Build: Updated nightly E2E test pipeline schedule in v16 (#22805)

Updated nightly E2E test pipeline schedule

.github/BUILD.md

@@ -9,7 +9,7 @@ In order to use Umbraco as a CMS and build your website with it, you should not
 -   Are you about to [create a pull request for Umbraco][contribution guidelines]?
 -   Are you trying to get to the bottom of a problem in your existing Umbraco installation?
 
-If the answer is yes, please read on. Otherwise, make sure to head on over [to the releases page](https://releases.umbraco.com) and start using Umbraco CMS as intended.
+If the answer is yes, please read on. Otherwise, make sure to head on over [to the download page](https://our.umbraco.com/download) and start using Umbraco CMS as intended.
 
 ## Table of contents
 
@@ -79,12 +79,13 @@ Conversely, if you are working on front-end only, you want to build the back-end
 "AuthorizeCallbackLogoutPathName": "/logout",
 "AuthorizeCallbackErrorPathName": "/error",
 "BackOfficeTokenCookie": {
+  "Enabled": true,
   "SameSite": "None"
 }
 ```
 
 > [!NOTE]
-> If you get stuck in a login loop, try clearing your browser cookies for localhost, and make sure that the `Umbraco:Cms:Security:BackOfficeTokenCookie:SameSite` setting is set to `None`.
+> If you get stuck in a login loop, try clearing your browser cookies for localhost, and make sure that the `BackOfficeTokenCookie` settings are correct. Namely, that `SameSite` should be set to `None` when running the front-end server separately.
 
 Then run Umbraco from the command line.
 

.github/README.md

@@ -38,6 +38,14 @@ Some important documentation links to get you started:
 - [Getting to know Umbraco](https://docs.umbraco.com/umbraco-cms/fundamentals/get-to-know-umbraco)
 - [Tutorials for creating a basic website and customizing the editing experience](https://docs.umbraco.com/umbraco-cms/tutorials/overview)
 
+## Backoffice Preview
+
+Want to see the latest backoffice UI in action? Check out our live preview:
+
+**[backofficepreview.umbraco.com](https://backofficepreview.umbraco.com/)**
+
+This preview is automatically deployed from the main branch and showcases the latest backoffice features and improvements.  It runs from mock data and persistent edits are not supported.
+
 ## Get help
 
 If you need a bit of feedback while building your Umbraco projects, we are [chatty on Discord](https://discord.umbraco.com). Our Discord server serves as a social space for all Umbracians. If you have any questions or need some help with a problem, head over to our [dedicated forum](https://forum.umbraco.com/) where the Umbraco Community will be happy to help. 

.github/contributing-first-issue.md

@@ -79,7 +79,7 @@ You can get in touch with [the core contributors team][core collabs] in multiple
 
 - If there's an existing issue on the issue tracker then that's a good place to leave questions and discuss how to start or move forward.
 - If you want to ask questions on some code you've already written you can create a draft pull request, [detailed in a GitHub blog post][draft prs].
-- Unsure where to start? Did something not work as expected? Try leaving a note in the [forum][forum]. The team monitors that one closely, so one of us will be on hand and ready to point you in the right direction.
+- Unsure where to start? Did something not work as expected? Try leaving a note in the ["Contributing to Umbraco"][contrib forum] forum. The team monitors that one closely, so one of us will be on hand and ready to point you in the right direction.
 
 
   <!-- Local -->
@@ -90,7 +90,7 @@ You can get in touch with [the core contributors team][core collabs] in multiple
 
 [sync fork ext]: http://robots.thoughtbot.com/post/5133345960/keeping-a-git-fork-updated	"Details on keeping a git fork updated"
 [draft prs]: https://github.blog/2019-02-14-introducing-draft-pull-requests/	"Github's blog post providing details on draft pull requests"
-[forum]: https://forum.umbraco.com/
+[contrib forum]: https://our.umbraco.com/forum/contributing-to-umbraco-cms/
 [Umbraco CMS repo]: https://github.com/umbraco/Umbraco-CMS
 [up for grabs issues]: https://github.com/umbraco/Umbraco-CMS/issues?q=is%3Aissue+is%3Aopen+label%3Acommunity%2Fup-for-grabs
 [issue tracker]: https://github.com/umbraco/Umbraco-CMS/issues

.github/copilot-instructions.md

@@ -31,8 +31,6 @@ Bootstrap, build, and test the repository:
   - `cd src/Umbraco.Web.UI`
   - `dotnet run --no-build` -- Application runs on https://localhost:44339 and http://localhost:11000
 
-Check out [BUILD.md](./BUILD.md) for more detailed instructions.
-
 ## Validation
 
 - ALWAYS run through at least one complete end-to-end scenario after making changes.
@@ -96,22 +94,34 @@ The solution contains 30 C# projects organized as follows:
 
 ## Common Tasks
 
-### Frontend Development
-For frontend-only changes:
-1. Configure backend for frontend development:
-   ```json
-   <!-- Add to src/Umbraco.Web.UI/appsettings.json under Umbraco:Cms:Security: -->
+### Running Umbraco in Different Modes
+
+**Production Mode (Standard Development)**
+Use this for backend development, testing full builds, or when you don't need hot reloading:
+1. Build frontend assets: `cd src/Umbraco.Web.UI.Client && npm run build:for:cms`
+2. Run backend: `cd src/Umbraco.Web.UI && dotnet run --no-build`
+3. Access backoffice: `https://localhost:44339/umbraco`
+4. Application uses compiled frontend from `wwwroot/umbraco/backoffice/`
+
+**Vite Dev Server Mode (Frontend Development with Hot Reload)**
+Use this for frontend-only development with hot module reloading:
+1. Configure backend for frontend development - Add to `src/Umbraco.Web.UI/appsettings.json` under `Umbraco:CMS:Security`:
    ```json
    "BackOfficeHost": "http://localhost:5173",
    "AuthorizeCallbackPathName": "/oauth_complete",
    "AuthorizeCallbackLogoutPathName": "/logout",
    "AuthorizeCallbackErrorPathName": "/error",
    "BackOfficeTokenCookie": {
+     "Enabled": true,
      "SameSite": "None"
    }
    ```
 2. Run backend: `cd src/Umbraco.Web.UI && dotnet run --no-build`
 3. Run frontend dev server: `cd src/Umbraco.Web.UI.Client && npm run dev:server`
+4. Access backoffice: `http://localhost:5173/` (no `/umbraco` prefix)
+5. Changes to TypeScript/Lit files hot reload automatically
+
+**Important:** Remove the `BackOfficeHost` configuration before committing or switching back to production mode.
 
 ### Backend-Only Development
 For backend-only changes, disable frontend builds:

.github/workflows/label-to-release-announcement.yml

@@ -52,7 +52,7 @@ jobs:
               for (const item of items) {
                 const releaseLabels = (item.labels || [])
                   .map(l => (typeof l === "string" ? l : l.name)) // always get the name
-                  .filter(n => typeof n === "string" && n.startsWith("release/"));
+                  .filter(n => typeof n === "string" && n.startsWith("release/") && n !== "release/no-notes");
                 if (releaseLabels.length === 0) continue;
 
                 core.info(`#${item.number}: ${releaseLabels.join(", ")}`);

.vscode/launch.json

@@ -101,11 +101,13 @@
       "env": {
         "ASPNETCORE_ENVIRONMENT": "Development",
         "ASPNETCORE_URLS": "https://localhost:44339",
+        "UMBRACO__CMS__WEBROUTING__UMBRACOAPPLICATIONURL": "https://localhost:44339",
         "UMBRACO__CMS__SECURITY__BACKOFFICEHOST": "http://localhost:5173",
         "UMBRACO__CMS__SECURITY__AUTHORIZECALLBACKPATHNAME": "/oauth_complete",
         "UMBRACO__CMS__SECURITY__AUTHORIZECALLBACKLOGOUTPATHNAME": "/logout",
         "UMBRACO__CMS__SECURITY__AUTHORIZECALLBACKERRORPATHNAME": "/error",
         "UMBRACO__CMS__SECURITY__KEEPUSERLOGGEDIN": "true",
+        "UMBRACO__CMS__SECURITY__BACKOFFICETOKENCOOKIE__ENABLED": "true",
         "UMBRACO__CMS__SECURITY__BACKOFFICETOKENCOOKIE__SAMESITE": "None"
       },
       "sourceFileMap": {

.vscode/settings.json

@@ -1,8 +1,5 @@
 {
   "cSpell.words": [
-    "backoffice",
-    "pickable",
-    "Pickable",
     "unprovide",
     "Unproviding"
   ],

Directory.Build.props

@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="utf-8"?>
 <Project>
   <PropertyGroup>
-    <TargetFramework>net10.0</TargetFramework>
+    <TargetFramework>net9.0</TargetFramework>
     <Company>Umbraco HQ</Company>
     <Authors>Umbraco</Authors>
     <Copyright>Copyright © Umbraco $([System.DateTime]::Today.ToString('yyyy'))</Copyright>
@@ -40,7 +40,7 @@
   <!-- Package Validation -->
   <PropertyGroup>
     <GenerateCompatibilitySuppressionFile>false</GenerateCompatibilitySuppressionFile>
-    <EnablePackageValidation>false</EnablePackageValidation> <!-- TODO (V17): Set to true with version 17.0.0 once this version is released. -->
+    <EnablePackageValidation>true</EnablePackageValidation>
     <PackageValidationBaselineVersion>16.0.0</PackageValidationBaselineVersion>
     <EnableStrictModeForCompatibleFrameworksInPackage>true</EnableStrictModeForCompatibleFrameworksInPackage>
     <EnableStrictModeForCompatibleTfms>true</EnableStrictModeForCompatibleTfms>

Directory.Packages.props

@@ -5,35 +5,36 @@
   </PropertyGroup>
   <!-- Global packages (private, build-time packages for all projects) -->
   <ItemGroup>
-    <GlobalPackageReference Include="Nerdbank.GitVersioning" Version="3.8.118" />
+    <GlobalPackageReference Include="Nerdbank.GitVersioning" Version="3.7.115" />
     <GlobalPackageReference Include="StyleCop.Analyzers" Version="1.2.0-beta.556" />
-    <GlobalPackageReference Include="Umbraco.Code" Version="2.4.0" />
+    <GlobalPackageReference Include="Umbraco.Code" Version="2.3.0" />
     <GlobalPackageReference Include="Umbraco.GitVersioning.Extensions" Version="0.2.0" />
   </ItemGroup>
   <!-- Microsoft packages -->
   <ItemGroup>
-    <PackageVersion Include="Microsoft.AspNetCore.Mvc.Razor.RuntimeCompilation" Version="10.0.0" />
-    <PackageVersion Include="Microsoft.CodeAnalysis.CSharp" Version="4.14.0" />
-    <PackageVersion Include="Microsoft.Data.Sqlite" Version="10.0.0" />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore.Sqlite" Version="10.0.0" />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore.SqlServer" Version="10.0.0" />
-    <PackageVersion Include="Microsoft.Extensions.Caching.Abstractions" Version="10.0.0" />
-    <PackageVersion Include="Microsoft.Extensions.Caching.Memory" Version="10.0.0" />
-    <PackageVersion Include="Microsoft.Extensions.Configuration.Abstractions" Version="10.0.0" />
-    <PackageVersion Include="Microsoft.Extensions.Configuration.Json" Version="10.0.0" />
-    <PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="10.0.0" />
-    <PackageVersion Include="Microsoft.Extensions.FileProviders.Embedded" Version="10.0.0" />
-    <PackageVersion Include="Microsoft.Extensions.FileProviders.Physical" Version="10.0.0" />
-    <PackageVersion Include="Microsoft.Extensions.Hosting.Abstractions" Version="10.0.0" />
-    <PackageVersion Include="Microsoft.Extensions.Http" Version="10.0.0" />
-    <PackageVersion Include="Microsoft.Extensions.Identity.Core" Version="10.0.0" />
-    <PackageVersion Include="Microsoft.Extensions.Identity.Stores" Version="10.0.0" />
-    <PackageVersion Include="Microsoft.Extensions.Logging" Version="10.0.0" />
-    <PackageVersion Include="Microsoft.Extensions.Options" Version="10.0.0" />
-    <PackageVersion Include="Microsoft.Extensions.Options.ConfigurationExtensions" Version="10.0.0" />
-    <PackageVersion Include="Microsoft.Extensions.Options.DataAnnotations" Version="10.0.0" />
-    <PackageVersion Include="Microsoft.Extensions.Caching.Hybrid" Version="10.0.0" />
-    <PackageVersion Include="System.Linq.Async" Version="7.0.0" />
+    <PackageVersion Include="Microsoft.AspNetCore.Mvc.Razor.RuntimeCompilation" Version="9.0.4" />
+    <PackageVersion Include="Microsoft.CodeAnalysis.CSharp" Version="4.13.0" />
+    <PackageVersion Include="Microsoft.CodeAnalysis.CSharp.Workspaces" Version="4.13.0" />
+    <PackageVersion Include="Microsoft.CodeAnalysis.Workspaces.MSBuild" Version="4.13.0" />
+    <PackageVersion Include="Microsoft.Data.Sqlite" Version="9.0.4" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.Sqlite" Version="9.0.4" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.SqlServer" Version="9.0.4" />
+    <PackageVersion Include="Microsoft.Extensions.Caching.Abstractions" Version="9.0.4" />
+    <PackageVersion Include="Microsoft.Extensions.Caching.Memory" Version="9.0.4" />
+    <PackageVersion Include="Microsoft.Extensions.Configuration.Abstractions" Version="9.0.4" />
+    <PackageVersion Include="Microsoft.Extensions.Configuration.Json" Version="9.0.4" />
+    <PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="9.0.4" />
+    <PackageVersion Include="Microsoft.Extensions.FileProviders.Embedded" Version="9.0.4" />
+    <PackageVersion Include="Microsoft.Extensions.FileProviders.Physical" Version="9.0.4" />
+    <PackageVersion Include="Microsoft.Extensions.Hosting.Abstractions" Version="9.0.4" />
+    <PackageVersion Include="Microsoft.Extensions.Http" Version="9.0.4" />
+    <PackageVersion Include="Microsoft.Extensions.Identity.Core" Version="9.0.4" />
+    <PackageVersion Include="Microsoft.Extensions.Identity.Stores" Version="9.0.4" />
+    <PackageVersion Include="Microsoft.Extensions.Logging" Version="9.0.4" />
+    <PackageVersion Include="Microsoft.Extensions.Options" Version="9.0.4" />
+    <PackageVersion Include="Microsoft.Extensions.Options.ConfigurationExtensions" Version="9.0.4" />
+    <PackageVersion Include="Microsoft.Extensions.Options.DataAnnotations" Version="9.0.4" />
+    <PackageVersion Include="Microsoft.Extensions.Caching.Hybrid" Version="9.4.0" />
   </ItemGroup>
   <!-- Umbraco packages -->
   <ItemGroup>
@@ -46,21 +47,21 @@
     <PackageVersion Include="Dazinator.Extensions.FileProviders" Version="2.0.0" />
     <PackageVersion Include="Examine" Version="3.7.1" />
     <PackageVersion Include="Examine.Core" Version="3.7.1" />
-    <PackageVersion Include="HtmlAgilityPack" Version="1.12.4" />
+    <PackageVersion Include="HtmlAgilityPack" Version="1.12.1" />
     <PackageVersion Include="JsonPatch.Net" Version="3.3.0" />
     <PackageVersion Include="K4os.Compression.LZ4" Version="1.3.8" />
-    <PackageVersion Include="MailKit" Version="4.14.0" />
+    <PackageVersion Include="MailKit" Version="4.11.0" />
     <PackageVersion Include="Markdown" Version="2.2.1" />
-    <PackageVersion Include="MessagePack" Version="3.1.4" />
+    <PackageVersion Include="MessagePack" Version="3.1.3" />
     <PackageVersion Include="MiniProfiler.AspNetCore.Mvc" Version="4.5.4" />
     <PackageVersion Include="MiniProfiler.Shared" Version="4.5.4" />
-    <PackageVersion Include="ncrontab" Version="3.4.0" />
-    <PackageVersion Include="NPoco" Version="6.1.0" />
-    <PackageVersion Include="NPoco.SqlServer" Version="6.1.0" />
-    <PackageVersion Include="OpenIddict.Abstractions" Version="7.1.0" />
-    <PackageVersion Include="OpenIddict.AspNetCore" Version="7.1.0" />
-    <PackageVersion Include="OpenIddict.EntityFrameworkCore" Version="7.1.0" />
-    <PackageVersion Include="Serilog" Version="4.3.0" />
+    <PackageVersion Include="ncrontab" Version="3.3.3" />
+    <PackageVersion Include="NPoco" Version="5.7.1" />
+    <PackageVersion Include="NPoco.SqlServer" Version="5.7.1" />
+    <PackageVersion Include="OpenIddict.Abstractions" Version="6.2.1" />
+    <PackageVersion Include="OpenIddict.AspNetCore" Version="6.2.1" />
+    <PackageVersion Include="OpenIddict.EntityFrameworkCore" Version="6.2.1" />
+    <PackageVersion Include="Serilog" Version="4.2.0" />
     <PackageVersion Include="Serilog.AspNetCore" Version="9.0.0" />
     <PackageVersion Include="Serilog.Enrichers.Process" Version="3.0.0" />
     <PackageVersion Include="Serilog.Enrichers.Thread" Version="4.0.0" />
@@ -70,13 +71,33 @@
     <PackageVersion Include="Serilog.Formatting.Compact.Reader" Version="4.0.0" />
     <PackageVersion Include="Serilog.Settings.Configuration" Version="9.0.0" />
     <PackageVersion Include="Serilog.Sinks.Async" Version="2.1.0" />
-    <PackageVersion Include="Serilog.Sinks.File" Version="7.0.0" />
+    <PackageVersion Include="Serilog.Sinks.File" Version="6.0.0" />
     <PackageVersion Include="Serilog.Sinks.Map" Version="2.0.0" />
     <PackageVersion Include="SixLabors.ImageSharp" Version="3.1.11" />
-    <PackageVersion Include="SixLabors.ImageSharp.Web" Version="3.2.0" />
-    <PackageVersion Include="Swashbuckle.AspNetCore" Version="10.0.1" />
+    <PackageVersion Include="SixLabors.ImageSharp.Web" Version="3.1.5" />
+    <PackageVersion Include="Swashbuckle.AspNetCore" Version="8.1.1" />
   </ItemGroup>
   <!-- Transitive pinned versions (only required because our direct dependencies have vulnerable versions of transitive dependencies) -->
   <ItemGroup>
+    <!-- Microsoft.EntityFrameworkCore.SqlServer and NPoco.SqlServer brings in a vulnerable version of Azure.Identity -->
+    <!-- Take top-level depedendency on Azure.Identity, because Microsoft.EntityFrameworkCore.SqlServer depends on a vulnerable version -->
+    <PackageVersion Include="Azure.Identity" Version="1.13.2" />
+    <!-- Microsoft.EntityFrameworkCore.SqlServer brings in a vulnerable version of System.Runtime.Caching -->
+    <PackageVersion Include="System.Runtime.Caching" Version="9.0.4" />
+    <!-- Dazinator.Extensions.FileProviders brings in a vulnerable version of System.Net.Http -->
+    <PackageVersion Include="System.Net.Http" Version="4.3.4" />
+    <!-- Examine brings in a vulnerable version of System.Security.Cryptography.Xml -->
+    <PackageVersion Include="System.Security.Cryptography.Xml" Version="9.0.4" />
+    <!-- Dazinator.Extensions.FileProviders and MiniProfiler.AspNetCore.Mvc brings in a vulnerable version of System.Text.RegularExpressions -->
+    <PackageVersion Include="System.Text.RegularExpressions" Version="4.3.1" />
+    <!-- OpenIddict.AspNetCore, Npoco.SqlServer and Microsoft.EntityFrameworkCore.SqlServer brings in a vulnerable version of Microsoft.IdentityModel.JsonWebTokens -->
+    <!-- Take top-level depedendency on Microsoft.IdentityModel.JsonWebTokens, because OpenIddict.AspNetCore, Npoco.SqlServer and Microsoft.EntityFrameworkCore.SqlServer depends on a vulnerable version -->
+    <PackageVersion Include="Microsoft.IdentityModel.JsonWebTokens" Version="8.8.0" />
+    <!-- Azure.Identity, Microsoft.EntityFrameworkCore.SqlServer and Dazinator.Extensions.FileProviders brings in a legacy version of System.Text.Encodings.Web -->
+    <PackageVersion Include="System.Text.Encodings.Web" Version="9.0.4" />
+    <!-- NPoco.SqlServer brings in a vulnerable version of Microsoft.Data.SqlClient  -->
+    <PackageVersion Include="Microsoft.Data.SqlClient" Version="6.0.1" />
+    <!-- Examine.Lucene brings in a vulnerable version of Lucene.Net.Replicator -->
+    <PackageVersion Include="Lucene.Net.Replicator" Version="4.8.0-beta00017" />
   </ItemGroup>
 </Project>

build/azure-pipelines.yml

@@ -365,8 +365,8 @@ stages:
               testFilter: "(FullyQualifiedName~Umbraco.Infrastructure.Service)"
             LinuxPart3Of3:
               vmImage: "ubuntu-latest"
-              # Filter tests that are not part of the Umbraco.Infrastructure and ManagementApi namespace. So this will run all tests that are not part of the Umbraco.Infrastructure and ManagementApi namespace
-              testFilter: "(FullyQualifiedName!~Umbraco.Infrastructure) & (FullyQualifiedName!~ManagementApi)"
+              # Filter tests that are not part of the Umbraco.Infrastructure namespace. So this will run all tests that are not part of the Umbraco.Infrastructure namespace
+              testFilter: "(FullyQualifiedName!~Umbraco.Infrastructure)"
             macOSPart1Of3:
               vmImage: "macOS-latest"
               # Filter tests that are part of the Umbraco.Infrastructure namespace but not part of the Umbraco.Infrastructure.Service namespace
@@ -377,8 +377,8 @@ stages:
               testFilter: "(FullyQualifiedName~Umbraco.Infrastructure.Service)"
             macOSPart3Of3:
               vmImage: "macOS-latest"
-              # Filter tests that are not part of the Umbraco.Infrastructure and ManagementApi namespace. So this will run all tests that are not part of the Umbraco.Infrastructure and the ManagementApi namespace
-              testFilter: "(FullyQualifiedName!~Umbraco.Infrastructure) & (FullyQualifiedName!~ManagementApi)"
+              # Filter tests that are not part of the Umbraco.Infrastructure namespace.
+              testFilter: "(FullyQualifiedName!~Umbraco.Infrastructure)"
         pool:
           vmImage: $(vmImage)
         variables:
@@ -441,8 +441,8 @@ stages:
               vmImage: "windows-latest"
               Tests__Database__DatabaseType: LocalDb
               Tests__Database__SQLServerMasterConnectionString: N/A
-              # Filter tests that are not part of the Umbraco.Infrastructure and ManagementApi namespace. So this will run all tests that are not part of the Umbraco.Infrastructure and ManagementApi namespace
-              testFilter: "(FullyQualifiedName!~Umbraco.Infrastructure) & (FullyQualifiedName!~ManagementApi)"
+              # Filter tests that are not part of the Umbraco.Infrastructure namespace. So this will run all tests that are not part of the Umbraco.Infrastructure namespace
+              testFilter: "(FullyQualifiedName!~Umbraco.Infrastructure)"
             LinuxPart1Of3:
               vmImage: "ubuntu-latest"
               SA_PASSWORD: UmbracoIntegration123!
@@ -462,8 +462,8 @@ stages:
               SA_PASSWORD: UmbracoIntegration123!
               Tests__Database__DatabaseType: SqlServer
               Tests__Database__SQLServerMasterConnectionString: "Server=(local);User Id=sa;Password=$(SA_PASSWORD);TrustServerCertificate=True"
-              # Filter tests that are not part of the Umbraco.Infrastructure and ManagementApi namespace. So this will run all tests that are not part of the Umbraco.Infrastructure and ManagementApi namespace
-              testFilter: "(FullyQualifiedName!~Umbraco.Infrastructure) & (FullyQualifiedName!~ManagementApi)"
+              # Filter tests that are not part of the Umbraco.Infrastructure namespace. So this will run all tests that are not part of the Umbraco.Infrastructure namespace
+              testFilter: "(FullyQualifiedName!~Umbraco.Infrastructure)"
         pool:
           vmImage: $(vmImage)
         steps:

build/nightly-E2E-test-pipelines.yml

@@ -4,13 +4,11 @@ pr: none
 trigger: none
 
 schedules:
-  - cron: '0 0 * * *'
-    displayName: Daily midnight build
+  - cron: '0 6 * * *'
+    displayName: Daily 6 AM build (v16/dev)
     branches:
       include:
-        - v15/dev
-        - main
-        - v17/dev
+        - v16/dev
 
 parameters:
   - name: skipIntegrationTests
@@ -21,7 +19,7 @@ parameters:
   - name: differentAppSettingsAcceptanceTests
     displayName: Run acceptance tests with different app settings
     type: boolean
-    default: true
+    default: false
 
   - name: skipDefaultConfigAcceptanceTests
     displayName: Skip tests with DefaultConfig
@@ -123,39 +121,31 @@ stages:
           matrix:
             #            Windows:
             #              vmImage: 'windows-latest'
-            # We split the tests into 4 parts for each OS to reduce the time it takes to run them on the pipeline
-            LinuxPart1Of4:
+            # We split the tests into 3 parts for each OS to reduce the time it takes to run them on the pipeline
+            LinuxPart1Of3:
               vmImage: "ubuntu-latest"
               # Filter tests that are part of the Umbraco.Infrastructure namespace but not part of the Umbraco.Infrastructure.Service namespace
               testFilter: "(FullyQualifiedName~Umbraco.Infrastructure) & (FullyQualifiedName!~Umbraco.Infrastructure.Service)"
-            LinuxPart2Of4:
+            LinuxPart2Of3:
               vmImage: "ubuntu-latest"
               # Filter tests that are part of the Umbraco.Infrastructure.Service namespace
               testFilter: "(FullyQualifiedName~Umbraco.Infrastructure.Service)"
-            LinuxPart3Of4:
+            LinuxPart3Of3:
               vmImage: "ubuntu-latest"
-              # Filter tests that are not part of the Umbraco.Infrastructure and ManagementApi namespace. So this will run all tests that are not part of the Umbraco.Infrastructure namespace
-              testFilter: "(FullyQualifiedName!~Umbraco.Infrastructure) & (FullyQualifiedName!~ManagementApi)"
-            LinuxPart4Of4:
-              vmImage: "ubuntu-latest"
-              # Filter tests that are part of the ManagementApi namespace
-              testFilter: "(FullyQualifiedName~ManagementApi)"
-            macOSPart1Of4:
+              # Filter tests that are not part of the Umbraco.Infrastructure namespace. So this will run all tests that are not part of the Umbraco.Infrastructure namespace
+              testFilter: "(FullyQualifiedName!~Umbraco.Infrastructure)"
+            macOSPart1Of3:
               vmImage: "macOS-latest"
               # Filter tests that are part of the Umbraco.Infrastructure namespace but not part of the Umbraco.Infrastructure.Service namespace
               testFilter: "(FullyQualifiedName~Umbraco.Infrastructure) & (FullyQualifiedName!~Umbraco.Infrastructure.Service)"
-            macOSPart2Of4:
+            macOSPart2Of3:
               vmImage: "macOS-latest"
               # Filter tests that are part of the Umbraco.Infrastructure.Service namespace
               testFilter: "(FullyQualifiedName~Umbraco.Infrastructure.Service)"
-            macOSPart3Of4:
+            macOSPart3Of3:
               vmImage: "macOS-latest"
-              # Filter tests that are not part of the Umbraco.Infrastructure and ManagementApi namespace.
-              testFilter: "(FullyQualifiedName!~Umbraco.Infrastructure) & (FullyQualifiedName!~ManagementApi)"
-            macOSPart4Of4:
-              vmImage: "macOS-latest"
-              # Filter tests that are part of the ManagementApi namespace.
-              testFilter: "(FullyQualifiedName~ManagementApi)"
+              # Filter tests that are not part of the Umbraco.Infrastructure namespace.
+              testFilter: "(FullyQualifiedName!~Umbraco.Infrastructure)"
         pool:
           vmImage: $(vmImage)
         variables:
@@ -195,55 +185,43 @@ stages:
           SA_PASSWORD: UmbracoAcceptance123!
         strategy:
           matrix:
-            # We split the tests into 4 parts for each OS to reduce the time it takes to run them on the pipeline
-            WindowsPart1Of4:
+            # We split the tests into 3 parts for each OS to reduce the time it takes to run them on the pipeline
+            WindowsPart1Of3:
               vmImage: "windows-latest"
               Tests__Database__DatabaseType: LocalDb
               Tests__Database__SQLServerMasterConnectionString: N/A
               # Filter tests that are part of the Umbraco.Infrastructure namespace but not part of the Umbraco.Infrastructure.Service namespace
               testFilter: "(FullyQualifiedName~Umbraco.Infrastructure) & (FullyQualifiedName!~Umbraco.Infrastructure.Service)"
-            WindowsPart2Of4:
+            WindowsPart2Of3:
               vmImage: "windows-latest"
               Tests__Database__DatabaseType: LocalDb
               Tests__Database__SQLServerMasterConnectionString: N/A
               # Filter tests that are part of the Umbraco.Infrastructure.Service namespace
               testFilter: "(FullyQualifiedName~Umbraco.Infrastructure.Service)"
-            WindowsPart3Of4:
+            WindowsPart3Of3:
               vmImage: "windows-latest"
               Tests__Database__DatabaseType: LocalDb
               Tests__Database__SQLServerMasterConnectionString: N/A
-              # Filter tests that are not part of the Umbraco.Infrastructure and ManagementApi namespace.
-              testFilter: "(FullyQualifiedName!~Umbraco.Infrastructure) & (FullyQualifiedName!~ManagementApi)"
-            WindowsPart4Of4:
-              vmImage: "windows-latest"
-              Tests__Database__DatabaseType: LocalDb
-              Tests__Database__SQLServerMasterConnectionString: N/A
-              # Filter tests that are part of the ManagementApi namespace.
-              testFilter: "(FullyQualifiedName~ManagementApi)"
-            LinuxPart1Of4:
+              # Filter tests that are not part of the Umbraco.Infrastructure namespace. So this will run all tests that are not part of the Umbraco.Infrastructure namespace
+              testFilter: "(FullyQualifiedName!~Umbraco.Infrastructure)"
+            LinuxPart1Of3:
               vmImage: "ubuntu-latest"
               Tests__Database__DatabaseType: SqlServer
               Tests__Database__SQLServerMasterConnectionString: "Server=(local);User Id=sa;Password=$(SA_PASSWORD);Encrypt=True;TrustServerCertificate=True"
               # Filter tests that are part of the Umbraco.Infrastructure namespace but not part of the Umbraco.Infrastructure.Service namespace
               testFilter: "(FullyQualifiedName~Umbraco.Infrastructure) & (FullyQualifiedName!~Umbraco.Infrastructure.Service)"
-            LinuxPart2Of4:
+            LinuxPart2Of3:
               vmImage: "ubuntu-latest"
               Tests__Database__DatabaseType: SqlServer
               Tests__Database__SQLServerMasterConnectionString: "Server=(local);User Id=sa;Password=$(SA_PASSWORD);Encrypt=True;TrustServerCertificate=True"
               # Filter tests that are part of the Umbraco.Infrastructure.Service namespace
               testFilter: "(FullyQualifiedName~Umbraco.Infrastructure.Service)"
-            LinuxPart3Of4:
+            LinuxPart3Of3:
               vmImage: "ubuntu-latest"
               Tests__Database__DatabaseType: SqlServer
               Tests__Database__SQLServerMasterConnectionString: "Server=(local);User Id=sa;Password=$(SA_PASSWORD);Encrypt=True;TrustServerCertificate=True"
-              # Filter tests that are not part of the Umbraco.Infrastructure and ManagementApi namespace.
-              testFilter: "(FullyQualifiedName!~Umbraco.Infrastructure) & (FullyQualifiedName!~ManagementApi)"
-            LinuxPart4Of4:
-              vmImage: "ubuntu-latest"
-              Tests__Database__DatabaseType: SqlServer
-              Tests__Database__SQLServerMasterConnectionString: "Server=(local);User Id=sa;Password=$(SA_PASSWORD);Encrypt=True;TrustServerCertificate=True"
-              # Filter tests that are part of the ManagementApi namespace.
-              testFilter: "(FullyQualifiedName~ManagementApi)"
+              # Filter tests that are not part of the Umbraco.Infrastructure namespace. So this will run all tests that are not part of the Umbraco.Infrastructure namespace
+              testFilter: "(FullyQualifiedName!~Umbraco.Infrastructure)"
         pool:
           vmImage: $(vmImage)
         steps:
@@ -315,7 +293,8 @@ stages:
 
   - stage: DefaultConfigE2E
     displayName: Default Config E2E Tests
-    dependsOn: Build
+    dependsOn: Integration
+    condition: always()
     variables:
       npm_config_cache: $(Pipeline.Workspace)/.npm_e2e
       # Enable console logging in Release mode
@@ -496,7 +475,8 @@ stages:
 
   - stage: AdditionalConfigE2E
     displayName: Additional Config E2E Tests
-    dependsOn: Build
+    dependsOn: DefaultConfigE2E
+    condition: always()
     variables:
       npm_config_cache: $(Pipeline.Workspace)/.npm_e2e
       ASPNETCORE_URLS: https://localhost:44331
@@ -505,7 +485,7 @@ stages:
     jobs:
       - job:
         displayName: E2E Tests with Different App settings (SQL Server)
-        condition: ${{ eq(parameters.differentAppSettingsAcceptanceTests, true) }}
+        condition: ${{ or(eq(parameters.differentAppSettingsAcceptanceTests, true), eq(parameters.skipDefaultConfigAcceptanceTests, true)) }}
         timeoutInMinutes: 180
         variables:
           SA_PASSWORD: UmbracoAcceptance123!
@@ -695,4 +675,4 @@ stages:
                 --data "$PAYLOAD" \
                 "$SLACK_WEBHOOK_URL"
             env:
-              SLACK_WEBHOOK_URL: $(E2ESLACKWEBHOOKURL)
+              SLACK_WEBHOOK_URL: $(E2ESLACKWEBHOOKURL)

global.json

@@ -1,6 +1,6 @@
 {
   "sdk": {
-    "version": "10.0.100",
+    "version": "9.0.306",
     "rollForward": "latestFeature",
     "allowPrerelease": false
   }

src/Umbraco.Cms.Api.Common/Configuration/ConfigureUmbracoSwaggerGenOptions.cs

@@ -4,7 +4,7 @@ using Microsoft.AspNetCore.Mvc.ApiExplorer;
 using Microsoft.AspNetCore.Mvc.Controllers;
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Options;
-using Microsoft.OpenApi;
+using Microsoft.OpenApi.Models;
 using Swashbuckle.AspNetCore.SwaggerGen;
 using Umbraco.Cms.Api.Common.OpenApi;
 using Umbraco.Extensions;

src/Umbraco.Cms.Api.Common/DependencyInjection/HideBackOfficeTokensHandler.cs

@@ -21,13 +21,9 @@ internal sealed class HideBackOfficeTokensHandler
         INotificationHandler<UserLogoutSuccessNotification>
 {
     private const string RedactedTokenValue = "[redacted]";
-
-    // The __Host- prefix enforces secure cookies at browser level (requires Secure, Path=/, no Domain).
-    // For local development over HTTP, we use a simpler prefix to avoid browser rejection.
-    private const string SecureCookiePrefix = "__Host-";
-    private const string AccessTokenCookieName = "umbAccessToken";
-    private const string RefreshTokenCookieName = "umbRefreshToken";
-    private const string PkceCodeCookieName = "umbPkceCode";
+    private const string AccessTokenCookieKey = "__Host-umbAccessToken";
+    private const string RefreshTokenCookieKey = "__Host-umbRefreshToken";
+    private const string PkceCodeCookieKey = "__Host-umbPkceCode";
 
     private readonly IHttpContextAccessor _httpContextAccessor;
     private readonly IDataProtectionProvider _dataProtectionProvider;
@@ -63,13 +59,13 @@ internal sealed class HideBackOfficeTokensHandler
 
         if (context.Response.AccessToken is not null)
         {
-            SetCookie(httpContext, AccessTokenCookieName, context.Response.AccessToken);
+            SetCookie(httpContext, AccessTokenCookieKey, context.Response.AccessToken);
             context.Response.AccessToken = RedactedTokenValue;
         }
 
         if (context.Response.RefreshToken is not null)
         {
-            SetCookie(httpContext, RefreshTokenCookieName, context.Response.RefreshToken);
+            SetCookie(httpContext, RefreshTokenCookieKey, context.Response.RefreshToken);
             context.Response.RefreshToken = RedactedTokenValue;
         }
 
@@ -91,7 +87,7 @@ internal sealed class HideBackOfficeTokensHandler
 
         if (context.Response.Code is not null)
         {
-            SetCookie(GetHttpContext(), PkceCodeCookieName, context.Response.Code);
+            SetCookie(GetHttpContext(), PkceCodeCookieKey, context.Response.Code);
             context.Response.Code = RedactedTokenValue;
         }
 
@@ -109,16 +105,14 @@ internal sealed class HideBackOfficeTokensHandler
             return ValueTask.CompletedTask;
         }
 
-        HttpContext httpContext = GetHttpContext();
-
         // Handle when the PKCE code is being exchanged for an access token.
         if (context.Request.Code == RedactedTokenValue
-            && TryGetCookie(httpContext, PkceCodeCookieName, out var code))
+            && TryGetCookie(PkceCodeCookieKey, out var code))
         {
             context.Request.Code = code;
 
             // We won't need the PKCE cookie after this, let's remove it.
-            RemoveCookie(httpContext, PkceCodeCookieName);
+            RemoveCookie(GetHttpContext(), PkceCodeCookieKey);
         }
         else
         {
@@ -129,7 +123,7 @@ internal sealed class HideBackOfficeTokensHandler
 
         // Handle when a refresh token is being exchanged for a new access token.
         if (context.Request.RefreshToken == RedactedTokenValue
-            && TryGetCookie(httpContext, RefreshTokenCookieName, out var refreshToken))
+            && TryGetCookie(RefreshTokenCookieKey, out var refreshToken))
         {
             context.Request.RefreshToken = refreshToken;
         }
@@ -155,7 +149,7 @@ internal sealed class HideBackOfficeTokensHandler
             return ValueTask.CompletedTask;
         }
 
-        if (TryGetCookie(GetHttpContext(), AccessTokenCookieName, out var accessToken))
+        if (TryGetCookie(AccessTokenCookieKey, out var accessToken))
         {
             context.AccessToken = accessToken;
         }
@@ -165,8 +159,8 @@ internal sealed class HideBackOfficeTokensHandler
 
     public void Handle(UserLogoutSuccessNotification notification)
     {
-        HttpContext? httpContext = _httpContextAccessor.HttpContext;
-        if (httpContext is null)
+        HttpContext? context = _httpContextAccessor.HttpContext;
+        if (context is null)
         {
             // For some reason there is no ambient HTTP context, so we can't clean up the cookies.
             // This is OK, because the tokens in the cookies have already been revoked at user sign-out,
@@ -174,32 +168,23 @@ internal sealed class HideBackOfficeTokensHandler
             return;
         }
 
-        RemoveCookie(httpContext, AccessTokenCookieName);
-        RemoveCookie(httpContext, RefreshTokenCookieName);
+        context.Response.Cookies.Delete(AccessTokenCookieKey);
+        context.Response.Cookies.Delete(RefreshTokenCookieKey);
     }
 
     private HttpContext GetHttpContext()
         => _httpContextAccessor.GetRequiredHttpContext();
 
-    private string GetCookieKey(HttpContext httpContext, string cookieName)
-        => _globalSettings.UseHttps || httpContext.Request.IsHttps
-            ? $"{SecureCookiePrefix}{cookieName}"
-            : cookieName;
-
-    private void SetCookie(HttpContext httpContext, string cookieName, string value)
+    private void SetCookie(HttpContext httpContext, string key, string value)
     {
-        var key = GetCookieKey(httpContext, cookieName);
         var cookieValue = EncryptionHelper.Encrypt(value, _dataProtectionProvider);
 
-        RemoveCookie(httpContext, cookieName);
+        RemoveCookie(httpContext, key);
         httpContext.Response.Cookies.Append(key, cookieValue, GetCookieOptions(httpContext));
     }
 
-    private void RemoveCookie(HttpContext httpContext, string cookieName)
-    {
-        var key = GetCookieKey(httpContext, cookieName);
-        httpContext.Response.Cookies.Delete(key, GetCookieOptions(httpContext));
-    }
+    private void RemoveCookie(HttpContext httpContext, string key)
+        => httpContext.Response.Cookies.Delete(key, GetCookieOptions(httpContext));
 
     private CookieOptions GetCookieOptions(HttpContext httpContext) =>
         new()
@@ -226,10 +211,9 @@ internal sealed class HideBackOfficeTokensHandler
             SameSite = ParseSameSiteMode(_backOfficeTokenCookieSettings.SameSite),
         };
 
-    private bool TryGetCookie(HttpContext httpContext, string cookieName, [NotNullWhen(true)] out string? value)
+    private bool TryGetCookie(string key, [NotNullWhen(true)] out string? value)
     {
-        var key = GetCookieKey(httpContext, cookieName);
-        if (httpContext.Request.Cookies.TryGetValue(key, out var cookieValue))
+        if (GetHttpContext().Request.Cookies.TryGetValue(key, out var cookieValue))
         {
             value = EncryptionHelper.Decrypt(cookieValue, _dataProtectionProvider);
             return true;

src/Umbraco.Cms.Api.Common/DependencyInjection/UmbracoBuilderAuthExtensions.cs

@@ -9,9 +9,9 @@ using Umbraco.Cms.Api.Common.Security;
 using Umbraco.Cms.Core;
 using Umbraco.Cms.Core.Configuration.Models;
 using Umbraco.Cms.Core.DependencyInjection;
-using Umbraco.Cms.Infrastructure.BackgroundJobs;
-using Umbraco.Cms.Infrastructure.BackgroundJobs.Jobs.DistributedJobs;
 using Umbraco.Cms.Core.Notifications;
+using Umbraco.Cms.Infrastructure.BackgroundJobs.Jobs;
+using Umbraco.Extensions;
 
 namespace Umbraco.Cms.Api.Common.DependencyInjection;
 
@@ -29,6 +29,11 @@ public static class UmbracoBuilderAuthExtensions
 
     private static void ConfigureOpenIddict(IUmbracoBuilder builder)
     {
+        // Optionally hide tokens from the back-office.
+        var hideBackOfficeTokens = (builder.Config
+            .GetSection(Constants.Configuration.ConfigBackOfficeTokenCookie)
+            .Get<BackOfficeTokenCookieSettings>() ?? new BackOfficeTokenCookieSettings()).Enabled;
+
         builder.Services.AddOpenIddict()
             // Register the OpenIddict server components.
             .AddServer(options =>
@@ -115,24 +120,27 @@ public static class UmbracoBuilderAuthExtensions
                     configuration.UseSingletonHandler<ProcessRequestContextHandler>().SetOrder(OpenIddict.Server.AspNetCore.OpenIddictServerAspNetCoreHandlers.ResolveRequestUri.Descriptor.Order - 1);
                 });
 
-                options.AddEventHandler<OpenIddictServerEvents.ApplyTokenResponseContext>(configuration =>
+                if (hideBackOfficeTokens)
                 {
-                    configuration
-                        .UseSingletonHandler<HideBackOfficeTokensHandler>()
-                        .SetOrder(OpenIddict.Server.AspNetCore.OpenIddictServerAspNetCoreHandlers.ProcessJsonResponse<OpenIddictServerEvents.ApplyTokenResponseContext>.Descriptor.Order - 1);
-                });
-                options.AddEventHandler<OpenIddictServerEvents.ApplyAuthorizationResponseContext>(configuration =>
-                {
-                    configuration
-                        .UseSingletonHandler<HideBackOfficeTokensHandler>()
-                        .SetOrder(OpenIddict.Server.AspNetCore.OpenIddictServerAspNetCoreHandlers.Authentication.ProcessQueryResponse.Descriptor.Order - 1);
-                });
-                options.AddEventHandler<OpenIddictServerEvents.ExtractTokenRequestContext>(configuration =>
-                {
-                    configuration
-                        .UseSingletonHandler<HideBackOfficeTokensHandler>()
-                        .SetOrder(OpenIddict.Server.AspNetCore.OpenIddictServerAspNetCoreHandlers.ExtractPostRequest<OpenIddictServerEvents.ExtractTokenRequestContext>.Descriptor.Order + 1);
-                });
+                    options.AddEventHandler<OpenIddictServerEvents.ApplyTokenResponseContext>(configuration =>
+                    {
+                        configuration
+                            .UseSingletonHandler<HideBackOfficeTokensHandler>()
+                            .SetOrder(OpenIddict.Server.AspNetCore.OpenIddictServerAspNetCoreHandlers.ProcessJsonResponse<OpenIddictServerEvents.ApplyTokenResponseContext>.Descriptor.Order - 1);
+                    });
+                    options.AddEventHandler<OpenIddictServerEvents.ApplyAuthorizationResponseContext>(configuration =>
+                    {
+                        configuration
+                            .UseSingletonHandler<HideBackOfficeTokensHandler>()
+                            .SetOrder(OpenIddict.Server.AspNetCore.OpenIddictServerAspNetCoreHandlers.Authentication.ProcessQueryResponse.Descriptor.Order - 1);
+                    });
+                    options.AddEventHandler<OpenIddictServerEvents.ExtractTokenRequestContext>(configuration =>
+                    {
+                        configuration
+                            .UseSingletonHandler<HideBackOfficeTokensHandler>()
+                            .SetOrder(OpenIddict.Server.AspNetCore.OpenIddictServerAspNetCoreHandlers.ExtractPostRequest<OpenIddictServerEvents.ExtractTokenRequestContext>.Descriptor.Order + 1);
+                    });
+                }
             })
 
             // Register the OpenIddict validation components.
@@ -158,18 +166,24 @@ public static class UmbracoBuilderAuthExtensions
                     configuration.UseSingletonHandler<ProcessRequestContextHandler>().SetOrder(OpenIddict.Validation.AspNetCore.OpenIddictValidationAspNetCoreHandlers.ResolveRequestUri.Descriptor.Order - 1);
                 });
 
-                options.AddEventHandler<OpenIddictValidationEvents.ProcessAuthenticationContext>(configuration =>
+                if (hideBackOfficeTokens)
                 {
-                    configuration
-                        .UseSingletonHandler<HideBackOfficeTokensHandler>()
-                        // IMPORTANT: the handler must be AFTER the built-in query string handler, because the client-side SignalR library sometimes appends access tokens to the query string.
-                        .SetOrder(OpenIddict.Validation.AspNetCore.OpenIddictValidationAspNetCoreHandlers.ExtractAccessTokenFromQueryString.Descriptor.Order + 1);
-                });
+                    options.AddEventHandler<OpenIddictValidationEvents.ProcessAuthenticationContext>(configuration =>
+                    {
+                        configuration
+                            .UseSingletonHandler<HideBackOfficeTokensHandler>()
+                            // IMPORTANT: the handler must be AFTER the built-in query string handler, because the client-side SignalR library sometimes appends access tokens to the query string.
+                            .SetOrder(OpenIddict.Validation.AspNetCore.OpenIddictValidationAspNetCoreHandlers.ExtractAccessTokenFromQueryString.Descriptor.Order + 1);
+                    });
+                }
             });
 
-        builder.Services.AddSingleton<IDistributedBackgroundJob, OpenIddictCleanupJob>();
+        builder.Services.AddRecurringBackgroundJob<OpenIddictCleanupJob>();
         builder.Services.ConfigureOptions<ConfigureOpenIddict>();
 
-        builder.AddNotificationHandler<UserLogoutSuccessNotification, HideBackOfficeTokensHandler>();
+        if (hideBackOfficeTokens)
+        {
+            builder.AddNotificationHandler<UserLogoutSuccessNotification, HideBackOfficeTokensHandler>();
+        }
     }
 }

src/Umbraco.Cms.Api.Common/Extensions/MethodInfoApiCommonExtensions.cs

@@ -8,11 +8,11 @@ namespace Umbraco.Extensions;
 public static class MethodInfoApiCommonExtensions
 {
 
-    public static string GetMapToApiVersionAttributeValue(this MethodInfo methodInfo)
+    public static string? GetMapToApiVersionAttributeValue(this MethodInfo methodInfo)
     {
         MapToApiVersionAttribute[] mapToApis = methodInfo.GetCustomAttributes(typeof(MapToApiVersionAttribute), inherit: true).Cast<MapToApiVersionAttribute>().ToArray();
 
-        return string.Join("|", mapToApis.SelectMany(x => x.Versions));
+        return string.Join("|", mapToApis.SelectMany(x=>x.Versions));
     }
 
     public static string? GetMapToApiAttributeValue(this MethodInfo methodInfo)

src/Umbraco.Cms.Api.Common/OpenApi/EnumSchemaFilter.cs

@@ -1,27 +1,25 @@
 using System.Reflection;
 using System.Runtime.Serialization;
-using System.Text.Json.Nodes;
-using Microsoft.OpenApi;
+using Microsoft.OpenApi.Any;
+using Microsoft.OpenApi.Models;
 using Swashbuckle.AspNetCore.SwaggerGen;
 
 namespace Umbraco.Cms.Api.Common.OpenApi;
 
 public class EnumSchemaFilter : ISchemaFilter
 {
-    public void Apply(IOpenApiSchema model, SchemaFilterContext context)
+    public void Apply(OpenApiSchema model, SchemaFilterContext context)
     {
-        if (model is not OpenApiSchema schema || context.Type.IsEnum is false)
+        if (context.Type.IsEnum)
         {
-            return;
-        }
-
-        schema.Type = JsonSchemaType.String;
-        schema.Format = null;
-        schema.Enum = new List<JsonNode>();
-        foreach (var name in Enum.GetNames(context.Type))
-        {
-            var actualName = context.Type.GetField(name)?.GetCustomAttribute<EnumMemberAttribute>()?.Value ?? name;
-            schema.Enum.Add(actualName);
+            model.Type = "string";
+            model.Format = null;
+            model.Enum.Clear();
+            foreach (var name in Enum.GetNames(context.Type))
+            {
+                var actualName = context.Type.GetField(name)?.GetCustomAttribute<EnumMemberAttribute>()?.Value ?? name;
+                model.Enum.Add(new OpenApiString(actualName));
+            }
         }
     }
 }

src/Umbraco.Cms.Api.Common/OpenApi/MimeTypeDocumentFilter.cs

@@ -1,4 +1,4 @@
-using Microsoft.OpenApi;
+using Microsoft.OpenApi.Models;
 using Swashbuckle.AspNetCore.SwaggerGen;
 using Umbraco.Extensions;
 
@@ -21,32 +21,25 @@ public class MimeTypeDocumentFilter : IDocumentFilter
         }
 
         OpenApiOperation[] operations = swaggerDoc.Paths
-            .SelectMany(path => path.Value.Operations?.Values ?? Enumerable.Empty<OpenApiOperation>())
+            .SelectMany(path => path.Value.Operations.Values)
             .ToArray();
 
-        void RemoveUnwantedMimeTypes(IDictionary<string, OpenApiMediaType>? content)
+        void RemoveUnwantedMimeTypes(IDictionary<string, OpenApiMediaType> content)
         {
-            if (content is null || content.ContainsKey("application/json") is false)
+            if (content.ContainsKey("application/json"))
             {
-                return;
+                content.RemoveAll(r => r.Key != "application/json");
             }
 
-            content.RemoveAll(r => r.Key != "application/json");
         }
 
-        OpenApiRequestBody[] requestBodies = operations
-            .Select(operation => operation.RequestBody)
-            .OfType<OpenApiRequestBody>()
-            .ToArray();
+        OpenApiRequestBody[] requestBodies = operations.Select(operation => operation.RequestBody).WhereNotNull().ToArray();
         foreach (OpenApiRequestBody requestBody in requestBodies)
         {
             RemoveUnwantedMimeTypes(requestBody.Content);
         }
 
-        OpenApiResponse[] responses = operations
-            .SelectMany(operation => operation.Responses?.Values ?? Enumerable.Empty<IOpenApiResponse>())
-            .OfType<OpenApiResponse>()
-            .ToArray();
+        OpenApiResponse[] responses = operations.SelectMany(operation => operation.Responses.Values).WhereNotNull().ToArray();
         foreach (OpenApiResponse response in responses)
         {
             RemoveUnwantedMimeTypes(response.Content);

src/Umbraco.Cms.Api.Common/OpenApi/RemoveSecuritySchemesDocumentFilter.cs

@@ -1,4 +1,4 @@
-using Microsoft.OpenApi;
+using Microsoft.OpenApi.Models;
 using Swashbuckle.AspNetCore.SwaggerGen;
 
 namespace Umbraco.Cms.Api.Common.OpenApi;
@@ -20,6 +20,6 @@ public class RemoveSecuritySchemesDocumentFilter : IDocumentFilter
             return;
         }
 
-        swaggerDoc.Components?.SecuritySchemes?.Clear();
+        swaggerDoc.Components.SecuritySchemes.Clear();
     }
 }

src/Umbraco.Cms.Api.Common/OpenApi/SubTypesSelector.cs

@@ -15,6 +15,20 @@ public class SubTypesSelector : ISubTypesSelector
     private readonly IEnumerable<ISubTypesHandler> _subTypeHandlers;
     private readonly IUmbracoJsonTypeInfoResolver _umbracoJsonTypeInfoResolver;
 
+    [Obsolete("The settings parameter is not required anymore, use the other constructor instead. Scheduled for removal in Umbraco 17.")]
+    public SubTypesSelector(
+        IOptions<GlobalSettings> settings,
+        IHostingEnvironment hostingEnvironment,
+        IHttpContextAccessor httpContextAccessor,
+        IEnumerable<ISubTypesHandler> subTypeHandlers,
+        IUmbracoJsonTypeInfoResolver umbracoJsonTypeInfoResolver)
+    {
+        _hostingEnvironment = hostingEnvironment;
+        _httpContextAccessor = httpContextAccessor;
+        _subTypeHandlers = subTypeHandlers;
+        _umbracoJsonTypeInfoResolver = umbracoJsonTypeInfoResolver;
+    }
+
     public SubTypesSelector(
         IHostingEnvironment hostingEnvironment,
         IHttpContextAccessor httpContextAccessor,

src/Umbraco.Cms.Api.Common/OpenApi/SwaggerRouteTemplatePipelineFilter.cs

@@ -3,12 +3,13 @@ using Microsoft.AspNetCore.Hosting;
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Hosting;
 using Microsoft.Extensions.Options;
-using Microsoft.OpenApi;
+using Microsoft.OpenApi.Models;
 using Swashbuckle.AspNetCore.SwaggerGen;
 using Swashbuckle.AspNetCore.SwaggerUI;
 using Umbraco.Cms.Core;
 using Umbraco.Cms.Core.Hosting;
 using Umbraco.Cms.Web.Common.ApplicationBuilder;
+using Umbraco.Extensions;
 using IHostingEnvironment = Umbraco.Cms.Core.Hosting.IHostingEnvironment;
 
 namespace Umbraco.Cms.Api.Common.OpenApi;

src/Umbraco.Cms.Api.Common/Umbraco.Cms.Api.Common.csproj

@@ -16,6 +16,11 @@
     <PackageReference Include="OpenIddict.AspNetCore" />
   </ItemGroup>
 
+  <ItemGroup>
+    <!-- Take top-level depedendency on OpenIddict.AspNetCore depends on a vulnerable version -->
+    <PackageReference Include="Microsoft.Extensions.Caching.Memory" />
+  </ItemGroup>
+
   <ItemGroup>
     <ProjectReference Include="..\Umbraco.Core\Umbraco.Core.csproj" />
     <ProjectReference Include="..\Umbraco.Web.Common\Umbraco.Web.Common.csproj" />

src/Umbraco.Cms.Api.Delivery/Configuration/ConfigureUmbracoDeliveryApiSwaggerGenOptions.cs

@@ -1,6 +1,6 @@
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Options;
-using Microsoft.OpenApi;
+using Microsoft.OpenApi.Models;
 using Swashbuckle.AspNetCore.SwaggerGen;
 using Umbraco.Cms.Api.Common.OpenApi;
 using Umbraco.Cms.Api.Delivery.Filters;

src/Umbraco.Cms.Api.Delivery/Configuration/ConfigureUmbracoMemberAuthenticationDeliveryApiSwaggerGenOptions.cs

@@ -1,6 +1,6 @@
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Options;
-using Microsoft.OpenApi;
+using Microsoft.OpenApi.Models;
 using Swashbuckle.AspNetCore.SwaggerGen;
 using Umbraco.Cms.Api.Common.Security;
 using Umbraco.Cms.Api.Delivery.Controllers.Content;
@@ -35,9 +35,23 @@ public class ConfigureUmbracoMemberAuthenticationDeliveryApiSwaggerGenOptions :
                 return;
             }
 
-            var schemaRef = new OpenApiSecuritySchemeReference(AuthSchemeName, context.Document);
-            operation.Security ??= new List<OpenApiSecurityRequirement>();
-            operation.Security.Add(new OpenApiSecurityRequirement { [schemaRef] = [] });
+            operation.Security = new List<OpenApiSecurityRequirement>
+            {
+                new OpenApiSecurityRequirement
+                {
+                    {
+                        new OpenApiSecurityScheme
+                        {
+                            Reference = new OpenApiReference
+                            {
+                                Type = ReferenceType.SecurityScheme,
+                                Id = AuthSchemeName,
+                            }
+                        },
+                        []
+                    }
+                }
+            };
         }
 
         public void Apply(OpenApiDocument swaggerDoc, DocumentFilterContext context)
@@ -47,7 +61,7 @@ public class ConfigureUmbracoMemberAuthenticationDeliveryApiSwaggerGenOptions :
                 return;
             }
 
-            swaggerDoc.AddComponent(
+            swaggerDoc.Components.SecuritySchemes.Add(
                 AuthSchemeName,
                 new OpenApiSecurityScheme
                 {
@@ -60,9 +74,9 @@ public class ConfigureUmbracoMemberAuthenticationDeliveryApiSwaggerGenOptions :
                         AuthorizationCode = new OpenApiOAuthFlow
                         {
                             AuthorizationUrl = new Uri(Paths.MemberApi.AuthorizationEndpoint, UriKind.Relative),
-                            TokenUrl = new Uri(Paths.MemberApi.TokenEndpoint, UriKind.Relative),
-                        },
-                    },
+                            TokenUrl = new Uri(Paths.MemberApi.TokenEndpoint, UriKind.Relative)
+                        }
+                    }
                 });
         }
     }

src/Umbraco.Cms.Api.Delivery/Filters/SwaggerContentDocumentationFilter.cs

@@ -1,9 +1,9 @@
-using System.Text.Json.Nodes;
-using Microsoft.OpenApi;
+using Microsoft.OpenApi.Any;
+using Microsoft.OpenApi.Models;
 using Swashbuckle.AspNetCore.SwaggerGen;
 using Umbraco.Cms.Api.Delivery.Configuration;
+using Umbraco.Cms.Api.Delivery.Controllers;
 using Umbraco.Cms.Api.Delivery.Controllers.Content;
-using Umbraco.Cms.Core;
 
 namespace Umbraco.Cms.Api.Delivery.Filters;
 
@@ -13,7 +13,7 @@ internal sealed class SwaggerContentDocumentationFilter : SwaggerDocumentationFi
 
     protected override void ApplyOperation(OpenApiOperation operation, OperationFilterContext context)
     {
-        operation.Parameters ??= new List<IOpenApiParameter>();
+        operation.Parameters ??= new List<OpenApiParameter>();
 
         AddExpand(operation, context);
 
@@ -21,50 +21,50 @@ internal sealed class SwaggerContentDocumentationFilter : SwaggerDocumentationFi
 
         operation.Parameters.Add(new OpenApiParameter
         {
-            Name = Constants.DeliveryApi.HeaderNames.AcceptLanguage,
+            Name = Core.Constants.DeliveryApi.HeaderNames.AcceptLanguage,
             In = ParameterLocation.Header,
             Required = false,
             Description = "Defines the language to return. Use this when querying language variant content items.",
-            Schema = new OpenApiSchema { Type = JsonSchemaType.String },
-            Examples = new Dictionary<string, IOpenApiExample>
+            Schema = new OpenApiSchema { Type = "string" },
+            Examples = new Dictionary<string, OpenApiExample>
             {
-                { "Default", new OpenApiExample { Value = string.Empty } },
-                { "English culture", new OpenApiExample { Value = "en-us" } },
-            },
+                { "Default", new OpenApiExample { Value = new OpenApiString(string.Empty) } },
+                { "English culture", new OpenApiExample { Value = new OpenApiString("en-us") } }
+            }
         });
 
         operation.Parameters.Add(new OpenApiParameter
         {
-            Name = Constants.DeliveryApi.HeaderNames.AcceptSegment,
+            Name = Core.Constants.DeliveryApi.HeaderNames.AcceptSegment,
             In = ParameterLocation.Header,
             Required = false,
             Description = "Defines the segment to return. Use this when querying segment variant content items.",
-            Schema = new OpenApiSchema { Type = JsonSchemaType.String },
-            Examples = new Dictionary<string, IOpenApiExample>
+            Schema = new OpenApiSchema { Type = "string" },
+            Examples = new Dictionary<string, OpenApiExample>
             {
-                { "Default", new OpenApiExample { Value = string.Empty } },
-                { "Segment One", new OpenApiExample { Value = "segment-one" } },
-            },
+                { "Default", new OpenApiExample { Value = new OpenApiString(string.Empty) } },
+                { "Segment One", new OpenApiExample { Value = new OpenApiString("segment-one") } }
+            }
         });
 
         AddApiKey(operation);
 
         operation.Parameters.Add(new OpenApiParameter
         {
-            Name = Constants.DeliveryApi.HeaderNames.Preview,
+            Name = Core.Constants.DeliveryApi.HeaderNames.Preview,
             In = ParameterLocation.Header,
             Required = false,
             Description = "Whether to request draft content.",
-            Schema = new OpenApiSchema { Type = JsonSchemaType.Boolean },
+            Schema = new OpenApiSchema { Type = "boolean" }
         });
 
         operation.Parameters.Add(new OpenApiParameter
         {
-            Name = Constants.DeliveryApi.HeaderNames.StartItem,
+            Name = Core.Constants.DeliveryApi.HeaderNames.StartItem,
             In = ParameterLocation.Header,
             Required = false,
             Description = "URL segment or GUID of a root content item.",
-            Schema = new OpenApiSchema { Type = JsonSchemaType.String },
+            Schema = new OpenApiSchema { Type = "string" }
         });
     }
 
@@ -92,36 +92,105 @@ internal sealed class SwaggerContentDocumentationFilter : SwaggerDocumentationFi
         }
     }
 
-    private Dictionary<string, IOpenApiExample> FetchQueryParameterExamples() =>
+    private Dictionary<string, OpenApiExample> FetchQueryParameterExamples() =>
         new()
         {
-            { "Select all", new OpenApiExample { Value = string.Empty } },
-            { "Select all ancestors of a node by id", new OpenApiExample { Value = "ancestors:id" } },
-            { "Select all ancestors of a node by path", new OpenApiExample { Value = "ancestors:path" } },
-            { "Select all children of a node by id", new OpenApiExample { Value = "children:id" } },
-            { "Select all children of a node by path", new OpenApiExample { Value = "children:path" } },
-            { "Select all descendants of a node by id", new OpenApiExample { Value = "descendants:id" } },
-            { "Select all descendants of a node by path", new OpenApiExample { Value = "descendants:path" } },
+            { "Select all", new OpenApiExample { Value = new OpenApiString(string.Empty) } },
+            {
+                "Select all ancestors of a node by id",
+                new OpenApiExample { Value = new OpenApiString("ancestors:id") }
+            },
+            {
+                "Select all ancestors of a node by path",
+                new OpenApiExample { Value = new OpenApiString("ancestors:path") }
+            },
+            {
+                "Select all children of a node by id",
+                new OpenApiExample { Value = new OpenApiString("children:id") }
+            },
+            {
+                "Select all children of a node by path",
+                new OpenApiExample { Value = new OpenApiString("children:path") }
+            },
+            {
+                "Select all descendants of a node by id",
+                new OpenApiExample { Value = new OpenApiString("descendants:id") }
+            },
+            {
+                "Select all descendants of a node by path",
+                new OpenApiExample { Value = new OpenApiString("descendants:path") }
+            }
         };
 
-    private Dictionary<string, IOpenApiExample> FilterQueryParameterExamples() =>
+    private Dictionary<string, OpenApiExample> FilterQueryParameterExamples() =>
         new()
         {
-            { "Default filter", new OpenApiExample { Value = string.Empty } },
-            { "Filter by content type (equals)", new OpenApiExample { Value = new JsonArray { "contentType:alias1" } } },
-            { "Filter by name (contains)", new OpenApiExample { Value = new JsonArray { "name:nodeName" } } },
-            { "Filter by creation date (less than)", new OpenApiExample { Value = new JsonArray { "createDate<2024-01-01" } } },
-            { "Filter by update date (greater than or equal)", new OpenApiExample { Value = new JsonArray { "updateDate>:2023-01-01" } } },
+            { "Default filter", new OpenApiExample { Value = new OpenApiString(string.Empty) } },
+            {
+                "Filter by content type (equals)",
+                new OpenApiExample { Value = new OpenApiArray { new OpenApiString("contentType:alias1") } }
+            },
+            {
+                "Filter by name (contains)",
+                new OpenApiExample { Value = new OpenApiArray { new OpenApiString("name:nodeName") } }
+            },
+            {
+                "Filter by creation date (less than)",
+                new OpenApiExample { Value = new OpenApiArray { new OpenApiString("createDate<2024-01-01") } }
+            },
+            {
+                "Filter by update date (greater than or equal)",
+                new OpenApiExample { Value = new OpenApiArray { new OpenApiString("updateDate>:2023-01-01") } }
+            }
         };
 
-    private Dictionary<string, IOpenApiExample> SortQueryParameterExamples() =>
+    private Dictionary<string, OpenApiExample> SortQueryParameterExamples() =>
         new()
         {
-            { "Default sort", new OpenApiExample { Value = string.Empty } },
-            { "Sort by create date", new OpenApiExample { Value = new JsonArray { "createDate:asc", "createDate:desc" } } },
-            { "Sort by level", new OpenApiExample { Value = new JsonArray { "level:asc", "level:desc" } } },
-            { "Sort by name", new OpenApiExample { Value = new JsonArray { "name:asc", "name:desc" } } },
-            { "Sort by sort order", new OpenApiExample { Value = new JsonArray { "sortOrder:asc", "sortOrder:desc" } } },
-            { "Sort by update date", new OpenApiExample { Value = new JsonArray { "updateDate:asc", "updateDate:desc" } } },
+            { "Default sort", new OpenApiExample { Value = new OpenApiString(string.Empty) } },
+            {
+                "Sort by create date",
+                new OpenApiExample
+                {
+                    Value = new OpenApiArray
+                    {
+                        new OpenApiString("createDate:asc"), new OpenApiString("createDate:desc")
+                    }
+                }
+            },
+            {
+                "Sort by level",
+                new OpenApiExample
+                {
+                    Value = new OpenApiArray { new OpenApiString("level:asc"), new OpenApiString("level:desc") }
+                }
+            },
+            {
+                "Sort by name",
+                new OpenApiExample
+                {
+                    Value = new OpenApiArray { new OpenApiString("name:asc"), new OpenApiString("name:desc") }
+                }
+            },
+            {
+                "Sort by sort order",
+                new OpenApiExample
+                {
+                    Value = new OpenApiArray
+                    {
+                        new OpenApiString("sortOrder:asc"), new OpenApiString("sortOrder:desc")
+                    }
+                }
+            },
+            {
+                "Sort by update date",
+                new OpenApiExample
+                {
+                    Value = new OpenApiArray
+                    {
+                        new OpenApiString("updateDate:asc"), new OpenApiString("updateDate:desc")
+                    }
+                }
+            }
         };
 }

src/Umbraco.Cms.Api.Delivery/Filters/SwaggerDocumentationFilterBase.cs

@@ -1,7 +1,7 @@
 using Microsoft.AspNetCore.Mvc;
-using Microsoft.OpenApi;
+using Microsoft.OpenApi.Any;
+using Microsoft.OpenApi.Models;
 using Swashbuckle.AspNetCore.SwaggerGen;
-using Umbraco.Cms.Core;
 
 namespace Umbraco.Cms.Api.Delivery.Filters;
 
@@ -9,8 +9,6 @@ internal abstract class SwaggerDocumentationFilterBase<TBaseController>
     : SwaggerFilterBase<TBaseController>, IOperationFilter, IParameterFilter
     where TBaseController : Controller
 {
-    protected abstract string DocumentationLink { get; }
-
     public void Apply(OpenApiOperation operation, OperationFilterContext context)
     {
         if (CanApply(context))
@@ -19,19 +17,21 @@ internal abstract class SwaggerDocumentationFilterBase<TBaseController>
         }
     }
 
-    public void Apply(IOpenApiParameter parameter, ParameterFilterContext context)
+    public void Apply(OpenApiParameter parameter, ParameterFilterContext context)
     {
-        if (CanApply(context) && parameter is OpenApiParameter openApiParameter)
+        if (CanApply(context))
         {
-            ApplyParameter(openApiParameter, context);
+            ApplyParameter(parameter, context);
         }
     }
 
+    protected abstract string DocumentationLink { get; }
+
     protected abstract void ApplyOperation(OpenApiOperation operation, OperationFilterContext context);
 
     protected abstract void ApplyParameter(OpenApiParameter parameter, ParameterFilterContext context);
 
-    protected void AddQueryParameterDocumentation(OpenApiParameter parameter, Dictionary<string, IOpenApiExample> examples, string description)
+    protected void AddQueryParameterDocumentation(OpenApiParameter parameter, Dictionary<string, OpenApiExample> examples, string description)
     {
         parameter.Description = QueryParameterDescription(description);
         parameter.Examples = examples;
@@ -60,19 +60,15 @@ internal abstract class SwaggerDocumentationFilterBase<TBaseController>
         AddFields(operation);
     }
 
-    protected void AddApiKey(OpenApiOperation operation)
-    {
-        operation.Parameters ??= new List<IOpenApiParameter>();
-        operation.Parameters.Add(
-            new OpenApiParameter
-            {
-                Name = Constants.DeliveryApi.HeaderNames.ApiKey,
-                In = ParameterLocation.Header,
-                Required = false,
-                Description = "API key specified through configuration to authorize access to the API.",
-                Schema = new OpenApiSchema { Type = JsonSchemaType.String },
-            });
-    }
+    protected void AddApiKey(OpenApiOperation operation) =>
+        operation.Parameters.Add(new OpenApiParameter
+        {
+            Name = Core.Constants.DeliveryApi.HeaderNames.ApiKey,
+            In = ParameterLocation.Header,
+            Required = false,
+            Description = "API key specified through configuration to authorize access to the API.",
+            Schema = new OpenApiSchema { Type = "string" }
+        });
 
     protected string PaginationDescription(bool skip, string itemType)
         => $"Specifies the number of found {itemType} items to {(skip ? "skip" : "take")}. Use this to control pagination of the response.";
@@ -86,70 +82,78 @@ internal abstract class SwaggerDocumentationFilterBase<TBaseController>
 
     // FIXME: remove this when Delivery API V1 has been removed (expectedly in V15)
     private void AddExpandV1(OpenApiOperation operation)
-    {
-        operation.Parameters ??= new List<IOpenApiParameter>();
-        operation.Parameters.Add(
-            new OpenApiParameter
+        => operation.Parameters.Add(new OpenApiParameter
+        {
+            Name = "expand",
+            In = ParameterLocation.Query,
+            Required = false,
+            Description = QueryParameterDescription("Defines the properties that should be expanded in the response"),
+            Schema = new OpenApiSchema { Type = "string" },
+            Examples = new Dictionary<string, OpenApiExample>
             {
-                Name = "expand",
-                In = ParameterLocation.Query,
-                Required = false,
-                Description =
-                    QueryParameterDescription("Defines the properties that should be expanded in the response"),
-                Schema = new OpenApiSchema { Type = JsonSchemaType.String },
-                Examples = new Dictionary<string, IOpenApiExample>
+                { "Expand none", new OpenApiExample { Value = new OpenApiString(string.Empty) } },
+                { "Expand all", new OpenApiExample { Value = new OpenApiString("all") } },
                 {
-                    { "Expand none", new OpenApiExample { Value = string.Empty } },
-                    { "Expand all", new OpenApiExample { Value = "all" } },
-                    { "Expand specific property", new OpenApiExample { Value = "property:alias1" } },
-                    { "Expand specific properties", new OpenApiExample { Value = "property:alias1,alias2" } },
+                    "Expand specific property",
+                    new OpenApiExample { Value = new OpenApiString("property:alias1") }
                 },
-            });
-    }
+                {
+                    "Expand specific properties",
+                    new OpenApiExample { Value = new OpenApiString("property:alias1,alias2") }
+                }
+            }
+        });
 
     private void AddExpand(OpenApiOperation operation)
-    {
-        operation.Parameters ??= new List<IOpenApiParameter>();
-        operation.Parameters.Add(
-            new OpenApiParameter
+        => operation.Parameters.Add(new OpenApiParameter
+        {
+            Name = "expand",
+            In = ParameterLocation.Query,
+            Required = false,
+            Description = QueryParameterDescription("Defines the properties that should be expanded in the response"),
+            Schema = new OpenApiSchema { Type = "string" },
+            Examples = new Dictionary<string, OpenApiExample>
             {
-                Name = "expand",
-                In = ParameterLocation.Query,
-                Required = false,
-                Description =
-                    QueryParameterDescription("Defines the properties that should be expanded in the response"),
-                Schema = new OpenApiSchema { Type = JsonSchemaType.String },
-                Examples = new Dictionary<string, IOpenApiExample>
+                { "Expand none", new OpenApiExample { Value = new OpenApiString(string.Empty) } },
+                { "Expand all properties", new OpenApiExample { Value = new OpenApiString("properties[$all]") } },
                 {
-                    { "Expand none", new OpenApiExample { Value = string.Empty } },
-                    { "Expand all properties", new OpenApiExample { Value = "properties[$all]" } },
-                    { "Expand specific property", new OpenApiExample { Value = "properties[alias1]" } },
-                    { "Expand specific properties", new OpenApiExample { Value = "properties[alias1,alias2]" } },
-                    { "Expand nested properties", new OpenApiExample { Value = "properties[alias1[properties[nestedAlias1,nestedAlias2]]]" } },
+                    "Expand specific property",
+                    new OpenApiExample { Value = new OpenApiString("properties[alias1]") }
                 },
-            });
-    }
+                {
+                    "Expand specific properties",
+                    new OpenApiExample { Value = new OpenApiString("properties[alias1,alias2]") }
+                },
+                {
+                    "Expand nested properties",
+                    new OpenApiExample { Value = new OpenApiString("properties[alias1[properties[nestedAlias1,nestedAlias2]]]") }
+                }
+            }
+        });
 
     private void AddFields(OpenApiOperation operation)
-    {
-        operation.Parameters ??= new List<IOpenApiParameter>();
-        operation.Parameters.Add(
-            new OpenApiParameter
+        => operation.Parameters.Add(new OpenApiParameter
+        {
+            Name = "fields",
+            In = ParameterLocation.Query,
+            Required = false,
+            Description = QueryParameterDescription("Explicitly defines which properties should be included in the response (by default all properties are included)"),
+            Schema = new OpenApiSchema { Type = "string" },
+            Examples = new Dictionary<string, OpenApiExample>
             {
-                Name = "fields",
-                In = ParameterLocation.Query,
-                Required = false,
-                Description =
-                    QueryParameterDescription(
-                        "Explicitly defines which properties should be included in the response (by default all properties are included)"),
-                Schema = new OpenApiSchema { Type = JsonSchemaType.String },
-                Examples = new Dictionary<string, IOpenApiExample>
+                { "Include all properties", new OpenApiExample { Value = new OpenApiString("properties[$all]") } },
                 {
-                    { "Include all properties", new OpenApiExample { Value = "properties[$all]" } },
-                    { "Include only specific property", new OpenApiExample { Value = "properties[alias1]" } },
-                    { "Include only specific properties", new OpenApiExample { Value = "properties[alias1,alias2]" } },
-                    { "Include only specific nested properties", new OpenApiExample { Value = "properties[alias1[properties[nestedAlias1,nestedAlias2]]]" } },
+                    "Include only specific property",
+                    new OpenApiExample { Value = new OpenApiString("properties[alias1]") }
                 },
-            });
-    }
+                {
+                    "Include only specific properties",
+                    new OpenApiExample { Value = new OpenApiString("properties[alias1,alias2]") }
+                },
+                {
+                    "Include only specific nested properties",
+                    new OpenApiExample { Value = new OpenApiString("properties[alias1[properties[nestedAlias1,nestedAlias2]]]") }
+                }
+            }
+        });
 }

src/Umbraco.Cms.Api.Delivery/Filters/SwaggerMediaDocumentationFilter.cs

@@ -1,7 +1,8 @@
-using System.Text.Json.Nodes;
-using Microsoft.OpenApi;
+using Microsoft.OpenApi.Any;
+using Microsoft.OpenApi.Models;
 using Swashbuckle.AspNetCore.SwaggerGen;
 using Umbraco.Cms.Api.Delivery.Configuration;
+using Umbraco.Cms.Api.Delivery.Controllers;
 using Umbraco.Cms.Api.Delivery.Controllers.Media;
 
 namespace Umbraco.Cms.Api.Delivery.Filters;
@@ -12,7 +13,7 @@ internal sealed class SwaggerMediaDocumentationFilter : SwaggerDocumentationFilt
 
     protected override void ApplyOperation(OpenApiOperation operation, OperationFilterContext context)
     {
-        operation.Parameters ??= new List<IOpenApiParameter>();
+        operation.Parameters ??= new List<OpenApiParameter>();
 
         AddExpand(operation, context);
 
@@ -45,29 +46,77 @@ internal sealed class SwaggerMediaDocumentationFilter : SwaggerDocumentationFilt
         }
     }
 
-    private Dictionary<string, IOpenApiExample> FetchQueryParameterExamples() =>
+    private Dictionary<string, OpenApiExample> FetchQueryParameterExamples() =>
         new()
         {
-            { "Select all children at root level", new OpenApiExample { Value = "children:/" } },
-            { "Select all children of a media item by id", new OpenApiExample { Value = "children:id" } },
-            { "Select all children of a media item by path", new OpenApiExample { Value = "children:path" } },
+            {
+                "Select all children at root level",
+                new OpenApiExample { Value = new OpenApiString("children:/") }
+            },
+            {
+                "Select all children of a media item by id",
+                new OpenApiExample { Value = new OpenApiString("children:id") }
+            },
+            {
+                "Select all children of a media item by path",
+                new OpenApiExample { Value = new OpenApiString("children:path") }
+            }
         };
 
-    private Dictionary<string, IOpenApiExample> FilterQueryParameterExamples() =>
+    private Dictionary<string, OpenApiExample> FilterQueryParameterExamples() =>
         new()
         {
-            { "Default filter", new OpenApiExample { Value = string.Empty } },
-            { "Filter by media type", new OpenApiExample { Value = new JsonArray { "mediaType:alias1" } } },
-            { "Filter by name", new OpenApiExample { Value = new JsonArray { "name:nodeName" } } },
+            { "Default filter", new OpenApiExample { Value = new OpenApiString(string.Empty) } },
+            {
+                "Filter by media type",
+                new OpenApiExample { Value = new OpenApiArray { new OpenApiString("mediaType:alias1") } }
+            },
+            {
+                "Filter by name",
+                new OpenApiExample { Value = new OpenApiArray { new OpenApiString("name:nodeName") } }
+            }
         };
 
-    private Dictionary<string, IOpenApiExample> SortQueryParameterExamples() =>
+    private Dictionary<string, OpenApiExample> SortQueryParameterExamples() =>
         new()
         {
-            { "Default sort", new OpenApiExample { Value = string.Empty } },
-            { "Sort by create date", new OpenApiExample { Value = new JsonArray { "createDate:asc", "createDate:desc" } } },
-            { "Sort by name", new OpenApiExample { Value = new JsonArray { "name:asc", "name:desc" } } },
-            { "Sort by sort order", new OpenApiExample { Value = new JsonArray { "sortOrder:asc", "sortOrder:desc" } } },
-            { "Sort by update date", new OpenApiExample { Value = new JsonArray { "updateDate:asc", "updateDate:desc" } } },
+            { "Default sort", new OpenApiExample { Value = new OpenApiString(string.Empty) } },
+            {
+                "Sort by create date",
+                new OpenApiExample
+                {
+                    Value = new OpenApiArray
+                    {
+                        new OpenApiString("createDate:asc"), new OpenApiString("createDate:desc")
+                    }
+                }
+            },
+            {
+                "Sort by name",
+                new OpenApiExample
+                {
+                    Value = new OpenApiArray { new OpenApiString("name:asc"), new OpenApiString("name:desc") }
+                }
+            },
+            {
+                "Sort by sort order",
+                new OpenApiExample
+                {
+                    Value = new OpenApiArray
+                    {
+                        new OpenApiString("sortOrder:asc"), new OpenApiString("sortOrder:desc")
+                    }
+                }
+            },
+            {
+                "Sort by update date",
+                new OpenApiExample
+                {
+                    Value = new OpenApiArray
+                    {
+                        new OpenApiString("updateDate:asc"), new OpenApiString("updateDate:desc")
+                    }
+                }
+            }
         };
 }

src/Umbraco.Cms.Api.Delivery/Querying/QueryOptionBase.cs

@@ -1,5 +1,8 @@
+using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Core.DeliveryApi;
+using Umbraco.Cms.Core.DependencyInjection;
 using Umbraco.Cms.Core.Models.PublishedContent;
+using Umbraco.Cms.Core.PublishedCache;
 using Umbraco.Extensions;
 
 namespace Umbraco.Cms.Api.Delivery.Querying;
@@ -11,6 +14,30 @@ public abstract class QueryOptionBase
     private readonly IApiDocumentUrlService _apiDocumentUrlService;
     private readonly IVariationContextAccessor _variationContextAccessor;
 
+    [Obsolete("Please use the non-obsolete constructor. Will be removed in V17.")]
+    public QueryOptionBase(
+        IPublishedContentCache publishedContentCache,
+        IRequestRoutingService requestRoutingService)
+        : this(
+            requestRoutingService,
+            StaticServiceProvider.Instance.GetRequiredService<IRequestPreviewService>(),
+            StaticServiceProvider.Instance.GetRequiredService<IApiDocumentUrlService>(),
+            StaticServiceProvider.Instance.GetRequiredService<IVariationContextAccessor>())
+    {
+    }
+
+    [Obsolete("Please use the non-obsolete constructor. Will be removed in V17.")]
+    public QueryOptionBase(
+        IPublishedContentCache publishedContentCache,
+        IRequestRoutingService requestRoutingService,
+        IRequestPreviewService requestPreviewService,
+        IRequestCultureService requestCultureService,
+        IApiDocumentUrlService apiDocumentUrlService,
+        IVariationContextAccessor variationContextAccessor)
+        : this(requestRoutingService, requestPreviewService, apiDocumentUrlService, variationContextAccessor)
+    {
+    }
+
     public QueryOptionBase(
         IRequestRoutingService requestRoutingService,
         IRequestPreviewService requestPreviewService,

src/Umbraco.Cms.Api.Delivery/Querying/Selectors/AncestorsSelector.cs

@@ -1,6 +1,9 @@
+using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Api.Delivery.Indexing.Selectors;
 using Umbraco.Cms.Core.DeliveryApi;
+using Umbraco.Cms.Core.DependencyInjection;
 using Umbraco.Cms.Core.Models.PublishedContent;
+using Umbraco.Cms.Core.PublishedCache;
 using Umbraco.Cms.Core.Services.Navigation;
 
 namespace Umbraco.Cms.Api.Delivery.Querying.Selectors;
@@ -10,6 +13,46 @@ public sealed class AncestorsSelector : QueryOptionBase, ISelectorHandler
     private readonly IDocumentNavigationQueryService _navigationQueryService;
     private const string AncestorsSpecifier = "ancestors:";
 
+    [Obsolete("Please use the non-obsolete constructor. Will be removed in V17.")]
+    public AncestorsSelector(
+        IPublishedContentCache publishedContentCache,
+        IRequestRoutingService requestRoutingService,
+        IDocumentNavigationQueryService navigationQueryService,
+        IRequestPreviewService requestPreviewService)
+        : this(
+            requestRoutingService,
+            requestPreviewService,
+            StaticServiceProvider.Instance.GetRequiredService<IApiDocumentUrlService>(),
+            StaticServiceProvider.Instance.GetRequiredService<IVariationContextAccessor>(),
+            navigationQueryService)
+    {
+    }
+
+    [Obsolete("Please use the non-obsolete constructor. Will be removed in V17.")]
+    public AncestorsSelector(
+        IPublishedContentCache publishedContentCache,
+        IRequestRoutingService requestRoutingService,
+        IDocumentNavigationQueryService navigationQueryService)
+        : this(
+            requestRoutingService,
+            StaticServiceProvider.Instance.GetRequiredService<IRequestPreviewService>(),
+            StaticServiceProvider.Instance.GetRequiredService<IApiDocumentUrlService>(),
+            StaticServiceProvider.Instance.GetRequiredService<IVariationContextAccessor>(),
+            navigationQueryService)
+    {
+    }
+
+    [Obsolete("Use the constructor that takes all parameters. Scheduled for removal in V17.")]
+    public AncestorsSelector(IPublishedContentCache publishedContentCache, IRequestRoutingService requestRoutingService)
+        : this(
+            requestRoutingService,
+            StaticServiceProvider.Instance.GetRequiredService<IRequestPreviewService>(),
+            StaticServiceProvider.Instance.GetRequiredService<IApiDocumentUrlService>(),
+            StaticServiceProvider.Instance.GetRequiredService<IVariationContextAccessor>(),
+            StaticServiceProvider.Instance.GetRequiredService<IDocumentNavigationQueryService>())
+    {
+    }
+
     public AncestorsSelector(
         IRequestRoutingService requestRoutingService,
         IRequestPreviewService requestPreviewService,
@@ -19,6 +62,18 @@ public sealed class AncestorsSelector : QueryOptionBase, ISelectorHandler
         : base(requestRoutingService, requestPreviewService, apiDocumentUrlService, variationContextAccessor)
         => _navigationQueryService = navigationQueryService;
 
+    [Obsolete("Use the constructor that takes all parameters. Scheduled for removal in V17.")]
+    public AncestorsSelector(
+        IRequestRoutingService requestRoutingService,
+        IPublishedContentCache publishedContentCache,
+        IRequestPreviewService requestPreviewService,
+        IApiDocumentUrlService apiDocumentUrlService,
+        IVariationContextAccessor variationContextAccessor,
+        IDocumentNavigationQueryService navigationQueryService)
+        : this(requestRoutingService, requestPreviewService, apiDocumentUrlService, variationContextAccessor, navigationQueryService)
+    {
+    }
+
     /// <inheritdoc />
     public bool CanHandle(string query)
         => query.StartsWith(AncestorsSpecifier, StringComparison.OrdinalIgnoreCase);

src/Umbraco.Cms.Api.Delivery/Querying/Selectors/ChildrenSelector.cs

@@ -12,6 +12,27 @@ public sealed class ChildrenSelector : QueryOptionBase, ISelectorHandler
 {
     private const string ChildrenSpecifier = "children:";
 
+    [Obsolete("Please use the non-obsolete constructor. Will be removed in V17.")]
+    public ChildrenSelector(IPublishedContentCache publishedContentCache, IRequestRoutingService requestRoutingService)
+        : this(
+            requestRoutingService,
+            StaticServiceProvider.Instance.GetRequiredService<IRequestPreviewService>(),
+            StaticServiceProvider.Instance.GetRequiredService<IApiDocumentUrlService>(),
+            StaticServiceProvider.Instance.GetRequiredService<IVariationContextAccessor>())
+    {
+    }
+
+    [Obsolete("Please use the non-obsolete constructor. Will be removed in V17.")]
+    public ChildrenSelector(
+        IPublishedContentCache publishedContentCache,
+        IRequestRoutingService requestRoutingService,
+        IRequestPreviewService requestPreviewService,
+        IApiDocumentUrlService apiDocumentUrlService,
+        IVariationContextAccessor variationContextAccessor)
+        : this(requestRoutingService, requestPreviewService, apiDocumentUrlService, variationContextAccessor)
+    {
+    }
+
     public ChildrenSelector(
         IRequestRoutingService requestRoutingService,
         IRequestPreviewService requestPreviewService,

src/Umbraco.Cms.Api.Delivery/Querying/Selectors/DescendantsSelector.cs

@@ -12,6 +12,27 @@ public sealed class DescendantsSelector : QueryOptionBase, ISelectorHandler
 {
     private const string DescendantsSpecifier = "descendants:";
 
+    [Obsolete("Please use the non-obsolete constructor. Will be removed in V17.")]
+    public DescendantsSelector(IPublishedContentCache publishedContentCache, IRequestRoutingService requestRoutingService)
+        : this(
+            requestRoutingService,
+            StaticServiceProvider.Instance.GetRequiredService<IRequestPreviewService>(),
+            StaticServiceProvider.Instance.GetRequiredService<IApiDocumentUrlService>(),
+            StaticServiceProvider.Instance.GetRequiredService<IVariationContextAccessor>())
+    {
+    }
+
+    [Obsolete("Please use the non-obsolete constructor. Will be removed in V17.")]
+    public DescendantsSelector(
+        IPublishedContentCache publishedContentCache,
+        IRequestRoutingService requestRoutingService,
+        IRequestPreviewService requestPreviewService,
+        IApiDocumentUrlService apiDocumentUrlService,
+        IVariationContextAccessor variationContextAccessor)
+        : this(requestRoutingService, requestPreviewService, apiDocumentUrlService, variationContextAccessor)
+    {
+    }
+
     public DescendantsSelector(
         IRequestRoutingService requestRoutingService,
         IRequestPreviewService requestPreviewService,

src/Umbraco.Cms.Api.Delivery/Routing/DeliveryApiItemsEndpointsMatcherPolicy.cs

@@ -66,14 +66,9 @@ internal sealed class DeliveryApiItemsEndpointsMatcherPolicy : MatcherPolicy, IE
     {
         ApiVersion[]? supportedApiVersions = endpoint.Metadata.GetMetadata<MapToApiVersionAttribute>()?.Versions.ToArray();
 
-        // If the endpoint is versioned, the requested API version must be among the API versions supported by the endpoint.
-        // If the endpoint is NOT versioned, it cannot be used with a requested API version.
-        if (supportedApiVersions is not null && requestedApiVersion is not null)
-        {
-            return supportedApiVersions.Contains(requestedApiVersion);
-        }
-
-        return requestedApiVersion is null;
+        // if the endpoint is versioned, the requested API version must be among the API versions supported by the endpoint.
+        // if the endpoint is NOT versioned, it cannot be used with a requested API version
+        return supportedApiVersions?.Contains(requestedApiVersion) ?? requestedApiVersion is null;
     }
 
     private static bool IsByIdsController(ControllerActionDescriptor? controllerActionDescriptor)

src/Umbraco.Cms.Api.Delivery/Services/ApiMediaQueryService.cs

@@ -66,7 +66,7 @@ internal sealed class ApiMediaQueryService : IApiMediaQueryService
     private IPublishedContent? TryGetByPath(string path, IPublishedMediaCache mediaCache)
     {
         var segments = path.Split(Constants.CharArrays.ForwardSlash, StringSplitOptions.RemoveEmptyEntries);
-        IEnumerable<IPublishedContent> currentChildren = GetRootContent(mediaCache);
+        IEnumerable<IPublishedContent> currentChildren = mediaCache.GetAtRoot();
         IPublishedContent? resolvedMedia = null;
 
         foreach (var segment in segments)
@@ -103,7 +103,7 @@ internal sealed class ApiMediaQueryService : IApiMediaQueryService
         IPublishedMediaCache mediaCache = GetRequiredPublishedMediaCache();
         if (childrenOf.Trim(Constants.CharArrays.ForwardSlash).Length == 0)
         {
-            return GetRootContent(mediaCache);
+            return mediaCache.GetAtRoot();
         }
 
         IPublishedContent? parent = Guid.TryParse(childrenOf, out Guid parentKey)
@@ -196,8 +196,4 @@ internal sealed class ApiMediaQueryService : IApiMediaQueryService
 
         return Attempt.SucceedWithStatus(ApiMediaQueryOperationStatus.Success, result);
     }
-
-    private IEnumerable<IPublishedContent> GetRootContent(IPublishedMediaCache mediaCache)
-        => _mediaNavigationQueryService.TryGetRootKeys(out IEnumerable<Guid> rootKeys) is false ? []
-            : rootKeys.Select(x => mediaCache.GetById(false, x)).WhereNotNull();
 }

src/Umbraco.Cms.Api.Delivery/Services/RequestCultureService.cs

@@ -19,6 +19,12 @@ internal sealed partial class RequestCultureService : RequestHeaderHandler, IReq
         return ValidLanguageHeaderRegex().IsMatch(acceptLanguage) ? acceptLanguage : null;
     }
 
+    [Obsolete("Use IVariationContextAccessor to manipulate the variation context. Scheduled for removal in V17.")]
+    public void SetRequestCulture(string culture)
+    {
+        // no-op
+    }
+
     // at the time of writing we're introducing this to get rid of accept-language header values like "en-GB,en-US;q=0.9,en;q=0.8",
     // so we don't want to be too restrictive in this regex - keep it simple for now.
     [GeneratedRegex(@"^[\w-]*$")]

src/Umbraco.Cms.Api.Delivery/Umbraco.Cms.Api.Delivery.csproj

@@ -3,7 +3,6 @@
     <Title>Umbraco CMS - Delivery API</Title>
     <Description>Contains the presentation layer for the Umbraco CMS Delivery API.</Description>
   </PropertyGroup>
-
   <PropertyGroup>
     <!--
       TODO: Fix and remove overrides:
@@ -12,18 +11,11 @@
     -->
     <WarningsNotAsErrors>$(WarningsNotAsErrors),ASP0019,CS0618,CS0612</WarningsNotAsErrors>
   </PropertyGroup>
-
   <ItemGroup>
     <ProjectReference Include="..\Umbraco.Cms.Api.Common\Umbraco.Cms.Api.Common.csproj" />
     <ProjectReference Include="..\Umbraco.Web.Common\Umbraco.Web.Common.csproj" />
   </ItemGroup>
 
-  <ItemGroup>
-    <PackageReference Include="System.Linq.Async">
-      <ExcludeAssets>compile</ExcludeAssets>
-    </PackageReference>
-  </ItemGroup>
-
   <ItemGroup>
     <AssemblyAttribute Include="System.Runtime.CompilerServices.InternalsVisibleTo">
       <_Parameter1>Umbraco.Tests.UnitTests</_Parameter1>

src/Umbraco.Cms.Api.Management/Configuration/ConfigureBackOfficeCookieOptions.cs

@@ -5,7 +5,6 @@ using Microsoft.AspNetCore.DataProtection;
 using Microsoft.AspNetCore.Http;
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Options;
-using Microsoft.Net.Http.Headers;
 using Umbraco.Cms.Api.Management.Security;
 using Umbraco.Cms.Core;
 using Umbraco.Cms.Core.Configuration.Models;
@@ -220,44 +219,10 @@ public class ConfigureBackOfficeCookieOptions : IConfigureNamedOptions<CookieAut
                 }
 
                 return Task.CompletedTask;
-            },
-            // FIXME: We want to change this over to using an attribute on the backoffice controllers
-            // See this for more: https://github.com/dotnet/aspnetcore/issues/63093#issuecomment-3201530217
-            OnRedirectToLogin = context =>
-            {
-                if (IsXhr(context.Request))
-                {
-                    context.Response.Headers.Location = context.RedirectUri;
-                    context.Response.StatusCode = 401;
-                }
-                else
-                {
-                    context.Response.Redirect(context.RedirectUri);
-                }
-
-                return Task.CompletedTask;
-            },
-            OnRedirectToAccessDenied = context =>
-            {
-                if (IsXhr(context.Request))
-                {
-                    context.Response.Headers.Location = context.RedirectUri;
-                    context.Response.StatusCode = 403;
-                }
-                else
-                {
-                    context.Response.Redirect(context.RedirectUri);
-                }
-
-                return Task.CompletedTask;
-            },
+            }
         };
     }
 
-    private bool IsXhr(HttpRequest request) =>
-        string.Equals(request.Query[HeaderNames.XRequestedWith], "XMLHttpRequest", StringComparison.Ordinal) ||
-        string.Equals(request.Headers.XRequestedWith, "XMLHttpRequest", StringComparison.Ordinal);
-
     /// <summary>
     ///     Ensures the ticket is renewed if the <see cref="SecuritySettings.KeepUserLoggedIn" /> is set to true
     ///     and the current request is for the get user seconds endpoint

src/Umbraco.Cms.Api.Management/Configuration/ConfigureUmbracoManagementApiSwaggerGenOptions.cs

@@ -1,8 +1,8 @@
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Options;
-using Microsoft.OpenApi;
+using Microsoft.OpenApi.Models;
 using Swashbuckle.AspNetCore.SwaggerGen;
-using Umbraco.Cms.Api.Common.Security;
+using Umbraco.Cms.Api.Common.OpenApi;
 using Umbraco.Cms.Api.Common.Serialization;
 using Umbraco.Cms.Api.Management.DependencyInjection;
 using Umbraco.Cms.Api.Management.OpenApi;
@@ -11,7 +11,7 @@ namespace Umbraco.Cms.Api.Management.Configuration;
 
 public class ConfigureUmbracoManagementApiSwaggerGenOptions : IConfigureOptions<SwaggerGenOptions>
 {
-    private readonly IUmbracoJsonTypeInfoResolver _umbracoJsonTypeInfoResolver;
+    private IUmbracoJsonTypeInfoResolver _umbracoJsonTypeInfoResolver;
 
     public ConfigureUmbracoManagementApiSwaggerGenOptions(IUmbracoJsonTypeInfoResolver umbracoJsonTypeInfoResolver)
     {
@@ -20,6 +20,7 @@ public class ConfigureUmbracoManagementApiSwaggerGenOptions : IConfigureOptions<
 
     public void Configure(SwaggerGenOptions swaggerGenOptions)
     {
+
         swaggerGenOptions.SwaggerDoc(
             ManagementApiConfiguration.ApiName,
             new OpenApiInfo
@@ -50,10 +51,10 @@ public class ConfigureUmbracoManagementApiSwaggerGenOptions : IConfigureOptions<
                      AuthorizationCode = new OpenApiOAuthFlow
                      {
                          AuthorizationUrl =
-                             new Uri(Paths.BackOfficeApi.AuthorizationEndpoint, UriKind.Relative),
-                         TokenUrl = new Uri(Paths.BackOfficeApi.TokenEndpoint, UriKind.Relative),
-                     },
-                 },
+                             new Uri(Common.Security.Paths.BackOfficeApi.AuthorizationEndpoint, UriKind.Relative),
+                         TokenUrl = new Uri(Common.Security.Paths.BackOfficeApi.TokenEndpoint, UriKind.Relative)
+                     }
+                 }
              });
 
         // Sets Security requirement on backoffice apis

src/Umbraco.Cms.Api.Management/Controllers/Content/ContentCollectionControllerBase.cs

@@ -29,6 +29,39 @@ public abstract class ContentCollectionControllerBase<TContent, TCollectionRespo
         _flagProviders = flagProvider;
     }
 
+    [Obsolete("Use the constructer with all parameters. To be removed in Umbraco 18")]
+    protected ContentCollectionControllerBase(IUmbracoMapper mapper)
+        : this(mapper, StaticServiceProvider.Instance.GetRequiredService<FlagProviderCollection>())
+    {
+    }
+
+    [Obsolete("This method is no longer used and will be removed in Umbraco 17.")]
+    protected IActionResult CollectionResult(ListViewPagedModel<TContent> result)
+    {
+        PagedModel<TContent> collectionItemsResult = result.Items;
+        ListViewConfiguration collectionConfiguration = result.ListViewConfiguration;
+
+        var collectionPropertyAliases = collectionConfiguration
+            .IncludeProperties
+            .Select(p => p.Alias)
+            .WhereNotNull()
+            .ToArray();
+
+        List<TCollectionResponseModel> collectionResponseModels =
+            _mapper.MapEnumerable<TContent, TCollectionResponseModel>(collectionItemsResult.Items, context =>
+            {
+                context.SetIncludedProperties(collectionPropertyAliases);
+            });
+
+        var pageViewModel = new PagedViewModel<TCollectionResponseModel>
+        {
+            Items = collectionResponseModels,
+            Total = collectionItemsResult.Total,
+        };
+
+        return Ok(pageViewModel);
+    }
+
     /// <summary>
     /// Creates a collection result from the provided collection response models and total number of items.
     /// </summary>

src/Umbraco.Cms.Api.Management/Controllers/Content/ContentControllerBase.cs

@@ -1,5 +1,7 @@
-using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
+using Umbraco.Cms.Api.Management.ViewModels.Content;
+using Umbraco.Cms.Core.Mapping;
 using Umbraco.Cms.Core.Models.ContentEditing;
 using Umbraco.Cms.Core.Models.ContentEditing.Validation;
 using Umbraco.Cms.Core.PropertyEditors.Validation;
@@ -10,6 +12,7 @@ namespace Umbraco.Cms.Api.Management.Controllers.Content;
 
 public abstract class ContentControllerBase : ManagementApiControllerBase
 {
+
     protected IActionResult ContentEditingOperationStatusResult(ContentEditingOperationStatus status)
         => OperationStatusResult(status, problemDetailsBuilder => status switch
         {
@@ -95,17 +98,6 @@ public abstract class ContentControllerBase : ManagementApiControllerBase
                 .Build()),
         });
 
-    protected IActionResult GetReferencesOperationStatusResult(GetReferencesOperationStatus status)
-        => OperationStatusResult(status, problemDetailsBuilder => status switch
-        {
-            GetReferencesOperationStatus.ContentNotFound => NotFound(problemDetailsBuilder
-                .WithTitle("The requested content could not be found")
-                .Build()),
-            _ => StatusCode(StatusCodes.Status500InternalServerError, problemDetailsBuilder
-                .WithTitle("Unknown get references operation status.")
-                .Build()),
-        });
-
     protected IActionResult ContentEditingOperationStatusResult<TContentModelBase, TValueModel, TVariantModel>(
         ContentEditingOperationStatus status,
         TContentModelBase requestModel,

src/Umbraco.Cms.Api.Management/Controllers/DataType/ReferencesDataTypeController.cs

@@ -0,0 +1,40 @@
+using Asp.Versioning;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Umbraco.Cms.Api.Management.Factories;
+using Umbraco.Cms.Api.Management.ViewModels.DataType;
+using Umbraco.Cms.Core;
+using Umbraco.Cms.Core.Services;
+using Umbraco.Cms.Core.Services.OperationStatus;
+
+namespace Umbraco.Cms.Api.Management.Controllers.DataType;
+
+[ApiVersion("1.0")]
+[Obsolete("Please use ReferencedByDataTypeController and the referenced-by endpoint. Scheduled for removal in Umbraco 17.")]
+public class ReferencesDataTypeController : DataTypeControllerBase
+{
+    private readonly IDataTypeService _dataTypeService;
+    private readonly IDataTypeReferencePresentationFactory _dataTypeReferencePresentationFactory;
+
+    public ReferencesDataTypeController(IDataTypeService dataTypeService, IDataTypeReferencePresentationFactory dataTypeReferencePresentationFactory)
+    {
+        _dataTypeService = dataTypeService;
+        _dataTypeReferencePresentationFactory = dataTypeReferencePresentationFactory;
+    }
+
+    [HttpGet("{id:guid}/references")]
+    [MapToApiVersion("1.0")]
+    [ProducesResponseType(typeof(DataTypeReferenceResponseModel[]), StatusCodes.Status200OK)]
+    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status404NotFound)]
+    public async Task<IActionResult> References(CancellationToken cancellationToken, Guid id)
+    {
+        Attempt<IReadOnlyDictionary<Udi, IEnumerable<string>>, DataTypeOperationStatus> result = await _dataTypeService.GetReferencesAsync(id);
+        if (result.Success == false)
+        {
+            return DataTypeOperationStatusResult(result.Status);
+        }
+
+        DataTypeReferenceResponseModel[] viewModels = _dataTypeReferencePresentationFactory.CreateDataTypeReferenceViewModels(result.Result).ToArray();
+        return Ok(viewModels);
+    }
+}

src/Umbraco.Cms.Api.Management/Controllers/Document/ByKeyDocumentController.cs

@@ -2,10 +2,13 @@ using Asp.Versioning;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Api.Management.Factories;
 using Umbraco.Cms.Api.Management.ViewModels.Document;
 using Umbraco.Cms.Core.Actions;
+using Umbraco.Cms.Core.DependencyInjection;
 using Umbraco.Cms.Core.Security.Authorization;
+using Umbraco.Cms.Core.Services;
 using Umbraco.Cms.Core.Services.Querying;
 using Umbraco.Cms.Web.Common.Authorization;
 using Umbraco.Extensions;
@@ -19,6 +22,31 @@ public class ByKeyDocumentController : DocumentControllerBase
     private readonly IDocumentPresentationFactory _documentPresentationFactory;
     private readonly IContentQueryService _contentQueryService;
 
+    [Obsolete("Scheduled for removal in v17")]
+    public ByKeyDocumentController(
+        IAuthorizationService authorizationService,
+        IContentEditingService contentEditingService,
+        IDocumentPresentationFactory documentPresentationFactory)
+    {
+        _authorizationService = authorizationService;
+        _documentPresentationFactory = documentPresentationFactory;
+        _contentQueryService = StaticServiceProvider.Instance.GetRequiredService<IContentQueryService>();
+    }
+
+    // needed for greedy selection until other constructor remains in v17
+    [Obsolete("Scheduled for removal in v17")]
+    public ByKeyDocumentController(
+        IAuthorizationService authorizationService,
+        IContentEditingService contentEditingService,
+        IDocumentPresentationFactory documentPresentationFactory,
+        IContentQueryService contentQueryService)
+    {
+        _authorizationService = authorizationService;
+        _documentPresentationFactory = documentPresentationFactory;
+        _contentQueryService = contentQueryService;
+    }
+
+    [ActivatorUtilitiesConstructor]
     public ByKeyDocumentController(
         IAuthorizationService authorizationService,
         IDocumentPresentationFactory documentPresentationFactory,

src/Umbraco.Cms.Api.Management/Controllers/Document/Collection/DocumentCollectionControllerBase.cs

@@ -23,6 +23,12 @@ public abstract class DocumentCollectionControllerBase : ContentCollectionContro
     {
     }
 
+    [Obsolete("Please use the constructor with all parameters. Scheduled to be removed in V18")]
+    protected DocumentCollectionControllerBase(IUmbracoMapper mapper)
+        : base(mapper)
+    {
+    }
+
     protected IActionResult CollectionOperationStatusResult(ContentCollectionOperationStatus status)
         => ContentCollectionOperationStatusResult(status, "document");
 }

src/Umbraco.Cms.Api.Management/Controllers/Document/DocumentPreviewUrlController.cs

@@ -1,53 +0,0 @@
-using Asp.Versioning;
-using Microsoft.AspNetCore.Http;
-using Microsoft.AspNetCore.Mvc;
-using Umbraco.Cms.Api.Common.Builders;
-using Umbraco.Cms.Api.Management.Factories;
-using Umbraco.Cms.Api.Management.ViewModels.Document;
-using Umbraco.Cms.Core.Models;
-using Umbraco.Cms.Core.Services;
-
-namespace Umbraco.Cms.Api.Management.Controllers.Document;
-
-[ApiVersion("1.0")]
-public class DocumentPreviewUrlController : DocumentControllerBase
-{
-    private readonly IContentService _contentService;
-    private readonly IDocumentUrlFactory _documentUrlFactory;
-
-    public DocumentPreviewUrlController(
-        IContentService contentService,
-        IDocumentUrlFactory documentUrlFactory)
-    {
-        _contentService = contentService;
-        _documentUrlFactory = documentUrlFactory;
-    }
-
-    [MapToApiVersion("1.0")]
-    [HttpGet("{id:guid}/preview-url")]
-    [ProducesResponseType(typeof(DocumentUrlInfo), StatusCodes.Status200OK)]
-    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status400BadRequest)]
-    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status404NotFound)]
-    public async Task<IActionResult> GetPreviewUrl(Guid id, string providerAlias, string? culture, string? segment)
-    {
-        IContent? content = _contentService.GetById(id);
-        if (content is null)
-        {
-            return NotFound(new ProblemDetailsBuilder()
-                .WithTitle("Document not found")
-                .WithDetail("The requested document did not exist.")
-                .Build());
-        }
-
-        DocumentUrlInfo? previewUrlInfo = await _documentUrlFactory.GetPreviewUrlAsync(content, providerAlias, culture, segment);
-        if (previewUrlInfo is null)
-        {
-            return BadRequest(new ProblemDetailsBuilder()
-                .WithTitle("No preview URL for document")
-                .WithDetail("Failed to produce a preview URL for the requested document.")
-                .Build());
-        }
-
-        return Ok(previewUrlInfo);
-    }
-}

src/Umbraco.Cms.Api.Management/Controllers/Document/DomainsController.cs

@@ -1,31 +1,60 @@
-using Asp.Versioning;
+using Asp.Versioning;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Api.Management.ViewModels.Document;
+using Umbraco.Cms.Core.Actions;
+using Umbraco.Cms.Core.DependencyInjection;
 using Umbraco.Cms.Core.Mapping;
 using Umbraco.Cms.Core.Models;
+using Umbraco.Cms.Core.Security.Authorization;
 using Umbraco.Cms.Core.Services;
+using Umbraco.Cms.Web.Common.Authorization;
+using Umbraco.Extensions;
 
 namespace Umbraco.Cms.Api.Management.Controllers.Document;
 
 [ApiVersion("1.0")]
 public class DomainsController : DocumentControllerBase
 {
+    private readonly IAuthorizationService _authorizationService;
     private readonly IDomainService _domainService;
     private readonly IUmbracoMapper _umbracoMapper;
 
-    public DomainsController(IDomainService domainService, IUmbracoMapper umbracoMapper)
+    [ActivatorUtilitiesConstructor]
+    public DomainsController(IAuthorizationService authorizationService, IDomainService domainService, IUmbracoMapper umbracoMapper)
     {
+        _authorizationService = authorizationService;
         _domainService = domainService;
         _umbracoMapper = umbracoMapper;
     }
 
+    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 18.")]
+    public DomainsController(IDomainService domainService, IUmbracoMapper umbracoMapper)
+        : this(
+            StaticServiceProvider.Instance.GetRequiredService<IAuthorizationService>(),
+            domainService,
+            umbracoMapper)
+    {
+    }
+
     [MapToApiVersion("1.0")]
     [HttpGet("{id:guid}/domains")]
     [ProducesResponseType(typeof(DomainsResponseModel), StatusCodes.Status200OK)]
     [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status404NotFound)]
     public async Task<IActionResult> Domains(CancellationToken cancellationToken, Guid id)
     {
+        AuthorizationResult authorizationResult = await _authorizationService.AuthorizeResourceAsync(
+            User,
+            ContentPermissionResource.WithKeys(ActionBrowse.ActionLetter, id),
+            AuthorizationPolicies.ContentPermissionByResource);
+
+        if (!authorizationResult.Succeeded)
+        {
+            return Forbidden();
+        }
+
         IDomain[] assignedDomains = (await _domainService.GetAssignedDomainsAsync(id, true))
             .OrderBy(d => d.SortOrder)
             .ToArray();

src/Umbraco.Cms.Api.Management/Controllers/Document/References/ReferencedByDocumentController.cs

@@ -4,10 +4,8 @@ using Microsoft.AspNetCore.Mvc;
 using Umbraco.Cms.Api.Common.ViewModels.Pagination;
 using Umbraco.Cms.Api.Management.Factories;
 using Umbraco.Cms.Api.Management.ViewModels.TrackedReferences;
-using Umbraco.Cms.Core;
 using Umbraco.Cms.Core.Models;
 using Umbraco.Cms.Core.Services;
-using Umbraco.Cms.Core.Services.OperationStatus;
 
 namespace Umbraco.Cms.Api.Management.Controllers.Document.References;
 
@@ -17,16 +15,22 @@ public class ReferencedByDocumentController : DocumentControllerBase
     private readonly ITrackedReferencesService _trackedReferencesService;
     private readonly IRelationTypePresentationFactory _relationTypePresentationFactory;
 
-    public ReferencedByDocumentController(
-        ITrackedReferencesService trackedReferencesService,
-        IRelationTypePresentationFactory relationTypePresentationFactory)
+    public ReferencedByDocumentController(ITrackedReferencesService trackedReferencesService, IRelationTypePresentationFactory relationTypePresentationFactory)
     {
         _trackedReferencesService = trackedReferencesService;
         _relationTypePresentationFactory = relationTypePresentationFactory;
     }
 
-    [Obsolete("Use the ReferencedBy2 action method instead. Scheduled for removal in Umbraco 19, when ReferencedBy2 will be renamed back to ReferencedBy.")]
-    [NonAction]
+    /// <summary>
+    ///     Gets a paged list of tracked references for the current item, so you can see where an item is being used.
+    /// </summary>
+    /// <remarks>
+    ///     Used by info tabs on content, media etc. and for the delete and unpublish of single items.
+    ///     This is basically finding parents of relations.
+    /// </remarks>
+    [HttpGet("{id:guid}/referenced-by")]
+    [MapToApiVersion("1.0")]
+    [ProducesResponseType(typeof(PagedViewModel<IReferenceResponseModel>), StatusCodes.Status200OK)]
     public async Task<ActionResult<PagedViewModel<IReferenceResponseModel>>> ReferencedBy(
         CancellationToken cancellationToken,
         Guid id,
@@ -43,37 +47,4 @@ public class ReferencedByDocumentController : DocumentControllerBase
 
         return pagedViewModel;
     }
-
-    /// <summary>
-    ///     Gets a paged list of tracked references for the current item, so you can see where an item is being used.
-    /// </summary>
-    /// <remarks>
-    ///     Used by info tabs on content, media etc. and for the delete and unpublish of single items.
-    ///     This is basically finding parents of relations.
-    /// </remarks>
-    [HttpGet("{id:guid}/referenced-by")]
-    [MapToApiVersion("1.0")]
-    [ProducesResponseType(typeof(PagedViewModel<IReferenceResponseModel>), StatusCodes.Status200OK)]
-    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status404NotFound)]
-    public async Task<IActionResult> ReferencedBy2(
-        CancellationToken cancellationToken,
-        Guid id,
-        int skip = 0,
-        int take = 20)
-    {
-        Attempt<PagedModel<RelationItemModel>, GetReferencesOperationStatus> relationItemsAttempt = await _trackedReferencesService.GetPagedRelationsForItemAsync(id, UmbracoObjectTypes.Document, skip, take, true);
-
-        if (relationItemsAttempt.Success is false)
-        {
-            return GetReferencesOperationStatusResult(relationItemsAttempt.Status);
-        }
-
-        var pagedViewModel = new PagedViewModel<IReferenceResponseModel>
-        {
-            Total = relationItemsAttempt.Result.Total,
-            Items = await _relationTypePresentationFactory.CreateReferenceResponseModelsAsync(relationItemsAttempt.Result.Items),
-        };
-
-        return Ok(pagedViewModel);
-    }
 }

src/Umbraco.Cms.Api.Management/Controllers/Document/References/ReferencedDescendantsDocumentController.cs

@@ -3,11 +3,9 @@ using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
 using Umbraco.Cms.Api.Common.ViewModels.Pagination;
 using Umbraco.Cms.Api.Management.ViewModels;
-using Umbraco.Cms.Core;
 using Umbraco.Cms.Core.Mapping;
 using Umbraco.Cms.Core.Models;
 using Umbraco.Cms.Core.Services;
-using Umbraco.Cms.Core.Services.OperationStatus;
 
 namespace Umbraco.Cms.Api.Management.Controllers.Document.References;
 
@@ -17,32 +15,12 @@ public class ReferencedDescendantsDocumentController : DocumentControllerBase
     private readonly ITrackedReferencesService _trackedReferencesSkipTakeService;
     private readonly IUmbracoMapper _umbracoMapper;
 
-    public ReferencedDescendantsDocumentController(
-        ITrackedReferencesService trackedReferencesSkipTakeService,
-        IUmbracoMapper umbracoMapper)
+    public ReferencedDescendantsDocumentController(ITrackedReferencesService trackedReferencesSkipTakeService, IUmbracoMapper umbracoMapper)
     {
         _trackedReferencesSkipTakeService = trackedReferencesSkipTakeService;
         _umbracoMapper = umbracoMapper;
     }
 
-    [Obsolete("Use the ReferencedDescendants2 action method instead. Scheduled for removal in Umbraco 19, when ReferencedDescendants2 will be renamed back to ReferencedDescendants.")]
-    [NonAction]
-    public async Task<ActionResult<PagedViewModel<ReferenceByIdModel>>> ReferencedDescendants(
-    CancellationToken cancellationToken,
-    Guid id,
-    int skip = 0,
-    int take = 20)
-    {
-        PagedModel<RelationItemModel> relationItems = await _trackedReferencesSkipTakeService.GetPagedDescendantsInReferencesAsync(id, skip, take, true);
-        var pagedViewModel = new PagedViewModel<ReferenceByIdModel>
-        {
-            Total = relationItems.Total,
-            Items = _umbracoMapper.MapEnumerable<RelationItemModel, ReferenceByIdModel>(relationItems.Items),
-        };
-
-        return pagedViewModel;
-    }
-
     /// <summary>
     ///     Gets a paged list of the descendant nodes of the current item used in any kind of relation.
     /// </summary>
@@ -54,26 +32,19 @@ public class ReferencedDescendantsDocumentController : DocumentControllerBase
     [HttpGet("{id:guid}/referenced-descendants")]
     [MapToApiVersion("1.0")]
     [ProducesResponseType(typeof(PagedViewModel<ReferenceByIdModel>), StatusCodes.Status200OK)]
-    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status404NotFound)]
-    public async Task<IActionResult> ReferencedDescendants2(
+    public async Task<ActionResult<PagedViewModel<ReferenceByIdModel>>> ReferencedDescendants(
         CancellationToken cancellationToken,
         Guid id,
         int skip = 0,
         int take = 20)
     {
-        Attempt<PagedModel<RelationItemModel>, GetReferencesOperationStatus> relationItemsAttempt = await _trackedReferencesSkipTakeService.GetPagedDescendantsInReferencesAsync(id, UmbracoObjectTypes.Document, skip, take, true);
-
-        if (relationItemsAttempt.Success is false)
-        {
-            return GetReferencesOperationStatusResult(relationItemsAttempt.Status);
-        }
-
+        PagedModel<RelationItemModel> relationItems = await _trackedReferencesSkipTakeService.GetPagedDescendantsInReferencesAsync(id, skip, take, true);
         var pagedViewModel = new PagedViewModel<ReferenceByIdModel>
         {
-            Total = relationItemsAttempt.Result.Total,
-            Items = _umbracoMapper.MapEnumerable<RelationItemModel, ReferenceByIdModel>(relationItemsAttempt.Result.Items),
+            Total = relationItems.Total,
+            Items = _umbracoMapper.MapEnumerable<RelationItemModel, ReferenceByIdModel>(relationItems.Items),
         };
 
-        return Ok(pagedViewModel);
+        return pagedViewModel;
     }
 }

src/Umbraco.Cms.Api.Management/Controllers/Document/UpdateDomainsController.cs

@@ -1,13 +1,19 @@
-using Asp.Versioning;
+using Asp.Versioning;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Api.Management.Factories;
 using Umbraco.Cms.Api.Management.ViewModels.Document;
 using Umbraco.Cms.Core;
+using Umbraco.Cms.Core.Actions;
+using Umbraco.Cms.Core.DependencyInjection;
 using Umbraco.Cms.Core.Mapping;
 using Umbraco.Cms.Core.Models.ContentEditing;
+using Umbraco.Cms.Core.Security.Authorization;
 using Umbraco.Cms.Core.Services;
 using Umbraco.Cms.Core.Services.OperationStatus;
+using Umbraco.Cms.Web.Common.Authorization;
 using Umbraco.Extensions;
 
 namespace Umbraco.Cms.Api.Management.Controllers.Document;
@@ -15,17 +21,30 @@ namespace Umbraco.Cms.Api.Management.Controllers.Document;
 [ApiVersion("1.0")]
 public class UpdateDomainsController : DocumentControllerBase
 {
+    private readonly IAuthorizationService _authorizationService;
     private readonly IDomainService _domainService;
     private readonly IUmbracoMapper _umbracoMapper;
     private readonly IDomainPresentationFactory _domainPresentationFactory;
 
-    public UpdateDomainsController(IDomainService domainService, IUmbracoMapper umbracoMapper, IDomainPresentationFactory domainPresentationFactory)
+    [ActivatorUtilitiesConstructor]
+    public UpdateDomainsController(IAuthorizationService authorizationService, IDomainService domainService, IUmbracoMapper umbracoMapper, IDomainPresentationFactory domainPresentationFactory)
     {
+        _authorizationService = authorizationService;
         _domainService = domainService;
         _umbracoMapper = umbracoMapper;
         _domainPresentationFactory = domainPresentationFactory;
     }
 
+    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 18.")]
+    public UpdateDomainsController(IDomainService domainService, IUmbracoMapper umbracoMapper, IDomainPresentationFactory domainPresentationFactory)
+        : this(
+            StaticServiceProvider.Instance.GetRequiredService<IAuthorizationService>(),
+            domainService,
+            umbracoMapper,
+            domainPresentationFactory)
+    {
+    }
+
     [MapToApiVersion("1.0")]
     [HttpPut("{id:guid}/domains")]
     [ProducesResponseType(StatusCodes.Status200OK)]
@@ -37,6 +56,16 @@ public class UpdateDomainsController : DocumentControllerBase
         Guid id,
         UpdateDomainsRequestModel updateModel)
     {
+        AuthorizationResult authorizationResult = await _authorizationService.AuthorizeResourceAsync(
+            User,
+            ContentPermissionResource.WithKeys(ActionAssignDomain.ActionLetter, id),
+            AuthorizationPolicies.ContentPermissionByResource);
+
+        if (!authorizationResult.Succeeded)
+        {
+            return Forbidden();
+        }
+
         DomainsUpdateModel domainsUpdateModel = _umbracoMapper.Map<DomainsUpdateModel>(updateModel)!;
 
         Attempt<DomainUpdateResult, DomainOperationStatus> result = await _domainService.UpdateDomainsAsync(id, domainsUpdateModel);

src/Umbraco.Cms.Api.Management/Controllers/Document/UpdateNotificationsController.cs

@@ -1,33 +1,63 @@
 using Asp.Versioning;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Api.Management.ViewModels.Document;
+using Umbraco.Cms.Core.Actions;
+using Umbraco.Cms.Core.DependencyInjection;
 using Umbraco.Cms.Core.Models;
 using Umbraco.Cms.Core.Security;
+using Umbraco.Cms.Core.Security.Authorization;
 using Umbraco.Cms.Core.Services;
+using Umbraco.Cms.Web.Common.Authorization;
+using Umbraco.Extensions;
 
 namespace Umbraco.Cms.Api.Management.Controllers.Document;
 
 [ApiVersion("1.0")]
 public class UpdateNotificationsController : DocumentControllerBase
 {
+    private readonly IAuthorizationService _authorizationService;
     private readonly IContentEditingService _contentEditingService;
     private readonly INotificationService _notificationService;
     private readonly IBackOfficeSecurityAccessor _backOfficeSecurityAccessor;
 
-    public UpdateNotificationsController(IContentEditingService contentEditingService, INotificationService notificationService, IBackOfficeSecurityAccessor backOfficeSecurityAccessor)
+    [ActivatorUtilitiesConstructor]
+    public UpdateNotificationsController(IAuthorizationService authorizationService, IContentEditingService contentEditingService, INotificationService notificationService, IBackOfficeSecurityAccessor backOfficeSecurityAccessor)
     {
+        _authorizationService = authorizationService;
         _contentEditingService = contentEditingService;
         _notificationService = notificationService;
         _backOfficeSecurityAccessor = backOfficeSecurityAccessor;
     }
 
+    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 18.")]
+    public UpdateNotificationsController(IContentEditingService contentEditingService, INotificationService notificationService, IBackOfficeSecurityAccessor backOfficeSecurityAccessor)
+        : this(
+            StaticServiceProvider.Instance.GetRequiredService<IAuthorizationService>(),
+            contentEditingService,
+            notificationService,
+            backOfficeSecurityAccessor)
+    {
+    }
+
     [MapToApiVersion("1.0")]
     [HttpPut("{id:guid}/notifications")]
     [ProducesResponseType(StatusCodes.Status200OK)]
     [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status404NotFound)]
     public async Task<IActionResult> UpdateNotifications(CancellationToken cancellationToken, Guid id, UpdateDocumentNotificationsRequestModel updateModel)
     {
+        AuthorizationResult authorizationResult = await _authorizationService.AuthorizeResourceAsync(
+            User,
+            ContentPermissionResource.WithKeys(ActionBrowse.ActionLetter, id),
+            AuthorizationPolicies.ContentPermissionByResource);
+
+        if (!authorizationResult.Succeeded)
+        {
+            return Forbidden();
+        }
+
         IContent? content = await _contentEditingService.GetAsync(id);
         if (content == null)
         {

src/Umbraco.Cms.Api.Management/Controllers/Document/ValidateCreateDocumentController.cs

@@ -21,6 +21,20 @@ public class ValidateCreateDocumentController : CreateDocumentControllerBase
     private readonly IContentEditingService _contentEditingService;
     private readonly IBackOfficeSecurityAccessor _backOfficeSecurityAccessor;
 
+    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 17.")]
+    public ValidateCreateDocumentController(
+        IAuthorizationService authorizationService,
+        IDocumentEditingPresentationFactory documentEditingPresentationFactory,
+        IContentEditingService contentEditingService)
+        : this(
+              authorizationService,
+              documentEditingPresentationFactory,
+              contentEditingService,
+              StaticServiceProvider.Instance.GetRequiredService<IBackOfficeSecurityAccessor>())
+    {
+    }
+
+    [ActivatorUtilitiesConstructor]
     public ValidateCreateDocumentController(
         IAuthorizationService authorizationService,
         IDocumentEditingPresentationFactory documentEditingPresentationFactory,

src/Umbraco.Cms.Api.Management/Controllers/Document/ValidateUpdateDocumentController.cs

@@ -21,6 +21,20 @@ public class ValidateUpdateDocumentController : UpdateDocumentControllerBase
     private readonly IDocumentEditingPresentationFactory _documentEditingPresentationFactory;
     private readonly IBackOfficeSecurityAccessor _backOfficeSecurityAccessor;
 
+    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 17.")]
+    public ValidateUpdateDocumentController(
+        IAuthorizationService authorizationService,
+        IContentEditingService contentEditingService,
+        IDocumentEditingPresentationFactory documentEditingPresentationFactory)
+        : this(
+              authorizationService,
+              contentEditingService,
+              documentEditingPresentationFactory,
+              StaticServiceProvider.Instance.GetRequiredService<IBackOfficeSecurityAccessor>())
+    {
+    }
+
+    [ActivatorUtilitiesConstructor]
     public ValidateUpdateDocumentController(
         IAuthorizationService authorizationService,
         IContentEditingService contentEditingService,

src/Umbraco.Cms.Api.Management/Controllers/DocumentType/Item/SearchDocumentTypeItemController.cs

@@ -16,12 +16,35 @@ public class SearchDocumentTypeItemController : DocumentTypeItemControllerBase
     private readonly IUmbracoMapper _mapper;
     private readonly IContentTypeSearchService _contentTypeSearchService;
 
+    [Obsolete("Please use ctor that only accepts IUmbracoMapper & IContentTypeSearchService, scheduled for removal in v17")]
+    public SearchDocumentTypeItemController(IEntitySearchService entitySearchService, IContentTypeService contentTypeService, IUmbracoMapper mapper)
+    : this(mapper, StaticServiceProvider.Instance.GetRequiredService<IContentTypeSearchService>())
+    {
+    }
+
+    [Obsolete("Please use ctor that only accepts IUmbracoMapper & IContentTypeSearchService, scheduled for removal in v17")]
+    // We need to have this constructor, or else we get ambiguous constructor error
+    public SearchDocumentTypeItemController(
+        IEntitySearchService entitySearchService,
+        IContentTypeService contentTypeService,
+        IUmbracoMapper mapper,
+        IContentTypeSearchService contentTypeSearchService)
+        : this(mapper, contentTypeSearchService)
+    {
+    }
+
+    [ActivatorUtilitiesConstructor]
     public SearchDocumentTypeItemController(IUmbracoMapper mapper, IContentTypeSearchService contentTypeSearchService)
     {
         _mapper = mapper;
         _contentTypeSearchService = contentTypeSearchService;
     }
 
+    [NonAction]
+    [Obsolete("Scheduled to be removed in v16, use the non obsoleted method instead")]
+    public async Task<IActionResult> Search(CancellationToken cancellationToken, string query, int skip = 0, int take = 100)
+        => await SearchDocumentType(cancellationToken, query, null, skip, take);
+
     [HttpGet("search")]
     [MapToApiVersion("1.0")]
     [ProducesResponseType(typeof(PagedModel<DocumentTypeItemResponseModel>), StatusCodes.Status200OK)]

src/Umbraco.Cms.Api.Management/Controllers/Help/GetHelpController.cs

@@ -11,13 +11,12 @@ using Umbraco.Cms.Api.Common.ViewModels.Pagination;
 
 namespace Umbraco.Cms.Api.Management.Controllers.Help;
 
-[Obsolete("This is no longer used and will be removed in v19")]
 [ApiVersion("1.0")]
 public class GetHelpController : HelpControllerBase
 {
     private readonly ILogger<GetHelpController> _logger;
     private readonly IJsonSerializer _jsonSerializer;
-    private readonly HelpPageSettings _helpPageSettings;
+    private HelpPageSettings _helpPageSettings;
 
     public GetHelpController(
         IOptionsMonitor<HelpPageSettings> helpPageSettings,
@@ -27,8 +26,11 @@ public class GetHelpController : HelpControllerBase
         _logger = logger;
         _jsonSerializer = jsonSerializer;
         _helpPageSettings = helpPageSettings.CurrentValue;
+        helpPageSettings.OnChange(UpdateHelpPageSettings);
     }
 
+    private void UpdateHelpPageSettings(HelpPageSettings settings) => _helpPageSettings = settings;
+
     [HttpGet]
     [MapToApiVersion("1.0")]
     [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status400BadRequest)]

src/Umbraco.Cms.Api.Management/Controllers/Help/HelpControllerBase.cs

@@ -3,7 +3,6 @@ using Umbraco.Cms.Api.Management.Routing;
 
 namespace Umbraco.Cms.Api.Management.Controllers.Help;
 
-[Obsolete("This is no longer used and will be removed in v19")]
 [VersionedApiBackOfficeRoute("help")]
 [ApiExplorerSettings(GroupName = "Help")]
 public abstract class HelpControllerBase : ManagementApiControllerBase

src/Umbraco.Cms.Api.Management/Controllers/Indexer/RebuildIndexerController.cs

@@ -26,9 +26,9 @@ public class RebuildIndexerController : IndexerControllerBase
     }
 
     /// <summary>
-    ///     Rebuilds the index.
+    ///     Rebuilds the index
     /// </summary>
-    /// <param name="indexName">The name of the index to rebuild.</param>
+    /// <param name="indexName"></param>
     /// <returns></returns>
     [HttpPost("{indexName}/rebuild")]
     [MapToApiVersion("1.0")]
@@ -36,7 +36,7 @@ public class RebuildIndexerController : IndexerControllerBase
     [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status404NotFound)]
     [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status409Conflict)]
     [ProducesResponseType(StatusCodes.Status200OK)]
-    public async Task<IActionResult> Rebuild(CancellationToken cancellationToken, string indexName)
+    public Task<IActionResult> Rebuild(CancellationToken cancellationToken, string indexName)
     {
         if (!_examineManager.TryGetIndex(indexName, out IIndex? index))
         {
@@ -48,7 +48,7 @@ public class RebuildIndexerController : IndexerControllerBase
                 Type = "Error",
             };
 
-            return NotFound(invalidModelProblem);
+            return Task.FromResult<IActionResult>(NotFound(invalidModelProblem));
         }
 
         if (!_indexingRebuilderService.CanRebuild(index.Name))
@@ -57,19 +57,19 @@ public class RebuildIndexerController : IndexerControllerBase
             {
                 Title = "Could not validate the populator",
                 Detail =
-                    $"The index {index.Name} could not be rebuilt because we could not validate its associated {typeof(IIndexPopulator)}",
+                    $"The index {index?.Name} could not be rebuilt because we could not validate its associated {typeof(IIndexPopulator)}",
                 Status = StatusCodes.Status400BadRequest,
                 Type = "Error",
             };
 
-            return BadRequest(invalidModelProblem);
+            return Task.FromResult<IActionResult>(BadRequest(invalidModelProblem));
         }
 
         _logger.LogInformation("Rebuilding index '{IndexName}'", indexName);
 
-        if (await _indexingRebuilderService.TryRebuildAsync(index, indexName))
+        if (_indexingRebuilderService.TryRebuild(index, indexName))
         {
-            return Ok();
+            return Task.FromResult<IActionResult>(Ok());
         }
 
         var problemDetails = new ProblemDetails
@@ -80,6 +80,6 @@ public class RebuildIndexerController : IndexerControllerBase
             Type = "Error",
         };
 
-        return Conflict(problemDetails);
+        return Task.FromResult<IActionResult>(Conflict(problemDetails));
     }
 }

src/Umbraco.Cms.Api.Management/Controllers/Media/Collection/MediaCollectionControllerBase.cs

@@ -26,6 +26,12 @@ public abstract class MediaCollectionControllerBase : ContentCollectionControlle
     {
     }
 
+    [Obsolete("Please use the constructor with all parameters. Scheduled to be removed in Umbraco 18")]
+    protected MediaCollectionControllerBase(IUmbracoMapper mapper)
+        : base(mapper)
+    {
+    }
+
     protected IActionResult CollectionOperationStatusResult(ContentCollectionOperationStatus status)
         => ContentCollectionOperationStatusResult(status, "media");
 }

src/Umbraco.Cms.Api.Management/Controllers/Media/References/ReferencedByMediaController.cs

@@ -4,10 +4,8 @@ using Microsoft.AspNetCore.Mvc;
 using Umbraco.Cms.Api.Common.ViewModels.Pagination;
 using Umbraco.Cms.Api.Management.Factories;
 using Umbraco.Cms.Api.Management.ViewModels.TrackedReferences;
-using Umbraco.Cms.Core;
 using Umbraco.Cms.Core.Models;
 using Umbraco.Cms.Core.Services;
-using Umbraco.Cms.Core.Services.OperationStatus;
 
 namespace Umbraco.Cms.Api.Management.Controllers.Media.References;
 
@@ -17,16 +15,22 @@ public class ReferencedByMediaController : MediaControllerBase
     private readonly ITrackedReferencesService _trackedReferencesService;
     private readonly IRelationTypePresentationFactory _relationTypePresentationFactory;
 
-    public ReferencedByMediaController(
-        ITrackedReferencesService trackedReferencesService,
-        IRelationTypePresentationFactory relationTypePresentationFactory)
+    public ReferencedByMediaController(ITrackedReferencesService trackedReferencesService, IRelationTypePresentationFactory relationTypePresentationFactory)
     {
         _trackedReferencesService = trackedReferencesService;
         _relationTypePresentationFactory = relationTypePresentationFactory;
     }
 
-    [Obsolete("Use the ReferencedBy2 action method instead. Scheduled for removal in Umbraco 19, when ReferencedBy2 will be renamed back to ReferencedBy.")]
-    [NonAction]
+    /// <summary>
+    ///     Gets a page list of tracked references for the current item, so you can see where an item is being used.
+    /// </summary>
+    /// <remarks>
+    ///     Used by info tabs on content, media etc. and for the delete and unpublish of single items.
+    ///     This is basically finding parents of relations.
+    /// </remarks>
+    [HttpGet("{id:guid}/referenced-by")]
+    [MapToApiVersion("1.0")]
+    [ProducesResponseType(typeof(PagedViewModel<IReferenceResponseModel>), StatusCodes.Status200OK)]
     public async Task<ActionResult<PagedViewModel<IReferenceResponseModel>>> ReferencedBy(
         CancellationToken cancellationToken,
         Guid id,
@@ -43,37 +47,4 @@ public class ReferencedByMediaController : MediaControllerBase
 
         return pagedViewModel;
     }
-
-    /// <summary>
-    ///     Gets a page list of tracked references for the current item, so you can see where an item is being used.
-    /// </summary>
-    /// <remarks>
-    ///     Used by info tabs on content, media etc. and for the delete and unpublish of single items.
-    ///     This is basically finding parents of relations.
-    /// </remarks>
-    [HttpGet("{id:guid}/referenced-by")]
-    [MapToApiVersion("1.0")]
-    [ProducesResponseType(typeof(PagedViewModel<IReferenceResponseModel>), StatusCodes.Status200OK)]
-    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status404NotFound)]
-    public async Task<IActionResult> ReferencedBy2(
-        CancellationToken cancellationToken,
-        Guid id,
-        int skip = 0,
-        int take = 20)
-    {
-        Attempt<PagedModel<RelationItemModel>, GetReferencesOperationStatus> relationItemsAttempt = await _trackedReferencesService.GetPagedRelationsForItemAsync(id, UmbracoObjectTypes.Media, skip, take, true);
-
-        if (relationItemsAttempt.Success is false)
-        {
-            return GetReferencesOperationStatusResult(relationItemsAttempt.Status);
-        }
-
-        var pagedViewModel = new PagedViewModel<IReferenceResponseModel>
-        {
-            Total = relationItemsAttempt.Result.Total,
-            Items = await _relationTypePresentationFactory.CreateReferenceResponseModelsAsync(relationItemsAttempt.Result.Items),
-        };
-
-        return Ok(pagedViewModel);
-    }
 }

src/Umbraco.Cms.Api.Management/Controllers/Media/References/ReferencedDescendantsMediaController.cs

@@ -3,11 +3,9 @@ using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
 using Umbraco.Cms.Api.Common.ViewModels.Pagination;
 using Umbraco.Cms.Api.Management.ViewModels;
-using Umbraco.Cms.Core;
 using Umbraco.Cms.Core.Mapping;
 using Umbraco.Cms.Core.Models;
 using Umbraco.Cms.Core.Services;
-using Umbraco.Cms.Core.Services.OperationStatus;
 
 namespace Umbraco.Cms.Api.Management.Controllers.Media.References;
 
@@ -16,32 +14,13 @@ public class ReferencedDescendantsMediaController : MediaControllerBase
 {
     private readonly ITrackedReferencesService _trackedReferencesSkipTakeService;
     private readonly IUmbracoMapper _umbracoMapper;
-    public ReferencedDescendantsMediaController(
-        ITrackedReferencesService trackedReferencesSkipTakeService,
-        IUmbracoMapper umbracoMapper)
+
+    public ReferencedDescendantsMediaController(ITrackedReferencesService trackedReferencesSkipTakeService, IUmbracoMapper umbracoMapper)
     {
         _trackedReferencesSkipTakeService = trackedReferencesSkipTakeService;
         _umbracoMapper = umbracoMapper;
     }
 
-    [Obsolete("Use the ReferencedDescendants2 action method instead. Scheduled for removal in Umbraco 19, when ReferencedDescendants2 will be renamed back to ReferencedDescendants.")]
-    [NonAction]
-    public async Task<ActionResult<PagedViewModel<ReferenceByIdModel>>> ReferencedDescendants(
-    CancellationToken cancellationToken,
-    Guid id,
-    int skip = 0,
-    int take = 20)
-    {
-        PagedModel<RelationItemModel> relationItems = await _trackedReferencesSkipTakeService.GetPagedDescendantsInReferencesAsync(id, skip, take, true);
-        var pagedViewModel = new PagedViewModel<ReferenceByIdModel>
-        {
-            Total = relationItems.Total,
-            Items = _umbracoMapper.MapEnumerable<RelationItemModel, ReferenceByIdModel>(relationItems.Items),
-        };
-
-        return pagedViewModel;
-    }
-
     /// <summary>
     ///     Gets a page list of the child nodes of the current item used in any kind of relation.
     /// </summary>
@@ -53,26 +32,19 @@ public class ReferencedDescendantsMediaController : MediaControllerBase
     [HttpGet("{id:guid}/referenced-descendants")]
     [MapToApiVersion("1.0")]
     [ProducesResponseType(typeof(PagedViewModel<ReferenceByIdModel>), StatusCodes.Status200OK)]
-    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status404NotFound)]
-    public async Task<IActionResult> ReferencedDescendants2(
+    public async Task<ActionResult<PagedViewModel<ReferenceByIdModel>>> ReferencedDescendants(
         CancellationToken cancellationToken,
         Guid id,
         int skip = 0,
         int take = 20)
     {
-        Attempt<PagedModel<RelationItemModel>, GetReferencesOperationStatus> relationItemsAttempt = await _trackedReferencesSkipTakeService.GetPagedDescendantsInReferencesAsync(id, UmbracoObjectTypes.Media, skip, take, true);
-
-        if (relationItemsAttempt.Success is false)
-        {
-            return GetReferencesOperationStatusResult(relationItemsAttempt.Status);
-        }
-
+        PagedModel<RelationItemModel> relationItems = await _trackedReferencesSkipTakeService.GetPagedDescendantsInReferencesAsync(id, skip, take, true);
         var pagedViewModel = new PagedViewModel<ReferenceByIdModel>
         {
-            Total = relationItemsAttempt.Result.Total,
-            Items = _umbracoMapper.MapEnumerable<RelationItemModel, ReferenceByIdModel>(relationItemsAttempt.Result.Items),
+            Total = relationItems.Total,
+            Items = _umbracoMapper.MapEnumerable<RelationItemModel, ReferenceByIdModel>(relationItems.Items),
         };
 
-        return Ok(pagedViewModel);
+        return pagedViewModel;
     }
 }

src/Umbraco.Cms.Api.Management/Controllers/Member/Item/SearchMemberItemController.cs

@@ -24,15 +24,15 @@ public class SearchMemberItemController : MemberItemControllerBase
     [HttpGet("search")]
     [MapToApiVersion("1.0")]
     [ProducesResponseType(typeof(PagedModel<MemberItemResponseModel>), StatusCodes.Status200OK)]
-    public async Task<IActionResult> SearchWithAllowedTypes(CancellationToken cancellationToken, string query, int skip = 0, int take = 100, [FromQuery]IEnumerable<Guid>? allowedMemberTypes = null)
+    public Task<IActionResult> SearchWithAllowedTypes(CancellationToken cancellationToken, string query, int skip = 0, int take = 100, [FromQuery]IEnumerable<Guid>? allowedMemberTypes = null)
     {
-        PagedModel<IEntitySlim> searchResult = await _indexedEntitySearchService.SearchAsync(UmbracoObjectTypes.Member, query, null, allowedMemberTypes, false, "*", skip, take);
+        PagedModel<IEntitySlim> searchResult = _indexedEntitySearchService.Search(UmbracoObjectTypes.Member, query, null, allowedMemberTypes, skip, take);
         var result = new PagedModel<MemberItemResponseModel>
         {
             Items = searchResult.Items.OfType<IMemberEntitySlim>().Select(_memberPresentationFactory.CreateItemResponseModel),
-            Total = searchResult.Total,
+            Total = searchResult.Total
         };
 
-        return await Task.FromResult<IActionResult>(Ok(result));
+        return Task.FromResult<IActionResult>(Ok(result));
     }
 }

src/Umbraco.Cms.Api.Management/Controllers/Member/References/ReferencedByMemberController.cs

@@ -4,10 +4,8 @@ using Microsoft.AspNetCore.Mvc;
 using Umbraco.Cms.Api.Common.ViewModels.Pagination;
 using Umbraco.Cms.Api.Management.Factories;
 using Umbraco.Cms.Api.Management.ViewModels.TrackedReferences;
-using Umbraco.Cms.Core;
 using Umbraco.Cms.Core.Models;
 using Umbraco.Cms.Core.Services;
-using Umbraco.Cms.Core.Services.OperationStatus;
 
 namespace Umbraco.Cms.Api.Management.Controllers.Member.References;
 
@@ -17,16 +15,22 @@ public class ReferencedByMemberController : MemberControllerBase
     private readonly ITrackedReferencesService _trackedReferencesService;
     private readonly IRelationTypePresentationFactory _relationTypePresentationFactory;
 
-    public ReferencedByMemberController(
-        ITrackedReferencesService trackedReferencesService,
-        IRelationTypePresentationFactory relationTypePresentationFactory)
+    public ReferencedByMemberController(ITrackedReferencesService trackedReferencesService, IRelationTypePresentationFactory relationTypePresentationFactory)
     {
         _trackedReferencesService = trackedReferencesService;
         _relationTypePresentationFactory = relationTypePresentationFactory;
     }
 
-    [Obsolete("Use the ReferencedBy2 action method instead. Scheduled for removal in Umbraco 19, when ReferencedBy2 will be renamed back to ReferencedBy.")]
-    [NonAction]
+    /// <summary>
+    ///     Gets a page list of tracked references for the current item, so you can see where an item is being used.
+    /// </summary>
+    /// <remarks>
+    ///     Used by info tabs on content, media etc. and for the delete and unpublish of single items.
+    ///     This is basically finding parents of relations.
+    /// </remarks>
+    [HttpGet("{id:guid}/referenced-by")]
+    [MapToApiVersion("1.0")]
+    [ProducesResponseType(typeof(PagedViewModel<IReferenceResponseModel>), StatusCodes.Status200OK)]
     public async Task<ActionResult<PagedViewModel<IReferenceResponseModel>>> ReferencedBy(
         CancellationToken cancellationToken,
         Guid id,
@@ -43,37 +47,4 @@ public class ReferencedByMemberController : MemberControllerBase
 
         return pagedViewModel;
     }
-
-    /// <summary>
-    ///     Gets a page list of tracked references for the current item, so you can see where an item is being used.
-    /// </summary>
-    /// <remarks>
-    ///     Used by info tabs on content, media etc. and for the delete and unpublish of single items.
-    ///     This is basically finding parents of relations.
-    /// </remarks>
-    [HttpGet("{id:guid}/referenced-by")]
-    [MapToApiVersion("1.0")]
-    [ProducesResponseType(typeof(PagedViewModel<IReferenceResponseModel>), StatusCodes.Status200OK)]
-    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status404NotFound)]
-    public async Task<IActionResult> ReferencedBy2(
-        CancellationToken cancellationToken,
-        Guid id,
-        int skip = 0,
-        int take = 20)
-    {
-        Attempt<PagedModel<RelationItemModel>, GetReferencesOperationStatus> relationItemsAttempt = await _trackedReferencesService.GetPagedRelationsForItemAsync(id, UmbracoObjectTypes.Member, skip, take, true);
-
-        if (relationItemsAttempt.Success is false)
-        {
-            return GetReferencesOperationStatusResult(relationItemsAttempt.Status);
-        }
-
-        var pagedViewModel = new PagedViewModel<IReferenceResponseModel>
-        {
-            Total = relationItemsAttempt.Result.Total,
-            Items = await _relationTypePresentationFactory.CreateReferenceResponseModelsAsync(relationItemsAttempt.Result.Items),
-        };
-
-        return Ok(pagedViewModel);
-    }
 }

src/Umbraco.Cms.Api.Management/Controllers/Member/References/ReferencedDescendantsMemberController.cs

@@ -3,11 +3,9 @@ using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
 using Umbraco.Cms.Api.Common.ViewModels.Pagination;
 using Umbraco.Cms.Api.Management.ViewModels;
-using Umbraco.Cms.Core;
 using Umbraco.Cms.Core.Mapping;
 using Umbraco.Cms.Core.Models;
 using Umbraco.Cms.Core.Services;
-using Umbraco.Cms.Core.Services.OperationStatus;
 
 namespace Umbraco.Cms.Api.Management.Controllers.Member.References;
 
@@ -17,16 +15,23 @@ public class ReferencedDescendantsMemberController : MemberControllerBase
     private readonly ITrackedReferencesService _trackedReferencesSkipTakeService;
     private readonly IUmbracoMapper _umbracoMapper;
 
-    public ReferencedDescendantsMemberController(
-        ITrackedReferencesService trackedReferencesSkipTakeService,
-        IUmbracoMapper umbracoMapper)
+    public ReferencedDescendantsMemberController(ITrackedReferencesService trackedReferencesSkipTakeService, IUmbracoMapper umbracoMapper)
     {
         _trackedReferencesSkipTakeService = trackedReferencesSkipTakeService;
         _umbracoMapper = umbracoMapper;
     }
 
-    [Obsolete("Use the ReferencedDescendants2 action method instead. Scheduled for removal in Umbraco 19, when ReferencedDescendants2 will be renamed back to ReferencedDescendants.")]
-    [NonAction]
+    /// <summary>
+    ///     Gets a page list of the child nodes of the current item used in any kind of relation.
+    /// </summary>
+    /// <remarks>
+    ///     Used when deleting and unpublishing a single item to check if this item has any descending items that are in any
+    ///     kind of relation.
+    ///     This is basically finding the descending items which are children in relations.
+    /// </remarks>
+    [HttpGet("{id:guid}/referenced-descendants")]
+    [MapToApiVersion("1.0")]
+    [ProducesResponseType(typeof(PagedViewModel<ReferenceByIdModel>), StatusCodes.Status200OK)]
     public async Task<ActionResult<PagedViewModel<ReferenceByIdModel>>> ReferencedDescendants(
         CancellationToken cancellationToken,
         Guid id,
@@ -42,38 +47,4 @@ public class ReferencedDescendantsMemberController : MemberControllerBase
 
         return pagedViewModel;
     }
-
-    /// <summary>
-    ///     Gets a page list of the child nodes of the current item used in any kind of relation.
-    /// </summary>
-    /// <remarks>
-    ///     Used when deleting and unpublishing a single item to check if this item has any descending items that are in any
-    ///     kind of relation.
-    ///     This is basically finding the descending items which are children in relations.
-    /// </remarks>
-    [HttpGet("{id:guid}/referenced-descendants")]
-    [MapToApiVersion("1.0")]
-    [ProducesResponseType(typeof(PagedViewModel<ReferenceByIdModel>), StatusCodes.Status200OK)]
-    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status404NotFound)]
-    public async Task<IActionResult> ReferencedDescendants2(
-        CancellationToken cancellationToken,
-        Guid id,
-        int skip = 0,
-        int take = 20)
-    {
-        Attempt<PagedModel<RelationItemModel>, GetReferencesOperationStatus> relationItemsAttempt = await _trackedReferencesSkipTakeService.GetPagedDescendantsInReferencesAsync(id, UmbracoObjectTypes.Member, skip, take, true);
-
-        if (relationItemsAttempt.Success is false)
-        {
-            return GetReferencesOperationStatusResult(relationItemsAttempt.Status);
-        }
-
-        var pagedViewModel = new PagedViewModel<ReferenceByIdModel>
-        {
-            Total = relationItemsAttempt.Result.Total,
-            Items = _umbracoMapper.MapEnumerable<RelationItemModel, ReferenceByIdModel>(relationItemsAttempt.Result.Items),
-        };
-
-        return Ok(pagedViewModel);
-    }
 }

src/Umbraco.Cms.Api.Management/Controllers/MemberType/Folder/ByKeyMemberTypeFolderController.cs

@@ -1,25 +0,0 @@
-using Asp.Versioning;
-using Microsoft.AspNetCore.Http;
-using Microsoft.AspNetCore.Mvc;
-using Umbraco.Cms.Api.Management.ViewModels.Folder;
-using Umbraco.Cms.Core.Security;
-using Umbraco.Cms.Core.Services;
-
-namespace Umbraco.Cms.Api.Management.Controllers.MemberType.Folder;
-
-[ApiVersion("1.0")]
-public class ByKeyMemberTypeFolderController : MemberTypeFolderControllerBase
-{
-    public ByKeyMemberTypeFolderController(
-        IBackOfficeSecurityAccessor backOfficeSecurityAccessor,
-        IMemberTypeContainerService memberTypeContainerService)
-        : base(backOfficeSecurityAccessor, memberTypeContainerService)
-    {
-    }
-
-    [HttpGet("{id:guid}")]
-    [MapToApiVersion("1.0")]
-    [ProducesResponseType(typeof(FolderResponseModel), StatusCodes.Status200OK)]
-    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status404NotFound)]
-    public async Task<IActionResult> ByKey(CancellationToken cancellationToken, Guid id) => await GetFolderAsync(id);
-}

src/Umbraco.Cms.Api.Management/Controllers/MemberType/Folder/CreateMemberTypeFolderController.cs

@@ -1,31 +0,0 @@
-using Asp.Versioning;
-using Microsoft.AspNetCore.Http;
-using Microsoft.AspNetCore.Mvc;
-using Umbraco.Cms.Api.Management.ViewModels.Folder;
-using Umbraco.Cms.Core.Security;
-using Umbraco.Cms.Core.Services;
-
-namespace Umbraco.Cms.Api.Management.Controllers.MemberType.Folder;
-
-[ApiVersion("1.0")]
-public class CreateMemberTypeFolderController : MemberTypeFolderControllerBase
-{
-    public CreateMemberTypeFolderController(
-        IBackOfficeSecurityAccessor backOfficeSecurityAccessor,
-        IMemberTypeContainerService memberTypeContainerService)
-        : base(backOfficeSecurityAccessor, memberTypeContainerService)
-    {
-    }
-
-    [HttpPost]
-    [MapToApiVersion("1.0")]
-    [ProducesResponseType(StatusCodes.Status201Created)]
-    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status400BadRequest)]
-    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status404NotFound)]
-    public async Task<IActionResult> Create(
-        CancellationToken cancellationToken,
-        CreateFolderRequestModel createFolderRequestModel)
-        => await CreateFolderAsync<ByKeyMemberTypeFolderController>(
-            createFolderRequestModel,
-            controller => nameof(controller.ByKey)).ConfigureAwait(false);
-}

src/Umbraco.Cms.Api.Management/Controllers/MemberType/Folder/DeleteMemberTypeFolderController.cs

@@ -1,25 +0,0 @@
-using Asp.Versioning;
-using Microsoft.AspNetCore.Http;
-using Microsoft.AspNetCore.Mvc;
-using Umbraco.Cms.Core.Security;
-using Umbraco.Cms.Core.Services;
-
-namespace Umbraco.Cms.Api.Management.Controllers.MemberType.Folder;
-
-[ApiVersion("1.0")]
-public class DeleteMemberTypeFolderController : MemberTypeFolderControllerBase
-{
-    public DeleteMemberTypeFolderController(
-        IBackOfficeSecurityAccessor backOfficeSecurityAccessor,
-        IMemberTypeContainerService memberTypeContainerService)
-        : base(backOfficeSecurityAccessor, memberTypeContainerService)
-    {
-    }
-
-    [HttpDelete("{id:guid}")]
-    [MapToApiVersion("1.0")]
-    [ProducesResponseType(StatusCodes.Status200OK)]
-    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status400BadRequest)]
-    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status404NotFound)]
-    public async Task<IActionResult> Delete(CancellationToken cancellationToken, Guid id) => await DeleteFolderAsync(id);
-}

src/Umbraco.Cms.Api.Management/Controllers/MemberType/Folder/MemberTypeFolderControllerBase.cs

@@ -1,23 +0,0 @@
-using Microsoft.AspNetCore.Authorization;
-using Microsoft.AspNetCore.Mvc;
-using Umbraco.Cms.Api.Management.Routing;
-using Umbraco.Cms.Core;
-using Umbraco.Cms.Core.Models;
-using Umbraco.Cms.Core.Security;
-using Umbraco.Cms.Core.Services;
-using Umbraco.Cms.Web.Common.Authorization;
-
-namespace Umbraco.Cms.Api.Management.Controllers.MemberType.Folder;
-
-[VersionedApiBackOfficeRoute($"{Constants.UdiEntityType.MemberType}/folder")]
-[ApiExplorerSettings(GroupName = "Member Type")]
-[Authorize(Policy = AuthorizationPolicies.TreeAccessMemberTypes)]
-public abstract class MemberTypeFolderControllerBase : FolderManagementControllerBase<IMemberType>
-{
-    protected MemberTypeFolderControllerBase(
-        IBackOfficeSecurityAccessor backOfficeSecurityAccessor,
-        IMemberTypeContainerService memberTypeContainerService)
-        : base(backOfficeSecurityAccessor, memberTypeContainerService)
-    {
-    }
-}

src/Umbraco.Cms.Api.Management/Controllers/MemberType/Folder/UpdateMemberTypeFolderController.cs

@@ -1,30 +0,0 @@
-using Asp.Versioning;
-using Microsoft.AspNetCore.Http;
-using Microsoft.AspNetCore.Mvc;
-using Umbraco.Cms.Api.Management.ViewModels.Folder;
-using Umbraco.Cms.Core.Security;
-using Umbraco.Cms.Core.Services;
-
-namespace Umbraco.Cms.Api.Management.Controllers.MemberType.Folder;
-
-[ApiVersion("1.0")]
-public class UpdateMemberTypeFolderController : MemberTypeFolderControllerBase
-{
-    public UpdateMemberTypeFolderController(
-        IBackOfficeSecurityAccessor backOfficeSecurityAccessor,
-        IMemberTypeContainerService memberTypeContainerService)
-        : base(backOfficeSecurityAccessor, memberTypeContainerService)
-    {
-    }
-
-    [HttpPut("{id:guid}")]
-    [MapToApiVersion("1.0")]
-    [ProducesResponseType(StatusCodes.Status200OK)]
-    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status400BadRequest)]
-    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status404NotFound)]
-    public async Task<IActionResult> Update(
-        CancellationToken cancellationToken,
-        Guid id,
-        UpdateFolderResponseModel updateFolderResponseModel)
-        => await UpdateFolderAsync(id, updateFolderResponseModel);
-}

src/Umbraco.Cms.Api.Management/Controllers/MemberType/Tree/RootMemberTypeTreeController.cs

@@ -30,7 +30,6 @@ public class RootMemberTypeTreeController : MemberTypeTreeControllerBase
     public async Task<ActionResult<PagedViewModel<MemberTypeTreeItemResponseModel>>> Root(
         CancellationToken cancellationToken,
         int skip = 0,
-        int take = 100,
-        bool foldersOnly = false)
+        int take = 100)
         => await GetRoot(skip, take);
 }

src/Umbraco.Cms.Api.Management/Controllers/MemberType/Tree/SiblingMemberTypeTreeController.cs

@@ -1,4 +1,4 @@
-using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
 using Umbraco.Cms.Api.Common.ViewModels.Pagination;
 using Umbraco.Cms.Api.Management.Services.Flags;
@@ -23,7 +23,6 @@ public class SiblingMemberTypeTreeController : MemberTypeTreeControllerBase
         CancellationToken cancellationToken,
         Guid target,
         int before,
-        int after,
-        bool foldersOnly = false)
+        int after)
         => await GetSiblings(target, before, after);
 }

src/Umbraco.Cms.Api.Management/Controllers/ModelsBuilder/BuildModelsBuilderController.cs

@@ -1,18 +1,21 @@
+using System;
+using System.Threading.Tasks;
 using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Options;
-using Umbraco.Cms.Core;
 using Umbraco.Cms.Core.Configuration.Models;
 using Umbraco.Cms.Infrastructure.ModelsBuilder;
 using Umbraco.Cms.Infrastructure.ModelsBuilder.Building;
+using Umbraco.Extensions;
 
 namespace Umbraco.Cms.Api.Management.Controllers.ModelsBuilder;
 
 [ApiVersion("1.0")]
 public class BuildModelsBuilderController : ModelsBuilderControllerBase
 {
-    private readonly ModelsBuilderSettings _modelsBuilderSettings;
+    private ModelsBuilderSettings _modelsBuilderSettings;
     private readonly ModelsGenerationError _mbErrors;
     private readonly IModelsGenerator _modelGenerator;
 
@@ -24,6 +27,8 @@ public class BuildModelsBuilderController : ModelsBuilderControllerBase
         _mbErrors = mbErrors;
         _modelGenerator = modelGenerator;
         _modelsBuilderSettings = modelsBuilderSettings.CurrentValue;
+
+        modelsBuilderSettings.OnChange(x => _modelsBuilderSettings = x);
     }
 
     [HttpPost("build")]
@@ -34,8 +39,7 @@ public class BuildModelsBuilderController : ModelsBuilderControllerBase
     {
         try
         {
-            if (_modelsBuilderSettings.ModelsMode != Constants.ModelsBuilder.ModelsModes.SourceCodeManual
-                && _modelsBuilderSettings.ModelsMode != Constants.ModelsBuilder.ModelsModes.SourceCodeAuto)
+            if (!_modelsBuilderSettings.ModelsMode.SupportsExplicitGeneration())
             {
                 var problemDetailsModel = new ProblemDetails
                 {

src/Umbraco.Cms.Api.Management/Controllers/NewsDashboard/NewsDashboardController.cs

@@ -1,22 +0,0 @@
-using Microsoft.AspNetCore.Http;
-using Microsoft.AspNetCore.Mvc;
-using Umbraco.Cms.Api.Management.Services.NewsDashboard;
-using Umbraco.Cms.Api.Management.ViewModels.NewsDashboard;
-
-namespace Umbraco.Cms.Api.Management.Controllers.NewsDashboard;
-
-public class NewsDashboardController : NewsDashboardControllerBase
-{
-    private readonly INewsDashboardService _newsDashboardService;
-
-    public NewsDashboardController(INewsDashboardService newsDashboardService) => _newsDashboardService = newsDashboardService;
-
-    [HttpGet]
-    [ProducesResponseType(typeof(NewsDashboardResponseModel), StatusCodes.Status200OK)]
-    public async Task<IActionResult> GetDashboard()
-    {
-        NewsDashboardResponseModel content = await _newsDashboardService.GetItemsAsync();
-
-        return Ok(content);
-    }
-}

src/Umbraco.Cms.Api.Management/Controllers/NewsDashboard/NewsDashboardControllerBase.cs

@@ -1,10 +0,0 @@
-using Microsoft.AspNetCore.Mvc;
-using Umbraco.Cms.Api.Management.Routing;
-
-namespace Umbraco.Cms.Api.Management.Controllers.NewsDashboard;
-
-[VersionedApiBackOfficeRoute("news-dashboard")]
-[ApiExplorerSettings(GroupName = "News Dashboard")]
-public abstract class NewsDashboardControllerBase : ManagementApiControllerBase
-{
-}

src/Umbraco.Cms.Api.Management/Controllers/Preview/EnterPreviewController.cs

@@ -7,7 +7,6 @@ using Umbraco.Cms.Core.Services;
 namespace Umbraco.Cms.Api.Management.Controllers.Preview;
 
 [ApiVersion("1.0")]
-[Obsolete("Do not use this. Preview state is initiated implicitly by the preview URL generation. Scheduled for removal in V18.")]
 public class EnterPreviewController : PreviewControllerBase
 {
     private readonly IPreviewService _previewService;

src/Umbraco.Cms.Api.Management/Controllers/Security/BackOfficeController.cs

@@ -254,7 +254,7 @@ public class BackOfficeController : SecurityControllerBase
         if (associatedUser is not null)
         {
             // log current datetime as last login (this also ensures that the user is not flagged as inactive)
-            associatedUser.LastLoginDate = DateTime.UtcNow;
+            associatedUser.LastLoginDateUtc = DateTime.UtcNow;
             await _backOfficeUserManager.UpdateAsync(associatedUser);
 
             return await SignInBackOfficeUser(associatedUser, request);

src/Umbraco.Cms.Api.Management/Controllers/Security/BackOfficeDefaultController.cs

@@ -17,6 +17,12 @@ public class BackOfficeDefaultController : Controller
     public BackOfficeDefaultController(IRuntime umbracoRuntime)
         => _umbracoRuntime = umbracoRuntime;
 
+    [Obsolete("Use the non obsoleted constructor instead. Scheduled to be removed in v17")]
+    public BackOfficeDefaultController()
+        : this(StaticServiceProvider.Instance.GetRequiredService<IRuntime>())
+    {
+    }
+
     [HttpGet]
     [AllowAnonymous]
     public async Task<IActionResult> Index(CancellationToken cancellationToken)

src/Umbraco.Cms.Api.Management/Controllers/StaticFile/Tree/StaticFileTreeControllerBase.cs

@@ -34,14 +34,14 @@ public class StaticFileTreeControllerBase : FileSystemTreeControllerBase
 
     protected override IFileSystem FileSystem { get; }
 
-    protected override string[] GetDirectories(string path) =>
+    protected string[] GetDirectories(string path) =>
         IsTreeRootPath(path)
             ? _allowedRootFolders
             : IsAllowedPath(path)
                 ? _fileSystemTreeService.GetDirectories(path)
                 : Array.Empty<string>();
 
-    protected override string[] GetFiles(string path)
+    protected string[] GetFiles(string path)
         => IsTreeRootPath(path) || IsAllowedPath(path) == false
             ? Array.Empty<string>()
             : _fileSystemTreeService.GetFiles(path);

src/Umbraco.Cms.Api.Management/Controllers/Template/Query/ExecuteTemplateQueryController.cs

@@ -43,6 +43,41 @@ public class ExecuteTemplateQueryController : TemplateQueryControllerBase
         _publishedContentStatusFilteringService = publishedContentStatusFilteringService;
     }
 
+    [Obsolete("Please use the non-obsolete constructor. Will be removed in V17.")]
+    public ExecuteTemplateQueryController(
+        IPublishedContentQuery publishedContentQuery,
+        IVariationContextAccessor variationContextAccessor,
+        IPublishedValueFallback publishedValueFallback,
+        IContentTypeService contentTypeService,
+        IPublishedContentCache contentCache,
+        IDocumentNavigationQueryService documentNavigationQueryService,
+        IPublishedContentStatusFilteringService publishedContentStatusFilteringService)
+        : this(
+            publishedContentQuery,
+            publishedValueFallback,
+            contentTypeService,
+            documentNavigationQueryService,
+            publishedContentStatusFilteringService)
+    {
+    }
+
+    [Obsolete("Please use the non-obsolete constructor. Will be removed in V17.")]
+    public ExecuteTemplateQueryController(
+        IPublishedContentQuery publishedContentQuery,
+        IVariationContextAccessor variationContextAccessor,
+        IPublishedValueFallback publishedValueFallback,
+        IContentTypeService contentTypeService,
+        IPublishedContentCache contentCache,
+        IDocumentNavigationQueryService documentNavigationQueryService)
+        : this(
+            publishedContentQuery,
+            publishedValueFallback,
+            contentTypeService,
+            documentNavigationQueryService,
+            StaticServiceProvider.Instance.GetRequiredService<IPublishedContentStatusFilteringService>())
+    {
+    }
+
     [HttpPost("execute")]
     [MapToApiVersion("1.0")]
     [ProducesResponseType(typeof(TemplateQueryResultResponseModel), StatusCodes.Status200OK)]

src/Umbraco.Cms.Api.Management/Controllers/User/UpdateUserGroupsUserController.cs

@@ -1,11 +1,14 @@
-using Asp.Versioning;
+using Asp.Versioning;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Api.Management.Controllers.UserGroup;
 using Umbraco.Cms.Api.Management.Routing;
 using Umbraco.Cms.Api.Management.ViewModels.User;
 using Umbraco.Cms.Core;
+using Umbraco.Cms.Core.DependencyInjection;
+using Umbraco.Cms.Core.Security;
 using Umbraco.Cms.Core.Security.Authorization;
 using Umbraco.Cms.Core.Services;
 using Umbraco.Cms.Core.Services.OperationStatus;
@@ -25,11 +28,26 @@ public class UpdateUserGroupsUserController : UserGroupControllerBase
 {
     private readonly IAuthorizationService _authorizationService;
     private readonly IUserGroupService _userGroupService;
+    private readonly IBackOfficeSecurityAccessor _backOfficeSecurityAccessor;
 
-    public UpdateUserGroupsUserController(IAuthorizationService authorizationService, IUserGroupService userGroupService)
+    [ActivatorUtilitiesConstructor]
+    public UpdateUserGroupsUserController(
+        IAuthorizationService authorizationService,
+        IUserGroupService userGroupService,
+        IBackOfficeSecurityAccessor backOfficeSecurityAccessor)
     {
         _authorizationService = authorizationService;
         _userGroupService = userGroupService;
+        _backOfficeSecurityAccessor = backOfficeSecurityAccessor;
+    }
+
+    [Obsolete("Please use the constructor accepting all parameters. Scheduled for removal in Umbraco 19.")]
+    public UpdateUserGroupsUserController(IAuthorizationService authorizationService, IUserGroupService userGroupService)
+        : this(
+            authorizationService,
+            userGroupService,
+            StaticServiceProvider.Instance.GetRequiredService<IBackOfficeSecurityAccessor>())
+    {
     }
 
     [HttpPost("set-user-groups")]
@@ -51,7 +69,8 @@ public class UpdateUserGroupsUserController : UserGroupControllerBase
 
         Attempt<UserGroupOperationStatus> result = await _userGroupService.UpdateUserGroupsOnUsersAsync(
             requestModel.UserGroupIds.Select(x => x.Id).ToHashSet(),
-            requestModel.UserIds.Select(x => x.Id).ToHashSet());
+            requestModel.UserIds.Select(x => x.Id).ToHashSet(),
+            CurrentUserKey(_backOfficeSecurityAccessor));
 
         return result.Success
             ? Ok()

src/Umbraco.Cms.Api.Management/DependencyInjection/AuditLogBuilderExtensions.cs

@@ -11,13 +11,13 @@ internal static class AuditLogBuilderExtensions
     internal static IUmbracoBuilder AddAuditLogs(this IUmbracoBuilder builder)
     {
         builder.Services.AddTransient<IAuditLogPresentationFactory, AuditLogPresentationFactory>();
-        builder.AddNotificationAsyncHandler<UserLoginSuccessNotification, BackOfficeUserManagerAuditer>();
-        builder.AddNotificationAsyncHandler<UserLogoutSuccessNotification, BackOfficeUserManagerAuditer>();
-        builder.AddNotificationAsyncHandler<UserLoginFailedNotification, BackOfficeUserManagerAuditer>();
-        builder.AddNotificationAsyncHandler<UserForgotPasswordRequestedNotification, BackOfficeUserManagerAuditer>();
-        builder.AddNotificationAsyncHandler<UserForgotPasswordChangedNotification, BackOfficeUserManagerAuditer>();
-        builder.AddNotificationAsyncHandler<UserPasswordChangedNotification, BackOfficeUserManagerAuditer>();
-        builder.AddNotificationAsyncHandler<UserPasswordResetNotification, BackOfficeUserManagerAuditer>();
+        builder.AddNotificationHandler<UserLoginSuccessNotification, BackOfficeUserManagerAuditer>();
+        builder.AddNotificationHandler<UserLogoutSuccessNotification, BackOfficeUserManagerAuditer>();
+        builder.AddNotificationHandler<UserLoginFailedNotification, BackOfficeUserManagerAuditer>();
+        builder.AddNotificationHandler<UserForgotPasswordRequestedNotification, BackOfficeUserManagerAuditer>();
+        builder.AddNotificationHandler<UserForgotPasswordChangedNotification, BackOfficeUserManagerAuditer>();
+        builder.AddNotificationHandler<UserPasswordChangedNotification, BackOfficeUserManagerAuditer>();
+        builder.AddNotificationHandler<UserPasswordResetNotification, BackOfficeUserManagerAuditer>();
 
         return builder;
     }

src/Umbraco.Cms.Api.Management/DependencyInjection/DashboardBuilderExtensions.cs

@@ -1,15 +0,0 @@
-using Microsoft.Extensions.DependencyInjection;
-using Umbraco.Cms.Api.Management.Services.NewsDashboard;
-using Umbraco.Cms.Core.DependencyInjection;
-
-namespace Umbraco.Cms.Api.Management.DependencyInjection;
-
-internal static class NewsDashboardBuilderExtensions
-{
-    internal static IUmbracoBuilder AddNewsDashboard(this IUmbracoBuilder builder)
-    {
-        builder.Services.AddSingleton<INewsDashboardService, NewsDashboardService>();
-
-        return builder;
-    }
-}

src/Umbraco.Cms.Api.Management/DependencyInjection/InstallerBuilderExtensions.cs

@@ -25,7 +25,7 @@ public static class InstallerBuilderExtensions
 
         builder.AddInstallSteps();
         services.AddTransient<IInstallService, InstallService>();
-        builder.AddNotificationAsyncHandler<UnattendedInstallNotification, PostUnattendedInstallNotificationHandler>();
+        builder.AddNotificationAsyncHandler<UnattendedInstallNotification, CreateUnattendedUserNotificationHandler>();
         builder.WithCollectionBuilder<MapDefinitionCollectionBuilder>().Add<InstallerViewModelsMapDefinition>();
 
         return builder;

src/Umbraco.Cms.Api.Management/DependencyInjection/UmbracoBuilder.BackOffice.cs

@@ -30,7 +30,7 @@ public static partial class UmbracoBuilderExtensions
         .AddMembersIdentity()
         .AddUmbracoProfiler()
         .AddMvcAndRazor(configureMvc)
-        .AddBackgroundJobs()
+        .AddRecurringBackgroundJobs()
         .AddUmbracoHybridCache()
         .AddDistributedCache()
         .AddCoreNotifications();

src/Umbraco.Cms.Api.Management/DependencyInjection/UmbracoBuilder.Collections.cs

@@ -10,26 +10,18 @@ namespace Umbraco.Extensions
     {
         internal static void AddCollectionBuilders(this IUmbracoBuilder builder)
         {
-            builder.FlagProviders()
+            builder.SignProviders()
                 .Append<HasScheduleFlagProvider>()
                 .Append<IsProtectedFlagProvider>()
                 .Append<HasPendingChangesFlagProvider>()
                 .Append<HasCollectionFlagProvider>();
         }
 
-        /// <summary>
-        /// Gets the flag providers collection builder.
-        /// </summary>
-        /// <param name="builder">The builder.</param>
-        public static FlagProviderCollectionBuilder FlagProviders(this IUmbracoBuilder builder)
-            => builder.WithCollectionBuilder<FlagProviderCollectionBuilder>();
-
         /// <summary>
         /// Gets the sign providers collection builder.
         /// </summary>
         /// <param name="builder">The builder.</param>
-        [Obsolete("Please use the correctly named FlagProviders. Scheduled for removal in Umbraco 19.")]
         public static FlagProviderCollectionBuilder SignProviders(this IUmbracoBuilder builder)
-            => builder.FlagProviders();
+            => builder.WithCollectionBuilder<FlagProviderCollectionBuilder>();
     }
 }

src/Umbraco.Cms.Api.Management/DependencyInjection/UmbracoBuilderExtensions.cs

@@ -71,8 +71,7 @@ public static partial class UmbracoBuilderExtensions
                 .AddUserData()
                 .AddSegment()
                 .AddExport()
-                .AddImport()
-                .AddNewsDashboard();
+                .AddImport();
 
             services
                 .ConfigureOptions<ConfigureApiBehaviorOptions>()

src/Umbraco.Cms.Api.Management/Factories/DocumentCollectionPresentationFactory.cs

@@ -14,6 +14,15 @@ public class DocumentCollectionPresentationFactory : ContentCollectionPresentati
     private readonly IPublicAccessService _publicAccessService;
     private readonly IEntityService _entityService;
 
+    [Obsolete("Please use the non-obsolete constructor. Scheduled for removal in V17.")]
+    public DocumentCollectionPresentationFactory(IUmbracoMapper mapper, IPublicAccessService publicAccessService)
+        : this(
+              mapper,
+              publicAccessService,
+              StaticServiceProvider.Instance.GetRequiredService<IEntityService>())
+    {
+    }
+
     [ActivatorUtilitiesConstructor]
     public DocumentCollectionPresentationFactory(IUmbracoMapper mapper, IPublicAccessService publicAccessService, IEntityService entityService)
     : base(mapper)

src/Umbraco.Cms.Api.Management/Factories/DocumentPresentationFactory.cs

@@ -65,6 +65,22 @@ internal sealed class DocumentPresentationFactory : IDocumentPresentationFactory
         _flagProviderCollection = flagProviderCollection;
     }
 
+    [Obsolete("Schedule for removal in v17")]
+    public async Task<DocumentResponseModel> CreateResponseModelAsync(IContent content)
+    {
+        DocumentResponseModel responseModel = _umbracoMapper.Map<DocumentResponseModel>(content)!;
+
+        Guid? templateKey = content.TemplateId.HasValue
+            ? _templateService.GetAsync(content.TemplateId.Value).Result?.Key
+            : null;
+
+        responseModel.Template = templateKey.HasValue
+            ? new ReferenceByIdModel { Id = templateKey.Value }
+            : null;
+
+        return responseModel;
+    }
+
     public async Task<PublishedDocumentResponseModel> CreatePublishedResponseModelAsync(IContent content)
     {
         PublishedDocumentResponseModel responseModel = _umbracoMapper.Map<PublishedDocumentResponseModel>(content)!;
@@ -165,6 +181,68 @@ internal sealed class DocumentPresentationFactory : IDocumentPresentationFactory
     public DocumentTypeReferenceResponseModel CreateDocumentTypeReferenceResponseModel(IDocumentEntitySlim entity)
         => _umbracoMapper.Map<DocumentTypeReferenceResponseModel>(entity)!;
 
+    [Obsolete("Use CreateCulturePublishScheduleModels instead. Scheduled for removal in v17")]
+    public Attempt<CultureAndScheduleModel, ContentPublishingOperationStatus> CreateCultureAndScheduleModel(PublishDocumentRequestModel requestModel)
+    {
+        var contentScheduleCollection = new ContentScheduleCollection();
+        var culturesToPublishImmediately = new HashSet<string>();
+        foreach (CultureAndScheduleRequestModel cultureAndScheduleRequestModel in requestModel.PublishSchedules)
+        {
+            if (cultureAndScheduleRequestModel.Schedule is null || (cultureAndScheduleRequestModel.Schedule.PublishTime is null && cultureAndScheduleRequestModel.Schedule.UnpublishTime is null))
+            {
+                culturesToPublishImmediately.Add(cultureAndScheduleRequestModel.Culture ?? Constants.System.InvariantCulture); // API have `null` for invariant, but service layer has "*".
+                continue;
+            }
+
+            if (cultureAndScheduleRequestModel.Schedule.PublishTime is not null)
+            {
+                if (cultureAndScheduleRequestModel.Schedule.PublishTime <= _timeProvider.GetUtcNow())
+                {
+                    return Attempt.FailWithStatus(ContentPublishingOperationStatus.PublishTimeNeedsToBeInFuture, new CultureAndScheduleModel()
+                    {
+                        Schedules = contentScheduleCollection,
+                        CulturesToPublishImmediately = culturesToPublishImmediately,
+                    });
+                }
+
+                contentScheduleCollection.Add(new ContentSchedule(
+                    cultureAndScheduleRequestModel.Culture ?? Constants.System.InvariantCulture,
+                    cultureAndScheduleRequestModel.Schedule.PublishTime.Value.UtcDateTime,
+                    ContentScheduleAction.Release));
+            }
+            if (cultureAndScheduleRequestModel.Schedule.UnpublishTime is not null)
+            {
+                if (cultureAndScheduleRequestModel.Schedule.UnpublishTime <= cultureAndScheduleRequestModel.Schedule.PublishTime)
+                {
+                    return Attempt.FailWithStatus(ContentPublishingOperationStatus.UnpublishTimeNeedsToBeAfterPublishTime, new CultureAndScheduleModel()
+                    {
+                        Schedules = contentScheduleCollection,
+                        CulturesToPublishImmediately = culturesToPublishImmediately,
+                    });
+                }
+
+                if (cultureAndScheduleRequestModel.Schedule.UnpublishTime <= _timeProvider.GetUtcNow())
+                {
+                    return Attempt.FailWithStatus(ContentPublishingOperationStatus.UpublishTimeNeedsToBeInFuture, new CultureAndScheduleModel()
+                    {
+                        Schedules = contentScheduleCollection,
+                        CulturesToPublishImmediately = culturesToPublishImmediately,
+                    });
+                }
+
+                contentScheduleCollection.Add(new ContentSchedule(
+                    cultureAndScheduleRequestModel.Culture ?? Constants.System.InvariantCulture,
+                    cultureAndScheduleRequestModel.Schedule.UnpublishTime.Value.UtcDateTime,
+                    ContentScheduleAction.Expire));
+            }
+        }
+        return Attempt.SucceedWithStatus(ContentPublishingOperationStatus.Success, new CultureAndScheduleModel()
+        {
+            Schedules = contentScheduleCollection,
+            CulturesToPublishImmediately = culturesToPublishImmediately,
+        });
+    }
+
     public Attempt<List<CulturePublishScheduleModel>, ContentPublishingOperationStatus> CreateCulturePublishScheduleModels(PublishDocumentRequestModel requestModel)
     {
         var model = new List<CulturePublishScheduleModel>();

src/Umbraco.Cms.Api.Management/Factories/DocumentUrlFactory.cs

@@ -1,42 +1,24 @@
-using Microsoft.Extensions.Logging;
-using Umbraco.Cms.Api.Management.Routing;
 using Umbraco.Cms.Api.Management.ViewModels.Document;
 using Umbraco.Cms.Core.Models;
-using Umbraco.Cms.Core.Models.Membership;
 using Umbraco.Cms.Core.Routing;
-using Umbraco.Cms.Core.Security;
-using Umbraco.Cms.Core.Services;
-using Umbraco.Extensions;
 
 namespace Umbraco.Cms.Api.Management.Factories;
 
 public class DocumentUrlFactory : IDocumentUrlFactory
 {
     private readonly IPublishedUrlInfoProvider _publishedUrlInfoProvider;
-    private readonly UrlProviderCollection _urlProviders;
-    private readonly IPreviewService _previewService;
-    private readonly IBackOfficeSecurityAccessor _backOfficeSecurityAccessor;
-    private readonly ILogger<DocumentUrlFactory> _logger;
 
-    public DocumentUrlFactory(
-        IPublishedUrlInfoProvider publishedUrlInfoProvider,
-        UrlProviderCollection urlProviders,
-        IPreviewService previewService,
-        IBackOfficeSecurityAccessor backOfficeSecurityAccessor,
-        ILogger<DocumentUrlFactory> logger)
-    {
-        _publishedUrlInfoProvider = publishedUrlInfoProvider;
-        _urlProviders = urlProviders;
-        _previewService = previewService;
-        _backOfficeSecurityAccessor = backOfficeSecurityAccessor;
-        _logger = logger;
-    }
+
+    public DocumentUrlFactory(IPublishedUrlInfoProvider publishedUrlInfoProvider)
+        => _publishedUrlInfoProvider = publishedUrlInfoProvider;
 
     public async Task<IEnumerable<DocumentUrlInfo>> CreateUrlsAsync(IContent content)
     {
         ISet<UrlInfo> urlInfos = await _publishedUrlInfoProvider.GetAllAsync(content);
+
         return urlInfos
-            .Select(CreateDocumentUrlInfo)
+            .Where(urlInfo => urlInfo.IsUrl)
+            .Select(urlInfo => new DocumentUrlInfo { Culture = urlInfo.Culture, Url = urlInfo.Text })
             .ToArray();
     }
 
@@ -52,52 +34,4 @@ public class DocumentUrlFactory : IDocumentUrlFactory
 
         return documentUrlInfoResourceSets;
     }
-
-    public async Task<DocumentUrlInfo?> GetPreviewUrlAsync(IContent content, string providerAlias, string? culture, string? segment)
-    {
-        IUrlProvider? provider = _urlProviders.FirstOrDefault(provider => provider.Alias.InvariantEquals(providerAlias));
-        if (provider is null)
-        {
-            _logger.LogError("Could not resolve a URL provider requested for preview - it was not registered in the URL providers collection.");
-            return null;
-        }
-
-        UrlInfo? previewUrlInfo = await provider.GetPreviewUrlAsync(content, culture, segment);
-        if (previewUrlInfo is null)
-        {
-            _logger.LogError("The URL provider could not generate a preview URL for content with key: {contentKey}", content.Key);
-            return null;
-        }
-
-        // must initiate preview state for internal preview URLs
-        if (previewUrlInfo.Url is not null && previewUrlInfo.IsExternal is false)
-        {
-            IUser? currentUser = _backOfficeSecurityAccessor.BackOfficeSecurity?.CurrentUser;
-            if (currentUser is null)
-            {
-                _logger.LogError("Could not access the current backoffice user while attempting to authenticate for preview.");
-                return null;
-            }
-
-            if (await _previewService.TryEnterPreviewAsync(currentUser) is false)
-            {
-                _logger.LogError("A server error occured, could not initiate an authenticated preview state for the current user.");
-                return null;
-            }
-        }
-
-        return CreateDocumentUrlInfo(previewUrlInfo);
-    }
-
-    private DocumentUrlInfo CreateDocumentUrlInfo(UrlInfo urlInfo)
-    {
-        var url = urlInfo.Url?.ToString();
-        return new DocumentUrlInfo
-        {
-            Culture = urlInfo.Culture,
-            Url = url,
-            Message = urlInfo.Message,
-            Provider = urlInfo.Provider,
-        };
-    }
 }

src/Umbraco.Cms.Api.Management/Factories/HealthCheckGroupPresentationFactory.cs

@@ -41,6 +41,14 @@ public class HealthCheckGroupPresentationFactory : IHealthCheckGroupPresentation
         return groups;
     }
 
+    [Obsolete("Use CreateHealthCheckGroupWithResultViewModelAsync instead. Will be removed in v17.")]
+    public HealthCheckGroupWithResultResponseModel CreateHealthCheckGroupWithResultViewModel(IGrouping<string?, HealthCheck> healthCheckGroup)
+        => CreateHealthCheckGroupWithResultViewModelAsync(healthCheckGroup).GetAwaiter().GetResult();
+
+    [Obsolete("Use CreateHealthCheckGroupWithResultViewModelAsync instead. Will be removed in v17.")]
+    public HealthCheckWithResultPresentationModel CreateHealthCheckWithResultViewModel(HealthCheck healthCheck) =>
+        CreateHealthCheckWithResultViewModelAsync(healthCheck).GetAwaiter().GetResult();
+
     public async Task<HealthCheckGroupWithResultResponseModel> CreateHealthCheckGroupWithResultViewModelAsync(IGrouping<string?, HealthCheck> healthCheckGroup)
     {
         var healthChecks = new List<HealthCheckWithResultPresentationModel>();

src/Umbraco.Cms.Api.Management/Factories/IDocumentPresentationFactory.cs

@@ -14,9 +14,17 @@ namespace Umbraco.Cms.Api.Management.Factories;
 
 public interface IDocumentPresentationFactory
 {
+    [Obsolete("Schedule for removal in v17")]
+    Task<DocumentResponseModel> CreateResponseModelAsync(IContent content);
+
     Task<PublishedDocumentResponseModel> CreatePublishedResponseModelAsync(IContent content);
 
-    Task<DocumentResponseModel> CreateResponseModelAsync(IContent content, ContentScheduleCollection schedule);
+    Task<DocumentResponseModel> CreateResponseModelAsync(IContent content, ContentScheduleCollection schedule)
+#pragma warning disable CS0618 // Type or member is obsolete
+        // Remove when obsolete CreateResponseModelAsync is removed
+        => CreateResponseModelAsync(content);
+#pragma warning restore CS0618 // Type or member is obsolete
+
     DocumentItemResponseModel CreateItemResponseModel(IDocumentEntitySlim entity);
 
     DocumentBlueprintItemResponseModel CreateBlueprintItemResponseModel(IDocumentEntitySlim entity);
@@ -25,6 +33,9 @@ public interface IDocumentPresentationFactory
 
     DocumentTypeReferenceResponseModel CreateDocumentTypeReferenceResponseModel(IDocumentEntitySlim entity);
 
+    [Obsolete("Use CreateCulturePublishScheduleModels instead. Scheduled for removal in v17")]
+    Attempt<CultureAndScheduleModel, ContentPublishingOperationStatus> CreateCultureAndScheduleModel(PublishDocumentRequestModel requestModel);
+
     Attempt<List<CulturePublishScheduleModel>, ContentPublishingOperationStatus> CreateCulturePublishScheduleModels(
         PublishDocumentRequestModel requestModel)
     {

src/Umbraco.Cms.Api.Management/Factories/IDocumentUrlFactory.cs

@@ -8,6 +8,4 @@ public interface IDocumentUrlFactory
     Task<IEnumerable<DocumentUrlInfo>> CreateUrlsAsync(IContent content);
 
     Task<IEnumerable<DocumentUrlInfoResponseModel>> CreateUrlSetsAsync(IEnumerable<IContent> contentItems);
-
-    Task<DocumentUrlInfo?> GetPreviewUrlAsync(IContent content, string providerAlias, string? culture, string? segment);
 }

src/Umbraco.Cms.Api.Management/Factories/IHealthCheckGroupPresentationFactory.cs

@@ -7,8 +7,19 @@ public interface IHealthCheckGroupPresentationFactory
 {
     IEnumerable<IGrouping<string?, HealthCheck>> CreateGroupingFromHealthCheckCollection();
 
-    Task<HealthCheckGroupWithResultResponseModel> CreateHealthCheckGroupWithResultViewModelAsync(
-        IGrouping<string?, HealthCheck> healthCheckGroup);
+    [Obsolete("Use CreateHealthCheckGroupWithResultViewModelAsync instead. Will be removed in v17.")]
+    HealthCheckGroupWithResultResponseModel CreateHealthCheckGroupWithResultViewModel(IGrouping<string?, HealthCheck> healthCheckGroup);
 
-    Task<HealthCheckWithResultPresentationModel> CreateHealthCheckWithResultViewModelAsync(HealthCheck healthCheck);
+    [Obsolete("Use CreateHealthCheckGroupWithResultViewModelAsync instead. Will be removed in v17.")]
+    HealthCheckWithResultPresentationModel CreateHealthCheckWithResultViewModel(HealthCheck healthCheck);
+
+    Task<HealthCheckGroupWithResultResponseModel> CreateHealthCheckGroupWithResultViewModelAsync(IGrouping<string?, HealthCheck> healthCheckGroup)
+#pragma warning disable CS0618 // Type or member is obsolete
+        => Task.FromResult(CreateHealthCheckGroupWithResultViewModel(healthCheckGroup));
+#pragma warning restore CS0618 // Type or member is obsolete
+
+    Task<HealthCheckWithResultPresentationModel> CreateHealthCheckWithResultViewModelAsync(HealthCheck healthCheck)
+#pragma warning disable CS0618 // Type or member is obsolete
+        => Task.FromResult(CreateHealthCheckWithResultViewModel(healthCheck));
+#pragma warning restore CS0618 // Type or member is obsolete
 }

src/Umbraco.Cms.Api.Management/Factories/IIndexPresentationFactory.cs

@@ -5,8 +5,5 @@ namespace Umbraco.Cms.Api.Management.Factories;
 
 public interface IIndexPresentationFactory
 {
-    [Obsolete("Use CreateAsync() instead. Scheduled for removal in v19.")]
     IndexResponseModel Create(IIndex index);
-
-    Task<IndexResponseModel> CreateAsync(IIndex index) => Task.FromResult(Create(index));
 }

src/Umbraco.Cms.Api.Management/Factories/IndexPresentationFactory.cs

@@ -28,17 +28,21 @@ public class IndexPresentationFactory : IIndexPresentationFactory
         _logger = logger;
     }
 
-    /// <inheritdoc />
-    [Obsolete("Use CreateAsync() instead. Scheduled for removal in v19.")]
-    public IndexResponseModel Create(IIndex index)
-        => CreateAsync(index).GetAwaiter().GetResult();
+    [Obsolete("Use the non obsolete method instead. Scheduled for removal in v17")]
+    public IndexPresentationFactory(IIndexDiagnosticsFactory indexDiagnosticsFactory, IIndexRebuilder indexRebuilder, IIndexingRebuilderService indexingRebuilderService)
+    :this(
+        indexDiagnosticsFactory,
+        indexRebuilder,
+        indexingRebuilderService,
+        StaticServiceProvider.Instance.GetRequiredService<ILogger<IndexPresentationFactory>>())
+    {
+    }
 
-    /// <inheritdoc />
-    public async Task<IndexResponseModel> CreateAsync(IIndex index)
+    public IndexResponseModel Create(IIndex index)
     {
         var isCorrupt = !TryGetSearcherName(index, out var searcherName);
 
-        if (await _indexingRebuilderService.IsRebuildingAsync(index.Name))
+        if (_indexingRebuilderService.IsRebuilding(index.Name))
         {
             return new IndexResponseModel
             {
@@ -59,7 +63,7 @@ public class IndexPresentationFactory : IIndexPresentationFactory
 
         var properties = new Dictionary<string, object?>();
 
-        foreach (KeyValuePair<string, object?> property in indexDiag.Metadata)
+        foreach (var property in indexDiag.Metadata)
         {
             if (property.Value is null)
             {
@@ -67,7 +71,7 @@ public class IndexPresentationFactory : IIndexPresentationFactory
             }
             else
             {
-                Type propertyType = property.Value.GetType();
+                var propertyType = property.Value.GetType();
                 properties[property.Key] = propertyType.IsClass && !propertyType.IsArray ? property.Value?.ToString() : property.Value;
             }
         }

src/Umbraco.Cms.Api.Management/Factories/ModelsBuilderPresentationFactory.cs

@@ -1,29 +1,35 @@
+using System.Text;
 using Microsoft.Extensions.Options;
-using Umbraco.Cms.Api.Management.ViewModels.ModelsBuilderDashboard;
 using Umbraco.Cms.Core;
+using Umbraco.Cms.Core.Configuration;
 using Umbraco.Cms.Core.Configuration.Models;
 using Umbraco.Cms.Infrastructure.ModelsBuilder;
+using Umbraco.Cms.Api.Management.ViewModels.ModelsBuilderDashboard;
+using Umbraco.Extensions;
 
 namespace Umbraco.Cms.Api.Management.Factories;
 
 public class ModelsBuilderPresentationFactory : IModelsBuilderPresentationFactory
 {
+    private ModelsBuilderSettings _modelsBuilderSettings;
     private readonly ModelsGenerationError _mbErrors;
     private readonly OutOfDateModelsStatus _outOfDateModels;
-    private readonly ModelsBuilderSettings _modelsBuilderSettings;
 
     public ModelsBuilderPresentationFactory(IOptionsMonitor<ModelsBuilderSettings> modelsBuilderSettings, ModelsGenerationError mbErrors, OutOfDateModelsStatus outOfDateModels)
     {
         _mbErrors = mbErrors;
         _outOfDateModels = outOfDateModels;
         _modelsBuilderSettings = modelsBuilderSettings.CurrentValue;
+
+        modelsBuilderSettings.OnChange(x => _modelsBuilderSettings = x);
     }
 
+
     public ModelsBuilderResponseModel Create() =>
         new()
         {
             Mode = _modelsBuilderSettings.ModelsMode,
-            CanGenerate = _modelsBuilderSettings.ModelsMode is Constants.ModelsBuilder.ModelsModes.SourceCodeManual or Constants.ModelsBuilder.ModelsModes.SourceCodeAuto,
+            CanGenerate = _modelsBuilderSettings.ModelsMode.SupportsExplicitGeneration(),
             OutOfDateModels = _outOfDateModels.IsOutOfDate,
             LastError = _mbErrors.GetLastError(),
             Version = ApiVersion.Current.Version.ToString(),

src/Umbraco.Cms.Api.Management/Factories/RelationTypePresentationFactory.cs

@@ -18,6 +18,16 @@ public class RelationTypePresentationFactory : IRelationTypePresentationFactory
     private readonly IDocumentPresentationFactory _documentPresentationFactory;
     private readonly IScopeProvider _scopeProvider;
 
+    [Obsolete("Please use the non obsoleted constructor. Scheduled for removal in v17")]
+    public RelationTypePresentationFactory(IUmbracoMapper umbracoMapper)
+        : this(
+            umbracoMapper,
+            StaticServiceProvider.Instance.GetRequiredService<IEntityRepository>(),
+            StaticServiceProvider.Instance.GetRequiredService<IDocumentPresentationFactory>(),
+            StaticServiceProvider.Instance.GetRequiredService<IScopeProvider>())
+    {
+    }
+
     public RelationTypePresentationFactory(
         IUmbracoMapper umbracoMapper,
         IEntityRepository entityRepository,

src/Umbraco.Cms.Api.Management/Factories/UserPresentationFactory.cs

@@ -43,6 +43,39 @@ public class UserPresentationFactory : IUserPresentationFactory
     /// <summary>
     /// Initializes a new instance of the <see cref="UserPresentationFactory"/> class.
     /// </summary>
+    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 17.")]
+    public UserPresentationFactory(
+        IEntityService entityService,
+        AppCaches appCaches,
+        MediaFileManager mediaFileManager,
+        IImageUrlGenerator imageUrlGenerator,
+        IUserGroupPresentationFactory userGroupPresentationFactory,
+        IAbsoluteUrlBuilder absoluteUrlBuilder,
+        IEmailSender emailSender,
+        IPasswordConfigurationPresentationFactory passwordConfigurationPresentationFactory,
+        IOptionsSnapshot<SecuritySettings> securitySettings,
+        IBackOfficeExternalLoginProviders externalLoginProviders)
+        : this(
+            entityService,
+            appCaches,
+            mediaFileManager,
+            imageUrlGenerator,
+            userGroupPresentationFactory,
+            absoluteUrlBuilder,
+            emailSender,
+            passwordConfigurationPresentationFactory,
+            securitySettings,
+            externalLoginProviders,
+            StaticServiceProvider.Instance.GetRequiredService<IUserService>(),
+            StaticServiceProvider.Instance.GetRequiredService<IContentService>(),
+            StaticServiceProvider.Instance.GetRequiredService<IEnumerable<IPermissionPresentationMapper>>())
+    {
+    }
+
+    /// <summary>
+    /// Initializes a new instance of the <see cref="UserPresentationFactory"/> class.
+    /// </summary>
+    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 17.")]
     public UserPresentationFactory(
         IEntityService entityService,
         AppCaches appCaches,
@@ -54,6 +87,45 @@ public class UserPresentationFactory : IUserPresentationFactory
         IPasswordConfigurationPresentationFactory passwordConfigurationPresentationFactory,
         IOptionsSnapshot<SecuritySettings> securitySettings,
         IBackOfficeExternalLoginProviders externalLoginProviders,
+        IUserService userService,
+        IContentService contentService)
+        : this(
+            entityService,
+            appCaches,
+            mediaFileManager,
+            imageUrlGenerator,
+            userGroupPresentationFactory,
+            absoluteUrlBuilder,
+            emailSender,
+            passwordConfigurationPresentationFactory,
+            securitySettings,
+            externalLoginProviders,
+            userService,
+            contentService,
+            StaticServiceProvider.Instance.GetRequiredService<IEnumerable<IPermissionPresentationMapper>>())
+    {
+    }
+
+    // TODO (V17): Remove the unused userService and contentService parameters from this constructor.
+
+    /// <summary>
+    /// Initializes a new instance of the <see cref="UserPresentationFactory"/> class.
+    /// </summary>
+    public UserPresentationFactory(
+        IEntityService entityService,
+        AppCaches appCaches,
+        MediaFileManager mediaFileManager,
+        IImageUrlGenerator imageUrlGenerator,
+        IUserGroupPresentationFactory userGroupPresentationFactory,
+        IAbsoluteUrlBuilder absoluteUrlBuilder,
+        IEmailSender emailSender,
+        IPasswordConfigurationPresentationFactory passwordConfigurationPresentationFactory,
+        IOptionsSnapshot<SecuritySettings> securitySettings,
+        IBackOfficeExternalLoginProviders externalLoginProviders,
+#pragma warning disable IDE0060 // Remove unused parameter - need to keep these until the next major to avoid breaking changes and/or ambiguous constructor errors
+        IUserService userService,
+        IContentService contentService,
+#pragma warning restore IDE0060 // Remove unused parameter
         IEnumerable<IPermissionPresentationMapper> permissionPresentationMappers)
     {
         _entityService = entityService;

src/Umbraco.Cms.Api.Management/Install/CreateUnattendedUserNotificationHandler.cs

@@ -12,31 +12,27 @@ using Umbraco.Extensions;
 
 namespace Umbraco.Cms.Api.Management.Install;
 
-public class PostUnattendedInstallNotificationHandler : INotificationAsyncHandler<UnattendedInstallNotification>
+public class CreateUnattendedUserNotificationHandler : INotificationAsyncHandler<UnattendedInstallNotification>
 {
     private readonly IServiceScopeFactory _serviceScopeFactory;
     private readonly IOptions<UnattendedSettings> _unattendedSettings;
     private readonly IUserService _userService;
-    private readonly IMetricsConsentService _metricsConsentService;
 
-    public PostUnattendedInstallNotificationHandler(IOptions<UnattendedSettings> unattendedSettings, IUserService userService, IServiceScopeFactory serviceScopeFactory, IMetricsConsentService metricsConsentService)
+    public CreateUnattendedUserNotificationHandler(IOptions<UnattendedSettings> unattendedSettings, IUserService userService, IServiceScopeFactory serviceScopeFactory)
     {
         _unattendedSettings = unattendedSettings;
         _userService = userService;
         _serviceScopeFactory = serviceScopeFactory;
-        _metricsConsentService = metricsConsentService;
     }
 
     /// <summary>
-    ///     Listening for when the UnattendedInstallNotification fired after a successful unattended install
-    ///     This creates the user and sets the telemetry level based on the 'Unattended' settings.
+    ///     Listening for when the UnattendedInstallNotification fired after a sucessfulk
     /// </summary>
     /// <param name="notification"></param>
     /// <param name="cancellationToken"></param>
     public async Task HandleAsync(UnattendedInstallNotification notification, CancellationToken cancellationToken)
     {
         UnattendedSettings? unattendedSettings = _unattendedSettings.Value;
-
         // Ensure we have the setting enabled (Sanity check)
         // In theory this should always be true as the event only fired when a sucessfull
         if (_unattendedSettings.Value.InstallUnattended == false)
@@ -87,7 +83,7 @@ public class PostUnattendedInstallNotificationHandler : INotificationAsyncHandle
                 $"No user found in membership provider with id of {Constants.Security.SuperUserIdAsString}.");
         }
 
-        // To change the password here we actually need to reset it since we don't have an old one to use to change
+        //To change the password here we actually need to reset it since we don't have an old one to use to change
         var resetToken = await backOfficeUserManager.GeneratePasswordResetTokenAsync(membershipUser);
         if (string.IsNullOrWhiteSpace(resetToken))
         {
@@ -102,7 +98,5 @@ public class PostUnattendedInstallNotificationHandler : INotificationAsyncHandle
             throw new InvalidOperationException("Could not reset password: " +
                                                 string.Join(", ", resetResult.Errors.ToErrorMessage()));
         }
-
-        await _metricsConsentService.SetConsentLevelAsync(unattendedSettings.UnattendedTelemetryLevel);
     }
 }

src/Umbraco.Cms.Api.Management/Mapping/Permissions/DocumentPermissionMapper.cs

@@ -22,6 +22,17 @@ public class DocumentPermissionMapper : IPermissionPresentationMapper, IPermissi
     private readonly Lazy<IEntityService> _entityService;
     private readonly Lazy<IUserService> _userService;
 
+    /// <summary>
+    /// Initializes a new instance of the <see cref="DocumentPermissionMapper"/> class.
+    /// </summary>
+    [Obsolete("Please use the constructor taking all parameters. Scheduled for removal in Umbraco 17.")]
+    public DocumentPermissionMapper()
+        : this(
+              StaticServiceProvider.Instance.GetRequiredService<Lazy<IEntityService>>(),
+              StaticServiceProvider.Instance.GetRequiredService<Lazy<IUserService>>())
+    {
+    }
+
     /// <summary>
     /// Initializes a new instance of the <see cref="DocumentPermissionMapper"/> class.
     /// </summary>

src/Umbraco.Cms.Api.Management/Middleware/BackOfficeAuthorizationInitializationMiddleware.cs

@@ -21,6 +21,18 @@ public class BackOfficeAuthorizationInitializationMiddleware : IMiddleware
     private readonly IRuntimeState _runtimeState;
     private readonly WebRoutingSettings _webRoutingSettings;
 
+    [Obsolete("Use the non-obsolete constructor. This will be removed in Umbraco 17.")]
+    public BackOfficeAuthorizationInitializationMiddleware(
+        UmbracoRequestPaths umbracoRequestPaths,
+        IServiceProvider serviceProvider,
+        IRuntimeState runtimeState,
+        IOptions<GlobalSettings> globalSettings,
+        IOptions<WebRoutingSettings> webRoutingSettings,
+        IHostingEnvironment hostingEnvironment)
+        : this(umbracoRequestPaths, serviceProvider, runtimeState, webRoutingSettings)
+    {
+    }
+
     public BackOfficeAuthorizationInitializationMiddleware(
         UmbracoRequestPaths umbracoRequestPaths,
         IServiceProvider serviceProvider,

src/Umbraco.Cms.Api.Management/OpenApi/BackOfficeSecurityRequirementsOperationFilterBase.cs

@@ -1,6 +1,6 @@
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Http;
-using Microsoft.OpenApi;
+using Microsoft.OpenApi.Models;
 using Swashbuckle.AspNetCore.SwaggerGen;
 using Umbraco.Cms.Api.Management.DependencyInjection;
 using Umbraco.Extensions;
@@ -21,17 +21,27 @@ public abstract class BackOfficeSecurityRequirementsOperationFilterBase : IOpera
         if (!context.MethodInfo.GetCustomAttributes(true).Any(x => x is AllowAnonymousAttribute) &&
             !(context.MethodInfo.DeclaringType?.GetCustomAttributes(true).Any(x => x is AllowAnonymousAttribute) ?? false))
         {
-            operation.Responses ??= new OpenApiResponses();
-            operation.Responses.Add(
-                StatusCodes.Status401Unauthorized.ToString(),
-                new OpenApiResponse
-                {
-                    Description = "The resource is protected and requires an authentication token",
-                });
+            operation.Responses.Add(StatusCodes.Status401Unauthorized.ToString(), new OpenApiResponse
+            {
+                Description = "The resource is protected and requires an authentication token"
+            });
 
-            var schemaRef = new OpenApiSecuritySchemeReference(ManagementApiConfiguration.ApiSecurityName, context.Document);
-            operation.Security ??= new List<OpenApiSecurityRequirement>();
-            operation.Security.Add(new OpenApiSecurityRequirement { [schemaRef] = [] });
+            operation.Security = new List<OpenApiSecurityRequirement>
+            {
+                new OpenApiSecurityRequirement
+                {
+                    {
+                        new OpenApiSecurityScheme
+                        {
+                            Reference = new OpenApiReference
+                            {
+                                Type = ReferenceType.SecurityScheme,
+                                Id = ManagementApiConfiguration.ApiSecurityName
+                            }
+                        }, []
+                    }
+                }
+            };
         }
 
         // Assuming if and endpoint have more then one AuthorizeAttribute, there is a risk the user do not have access while still being authorized.
@@ -47,13 +57,10 @@ public abstract class BackOfficeSecurityRequirementsOperationFilterBase : IOpera
 
         if (numberOfAuthorizeAttributes > 2 || hasConstructorInjectingIAuthorizationService)
         {
-            operation.Responses ??= new OpenApiResponses();
-            operation.Responses.Add(
-                StatusCodes.Status403Forbidden.ToString(),
-                new OpenApiResponse
-                {
-                    Description = "The authenticated user does not have access to this resource",
-                });
+            operation.Responses.Add(StatusCodes.Status403Forbidden.ToString(), new OpenApiResponse()
+            {
+                Description = "The authenticated user does not have access to this resource"
+            });
         }
     }
 }

src/Umbraco.Cms.Api.Management/OpenApi/NotificationHeaderFilter.cs

@@ -1,5 +1,5 @@
 using Microsoft.AspNetCore.Http;
-using Microsoft.OpenApi;
+using Microsoft.OpenApi.Models;
 using Swashbuckle.AspNetCore.SwaggerGen;
 using Umbraco.Cms.Api.Management.ViewModels;
 using Umbraco.Cms.Core;
@@ -24,25 +24,28 @@ internal sealed class NotificationHeaderFilter : IOperationFilter
 
         // filter out irrelevant responses (401 will never produce notifications)
         IEnumerable<OpenApiResponse> relevantResponses = operation
-            .Responses?
+            .Responses
             .Where(pair => pair.Key != StatusCodes.Status401Unauthorized.ToString())
-            .Select(pair => pair.Value)
-            .OfType<OpenApiResponse>()
-            ?? Enumerable.Empty<OpenApiResponse>();
+            .Select(pair => pair.Value);
         foreach (OpenApiResponse response in relevantResponses)
         {
-            response.Headers ??= new Dictionary<string, IOpenApiHeader>();
-            response.Headers.TryAdd(
-                Constants.Headers.Notifications,
-                new OpenApiHeader
+            response.Headers.TryAdd(Constants.Headers.Notifications, new OpenApiHeader
+            {
+                Description = "The list of notifications produced during the request.",
+                Schema = new OpenApiSchema
                 {
-                    Description = "The list of notifications produced during the request.",
-                    Schema = new OpenApiSchema
+                    Type = "array",
+                    Nullable = true,
+                    Items = new OpenApiSchema()
                     {
-                        Type = JsonSchemaType.Array | JsonSchemaType.Null,
-                        Items = new OpenApiSchemaReference(notificationModelType.Name),
-                    },
-                });
+                        Reference = new OpenApiReference()
+                        {
+                            Type = ReferenceType.Schema,
+                            Id = notificationModelType.Name
+                        },
+                    }
+                }
+            });
         }
     }
 }