Updated version and assets for release v24.10

Revert "Update german translation"

.env.example

@@ -26,13 +26,6 @@ DB_DATABASE=database_database
 DB_USERNAME=database_username
 DB_PASSWORD=database_user_password
 
-# Storage system to use
-# By default files are stored on the local filesystem, with images being placed in
-# public web space so they can be efficiently served directly by the web-server.
-# For other options with different security levels & considerations, refer to:
-# https://www.bookstackapp.com/docs/admin/upload-config/
-STORAGE_TYPE=local
-
 # Mail system to use
 # Can be 'smtp' or 'sendmail'
 MAIL_DRIVER=smtp

.env.example.complete

@@ -36,14 +36,10 @@ APP_LANG=en
 # APP_LANG will be used if such a header is not provided.
 APP_AUTO_LANG_PUBLIC=true
 
-# Application timezones
-# The first option is used to determine what timezone is used for date storage.
-# Leaving that as "UTC" is advised.
-# The second option is used to set the timezone which will be used for date
-# formatting and display. This defaults to the "APP_TIMEZONE" value.
+# Application timezone
+# Used where dates are displayed such as on exported content.
 # Valid timezone values can be found here: https://www.php.net/manual/en/timezones.php
 APP_TIMEZONE=UTC
-APP_DISPLAY_TIMEZONE=UTC
 
 # Application theme
 # Used to specific a themes/<APP_THEME> folder where BookStack UI
@@ -60,7 +56,6 @@ APP_PROXIES=null
 
 # Database details
 # Host can contain a port (localhost:3306) or a separate DB_PORT option can be used.
-# An ipv6 address can be used via the square bracket format ([::1]).
 DB_HOST=localhost
 DB_PORT=3306
 DB_DATABASE=database_database
@@ -351,25 +346,10 @@ EXPORT_PDF_COMMAND_TIMEOUT=15
 # Only used if 'ALLOW_UNTRUSTED_SERVER_FETCHING=true' which disables security protections.
 WKHTMLTOPDF=false
 
-# Allow JavaScript, and other potentiall dangerous content in page content.
-# This also removes CSP-level JavaScript control.
+# Allow <script> tags in page content
 # Note, if set to 'true' the page editor may still escape scripts.
-# DEPRECATED: Use 'APP_CONTENT_FILTERING' instead as detailed below. Activiting this option
-# effectively sets APP_CONTENT_FILTERING='' (No filtering)
 ALLOW_CONTENT_SCRIPTS=false
 
-# Control the behaviour of content filtering, primarily used for page content.
-# This setting is a string of characters which represent different available filters:
-# - j - Filter out JavaScript and unknown binary data based content
-# - h - Filter out unexpected, and potentially dangerous, HTML elements
-# - f - Filter out unexpected form elements
-# - a - Run content through a more complex allowlist filter
-# This defaults to using all filters, unless ALLOW_CONTENT_SCRIPTS is set to true in which case no filters are used.
-# Note: These filters are a best-attempt and may not be 100% effective. They are typically a layer used in addition to other security measures.
-# Note: The default value will always be the most-strict, so it's advised to leave this unset in your own configuration
-# to ensure you are always using the full range of filters.
-APP_CONTENT_FILTERING="jfha"
-
 # Indicate if robots/crawlers should crawl your instance.
 # Can be 'true', 'false' or 'null'.
 # The behaviour of the default 'null' option will depend on the 'app-public' admin setting.

.github/CODE_OF_CONDUCT.md

@@ -1,2 +1,84 @@
-Please find our community rules on our website here:
-https://www.bookstackapp.com/about/community-rules/
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+In the interest of fostering an open and welcoming environment, we as
+contributors and maintainers pledge to making participation in our project and
+our community a harassment-free experience for everyone, regardless of age, body
+size, disability, ethnicity, gender identity and expression, level of experience,
+education, socio-economic status, nationality, personal appearance, race,
+religion, or sexual identity and orientation.
+
+## Our Standards
+
+Examples of behavior that contributes to creating a positive environment
+include:
+
+* Being respectful of differing viewpoints and experiences
+* Gracefully accepting constructive criticism
+* Focusing on what is best for the community
+* Showing empathy towards other community members
+
+Examples of unacceptable behavior by participants include:
+
+* The use of sexualized language or imagery and unwelcome sexual attention or
+  advances
+* Trolling, insulting/derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or electronic
+  address, without explicit permission
+* Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+### Project Maintainer Standards
+
+Project maintainers should generally follow these additional standards:
+
+* Avoid using a negative or harsh tone in communication, Even if the other party
+is being negative themselves.
+* When providing criticism, try to make it constructive to lead the other person
+down the correct path.
+* Keep the [project definition](https://github.com/BookStackApp/BookStack#project-definition)
+in mind when deciding what's in scope of the Project.
+
+## Our Responsibilities
+
+Project maintainers are responsible for clarifying the standards of acceptable
+behavior and are expected to take appropriate and fair corrective action in
+response to any instances of unacceptable behavior. In addition, Project
+maintainers are responsible for following the standards themselves.
+
+Project maintainers have the right and responsibility to remove, edit, or
+reject comments, commits, code, wiki edits, issues, and other contributions
+that are not aligned to this Code of Conduct, or to ban temporarily or
+permanently any contributor for other behaviors that they deem inappropriate,
+threatening, offensive, or harmful.
+
+## Scope
+
+This Code of Conduct applies both within project spaces and in public spaces
+when an individual is representing the project or its community. Examples of
+representing a project or community include using an official project e-mail
+address, posting via an official social media account, or acting as an appointed
+representative at an online or offline event. Representation of a project may be
+further defined and clarified by project maintainers.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported by contacting the project team at the email address shown on [the profile here](https://github.com/ssddanbrown). All
+complaints will be reviewed and investigated and will result in a response that
+is deemed necessary and appropriate to the circumstances. The project team is
+obligated to maintain confidentiality with regard to the reporter of an incident.
+Further details of specific enforcement policies may be posted separately.
+
+Project maintainers who do not follow or enforce the Code of Conduct in good
+faith may face temporary or permanent repercussions as determined by other
+members of the project's leadership.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4,
+available at https://www.contributor-covenant.org/version/1/4/code-of-conduct.html
+
+[homepage]: https://www.contributor-covenant.org

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -56,13 +56,3 @@ body:
       description: Add any other context or screenshots about the feature request here.
     validations:
       required: false
-  - type: checkboxes
-    id: ai-thoughts
-    attributes:
-      label: Have you used generative AI/LLMs to create any thoughts in this request?
-      description: |
-        We ask that no machine generated thoughts or ideas are provided, to avoid us spending time considering the ideas
-        of a machine instead of a human. Further guidance on this can be found [in the BookStack community rules](https://www.bookstackapp.com/about/community-rules/#use-of-llmsai).
-      options:
-        - label: This request only contains the thoughts & ideas of a human
-          required: true

.github/ISSUE_TEMPLATE/support_request.yml

@@ -42,7 +42,6 @@ body:
       label: Log Content
       description: If the issue has produced an error, provide any [BookStack or server log](https://www.bookstackapp.com/docs/admin/debugging/) content below.
       placeholder: Be sure to remove any confidential details in your logs
-      render: text
     validations:
       required: false
   - type: textarea

.github/ISSUE_TEMPLATE/z_blank_request.yml

@@ -1,9 +0,0 @@
-name: Blank Request (Maintainers Only)
-description: For maintainers only - Start a blank request
-body:
-  - type: markdown
-    attributes:
-      value: "**This blank request option is only for existing official maintainers of the project!** Please instead use a different request option. If you use this your issue will be closed off."
-  - type: textarea
-    attributes:
-      label: Description

.github/pull_request_template.md

@@ -1,11 +0,0 @@
-## Details
-
-<!-- Write details of your pull request in here -->
-<!-- Include references to any relevant issues/discussions -->
-
-## Checklist
-
-<!-- Put an 'x' in between the brackets below to confirm these elements -->
-
-- [ ] I have read the [BookStack community rules](https://www.bookstackapp.com/about/community-rules/).
-- [ ] This PR does not feature significant use of LLM/AI generation as per the community rules above.

.github/translators.txt

@@ -177,7 +177,7 @@ Alexander Predl (Harveyhase68) :: German
 Rem (Rem9000) :: Dutch
 Michał Stelmach (stelmach-web) :: Polish
 arniom :: French
-REMOVED_USER :: French; German; Dutch; Portuguese, Brazilian; Portuguese; Turkish; 
+REMOVED_USER :: French; Dutch; Portuguese, Brazilian; Portuguese; Turkish; 
 林祖年 (contagion) :: Chinese Traditional
 Siamak Guodarzi (siamakgoudarzi88) :: Persian
 Lis Maestrelo (lismtrl) :: Portuguese, Brazilian
@@ -222,7 +222,7 @@ SmokingCrop :: Dutch
 Maciej Lebiest (Szwendacz) :: Polish
 DiscordDigital :: German; German Informal
 Gábor Marton (dodver) :: Hungarian
-Jakob Åsell (Jasell) :: Swedish
+Jasell :: Swedish
 Ghost_chu (ghostchu) :: Chinese Simplified
 Ravid Shachar (ravidshachar) :: Hebrew
 Helga Guchshenskaya (guchshenskaya) :: Russian
@@ -438,102 +438,14 @@ javadataherian :: Persian
 Ludo-code :: French
 hollsten :: Swedish
 Ngoc Lan Phung (lanpncz) :: Vietnamese
-Worive :: Catalan; French
+Worive :: Catalan
 Илья Скаба (skabailya) :: Russian
 Irjan Olsen (Irch) :: Norwegian Bokmal
 Aleksandar Jovanovic (jovanoviczaleksandar) :: Serbian (Cyrillic)
 Red (RedVortex) :: Hebrew
 xgrug :: Chinese Simplified
-Calle Calmar (HrCalmar) :: Danish
+HrCalmar :: Danish
 Avishay Rapp (AvishayRapp) :: Hebrew
 matthias4217 :: French
 Berke BOYLU2 (berkeboylu2) :: Turkish
 etwas7B :: German
-Mohammed srhiri (m.sghiri20) :: Arabic
-YongMin Kim (kym0118) :: Korean
-Rivo Zängov (Eraser) :: Estonian
-Francisco Rafael Fonseca (chicoraf) :: Portuguese, Brazilian
-ИEØ_ΙΙØZ (NEO_IIOZ) :: Chinese Traditional
-madnjpn (madnjpn.) :: Georgian
-Ásgeir Shiny Ásgeirsson (AsgeirShiny) :: Icelandic
-Mohammad Aftab Uddin (chirohorit) :: Bengali
-Yannis Karlaftis (meliseus) :: Greek
-felixxx :: German Informal
-randi (randi65535) :: Korean
-test65428 :: Greek
-zeronell :: Chinese Simplified
-julien Vinber (julienVinber) :: French
-Hyunwoo Park (oksure) :: Korean
-aram.rafeq.7 (aramrafeq2) :: Kurdish
-Raphael Moreno (RaphaelMoreno) :: Portuguese, Brazilian
-yn (user99) :: Arabic
-Pavel Zlatarov (pzlatarov) :: Bulgarian
-ingelres :: French
-mabdullah :: Arabic
-Skrabák Csaba (kekcsi) :: Hungarian
-Evert Meulie (Evert) :: Norwegian Bokmal
-Jasper Backer (jasperb) :: Dutch
-Alexandar Cavdarovski (ace.200112) :: Swedish
-구닥다리TV (yjj8353) :: Korean
-Onur Oskay (o.oskay) :: Turkish
-Sébastien Merveille (SebastienMerv) :: French
-Maxim Kouznetsov (masya.work) :: Hebrew
-neodvisnost :: Slovenian
-Soubi Agatsuma (bisouya) :: Hebrew
-Ilya Shaulov (ishaulov) :: Russian
-Konstantin Bobkov (b.konstantv) :: Russian
-Ruben Sutter (rubensutter) :: German
-jellium :: French
-Qxlkdr :: Swedish
-Hari (muhhari) :: Indonesian
-仙君御 (xjy) :: Chinese Simplified
-TapioM :: Finnish
-lingb58 :: Chinese Traditional
-Angel Pandey (angel-pandey) :: Nepali
-Supriya Shrestha (supriyashrestha) :: Nepali
-gprabhat :: Nepali
-CellCat :: Chinese Simplified
-Al Desrahim (aldesrahim) :: Indonesian
-ahmad abbaspour (deshneh.dar.diss) :: Persian
-Erjon K. (ekr) :: Albanian
-LiZerui (iamzrli) :: Chinese Traditional
-Ticker (ticker.com) :: Hebrew
-CrazyComputer :: Chinese Simplified
-Firr (FirrV) :: Russian
-João Faro (FaroJoaoFaro) :: Portuguese
-Danilo dos Santos Barbosa (bozochegou) :: Portuguese, Brazilian
-Chris (furesoft) :: German
-Silvia Isern (eiendragon) :: Catalan
-Dennis Kron Pedersen (ahjdp) :: Danish
-iamwhoiamwhoami :: Swedish
-Grogui :: French
-MrCharlesIII :: Arabic
-David Olsen (dawin) :: Danish
-ltnzr :: French
-Frank Holler (holler.frank) :: German; German Informal
-Korab Arifi (korabidev) :: Albanian
-Petr Husák (petrhusak) :: Czech
-Bernardo Maia (bernardo.bmaia2) :: Portuguese, Brazilian
-Amr (amr3k) :: Arabic
-Tahsin Ahmed (tahsinahmed2012) :: Bengali
-bojan_che :: Serbian (Cyrillic)
-setiawan setiawan (culture.setiawan) :: Indonesian
-Donald Mac Kenzie (kiuman) :: Norwegian Bokmal
-Gabriel Silver (GabrielBSilver) :: Hebrew
-Tomas Darius Davainis (Tomasdd) :: Lithuanian
-CriedHero :: Chinese Simplified
-Henrik (henrik2105) :: Norwegian Bokmal
-FoW (fofwisdom) :: Korean
-serinf-lauza :: French
-Diyan Nikolaev (nikolaev.diyan) :: Bulgarian
-Shadluk Avan (quldosh) :: Uzbek
-Marci (MartonPoto) :: Hungarian
-Michał Sadurski (wheeskeey) :: Polish
-JanDziaslo :: Polish
-Charllys Fernandes (CharllysFernandes) :: Portuguese, Brazilian
-Ilgiz Zigangirov (inov8) :: Russian
-Max Israelsson (Blezie) :: Swedish
-Skiddybison5924 (chris-devel0per) :: German
-Veyilla Nightwhisper (Veyilla) :: German
-João Barbosa (hypeedd) :: Portuguese
-Abcdefg Hijklmn (collatek) :: Korean

.github/workflows/analyse-php.yml

@@ -11,9 +11,9 @@ on:
 jobs:
   build:
     if: ${{ github.ref != 'refs/heads/l10n_development' }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-22.04
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v1
 
     - name: Setup PHP
       uses: shivammathur/setup-php@v2

.github/workflows/lint-php.yml

@@ -11,14 +11,14 @@ on:
 jobs:
   build:
     if: ${{ github.ref != 'refs/heads/l10n_development' }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-22.04
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v1
 
     - name: Setup PHP
       uses: shivammathur/setup-php@v2
       with:
-        php-version: 8.3
+        php-version: 8.1
         tools: phpcs
 
     - name: Run formatting check

.github/workflows/test-js.yml

@@ -17,7 +17,7 @@ jobs:
     if: ${{ github.ref != 'refs/heads/l10n_development' }}
     runs-on: ubuntu-24.04
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v4
 
     - name: Install NPM deps
       run: npm ci

.github/workflows/test-migrations.yml

@@ -13,12 +13,12 @@ on:
 jobs:
   build:
     if: ${{ github.ref != 'refs/heads/l10n_development' }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-22.04
     strategy:
       matrix:
-        php: ['8.2', '8.3', '8.4', '8.5']
+        php: ['8.1', '8.2', '8.3']
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v1
 
       - name: Setup PHP
         uses: shivammathur/setup-php@v2

.github/workflows/test-php.yml

@@ -13,12 +13,12 @@ on:
 jobs:
   build:
     if: ${{ github.ref != 'refs/heads/l10n_development' }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-22.04
     strategy:
       matrix:
-        php: ['8.2', '8.3', '8.4', '8.5']
+        php: ['8.1', '8.2', '8.3']
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v1
 
     - name: Setup PHP
       uses: shivammathur/setup-php@v2

.gitignore

@@ -2,17 +2,16 @@
 /node_modules
 /.vscode
 /composer
-/composer.phar
 /coverage
 Homestead.yaml
 .env
 .idea
 npm-debug.log
 yarn-error.log
-/public/dist
+/public/dist/*.map
 /public/plugins
-/public/css
-/public/js
+/public/css/*.map
+/public/js/*.map
 /public/bower
 /public/build/
 /public/favicon.ico
@@ -33,4 +32,3 @@ webpack-stats.json
 phpstan.neon
 esbuild-meta.json
 .phpactor.json
-/*.zip

LICENSE

@@ -1,6 +1,6 @@
 The MIT License (MIT)
 
-Copyright (c) 2015-2026, Dan Brown and the BookStack project contributors.
+Copyright (c) 2015-2024, Dan Brown and the BookStack Project contributors.
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

app/Access/Controllers/ForgotPasswordController.php

@@ -45,11 +45,11 @@ class ForgotPasswordController extends Controller
         );
 
         if ($response === Password::RESET_LINK_SENT) {
-            $this->logActivity(ActivityType::AUTH_PASSWORD_RESET, $request->input('email'));
+            $this->logActivity(ActivityType::AUTH_PASSWORD_RESET, $request->get('email'));
         }
 
         if (in_array($response, [Password::RESET_LINK_SENT, Password::INVALID_USER, Password::RESET_THROTTLED])) {
-            $message = trans('auth.reset_password_sent', ['email' => $request->input('email')]);
+            $message = trans('auth.reset_password_sent', ['email' => $request->get('email')]);
             $this->showSuccessNotification($message);
 
             return redirect('/password/email')->with('status', trans($response));

app/Access/Controllers/LoginController.php

@@ -32,12 +32,12 @@ class LoginController extends Controller
     {
         $socialDrivers = $this->socialDriverManager->getActive();
         $authMethod = config('auth.method');
-        $preventInitiation = $request->input('prevent_auto_init') === 'true';
+        $preventInitiation = $request->get('prevent_auto_init') === 'true';
 
         if ($request->has('email')) {
             session()->flashInput([
-                'email'    => $request->input('email'),
-                'password' => (config('app.env') === 'demo') ? $request->input('password', '') : '',
+                'email'    => $request->get('email'),
+                'password' => (config('app.env') === 'demo') ? $request->get('password', '') : '',
             ]);
         }
 
@@ -62,7 +62,7 @@ class LoginController extends Controller
     public function login(Request $request)
     {
         $this->validateLogin($request);
-        $username = $request->input($this->username());
+        $username = $request->get($this->username());
 
         // Check login throttling attempts to see if they've gone over the limit
         if ($this->hasTooManyLoginAttempts($request)) {

app/Access/Controllers/MfaBackupCodesController.php

@@ -84,7 +84,7 @@ class MfaBackupCodesController extends Controller
             ],
         ]);
 
-        $updatedCodes = $codeService->removeInputCodeFromSet($request->input('code'), $codes);
+        $updatedCodes = $codeService->removeInputCodeFromSet($request->get('code'), $codes);
         MfaValue::upsertWithValue($user, MfaValue::METHOD_BACKUP_CODES, $updatedCodes);
 
         $mfaSession->markVerifiedForUser($user);

app/Access/Controllers/MfaController.php

@@ -51,14 +51,14 @@ class MfaController extends Controller
      */
     public function verify(Request $request)
     {
-        $desiredMethod = $request->input('method');
+        $desiredMethod = $request->get('method');
         $userMethods = $this->currentOrLastAttemptedUser()
             ->mfaValues()
             ->get(['id', 'method'])
             ->groupBy('method');
 
         // Basic search for the default option for a user.
-        // (Prioritises TOTP over backup codes)
+        // (Prioritises totp over backup codes)
         $method = $userMethods->has($desiredMethod) ? $desiredMethod : $userMethods->keys()->sort()->reverse()->first();
         $otherMethods = $userMethods->keys()->filter(function ($userMethod) use ($method) {
             return $method !== $userMethod;

app/Access/Controllers/OidcController.php

@@ -9,9 +9,11 @@ use Illuminate\Http\Request;
 
 class OidcController extends Controller
 {
-    public function __construct(
-        protected OidcService $oidcService
-    ) {
+    protected OidcService $oidcService;
+
+    public function __construct(OidcService $oidcService)
+    {
+        $this->oidcService = $oidcService;
         $this->middleware('guard:oidc');
     }
 
@@ -28,7 +30,7 @@ class OidcController extends Controller
             return redirect('/login');
         }
 
-        session()->put('oidc_state', time() . ':' . $loginDetails['state']);
+        session()->flash('oidc_state', $loginDetails['state']);
 
         return redirect($loginDetails['url']);
     }
@@ -39,23 +41,16 @@ class OidcController extends Controller
      */
     public function callback(Request $request)
     {
+        $storedState = session()->pull('oidc_state');
         $responseState = $request->query('state');
-        $splitState =  explode(':', session()->pull('oidc_state', ':'), 2);
-        if (count($splitState) !== 2) {
-            $splitState = [null, null];
-        }
 
-        [$storedStateTime, $storedState] = $splitState;
-        $threeMinutesAgo = time() - 3 * 60;
-
-        if (!$storedState || $storedState !== $responseState || intval($storedStateTime) < $threeMinutesAgo) {
+        if ($storedState !== $responseState) {
             $this->showErrorNotification(trans('errors.oidc_fail_authed', ['system' => config('oidc.name')]));
 
             return redirect('/login');
         }
 
         try {
-            $this->throwIfAuthorizationError($request);
             $this->oidcService->processAuthorizeResponse($request->query('code'));
         } catch (OidcException $oidcException) {
             $this->showErrorNotification($oidcException->getMessage());
@@ -67,29 +62,10 @@ class OidcController extends Controller
     }
 
     /**
-     * Log the user out, then start the OIDC RP-initiated logout process.
+     * Log the user out then start the OIDC RP-initiated logout process.
      */
     public function logout()
     {
         return redirect($this->oidcService->logout());
     }
-
-    /**
-     *
-     * @throws OidcException
-     */
-    private function throwIfAuthorizationError(Request $request): void
-    {
-        $errorCode = $request->query('error');
-        if (!$errorCode) {
-            return;
-        }
-
-        $errorDescription = $request->query('error_description');
-        if ($errorDescription) {
-            throw new OidcException($errorDescription);
-        }
-
-        throw new OidcException(trans('errors.oidc_fail_authed', ['system' => config('oidc.name')]));
-    }
 }

app/Access/Controllers/RegisterController.php

@@ -48,7 +48,8 @@ class RegisterController extends Controller
     public function postRegister(Request $request)
     {
         $this->registrationService->ensureRegistrationAllowed();
-        $userData = $this->validator($request->all())->validate();
+        $this->validator($request->all())->validate();
+        $userData = $request->all();
 
         try {
             $user = $this->registrationService->registerUser($userData);

app/Access/Controllers/ResetPasswordController.php

@@ -48,7 +48,7 @@ class ResetPasswordController extends Controller
 
         // Here we will attempt to reset the user's password. If it is successful we
         // will update the password on an actual user model and persist it to the
-        // database. Otherwise, we will parse the error and return the response.
+        // database. Otherwise we will parse the error and return the response.
         $credentials = $request->only('email', 'password', 'password_confirmation', 'token');
         $response = Password::broker()->reset($credentials, function (User $user, string $password) {
             $user->password = Hash::make($password);
@@ -63,7 +63,7 @@ class ResetPasswordController extends Controller
         // redirect them back to where they came from with their error message.
         return $response === Password::PASSWORD_RESET
             ? $this->sendResetResponse()
-            : $this->sendResetFailedResponse($request, $response, $request->input('token'));
+            : $this->sendResetFailedResponse($request, $response, $request->get('token'));
     }
 
     /**

app/Access/Controllers/Saml2Controller.php

@@ -78,7 +78,7 @@ class Saml2Controller extends Controller
      */
     public function startAcs(Request $request)
     {
-        $samlResponse = $request->input('SAMLResponse', null);
+        $samlResponse = $request->get('SAMLResponse', null);
 
         if (empty($samlResponse)) {
             $this->showErrorNotification(trans('errors.saml_fail_authed', ['system' => config('saml2.name')]));
@@ -100,7 +100,7 @@ class Saml2Controller extends Controller
      */
     public function processAcs(Request $request)
     {
-        $acsId = $request->input('id', null);
+        $acsId = $request->get('id', null);
         $cacheKey = 'saml2_acs:' . $acsId;
         $samlResponse = null;
 

app/Access/Controllers/SocialController.php

@@ -67,7 +67,7 @@ class SocialController extends Controller
         if ($request->has('error') && $request->has('error_description')) {
             throw new SocialSignInException(trans('errors.social_login_bad_response', [
                 'socialAccount' => $socialDriver,
-                'error'         => $request->input('error_description'),
+                'error'         => $request->get('error_description'),
             ]), '/login');
         }
 

app/Access/Controllers/UserInviteController.php

@@ -67,7 +67,7 @@ class UserInviteController extends Controller
         }
 
         $user = $this->userRepo->getById($userId);
-        $user->password = Hash::make($request->input('password'));
+        $user->password = Hash::make($request->get('password'));
         $user->email_confirmed = true;
         $user->save();
 

app/Access/EmailConfirmationService.php

@@ -5,7 +5,6 @@ namespace BookStack\Access;
 use BookStack\Access\Notifications\ConfirmEmailNotification;
 use BookStack\Exceptions\ConfirmationEmailException;
 use BookStack\Users\Models\User;
-use Exception;
 
 class EmailConfirmationService extends UserTokenService
 {
@@ -17,7 +16,6 @@ class EmailConfirmationService extends UserTokenService
      * Also removes any existing old ones.
      *
      * @throws ConfirmationEmailException
-     * @throws Exception
      */
     public function sendConfirmation(User $user): void
     {

app/Access/ExternalBaseUserProvider.php

@@ -2,26 +2,60 @@
 
 namespace BookStack\Access;
 
-use BookStack\Users\Models\User;
 use Illuminate\Contracts\Auth\Authenticatable;
 use Illuminate\Contracts\Auth\UserProvider;
+use Illuminate\Database\Eloquent\Model;
 
 class ExternalBaseUserProvider implements UserProvider
 {
     /**
-     * Retrieve a user by their unique identifier.
+     * The user model.
+     *
+     * @var string
      */
-    public function retrieveById(mixed $identifier): ?Authenticatable
+    protected $model;
+
+    /**
+     * LdapUserProvider constructor.
+     */
+    public function __construct(string $model)
     {
-        return User::query()->find($identifier);
+        $this->model = $model;
+    }
+
+    /**
+     * Create a new instance of the model.
+     *
+     * @return Model
+     */
+    public function createModel()
+    {
+        $class = '\\' . ltrim($this->model, '\\');
+
+        return new $class();
+    }
+
+    /**
+     * Retrieve a user by their unique identifier.
+     *
+     * @param mixed $identifier
+     *
+     * @return Authenticatable|null
+     */
+    public function retrieveById($identifier)
+    {
+        return $this->createModel()->newQuery()->find($identifier);
     }
 
     /**
      * Retrieve a user by their unique identifier and "remember me" token.
      *
+     * @param mixed  $identifier
      * @param string $token
+     *
+     * @return Authenticatable|null
      */
-    public function retrieveByToken(mixed $identifier, $token): null
+    public function retrieveByToken($identifier, $token)
     {
         return null;
     }
@@ -41,25 +75,32 @@ class ExternalBaseUserProvider implements UserProvider
 
     /**
      * Retrieve a user by the given credentials.
+     *
+     * @param array $credentials
+     *
+     * @return Authenticatable|null
      */
-    public function retrieveByCredentials(array $credentials): ?Authenticatable
+    public function retrieveByCredentials(array $credentials)
     {
-        return User::query()
+        // Search current user base by looking up a uid
+        $model = $this->createModel();
+
+        return $model->newQuery()
             ->where('external_auth_id', $credentials['external_auth_id'])
             ->first();
     }
 
     /**
      * Validate a user against the given credentials.
+     *
+     * @param Authenticatable $user
+     * @param array           $credentials
+     *
+     * @return bool
      */
-    public function validateCredentials(Authenticatable $user, array $credentials): bool
+    public function validateCredentials(Authenticatable $user, array $credentials)
     {
         // Should be done in the guard.
         return false;
     }
-
-    public function rehashPasswordIfRequired(Authenticatable $user, #[\SensitiveParameter] array $credentials, bool $force = false)
-    {
-        // No action to perform, any passwords are external in the auth system
-    }
 }

app/Access/Guards/AsyncExternalBaseSessionGuard.php

@@ -3,18 +3,23 @@
 namespace BookStack\Access\Guards;
 
 /**
- * External Auth Session Guard.
+ * Saml2 Session Guard.
  *
- * The login process for external auth (SAML2/OIDC) is async in nature, meaning it does not fit very well
- * into the default laravel 'Guard' auth flow. Instead, most of the logic is done via the relevant
- * controller and services. This class provides a safer, thin version of SessionGuard.
+ * The saml2 login process is async in nature meaning it does not fit very well
+ * into the default laravel 'Guard' auth flow. Instead most of the logic is done
+ * via the Saml2 controller & Saml2Service. This class provides a safer, thin
+ * version of SessionGuard.
  */
 class AsyncExternalBaseSessionGuard extends ExternalBaseSessionGuard
 {
     /**
      * Validate a user's credentials.
+     *
+     * @param array $credentials
+     *
+     * @return bool
      */
-    public function validate(array $credentials = []): bool
+    public function validate(array $credentials = [])
     {
         return false;
     }
@@ -22,9 +27,12 @@ class AsyncExternalBaseSessionGuard extends ExternalBaseSessionGuard
     /**
      * Attempt to authenticate a user using the given credentials.
      *
+     * @param array $credentials
      * @param bool  $remember
+     *
+     * @return bool
      */
-    public function attempt(array $credentials = [], $remember = false): bool
+    public function attempt(array $credentials = [], $remember = false)
     {
         return false;
     }

app/Access/Guards/ExternalBaseSessionGuard.php

@@ -4,7 +4,7 @@ namespace BookStack\Access\Guards;
 
 use BookStack\Access\RegistrationService;
 use Illuminate\Auth\GuardHelpers;
-use Illuminate\Contracts\Auth\Authenticatable;
+use Illuminate\Contracts\Auth\Authenticatable as AuthenticatableContract;
 use Illuminate\Contracts\Auth\StatefulGuard;
 use Illuminate\Contracts\Auth\UserProvider;
 use Illuminate\Contracts\Session\Session;
@@ -24,31 +24,43 @@ class ExternalBaseSessionGuard implements StatefulGuard
      * The name of the Guard. Typically "session".
      *
      * Corresponds to guard name in authentication configuration.
+     *
+     * @var string
      */
-    protected readonly string $name;
+    protected $name;
 
     /**
      * The user we last attempted to retrieve.
+     *
+     * @var \Illuminate\Contracts\Auth\Authenticatable
      */
-    protected Authenticatable|null $lastAttempted;
+    protected $lastAttempted;
 
     /**
      * The session used by the guard.
+     *
+     * @var \Illuminate\Contracts\Session\Session
      */
-    protected Session $session;
+    protected $session;
 
     /**
      * Indicates if the logout method has been called.
+     *
+     * @var bool
      */
-    protected bool $loggedOut = false;
+    protected $loggedOut = false;
 
     /**
      * Service to handle common registration actions.
+     *
+     * @var RegistrationService
      */
-    protected RegistrationService $registrationService;
+    protected $registrationService;
 
     /**
      * Create a new authentication guard.
+     *
+     * @return void
      */
     public function __construct(string $name, UserProvider $provider, Session $session, RegistrationService $registrationService)
     {
@@ -60,11 +72,13 @@ class ExternalBaseSessionGuard implements StatefulGuard
 
     /**
      * Get the currently authenticated user.
+     *
+     * @return \Illuminate\Contracts\Auth\Authenticatable|null
      */
-    public function user(): Authenticatable|null
+    public function user()
     {
         if ($this->loggedOut) {
-            return null;
+            return;
         }
 
         // If we've already retrieved the user for the current request we can just
@@ -87,11 +101,13 @@ class ExternalBaseSessionGuard implements StatefulGuard
 
     /**
      * Get the ID for the currently authenticated user.
+     *
+     * @return int|null
      */
-    public function id(): int|null
+    public function id()
     {
         if ($this->loggedOut) {
-            return null;
+            return;
         }
 
         return $this->user()
@@ -101,8 +117,12 @@ class ExternalBaseSessionGuard implements StatefulGuard
 
     /**
      * Log a user into the application without sessions or cookies.
+     *
+     * @param array $credentials
+     *
+     * @return bool
      */
-    public function once(array $credentials = []): bool
+    public function once(array $credentials = [])
     {
         if ($this->validate($credentials)) {
             $this->setUser($this->lastAttempted);
@@ -115,8 +135,12 @@ class ExternalBaseSessionGuard implements StatefulGuard
 
     /**
      * Log the given user ID into the application without sessions or cookies.
+     *
+     * @param mixed $id
+     *
+     * @return \Illuminate\Contracts\Auth\Authenticatable|false
      */
-    public function onceUsingId($id): Authenticatable|false
+    public function onceUsingId($id)
     {
         if (!is_null($user = $this->provider->retrieveById($id))) {
             $this->setUser($user);
@@ -129,26 +153,38 @@ class ExternalBaseSessionGuard implements StatefulGuard
 
     /**
      * Validate a user's credentials.
+     *
+     * @param array $credentials
+     *
+     * @return bool
      */
-    public function validate(array $credentials = []): bool
+    public function validate(array $credentials = [])
     {
         return false;
     }
 
     /**
      * Attempt to authenticate a user using the given credentials.
-     * @param bool $remember
+     *
+     * @param array $credentials
+     * @param bool  $remember
+     *
+     * @return bool
      */
-    public function attempt(array $credentials = [], $remember = false): bool
+    public function attempt(array $credentials = [], $remember = false)
     {
         return false;
     }
 
     /**
      * Log the given user ID into the application.
+     *
+     * @param mixed $id
      * @param bool  $remember
+     *
+     * @return \Illuminate\Contracts\Auth\Authenticatable|false
      */
-    public function loginUsingId(mixed $id, $remember = false): Authenticatable|false
+    public function loginUsingId($id, $remember = false)
     {
         // Always return false as to disable this method,
         // Logins should route through LoginService.
@@ -158,9 +194,12 @@ class ExternalBaseSessionGuard implements StatefulGuard
     /**
      * Log a user into the application.
      *
-     * @param bool $remember
+     * @param \Illuminate\Contracts\Auth\Authenticatable $user
+     * @param bool                                       $remember
+     *
+     * @return void
      */
-    public function login(Authenticatable $user, $remember = false): void
+    public function login(AuthenticatableContract $user, $remember = false)
     {
         $this->updateSession($user->getAuthIdentifier());
 
@@ -169,8 +208,12 @@ class ExternalBaseSessionGuard implements StatefulGuard
 
     /**
      * Update the session with the given ID.
+     *
+     * @param string $id
+     *
+     * @return void
      */
-    protected function updateSession(string|int $id): void
+    protected function updateSession($id)
     {
         $this->session->put($this->getName(), $id);
 
@@ -179,8 +222,10 @@ class ExternalBaseSessionGuard implements StatefulGuard
 
     /**
      * Log the user out of the application.
+     *
+     * @return void
      */
-    public function logout(): void
+    public function logout()
     {
         $this->clearUserDataFromStorage();
 
@@ -194,48 +239,62 @@ class ExternalBaseSessionGuard implements StatefulGuard
 
     /**
      * Remove the user data from the session and cookies.
+     *
+     * @return void
      */
-    protected function clearUserDataFromStorage(): void
+    protected function clearUserDataFromStorage()
     {
         $this->session->remove($this->getName());
     }
 
     /**
      * Get the last user we attempted to authenticate.
+     *
+     * @return \Illuminate\Contracts\Auth\Authenticatable
      */
-    public function getLastAttempted(): Authenticatable
+    public function getLastAttempted()
     {
         return $this->lastAttempted;
     }
 
     /**
      * Get a unique identifier for the auth session value.
+     *
+     * @return string
      */
-    public function getName(): string
+    public function getName()
     {
         return 'login_' . $this->name . '_' . sha1(static::class);
     }
 
     /**
      * Determine if the user was authenticated via "remember me" cookie.
+     *
+     * @return bool
      */
-    public function viaRemember(): bool
+    public function viaRemember()
     {
         return false;
     }
 
     /**
      * Return the currently cached user.
+     *
+     * @return \Illuminate\Contracts\Auth\Authenticatable|null
      */
-    public function getUser(): Authenticatable|null
+    public function getUser()
     {
         return $this->user;
     }
 
     /**
      * Set the current user.
+     *
+     * @param \Illuminate\Contracts\Auth\Authenticatable $user
+     *
+     * @return $this
      */
-    public function setUser(Authenticatable $user): self
+    public function setUser(AuthenticatableContract $user)
     {
         $this->user = $user;
 

app/Access/Guards/LdapSessionGuard.php

@@ -35,9 +35,13 @@ class LdapSessionGuard extends ExternalBaseSessionGuard
     /**
      * Validate a user's credentials.
      *
+     * @param array $credentials
+     *
      * @throws LdapException
+     *
+     * @return bool
      */
-    public function validate(array $credentials = []): bool
+    public function validate(array $credentials = [])
     {
         $userDetails = $this->ldapService->getUserDetails($credentials['username']);
 
@@ -53,13 +57,16 @@ class LdapSessionGuard extends ExternalBaseSessionGuard
     /**
      * Attempt to authenticate a user using the given credentials.
      *
+     * @param array $credentials
      * @param bool  $remember
      *
-     * @throws LdapException
+     * @throws LdapException*@throws \BookStack\Exceptions\JsonDebugException
      * @throws LoginAttemptException
      * @throws JsonDebugException
+     *
+     * @return bool
      */
-    public function attempt(array $credentials = [], $remember = false): bool
+    public function attempt(array $credentials = [], $remember = false)
     {
         $username = $credentials['username'];
         $userDetails = $this->ldapService->getUserDetails($username);

app/Access/Ldap.php

@@ -54,7 +54,7 @@ class Ldap
      *
      * @return \LDAP\Result|array|false
      */
-    public function search($ldapConnection, string $baseDn, string $filter, array $attributes = [])
+    public function search($ldapConnection, string $baseDn, string $filter, array $attributes = null)
     {
         return ldap_search($ldapConnection, $baseDn, $filter, $attributes);
     }
@@ -66,7 +66,7 @@ class Ldap
      *
      * @return \LDAP\Result|array|false
      */
-    public function read($ldapConnection, string $baseDn, string $filter, array $attributes = [])
+    public function read($ldapConnection, string $baseDn, string $filter, array $attributes = null)
     {
         return ldap_read($ldapConnection, $baseDn, $filter, $attributes);
     }
@@ -87,7 +87,7 @@ class Ldap
      *
      * @param resource|\LDAP\Connection   $ldapConnection
      */
-    public function searchAndGetEntries($ldapConnection, string $baseDn, string $filter, array $attributes = []): array|false
+    public function searchAndGetEntries($ldapConnection, string $baseDn, string $filter, array $attributes = null): array|false
     {
         $search = $this->search($ldapConnection, $baseDn, $filter, $attributes);
 
@@ -99,7 +99,7 @@ class Ldap
      *
      * @param resource|\LDAP\Connection $ldapConnection
      */
-    public function bind($ldapConnection, ?string $bindRdn = null, ?string $bindPassword = null): bool
+    public function bind($ldapConnection, string $bindRdn = null, string $bindPassword = null): bool
     {
         return ldap_bind($ldapConnection, $bindRdn, $bindPassword);
     }

app/Access/LdapService.php

@@ -71,26 +71,6 @@ class LdapService
         return $users[0];
     }
 
-    /**
-     * Build the user display name from the (potentially multiple) attributes defined by the configuration.
-     */
-    protected function getUserDisplayName(array $userDetails, array $displayNameAttrs, string $defaultValue): string
-    {
-        $displayNameParts = [];
-        foreach ($displayNameAttrs as $dnAttr) {
-            $dnComponent = $this->getUserResponseProperty($userDetails, $dnAttr, null);
-            if ($dnComponent) {
-                $displayNameParts[] = $dnComponent;
-            }
-        }
-
-        if (empty($displayNameParts)) {
-            return $defaultValue;
-        }
-
-        return implode(' ', $displayNameParts);
-    }
-
     /**
      * Get the details of a user from LDAP using the given username.
      * User found via configurable user filter.
@@ -101,25 +81,21 @@ class LdapService
     {
         $idAttr = $this->config['id_attribute'];
         $emailAttr = $this->config['email_attribute'];
-        $displayNameAttrs = explode('|', $this->config['display_name_attribute']);
+        $displayNameAttr = $this->config['display_name_attribute'];
         $thumbnailAttr = $this->config['thumbnail_attribute'];
 
         $user = $this->getUserWithAttributes($userName, array_filter([
-            'cn', 'dn', $idAttr, $emailAttr, ...$displayNameAttrs, $thumbnailAttr,
+            'cn', 'dn', $idAttr, $emailAttr, $displayNameAttr, $thumbnailAttr,
         ]));
 
         if (is_null($user)) {
             return null;
         }
 
-        $nameDefault = $this->getUserResponseProperty($user, 'cn', null);
-        if (is_null($nameDefault)) {
-            $nameDefault = ldap_explode_dn($user['dn'], 1)[0] ?? $user['dn'];
-        }
-
+        $userCn = $this->getUserResponseProperty($user, 'cn', null);
         $formatted = [
             'uid'   => $this->getUserResponseProperty($user, $idAttr, $user['dn']),
-            'name'  => $this->getUserDisplayName($user, $displayNameAttrs, $nameDefault),
+            'name'  => $this->getUserResponseProperty($user, $displayNameAttr, $userCn),
             'dn'    => $user['dn'],
             'email' => $this->getUserResponseProperty($user, $emailAttr, null),
             'avatar' => $thumbnailAttr ? $this->getUserResponseProperty($user, $thumbnailAttr, null) : null,

app/Access/LoginService.php

@@ -5,11 +5,9 @@ namespace BookStack\Access;
 use BookStack\Access\Mfa\MfaSession;
 use BookStack\Activity\ActivityType;
 use BookStack\Exceptions\LoginAttemptException;
-use BookStack\Exceptions\LoginAttemptInvalidUserException;
 use BookStack\Exceptions\StoppedAuthenticationException;
 use BookStack\Facades\Activity;
 use BookStack\Facades\Theme;
-use BookStack\Permissions\Permission;
 use BookStack\Theming\ThemeEvents;
 use BookStack\Users\Models\User;
 use Exception;
@@ -31,14 +29,10 @@ class LoginService
      * a reason to (MFA or Unconfirmed Email).
      * Returns a boolean to indicate the current login result.
      *
-     * @throws StoppedAuthenticationException|LoginAttemptInvalidUserException
+     * @throws StoppedAuthenticationException
      */
     public function login(User $user, string $method, bool $remember = false): void
     {
-        if ($user->isGuest()) {
-            throw new LoginAttemptInvalidUserException('Login not allowed for guest user');
-        }
-
         if ($this->awaitingEmailConfirmation($user) || $this->needsMfaVerification($user)) {
             $this->setLastLoginAttemptedForUser($user, $method, $remember);
 
@@ -51,7 +45,7 @@ class LoginService
         Theme::dispatch(ThemeEvents::AUTH_LOGIN, $method, $user);
 
         // Authenticate on all session guards if a likely admin
-        if ($user->can(Permission::UsersManage) && $user->can(Permission::UserRolesManage)) {
+        if ($user->can('users-manage') && $user->can('user-roles-manage')) {
             $guards = ['standard', 'ldap', 'saml2', 'oidc'];
             foreach ($guards as $guard) {
                 auth($guard)->login($user);
@@ -64,14 +58,14 @@ class LoginService
      *
      * @throws Exception
      */
-    public function reattemptLoginFor(User $user): void
+    public function reattemptLoginFor(User $user)
     {
         if ($user->id !== ($this->getLastLoginAttemptUser()->id ?? null)) {
             throw new Exception('Login reattempt user does align with current session state');
         }
 
         $lastLoginDetails = $this->getLastLoginAttemptDetails();
-        $this->login($user, $lastLoginDetails['method'], $lastLoginDetails['remember']);
+        $this->login($user, $lastLoginDetails['method'], $lastLoginDetails['remember'] ?? false);
     }
 
     /**
@@ -96,7 +90,7 @@ class LoginService
     {
         $value = session()->get(self::LAST_LOGIN_ATTEMPTED_SESSION_KEY);
         if (!$value) {
-            return ['user_id' => null, 'method' => null, 'remember' => false];
+            return ['user_id' => null, 'method' => null];
         }
 
         [$id, $method, $remember, $time] = explode(':', $value);
@@ -104,18 +98,18 @@ class LoginService
         if ($time < $hourAgo) {
             $this->clearLastLoginAttempted();
 
-            return ['user_id' => null, 'method' => null, 'remember' => false];
+            return ['user_id' => null, 'method' => null];
         }
 
         return ['user_id' => $id, 'method' => $method, 'remember' => boolval($remember)];
     }
 
     /**
-     * Set the last login-attempted user.
+     * Set the last login attempted user.
      * Must be only used when credentials are correct and a login could be
-     * achieved, but a secondary factor has stopped the login.
+     * achieved but a secondary factor has stopped the login.
      */
-    protected function setLastLoginAttemptedForUser(User $user, string $method, bool $remember): void
+    protected function setLastLoginAttemptedForUser(User $user, string $method, bool $remember)
     {
         session()->put(
             self::LAST_LOGIN_ATTEMPTED_SESSION_KEY,
@@ -158,40 +152,16 @@ class LoginService
      */
     public function attempt(array $credentials, string $method, bool $remember = false): bool
     {
-        if ($this->areCredentialsForGuest($credentials)) {
-            return false;
-        }
-
         $result = auth()->attempt($credentials, $remember);
         if ($result) {
             $user = auth()->user();
             auth()->logout();
-            try {
-                $this->login($user, $method, $remember);
-            } catch (LoginAttemptInvalidUserException $e) {
-                // Catch and return false for non-login accounts
-                // so it looks like a normal invalid login.
-                return false;
-            }
+            $this->login($user, $method, $remember);
         }
 
         return $result;
     }
 
-    /**
-     * Check if the given credentials are likely for the system guest account.
-     */
-    protected function areCredentialsForGuest(array $credentials): bool
-    {
-        if (isset($credentials['email'])) {
-            return User::query()->where('email', '=', $credentials['email'])
-                ->where('system_name', '=', 'public')
-                ->exists();
-        }
-
-        return false;
-    }
-
     /**
      * Logs the current user out of the application.
      * Returns an app post-redirect path.

app/Access/Mfa/MfaSession.php

@@ -11,6 +11,7 @@ class MfaSession
      */
     public function isRequiredForUser(User $user): bool
     {
+        // TODO - Test both these cases
         return $user->mfaValues()->exists() || $this->userRoleEnforcesMfa($user);
     }
 

app/Access/Mfa/MfaValue.php

@@ -4,7 +4,6 @@ namespace BookStack\Access\Mfa;
 
 use BookStack\Users\Models\User;
 use Carbon\Carbon;
-use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\Model;
 
 /**
@@ -17,8 +16,6 @@ use Illuminate\Database\Eloquent\Model;
  */
 class MfaValue extends Model
 {
-    use HasFactory;
-
     protected static $unguarded = true;
 
     const METHOD_TOTP = 'totp';
@@ -48,16 +45,17 @@ class MfaValue extends Model
     }
 
     /**
-     * Get the decrypted MFA value for the given user and method.
+     * Easily get the decrypted MFA value for the given user and method.
      */
     public static function getValueForUser(User $user, string $method): ?string
     {
+        /** @var MfaValue $mfaVal */
         $mfaVal = static::query()
             ->where('user_id', '=', $user->id)
             ->where('method', '=', $method)
             ->first();
 
-        return $mfaVal?->getValue();
+        return $mfaVal ? $mfaVal->getValue() : null;
     }
 
     /**

app/Access/Mfa/TotpService.php

@@ -14,9 +14,10 @@ use PragmaRX\Google2FA\Support\Constants;
 
 class TotpService
 {
-    public function __construct(
-        protected Google2FA $google2fa
-    ) {
+    protected $google2fa;
+
+    public function __construct(Google2FA $google2fa)
+    {
         $this->google2fa = $google2fa;
         // Use SHA1 as a default, Personal testing of other options in 2021 found
         // many apps lack support for other algorithms yet still will scan
@@ -34,7 +35,7 @@ class TotpService
     }
 
     /**
-     * Generate a TOTP URL from a secret key.
+     * Generate a TOTP URL from secret key.
      */
     public function generateUrl(string $secret, User $user): string
     {

app/Access/Oidc/OidcHttpBasicWithClientIdOptionProvider.php

@@ -1,27 +0,0 @@
-<?php
-
-namespace BookStack\Access\Oidc;
-
-use League\OAuth2\Client\OptionProvider\HttpBasicAuthOptionProvider;
-
-/**
- * Option provider that sends credentials via HTTP Basic Auth header
- * and also includes client_id in the request body.
- */
-class OidcHttpBasicWithClientIdOptionProvider extends HttpBasicAuthOptionProvider
-{
-    public function getAccessTokenOptions($method, array $params)
-    {
-        $clientId = $params['client_id'] ?? null;
-
-        $options = parent::getAccessTokenOptions($method, $params);
-
-        if ($clientId) {
-            parse_str($options['body'] ?? '', $body);
-            $body['client_id'] = $clientId;
-            $options['body'] = http_build_query($body);
-        }
-
-        return $options;
-    }
-}

app/Access/Oidc/OidcIdToken.php

@@ -9,10 +9,10 @@ class OidcIdToken extends OidcJwtWithClaims implements ProvidesClaims
      *
      * @throws OidcInvalidTokenException
      */
-    public function validate(OidcProviderSettings $settings): bool
+    public function validate(string $clientId): bool
     {
-        parent::validateCommonTokenDetails($settings);
-        $this->validateTokenClaims($settings->clientId);
+        parent::validateCommonTokenDetails($clientId);
+        $this->validateTokenClaims($clientId);
 
         return true;
     }

app/Access/Oidc/OidcJwtSigningKey.php

@@ -9,7 +9,10 @@ use phpseclib3\Math\BigInteger;
 
 class OidcJwtSigningKey
 {
-    protected PublicKey $key;
+    /**
+     * @var PublicKey
+     */
+    protected $key;
 
     /**
      * Can be created either from a JWK parameter array or local file path to load a certificate from.
@@ -17,13 +20,15 @@ class OidcJwtSigningKey
      * 'file:///var/www/cert.pem'
      * ['kty' => 'RSA', 'alg' => 'RS256', 'n' => 'abc123...'].
      *
+     * @param array|string $jwkOrKeyPath
+     *
      * @throws OidcInvalidKeyException
      */
-    public function __construct(array|string $jwkOrKeyPath)
+    public function __construct($jwkOrKeyPath)
     {
         if (is_array($jwkOrKeyPath)) {
             $this->loadFromJwkArray($jwkOrKeyPath);
-        } elseif (str_starts_with($jwkOrKeyPath, 'file://')) {
+        } elseif (is_string($jwkOrKeyPath) && strpos($jwkOrKeyPath, 'file://') === 0) {
             $this->loadFromPath($jwkOrKeyPath);
         } else {
             throw new OidcInvalidKeyException('Unexpected type of key value provided');
@@ -33,7 +38,7 @@ class OidcJwtSigningKey
     /**
      * @throws OidcInvalidKeyException
      */
-    protected function loadFromPath(string $path): void
+    protected function loadFromPath(string $path)
     {
         try {
             $key = PublicKeyLoader::load(
@@ -53,7 +58,7 @@ class OidcJwtSigningKey
     /**
      * @throws OidcInvalidKeyException
      */
-    protected function loadFromJwkArray(array $jwk): void
+    protected function loadFromJwkArray(array $jwk)
     {
         // 'alg' is optional for a JWK, but we will still attempt to validate if
         // it exists otherwise presume it will be compatible.
@@ -77,7 +82,7 @@ class OidcJwtSigningKey
             throw new OidcInvalidKeyException('A "n" parameter on the provided key is expected');
         }
 
-        $n = strtr($jwk['n'], '-_', '+/');
+        $n = strtr($jwk['n'] ?? '', '-_', '+/');
 
         try {
             $key = PublicKeyLoader::load([

app/Access/Oidc/OidcJwtWithClaims.php

@@ -9,9 +9,7 @@ class OidcJwtWithClaims implements ProvidesClaims
     protected string $signature;
     protected string $issuer;
     protected array $tokenParts = [];
-    protected array $acceptedSignatures = [self::hs256Signature, self::rs256Signature];
-    private const hs256Signature = 'HS256'
-        , rs256Signature = 'RS256';
+
     /**
      * @var array[]|string[]
      */
@@ -61,11 +59,11 @@ class OidcJwtWithClaims implements ProvidesClaims
      *
      * @throws OidcInvalidTokenException
      */
-    public function validateCommonTokenDetails(OidcProviderSettings $settings): bool
+    public function validateCommonTokenDetails(string $clientId): bool
     {
         $this->validateTokenStructure();
-        $this->validateTokenSignature($settings);
-        $this->validateCommonClaims($settings->clientId);
+        $this->validateTokenSignature();
+        $this->validateCommonClaims($clientId);
 
         return true;
     }
@@ -119,42 +117,31 @@ class OidcJwtWithClaims implements ProvidesClaims
      *
      * @throws OidcInvalidTokenException
      */
-    protected function validateTokenSignature(OidcProviderSettings $settings): void {  
-        $validSignatures = implode(', ',$this->acceptedSignatures);
-        switch ($this->header['alg']) {
-            case self::rs256Signature:
-                $parsedKeys = array_map(function ($key) {
-                    try {
-                        return new OidcJwtSigningKey($key);
-                    } catch (OidcInvalidKeyException $e) {
-                        throw new OidcInvalidTokenException('Failed to read signing key with error: ' . $e->getMessage());
-                    }
-                }, $this->keys);
-
-                $parsedKeys = array_filter($parsedKeys);
-
-                $contentToSign = $this->tokenParts[0] . '.' . $this->tokenParts[1];
-                /** @var OidcJwtSigningKey $parsedKey */
-                foreach ($parsedKeys as $parsedKey) {
-                    if ($parsedKey->verify($contentToSign, $this->signature)) {
-                        return;
-                    }
-                }
-            
-                throw new OidcInvalidTokenException('Token signature could not be validated using the provided keys');                
-            case self::hs256Signature:
-                $secret = $settings->clientSecret;
-                $contentToSign = $this->tokenParts[0] . '.' . $this->tokenParts[1];
-                $expectedSignature = hash_hmac('sha256', $contentToSign, $secret, true);
-
-                if (hash_equals($expectedSignature, $this->signature)) {
-                    return;
-                }
-            
-                throw new OidcInvalidTokenException('Token signature could not be validated using the provided secret');                
-            default:
-                throw new OidcInvalidTokenException("Only $validSignatures signatures validation are supported. Token reports using {$this->header['alg']}");
+    protected function validateTokenSignature(): void
+    {
+        if ($this->header['alg'] !== 'RS256') {
+            throw new OidcInvalidTokenException("Only RS256 signature validation is supported. Token reports using {$this->header['alg']}");
         }
+
+        $parsedKeys = array_map(function ($key) {
+            try {
+                return new OidcJwtSigningKey($key);
+            } catch (OidcInvalidKeyException $e) {
+                throw new OidcInvalidTokenException('Failed to read signing key with error: ' . $e->getMessage());
+            }
+        }, $this->keys);
+
+        $parsedKeys = array_filter($parsedKeys);
+
+        $contentToSign = $this->tokenParts[0] . '.' . $this->tokenParts[1];
+        /** @var OidcJwtSigningKey $parsedKey */
+        foreach ($parsedKeys as $parsedKey) {
+            if ($parsedKey->verify($contentToSign, $this->signature)) {
+                return;
+            }
+        }
+
+        throw new OidcInvalidTokenException('Token signature could not be validated using the provided keys');
     }
 
     /**

app/Access/Oidc/OidcProviderSettings.php

@@ -74,7 +74,7 @@ class OidcProviderSettings
     {
         $this->validateInitial();
 
-        $required = ['tokenEndpoint', 'authorizationEndpoint'];
+        $required = ['keys', 'tokenEndpoint', 'authorizationEndpoint'];
         foreach ($required as $prop) {
             if (empty($this->$prop)) {
                 throw new InvalidArgumentException("Missing required configuration \"{$prop}\" value");

app/Access/Oidc/OidcService.php

@@ -11,9 +11,9 @@ use BookStack\Exceptions\UserRegistrationException;
 use BookStack\Facades\Theme;
 use BookStack\Http\HttpRequestService;
 use BookStack\Theming\ThemeEvents;
-use BookStack\Uploads\UserAvatars;
 use BookStack\Users\Models\User;
 use Illuminate\Support\Facades\Cache;
+use League\OAuth2\Client\OptionProvider\HttpBasicAuthOptionProvider;
 use League\OAuth2\Client\Provider\Exception\IdentityProviderException;
 
 /**
@@ -26,8 +26,7 @@ class OidcService
         protected RegistrationService $registrationService,
         protected LoginService $loginService,
         protected HttpRequestService $http,
-        protected GroupSyncService $groupService,
-        protected UserAvatars $userAvatars
+        protected GroupSyncService $groupService
     ) {
     }
 
@@ -48,11 +47,6 @@ class OidcService
         $url = $provider->getAuthorizationUrl();
         session()->put('oidc_pkce_code', $provider->getPkceCode() ?? '');
 
-        $returnUrl = Theme::dispatch(ThemeEvents::OIDC_AUTH_PRE_REDIRECT, $url);
-        if (is_string($returnUrl)) {
-            $url = $returnUrl;
-        }
-
         return [
             'url'   => $url,
             'state' => $provider->getState(),
@@ -139,7 +133,7 @@ class OidcService
             'redirectUri' => url('/oidc/callback'),
         ], [
             'httpClient'     => $this->http->buildClient(5),
-            'optionProvider' => new OidcHttpBasicWithClientIdOptionProvider(),
+            'optionProvider' => new HttpBasicAuthOptionProvider(),
         ]);
 
         foreach ($this->getAdditionalScopes() as $scope) {
@@ -198,7 +192,7 @@ class OidcService
         }
 
         try {
-            $idToken->validate($settings);
+            $idToken->validate($settings->clientId);
         } catch (OidcInvalidTokenException $exception) {
             throw new OidcException("ID token validation failed with error: {$exception->getMessage()}");
         }
@@ -226,10 +220,6 @@ class OidcService
             throw new OidcException($exception->getMessage());
         }
 
-        if ($this->config()['fetch_avatar'] && !$user->avatar()->exists() && $userDetails->picture) {
-            $this->userAvatars->assignToUserFromUrl($user, $userDetails->picture);
-        }
-
         if ($this->shouldSyncGroups()) {
             $detachExisting = $this->config()['remove_from_groups'];
             $this->groupService->syncUserWithFoundGroups($user, $userDetails->groups ?? [], $detachExisting);

app/Access/Oidc/OidcUserDetails.php

@@ -11,7 +11,6 @@ class OidcUserDetails
         public ?string $email = null,
         public ?string $name = null,
         public ?array $groups = null,
-        public ?string $picture = null,
     ) {
     }
 
@@ -39,18 +38,17 @@ class OidcUserDetails
     ): void {
         $this->externalId = $claims->getClaim($idClaim) ?? $this->externalId;
         $this->email = $claims->getClaim('email') ?? $this->email;
-        $this->name = static::getUserDisplayName($displayNameClaims, $claims) ?: $this->name;
+        $this->name = static::getUserDisplayName($displayNameClaims, $claims) ?? $this->name;
         $this->groups = static::getUserGroups($groupsClaim, $claims) ?? $this->groups;
-        $this->picture = static::getPicture($claims) ?: $this->picture;
     }
 
-    protected static function getUserDisplayName(string $displayNameClaims, ProvidesClaims $claims): string
+    protected static function getUserDisplayName(string $displayNameClaims, ProvidesClaims $token): string
     {
         $displayNameClaimParts = explode('|', $displayNameClaims);
 
         $displayName = [];
         foreach ($displayNameClaimParts as $claim) {
-            $component = $claims->getClaim(trim($claim)) ?? '';
+            $component = $token->getClaim(trim($claim)) ?? '';
             if ($component !== '') {
                 $displayName[] = $component;
             }
@@ -59,13 +57,13 @@ class OidcUserDetails
         return implode(' ', $displayName);
     }
 
-    protected static function getUserGroups(string $groupsClaim, ProvidesClaims $claims): ?array
+    protected static function getUserGroups(string $groupsClaim, ProvidesClaims $token): ?array
     {
         if (empty($groupsClaim)) {
             return null;
         }
 
-        $groupsList = Arr::get($claims->getAllClaims(), $groupsClaim);
+        $groupsList = Arr::get($token->getAllClaims(), $groupsClaim);
         if (!is_array($groupsList)) {
             return null;
         }
@@ -74,14 +72,4 @@ class OidcUserDetails
             return is_string($val);
         }));
     }
-
-    protected static function getPicture(ProvidesClaims $claims): ?string
-    {
-        $picture = $claims->getClaim('picture');
-        if (is_string($picture) && str_starts_with($picture, 'http')) {
-            return $picture;
-        }
-
-        return null;
-    }
 }

app/Access/Oidc/OidcUserinfoResponse.php

@@ -11,9 +11,7 @@ class OidcUserinfoResponse implements ProvidesClaims
 
     public function __construct(ResponseInterface $response, string $issuer, array $keys)
     {
-        $contentTypeHeaderValue = $response->getHeader('Content-Type')[0] ?? '';
-        $contentType = strtolower(trim(explode(';', $contentTypeHeaderValue, 2)[0]));
-
+        $contentType = $response->getHeader('Content-Type')[0];
         if ($contentType === 'application/json') {
             $this->claims = json_decode($response->getBody()->getContents(), true);
         }

app/Access/RegistrationService.php

@@ -83,7 +83,7 @@ class RegistrationService
         // Email restriction
         $this->ensureEmailDomainAllowed($userEmail);
 
-        // Ensure the user does not already exist
+        // Ensure user does not already exist
         $alreadyUser = !is_null($this->userRepo->getByEmail($userEmail));
         if ($alreadyUser) {
             throw new UserRegistrationException(trans('errors.error_user_exists_different_creds', ['email' => $userEmail]), '/login');
@@ -99,7 +99,7 @@ class RegistrationService
         $newUser = $this->userRepo->createWithoutActivity($userData, $emailConfirmed);
         $newUser->attachDefaultRole();
 
-        // Assign a social account if given
+        // Assign social account if given
         if ($socialAccount) {
             $newUser->socialAccounts()->save($socialAccount);
         }
@@ -107,7 +107,7 @@ class RegistrationService
         Activity::add(ActivityType::AUTH_REGISTER, $socialAccount ?? $newUser);
         Theme::dispatch(ThemeEvents::AUTH_REGISTER, $authSystem, $newUser);
 
-        // Start the email confirmation flow if required
+        // Start email confirmation flow if required
         if ($this->emailConfirmationService->confirmationRequired() && !$emailConfirmed) {
             $newUser->save();
 

app/Access/Saml2Service.php

@@ -51,7 +51,7 @@ class Saml2Service
      * Returns the SAML2 request ID, and the URL to redirect the user to.
      *
      * @throws Error
-     * @return array{url: string, id: ?string}
+     * @returns array{url: string, id: ?string}
      */
     public function logout(User $user): array
     {
@@ -266,7 +266,7 @@ class Saml2Service
     /**
      * Extract the details of a user from a SAML response.
      *
-     * @return array{external_id: string, name: string, email: string|null, saml_id: string}
+     * @return array{external_id: string, name: string, email: string, saml_id: string}
      */
     protected function getUserDetails(string $samlID, $samlAttributes): array
     {
@@ -357,7 +357,7 @@ class Saml2Service
             ]);
         }
 
-        if (empty($userDetails['email'])) {
+        if ($userDetails['email'] === null) {
             throw new SamlException(trans('errors.saml_no_email_address'));
         }
 

app/Access/SocialAccount.php

@@ -5,23 +5,18 @@ namespace BookStack\Access;
 use BookStack\Activity\Models\Loggable;
 use BookStack\App\Model;
 use BookStack\Users\Models\User;
-use Illuminate\Database\Eloquent\Factories\HasFactory;
-use Illuminate\Database\Eloquent\Relations\BelongsTo;
 
 /**
+ * Class SocialAccount.
+ *
  * @property string $driver
  * @property User   $user
  */
 class SocialAccount extends Model implements Loggable
 {
-    use HasFactory;
+    protected $fillable = ['user_id', 'driver', 'driver_id', 'timestamps'];
 
-    protected $fillable = ['user_id', 'driver', 'driver_id'];
-
-    /**
-     * @return BelongsTo<User, $this>
-     */
-    public function user(): BelongsTo
+    public function user()
     {
         return $this->belongsTo(User::class);
     }

app/Access/SocialAuthService.php

@@ -117,14 +117,14 @@ class SocialAuthService
         }
 
         // When a user is logged in and the social account exists and is already linked to the current user.
-        if ($isLoggedIn && $socialAccount->user->id === $currentUser->id) {
+        if ($isLoggedIn && $socialAccount !== null && $socialAccount->user->id === $currentUser->id) {
             session()->flash('error', trans('errors.social_account_existing', ['socialAccount' => $titleCaseDriver]));
 
             return redirect('/my-account/auth#social_accounts');
         }
 
         // When a user is logged in, A social account exists but the users do not match.
-        if ($isLoggedIn && $socialAccount->user->id != $currentUser->id) {
+        if ($isLoggedIn && $socialAccount !== null && $socialAccount->user->id != $currentUser->id) {
             session()->flash('error', trans('errors.social_account_already_used_existing', ['socialAccount' => $titleCaseDriver]));
 
             return redirect('/my-account/auth#social_accounts');

app/Access/SocialDriverManager.php

@@ -55,7 +55,7 @@ class SocialDriverManager
 
     /**
      * Gets the names of the active social drivers, keyed by driver id.
-     * @return array<string, string>
+     * @returns array<string, string>
      */
     public function getActive(): array
     {
@@ -92,7 +92,7 @@ class SocialDriverManager
         string $driverName,
         array $config,
         string $socialiteHandler,
-        ?callable $configureForRedirect = null
+        callable $configureForRedirect = null
     ) {
         $this->validDrivers[] = $driverName;
         config()->set('services.' . $driverName, $config);

app/Activity/ActivityQueries.php

@@ -11,7 +11,6 @@ use BookStack\Entities\Tools\MixedEntityListLoader;
 use BookStack\Permissions\PermissionApplicator;
 use BookStack\Users\Models\User;
 use Illuminate\Database\Eloquent\Builder;
-use Illuminate\Database\Eloquent\Relations\MorphTo;
 use Illuminate\Database\Eloquent\Relations\Relation;
 
 class ActivityQueries
@@ -68,7 +67,6 @@ class ActivityQueries
 
         $activity = $query->orderBy('created_at', 'desc')
             ->with(['loggable' => function (Relation $query) {
-                /** @var MorphTo<Entity, Activity> $query */
                 $query->withTrashed();
             }, 'user.avatar'])
             ->skip($count * ($page - 1))

app/Activity/ActivityType.php

@@ -67,14 +67,6 @@ class ActivityType
     const WEBHOOK_UPDATE = 'webhook_update';
     const WEBHOOK_DELETE = 'webhook_delete';
 
-    const IMPORT_CREATE = 'import_create';
-    const IMPORT_RUN = 'import_run';
-    const IMPORT_DELETE = 'import_delete';
-
-    const SORT_RULE_CREATE = 'sort_rule_create';
-    const SORT_RULE_UPDATE = 'sort_rule_update';
-    const SORT_RULE_DELETE = 'sort_rule_delete';
-
     /**
      * Get all the possible values.
      */

app/Activity/CommentRepo.php

@@ -4,11 +4,8 @@ namespace BookStack\Activity;
 
 use BookStack\Activity\Models\Comment;
 use BookStack\Entities\Models\Entity;
-use BookStack\Entities\Models\Page;
-use BookStack\Exceptions\NotifyException;
 use BookStack\Facades\Activity as ActivityService;
 use BookStack\Util\HtmlDescriptionFilter;
-use Illuminate\Database\Eloquent\Builder;
 
 class CommentRepo
 {
@@ -20,46 +17,11 @@ class CommentRepo
         return Comment::query()->findOrFail($id);
     }
 
-    /**
-     * Get a comment by ID, ensuring it is visible to the user based upon access to the page
-     * which the comment is attached to.
-     */
-    public function getVisibleById(int $id): Comment
-    {
-        return $this->getQueryForVisible()->findOrFail($id);
-    }
-
-    /**
-     * Start a query for comments visible to the user.
-     * @return Builder<Comment>
-     */
-    public function getQueryForVisible(): Builder
-    {
-        return Comment::query()->scopes('visible');
-    }
-
     /**
      * Create a new comment on an entity.
      */
-    public function create(Entity $entity, string $html, ?int $parentId, string $contentRef): Comment
+    public function create(Entity $entity, string $html, ?int $parent_id): Comment
     {
-        // Prevent comments being added to draft pages
-        if ($entity instanceof Page && $entity->draft) {
-            throw new \Exception(trans('errors.cannot_add_comment_to_draft'));
-        }
-
-        // Validate parent ID
-        if ($parentId !== null) {
-            $parentCommentExists = Comment::query()
-                ->where('commentable_id', '=', $entity->id)
-                ->where('commentable_type', '=', $entity->getMorphClass())
-                ->where('local_id', '=', $parentId)
-                ->exists();
-            if (!$parentCommentExists) {
-                $parentId = null;
-            }
-        }
-
         $userId = user()->id;
         $comment = new Comment();
 
@@ -67,14 +29,12 @@ class CommentRepo
         $comment->created_by = $userId;
         $comment->updated_by = $userId;
         $comment->local_id = $this->getNextLocalId($entity);
-        $comment->parent_id = $parentId;
-        $comment->content_ref = preg_match('/^bkmrk-(.*?):\d+:(\d*-\d*)?$/', $contentRef) === 1 ? $contentRef : '';
+        $comment->parent_id = $parent_id;
 
         $entity->comments()->save($comment);
         ActivityService::add(ActivityType::COMMENT_CREATE, $comment);
         ActivityService::add(ActivityType::COMMENTED_ON, $entity);
 
-        $comment->refresh()->unsetRelations();
         return $comment;
     }
 
@@ -92,45 +52,6 @@ class CommentRepo
         return $comment;
     }
 
-
-    /**
-     * Archive an existing comment.
-     */
-    public function archive(Comment $comment, bool $log = true): Comment
-    {
-        if ($comment->parent_id) {
-            throw new NotifyException('Only top-level comments can be archived.', '/', 400);
-        }
-
-        $comment->archived = true;
-        $comment->save();
-
-        if ($log) {
-            ActivityService::add(ActivityType::COMMENT_UPDATE, $comment);
-        }
-
-        return $comment;
-    }
-
-    /**
-     * Un-archive an existing comment.
-     */
-    public function unarchive(Comment $comment, bool $log = true): Comment
-    {
-        if ($comment->parent_id) {
-            throw new NotifyException('Only top-level comments can be un-archived.', '/', 400);
-        }
-
-        $comment->archived = false;
-        $comment->save();
-
-        if ($log) {
-            ActivityService::add(ActivityType::COMMENT_UPDATE, $comment);
-        }
-
-        return $comment;
-    }
-
     /**
      * Delete a comment from the system.
      */

app/Activity/Controllers/AuditLogApiController.php

@@ -4,7 +4,6 @@ namespace BookStack\Activity\Controllers;
 
 use BookStack\Activity\Models\Activity;
 use BookStack\Http\ApiController;
-use BookStack\Permissions\Permission;
 
 class AuditLogApiController extends ApiController
 {
@@ -17,8 +16,8 @@ class AuditLogApiController extends ApiController
      */
     public function list()
     {
-        $this->checkPermission(Permission::SettingsManage);
-        $this->checkPermission(Permission::UsersManage);
+        $this->checkPermission('settings-manage');
+        $this->checkPermission('users-manage');
 
         $query = Activity::query()->with(['user']);
 

app/Activity/Controllers/AuditLogController.php

@@ -5,8 +5,6 @@ namespace BookStack\Activity\Controllers;
 use BookStack\Activity\ActivityType;
 use BookStack\Activity\Models\Activity;
 use BookStack\Http\Controller;
-use BookStack\Permissions\Permission;
-use BookStack\Sorting\SortUrl;
 use BookStack\Util\SimpleListOptions;
 use Illuminate\Http\Request;
 
@@ -14,22 +12,22 @@ class AuditLogController extends Controller
 {
     public function index(Request $request)
     {
-        $this->checkPermission(Permission::SettingsManage);
-        $this->checkPermission(Permission::UsersManage);
+        $this->checkPermission('settings-manage');
+        $this->checkPermission('users-manage');
 
-        $sort = $request->input('sort', 'activity_date');
-        $order = $request->input('order', 'desc');
+        $sort = $request->get('sort', 'activity_date');
+        $order = $request->get('order', 'desc');
         $listOptions = (new SimpleListOptions('', $sort, $order))->withSortOptions([
             'created_at' => trans('settings.audit_table_date'),
             'type' => trans('settings.audit_table_event'),
         ]);
 
         $filters = [
-            'event'     => $request->input('event', ''),
-            'date_from' => $request->input('date_from', ''),
-            'date_to'   => $request->input('date_to', ''),
-            'user'      => $request->input('user', ''),
-            'ip'        => $request->input('ip', ''),
+            'event'     => $request->get('event', ''),
+            'date_from' => $request->get('date_from', ''),
+            'date_to'   => $request->get('date_to', ''),
+            'user'      => $request->get('user', ''),
+            'ip'        => $request->get('ip', ''),
         ];
 
         $query = Activity::query()
@@ -67,7 +65,6 @@ class AuditLogController extends Controller
             'filters'       => $filters,
             'listOptions'   => $listOptions,
             'activityTypes' => $types,
-            'filterSortUrl' => new SortUrl('settings/audit', array_filter($request->except('page')))
         ]);
     }
 }

app/Activity/Controllers/CommentApiController.php

@@ -1,148 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace BookStack\Activity\Controllers;
-
-use BookStack\Activity\CommentRepo;
-use BookStack\Activity\Models\Comment;
-use BookStack\Entities\Queries\PageQueries;
-use BookStack\Http\ApiController;
-use BookStack\Permissions\Permission;
-use Illuminate\Http\JsonResponse;
-use Illuminate\Http\Request;
-use Illuminate\Http\Response;
-
-/**
- * The comment data model has a 'local_id' property, which is a unique integer ID
- * scoped to the page which the comment is on. The 'parent_id' is used for replies
- * and refers to the 'local_id' of the parent comment on the same page, not the main
- * globally unique 'id'.
- *
- * If you want to get all comments for a page in a tree-like structure, as reflected in
- * the UI, then that is provided on pages-read API responses.
- */
-class CommentApiController extends ApiController
-{
-    protected array $rules = [
-        'create' => [
-            'page_id' => ['required', 'integer'],
-            'reply_to' => ['nullable', 'integer'],
-            'html' => ['required', 'string'],
-            'content_ref' => ['string'],
-        ],
-        'update' => [
-            'html' => ['string'],
-            'archived' => ['boolean'],
-        ]
-    ];
-
-    public function __construct(
-        protected CommentRepo $commentRepo,
-        protected PageQueries $pageQueries,
-    ) {
-    }
-
-    /**
-     * Get a listing of comments visible to the user.
-     */
-    public function list(): JsonResponse
-    {
-        $query = $this->commentRepo->getQueryForVisible();
-
-        return $this->apiListingResponse($query, [
-            'id', 'commentable_id', 'commentable_type', 'parent_id', 'local_id', 'content_ref', 'created_by', 'updated_by', 'created_at', 'updated_at'
-        ]);
-    }
-
-    /**
-     * Create a new comment on a page.
-     * If commenting as a reply to an existing comment, the 'reply_to' parameter
-     * should be provided, set to the 'local_id' of the comment being replied to.
-     */
-    public function create(Request $request): JsonResponse
-    {
-        $this->checkPermission(Permission::CommentCreateAll);
-
-        $input = $this->validate($request, $this->rules()['create']);
-        $page = $this->pageQueries->findVisibleByIdOrFail($input['page_id']);
-
-        $comment = $this->commentRepo->create(
-            $page,
-            $input['html'],
-            $input['reply_to'] ?? null,
-            $input['content_ref'] ?? '',
-        );
-
-        return response()->json($comment);
-    }
-
-    /**
-     * Read the details of a single comment, along with its direct replies.
-     */
-    public function read(string $id): JsonResponse
-    {
-        $comment = $this->commentRepo->getVisibleById(intval($id));
-        $comment->load('createdBy', 'updatedBy');
-
-        $replies = $this->commentRepo->getQueryForVisible()
-            ->where('parent_id', '=', $comment->local_id)
-            ->where('commentable_id', '=', $comment->commentable_id)
-            ->where('commentable_type', '=', $comment->commentable_type)
-            ->get();
-
-        /** @var Comment[] $toProcess */
-        $toProcess = [$comment, ...$replies];
-        foreach ($toProcess as $commentToProcess) {
-            $commentToProcess->setAttribute('html', $commentToProcess->safeHtml());
-            $commentToProcess->makeVisible('html');
-        }
-
-        $comment->setRelation('replies', $replies);
-
-        return response()->json($comment);
-    }
-
-
-    /**
-     * Update the content or archived status of an existing comment.
-     *
-     * Only provide a new archived status if needing to actively change the archive state.
-     * Only top-level comments (non-replies) can be archived or unarchived.
-     */
-    public function update(Request $request, string $id): JsonResponse
-    {
-        $comment = $this->commentRepo->getVisibleById(intval($id));
-        $this->checkOwnablePermission(Permission::CommentUpdate, $comment);
-
-        $input = $this->validate($request, $this->rules()['update']);
-        $hasHtml = isset($input['html']);
-
-        if (isset($input['archived'])) {
-            if ($input['archived']) {
-                $this->commentRepo->archive($comment, !$hasHtml);
-            } else {
-                $this->commentRepo->unarchive($comment, !$hasHtml);
-            }
-        }
-
-        if ($hasHtml) {
-            $comment = $this->commentRepo->update($comment, $input['html']);
-        }
-
-        return response()->json($comment);
-    }
-
-    /**
-     * Delete a single comment from the system.
-     */
-    public function delete(string $id): Response
-    {
-        $comment = $this->commentRepo->getVisibleById(intval($id));
-        $this->checkOwnablePermission(Permission::CommentDelete, $comment);
-
-        $this->commentRepo->delete($comment);
-
-        return response('', 204);
-    }
-}

app/Activity/Controllers/CommentController.php

@@ -3,11 +3,8 @@
 namespace BookStack\Activity\Controllers;
 
 use BookStack\Activity\CommentRepo;
-use BookStack\Activity\Tools\CommentTree;
-use BookStack\Activity\Tools\CommentTreeNode;
 use BookStack\Entities\Queries\PageQueries;
 use BookStack\Http\Controller;
-use BookStack\Permissions\Permission;
 use Illuminate\Http\Request;
 use Illuminate\Validation\ValidationException;
 
@@ -22,14 +19,13 @@ class CommentController extends Controller
     /**
      * Save a new comment for a Page.
      *
-     * @throws ValidationException|\Exception
+     * @throws ValidationException
      */
     public function savePageComment(Request $request, int $pageId)
     {
         $input = $this->validate($request, [
             'html'      => ['required', 'string'],
             'parent_id' => ['nullable', 'integer'],
-            'content_ref' => ['string'],
         ]);
 
         $page = $this->pageQueries->findVisibleById($pageId);
@@ -37,14 +33,21 @@ class CommentController extends Controller
             return response('Not found', 404);
         }
 
+        // Prevent adding comments to draft pages
+        if ($page->draft) {
+            return $this->jsonError(trans('errors.cannot_add_comment_to_draft'), 400);
+        }
+
         // Create a new comment.
-        $this->checkPermission(Permission::CommentCreateAll);
-        $contentRef = $input['content_ref'] ?? '';
-        $comment = $this->commentRepo->create($page, $input['html'], $input['parent_id'] ?? null, $contentRef);
+        $this->checkPermission('comment-create-all');
+        $comment = $this->commentRepo->create($page, $input['html'], $input['parent_id'] ?? null);
 
         return view('comments.comment-branch', [
             'readOnly' => false,
-            'branch' => new CommentTreeNode($comment, 0, []),
+            'branch' => [
+                'comment' => $comment,
+                'children' => [],
+            ]
         ]);
     }
 
@@ -60,8 +63,8 @@ class CommentController extends Controller
         ]);
 
         $comment = $this->commentRepo->getById($commentId);
-        $this->checkOwnablePermission(Permission::PageView, $comment->entity);
-        $this->checkOwnablePermission(Permission::CommentUpdate, $comment);
+        $this->checkOwnablePermission('page-view', $comment->entity);
+        $this->checkOwnablePermission('comment-update', $comment);
 
         $comment = $this->commentRepo->update($comment, $input['html']);
 
@@ -71,53 +74,13 @@ class CommentController extends Controller
         ]);
     }
 
-    /**
-     * Mark a comment as archived.
-     */
-    public function archive(int $id)
-    {
-        $comment = $this->commentRepo->getById($id);
-        $this->checkOwnablePermission(Permission::PageView, $comment->entity);
-        if (!userCan(Permission::CommentUpdate, $comment) && !userCan(Permission::CommentDelete, $comment)) {
-            $this->showPermissionError();
-        }
-
-        $this->commentRepo->archive($comment);
-
-        $tree = new CommentTree($comment->entity);
-        return view('comments.comment-branch', [
-            'readOnly' => false,
-            'branch' => $tree->getCommentNodeForId($id),
-        ]);
-    }
-
-    /**
-     * Unmark a comment as archived.
-     */
-    public function unarchive(int $id)
-    {
-        $comment = $this->commentRepo->getById($id);
-        $this->checkOwnablePermission(Permission::PageView, $comment->entity);
-        if (!userCan(Permission::CommentUpdate, $comment) && !userCan(Permission::CommentDelete, $comment)) {
-            $this->showPermissionError();
-        }
-
-        $this->commentRepo->unarchive($comment);
-
-        $tree = new CommentTree($comment->entity);
-        return view('comments.comment-branch', [
-            'readOnly' => false,
-            'branch' => $tree->getCommentNodeForId($id),
-        ]);
-    }
-
     /**
      * Delete a comment from the system.
      */
     public function destroy(int $id)
     {
         $comment = $this->commentRepo->getById($id);
-        $this->checkOwnablePermission(Permission::CommentDelete, $comment);
+        $this->checkOwnablePermission('comment-delete', $comment);
 
         $this->commentRepo->delete($comment);
 

app/Activity/Controllers/FavouriteController.php

@@ -20,7 +20,7 @@ class FavouriteController extends Controller
     public function index(Request $request, QueryTopFavourites $topFavourites)
     {
         $viewCount = 20;
-        $page = intval($request->input('page', 1));
+        $page = intval($request->get('page', 1));
         $favourites = $topFavourites->run($viewCount + 1, (($page - 1) * $viewCount));
 
         $hasMoreLink = ($favourites->count() > $viewCount) ? url('/favourites?page=' . ($page + 1)) : null;

app/Activity/Controllers/TagApiController.php

@@ -1,68 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace BookStack\Activity\Controllers;
-
-use BookStack\Activity\TagRepo;
-use BookStack\Http\ApiController;
-use Illuminate\Http\JsonResponse;
-use Illuminate\Http\Request;
-
-/**
- * Endpoints to query data about tags in the system.
- * You'll only see results based on tags applied to content you have access to.
- * There are no general create/update/delete endpoints here since tags do not exist
- * by themselves, they are managed via the items they are assigned to.
- */
-class TagApiController extends ApiController
-{
-    public function __construct(
-        protected TagRepo $tagRepo,
-    ) {
-    }
-
-    protected function rules(): array
-    {
-        return [
-            'listValues' => [
-                'name' => ['required', 'string'],
-            ],
-        ];
-    }
-
-    /**
-     * Get a list of tag names used in the system.
-     * Only the name field can be used in filters.
-     */
-    public function listNames(): JsonResponse
-    {
-        $tagQuery = $this->tagRepo
-            ->queryWithTotalsForApi('');
-
-        return $this->apiListingResponse($tagQuery, [
-            'name', 'values', 'usages', 'page_count', 'chapter_count', 'book_count', 'shelf_count',
-        ], [], [
-            'name'
-        ]);
-    }
-
-    /**
-     * Get a list of tag values, which have been set for the given tag name,
-     * which must be provided as a query parameter on the request.
-     * Only the value field can be used in filters.
-     */
-    public function listValues(Request $request): JsonResponse
-    {
-        $data = $this->validate($request, $this->rules()['listValues']);
-        $name = $data['name'];
-
-        $tagQuery = $this->tagRepo->queryWithTotalsForApi($name);
-
-        return $this->apiListingResponse($tagQuery, [
-            'name', 'value', 'usages', 'page_count', 'chapter_count', 'book_count', 'shelf_count',
-        ], [], [
-            'value',
-        ]);
-    }
-}

app/Activity/Controllers/TagController.php

@@ -24,9 +24,9 @@ class TagController extends Controller
             'usages' => trans('entities.tags_usages'),
         ]);
 
-        $nameFilter = $request->input('name', '');
+        $nameFilter = $request->get('name', '');
         $tags = $this->tagRepo
-            ->queryWithTotalsForList($listOptions, $nameFilter)
+            ->queryWithTotals($listOptions, $nameFilter)
             ->paginate(50)
             ->appends(array_filter(array_merge($listOptions->getPaginationAppends(), [
                 'name'   => $nameFilter,
@@ -46,7 +46,7 @@ class TagController extends Controller
      */
     public function getNameSuggestions(Request $request)
     {
-        $searchTerm = $request->input('search', '');
+        $searchTerm = $request->get('search', '');
         $suggestions = $this->tagRepo->getNameSuggestions($searchTerm);
 
         return response()->json($suggestions);
@@ -57,8 +57,8 @@ class TagController extends Controller
      */
     public function getValueSuggestions(Request $request)
     {
-        $searchTerm = $request->input('search', '');
-        $tagName = $request->input('name', '');
+        $searchTerm = $request->get('search', '');
+        $tagName = $request->get('name', '');
         $suggestions = $this->tagRepo->getValueSuggestions($searchTerm, $tagName);
 
         return response()->json($suggestions);

app/Activity/Controllers/WatchController.php

@@ -5,14 +5,13 @@ namespace BookStack\Activity\Controllers;
 use BookStack\Activity\Tools\UserEntityWatchOptions;
 use BookStack\Entities\Tools\MixedEntityRequestHelper;
 use BookStack\Http\Controller;
-use BookStack\Permissions\Permission;
 use Illuminate\Http\Request;
 
 class WatchController extends Controller
 {
     public function update(Request $request, MixedEntityRequestHelper $entityHelper)
     {
-        $this->checkPermission(Permission::ReceiveNotifications);
+        $this->checkPermission('receive-notifications');
         $this->preventGuestAccess();
 
         $requestData = $this->validate($request, array_merge([

app/Activity/Controllers/WebhookController.php

@@ -6,7 +6,6 @@ use BookStack\Activity\ActivityType;
 use BookStack\Activity\Models\Webhook;
 use BookStack\Activity\Queries\WebhooksAllPaginatedAndSorted;
 use BookStack\Http\Controller;
-use BookStack\Permissions\Permission;
 use BookStack\Util\SimpleListOptions;
 use Illuminate\Http\Request;
 
@@ -15,7 +14,7 @@ class WebhookController extends Controller
     public function __construct()
     {
         $this->middleware([
-            Permission::SettingsManage->middleware()
+            'can:settings-manage',
         ]);
     }
 

app/Activity/Models/Activity.php

@@ -6,7 +6,6 @@ use BookStack\App\Model;
 use BookStack\Entities\Models\Entity;
 use BookStack\Permissions\Models\JointPermission;
 use BookStack\Users\Models\User;
-use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\Relations\BelongsTo;
 use Illuminate\Database\Eloquent\Relations\HasMany;
 use Illuminate\Database\Eloquent\Relations\MorphTo;
@@ -25,8 +24,6 @@ use Illuminate\Support\Str;
  */
 class Activity extends Model
 {
-    use HasFactory;
-
     /**
      * Get the loggable model related to this activity.
      * Currently only used for entities (previously entity_[id/type] columns).

app/Activity/Models/Comment.php

@@ -3,70 +3,47 @@
 namespace BookStack\Activity\Models;
 
 use BookStack\App\Model;
-use BookStack\Permissions\Models\JointPermission;
-use BookStack\Permissions\PermissionApplicator;
 use BookStack\Users\Models\HasCreatorAndUpdater;
-use BookStack\Users\Models\OwnableInterface;
 use BookStack\Util\HtmlContentFilter;
-use BookStack\Util\HtmlContentFilterConfig;
-use BookStack\Util\HtmlToPlainText;
-use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\Relations\BelongsTo;
-use Illuminate\Database\Eloquent\Relations\HasMany;
 use Illuminate\Database\Eloquent\Relations\MorphTo;
 
 /**
  * @property int      $id
+ * @property string   $text - Deprecated & now unused (#4821)
  * @property string   $html
  * @property int|null $parent_id  - Relates to local_id, not id
  * @property int      $local_id
- * @property string   $commentable_type
- * @property int      $commentable_id
- * @property string   $content_ref
- * @property bool     $archived
+ * @property string   $entity_type
+ * @property int      $entity_id
+ * @property int      $created_by
+ * @property int      $updated_by
  */
-class Comment extends Model implements Loggable, OwnableInterface
+class Comment extends Model implements Loggable
 {
     use HasFactory;
     use HasCreatorAndUpdater;
 
     protected $fillable = ['parent_id'];
-    protected $hidden = ['html'];
-
-    protected $casts = [
-        'archived' => 'boolean',
-    ];
+    protected $appends = ['created', 'updated'];
 
     /**
      * Get the entity that this comment belongs to.
      */
     public function entity(): MorphTo
     {
-        // We specifically define null here to avoid the different name (commentable)
-        // being used by Laravel eager loading instead of the method name, which it was doing
-        // in some scenarios like when deserialized when going through the queue system.
-        // So we instead specify the type and id column names to use.
-        // Related to:
-        // https://github.com/laravel/framework/pull/24815
-        // https://github.com/laravel/framework/issues/27342
-        // https://github.com/laravel/framework/issues/47953
-        // (and probably more)
-
-        // Ultimately, we could just align the method name to 'commentable' but that would be a potential
-        // breaking change and not really worthwhile in a patch due to the risk of creating extra problems.
-        return $this->morphTo(null, 'commentable_type', 'commentable_id');
+        return $this->morphTo('entity');
     }
 
     /**
      * Get the parent comment this is in reply to (if existing).
-     * @return BelongsTo<Comment, $this>
      */
     public function parent(): BelongsTo
     {
         return $this->belongsTo(Comment::class, 'parent_id', 'local_id', 'parent')
-            ->where('commentable_type', '=', $this->commentable_type)
-            ->where('commentable_id', '=', $this->commentable_id);
+            ->where('entity_type', '=', $this->entity_type)
+            ->where('entity_id', '=', $this->entity_id);
     }
 
     /**
@@ -77,36 +54,29 @@ class Comment extends Model implements Loggable, OwnableInterface
         return $this->updated_at->timestamp > $this->created_at->timestamp;
     }
 
+    /**
+     * Get created date as a relative diff.
+     */
+    public function getCreatedAttribute(): string
+    {
+        return $this->created_at->diffForHumans();
+    }
+
+    /**
+     * Get updated date as a relative diff.
+     */
+    public function getUpdatedAttribute(): string
+    {
+        return $this->updated_at->diffForHumans();
+    }
+
     public function logDescriptor(): string
     {
-        return "Comment #{$this->local_id} (ID: {$this->id}) for {$this->commentable_type} (ID: {$this->commentable_id})";
+        return "Comment #{$this->local_id} (ID: {$this->id}) for {$this->entity_type} (ID: {$this->entity_id})";
     }
 
     public function safeHtml(): string
     {
-        $filter = new HtmlContentFilter(new HtmlContentFilterConfig());
-        return $filter->filterString($this->html ?? '');
-    }
-
-    public function getPlainText(): string
-    {
-        $converter = new HtmlToPlainText();
-        return $converter->convert($this->html ?? '');
-    }
-
-    public function jointPermissions(): HasMany
-    {
-        return $this->hasMany(JointPermission::class, 'entity_id', 'commentable_id')
-            ->whereColumn('joint_permissions.entity_type', '=', 'comments.commentable_type');
-    }
-
-    /**
-     * Scope the query to just the comments visible to the user based upon the
-     * user visibility of what has been commented on.
-     */
-    public function scopeVisible(Builder $query): Builder
-    {
-        return app()->make(PermissionApplicator::class)
-            ->restrictEntityRelationQuery($query, 'comments', 'commentable_id', 'commentable_type');
+        return HtmlContentFilter::removeScriptsFromHtmlString($this->html ?? '');
     }
 }

app/Activity/Models/Favourite.php

@@ -4,14 +4,11 @@ namespace BookStack\Activity\Models;
 
 use BookStack\App\Model;
 use BookStack\Permissions\Models\JointPermission;
-use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\Relations\HasMany;
 use Illuminate\Database\Eloquent\Relations\MorphTo;
 
 class Favourite extends Model
 {
-    use HasFactory;
-
     protected $fillable = ['user_id'];
 
     /**

app/Activity/Models/MentionHistory.php

@@ -1,20 +0,0 @@
-<?php
-
-namespace BookStack\Activity\Models;
-
-use Illuminate\Database\Eloquent\Model;
-use Illuminate\Support\Carbon;
-
-/**
- * @property int $id
- * @property string $mentionable_type
- * @property int $mentionable_id
- * @property int $from_user_id
- * @property int $to_user_id
- * @property Carbon $created_at
- * @property Carbon $updated_at
- */
-class MentionHistory extends Model
-{
-    protected $table = 'mention_history';
-}

app/Activity/Models/Tag.php

@@ -12,8 +12,6 @@ use Illuminate\Database\Eloquent\Relations\MorphTo;
  * @property int    $id
  * @property string $name
  * @property string $value
- * @property int    $entity_id
- * @property string $entity_type
  * @property int    $order
  */
 class Tag extends Model

app/Activity/Models/Watch.php

@@ -5,7 +5,6 @@ namespace BookStack\Activity\Models;
 use BookStack\Activity\WatchLevels;
 use BookStack\Permissions\Models\JointPermission;
 use Carbon\Carbon;
-use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Database\Eloquent\Relations\HasMany;
 use Illuminate\Database\Eloquent\Relations\MorphTo;
@@ -21,8 +20,6 @@ use Illuminate\Database\Eloquent\Relations\MorphTo;
  */
 class Watch extends Model
 {
-    use HasFactory;
-
     protected $guarded = [];
 
     public function watchable(): MorphTo

app/Activity/Notifications/Handlers/BaseNotificationHandler.php

@@ -5,10 +5,8 @@ namespace BookStack\Activity\Notifications\Handlers;
 use BookStack\Activity\Models\Loggable;
 use BookStack\Activity\Notifications\Messages\BaseActivityNotification;
 use BookStack\Entities\Models\Entity;
-use BookStack\Permissions\Permission;
 use BookStack\Permissions\PermissionApplicator;
 use BookStack\Users\Models\User;
-use Illuminate\Support\Facades\Log;
 
 abstract class BaseNotificationHandler implements NotificationHandler
 {
@@ -20,7 +18,6 @@ abstract class BaseNotificationHandler implements NotificationHandler
     {
         $users = User::query()->whereIn('id', array_unique($userIds))->get();
 
-        /** @var User $user */
         foreach ($users as $user) {
             // Prevent sending to the user that initiated the activity
             if ($user->id === $initiator->id) {
@@ -28,7 +25,7 @@ abstract class BaseNotificationHandler implements NotificationHandler
             }
 
             // Prevent sending of the user does not have notification permissions
-            if (!$user->can(Permission::ReceiveNotifications)) {
+            if (!$user->can('receive-notifications')) {
                 continue;
             }
 
@@ -39,11 +36,7 @@ abstract class BaseNotificationHandler implements NotificationHandler
             }
 
             // Send the notification
-            try {
-                $user->notify(new $notification($detail, $initiator));
-            } catch (\Exception $exception) {
-                Log::error("Failed to send email notification to user [id:{$user->id}] with error: {$exception->getMessage()}");
-            }
+            $user->notify(new $notification($detail, $initiator));
         }
     }
 }

app/Activity/Notifications/Handlers/CommentCreationNotificationHandler.php

@@ -27,7 +27,7 @@ class CommentCreationNotificationHandler extends BaseNotificationHandler
         $watcherIds = $watchers->getWatcherUserIds();
 
         // Page owner if user preferences allow
-        if ($page->owned_by && !$watchers->isUserIgnoring($page->owned_by) && $page->ownedBy) {
+        if (!$watchers->isUserIgnoring($page->owned_by) && $page->ownedBy) {
             $userNotificationPrefs = new UserNotificationPreferences($page->ownedBy);
             if ($userNotificationPrefs->notifyOnOwnPageComments()) {
                 $watcherIds[] = $page->owned_by;
@@ -36,7 +36,7 @@ class CommentCreationNotificationHandler extends BaseNotificationHandler
 
         // Parent comment creator if preferences allow
         $parentComment = $detail->parent()->first();
-        if ($parentComment && $parentComment->created_by && !$watchers->isUserIgnoring($parentComment->created_by) && $parentComment->createdBy) {
+        if ($parentComment && !$watchers->isUserIgnoring($parentComment->created_by) && $parentComment->createdBy) {
             $parentCommenterNotificationsPrefs = new UserNotificationPreferences($parentComment->createdBy);
             if ($parentCommenterNotificationsPrefs->notifyOnCommentReplies()) {
                 $watcherIds[] = $parentComment->created_by;

app/Activity/Notifications/Handlers/CommentMentionNotificationHandler.php

@@ -1,85 +0,0 @@
-<?php
-
-namespace BookStack\Activity\Notifications\Handlers;
-
-use BookStack\Activity\ActivityType;
-use BookStack\Activity\Models\Activity;
-use BookStack\Activity\Models\Comment;
-use BookStack\Activity\Models\Loggable;
-use BookStack\Activity\Models\MentionHistory;
-use BookStack\Activity\Notifications\Messages\CommentMentionNotification;
-use BookStack\Activity\Tools\MentionParser;
-use BookStack\Entities\Models\Page;
-use BookStack\Settings\UserNotificationPreferences;
-use BookStack\Users\Models\User;
-use Illuminate\Database\Eloquent\Collection;
-use Illuminate\Support\Carbon;
-
-class CommentMentionNotificationHandler extends BaseNotificationHandler
-{
-    public function handle(Activity $activity, Loggable|string $detail, User $user): void
-    {
-        if (!($detail instanceof Comment) || !($detail->entity instanceof Page)) {
-            throw new \InvalidArgumentException("Detail for comment mention notifications must be a comment on a page");
-        }
-
-        /** @var Page $page */
-        $page = $detail->entity;
-
-        $parser = new MentionParser();
-        $mentionedUserIds = $parser->parseUserIdsFromHtml($detail->html);
-        $realMentionedUsers = User::whereIn('id', $mentionedUserIds)->get();
-
-        $receivingNotifications = $realMentionedUsers->filter(function (User $user) {
-            $prefs = new UserNotificationPreferences($user);
-            return $prefs->notifyOnCommentMentions();
-        });
-        $receivingNotificationsUserIds = $receivingNotifications->pluck('id')->toArray();
-
-        $userMentionsToLog = $realMentionedUsers;
-
-        // When an edit, we check our history to see if we've already notified the user about this comment before
-        // so that we can filter them out to avoid double notifications.
-        if ($activity->type === ActivityType::COMMENT_UPDATE) {
-            $previouslyNotifiedUserIds = $this->getPreviouslyNotifiedUserIds($detail);
-            $receivingNotificationsUserIds = array_values(array_diff($receivingNotificationsUserIds, $previouslyNotifiedUserIds));
-            $userMentionsToLog = $userMentionsToLog->filter(function (User $user) use ($previouslyNotifiedUserIds) {
-                return !in_array($user->id, $previouslyNotifiedUserIds);
-            });
-        }
-
-        $this->logMentions($userMentionsToLog, $detail, $user);
-        $this->sendNotificationToUserIds(CommentMentionNotification::class, $receivingNotificationsUserIds, $user, $detail, $page);
-    }
-
-    /**
-     * @param Collection<User> $mentionedUsers
-     */
-    protected function logMentions(Collection $mentionedUsers, Comment $comment, User $fromUser): void
-    {
-        $mentions = [];
-        $now = Carbon::now();
-
-        foreach ($mentionedUsers as $mentionedUser) {
-            $mentions[] = [
-                'mentionable_type' => $comment->getMorphClass(),
-                'mentionable_id' => $comment->id,
-                'from_user_id' => $fromUser->id,
-                'to_user_id' => $mentionedUser->id,
-                'created_at' => $now,
-                'updated_at' => $now,
-            ];
-        }
-
-        MentionHistory::query()->insert($mentions);
-    }
-
-    protected function getPreviouslyNotifiedUserIds(Comment $comment): array
-    {
-        return MentionHistory::query()
-            ->where('mentionable_id', $comment->id)
-            ->where('mentionable_type', $comment->getMorphClass())
-            ->pluck('to_user_id')
-            ->toArray();
-    }
-}

app/Activity/Notifications/Handlers/PageUpdateNotificationHandler.php

@@ -20,8 +20,7 @@ class PageUpdateNotificationHandler extends BaseNotificationHandler
             throw new \InvalidArgumentException("Detail for page update notifications must be a page");
         }
 
-        // Get the last update from activity
-        /** @var ?Activity $lastUpdate */
+        // Get last update from activity
         $lastUpdate = $detail->activity()
             ->where('type', '=', ActivityType::PAGE_UPDATE)
             ->where('id', '!=', $activity->id)
@@ -39,8 +38,8 @@ class PageUpdateNotificationHandler extends BaseNotificationHandler
         $watchers = new EntityWatchers($detail, WatchLevels::UPDATES);
         $watcherIds = $watchers->getWatcherUserIds();
 
-        // Add the page owner if preferences allow
-        if ($detail->owned_by && !$watchers->isUserIgnoring($detail->owned_by) && $detail->ownedBy) {
+        // Add page owner if preferences allow
+        if (!$watchers->isUserIgnoring($detail->owned_by) && $detail->ownedBy) {
             $userNotificationPrefs = new UserNotificationPreferences($detail->ownedBy);
             if ($userNotificationPrefs->notifyOnOwnPageChanges()) {
                 $watcherIds[] = $detail->owned_by;

app/Activity/Notifications/Messages/CommentCreationNotification.php

@@ -24,7 +24,7 @@ class CommentCreationNotification extends BaseActivityNotification
             $locale->trans('notifications.detail_page_name') => new EntityLinkMessageLine($page),
             $locale->trans('notifications.detail_page_path') => $this->buildPagePathLine($page, $notifiable),
             $locale->trans('notifications.detail_commenter') => $this->user->name,
-            $locale->trans('notifications.detail_comment') => $comment->getPlainText(),
+            $locale->trans('notifications.detail_comment') => strip_tags($comment->html),
         ]);
 
         return $this->newMailMessage($locale)

app/Activity/Notifications/Messages/CommentMentionNotification.php

@@ -1,37 +0,0 @@
-<?php
-
-namespace BookStack\Activity\Notifications\Messages;
-
-use BookStack\Activity\Models\Comment;
-use BookStack\Activity\Notifications\MessageParts\EntityLinkMessageLine;
-use BookStack\Activity\Notifications\MessageParts\ListMessageLine;
-use BookStack\Entities\Models\Page;
-use BookStack\Users\Models\User;
-use Illuminate\Notifications\Messages\MailMessage;
-
-class CommentMentionNotification extends BaseActivityNotification
-{
-    public function toMail(User $notifiable): MailMessage
-    {
-        /** @var Comment $comment */
-        $comment = $this->detail;
-        /** @var Page $page */
-        $page = $comment->entity;
-
-        $locale = $notifiable->getLocale();
-
-        $listLines = array_filter([
-            $locale->trans('notifications.detail_page_name') => new EntityLinkMessageLine($page),
-            $locale->trans('notifications.detail_page_path') => $this->buildPagePathLine($page, $notifiable),
-            $locale->trans('notifications.detail_commenter') => $this->user->name,
-            $locale->trans('notifications.detail_comment') => $comment->getPlainText(),
-        ]);
-
-        return $this->newMailMessage($locale)
-            ->subject($locale->trans('notifications.comment_mention_subject', ['pageName' => $page->getShortName()]))
-            ->line($locale->trans('notifications.comment_mention_intro', ['appName' => setting('app-name')]))
-            ->line(new ListMessageLine($listLines))
-            ->action($locale->trans('notifications.action_view_comment'), $page->getUrl('#comment' . $comment->local_id))
-            ->line($this->buildReasonFooterLine($locale));
-    }
-}

app/Activity/Notifications/NotificationManager.php

@@ -6,7 +6,6 @@ use BookStack\Activity\ActivityType;
 use BookStack\Activity\Models\Activity;
 use BookStack\Activity\Models\Loggable;
 use BookStack\Activity\Notifications\Handlers\CommentCreationNotificationHandler;
-use BookStack\Activity\Notifications\Handlers\CommentMentionNotificationHandler;
 use BookStack\Activity\Notifications\Handlers\NotificationHandler;
 use BookStack\Activity\Notifications\Handlers\PageCreationNotificationHandler;
 use BookStack\Activity\Notifications\Handlers\PageUpdateNotificationHandler;
@@ -15,14 +14,14 @@ use BookStack\Users\Models\User;
 class NotificationManager
 {
     /**
-     * @var array<string, class-string<NotificationHandler>[]>
+     * @var class-string<NotificationHandler>[]
      */
-    protected array $handlersByActivity = [];
+    protected array $handlers = [];
 
     public function handle(Activity $activity, string|Loggable $detail, User $user): void
     {
         $activityType = $activity->type;
-        $handlersToRun = $this->handlersByActivity[$activityType] ?? [];
+        $handlersToRun = $this->handlers[$activityType] ?? [];
         foreach ($handlersToRun as $handlerClass) {
             /** @var NotificationHandler $handler */
             $handler = new $handlerClass();
@@ -35,12 +34,12 @@ class NotificationManager
      */
     public function registerHandler(string $activityType, string $handlerClass): void
     {
-        if (!isset($this->handlersByActivity[$activityType])) {
-            $this->handlersByActivity[$activityType] = [];
+        if (!isset($this->handlers[$activityType])) {
+            $this->handlers[$activityType] = [];
         }
 
-        if (!in_array($handlerClass, $this->handlersByActivity[$activityType])) {
-            $this->handlersByActivity[$activityType][] = $handlerClass;
+        if (!in_array($handlerClass, $this->handlers[$activityType])) {
+            $this->handlers[$activityType][] = $handlerClass;
         }
     }
 
@@ -49,7 +48,5 @@ class NotificationManager
         $this->registerHandler(ActivityType::PAGE_CREATE, PageCreationNotificationHandler::class);
         $this->registerHandler(ActivityType::PAGE_UPDATE, PageUpdateNotificationHandler::class);
         $this->registerHandler(ActivityType::COMMENT_CREATE, CommentCreationNotificationHandler::class);
-        $this->registerHandler(ActivityType::COMMENT_CREATE, CommentMentionNotificationHandler::class);
-        $this->registerHandler(ActivityType::COMMENT_UPDATE, CommentMentionNotificationHandler::class);
     }
 }

app/Activity/TagRepo.php

@@ -18,10 +18,9 @@ class TagRepo
     }
 
     /**
-     * Start a query against all tags in the system, with total counts for their usage,
-     * suitable for a system interface list with listing options.
+     * Start a query against all tags in the system.
      */
-    public function queryWithTotalsForList(SimpleListOptions $listOptions, string $nameFilter): Builder
+    public function queryWithTotals(SimpleListOptions $listOptions, string $nameFilter): Builder
     {
         $searchTerm = $listOptions->getSearch();
         $sort = $listOptions->getSort();
@@ -29,34 +28,17 @@ class TagRepo
             $sort = 'value';
         }
 
-        $query = $this->baseQueryWithTotals($nameFilter, $searchTerm)
-            ->orderBy($sort, $listOptions->getOrder());
-
-        return $this->permissions->restrictEntityRelationQuery($query, 'tags', 'entity_id', 'entity_type');
-    }
-
-    /**
-     * Start a query against all tags in the system, with total counts for their usage,
-     * which can be used via the API.
-     */
-    public function queryWithTotalsForApi(string $nameFilter): Builder
-    {
-        $query = $this->baseQueryWithTotals($nameFilter, '');
-        return $this->permissions->restrictEntityRelationQuery($query, 'tags', 'entity_id', 'entity_type');
-    }
-
-    protected function baseQueryWithTotals(string $nameFilter, string $searchTerm): Builder
-    {
         $query = Tag::query()
             ->select([
                 'name',
                 ($searchTerm || $nameFilter) ? 'value' : DB::raw('COUNT(distinct value) as `values`'),
                 DB::raw('COUNT(id) as usages'),
-                DB::raw('CAST(SUM(IF(entity_type = \'page\', 1, 0)) as UNSIGNED) as page_count'),
-                DB::raw('CAST(SUM(IF(entity_type = \'chapter\', 1, 0)) as UNSIGNED) as chapter_count'),
-                DB::raw('CAST(SUM(IF(entity_type = \'book\', 1, 0)) as UNSIGNED) as book_count'),
-                DB::raw('CAST(SUM(IF(entity_type = \'bookshelf\', 1, 0)) as UNSIGNED) as shelf_count'),
+                DB::raw('SUM(IF(entity_type = \'page\', 1, 0)) as page_count'),
+                DB::raw('SUM(IF(entity_type = \'chapter\', 1, 0)) as chapter_count'),
+                DB::raw('SUM(IF(entity_type = \'book\', 1, 0)) as book_count'),
+                DB::raw('SUM(IF(entity_type = \'bookshelf\', 1, 0)) as shelf_count'),
             ])
+            ->orderBy($sort, $listOptions->getOrder())
             ->whereHas('entity');
 
         if ($nameFilter) {
@@ -75,7 +57,7 @@ class TagRepo
             });
         }
 
-        return $query;
+        return $this->permissions->restrictEntityRelationQuery($query, 'tags', 'entity_id', 'entity_type');
     }
 
     /**

app/Activity/Tools/CommentTree.php

@@ -4,20 +4,14 @@ namespace BookStack\Activity\Tools;
 
 use BookStack\Activity\Models\Comment;
 use BookStack\Entities\Models\Page;
-use BookStack\Permissions\Permission;
 
 class CommentTree
 {
     /**
      * The built nested tree structure array.
-     * @var CommentTreeNode[]
+     * @var array{comment: Comment, depth: int, children: array}[]
      */
     protected array $tree;
-
-    /**
-     * A linear array of loaded comments.
-     * @var Comment[]
-     */
     protected array $comments;
 
     public function __construct(
@@ -34,7 +28,7 @@ class CommentTree
 
     public function empty(): bool
     {
-        return count($this->getActive()) === 0;
+        return count($this->tree) === 0;
     }
 
     public function count(): int
@@ -42,41 +36,15 @@ class CommentTree
         return count($this->comments);
     }
 
-    public function getActive(): array
+    public function get(): array
     {
-        return array_values(array_filter($this->tree, fn (CommentTreeNode $node) => !$node->comment->archived));
-    }
-
-    public function activeThreadCount(): int
-    {
-        return count($this->getActive());
-    }
-
-    public function getArchived(): array
-    {
-        return array_values(array_filter($this->tree, fn (CommentTreeNode $node) => $node->comment->archived));
-    }
-
-    public function archivedThreadCount(): int
-    {
-        return count($this->getArchived());
-    }
-
-    public function getCommentNodeForId(int $commentId): ?CommentTreeNode
-    {
-        foreach ($this->tree as $node) {
-            if ($node->comment->id === $commentId) {
-                return $node;
-            }
-        }
-
-        return null;
+        return $this->tree;
     }
 
     public function canUpdateAny(): bool
     {
         foreach ($this->comments as $comment) {
-            if (userCan(Permission::CommentUpdate, $comment)) {
+            if (userCan('comment-update', $comment)) {
                 return true;
             }
         }
@@ -84,17 +52,8 @@ class CommentTree
         return false;
     }
 
-    public function loadVisibleHtml(): void
-    {
-        foreach ($this->comments as $comment) {
-            $comment->setAttribute('html', $comment->safeHtml());
-            $comment->makeVisible('html');
-        }
-    }
-
     /**
      * @param Comment[] $comments
-     * @return CommentTreeNode[]
      */
     protected function createTree(array $comments): array
     {
@@ -118,27 +77,28 @@ class CommentTree
 
         $tree = [];
         foreach ($childMap[0] ?? [] as $childId) {
-            $tree[] = $this->createTreeNodeForId($childId, 0, $byId, $childMap);
+            $tree[] = $this->createTreeForId($childId, 0, $byId, $childMap);
         }
 
         return $tree;
     }
 
-    protected function createTreeNodeForId(int $id, int $depth, array &$byId, array &$childMap): CommentTreeNode
+    protected function createTreeForId(int $id, int $depth, array &$byId, array &$childMap): array
     {
         $childIds = $childMap[$id] ?? [];
         $children = [];
 
         foreach ($childIds as $childId) {
-            $children[] = $this->createTreeNodeForId($childId, $depth + 1, $byId, $childMap);
+            $children[] = $this->createTreeForId($childId, $depth + 1, $byId, $childMap);
         }
 
-        return new CommentTreeNode($byId[$id], $depth, $children);
+        return [
+            'comment' => $byId[$id],
+            'depth' => $depth,
+            'children' => $children,
+        ];
     }
 
-    /**
-     * @return Comment[]
-     */
     protected function loadComments(): array
     {
         if (!$this->enabled()) {

app/Activity/Tools/CommentTreeNode.php

@@ -1,23 +0,0 @@
-<?php
-
-namespace BookStack\Activity\Tools;
-
-use BookStack\Activity\Models\Comment;
-
-class CommentTreeNode
-{
-    public Comment $comment;
-    public int $depth;
-
-    /**
-     * @var CommentTreeNode[]
-     */
-    public array $children;
-
-    public function __construct(Comment $comment, int $depth, array $children)
-    {
-        $this->comment = $comment;
-        $this->depth = $depth;
-        $this->children = $children;
-    }
-}

app/Activity/Tools/MentionParser.php

@@ -1,28 +0,0 @@
-<?php
-
-namespace BookStack\Activity\Tools;
-
-use BookStack\Util\HtmlDocument;
-use DOMElement;
-
-class MentionParser
-{
-    public function parseUserIdsFromHtml(string $html): array
-    {
-        $doc = new HtmlDocument($html);
-
-        $ids = [];
-        $mentionLinks = $doc->queryXPath('//a[@data-mention-user-id]');
-
-        foreach ($mentionLinks as $link) {
-            if ($link instanceof DOMElement) {
-                $id = intval($link->getAttribute('data-mention-user-id'));
-                if ($id > 0) {
-                    $ids[] = $id;
-                }
-            }
-        }
-
-        return array_values(array_unique($ids));
-    }
-}

app/Activity/Tools/TagClassGenerator.php

@@ -3,16 +3,17 @@
 namespace BookStack\Activity\Tools;
 
 use BookStack\Activity\Models\Tag;
-use BookStack\Entities\Models\BookChild;
-use BookStack\Entities\Models\Entity;
-use BookStack\Entities\Models\Page;
-use BookStack\Permissions\Permission;
 
 class TagClassGenerator
 {
-    public function __construct(
-        protected Entity $entity
-    ) {
+    protected array $tags;
+
+    /**
+     * @param Tag[] $tags
+     */
+    public function __construct(array $tags)
+    {
+        $this->tags = $tags;
     }
 
     /**
@@ -21,23 +22,14 @@ class TagClassGenerator
     public function generate(): array
     {
         $classes = [];
-        $tags = $this->entity->tags->all();
 
-        foreach ($tags as $tag) {
-             array_push($classes, ...$this->generateClassesForTag($tag));
-        }
-
-        if ($this->entity instanceof BookChild && userCan(Permission::BookView, $this->entity->book)) {
-            $bookTags = $this->entity->book->tags;
-            foreach ($bookTags as $bookTag) {
-                 array_push($classes, ...$this->generateClassesForTag($bookTag, 'book-'));
-            }
-        }
-
-        if ($this->entity instanceof Page && $this->entity->chapter && userCan(Permission::ChapterView, $this->entity->chapter)) {
-            $chapterTags = $this->entity->chapter->tags;
-            foreach ($chapterTags as $chapterTag) {
-                 array_push($classes, ...$this->generateClassesForTag($chapterTag, 'chapter-'));
+        foreach ($this->tags as $tag) {
+            $name = $this->normalizeTagClassString($tag->name);
+            $value = $this->normalizeTagClassString($tag->value);
+            $classes[] = 'tag-name-' . $name;
+            if ($value) {
+                $classes[] = 'tag-value-' . $value;
+                $classes[] = 'tag-pair-' . $name . '-' . $value;
             }
         }
 
@@ -49,22 +41,6 @@ class TagClassGenerator
         return implode(' ', $this->generate());
     }
 
-    /**
-     * @return string[]
-     */
-    protected function generateClassesForTag(Tag $tag, string $prefix = ''): array
-    {
-        $classes = [];
-        $name = $this->normalizeTagClassString($tag->name);
-        $value = $this->normalizeTagClassString($tag->value);
-        $classes[] = "{$prefix}tag-name-{$name}";
-        if ($value) {
-            $classes[] = "{$prefix}tag-value-{$value}";
-            $classes[] = "{$prefix}tag-pair-{$name}-{$value}";
-        }
-        return $classes;
-    }
-
     protected function normalizeTagClassString(string $value): string
     {
         $value = str_replace(' ', '', strtolower($value));

app/Activity/Tools/UserEntityWatchOptions.php

@@ -7,7 +7,6 @@ use BookStack\Activity\WatchLevels;
 use BookStack\Entities\Models\BookChild;
 use BookStack\Entities\Models\Entity;
 use BookStack\Entities\Models\Page;
-use BookStack\Permissions\Permission;
 use BookStack\Users\Models\User;
 use Illuminate\Database\Eloquent\Builder;
 
@@ -23,7 +22,7 @@ class UserEntityWatchOptions
 
     public function canWatch(): bool
     {
-        return $this->user->can(Permission::ReceiveNotifications) && !$this->user->isGuest();
+        return $this->user->can('receive-notifications') && !$this->user->isGuest();
     }
 
     public function getWatchLevel(): string

app/Activity/Tools/WebhookFormatter.php

@@ -50,7 +50,7 @@ class WebhookFormatter
         }
 
         if ($this->detail instanceof Model) {
-            $data['related_item'] = $this->formatModel($this->detail);
+            $data['related_item'] = $this->formatModel();
         }
 
         return $data;
@@ -83,8 +83,10 @@ class WebhookFormatter
         );
     }
 
-    protected function formatModel(Model $model): array
+    protected function formatModel(): array
     {
+        /** @var Model $model */
+        $model = $this->detail;
         $model->unsetRelations();
 
         foreach ($this->modelFormatters as $formatter) {

app/Activity/WatchLevels.php

@@ -36,7 +36,7 @@ class WatchLevels
 
     /**
      * Get all the possible values as an option_name => value array.
-     * @return array<string, int>
+     * @returns array<string, int>
      */
     public static function all(): array
     {
@@ -50,7 +50,7 @@ class WatchLevels
 
     /**
      * Get the watch options suited for the given entity.
-     * @return array<string, int>
+     * @returns array<string, int>
      */
     public static function allSuitedFor(Entity $entity): array
     {

app/Api/ApiDocsGenerator.php

@@ -2,7 +2,6 @@
 
 namespace BookStack\Api;
 
-use BookStack\App\AppVersion;
 use BookStack\Http\ApiController;
 use Exception;
 use Illuminate\Contracts\Container\BindingResolutionException;
@@ -17,14 +16,7 @@ use ReflectionMethod;
 
 class ApiDocsGenerator
 {
-    /**
-     * @var array<string, ReflectionClass>
-     */
     protected array $reflectionClasses = [];
-
-    /**
-     * @var array<string, ApiController>
-     */
     protected array $controllerClasses = [];
 
     /**
@@ -33,7 +25,7 @@ class ApiDocsGenerator
      */
     public static function generateConsideringCache(): Collection
     {
-        $appVersion = AppVersion::get();
+        $appVersion = trim(file_get_contents(base_path('version')));
         $cacheKey = 'api-docs::' . $appVersion;
         $isProduction = config('app.env') === 'production';
         $cacheVal = $isProduction ? Cache::get($cacheKey) : null;
@@ -90,19 +82,11 @@ class ApiDocsGenerator
     protected function loadDetailsFromControllers(Collection $routes): Collection
     {
         return $routes->map(function (array $route) {
-            $class = $this->getReflectionClass($route['controller']);
             $method = $this->getReflectionMethod($route['controller'], $route['controller_method']);
             $comment = $method->getDocComment();
-            $route['description'] = $comment ? $this->parseDescriptionFromDocBlockComment($comment) : null;
+            $route['description'] = $comment ? $this->parseDescriptionFromMethodComment($comment) : null;
             $route['body_params'] = $this->getBodyParamsFromClass($route['controller'], $route['controller_method']);
 
-            // Load class description for the model
-            // Not ideal to have it here on each route, but adding it in a more structured manner would break
-            // docs resulting JSON format and therefore be an API break.
-            // Save refactoring for a more significant set of changes.
-            $classComment = $class->getDocComment();
-            $route['model_description'] = $classComment ? $this->parseDescriptionFromDocBlockComment($classComment) : null;
-
             return $route;
         });
     }
@@ -114,6 +98,7 @@ class ApiDocsGenerator
      */
     protected function getBodyParamsFromClass(string $className, string $methodName): ?array
     {
+        /** @var ApiController $class */
         $class = $this->controllerClasses[$className] ?? null;
         if ($class === null) {
             $class = app()->make($className);
@@ -154,12 +139,12 @@ class ApiDocsGenerator
     /**
      * Parse out the description text from a class method comment.
      */
-    protected function parseDescriptionFromDocBlockComment(string $comment): string
+    protected function parseDescriptionFromMethodComment(string $comment): string
     {
         $matches = [];
         preg_match_all('/^\s*?\*\s?($|((?![\/@\s]).*?))$/m', $comment, $matches);
 
-        $text = implode(' ', $matches[1]);
+        $text = implode(' ', $matches[1] ?? []);
         return str_replace('  ', "\n", $text);
     }
 
@@ -169,16 +154,6 @@ class ApiDocsGenerator
      * @throws ReflectionException
      */
     protected function getReflectionMethod(string $className, string $methodName): ReflectionMethod
-    {
-        return $this->getReflectionClass($className)->getMethod($methodName);
-    }
-
-    /**
-     * Get a reflection class from the given class name.
-     *
-     * @throws ReflectionException
-     */
-    protected function getReflectionClass(string $className): ReflectionClass
     {
         $class = $this->reflectionClasses[$className] ?? null;
         if ($class === null) {
@@ -186,7 +161,7 @@ class ApiDocsGenerator
             $this->reflectionClasses[$className] = $class;
         }
 
-        return $class;
+        return $class->getMethod($methodName);
     }
 
     /**
@@ -195,12 +170,11 @@ class ApiDocsGenerator
     protected function getFlatApiRoutes(): Collection
     {
         return collect(Route::getRoutes()->getRoutes())->filter(function ($route) {
-            return str_starts_with($route->uri, 'api/');
+            return strpos($route->uri, 'api/') === 0;
         })->map(function ($route) {
             [$controller, $controllerMethod] = explode('@', $route->action['uses']);
             $baseModelName = explode('.', explode('/', $route->uri)[1])[0];
-            $controllerMethodKebab = Str::kebab($controllerMethod);
-            $shortName = $baseModelName . '-' . $controllerMethodKebab;
+            $shortName = $baseModelName . '-' . $controllerMethod;
 
             return [
                 'name'                    => $shortName,
@@ -208,7 +182,7 @@ class ApiDocsGenerator
                 'method'                  => $route->methods[0],
                 'controller'              => $controller,
                 'controller_method'       => $controllerMethod,
-                'controller_method_kebab' => $controllerMethodKebab,
+                'controller_method_kebab' => Str::kebab($controllerMethod),
                 'base_model'              => $baseModelName,
             ];
         });

app/Api/ApiEntityListFormatter.php

@@ -2,9 +2,7 @@
 
 namespace BookStack\Api;
 
-use BookStack\Entities\Models\BookChild;
 use BookStack\Entities\Models\Entity;
-use BookStack\Entities\Models\Page;
 
 class ApiEntityListFormatter
 {
@@ -22,16 +20,8 @@ class ApiEntityListFormatter
      * @var array<string|int, string|callable>
      */
     protected array $fields = [
-        'id',
-        'name',
-        'slug',
-        'book_id',
-        'chapter_id',
-        'draft',
-        'template',
-        'priority',
-        'created_at',
-        'updated_at',
+        'id', 'name', 'slug', 'book_id', 'chapter_id', 'draft',
+        'template', 'priority', 'created_at', 'updated_at',
     ];
 
     public function __construct(array $list)
@@ -72,31 +62,6 @@ class ApiEntityListFormatter
         return $this;
     }
 
-    /**
-     * Include parent book/chapter info in the formatted data.
-     * These functions are careful to not load the relation themselves, since they should
-     * have already been loaded in a more efficient manner, with permissions applied, by the time
-     * the parent fields are handled here.
-     */
-    public function withParents(): self
-    {
-        $this->withField('book', function (Entity $entity) {
-            if ($entity instanceof BookChild && $entity->relationLoaded('book') && $entity->getRelationValue('book')) {
-                return $entity->book->only(['id', 'name', 'slug']);
-            }
-            return null;
-        });
-
-        $this->withField('chapter', function (Entity $entity) {
-            if ($entity instanceof Page && $entity->relationLoaded('chapter') && $entity->getRelationValue('chapter')) {
-                return $entity->chapter->only(['id', 'name', 'slug']);
-            }
-            return null;
-        });
-
-        return $this;
-    }
-
     /**
      * Format the data and return an array of formatted content.
      * @return array[]

app/Api/ApiTokenGuard.php

@@ -4,7 +4,6 @@ namespace BookStack\Api;
 
 use BookStack\Access\LoginService;
 use BookStack\Exceptions\ApiAuthException;
-use BookStack\Permissions\Permission;
 use Illuminate\Auth\GuardHelpers;
 use Illuminate\Contracts\Auth\Authenticatable;
 use Illuminate\Contracts\Auth\Guard;
@@ -17,14 +16,29 @@ class ApiTokenGuard implements Guard
     use GuardHelpers;
 
     /**
-     * The last auth exception thrown in this request.
+     * The request instance.
      */
-    protected ApiAuthException|null $lastAuthException = null;
+    protected $request;
 
-    public function __construct(
-        protected Request $request,
-        protected LoginService $loginService
-    ) {
+    /**
+     * @var LoginService
+     */
+    protected $loginService;
+
+    /**
+     * The last auth exception thrown in this request.
+     *
+     * @var ApiAuthException
+     */
+    protected $lastAuthException;
+
+    /**
+     * ApiTokenGuard constructor.
+     */
+    public function __construct(Request $request, LoginService $loginService)
+    {
+        $this->request = $request;
+        $this->loginService = $loginService;
     }
 
     /**
@@ -52,7 +66,7 @@ class ApiTokenGuard implements Guard
     }
 
     /**
-     * Determine if the current user is authenticated. If not, throw an exception.
+     * Determine if current user is authenticated. If not, throw an exception.
      *
      * @throws ApiAuthException
      *
@@ -106,7 +120,7 @@ class ApiTokenGuard implements Guard
             throw new ApiAuthException(trans('errors.api_no_authorization_found'));
         }
 
-        if (!str_contains($authToken, ':') || !str_starts_with($authToken, 'Token ')) {
+        if (strpos($authToken, ':') === false || strpos($authToken, 'Token ') !== 0) {
             throw new ApiAuthException(trans('errors.api_bad_authorization_format'));
         }
     }
@@ -132,7 +146,7 @@ class ApiTokenGuard implements Guard
             throw new ApiAuthException(trans('errors.api_user_token_expired'), 403);
         }
 
-        if (!$token->user->can(Permission::AccessApi)) {
+        if (!$token->user->can('access-api')) {
             throw new ApiAuthException(trans('errors.api_user_no_api_permission'), 403);
         }
     }
@@ -140,7 +154,7 @@ class ApiTokenGuard implements Guard
     /**
      * {@inheritdoc}
      */
-    public function validate(array $credentials = []): bool
+    public function validate(array $credentials = [])
     {
         if (empty($credentials['id']) || empty($credentials['secret'])) {
             return false;
@@ -160,7 +174,7 @@ class ApiTokenGuard implements Guard
     /**
      * "Log out" the currently authenticated user.
      */
-    public function logout(): void
+    public function logout()
     {
         $this->user = null;
     }

app/Api/ListingResponseBuilder.php

@@ -18,13 +18,6 @@ class ListingResponseBuilder
      */
     protected array $fields;
 
-    /**
-     * Which fields are filterable.
-     * When null, the $fields above are used instead (Allow all fields).
-     * @var string[]|null
-     */
-    protected array|null $filterableFields = null;
-
     /**
      * @var array<callable>
      */
@@ -61,7 +54,7 @@ class ListingResponseBuilder
     {
         $filteredQuery = $this->filterQuery($this->query);
 
-        $total = $filteredQuery->getCountForPagination();
+        $total = $filteredQuery->count();
         $data = $this->fetchData($filteredQuery)->each(function ($model) {
             foreach ($this->resultModifiers as $modifier) {
                 $modifier($model);
@@ -84,14 +77,6 @@ class ListingResponseBuilder
         $this->resultModifiers[] = $modifier;
     }
 
-    /**
-     * Limit filtering to just the given set of fields.
-     */
-    public function setFilterableFields(array $fields): void
-    {
-        $this->filterableFields = $fields;
-    }
-
     /**
      * Fetch the data to return within the response.
      */
@@ -109,7 +94,7 @@ class ListingResponseBuilder
     protected function filterQuery(Builder $query): Builder
     {
         $query = clone $query;
-        $requestFilters = $this->request->input('filter', []);
+        $requestFilters = $this->request->get('filter', []);
         if (!is_array($requestFilters)) {
             return $query;
         }
@@ -129,11 +114,10 @@ class ListingResponseBuilder
     protected function requestFilterToQueryFilter($fieldKey, $value): ?array
     {
         $splitKey = explode(':', $fieldKey);
-        $field = strtolower($splitKey[0]);
+        $field = $splitKey[0];
         $filterOperator = $splitKey[1] ?? 'eq';
 
-        $filterFields = $this->filterableFields ?? $this->fields;
-        if (!in_array($field, $filterFields)) {
+        if (!in_array($field, $this->fields)) {
             return null;
         }
 
@@ -156,8 +140,8 @@ class ListingResponseBuilder
         $defaultSortName = $this->fields[0];
         $direction = 'asc';
 
-        $sort = $this->request->input('sort', '');
-        if (str_starts_with($sort, '-')) {
+        $sort = $this->request->get('sort', '');
+        if (strpos($sort, '-') === 0) {
             $direction = 'desc';
         }
 
@@ -176,9 +160,9 @@ class ListingResponseBuilder
     protected function countAndOffsetQuery(Builder $query): Builder
     {
         $query = clone $query;
-        $offset = max(0, $this->request->input('offset', 0));
+        $offset = max(0, $this->request->get('offset', 0));
         $maxCount = config('api.max_item_count');
-        $count = $this->request->input('count', config('api.default_item_count'));
+        $count = $this->request->get('count', config('api.default_item_count'));
         $count = max(min($maxCount, $count), 1);
 
         return $query->skip($offset)->take($count);

app/Api/UserApiTokenController.php

@@ -4,7 +4,6 @@ namespace BookStack\Api;
 
 use BookStack\Activity\ActivityType;
 use BookStack\Http\Controller;
-use BookStack\Permissions\Permission;
 use BookStack\Users\Models\User;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Hash;
@@ -17,8 +16,8 @@ class UserApiTokenController extends Controller
      */
     public function create(Request $request, int $userId)
     {
-        $this->checkPermission(Permission::AccessApi);
-        $this->checkPermissionOrCurrentUser(Permission::UsersManage, $userId);
+        $this->checkPermission('access-api');
+        $this->checkPermissionOrCurrentUser('users-manage', $userId);
         $this->updateContext($request);
 
         $user = User::query()->findOrFail($userId);
@@ -36,8 +35,8 @@ class UserApiTokenController extends Controller
      */
     public function store(Request $request, int $userId)
     {
-        $this->checkPermission(Permission::AccessApi);
-        $this->checkPermissionOrCurrentUser(Permission::UsersManage, $userId);
+        $this->checkPermission('access-api');
+        $this->checkPermissionOrCurrentUser('users-manage', $userId);
 
         $this->validate($request, [
             'name'       => ['required', 'max:250'],
@@ -48,11 +47,11 @@ class UserApiTokenController extends Controller
         $secret = Str::random(32);
 
         $token = (new ApiToken())->forceFill([
-            'name'       => $request->input('name'),
+            'name'       => $request->get('name'),
             'token_id'   => Str::random(32),
             'secret'     => Hash::make($secret),
             'user_id'    => $user->id,
-            'expires_at' => $request->input('expires_at') ?: ApiToken::defaultExpiry(),
+            'expires_at' => $request->get('expires_at') ?: ApiToken::defaultExpiry(),
         ]);
 
         while (ApiToken::query()->where('token_id', '=', $token->token_id)->exists()) {
@@ -100,8 +99,8 @@ class UserApiTokenController extends Controller
 
         [$user, $token] = $this->checkPermissionAndFetchUserToken($userId, $tokenId);
         $token->fill([
-            'name'       => $request->input('name'),
-            'expires_at' => $request->input('expires_at') ?: ApiToken::defaultExpiry(),
+            'name'       => $request->get('name'),
+            'expires_at' => $request->get('expires_at') ?: ApiToken::defaultExpiry(),
         ])->save();
 
         $this->logActivity(ActivityType::API_TOKEN_UPDATE, $token);
@@ -144,8 +143,8 @@ class UserApiTokenController extends Controller
      */
     protected function checkPermissionAndFetchUserToken(int $userId, int $tokenId): array
     {
-        $this->checkPermissionOr(Permission::UsersManage, function () use ($userId) {
-            return $userId === user()->id && userCan(Permission::AccessApi);
+        $this->checkPermissionOr('users-manage', function () use ($userId) {
+            return $userId === user()->id && userCan('access-api');
         });
 
         $user = User::query()->findOrFail($userId);

app/App/AppVersion.php

@@ -1,24 +0,0 @@
-<?php
-
-namespace BookStack\App;
-
-class AppVersion
-{
-    protected static string $version = '';
-
-    /**
-     * Get the application's version number from its top-level `version` text file.
-     */
-    public static function get(): string
-    {
-        if (!empty(static::$version)) {
-            return static::$version;
-        }
-
-        $versionFile = base_path('version');
-        $version = trim(file_get_contents($versionFile));
-        static::$version = $version;
-
-        return $version;
-    }
-}

app/App/HomeController.php

@@ -83,7 +83,7 @@ class HomeController extends Controller
         if ($homepageOption === 'bookshelves') {
             $shelves = $this->queries->shelves->visibleForListWithCover()
                 ->orderBy($commonData['listOptions']->getSort(), $commonData['listOptions']->getOrder())
-                ->paginate(setting()->getInteger('lists-page-count-shelves', 18, 1, 1000));
+                ->paginate(18);
             $data = array_merge($commonData, ['shelves' => $shelves]);
 
             return view('home.shelves', $data);
@@ -92,7 +92,7 @@ class HomeController extends Controller
         if ($homepageOption === 'books') {
             $books = $this->queries->books->visibleForListWithCover()
                 ->orderBy($commonData['listOptions']->getSort(), $commonData['listOptions']->getOrder())
-                ->paginate(setting()->getInteger('lists-page-count-books', 18, 1, 1000));
+                ->paginate(18);
             $data = array_merge($commonData, ['books' => $books]);
 
             return view('home.books', $data);

app/App/Model.php

@@ -8,7 +8,7 @@ class Model extends EloquentModel
 {
     /**
      * Provides public access to get the raw attribute value from the model.
-     * Used in areas where no mutations are required, but performance is critical.
+     * Used in areas where no mutations are required but performance is critical.
      *
      * @return mixed
      */

app/App/Providers/AppServiceProvider.php

@@ -3,7 +3,6 @@
 namespace BookStack\App\Providers;
 
 use BookStack\Access\SocialDriverManager;
-use BookStack\Activity\Models\Comment;
 use BookStack\Activity\Tools\ActivityLogger;
 use BookStack\Entities\Models\Book;
 use BookStack\Entities\Models\Bookshelf;
@@ -65,13 +64,6 @@ class AppServiceProvider extends ServiceProvider
             URL::forceScheme($isHttps ? 'https' : 'http');
         }
 
-        // Set SMTP mail driver to use a local domain matching the app domain,
-        // which helps avoid defaulting to a 127.0.0.1 domain
-        if ($appUrl) {
-            $hostName = parse_url($appUrl, PHP_URL_HOST) ?: null;
-            config()->set('mail.mailers.smtp.local_domain', $hostName);
-        }
-
         // Allow longer string lengths after upgrade to utf8mb4
         Schema::defaultStringLength(191);
 
@@ -81,7 +73,6 @@ class AppServiceProvider extends ServiceProvider
             'book'      => Book::class,
             'chapter'   => Chapter::class,
             'page'      => Page::class,
-            'comment'   => Comment::class,
         ]);
     }
 }

app/App/Providers/AuthServiceProvider.php

@@ -59,8 +59,8 @@ class AuthServiceProvider extends ServiceProvider
      */
     public function register(): void
     {
-        Auth::provider('external-users', function () {
-            return new ExternalBaseUserProvider();
+        Auth::provider('external-users', function ($app, array $config) {
+            return new ExternalBaseUserProvider($config['model']);
         });
 
         // Bind and provide the default system user as a singleton to the app instance when needed.

app/App/Providers/EventServiceProvider.php

@@ -15,7 +15,7 @@ class EventServiceProvider extends ServiceProvider
     /**
      * The event listener mappings for the application.
      *
-     * @var array<class-string, array<int, string>>
+     * @var array<class-string, array<int, class-string>>
      */
     protected $listen = [
         SocialiteWasCalled::class => [
@@ -42,12 +42,4 @@ class EventServiceProvider extends ServiceProvider
     {
         return false;
     }
-
-    /**
-     * Overrides the registration of Laravel's default email verification system
-     */
-    protected function configureEmailVerification(): void
-    {
-        //
-    }
 }

app/App/Providers/RouteServiceProvider.php

@@ -85,12 +85,5 @@ class RouteServiceProvider extends ServiceProvider
         RateLimiter::for('public', function (Request $request) {
             return Limit::perMinute(10)->by($request->ip());
         });
-
-        RateLimiter::for('exports', function (Request $request) {
-            $user = user();
-            $attempts = $user->isGuest() ? 4 : 10;
-            $key = $user->isGuest() ? $request->ip() : $user->id;
-            return Limit::perMinute($attempts)->by($key);
-        });
     }
 }

app/App/Providers/ThemeServiceProvider.php

@@ -4,8 +4,6 @@ namespace BookStack\App\Providers;
 
 use BookStack\Theming\ThemeEvents;
 use BookStack\Theming\ThemeService;
-use BookStack\Theming\ThemeViews;
-use Illuminate\Support\Facades\Blade;
 use Illuminate\Support\ServiceProvider;
 
 class ThemeServiceProvider extends ServiceProvider
@@ -26,26 +24,7 @@ class ThemeServiceProvider extends ServiceProvider
     {
         // Boot up the theme system
         $themeService = $this->app->make(ThemeService::class);
-        $viewFactory = $this->app->make('view');
-        $themeViews = new ThemeViews($viewFactory->getFinder());
-
-        // Use a custom include so that we can insert theme views before/after includes.
-        // This is done, even if no theme is active, so that view caching does not create problems
-        // when switching between themes or when switching a theme on/off.
-        $viewFactory->share('__themeViews', $themeViews);
-        Blade::directive('include', function ($expression) {
-            return "<?php echo \$__themeViews->handleViewInclude({$expression}, array_diff_key(get_defined_vars(), ['__data' => 1, '__path' => 1])); ?>";
-        });
-
-        if (!$themeService->getTheme()) {
-            return;
-        }
-
-        $themeService->loadModules();
         $themeService->readThemeActions();
         $themeService->dispatch(ThemeEvents::APP_BOOT, $this->app);
-
-        $themeViews->registerViewPathsForTheme($themeService->getModules());
-        $themeService->dispatch(ThemeEvents::THEME_REGISTER_VIEWS, $themeViews);
     }
 }

app/App/Providers/ViewTweaksServiceProvider.php

@@ -3,7 +3,6 @@
 namespace BookStack\App\Providers;
 
 use BookStack\Entities\BreadcrumbsViewComposer;
-use BookStack\Util\DateFormatter;
 use Illuminate\Pagination\Paginator;
 use Illuminate\Support\Facades\Blade;
 use Illuminate\Support\Facades\View;
@@ -11,15 +10,6 @@ use Illuminate\Support\ServiceProvider;
 
 class ViewTweaksServiceProvider extends ServiceProvider
 {
-    public function register()
-    {
-        $this->app->singleton(DateFormatter::class, function ($app) {
-            return new DateFormatter(
-                $app['config']->get('app.display_timezone'),
-            );
-        });
-    }
-
     /**
      * Bootstrap services.
      */
@@ -31,9 +21,6 @@ class ViewTweaksServiceProvider extends ServiceProvider
         // View Composers
         View::composer('entities.breadcrumbs', BreadcrumbsViewComposer::class);
 
-        // View Globals
-        View::share('dates', $this->app->make(DateFormatter::class));
-
         // Custom blade view directives
         Blade::directive('icon', function ($expression) {
             return "<?php echo (new \BookStack\Util\SvgIcon($expression))->toHtml(); ?>";

app/App/Sluggable.php

@@ -0,0 +1,18 @@
+<?php
+
+namespace BookStack\App;
+
+/**
+ * Assigned to models that can have slugs.
+ * Must have the below properties.
+ *
+ * @property int    $id
+ * @property string $name
+ */
+interface Sluggable
+{
+    /**
+     * Regenerate the slug for this model.
+     */
+    public function refreshSlug(): string;
+}

app/App/SluggableInterface.php

@@ -1,13 +0,0 @@
-<?php
-
-namespace BookStack\App;
-
-/**
- * Assigned to models that can have slugs.
- * Must have the below properties.
- *
- * @property string $slug
- */
-interface SluggableInterface
-{
-}

app/App/SystemApiController.php

@@ -1,31 +0,0 @@
-<?php
-
-namespace BookStack\App;
-
-use BookStack\Http\ApiController;
-use Illuminate\Http\JsonResponse;
-
-class SystemApiController extends ApiController
-{
-    /**
-     * Read details regarding the BookStack instance.
-     * Some details may be null where not set, like the app logo for example.
-     */
-    public function read(): JsonResponse
-    {
-        $logoSetting = setting('app-logo', '');
-        if ($logoSetting === 'none') {
-            $logo = null;
-        } else {
-            $logo = $logoSetting ? url($logoSetting) : url('/logo.png');
-        }
-
-        return response()->json([
-            'version' => AppVersion::get(),
-            'instance_id' => setting('instance-id'),
-            'app_name' => setting('app-name'),
-            'app_logo' => $logo,
-            'base_url' => url('/'),
-        ]);
-    }
-}

app/App/helpers.php

@@ -1,9 +1,6 @@
 <?php
 
-use BookStack\App\AppVersion;
 use BookStack\App\Model;
-use BookStack\Facades\Theme;
-use BookStack\Permissions\Permission;
 use BookStack\Permissions\PermissionApplicator;
 use BookStack\Settings\SettingService;
 use BookStack\Users\Models\User;
@@ -15,7 +12,12 @@ use BookStack\Users\Models\User;
  */
 function versioned_asset(string $file = ''): string
 {
-    $version = AppVersion::get();
+    static $version = null;
+
+    if (is_null($version)) {
+        $versionFile = base_path('version');
+        $version = trim(file_get_contents($versionFile));
+    }
 
     $additional = '';
     if (config('app.env') === 'development') {
@@ -40,9 +42,9 @@ function user(): User
  * Check if the current user has a permission. If an ownable element
  * is passed in the jointPermissions are checked against that particular item.
  */
-function userCan(string|Permission $permission, ?Model $ownable = null): bool
+function userCan(string $permission, Model $ownable = null): bool
 {
-    if (is_null($ownable)) {
+    if ($ownable === null) {
         return user()->can($permission);
     }
 
@@ -56,7 +58,7 @@ function userCan(string|Permission $permission, ?Model $ownable = null): bool
  * Check if the current user can perform the given action on any items in the system.
  * Can be provided the class name of an entity to filter ability to that specific entity type.
  */
-function userCanOnAny(string|Permission $action, string $entityClass = ''): bool
+function userCanOnAny(string $action, string $entityClass = ''): bool
 {
     $permissions = app()->make(PermissionApplicator::class);
 
@@ -68,7 +70,7 @@ function userCanOnAny(string|Permission $action, string $entityClass = ''): bool
  *
  * @return mixed|SettingService
  */
-function setting(?string $key = null, mixed $default = null): mixed
+function setting(string $key = null, $default = null)
 {
     $settingService = app()->make(SettingService::class);
 
@@ -81,14 +83,48 @@ function setting(?string $key = null, mixed $default = null): mixed
 
 /**
  * Get a path to a theme resource.
- * Returns null if a theme is not configured, and therefore a full path is not available for use.
+ * Returns null if a theme is not configured and
+ * therefore a full path is not available for use.
  */
 function theme_path(string $path = ''): ?string
 {
-    $theme = Theme::getTheme();
+    $theme = config('view.theme');
+
     if (!$theme) {
         return null;
     }
 
     return base_path('themes/' . $theme . ($path ? DIRECTORY_SEPARATOR . $path : $path));
 }
+
+/**
+ * Generate a URL with multiple parameters for sorting purposes.
+ * Works out the logic to set the correct sorting direction
+ * Discards empty parameters and allows overriding.
+ */
+function sortUrl(string $path, array $data, array $overrideData = []): string
+{
+    $queryStringSections = [];
+    $queryData = array_merge($data, $overrideData);
+
+    // Change sorting direction is already sorted on current attribute
+    if (isset($overrideData['sort']) && $overrideData['sort'] === $data['sort']) {
+        $queryData['order'] = ($data['order'] === 'asc') ? 'desc' : 'asc';
+    } elseif (isset($overrideData['sort'])) {
+        $queryData['order'] = 'asc';
+    }
+
+    foreach ($queryData as $name => $value) {
+        $trimmedVal = trim($value);
+        if ($trimmedVal === '') {
+            continue;
+        }
+        $queryStringSections[] = urlencode($name) . '=' . urlencode($trimmedVal);
+    }
+
+    if (count($queryStringSections) === 0) {
+        return url($path);
+    }
+
+    return url($path . '?' . implode('&', $queryStringSections));
+}