Added more complexity in an attempt to make ldap host failover fit

Updated ldap connections to be carried via their own class.
Extracted connection logic to its own class.
Having trouble making this new format testable.

.env.example

@@ -37,10 +37,8 @@ MAIL_FROM=bookstack@example.com
 # SMTP mail options
 # These settings can be checked using the "Send a Test Email"
 # feature found in the "Settings > Maintenance" area of the system.
-# For more detailed documentation on mail options, refer to:
-# https://www.bookstackapp.com/docs/admin/email-webhooks/#email-configuration
 MAIL_HOST=localhost
-MAIL_PORT=587
+MAIL_PORT=1025
 MAIL_USERNAME=null
 MAIL_PASSWORD=null
 MAIL_ENCRYPTION=null

.env.example.complete

@@ -3,10 +3,6 @@
 # Each option is shown with it's default value.
 # Do not copy this whole file to use as your '.env' file.
 
-# The details here only serve as a quick reference.
-# Please refer to the BookStack documentation for full details:
-# https://www.bookstackapp.com/docs/
-
 # Application environment
 # Can be 'production', 'development', 'testing' or 'demo'
 APP_ENV=production
@@ -69,20 +65,20 @@ DB_PASSWORD=database_user_password
 # certificate itself (Common Name or Subject Alternative Name).
 MYSQL_ATTR_SSL_CA="/path/to/ca.pem"
 
-# Mail configuration
-# Refer to https://www.bookstackapp.com/docs/admin/email-webhooks/#email-configuration
+# Mail system to use
+# Can be 'smtp' or 'sendmail'
 MAIL_DRIVER=smtp
+
+# Mail sending options
 MAIL_FROM=mail@bookstackapp.com
 MAIL_FROM_NAME=BookStack
 
+# SMTP mail options
 MAIL_HOST=localhost
-MAIL_PORT=587
+MAIL_PORT=1025
 MAIL_USERNAME=null
 MAIL_PASSWORD=null
 MAIL_ENCRYPTION=null
-MAIL_VERIFY_SSL=true
-
-MAIL_SENDMAIL_COMMAND="/usr/sbin/sendmail -bs"
 
 # Cache & Session driver to use
 # Can be 'file', 'database', 'memcached' or 'redis'
@@ -272,7 +268,6 @@ OIDC_DUMP_USER_DETAILS=false
 OIDC_USER_TO_GROUPS=false
 OIDC_GROUPS_CLAIM=groups
 OIDC_REMOVE_FROM_GROUPS=false
-OIDC_EXTERNAL_ID_CLAIM=sub
 
 # Disable default third-party services such as Gravatar and Draw.IO
 # Service-specific options will override this option
@@ -323,13 +318,6 @@ FILE_UPLOAD_SIZE_LIMIT=50
 # Can be 'a4' or 'letter'.
 EXPORT_PAGE_SIZE=a4
 
-# Set path to wkhtmltopdf binary for PDF generation.
-# Can be 'false' or a path path like: '/home/bins/wkhtmltopdf'
-# When false, BookStack will attempt to find a wkhtmltopdf in the application
-# root folder then fall back to the default dompdf renderer if no binary exists.
-# Only used if 'ALLOW_UNTRUSTED_SERVER_FETCHING=true' which disables security protections.
-WKHTMLTOPDF=false
-
 # Allow <script> tags in page content
 # Note, if set to 'true' the page editor may still escape scripts.
 ALLOW_CONTENT_SCRIPTS=false

.github/translators.txt

@@ -176,7 +176,7 @@ Alexander Predl (Harveyhase68) :: German
 Rem (Rem9000) :: Dutch
 Michał Stelmach (stelmach-web) :: Polish
 arniom :: French
-REMOVED_USER :: ; French; Dutch; Turkish
+REMOVED_USER :: ; Dutch; Turkish
 林祖年 (contagion) :: Chinese Traditional
 Siamak Guodarzi (siamakgoudarzi88) :: Persian
 Lis Maestrelo (lismtrl) :: Portuguese, Brazilian
@@ -280,67 +280,3 @@ DerLinkman (derlinkman) :: German; German Informal
 TurnArabic :: Arabic
 Martin Sebek (sebekmartin) :: Czech
 Kuchinashi Hoshikawa (kuchinashi) :: Chinese Simplified
-digilady :: Greek
-Linus (LinusOP) :: Swedish
-Felipe Cardoso (felipecardosoruff) :: Portuguese, Brazilian
-RandomUser0815 :: German Informal; German
-Ismael Mesquita (mesquitoliveira) :: Portuguese, Brazilian
-구인회 (laskdjlaskdj12) :: Korean
-LiZerui (CNLiZerui) :: Chinese Traditional
-Fabrice Boyer (FabriceBoyer) :: French
-mikael (bitcanon) :: Swedish
-Matthias Mai (schnapsidee) :: German; German Informal
-Ufuk Ayyıldız (ufukayyildiz) :: Turkish
-Jan Mitrof (jan.kachlik) :: Czech
-edwardsmirnov :: Russian
-Mr_OSS117 :: French
-shotu :: French
-Cesar_Lopez_Aguillon :: Spanish
-bdewoop :: German
-dina davoudi (dina.davoudi) :: Persian
-Angelos Chouvardas (achouvardas) :: Greek
-rndrss :: Portuguese, Brazilian
-rirac294 :: Russian
-David Furman (thefourCraft) :: Hebrew
-Pafzedog :: French
-Yllelder :: Spanish
-Adrian Ocneanu (aocneanu) :: Romanian
-Eduardo Castanho (EduardoCastanho) :: Portuguese
-VIET NAM VPS (vietnamvps) :: Vietnamese
-m4tthi4s :: French
-toras9000 :: Japanese
-pathab :: German
-MichelSchoon85 :: Dutch
-Jøran Haugli (haugli92) :: Norwegian Bokmal
-Vasileios Kouvelis (VasilisKouvelis) :: Greek
-Dremski :: Bulgarian
-Frédéric SENE (nothingfr) :: French
-bendem :: French
-kostasdizas :: Greek
-Ricardo Schroeder (brownstone666) :: Portuguese, Brazilian
-Eitan MG (EitanMG) :: Hebrew
-Robin Flikkema (RobinFlikkema) :: Dutch
-Michal Gurcik (mgurcik) :: Slovak
-Pooyan Arab (pooyanarab) :: Persian
-Ochi Darma Putra (troke12) :: Indonesian
-H.-H. Peng (Hsins) :: Chinese Traditional
-Mosi  Wang (mosiwang) :: Chinese Traditional
-骆言 (LawssssCat) :: Chinese Simplified
-Stickers Gaming Shøw (StickerSGSHOW) :: French
-Le Van Chinh (Chino) (lvanchinh86) :: Vietnamese
-Rubens nagios (rubenix) :: Catalan
-Patrick Dantas (pa-tiq) :: Portuguese, Brazilian
-Michal (michalgurcik) :: Slovak
-Nepomacs :: German
-Rubens (rubenix) :: Catalan
-m4z :: German; German Informal
-TheRazvy :: Romanian
-Yossi Zilber (lortens) :: Hebrew; Uzbek
-desdinova :: French
-Ingus Rūķis (ingus.rukis) :: Latvian
-Eugene Pershin (SilentEugene) :: Russian
-周盛道 (zhoushengdao) :: Chinese Simplified
-hamidreza amini (hamidrezaamini2022) :: Persian
-Tomislav Kraljević (tomislav.kraljevic) :: Croatian
-Taygun Yıldırım (yildirimtaygun) :: Turkish
-robing29 :: German

.github/workflows/analyse-php.yml

@@ -18,10 +18,10 @@ jobs:
     - name: Get Composer Cache Directory
       id: composer-cache
       run: |
-        echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
+        echo "::set-output name=dir::$(composer config cache-files-dir)"
 
     - name: Cache composer packages
-      uses: actions/cache@v3
+      uses: actions/cache@v2
       with:
         path: ${{ steps.composer-cache.outputs.dir }}
         key: ${{ runner.os }}-composer-8.1

.github/workflows/lint-js.yml

@@ -1,16 +0,0 @@
-name: lint-js
-
-on: [push, pull_request]
-
-jobs:
-  build:
-    if: ${{ github.ref != 'refs/heads/l10n_development' }}
-    runs-on: ubuntu-22.04
-    steps:
-    - uses: actions/checkout@v1
-
-    - name: Install NPM deps
-      run: npm ci
-
-    - name: Run formatting check
-      run: npm run lint

.github/workflows/test-migrations.yml

@@ -8,7 +8,7 @@ jobs:
     runs-on: ubuntu-22.04
     strategy:
       matrix:
-        php: ['8.0', '8.1', '8.2']
+        php: ['7.4', '8.0', '8.1']
     steps:
       - uses: actions/checkout@v1
 
@@ -21,10 +21,10 @@ jobs:
       - name: Get Composer Cache Directory
         id: composer-cache
         run: |
-          echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
+          echo "::set-output name=dir::$(composer config cache-files-dir)"
 
       - name: Cache composer packages
-        uses: actions/cache@v3
+        uses: actions/cache@v2
         with:
           path: ${{ steps.composer-cache.outputs.dir }}
           key: ${{ runner.os }}-composer-${{ matrix.php }}

.github/workflows/test-php.yml

@@ -8,7 +8,7 @@ jobs:
     runs-on: ubuntu-22.04
     strategy:
       matrix:
-        php: ['8.0', '8.1', '8.2']
+        php: ['7.4', '8.0', '8.1']
     steps:
     - uses: actions/checkout@v1
 
@@ -16,15 +16,15 @@ jobs:
       uses: shivammathur/setup-php@v2
       with:
         php-version: ${{ matrix.php }}
-        extensions: gd, mbstring, json, curl, xml, mysql, ldap, gmp
+        extensions: gd, mbstring, json, curl, xml, mysql, ldap
 
     - name: Get Composer Cache Directory
       id: composer-cache
       run: |
-        echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
+        echo "::set-output name=dir::$(composer config cache-files-dir)"
 
     - name: Cache composer packages
-      uses: actions/cache@v3
+      uses: actions/cache@v2
       with:
         path: ${{ steps.composer-cache.outputs.dir }}
         key: ${{ runner.os }}-composer-${{ matrix.php }}

.gitignore

@@ -1,19 +1,16 @@
 /vendor
 /node_modules
-/.vscode
-/composer
 Homestead.yaml
 .env
 .idea
 npm-debug.log
 yarn-error.log
-/public/dist/*.map
+/public/dist
 /public/plugins
-/public/css/*.map
-/public/js/*.map
+/public/css
+/public/js
 /public/bower
 /public/build/
-/public/favicon.ico
 /storage/images
 _ide_helper.php
 /storage/debugbar
@@ -23,10 +20,8 @@ yarn.lock
 nbproject
 .buildpath
 .project
-.nvmrc
 .settings/
 webpack-stats.json
 .phpunit.result.cache
 .DS_Store
-phpstan.neon
-esbuild-meta.json
+phpstan.neon

LICENSE

@@ -1,6 +1,6 @@
 The MIT License (MIT)
 
-Copyright (c) 2015-2023, Dan Brown and the BookStack Project contributors.
+Copyright (c) 2015-2022, Dan Brown and the BookStack Project contributors.
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

app/Access/Ldap.php

@@ -1,110 +0,0 @@
-<?php
-
-namespace BookStack\Access;
-
-/**
- * Class Ldap
- * An object-orientated thin abstraction wrapper for common PHP LDAP functions.
- * Allows the standard LDAP functions to be mocked for testing.
- */
-class Ldap
-{
-    /**
-     * Connect to an LDAP server.
-     *
-     * @return resource|\LDAP\Connection|false
-     */
-    public function connect(string $hostName)
-    {
-        return ldap_connect($hostName);
-    }
-
-    /**
-     * Set the value of an LDAP option for the given connection.
-     *
-     * @param resource|\LDAP\Connection|null $ldapConnection
-     */
-    public function setOption($ldapConnection, int $option, mixed $value): bool
-    {
-        return ldap_set_option($ldapConnection, $option, $value);
-    }
-
-    /**
-     * Start TLS on the given LDAP connection.
-     */
-    public function startTls($ldapConnection): bool
-    {
-        return ldap_start_tls($ldapConnection);
-    }
-
-    /**
-     * Set the version number for the given LDAP connection.
-     *
-     * @param resource|\LDAP\Connection $ldapConnection
-     */
-    public function setVersion($ldapConnection, int $version): bool
-    {
-        return $this->setOption($ldapConnection, LDAP_OPT_PROTOCOL_VERSION, $version);
-    }
-
-    /**
-     * Search LDAP tree using the provided filter.
-     *
-     * @param resource|\LDAP\Connection   $ldapConnection
-     *
-     * @return resource|\LDAP\Result
-     */
-    public function search($ldapConnection, string $baseDn, string $filter, array $attributes = null)
-    {
-        return ldap_search($ldapConnection, $baseDn, $filter, $attributes);
-    }
-
-    /**
-     * Get entries from an LDAP search result.
-     *
-     * @param resource|\LDAP\Connection $ldapConnection
-     * @param resource|\LDAP\Result $ldapSearchResult
-     */
-    public function getEntries($ldapConnection, $ldapSearchResult): array|false
-    {
-        return ldap_get_entries($ldapConnection, $ldapSearchResult);
-    }
-
-    /**
-     * Search and get entries immediately.
-     *
-     * @param resource|\LDAP\Connection   $ldapConnection
-     */
-    public function searchAndGetEntries($ldapConnection, string $baseDn, string $filter, array $attributes = null): array|false
-    {
-        $search = $this->search($ldapConnection, $baseDn, $filter, $attributes);
-
-        return $this->getEntries($ldapConnection, $search);
-    }
-
-    /**
-     * Bind to LDAP directory.
-     *
-     * @param resource|\LDAP\Connection $ldapConnection
-     */
-    public function bind($ldapConnection, string $bindRdn = null, string $bindPassword = null): bool
-    {
-        return ldap_bind($ldapConnection, $bindRdn, $bindPassword);
-    }
-
-    /**
-     * Explode an LDAP dn string into an array of components.
-     */
-    public function explodeDn(string $dn, int $withAttrib): array|false
-    {
-        return ldap_explode_dn($dn, $withAttrib);
-    }
-
-    /**
-     * Escape a string for use in an LDAP filter.
-     */
-    public function escape(string $value, string $ignore = '', int $flags = 0): string
-    {
-        return ldap_escape($value, $ignore, $flags);
-    }
-}

app/Actions/Activity.php

@@ -1,13 +1,11 @@
 <?php
 
-namespace BookStack\Activity\Models;
+namespace BookStack\Actions;
 
-use BookStack\App\Model;
+use BookStack\Auth\User;
 use BookStack\Entities\Models\Entity;
-use BookStack\Permissions\Models\JointPermission;
-use BookStack\Users\Models\User;
+use BookStack\Model;
 use Illuminate\Database\Eloquent\Relations\BelongsTo;
-use Illuminate\Database\Eloquent\Relations\HasMany;
 use Illuminate\Database\Eloquent\Relations\MorphTo;
 use Illuminate\Support\Str;
 
@@ -19,8 +17,6 @@ use Illuminate\Support\Str;
  * @property string $entity_type
  * @property int    $entity_id
  * @property int    $user_id
- * @property Carbon $created_at
- * @property Carbon $updated_at
  */
 class Activity extends Model
 {
@@ -44,12 +40,6 @@ class Activity extends Model
         return $this->belongsTo(User::class);
     }
 
-    public function jointPermissions(): HasMany
-    {
-        return $this->hasMany(JointPermission::class, 'entity_id', 'entity_id')
-            ->whereColumn('activities.entity_type', '=', 'joint_permissions.entity_type');
-    }
-
     /**
      * Returns text from the language files, Looks up by using the activity key.
      */

app/Actions/ActivityLogger.php

@@ -1,13 +1,10 @@
 <?php
 
-namespace BookStack\Activity\Tools;
+namespace BookStack\Actions;
 
-use BookStack\Activity\DispatchWebhookJob;
-use BookStack\Activity\Models\Activity;
-use BookStack\Activity\Models\Loggable;
-use BookStack\Activity\Models\Webhook;
 use BookStack\Entities\Models\Entity;
 use BookStack\Facades\Theme;
+use BookStack\Interfaces\Loggable;
 use BookStack\Theming\ThemeEvents;
 use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Support\Facades\Log;

app/Actions/ActivityQueries.php

@@ -1,14 +1,13 @@
 <?php
 
-namespace BookStack\Activity;
+namespace BookStack\Actions;
 
-use BookStack\Activity\Models\Activity;
+use BookStack\Auth\Permissions\PermissionApplicator;
+use BookStack\Auth\User;
 use BookStack\Entities\Models\Book;
 use BookStack\Entities\Models\Chapter;
 use BookStack\Entities\Models\Entity;
 use BookStack\Entities\Models\Page;
-use BookStack\Permissions\PermissionApplicator;
-use BookStack\Users\Models\User;
 use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Database\Eloquent\Relations\Relation;
 

app/Actions/ActivityType.php

@@ -1,6 +1,6 @@
 <?php
 
-namespace BookStack\Activity;
+namespace BookStack\Actions;
 
 class ActivityType
 {

app/Actions/Comment.php

@@ -1,9 +1,9 @@
 <?php
 
-namespace BookStack\Activity\Models;
+namespace BookStack\Actions;
 
-use BookStack\App\Model;
-use BookStack\Users\Models\HasCreatorAndUpdater;
+use BookStack\Model;
+use BookStack\Traits\HasCreatorAndUpdater;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\Relations\MorphTo;
 

app/Actions/CommentRepo.php

@@ -1,20 +1,32 @@
 <?php
 
-namespace BookStack\Activity;
+namespace BookStack\Actions;
 
-use BookStack\Activity\Models\Comment;
 use BookStack\Entities\Models\Entity;
 use BookStack\Facades\Activity as ActivityService;
 use League\CommonMark\CommonMarkConverter;
 
+/**
+ * Class CommentRepo.
+ */
 class CommentRepo
 {
+    /**
+     * @var Comment
+     */
+    protected $comment;
+
+    public function __construct(Comment $comment)
+    {
+        $this->comment = $comment;
+    }
+
     /**
      * Get a comment by ID.
      */
     public function getById(int $id): Comment
     {
-        return Comment::query()->findOrFail($id);
+        return $this->comment->newQuery()->findOrFail($id);
     }
 
     /**
@@ -23,7 +35,7 @@ class CommentRepo
     public function create(Entity $entity, string $text, ?int $parent_id): Comment
     {
         $userId = user()->id;
-        $comment = new Comment();
+        $comment = $this->comment->newInstance();
 
         $comment->text = $text;
         $comment->html = $this->commentToHtml($text);
@@ -70,7 +82,7 @@ class CommentRepo
             'allow_unsafe_links' => false,
         ]);
 
-        return $converter->convert($commentText);
+        return $converter->convertToHtml($commentText);
     }
 
     /**
@@ -78,8 +90,9 @@ class CommentRepo
      */
     protected function getNextLocalId(Entity $entity): int
     {
-        $currentMaxId = $entity->comments()->max('local_id');
+        /** @var Comment $comment */
+        $comment = $entity->comments(false)->orderBy('local_id', 'desc')->first();
 
-        return $currentMaxId + 1;
+        return ($comment->local_id ?? 0) + 1;
     }
 }

app/Actions/DispatchWebhookJob.php

@@ -1,13 +1,11 @@
 <?php
 
-namespace BookStack\Activity;
+namespace BookStack\Actions;
 
-use BookStack\Activity\Models\Loggable;
-use BookStack\Activity\Models\Webhook;
-use BookStack\Activity\Tools\WebhookFormatter;
+use BookStack\Auth\User;
 use BookStack\Facades\Theme;
+use BookStack\Interfaces\Loggable;
 use BookStack\Theming\ThemeEvents;
-use BookStack\Users\Models\User;
 use Illuminate\Bus\Queueable;
 use Illuminate\Contracts\Queue\ShouldQueue;
 use Illuminate\Foundation\Bus\Dispatchable;
@@ -24,23 +22,27 @@ class DispatchWebhookJob implements ShouldQueue
     use SerializesModels;
 
     protected Webhook $webhook;
+    protected string $event;
     protected User $initiator;
     protected int $initiatedTime;
-    protected array $webhookData;
+
+    /**
+     * @var string|Loggable
+     */
+    protected $detail;
 
     /**
      * Create a new job instance.
      *
      * @return void
      */
-    public function __construct(Webhook $webhook, string $event, Loggable|string $detail)
+    public function __construct(Webhook $webhook, string $event, $detail)
     {
         $this->webhook = $webhook;
+        $this->event = $event;
+        $this->detail = $detail;
         $this->initiator = user();
         $this->initiatedTime = time();
-
-        $themeResponse = Theme::dispatch(ThemeEvents::WEBHOOK_CALL_BEFORE, $event, $this->webhook, $detail, $this->initiator, $this->initiatedTime);
-        $this->webhookData =  $themeResponse ?? WebhookFormatter::getDefault($event, $this->webhook, $detail, $this->initiator, $this->initiatedTime)->format();
     }
 
     /**
@@ -50,13 +52,15 @@ class DispatchWebhookJob implements ShouldQueue
      */
     public function handle()
     {
+        $themeResponse = Theme::dispatch(ThemeEvents::WEBHOOK_CALL_BEFORE, $this->event, $this->webhook, $this->detail, $this->initiator, $this->initiatedTime);
+        $webhookData = $themeResponse ?? WebhookFormatter::getDefault($this->event, $this->webhook, $this->detail, $this->initiator, $this->initiatedTime)->format();
         $lastError = null;
 
         try {
             $response = Http::asJson()
                 ->withOptions(['allow_redirects' => ['strict' => true]])
                 ->timeout($this->webhook->timeout)
-                ->post($this->webhook->endpoint, $this->webhookData);
+                ->post($this->webhook->endpoint, $webhookData);
         } catch (\Exception $exception) {
             $lastError = $exception->getMessage();
             Log::error("Webhook call to endpoint {$this->webhook->endpoint} failed with error \"{$lastError}\"");

app/Actions/Favourite.php

@@ -0,0 +1,19 @@
+<?php
+
+namespace BookStack\Actions;
+
+use BookStack\Model;
+use Illuminate\Database\Eloquent\Relations\MorphTo;
+
+class Favourite extends Model
+{
+    protected $fillable = ['user_id'];
+
+    /**
+     * Get the related model that can be favourited.
+     */
+    public function favouritable(): MorphTo
+    {
+        return $this->morphTo();
+    }
+}

app/Actions/IpFormatter.php

@@ -1,6 +1,6 @@
 <?php
 
-namespace BookStack\Activity\Tools;
+namespace BookStack\Actions;
 
 class IpFormatter
 {

app/Actions/Tag.php

@@ -1,11 +1,9 @@
 <?php
 
-namespace BookStack\Activity\Models;
+namespace BookStack\Actions;
 
-use BookStack\App\Model;
-use BookStack\Permissions\Models\JointPermission;
+use BookStack\Model;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
-use Illuminate\Database\Eloquent\Relations\HasMany;
 use Illuminate\Database\Eloquent\Relations\MorphTo;
 
 /**
@@ -29,12 +27,6 @@ class Tag extends Model
         return $this->morphTo('entity');
     }
 
-    public function jointPermissions(): HasMany
-    {
-        return $this->hasMany(JointPermission::class, 'entity_id', 'entity_id')
-            ->whereColumn('tags.entity_type', '=', 'joint_permissions.entity_type');
-    }
-
     /**
      * Get a full URL to start a tag name search for this tag name.
      */

app/Actions/TagClassGenerator.php

@@ -1,8 +1,6 @@
 <?php
 
-namespace BookStack\Activity\Tools;
-
-use BookStack\Activity\Models\Tag;
+namespace BookStack\Actions;
 
 class TagClassGenerator
 {

app/Actions/TagRepo.php

@@ -1,33 +1,27 @@
 <?php
 
-namespace BookStack\Activity;
+namespace BookStack\Actions;
 
-use BookStack\Activity\Models\Tag;
+use BookStack\Auth\Permissions\PermissionApplicator;
 use BookStack\Entities\Models\Entity;
-use BookStack\Permissions\PermissionApplicator;
-use BookStack\Util\SimpleListOptions;
 use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Support\Collection;
 use Illuminate\Support\Facades\DB;
 
 class TagRepo
 {
-    public function __construct(
-        protected PermissionApplicator $permissions
-    ) {
+    protected PermissionApplicator $permissions;
+
+    public function __construct(PermissionApplicator $permissions)
+    {
+        $this->permissions = $permissions;
     }
 
     /**
      * Start a query against all tags in the system.
      */
-    public function queryWithTotals(SimpleListOptions $listOptions, string $nameFilter): Builder
+    public function queryWithTotals(string $searchTerm, string $nameFilter): Builder
     {
-        $searchTerm = $listOptions->getSearch();
-        $sort = $listOptions->getSort();
-        if ($sort === 'name' && $nameFilter) {
-            $sort = 'value';
-        }
-
         $query = Tag::query()
             ->select([
                 'name',
@@ -38,7 +32,7 @@ class TagRepo
                 DB::raw('SUM(IF(entity_type = \'book\', 1, 0)) as book_count'),
                 DB::raw('SUM(IF(entity_type = \'bookshelf\', 1, 0)) as shelf_count'),
             ])
-            ->orderBy($sort, $listOptions->getOrder());
+            ->orderBy($nameFilter ? 'value' : 'name');
 
         if ($nameFilter) {
             $query->where('name', '=', $nameFilter);
@@ -89,7 +83,6 @@ class TagRepo
     {
         $query = Tag::query()
             ->select('*', DB::raw('count(*) as count'))
-            ->where('value', '!=', '')
             ->groupBy('value');
 
         if ($searchTerm) {

app/Actions/View.php

@@ -1,10 +1,9 @@
 <?php
 
-namespace BookStack\Activity\Models;
+namespace BookStack\Actions;
 
-use BookStack\App\Model;
-use BookStack\Permissions\Models\JointPermission;
-use Illuminate\Database\Eloquent\Relations\HasMany;
+use BookStack\Interfaces\Viewable;
+use BookStack\Model;
 use Illuminate\Database\Eloquent\Relations\MorphTo;
 
 /**
@@ -29,12 +28,6 @@ class View extends Model
         return $this->morphTo();
     }
 
-    public function jointPermissions(): HasMany
-    {
-        return $this->hasMany(JointPermission::class, 'entity_id', 'viewable_id')
-            ->whereColumn('views.viewable_type', '=', 'joint_permissions.entity_type');
-    }
-
     /**
      * Increment the current user's view count for the given viewable model.
      */
@@ -54,4 +47,12 @@ class View extends Model
 
         return $view->views;
     }
+
+    /**
+     * Clear all views from the system.
+     */
+    public static function clearAll()
+    {
+        static::query()->truncate();
+    }
 }

app/Actions/Webhook.php

@@ -1,8 +1,8 @@
 <?php
 
-namespace BookStack\Activity\Models;
+namespace BookStack\Actions;
 
-use BookStack\Activity\ActivityType;
+use BookStack\Interfaces\Loggable;
 use Carbon\Carbon;
 use Illuminate\Database\Eloquent\Collection;
 use Illuminate\Database\Eloquent\Factories\HasFactory;

app/Actions/WebhookFormatter.php

@@ -1,14 +1,12 @@
 <?php
 
-namespace BookStack\Activity\Tools;
+namespace BookStack\Actions;
 
-use BookStack\Activity\ActivityType;
-use BookStack\Activity\Models\Loggable;
-use BookStack\Activity\Models\Webhook;
-use BookStack\App\Model;
+use BookStack\Auth\User;
 use BookStack\Entities\Models\Entity;
 use BookStack\Entities\Models\Page;
-use BookStack\Users\Models\User;
+use BookStack\Interfaces\Loggable;
+use BookStack\Model;
 use Illuminate\Support\Carbon;
 
 class WebhookFormatter
@@ -17,14 +15,18 @@ class WebhookFormatter
     protected string $event;
     protected User $initiator;
     protected int $initiatedTime;
-    protected string|Loggable $detail;
+
+    /**
+     * @var string|Loggable
+     */
+    protected $detail;
 
     /**
      * @var array{condition: callable(string, Model):bool, format: callable(Model):void}[]
      */
     protected $modelFormatters = [];
 
-    public function __construct(string $event, Webhook $webhook, string|Loggable $detail, User $initiator, int $initiatedTime)
+    public function __construct(string $event, Webhook $webhook, $detail, User $initiator, int $initiatedTime)
     {
         $this->webhook = $webhook;
         $this->event = $event;

app/Actions/WebhookTrackedEvent.php

@@ -1,6 +1,6 @@
 <?php
 
-namespace BookStack\Activity\Models;
+namespace BookStack\Actions;
 
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\Model;

app/Activity/Controllers/AuditLogController.php

@@ -1,70 +0,0 @@
-<?php
-
-namespace BookStack\Activity\Controllers;
-
-use BookStack\Activity\ActivityType;
-use BookStack\Activity\Models\Activity;
-use BookStack\Http\Controller;
-use BookStack\Util\SimpleListOptions;
-use Illuminate\Http\Request;
-
-class AuditLogController extends Controller
-{
-    public function index(Request $request)
-    {
-        $this->checkPermission('settings-manage');
-        $this->checkPermission('users-manage');
-
-        $sort = $request->get('sort', 'activity_date');
-        $order = $request->get('order', 'desc');
-        $listOptions = (new SimpleListOptions('', $sort, $order))->withSortOptions([
-            'created_at' => trans('settings.audit_table_date'),
-            'type' => trans('settings.audit_table_event'),
-        ]);
-
-        $filters = [
-            'event'     => $request->get('event', ''),
-            'date_from' => $request->get('date_from', ''),
-            'date_to'   => $request->get('date_to', ''),
-            'user'      => $request->get('user', ''),
-            'ip'        => $request->get('ip', ''),
-        ];
-
-        $query = Activity::query()
-            ->with([
-                'entity' => fn ($query) => $query->withTrashed(),
-                'user',
-            ])
-            ->orderBy($listOptions->getSort(), $listOptions->getOrder());
-
-        if ($filters['event']) {
-            $query->where('type', '=', $filters['event']);
-        }
-        if ($filters['user']) {
-            $query->where('user_id', '=', $filters['user']);
-        }
-
-        if ($filters['date_from']) {
-            $query->where('created_at', '>=', $filters['date_from']);
-        }
-        if ($filters['date_to']) {
-            $query->where('created_at', '<=', $filters['date_to']);
-        }
-        if ($filters['ip']) {
-            $query->where('ip', 'like', $filters['ip'] . '%');
-        }
-
-        $activities = $query->paginate(100);
-        $activities->appends($request->all());
-
-        $types = ActivityType::all();
-        $this->setPageTitle(trans('settings.audit'));
-
-        return view('settings.audit', [
-            'activities'    => $activities,
-            'filters'       => $filters,
-            'listOptions'   => $listOptions,
-            'activityTypes' => $types,
-        ]);
-    }
-}

app/Activity/Models/Favourite.php

@@ -1,27 +0,0 @@
-<?php
-
-namespace BookStack\Activity\Models;
-
-use BookStack\App\Model;
-use BookStack\Permissions\Models\JointPermission;
-use Illuminate\Database\Eloquent\Relations\HasMany;
-use Illuminate\Database\Eloquent\Relations\MorphTo;
-
-class Favourite extends Model
-{
-    protected $fillable = ['user_id'];
-
-    /**
-     * Get the related model that can be favourited.
-     */
-    public function favouritable(): MorphTo
-    {
-        return $this->morphTo();
-    }
-
-    public function jointPermissions(): HasMany
-    {
-        return $this->hasMany(JointPermission::class, 'entity_id', 'favouritable_id')
-            ->whereColumn('favourites.favouritable_type', '=', 'joint_permissions.entity_type');
-    }
-}

app/Activity/Queries/WebhooksAllPaginatedAndSorted.php

@@ -1,30 +0,0 @@
-<?php
-
-namespace BookStack\Activity\Queries;
-
-use BookStack\Activity\Models\Webhook;
-use BookStack\Util\SimpleListOptions;
-use Illuminate\Pagination\LengthAwarePaginator;
-
-/**
- * Get all the webhooks in the system in a paginated format.
- */
-class WebhooksAllPaginatedAndSorted
-{
-    public function run(int $count, SimpleListOptions $listOptions): LengthAwarePaginator
-    {
-        $query = Webhook::query()->select(['*'])
-            ->withCount(['trackedEvents'])
-            ->orderBy($listOptions->getSort(), $listOptions->getOrder());
-
-        if ($listOptions->getSearch()) {
-            $term = '%' . $listOptions->getSearch() . '%';
-            $query->where(function ($query) use ($term) {
-                $query->where('name', 'like', $term)
-                    ->orWhere('endpoint', 'like', $term);
-            });
-        }
-
-        return $query->paginate($count);
-    }
-}

app/Activity/Tools/CommentTree.php

@@ -1,102 +0,0 @@
-<?php
-
-namespace BookStack\Activity\Tools;
-
-use BookStack\Activity\Models\Comment;
-use BookStack\Entities\Models\Page;
-
-class CommentTree
-{
-    /**
-     * The built nested tree structure array.
-     * @var array{comment: Comment, depth: int, children: array}[]
-     */
-    protected array $tree;
-    protected array $comments;
-
-    public function __construct(
-        protected Page $page
-    ) {
-        $this->comments = $this->loadComments();
-        $this->tree = $this->createTree($this->comments);
-    }
-
-    public function enabled(): bool
-    {
-        return !setting('app-disable-comments');
-    }
-
-    public function empty(): bool
-    {
-        return count($this->tree) === 0;
-    }
-
-    public function count(): int
-    {
-        return count($this->comments);
-    }
-
-    public function get(): array
-    {
-        return $this->tree;
-    }
-
-    /**
-     * @param Comment[] $comments
-     */
-    protected function createTree(array $comments): array
-    {
-        $byId = [];
-        foreach ($comments as $comment) {
-            $byId[$comment->local_id] = $comment;
-        }
-
-        $childMap = [];
-        foreach ($comments as $comment) {
-            $parent = $comment->parent_id;
-            if (is_null($parent) || !isset($byId[$parent])) {
-                $parent = 0;
-            }
-
-            if (!isset($childMap[$parent])) {
-                $childMap[$parent] = [];
-            }
-            $childMap[$parent][] = $comment->local_id;
-        }
-
-        $tree = [];
-        foreach ($childMap[0] ?? [] as $childId) {
-            $tree[] = $this->createTreeForId($childId, 0, $byId, $childMap);
-        }
-
-        return $tree;
-    }
-
-    protected function createTreeForId(int $id, int $depth, array &$byId, array &$childMap): array
-    {
-        $childIds = $childMap[$id] ?? [];
-        $children = [];
-
-        foreach ($childIds as $childId) {
-            $children[] = $this->createTreeForId($childId, $depth + 1, $byId, $childMap);
-        }
-
-        return [
-            'comment' => $byId[$id],
-            'depth' => $depth,
-            'children' => $children,
-        ];
-    }
-
-    protected function loadComments(): array
-    {
-        if (!$this->enabled()) {
-            return [];
-        }
-
-        return $this->page->comments()
-            ->with('createdBy')
-            ->get()
-            ->all();
-    }
-}

app/Api/ApiDocsGenerator.php

@@ -2,7 +2,7 @@
 
 namespace BookStack\Api;
 
-use BookStack\Http\ApiController;
+use BookStack\Http\Controllers\Api\ApiController;
 use Exception;
 use Illuminate\Contracts\Container\BindingResolutionException;
 use Illuminate\Support\Collection;
@@ -16,8 +16,8 @@ use ReflectionMethod;
 
 class ApiDocsGenerator
 {
-    protected array $reflectionClasses = [];
-    protected array $controllerClasses = [];
+    protected $reflectionClasses = [];
+    protected $controllerClasses = [];
 
     /**
      * Load the docs form the cache if existing
@@ -139,10 +139,9 @@ class ApiDocsGenerator
     protected function parseDescriptionFromMethodComment(string $comment): string
     {
         $matches = [];
-        preg_match_all('/^\s*?\*\s?($|((?![\/@\s]).*?))$/m', $comment, $matches);
+        preg_match_all('/^\s*?\*\s((?![@\s]).*?)$/m', $comment, $matches);
 
-        $text = implode(' ', $matches[1] ?? []);
-        return str_replace('  ', "\n", $text);
+        return implode(' ', $matches[1] ?? []);
     }
 
     /**

app/Api/ApiToken.php

@@ -2,9 +2,8 @@
 
 namespace BookStack\Api;
 
-use BookStack\Activity\Models\Loggable;
-use BookStack\Users\Models\User;
-use Illuminate\Database\Eloquent\Factories\HasFactory;
+use BookStack\Auth\User;
+use BookStack\Interfaces\Loggable;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Database\Eloquent\Relations\BelongsTo;
 use Illuminate\Support\Carbon;
@@ -21,8 +20,6 @@ use Illuminate\Support\Carbon;
  */
 class ApiToken extends Model implements Loggable
 {
-    use HasFactory;
-
     protected $fillable = ['name', 'expires_at'];
     protected $casts = [
         'expires_at' => 'date:Y-m-d',

app/Api/ApiTokenGuard.php

@@ -2,7 +2,7 @@
 
 namespace BookStack\Api;
 
-use BookStack\Access\LoginService;
+use BookStack\Auth\Access\LoginService;
 use BookStack\Exceptions\ApiAuthException;
 use Illuminate\Auth\GuardHelpers;
 use Illuminate\Contracts\Auth\Authenticatable;

app/Api/ListingResponseBuilder.php

@@ -4,29 +4,21 @@ namespace BookStack\Api;
 
 use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Database\Eloquent\Collection;
-use Illuminate\Database\Eloquent\Model;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
 
 class ListingResponseBuilder
 {
-    protected Builder $query;
-    protected Request $request;
-
-    /**
-     * @var string[]
-     */
-    protected array $fields;
+    protected $query;
+    protected $request;
+    protected $fields;
 
     /**
      * @var array<callable>
      */
-    protected array $resultModifiers = [];
+    protected $resultModifiers = [];
 
-    /**
-     * @var array<string, string>
-     */
-    protected array $filterOperators = [
+    protected $filterOperators = [
         'eq'   => '=',
         'ne'   => '!=',
         'gt'   => '>',
@@ -70,9 +62,9 @@ class ListingResponseBuilder
     /**
      * Add a callback to modify each element of the results.
      *
-     * @param (callable(Model): void) $modifier
+     * @param (callable(Model)) $modifier
      */
-    public function modifyResults(callable $modifier): void
+    public function modifyResults($modifier): void
     {
         $this->resultModifiers[] = $modifier;
     }

app/App/Providers/TranslationServiceProvider.php

@@ -1,53 +0,0 @@
-<?php
-
-namespace BookStack\App\Providers;
-
-use BookStack\Translation\FileLoader;
-use BookStack\Translation\MessageSelector;
-use Illuminate\Translation\TranslationServiceProvider as BaseProvider;
-use Illuminate\Translation\Translator;
-
-class TranslationServiceProvider extends BaseProvider
-{
-    /**
-     * Register the service provider.
-     *
-     * @return void
-     */
-    public function register()
-    {
-        $this->registerLoader();
-
-        // This is a tweak upon Laravel's based translation service registration to allow
-        // usage of a custom MessageSelector class
-        $this->app->singleton('translator', function ($app) {
-            $loader = $app['translation.loader'];
-
-            // When registering the translator component, we'll need to set the default
-            // locale as well as the fallback locale. So, we'll grab the application
-            // configuration so we can easily get both of these values from there.
-            $locale = $app['config']['app.locale'];
-
-            $trans = new Translator($loader, $locale);
-            $trans->setFallback($app['config']['app.fallback_locale']);
-            $trans->setSelector(new MessageSelector());
-
-            return $trans;
-        });
-    }
-
-
-
-    /**
-     * Register the translation line loader.
-     * Overrides the default register action from Laravel so a custom loader can be used.
-     *
-     * @return void
-     */
-    protected function registerLoader()
-    {
-        $this->app->singleton('translation.loader', function ($app) {
-            return new FileLoader($app['files'], $app['path.lang']);
-        });
-    }
-}

app/Application.php

@@ -1,6 +1,6 @@
 <?php
 
-namespace BookStack\App;
+namespace BookStack;
 
 class Application extends \Illuminate\Foundation\Application
 {

app/Auth/Access/EmailConfirmationService.php

@@ -1,15 +1,15 @@
 <?php
 
-namespace BookStack\Access;
+namespace BookStack\Auth\Access;
 
+use BookStack\Auth\User;
 use BookStack\Exceptions\ConfirmationEmailException;
 use BookStack\Notifications\ConfirmEmail;
-use BookStack\Users\Models\User;
 
 class EmailConfirmationService extends UserTokenService
 {
-    protected string $tokenTable = 'email_confirmations';
-    protected int $expiryTime = 24;
+    protected $tokenTable = 'email_confirmations';
+    protected $expiryTime = 24;
 
     /**
      * Create new confirmation for a user,

app/Auth/Access/ExternalBaseUserProvider.php

@@ -1,6 +1,6 @@
 <?php
 
-namespace BookStack\Access;
+namespace BookStack\Auth\Access;
 
 use Illuminate\Contracts\Auth\Authenticatable;
 use Illuminate\Contracts\Auth\UserProvider;

app/Auth/Access/GroupSyncService.php

@@ -1,9 +1,9 @@
 <?php
 
-namespace BookStack\Access;
+namespace BookStack\Auth\Access;
 
-use BookStack\Users\Models\Role;
-use BookStack\Users\Models\User;
+use BookStack\Auth\Role;
+use BookStack\Auth\User;
 use Illuminate\Support\Collection;
 
 class GroupSyncService

app/Auth/Access/Guards/AsyncExternalBaseSessionGuard.php

@@ -1,6 +1,6 @@
 <?php
 
-namespace BookStack\Access\Guards;
+namespace BookStack\Auth\Access\Guards;
 
 /**
  * Saml2 Session Guard.

app/Auth/Access/Guards/ExternalBaseSessionGuard.php

@@ -1,8 +1,8 @@
 <?php
 
-namespace BookStack\Access\Guards;
+namespace BookStack\Auth\Access\Guards;
 
-use BookStack\Access\RegistrationService;
+use BookStack\Auth\Access\RegistrationService;
 use Illuminate\Auth\GuardHelpers;
 use Illuminate\Contracts\Auth\Authenticatable as AuthenticatableContract;
 use Illuminate\Contracts\Auth\StatefulGuard;

app/Auth/Access/Guards/LdapSessionGuard.php

@@ -1,15 +1,15 @@
 <?php
 
-namespace BookStack\Access\Guards;
+namespace BookStack\Auth\Access\Guards;
 
-use BookStack\Access\LdapService;
-use BookStack\Access\RegistrationService;
+use BookStack\Auth\Access\Ldap\LdapService;
+use BookStack\Auth\Access\RegistrationService;
+use BookStack\Auth\User;
 use BookStack\Exceptions\JsonDebugException;
 use BookStack\Exceptions\LdapException;
 use BookStack\Exceptions\LoginAttemptEmailNeededException;
 use BookStack\Exceptions\LoginAttemptException;
 use BookStack\Exceptions\UserRegistrationException;
-use BookStack\Users\Models\User;
 use Illuminate\Contracts\Auth\UserProvider;
 use Illuminate\Contracts\Session\Session;
 use Illuminate\Support\Str;

app/Auth/Access/Ldap/LdapConfig.php

@@ -0,0 +1,60 @@
+<?php
+
+namespace BookStack\Auth\Access\Ldap;
+
+class LdapConfig
+{
+    /**
+     * App provided config array.
+     * @var array
+     */
+    protected array $config;
+
+    public function __construct(array $config)
+    {
+        $this->config = $config;
+    }
+
+    /**
+     * Get a value from the config.
+     */
+    public function get(string $key)
+    {
+        return $this->config[$key] ?? null;
+    }
+
+    /**
+     * Parse the potentially multi-value LDAP server host string and return an array of host/port detail pairs.
+     * Multiple hosts are separated with a semicolon, for example: 'ldap.example.com:8069;ldaps://ldap.example.com'
+     *
+     * @return array<array{host: string, port: int}>
+     */
+    public function getServers(): array
+    {
+        $serverStringList = explode(';', $this->get('server'));
+
+        return array_map(fn ($serverStr) => $this->parseSingleServerString($serverStr), $serverStringList);
+    }
+
+    /**
+     * Parse an LDAP server string and return the host and port for a connection.
+     * Is flexible to formats such as 'ldap.example.com:8069' or 'ldaps://ldap.example.com'.
+     *
+     * @return array{host: string, port: int}
+     */
+    protected function parseSingleServerString(string $serverString): array
+    {
+        $serverNameParts = explode(':', trim($serverString));
+
+        // If we have a protocol just return the full string since PHP will ignore a separate port.
+        if ($serverNameParts[0] === 'ldaps' || $serverNameParts[0] === 'ldap') {
+            return ['host' => $serverString, 'port' => 389];
+        }
+
+        // Otherwise, extract the port out
+        $hostName = $serverNameParts[0];
+        $ldapPort = (count($serverNameParts) > 1) ? intval($serverNameParts[1]) : 389;
+
+        return ['host' => $hostName, 'port' => $ldapPort];
+    }
+}

app/Auth/Access/Ldap/LdapConnection.php

@@ -0,0 +1,135 @@
+<?php
+
+namespace BookStack\Auth\Access\Ldap;
+
+use ErrorException;
+
+/**
+ * An object-orientated wrapper for core ldap functions,
+ * holding an internal connection instance.
+ */
+class LdapConnection
+{
+    /**
+     * The core ldap connection resource.
+     * @var resource
+     */
+    protected $connection;
+
+    protected string $hostName;
+    protected int $port;
+
+    public function __construct(string $hostName, int $port)
+    {
+        $this->hostName = $hostName;
+        $this->port = $port;
+        $this->connection = $this->connect();
+    }
+
+    /**
+     * Start a connection to an LDAP server.
+     * Does not actually call out to the external server until an action is performed.
+     *
+     * @return resource
+     */
+    protected function connect()
+    {
+        return ldap_connect($this->hostName, $this->port);
+    }
+
+    /**
+     * Set the value of a LDAP option for the current connection.
+     *
+     * @param mixed    $value
+     */
+    public function setOption(int $option, $value): bool
+    {
+        return ldap_set_option($this->connection, $option, $value);
+    }
+
+    /**
+     * Start TLS for this LDAP connection.
+     */
+    public function startTls(): bool
+    {
+        return ldap_start_tls($this->connection);
+    }
+
+    /**
+     * Set the version number for this ldap connection.
+     */
+    public function setVersion(int $version): bool
+    {
+        return $this->setOption(LDAP_OPT_PROTOCOL_VERSION, $version);
+    }
+
+    /**
+     * Search LDAP tree using the provided filter.
+     *
+     * @return resource
+     */
+    public function search(string $baseDn, string $filter, array $attributes = null)
+    {
+        return ldap_search($this->connection, $baseDn, $filter, $attributes);
+    }
+
+    /**
+     * Get entries from an ldap search result.
+     *
+     * @param resource $ldapSearchResult
+     * @return array|false
+     */
+    public function getEntries($ldapSearchResult)
+    {
+        return ldap_get_entries($this->connection, $ldapSearchResult);
+    }
+
+    /**
+     * Search and get entries immediately.
+     *
+     * @return array|false
+     */
+    public function searchAndGetEntries(string $baseDn, string $filter, array $attributes = null)
+    {
+        $search = $this->search($baseDn, $filter, $attributes);
+
+        return $this->getEntries($search);
+    }
+
+    /**
+     * Bind to LDAP directory.
+     *
+     * @throws ErrorException
+     */
+    public function bind(string $bindRdn = null, string $bindPassword = null): bool
+    {
+        return ldap_bind($this->connection, $bindRdn, $bindPassword);
+    }
+
+    /**
+     * Explode a LDAP dn string into an array of components.
+     *
+     * @return array|false
+     */
+    public static function explodeDn(string $dn, int $withAttrib)
+    {
+        return ldap_explode_dn($dn, $withAttrib);
+    }
+
+    /**
+     * Escape a string for use in an LDAP filter.
+     */
+    public static function escape(string $value, string $ignore = '', int $flags = 0): string
+    {
+        return ldap_escape($value, $ignore, $flags);
+    }
+
+    /**
+     * Set a non-connection-specific LDAP option.
+     * @param mixed $value
+     */
+    public static function setGlobalOption(int $option, $value): bool
+    {
+        return ldap_set_option(null, $option, $value);
+    }
+}

app/Auth/Access/Ldap/LdapConnectionManager.php

@@ -0,0 +1,121 @@
+<?php
+
+namespace BookStack\Auth\Access\Ldap;
+
+use BookStack\Exceptions\LdapException;
+use BookStack\Exceptions\LdapFailedBindException;
+use ErrorException;
+use Illuminate\Support\Facades\Log;
+
+class LdapConnectionManager
+{
+    protected array $connectionCache = [];
+
+    /**
+     * Attempt to start and bind to a new LDAP connection as the configured LDAP system user.
+     */
+    public function startSystemBind(LdapConfig $config): LdapConnection
+    {
+        // Incoming options are string|false
+        $dn = $config->get('dn');
+        $pass = $config->get('pass');
+
+        $isAnonymous = ($dn === false || $pass === false);
+
+        try {
+            return $this->startBind($dn ?: null, $pass ?: null, $config);
+        } catch (LdapFailedBindException $exception) {
+            $msg = ($isAnonymous ? trans('errors.ldap_fail_anonymous') : trans('errors.ldap_fail_authed'));
+            throw new LdapFailedBindException($msg);
+        }
+    }
+
+    /**
+     * Attempt to start and bind to a new LDAP connection.
+     * Will attempt against multiple defined fail-over hosts if set in the provided config.
+     *
+     * Throws a LdapFailedBindException error if the bind connected but failed.
+     * Otherwise, generic LdapException errors would be thrown.
+     *
+     * @throws LdapException
+     */
+    public function startBind(?string $dn, ?string $password, LdapConfig $config): LdapConnection
+    {
+        // Check LDAP extension in installed
+        if (!function_exists('ldap_connect') && config('app.env') !== 'testing') {
+            throw new LdapException(trans('errors.ldap_extension_not_installed'));
+        }
+
+        // Disable certificate verification.
+        // This option works globally and must be set before a connection is created.
+        if ($config->get('tls_insecure')) {
+            LdapConnection::setGlobalOption(LDAP_OPT_X_TLS_REQUIRE_CERT, LDAP_OPT_X_TLS_NEVER);
+        }
+
+        $serverDetails = $config->getServers();
+        $lastException = null;
+
+        foreach ($serverDetails as $server) {
+            try {
+                $connection = $this->startServerConnection($server['host'], $server['port'], $config);
+            } catch (LdapException $exception) {
+                $lastException = $exception;
+                continue;
+            }
+
+            try {
+                $bound = $connection->bind($dn, $password);
+                if (!$bound) {
+                    throw new LdapFailedBindException('Failed to perform LDAP bind');
+                }
+            } catch (ErrorException $exception) {
+                Log::error('LDAP bind error: ' . $exception->getMessage());
+                $lastException = new LdapException('Encountered error during LDAP bind');
+                continue;
+            }
+
+            $this->connectionCache[$server['host'] . ':' . $server['port']] = $connection;
+            return $connection;
+        }
+
+        throw $lastException;
+    }
+
+    /**
+     * Attempt to start a server connection from the provided details.
+     * @throws LdapException
+     */
+    protected function startServerConnection(string $host, int $port, LdapConfig $config): LdapConnection
+    {
+        if (isset($this->connectionCache[$host . ':' . $port])) {
+            return $this->connectionCache[$host . ':' . $port];
+        }
+
+        /** @var LdapConnection $ldapConnection */
+        $ldapConnection = app()->make(LdapConnection::class, [$host, $port]);
+
+        if (!$ldapConnection) {
+            throw new LdapException(trans('errors.ldap_cannot_connect'));
+        }
+
+        // Set any required options
+        if ($config->get('version')) {
+            $ldapConnection->setVersion($config->get('version'));
+        }
+
+        // Start and verify TLS if it's enabled
+        if ($config->get('start_tls')) {
+            try {
+                $tlsStarted = $ldapConnection->startTls();
+            } catch (ErrorException $exception) {
+                $tlsStarted = false;
+            }
+
+            if (!$tlsStarted) {
+                throw new LdapException('Could not start TLS connection');
+            }
+        }
+
+        return $ldapConnection;
+    }
+}

app/Auth/Access/Ldap/LdapService.php

@@ -1,12 +1,13 @@
 <?php
 
-namespace BookStack\Access;
+namespace BookStack\Auth\Access\Ldap;
 
+use BookStack\Auth\Access\GroupSyncService;
+use BookStack\Auth\User;
 use BookStack\Exceptions\JsonDebugException;
 use BookStack\Exceptions\LdapException;
+use BookStack\Exceptions\LdapFailedBindException;
 use BookStack\Uploads\UserAvatars;
-use BookStack\Users\Models\User;
-use ErrorException;
 use Illuminate\Support\Facades\Log;
 
 /**
@@ -15,29 +16,18 @@ use Illuminate\Support\Facades\Log;
  */
 class LdapService
 {
-    /**
-     * @var resource|\LDAP\Connection
-     */
-    protected $ldapConnection;
+    protected LdapConnectionManager $ldap;
+    protected GroupSyncService $groupSyncService;
+    protected UserAvatars $userAvatars;
 
-    protected array $config;
-    protected bool $enabled;
+    protected LdapConfig $config;
 
-    public function __construct(
-        protected Ldap $ldap,
-        protected UserAvatars $userAvatars,
-        protected GroupSyncService $groupSyncService
-    ) {
-        $this->config = config('services.ldap');
-        $this->enabled = config('auth.method') === 'ldap';
-    }
-
-    /**
-     * Check if groups should be synced.
-     */
-    public function shouldSyncGroups(): bool
+    public function __construct(LdapConnectionManager $ldap, UserAvatars $userAvatars, GroupSyncService $groupSyncService)
     {
-        return $this->enabled && $this->config['user_to_groups'] !== false;
+        $this->ldap = $ldap;
+        $this->userAvatars = $userAvatars;
+        $this->groupSyncService = $groupSyncService;
+        $this->config = new LdapConfig(config('services.ldap'));
     }
 
     /**
@@ -45,25 +35,24 @@ class LdapService
      *
      * @throws LdapException
      */
-    private function getUserWithAttributes(string $userName, array $attributes): ?array
+    protected function getUserWithAttributes(string $userName, array $attributes): ?array
     {
-        $ldapConnection = $this->getConnection();
-        $this->bindSystemUser($ldapConnection);
+        $connection = $this->ldap->startSystemBind($this->config);
 
         // Clean attributes
         foreach ($attributes as $index => $attribute) {
-            if (str_starts_with($attribute, 'BIN;')) {
+            if (strpos($attribute, 'BIN;') === 0) {
                 $attributes[$index] = substr($attribute, strlen('BIN;'));
             }
         }
 
         // Find user
-        $userFilter = $this->buildFilter($this->config['user_filter'], ['user' => $userName]);
-        $baseDn = $this->config['base_dn'];
+        $userFilter = $this->buildFilter($this->config->get('user_filter'), ['user' => $userName]);
+        $baseDn = $this->config->get('base_dn');
 
-        $followReferrals = $this->config['follow_referrals'] ? 1 : 0;
-        $this->ldap->setOption($ldapConnection, LDAP_OPT_REFERRALS, $followReferrals);
-        $users = $this->ldap->searchAndGetEntries($ldapConnection, $baseDn, $userFilter, $attributes);
+        $followReferrals = $this->config->get('follow_referrals') ? 1 : 0;
+        $connection->setOption(LDAP_OPT_REFERRALS, $followReferrals);
+        $users = $connection->searchAndGetEntries($baseDn, $userFilter, $attributes);
         if ($users['count'] === 0) {
             return null;
         }
@@ -75,14 +64,14 @@ class LdapService
      * Get the details of a user from LDAP using the given username.
      * User found via configurable user filter.
      *
-     * @throws LdapException|JsonDebugException
+     * @throws LdapException
      */
     public function getUserDetails(string $userName): ?array
     {
-        $idAttr = $this->config['id_attribute'];
-        $emailAttr = $this->config['email_attribute'];
-        $displayNameAttr = $this->config['display_name_attribute'];
-        $thumbnailAttr = $this->config['thumbnail_attribute'];
+        $idAttr = $this->config->get('id_attribute');
+        $emailAttr = $this->config->get('email_attribute');
+        $displayNameAttr = $this->config->get('display_name_attribute');
+        $thumbnailAttr = $this->config->get('thumbnail_attribute');
 
         $user = $this->getUserWithAttributes($userName, array_filter([
             'cn', 'dn', $idAttr, $emailAttr, $displayNameAttr, $thumbnailAttr,
@@ -101,7 +90,7 @@ class LdapService
             'avatar' => $thumbnailAttr ? $this->getUserResponseProperty($user, $thumbnailAttr, null) : null,
         ];
 
-        if ($this->config['dump_user_details']) {
+        if ($this->config->get('dump_user_details')) {
             throw new JsonDebugException([
                 'details_from_ldap'        => $user,
                 'details_bookstack_parsed' => $formatted,
@@ -119,7 +108,7 @@ class LdapService
      */
     protected function getUserResponseProperty(array $userDetails, string $propertyKey, $defaultValue)
     {
-        $isBinary = str_starts_with($propertyKey, 'BIN;');
+        $isBinary = strpos($propertyKey, 'BIN;') === 0;
         $propertyKey = strtolower($propertyKey);
         $value = $defaultValue;
 
@@ -148,103 +137,15 @@ class LdapService
             return false;
         }
 
-        $ldapConnection = $this->getConnection();
-
         try {
-            $ldapBind = $this->ldap->bind($ldapConnection, $ldapUserDetails['dn'], $password);
-        } catch (ErrorException $e) {
-            $ldapBind = false;
+            $this->ldap->startBind($ldapUserDetails['dn'], $password, $this->config);
+        } catch (LdapFailedBindException $e) {
+            return false;
+        } catch (LdapException $e) {
+            throw $e;
         }
 
-        return $ldapBind;
-    }
-
-    /**
-     * Bind the system user to the LDAP connection using the given credentials
-     * otherwise anonymous access is attempted.
-     *
-     * @param resource|\LDAP\Connection $connection
-     *
-     * @throws LdapException
-     */
-    protected function bindSystemUser($connection): void
-    {
-        $ldapDn = $this->config['dn'];
-        $ldapPass = $this->config['pass'];
-
-        $isAnonymous = ($ldapDn === false || $ldapPass === false);
-        if ($isAnonymous) {
-            $ldapBind = $this->ldap->bind($connection);
-        } else {
-            $ldapBind = $this->ldap->bind($connection, $ldapDn, $ldapPass);
-        }
-
-        if (!$ldapBind) {
-            throw new LdapException(($isAnonymous ? trans('errors.ldap_fail_anonymous') : trans('errors.ldap_fail_authed')));
-        }
-    }
-
-    /**
-     * Get the connection to the LDAP server.
-     * Creates a new connection if one does not exist.
-     *
-     * @throws LdapException
-     *
-     * @return resource|\LDAP\Connection
-     */
-    protected function getConnection()
-    {
-        if ($this->ldapConnection !== null) {
-            return $this->ldapConnection;
-        }
-
-        // Check LDAP extension in installed
-        if (!function_exists('ldap_connect') && config('app.env') !== 'testing') {
-            throw new LdapException(trans('errors.ldap_extension_not_installed'));
-        }
-
-        // Disable certificate verification.
-        // This option works globally and must be set before a connection is created.
-        if ($this->config['tls_insecure']) {
-            $this->ldap->setOption(null, LDAP_OPT_X_TLS_REQUIRE_CERT, LDAP_OPT_X_TLS_NEVER);
-        }
-
-        $ldapHost = $this->parseServerString($this->config['server']);
-        $ldapConnection = $this->ldap->connect($ldapHost);
-
-        if ($ldapConnection === false) {
-            throw new LdapException(trans('errors.ldap_cannot_connect'));
-        }
-
-        // Set any required options
-        if ($this->config['version']) {
-            $this->ldap->setVersion($ldapConnection, $this->config['version']);
-        }
-
-        // Start and verify TLS if it's enabled
-        if ($this->config['start_tls']) {
-            $started = $this->ldap->startTls($ldapConnection);
-            if (!$started) {
-                throw new LdapException('Could not start TLS connection');
-            }
-        }
-
-        $this->ldapConnection = $ldapConnection;
-
-        return $this->ldapConnection;
-    }
-
-    /**
-     * Parse an LDAP server string and return the host suitable for a connection.
-     * Is flexible to formats such as 'ldap.example.com:8069' or 'ldaps://ldap.example.com'.
-     */
-    protected function parseServerString(string $serverString): string
-    {
-        if (str_starts_with($serverString, 'ldaps://') || str_starts_with($serverString, 'ldap://')) {
-            return $serverString;
-        }
-
-        return "ldap://{$serverString}";
+        return true;
     }
 
     /**
@@ -255,7 +156,7 @@ class LdapService
         $newAttrs = [];
         foreach ($attrs as $key => $attrText) {
             $newKey = '${' . $key . '}';
-            $newAttrs[$newKey] = $this->ldap->escape($attrText);
+            $newAttrs[$newKey] = LdapConnection::escape($attrText);
         }
 
         return strtr($filterString, $newAttrs);
@@ -269,7 +170,7 @@ class LdapService
      */
     public function getUserGroups(string $userName): array
     {
-        $groupsAttr = $this->config['group_attribute'];
+        $groupsAttr = $this->config->get('group_attribute');
         $user = $this->getUserWithAttributes($userName, [$groupsAttr]);
 
         if ($user === null) {
@@ -279,7 +180,7 @@ class LdapService
         $userGroups = $this->groupFilter($user);
         $allGroups = $this->getGroupsRecursive($userGroups, []);
 
-        if ($this->config['dump_user_groups']) {
+        if ($this->config->get('dump_user_groups')) {
             throw new JsonDebugException([
                 'details_from_ldap'             => $user,
                 'parsed_direct_user_groups'     => $userGroups,
@@ -324,17 +225,16 @@ class LdapService
      */
     private function getGroupGroups(string $groupName): array
     {
-        $ldapConnection = $this->getConnection();
-        $this->bindSystemUser($ldapConnection);
+        $connection = $this->ldap->startSystemBind($this->config);
 
-        $followReferrals = $this->config['follow_referrals'] ? 1 : 0;
-        $this->ldap->setOption($ldapConnection, LDAP_OPT_REFERRALS, $followReferrals);
+        $followReferrals = $this->config->get('follow_referrals') ? 1 : 0;
+        $connection->setOption(LDAP_OPT_REFERRALS, $followReferrals);
 
-        $baseDn = $this->config['base_dn'];
-        $groupsAttr = strtolower($this->config['group_attribute']);
+        $baseDn = $this->config->get('base_dn');
+        $groupsAttr = strtolower($this->config->get('group_attribute'));
 
-        $groupFilter = 'CN=' . $this->ldap->escape($groupName);
-        $groups = $this->ldap->searchAndGetEntries($ldapConnection, $baseDn, $groupFilter, [$groupsAttr]);
+        $groupFilter = 'CN=' . LdapConnection::escape($groupName);
+        $groups = $connection->searchAndGetEntries($baseDn, $groupFilter, [$groupsAttr]);
         if ($groups['count'] === 0) {
             return [];
         }
@@ -348,7 +248,7 @@ class LdapService
      */
     protected function groupFilter(array $userGroupSearchResponse): array
     {
-        $groupsAttr = strtolower($this->config['group_attribute']);
+        $groupsAttr = strtolower($this->config->get('group_attribute'));
         $ldapGroups = [];
         $count = 0;
 
@@ -357,7 +257,7 @@ class LdapService
         }
 
         for ($i = 0; $i < $count; $i++) {
-            $dnComponents = $this->ldap->explodeDn($userGroupSearchResponse[$groupsAttr][$i], 1);
+            $dnComponents = LdapConnection::explodeDn($userGroupSearchResponse[$groupsAttr][$i], 1);
             if (!in_array($dnComponents[0], $ldapGroups)) {
                 $ldapGroups[] = $dnComponents[0];
             }
@@ -372,10 +272,18 @@ class LdapService
      * @throws LdapException
      * @throws JsonDebugException
      */
-    public function syncGroups(User $user, string $username): void
+    public function syncGroups(User $user, string $username)
     {
         $userLdapGroups = $this->getUserGroups($username);
-        $this->groupSyncService->syncUserWithFoundGroups($user, $userLdapGroups, $this->config['remove_from_groups']);
+        $this->groupSyncService->syncUserWithFoundGroups($user, $userLdapGroups, $this->config->get('remove_from_groups'));
+    }
+
+    /**
+     * Check if groups should be synced.
+     */
+    public function shouldSyncGroups(): bool
+    {
+        return $this->config->get('user_to_groups') !== false;
     }
 
     /**
@@ -384,7 +292,7 @@ class LdapService
      */
     public function saveAndAttachAvatar(User $user, array $ldapUserDetails): void
     {
-        if (is_null(config('services.ldap.thumbnail_attribute')) || is_null($ldapUserDetails['avatar'])) {
+        if (is_null($this->config->get('thumbnail_attribute')) || is_null($ldapUserDetails['avatar'])) {
             return;
         }
 

app/Auth/Access/LoginService.php

@@ -1,15 +1,15 @@
 <?php
 
-namespace BookStack\Access;
+namespace BookStack\Auth\Access;
 
-use BookStack\Access\Mfa\MfaSession;
-use BookStack\Activity\ActivityType;
+use BookStack\Actions\ActivityType;
+use BookStack\Auth\Access\Mfa\MfaSession;
+use BookStack\Auth\User;
 use BookStack\Exceptions\LoginAttemptException;
 use BookStack\Exceptions\StoppedAuthenticationException;
 use BookStack\Facades\Activity;
 use BookStack\Facades\Theme;
 use BookStack\Theming\ThemeEvents;
-use BookStack\Users\Models\User;
 use Exception;
 
 class LoginService

app/Auth/Access/Mfa/BackupCodeService.php

@@ -1,6 +1,6 @@
 <?php
 
-namespace BookStack\Access\Mfa;
+namespace BookStack\Auth\Access\Mfa;
 
 use Illuminate\Support\Str;
 

app/Auth/Access/Mfa/MfaSession.php

@@ -1,8 +1,8 @@
 <?php
 
-namespace BookStack\Access\Mfa;
+namespace BookStack\Auth\Access\Mfa;
 
-use BookStack\Users\Models\User;
+use BookStack\Auth\User;
 
 class MfaSession
 {

app/Auth/Access/Mfa/MfaValue.php

@@ -1,8 +1,8 @@
 <?php
 
-namespace BookStack\Access\Mfa;
+namespace BookStack\Auth\Access\Mfa;
 
-use BookStack\Users\Models\User;
+use BookStack\Auth\User;
 use Carbon\Carbon;
 use Illuminate\Database\Eloquent\Model;
 

app/Auth/Access/Mfa/TotpService.php

@@ -1,6 +1,6 @@
 <?php
 
-namespace BookStack\Access\Mfa;
+namespace BookStack\Auth\Access\Mfa;
 
 use BaconQrCode\Renderer\Color\Rgb;
 use BaconQrCode\Renderer\Image\SvgImageBackEnd;
@@ -8,7 +8,7 @@ use BaconQrCode\Renderer\ImageRenderer;
 use BaconQrCode\Renderer\RendererStyle\Fill;
 use BaconQrCode\Renderer\RendererStyle\RendererStyle;
 use BaconQrCode\Writer;
-use BookStack\Users\Models\User;
+use BookStack\Auth\User;
 use PragmaRX\Google2FA\Google2FA;
 use PragmaRX\Google2FA\Support\Constants;
 

app/Auth/Access/Mfa/TotpValidationRule.php

@@ -1,6 +1,6 @@
 <?php
 
-namespace BookStack\Access\Mfa;
+namespace BookStack\Auth\Access\Mfa;
 
 use Illuminate\Contracts\Validation\Rule;
 

app/Auth/Access/Oidc/OidcAccessToken.php

@@ -1,6 +1,6 @@
 <?php
 
-namespace BookStack\Access\Oidc;
+namespace BookStack\Auth\Access\Oidc;
 
 use InvalidArgumentException;
 use League\OAuth2\Client\Token\AccessToken;

app/Auth/Access/Oidc/OidcException.php

@@ -1,6 +1,6 @@
 <?php
 
-namespace BookStack\Access\Oidc;
+namespace BookStack\Auth\Access\Oidc;
 
 use Exception;
 

app/Auth/Access/Oidc/OidcIdToken.php

@@ -1,19 +1,38 @@
 <?php
 
-namespace BookStack\Access\Oidc;
+namespace BookStack\Auth\Access\Oidc;
 
 class OidcIdToken
 {
-    protected array $header;
-    protected array $payload;
-    protected string $signature;
-    protected string $issuer;
-    protected array $tokenParts = [];
+    /**
+     * @var array
+     */
+    protected $header;
+
+    /**
+     * @var array
+     */
+    protected $payload;
+
+    /**
+     * @var string
+     */
+    protected $signature;
 
     /**
      * @var array[]|string[]
      */
-    protected array $keys;
+    protected $keys;
+
+    /**
+     * @var string
+     */
+    protected $issuer;
+
+    /**
+     * @var array
+     */
+    protected $tokenParts = [];
 
     public function __construct(string $token, string $issuer, array $keys)
     {
@@ -87,14 +106,6 @@ class OidcIdToken
         return $this->payload;
     }
 
-    /**
-     * Replace the existing claim data of this token with that provided.
-     */
-    public function replaceClaims(array $claims): void
-    {
-        $this->payload = $claims;
-    }
-
     /**
      * Validate the structure of the given token and ensure we have the required pieces.
      * As per https://datatracker.ietf.org/doc/html/rfc7519#section-7.2.

app/Auth/Access/Oidc/OidcInvalidKeyException.php

@@ -1,6 +1,6 @@
 <?php
 
-namespace BookStack\Access\Oidc;
+namespace BookStack\Auth\Access\Oidc;
 
 class OidcInvalidKeyException extends \Exception
 {

app/Auth/Access/Oidc/OidcInvalidTokenException.php

@@ -1,6 +1,6 @@
 <?php
 
-namespace BookStack\Access\Oidc;
+namespace BookStack\Auth\Access\Oidc;
 
 use Exception;
 

app/Auth/Access/Oidc/OidcIssuerDiscoveryException.php

@@ -1,6 +1,6 @@
 <?php
 
-namespace BookStack\Access\Oidc;
+namespace BookStack\Auth\Access\Oidc;
 
 use Exception;
 

app/Auth/Access/Oidc/OidcJwtSigningKey.php

@@ -1,6 +1,6 @@
 <?php
 
-namespace BookStack\Access\Oidc;
+namespace BookStack\Auth\Access\Oidc;
 
 use phpseclib3\Crypt\Common\PublicKey;
 use phpseclib3\Crypt\PublicKeyLoader;
@@ -67,10 +67,11 @@ class OidcJwtSigningKey
             throw new OidcInvalidKeyException("Only RS256 keys are currently supported. Found key using {$alg}");
         }
 
-        // 'use' is optional for a JWK but we assume 'sig' where no value exists since that's what
-        // the OIDC discovery spec infers since 'sig' MUST be set if encryption keys come into play.
-        $use = $jwk['use'] ?? 'sig';
-        if ($use !== 'sig') {
+        if (empty($jwk['use'])) {
+            throw new OidcInvalidKeyException('A "use" parameter on the provided key is expected');
+        }
+
+        if ($jwk['use'] !== 'sig') {
             throw new OidcInvalidKeyException("Only signature keys are currently supported. Found key for use {$jwk['use']}");
         }
 

app/Auth/Access/Oidc/OidcOAuthProvider.php

@@ -1,6 +1,6 @@
 <?php
 
-namespace BookStack\Access\Oidc;
+namespace BookStack\Auth\Access\Oidc;
 
 use League\OAuth2\Client\Grant\AbstractGrant;
 use League\OAuth2\Client\Provider\AbstractProvider;

app/Auth/Access/Oidc/OidcProviderSettings.php

@@ -1,6 +1,6 @@
 <?php
 
-namespace BookStack\Access\Oidc;
+namespace BookStack\Auth\Access\Oidc;
 
 use GuzzleHttp\Psr7\Request;
 use Illuminate\Contracts\Cache\Repository;
@@ -15,17 +15,40 @@ use Psr\Http\Client\ClientInterface;
  */
 class OidcProviderSettings
 {
-    public string $issuer;
-    public string $clientId;
-    public string $clientSecret;
-    public ?string $redirectUri;
-    public ?string $authorizationEndpoint;
-    public ?string $tokenEndpoint;
+    /**
+     * @var string
+     */
+    public $issuer;
+
+    /**
+     * @var string
+     */
+    public $clientId;
+
+    /**
+     * @var string
+     */
+    public $clientSecret;
+
+    /**
+     * @var string
+     */
+    public $redirectUri;
+
+    /**
+     * @var string
+     */
+    public $authorizationEndpoint;
+
+    /**
+     * @var string
+     */
+    public $tokenEndpoint;
 
     /**
      * @var string[]|array[]
      */
-    public ?array $keys = [];
+    public $keys = [];
 
     public function __construct(array $settings)
     {
@@ -141,10 +164,9 @@ class OidcProviderSettings
     protected function filterKeys(array $keys): array
     {
         return array_filter($keys, function (array $key) {
-            $alg = $key['alg'] ?? 'RS256';
-            $use = $key['use'] ?? 'sig';
+            $alg = $key['alg'] ?? null;
 
-            return $key['kty'] === 'RSA' && $use === 'sig' && $alg === 'RS256';
+            return $key['kty'] === 'RSA' && $key['use'] === 'sig' && (is_null($alg) || $alg === 'RS256');
         });
     }
 

app/Auth/Access/Oidc/OidcService.php

@@ -1,16 +1,14 @@
 <?php
 
-namespace BookStack\Access\Oidc;
+namespace BookStack\Auth\Access\Oidc;
 
-use BookStack\Access\GroupSyncService;
-use BookStack\Access\LoginService;
-use BookStack\Access\RegistrationService;
+use BookStack\Auth\Access\GroupSyncService;
+use BookStack\Auth\Access\LoginService;
+use BookStack\Auth\Access\RegistrationService;
+use BookStack\Auth\User;
 use BookStack\Exceptions\JsonDebugException;
 use BookStack\Exceptions\StoppedAuthenticationException;
 use BookStack\Exceptions\UserRegistrationException;
-use BookStack\Facades\Theme;
-use BookStack\Theming\ThemeEvents;
-use BookStack\Users\Models\User;
 use Illuminate\Support\Arr;
 use Illuminate\Support\Facades\Cache;
 use League\OAuth2\Client\OptionProvider\HttpBasicAuthOptionProvider;
@@ -23,12 +21,24 @@ use Psr\Http\Client\ClientInterface as HttpClient;
  */
 class OidcService
 {
+    protected RegistrationService $registrationService;
+    protected LoginService $loginService;
+    protected HttpClient $httpClient;
+    protected GroupSyncService $groupService;
+
+    /**
+     * OpenIdService constructor.
+     */
     public function __construct(
-        protected RegistrationService $registrationService,
-        protected LoginService $loginService,
-        protected HttpClient $httpClient,
-        protected GroupSyncService $groupService
+        RegistrationService $registrationService,
+        LoginService $loginService,
+        HttpClient $httpClient,
+        GroupSyncService $groupService
     ) {
+        $this->registrationService = $registrationService;
+        $this->loginService = $loginService;
+        $this->httpClient = $httpClient;
+        $this->groupService = $groupService;
     }
 
     /**
@@ -42,6 +52,7 @@ class OidcService
     {
         $settings = $this->getProviderSettings();
         $provider = $this->getProvider($settings);
+
         return [
             'url'   => $provider->getAuthorizationUrl(),
             'state' => $provider->getState(),
@@ -188,8 +199,7 @@ class OidcService
      */
     protected function getUserDetails(OidcIdToken $token): array
     {
-        $idClaim = $this->config()['external_id_claim'];
-        $id = $token->getClaim($idClaim);
+        $id = $token->getClaim('sub');
 
         return [
             'external_id' => $id,
@@ -216,16 +226,6 @@ class OidcService
             $settings->keys,
         );
 
-        $returnClaims = Theme::dispatch(ThemeEvents::OIDC_ID_TOKEN_PRE_VALIDATE, $idToken->getAllClaims(), [
-            'access_token' => $accessToken->getToken(),
-            'expires_in' => $accessToken->getExpires(),
-            'refresh_token' => $accessToken->getRefreshToken(),
-        ]);
-
-        if (!is_null($returnClaims)) {
-            $idToken->replaceClaims($returnClaims);
-        }
-
         if ($this->config()['dump_user_details']) {
             throw new JsonDebugException($idToken->getAllClaims());
         }

app/Auth/Access/RegistrationService.php

@@ -1,14 +1,15 @@
 <?php
 
-namespace BookStack\Access;
+namespace BookStack\Auth\Access;
 
-use BookStack\Activity\ActivityType;
+use BookStack\Actions\ActivityType;
+use BookStack\Auth\SocialAccount;
+use BookStack\Auth\User;
+use BookStack\Auth\UserRepo;
 use BookStack\Exceptions\UserRegistrationException;
 use BookStack\Facades\Activity;
 use BookStack\Facades\Theme;
 use BookStack\Theming\ThemeEvents;
-use BookStack\Users\Models\User;
-use BookStack\Users\UserRepo;
 use Exception;
 use Illuminate\Support\Str;
 

app/Auth/Access/Saml2Service.php

@@ -1,12 +1,12 @@
 <?php
 
-namespace BookStack\Access;
+namespace BookStack\Auth\Access;
 
+use BookStack\Auth\User;
 use BookStack\Exceptions\JsonDebugException;
 use BookStack\Exceptions\SamlException;
 use BookStack\Exceptions\StoppedAuthenticationException;
 use BookStack\Exceptions\UserRegistrationException;
-use BookStack\Users\Models\User;
 use Exception;
 use OneLogin\Saml2\Auth;
 use OneLogin\Saml2\Constants;
@@ -67,7 +67,7 @@ class Saml2Service
                 $returnRoute,
                 [],
                 $user->email,
-                session()->get('saml2_session_index'),
+                null,
                 true,
                 Constants::NAMEID_EMAIL_ADDRESS
             );
@@ -118,7 +118,6 @@ class Saml2Service
 
         $attrs = $toolkit->getAttributes();
         $id = $toolkit->getNameId();
-        session()->put('saml2_session_index', $toolkit->getSessionIndex());
 
         return $this->processLoginCallback($id, $attrs);
     }

app/Auth/Access/SocialAuthService.php

@@ -1,12 +1,12 @@
 <?php
 
-namespace BookStack\Access;
+namespace BookStack\Auth\Access;
 
-use BookStack\Auth\Access\handler;
+use BookStack\Auth\SocialAccount;
+use BookStack\Auth\User;
 use BookStack\Exceptions\SocialDriverNotConfigured;
 use BookStack\Exceptions\SocialSignInAccountNotUsed;
 use BookStack\Exceptions\UserRegistrationException;
-use BookStack\Users\Models\User;
 use Illuminate\Support\Facades\Event;
 use Illuminate\Support\Str;
 use Laravel\Socialite\Contracts\Factory as Socialite;

app/Auth/Access/UserInviteService.php

@@ -1,18 +1,20 @@
 <?php
 
-namespace BookStack\Access;
+namespace BookStack\Auth\Access;
 
+use BookStack\Auth\User;
 use BookStack\Notifications\UserInvite;
-use BookStack\Users\Models\User;
 
 class UserInviteService extends UserTokenService
 {
-    protected string $tokenTable = 'user_invites';
-    protected int $expiryTime = 336; // Two weeks
+    protected $tokenTable = 'user_invites';
+    protected $expiryTime = 336; // Two weeks
 
     /**
      * Send an invitation to a user to sign into BookStack
      * Removes existing invitation tokens.
+     *
+     * @param User $user
      */
     public function sendInvitation(User $user)
     {

app/Auth/Access/UserTokenService.php

@@ -1,10 +1,10 @@
 <?php
 
-namespace BookStack\Access;
+namespace BookStack\Auth\Access;
 
+use BookStack\Auth\User;
 use BookStack\Exceptions\UserTokenExpiredException;
 use BookStack\Exceptions\UserTokenNotFoundException;
-use BookStack\Users\Models\User;
 use Carbon\Carbon;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Str;
@@ -14,29 +14,41 @@ class UserTokenService
 {
     /**
      * Name of table where user tokens are stored.
+     *
+     * @var string
      */
-    protected string $tokenTable = 'user_tokens';
+    protected $tokenTable = 'user_tokens';
 
     /**
      * Token expiry time in hours.
+     *
+     * @var int
      */
-    protected int $expiryTime = 24;
+    protected $expiryTime = 24;
 
     /**
-     * Delete all tokens that belong to a user.
+     * Delete all email confirmations that belong to a user.
+     *
+     * @param User $user
+     *
+     * @return mixed
      */
-    public function deleteByUser(User $user): void
+    public function deleteByUser(User $user)
     {
-        DB::table($this->tokenTable)
+        return DB::table($this->tokenTable)
             ->where('user_id', '=', $user->id)
             ->delete();
     }
 
     /**
-     * Get the user id from a token, while checking the token exists and has not expired.
+     * Get the user id from a token, while check the token exists and has not expired.
+     *
+     * @param string $token
      *
      * @throws UserTokenNotFoundException
      * @throws UserTokenExpiredException
+     *
+     * @return int
      */
     public function checkTokenAndGetUserId(string $token): int
     {
@@ -55,6 +67,8 @@ class UserTokenService
 
     /**
      * Creates a unique token within the email confirmation database.
+     *
+     * @return string
      */
     protected function generateToken(): string
     {
@@ -68,6 +82,10 @@ class UserTokenService
 
     /**
      * Generate and store a token for the given user.
+     *
+     * @param User $user
+     *
+     * @return string
      */
     protected function createTokenForUser(User $user): string
     {
@@ -84,6 +102,10 @@ class UserTokenService
 
     /**
      * Check if the given token exists.
+     *
+     * @param string $token
+     *
+     * @return bool
      */
     protected function tokenExists(string $token): bool
     {
@@ -93,8 +115,12 @@ class UserTokenService
 
     /**
      * Get a token entry for the given token.
+     *
+     * @param string $token
+     *
+     * @return object|null
      */
-    protected function getEntryByToken(string $token): ?stdClass
+    protected function getEntryByToken(string $token)
     {
         return DB::table($this->tokenTable)
             ->where('token', '=', $token)
@@ -103,6 +129,10 @@ class UserTokenService
 
     /**
      * Check if the given token entry has expired.
+     *
+     * @param stdClass $tokenEntry
+     *
+     * @return bool
      */
     protected function entryExpired(stdClass $tokenEntry): bool
     {

app/Auth/Permissions/EntityPermission.php

@@ -1,10 +1,11 @@
 <?php
 
-namespace BookStack\Permissions\Models;
+namespace BookStack\Auth\Permissions;
 
-use BookStack\App\Model;
-use BookStack\Users\Models\Role;
+use BookStack\Auth\Role;
+use BookStack\Model;
 use Illuminate\Database\Eloquent\Relations\BelongsTo;
+use Illuminate\Database\Eloquent\Relations\MorphTo;
 
 /**
  * @property int $id
@@ -22,14 +23,14 @@ class EntityPermission extends Model
 
     protected $fillable = ['role_id', 'view', 'create', 'update', 'delete'];
     public $timestamps = false;
-    protected $hidden = ['entity_id', 'entity_type', 'id'];
-    protected $casts = [
-        'view' => 'boolean',
-        'create' => 'boolean',
-        'read' => 'boolean',
-        'update' => 'boolean',
-        'delete' => 'boolean',
-    ];
+
+    /**
+     * Get this restriction's attached entity.
+     */
+    public function restrictable(): MorphTo
+    {
+        return $this->morphTo('restrictable');
+    }
 
     /**
      * Get the role assigned to this entity permission.

app/Auth/Permissions/JointPermission.php

@@ -1,10 +1,10 @@
 <?php
 
-namespace BookStack\Permissions\Models;
+namespace BookStack\Auth\Permissions;
 
-use BookStack\App\Model;
+use BookStack\Auth\Role;
 use BookStack\Entities\Models\Entity;
-use BookStack\Users\Models\Role;
+use BookStack\Model;
 use Illuminate\Database\Eloquent\Relations\BelongsTo;
 use Illuminate\Database\Eloquent\Relations\MorphOne;
 

app/Auth/Permissions/JointPermissionBuilder.php

@@ -1,15 +1,14 @@
 <?php
 
-namespace BookStack\Permissions;
+namespace BookStack\Auth\Permissions;
 
+use BookStack\Auth\Role;
 use BookStack\Entities\Models\Book;
 use BookStack\Entities\Models\BookChild;
 use BookStack\Entities\Models\Bookshelf;
 use BookStack\Entities\Models\Chapter;
 use BookStack\Entities\Models\Entity;
 use BookStack\Entities\Models\Page;
-use BookStack\Permissions\Models\JointPermission;
-use BookStack\Users\Models\Role;
 use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Database\Eloquent\Collection as EloquentCollection;
 use Illuminate\Support\Facades\DB;
@@ -20,6 +19,11 @@ use Illuminate\Support\Facades\DB;
  */
 class JointPermissionBuilder
 {
+    /**
+     * @var array<string, array<int, SimpleEntityData>>
+     */
+    protected $entityCache;
+
     /**
      * Re-generate all entity permission from scratch.
      */
@@ -94,6 +98,40 @@ class JointPermissionBuilder
             });
     }
 
+    /**
+     * Prepare the local entity cache and ensure it's empty.
+     *
+     * @param SimpleEntityData[] $entities
+     */
+    protected function readyEntityCache(array $entities)
+    {
+        $this->entityCache = [];
+
+        foreach ($entities as $entity) {
+            if (!isset($this->entityCache[$entity->type])) {
+                $this->entityCache[$entity->type] = [];
+            }
+
+            $this->entityCache[$entity->type][$entity->id] = $entity;
+        }
+    }
+
+    /**
+     * Get a book via ID, Checks local cache.
+     */
+    protected function getBook(int $bookId): SimpleEntityData
+    {
+        return $this->entityCache['book'][$bookId];
+    }
+
+    /**
+     * Get a chapter via ID, Checks local cache.
+     */
+    protected function getChapter(int $chapterId): SimpleEntityData
+    {
+        return $this->entityCache['chapter'][$chapterId];
+    }
+
     /**
      * Get a query for fetching a book with its children.
      */
@@ -102,7 +140,6 @@ class JointPermissionBuilder
         return Book::query()->withTrashed()
             ->select(['id', 'owned_by'])->with([
                 'chapters' => function ($query) {
-                    $query->withTrashed()->select(['id', 'owned_by', 'book_id']);
                 },
                 'pages' => function ($query) {
                     $query->withTrashed()->select(['id', 'owned_by', 'book_id', 'chapter_id']);
@@ -176,7 +213,13 @@ class JointPermissionBuilder
         $simpleEntities = [];
 
         foreach ($entities as $entity) {
-            $simple = SimpleEntityData::fromEntity($entity);
+            $attrs = $entity->getAttributes();
+            $simple = new SimpleEntityData();
+            $simple->id = $attrs['id'];
+            $simple->type = $entity->getMorphClass();
+            $simple->owned_by = $attrs['owned_by'] ?? 0;
+            $simple->book_id = $attrs['book_id'] ?? null;
+            $simple->chapter_id = $attrs['chapter_id'] ?? null;
             $simpleEntities[] = $simple;
         }
 
@@ -186,16 +229,24 @@ class JointPermissionBuilder
     /**
      * Create & Save entity jointPermissions for many entities and roles.
      *
-     * @param Entity[] $originalEntities
+     * @param Entity[] $entities
      * @param Role[]   $roles
      */
     protected function createManyJointPermissions(array $originalEntities, array $roles)
     {
         $entities = $this->entitiesToSimpleEntities($originalEntities);
+        $this->readyEntityCache($entities);
         $jointPermissions = [];
 
         // Fetch related entity permissions
-        $permissions = new MassEntityPermissionEvaluator($entities, 'view');
+        $permissions = $this->getEntityPermissionsForEntities($entities);
+
+        // Create a mapping of explicit entity permissions
+        $permissionMap = [];
+        foreach ($permissions as $permission) {
+            $key = $permission->entity_type . ':' . $permission->entity_id . ':' . $permission->role_id;
+            $permissionMap[$key] = $permission->view;
+        }
 
         // Create a mapping of role permissions
         $rolePermissionMap = [];
@@ -208,14 +259,13 @@ class JointPermissionBuilder
         // Create Joint Permission Data
         foreach ($entities as $entity) {
             foreach ($roles as $role) {
-                $jp = $this->createJointPermissionData(
+                $jointPermissions[] = $this->createJointPermissionData(
                     $entity,
                     $role->getRawAttribute('id'),
-                    $permissions,
+                    $permissionMap,
                     $rolePermissionMap,
                     $role->system_name === 'admin'
                 );
-                $jointPermissions[] = $jp;
             }
         }
 
@@ -249,45 +299,109 @@ class JointPermissionBuilder
         return $idsByType;
     }
 
+    /**
+     * Get the entity permissions for all the given entities.
+     *
+     * @param SimpleEntityData[] $entities
+     *
+     * @return EntityPermission[]
+     */
+    protected function getEntityPermissionsForEntities(array $entities): array
+    {
+        $idsByType = $this->entitiesToTypeIdMap($entities);
+        $permissionFetch = EntityPermission::query()
+            ->where(function (Builder $query) use ($idsByType) {
+                foreach ($idsByType as $type => $ids) {
+                    $query->orWhere(function (Builder $query) use ($type, $ids) {
+                        $query->where('entity_type', '=', $type)->whereIn('entity_id', $ids);
+                    });
+                }
+            });
+
+        return $permissionFetch->get()->all();
+    }
+
     /**
      * Create entity permission data for an entity and role
      * for a particular action.
      */
-    protected function createJointPermissionData(SimpleEntityData $entity, int $roleId, MassEntityPermissionEvaluator $permissionMap, array $rolePermissionMap, bool $isAdminRole): array
+    protected function createJointPermissionData(SimpleEntityData $entity, int $roleId, array $permissionMap, array $rolePermissionMap, bool $isAdminRole): array
     {
-        // Ensure system admin role retains permissions
-        if ($isAdminRole) {
-            return $this->createJointPermissionDataArray($entity, $roleId, PermissionStatus::EXPLICIT_ALLOW, true);
-        }
-
-        // Return evaluated entity permission status if it has an affect.
-        $entityPermissionStatus = $permissionMap->evaluateEntityForRole($entity, $roleId);
-        if ($entityPermissionStatus !== null) {
-            return $this->createJointPermissionDataArray($entity, $roleId, $entityPermissionStatus, false);
-        }
-
-        // Otherwise default to the role-level permissions
         $permissionPrefix = $entity->type . '-view';
         $roleHasPermission = isset($rolePermissionMap[$roleId . ':' . $permissionPrefix . '-all']);
         $roleHasPermissionOwn = isset($rolePermissionMap[$roleId . ':' . $permissionPrefix . '-own']);
-        $status = $roleHasPermission ? PermissionStatus::IMPLICIT_ALLOW : PermissionStatus::IMPLICIT_DENY;
-        return $this->createJointPermissionDataArray($entity, $roleId, $status, $roleHasPermissionOwn);
+
+        if ($isAdminRole) {
+            return $this->createJointPermissionDataArray($entity, $roleId, true, true);
+        }
+
+        if ($this->entityPermissionsActiveForRole($permissionMap, $entity, $roleId)) {
+            $hasAccess = $this->mapHasActiveRestriction($permissionMap, $entity, $roleId);
+
+            return $this->createJointPermissionDataArray($entity, $roleId, $hasAccess, $hasAccess);
+        }
+
+        if ($entity->type === 'book' || $entity->type === 'bookshelf') {
+            return $this->createJointPermissionDataArray($entity, $roleId, $roleHasPermission, $roleHasPermissionOwn);
+        }
+
+        // For chapters and pages, Check if explicit permissions are set on the Book.
+        $book = $this->getBook($entity->book_id);
+        $hasExplicitAccessToParents = $this->mapHasActiveRestriction($permissionMap, $book, $roleId);
+        $hasPermissiveAccessToParents = !$this->entityPermissionsActiveForRole($permissionMap, $book, $roleId);
+
+        // For pages with a chapter, Check if explicit permissions are set on the Chapter
+        if ($entity->type === 'page' && $entity->chapter_id !== 0) {
+            $chapter = $this->getChapter($entity->chapter_id);
+            $chapterRestricted = $this->entityPermissionsActiveForRole($permissionMap, $chapter, $roleId);
+            $hasPermissiveAccessToParents = $hasPermissiveAccessToParents && !$chapterRestricted;
+            if ($chapterRestricted) {
+                $hasExplicitAccessToParents = $this->mapHasActiveRestriction($permissionMap, $chapter, $roleId);
+            }
+        }
+
+        return $this->createJointPermissionDataArray(
+            $entity,
+            $roleId,
+            ($hasExplicitAccessToParents || ($roleHasPermission && $hasPermissiveAccessToParents)),
+            ($hasExplicitAccessToParents || ($roleHasPermissionOwn && $hasPermissiveAccessToParents))
+        );
+    }
+
+    /**
+     * Check if entity permissions are defined within the given map, for the given entity and role.
+     * Checks for the default `role_id=0` backup option as a fallback.
+     */
+    protected function entityPermissionsActiveForRole(array $permissionMap, SimpleEntityData $entity, int $roleId): bool
+    {
+        $keyPrefix = $entity->type . ':' . $entity->id . ':';
+        return isset($permissionMap[$keyPrefix . $roleId]) || isset($permissionMap[$keyPrefix . '0']);
+    }
+
+    /**
+     * Check for an active restriction in an entity map.
+     */
+    protected function mapHasActiveRestriction(array $entityMap, SimpleEntityData $entity, int $roleId): bool
+    {
+        $roleKey = $entity->type . ':' . $entity->id . ':' . $roleId;
+        $defaultKey = $entity->type . ':' . $entity->id . ':0';
+
+        return $entityMap[$roleKey] ?? $entityMap[$defaultKey] ?? false;
     }
 
     /**
      * Create an array of data with the information of an entity jointPermissions.
      * Used to build data for bulk insertion.
      */
-    protected function createJointPermissionDataArray(SimpleEntityData $entity, int $roleId, int $permissionStatus, bool $hasPermissionOwn): array
+    protected function createJointPermissionDataArray(SimpleEntityData $entity, int $roleId, bool $permissionAll, bool $permissionOwn): array
     {
-        $ownPermissionActive = ($hasPermissionOwn && $permissionStatus !== PermissionStatus::EXPLICIT_DENY && $entity->owned_by);
-
         return [
-            'entity_id'   => $entity->id,
-            'entity_type' => $entity->type,
-            'role_id'     => $roleId,
-            'status'      => $permissionStatus,
-            'owner_id'    => $ownPermissionActive ? $entity->owned_by : null,
+            'entity_id'          => $entity->id,
+            'entity_type'        => $entity->type,
+            'has_permission'     => $permissionAll,
+            'has_permission_own' => $permissionOwn,
+            'owned_by'           => $entity->owned_by,
+            'role_id'            => $roleId,
         ];
     }
 }

app/Auth/Permissions/PermissionApplicator.php

@@ -1,15 +1,15 @@
 <?php
 
-namespace BookStack\Permissions;
+namespace BookStack\Auth\Permissions;
 
-use BookStack\App\Model;
+use BookStack\Auth\Role;
+use BookStack\Auth\User;
+use BookStack\Entities\Models\Chapter;
 use BookStack\Entities\Models\Entity;
 use BookStack\Entities\Models\Page;
-use BookStack\Permissions\Models\EntityPermission;
-use BookStack\Users\Models\HasCreatorAndUpdater;
-use BookStack\Users\Models\HasOwner;
-use BookStack\Users\Models\Role;
-use BookStack\Users\Models\User;
+use BookStack\Model;
+use BookStack\Traits\HasCreatorAndUpdater;
+use BookStack\Traits\HasOwner;
 use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Database\Query\Builder as QueryBuilder;
 use InvalidArgumentException;
@@ -61,7 +61,46 @@ class PermissionApplicator
     {
         $this->ensureValidEntityAction($action);
 
-        return (new EntityPermissionEvaluator($action))->evaluateEntityForUser($entity, $userRoleIds);
+        $adminRoleId = Role::getSystemRole('admin')->id;
+        if (in_array($adminRoleId, $userRoleIds)) {
+            return true;
+        }
+
+        // The chain order here is very important due to the fact we walk up the chain
+        // in the loop below. Earlier items in the chain have higher priority.
+        $chain = [$entity];
+        if ($entity instanceof Page && $entity->chapter_id) {
+            $chain[] = $entity->chapter;
+        }
+
+        if ($entity instanceof Page || $entity instanceof Chapter) {
+            $chain[] = $entity->book;
+        }
+
+        foreach ($chain as $currentEntity) {
+            $allowedByRoleId = $currentEntity->permissions()
+                ->whereIn('role_id', [0, ...$userRoleIds])
+                ->pluck($action, 'role_id');
+
+            // Continue up the chain if no applicable entity permission overrides.
+            if ($allowedByRoleId->isEmpty()) {
+                continue;
+            }
+
+            // If we have user-role-specific permissions set, allow if any of those
+            // role permissions allow access.
+            $hasDefault = $allowedByRoleId->has(0);
+            if (!$hasDefault || $allowedByRoleId->count() > 1) {
+                return $allowedByRoleId->search(function (bool $allowed, int $roleId) {
+                        return $roleId !== 0 && $allowed;
+                }) !== false;
+            }
+
+            // Otherwise, return the default "Other roles" fallback value.
+            return $allowedByRoleId->get(0);
+        }
+
+        return null;
     }
 
     /**
@@ -95,12 +134,10 @@ class PermissionApplicator
     {
         return $query->where(function (Builder $parentQuery) {
             $parentQuery->whereHas('jointPermissions', function (Builder $permissionQuery) {
-                $permissionQuery->select(['entity_id', 'entity_type'])
-                    ->selectRaw('max(owner_id) as owner_id')
-                    ->selectRaw('max(status) as status')
-                    ->whereIn('role_id', $this->getCurrentUserRoleIds())
-                    ->groupBy(['entity_type', 'entity_id'])
-                    ->havingRaw('(status IN (1, 3) or (owner_id = ? and status != 2))', [$this->currentUser()->id]);
+                $permissionQuery->whereIn('role_id', $this->getCurrentUserRoleIds())
+                    ->where(function (Builder $query) {
+                        $this->addJointHasPermissionCheck($query, $this->currentUser()->id);
+                    });
             });
         });
     }
@@ -124,23 +161,35 @@ class PermissionApplicator
      * Filter items that have entities set as a polymorphic relation.
      * For simplicity, this will not return results attached to draft pages.
      * Draft pages should never really have related items though.
+     *
+     * @param Builder|QueryBuilder $query
      */
-    public function restrictEntityRelationQuery(Builder $query, string $tableName, string $entityIdColumn, string $entityTypeColumn): Builder
+    public function restrictEntityRelationQuery($query, string $tableName, string $entityIdColumn, string $entityTypeColumn)
     {
         $tableDetails = ['tableName' => $tableName, 'entityIdColumn' => $entityIdColumn, 'entityTypeColumn' => $entityTypeColumn];
         $pageMorphClass = (new Page())->getMorphClass();
 
-        return $this->restrictEntityQuery($query)
-            ->where(function ($query) use ($tableDetails, $pageMorphClass) {
-                /** @var Builder $query */
-                $query->where($tableDetails['entityTypeColumn'], '!=', $pageMorphClass)
+        $q = $query->whereExists(function ($permissionQuery) use (&$tableDetails) {
+            /** @var Builder $permissionQuery */
+            $permissionQuery->select(['role_id'])->from('joint_permissions')
+                ->whereColumn('joint_permissions.entity_id', '=', $tableDetails['tableName'] . '.' . $tableDetails['entityIdColumn'])
+                ->whereColumn('joint_permissions.entity_type', '=', $tableDetails['tableName'] . '.' . $tableDetails['entityTypeColumn'])
+                ->whereIn('joint_permissions.role_id', $this->getCurrentUserRoleIds())
+                ->where(function (QueryBuilder $query) {
+                    $this->addJointHasPermissionCheck($query, $this->currentUser()->id);
+                });
+        })->where(function ($query) use ($tableDetails, $pageMorphClass) {
+            /** @var Builder $query */
+            $query->where($tableDetails['entityTypeColumn'], '!=', $pageMorphClass)
                 ->orWhereExists(function (QueryBuilder $query) use ($tableDetails, $pageMorphClass) {
                     $query->select('id')->from('pages')
                         ->whereColumn('pages.id', '=', $tableDetails['tableName'] . '.' . $tableDetails['entityIdColumn'])
                         ->where($tableDetails['tableName'] . '.' . $tableDetails['entityTypeColumn'], '=', $pageMorphClass)
                         ->where('pages.draft', '=', false);
                 });
-            });
+        });
+
+        return $q;
     }
 
     /**
@@ -152,20 +201,49 @@ class PermissionApplicator
     public function restrictPageRelationQuery(Builder $query, string $tableName, string $pageIdColumn): Builder
     {
         $fullPageIdColumn = $tableName . '.' . $pageIdColumn;
-        return $this->restrictEntityQuery($query)
-            ->where(function ($query) use ($fullPageIdColumn) {
-                /** @var Builder $query */
-                $query->whereExists(function (QueryBuilder $query) use ($fullPageIdColumn) {
-                    $query->select('id')->from('pages')
-                        ->whereColumn('pages.id', '=', $fullPageIdColumn)
-                        ->where('pages.draft', '=', false);
-                })->orWhereExists(function (QueryBuilder $query) use ($fullPageIdColumn) {
-                    $query->select('id')->from('pages')
-                        ->whereColumn('pages.id', '=', $fullPageIdColumn)
-                        ->where('pages.draft', '=', true)
-                        ->where('pages.created_by', '=', $this->currentUser()->id);
+        $morphClass = (new Page())->getMorphClass();
+
+        $existsQuery = function ($permissionQuery) use ($fullPageIdColumn, $morphClass) {
+            /** @var Builder $permissionQuery */
+            $permissionQuery->select('joint_permissions.role_id')->from('joint_permissions')
+                ->whereColumn('joint_permissions.entity_id', '=', $fullPageIdColumn)
+                ->where('joint_permissions.entity_type', '=', $morphClass)
+                ->whereIn('joint_permissions.role_id', $this->getCurrentUserRoleIds())
+                ->where(function (QueryBuilder $query) {
+                    $this->addJointHasPermissionCheck($query, $this->currentUser()->id);
                 });
-            });
+        };
+
+        $q = $query->where(function ($query) use ($existsQuery, $fullPageIdColumn) {
+            $query->whereExists($existsQuery)
+                ->orWhere($fullPageIdColumn, '=', 0);
+        });
+
+        // Prevent visibility of non-owned draft pages
+        $q->whereExists(function (QueryBuilder $query) use ($fullPageIdColumn) {
+            $query->select('id')->from('pages')
+                ->whereColumn('pages.id', '=', $fullPageIdColumn)
+                ->where(function (QueryBuilder $query) {
+                    $query->where('pages.draft', '=', false)
+                        ->orWhere('pages.owned_by', '=', $this->currentUser()->id);
+                });
+        });
+
+        return $q;
+    }
+
+    /**
+     * Add the query for checking the given user id has permission
+     * within the join_permissions table.
+     *
+     * @param QueryBuilder|Builder $query
+     */
+    protected function addJointHasPermissionCheck($query, int $userIdToCheck)
+    {
+        $query->where('joint_permissions.has_permission', '=', true)->orWhere(function ($query) use ($userIdToCheck) {
+            $query->where('joint_permissions.has_permission_own', '=', true)
+                ->where('joint_permissions.owned_by', '=', $userIdToCheck);
+        });
     }
 
     /**
@@ -183,6 +261,10 @@ class PermissionApplicator
      */
     protected function getCurrentUserRoleIds(): array
     {
+        if (auth()->guest()) {
+            return [Role::getSystemRole('public')->id];
+        }
+
         return $this->currentUser()->roles->pluck('id')->values()->all();
     }
 

app/Auth/Permissions/PermissionFormData.php

@@ -1,10 +1,9 @@
 <?php
 
-namespace BookStack\Permissions;
+namespace BookStack\Auth\Permissions;
 
+use BookStack\Auth\Role;
 use BookStack\Entities\Models\Entity;
-use BookStack\Permissions\Models\EntityPermission;
-use BookStack\Users\Models\Role;
 
 class PermissionFormData
 {

app/Auth/Permissions/PermissionsRepo.php

@@ -1,20 +1,22 @@
 <?php
 
-namespace BookStack\Permissions;
+namespace BookStack\Auth\Permissions;
 
-use BookStack\Activity\ActivityType;
+use BookStack\Actions\ActivityType;
+use BookStack\Auth\Role;
 use BookStack\Exceptions\PermissionsException;
 use BookStack\Facades\Activity;
-use BookStack\Permissions\Models\RolePermission;
-use BookStack\Users\Models\Role;
 use Exception;
 use Illuminate\Database\Eloquent\Collection;
 
 class PermissionsRepo
 {
     protected JointPermissionBuilder $permissionBuilder;
-    protected array $systemRoles = ['admin', 'public'];
+    protected $systemRoles = ['admin', 'public'];
 
+    /**
+     * PermissionsRepo constructor.
+     */
     public function __construct(JointPermissionBuilder $permissionBuilder)
     {
         $this->permissionBuilder = $permissionBuilder;
@@ -39,7 +41,7 @@ class PermissionsRepo
     /**
      * Get a role via its ID.
      */
-    public function getRoleById(int $id): Role
+    public function getRoleById($id): Role
     {
         return Role::query()->findOrFail($id);
     }
@@ -50,10 +52,10 @@ class PermissionsRepo
     public function saveNewRole(array $roleData): Role
     {
         $role = new Role($roleData);
-        $role->mfa_enforced = boolval($roleData['mfa_enforced'] ?? false);
+        $role->mfa_enforced = ($roleData['mfa_enforced'] ?? 'false') === 'true';
         $role->save();
 
-        $permissions = $roleData['permissions'] ?? [];
+        $permissions = isset($roleData['permissions']) ? array_keys($roleData['permissions']) : [];
         $this->assignRolePermissions($role, $permissions);
         $this->permissionBuilder->rebuildForRole($role);
 
@@ -64,45 +66,42 @@ class PermissionsRepo
 
     /**
      * Updates an existing role.
-     * Ensures Admin system role always have core permissions.
+     * Ensure Admin role always have core permissions.
      */
-    public function updateRole($roleId, array $roleData): Role
+    public function updateRole($roleId, array $roleData)
     {
         $role = $this->getRoleById($roleId);
 
-        if (isset($roleData['permissions'])) {
-            $this->assignRolePermissions($role, $roleData['permissions']);
-        }
-
-        $role->fill($roleData);
-        $role->save();
-        $this->permissionBuilder->rebuildForRole($role);
-
-        Activity::add(ActivityType::ROLE_UPDATE, $role);
-
-        return $role;
-    }
-
-    /**
-     * Assign a list of permission names to the given role.
-     */
-    protected function assignRolePermissions(Role $role, array $permissionNameArray = []): void
-    {
-        $permissions = [];
-        $permissionNameArray = array_values($permissionNameArray);
-
-        // Ensure the admin system role retains vital system permissions
+        $permissions = isset($roleData['permissions']) ? array_keys($roleData['permissions']) : [];
         if ($role->system_name === 'admin') {
-            $permissionNameArray = array_unique(array_merge($permissionNameArray, [
+            $permissions = array_merge($permissions, [
                 'users-manage',
                 'user-roles-manage',
                 'restrictions-manage-all',
                 'restrictions-manage-own',
                 'settings-manage',
-            ]));
+            ]);
         }
 
-        if (!empty($permissionNameArray)) {
+        $this->assignRolePermissions($role, $permissions);
+
+        $role->fill($roleData);
+        $role->mfa_enforced = ($roleData['mfa_enforced'] ?? 'false') === 'true';
+        $role->save();
+        $this->permissionBuilder->rebuildForRole($role);
+
+        Activity::add(ActivityType::ROLE_UPDATE, $role);
+    }
+
+    /**
+     * Assign a list of permission names to a role.
+     */
+    protected function assignRolePermissions(Role $role, array $permissionNameArray = [])
+    {
+        $permissions = [];
+        $permissionNameArray = array_values($permissionNameArray);
+
+        if ($permissionNameArray) {
             $permissions = RolePermission::query()
                 ->whereIn('name', $permissionNameArray)
                 ->pluck('id')
@@ -115,13 +114,13 @@ class PermissionsRepo
     /**
      * Delete a role from the system.
      * Check it's not an admin role or set as default before deleting.
-     * If a migration Role ID is specified the users assign to the current role
+     * If an migration Role ID is specified the users assign to the current role
      * will be added to the role of the specified id.
      *
      * @throws PermissionsException
      * @throws Exception
      */
-    public function deleteRole(int $roleId, int $migrateRoleId = 0): void
+    public function deleteRole($roleId, $migrateRoleId)
     {
         $role = $this->getRoleById($roleId);
 
@@ -132,7 +131,7 @@ class PermissionsRepo
             throw new PermissionsException(trans('errors.role_registration_default_cannot_delete'));
         }
 
-        if ($migrateRoleId !== 0) {
+        if ($migrateRoleId) {
             $newRole = Role::query()->find($migrateRoleId);
             if ($newRole) {
                 $users = $role->users()->pluck('id')->toArray();

app/Auth/Permissions/RolePermission.php

@@ -1,15 +1,13 @@
 <?php
 
-namespace BookStack\Permissions\Models;
+namespace BookStack\Auth\Permissions;
 
-use BookStack\App\Model;
-use BookStack\Users\Models\Role;
+use BookStack\Auth\Role;
+use BookStack\Model;
 use Illuminate\Database\Eloquent\Relations\BelongsToMany;
 
 /**
  * @property int $id
- * @property string $name
- * @property string $display_name
  */
 class RolePermission extends Model
 {

app/Auth/Permissions/SimpleEntityData.php

@@ -0,0 +1,12 @@
+<?php
+
+namespace BookStack\Auth\Permissions;
+
+class SimpleEntityData
+{
+    public int $id;
+    public string $type;
+    public int $owned_by;
+    public ?int $book_id;
+    public ?int $chapter_id;
+}

app/Auth/Queries/AllUsersPaginatedAndSorted.php

@@ -1,9 +1,8 @@
 <?php
 
-namespace BookStack\Users\Queries;
+namespace BookStack\Auth\Queries;
 
-use BookStack\Users\Models\User;
-use BookStack\Util\SimpleListOptions;
+use BookStack\Auth\User;
 use Illuminate\Pagination\LengthAwarePaginator;
 
 /**
@@ -12,23 +11,23 @@ use Illuminate\Pagination\LengthAwarePaginator;
  * user is assumed to be trusted. (Admin users).
  * Email search can be abused to extract email addresses.
  */
-class UsersAllPaginatedAndSorted
+class AllUsersPaginatedAndSorted
 {
-    public function run(int $count, SimpleListOptions $listOptions): LengthAwarePaginator
+    /**
+     * @param array{sort: string, order: string, search: string} $sortData
+     */
+    public function run(int $count, array $sortData): LengthAwarePaginator
     {
-        $sort = $listOptions->getSort();
-        if ($sort === 'created_at') {
-            $sort = 'users.created_at';
-        }
+        $sort = $sortData['sort'];
 
         $query = User::query()->select(['*'])
             ->scopes(['withLastActivityAt'])
             ->with(['roles', 'avatar'])
             ->withCount('mfaValues')
-            ->orderBy($sort, $listOptions->getOrder());
+            ->orderBy($sort, $sortData['order']);
 
-        if ($listOptions->getSearch()) {
-            $term = '%' . $listOptions->getSearch() . '%';
+        if ($sortData['search']) {
+            $term = '%' . $sortData['search'] . '%';
             $query->where(function ($query) use ($term) {
                 $query->where('name', 'like', $term)
                     ->orWhere('email', 'like', $term);

app/Auth/Queries/UserContentCounts.php

@@ -1,12 +1,12 @@
 <?php
 
-namespace BookStack\Users\Queries;
+namespace BookStack\Auth\Queries;
 
+use BookStack\Auth\User;
 use BookStack\Entities\Models\Book;
 use BookStack\Entities\Models\Bookshelf;
 use BookStack\Entities\Models\Chapter;
 use BookStack\Entities\Models\Page;
-use BookStack\Users\Models\User;
 
 /**
  * Get asset created counts for the given user.

app/Auth/Queries/UserRecentlyCreatedContent.php

@@ -1,12 +1,12 @@
 <?php
 
-namespace BookStack\Users\Queries;
+namespace BookStack\Auth\Queries;
 
+use BookStack\Auth\User;
 use BookStack\Entities\Models\Book;
 use BookStack\Entities\Models\Bookshelf;
 use BookStack\Entities\Models\Chapter;
 use BookStack\Entities\Models\Page;
-use BookStack\Users\Models\User;
 use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Database\Eloquent\Collection;
 

app/Auth/Role.php

@@ -1,12 +1,12 @@
 <?php
 
-namespace BookStack\Users\Models;
+namespace BookStack\Auth;
 
-use BookStack\Activity\Models\Loggable;
-use BookStack\App\Model;
-use BookStack\Permissions\Models\EntityPermission;
-use BookStack\Permissions\Models\JointPermission;
-use BookStack\Permissions\Models\RolePermission;
+use BookStack\Auth\Permissions\EntityPermission;
+use BookStack\Auth\Permissions\JointPermission;
+use BookStack\Auth\Permissions\RolePermission;
+use BookStack\Interfaces\Loggable;
+use BookStack\Model;
 use Illuminate\Database\Eloquent\Collection;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\Relations\BelongsToMany;
@@ -27,14 +27,10 @@ class Role extends Model implements Loggable
 {
     use HasFactory;
 
-    protected $fillable = ['display_name', 'description', 'external_auth_id', 'mfa_enforced'];
+    protected $fillable = ['display_name', 'description', 'external_auth_id'];
 
     protected $hidden = ['pivot'];
 
-    protected $casts = [
-        'mfa_enforced' => 'boolean',
-    ];
-
     /**
      * The roles that belong to the role.
      */
@@ -111,13 +107,15 @@ class Role extends Model implements Loggable
      */
     public static function getSystemRole(string $systemName): ?self
     {
-        static $cache = [];
+        return static::query()->where('system_name', '=', $systemName)->first();
+    }
 
-        if (!isset($cache[$systemName])) {
-            $cache[$systemName] = static::query()->where('system_name', '=', $systemName)->first();
-        }
-
-        return $cache[$systemName];
+    /**
+     * Get all visible roles.
+     */
+    public static function visible(): Collection
+    {
+        return static::query()->where('hidden', '=', false)->orderBy('name')->get();
     }
 
     /**

app/Auth/SocialAccount.php

@@ -1,10 +1,9 @@
 <?php
 
-namespace BookStack\Access;
+namespace BookStack\Auth;
 
-use BookStack\Activity\Models\Loggable;
-use BookStack\App\Model;
-use BookStack\Users\Models\User;
+use BookStack\Interfaces\Loggable;
+use BookStack\Model;
 
 /**
  * Class SocialAccount.

app/Auth/User.php

@@ -1,15 +1,14 @@
 <?php
 
-namespace BookStack\Users\Models;
+namespace BookStack\Auth;
 
-use BookStack\Access\Mfa\MfaValue;
-use BookStack\Access\SocialAccount;
-use BookStack\Activity\Models\Favourite;
-use BookStack\Activity\Models\Loggable;
+use BookStack\Actions\Favourite;
 use BookStack\Api\ApiToken;
-use BookStack\App\Model;
-use BookStack\App\Sluggable;
+use BookStack\Auth\Access\Mfa\MfaValue;
 use BookStack\Entities\Tools\SlugGenerator;
+use BookStack\Interfaces\Loggable;
+use BookStack\Interfaces\Sluggable;
+use BookStack\Model;
 use BookStack\Notifications\ResetPassword;
 use BookStack\Uploads\Image;
 use Carbon\Carbon;
@@ -73,7 +72,7 @@ class User extends Model implements AuthenticatableContract, CanResetPasswordCon
      */
     protected $hidden = [
         'password', 'remember_token', 'system_name', 'email_confirmed', 'external_auth_id', 'email',
-        'created_at', 'updated_at', 'image_id', 'roles', 'avatar', 'user_id', 'pivot',
+        'created_at', 'updated_at', 'image_id', 'roles', 'avatar', 'user_id',
     ];
 
     /**
@@ -201,7 +200,6 @@ class User extends Model implements AuthenticatableContract, CanResetPasswordCon
     public function attachRole(Role $role)
     {
         $this->roles()->attach($role->id);
-        $this->unsetRelation('roles');
     }
 
     /**

app/Auth/UserRepo.php

@@ -1,16 +1,14 @@
 <?php
 
-namespace BookStack\Users;
+namespace BookStack\Auth;
 
-use BookStack\Access\UserInviteService;
-use BookStack\Activity\ActivityType;
+use BookStack\Actions\ActivityType;
+use BookStack\Auth\Access\UserInviteService;
 use BookStack\Entities\EntityProvider;
 use BookStack\Exceptions\NotifyException;
 use BookStack\Exceptions\UserUpdateException;
 use BookStack\Facades\Activity;
 use BookStack\Uploads\UserAvatars;
-use BookStack\Users\Models\Role;
-use BookStack\Users\Models\User;
 use Exception;
 use Illuminate\Support\Facades\Hash;
 use Illuminate\Support\Facades\Log;
@@ -160,9 +158,6 @@ class UserRepo
         // Delete user profile images
         $this->userAvatar->destroyAllForUser($user);
 
-        // Delete related activities
-        setting()->deleteUserSettings($user->id);
-
         if (!empty($newOwnerId)) {
             $newOwner = User::query()->find($newOwnerId);
             if (!is_null($newOwner)) {
@@ -236,8 +231,6 @@ class UserRepo
      */
     protected function setUserRoles(User $user, array $roles)
     {
-        $roles = array_filter(array_values($roles));
-
         if ($this->demotingLastAdmin($user, $roles)) {
             throw new UserUpdateException(trans('errors.role_cannot_remove_only_admin'), $user->getEditUrl());
         }

app/Config/app.php

@@ -8,8 +8,6 @@
  * Do not edit this file unless you're happy to maintain any changes yourself.
  */
 
-use Illuminate\Support\Facades\Facade;
-
 return [
 
     // The environment to run BookStack in.
@@ -77,7 +75,7 @@ return [
     'locale' => env('APP_LANG', 'en'),
 
     // Locales available
-    'locales' => ['en', 'ar', 'bg', 'bs', 'ca', 'cs', 'cy', 'da', 'de', 'de_informal', 'el', 'es', 'es_AR', 'et', 'eu', 'fa', 'fr', 'he', 'hr', 'hu', 'id', 'it', 'ja', 'ka', 'ko', 'lt', 'lv', 'nl', 'nb', 'pt', 'pt_BR', 'sk', 'sl', 'sv', 'pl',  'ro', 'ru', 'tr', 'uk', 'uz', 'vi', 'zh_CN', 'zh_TW'],
+    'locales' => ['en', 'ar', 'bg', 'bs', 'ca', 'cs', 'cy', 'da', 'de', 'de_informal', 'es', 'es_AR', 'et', 'eu', 'fa', 'fr', 'he', 'hr', 'hu', 'id', 'it', 'ja', 'ko', 'lt', 'lv', 'nl', 'nb', 'pt', 'pt_BR', 'sk', 'sl', 'sv', 'pl',  'ro', 'ru', 'tr', 'uk', 'uz', 'vi', 'zh_CN', 'zh_TW'],
 
     //  Application Fallback Locale
     'fallback_locale' => 'en',
@@ -100,13 +98,7 @@ return [
     // Encryption cipher
     'cipher' => 'AES-256-CBC',
 
-    // Maintenance Mode Driver
-    'maintenance' => [
-        'driver' => 'file',
-        // 'store'  => 'redis',
-    ],
-
-    // Application Service Providers
+    // Application Services Provides
     'providers' => [
 
         // Laravel Framework Service Providers...
@@ -139,19 +131,68 @@ return [
         SocialiteProviders\Manager\ServiceProvider::class,
 
         // BookStack custom service providers
-        \BookStack\App\Providers\ThemeServiceProvider::class,
-        \BookStack\App\Providers\AppServiceProvider::class,
-        \BookStack\App\Providers\AuthServiceProvider::class,
-        \BookStack\App\Providers\EventServiceProvider::class,
-        \BookStack\App\Providers\RouteServiceProvider::class,
-        \BookStack\App\Providers\TranslationServiceProvider::class,
-        \BookStack\App\Providers\ValidationRuleServiceProvider::class,
-        \BookStack\App\Providers\ViewTweaksServiceProvider::class,
+        BookStack\Providers\ThemeServiceProvider::class,
+        BookStack\Providers\AppServiceProvider::class,
+        BookStack\Providers\AuthServiceProvider::class,
+        BookStack\Providers\EventServiceProvider::class,
+        BookStack\Providers\RouteServiceProvider::class,
+        BookStack\Providers\TranslationServiceProvider::class,
+        BookStack\Providers\ValidationRuleServiceProvider::class,
+        BookStack\Providers\ViewTweaksServiceProvider::class,
     ],
 
-    // Class Aliases
-    // This array of class aliases to be registered on application start.
-    'aliases' => Facade::defaultAliases()->merge([
+    /*
+    |--------------------------------------------------------------------------
+    | Class Aliases
+    |--------------------------------------------------------------------------
+    |
+    | This array of class aliases will be registered when this application
+    | is started. However, feel free to register as many as you wish as
+    | the aliases are "lazy" loaded so they don't hinder performance.
+    |
+    */
+
+    // Class aliases, Registered on application start
+    'aliases' => [
+        // Laravel
+        'App'          => Illuminate\Support\Facades\App::class,
+        'Arr'          => Illuminate\Support\Arr::class,
+        'Artisan'      => Illuminate\Support\Facades\Artisan::class,
+        'Auth'         => Illuminate\Support\Facades\Auth::class,
+        'Blade'        => Illuminate\Support\Facades\Blade::class,
+        'Bus'          => Illuminate\Support\Facades\Bus::class,
+        'Cache'        => Illuminate\Support\Facades\Cache::class,
+        'Config'       => Illuminate\Support\Facades\Config::class,
+        'Cookie'       => Illuminate\Support\Facades\Cookie::class,
+        'Crypt'        => Illuminate\Support\Facades\Crypt::class,
+        'Date'         => Illuminate\Support\Facades\Date::class,
+        'DB'           => Illuminate\Support\Facades\DB::class,
+        'Eloquent'     => Illuminate\Database\Eloquent\Model::class,
+        'Event'        => Illuminate\Support\Facades\Event::class,
+        'File'         => Illuminate\Support\Facades\File::class,
+        'Gate'         => Illuminate\Support\Facades\Gate::class,
+        'Hash'         => Illuminate\Support\Facades\Hash::class,
+        'Http'         => Illuminate\Support\Facades\Http::class,
+        'Lang'         => Illuminate\Support\Facades\Lang::class,
+        'Log'          => Illuminate\Support\Facades\Log::class,
+        'Mail'         => Illuminate\Support\Facades\Mail::class,
+        'Notification' => Illuminate\Support\Facades\Notification::class,
+        'Password'     => Illuminate\Support\Facades\Password::class,
+        'Queue'        => Illuminate\Support\Facades\Queue::class,
+        'RateLimiter'  => Illuminate\Support\Facades\RateLimiter::class,
+        'Redirect'     => Illuminate\Support\Facades\Redirect::class,
+        // 'Redis'        => Illuminate\Support\Facades\Redis::class,
+        'Request'      => Illuminate\Support\Facades\Request::class,
+        'Response'     => Illuminate\Support\Facades\Response::class,
+        'Route'        => Illuminate\Support\Facades\Route::class,
+        'Schema'       => Illuminate\Support\Facades\Schema::class,
+        'Session'      => Illuminate\Support\Facades\Session::class,
+        'Storage'      => Illuminate\Support\Facades\Storage::class,
+        'Str'          => Illuminate\Support\Str::class,
+        'URL'          => Illuminate\Support\Facades\URL::class,
+        'Validator'    => Illuminate\Support\Facades\Validator::class,
+        'View'         => Illuminate\Support\Facades\View::class,
+
         // Laravel Packages
         'Socialite'    => Laravel\Socialite\Facades\Socialite::class,
 
@@ -161,7 +202,7 @@ return [
         // Custom BookStack
         'Activity'    => BookStack\Facades\Activity::class,
         'Theme'       => BookStack\Facades\Theme::class,
-    ])->toArray(),
+    ],
 
     // Proxy configuration
     'proxies' => env('APP_PROXIES', ''),

app/Config/auth.php

@@ -59,12 +59,12 @@ return [
     'providers' => [
         'users' => [
             'driver' => 'eloquent',
-            'model'  => \BookStack\Users\Models\User::class,
+            'model'  => \BookStack\Auth\User::class,
         ],
 
         'external' => [
             'driver' => 'external-users',
-            'model'  => \BookStack\Users\Models\User::class,
+            'model'  => \BookStack\Auth\User::class,
         ],
 
         // 'users' => [

app/Config/broadcasting.php

@@ -14,7 +14,7 @@ return [
     // This option controls the default broadcaster that will be used by the
     // framework when an event needs to be broadcast. This can be set to
     // any of the connections defined in the "connections" array below.
-    'default' => 'null',
+    'default' => env('BROADCAST_DRIVER', 'pusher'),
 
     // Broadcast Connections
     // Here you may define all of the broadcast connections that will be used
@@ -22,7 +22,21 @@ return [
     // each available type of connection are provided inside this array.
     'connections' => [
 
-        // Default options removed since we don't use broadcasting.
+        'pusher' => [
+            'driver'  => 'pusher',
+            'key'     => env('PUSHER_APP_KEY'),
+            'secret'  => env('PUSHER_APP_SECRET'),
+            'app_id'  => env('PUSHER_APP_ID'),
+            'options' => [
+                'cluster' => env('PUSHER_APP_CLUSTER'),
+                'useTLS'  => true,
+            ],
+        ],
+
+        'redis' => [
+            'driver'     => 'redis',
+            'connection' => 'default',
+        ],
 
         'log' => [
             'driver' => 'log',

app/Config/cache.php

@@ -87,6 +87,6 @@ return [
     |
     */
 
-    'prefix' => env('CACHE_PREFIX', Str::slug(env('APP_NAME', 'laravel'), '_') . '_cache_'),
+    'prefix' => env('CACHE_PREFIX', Str::slug(env('APP_NAME', 'laravel'), '_') . '_cache'),
 
 ];

app/Config/filesystems.php

@@ -33,20 +33,17 @@ return [
             'driver'     => 'local',
             'root'       => public_path(),
             'visibility' => 'public',
-            'throw'      => true,
         ],
 
         'local_secure_attachments' => [
             'driver' => 'local',
             'root'   => storage_path('uploads/files/'),
-            'throw'  => true,
         ],
 
         'local_secure_images' => [
             'driver'     => 'local',
             'root'       => storage_path('uploads/images/'),
             'visibility' => 'public',
-            'throw'      => true,
         ],
 
         's3' => [
@@ -57,7 +54,6 @@ return [
             'bucket'                  => env('STORAGE_S3_BUCKET', 'your-bucket'),
             'endpoint'                => env('STORAGE_S3_ENDPOINT', null),
             'use_path_style_endpoint' => env('STORAGE_S3_ENDPOINT', null) !== null,
-            'throw'                   => true,
         ],
 
     ],

app/Config/logging.php

@@ -21,15 +21,6 @@ return [
     // one of the channels defined in the "channels" configuration array.
     'default' => env('LOG_CHANNEL', 'single'),
 
-    // Deprecations Log Channel
-    // This option controls the log channel that should be used to log warnings
-    // regarding deprecated PHP and library features. This allows you to get
-    // your application ready for upcoming major versions of dependencies.
-    'deprecations' => [
-        'channel' => 'null',
-        'trace' => false,
-    ],
-
     // Log Channels
     // Here you may configure the log channels for your application. Out of
     // the box, Laravel uses the Monolog PHP logging library. This gives

app/Config/mail.php

@@ -8,17 +8,19 @@
  * Do not edit this file unless you're happy to maintain any changes yourself.
  */
 
-// Configured mail encryption method.
-// STARTTLS should still be attempted, but tls/ssl forces TLS usage.
-$mailEncryption = env('MAIL_ENCRYPTION', null);
-
 return [
 
     // Mail driver to use.
     // From Laravel 7+ this is MAIL_MAILER in laravel.
     // Kept as MAIL_DRIVER in BookStack to prevent breaking change.
     // Options: smtp, sendmail, log, array
-    'default' => env('MAIL_DRIVER', 'smtp'),
+    'driver' => env('MAIL_DRIVER', 'smtp'),
+
+    // SMTP host address
+    'host' => env('MAIL_HOST', 'smtp.mailgun.org'),
+
+    // SMTP host port
+    'port' => env('MAIL_PORT', 587),
 
     // Global "From" address & name
     'from' => [
@@ -26,44 +28,17 @@ return [
         'name'    => env('MAIL_FROM_NAME', 'BookStack'),
     ],
 
-    // Mailer Configurations
-    // Available mailing methods and their settings.
-    'mailers' => [
-        'smtp' => [
-            'transport' => 'smtp',
-            'scheme' => null,
-            'host' => env('MAIL_HOST', 'smtp.mailgun.org'),
-            'port' => env('MAIL_PORT', 587),
-            'username' => env('MAIL_USERNAME'),
-            'password' => env('MAIL_PASSWORD'),
-            'verify_peer' => env('MAIL_VERIFY_SSL', true),
-            'timeout' => null,
-            'local_domain' => env('MAIL_EHLO_DOMAIN'),
-            'tls_required' => ($mailEncryption === 'tls' || $mailEncryption === 'ssl'),
-        ],
+    // Email encryption protocol
+    'encryption' => env('MAIL_ENCRYPTION', 'tls'),
 
-        'sendmail' => [
-            'transport' => 'sendmail',
-            'path' => env('MAIL_SENDMAIL_COMMAND', '/usr/sbin/sendmail -bs'),
-        ],
+    // SMTP server username
+    'username' => env('MAIL_USERNAME'),
 
-        'log' => [
-            'transport' => 'log',
-            'channel' => env('MAIL_LOG_CHANNEL'),
-        ],
+    // SMTP server password
+    'password' => env('MAIL_PASSWORD'),
 
-        'array' => [
-            'transport' => 'array',
-        ],
-
-        'failover' => [
-            'transport' => 'failover',
-            'mailers' => [
-                'smtp',
-                'log',
-            ],
-        ],
-    ],
+    // Sendmail application path
+    'sendmail' => '/usr/sbin/sendmail -bs',
 
     // Email markdown configuration
     'markdown' => [
@@ -72,4 +47,11 @@ return [
             resource_path('views/vendor/mail'),
         ],
     ],
+
+    // Log Channel
+    // If you are using the "log" driver, you may specify the logging channel
+    // if you prefer to keep mail messages separate from other log entries
+    // for simpler reading. Otherwise, the default channel will be used.
+    'log_channel' => env('MAIL_LOG_CHANNEL'),
+
 ];

app/Config/oidc.php

@@ -8,12 +8,9 @@ return [
     // Dump user details after a login request for debugging purposes
     'dump_user_details' => env('OIDC_DUMP_USER_DETAILS', false),
 
-    // Claim, within an OpenId token, to find the user's display name
+    // Attribute, within a OpenId token, to find the user's display name
     'display_name_claims' => explode('|', env('OIDC_DISPLAY_NAME_CLAIMS', 'name')),
 
-    // Claim, within an OpenID token, to use to connect a BookStack user to the OIDC user.
-    'external_id_claim' => env('OIDC_EXTERNAL_ID_CLAIM', 'sub'),
-
     // OAuth2/OpenId client id, as configured in your Authorization server.
     'client_id' => env('OIDC_CLIENT_ID', null),
 

app/Config/setting-defaults.php

@@ -16,27 +16,16 @@ return [
     'app-editor'           => 'wysiwyg',
     'app-color'            => '#206ea7',
     'app-color-light'      => 'rgba(32,110,167,0.15)',
-    'link-color'           => '#206ea7',
     'bookshelf-color'      => '#a94747',
     'book-color'           => '#077b70',
     'chapter-color'        => '#af4d0d',
     'page-color'           => '#206ea7',
     'page-draft-color'     => '#7e50b1',
-    'app-color-dark'       => '#195785',
-    'app-color-light-dark' => 'rgba(32,110,167,0.15)',
-    'link-color-dark'      => '#429fe3',
-    'bookshelf-color-dark' => '#ff5454',
-    'book-color-dark'      => '#389f60',
-    'chapter-color-dark'   => '#ee7a2d',
-    'page-color-dark'      => '#429fe3',
-    'page-draft-color-dark' => '#a66ce8',
     'app-custom-head'      => false,
     'registration-enabled' => false,
 
     // User-level default settings
     'user' => [
-        'ui-shortcuts'          => '{}',
-        'ui-shortcuts-enabled'  => false,
         'dark-mode-enabled'     => env('APP_DEFAULT_DARK_MODE', false),
         'bookshelves_view_type' => env('APP_VIEWS_BOOKSHELVES', 'grid'),
         'bookshelf_view_type'   => env('APP_VIEWS_BOOKSHELF', 'grid'),

app/Console/Commands/CleanupImages.php

@@ -6,7 +6,7 @@ use BookStack\Uploads\ImageService;
 use Illuminate\Console\Command;
 use Symfony\Component\Console\Output\OutputInterface;
 
-class CleanupImagesCommand extends Command
+class CleanupImages extends Command
 {
     /**
      * The name and signature of the console command.
@@ -25,49 +25,60 @@ class CleanupImagesCommand extends Command
      */
     protected $description = 'Cleanup images and drawings';
 
+    protected $imageService;
+
+    /**
+     * Create a new command instance.
+     *
+     * @param \BookStack\Uploads\ImageService $imageService
+     */
+    public function __construct(ImageService $imageService)
+    {
+        $this->imageService = $imageService;
+        parent::__construct();
+    }
+
     /**
      * Execute the console command.
+     *
+     * @return mixed
      */
-    public function handle(ImageService $imageService): int
+    public function handle()
     {
-        $checkRevisions = !$this->option('all');
-        $dryRun = !$this->option('force');
+        $checkRevisions = $this->option('all') ? false : true;
+        $dryRun = $this->option('force') ? false : true;
 
         if (!$dryRun) {
-            $this->warn("This operation is destructive and is not guaranteed to be fully accurate.\nEnsure you have a backup of your images.\n");
-            $proceed = $this->confirm("Are you sure you want to proceed?");
+            $proceed = $this->confirm("This operation is destructive and is not guaranteed to be fully accurate.\nEnsure you have a backup of your images.\nAre you sure you want to proceed?");
             if (!$proceed) {
-                return 0;
+                return;
             }
         }
 
-        $deleted = $imageService->deleteUnusedImages($checkRevisions, $dryRun);
+        $deleted = $this->imageService->deleteUnusedImages($checkRevisions, $dryRun);
         $deleteCount = count($deleted);
 
         if ($dryRun) {
-            $this->comment('Dry run, no images have been deleted');
+            $this->comment('Dry run, No images have been deleted');
             $this->comment($deleteCount . ' images found that would have been deleted');
             $this->showDeletedImages($deleted);
             $this->comment('Run with -f or --force to perform deletions');
 
-            return 0;
+            return;
         }
 
         $this->showDeletedImages($deleted);
         $this->comment($deleteCount . ' images deleted');
-        return 0;
     }
 
-    protected function showDeletedImages($paths): void
+    protected function showDeletedImages($paths)
     {
         if ($this->getOutput()->getVerbosity() <= OutputInterface::VERBOSITY_NORMAL) {
             return;
         }
-
         if (count($paths) > 0) {
             $this->line('Images to delete:');
         }
-
         foreach ($paths as $path) {
             $this->line($path);
         }

app/Console/Commands/ClearActivity.php

@@ -2,10 +2,10 @@
 
 namespace BookStack\Console\Commands;
 
-use BookStack\Activity\Models\Activity;
+use BookStack\Actions\Activity;
 use Illuminate\Console\Command;
 
-class ClearActivityCommand extends Command
+class ClearActivity extends Command
 {
     /**
      * The name and signature of the console command.
@@ -21,13 +21,27 @@ class ClearActivityCommand extends Command
      */
     protected $description = 'Clear user activity from the system';
 
+    protected $activity;
+
+    /**
+     * Create a new command instance.
+     *
+     * @param Activity $activity
+     */
+    public function __construct(Activity $activity)
+    {
+        $this->activity = $activity;
+        parent::__construct();
+    }
+
     /**
      * Execute the console command.
+     *
+     * @return mixed
      */
-    public function handle(): int
+    public function handle()
     {
-        Activity::query()->truncate();
+        $this->activity->newQuery()->truncate();
         $this->comment('System activity cleared');
-        return 0;
     }
 }

app/Console/Commands/ClearRevisions.php

@@ -5,7 +5,7 @@ namespace BookStack\Console\Commands;
 use BookStack\Entities\Models\PageRevision;
 use Illuminate\Console\Command;
 
-class ClearRevisionsCommand extends Command
+class ClearRevisions extends Command
 {
     /**
      * The name and signature of the console command.
@@ -23,14 +23,28 @@ class ClearRevisionsCommand extends Command
      */
     protected $description = 'Clear page revisions';
 
+    protected $pageRevision;
+
+    /**
+     * Create a new command instance.
+     *
+     * @param PageRevision $pageRevision
+     */
+    public function __construct(PageRevision $pageRevision)
+    {
+        $this->pageRevision = $pageRevision;
+        parent::__construct();
+    }
+
     /**
      * Execute the console command.
+     *
+     * @return mixed
      */
-    public function handle(): int
+    public function handle()
     {
         $deleteTypes = $this->option('all') ? ['version', 'update_draft'] : ['version'];
-        PageRevision::query()->whereIn('type', $deleteTypes)->delete();
+        $this->pageRevision->newQuery()->whereIn('type', $deleteTypes)->delete();
         $this->comment('Revisions deleted');
-        return 0;
     }
 }

app/Console/Commands/ClearViews.php

@@ -2,10 +2,10 @@
 
 namespace BookStack\Console\Commands;
 
-use BookStack\Activity\Models\View;
+use BookStack\Actions\View;
 use Illuminate\Console\Command;
 
-class ClearViewsCommand extends Command
+class ClearViews extends Command
 {
     /**
      * The name and signature of the console command.
@@ -22,12 +22,21 @@ class ClearViewsCommand extends Command
     protected $description = 'Clear all view-counts for all entities';
 
     /**
-     * Execute the console command.
+     * Create a new command instance.
      */
-    public function handle(): int
+    public function __construct()
     {
-        View::query()->truncate();
+        parent::__construct();
+    }
+
+    /**
+     * Execute the console command.
+     *
+     * @return mixed
+     */
+    public function handle()
+    {
+        View::clearAll();
         $this->comment('Views cleared');
-        return 0;
     }
 }

app/Console/Commands/CopyShelfPermissions.php

@@ -6,7 +6,7 @@ use BookStack\Entities\Models\Bookshelf;
 use BookStack\Entities\Tools\PermissionsUpdater;
 use Illuminate\Console\Command;
 
-class CopyShelfPermissionsCommand extends Command
+class CopyShelfPermissions extends Command
 {
     /**
      * The name and signature of the console command.
@@ -25,10 +25,25 @@ class CopyShelfPermissionsCommand extends Command
      */
     protected $description = 'Copy shelf permissions to all child books';
 
+    protected PermissionsUpdater $permissionsUpdater;
+
+    /**
+     * Create a new command instance.
+     *
+     * @return void
+     */
+    public function __construct(PermissionsUpdater $permissionsUpdater)
+    {
+        $this->permissionsUpdater = $permissionsUpdater;
+        parent::__construct();
+    }
+
     /**
      * Execute the console command.
+     *
+     * @return mixed
      */
-    public function handle(PermissionsUpdater $permissionsUpdater): int
+    public function handle()
     {
         $shelfSlug = $this->option('slug');
         $cascadeAll = $this->option('all');
@@ -37,7 +52,7 @@ class CopyShelfPermissionsCommand extends Command
         if (!$cascadeAll && !$shelfSlug) {
             $this->error('Either a --slug or --all option must be provided.');
 
-            return 1;
+            return;
         }
 
         if ($cascadeAll) {
@@ -48,7 +63,7 @@ class CopyShelfPermissionsCommand extends Command
             );
 
             if (!$continue && !$this->hasOption('no-interaction')) {
-                return 0;
+                return;
             }
 
             $shelves = Bookshelf::query()->get(['id']);
@@ -62,11 +77,10 @@ class CopyShelfPermissionsCommand extends Command
         }
 
         foreach ($shelves as $shelf) {
-            $permissionsUpdater->updateBookPermissionsFromShelf($shelf, false);
+            $this->permissionsUpdater->updateBookPermissionsFromShelf($shelf, false);
             $this->info('Copied permissions for shelf [' . $shelf->id . ']');
         }
 
         $this->info('Permissions copied for ' . $shelves->count() . ' shelves.');
-        return 0;
     }
 }

app/Console/Commands/CreateAdmin.php

@@ -2,15 +2,17 @@
 
 namespace BookStack\Console\Commands;
 
-use BookStack\Users\Models\Role;
-use BookStack\Users\UserRepo;
+use BookStack\Auth\Role;
+use BookStack\Auth\UserRepo;
+use BookStack\Exceptions\NotFoundException;
 use Illuminate\Console\Command;
 use Illuminate\Support\Facades\Validator;
 use Illuminate\Support\Str;
 use Illuminate\Validation\Rules\Password;
 use Illuminate\Validation\Rules\Unique;
+use Symfony\Component\Console\Command\Command as SymfonyCommand;
 
-class CreateAdminCommand extends Command
+class CreateAdmin extends Command
 {
     /**
      * The name and signature of the console command.
@@ -30,10 +32,25 @@ class CreateAdminCommand extends Command
      */
     protected $description = 'Add a new admin user to the system';
 
+    protected $userRepo;
+
+    /**
+     * Create a new command instance.
+     */
+    public function __construct(UserRepo $userRepo)
+    {
+        $this->userRepo = $userRepo;
+        parent::__construct();
+    }
+
     /**
      * Execute the console command.
+     *
+     * @throws NotFoundException
+     *
+     * @return mixed
      */
-    public function handle(UserRepo $userRepo): int
+    public function handle()
     {
         $details = $this->snakeCaseOptions();
 
@@ -65,17 +82,17 @@ class CreateAdminCommand extends Command
                 $this->error($error);
             }
 
-            return 1;
+            return SymfonyCommand::FAILURE;
         }
 
-        $user = $userRepo->createWithoutActivity($validator->validated());
+        $user = $this->userRepo->createWithoutActivity($validator->validated());
         $user->attachRole(Role::getSystemRole('admin'));
         $user->email_confirmed = true;
         $user->save();
 
         $this->info("Admin account with email \"{$user->email}\" successfully created!");
 
-        return 0;
+        return SymfonyCommand::SUCCESS;
     }
 
     protected function snakeCaseOptions(): array

app/Console/Commands/DeleteUsers.php

@@ -0,0 +1,53 @@
+<?php
+
+namespace BookStack\Console\Commands;
+
+use BookStack\Auth\User;
+use BookStack\Auth\UserRepo;
+use Illuminate\Console\Command;
+
+class DeleteUsers extends Command
+{
+    /**
+     * The name and signature of the console command.
+     *
+     * @var string
+     */
+    protected $signature = 'bookstack:delete-users';
+
+    protected $userRepo;
+
+    /**
+     * The console command description.
+     *
+     * @var string
+     */
+    protected $description = 'Delete users that are not "admin" or system users';
+
+    public function __construct(UserRepo $userRepo)
+    {
+        $this->userRepo = $userRepo;
+        parent::__construct();
+    }
+
+    public function handle()
+    {
+        $confirm = $this->ask('This will delete all users from the system that are not "admin" or system users. Are you sure you want to continue? (Type "yes" to continue)');
+        $numDeleted = 0;
+        if (strtolower(trim($confirm)) === 'yes') {
+            $totalUsers = User::query()->count();
+            $users = User::query()->whereNull('system_name')->with('roles')->get();
+            foreach ($users as $user) {
+                if ($user->hasSystemRole('admin')) {
+                    // don't delete users with "admin" role
+                    continue;
+                }
+                $this->userRepo->destroy($user);
+                $numDeleted++;
+            }
+            $this->info("Deleted $numDeleted of $totalUsers total users.");
+        } else {
+            $this->info('Exiting...');
+        }
+    }
+}

app/Console/Commands/DeleteUsersCommand.php

@@ -1,53 +0,0 @@
-<?php
-
-namespace BookStack\Console\Commands;
-
-use BookStack\Users\Models\User;
-use BookStack\Users\UserRepo;
-use Illuminate\Console\Command;
-
-class DeleteUsersCommand extends Command
-{
-    /**
-     * The name and signature of the console command.
-     *
-     * @var string
-     */
-    protected $signature = 'bookstack:delete-users';
-
-    /**
-     * The console command description.
-     *
-     * @var string
-     */
-    protected $description = 'Delete users that are not "admin" or system users';
-
-    /**
-     * Execute the console command.
-     */
-    public function handle(UserRepo $userRepo): int
-    {
-        $this->warn('This will delete all users from the system that are not "admin" or system users.');
-        $confirm = $this->confirm('Are you sure you want to continue?');
-
-        if (!$confirm) {
-            return 0;
-        }
-
-        $totalUsers = User::query()->count();
-        $numDeleted = 0;
-        $users = User::query()->whereNull('system_name')->with('roles')->get();
-
-        foreach ($users as $user) {
-            if ($user->hasSystemRole('admin')) {
-                // don't delete users with "admin" role
-                continue;
-            }
-            $userRepo->destroy($user);
-            $numDeleted++;
-        }
-
-        $this->info("Deleted $numDeleted of $totalUsers total users.");
-        return 0;
-    }
-}

app/Console/Commands/RegenerateCommentContent.php

@@ -2,20 +2,19 @@
 
 namespace BookStack\Console\Commands;
 
-use BookStack\Activity\CommentRepo;
-use BookStack\Activity\Models\Comment;
+use BookStack\Actions\Comment;
+use BookStack\Actions\CommentRepo;
 use Illuminate\Console\Command;
 use Illuminate\Support\Facades\DB;
 
-class RegenerateCommentContentCommand extends Command
+class RegenerateCommentContent extends Command
 {
     /**
      * The name and signature of the console command.
      *
      * @var string
      */
-    protected $signature = 'bookstack:regenerate-comment-content
-                            {--database= : The database connection to use}';
+    protected $signature = 'bookstack:regenerate-comment-content {--database= : The database connection to use.}';
 
     /**
      * The console command description.
@@ -25,18 +24,34 @@ class RegenerateCommentContentCommand extends Command
     protected $description = 'Regenerate the stored HTML of all comments';
 
     /**
-     * Execute the console command.
+     * @var CommentRepo
      */
-    public function handle(CommentRepo $commentRepo): int
+    protected $commentRepo;
+
+    /**
+     * Create a new command instance.
+     */
+    public function __construct(CommentRepo $commentRepo)
+    {
+        $this->commentRepo = $commentRepo;
+        parent::__construct();
+    }
+
+    /**
+     * Execute the console command.
+     *
+     * @return mixed
+     */
+    public function handle()
     {
         $connection = DB::getDefaultConnection();
         if ($this->option('database') !== null) {
             DB::setDefaultConnection($this->option('database'));
         }
 
-        Comment::query()->chunk(100, function ($comments) use ($commentRepo) {
+        Comment::query()->chunk(100, function ($comments) {
             foreach ($comments as $comment) {
-                $comment->html = $commentRepo->commentToHtml($comment->text);
+                $comment->html = $this->commentRepo->commentToHtml($comment->text);
                 $comment->save();
             }
         });