBackOfficeSecurityAccessor backOfficeSecurityAccessor,
         IUmbracoMapper mapper,
         IDocumentCollectionPresentationFactory documentCollectionPresentationFactory)
-        : base(mapper)
+        : this(
+            contentListViewService,
+            backOfficeSecurityAccessor,
+            mapper,
+            documentCollectionPresentationFactory,
+            StaticServiceProvider.Instance.GetRequiredService<FlagProviderCollection>())
     {
-        _contentListViewService = contentListViewService;
-        _backOfficeSecurityAccessor = backOfficeSecurityAccessor;
-        _documentCollectionPresentationFactory = documentCollectionPresentationFactory;
     }
 
     [HttpGet("{id:guid}")]

src/Umbraco.Cms.Api.Management/Controllers/Document/Collection/DocumentCollectionControllerBase.cs

@@ -2,6 +2,7 @@ using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Umbraco.Cms.Api.Management.Controllers.Content;
 using Umbraco.Cms.Api.Management.Routing;
+using Umbraco.Cms.Api.Management.Services.Flags;
 using Umbraco.Cms.Api.Management.ViewModels.Document;
 using Umbraco.Cms.Api.Management.ViewModels.Document.Collection;
 using Umbraco.Cms.Core;
@@ -17,6 +18,12 @@ namespace Umbraco.Cms.Api.Management.Controllers.Document.Collection;
 [Authorize(Policy = AuthorizationPolicies.TreeAccessDocuments)]
 public abstract class DocumentCollectionControllerBase : ContentCollectionControllerBase<IContent, DocumentCollectionResponseModel, DocumentValueResponseModel, DocumentVariantResponseModel>
 {
+    protected DocumentCollectionControllerBase(IUmbracoMapper mapper, FlagProviderCollection flagProviders)
+        : base(mapper, flagProviders)
+    {
+    }
+
+    [Obsolete("Please use the constructor with all parameters. Scheduled to be removed in V18")]
     protected DocumentCollectionControllerBase(IUmbracoMapper mapper)
         : base(mapper)
     {

src/Umbraco.Cms.Api.Management/Controllers/Document/DomainsController.cs

@@ -1,31 +1,60 @@
-using Asp.Versioning;
+using Asp.Versioning;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Api.Management.ViewModels.Document;
+using Umbraco.Cms.Core.Actions;
+using Umbraco.Cms.Core.DependencyInjection;
 using Umbraco.Cms.Core.Mapping;
 using Umbraco.Cms.Core.Models;
+using Umbraco.Cms.Core.Security.Authorization;
 using Umbraco.Cms.Core.Services;
+using Umbraco.Cms.Web.Common.Authorization;
+using Umbraco.Extensions;
 
 namespace Umbraco.Cms.Api.Management.Controllers.Document;
 
 [ApiVersion("1.0")]
 public class DomainsController : DocumentControllerBase
 {
+    private readonly IAuthorizationService _authorizationService;
     private readonly IDomainService _domainService;
     private readonly IUmbracoMapper _umbracoMapper;
 
-    public DomainsController(IDomainService domainService, IUmbracoMapper umbracoMapper)
+    [ActivatorUtilitiesConstructor]
+    public DomainsController(IAuthorizationService authorizationService, IDomainService domainService, IUmbracoMapper umbracoMapper)
     {
+        _authorizationService = authorizationService;
         _domainService = domainService;
         _umbracoMapper = umbracoMapper;
     }
 
+    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 18.")]
+    public DomainsController(IDomainService domainService, IUmbracoMapper umbracoMapper)
+        : this(
+            StaticServiceProvider.Instance.GetRequiredService<IAuthorizationService>(),
+            domainService,
+            umbracoMapper)
+    {
+    }
+
     [MapToApiVersion("1.0")]
     [HttpGet("{id:guid}/domains")]
     [ProducesResponseType(typeof(DomainsResponseModel), StatusCodes.Status200OK)]
     [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status404NotFound)]
     public async Task<IActionResult> Domains(CancellationToken cancellationToken, Guid id)
     {
+        AuthorizationResult authorizationResult = await _authorizationService.AuthorizeResourceAsync(
+            User,
+            ContentPermissionResource.WithKeys(ActionBrowse.ActionLetter, id),
+            AuthorizationPolicies.ContentPermissionByResource);
+
+        if (!authorizationResult.Succeeded)
+        {
+            return Forbidden();
+        }
+
         IDomain[] assignedDomains = (await _domainService.GetAssignedDomainsAsync(id, true))
             .OrderBy(d => d.SortOrder)
             .ToArray();

src/Umbraco.Cms.Api.Management/Controllers/Document/Item/ItemDocumentItemController.cs

@@ -1,6 +1,7 @@
 using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Api.Management.Factories;
 using Umbraco.Cms.Api.Management.ViewModels.Document.Item;
 using Umbraco.Cms.Core.Models;
@@ -15,7 +16,10 @@ public class ItemDocumentItemController : DocumentItemControllerBase
     private readonly IEntityService _entityService;
     private readonly IDocumentPresentationFactory _documentPresentationFactory;
 
-    public ItemDocumentItemController(IEntityService entityService, IDocumentPresentationFactory documentPresentationFactory)
+    [ActivatorUtilitiesConstructor]
+    public ItemDocumentItemController(
+        IEntityService entityService,
+        IDocumentPresentationFactory documentPresentationFactory)
     {
         _entityService = entityService;
         _documentPresentationFactory = documentPresentationFactory;
@@ -24,20 +28,20 @@ public class ItemDocumentItemController : DocumentItemControllerBase
     [HttpGet]
     [MapToApiVersion("1.0")]
     [ProducesResponseType(typeof(IEnumerable<DocumentItemResponseModel>), StatusCodes.Status200OK)]
-    public Task<IActionResult> Item(
+    public async Task<IActionResult> Item(
         CancellationToken cancellationToken,
         [FromQuery(Name = "id")] HashSet<Guid> ids)
     {
         if (ids.Count is 0)
         {
-            return Task.FromResult<IActionResult>(Ok(Enumerable.Empty<DocumentItemResponseModel>()));
+            return Ok(Enumerable.Empty<DocumentItemResponseModel>());
         }
 
         IEnumerable<IDocumentEntitySlim> documents = _entityService
             .GetAll(UmbracoObjectTypes.Document, ids.ToArray())
             .OfType<IDocumentEntitySlim>();
 
-        IEnumerable<DocumentItemResponseModel> documentItemResponseModels = documents.Select(_documentPresentationFactory.CreateItemResponseModel);
-        return Task.FromResult<IActionResult>(Ok(documentItemResponseModels));
+        IEnumerable<DocumentItemResponseModel> responseModels = documents.Select(_documentPresentationFactory.CreateItemResponseModel);
+        return Ok(responseModels);
     }
 }

src/Umbraco.Cms.Api.Management/Controllers/Document/RecycleBin/SiblingsDocumentRecycleBinController.cs

@@ -0,0 +1,24 @@
+using Asp.Versioning;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Umbraco.Cms.Api.Common.ViewModels.Pagination;
+using Umbraco.Cms.Api.Management.Factories;
+using Umbraco.Cms.Api.Management.ViewModels.Document.RecycleBin;
+using Umbraco.Cms.Core.Services;
+
+namespace Umbraco.Cms.Api.Management.Controllers.Document.RecycleBin;
+
+[ApiVersion("1.0")]
+public class SiblingsDocumentRecycleBinController : DocumentRecycleBinControllerBase
+{
+    public SiblingsDocumentRecycleBinController(IEntityService entityService, IDocumentPresentationFactory documentPresentationFactory)
+        : base(entityService, documentPresentationFactory)
+    {
+    }
+
+    [HttpGet("siblings")]
+    [MapToApiVersion("1.0")]
+    [ProducesResponseType(typeof(SubsetViewModel<DocumentRecycleBinItemResponseModel>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<SubsetViewModel<DocumentRecycleBinItemResponseModel>>> Siblings(CancellationToken cancellationToken, Guid target, int before, int after, Guid? dataTypeId = null)
+        => await GetSiblings(target, before, after);
+}

src/Umbraco.Cms.Api.Management/Controllers/Document/Tree/AncestorsDocumentTreeController.cs

@@ -1,8 +1,10 @@
 using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Api.Management.Factories;
 using Umbraco.Cms.Api.Management.Services.Entities;
+using Umbraco.Cms.Api.Management.Services.Flags;
 using Umbraco.Cms.Api.Management.ViewModels.Tree;
 using Umbraco.Cms.Core.Cache;
 using Umbraco.Cms.Core.Security;
@@ -13,6 +15,7 @@ namespace Umbraco.Cms.Api.Management.Controllers.Document.Tree;
 [ApiVersion("1.0")]
 public class AncestorsDocumentTreeController : DocumentTreeControllerBase
 {
+    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 18.")]
     public AncestorsDocumentTreeController(
         IEntityService entityService,
         IUserStartNodeEntitiesService userStartNodeEntitiesService,
@@ -32,6 +35,28 @@ public class AncestorsDocumentTreeController : DocumentTreeControllerBase
     {
     }
 
+    [ActivatorUtilitiesConstructor]
+    public AncestorsDocumentTreeController(
+        IEntityService entityService,
+        FlagProviderCollection flagProviders,
+        IUserStartNodeEntitiesService userStartNodeEntitiesService,
+        IDataTypeService dataTypeService,
+        IPublicAccessService publicAccessService,
+        AppCaches appCaches,
+        IBackOfficeSecurityAccessor backofficeSecurityAccessor,
+        IDocumentPresentationFactory documentPresentationFactory)
+        : base(
+            entityService,
+            flagProviders,
+            userStartNodeEntitiesService,
+            dataTypeService,
+            publicAccessService,
+            appCaches,
+            backofficeSecurityAccessor,
+            documentPresentationFactory)
+    {
+    }
+
     [HttpGet("ancestors")]
     [MapToApiVersion("1.0")]
     [ProducesResponseType(typeof(IEnumerable<DocumentTreeItemResponseModel>), StatusCodes.Status200OK)]

src/Umbraco.Cms.Api.Management/Controllers/Document/Tree/ChildrenDocumentTreeController.cs

@@ -1,19 +1,22 @@
-using Asp.Versioning;
+using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
+using Umbraco.Cms.Api.Common.ViewModels.Pagination;
+using Umbraco.Cms.Api.Management.Factories;
+using Umbraco.Cms.Api.Management.Services.Entities;
+using Umbraco.Cms.Api.Management.Services.Flags;
+using Umbraco.Cms.Api.Management.ViewModels.Tree;
 using Umbraco.Cms.Core.Cache;
 using Umbraco.Cms.Core.Security;
 using Umbraco.Cms.Core.Services;
-using Umbraco.Cms.Api.Management.Services.Entities;
-using Umbraco.Cms.Api.Common.ViewModels.Pagination;
-using Umbraco.Cms.Api.Management.Factories;
-using Umbraco.Cms.Api.Management.ViewModels.Tree;
 
 namespace Umbraco.Cms.Api.Management.Controllers.Document.Tree;
 
 [ApiVersion("1.0")]
 public class ChildrenDocumentTreeController : DocumentTreeControllerBase
 {
+    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 18.")]
     public ChildrenDocumentTreeController(
         IEntityService entityService,
         IUserStartNodeEntitiesService userStartNodeEntitiesService,
@@ -33,6 +36,28 @@ public class ChildrenDocumentTreeController : DocumentTreeControllerBase
     {
     }
 
+    [ActivatorUtilitiesConstructor]
+    public ChildrenDocumentTreeController(
+        IEntityService entityService,
+        FlagProviderCollection flagProviders,
+        IUserStartNodeEntitiesService userStartNodeEntitiesService,
+        IDataTypeService dataTypeService,
+        IPublicAccessService publicAccessService,
+        AppCaches appCaches,
+        IBackOfficeSecurityAccessor backofficeSecurityAccessor,
+        IDocumentPresentationFactory documentPresentationFactory)
+        : base(
+            entityService,
+            flagProviders,
+            userStartNodeEntitiesService,
+            dataTypeService,
+            publicAccessService,
+            appCaches,
+            backofficeSecurityAccessor,
+            documentPresentationFactory)
+    {
+    }
+
     [HttpGet("children")]
     [MapToApiVersion("1.0")]
     [ProducesResponseType(typeof(PagedViewModel<DocumentTreeItemResponseModel>), StatusCodes.Status200OK)]

src/Umbraco.Cms.Api.Management/Controllers/Document/Tree/DocumentTreeControllerBase.cs

@@ -1,13 +1,16 @@
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Api.Management.Controllers.Tree;
 using Umbraco.Cms.Api.Management.Factories;
 using Umbraco.Cms.Api.Management.Routing;
 using Umbraco.Cms.Api.Management.Services.Entities;
+using Umbraco.Cms.Api.Management.Services.Flags;
 using Umbraco.Cms.Api.Management.ViewModels;
 using Umbraco.Cms.Api.Management.ViewModels.Tree;
 using Umbraco.Cms.Core;
 using Umbraco.Cms.Core.Cache;
+using Umbraco.Cms.Core.DependencyInjection;
 using Umbraco.Cms.Core.Models;
 using Umbraco.Cms.Core.Models.Entities;
 using Umbraco.Cms.Core.Security;
@@ -26,6 +29,7 @@ public abstract class DocumentTreeControllerBase : UserStartNodeTreeControllerBa
     private readonly IBackOfficeSecurityAccessor _backofficeSecurityAccessor;
     private readonly IDocumentPresentationFactory _documentPresentationFactory;
 
+    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 18.")]
     protected DocumentTreeControllerBase(
         IEntityService entityService,
         IUserStartNodeEntitiesService userStartNodeEntitiesService,
@@ -34,7 +38,29 @@ public abstract class DocumentTreeControllerBase : UserStartNodeTreeControllerBa
         AppCaches appCaches,
         IBackOfficeSecurityAccessor backofficeSecurityAccessor,
         IDocumentPresentationFactory documentPresentationFactory)
-    : base(entityService, userStartNodeEntitiesService, dataTypeService)
+        : this(
+              entityService,
+              StaticServiceProvider.Instance.GetRequiredService<FlagProviderCollection>(),
+              userStartNodeEntitiesService,
+              dataTypeService,
+              publicAccessService,
+              appCaches,
+              backofficeSecurityAccessor,
+              documentPresentationFactory)
+    {
+    }
+
+    [ActivatorUtilitiesConstructor]
+    protected DocumentTreeControllerBase(
+        IEntityService entityService,
+        FlagProviderCollection flagProviders,
+        IUserStartNodeEntitiesService userStartNodeEntitiesService,
+        IDataTypeService dataTypeService,
+        IPublicAccessService publicAccessService,
+        AppCaches appCaches,
+        IBackOfficeSecurityAccessor backofficeSecurityAccessor,
+        IDocumentPresentationFactory documentPresentationFactory)
+        : base(entityService, flagProviders, userStartNodeEntitiesService, dataTypeService)
     {
         _publicAccessService = publicAccessService;
         _appCaches = appCaches;

src/Umbraco.Cms.Api.Management/Controllers/Document/Tree/RootDocumentTreeController.cs

@@ -1,19 +1,22 @@
-using Asp.Versioning;
+using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
+using Umbraco.Cms.Api.Common.ViewModels.Pagination;
+using Umbraco.Cms.Api.Management.Factories;
+using Umbraco.Cms.Api.Management.Services.Entities;
+using Umbraco.Cms.Api.Management.Services.Flags;
+using Umbraco.Cms.Api.Management.ViewModels.Tree;
 using Umbraco.Cms.Core.Cache;
 using Umbraco.Cms.Core.Security;
 using Umbraco.Cms.Core.Services;
-using Umbraco.Cms.Api.Management.Services.Entities;
-using Umbraco.Cms.Api.Common.ViewModels.Pagination;
-using Umbraco.Cms.Api.Management.Factories;
-using Umbraco.Cms.Api.Management.ViewModels.Tree;
 
 namespace Umbraco.Cms.Api.Management.Controllers.Document.Tree;
 
 [ApiVersion("1.0")]
 public class RootDocumentTreeController : DocumentTreeControllerBase
 {
+    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 18.")]
     public RootDocumentTreeController(
         IEntityService entityService,
         IUserStartNodeEntitiesService userStartNodeEntitiesService,
@@ -33,6 +36,28 @@ public class RootDocumentTreeController : DocumentTreeControllerBase
     {
     }
 
+    [ActivatorUtilitiesConstructor]
+    public RootDocumentTreeController(
+        IEntityService entityService,
+        FlagProviderCollection flagProviders,
+        IUserStartNodeEntitiesService userStartNodeEntitiesService,
+        IDataTypeService dataTypeService,
+        IPublicAccessService publicAccessService,
+        AppCaches appCaches,
+        IBackOfficeSecurityAccessor backofficeSecurityAccessor,
+        IDocumentPresentationFactory documentPresentationFactory)
+        : base(
+            entityService,
+            flagProviders,
+            userStartNodeEntitiesService,
+            dataTypeService,
+            publicAccessService,
+            appCaches,
+            backofficeSecurityAccessor,
+            documentPresentationFactory)
+    {
+    }
+
     [HttpGet("root")]
     [MapToApiVersion("1.0")]
     [ProducesResponseType(typeof(PagedViewModel<DocumentTreeItemResponseModel>), StatusCodes.Status200OK)]

src/Umbraco.Cms.Api.Management/Controllers/Document/Tree/SiblingsDocumentTreeController.cs

@@ -1,9 +1,11 @@
 using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Api.Common.ViewModels.Pagination;
 using Umbraco.Cms.Api.Management.Factories;
 using Umbraco.Cms.Api.Management.Services.Entities;
+using Umbraco.Cms.Api.Management.Services.Flags;
 using Umbraco.Cms.Api.Management.ViewModels.Tree;
 using Umbraco.Cms.Core.Cache;
 using Umbraco.Cms.Core.Security;
@@ -14,6 +16,7 @@ namespace Umbraco.Cms.Api.Management.Controllers.Document.Tree;
 [ApiVersion("1.0")]
 public class SiblingsDocumentTreeController : DocumentTreeControllerBase
 {
+    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 18.")]
     public SiblingsDocumentTreeController(
         IEntityService entityService,
         IUserStartNodeEntitiesService userStartNodeEntitiesService,
@@ -33,6 +36,28 @@ public class SiblingsDocumentTreeController : DocumentTreeControllerBase
     {
     }
 
+    [ActivatorUtilitiesConstructor]
+    public SiblingsDocumentTreeController(
+        IEntityService entityService,
+        FlagProviderCollection flagProviders,
+        IUserStartNodeEntitiesService userStartNodeEntitiesService,
+        IDataTypeService dataTypeService,
+        IPublicAccessService publicAccessService,
+        AppCaches appCaches,
+        IBackOfficeSecurityAccessor backofficeSecurityAccessor,
+        IDocumentPresentationFactory documentPresentationFactory)
+        : base(
+            entityService,
+            flagProviders,
+            userStartNodeEntitiesService,
+            dataTypeService,
+            publicAccessService,
+            appCaches,
+            backofficeSecurityAccessor,
+            documentPresentationFactory)
+    {
+    }
+
     [HttpGet("siblings")]
     [MapToApiVersion("1.0")]
     [ProducesResponseType(typeof(SubsetViewModel<DocumentTreeItemResponseModel>), StatusCodes.Status200OK)]

src/Umbraco.Cms.Api.Management/Controllers/Document/UpdateDomainsController.cs

@@ -1,13 +1,19 @@
-using Asp.Versioning;
+using Asp.Versioning;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Api.Management.Factories;
 using Umbraco.Cms.Api.Management.ViewModels.Document;
 using Umbraco.Cms.Core;
+using Umbraco.Cms.Core.Actions;
+using Umbraco.Cms.Core.DependencyInjection;
 using Umbraco.Cms.Core.Mapping;
 using Umbraco.Cms.Core.Models.ContentEditing;
+using Umbraco.Cms.Core.Security.Authorization;
 using Umbraco.Cms.Core.Services;
 using Umbraco.Cms.Core.Services.OperationStatus;
+using Umbraco.Cms.Web.Common.Authorization;
 using Umbraco.Extensions;
 
 namespace Umbraco.Cms.Api.Management.Controllers.Document;
@@ -15,17 +21,30 @@ namespace Umbraco.Cms.Api.Management.Controllers.Document;
 [ApiVersion("1.0")]
 public class UpdateDomainsController : DocumentControllerBase
 {
+    private readonly IAuthorizationService _authorizationService;
     private readonly IDomainService _domainService;
     private readonly IUmbracoMapper _umbracoMapper;
     private readonly IDomainPresentationFactory _domainPresentationFactory;
 
-    public UpdateDomainsController(IDomainService domainService, IUmbracoMapper umbracoMapper, IDomainPresentationFactory domainPresentationFactory)
+    [ActivatorUtilitiesConstructor]
+    public UpdateDomainsController(IAuthorizationService authorizationService, IDomainService domainService, IUmbracoMapper umbracoMapper, IDomainPresentationFactory domainPresentationFactory)
     {
+        _authorizationService = authorizationService;
         _domainService = domainService;
         _umbracoMapper = umbracoMapper;
         _domainPresentationFactory = domainPresentationFactory;
     }
 
+    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 18.")]
+    public UpdateDomainsController(IDomainService domainService, IUmbracoMapper umbracoMapper, IDomainPresentationFactory domainPresentationFactory)
+        : this(
+            StaticServiceProvider.Instance.GetRequiredService<IAuthorizationService>(),
+            domainService,
+            umbracoMapper,
+            domainPresentationFactory)
+    {
+    }
+
     [MapToApiVersion("1.0")]
     [HttpPut("{id:guid}/domains")]
     [ProducesResponseType(StatusCodes.Status200OK)]
@@ -37,6 +56,16 @@ public class UpdateDomainsController : DocumentControllerBase
         Guid id,
         UpdateDomainsRequestModel updateModel)
     {
+        AuthorizationResult authorizationResult = await _authorizationService.AuthorizeResourceAsync(
+            User,
+            ContentPermissionResource.WithKeys(ActionAssignDomain.ActionLetter, id),
+            AuthorizationPolicies.ContentPermissionByResource);
+
+        if (!authorizationResult.Succeeded)
+        {
+            return Forbidden();
+        }
+
         DomainsUpdateModel domainsUpdateModel = _umbracoMapper.Map<DomainsUpdateModel>(updateModel)!;
 
         Attempt<DomainUpdateResult, DomainOperationStatus> result = await _domainService.UpdateDomainsAsync(id, domainsUpdateModel);

src/Umbraco.Cms.Api.Management/Controllers/Document/UpdateNotificationsController.cs

@@ -1,33 +1,63 @@
 using Asp.Versioning;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Api.Management.ViewModels.Document;
+using Umbraco.Cms.Core.Actions;
+using Umbraco.Cms.Core.DependencyInjection;
 using Umbraco.Cms.Core.Models;
 using Umbraco.Cms.Core.Security;
+using Umbraco.Cms.Core.Security.Authorization;
 using Umbraco.Cms.Core.Services;
+using Umbraco.Cms.Web.Common.Authorization;
+using Umbraco.Extensions;
 
 namespace Umbraco.Cms.Api.Management.Controllers.Document;
 
 [ApiVersion("1.0")]
 public class UpdateNotificationsController : DocumentControllerBase
 {
+    private readonly IAuthorizationService _authorizationService;
     private readonly IContentEditingService _contentEditingService;
     private readonly INotificationService _notificationService;
     private readonly IBackOfficeSecurityAccessor _backOfficeSecurityAccessor;
 
-    public UpdateNotificationsController(IContentEditingService contentEditingService, INotificationService notificationService, IBackOfficeSecurityAccessor backOfficeSecurityAccessor)
+    [ActivatorUtilitiesConstructor]
+    public UpdateNotificationsController(IAuthorizationService authorizationService, IContentEditingService contentEditingService, INotificationService notificationService, IBackOfficeSecurityAccessor backOfficeSecurityAccessor)
     {
+        _authorizationService = authorizationService;
         _contentEditingService = contentEditingService;
         _notificationService = notificationService;
         _backOfficeSecurityAccessor = backOfficeSecurityAccessor;
     }
 
+    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 18.")]
+    public UpdateNotificationsController(IContentEditingService contentEditingService, INotificationService notificationService, IBackOfficeSecurityAccessor backOfficeSecurityAccessor)
+        : this(
+            StaticServiceProvider.Instance.GetRequiredService<IAuthorizationService>(),
+            contentEditingService,
+            notificationService,
+            backOfficeSecurityAccessor)
+    {
+    }
+
     [MapToApiVersion("1.0")]
     [HttpPut("{id:guid}/notifications")]
     [ProducesResponseType(StatusCodes.Status200OK)]
     [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status404NotFound)]
     public async Task<IActionResult> UpdateNotifications(CancellationToken cancellationToken, Guid id, UpdateDocumentNotificationsRequestModel updateModel)
     {
+        AuthorizationResult authorizationResult = await _authorizationService.AuthorizeResourceAsync(
+            User,
+            ContentPermissionResource.WithKeys(ActionBrowse.ActionLetter, id),
+            AuthorizationPolicies.ContentPermissionByResource);
+
+        if (!authorizationResult.Succeeded)
+        {
+            return Forbidden();
+        }
+
         IContent? content = await _contentEditingService.GetAsync(id);
         if (content == null)
         {

src/Umbraco.Cms.Api.Management/Controllers/DocumentBlueprint/Tree/AncestorsDocumentBlueprintTreeController.cs

@@ -1,7 +1,9 @@
 using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Api.Management.Factories;
+using Umbraco.Cms.Api.Management.Services.Flags;
 using Umbraco.Cms.Api.Management.ViewModels.Tree;
 using Umbraco.Cms.Core.Services;
 
@@ -10,11 +12,18 @@ namespace Umbraco.Cms.Api.Management.Controllers.DocumentBlueprint.Tree;
 [ApiVersion("1.0")]
 public class AncestorsDocumentBlueprintTreeController : DocumentBlueprintTreeControllerBase
 {
+    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 18.")]
     public AncestorsDocumentBlueprintTreeController(IEntityService entityService, IDocumentPresentationFactory documentPresentationFactory)
         : base(entityService, documentPresentationFactory)
     {
     }
 
+    [ActivatorUtilitiesConstructor]
+    public AncestorsDocumentBlueprintTreeController(IEntityService entityService, FlagProviderCollection flagProviders, IDocumentPresentationFactory documentPresentationFactory)
+    : base(entityService, flagProviders, documentPresentationFactory)
+    {
+    }
+
     [HttpGet("ancestors")]
     [MapToApiVersion("1.0")]
     [ProducesResponseType(typeof(IEnumerable<DocumentBlueprintTreeItemResponseModel>), StatusCodes.Status200OK)]

src/Umbraco.Cms.Api.Management/Controllers/DocumentBlueprint/Tree/ChildrenDocumentBlueprintTreeController.cs

@@ -1,8 +1,10 @@
-using Asp.Versioning;
+using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Api.Common.ViewModels.Pagination;
 using Umbraco.Cms.Api.Management.Factories;
+using Umbraco.Cms.Api.Management.Services.Flags;
 using Umbraco.Cms.Api.Management.ViewModels.Tree;
 using Umbraco.Cms.Core.Services;
 
@@ -11,11 +13,18 @@ namespace Umbraco.Cms.Api.Management.Controllers.DocumentBlueprint.Tree;
 [ApiVersion("1.0")]
 public class ChildrenDocumentBlueprintTreeController : DocumentBlueprintTreeControllerBase
 {
+    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 18.")]
     public ChildrenDocumentBlueprintTreeController(IEntityService entityService, IDocumentPresentationFactory documentPresentationFactory)
         : base(entityService, documentPresentationFactory)
     {
     }
 
+    [ActivatorUtilitiesConstructor]
+    public ChildrenDocumentBlueprintTreeController(IEntityService entityService, FlagProviderCollection flagProviders, IDocumentPresentationFactory documentPresentationFactory)
+        : base(entityService, flagProviders, documentPresentationFactory)
+    {
+    }
+
     [HttpGet("children")]
     [MapToApiVersion("1.0")]
     [ProducesResponseType(typeof(PagedViewModel<DocumentBlueprintTreeItemResponseModel>), StatusCodes.Status200OK)]

src/Umbraco.Cms.Api.Management/Controllers/DocumentBlueprint/Tree/DocumentBlueprintTreeControllerBase.cs

@@ -1,10 +1,13 @@
-using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Api.Management.Controllers.Tree;
 using Umbraco.Cms.Api.Management.Factories;
 using Umbraco.Cms.Api.Management.Routing;
+using Umbraco.Cms.Api.Management.Services.Flags;
 using Umbraco.Cms.Api.Management.ViewModels.Tree;
 using Umbraco.Cms.Core;
+using Umbraco.Cms.Core.DependencyInjection;
 using Umbraco.Cms.Core.Models;
 using Umbraco.Cms.Core.Models.Entities;
 using Umbraco.Cms.Core.Services;
@@ -19,8 +22,17 @@ public class DocumentBlueprintTreeControllerBase : FolderTreeControllerBase<Docu
 {
     private readonly IDocumentPresentationFactory _documentPresentationFactory;
 
+    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 18.")]
     public DocumentBlueprintTreeControllerBase(IEntityService entityService, IDocumentPresentationFactory documentPresentationFactory)
-        : base(entityService)
+        : this(
+              entityService,
+              StaticServiceProvider.Instance.GetRequiredService<FlagProviderCollection>(),
+              documentPresentationFactory)
+    {
+    }
+
+    public DocumentBlueprintTreeControllerBase(IEntityService entityService, FlagProviderCollection flagProviders, IDocumentPresentationFactory documentPresentationFactory)
+        : base(entityService, flagProviders)
         => _documentPresentationFactory = documentPresentationFactory;
 
     protected override UmbracoObjectTypes ItemObjectType => UmbracoObjectTypes.DocumentBlueprint;

src/Umbraco.Cms.Api.Management/Controllers/DocumentBlueprint/Tree/RootDocumentBlueprintTreeController.cs

@@ -1,8 +1,10 @@
-using Asp.Versioning;
+using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Api.Common.ViewModels.Pagination;
 using Umbraco.Cms.Api.Management.Factories;
+using Umbraco.Cms.Api.Management.Services.Flags;
 using Umbraco.Cms.Api.Management.ViewModels.Tree;
 using Umbraco.Cms.Core.Services;
 
@@ -11,11 +13,18 @@ namespace Umbraco.Cms.Api.Management.Controllers.DocumentBlueprint.Tree;
 [ApiVersion("1.0")]
 public class RootDocumentBlueprintTreeController : DocumentBlueprintTreeControllerBase
 {
+    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 18.")]
     public RootDocumentBlueprintTreeController(IEntityService entityService, IDocumentPresentationFactory documentPresentationFactory)
         : base(entityService, documentPresentationFactory)
     {
     }
 
+    [ActivatorUtilitiesConstructor]
+    public RootDocumentBlueprintTreeController(IEntityService entityService, FlagProviderCollection flagProviders, IDocumentPresentationFactory documentPresentationFactory)
+        : base(entityService, flagProviders, documentPresentationFactory)
+    {
+    }
+
     [HttpGet("root")]
     [MapToApiVersion("1.0")]
     [ProducesResponseType(typeof(PagedViewModel<DocumentBlueprintTreeItemResponseModel>), StatusCodes.Status200OK)]

src/Umbraco.Cms.Api.Management/Controllers/DocumentBlueprint/Tree/SiblingsDocumentBlueprintTreeController.cs

@@ -1,7 +1,9 @@
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Api.Common.ViewModels.Pagination;
 using Umbraco.Cms.Api.Management.Factories;
+using Umbraco.Cms.Api.Management.Services.Flags;
 using Umbraco.Cms.Api.Management.ViewModels.Tree;
 using Umbraco.Cms.Core.Services;
 
@@ -9,11 +11,18 @@ namespace Umbraco.Cms.Api.Management.Controllers.DocumentBlueprint.Tree;
 
 public class SiblingsDocumentBlueprintTreeController : DocumentBlueprintTreeControllerBase
 {
+    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 18.")]
     public SiblingsDocumentBlueprintTreeController(IEntityService entityService, IDocumentPresentationFactory documentPresentationFactory)
         : base(entityService, documentPresentationFactory)
     {
     }
 
+    [ActivatorUtilitiesConstructor]
+    public SiblingsDocumentBlueprintTreeController(IEntityService entityService, FlagProviderCollection flagProviders, IDocumentPresentationFactory documentPresentationFactory)
+        : base(entityService, flagProviders, documentPresentationFactory)
+    {
+    }
+
     [HttpGet("siblings")]
     [ProducesResponseType(typeof(SubsetViewModel<DocumentBlueprintTreeItemResponseModel>), StatusCodes.Status200OK)]
     public async Task<ActionResult<SubsetViewModel<DocumentBlueprintTreeItemResponseModel>>> Siblings(

src/Umbraco.Cms.Api.Management/Controllers/DocumentType/Tree/AncestorsDocumentTypeTreeController.cs

@@ -1,6 +1,8 @@
-using Asp.Versioning;
+using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
+using Umbraco.Cms.Api.Management.Services.Flags;
 using Umbraco.Cms.Api.Management.ViewModels.Tree;
 using Umbraco.Cms.Core.Services;
 
@@ -9,11 +11,18 @@ namespace Umbraco.Cms.Api.Management.Controllers.DocumentType.Tree;
 [ApiVersion("1.0")]
 public class AncestorsDocumentTypeTreeController : DocumentTypeTreeControllerBase
 {
+    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 18.")]
     public AncestorsDocumentTypeTreeController(IEntityService entityService, IContentTypeService contentTypeService)
         : base(entityService, contentTypeService)
     {
     }
 
+    [ActivatorUtilitiesConstructor]
+    public AncestorsDocumentTypeTreeController(IEntityService entityService, FlagProviderCollection flagProviders, IContentTypeService contentTypeService)
+        : base(entityService, flagProviders, contentTypeService)
+    {
+    }
+
     [HttpGet("ancestors")]
     [MapToApiVersion("1.0")]
     [ProducesResponseType(typeof(IEnumerable<DocumentTypeTreeItemResponseModel>), StatusCodes.Status200OK)]

src/Umbraco.Cms.Api.Management/Controllers/DocumentType/Tree/ChildrenDocumentTypeTreeController.cs

@@ -1,20 +1,29 @@
-using Asp.Versioning;
+using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
-using Umbraco.Cms.Core.Services;
+using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Api.Common.ViewModels.Pagination;
+using Umbraco.Cms.Api.Management.Services.Flags;
 using Umbraco.Cms.Api.Management.ViewModels.Tree;
+using Umbraco.Cms.Core.Services;
 
 namespace Umbraco.Cms.Api.Management.Controllers.DocumentType.Tree;
 
 [ApiVersion("1.0")]
 public class ChildrenDocumentTypeTreeController : DocumentTypeTreeControllerBase
 {
+    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 18.")]
     public ChildrenDocumentTypeTreeController(IEntityService entityService, IContentTypeService contentTypeService)
         : base(entityService, contentTypeService)
     {
     }
 
+    [ActivatorUtilitiesConstructor]
+    public ChildrenDocumentTypeTreeController(IEntityService entityService, FlagProviderCollection flagProviders, IContentTypeService contentTypeService)
+        : base(entityService, flagProviders, contentTypeService)
+    {
+    }
+
     [HttpGet("children")]
     [MapToApiVersion("1.0")]
     [ProducesResponseType(typeof(PagedViewModel<DocumentTypeTreeItemResponseModel>), StatusCodes.Status200OK)]

src/Umbraco.Cms.Api.Management/Controllers/DocumentType/Tree/DocumentTypeTreeControllerBase.cs

@@ -1,9 +1,12 @@
-using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Api.Management.Controllers.Tree;
 using Umbraco.Cms.Api.Management.Routing;
+using Umbraco.Cms.Api.Management.Services.Flags;
 using Umbraco.Cms.Api.Management.ViewModels.Tree;
 using Umbraco.Cms.Core;
+using Umbraco.Cms.Core.DependencyInjection;
 using Umbraco.Cms.Core.Models;
 using Umbraco.Cms.Core.Models.Entities;
 using Umbraco.Cms.Core.Services;
@@ -18,8 +21,17 @@ public class DocumentTypeTreeControllerBase : FolderTreeControllerBase<DocumentT
 {
     private readonly IContentTypeService _contentTypeService;
 
+    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 18.")]
     public DocumentTypeTreeControllerBase(IEntityService entityService, IContentTypeService contentTypeService)
-        : base(entityService) =>
+        : this(
+              entityService,
+              StaticServiceProvider.Instance.GetRequiredService<FlagProviderCollection>(),
+              contentTypeService)
+    {
+    }
+
+    public DocumentTypeTreeControllerBase(IEntityService entityService, FlagProviderCollection flagProviders, IContentTypeService contentTypeService)
+        : base(entityService, flagProviders) =>
         _contentTypeService = contentTypeService;
 
     protected override UmbracoObjectTypes ItemObjectType => UmbracoObjectTypes.DocumentType;

src/Umbraco.Cms.Api.Management/Controllers/DocumentType/Tree/RootDocumentTypeTreeController.cs

@@ -1,20 +1,29 @@
-using Asp.Versioning;
+using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
-using Umbraco.Cms.Core.Services;
+using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Api.Common.ViewModels.Pagination;
+using Umbraco.Cms.Api.Management.Services.Flags;
 using Umbraco.Cms.Api.Management.ViewModels.Tree;
+using Umbraco.Cms.Core.Services;
 
 namespace Umbraco.Cms.Api.Management.Controllers.DocumentType.Tree;
 
 [ApiVersion("1.0")]
 public class RootDocumentTypeTreeController : DocumentTypeTreeControllerBase
 {
+    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 18.")]
     public RootDocumentTypeTreeController(IEntityService entityService, IContentTypeService contentTypeService)
         : base(entityService, contentTypeService)
     {
     }
 
+    [ActivatorUtilitiesConstructor]
+    public RootDocumentTypeTreeController(IEntityService entityService, FlagProviderCollection flagProviders, IContentTypeService contentTypeService)
+        : base(entityService, flagProviders, contentTypeService)
+    {
+    }
+
     [HttpGet("root")]
     [MapToApiVersion("1.0")]
     [ProducesResponseType(typeof(PagedViewModel<DocumentTypeTreeItemResponseModel>), StatusCodes.Status200OK)]

src/Umbraco.Cms.Api.Management/Controllers/DocumentType/Tree/SiblingsDocumentTypeTreeController.cs

@@ -1,6 +1,8 @@
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Api.Common.ViewModels.Pagination;
+using Umbraco.Cms.Api.Management.Services.Flags;
 using Umbraco.Cms.Api.Management.ViewModels.Tree;
 using Umbraco.Cms.Core.Services;
 
@@ -8,11 +10,18 @@ namespace Umbraco.Cms.Api.Management.Controllers.DocumentType.Tree;
 
 public class SiblingsDocumentTypeTreeController : DocumentTypeTreeControllerBase
 {
+    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 18.")]
     public SiblingsDocumentTypeTreeController(IEntityService entityService, IContentTypeService contentTypeService)
         : base(entityService, contentTypeService)
     {
     }
 
+    [ActivatorUtilitiesConstructor]
+    public SiblingsDocumentTypeTreeController(IEntityService entityService, FlagProviderCollection flagProviders, IContentTypeService contentTypeService)
+        : base(entityService, flagProviders, contentTypeService)
+    {
+    }
+
     [HttpGet("siblings")]
     [ProducesResponseType(typeof(SubsetViewModel<DocumentTypeTreeItemResponseModel>), StatusCodes.Status200OK)]
     public async Task<ActionResult<SubsetViewModel<DocumentTypeTreeItemResponseModel>>> Siblings(

src/Umbraco.Cms.Api.Management/Controllers/Media/Collection/ByKeyMediaCollectionController.cs

@@ -1,10 +1,13 @@
 using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Api.Common.ViewModels.Pagination;
 using Umbraco.Cms.Api.Management.Factories;
+using Umbraco.Cms.Api.Management.Services.Flags;
 using Umbraco.Cms.Api.Management.ViewModels.Media.Collection;
 using Umbraco.Cms.Core;
+using Umbraco.Cms.Core.DependencyInjection;
 using Umbraco.Cms.Core.Mapping;
 using Umbraco.Cms.Core.Models;
 using Umbraco.Cms.Core.Security;
@@ -20,16 +23,33 @@ public class ByKeyMediaCollectionController : MediaCollectionControllerBase
     private readonly IBackOfficeSecurityAccessor _backOfficeSecurityAccessor;
     private readonly IMediaCollectionPresentationFactory _mediaCollectionPresentationFactory;
 
+    [ActivatorUtilitiesConstructor]
+    public ByKeyMediaCollectionController(
+        IMediaListViewService mediaListViewService,
+        IBackOfficeSecurityAccessor backOfficeSecurityAccessor,
+        IUmbracoMapper mapper,
+        IMediaCollectionPresentationFactory mediaCollectionPresentationFactory,
+        FlagProviderCollection flagProviders)
+        : base(mapper, flagProviders)
+    {
+        _mediaListViewService = mediaListViewService;
+        _backOfficeSecurityAccessor = backOfficeSecurityAccessor;
+        _mediaCollectionPresentationFactory = mediaCollectionPresentationFactory;
+    }
+
+    [Obsolete("Please use the constructor with all parameters. Scheduled to be removed in Umbraco 18")]
     public ByKeyMediaCollectionController(
         IMediaListViewService mediaListViewService,
         IBackOfficeSecurityAccessor backOfficeSecurityAccessor,
         IUmbracoMapper mapper,
         IMediaCollectionPresentationFactory mediaCollectionPresentationFactory)
-        : base(mapper)
+        : this(
+            mediaListViewService,
+            backOfficeSecurityAccessor,
+            mapper,
+            mediaCollectionPresentationFactory,
+            StaticServiceProvider.Instance.GetRequiredService<FlagProviderCollection>())
     {
-        _mediaListViewService = mediaListViewService;
-        _backOfficeSecurityAccessor = backOfficeSecurityAccessor;
-        _mediaCollectionPresentationFactory = mediaCollectionPresentationFactory;
     }
 
     [HttpGet]

src/Umbraco.Cms.Api.Management/Controllers/Media/Collection/MediaCollectionControllerBase.cs

@@ -1,10 +1,14 @@
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Api.Management.Controllers.Content;
 using Umbraco.Cms.Api.Management.Routing;
+using Umbraco.Cms.Api.Management.Services.Flags;
+using Umbraco.Cms.Api.Management.ViewModels.Document.Collection;
 using Umbraco.Cms.Api.Management.ViewModels.Media;
 using Umbraco.Cms.Api.Management.ViewModels.Media.Collection;
 using Umbraco.Cms.Core;
+using Umbraco.Cms.Core.DependencyInjection;
 using Umbraco.Cms.Core.Mapping;
 using Umbraco.Cms.Core.Models;
 using Umbraco.Cms.Core.Services.OperationStatus;
@@ -17,6 +21,12 @@ namespace Umbraco.Cms.Api.Management.Controllers.Media.Collection;
 [Authorize(Policy = AuthorizationPolicies.SectionAccessMedia)]
 public abstract class MediaCollectionControllerBase : ContentCollectionControllerBase<IMedia, MediaCollectionResponseModel, MediaValueResponseModel, MediaVariantResponseModel>
 {
+    protected MediaCollectionControllerBase(IUmbracoMapper mapper, FlagProviderCollection flagProviders)
+        : base(mapper, flagProviders)
+    {
+    }
+
+    [Obsolete("Please use the constructor with all parameters. Scheduled to be removed in Umbraco 18")]
     protected MediaCollectionControllerBase(IUmbracoMapper mapper)
         : base(mapper)
     {

src/Umbraco.Cms.Api.Management/Controllers/Media/Item/ItemMediaItemController.cs

@@ -1,8 +1,12 @@
 using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Api.Management.Factories;
+using Umbraco.Cms.Api.Management.Services.Flags;
+using Umbraco.Cms.Api.Management.ViewModels.Document.Item;
 using Umbraco.Cms.Api.Management.ViewModels.Media.Item;
+using Umbraco.Cms.Core.DependencyInjection;
 using Umbraco.Cms.Core.Mapping;
 using Umbraco.Cms.Core.Models;
 using Umbraco.Cms.Core.Models.Entities;
@@ -15,23 +19,35 @@ public class ItemMediaItemController : MediaItemControllerBase
 {
     private readonly IEntityService _entityService;
     private readonly IMediaPresentationFactory _mediaPresentationFactory;
+    private readonly FlagProviderCollection _flagProviders;
 
-    public ItemMediaItemController(IEntityService entityService, IMediaPresentationFactory mediaPresentationFactory)
+    [ActivatorUtilitiesConstructor]
+    public ItemMediaItemController(
+        IEntityService entityService,
+        IMediaPresentationFactory mediaPresentationFactory,
+        FlagProviderCollection flagProviders)
     {
         _entityService = entityService;
         _mediaPresentationFactory = mediaPresentationFactory;
+        _flagProviders = flagProviders;
+    }
+
+    [Obsolete("Please use the constructor with all parameters. Scheduled for removal in Umbraco 18")]
+    public ItemMediaItemController(IEntityService entityService, IMediaPresentationFactory mediaPresentationFactory)
+        : this(entityService, mediaPresentationFactory, StaticServiceProvider.Instance.GetRequiredService<FlagProviderCollection>())
+    {
     }
 
     [HttpGet]
     [MapToApiVersion("1.0")]
     [ProducesResponseType(typeof(IEnumerable<MediaItemResponseModel>), StatusCodes.Status200OK)]
-    public Task<IActionResult> Item(
+    public async Task<IActionResult> Item(
         CancellationToken cancellationToken,
         [FromQuery(Name = "id")] HashSet<Guid> ids)
     {
         if (ids.Count is 0)
         {
-            return Task.FromResult<IActionResult>(Ok(Enumerable.Empty<MediaItemResponseModel>()));
+            return Ok(Enumerable.Empty<MediaItemResponseModel>());
         }
 
         IEnumerable<IMediaEntitySlim> media = _entityService
@@ -39,6 +55,16 @@ public class ItemMediaItemController : MediaItemControllerBase
             .OfType<IMediaEntitySlim>();
 
         IEnumerable<MediaItemResponseModel> responseModels = media.Select(_mediaPresentationFactory.CreateItemResponseModel);
-        return Task.FromResult<IActionResult>(Ok(responseModels));
+        await PopulateFlags(responseModels);
+
+        return Ok(responseModels);
+    }
+
+    private async Task PopulateFlags(IEnumerable<MediaItemResponseModel> itemViewModels)
+    {
+        foreach (IFlagProvider signProvider in _flagProviders.Where(x => x.CanProvideFlags<DocumentItemResponseModel>()))
+        {
+            await signProvider.PopulateFlagsAsync(itemViewModels);
+        }
     }
 }

src/Umbraco.Cms.Api.Management/Controllers/Media/RecycleBin/SiblingsMediaRecycleBinController.cs

@@ -0,0 +1,24 @@
+using Asp.Versioning;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Umbraco.Cms.Api.Common.ViewModels.Pagination;
+using Umbraco.Cms.Api.Management.Factories;
+using Umbraco.Cms.Api.Management.ViewModels.Media.RecycleBin;
+using Umbraco.Cms.Core.Services;
+
+namespace Umbraco.Cms.Api.Management.Controllers.Media.RecycleBin;
+
+[ApiVersion("1.0")]
+public class SiblingsMediaRecycleBinController : MediaRecycleBinControllerBase
+{
+    public SiblingsMediaRecycleBinController(IEntityService entityService, IMediaPresentationFactory mediaPresentationFactory)
+        : base(entityService, mediaPresentationFactory)
+    {
+    }
+
+    [HttpGet("siblings")]
+    [MapToApiVersion("1.0")]
+    [ProducesResponseType(typeof(SubsetViewModel<MediaRecycleBinItemResponseModel>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<SubsetViewModel<MediaRecycleBinItemResponseModel>>> Siblings(CancellationToken cancellationToken, Guid target, int before, int after, Guid? dataTypeId = null)
+        => await GetSiblings(target, before, after);
+}

src/Umbraco.Cms.Api.Management/Controllers/Media/Tree/AncestorsMediaTreeController.cs

@@ -1,8 +1,10 @@
-using Asp.Versioning;
+using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Api.Management.Factories;
 using Umbraco.Cms.Api.Management.Services.Entities;
+using Umbraco.Cms.Api.Management.Services.Flags;
 using Umbraco.Cms.Api.Management.ViewModels.Tree;
 using Umbraco.Cms.Core.Cache;
 using Umbraco.Cms.Core.Security;
@@ -13,6 +15,7 @@ namespace Umbraco.Cms.Api.Management.Controllers.Media.Tree;
 [ApiVersion("1.0")]
 public class AncestorsMediaTreeController : MediaTreeControllerBase
 {
+    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 18.")]
     public AncestorsMediaTreeController(
         IEntityService entityService,
         IUserStartNodeEntitiesService userStartNodeEntitiesService,
@@ -24,6 +27,19 @@ public class AncestorsMediaTreeController : MediaTreeControllerBase
     {
     }
 
+    [ActivatorUtilitiesConstructor]
+    public AncestorsMediaTreeController(
+        IEntityService entityService,
+        FlagProviderCollection flagProviders,
+        IUserStartNodeEntitiesService userStartNodeEntitiesService,
+        IDataTypeService dataTypeService,
+        AppCaches appCaches,
+        IBackOfficeSecurityAccessor backofficeSecurityAccessor,
+        IMediaPresentationFactory mediaPresentationFactory)
+        : base(entityService, flagProviders, userStartNodeEntitiesService, dataTypeService, appCaches, backofficeSecurityAccessor, mediaPresentationFactory)
+    {
+    }
+
     [HttpGet("ancestors")]
     [MapToApiVersion("1.0")]
     [ProducesResponseType(typeof(IEnumerable<MediaTreeItemResponseModel>), StatusCodes.Status200OK)]

src/Umbraco.Cms.Api.Management/Controllers/Media/Tree/ChildrenMediaTreeController.cs

@@ -1,9 +1,11 @@
-using Asp.Versioning;
+using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Api.Common.ViewModels.Pagination;
 using Umbraco.Cms.Api.Management.Factories;
 using Umbraco.Cms.Api.Management.Services.Entities;
+using Umbraco.Cms.Api.Management.Services.Flags;
 using Umbraco.Cms.Api.Management.ViewModels.Tree;
 using Umbraco.Cms.Core.Cache;
 using Umbraco.Cms.Core.Security;
@@ -14,6 +16,7 @@ namespace Umbraco.Cms.Api.Management.Controllers.Media.Tree;
 [ApiVersion("1.0")]
 public class ChildrenMediaTreeController : MediaTreeControllerBase
 {
+    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 18.")]
     public ChildrenMediaTreeController(
         IEntityService entityService,
         IUserStartNodeEntitiesService userStartNodeEntitiesService,
@@ -25,6 +28,19 @@ public class ChildrenMediaTreeController : MediaTreeControllerBase
     {
     }
 
+    [ActivatorUtilitiesConstructor]
+    public ChildrenMediaTreeController(
+        IEntityService entityService,
+        FlagProviderCollection flagProviders,
+        IUserStartNodeEntitiesService userStartNodeEntitiesService,
+        IDataTypeService dataTypeService,
+        AppCaches appCaches,
+        IBackOfficeSecurityAccessor backofficeSecurityAccessor,
+        IMediaPresentationFactory mediaPresentationFactory)
+        : base(entityService, flagProviders, userStartNodeEntitiesService, dataTypeService, appCaches, backofficeSecurityAccessor, mediaPresentationFactory)
+    {
+    }
+
     [HttpGet("children")]
     [MapToApiVersion("1.0")]
     [ProducesResponseType(typeof(PagedViewModel<MediaTreeItemResponseModel>), StatusCodes.Status200OK)]

src/Umbraco.Cms.Api.Management/Controllers/Media/Tree/MediaTreeControllerBase.cs

@@ -1,12 +1,15 @@
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Api.Management.Controllers.Tree;
 using Umbraco.Cms.Api.Management.Factories;
 using Umbraco.Cms.Api.Management.Routing;
 using Umbraco.Cms.Api.Management.Services.Entities;
+using Umbraco.Cms.Api.Management.Services.Flags;
 using Umbraco.Cms.Api.Management.ViewModels.Tree;
 using Umbraco.Cms.Core;
 using Umbraco.Cms.Core.Cache;
+using Umbraco.Cms.Core.DependencyInjection;
 using Umbraco.Cms.Core.Models;
 using Umbraco.Cms.Core.Models.Entities;
 using Umbraco.Cms.Core.Security;
@@ -24,6 +27,7 @@ public class MediaTreeControllerBase : UserStartNodeTreeControllerBase<MediaTree
     private readonly IBackOfficeSecurityAccessor _backofficeSecurityAccessor;
     private readonly IMediaPresentationFactory _mediaPresentationFactory;
 
+    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 18.")]
     public MediaTreeControllerBase(
         IEntityService entityService,
         IUserStartNodeEntitiesService userStartNodeEntitiesService,
@@ -31,7 +35,27 @@ public class MediaTreeControllerBase : UserStartNodeTreeControllerBase<MediaTree
         AppCaches appCaches,
         IBackOfficeSecurityAccessor backofficeSecurityAccessor,
         IMediaPresentationFactory mediaPresentationFactory)
-        : base(entityService, userStartNodeEntitiesService, dataTypeService)
+        : this(
+              entityService,
+              StaticServiceProvider.Instance.GetRequiredService<FlagProviderCollection>(),
+              userStartNodeEntitiesService,
+              dataTypeService,
+              appCaches,
+              backofficeSecurityAccessor,
+              mediaPresentationFactory)
+    {
+    }
+
+    [ActivatorUtilitiesConstructor]
+    public MediaTreeControllerBase(
+        IEntityService entityService,
+        FlagProviderCollection flagProviders,
+        IUserStartNodeEntitiesService userStartNodeEntitiesService,
+        IDataTypeService dataTypeService,
+        AppCaches appCaches,
+        IBackOfficeSecurityAccessor backofficeSecurityAccessor,
+        IMediaPresentationFactory mediaPresentationFactory)
+        : base(entityService, flagProviders, userStartNodeEntitiesService, dataTypeService)
     {
         _appCaches = appCaches;
         _backofficeSecurityAccessor = backofficeSecurityAccessor;

src/Umbraco.Cms.Api.Management/Controllers/Media/Tree/RootMediaTreeController.cs

@@ -1,9 +1,11 @@
-using Asp.Versioning;
+using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Api.Common.ViewModels.Pagination;
 using Umbraco.Cms.Api.Management.Factories;
 using Umbraco.Cms.Api.Management.Services.Entities;
+using Umbraco.Cms.Api.Management.Services.Flags;
 using Umbraco.Cms.Api.Management.ViewModels.Tree;
 using Umbraco.Cms.Core.Cache;
 using Umbraco.Cms.Core.Security;
@@ -14,6 +16,7 @@ namespace Umbraco.Cms.Api.Management.Controllers.Media.Tree;
 [ApiVersion("1.0")]
 public class RootMediaTreeController : MediaTreeControllerBase
 {
+    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 18.")]
     public RootMediaTreeController(
         IEntityService entityService,
         IUserStartNodeEntitiesService userStartNodeEntitiesService,
@@ -25,6 +28,19 @@ public class RootMediaTreeController : MediaTreeControllerBase
     {
     }
 
+    [ActivatorUtilitiesConstructor]
+    public RootMediaTreeController(
+        IEntityService entityService,
+        FlagProviderCollection flagProviders,
+        IUserStartNodeEntitiesService userStartNodeEntitiesService,
+        IDataTypeService dataTypeService,
+        AppCaches appCaches,
+        IBackOfficeSecurityAccessor backofficeSecurityAccessor,
+        IMediaPresentationFactory mediaPresentationFactory)
+        : base(entityService, flagProviders, userStartNodeEntitiesService, dataTypeService, appCaches, backofficeSecurityAccessor, mediaPresentationFactory)
+    {
+    }
+
     [HttpGet("root")]
     [MapToApiVersion("1.0")]
     [ProducesResponseType(typeof(PagedViewModel<MediaTreeItemResponseModel>), StatusCodes.Status200OK)]

src/Umbraco.Cms.Api.Management/Controllers/Media/Tree/SiblingsMediaTreeController.cs

@@ -1,8 +1,10 @@
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Api.Common.ViewModels.Pagination;
 using Umbraco.Cms.Api.Management.Factories;
 using Umbraco.Cms.Api.Management.Services.Entities;
+using Umbraco.Cms.Api.Management.Services.Flags;
 using Umbraco.Cms.Api.Management.ViewModels.Tree;
 using Umbraco.Cms.Core.Cache;
 using Umbraco.Cms.Core.Security;
@@ -12,6 +14,7 @@ namespace Umbraco.Cms.Api.Management.Controllers.Media.Tree;
 
 public class SiblingsMediaTreeController : MediaTreeControllerBase
 {
+    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 18.")]
     public SiblingsMediaTreeController(
         IEntityService entityService,
         IUserStartNodeEntitiesService userStartNodeEntitiesService,
@@ -23,6 +26,19 @@ public class SiblingsMediaTreeController : MediaTreeControllerBase
     {
     }
 
+    [ActivatorUtilitiesConstructor]
+    public SiblingsMediaTreeController(
+        IEntityService entityService,
+        FlagProviderCollection flagProviders,
+        IUserStartNodeEntitiesService userStartNodeEntitiesService,
+        IDataTypeService dataTypeService,
+        AppCaches appCaches,
+        IBackOfficeSecurityAccessor backofficeSecurityAccessor,
+        IMediaPresentationFactory mediaPresentationFactory)
+        : base(entityService, flagProviders, userStartNodeEntitiesService, dataTypeService, appCaches, backofficeSecurityAccessor, mediaPresentationFactory)
+    {
+    }
+
     [HttpGet("siblings")]
     [ProducesResponseType(typeof(SubsetViewModel<MediaTreeItemResponseModel>), StatusCodes.Status200OK)]
     public async Task<ActionResult<SubsetViewModel<MediaTreeItemResponseModel>>> Siblings(CancellationToken cancellationToken, Guid target, int before, int after, Guid? dataTypeId = null)

src/Umbraco.Cms.Api.Management/Controllers/MediaType/Tree/AncestorsMediaTypeTreeController.cs

@@ -1,6 +1,8 @@
-using Asp.Versioning;
+using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
+using Umbraco.Cms.Api.Management.Services.Flags;
 using Umbraco.Cms.Api.Management.ViewModels.Tree;
 using Umbraco.Cms.Core.Services;
 
@@ -9,11 +11,18 @@ namespace Umbraco.Cms.Api.Management.Controllers.MediaType.Tree;
 [ApiVersion("1.0")]
 public class AncestorsMediaTypeTreeController : MediaTypeTreeControllerBase
 {
+    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 18.")]
     public AncestorsMediaTypeTreeController(IEntityService entityService, IMediaTypeService mediaTypeService)
         : base(entityService, mediaTypeService)
     {
     }
 
+    [ActivatorUtilitiesConstructor]
+    public AncestorsMediaTypeTreeController(IEntityService entityService, FlagProviderCollection flagProviders, IMediaTypeService mediaTypeService)
+        : base(entityService, flagProviders, mediaTypeService)
+    {
+    }
+
     [HttpGet("ancestors")]
     [MapToApiVersion("1.0")]
     [ProducesResponseType(typeof(IEnumerable<MediaTypeTreeItemResponseModel>), StatusCodes.Status200OK)]

src/Umbraco.Cms.Api.Management/Controllers/MediaType/Tree/ChildrenMediaTypeTreeController.cs

@@ -1,7 +1,9 @@
-using Asp.Versioning;
+using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Api.Common.ViewModels.Pagination;
+using Umbraco.Cms.Api.Management.Services.Flags;
 using Umbraco.Cms.Api.Management.ViewModels.Tree;
 using Umbraco.Cms.Core.Services;
 
@@ -10,11 +12,18 @@ namespace Umbraco.Cms.Api.Management.Controllers.MediaType.Tree;
 [ApiVersion("1.0")]
 public class ChildrenMediaTypeTreeController : MediaTypeTreeControllerBase
 {
+    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 18.")]
     public ChildrenMediaTypeTreeController(IEntityService entityService, IMediaTypeService mediaTypeService)
         : base(entityService, mediaTypeService)
     {
     }
 
+    [ActivatorUtilitiesConstructor]
+    public ChildrenMediaTypeTreeController(IEntityService entityService, FlagProviderCollection flagProviders, IMediaTypeService mediaTypeService)
+        : base(entityService, flagProviders, mediaTypeService)
+    {
+    }
+
     [HttpGet("children")]
     [MapToApiVersion("1.0")]
     [ProducesResponseType(typeof(PagedViewModel<MediaTypeTreeItemResponseModel>), StatusCodes.Status200OK)]

src/Umbraco.Cms.Api.Management/Controllers/MediaType/Tree/MediaTypeTreeControllerBase.cs

@@ -1,9 +1,12 @@
-using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Api.Management.Controllers.Tree;
 using Umbraco.Cms.Api.Management.Routing;
+using Umbraco.Cms.Api.Management.Services.Flags;
 using Umbraco.Cms.Api.Management.ViewModels.Tree;
 using Umbraco.Cms.Core;
+using Umbraco.Cms.Core.DependencyInjection;
 using Umbraco.Cms.Core.Models;
 using Umbraco.Cms.Core.Models.Entities;
 using Umbraco.Cms.Core.Services;
@@ -19,8 +22,17 @@ public class MediaTypeTreeControllerBase : FolderTreeControllerBase<MediaTypeTre
 {
     private readonly IMediaTypeService _mediaTypeService;
 
+    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 18.")]
     public MediaTypeTreeControllerBase(IEntityService entityService, IMediaTypeService mediaTypeService)
-        : base(entityService) =>
+        : this(
+            entityService,
+            StaticServiceProvider.Instance.GetRequiredService<FlagProviderCollection>(),
+            mediaTypeService)
+    {
+    }
+
+    public MediaTypeTreeControllerBase(IEntityService entityService, FlagProviderCollection flagProviders, IMediaTypeService mediaTypeService)
+        : base(entityService, flagProviders) =>
         _mediaTypeService = mediaTypeService;
 
     protected override UmbracoObjectTypes ItemObjectType => UmbracoObjectTypes.MediaType;

src/Umbraco.Cms.Api.Management/Controllers/MediaType/Tree/RootMediaTypeTreeController.cs

@@ -1,7 +1,9 @@
-using Asp.Versioning;
+using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Api.Common.ViewModels.Pagination;
+using Umbraco.Cms.Api.Management.Services.Flags;
 using Umbraco.Cms.Api.Management.ViewModels.Tree;
 using Umbraco.Cms.Core.Services;
 
@@ -10,11 +12,18 @@ namespace Umbraco.Cms.Api.Management.Controllers.MediaType.Tree;
 [ApiVersion("1.0")]
 public class RootMediaTypeTreeController : MediaTypeTreeControllerBase
 {
+    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 18.")]
     public RootMediaTypeTreeController(IEntityService entityService, IMediaTypeService mediaTypeService)
         : base(entityService, mediaTypeService)
     {
     }
 
+    [ActivatorUtilitiesConstructor]
+    public RootMediaTypeTreeController(IEntityService entityService, FlagProviderCollection flagProviders, IMediaTypeService mediaTypeService)
+        : base(entityService, flagProviders, mediaTypeService)
+    {
+    }
+
     [HttpGet("root")]
     [MapToApiVersion("1.0")]
     [ProducesResponseType(typeof(PagedViewModel<MediaTypeTreeItemResponseModel>), StatusCodes.Status200OK)]

src/Umbraco.Cms.Api.Management/Controllers/MediaType/Tree/SiblingsMediaTypeTreeController.cs

@@ -1,6 +1,8 @@
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Api.Common.ViewModels.Pagination;
+using Umbraco.Cms.Api.Management.Services.Flags;
 using Umbraco.Cms.Api.Management.ViewModels.Tree;
 using Umbraco.Cms.Core.Services;
 
@@ -8,11 +10,18 @@ namespace Umbraco.Cms.Api.Management.Controllers.MediaType.Tree;
 
 public class SiblingsMediaTypeTreeController : MediaTypeTreeControllerBase
 {
+    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 18.")]
     public SiblingsMediaTypeTreeController(IEntityService entityService, IMediaTypeService mediaTypeService)
         : base(entityService, mediaTypeService)
     {
     }
 
+    [ActivatorUtilitiesConstructor]
+    public SiblingsMediaTypeTreeController(IEntityService entityService, FlagProviderCollection flagProviders, IMediaTypeService mediaTypeService)
+        : base(entityService, flagProviders, mediaTypeService)
+    {
+    }
+
     [HttpGet("siblings")]
     [ProducesResponseType(typeof(SubsetViewModel<MediaTypeTreeItemResponseModel>), StatusCodes.Status200OK)]
     public async Task<ActionResult<SubsetViewModel<MediaTypeTreeItemResponseModel>>> Siblings(

src/Umbraco.Cms.Api.Management/Controllers/MemberGroup/Tree/MemberGroupTreeControllerBase.cs

@@ -1,7 +1,8 @@
-using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Umbraco.Cms.Api.Management.Controllers.Tree;
 using Umbraco.Cms.Api.Management.Routing;
+using Umbraco.Cms.Api.Management.Services.Flags;
 using Umbraco.Cms.Api.Management.ViewModels.Tree;
 using Umbraco.Cms.Core;
 using Umbraco.Cms.Core.Models;
@@ -15,10 +16,16 @@ namespace Umbraco.Cms.Api.Management.Controllers.MemberGroup.Tree;
 [Authorize(Policy = AuthorizationPolicies.TreeAccessMemberGroups)]
 public class MemberGroupTreeControllerBase : NamedEntityTreeControllerBase<NamedEntityTreeItemResponseModel>
 {
+    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 18.")]
     public MemberGroupTreeControllerBase(IEntityService entityService)
         : base(entityService)
     {
     }
 
+    public MemberGroupTreeControllerBase(IEntityService entityService, FlagProviderCollection flagProviders)
+        : base(entityService, flagProviders)
+    {
+    }
+
     protected override UmbracoObjectTypes ItemObjectType => UmbracoObjectTypes.MemberGroup;
 }

src/Umbraco.Cms.Api.Management/Controllers/MemberGroup/Tree/RootMemberGroupTreeController.cs

@@ -1,20 +1,29 @@
-using Asp.Versioning;
+using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
 using Umbraco.Cms.Core.Services;
 using Umbraco.Cms.Api.Common.ViewModels.Pagination;
 using Umbraco.Cms.Api.Management.ViewModels.Tree;
+using Umbraco.Cms.Api.Management.Services.Flags;
+using Microsoft.Extensions.DependencyInjection;
 
 namespace Umbraco.Cms.Api.Management.Controllers.MemberGroup.Tree;
 
 [ApiVersion("1.0")]
 public class RootMemberGroupTreeController : MemberGroupTreeControllerBase
 {
+    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 18.")]
     public RootMemberGroupTreeController(IEntityService entityService)
         : base(entityService)
     {
     }
 
+    [ActivatorUtilitiesConstructor]
+    public RootMemberGroupTreeController(IEntityService entityService, FlagProviderCollection flagProviders)
+        : base(entityService, flagProviders)
+    {
+    }
+
     [HttpGet("root")]
     [MapToApiVersion("1.0")]
     [ProducesResponseType(typeof(PagedViewModel<NamedEntityTreeItemResponseModel>), StatusCodes.Status200OK)]

src/Umbraco.Cms.Api.Management/Controllers/MemberType/Tree/MemberTypeTreeControllerBase.cs

@@ -1,9 +1,12 @@
-using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Api.Management.Controllers.Tree;
 using Umbraco.Cms.Api.Management.Routing;
+using Umbraco.Cms.Api.Management.Services.Flags;
 using Umbraco.Cms.Api.Management.ViewModels.Tree;
 using Umbraco.Cms.Core;
+using Umbraco.Cms.Core.DependencyInjection;
 using Umbraco.Cms.Core.Models;
 using Umbraco.Cms.Core.Models.Entities;
 using Umbraco.Cms.Core.Services;
@@ -18,10 +21,20 @@ public class MemberTypeTreeControllerBase : NamedEntityTreeControllerBase<Member
 {
     private readonly IMemberTypeService _memberTypeService;
 
+    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 18.")]
     public MemberTypeTreeControllerBase(IEntityService entityService, IMemberTypeService memberTypeService)
-        : base(entityService) =>
+        : this(
+              entityService,
+              StaticServiceProvider.Instance.GetRequiredService<FlagProviderCollection>(),
+              memberTypeService)
+    {
+    }
+
+    public MemberTypeTreeControllerBase(IEntityService entityService, FlagProviderCollection flagProviders, IMemberTypeService memberTypeService)
+        : base(entityService, flagProviders) =>
         _memberTypeService = memberTypeService;
 
+
     protected override UmbracoObjectTypes ItemObjectType => UmbracoObjectTypes.MemberType;
 
     protected override MemberTypeTreeItemResponseModel[] MapTreeItemViewModels(Guid? parentKey, IEntitySlim[] entities)

src/Umbraco.Cms.Api.Management/Controllers/MemberType/Tree/RootMemberTypeTreeController.cs

@@ -1,20 +1,29 @@
-using Asp.Versioning;
+using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
-using Umbraco.Cms.Core.Services;
+using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Api.Common.ViewModels.Pagination;
+using Umbraco.Cms.Api.Management.Services.Flags;
 using Umbraco.Cms.Api.Management.ViewModels.Tree;
+using Umbraco.Cms.Core.Services;
 
 namespace Umbraco.Cms.Api.Management.Controllers.MemberType.Tree;
 
 [ApiVersion("1.0")]
 public class RootMemberTypeTreeController : MemberTypeTreeControllerBase
 {
+    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 18.")]
     public RootMemberTypeTreeController(IEntityService entityService, IMemberTypeService memberTypeService)
         : base(entityService, memberTypeService)
     {
     }
 
+    [ActivatorUtilitiesConstructor]
+    public RootMemberTypeTreeController(IEntityService entityService, FlagProviderCollection flagProviders, IMemberTypeService memberTypeService)
+        : base(entityService, flagProviders, memberTypeService)
+    {
+    }
+
     [HttpGet("root")]
     [MapToApiVersion("1.0")]
     [ProducesResponseType(typeof(PagedViewModel<MemberTypeTreeItemResponseModel>), StatusCodes.Status200OK)]

src/Umbraco.Cms.Api.Management/Controllers/MemberType/Tree/SiblingMemberTypeTreeController.cs

@@ -0,0 +1,28 @@
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Umbraco.Cms.Api.Common.ViewModels.Pagination;
+using Umbraco.Cms.Api.Management.Services.Flags;
+using Umbraco.Cms.Api.Management.ViewModels.Tree;
+using Umbraco.Cms.Core.Services;
+
+namespace Umbraco.Cms.Api.Management.Controllers.MemberType.Tree;
+
+public class SiblingMemberTypeTreeController : MemberTypeTreeControllerBase
+{
+    public SiblingMemberTypeTreeController(
+        IEntityService entityService,
+        FlagProviderCollection flagProviders,
+        IMemberTypeService memberTypeService)
+        : base(entityService, flagProviders, memberTypeService)
+    {
+    }
+
+    [HttpGet("siblings")]
+    [ProducesResponseType(typeof(SubsetViewModel<MemberTypeTreeItemResponseModel>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<SubsetViewModel<MemberTypeTreeItemResponseModel>>> Siblings(
+        CancellationToken cancellationToken,
+        Guid target,
+        int before,
+        int after)
+        => await GetSiblings(target, before, after);
+}

src/Umbraco.Cms.Api.Management/Controllers/PartialView/Tree/AncestorsPartialViewTreeController.cs

@@ -1,6 +1,8 @@
-using Asp.Versioning;
+using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
+using Umbraco.Cms.Api.Management.Services.FileSystem;
 using Umbraco.Cms.Api.Management.ViewModels.Tree;
 using Umbraco.Cms.Core.IO;
 
@@ -9,6 +11,20 @@ namespace Umbraco.Cms.Api.Management.Controllers.PartialView.Tree;
 [ApiVersion("1.0")]
 public class AncestorsPartialViewTreeController : PartialViewTreeControllerBase
 {
+    // TODO Remove the static service provider, and replace with base when the other constructors are obsoleted.
+    [ActivatorUtilitiesConstructor]
+    public AncestorsPartialViewTreeController(IPartialViewTreeService partialViewTreeService)
+        : base(partialViewTreeService)
+    {
+    }
+
+    [Obsolete("Please use the constructor taking all parameters. Scheduled to be removed in Umbraco 19.")]
+    public AncestorsPartialViewTreeController(IPartialViewTreeService partialViewTreeService, FileSystems fileSystems)
+        : base(partialViewTreeService, fileSystems)
+    {
+    }
+
+    [Obsolete("Please use the constructor taking all parameters. Scheduled to be removed in Umbraco 19.")]
     public AncestorsPartialViewTreeController(FileSystems fileSystems)
         : base(fileSystems)
     {

src/Umbraco.Cms.Api.Management/Controllers/PartialView/Tree/ChildrenPartialViewTreeController.cs

@@ -1,15 +1,31 @@
-using Asp.Versioning;
+using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
-using Umbraco.Cms.Core.IO;
+using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Api.Common.ViewModels.Pagination;
+using Umbraco.Cms.Api.Management.Services.FileSystem;
 using Umbraco.Cms.Api.Management.ViewModels.Tree;
+using Umbraco.Cms.Core.IO;
 
 namespace Umbraco.Cms.Api.Management.Controllers.PartialView.Tree;
 
 [ApiVersion("1.0")]
 public class ChildrenPartialViewTreeController : PartialViewTreeControllerBase
 {
+    // TODO Remove the static service provider, and replace with base when the other constructors are obsoleted.
+    [ActivatorUtilitiesConstructor]
+    public ChildrenPartialViewTreeController(IPartialViewTreeService partialViewTreeService)
+        : base(partialViewTreeService)
+    {
+    }
+
+    [Obsolete("Please use the constructor taking all parameters. Scheduled to be removed in Umbraco 19.")]
+    public ChildrenPartialViewTreeController(IPartialViewTreeService partialViewTreeService, FileSystems fileSystems)
+        : base(partialViewTreeService, fileSystems)
+    {
+    }
+
+    [Obsolete("Please use the constructor taking all parameters. Scheduled to be removed in Umbraco 19.")]
     public ChildrenPartialViewTreeController(FileSystems fileSystems)
         : base(fileSystems)
     {

src/Umbraco.Cms.Api.Management/Controllers/PartialView/Tree/PartialViewTreeControllerBase.cs

@@ -1,7 +1,8 @@
-using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Umbraco.Cms.Api.Management.Controllers.Tree;
 using Umbraco.Cms.Api.Management.Routing;
+using Umbraco.Cms.Api.Management.Services.FileSystem;
 using Umbraco.Cms.Core;
 using Umbraco.Cms.Core.IO;
 using Umbraco.Cms.Web.Common.Authorization;
@@ -13,9 +14,28 @@ namespace Umbraco.Cms.Api.Management.Controllers.PartialView.Tree;
 [Authorize(Policy = AuthorizationPolicies.TreeAccessPartialViews)]
 public class PartialViewTreeControllerBase : FileSystemTreeControllerBase
 {
-    public PartialViewTreeControllerBase(FileSystems fileSystems)
-        => FileSystem = fileSystems.PartialViewsFileSystem ??
-                        throw new ArgumentException("Missing partial views file system", nameof(fileSystems));
+    // TODO Remove the static service provider, and replace with base when the other constructors are obsoleted.
+    public PartialViewTreeControllerBase(IPartialViewTreeService partialViewTreeService)
+        : base(partialViewTreeService)
+    {
+        FileSystem = null!;
+    }
 
+    // FileSystem is required therefore, we can't remove it without some wizardry. When obsoletion is due, remove this.
+    [Obsolete("Please use the constructor taking all parameters. Scheduled to be removed in Umbraco 19.")]
+    public PartialViewTreeControllerBase(IPartialViewTreeService partialViewTreeService, FileSystems fileSystems)
+        : base(partialViewTreeService)
+    {
+        FileSystem = fileSystems.PartialViewsFileSystem ??
+                     throw new ArgumentException("Missing scripts file system", nameof(fileSystems));
+    }
+
+    [Obsolete("Please use the constructor taking all parameters. Scheduled to be removed in Umbraco 19.")]
+    public PartialViewTreeControllerBase(FileSystems fileSystems)
+        : base()
+        => FileSystem = fileSystems.PartialViewsFileSystem ??
+                        throw new ArgumentException("Missing scripts file system", nameof(fileSystems));
+
+    [Obsolete("Included in the service class. Scheduled to be removed in Umbraco 19.")]
     protected override IFileSystem FileSystem { get; }
 }

src/Umbraco.Cms.Api.Management/Controllers/PartialView/Tree/RootPartialViewTreeController.cs

@@ -1,15 +1,31 @@
-using Asp.Versioning;
+using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
-using Umbraco.Cms.Core.IO;
+using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Api.Common.ViewModels.Pagination;
+using Umbraco.Cms.Api.Management.Services.FileSystem;
 using Umbraco.Cms.Api.Management.ViewModels.Tree;
+using Umbraco.Cms.Core.IO;
 
 namespace Umbraco.Cms.Api.Management.Controllers.PartialView.Tree;
 
 [ApiVersion("1.0")]
 public class RootPartialViewTreeController : PartialViewTreeControllerBase
 {
+    // TODO Remove the static service provider, and replace with base when the other constructors are obsoleted.
+    [ActivatorUtilitiesConstructor]
+    public RootPartialViewTreeController(IPartialViewTreeService partialViewTreeService)
+        : base(partialViewTreeService)
+    {
+    }
+
+    [Obsolete("Please use the constructor taking all parameters. Scheduled to be removed in Umbraco 19.")]
+    public RootPartialViewTreeController(IPartialViewTreeService partialViewTreeService, FileSystems fileSystems)
+        : base(partialViewTreeService, fileSystems)
+    {
+    }
+
+    [Obsolete("Please use the constructor taking all parameters. Scheduled to be removed in Umbraco 19.")]
     public RootPartialViewTreeController(FileSystems fileSystems)
         : base(fileSystems)
     {

src/Umbraco.Cms.Api.Management/Controllers/PartialView/Tree/SiblingsPartialViewTreeController.cs

@@ -0,0 +1,40 @@
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
+using Umbraco.Cms.Api.Common.ViewModels.Pagination;
+using Umbraco.Cms.Api.Management.Services.FileSystem;
+using Umbraco.Cms.Api.Management.ViewModels.Tree;
+using Umbraco.Cms.Core.IO;
+
+namespace Umbraco.Cms.Api.Management.Controllers.PartialView.Tree;
+
+public class SiblingsPartialViewTreeController : PartialViewTreeControllerBase
+{
+    // TODO Remove the static service provider, and replace with base when the other constructors are obsoleted.
+    [ActivatorUtilitiesConstructor]
+    public SiblingsPartialViewTreeController(IPartialViewTreeService partialViewTreeService)
+        : base(partialViewTreeService)
+    {
+    }
+
+    [Obsolete("Please use the constructor taking all parameters. Scheduled to be removed in Umbraco 19.")]
+    public SiblingsPartialViewTreeController(IPartialViewTreeService partialViewTreeService, FileSystems fileSystems)
+        : base(partialViewTreeService, fileSystems)
+    {
+    }
+
+    [Obsolete("Please use the constructor taking all parameters. Scheduled to be removed in Umbraco 19.")]
+    public SiblingsPartialViewTreeController(FileSystems fileSystems)
+        : base(fileSystems)
+    {
+    }
+
+    [HttpGet("siblings")]
+    [ProducesResponseType(typeof(SubsetViewModel<FileSystemTreeItemPresentationModel>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<SubsetViewModel<FileSystemTreeItemPresentationModel>>> Siblings(
+        CancellationToken cancellationToken,
+        string path,
+        int before,
+        int after)
+        => await GetSiblings(path, before, after);
+}

src/Umbraco.Cms.Api.Management/Controllers/RecycleBin/RecycleBinControllerBase.cs

@@ -4,6 +4,7 @@ using Umbraco.Cms.Api.Common.ViewModels.Pagination;
 using Umbraco.Cms.Api.Management.Controllers.Content;
 using Umbraco.Cms.Api.Management.ViewModels.Item;
 using Umbraco.Cms.Api.Management.ViewModels.RecycleBin;
+using Umbraco.Cms.Core;
 using Umbraco.Cms.Core.Models;
 using Umbraco.Cms.Core.Models.Entities;
 using Umbraco.Cms.Core.Services;
@@ -45,6 +46,24 @@ public abstract class RecycleBinControllerBase<TItem> : ContentControllerBase
         return Task.FromResult<ActionResult<PagedViewModel<TItem>>>(Ok(result));
     }
 
+    protected async Task<ActionResult<SubsetViewModel<TItem>>> GetSiblings(Guid target, int before, int after)
+    {
+        IEntitySlim[] siblings = GetSiblingEntities(target, before, after, out var totalBefore, out var totalAfter);
+        if (siblings.Length == 0)
+        {
+            return NotFound();
+        }
+
+        IEntitySlim entity = siblings.First();
+        Guid? parentKey = GetParentKey(entity);
+
+        TItem[] treeItemViewModels = MapRecycleBinViewModels(parentKey, siblings);
+
+        SubsetViewModel<TItem> result = SubsetViewModel(treeItemViewModels, totalBefore, totalAfter);
+
+        return Ok(result);
+    }
+
     protected virtual TItem MapRecycleBinViewModel(Guid? parentKey, IEntitySlim entity)
     {
         if (entity == null)
@@ -136,4 +155,27 @@ public abstract class RecycleBinControllerBase<TItem> : ContentControllerBase
 
     private PagedViewModel<TItem> PagedViewModel(IEnumerable<TItem> treeItemViewModels, long totalItems)
         => new() { Total = totalItems, Items = treeItemViewModels };
+
+    protected SubsetViewModel<TItem> SubsetViewModel(IEnumerable<TItem> treeItemViewModels, long totalBefore, long totalAfter)
+        => new() { TotalBefore = totalBefore, TotalAfter = totalAfter, Items = treeItemViewModels };
+
+    protected virtual IEntitySlim[] GetSiblingEntities(Guid target, int before, int after, out long totalBefore, out long totalAfter) =>
+        _entityService
+            .GetTrashedSiblings(
+                target,
+                [ItemObjectType],
+                before,
+                after,
+                out totalBefore,
+                out totalAfter,
+                ordering: Ordering.By(nameof(Infrastructure.Persistence.Dtos.NodeDto.Text)))
+            .ToArray();
+
+    /// <summary>
+    /// Gets the parent key for an entity, or root if null or no parent.
+    /// </summary>
+    protected virtual Guid? GetParentKey(IEntitySlim entity) =>
+        entity.ParentId > 0
+            ? _entityService.GetKey(entity.ParentId, ItemObjectType).Result
+            : Constants.System.RootKey;
 }

src/Umbraco.Cms.Api.Management/Controllers/Script/Tree/AncestorsScriptTreeController.cs

@@ -1,6 +1,8 @@
-using Asp.Versioning;
+using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
+using Umbraco.Cms.Api.Management.Services.FileSystem;
 using Umbraco.Cms.Api.Management.ViewModels.Tree;
 using Umbraco.Cms.Core.IO;
 
@@ -9,6 +11,20 @@ namespace Umbraco.Cms.Api.Management.Controllers.Script.Tree;
 [ApiVersion("1.0")]
 public class AncestorsScriptTreeController : ScriptTreeControllerBase
 {
+    // TODO Remove the static service provider, and replace with base when the other constructors are obsoleted.
+    [ActivatorUtilitiesConstructor]
+    public AncestorsScriptTreeController(IScriptTreeService scriptTreeService)
+        : base(scriptTreeService)
+    {
+    }
+
+    [Obsolete("Please use the constructor taking all parameters. Scheduled to be removed in Umbraco 19.")]
+    public AncestorsScriptTreeController(IScriptTreeService scriptTreeService, FileSystems fileSystems)
+        : base(scriptTreeService, fileSystems)
+    {
+    }
+
+    [Obsolete("Please use the constructor taking all parameters. Scheduled to be removed in Umbraco 19.")]
     public AncestorsScriptTreeController(FileSystems fileSystems)
         : base(fileSystems)
     {

src/Umbraco.Cms.Api.Management/Controllers/Script/Tree/ChildrenScriptTreeController.cs

@@ -1,15 +1,31 @@
-using Asp.Versioning;
+using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
-using Umbraco.Cms.Core.IO;
+using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Api.Common.ViewModels.Pagination;
+using Umbraco.Cms.Api.Management.Services.FileSystem;
 using Umbraco.Cms.Api.Management.ViewModels.Tree;
+using Umbraco.Cms.Core.IO;
 
 namespace Umbraco.Cms.Api.Management.Controllers.Script.Tree;
 
 [ApiVersion("1.0")]
 public class ChildrenScriptTreeController : ScriptTreeControllerBase
 {
+    // TODO Remove the static service provider, and replace with base when the other constructors are obsoleted.
+    [ActivatorUtilitiesConstructor]
+    public ChildrenScriptTreeController(IScriptTreeService scriptTreeService)
+        : base(scriptTreeService)
+    {
+    }
+
+    [Obsolete("Please use the constructor taking all parameters. Scheduled to be removed in Umbraco 19.")]
+    public ChildrenScriptTreeController(IScriptTreeService scriptTreeService, FileSystems fileSystems)
+        : base(scriptTreeService, fileSystems)
+    {
+    }
+
+    [Obsolete("Please use the constructor taking all parameters. Scheduled to be removed in Umbraco 19.")]
     public ChildrenScriptTreeController(FileSystems fileSystems)
         : base(fileSystems)
     {

src/Umbraco.Cms.Api.Management/Controllers/Script/Tree/RootScriptTreeController.cs

@@ -1,15 +1,31 @@
-using Asp.Versioning;
+using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
-using Umbraco.Cms.Core.IO;
+using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Api.Common.ViewModels.Pagination;
+using Umbraco.Cms.Api.Management.Services.FileSystem;
 using Umbraco.Cms.Api.Management.ViewModels.Tree;
+using Umbraco.Cms.Core.IO;
 
 namespace Umbraco.Cms.Api.Management.Controllers.Script.Tree;
 
 [ApiVersion("1.0")]
 public class RootScriptTreeController : ScriptTreeControllerBase
 {
+    // TODO Remove the static service provider, and replace with base when the other constructors are obsoleted.
+    [ActivatorUtilitiesConstructor]
+    public RootScriptTreeController(IScriptTreeService scriptTreeService)
+        : base(scriptTreeService)
+    {
+    }
+
+    [Obsolete("Please use the constructor taking all parameters. Scheduled to be removed in Umbraco 19.")]
+    public RootScriptTreeController(IScriptTreeService scriptTreeService, FileSystems fileSystems)
+        : base(scriptTreeService, fileSystems)
+    {
+    }
+
+    [Obsolete("Please use the constructor taking all parameters. Scheduled to be removed in Umbraco 19.")]
     public RootScriptTreeController(FileSystems fileSystems)
         : base(fileSystems)
     {

src/Umbraco.Cms.Api.Management/Controllers/Script/Tree/ScriptTreeControllerBase.cs

@@ -1,7 +1,8 @@
-using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Umbraco.Cms.Api.Management.Controllers.Tree;
 using Umbraco.Cms.Api.Management.Routing;
+using Umbraco.Cms.Api.Management.Services.FileSystem;
 using Umbraco.Cms.Core;
 using Umbraco.Cms.Core.IO;
 using Umbraco.Cms.Web.Common.Authorization;
@@ -13,9 +14,28 @@ namespace Umbraco.Cms.Api.Management.Controllers.Script.Tree;
 [Authorize(Policy = AuthorizationPolicies.TreeAccessScripts)]
 public class ScriptTreeControllerBase : FileSystemTreeControllerBase
 {
+    // TODO Remove the static service provider, and replace with base when the other constructors are obsoleted.
+    public ScriptTreeControllerBase(IScriptTreeService scriptTreeService)
+        : base(scriptTreeService)
+    {
+        FileSystem = null!;
+    }
+
+    // FileSystem is required therefore, we can't remove it without some wizardry. When obsoletion is due, remove this.
+    [Obsolete("Please use the constructor taking all parameters. Scheduled to be removed in Umbraco 19.")]
+    public ScriptTreeControllerBase(IScriptTreeService scriptTreeService, FileSystems fileSystems)
+        : base(scriptTreeService)
+    {
+        FileSystem = fileSystems.ScriptsFileSystem ??
+                     throw new ArgumentException("Missing scripts file system", nameof(fileSystems));
+    }
+
+    [Obsolete("Please use the constructor taking all parameters. Scheduled to be removed in Umbraco 19.")]
     public ScriptTreeControllerBase(FileSystems fileSystems)
+        : base()
         => FileSystem = fileSystems.ScriptsFileSystem ??
                         throw new ArgumentException("Missing scripts file system", nameof(fileSystems));
 
+    [Obsolete("Included in the service class. Scheduled to be removed in Umbraco 19.")]
     protected override IFileSystem FileSystem { get; }
 }

src/Umbraco.Cms.Api.Management/Controllers/Script/Tree/SiblingsScriptTreeController.cs

@@ -0,0 +1,40 @@
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
+using Umbraco.Cms.Api.Common.ViewModels.Pagination;
+using Umbraco.Cms.Api.Management.Services.FileSystem;
+using Umbraco.Cms.Api.Management.ViewModels.Tree;
+using Umbraco.Cms.Core.IO;
+
+namespace Umbraco.Cms.Api.Management.Controllers.Script.Tree;
+
+public class SiblingsScriptTreeController : ScriptTreeControllerBase
+{
+    // TODO Remove the static service provider, and replace with base when the other constructors are obsoleted.
+    [ActivatorUtilitiesConstructor]
+    public SiblingsScriptTreeController(IScriptTreeService scriptTreeService)
+        : base(scriptTreeService)
+    {
+    }
+
+    [Obsolete("Please use the constructor taking all parameters. Scheduled to be removed in Umbraco 19.")]
+    public SiblingsScriptTreeController(IScriptTreeService scriptTreeService, FileSystems fileSystems)
+        : base(scriptTreeService, fileSystems)
+    {
+    }
+
+    [Obsolete("Please use the constructor taking all parameters. Scheduled to be removed in Umbraco 19.")]
+    public SiblingsScriptTreeController(FileSystems fileSystems)
+        : base(fileSystems)
+    {
+    }
+
+    [HttpGet("siblings")]
+    [ProducesResponseType(typeof(SubsetViewModel<FileSystemTreeItemPresentationModel>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<SubsetViewModel<FileSystemTreeItemPresentationModel>>> Siblings(
+        CancellationToken cancellationToken,
+        string path,
+        int before,
+        int after)
+        => await GetSiblings(path, before, after);
+}

src/Umbraco.Cms.Api.Management/Controllers/StaticFile/Tree/AncestorsStaticFileTreeController.cs

@@ -1,6 +1,8 @@
-using Asp.Versioning;
+using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
+using Umbraco.Cms.Api.Management.Services.FileSystem;
 using Umbraco.Cms.Api.Management.ViewModels.Tree;
 using Umbraco.Cms.Core.IO;
 
@@ -9,11 +11,18 @@ namespace Umbraco.Cms.Api.Management.Controllers.StaticFile.Tree;
 [ApiVersion("1.0")]
 public class AncestorsStaticFileTreeController : StaticFileTreeControllerBase
 {
+    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 18.")]
     public AncestorsStaticFileTreeController(IPhysicalFileSystem physicalFileSystem)
         : base(physicalFileSystem)
     {
     }
 
+    [ActivatorUtilitiesConstructor]
+    public AncestorsStaticFileTreeController(IPhysicalFileSystem physicalFileSystem, IPhysicalFileSystemTreeService fileSystemTreeService)
+        : base(physicalFileSystem, fileSystemTreeService)
+    {
+    }
+
     [HttpGet("ancestors")]
     [MapToApiVersion("1.0")]
     [ProducesResponseType(typeof(IEnumerable<FileSystemTreeItemPresentationModel>), StatusCodes.Status200OK)]