Updated translator & dependency attribution before release v25.02.2

Merge pull request #5558 from BookStackApp/lexical_round3
Lexical Fixes: Round 3
2025-04-20 10:57:35 +08:00 · 2025-04-02 17:30:43 +01:00 · 2025-04-02 17:23:38 +01:00 · 2025-04-02 17:19:34 +01:00 · 2025-04-02 15:30:31 +01:00 · 2025-04-02 15:18:31 +01:00
1801 changed files with 127881 additions and 22366 deletions
--- a/.env.example.complete
+++ b/.env.example.complete
@ -56,6 +56,7 @@ APP_PROXIES=null

 # Database details
 # Host can contain a port (localhost:3306) or a separate DB_PORT option can be used.
+# An ipv6 address can be used via the square bracket format ([::1]).
 DB_HOST=localhost
 DB_PORT=3306
 DB_DATABASE=database_database
@ -72,7 +73,7 @@ MYSQL_ATTR_SSL_CA="/path/to/ca.pem"
 # Mail configuration
 # Refer to https://www.bookstackapp.com/docs/admin/email-webhooks/#email-configuration
 MAIL_DRIVER=smtp
-MAIL_FROM=mail@bookstackapp.com
+MAIL_FROM=bookstack@example.com
 MAIL_FROM_NAME=BookStack

 MAIL_HOST=localhost
@ -215,10 +216,11 @@ LDAP_SERVER=false
 LDAP_BASE_DN=false
 LDAP_DN=false
 LDAP_PASS=false
-LDAP_USER_FILTER=false
+LDAP_USER_FILTER="(&(uid={user}))"
 LDAP_VERSION=false
 LDAP_START_TLS=false
 LDAP_TLS_INSECURE=false
+LDAP_TLS_CA_CERT=false
 LDAP_ID_ATTRIBUTE=uid
 LDAP_EMAIL_ATTRIBUTE=mail
 LDAP_DISPLAY_NAME_ATTRIBUTE=cn
@ -267,12 +269,14 @@ OIDC_ISSUER_DISCOVER=false
 OIDC_PUBLIC_KEY=null
 OIDC_AUTH_ENDPOINT=null
 OIDC_TOKEN_ENDPOINT=null
+OIDC_USERINFO_ENDPOINT=null
 OIDC_ADDITIONAL_SCOPES=null
 OIDC_DUMP_USER_DETAILS=false
 OIDC_USER_TO_GROUPS=false
 OIDC_GROUPS_CLAIM=groups
 OIDC_REMOVE_FROM_GROUPS=false
 OIDC_EXTERNAL_ID_CLAIM=sub
+OIDC_END_SESSION_ENDPOINT=false

 # Disable default third-party services such as Gravatar and Draw.IO
 # Service-specific options will override this option
@ -323,6 +327,19 @@ FILE_UPLOAD_SIZE_LIMIT=50
 # Can be 'a4' or 'letter'.
 EXPORT_PAGE_SIZE=a4

+# Export PDF Command
+# Set a command which can be used to convert a HTML file into a PDF file.
+# When false this will not be used.
+# String values represent the command to be called for conversion.
+# Supports '{input_html_path}' and '{output_pdf_path}' placeholder values.
+# Example: EXPORT_PDF_COMMAND="/scripts/convert.sh {input_html_path} {output_pdf_path}"
+EXPORT_PDF_COMMAND=false
+
+# Export PDF Command Timeout
+# The number of seconds that the export PDF command will run before a timeout occurs.
+# Only applies for the EXPORT_PDF_COMMAND option, not for DomPDF or wkhtmltopdf.
+EXPORT_PDF_COMMAND_TIMEOUT=15
+
 # Set path to wkhtmltopdf binary for PDF generation.
 # Can be 'false' or a path path like: '/home/bins/wkhtmltopdf'
 # When false, BookStack will attempt to find a wkhtmltopdf in the application
--- a/.github/ISSUE_TEMPLATE/bug_report.yml
+++ b/.github/ISSUE_TEMPLATE/bug_report.yml
@ -1,7 +1,14 @@
 name: Bug Report
-description: Create a report to help us improve or fix things
+description: Create a report to help us fix bugs & issues in existing supported functionality
 labels: [":bug: Bug"]
 body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for taking the time to fill out a bug report!
+        Please note that this form is for reporting bugs in existing supported functionality.
+        
+        If you are reporting something that's not an issue in functionality we've previously supported and/or is simply something different to your expectations, then it may be more appropriate to raise via a feature or support request instead.
  - type: textarea
    id: description
    attributes:
@ -13,7 +20,7 @@ body:
    id: reproduction
    attributes:
      label: Steps to Reproduce
-      description: Detail the steps that would replicate this issue
+      description: Detail the steps that would replicate this issue.
      placeholder: |
        1. Go to '...'
        2. Click on '....'
@ -32,7 +39,7 @@ body:
    id: context
    attributes:
      label: Screenshots or Additional Context
-      description: Provide any additional context and screenshots here to help us solve this issue
+      description: Provide any additional context and screenshots here to help us solve this issue.
    validations:
      required: false
  - type: input
@ -48,23 +55,7 @@ body:
    id: bsversion
    attributes:
      label: Exact BookStack Version
-      description: This can be found in the settings view of BookStack. Please provide an exact version.
-      placeholder: (eg. v21.08.5)
-    validations:
-      required: true
-  - type: input
-    id: phpversion
-    attributes:
-      label: PHP Version
-      description: Keep in mind your command-line PHP version may differ to that of your webserver. Provide that relevant to the issue.
-      placeholder: (eg. 7.4)
-    validations:
-      required: false
-  - type: textarea
-    id: hosting
-    attributes:
-      label: Hosting Environment
-      description: Describe your hosting environment as much as possible including any proxies used (If applicable).
-      placeholder: (eg. Ubuntu 20.04 VPS, installed using official installation script)
+      description: This can be found in the settings view of BookStack. Please provide an exact version(s) you've tested on.
+      placeholder: (eg. v23.06.7)
    validations:
      required: true
--- a/.github/ISSUE_TEMPLATE/feature_request.yml
+++ b/.github/ISSUE_TEMPLATE/feature_request.yml
@ -33,9 +33,9 @@ body:
    attributes:
      label: Have you searched for an existing open/closed issue?
      description: |
-        To help us keep these issues under control, please ensure you have first [searched our issue list](https://github.com/BookStackApp/BookStack/issues?q=is%3Aissue) for any existing issues that cover the fundemental benefit/goal of your request.
+        To help us keep these issues under control, please ensure you have first [searched our issue list](https://github.com/BookStackApp/BookStack/issues?q=is%3Aissue) for any existing issues that cover the fundamental benefit/goal of your request.
      options:
-        - label: I have searched for existing issues and none cover my fundemental request
+        - label: I have searched for existing issues and none cover my fundamental request
          required: true
  - type: dropdown
    id: existing_usage
@ -43,8 +43,8 @@ body:
      label: How long have you been using BookStack?
      options:
        - Not using yet, just scoping
-        - 0 to 6 months
-        - 6 months to 1 year
+        - Under 3 months
+        - 3 months to 1 year
        - 1 to 5 years
        - Over 5 years
    validations:
--- a/.github/ISSUE_TEMPLATE/support_request.yml
+++ b/.github/ISSUE_TEMPLATE/support_request.yml
@ -33,7 +33,7 @@ body:
    attributes:
      label: Exact BookStack Version
      description: This can be found in the settings view of BookStack. Please provide an exact version.
-      placeholder: (eg. v21.08.5)
+      placeholder: (eg. v23.06.7)
    validations:
      required: true
  - type: textarea
@ -44,19 +44,11 @@ body:
      placeholder: Be sure to remove any confidential details in your logs
    validations:
      required: false
-  - type: input
-    id: phpversion
-    attributes:
-      label: PHP Version
-      description: Keep in mind your command-line PHP version may differ to that of your webserver. Provide that most relevant to the issue.
-      placeholder: (eg. 7.4)
-    validations:
-      required: false
  - type: textarea
    id: hosting
    attributes:
      label: Hosting Environment
      description: Describe your hosting environment as much as possible including any proxies used (If applicable).
-      placeholder: (eg. Ubuntu 20.04 VPS, installed using official installation script)
+      placeholder: (eg. PHP8.1 on Ubuntu 22.04 VPS, installed using official installation script)
    validations:
      required: true
--- a/.github/SECURITY.md
+++ b/.github/SECURITY.md
@ -15,18 +15,13 @@ If you'd like to be notified of new potential security concerns you can [sign-up
 If you've found an issue that likely has no impact to existing users (For example, in a development-only branch)
 feel free to raise it via a standard GitHub bug report issue.

-If the issue could have a security impact to BookStack instances, please use one of the below 
-methods to report the vulnerability:
-
- Directly contact the lead maintainer [@ssddanbrown](https://github.com/ssddanbrown). 
-  - You will need to login to be able to see the email address on the [GitHub profile page](https://github.com/ssddanbrown).
-  - Alternatively you can send a DM via Twitter to [@ssddanbrown](https://twitter.com/ssddanbrown).
- [Disclose via huntr.dev](https://huntr.dev/bounties/disclose)
-  - Bounties may be available to you through this platform.
-  - Be sure to use `https://github.com/BookStackApp/BookStack` as the repository URL.
+If the issue could have a security impact to BookStack instances, 
+please directly contact the lead maintainer [@ssddanbrown](https://github.com/ssddanbrown). 
+You will need to log in to be able to see the email address on the [GitHub profile page](https://github.com/ssddanbrown).
+Alternatively you can send a DM via Mastodon to [@danb@fosstodon.org](https://fosstodon.org/@danb).

 Please be patient while the vulnerability is being reviewed. Deploying the fix to address the vulnerability
 can often take a little time due to the amount of preparation required, to ensure the vulnerability has
 been covered, and to create the content required to adequately notify the user-base.

-Thank you for keeping BookStack instances safe!
+Thank you for keeping BookStack instances safe!
--- a/.github/translators.txt
+++ b/.github/translators.txt
@ -57,6 +57,7 @@ Name :: Languages
@Jokuna :: Korean
@smartshogu :: German; German Informal
@samadha56 :: Persian
+@mrmuminov :: Uzbek
 cipi1965 :: Italian
 Mykola Ronik (Mantikor) :: Ukrainian
 furkanoyk :: Turkish
@ -140,7 +141,7 @@ Kauê Sena (kaue.sena.ks) :: Portuguese, Brazilian
 MatthieuParis :: French
 Douradinho :: Portuguese, Brazilian; Portuguese
 Gaku Yaguchi (tama11) :: Japanese
-johnroyer :: Chinese Traditional
+Zero Huang (johnroyer) :: Chinese Traditional
 jackaaa :: Chinese Traditional
 Irfan Hukama Arsyad (IrfanArsyad) :: Indonesian
 Jeff Huang (s8321414) :: Chinese Traditional
@ -176,7 +177,7 @@ Alexander Predl (Harveyhase68) :: German
 Rem (Rem9000) :: Dutch
 Michał Stelmach (stelmach-web) :: Polish
 arniom :: French
-REMOVED_USER :: ; French; Dutch; Turkish
+REMOVED_USER :: French; Dutch; Portuguese, Brazilian; Portuguese; Turkish; 
 林祖年 (contagion) :: Chinese Traditional
 Siamak Guodarzi (siamakgoudarzi88) :: Persian
 Lis Maestrelo (lismtrl) :: Portuguese, Brazilian
@ -269,7 +270,7 @@ mcgong (GongMingCai) :: Chinese Simplified; Chinese Traditional
 Nanang Setia Budi (sefidananang) :: Indonesian
 Андрей Павлов (andrei.pavlov) :: Russian
 Alex Navarro (alex.n.navarro) :: Portuguese, Brazilian
-Ji-Hyeon Gim (PotatoGim) :: Korean
+Jihyeon Gim (PotatoGim) :: Korean
 Mihai Ochian (soulstorm19) :: Romanian
 HeartCore :: German Informal; German
 simon.pct :: French
@ -289,7 +290,7 @@ Ismael Mesquita (mesquitoliveira) :: Portuguese, Brazilian
 LiZerui (CNLiZerui) :: Chinese Traditional
 Fabrice Boyer (FabriceBoyer) :: French
 mikael (bitcanon) :: Swedish
-Matthias Mai (schnapsidee) :: German; German Informal
+Matthias Mai (schnapsidee) :: German Informal; German
 Ufuk Ayyıldız (ufukayyildiz) :: Turkish
 Jan Mitrof (jan.kachlik) :: Czech
 edwardsmirnov :: Russian
@ -323,7 +324,7 @@ Robin Flikkema (RobinFlikkema) :: Dutch
 Michal Gurcik (mgurcik) :: Slovak
 Pooyan Arab (pooyanarab) :: Persian
 Ochi Darma Putra (troke12) :: Indonesian
-H.-H. Peng (Hsins) :: Chinese Traditional
+Hsin-Hsiang Peng (Hsins) :: Chinese Traditional
 Mosi  Wang (mosiwang) :: Chinese Traditional
 骆言 (LawssssCat) :: Chinese Simplified
 Stickers Gaming Shøw (StickerSGSHOW) :: French
@ -346,8 +347,8 @@ Taygun Yıldırım (yildirimtaygun) :: Turkish
 robing29 :: German
 Bruno Eduardo de Jesus Barroso (brunoejb) :: Portuguese, Brazilian
 Igor V Belousov (biv) :: Russian
-David Bauer (davbauer) :: German
-Guttorm Hveem (guttormhveem) :: Norwegian Bokmal
+David Bauer (davbauer) :: German; German Informal
+Guttorm Hveem (guttormhveem) :: Norwegian Nynorsk; Norwegian Bokmal
 Minh Giang Truong (minhgiang1204) :: Vietnamese
 Ioannis Ioannides (i.ioannides) :: Greek
 Vadim (vadrozh) :: Russian
@ -356,4 +357,130 @@ Paulo Henrique (paulohsantos114) :: Portuguese, Brazilian
 Dženan (Dzenan) :: Swedish
 Péter Péli (peter.peli) :: Hungarian
 TWME :: Chinese Traditional
-Sascha (Man-in-Black) :: German
+Sascha (Man-in-Black) :: German; German Informal
+Mohammadreza Madadi (madadi.efl) :: Persian
+Konstantin (kkovacheli) :: Ukrainian; Russian
+link1183 :: French
+Renan (rfpe) :: Portuguese, Brazilian
+Lowkey (bbsweb) :: Chinese Simplified
+ZZnOB (zznobzz) :: Russian
+rupus :: Swedish
+developernecsys :: Norwegian Nynorsk
+xuan LI (xuanli233) :: Chinese Simplified
+LameeQS :: Latvian
+Sorin T. (trimbitassorin) :: Romanian
+poesty :: Chinese Simplified
+balmag :: Hungarian
+Antti-Jussi Nygård (ajnyga) :: Finnish
+Eduard Ereza Martínez (Ereza) :: Catalan
+Jabir Lang (amar.almrad) :: Arabic
+Jaroslav Kobližek (foretix) :: Czech; French
+Wiktor Adamczyk (adamczyk.wiktor) :: Polish
+Abdulmajeed Alshuaibi (4Majeed) :: Arabic
+NotSmartZakk :: Czech
+HyoungMin Lee (ddokkaebi) :: Korean
+Dasferco :: Chinese Simplified
+Marcus Teräs (mteras) :: Finnish
+Serkan Yardim (serkanzz) :: Turkish
+Y (cnsr) :: Ukrainian
+ZY ZV (vy0b0x) :: Chinese Simplified
+diegobenitez :: Spanish
+Marc Hagen (MarcHagen) :: Dutch
+Kasper Alsøe (zeonos) :: Danish
+sultani :: Persian
+renge :: Korean
+Tim (thegatesdev) :: Dutch; German Informal; French; Romanian; Catalan; Czech; Danish; German; Finnish; Hungarian; Italian; Japanese; Korean; Polish; Russian; Ukrainian; Chinese Simplified; Chinese Traditional; Portuguese, Brazilian; Persian; Spanish, Argentina; Croatian; Norwegian Nynorsk; Estonian; Uzbek; Norwegian Bokmal
+Irdi (irdiOL) :: Albanian
+KateBarber :: Welsh
+Twister (theuncles75) :: Hebrew
+algernon19 :: Hungarian
+Ivan Krstic (ikrstic) :: Serbian (Cyrillic)
+Show :: Russian
+xBahamut :: Portuguese, Brazilian
+Pavle Knežević (pavleknezzevic) :: Serbian (Cyrillic)
+Vanja Cvelbar (b100w11) :: Slovenian
+simonpct :: French
+Honza Nagy (honza.nagy) :: Czech
+asd20752 :: Norwegian Bokmal
+Jan Picka (polipones) :: Czech
+diogoalex991 :: Portuguese
+Ehsan Sadeghi (ehsansadeghi) :: Persian
+ka_picit :: Danish
+cracrayol :: French
+CapuaSC :: Dutch
+Guardian75 :: German Informal
+mr-kanister :: German
+Michele Bastianelli (makoblaster) :: Italian
+jespernissen :: Danish
+Andrey (avmaksimov) :: Russian
+Gonzalo Loyola (AlFcl) :: Spanish, Argentina; Spanish
+grobert63 :: French
+wusst. (Supporti) :: German
+MaximMaximS :: Czech
+damian-klima :: Slovak
+crow_ :: Latvian
+JocelynDelalande :: French
+Jan (JW-CH) :: German Informal
+Timo B (lommes) :: German Informal
+Erik Lundstedt (Erik.Lundstedt) :: Swedish
+yngams (younessmouhid) :: Arabic
+Ohadp :: Hebrew
+cbridi :: Portuguese, Brazilian
+nanangsb :: Indonesian
+Michal Melich (michalmelich) :: Czech
+David (david-prv) :: German; German Informal
+Larry (lahoje) :: Swedish
+Marcia dos Santos (marciab80) :: Portuguese
+Ricard López Torres (richilpez.torres) :: Catalan
+sarahalves7 :: Portuguese, Brazilian
+petr.husak :: Czech
+javadataherian :: Persian
+Ludo-code :: French
+hollsten :: Swedish
+Ngoc Lan Phung (lanpncz) :: Vietnamese
+Worive :: Catalan
+Илья Скаба (skabailya) :: Russian
+Irjan Olsen (Irch) :: Norwegian Bokmal
+Aleksandar Jovanovic (jovanoviczaleksandar) :: Serbian (Cyrillic)
+Red (RedVortex) :: Hebrew
+xgrug :: Chinese Simplified
+HrCalmar :: Danish
+Avishay Rapp (AvishayRapp) :: Hebrew
+matthias4217 :: French
+Berke BOYLU2 (berkeboylu2) :: Turkish
+etwas7B :: German
+Mohammed srhiri (m.sghiri20) :: Arabic
+YongMin Kim (kym0118) :: Korean
+Rivo Zängov (Eraser) :: Estonian
+Francisco Rafael Fonseca (chicoraf) :: Portuguese, Brazilian
+ИEØ_ΙΙØZ (NEO_IIOZ) :: Chinese Traditional
+madnjpn (madnjpn.) :: Georgian
+Ásgeir Shiny Ásgeirsson (AsgeirShiny) :: Icelandic
+Mohammad Aftab Uddin (chirohorit) :: Bengali
+Yannis Karlaftis (meliseus) :: Greek
+felixxx :: German Informal
+randi (randi65535) :: Korean
+test65428 :: Greek
+zeronell :: Chinese Simplified
+julien Vinber (julienVinber) :: French
+Hyunwoo Park (oksure) :: Korean
+aram.rafeq.7 (aramrafeq2) :: Kurdish
+Raphael Moreno (RaphaelMoreno) :: Portuguese, Brazilian
+yn (user99) :: Arabic
+Pavel Zlatarov (pzlatarov) :: Bulgarian
+ingelres :: French
+mabdullah :: Arabic
+Skrabák Csaba (kekcsi) :: Hungarian
+Evert Meulie (Evert) :: Norwegian Bokmal
+Jasper Backer (jasperb) :: Dutch
+Alexandar Cavdarovski (ace.200112) :: Swedish
+구닥다리TV (yjj8353) :: Korean
+Onur Oskay (o.oskay) :: Turkish
+Sébastien Merveille (SebastienMerv) :: French
+Maxim Kouznetsov (masya.work) :: Hebrew
+neodvisnost :: Slovenian
+Soubi Agatsuma (bisouya) :: Hebrew
+Ilya Shaulov (ishaulov) :: Russian
+Konstantin Bobkov (b.konstantv) :: Russian
+Ruben Sutter (rubensutter) :: German
+jellium :: French
--- a/.github/workflows/analyse-php.yml
+++ b/.github/workflows/analyse-php.yml
@ -1,18 +1,24 @@
 name: analyse-php

-on: [push, pull_request]
+on:
+  push:
+    paths:
+      - '**.php'
+  pull_request:
+    paths:
+      - '**.php'

 jobs:
  build:
    if: ${{ github.ref != 'refs/heads/l10n_development' }}
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
    steps:
-    - uses: actions/checkout@v1
+    - uses: actions/checkout@v4

    - name: Setup PHP
      uses: shivammathur/setup-php@v2
      with:
-        php-version: 8.1
+        php-version: 8.3
        extensions: gd, mbstring, json, curl, xml, mysql, ldap

    - name: Get Composer Cache Directory
@ -21,10 +27,10 @@ jobs:
        echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT

    - name: Cache composer packages
-      uses: actions/cache@v3
+      uses: actions/cache@v4
      with:
        path: ${{ steps.composer-cache.outputs.dir }}
-        key: ${{ runner.os }}-composer-8.1
+        key: ${{ runner.os }}-composer-8.3
        restore-keys: ${{ runner.os }}-composer-

    - name: Install composer dependencies
--- a/.github/workflows/lint-js.yml
+++ b/.github/workflows/lint-js.yml
@ -1,13 +1,21 @@
 name: lint-js

-on: [push, pull_request]
+on:
+  push:
+    paths:
+      - '**.js'
+      - '**.json'
+  pull_request:
+    paths:
+      - '**.js'
+      - '**.json'

 jobs:
  build:
    if: ${{ github.ref != 'refs/heads/l10n_development' }}
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
    steps:
-    - uses: actions/checkout@v1
+    - uses: actions/checkout@v4

    - name: Install NPM deps
      run: npm ci
--- a/.github/workflows/lint-php.yml
+++ b/.github/workflows/lint-php.yml
@ -1,18 +1,24 @@
 name: lint-php

-on: [push, pull_request]
+on:
+  push:
+    paths:
+      - '**.php'
+  pull_request:
+    paths:
+      - '**.php'

 jobs:
  build:
    if: ${{ github.ref != 'refs/heads/l10n_development' }}
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
    steps:
-    - uses: actions/checkout@v1
+    - uses: actions/checkout@v4

    - name: Setup PHP
      uses: shivammathur/setup-php@v2
      with:
-        php-version: 8.1
+        php-version: 8.3
        tools: phpcs

    - name: Run formatting check
--- a/.github/workflows/test-js.yml
+++ b/.github/workflows/test-js.yml
@ -0,0 +1,29 @@
+name: test-js
+
+on:
+  push:
+    paths:
+      - '**.js'
+      - '**.ts'
+      - '**.json'
+  pull_request:
+    paths:
+      - '**.js'
+      - '**.ts'
+      - '**.json'
+
+jobs:
+  build:
+    if: ${{ github.ref != 'refs/heads/l10n_development' }}
+    runs-on: ubuntu-24.04
+    steps:
+    - uses: actions/checkout@v4
+
+    - name: Install NPM deps
+      run: npm ci
+
+    - name: Run TypeScript type checking
+      run: npm run ts:lint
+
+    - name: Run JavaScript tests
+      run: npm run test
--- a/.github/workflows/test-migrations.yml
+++ b/.github/workflows/test-migrations.yml
@ -1,16 +1,24 @@
 name: test-migrations

-on: [push, pull_request]
+on:
+  push:
+    paths:
+      - '**.php'
+      - 'composer.*'
+  pull_request:
+    paths:
+      - '**.php'
+      - 'composer.*'

 jobs:
  build:
    if: ${{ github.ref != 'refs/heads/l10n_development' }}
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
    strategy:
      matrix:
-        php: ['8.0', '8.1', '8.2']
+        php: ['8.2', '8.3', '8.4']
    steps:
-      - uses: actions/checkout@v1
+      - uses: actions/checkout@v4

      - name: Setup PHP
        uses: shivammathur/setup-php@v2
@ -24,7 +32,7 @@ jobs:
          echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT

      - name: Cache composer packages
-        uses: actions/cache@v3
+        uses: actions/cache@v4
        with:
          path: ${{ steps.composer-cache.outputs.dir }}
          key: ${{ runner.os }}-composer-${{ matrix.php }}
--- a/.github/workflows/test-php.yml
+++ b/.github/workflows/test-php.yml
@ -1,16 +1,24 @@
 name: test-php

-on: [push, pull_request]
+on:
+  push:
+    paths:
+      - '**.php'
+      - 'composer.*'
+  pull_request:
+    paths:
+      - '**.php'
+      - 'composer.*'

 jobs:
  build:
    if: ${{ github.ref != 'refs/heads/l10n_development' }}
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
    strategy:
      matrix:
-        php: ['8.0', '8.1', '8.2']
+        php: ['8.2', '8.3', '8.4']
    steps:
-    - uses: actions/checkout@v1
+    - uses: actions/checkout@v4

    - name: Setup PHP
      uses: shivammathur/setup-php@v2
@ -24,7 +32,7 @@ jobs:
        echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT

    - name: Cache composer packages
-      uses: actions/cache@v3
+      uses: actions/cache@v4
      with:
        path: ${{ steps.composer-cache.outputs.dir }}
        key: ${{ runner.os }}-composer-${{ matrix.php }}
--- a/.gitignore
+++ b/.gitignore
@ -2,15 +2,16 @@
 /node_modules
 /.vscode
 /composer
+/coverage
 Homestead.yaml
 .env
 .idea
 npm-debug.log
 yarn-error.log
-/public/dist/*.map
+/public/dist
 /public/plugins
-/public/css/*.map
-/public/js/*.map
+/public/css
+/public/js
 /public/bower
 /public/build/
 /public/favicon.ico
@ -29,4 +30,6 @@ webpack-stats.json
 .phpunit.result.cache
 .DS_Store
 phpstan.neon
-esbuild-meta.json
+esbuild-meta.json
+.phpactor.json
+/*.zip
--- a/2
+++ b/2
@ -1,6 +1,6 @@
 The MIT License (MIT)

-Copyright (c) 2015-2023, Dan Brown and the BookStack Project contributors.
+Copyright (c) 2015-2025, Dan Brown and the BookStack project contributors.

 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
--- a/app/Access/Controllers/ConfirmEmailController.php
+++ b/app/Access/Controllers/ConfirmEmailController.php
@ -32,13 +32,17 @@ class ConfirmEmailController extends Controller

    /**
     * Shows a notice that a user's email address has not been confirmed,
-     * Also has the option to re-send the confirmation email.
+     * along with the option to re-send the confirmation email.
     */
    public function showAwaiting()
    {
        $user = $this->loginService->getLastLoginAttemptUser();
+        if ($user === null) {
+            $this->showErrorNotification(trans('errors.login_user_not_found'));
+            return redirect('/login');
+        }

-        return view('auth.user-unconfirmed', ['user' => $user]);
+        return view('auth.register-confirm-awaiting');
    }

    /**
@ -90,19 +94,24 @@ class ConfirmEmailController extends Controller
    /**
     * Resend the confirmation email.
     */
-    public function resend(Request $request)
+    public function resend()
    {
-        $this->validate($request, [
-            'email' => ['required', 'email', 'exists:users,email'],
-        ]);
-        $user = $this->userRepo->getByEmail($request->get('email'));
+        $user = $this->loginService->getLastLoginAttemptUser();
+        if ($user === null) {
+            $this->showErrorNotification(trans('errors.login_user_not_found'));
+            return redirect('/login');
+        }

        try {
            $this->emailConfirmationService->sendConfirmation($user);
+        } catch (ConfirmationEmailException $e) {
+            $this->showErrorNotification($e->getMessage());
+
+            return redirect('/login');
        } catch (Exception $e) {
            $this->showErrorNotification(trans('auth.email_confirm_send_error'));

-            return redirect('/register/confirm');
+            return redirect('/register/awaiting');
        }

        $this->showSuccessNotification(trans('auth.email_confirm_resent'));
--- a/app/Access/Controllers/ForgotPasswordController.php
+++ b/app/Access/Controllers/ForgotPasswordController.php
@ -6,14 +6,10 @@ use BookStack\Activity\ActivityType;
 use BookStack\Http\Controller;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Password;
+use Illuminate\Support\Sleep;

 class ForgotPasswordController extends Controller
 {
-    /**
-     * Create a new controller instance.
-     *
-     * @return void
-     */
    public function __construct()
    {
        $this->middleware('guest');
@ -30,10 +26,6 @@ class ForgotPasswordController extends Controller

    /**
     * Send a reset link to the given user.
-     *
-     * @param \Illuminate\Http\Request $request
-     *
-     * @return \Illuminate\Http\RedirectResponse
     */
    public function sendResetLinkEmail(Request $request)
    {
@ -41,6 +33,10 @@ class ForgotPasswordController extends Controller
            'email' => ['required', 'email'],
        ]);

+        // Add random pause to the response to help avoid time-base sniffing
+        // of valid resets via slower email send handling.
+        Sleep::for(random_int(1000, 3000))->milliseconds();
+
        // We will send the password reset link to this user. Once we have attempted
        // to send the link, we will examine the response then see the message we
        // need to show to the user. Finally, we'll send out a proper response.
@ -56,13 +52,13 @@ class ForgotPasswordController extends Controller
            $message = trans('auth.reset_password_sent', ['email' => $request->get('email')]);
            $this->showSuccessNotification($message);

-            return back()->with('status', trans($response));
+            return redirect('/password/email')->with('status', trans($response));
        }

        // If an error was returned by the password broker, we will get this message
        // translated so we can notify a user of the problem. We'll redirect back
        // to where the users came from so they can attempt this process again.
-        return back()->withErrors(
+        return redirect('/password/email')->withErrors(
            ['email' => trans($response)]
        );
    }
--- a/app/Access/Controllers/HandlesPartialLogins.php
+++ b/app/Access/Controllers/HandlesPartialLogins.php
@ -17,7 +17,7 @@ trait HandlesPartialLogins
        $user = auth()->user() ?? $loginService->getLastLoginAttemptUser();

        if (!$user) {
-            throw new NotFoundException('A user for this action could not be found');
+            throw new NotFoundException(trans('errors.login_user_not_found'));
        }

        return $user;
--- a/app/Access/Controllers/LoginController.php
+++ b/app/Access/Controllers/LoginController.php
@ -3,34 +3,26 @@
 namespace BookStack\Access\Controllers;

 use BookStack\Access\LoginService;
-use BookStack\Access\SocialAuthService;
+use BookStack\Access\SocialDriverManager;
 use BookStack\Exceptions\LoginAttemptEmailNeededException;
 use BookStack\Exceptions\LoginAttemptException;
 use BookStack\Facades\Activity;
 use BookStack\Http\Controller;
 use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
-use Illuminate\Support\Facades\Auth;
 use Illuminate\Validation\ValidationException;

 class LoginController extends Controller
 {
    use ThrottlesLogins;

-    protected SocialAuthService $socialAuthService;
-    protected LoginService $loginService;
-
-    /**
-     * Create a new controller instance.
-     */
-    public function __construct(SocialAuthService $socialAuthService, LoginService $loginService)
-    {
+    public function __construct(
+        protected SocialDriverManager $socialDriverManager,
+        protected LoginService $loginService,
+    ) {
        $this->middleware('guest', ['only' => ['getLogin', 'login']]);
        $this->middleware('guard:standard,ldap', ['only' => ['login']]);
        $this->middleware('guard:standard,ldap,oidc', ['only' => ['logout']]);
-
-        $this->socialAuthService = $socialAuthService;
-        $this->loginService = $loginService;
    }

    /**
@ -38,7 +30,7 @@ class LoginController extends Controller
     */
    public function getLogin(Request $request)
    {
-        $socialDrivers = $this->socialAuthService->getActiveDrivers();
+        $socialDrivers = $this->socialDriverManager->getActive();
        $authMethod = config('auth.method');
        $preventInitiation = $request->get('prevent_auto_init') === 'true';

@ -52,7 +44,7 @@ class LoginController extends Controller
        // Store the previous location for redirect after login
        $this->updateIntendedFromPrevious();

-        if (!$preventInitiation && $this->shouldAutoInitiate()) {
+        if (!$preventInitiation && $this->loginService->shouldAutoInitiate()) {
            return view('auth.login-initiate', [
                'authMethod'    => $authMethod,
            ]);
@ -101,15 +93,9 @@ class LoginController extends Controller
    /**
     * Logout user and perform subsequent redirect.
     */
-    public function logout(Request $request)
+    public function logout()
    {
-        Auth::guard()->logout();
-        $request->session()->invalidate();
-        $request->session()->regenerateToken();
-
-        $redirectUri = $this->shouldAutoInitiate() ? '/login?prevent_auto_init=true' : '/';
-
-        return redirect($redirectUri);
+        return redirect($this->loginService->logout());
    }

    /**
@ -200,7 +186,7 @@ class LoginController extends Controller
    {
        // Store the previous location for redirect after login
        $previous = url()->previous('');
-        $isPreviousFromInstance = (strpos($previous, url('/')) === 0);
+        $isPreviousFromInstance = str_starts_with($previous, url('/'));
        if (!$previous || !setting('app-public') || !$isPreviousFromInstance) {
            return;
        }
@ -211,23 +197,11 @@ class LoginController extends Controller
        ];

        foreach ($ignorePrefixList as $ignorePrefix) {
-            if (strpos($previous, url($ignorePrefix)) === 0) {
+            if (str_starts_with($previous, url($ignorePrefix))) {
                return;
            }
        }

        redirect()->setIntendedUrl($previous);
    }
-
-    /**
-     * Check if login auto-initiate should be valid based upon authentication config.
-     */
-    protected function shouldAutoInitiate(): bool
-    {
-        $socialDrivers = $this->socialAuthService->getActiveDrivers();
-        $authMethod = config('auth.method');
-        $autoRedirect = config('auth.auto_initiate');
-
-        return $autoRedirect && count($socialDrivers) === 0 && in_array($authMethod, ['oidc', 'saml2']);
-    }
 }
--- a/app/Access/Controllers/MfaTotpController.php
+++ b/app/Access/Controllers/MfaTotpController.php
@ -19,20 +19,25 @@ class MfaTotpController extends Controller

    protected const SETUP_SECRET_SESSION_KEY = 'mfa-setup-totp-secret';

+    public function __construct(
+        protected TotpService $totp
+    ) {
+    }
+
    /**
     * Show a view that generates and displays a TOTP QR code.
     */
-    public function generate(TotpService $totp)
+    public function generate()
    {
        if (session()->has(static::SETUP_SECRET_SESSION_KEY)) {
            $totpSecret = decrypt(session()->get(static::SETUP_SECRET_SESSION_KEY));
        } else {
-            $totpSecret = $totp->generateSecret();
+            $totpSecret = $this->totp->generateSecret();
            session()->put(static::SETUP_SECRET_SESSION_KEY, encrypt($totpSecret));
        }

-        $qrCodeUrl = $totp->generateUrl($totpSecret, $this->currentOrLastAttemptedUser());
-        $svg = $totp->generateQrCodeSvg($qrCodeUrl);
+        $qrCodeUrl = $this->totp->generateUrl($totpSecret, $this->currentOrLastAttemptedUser());
+        $svg = $this->totp->generateQrCodeSvg($qrCodeUrl);

        $this->setPageTitle(trans('auth.mfa_gen_totp_title'));

@ -56,7 +61,7 @@ class MfaTotpController extends Controller
            'code' => [
                'required',
                'max:12', 'min:4',
-                new TotpValidationRule($totpSecret),
+                new TotpValidationRule($totpSecret, $this->totp),
            ],
        ]);

@ -87,7 +92,7 @@ class MfaTotpController extends Controller
            'code' => [
                'required',
                'max:12', 'min:4',
-                new TotpValidationRule($totpSecret),
+                new TotpValidationRule($totpSecret, $this->totp),
            ],
        ]);

--- a/app/Access/Controllers/OidcController.php
+++ b/app/Access/Controllers/OidcController.php
@ -11,9 +11,6 @@ class OidcController extends Controller
 {
    protected OidcService $oidcService;

-    /**
-     * OpenIdController constructor.
-     */
    public function __construct(OidcService $oidcService)
    {
        $this->oidcService = $oidcService;
@ -63,4 +60,12 @@ class OidcController extends Controller

        return redirect()->intended();
    }
+
+    /**
+     * Log the user out then start the OIDC RP-initiated logout process.
+     */
+    public function logout()
+    {
+        return redirect($this->oidcService->logout());
+    }
 }
--- a/app/Access/Controllers/RegisterController.php
+++ b/app/Access/Controllers/RegisterController.php
@ -4,7 +4,7 @@ namespace BookStack\Access\Controllers;

 use BookStack\Access\LoginService;
 use BookStack\Access\RegistrationService;
-use BookStack\Access\SocialAuthService;
+use BookStack\Access\SocialDriverManager;
 use BookStack\Exceptions\StoppedAuthenticationException;
 use BookStack\Exceptions\UserRegistrationException;
 use BookStack\Http\Controller;
@ -15,24 +15,13 @@ use Illuminate\Validation\Rules\Password;

 class RegisterController extends Controller
 {
-    protected SocialAuthService $socialAuthService;
-    protected RegistrationService $registrationService;
-    protected LoginService $loginService;
-
-    /**
-     * Create a new controller instance.
-     */
    public function __construct(
-        SocialAuthService $socialAuthService,
-        RegistrationService $registrationService,
-        LoginService $loginService
+        protected SocialDriverManager $socialDriverManager,
+        protected RegistrationService $registrationService,
+        protected LoginService $loginService
    ) {
        $this->middleware('guest');
        $this->middleware('guard:standard');
-
-        $this->socialAuthService = $socialAuthService;
-        $this->registrationService = $registrationService;
-        $this->loginService = $loginService;
    }

    /**
@ -43,7 +32,7 @@ class RegisterController extends Controller
    public function getRegister()
    {
        $this->registrationService->ensureRegistrationAllowed();
-        $socialDrivers = $this->socialAuthService->getActiveDrivers();
+        $socialDrivers = $this->socialDriverManager->getActive();

        return view('auth.register', [
            'socialDrivers' => $socialDrivers,
@ -87,6 +76,8 @@ class RegisterController extends Controller
            'name'     => ['required', 'min:2', 'max:100'],
            'email'    => ['required', 'email', 'max:255', 'unique:users'],
            'password' => ['required', Password::default()],
+            // Basic honey for bots that must not be filled in
+            'username' => ['prohibited'],
        ]);
    }
 }
--- a/app/Access/Controllers/ResetPasswordController.php
+++ b/app/Access/Controllers/ResetPasswordController.php
@ -15,14 +15,11 @@ use Illuminate\Validation\Rules\Password as PasswordRule;

 class ResetPasswordController extends Controller
 {
-    protected LoginService $loginService;
-
-    public function __construct(LoginService $loginService)
-    {
+    public function __construct(
+        protected LoginService $loginService
+    ) {
        $this->middleware('guest');
        $this->middleware('guard:standard');
-
-        $this->loginService = $loginService;
    }

    /**
@ -66,7 +63,7 @@ class ResetPasswordController extends Controller
        // redirect them back to where they came from with their error message.
        return $response === Password::PASSWORD_RESET
            ? $this->sendResetResponse()
-            : $this->sendResetFailedResponse($request, $response);
+            : $this->sendResetFailedResponse($request, $response, $request->get('token'));
    }

    /**
@ -83,7 +80,7 @@ class ResetPasswordController extends Controller
    /**
     * Get the response for a failed password reset.
     */
-    protected function sendResetFailedResponse(Request $request, string $response): RedirectResponse
+    protected function sendResetFailedResponse(Request $request, string $response, string $token): RedirectResponse
    {
        // We show invalid users as invalid tokens as to not leak what
        // users may exist in the system.
@ -91,7 +88,7 @@ class ResetPasswordController extends Controller
            $response = Password::INVALID_TOKEN;
        }

-        return redirect()->back()
+        return redirect("/password/reset/{$token}")
            ->withInput($request->only('email'))
            ->withErrors(['email' => trans($response)]);
    }
--- a/app/Access/Controllers/Saml2Controller.php
+++ b/app/Access/Controllers/Saml2Controller.php
@ -9,14 +9,9 @@ use Illuminate\Support\Str;

 class Saml2Controller extends Controller
 {
-    protected Saml2Service $samlService;
-
-    /**
-     * Saml2Controller constructor.
-     */
-    public function __construct(Saml2Service $samlService)
-    {
-        $this->samlService = $samlService;
+    public function __construct(
+        protected Saml2Service $samlService
+    ) {
        $this->middleware('guard:saml2');
    }

@ -36,7 +31,12 @@ class Saml2Controller extends Controller
     */
    public function logout()
    {
-        $logoutDetails = $this->samlService->logout(auth()->user());
+        $user = user();
+        if ($user->isGuest()) {
+            return redirect('/login');
+        }
+
+        $logoutDetails = $this->samlService->logout($user);

        if ($logoutDetails['id']) {
            session()->flash('saml2_logout_request_id', $logoutDetails['id']);
@ -64,7 +64,7 @@ class Saml2Controller extends Controller
    public function sls()
    {
        $requestId = session()->pull('saml2_logout_request_id', null);
-        $redirect = $this->samlService->processSlsResponse($requestId) ?? '/';
+        $redirect = $this->samlService->processSlsResponse($requestId);

        return redirect($redirect);
    }
--- a/app/Access/Controllers/SocialController.php
+++ b/app/Access/Controllers/SocialController.php
@ -16,22 +16,12 @@ use Laravel\Socialite\Contracts\User as SocialUser;

 class SocialController extends Controller
 {
-    protected SocialAuthService $socialAuthService;
-    protected RegistrationService $registrationService;
-    protected LoginService $loginService;
-
-    /**
-     * SocialController constructor.
-     */
    public function __construct(
-        SocialAuthService $socialAuthService,
-        RegistrationService $registrationService,
-        LoginService $loginService
+        protected SocialAuthService $socialAuthService,
+        protected RegistrationService $registrationService,
+        protected LoginService $loginService,
    ) {
        $this->middleware('guest')->only(['register']);
-        $this->socialAuthService = $socialAuthService;
-        $this->registrationService = $registrationService;
-        $this->loginService = $loginService;
    }

    /**
@ -89,7 +79,7 @@ class SocialController extends Controller
            try {
                return $this->socialAuthService->handleLoginCallback($socialDriver, $socialUser);
            } catch (SocialSignInAccountNotUsed $exception) {
-                if ($this->socialAuthService->driverAutoRegisterEnabled($socialDriver)) {
+                if ($this->socialAuthService->drivers()->isAutoRegisterEnabled($socialDriver)) {
                    return $this->socialRegisterCallback($socialDriver, $socialUser);
                }

@ -101,7 +91,7 @@ class SocialController extends Controller
            return $this->socialRegisterCallback($socialDriver, $socialUser);
        }

-        return redirect()->back();
+        return redirect('/');
    }

    /**
@ -112,7 +102,7 @@ class SocialController extends Controller
        $this->socialAuthService->detachSocialAccount($socialDriver);
        session()->flash('success', trans('settings.users_social_disconnected', ['socialAccount' => Str::title($socialDriver)]));

-        return redirect(user()->getEditUrl());
+        return redirect('/my-account/auth#social-accounts');
    }

    /**
@ -124,7 +114,7 @@ class SocialController extends Controller
    {
        $socialUser = $this->socialAuthService->handleRegistrationCallback($socialDriver, $socialUser);
        $socialAccount = $this->socialAuthService->newSocialAccount($socialDriver, $socialUser);
-        $emailVerified = $this->socialAuthService->driverAutoConfirmEmailEnabled($socialDriver);
+        $emailVerified = $this->socialAuthService->drivers()->isAutoConfirmEmailEnabled($socialDriver);

        // Create an array of the user data to create a new user instance
        $userData = [
--- a/app/Access/Controllers/ThrottlesLogins.php
+++ b/app/Access/Controllers/ThrottlesLogins.php
@ -71,7 +71,7 @@ trait ThrottlesLogins
     */
    protected function limiter(): RateLimiter
    {
-        return app(RateLimiter::class);
+        return app()->make(RateLimiter::class);
    }

    /**
--- a/app/Access/EmailConfirmationService.php
+++ b/app/Access/EmailConfirmationService.php
@ -2,8 +2,8 @@

 namespace BookStack\Access;

+use BookStack\Access\Notifications\ConfirmEmailNotification;
 use BookStack\Exceptions\ConfirmationEmailException;
-use BookStack\Notifications\ConfirmEmail;
 use BookStack\Users\Models\User;

 class EmailConfirmationService extends UserTokenService
@ -17,7 +17,7 @@ class EmailConfirmationService extends UserTokenService
     *
     * @throws ConfirmationEmailException
     */
-    public function sendConfirmation(User $user)
+    public function sendConfirmation(User $user): void
    {
        if ($user->email_confirmed) {
            throw new ConfirmationEmailException(trans('errors.email_already_confirmed'), '/login');
@ -26,7 +26,7 @@ class EmailConfirmationService extends UserTokenService
        $this->deleteByUser($user);
        $token = $this->createTokenForUser($user);

-        $user->notify(new ConfirmEmail($token));
+        $user->notify(new ConfirmEmailNotification($token));
    }

    /**
--- a/app/Access/ExternalBaseUserProvider.php
+++ b/app/Access/ExternalBaseUserProvider.php
@ -8,27 +8,15 @@ use Illuminate\Database\Eloquent\Model;

 class ExternalBaseUserProvider implements UserProvider
 {
-    /**
-     * The user model.
-     *
-     * @var string
-     */
-    protected $model;
-
-    /**
-     * LdapUserProvider constructor.
-     */
-    public function __construct(string $model)
-    {
-        $this->model = $model;
+    public function __construct(
+        protected string $model
+    ) {
    }

    /**
     * Create a new instance of the model.
-     *
-     * @return Model
     */
-    public function createModel()
+    public function createModel(): Model
    {
        $class = '\\' . ltrim($this->model, '\\');

@ -37,12 +25,8 @@ class ExternalBaseUserProvider implements UserProvider

    /**
     * Retrieve a user by their unique identifier.
-     *
-     * @param mixed $identifier
-     *
-     * @return Authenticatable|null
     */
-    public function retrieveById($identifier)
+    public function retrieveById(mixed $identifier): ?Authenticatable
    {
        return $this->createModel()->newQuery()->find($identifier);
    }
@ -50,12 +34,9 @@ class ExternalBaseUserProvider implements UserProvider
    /**
     * Retrieve a user by their unique identifier and "remember me" token.
     *
-     * @param mixed  $identifier
     * @param string $token
-     *
-     * @return Authenticatable|null
     */
-    public function retrieveByToken($identifier, $token)
+    public function retrieveByToken(mixed $identifier, $token): null
    {
        return null;
    }
@ -75,12 +56,8 @@ class ExternalBaseUserProvider implements UserProvider

    /**
     * Retrieve a user by the given credentials.
-     *
-     * @param array $credentials
-     *
-     * @return Authenticatable|null
     */
-    public function retrieveByCredentials(array $credentials)
+    public function retrieveByCredentials(array $credentials): ?Authenticatable
    {
        // Search current user base by looking up a uid
        $model = $this->createModel();
@ -92,15 +69,15 @@ class ExternalBaseUserProvider implements UserProvider

    /**
     * Validate a user against the given credentials.
-     *
-     * @param Authenticatable $user
-     * @param array           $credentials
-     *
-     * @return bool
     */
-    public function validateCredentials(Authenticatable $user, array $credentials)
+    public function validateCredentials(Authenticatable $user, array $credentials): bool
    {
        // Should be done in the guard.
        return false;
    }
+
+    public function rehashPasswordIfRequired(Authenticatable $user, #[\SensitiveParameter] array $credentials, bool $force = false)
+    {
+        // No action to perform, any passwords are external in the auth system
+    }
 }
--- a/app/Access/Ldap.php
+++ b/app/Access/Ldap.php
@ -52,13 +52,25 @@ class Ldap
     *
     * @param resource|\LDAP\Connection   $ldapConnection
     *
-     * @return resource|\LDAP\Result
+     * @return \LDAP\Result|array|false
     */
-    public function search($ldapConnection, string $baseDn, string $filter, array $attributes = null)
+    public function search($ldapConnection, string $baseDn, string $filter, array $attributes = [])
    {
        return ldap_search($ldapConnection, $baseDn, $filter, $attributes);
    }

+    /**
+     * Read an entry from the LDAP tree.
+     *
+     * @param resource|\Ldap\Connection $ldapConnection
+     *
+     * @return \LDAP\Result|array|false
+     */
+    public function read($ldapConnection, string $baseDn, string $filter, array $attributes = [])
+    {
+        return ldap_read($ldapConnection, $baseDn, $filter, $attributes);
+    }
+
    /**
     * Get entries from an LDAP search result.
     *
@ -75,7 +87,7 @@ class Ldap
     *
     * @param resource|\LDAP\Connection   $ldapConnection
     */
-    public function searchAndGetEntries($ldapConnection, string $baseDn, string $filter, array $attributes = null): array|false
+    public function searchAndGetEntries($ldapConnection, string $baseDn, string $filter, array $attributes = []): array|false
    {
        $search = $this->search($ldapConnection, $baseDn, $filter, $attributes);

@ -87,7 +99,7 @@ class Ldap
     *
     * @param resource|\LDAP\Connection $ldapConnection
     */
-    public function bind($ldapConnection, string $bindRdn = null, string $bindPassword = null): bool
+    public function bind($ldapConnection, ?string $bindRdn = null, ?string $bindPassword = null): bool
    {
        return ldap_bind($ldapConnection, $bindRdn, $bindPassword);
    }
--- a/app/Access/LdapService.php
+++ b/app/Access/LdapService.php
@ -71,6 +71,26 @@ class LdapService
        return $users[0];
    }

+    /**
+     * Build the user display name from the (potentially multiple) attributes defined by the configuration.
+     */
+    protected function getUserDisplayName(array $userDetails, array $displayNameAttrs, string $defaultValue): string
+    {
+        $displayNameParts = [];
+        foreach ($displayNameAttrs as $dnAttr) {
+            $dnComponent = $this->getUserResponseProperty($userDetails, $dnAttr, null);
+            if ($dnComponent) {
+                $displayNameParts[] = $dnComponent;
+            }
+        }
+
+        if (empty($displayNameParts)) {
+            return $defaultValue;
+        }
+
+        return implode(' ', $displayNameParts);
+    }
+
    /**
     * Get the details of a user from LDAP using the given username.
     * User found via configurable user filter.
@ -81,21 +101,25 @@ class LdapService
    {
        $idAttr = $this->config['id_attribute'];
        $emailAttr = $this->config['email_attribute'];
-        $displayNameAttr = $this->config['display_name_attribute'];
+        $displayNameAttrs = explode('|', $this->config['display_name_attribute']);
        $thumbnailAttr = $this->config['thumbnail_attribute'];

        $user = $this->getUserWithAttributes($userName, array_filter([
-            'cn', 'dn', $idAttr, $emailAttr, $displayNameAttr, $thumbnailAttr,
+            'cn', 'dn', $idAttr, $emailAttr, ...$displayNameAttrs, $thumbnailAttr,
        ]));

        if (is_null($user)) {
            return null;
        }

-        $userCn = $this->getUserResponseProperty($user, 'cn', null);
+        $nameDefault = $this->getUserResponseProperty($user, 'cn', null);
+        if (is_null($nameDefault)) {
+            $nameDefault = ldap_explode_dn($user['dn'], 1)[0] ?? $user['dn'];
+        }
+
        $formatted = [
            'uid'   => $this->getUserResponseProperty($user, $idAttr, $user['dn']),
-            'name'  => $this->getUserResponseProperty($user, $displayNameAttr, $userCn),
+            'name'  => $this->getUserDisplayName($user, $displayNameAttrs, $nameDefault),
            'dn'    => $user['dn'],
            'email' => $this->getUserResponseProperty($user, $emailAttr, null),
            'avatar' => $thumbnailAttr ? $this->getUserResponseProperty($user, $thumbnailAttr, null) : null,
@ -209,6 +233,12 @@ class LdapService
            $this->ldap->setOption(null, LDAP_OPT_X_TLS_REQUIRE_CERT, LDAP_OPT_X_TLS_NEVER);
        }

+        // Configure any user-provided CA cert files for LDAP.
+        // This option works globally and must be set before a connection is created.
+        if ($this->config['tls_ca_cert']) {
+            $this->configureTlsCaCerts($this->config['tls_ca_cert']);
+        }
+
        $ldapHost = $this->parseServerString($this->config['server']);
        $ldapConnection = $this->ldap->connect($ldapHost);

@ -223,7 +253,14 @@ class LdapService

        // Start and verify TLS if it's enabled
        if ($this->config['start_tls']) {
-            $started = $this->ldap->startTls($ldapConnection);
+            try {
+                $started = $this->ldap->startTls($ldapConnection);
+            } catch (\Exception $exception) {
+                $error = $exception->getMessage() . ' :: ' . ldap_error($ldapConnection);
+                ldap_get_option($ldapConnection, LDAP_OPT_DIAGNOSTIC_MESSAGE, $detail);
+                Log::info("LDAP STARTTLS failure: {$error} {$detail}");
+                throw new LdapException('Could not start TLS connection. Further details in the application log.');
+            }
            if (!$started) {
                throw new LdapException('Could not start TLS connection');
            }
@ -234,6 +271,33 @@ class LdapService
        return $this->ldapConnection;
    }

+    /**
+     * Configure TLS CA certs globally for ldap use.
+     * This will detect if the given path is a directory or file, and set the relevant
+     * LDAP TLS options appropriately otherwise throw an exception if no file/folder found.
+     *
+     * Note: When using a folder, certificates are expected to be correctly named by hash
+     * which can be done via the c_rehash utility.
+     *
+     * @throws LdapException
+     */
+    protected function configureTlsCaCerts(string $caCertPath): void
+    {
+        $errMessage = "Provided path [{$caCertPath}] for LDAP TLS CA certs could not be resolved to an existing location";
+        $path = realpath($caCertPath);
+        if ($path === false) {
+            throw new LdapException($errMessage);
+        }
+
+        if (is_dir($path)) {
+            $this->ldap->setOption(null, LDAP_OPT_X_TLS_CACERTDIR, $path);
+        } else if (is_file($path)) {
+            $this->ldap->setOption(null, LDAP_OPT_X_TLS_CACERTFILE, $path);
+        } else {
+            throw new LdapException($errMessage);
+        }
+    }
+
    /**
     * Parse an LDAP server string and return the host suitable for a connection.
     * Is flexible to formats such as 'ldap.example.com:8069' or 'ldaps://ldap.example.com'.
@ -249,13 +313,18 @@ class LdapService

    /**
     * Build a filter string by injecting common variables.
+     * Both "${var}" and "{var}" style placeholders are supported.
+     * Dollar based are old format but supported for compatibility.
     */
    protected function buildFilter(string $filterString, array $attrs): string
    {
        $newAttrs = [];
        foreach ($attrs as $key => $attrText) {
-            $newKey = '${' . $key . '}';
-            $newAttrs[$newKey] = $this->ldap->escape($attrText);
+            $escapedText = $this->ldap->escape($attrText);
+            $oldVarKey = '${' . $key . '}';
+            $newVarKey = '{' . $key . '}';
+            $newAttrs[$oldVarKey] = $escapedText;
+            $newAttrs[$newVarKey] = $escapedText;
        }

        return strtr($filterString, $newAttrs);
@ -276,94 +345,105 @@ class LdapService
            return [];
        }

-        $userGroups = $this->groupFilter($user);
+        $userGroups = $this->extractGroupsFromSearchResponseEntry($user);
        $allGroups = $this->getGroupsRecursive($userGroups, []);
+        $formattedGroups = $this->extractGroupNamesFromLdapGroupDns($allGroups);

        if ($this->config['dump_user_groups']) {
            throw new JsonDebugException([
-                'details_from_ldap'             => $user,
-                'parsed_direct_user_groups'     => $userGroups,
-                'parsed_recursive_user_groups'  => $allGroups,
+                'details_from_ldap'            => $user,
+                'parsed_direct_user_groups'    => $userGroups,
+                'parsed_recursive_user_groups' => $allGroups,
+                'parsed_resulting_group_names' => $formattedGroups,
            ]);
        }

-        return $allGroups;
+        return $formattedGroups;
+    }
+
+    protected function extractGroupNamesFromLdapGroupDns(array $groupDNs): array
+    {
+        $names = [];
+
+        foreach ($groupDNs as $groupDN) {
+            $exploded = $this->ldap->explodeDn($groupDN, 1);
+            if ($exploded !== false && count($exploded) > 0) {
+                $names[] = $exploded[0];
+            }
+        }
+
+        return array_unique($names);
    }

    /**
-     * Get the parent groups of an array of groups.
+     * Build an array of all relevant groups DNs after recursively scanning
+     * across parents of the groups given.
     *
     * @throws LdapException
     */
-    private function getGroupsRecursive(array $groupsArray, array $checked): array
+    protected function getGroupsRecursive(array $groupDNs, array $checked): array
    {
        $groupsToAdd = [];
-        foreach ($groupsArray as $groupName) {
-            if (in_array($groupName, $checked)) {
+        foreach ($groupDNs as $groupDN) {
+            if (in_array($groupDN, $checked)) {
                continue;
            }

-            $parentGroups = $this->getGroupGroups($groupName);
+            $parentGroups = $this->getParentsOfGroup($groupDN);
            $groupsToAdd = array_merge($groupsToAdd, $parentGroups);
-            $checked[] = $groupName;
+            $checked[] = $groupDN;
        }

-        $groupsArray = array_unique(array_merge($groupsArray, $groupsToAdd), SORT_REGULAR);
+        $uniqueDNs = array_unique(array_merge($groupDNs, $groupsToAdd), SORT_REGULAR);

        if (empty($groupsToAdd)) {
-            return $groupsArray;
+            return $uniqueDNs;
        }

-        return $this->getGroupsRecursive($groupsArray, $checked);
+        return $this->getGroupsRecursive($uniqueDNs, $checked);
    }

    /**
-     * Get the parent groups of a single group.
-     *
     * @throws LdapException
     */
-    private function getGroupGroups(string $groupName): array
+    protected function getParentsOfGroup(string $groupDN): array
    {
+        $groupsAttr = strtolower($this->config['group_attribute']);
        $ldapConnection = $this->getConnection();
        $this->bindSystemUser($ldapConnection);

        $followReferrals = $this->config['follow_referrals'] ? 1 : 0;
        $this->ldap->setOption($ldapConnection, LDAP_OPT_REFERRALS, $followReferrals);
-
-        $baseDn = $this->config['base_dn'];
-        $groupsAttr = strtolower($this->config['group_attribute']);
-
-        $groupFilter = 'CN=' . $this->ldap->escape($groupName);
-        $groups = $this->ldap->searchAndGetEntries($ldapConnection, $baseDn, $groupFilter, [$groupsAttr]);
-        if ($groups['count'] === 0) {
+        $read = $this->ldap->read($ldapConnection, $groupDN, '(objectClass=*)', [$groupsAttr]);
+        $results = $this->ldap->getEntries($ldapConnection, $read);
+        if ($results['count'] === 0) {
            return [];
        }

-        return $this->groupFilter($groups[0]);
+        return $this->extractGroupsFromSearchResponseEntry($results[0]);
    }

    /**
-     * Filter out LDAP CN and DN language in a ldap search return.
-     * Gets the base CN (common name) of the string.
+     * Extract an array of group DN values from the given LDAP search response entry
     */
-    protected function groupFilter(array $userGroupSearchResponse): array
+    protected function extractGroupsFromSearchResponseEntry(array $ldapEntry): array
    {
        $groupsAttr = strtolower($this->config['group_attribute']);
-        $ldapGroups = [];
+        $groupDNs = [];
        $count = 0;

-        if (isset($userGroupSearchResponse[$groupsAttr]['count'])) {
-            $count = (int) $userGroupSearchResponse[$groupsAttr]['count'];
+        if (isset($ldapEntry[$groupsAttr]['count'])) {
+            $count = (int) $ldapEntry[$groupsAttr]['count'];
        }

        for ($i = 0; $i < $count; $i++) {
-            $dnComponents = $this->ldap->explodeDn($userGroupSearchResponse[$groupsAttr][$i], 1);
-            if (!in_array($dnComponents[0], $ldapGroups)) {
-                $ldapGroups[] = $dnComponents[0];
+            $dn = $ldapEntry[$groupsAttr][$i];
+            if (!in_array($dn, $groupDNs)) {
+                $groupDNs[] = $dn;
            }
        }

-        return $ldapGroups;
+        return $groupDNs;
    }

    /**
--- a/app/Access/LoginService.php
+++ b/app/Access/LoginService.php
@ -5,6 +5,7 @@ namespace BookStack\Access;
 use BookStack\Access\Mfa\MfaSession;
 use BookStack\Activity\ActivityType;
 use BookStack\Exceptions\LoginAttemptException;
+use BookStack\Exceptions\LoginAttemptInvalidUserException;
 use BookStack\Exceptions\StoppedAuthenticationException;
 use BookStack\Facades\Activity;
 use BookStack\Facades\Theme;
@ -16,13 +17,11 @@ class LoginService
 {
    protected const LAST_LOGIN_ATTEMPTED_SESSION_KEY = 'auth-login-last-attempted';

-    protected $mfaSession;
-    protected $emailConfirmationService;
-
-    public function __construct(MfaSession $mfaSession, EmailConfirmationService $emailConfirmationService)
-    {
-        $this->mfaSession = $mfaSession;
-        $this->emailConfirmationService = $emailConfirmationService;
+    public function __construct(
+        protected MfaSession $mfaSession,
+        protected EmailConfirmationService $emailConfirmationService,
+        protected SocialDriverManager $socialDriverManager,
+    ) {
    }

    /**
@ -31,10 +30,14 @@ class LoginService
     * a reason to (MFA or Unconfirmed Email).
     * Returns a boolean to indicate the current login result.
     *
-     * @throws StoppedAuthenticationException
+     * @throws StoppedAuthenticationException|LoginAttemptInvalidUserException
     */
    public function login(User $user, string $method, bool $remember = false): void
    {
+        if ($user->isGuest()) {
+            throw new LoginAttemptInvalidUserException('Login not allowed for guest user');
+        }
+
        if ($this->awaitingEmailConfirmation($user) || $this->needsMfaVerification($user)) {
            $this->setLastLoginAttemptedForUser($user, $method, $remember);

@ -60,7 +63,7 @@ class LoginService
     *
     * @throws Exception
     */
-    public function reattemptLoginFor(User $user)
+    public function reattemptLoginFor(User $user): void
    {
        if ($user->id !== ($this->getLastLoginAttemptUser()->id ?? null)) {
            throw new Exception('Login reattempt user does align with current session state');
@ -154,13 +157,66 @@ class LoginService
     */
    public function attempt(array $credentials, string $method, bool $remember = false): bool
    {
+        if ($this->areCredentialsForGuest($credentials)) {
+            return false;
+        }
+
        $result = auth()->attempt($credentials, $remember);
        if ($result) {
            $user = auth()->user();
            auth()->logout();
-            $this->login($user, $method, $remember);
+            try {
+                $this->login($user, $method, $remember);
+            } catch (LoginAttemptInvalidUserException $e) {
+                // Catch and return false for non-login accounts
+                // so it looks like a normal invalid login.
+                return false;
+            }
        }

        return $result;
    }
+
+    /**
+     * Check if the given credentials are likely for the system guest account.
+     */
+    protected function areCredentialsForGuest(array $credentials): bool
+    {
+        if (isset($credentials['email'])) {
+            return User::query()->where('email', '=', $credentials['email'])
+                ->where('system_name', '=', 'public')
+                ->exists();
+        }
+
+        return false;
+    }
+
+    /**
+     * Logs the current user out of the application.
+     * Returns an app post-redirect path.
+     */
+    public function logout(): string
+    {
+        auth()->logout();
+        session()->invalidate();
+        session()->regenerateToken();
+
+        return $this->shouldAutoInitiate() ? '/login?prevent_auto_init=true' : '/';
+    }
+
+    /**
+     * Check if login auto-initiate should be active based upon authentication config.
+     */
+    public function shouldAutoInitiate(): bool
+    {
+        $autoRedirect = config('auth.auto_initiate');
+        if (!$autoRedirect) {
+            return false;
+        }
+
+        $socialDrivers = $this->socialDriverManager->getActive();
+        $authMethod = config('auth.method');
+
+        return count($socialDrivers) === 0 && in_array($authMethod, ['oidc', 'saml2']);
+    }
 }
--- a/app/Access/Mfa/TotpValidationRule.php
+++ b/app/Access/Mfa/TotpValidationRule.php
@ -2,36 +2,26 @@

 namespace BookStack\Access\Mfa;

-use Illuminate\Contracts\Validation\Rule;
+use Closure;
+use Illuminate\Contracts\Validation\ValidationRule;

-class TotpValidationRule implements Rule
+class TotpValidationRule implements ValidationRule
 {
-    protected $secret;
-    protected $totpService;
-
    /**
     * Create a new rule instance.
     * Takes the TOTP secret that must be system provided, not user provided.
     */
-    public function __construct(string $secret)
-    {
-        $this->secret = $secret;
-        $this->totpService = app()->make(TotpService::class);
+    public function __construct(
+        protected string $secret,
+        protected TotpService $totpService,
+    ) {
    }

-    /**
-     * Determine if the validation rule passes.
-     */
-    public function passes($attribute, $value)
+    public function validate(string $attribute, mixed $value, Closure $fail): void
    {
-        return $this->totpService->verifyCode($value, $this->secret);
-    }
-
-    /**
-     * Get the validation error message.
-     */
-    public function message()
-    {
-        return trans('validation.totp');
+        $passes = $this->totpService->verifyCode($value, $this->secret);
+        if (!$passes) {
+            $fail(trans('validation.totp'));
+        }
    }
 }
--- a/app/Access/Notifications/ConfirmEmailNotification.php
+++ b/app/Access/Notifications/ConfirmEmailNotification.php
@ -1,11 +1,12 @@
 <?php

-namespace BookStack\Notifications;
+namespace BookStack\Access\Notifications;

+use BookStack\App\MailNotification;
 use BookStack\Users\Models\User;
 use Illuminate\Notifications\Messages\MailMessage;

-class ConfirmEmail extends MailNotification
+class ConfirmEmailNotification extends MailNotification
 {
    public function __construct(
        public string $token
--- a/app/Access/Notifications/ResetPasswordNotification.php
+++ b/app/Access/Notifications/ResetPasswordNotification.php
@ -1,11 +1,12 @@
 <?php

-namespace BookStack\Notifications;
+namespace BookStack\Access\Notifications;

+use BookStack\App\MailNotification;
 use BookStack\Users\Models\User;
 use Illuminate\Notifications\Messages\MailMessage;

-class ResetPassword extends MailNotification
+class ResetPasswordNotification extends MailNotification
 {
    public function __construct(
        public string $token
--- a/app/Access/Notifications/UserInviteNotification.php
+++ b/app/Access/Notifications/UserInviteNotification.php
@ -0,0 +1,27 @@
+<?php
+
+namespace BookStack\Access\Notifications;
+
+use BookStack\App\MailNotification;
+use BookStack\Users\Models\User;
+use Illuminate\Notifications\Messages\MailMessage;
+
+class UserInviteNotification extends MailNotification
+{
+    public function __construct(
+        public string $token
+    ) {
+    }
+
+    public function toMail(User $notifiable): MailMessage
+    {
+        $appName = ['appName' => setting('app-name')];
+        $locale = $notifiable->getLocale();
+
+        return $this->newMailMessage($locale)
+                ->subject($locale->trans('auth.user_invite_email_subject', $appName))
+                ->greeting($locale->trans('auth.user_invite_email_greeting', $appName))
+                ->line($locale->trans('auth.user_invite_email_text'))
+                ->action($locale->trans('auth.user_invite_email_action'), url('/register/invite/' . $this->token));
+    }
+}
--- a/app/Access/Oidc/OidcIdToken.php
+++ b/app/Access/Oidc/OidcIdToken.php
@ -2,58 +2,8 @@

 namespace BookStack\Access\Oidc;

-class OidcIdToken
+class OidcIdToken extends OidcJwtWithClaims implements ProvidesClaims
 {
-    protected array $header;
-    protected array $payload;
-    protected string $signature;
-    protected string $issuer;
-    protected array $tokenParts = [];
-
-    /**
-     * @var array[]|string[]
-     */
-    protected array $keys;
-
-    public function __construct(string $token, string $issuer, array $keys)
-    {
-        $this->keys = $keys;
-        $this->issuer = $issuer;
-        $this->parse($token);
-    }
-
-    /**
-     * Parse the token content into its components.
-     */
-    protected function parse(string $token): void
-    {
-        $this->tokenParts = explode('.', $token);
-        $this->header = $this->parseEncodedTokenPart($this->tokenParts[0]);
-        $this->payload = $this->parseEncodedTokenPart($this->tokenParts[1] ?? '');
-        $this->signature = $this->base64UrlDecode($this->tokenParts[2] ?? '') ?: '';
-    }
-
-    /**
-     * Parse a Base64-JSON encoded token part.
-     * Returns the data as a key-value array or empty array upon error.
-     */
-    protected function parseEncodedTokenPart(string $part): array
-    {
-        $json = $this->base64UrlDecode($part) ?: '{}';
-        $decoded = json_decode($json, true);
-
-        return is_array($decoded) ? $decoded : [];
-    }
-
-    /**
-     * Base64URL decode. Needs some character conversions to be compatible
-     * with PHP's default base64 handling.
-     */
-    protected function base64UrlDecode(string $encoded): string
-    {
-        return base64_decode(strtr($encoded, '-_', '+/'));
-    }
-
    /**
     * Validate all possible parts of the id token.
     *
@ -61,91 +11,12 @@ class OidcIdToken
     */
    public function validate(string $clientId): bool
    {
-        $this->validateTokenStructure();
-        $this->validateTokenSignature();
+        parent::validateCommonTokenDetails($clientId);
        $this->validateTokenClaims($clientId);

        return true;
    }

-    /**
-     * Fetch a specific claim from this token.
-     * Returns null if it is null or does not exist.
-     *
-     * @return mixed|null
-     */
-    public function getClaim(string $claim)
-    {
-        return $this->payload[$claim] ?? null;
-    }
-
-    /**
-     * Get all returned claims within the token.
-     */
-    public function getAllClaims(): array
-    {
-        return $this->payload;
-    }
-
-    /**
-     * Replace the existing claim data of this token with that provided.
-     */
-    public function replaceClaims(array $claims): void
-    {
-        $this->payload = $claims;
-    }
-
-    /**
-     * Validate the structure of the given token and ensure we have the required pieces.
-     * As per https://datatracker.ietf.org/doc/html/rfc7519#section-7.2.
-     *
-     * @throws OidcInvalidTokenException
-     */
-    protected function validateTokenStructure(): void
-    {
-        foreach (['header', 'payload'] as $prop) {
-            if (empty($this->$prop) || !is_array($this->$prop)) {
-                throw new OidcInvalidTokenException("Could not parse out a valid {$prop} within the provided token");
-            }
-        }
-
-        if (empty($this->signature) || !is_string($this->signature)) {
-            throw new OidcInvalidTokenException('Could not parse out a valid signature within the provided token');
-        }
-    }
-
-    /**
-     * Validate the signature of the given token and ensure it validates against the provided key.
-     *
-     * @throws OidcInvalidTokenException
-     */
-    protected function validateTokenSignature(): void
-    {
-        if ($this->header['alg'] !== 'RS256') {
-            throw new OidcInvalidTokenException("Only RS256 signature validation is supported. Token reports using {$this->header['alg']}");
-        }
-
-        $parsedKeys = array_map(function ($key) {
-            try {
-                return new OidcJwtSigningKey($key);
-            } catch (OidcInvalidKeyException $e) {
-                throw new OidcInvalidTokenException('Failed to read signing key with error: ' . $e->getMessage());
-            }
-        }, $this->keys);
-
-        $parsedKeys = array_filter($parsedKeys);
-
-        $contentToSign = $this->tokenParts[0] . '.' . $this->tokenParts[1];
-        /** @var OidcJwtSigningKey $parsedKey */
-        foreach ($parsedKeys as $parsedKey) {
-            if ($parsedKey->verify($contentToSign, $this->signature)) {
-                return;
-            }
-        }
-
-        throw new OidcInvalidTokenException('Token signature could not be validated using the provided keys');
-    }
-
    /**
     * Validate the claims of the token.
     * As per https://openid.net/specs/openid-connect-basic-1_0.html#IDTokenValidation.
@ -156,27 +27,18 @@ class OidcIdToken
    {
        // 1. The Issuer Identifier for the OpenID Provider (which is typically obtained during Discovery)
        // MUST exactly match the value of the iss (issuer) Claim.
-        if (empty($this->payload['iss']) || $this->issuer !== $this->payload['iss']) {
-            throw new OidcInvalidTokenException('Missing or non-matching token issuer value');
-        }
+        // Already done in parent.

        // 2. The Client MUST validate that the aud (audience) Claim contains its client_id value registered
        // at the Issuer identified by the iss (issuer) Claim as an audience. The ID Token MUST be rejected
        // if the ID Token does not list the Client as a valid audience, or if it contains additional
        // audiences not trusted by the Client.
-        if (empty($this->payload['aud'])) {
-            throw new OidcInvalidTokenException('Missing token audience value');
-        }
-
+        // Partially done in parent.
        $aud = is_string($this->payload['aud']) ? [$this->payload['aud']] : $this->payload['aud'];
        if (count($aud) !== 1) {
            throw new OidcInvalidTokenException('Token audience value has ' . count($aud) . ' values, Expected 1');
        }

-        if ($aud[0] !== $clientId) {
-            throw new OidcInvalidTokenException('Token audience value did not match the expected client_id');
-        }
-
        // 3. If the ID Token contains multiple audiences, the Client SHOULD verify that an azp Claim is present.
        // NOTE: Addressed by enforcing a count of 1 above.

--- a/app/Access/Oidc/OidcJwtWithClaims.php
+++ b/app/Access/Oidc/OidcJwtWithClaims.php
@ -0,0 +1,174 @@
+<?php
+
+namespace BookStack\Access\Oidc;
+
+class OidcJwtWithClaims implements ProvidesClaims
+{
+    protected array $header;
+    protected array $payload;
+    protected string $signature;
+    protected string $issuer;
+    protected array $tokenParts = [];
+
+    /**
+     * @var array[]|string[]
+     */
+    protected array $keys;
+
+    public function __construct(string $token, string $issuer, array $keys)
+    {
+        $this->keys = $keys;
+        $this->issuer = $issuer;
+        $this->parse($token);
+    }
+
+    /**
+     * Parse the token content into its components.
+     */
+    protected function parse(string $token): void
+    {
+        $this->tokenParts = explode('.', $token);
+        $this->header = $this->parseEncodedTokenPart($this->tokenParts[0]);
+        $this->payload = $this->parseEncodedTokenPart($this->tokenParts[1] ?? '');
+        $this->signature = $this->base64UrlDecode($this->tokenParts[2] ?? '') ?: '';
+    }
+
+    /**
+     * Parse a Base64-JSON encoded token part.
+     * Returns the data as a key-value array or empty array upon error.
+     */
+    protected function parseEncodedTokenPart(string $part): array
+    {
+        $json = $this->base64UrlDecode($part) ?: '{}';
+        $decoded = json_decode($json, true);
+
+        return is_array($decoded) ? $decoded : [];
+    }
+
+    /**
+     * Base64URL decode. Needs some character conversions to be compatible
+     * with PHP's default base64 handling.
+     */
+    protected function base64UrlDecode(string $encoded): string
+    {
+        return base64_decode(strtr($encoded, '-_', '+/'));
+    }
+
+    /**
+     * Validate common parts of OIDC JWT tokens.
+     *
+     * @throws OidcInvalidTokenException
+     */
+    public function validateCommonTokenDetails(string $clientId): bool
+    {
+        $this->validateTokenStructure();
+        $this->validateTokenSignature();
+        $this->validateCommonClaims($clientId);
+
+        return true;
+    }
+
+    /**
+     * Fetch a specific claim from this token.
+     * Returns null if it is null or does not exist.
+     */
+    public function getClaim(string $claim): mixed
+    {
+        return $this->payload[$claim] ?? null;
+    }
+
+    /**
+     * Get all returned claims within the token.
+     */
+    public function getAllClaims(): array
+    {
+        return $this->payload;
+    }
+
+    /**
+     * Replace the existing claim data of this token with that provided.
+     */
+    public function replaceClaims(array $claims): void
+    {
+        $this->payload = $claims;
+    }
+
+    /**
+     * Validate the structure of the given token and ensure we have the required pieces.
+     * As per https://datatracker.ietf.org/doc/html/rfc7519#section-7.2.
+     *
+     * @throws OidcInvalidTokenException
+     */
+    protected function validateTokenStructure(): void
+    {
+        foreach (['header', 'payload'] as $prop) {
+            if (empty($this->$prop) || !is_array($this->$prop)) {
+                throw new OidcInvalidTokenException("Could not parse out a valid {$prop} within the provided token");
+            }
+        }
+
+        if (empty($this->signature) || !is_string($this->signature)) {
+            throw new OidcInvalidTokenException('Could not parse out a valid signature within the provided token');
+        }
+    }
+
+    /**
+     * Validate the signature of the given token and ensure it validates against the provided key.
+     *
+     * @throws OidcInvalidTokenException
+     */
+    protected function validateTokenSignature(): void
+    {
+        if ($this->header['alg'] !== 'RS256') {
+            throw new OidcInvalidTokenException("Only RS256 signature validation is supported. Token reports using {$this->header['alg']}");
+        }
+
+        $parsedKeys = array_map(function ($key) {
+            try {
+                return new OidcJwtSigningKey($key);
+            } catch (OidcInvalidKeyException $e) {
+                throw new OidcInvalidTokenException('Failed to read signing key with error: ' . $e->getMessage());
+            }
+        }, $this->keys);
+
+        $parsedKeys = array_filter($parsedKeys);
+
+        $contentToSign = $this->tokenParts[0] . '.' . $this->tokenParts[1];
+        /** @var OidcJwtSigningKey $parsedKey */
+        foreach ($parsedKeys as $parsedKey) {
+            if ($parsedKey->verify($contentToSign, $this->signature)) {
+                return;
+            }
+        }
+
+        throw new OidcInvalidTokenException('Token signature could not be validated using the provided keys');
+    }
+
+    /**
+     * Validate common claims for OIDC JWT tokens.
+     * As per https://openid.net/specs/openid-connect-basic-1_0.html#IDTokenValidation
+     * and https://openid.net/specs/openid-connect-core-1_0.html#UserInfoResponse
+     *
+     * @throws OidcInvalidTokenException
+     */
+    protected function validateCommonClaims(string $clientId): void
+    {
+        // 1. The Issuer Identifier for the OpenID Provider (which is typically obtained during Discovery)
+        // MUST exactly match the value of the iss (issuer) Claim.
+        if (empty($this->payload['iss']) || $this->issuer !== $this->payload['iss']) {
+            throw new OidcInvalidTokenException('Missing or non-matching token issuer value');
+        }
+
+        // 2. The Client MUST validate that the aud (audience) Claim contains its client_id value registered
+        // at the Issuer identified by the iss (issuer) Claim as an audience. The ID Token MUST be rejected
+        // if the ID Token does not list the Client as a valid audience.
+        if (empty($this->payload['aud'])) {
+            throw new OidcInvalidTokenException('Missing token audience value');
+        }
+
+        $aud = is_string($this->payload['aud']) ? [$this->payload['aud']] : $this->payload['aud'];
+        if (!in_array($clientId, $aud, true)) {
+            throw new OidcInvalidTokenException('Token audience value did not match the expected client_id');
+        }
+    }
+}
--- a/app/Access/Oidc/OidcOAuthProvider.php
+++ b/app/Access/Oidc/OidcOAuthProvider.php
@ -20,15 +20,8 @@ class OidcOAuthProvider extends AbstractProvider
 {
    use BearerAuthorizationTrait;

-    /**
-     * @var string
-     */
-    protected $authorizationEndpoint;
-
-    /**
-     * @var string
-     */
-    protected $tokenEndpoint;
+    protected string $authorizationEndpoint;
+    protected string $tokenEndpoint;

    /**
     * Scopes to use for the OIDC authorization call.
@ -60,7 +53,7 @@ class OidcOAuthProvider extends AbstractProvider
    }

    /**
-     * Add an additional scope to this provider upon the default.
+     * Add another scope to this provider upon the default.
     */
    public function addScope(string $scope): void
    {
@ -90,15 +83,9 @@ class OidcOAuthProvider extends AbstractProvider

    /**
     * Checks a provider response for errors.
-     *
-     * @param ResponseInterface $response
-     * @param array|string      $data     Parsed response data
-     *
     * @throws IdentityProviderException
-     *
-     * @return void
     */
-    protected function checkResponse(ResponseInterface $response, $data)
+    protected function checkResponse(ResponseInterface $response, $data): void
    {
        if ($response->getStatusCode() >= 400 || isset($data['error'])) {
            throw new IdentityProviderException(
@ -112,13 +99,8 @@ class OidcOAuthProvider extends AbstractProvider
    /**
     * Generates a resource owner object from a successful resource owner
     * details request.
-     *
-     * @param array       $response
-     * @param AccessToken $token
-     *
-     * @return ResourceOwnerInterface
     */
-    protected function createResourceOwner(array $response, AccessToken $token)
+    protected function createResourceOwner(array $response, AccessToken $token): ResourceOwnerInterface
    {
        return new GenericResourceOwner($response, '');
    }
@ -128,14 +110,18 @@ class OidcOAuthProvider extends AbstractProvider
     *
     * The grant that was used to fetch the response can be used to provide
     * additional context.
-     *
-     * @param array         $response
-     * @param AbstractGrant $grant
-     *
-     * @return OidcAccessToken
     */
-    protected function createAccessToken(array $response, AbstractGrant $grant)
+    protected function createAccessToken(array $response, AbstractGrant $grant): OidcAccessToken
    {
        return new OidcAccessToken($response);
    }
+
+    /**
+     * Get the method used for PKCE code verifier hashing, which is passed
+     * in the "code_challenge_method" parameter in the authorization request.
+     */
+    protected function getPkceMethod(): string
+    {
+        return static::PKCE_METHOD_S256;
+    }
 }
--- a/app/Access/Oidc/OidcProviderSettings.php
+++ b/app/Access/Oidc/OidcProviderSettings.php
@ -18,9 +18,10 @@ class OidcProviderSettings
    public string $issuer;
    public string $clientId;
    public string $clientSecret;
-    public ?string $redirectUri;
    public ?string $authorizationEndpoint;
    public ?string $tokenEndpoint;
+    public ?string $endSessionEndpoint;
+    public ?string $userinfoEndpoint;

    /**
     * @var string[]|array[]
@ -36,7 +37,7 @@ class OidcProviderSettings
    /**
     * Apply an array of settings to populate setting properties within this class.
     */
-    protected function applySettingsFromArray(array $settingsArray)
+    protected function applySettingsFromArray(array $settingsArray): void
    {
        foreach ($settingsArray as $key => $value) {
            if (property_exists($this, $key)) {
@ -50,16 +51,16 @@ class OidcProviderSettings
     *
     * @throws InvalidArgumentException
     */
-    protected function validateInitial()
+    protected function validateInitial(): void
    {
-        $required = ['clientId', 'clientSecret', 'redirectUri', 'issuer'];
+        $required = ['clientId', 'clientSecret', 'issuer'];
        foreach ($required as $prop) {
            if (empty($this->$prop)) {
                throw new InvalidArgumentException("Missing required configuration \"{$prop}\" value");
            }
        }

-        if (strpos($this->issuer, 'https://') !== 0) {
+        if (!str_starts_with($this->issuer, 'https://')) {
            throw new InvalidArgumentException('Issuer value must start with https://');
        }
    }
@ -72,12 +73,20 @@ class OidcProviderSettings
    public function validate(): void
    {
        $this->validateInitial();
+
        $required = ['keys', 'tokenEndpoint', 'authorizationEndpoint'];
        foreach ($required as $prop) {
            if (empty($this->$prop)) {
                throw new InvalidArgumentException("Missing required configuration \"{$prop}\" value");
            }
        }
+
+        $endpointProperties = ['tokenEndpoint', 'authorizationEndpoint', 'userinfoEndpoint'];
+        foreach ($endpointProperties as $prop) {
+            if (is_string($this->$prop) && !str_starts_with($this->$prop, 'https://')) {
+                throw new InvalidArgumentException("Endpoint value for \"{$prop}\" must start with https://");
+            }
+        }
    }

    /**
@ -85,7 +94,7 @@ class OidcProviderSettings
     *
     * @throws OidcIssuerDiscoveryException
     */
-    public function discoverFromIssuer(ClientInterface $httpClient, Repository $cache, int $cacheMinutes)
+    public function discoverFromIssuer(ClientInterface $httpClient, Repository $cache, int $cacheMinutes): void
    {
        try {
            $cacheKey = 'oidc-discovery::' . $this->issuer;
@ -127,11 +136,19 @@ class OidcProviderSettings
            $discoveredSettings['tokenEndpoint'] = $result['token_endpoint'];
        }

+        if (!empty($result['userinfo_endpoint'])) {
+            $discoveredSettings['userinfoEndpoint'] = $result['userinfo_endpoint'];
+        }
+
        if (!empty($result['jwks_uri'])) {
            $keys = $this->loadKeysFromUri($result['jwks_uri'], $httpClient);
            $discoveredSettings['keys'] = $this->filterKeys($keys);
        }

+        if (!empty($result['end_session_endpoint'])) {
+            $discoveredSettings['endSessionEndpoint'] = $result['end_session_endpoint'];
+        }
+
        return $discoveredSettings;
    }

@ -170,9 +187,9 @@ class OidcProviderSettings
    /**
     * Get the settings needed by an OAuth provider, as a key=>value array.
     */
-    public function arrayForProvider(): array
+    public function arrayForOAuthProvider(): array
    {
-        $settingKeys = ['clientId', 'clientSecret', 'redirectUri', 'authorizationEndpoint', 'tokenEndpoint'];
+        $settingKeys = ['clientId', 'clientSecret', 'authorizationEndpoint', 'tokenEndpoint', 'userinfoEndpoint'];
        $settings = [];
        foreach ($settingKeys as $setting) {
            $settings[$setting] = $this->$setting;
--- a/app/Access/Oidc/OidcService.php
+++ b/app/Access/Oidc/OidcService.php
@ -9,13 +9,12 @@ use BookStack\Exceptions\JsonDebugException;
 use BookStack\Exceptions\StoppedAuthenticationException;
 use BookStack\Exceptions\UserRegistrationException;
 use BookStack\Facades\Theme;
+use BookStack\Http\HttpRequestService;
 use BookStack\Theming\ThemeEvents;
 use BookStack\Users\Models\User;
-use Illuminate\Support\Arr;
 use Illuminate\Support\Facades\Cache;
 use League\OAuth2\Client\OptionProvider\HttpBasicAuthOptionProvider;
 use League\OAuth2\Client\Provider\Exception\IdentityProviderException;
-use Psr\Http\Client\ClientInterface as HttpClient;

 /**
 * Class OpenIdConnectService
@ -26,13 +25,15 @@ class OidcService
    public function __construct(
        protected RegistrationService $registrationService,
        protected LoginService $loginService,
-        protected HttpClient $httpClient,
+        protected HttpRequestService $http,
        protected GroupSyncService $groupService
    ) {
    }

    /**
     * Initiate an authorization flow.
+     * Provides back an authorize redirect URL, in addition to other
+     * details which may be required for the auth flow.
     *
     * @throws OidcException
     *
@ -42,8 +43,12 @@ class OidcService
    {
        $settings = $this->getProviderSettings();
        $provider = $this->getProvider($settings);
+
+        $url = $provider->getAuthorizationUrl();
+        session()->put('oidc_pkce_code', $provider->getPkceCode() ?? '');
+
        return [
-            'url'   => $provider->getAuthorizationUrl(),
+            'url'   => $url,
            'state' => $provider->getState(),
        ];
    }
@ -63,6 +68,10 @@ class OidcService
        $settings = $this->getProviderSettings();
        $provider = $this->getProvider($settings);

+        // Set PKCE code flashed at login
+        $pkceCode = session()->pull('oidc_pkce_code', '');
+        $provider->setPkceCode($pkceCode);
+
        // Try to exchange authorization code for access token
        $accessToken = $provider->getAccessToken('authorization_code', [
            'code' => $authorizationCode,
@ -81,9 +90,10 @@ class OidcService
            'issuer'                => $config['issuer'],
            'clientId'              => $config['client_id'],
            'clientSecret'          => $config['client_secret'],
-            'redirectUri'           => url('/oidc/callback'),
            'authorizationEndpoint' => $config['authorization_endpoint'],
            'tokenEndpoint'         => $config['token_endpoint'],
+            'endSessionEndpoint'    => is_string($config['end_session_endpoint']) ? $config['end_session_endpoint'] : null,
+            'userinfoEndpoint'      => $config['userinfo_endpoint'],
        ]);

        // Use keys if configured
@ -94,12 +104,20 @@ class OidcService
        // Run discovery
        if ($config['discover'] ?? false) {
            try {
-                $settings->discoverFromIssuer($this->httpClient, Cache::store(null), 15);
+                $settings->discoverFromIssuer($this->http->buildClient(5), Cache::store(null), 15);
            } catch (OidcIssuerDiscoveryException $exception) {
                throw new OidcException('OIDC Discovery Error: ' . $exception->getMessage());
            }
        }

+        // Prevent use of RP-initiated logout if specifically disabled
+        // Or force use of a URL if specifically set.
+        if ($config['end_session_endpoint'] === false) {
+            $settings->endSessionEndpoint = null;
+        } else if (is_string($config['end_session_endpoint'])) {
+            $settings->endSessionEndpoint = $config['end_session_endpoint'];
+        }
+
        $settings->validate();

        return $settings;
@ -110,8 +128,11 @@ class OidcService
     */
    protected function getProvider(OidcProviderSettings $settings): OidcOAuthProvider
    {
-        $provider = new OidcOAuthProvider($settings->arrayForProvider(), [
-            'httpClient'     => $this->httpClient,
+        $provider = new OidcOAuthProvider([
+            ...$settings->arrayForOAuthProvider(),
+            'redirectUri' => url('/oidc/callback'),
+        ], [
+            'httpClient'     => $this->http->buildClient(5),
            'optionProvider' => new HttpBasicAuthOptionProvider(),
        ]);

@ -137,68 +158,6 @@ class OidcService
        return array_filter($scopeArr);
    }

-    /**
-     * Calculate the display name.
-     */
-    protected function getUserDisplayName(OidcIdToken $token, string $defaultValue): string
-    {
-        $displayNameAttr = $this->config()['display_name_claims'];
-
-        $displayName = [];
-        foreach ($displayNameAttr as $dnAttr) {
-            $dnComponent = $token->getClaim($dnAttr) ?? '';
-            if ($dnComponent !== '') {
-                $displayName[] = $dnComponent;
-            }
-        }
-
-        if (count($displayName) == 0) {
-            $displayName[] = $defaultValue;
-        }
-
-        return implode(' ', $displayName);
-    }
-
-    /**
-     * Extract the assigned groups from the id token.
-     *
-     * @return string[]
-     */
-    protected function getUserGroups(OidcIdToken $token): array
-    {
-        $groupsAttr = $this->config()['groups_claim'];
-        if (empty($groupsAttr)) {
-            return [];
-        }
-
-        $groupsList = Arr::get($token->getAllClaims(), $groupsAttr);
-        if (!is_array($groupsList)) {
-            return [];
-        }
-
-        return array_values(array_filter($groupsList, function ($val) {
-            return is_string($val);
-        }));
-    }
-
-    /**
-     * Extract the details of a user from an ID token.
-     *
-     * @return array{name: string, email: string, external_id: string, groups: string[]}
-     */
-    protected function getUserDetails(OidcIdToken $token): array
-    {
-        $idClaim = $this->config()['external_id_claim'];
-        $id = $token->getClaim($idClaim);
-
-        return [
-            'external_id' => $id,
-            'email'       => $token->getClaim('email'),
-            'name'        => $this->getUserDisplayName($token, $id),
-            'groups'      => $this->getUserGroups($token),
-        ];
-    }
-
    /**
     * Processes a received access token for a user. Login the user when
     * they exist, optionally registering them automatically.
@ -216,6 +175,8 @@ class OidcService
            $settings->keys,
        );

+        session()->put("oidc_id_token", $idTokenText);
+
        $returnClaims = Theme::dispatch(ThemeEvents::OIDC_ID_TOKEN_PRE_VALIDATE, $idToken->getAllClaims(), [
            'access_token' => $accessToken->getToken(),
            'expires_in' => $accessToken->getExpires(),
@ -233,34 +194,35 @@ class OidcService
        try {
            $idToken->validate($settings->clientId);
        } catch (OidcInvalidTokenException $exception) {
-            throw new OidcException("ID token validate failed with error: {$exception->getMessage()}");
+            throw new OidcException("ID token validation failed with error: {$exception->getMessage()}");
        }

-        $userDetails = $this->getUserDetails($idToken);
-        $isLoggedIn = auth()->check();
-
-        if (empty($userDetails['email'])) {
+        $userDetails = $this->getUserDetailsFromToken($idToken, $accessToken, $settings);
+        if (empty($userDetails->email)) {
            throw new OidcException(trans('errors.oidc_no_email_address'));
        }
+        if (empty($userDetails->name)) {
+            $userDetails->name = $userDetails->externalId;
+        }

+        $isLoggedIn = auth()->check();
        if ($isLoggedIn) {
            throw new OidcException(trans('errors.oidc_already_logged_in'));
        }

        try {
            $user = $this->registrationService->findOrRegister(
-                $userDetails['name'],
-                $userDetails['email'],
-                $userDetails['external_id']
+                $userDetails->name,
+                $userDetails->email,
+                $userDetails->externalId
            );
        } catch (UserRegistrationException $exception) {
            throw new OidcException($exception->getMessage());
        }

        if ($this->shouldSyncGroups()) {
-            $groups = $userDetails['groups'];
            $detachExisting = $this->config()['remove_from_groups'];
-            $this->groupService->syncUserWithFoundGroups($user, $groups, $detachExisting);
+            $this->groupService->syncUserWithFoundGroups($user, $userDetails->groups ?? [], $detachExisting);
        }

        $this->loginService->login($user, 'oidc');
@ -268,6 +230,45 @@ class OidcService
        return $user;
    }

+    /**
+     * @throws OidcException
+     */
+    protected function getUserDetailsFromToken(OidcIdToken $idToken, OidcAccessToken $accessToken, OidcProviderSettings $settings): OidcUserDetails
+    {
+        $userDetails = new OidcUserDetails();
+        $userDetails->populate(
+            $idToken,
+            $this->config()['external_id_claim'],
+            $this->config()['display_name_claims'] ?? '',
+            $this->config()['groups_claim'] ?? ''
+        );
+
+        if (!$userDetails->isFullyPopulated($this->shouldSyncGroups()) && !empty($settings->userinfoEndpoint)) {
+            $provider = $this->getProvider($settings);
+            $request = $provider->getAuthenticatedRequest('GET', $settings->userinfoEndpoint, $accessToken->getToken());
+            $response = new OidcUserinfoResponse(
+                $provider->getResponse($request),
+                $settings->issuer,
+                $settings->keys,
+            );
+
+            try {
+                $response->validate($idToken->getClaim('sub'), $settings->clientId);
+            } catch (OidcInvalidTokenException $exception) {
+                throw new OidcException("Userinfo endpoint response validation failed with error: {$exception->getMessage()}");
+            }
+
+            $userDetails->populate(
+                $response,
+                $this->config()['external_id_claim'],
+                $this->config()['display_name_claims'] ?? '',
+                $this->config()['groups_claim'] ?? ''
+            );
+        }
+
+        return $userDetails;
+    }
+
    /**
     * Get the OIDC config from the application.
     */
@ -283,4 +284,30 @@ class OidcService
    {
        return $this->config()['user_to_groups'] !== false;
    }
+
+    /**
+     * Start the RP-initiated logout flow if active, otherwise start a standard logout flow.
+     * Returns a post-app-logout redirect URL.
+     * Reference: https://openid.net/specs/openid-connect-rpinitiated-1_0.html
+     * @throws OidcException
+     */
+    public function logout(): string
+    {
+        $oidcToken = session()->pull("oidc_id_token");
+        $defaultLogoutUrl = url($this->loginService->logout());
+        $oidcSettings = $this->getProviderSettings();
+
+        if (!$oidcSettings->endSessionEndpoint) {
+            return $defaultLogoutUrl;
+        }
+
+        $endpointParams = [
+            'id_token_hint' => $oidcToken,
+            'post_logout_redirect_uri' => $defaultLogoutUrl,
+        ];
+
+        $joiner = str_contains($oidcSettings->endSessionEndpoint, '?') ? '&' : '?';
+
+        return $oidcSettings->endSessionEndpoint . $joiner . http_build_query($endpointParams);
+    }
 }
--- a/app/Access/Oidc/OidcUserDetails.php
+++ b/app/Access/Oidc/OidcUserDetails.php
@ -0,0 +1,75 @@
+<?php
+
+namespace BookStack\Access\Oidc;
+
+use Illuminate\Support\Arr;
+
+class OidcUserDetails
+{
+    public function __construct(
+        public ?string $externalId = null,
+        public ?string $email = null,
+        public ?string $name = null,
+        public ?array $groups = null,
+    ) {
+    }
+
+    /**
+     * Check if the user details are fully populated for our usage.
+     */
+    public function isFullyPopulated(bool $groupSyncActive): bool
+    {
+        $hasEmpty = empty($this->externalId)
+            || empty($this->email)
+            || empty($this->name)
+            || ($groupSyncActive && $this->groups === null);
+
+        return !$hasEmpty;
+    }
+
+    /**
+     * Populate user details from the given claim data.
+     */
+    public function populate(
+        ProvidesClaims $claims,
+        string $idClaim,
+        string $displayNameClaims,
+        string $groupsClaim,
+    ): void {
+        $this->externalId = $claims->getClaim($idClaim) ?? $this->externalId;
+        $this->email = $claims->getClaim('email') ?? $this->email;
+        $this->name = static::getUserDisplayName($displayNameClaims, $claims) ?? $this->name;
+        $this->groups = static::getUserGroups($groupsClaim, $claims) ?? $this->groups;
+    }
+
+    protected static function getUserDisplayName(string $displayNameClaims, ProvidesClaims $token): string
+    {
+        $displayNameClaimParts = explode('|', $displayNameClaims);
+
+        $displayName = [];
+        foreach ($displayNameClaimParts as $claim) {
+            $component = $token->getClaim(trim($claim)) ?? '';
+            if ($component !== '') {
+                $displayName[] = $component;
+            }
+        }
+
+        return implode(' ', $displayName);
+    }
+
+    protected static function getUserGroups(string $groupsClaim, ProvidesClaims $token): ?array
+    {
+        if (empty($groupsClaim)) {
+            return null;
+        }
+
+        $groupsList = Arr::get($token->getAllClaims(), $groupsClaim);
+        if (!is_array($groupsList)) {
+            return null;
+        }
+
+        return array_values(array_filter($groupsList, function ($val) {
+            return is_string($val);
+        }));
+    }
+}
--- a/app/Access/Oidc/OidcUserinfoResponse.php
+++ b/app/Access/Oidc/OidcUserinfoResponse.php
@ -0,0 +1,69 @@
+<?php
+
+namespace BookStack\Access\Oidc;
+
+use Psr\Http\Message\ResponseInterface;
+
+class OidcUserinfoResponse implements ProvidesClaims
+{
+    protected array $claims = [];
+    protected ?OidcJwtWithClaims $jwt = null;
+
+    public function __construct(ResponseInterface $response, string $issuer, array $keys)
+    {
+        $contentTypeHeaderValue = $response->getHeader('Content-Type')[0] ?? '';
+        $contentType = strtolower(trim(explode(';', $contentTypeHeaderValue, 2)[0]));
+
+        if ($contentType === 'application/json') {
+            $this->claims = json_decode($response->getBody()->getContents(), true);
+        }
+
+        if ($contentType === 'application/jwt') {
+            $this->jwt = new OidcJwtWithClaims($response->getBody()->getContents(), $issuer, $keys);
+            $this->claims = $this->jwt->getAllClaims();
+        }
+    }
+
+    /**
+     * @throws OidcInvalidTokenException
+     */
+    public function validate(string $idTokenSub, string $clientId): bool
+    {
+        if (!is_null($this->jwt)) {
+            $this->jwt->validateCommonTokenDetails($clientId);
+        }
+
+        $sub = $this->getClaim('sub');
+
+        // Spec: v1.0 5.3.2: The sub (subject) Claim MUST always be returned in the UserInfo Response.
+        if (!is_string($sub) || empty($sub)) {
+            throw new OidcInvalidTokenException("No valid subject value found in userinfo data");
+        }
+
+        // Spec: v1.0 5.3.2: The sub Claim in the UserInfo Response MUST be verified to exactly match the sub Claim in the ID Token;
+        // if they do not match, the UserInfo Response values MUST NOT be used.
+        if ($idTokenSub !== $sub) {
+            throw new OidcInvalidTokenException("Subject value provided in the userinfo endpoint does not match the provided ID token value");
+        }
+
+        // Spec v1.0 5.3.4 Defines the following:
+        // Verify that the OP that responded was the intended OP through a TLS server certificate check, per RFC 6125 [RFC6125].
+          // This is effectively done as part of the HTTP request we're making through CURLOPT_SSL_VERIFYHOST on the request.
+        // If the Client has provided a userinfo_encrypted_response_alg parameter during Registration, decrypt the UserInfo Response using the keys specified during Registration.
+          // We don't currently support JWT encryption for OIDC
+        // If the response was signed, the Client SHOULD validate the signature according to JWS [JWS].
+          // This is done as part of the validateCommonClaims above.
+
+        return true;
+    }
+
+    public function getClaim(string $claim): mixed
+    {
+        return $this->claims[$claim] ?? null;
+    }
+
+    public function getAllClaims(): array
+    {
+        return $this->claims;
+    }
+}
--- a/app/Access/Oidc/ProvidesClaims.php
+++ b/app/Access/Oidc/ProvidesClaims.php
@ -0,0 +1,17 @@
+<?php
+
+namespace BookStack\Access\Oidc;
+
+interface ProvidesClaims
+{
+    /**
+     * Fetch a specific claim.
+     * Returns null if it is null or does not exist.
+     */
+    public function getClaim(string $claim): mixed;
+
+    /**
+     * Get all contained claims.
+     */
+    public function getAllClaims(): array;
+}
--- a/app/Access/RegistrationService.php
+++ b/app/Access/RegistrationService.php
@ -14,20 +14,14 @@ use Illuminate\Support\Str;

 class RegistrationService
 {
-    protected $userRepo;
-    protected $emailConfirmationService;
-
-    /**
-     * RegistrationService constructor.
-     */
-    public function __construct(UserRepo $userRepo, EmailConfirmationService $emailConfirmationService)
-    {
-        $this->userRepo = $userRepo;
-        $this->emailConfirmationService = $emailConfirmationService;
+    public function __construct(
+        protected UserRepo $userRepo,
+        protected EmailConfirmationService $emailConfirmationService,
+    ) {
    }

    /**
-     * Check whether or not registrations are allowed in the app settings.
+     * Check if registrations are allowed in the app settings.
     *
     * @throws UserRegistrationException
     */
@ -84,6 +78,7 @@ class RegistrationService
    public function registerUser(array $userData, ?SocialAccount $socialAccount = null, bool $emailConfirmed = false): User
    {
        $userEmail = $userData['email'];
+        $authSystem = $socialAccount ? $socialAccount->driver : auth()->getDefaultDriver();

        // Email restriction
        $this->ensureEmailDomainAllowed($userEmail);
@ -94,6 +89,12 @@ class RegistrationService
            throw new UserRegistrationException(trans('errors.error_user_exists_different_creds', ['email' => $userEmail]), '/login');
        }

+        /** @var ?bool $shouldRegister */
+        $shouldRegister = Theme::dispatch(ThemeEvents::AUTH_PRE_REGISTER, $authSystem, $userData);
+        if ($shouldRegister === false) {
+            throw new UserRegistrationException(trans('errors.auth_pre_register_theme_prevention'), '/login');
+        }
+
        // Create the user
        $newUser = $this->userRepo->createWithoutActivity($userData, $emailConfirmed);
        $newUser->attachDefaultRole();
@ -104,7 +105,7 @@ class RegistrationService
        }

        Activity::add(ActivityType::AUTH_REGISTER, $socialAccount ?? $newUser);
-        Theme::dispatch(ThemeEvents::AUTH_REGISTER, $socialAccount ? $socialAccount->driver : auth()->getDefaultDriver(), $newUser);
+        Theme::dispatch(ThemeEvents::AUTH_REGISTER, $authSystem, $newUser);

        // Start email confirmation flow if required
        if ($this->emailConfirmationService->confirmationRequired() && !$emailConfirmed) {
@ -138,7 +139,7 @@ class RegistrationService
        }

        $restrictedEmailDomains = explode(',', str_replace(' ', '', $registrationRestrict));
-        $userEmailDomain = $domain = mb_substr(mb_strrchr($userEmail, '@'), 1);
+        $userEmailDomain = mb_substr(mb_strrchr($userEmail, '@'), 1);
        if (!in_array($userEmailDomain, $restrictedEmailDomains)) {
            $redirect = $this->registrationAllowed() ? '/register' : '/login';

--- a/app/Access/Saml2Service.php
+++ b/app/Access/Saml2Service.php
@ -21,19 +21,13 @@ use OneLogin\Saml2\ValidationError;
 class Saml2Service
 {
    protected array $config;
-    protected RegistrationService $registrationService;
-    protected LoginService $loginService;
-    protected GroupSyncService $groupSyncService;

    public function __construct(
-        RegistrationService $registrationService,
-        LoginService $loginService,
-        GroupSyncService $groupSyncService
+        protected RegistrationService $registrationService,
+        protected LoginService $loginService,
+        protected GroupSyncService $groupSyncService
    ) {
        $this->config = config('saml2');
-        $this->registrationService = $registrationService;
-        $this->loginService = $loginService;
-        $this->groupSyncService = $groupSyncService;
    }

    /**
@ -54,20 +48,23 @@ class Saml2Service

    /**
     * Initiate a logout flow.
+     * Returns the SAML2 request ID, and the URL to redirect the user to.
     *
     * @throws Error
+     * @returns array{url: string, id: ?string}
     */
    public function logout(User $user): array
    {
        $toolKit = $this->getToolkit();
-        $returnRoute = url('/');
+        $sessionIndex = session()->get('saml2_session_index');
+        $returnUrl = url($this->loginService->logout());

        try {
            $url = $toolKit->logout(
-                $returnRoute,
+                $returnUrl,
                [],
                $user->email,
-                session()->get('saml2_session_index'),
+                $sessionIndex,
                true,
                Constants::NAMEID_EMAIL_ADDRESS
            );
@ -77,8 +74,7 @@ class Saml2Service
                throw $error;
            }

-            $this->actionLogout();
-            $url = '/';
+            $url = $returnUrl;
            $id = null;
        }

@ -128,7 +124,7 @@ class Saml2Service
     *
     * @throws Error
     */
-    public function processSlsResponse(?string $requestId): ?string
+    public function processSlsResponse(?string $requestId): string
    {
        $toolkit = $this->getToolkit();

@ -137,7 +133,8 @@ class Saml2Service
        // value so that the exact encoding format is matched when checking the signature.
        // This is primarily due to ADFS encoding query params with lowercase percent encoding while
        // PHP (And most other sensible providers) standardise on uppercase.
-        $redirect = $toolkit->processSLO(true, $requestId, true, null, true);
+        /** @var ?string $samlRedirect */
+        $samlRedirect = $toolkit->processSLO(true, $requestId, true, null, true);
        $errors = $toolkit->getErrors();

        if (!empty($errors)) {
@ -146,18 +143,9 @@ class Saml2Service
            );
        }

-        $this->actionLogout();
+        $defaultBookStackRedirect = $this->loginService->logout();

-        return $redirect;
-    }
-
-    /**
-     * Do the required actions to log a user out.
-     */
-    protected function actionLogout()
-    {
-        auth()->logout();
-        session()->invalidate();
+        return $samlRedirect ?? $defaultBookStackRedirect;
    }

    /**
@ -357,6 +345,10 @@ class Saml2Service
        $userDetails = $this->getUserDetails($samlID, $samlAttributes);
        $isLoggedIn = auth()->check();

+        if ($this->shouldSyncGroups()) {
+            $userDetails['groups'] = $this->getUserGroups($samlAttributes);
+        }
+
        if ($this->config['dump_user_details']) {
            throw new JsonDebugException([
                'id_from_idp'         => $samlID,
@ -379,13 +371,8 @@ class Saml2Service
            $userDetails['external_id']
        );

-        if ($user === null) {
-            throw new SamlException(trans('errors.saml_user_not_registered', ['name' => $userDetails['external_id']]), '/login');
-        }
-
        if ($this->shouldSyncGroups()) {
-            $groups = $this->getUserGroups($samlAttributes);
-            $this->groupSyncService->syncUserWithFoundGroups($user, $groups, $this->config['remove_from_groups']);
+            $this->groupSyncService->syncUserWithFoundGroups($user, $userDetails['groups'], $this->config['remove_from_groups']);
        }

        $this->loginService->login($user, 'saml2');
--- a/app/Access/SocialAuthService.php
+++ b/app/Access/SocialAuthService.php
@ -2,69 +2,24 @@

 namespace BookStack\Access;

-use BookStack\Auth\Access\handler;
 use BookStack\Exceptions\SocialDriverNotConfigured;
 use BookStack\Exceptions\SocialSignInAccountNotUsed;
 use BookStack\Exceptions\UserRegistrationException;
 use BookStack\Users\Models\User;
-use Illuminate\Support\Facades\Event;
 use Illuminate\Support\Str;
 use Laravel\Socialite\Contracts\Factory as Socialite;
 use Laravel\Socialite\Contracts\Provider;
 use Laravel\Socialite\Contracts\User as SocialUser;
 use Laravel\Socialite\Two\GoogleProvider;
-use SocialiteProviders\Manager\SocialiteWasCalled;
 use Symfony\Component\HttpFoundation\RedirectResponse;

 class SocialAuthService
 {
-    /**
-     * The core socialite library used.
-     *
-     * @var Socialite
-     */
-    protected $socialite;
-
-    /**
-     * @var LoginService
-     */
-    protected $loginService;
-
-    /**
-     * The default built-in social drivers we support.
-     *
-     * @var string[]
-     */
-    protected $validSocialDrivers = [
-        'google',
-        'github',
-        'facebook',
-        'slack',
-        'twitter',
-        'azure',
-        'okta',
-        'gitlab',
-        'twitch',
-        'discord',
-    ];
-
-    /**
-     * Callbacks to run when configuring a social driver
-     * for an initial redirect action.
-     * Array is keyed by social driver name.
-     * Callbacks are passed an instance of the driver.
-     *
-     * @var array<string, callable>
-     */
-    protected $configureForRedirectCallbacks = [];
-
-    /**
-     * SocialAuthService constructor.
-     */
-    public function __construct(Socialite $socialite, LoginService $loginService)
-    {
-        $this->socialite = $socialite;
-        $this->loginService = $loginService;
+    public function __construct(
+        protected Socialite $socialite,
+        protected LoginService $loginService,
+        protected SocialDriverManager $driverManager,
+    ) {
    }

    /**
@ -74,9 +29,10 @@ class SocialAuthService
     */
    public function startLogIn(string $socialDriver): RedirectResponse
    {
-        $driver = $this->validateDriver($socialDriver);
+        $socialDriver = trim(strtolower($socialDriver));
+        $this->driverManager->ensureDriverActive($socialDriver);

-        return $this->getDriverForRedirect($driver)->redirect();
+        return $this->getDriverForRedirect($socialDriver)->redirect();
    }

    /**
@ -86,9 +42,10 @@ class SocialAuthService
     */
    public function startRegister(string $socialDriver): RedirectResponse
    {
-        $driver = $this->validateDriver($socialDriver);
+        $socialDriver = trim(strtolower($socialDriver));
+        $this->driverManager->ensureDriverActive($socialDriver);

-        return $this->getDriverForRedirect($driver)->redirect();
+        return $this->getDriverForRedirect($socialDriver)->redirect();
    }

    /**
@ -119,9 +76,10 @@ class SocialAuthService
     */
    public function getSocialUser(string $socialDriver): SocialUser
    {
-        $driver = $this->validateDriver($socialDriver);
+        $socialDriver = trim(strtolower($socialDriver));
+        $this->driverManager->ensureDriverActive($socialDriver);

-        return $this->socialite->driver($driver)->user();
+        return $this->socialite->driver($socialDriver)->user();
    }

    /**
@ -131,6 +89,7 @@ class SocialAuthService
     */
    public function handleLoginCallback(string $socialDriver, SocialUser $socialUser)
    {
+        $socialDriver = trim(strtolower($socialDriver));
        $socialId = $socialUser->getId();

        // Get any attached social accounts or users
@ -154,21 +113,21 @@ class SocialAuthService
            $currentUser->socialAccounts()->save($account);
            session()->flash('success', trans('settings.users_social_connected', ['socialAccount' => $titleCaseDriver]));

-            return redirect($currentUser->getEditUrl());
+            return redirect('/my-account/auth#social_accounts');
        }

        // When a user is logged in and the social account exists and is already linked to the current user.
        if ($isLoggedIn && $socialAccount !== null && $socialAccount->user->id === $currentUser->id) {
            session()->flash('error', trans('errors.social_account_existing', ['socialAccount' => $titleCaseDriver]));

-            return redirect($currentUser->getEditUrl());
+            return redirect('/my-account/auth#social_accounts');
        }

        // When a user is logged in, A social account exists but the users do not match.
        if ($isLoggedIn && $socialAccount !== null && $socialAccount->user->id != $currentUser->id) {
            session()->flash('error', trans('errors.social_account_already_used_existing', ['socialAccount' => $titleCaseDriver]));

-            return redirect($currentUser->getEditUrl());
+            return redirect('/my-account/auth#social_accounts');
        }

        // Otherwise let the user know this social account is not used by anyone.
@ -181,75 +140,11 @@ class SocialAuthService
    }

    /**
-     * Ensure the social driver is correct and supported.
-     *
-     * @throws SocialDriverNotConfigured
+     * Get the social driver manager used by this service.
     */
-    protected function validateDriver(string $socialDriver): string
+    public function drivers(): SocialDriverManager
    {
-        $driver = trim(strtolower($socialDriver));
-
-        if (!in_array($driver, $this->validSocialDrivers)) {
-            abort(404, trans('errors.social_driver_not_found'));
-        }
-
-        if (!$this->checkDriverConfigured($driver)) {
-            throw new SocialDriverNotConfigured(trans('errors.social_driver_not_configured', ['socialAccount' => Str::title($socialDriver)]));
-        }
-
-        return $driver;
-    }
-
-    /**
-     * Check a social driver has been configured correctly.
-     */
-    protected function checkDriverConfigured(string $driver): bool
-    {
-        $lowerName = strtolower($driver);
-        $configPrefix = 'services.' . $lowerName . '.';
-        $config = [config($configPrefix . 'client_id'), config($configPrefix . 'client_secret'), config('services.callback_url')];
-
-        return !in_array(false, $config) && !in_array(null, $config);
-    }
-
-    /**
-     * Gets the names of the active social drivers.
-     */
-    public function getActiveDrivers(): array
-    {
-        $activeDrivers = [];
-
-        foreach ($this->validSocialDrivers as $driverKey) {
-            if ($this->checkDriverConfigured($driverKey)) {
-                $activeDrivers[$driverKey] = $this->getDriverName($driverKey);
-            }
-        }
-
-        return $activeDrivers;
-    }
-
-    /**
-     * Get the presentational name for a driver.
-     */
-    public function getDriverName(string $driver): string
-    {
-        return config('services.' . strtolower($driver) . '.name');
-    }
-
-    /**
-     * Check if the current config for the given driver allows auto-registration.
-     */
-    public function driverAutoRegisterEnabled(string $driver): bool
-    {
-        return config('services.' . strtolower($driver) . '.auto_register') === true;
-    }
-
-    /**
-     * Check if the current config for the given driver allow email address auto-confirmation.
-     */
-    public function driverAutoConfirmEmailEnabled(string $driver): bool
-    {
-        return config('services.' . strtolower($driver) . '.auto_confirm') === true;
+        return $this->driverManager;
    }

    /**
@ -283,33 +178,8 @@ class SocialAuthService
            $driver->with(['prompt' => 'select_account']);
        }

-        if (isset($this->configureForRedirectCallbacks[$driverName])) {
-            $this->configureForRedirectCallbacks[$driverName]($driver);
-        }
+        $this->driverManager->getConfigureForRedirectCallback($driverName)($driver);

        return $driver;
    }
-
-    /**
-     * Add a custom socialite driver to be used.
-     * Driver name should be lower_snake_case.
-     * Config array should mirror the structure of a service
-     * within the `Config/services.php` file.
-     * Handler should be a Class@method handler to the SocialiteWasCalled event.
-     */
-    public function addSocialDriver(
-        string $driverName,
-        array $config,
-        string $socialiteHandler,
-        callable $configureForRedirect = null
-    ) {
-        $this->validSocialDrivers[] = $driverName;
-        config()->set('services.' . $driverName, $config);
-        config()->set('services.' . $driverName . '.redirect', url('/login/service/' . $driverName . '/callback'));
-        config()->set('services.' . $driverName . '.name', $config['name'] ?? $driverName);
-        Event::listen(SocialiteWasCalled::class, $socialiteHandler);
-        if (!is_null($configureForRedirect)) {
-            $this->configureForRedirectCallbacks[$driverName] = $configureForRedirect;
-        }
-    }
 }
--- a/app/Access/SocialDriverManager.php
+++ b/app/Access/SocialDriverManager.php
@ -0,0 +1,147 @@
+<?php
+
+namespace BookStack\Access;
+
+use BookStack\Exceptions\SocialDriverNotConfigured;
+use Illuminate\Support\Facades\Event;
+use Illuminate\Support\Str;
+use SocialiteProviders\Manager\SocialiteWasCalled;
+
+class SocialDriverManager
+{
+    /**
+     * The default built-in social drivers we support.
+     *
+     * @var string[]
+     */
+    protected array $validDrivers = [
+        'google',
+        'github',
+        'facebook',
+        'slack',
+        'twitter',
+        'azure',
+        'okta',
+        'gitlab',
+        'twitch',
+        'discord',
+    ];
+
+    /**
+     * Callbacks to run when configuring a social driver
+     * for an initial redirect action.
+     * Array is keyed by social driver name.
+     * Callbacks are passed an instance of the driver.
+     *
+     * @var array<string, callable>
+     */
+    protected array $configureForRedirectCallbacks = [];
+
+    /**
+     * Check if the current config for the given driver allows auto-registration.
+     */
+    public function isAutoRegisterEnabled(string $driver): bool
+    {
+        return $this->getDriverConfigProperty($driver, 'auto_register') === true;
+    }
+
+    /**
+     * Check if the current config for the given driver allow email address auto-confirmation.
+     */
+    public function isAutoConfirmEmailEnabled(string $driver): bool
+    {
+        return $this->getDriverConfigProperty($driver, 'auto_confirm') === true;
+    }
+
+    /**
+     * Gets the names of the active social drivers, keyed by driver id.
+     * @returns array<string, string>
+     */
+    public function getActive(): array
+    {
+        $activeDrivers = [];
+
+        foreach ($this->validDrivers as $driverKey) {
+            if ($this->checkDriverConfigured($driverKey)) {
+                $activeDrivers[$driverKey] = $this->getName($driverKey);
+            }
+        }
+
+        return $activeDrivers;
+    }
+
+    /**
+     * Get the configure-for-redirect callback for the given driver.
+     * This is a callable that allows modification of the driver at redirect time.
+     * Commonly used to perform custom dynamic configuration where required.
+     * The callback is passed a \Laravel\Socialite\Contracts\Provider instance.
+     */
+    public function getConfigureForRedirectCallback(string $driver): callable
+    {
+        return $this->configureForRedirectCallbacks[$driver] ?? (fn() => true);
+    }
+
+    /**
+     * Add a custom socialite driver to be used.
+     * Driver name should be lower_snake_case.
+     * Config array should mirror the structure of a service
+     * within the `Config/services.php` file.
+     * Handler should be a Class@method handler to the SocialiteWasCalled event.
+     */
+    public function addSocialDriver(
+        string $driverName,
+        array $config,
+        string $socialiteHandler,
+        ?callable $configureForRedirect = null
+    ) {
+        $this->validDrivers[] = $driverName;
+        config()->set('services.' . $driverName, $config);
+        config()->set('services.' . $driverName . '.redirect', url('/login/service/' . $driverName . '/callback'));
+        config()->set('services.' . $driverName . '.name', $config['name'] ?? $driverName);
+        Event::listen(SocialiteWasCalled::class, $socialiteHandler);
+        if (!is_null($configureForRedirect)) {
+            $this->configureForRedirectCallbacks[$driverName] = $configureForRedirect;
+        }
+    }
+
+    /**
+     * Get the presentational name for a driver.
+     */
+    protected function getName(string $driver): string
+    {
+        return $this->getDriverConfigProperty($driver, 'name') ?? '';
+    }
+
+    protected function getDriverConfigProperty(string $driver, string $property): mixed
+    {
+        return config("services.{$driver}.{$property}");
+    }
+
+    /**
+     * Ensure the social driver is correct and supported.
+     *
+     * @throws SocialDriverNotConfigured
+     */
+    public function ensureDriverActive(string $driverName): void
+    {
+        if (!in_array($driverName, $this->validDrivers)) {
+            abort(404, trans('errors.social_driver_not_found'));
+        }
+
+        if (!$this->checkDriverConfigured($driverName)) {
+            throw new SocialDriverNotConfigured(trans('errors.social_driver_not_configured', ['socialAccount' => Str::title($driverName)]));
+        }
+    }
+
+    /**
+     * Check a social driver has been configured correctly.
+     */
+    protected function checkDriverConfigured(string $driver): bool
+    {
+        $lowerName = strtolower($driver);
+        $configPrefix = 'services.' . $lowerName . '.';
+        $config = [config($configPrefix . 'client_id'), config($configPrefix . 'client_secret'), config('services.callback_url')];
+
+        return !in_array(false, $config) && !in_array(null, $config);
+    }
+}
--- a/app/Access/UserInviteException.php
+++ b/app/Access/UserInviteException.php
@ -0,0 +1,10 @@
+<?php
+
+namespace BookStack\Access;
+
+use Exception;
+
+class UserInviteException extends Exception
+{
+    //
+}
--- a/app/Access/UserInviteService.php
+++ b/app/Access/UserInviteService.php
@ -2,7 +2,7 @@

 namespace BookStack\Access;

-use BookStack\Notifications\UserInvite;
+use BookStack\Access\Notifications\UserInviteNotification;
 use BookStack\Users\Models\User;

 class UserInviteService extends UserTokenService
@ -13,11 +13,17 @@ class UserInviteService extends UserTokenService
    /**
     * Send an invitation to a user to sign into BookStack
     * Removes existing invitation tokens.
+     * @throws UserInviteException
     */
    public function sendInvitation(User $user)
    {
        $this->deleteByUser($user);
        $token = $this->createTokenForUser($user);
-        $user->notify(new UserInvite($token));
+
+        try {
+            $user->notify(new UserInviteNotification($token));
+        } catch (\Exception $exception) {
+            throw new UserInviteException($exception->getMessage(), $exception->getCode(), $exception);
+        }
    }
 }
--- a/app/Activity/ActivityQueries.php
+++ b/app/Activity/ActivityQueries.php
@ -7,6 +7,7 @@ use BookStack\Entities\Models\Book;
 use BookStack\Entities\Models\Chapter;
 use BookStack\Entities\Models\Entity;
 use BookStack\Entities\Models\Page;
+use BookStack\Entities\Tools\MixedEntityListLoader;
 use BookStack\Permissions\PermissionApplicator;
 use BookStack\Users\Models\User;
 use Illuminate\Database\Eloquent\Builder;
@ -14,11 +15,10 @@ use Illuminate\Database\Eloquent\Relations\Relation;

 class ActivityQueries
 {
-    protected PermissionApplicator $permissions;
-
-    public function __construct(PermissionApplicator $permissions)
-    {
-        $this->permissions = $permissions;
+    public function __construct(
+        protected PermissionApplicator $permissions,
+        protected MixedEntityListLoader $listLoader,
+    ) {
    }

    /**
@ -27,13 +27,15 @@ class ActivityQueries
    public function latest(int $count = 20, int $page = 0): array
    {
        $activityList = $this->permissions
-            ->restrictEntityRelationQuery(Activity::query(), 'activities', 'entity_id', 'entity_type')
+            ->restrictEntityRelationQuery(Activity::query(), 'activities', 'loggable_id', 'loggable_type')
            ->orderBy('created_at', 'desc')
-            ->with(['user', 'entity'])
+            ->with(['user'])
            ->skip($count * $page)
            ->take($count)
            ->get();

+        $this->listLoader->loadIntoRelations($activityList->all(), 'loggable', false);
+
        return $this->filterSimilar($activityList);
    }

@ -57,14 +59,14 @@ class ActivityQueries
        $query->where(function (Builder $query) use ($queryIds) {
            foreach ($queryIds as $morphClass => $idArr) {
                $query->orWhere(function (Builder $innerQuery) use ($morphClass, $idArr) {
-                    $innerQuery->where('entity_type', '=', $morphClass)
-                        ->whereIn('entity_id', $idArr);
+                    $innerQuery->where('loggable_type', '=', $morphClass)
+                        ->whereIn('loggable_id', $idArr);
                });
            }
        });

        $activity = $query->orderBy('created_at', 'desc')
-            ->with(['entity' => function (Relation $query) {
+            ->with(['loggable' => function (Relation $query) {
                $query->withTrashed();
            }, 'user.avatar'])
            ->skip($count * ($page - 1))
@ -80,7 +82,7 @@ class ActivityQueries
    public function userActivity(User $user, int $count = 20, int $page = 0): array
    {
        $activityList = $this->permissions
-            ->restrictEntityRelationQuery(Activity::query(), 'activities', 'entity_id', 'entity_type')
+            ->restrictEntityRelationQuery(Activity::query(), 'activities', 'loggable_id', 'loggable_type')
            ->orderBy('created_at', 'desc')
            ->where('user_id', '=', $user->id)
            ->skip($count * $page)
--- a/app/Activity/ActivityType.php
+++ b/app/Activity/ActivityType.php
@ -67,6 +67,14 @@ class ActivityType
    const WEBHOOK_UPDATE = 'webhook_update';
    const WEBHOOK_DELETE = 'webhook_delete';

+    const IMPORT_CREATE = 'import_create';
+    const IMPORT_RUN = 'import_run';
+    const IMPORT_DELETE = 'import_delete';
+
+    const SORT_RULE_CREATE = 'sort_rule_create';
+    const SORT_RULE_UPDATE = 'sort_rule_update';
+    const SORT_RULE_DELETE = 'sort_rule_delete';
+
    /**
     * Get all the possible values.
     */
--- a/app/Activity/CommentRepo.php
+++ b/app/Activity/CommentRepo.php
@ -5,7 +5,7 @@ namespace BookStack\Activity;
 use BookStack\Activity\Models\Comment;
 use BookStack\Entities\Models\Entity;
 use BookStack\Facades\Activity as ActivityService;
-use League\CommonMark\CommonMarkConverter;
+use BookStack\Util\HtmlDescriptionFilter;

 class CommentRepo
 {
@ -20,13 +20,12 @@ class CommentRepo
    /**
     * Create a new comment on an entity.
     */
-    public function create(Entity $entity, string $text, ?int $parent_id): Comment
+    public function create(Entity $entity, string $html, ?int $parent_id): Comment
    {
        $userId = user()->id;
        $comment = new Comment();

-        $comment->text = $text;
-        $comment->html = $this->commentToHtml($text);
+        $comment->html = HtmlDescriptionFilter::filterFromString($html);
        $comment->created_by = $userId;
        $comment->updated_by = $userId;
        $comment->local_id = $this->getNextLocalId($entity);
@ -42,11 +41,10 @@ class CommentRepo
    /**
     * Update an existing comment.
     */
-    public function update(Comment $comment, string $text): Comment
+    public function update(Comment $comment, string $html): Comment
    {
        $comment->updated_by = user()->id;
-        $comment->text = $text;
-        $comment->html = $this->commentToHtml($text);
+        $comment->html = HtmlDescriptionFilter::filterFromString($html);
        $comment->save();

        ActivityService::add(ActivityType::COMMENT_UPDATE, $comment);
@ -64,20 +62,6 @@ class CommentRepo
        ActivityService::add(ActivityType::COMMENT_DELETE, $comment);
    }

-    /**
-     * Convert the given comment Markdown to HTML.
-     */
-    public function commentToHtml(string $commentText): string
-    {
-        $converter = new CommonMarkConverter([
-            'html_input'         => 'strip',
-            'max_nesting_level'  => 10,
-            'allow_unsafe_links' => false,
-        ]);
-
-        return $converter->convert($commentText);
-    }
-
    /**
     * Get the next local ID relative to the linked entity.
     */
--- a/app/Activity/Controllers/AuditLogApiController.php
+++ b/app/Activity/Controllers/AuditLogApiController.php
@ -0,0 +1,28 @@
+<?php
+
+namespace BookStack\Activity\Controllers;
+
+use BookStack\Activity\Models\Activity;
+use BookStack\Http\ApiController;
+
+class AuditLogApiController extends ApiController
+{
+    /**
+     * Get a listing of audit log events in the system.
+     * The loggable relation fields currently only relates to core
+     * content types (page, book, bookshelf, chapter) but this may be
+     * used more in the future across other types.
+     * Requires permission to manage both users and system settings.
+     */
+    public function list()
+    {
+        $this->checkPermission('settings-manage');
+        $this->checkPermission('users-manage');
+
+        $query = Activity::query()->with(['user']);
+
+        return $this->apiListingResponse($query, [
+            'id', 'type', 'detail', 'user_id', 'loggable_id', 'loggable_type', 'ip', 'created_at',
+        ]);
+    }
+}
--- a/app/Activity/Controllers/AuditLogController.php
+++ b/app/Activity/Controllers/AuditLogController.php
@ -5,6 +5,7 @@ namespace BookStack\Activity\Controllers;
 use BookStack\Activity\ActivityType;
 use BookStack\Activity\Models\Activity;
 use BookStack\Http\Controller;
+use BookStack\Sorting\SortUrl;
 use BookStack\Util\SimpleListOptions;
 use Illuminate\Http\Request;

@ -32,7 +33,7 @@ class AuditLogController extends Controller

        $query = Activity::query()
            ->with([
-                'entity' => fn ($query) => $query->withTrashed(),
+                'loggable' => fn ($query) => $query->withTrashed(),
                'user',
            ])
            ->orderBy($listOptions->getSort(), $listOptions->getOrder());
@ -65,6 +66,7 @@ class AuditLogController extends Controller
            'filters'       => $filters,
            'listOptions'   => $listOptions,
            'activityTypes' => $types,
+            'filterSortUrl' => new SortUrl('settings/audit', array_filter($request->except('page')))
        ]);
    }
 }
--- a/app/Activity/Controllers/CommentController.php
+++ b/app/Activity/Controllers/CommentController.php
@ -3,7 +3,7 @@
 namespace BookStack\Activity\Controllers;

 use BookStack\Activity\CommentRepo;
-use BookStack\Entities\Models\Page;
+use BookStack\Entities\Queries\PageQueries;
 use BookStack\Http\Controller;
 use Illuminate\Http\Request;
 use Illuminate\Validation\ValidationException;
@ -11,7 +11,8 @@ use Illuminate\Validation\ValidationException;
 class CommentController extends Controller
 {
    public function __construct(
-        protected CommentRepo $commentRepo
+        protected CommentRepo $commentRepo,
+        protected PageQueries $pageQueries,
    ) {
    }

@ -22,12 +23,12 @@ class CommentController extends Controller
     */
    public function savePageComment(Request $request, int $pageId)
    {
-        $this->validate($request, [
-            'text'      => ['required', 'string'],
+        $input = $this->validate($request, [
+            'html'      => ['required', 'string'],
            'parent_id' => ['nullable', 'integer'],
        ]);

-        $page = Page::visible()->find($pageId);
+        $page = $this->pageQueries->findVisibleById($pageId);
        if ($page === null) {
            return response('Not found', 404);
        }
@ -39,7 +40,7 @@ class CommentController extends Controller

        // Create a new comment.
        $this->checkPermission('comment-create-all');
-        $comment = $this->commentRepo->create($page, $request->get('text'), $request->get('parent_id'));
+        $comment = $this->commentRepo->create($page, $input['html'], $input['parent_id'] ?? null);

        return view('comments.comment-branch', [
            'readOnly' => false,
@ -57,17 +58,20 @@ class CommentController extends Controller
     */
    public function update(Request $request, int $commentId)
    {
-        $this->validate($request, [
-            'text' => ['required', 'string'],
+        $input = $this->validate($request, [
+            'html' => ['required', 'string'],
        ]);

        $comment = $this->commentRepo->getById($commentId);
        $this->checkOwnablePermission('page-view', $comment->entity);
        $this->checkOwnablePermission('comment-update', $comment);

-        $comment = $this->commentRepo->update($comment, $request->get('text'));
+        $comment = $this->commentRepo->update($comment, $input['html']);

-        return view('comments.comment', ['comment' => $comment, 'readOnly' => false]);
+        return view('comments.comment', [
+            'comment' => $comment,
+            'readOnly' => false,
+        ]);
    }

    /**
--- a/app/Activity/Controllers/FavouriteController.php
+++ b/app/Activity/Controllers/FavouriteController.php
@ -2,23 +2,26 @@

 namespace BookStack\Activity\Controllers;

-use BookStack\Activity\Models\Favouritable;
-use BookStack\App\Model;
-use BookStack\Entities\Models\Entity;
-use BookStack\Entities\Queries\TopFavourites;
+use BookStack\Entities\Queries\QueryTopFavourites;
+use BookStack\Entities\Tools\MixedEntityRequestHelper;
 use BookStack\Http\Controller;
 use Illuminate\Http\Request;

 class FavouriteController extends Controller
 {
+    public function __construct(
+        protected MixedEntityRequestHelper $entityHelper,
+    ) {
+    }
+
    /**
     * Show a listing of all favourite items for the current user.
     */
-    public function index(Request $request)
+    public function index(Request $request, QueryTopFavourites $topFavourites)
    {
        $viewCount = 20;
        $page = intval($request->get('page', 1));
-        $favourites = (new TopFavourites())->run($viewCount + 1, (($page - 1) * $viewCount));
+        $favourites = $topFavourites->run($viewCount + 1, (($page - 1) * $viewCount));

        $hasMoreLink = ($favourites->count() > $viewCount) ? url('/favourites?page=' . ($page + 1)) : null;

@ -36,16 +39,17 @@ class FavouriteController extends Controller
     */
    public function add(Request $request)
    {
-        $favouritable = $this->getValidatedModelFromRequest($request);
-        $favouritable->favourites()->firstOrCreate([
+        $modelInfo = $this->validate($request, $this->entityHelper->validationRules());
+        $entity = $this->entityHelper->getVisibleEntityFromRequestData($modelInfo);
+        $entity->favourites()->firstOrCreate([
            'user_id' => user()->id,
        ]);

        $this->showSuccessNotification(trans('activities.favourite_add_notification', [
-            'name' => $favouritable->name,
+            'name' => $entity->name,
        ]));

-        return redirect()->back();
+        return redirect($entity->getUrl());
    }

    /**
@ -53,48 +57,16 @@ class FavouriteController extends Controller
     */
    public function remove(Request $request)
    {
-        $favouritable = $this->getValidatedModelFromRequest($request);
-        $favouritable->favourites()->where([
+        $modelInfo = $this->validate($request, $this->entityHelper->validationRules());
+        $entity = $this->entityHelper->getVisibleEntityFromRequestData($modelInfo);
+        $entity->favourites()->where([
            'user_id' => user()->id,
        ])->delete();

        $this->showSuccessNotification(trans('activities.favourite_remove_notification', [
-            'name' => $favouritable->name,
+            'name' => $entity->name,
        ]));

-        return redirect()->back();
-    }
-
-    /**
-     * @throws \Illuminate\Validation\ValidationException
-     * @throws \Exception
-     */
-    protected function getValidatedModelFromRequest(Request $request): Entity
-    {
-        $modelInfo = $this->validate($request, [
-            'type' => ['required', 'string'],
-            'id'   => ['required', 'integer'],
-        ]);
-
-        if (!class_exists($modelInfo['type'])) {
-            throw new \Exception('Model not found');
-        }
-
-        /** @var Model $model */
-        $model = new $modelInfo['type']();
-        if (!$model instanceof Favouritable) {
-            throw new \Exception('Model not favouritable');
-        }
-
-        $modelInstance = $model->newQuery()
-            ->where('id', '=', $modelInfo['id'])
-            ->first(['id', 'name', 'owned_by']);
-
-        $inaccessibleEntity = ($modelInstance instanceof Entity && !userCan('view', $modelInstance));
-        if (is_null($modelInstance) || $inaccessibleEntity) {
-            throw new \Exception('Model instance not found');
-        }
-
-        return $modelInstance;
+        return redirect($entity->getUrl());
    }
 }
--- a/app/Activity/Controllers/WatchController.php
+++ b/app/Activity/Controllers/WatchController.php
@ -3,63 +3,27 @@
 namespace BookStack\Activity\Controllers;

 use BookStack\Activity\Tools\UserEntityWatchOptions;
-use BookStack\App\Model;
-use BookStack\Entities\Models\Entity;
+use BookStack\Entities\Tools\MixedEntityRequestHelper;
 use BookStack\Http\Controller;
-use Exception;
 use Illuminate\Http\Request;
-use Illuminate\Validation\ValidationException;

 class WatchController extends Controller
 {
-    public function update(Request $request)
+    public function update(Request $request, MixedEntityRequestHelper $entityHelper)
    {
        $this->checkPermission('receive-notifications');
        $this->preventGuestAccess();

-        $requestData = $this->validate($request, [
+        $requestData = $this->validate($request, array_merge([
            'level' => ['required', 'string'],
-        ]);
+        ], $entityHelper->validationRules()));

-        $watchable = $this->getValidatedModelFromRequest($request);
+        $watchable = $entityHelper->getVisibleEntityFromRequestData($requestData);
        $watchOptions = new UserEntityWatchOptions(user(), $watchable);
        $watchOptions->updateLevelByName($requestData['level']);

        $this->showSuccessNotification(trans('activities.watch_update_level_notification'));

-        return redirect()->back();
-    }
-
-    /**
-     * @throws ValidationException
-     * @throws Exception
-     */
-    protected function getValidatedModelFromRequest(Request $request): Entity
-    {
-        $modelInfo = $this->validate($request, [
-            'type' => ['required', 'string'],
-            'id'   => ['required', 'integer'],
-        ]);
-
-        if (!class_exists($modelInfo['type'])) {
-            throw new Exception('Model not found');
-        }
-
-        /** @var Model $model */
-        $model = new $modelInfo['type']();
-        if (!$model instanceof Entity) {
-            throw new Exception('Model not an entity');
-        }
-
-        $modelInstance = $model->newQuery()
-            ->where('id', '=', $modelInfo['id'])
-            ->first(['id', 'name', 'owned_by']);
-
-        $inaccessibleEntity = ($modelInstance instanceof Entity && !userCan('view', $modelInstance));
-        if (is_null($modelInstance) || $inaccessibleEntity) {
-            throw new Exception('Model instance not found');
-        }
-
-        return $modelInstance;
+        return redirect($watchable->getUrl());
    }
 }
--- a/app/Activity/DispatchWebhookJob.php
+++ b/app/Activity/DispatchWebhookJob.php
@ -6,6 +6,7 @@ use BookStack\Activity\Models\Loggable;
 use BookStack\Activity\Models\Webhook;
 use BookStack\Activity\Tools\WebhookFormatter;
 use BookStack\Facades\Theme;
+use BookStack\Http\HttpRequestService;
 use BookStack\Theming\ThemeEvents;
 use BookStack\Users\Models\User;
 use BookStack\Util\SsrUrlValidator;
@ -14,7 +15,6 @@ use Illuminate\Contracts\Queue\ShouldQueue;
 use Illuminate\Foundation\Bus\Dispatchable;
 use Illuminate\Queue\InteractsWithQueue;
 use Illuminate\Queue\SerializesModels;
-use Illuminate\Support\Facades\Http;
 use Illuminate\Support\Facades\Log;

 class DispatchWebhookJob implements ShouldQueue
@ -49,25 +49,28 @@ class DispatchWebhookJob implements ShouldQueue
     *
     * @return void
     */
-    public function handle()
+    public function handle(HttpRequestService $http)
    {
        $lastError = null;

        try {
            (new SsrUrlValidator())->ensureAllowed($this->webhook->endpoint);

-            $response = Http::asJson()
-                ->withOptions(['allow_redirects' => ['strict' => true]])
-                ->timeout($this->webhook->timeout)
-                ->post($this->webhook->endpoint, $this->webhookData);
-        } catch (\Exception $exception) {
-            $lastError = $exception->getMessage();
-            Log::error("Webhook call to endpoint {$this->webhook->endpoint} failed with error \"{$lastError}\"");
-        }
+            $client = $http->buildClient($this->webhook->timeout, [
+                'connect_timeout' => 10,
+                'allow_redirects' => ['strict' => true],
+            ]);

-        if (isset($response) && $response->failed()) {
-            $lastError = "Response status from endpoint was {$response->status()}";
-            Log::error("Webhook call to endpoint {$this->webhook->endpoint} failed with status {$response->status()}");
+            $response = $client->sendRequest($http->jsonRequest('POST', $this->webhook->endpoint, $this->webhookData));
+            $statusCode = $response->getStatusCode();
+
+            if ($statusCode >= 400) {
+                $lastError = "Response status from endpoint was {$statusCode}";
+                Log::error("Webhook call to endpoint {$this->webhook->endpoint} failed with status {$statusCode}");
+            }
+        } catch (\Exception $error) {
+            $lastError = $error->getMessage();
+            Log::error("Webhook call to endpoint {$this->webhook->endpoint} failed with error \"{$lastError}\"");
        }

        $this->webhook->last_called_at = now();
--- a/app/Activity/Models/Activity.php
+++ b/app/Activity/Models/Activity.php
@ -9,31 +9,30 @@ use BookStack\Users\Models\User;
 use Illuminate\Database\Eloquent\Relations\BelongsTo;
 use Illuminate\Database\Eloquent\Relations\HasMany;
 use Illuminate\Database\Eloquent\Relations\MorphTo;
+use Illuminate\Support\Carbon;
 use Illuminate\Support\Str;

 /**
 * @property string $type
 * @property User   $user
- * @property Entity $entity
+ * @property Entity $loggable
 * @property string $detail
- * @property string $entity_type
- * @property int    $entity_id
+ * @property string $loggable_type
+ * @property int    $loggable_id
 * @property int    $user_id
 * @property Carbon $created_at
- * @property Carbon $updated_at
 */
 class Activity extends Model
 {
    /**
-     * Get the entity for this activity.
+     * Get the loggable model related to this activity.
+     * Currently only used for entities (previously entity_[id/type] columns).
+     * Could be used for others but will need an audit of uses where assumed
+     * to be entities.
     */
-    public function entity(): MorphTo
+    public function loggable(): MorphTo
    {
-        if ($this->entity_type === '') {
-            $this->entity_type = null;
-        }
-
-        return $this->morphTo('entity');
+        return $this->morphTo('loggable');
    }

    /**
@ -46,8 +45,8 @@ class Activity extends Model

    public function jointPermissions(): HasMany
    {
-        return $this->hasMany(JointPermission::class, 'entity_id', 'entity_id')
-            ->whereColumn('activities.entity_type', '=', 'joint_permissions.entity_type');
+        return $this->hasMany(JointPermission::class, 'entity_id', 'loggable_id')
+            ->whereColumn('activities.loggable_type', '=', 'joint_permissions.entity_type');
    }

    /**
@ -73,6 +72,6 @@ class Activity extends Model
     */
    public function isSimilarTo(self $activityB): bool
    {
-        return [$this->type, $this->entity_type, $this->entity_id] === [$activityB->type, $activityB->entity_type, $activityB->entity_id];
+        return [$this->type, $this->loggable_type, $this->loggable_id] === [$activityB->type, $activityB->loggable_type, $activityB->loggable_id];
    }
 }
--- a/app/Activity/Models/Comment.php
+++ b/app/Activity/Models/Comment.php
@ -4,26 +4,28 @@ namespace BookStack\Activity\Models;

 use BookStack\App\Model;
 use BookStack\Users\Models\HasCreatorAndUpdater;
+use BookStack\Util\HtmlContentFilter;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\Relations\BelongsTo;
 use Illuminate\Database\Eloquent\Relations\MorphTo;

 /**
 * @property int      $id
- * @property string   $text
+ * @property string   $text - Deprecated & now unused (#4821)
 * @property string   $html
- * @property int|null $parent_id
+ * @property int|null $parent_id  - Relates to local_id, not id
 * @property int      $local_id
 * @property string   $entity_type
 * @property int      $entity_id
+ * @property int      $created_by
+ * @property int      $updated_by
 */
 class Comment extends Model implements Loggable
 {
    use HasFactory;
    use HasCreatorAndUpdater;

-    protected $fillable = ['text', 'parent_id'];
-    protected $appends = ['created', 'updated'];
+    protected $fillable = ['parent_id'];

    /**
     * Get the entity that this comment belongs to.
@ -38,7 +40,9 @@ class Comment extends Model implements Loggable
     */
    public function parent(): BelongsTo
    {
-        return $this->belongsTo(Comment::class);
+        return $this->belongsTo(Comment::class, 'parent_id', 'local_id', 'parent')
+            ->where('entity_type', '=', $this->entity_type)
+            ->where('entity_id', '=', $this->entity_id);
    }

    /**
@ -49,24 +53,13 @@ class Comment extends Model implements Loggable
        return $this->updated_at->timestamp > $this->created_at->timestamp;
    }

-    /**
-     * Get created date as a relative diff.
-     */
-    public function getCreatedAttribute(): string
-    {
-        return $this->created_at->diffForHumans();
-    }
-
-    /**
-     * Get updated date as a relative diff.
-     */
-    public function getUpdatedAttribute(): string
-    {
-        return $this->updated_at->diffForHumans();
-    }
-
    public function logDescriptor(): string
    {
        return "Comment #{$this->local_id} (ID: {$this->id}) for {$this->entity_type} (ID: {$this->entity_id})";
    }
+
+    public function safeHtml(): string
+    {
+        return HtmlContentFilter::removeScriptsFromHtmlString($this->html ?? '');
+    }
 }
--- a/app/Activity/Models/View.php
+++ b/app/Activity/Models/View.php
@ -41,7 +41,7 @@ class View extends Model
    public static function incrementFor(Viewable $viewable): int
    {
        $user = user();
-        if (is_null($user) || $user->isDefault()) {
+        if ($user->isGuest()) {
            return 0;
        }

--- a/app/Activity/Notifications/Handlers/BaseNotificationHandler.php
+++ b/app/Activity/Notifications/Handlers/BaseNotificationHandler.php
@ -7,6 +7,7 @@ use BookStack\Activity\Notifications\Messages\BaseActivityNotification;
 use BookStack\Entities\Models\Entity;
 use BookStack\Permissions\PermissionApplicator;
 use BookStack\Users\Models\User;
+use Illuminate\Support\Facades\Log;

 abstract class BaseNotificationHandler implements NotificationHandler
 {
@ -36,7 +37,11 @@ abstract class BaseNotificationHandler implements NotificationHandler
            }

            // Send the notification
-            $user->notify(new $notification($detail, $initiator));
+            try {
+                $user->notify(new $notification($detail, $initiator));
+            } catch (\Exception $exception) {
+                Log::error("Failed to send email notification to user [id:{$user->id}] with error: {$exception->getMessage()}");
+            }
        }
    }
 }
--- a/app/Activity/Notifications/MessageParts/EntityLinkMessageLine.php
+++ b/app/Activity/Notifications/MessageParts/EntityLinkMessageLine.php
@ -0,0 +1,29 @@
+<?php
+
+namespace BookStack\Activity\Notifications\MessageParts;
+
+use BookStack\Entities\Models\Entity;
+use Illuminate\Contracts\Support\Htmlable;
+use Stringable;
+
+/**
+ * A link to a specific entity in the system, with the text showing its name.
+ */
+class EntityLinkMessageLine implements Htmlable, Stringable
+{
+    public function __construct(
+        protected Entity $entity,
+        protected int $nameLength = 120,
+    ) {
+    }
+
+    public function toHtml(): string
+    {
+        return '<a href="' . e($this->entity->getUrl()) . '">' . e($this->entity->getShortName($this->nameLength)) . '</a>';
+    }
+
+    public function __toString(): string
+    {
+        return "{$this->entity->getShortName($this->nameLength)} ({$this->entity->getUrl()})";
+    }
+}
--- a/app/Activity/Notifications/MessageParts/EntityPathMessageLine.php
+++ b/app/Activity/Notifications/MessageParts/EntityPathMessageLine.php
@ -0,0 +1,35 @@
+<?php
+
+namespace BookStack\Activity\Notifications\MessageParts;
+
+use BookStack\Entities\Models\Entity;
+use Illuminate\Contracts\Support\Htmlable;
+use Stringable;
+
+/**
+ * A link to a specific entity in the system, with the text showing its name.
+ */
+class EntityPathMessageLine implements Htmlable, Stringable
+{
+    /**
+     * @var EntityLinkMessageLine[]
+     */
+    protected array $entityLinks;
+
+    public function __construct(
+        protected array $entities
+    ) {
+        $this->entityLinks = array_map(fn (Entity $entity) => new EntityLinkMessageLine($entity, 24), $this->entities);
+    }
+
+    public function toHtml(): string
+    {
+        $entityHtmls = array_map(fn (EntityLinkMessageLine $line) => $line->toHtml(), $this->entityLinks);
+        return implode(' &gt; ', $entityHtmls);
+    }
+
+    public function __toString(): string
+    {
+        return implode(' > ', $this->entityLinks);
+    }
+}
--- a/app/Activity/Notifications/Messages/BaseActivityNotification.php
+++ b/app/Activity/Notifications/Messages/BaseActivityNotification.php
@ -3,8 +3,13 @@
 namespace BookStack\Activity\Notifications\Messages;

 use BookStack\Activity\Models\Loggable;
+use BookStack\Activity\Notifications\MessageParts\EntityPathMessageLine;
 use BookStack\Activity\Notifications\MessageParts\LinkedMailMessageLine;
-use BookStack\Notifications\MailNotification;
+use BookStack\App\MailNotification;
+use BookStack\Entities\Models\Entity;
+use BookStack\Entities\Models\Page;
+use BookStack\Permissions\PermissionApplicator;
+use BookStack\Translation\LocaleDefinition;
 use BookStack\Users\Models\User;
 use Illuminate\Bus\Queueable;

@ -35,12 +40,28 @@ abstract class BaseActivityNotification extends MailNotification
    /**
     * Build the common reason footer line used in mail messages.
     */
-    protected function buildReasonFooterLine(string $language): LinkedMailMessageLine
+    protected function buildReasonFooterLine(LocaleDefinition $locale): LinkedMailMessageLine
    {
        return new LinkedMailMessageLine(
-            url('/preferences/notifications'),
-            trans('notifications.footer_reason', [], $language),
-            trans('notifications.footer_reason_link', [], $language),
+            url('/my-account/notifications'),
+            $locale->trans('notifications.footer_reason'),
+            $locale->trans('notifications.footer_reason_link'),
        );
    }
+
+    /**
+     * Build a line which provides the book > chapter path to a page.
+     * Takes into account visibility of these parent items.
+     * Returns null if no path items can be used.
+     */
+    protected function buildPagePathLine(Page $page, User $notifiable): ?EntityPathMessageLine
+    {
+        $permissions = new PermissionApplicator($notifiable);
+
+        $path = array_filter([$page->book, $page->chapter], function (?Entity $entity) use ($permissions) {
+            return !is_null($entity) && $permissions->checkOwnableUserAccess($entity, 'view');
+        });
+
+        return empty($path) ? null : new EntityPathMessageLine($path);
+    }
 }
--- a/app/Activity/Notifications/Messages/CommentCreationNotification.php
+++ b/app/Activity/Notifications/Messages/CommentCreationNotification.php
@ -3,6 +3,7 @@
 namespace BookStack\Activity\Notifications\Messages;

 use BookStack\Activity\Models\Comment;
+use BookStack\Activity\Notifications\MessageParts\EntityLinkMessageLine;
 use BookStack\Activity\Notifications\MessageParts\ListMessageLine;
 use BookStack\Entities\Models\Page;
 use BookStack\Users\Models\User;
@ -17,17 +18,20 @@ class CommentCreationNotification extends BaseActivityNotification
        /** @var Page $page */
        $page = $comment->entity;

-        $language = $notifiable->getLanguage();
+        $locale = $notifiable->getLocale();

-        return $this->newMailMessage($language)
-            ->subject(trans('notifications.new_comment_subject', ['pageName' => $page->getShortName()], $language))
-            ->line(trans('notifications.new_comment_intro', ['appName' => setting('app-name')], $language))
-            ->line(new ListMessageLine([
-                trans('notifications.detail_page_name', [], $language) => $page->name,
-                trans('notifications.detail_commenter', [], $language) => $this->user->name,
-                trans('notifications.detail_comment', [], $language) => strip_tags($comment->html),
-            ]))
-            ->action(trans('notifications.action_view_comment', [], $language), $page->getUrl('#comment' . $comment->local_id))
-            ->line($this->buildReasonFooterLine($language));
+        $listLines = array_filter([
+            $locale->trans('notifications.detail_page_name') => new EntityLinkMessageLine($page),
+            $locale->trans('notifications.detail_page_path') => $this->buildPagePathLine($page, $notifiable),
+            $locale->trans('notifications.detail_commenter') => $this->user->name,
+            $locale->trans('notifications.detail_comment') => strip_tags($comment->html),
+        ]);
+
+        return $this->newMailMessage($locale)
+            ->subject($locale->trans('notifications.new_comment_subject', ['pageName' => $page->getShortName()]))
+            ->line($locale->trans('notifications.new_comment_intro', ['appName' => setting('app-name')]))
+            ->line(new ListMessageLine($listLines))
+            ->action($locale->trans('notifications.action_view_comment'), $page->getUrl('#comment' . $comment->local_id))
+            ->line($this->buildReasonFooterLine($locale));
    }
 }
--- a/app/Activity/Notifications/Messages/PageCreationNotification.php
+++ b/app/Activity/Notifications/Messages/PageCreationNotification.php
@ -2,6 +2,7 @@

 namespace BookStack\Activity\Notifications\Messages;

+use BookStack\Activity\Notifications\MessageParts\EntityLinkMessageLine;
 use BookStack\Activity\Notifications\MessageParts\ListMessageLine;
 use BookStack\Entities\Models\Page;
 use BookStack\Users\Models\User;
@ -14,16 +15,19 @@ class PageCreationNotification extends BaseActivityNotification
        /** @var Page $page */
        $page = $this->detail;

-        $language = $notifiable->getLanguage();
+        $locale = $notifiable->getLocale();

-        return $this->newMailMessage($language)
-            ->subject(trans('notifications.new_page_subject', ['pageName' => $page->getShortName()], $language))
-            ->line(trans('notifications.new_page_intro', ['appName' => setting('app-name')], $language))
-            ->line(new ListMessageLine([
-                trans('notifications.detail_page_name', [], $language) => $page->name,
-                trans('notifications.detail_created_by', [], $language) => $this->user->name,
-            ]))
-            ->action(trans('notifications.action_view_page', [], $language), $page->getUrl())
-            ->line($this->buildReasonFooterLine($language));
+        $listLines = array_filter([
+            $locale->trans('notifications.detail_page_name') => new EntityLinkMessageLine($page),
+            $locale->trans('notifications.detail_page_path') => $this->buildPagePathLine($page, $notifiable),
+            $locale->trans('notifications.detail_created_by') => $this->user->name,
+        ]);
+
+        return $this->newMailMessage($locale)
+            ->subject($locale->trans('notifications.new_page_subject', ['pageName' => $page->getShortName()]))
+            ->line($locale->trans('notifications.new_page_intro', ['appName' => setting('app-name')]))
+            ->line(new ListMessageLine($listLines))
+            ->action($locale->trans('notifications.action_view_page'), $page->getUrl())
+            ->line($this->buildReasonFooterLine($locale));
    }
 }
--- a/app/Activity/Notifications/Messages/PageUpdateNotification.php
+++ b/app/Activity/Notifications/Messages/PageUpdateNotification.php
@ -2,6 +2,7 @@

 namespace BookStack\Activity\Notifications\Messages;

+use BookStack\Activity\Notifications\MessageParts\EntityLinkMessageLine;
 use BookStack\Activity\Notifications\MessageParts\ListMessageLine;
 use BookStack\Entities\Models\Page;
 use BookStack\Users\Models\User;
@ -14,17 +15,20 @@ class PageUpdateNotification extends BaseActivityNotification
        /** @var Page $page */
        $page = $this->detail;

-        $language = $notifiable->getLanguage();
+        $locale = $notifiable->getLocale();

-        return $this->newMailMessage($language)
-            ->subject(trans('notifications.updated_page_subject', ['pageName' => $page->getShortName()], $language))
-            ->line(trans('notifications.updated_page_intro', ['appName' => setting('app-name')], $language))
-            ->line(new ListMessageLine([
-                trans('notifications.detail_page_name', [], $language) => $page->name,
-                trans('notifications.detail_updated_by', [], $language) => $this->user->name,
-            ]))
-            ->line(trans('notifications.updated_page_debounce', [], $language))
-            ->action(trans('notifications.action_view_page', [], $language), $page->getUrl())
-            ->line($this->buildReasonFooterLine($language));
+        $listLines = array_filter([
+            $locale->trans('notifications.detail_page_name') => new EntityLinkMessageLine($page),
+            $locale->trans('notifications.detail_page_path') => $this->buildPagePathLine($page, $notifiable),
+            $locale->trans('notifications.detail_updated_by') => $this->user->name,
+        ]);
+
+        return $this->newMailMessage($locale)
+            ->subject($locale->trans('notifications.updated_page_subject', ['pageName' => $page->getShortName()]))
+            ->line($locale->trans('notifications.updated_page_intro', ['appName' => setting('app-name')]))
+            ->line(new ListMessageLine($listLines))
+            ->line($locale->trans('notifications.updated_page_debounce'))
+            ->action($locale->trans('notifications.action_view_page'), $page->getUrl())
+            ->line($this->buildReasonFooterLine($locale));
    }
 }
--- a/app/Activity/TagRepo.php
+++ b/app/Activity/TagRepo.php
@ -38,7 +38,8 @@ class TagRepo
                DB::raw('SUM(IF(entity_type = \'book\', 1, 0)) as book_count'),
                DB::raw('SUM(IF(entity_type = \'bookshelf\', 1, 0)) as shelf_count'),
            ])
-            ->orderBy($sort, $listOptions->getOrder());
+            ->orderBy($sort, $listOptions->getOrder())
+            ->whereHas('entity');

        if ($nameFilter) {
            $query->where('name', '=', $nameFilter);
--- a/app/Activity/Tools/ActivityLogger.php
+++ b/app/Activity/Tools/ActivityLogger.php
@ -32,8 +32,8 @@ class ActivityLogger
        $activity->detail = $detailToStore;

        if ($detail instanceof Entity) {
-            $activity->entity_id = $detail->id;
-            $activity->entity_type = $detail->getMorphClass();
+            $activity->loggable_id = $detail->id;
+            $activity->loggable_type = $detail->getMorphClass();
        }

        $activity->save();
@ -64,9 +64,9 @@ class ActivityLogger
    public function removeEntity(Entity $entity): void
    {
        $entity->activity()->update([
-            'detail'       => $entity->name,
-            'entity_id'    => null,
-            'entity_type'  => null,
+            'detail'         => $entity->name,
+            'loggable_id'    => null,
+            'loggable_type'  => null,
        ]);
    }

--- a/app/Activity/Tools/CommentTree.php
+++ b/app/Activity/Tools/CommentTree.php
@ -41,6 +41,17 @@ class CommentTree
        return $this->tree;
    }

+    public function canUpdateAny(): bool
+    {
+        foreach ($this->comments as $comment) {
+            if (userCan('comment-update', $comment)) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
    /**
     * @param Comment[] $comments
     */
--- a/app/Activity/Tools/UserEntityWatchOptions.php
+++ b/app/Activity/Tools/UserEntityWatchOptions.php
@ -22,7 +22,7 @@ class UserEntityWatchOptions

    public function canWatch(): bool
    {
-        return $this->user->can('receive-notifications') && !$this->user->isDefault();
+        return $this->user->can('receive-notifications') && !$this->user->isGuest();
    }

    public function getWatchLevel(): string
--- a/app/Api/ApiDocsController.php
+++ b/app/Api/ApiDocsController.php
@ -31,6 +31,8 @@ class ApiDocsController extends ApiController

    /**
     * Redirect to the API docs page.
+     *  Required as a controller method, instead of the Route::redirect helper,
+     *  to ensure the URL is generated correctly.
     */
    public function redirect()
    {
--- a/app/Api/ApiDocsGenerator.php
+++ b/app/Api/ApiDocsGenerator.php
@ -7,7 +7,6 @@ use Exception;
 use Illuminate\Contracts\Container\BindingResolutionException;
 use Illuminate\Support\Collection;
 use Illuminate\Support\Facades\Cache;
-use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Route;
 use Illuminate\Support\Str;
 use Illuminate\Validation\Rules\Password;
--- a/app/Api/ApiEntityListFormatter.php
+++ b/app/Api/ApiEntityListFormatter.php
@ -2,7 +2,9 @@

 namespace BookStack\Api;

+use BookStack\Entities\Models\BookChild;
 use BookStack\Entities\Models\Entity;
+use BookStack\Entities\Models\Page;

 class ApiEntityListFormatter
 {
@ -20,8 +22,16 @@ class ApiEntityListFormatter
     * @var array<string|int, string|callable>
     */
    protected array $fields = [
-        'id', 'name', 'slug', 'book_id', 'chapter_id', 'draft',
-        'template', 'priority', 'created_at', 'updated_at',
+        'id',
+        'name',
+        'slug',
+        'book_id',
+        'chapter_id',
+        'draft',
+        'template',
+        'priority',
+        'created_at',
+        'updated_at',
    ];

    public function __construct(array $list)
@ -62,6 +72,28 @@ class ApiEntityListFormatter
        return $this;
    }

+    /**
+     * Include parent book/chapter info in the formatted data.
+     */
+    public function withParents(): self
+    {
+        $this->withField('book', function (Entity $entity) {
+            if ($entity instanceof BookChild && $entity->book) {
+                return $entity->book->only(['id', 'name', 'slug']);
+            }
+            return null;
+        });
+
+        $this->withField('chapter', function (Entity $entity) {
+            if ($entity instanceof Page && $entity->chapter) {
+                return $entity->chapter->only(['id', 'name', 'slug']);
+            }
+            return null;
+        });
+
+        return $this;
+    }
+
    /**
     * Format the data and return an array of formatted content.
     * @return array[]
--- a/app/Api/ApiToken.php
+++ b/app/Api/ApiToken.php
@ -52,4 +52,12 @@ class ApiToken extends Model implements Loggable
    {
        return "({$this->id}) {$this->name}; User: {$this->user->logDescriptor()}";
    }
+
+    /**
+     * Get the URL for managing this token.
+     */
+    public function getUrl(string $path = ''): string
+    {
+        return url("/api-tokens/{$this->user_id}/{$this->id}/" . trim($path, '/'));
+    }
 }
--- a/app/Api/UserApiTokenController.php
+++ b/app/Api/UserApiTokenController.php
@ -14,16 +14,19 @@ class UserApiTokenController extends Controller
    /**
     * Show the form to create a new API token.
     */
-    public function create(int $userId)
+    public function create(Request $request, int $userId)
    {
-        // Ensure user is has access-api permission and is the current user or has permission to manage the current user.
        $this->checkPermission('access-api');
        $this->checkPermissionOrCurrentUser('users-manage', $userId);
+        $this->updateContext($request);

        $user = User::query()->findOrFail($userId);

+        $this->setPageTitle(trans('settings.user_api_token_create'));
+
        return view('users.api-tokens.create', [
            'user' => $user,
+            'back' => $this->getRedirectPath($user),
        ]);
    }

@ -60,22 +63,27 @@ class UserApiTokenController extends Controller
        session()->flash('api-token-secret:' . $token->id, $secret);
        $this->logActivity(ActivityType::API_TOKEN_CREATE, $token);

-        return redirect($user->getEditUrl('/api-tokens/' . $token->id));
+        return redirect($token->getUrl());
    }

    /**
     * Show the details for a user API token, with access to edit.
     */
-    public function edit(int $userId, int $tokenId)
+    public function edit(Request $request, int $userId, int $tokenId)
    {
+        $this->updateContext($request);
+
        [$user, $token] = $this->checkPermissionAndFetchUserToken($userId, $tokenId);
        $secret = session()->pull('api-token-secret:' . $token->id, null);

+        $this->setPageTitle(trans('settings.user_api_token'));
+
        return view('users.api-tokens.edit', [
            'user'   => $user,
            'token'  => $token,
            'model'  => $token,
            'secret' => $secret,
+            'back' => $this->getRedirectPath($user),
        ]);
    }

@ -97,7 +105,7 @@ class UserApiTokenController extends Controller

        $this->logActivity(ActivityType::API_TOKEN_UPDATE, $token);

-        return redirect($user->getEditUrl('/api-tokens/' . $token->id));
+        return redirect($token->getUrl());
    }

    /**
@ -107,6 +115,8 @@ class UserApiTokenController extends Controller
    {
        [$user, $token] = $this->checkPermissionAndFetchUserToken($userId, $tokenId);

+        $this->setPageTitle(trans('settings.user_api_token_delete'));
+
        return view('users.api-tokens.delete', [
            'user'  => $user,
            'token' => $token,
@ -123,7 +133,7 @@ class UserApiTokenController extends Controller

        $this->logActivity(ActivityType::API_TOKEN_DELETE, $token);

-        return redirect($user->getEditUrl('#api_tokens'));
+        return redirect($this->getRedirectPath($user));
    }

    /**
@ -142,4 +152,30 @@ class UserApiTokenController extends Controller

        return [$user, $token];
    }
+
+    /**
+     * Update the context for where the user is coming from to manage API tokens.
+     * (Track of location for correct return redirects)
+     */
+    protected function updateContext(Request $request): void
+    {
+        $context = $request->query('context');
+        if ($context) {
+            session()->put('api-token-context', $context);
+        }
+    }
+
+    /**
+     * Get the redirect path for the current api token editing session.
+     * Attempts to recall the context of where the user is editing from.
+     */
+    protected function getRedirectPath(User $relatedUser): string
+    {
+        $context = session()->get('api-token-context');
+        if ($context === 'settings' || user()->id !== $relatedUser->id) {
+            return $relatedUser->getEditUrl('#api_tokens');
+        }
+
+        return url('/my-account/auth#api_tokens');
+    }
 }
--- a/app/App/HomeController.php
+++ b/app/App/HomeController.php
@ -3,32 +3,36 @@
 namespace BookStack\App;

 use BookStack\Activity\ActivityQueries;
-use BookStack\Entities\Models\Book;
 use BookStack\Entities\Models\Page;
-use BookStack\Entities\Queries\RecentlyViewed;
-use BookStack\Entities\Queries\TopFavourites;
-use BookStack\Entities\Repos\BookRepo;
-use BookStack\Entities\Repos\BookshelfRepo;
+use BookStack\Entities\Queries\EntityQueries;
+use BookStack\Entities\Queries\QueryRecentlyViewed;
+use BookStack\Entities\Queries\QueryTopFavourites;
 use BookStack\Entities\Tools\PageContent;
 use BookStack\Http\Controller;
-use BookStack\Uploads\FaviconHandler;
 use BookStack\Util\SimpleListOptions;
 use Illuminate\Http\Request;

 class HomeController extends Controller
 {
+    public function __construct(
+        protected EntityQueries $queries,
+    ) {
+    }
+
    /**
     * Display the homepage.
     */
-    public function index(Request $request, ActivityQueries $activities)
-    {
+    public function index(
+        Request $request,
+        ActivityQueries $activities,
+        QueryRecentlyViewed $recentlyViewed,
+        QueryTopFavourites $topFavourites,
+    ) {
        $activity = $activities->latest(10);
        $draftPages = [];

        if ($this->isSignedIn()) {
-            $draftPages = Page::visible()
-                ->where('draft', '=', true)
-                ->where('created_by', '=', user()->id)
+            $draftPages = $this->queries->pages->currentUserDraftsForList()
                ->orderBy('updated_at', 'desc')
                ->with('book')
                ->take(6)
@ -37,14 +41,13 @@ class HomeController extends Controller

        $recentFactor = count($draftPages) > 0 ? 0.5 : 1;
        $recents = $this->isSignedIn() ?
-            (new RecentlyViewed())->run(12 * $recentFactor, 1)
-            : Book::visible()->orderBy('created_at', 'desc')->take(12 * $recentFactor)->get();
-        $favourites = (new TopFavourites())->run(6);
-        $recentlyUpdatedPages = Page::visible()->with('book')
+            $recentlyViewed->run(12 * $recentFactor, 1)
+            : $this->queries->books->visibleForList()->orderBy('created_at', 'desc')->take(12 * $recentFactor)->get();
+        $favourites = $topFavourites->run(6);
+        $recentlyUpdatedPages = $this->queries->pages->visibleForList()
            ->where('draft', false)
            ->orderBy('updated_at', 'desc')
            ->take($favourites->count() > 0 ? 5 : 10)
-            ->select(Page::$listAttributes)
            ->get();

        $homepageOptions = ['default', 'books', 'bookshelves', 'page'];
@ -78,14 +81,18 @@ class HomeController extends Controller
        }

        if ($homepageOption === 'bookshelves') {
-            $shelves = app(BookshelfRepo::class)->getAllPaginated(18, $commonData['listOptions']->getSort(), $commonData['listOptions']->getOrder());
+            $shelves = $this->queries->shelves->visibleForListWithCover()
+                ->orderBy($commonData['listOptions']->getSort(), $commonData['listOptions']->getOrder())
+                ->paginate(18);
            $data = array_merge($commonData, ['shelves' => $shelves]);

            return view('home.shelves', $data);
        }

        if ($homepageOption === 'books') {
-            $books = app(BookRepo::class)->getAllPaginated(18, $commonData['listOptions']->getSort(), $commonData['listOptions']->getOrder());
+            $books = $this->queries->books->visibleForListWithCover()
+                ->orderBy($commonData['listOptions']->getSort(), $commonData['listOptions']->getOrder())
+                ->paginate(18);
            $data = array_merge($commonData, ['books' => $books]);

            return view('home.books', $data);
@ -95,7 +102,7 @@ class HomeController extends Controller
            $homepageSetting = setting('app-homepage', '0:');
            $id = intval(explode(':', $homepageSetting)[0]);
            /** @var Page $customHomepage */
-            $customHomepage = Page::query()->where('draft', '=', false)->findOrFail($id);
+            $customHomepage = $this->queries->pages->start()->where('draft', '=', false)->findOrFail($id);
            $pageContent = new PageContent($customHomepage);
            $customHomepage->html = $pageContent->render(false);

@ -104,40 +111,4 @@ class HomeController extends Controller

        return view('home.default', $commonData);
    }
-
-    /**
-     * Show the view for /robots.txt.
-     */
-    public function robots()
-    {
-        $sitePublic = setting('app-public', false);
-        $allowRobots = config('app.allow_robots');
-
-        if ($allowRobots === null) {
-            $allowRobots = $sitePublic;
-        }
-
-        return response()
-            ->view('misc.robots', ['allowRobots' => $allowRobots])
-            ->header('Content-Type', 'text/plain');
-    }
-
-    /**
-     * Show the route for 404 responses.
-     */
-    public function notFound()
-    {
-        return response()->view('errors.404', [], 404);
-    }
-
-    /**
-     * Serve the application favicon.
-     * Ensures a 'favicon.ico' file exists at the web root location (if writable) to be served
-     * directly by the webserver in the future.
-     */
-    public function favicon(FaviconHandler $favicons)
-    {
-        $exists = $favicons->restoreOriginalIfNotExists();
-        return response()->file($exists ? $favicons->getPath() : $favicons->getOriginalPath());
-    }
 }
--- a/app/Notifications/MailNotification.php
+++ b/app/Notifications/MailNotification.php
@ -1,7 +1,8 @@
 <?php

-namespace BookStack\Notifications;
+namespace BookStack\App;

+use BookStack\Translation\LocaleDefinition;
 use BookStack\Users\Models\User;
 use Illuminate\Bus\Queueable;
 use Illuminate\Contracts\Queue\ShouldQueue;
@ -32,9 +33,9 @@ abstract class MailNotification extends Notification implements ShouldQueue
    /**
     * Create a new mail message.
     */
-    protected function newMailMessage(string $language = ''): MailMessage
+    protected function newMailMessage(?LocaleDefinition $locale = null): MailMessage
    {
-        $data = ['language' => $language ?: null];
+        $data = ['locale' => $locale ?? user()->getLocale()];

        return (new MailMessage())->view([
            'html' => 'vendor.notifications.email',
--- a/app/App/MetaController.php
+++ b/app/App/MetaController.php
@ -0,0 +1,77 @@
+<?php
+
+namespace BookStack\App;
+
+use BookStack\Http\Controller;
+use BookStack\Uploads\FaviconHandler;
+
+class MetaController extends Controller
+{
+    /**
+     * Show the view for /robots.txt.
+     */
+    public function robots()
+    {
+        $sitePublic = setting('app-public', false);
+        $allowRobots = config('app.allow_robots');
+
+        if ($allowRobots === null) {
+            $allowRobots = $sitePublic;
+        }
+
+        return response()
+            ->view('misc.robots', ['allowRobots' => $allowRobots])
+            ->header('Content-Type', 'text/plain');
+    }
+
+    /**
+     * Show the route for 404 responses.
+     */
+    public function notFound()
+    {
+        return response()->view('errors.404', [], 404);
+    }
+
+    /**
+     * Serve the application favicon.
+     * Ensures a 'favicon.ico' file exists at the web root location (if writable) to be served
+     * directly by the webserver in the future.
+     */
+    public function favicon(FaviconHandler $favicons)
+    {
+        $exists = $favicons->restoreOriginalIfNotExists();
+        return response()->file($exists ? $favicons->getPath() : $favicons->getOriginalPath());
+    }
+
+    /**
+     * Serve a PWA application manifest.
+     */
+    public function pwaManifest(PwaManifestBuilder $manifestBuilder)
+    {
+        return response()->json($manifestBuilder->build());
+    }
+
+    /**
+     * Show license information for the application.
+     */
+    public function licenses()
+    {
+        $this->setPageTitle(trans('settings.licenses'));
+
+        return view('help.licenses', [
+            'license' => file_get_contents(base_path('LICENSE')),
+            'phpLibData' => file_get_contents(base_path('dev/licensing/php-library-licenses.txt')),
+            'jsLibData' => file_get_contents(base_path('dev/licensing/js-library-licenses.txt')),
+        ]);
+    }
+
+    /**
+     * Show the view for /opensearch.xml.
+     */
+    public function opensearch()
+    {
+        return response()
+            ->view('misc.opensearch')
+            ->header('Content-Type', 'application/opensearchdescription+xml');
+    }
+}
--- a/app/App/Providers/AppServiceProvider.php
+++ b/app/App/Providers/AppServiceProvider.php
@ -2,23 +2,22 @@

 namespace BookStack\App\Providers;

-use BookStack\Access\SocialAuthService;
+use BookStack\Access\SocialDriverManager;
 use BookStack\Activity\Tools\ActivityLogger;
 use BookStack\Entities\Models\Book;
 use BookStack\Entities\Models\Bookshelf;
 use BookStack\Entities\Models\Chapter;
 use BookStack\Entities\Models\Page;
 use BookStack\Exceptions\BookStackExceptionHandlerPage;
+use BookStack\Http\HttpRequestService;
 use BookStack\Permissions\PermissionApplicator;
 use BookStack\Settings\SettingService;
 use BookStack\Util\CspService;
-use GuzzleHttp\Client;
 use Illuminate\Contracts\Foundation\ExceptionRenderer;
 use Illuminate\Database\Eloquent\Relations\Relation;
 use Illuminate\Support\Facades\Schema;
 use Illuminate\Support\Facades\URL;
 use Illuminate\Support\ServiceProvider;
-use Psr\Http\Client\ClientInterface as HttpClientInterface;

 class AppServiceProvider extends ServiceProvider
 {
@ -26,7 +25,7 @@ class AppServiceProvider extends ServiceProvider
     * Custom container bindings to register.
     * @var string[]
     */
-    public $bindings = [
+    public array $bindings = [
        ExceptionRenderer::class => BookStackExceptionHandlerPage::class,
    ];

@ -34,24 +33,33 @@ class AppServiceProvider extends ServiceProvider
     * Custom singleton bindings to register.
     * @var string[]
     */
-    public $singletons = [
+    public array $singletons = [
        'activity' => ActivityLogger::class,
        SettingService::class => SettingService::class,
-        SocialAuthService::class => SocialAuthService::class,
+        SocialDriverManager::class => SocialDriverManager::class,
        CspService::class => CspService::class,
+        HttpRequestService::class => HttpRequestService::class,
    ];

    /**
-     * Bootstrap any application services.
-     *
-     * @return void
+     * Register any application services.
     */
-    public function boot()
+    public function register(): void
+    {
+        $this->app->singleton(PermissionApplicator::class, function ($app) {
+            return new PermissionApplicator(null);
+        });
+    }
+
+    /**
+     * Bootstrap any application services.
+     */
+    public function boot(): void
    {
        // Set root URL
        $appUrl = config('app.url');
        if ($appUrl) {
-            $isHttps = (strpos($appUrl, 'https://') === 0);
+            $isHttps = str_starts_with($appUrl, 'https://');
            URL::forceRootUrl($appUrl);
            URL::forceScheme($isHttps ? 'https' : 'http');
        }
@ -67,22 +75,4 @@ class AppServiceProvider extends ServiceProvider
            'page'      => Page::class,
        ]);
    }
-
-    /**
-     * Register any application services.
-     *
-     * @return void
-     */
-    public function register()
-    {
-        $this->app->bind(HttpClientInterface::class, function ($app) {
-            return new Client([
-                'timeout' => 3,
-            ]);
-        });
-
-        $this->app->singleton(PermissionApplicator::class, function ($app) {
-            return new PermissionApplicator(null);
-        });
-    }
 }
--- a/app/App/Providers/AuthServiceProvider.php
+++ b/app/App/Providers/AuthServiceProvider.php
@ -9,6 +9,7 @@ use BookStack\Access\LdapService;
 use BookStack\Access\LoginService;
 use BookStack\Access\RegistrationService;
 use BookStack\Api\ApiTokenGuard;
+use BookStack\Users\Models\User;
 use Illuminate\Support\Facades\Auth;
 use Illuminate\Support\ServiceProvider;
 use Illuminate\Validation\Rules\Password;
@ -17,10 +18,8 @@ class AuthServiceProvider extends ServiceProvider
 {
    /**
     * Bootstrap the application services.
-     *
-     * @return void
     */
-    public function boot()
+    public function boot(): void
    {
        // Password Configuration
        // Changes here must be reflected in ApiDocsGenerate@getValidationAsString.
@ -57,13 +56,17 @@ class AuthServiceProvider extends ServiceProvider

    /**
     * Register the application services.
-     *
-     * @return void
     */
-    public function register()
+    public function register(): void
    {
        Auth::provider('external-users', function ($app, array $config) {
            return new ExternalBaseUserProvider($config['model']);
        });
+
+        // Bind and provide the default system user as a singleton to the app instance when needed.
+        // This effectively "caches" fetching the user at an app-instance level.
+        $this->app->singleton('users.default', function () {
+            return User::query()->where('system_name', '=', 'public')->first();
+        });
    }
 }
--- a/app/App/Providers/EventServiceProvider.php
+++ b/app/App/Providers/EventServiceProvider.php
@ -3,7 +3,12 @@
 namespace BookStack\App\Providers;

 use Illuminate\Foundation\Support\Providers\EventServiceProvider as ServiceProvider;
+use SocialiteProviders\Azure\AzureExtendSocialite;
+use SocialiteProviders\Discord\DiscordExtendSocialite;
+use SocialiteProviders\GitLab\GitLabExtendSocialite;
 use SocialiteProviders\Manager\SocialiteWasCalled;
+use SocialiteProviders\Okta\OktaExtendSocialite;
+use SocialiteProviders\Twitch\TwitchExtendSocialite;

 class EventServiceProvider extends ServiceProvider
 {
@ -14,32 +19,35 @@ class EventServiceProvider extends ServiceProvider
     */
    protected $listen = [
        SocialiteWasCalled::class => [
-            'SocialiteProviders\Slack\SlackExtendSocialite@handle',
-            'SocialiteProviders\Azure\AzureExtendSocialite@handle',
-            'SocialiteProviders\Okta\OktaExtendSocialite@handle',
-            'SocialiteProviders\GitLab\GitLabExtendSocialite@handle',
-            'SocialiteProviders\Twitch\TwitchExtendSocialite@handle',
-            'SocialiteProviders\Discord\DiscordExtendSocialite@handle',
+            AzureExtendSocialite::class . '@handle',
+            OktaExtendSocialite::class . '@handle',
+            GitLabExtendSocialite::class . '@handle',
+            TwitchExtendSocialite::class . '@handle',
+            DiscordExtendSocialite::class . '@handle',
        ],
    ];

    /**
     * Register any events for your application.
-     *
-     * @return void
     */
-    public function boot()
+    public function boot(): void
    {
        //
    }

    /**
     * Determine if events and listeners should be automatically discovered.
-     *
-     * @return bool
     */
-    public function shouldDiscoverEvents()
+    public function shouldDiscoverEvents(): bool
    {
        return false;
    }
+
+    /**
+     * Overrides the registration of Laravel's default email verification system
+     */
+    protected function configureEmailVerification(): void
+    {
+        //
+    }
 }
--- a/app/App/Providers/RouteServiceProvider.php
+++ b/app/App/Providers/RouteServiceProvider.php
@ -2,9 +2,12 @@

 namespace BookStack\App\Providers;

+use BookStack\Facades\Theme;
+use BookStack\Theming\ThemeEvents;
 use Illuminate\Cache\RateLimiting\Limit;
 use Illuminate\Foundation\Support\Providers\RouteServiceProvider as ServiceProvider;
 use Illuminate\Http\Request;
+use Illuminate\Routing\Router;
 use Illuminate\Support\Facades\RateLimiter;
 use Illuminate\Support\Facades\Route;

@ -21,10 +24,8 @@ class RouteServiceProvider extends ServiceProvider

    /**
     * Define your route model bindings, pattern filters, etc.
-     *
-     * @return void
     */
-    public function boot()
+    public function boot(): void
    {
        $this->configureRateLimiting();

@ -38,16 +39,21 @@ class RouteServiceProvider extends ServiceProvider
     * Define the "web" routes for the application.
     *
     * These routes all receive session state, CSRF protection, etc.
-     *
-     * @return void
     */
-    protected function mapWebRoutes()
+    protected function mapWebRoutes(): void
    {
        Route::group([
            'middleware' => 'web',
            'namespace'  => $this->namespace,
-        ], function ($router) {
+        ], function (Router $router) {
            require base_path('routes/web.php');
+            Theme::dispatch(ThemeEvents::ROUTES_REGISTER_WEB, $router);
+        });
+
+        Route::group([
+            'middleware' => ['web', 'auth'],
+        ], function (Router $router) {
+            Theme::dispatch(ThemeEvents::ROUTES_REGISTER_WEB_AUTH, $router);
        });
    }

@ -55,10 +61,8 @@ class RouteServiceProvider extends ServiceProvider
     * Define the "api" routes for the application.
     *
     * These routes are typically stateless.
-     *
-     * @return void
     */
-    protected function mapApiRoutes()
+    protected function mapApiRoutes(): void
    {
        Route::group([
            'middleware' => 'api',
@ -71,13 +75,22 @@ class RouteServiceProvider extends ServiceProvider

    /**
     * Configure the rate limiters for the application.
-     *
-     * @return void
     */
-    protected function configureRateLimiting()
+    protected function configureRateLimiting(): void
    {
        RateLimiter::for('api', function (Request $request) {
            return Limit::perMinute(60)->by($request->user()?->id ?: $request->ip());
        });
+
+        RateLimiter::for('public', function (Request $request) {
+            return Limit::perMinute(10)->by($request->ip());
+        });
+
+        RateLimiter::for('exports', function (Request $request) {
+            $user = user();
+            $attempts = $user->isGuest() ? 4 : 10;
+            $key = $user->isGuest() ? $request->ip() : $user->id;
+            return Limit::perMinute($attempts)->by($key);
+        });
    }
 }
--- a/app/App/Providers/ThemeServiceProvider.php
+++ b/app/App/Providers/ThemeServiceProvider.php
@ -10,10 +10,8 @@ class ThemeServiceProvider extends ServiceProvider
 {
    /**
     * Register services.
-     *
-     * @return void
     */
-    public function register()
+    public function register(): void
    {
        // Register the ThemeService as a singleton
        $this->app->singleton(ThemeService::class, fn ($app) => new ThemeService());
@ -21,10 +19,8 @@ class ThemeServiceProvider extends ServiceProvider

    /**
     * Bootstrap services.
-     *
-     * @return void
     */
-    public function boot()
+    public function boot(): void
    {
        // Boot up the theme system
        $themeService = $this->app->make(ThemeService::class);
--- a/app/App/Providers/TranslationServiceProvider.php
+++ b/app/App/Providers/TranslationServiceProvider.php
@ -11,10 +11,8 @@ class TranslationServiceProvider extends BaseProvider
 {
    /**
     * Register the service provider.
-     *
-     * @return void
     */
-    public function register()
+    public function register(): void
    {
        $this->registerLoader();

@ -41,10 +39,8 @@ class TranslationServiceProvider extends BaseProvider
    /**
     * Register the translation line loader.
     * Overrides the default register action from Laravel so a custom loader can be used.
-     *
-     * @return void
     */
-    protected function registerLoader()
+    protected function registerLoader(): void
    {
        $this->app->singleton('translation.loader', function ($app) {
            return new FileLoader($app['files'], $app['path.lang']);
--- a/app/App/Providers/ViewTweaksServiceProvider.php
+++ b/app/App/Providers/ViewTweaksServiceProvider.php
@ -12,10 +12,8 @@ class ViewTweaksServiceProvider extends ServiceProvider
 {
    /**
     * Bootstrap services.
-     *
-     * @return void
     */
-    public function boot()
+    public function boot(): void
    {
        // Set paginator to use bootstrap-style pagination
        Paginator::useBootstrap();
@ -25,7 +23,7 @@ class ViewTweaksServiceProvider extends ServiceProvider

        // Custom blade view directives
        Blade::directive('icon', function ($expression) {
-            return "<?php echo icon($expression); ?>";
+            return "<?php echo (new \BookStack\Util\SvgIcon($expression))->toHtml(); ?>";
        });
    }
 }
--- a/app/App/PwaManifestBuilder.php
+++ b/app/App/PwaManifestBuilder.php
@ -0,0 +1,64 @@
+<?php
+
+namespace BookStack\App;
+
+class PwaManifestBuilder
+{
+    public function build(): array
+    {
+        // Note, while we attempt to use the user's preference here, the request to the manifest
+        // does not start a session, so we won't have current user context.
+        // This was attempted but removed since manifest calls could affect user session
+        // history tracking and back redirection.
+        // Context: https://github.com/BookStackApp/BookStack/issues/4649
+        $darkMode = (bool) setting()->getForCurrentUser('dark-mode-enabled');
+        $appName = setting('app-name');
+
+        return [
+            "name" => $appName,
+            "short_name" => $appName,
+            "start_url" => "./",
+            "scope" => "/",
+            "display" => "standalone",
+            "background_color" => $darkMode ? '#111111' : '#F2F2F2',
+            "description" => $appName,
+            "theme_color" => ($darkMode ? setting('app-color-dark') : setting('app-color')),
+            "launch_handler" => [
+                "client_mode" => "focus-existing"
+            ],
+            "orientation" => "any",
+            "icons" => [
+                [
+                    "src" => setting('app-icon-32') ?: url('/icon-32.png'),
+                    "sizes" => "32x32",
+                    "type" => "image/png"
+                ],
+                [
+                    "src" => setting('app-icon-64') ?: url('/icon-64.png'),
+                    "sizes" => "64x64",
+                    "type" => "image/png"
+                ],
+                [
+                    "src" => setting('app-icon-128') ?: url('/icon-128.png'),
+                    "sizes" => "128x128",
+                    "type" => "image/png"
+                ],
+                [
+                    "src" => setting('app-icon-180') ?: url('/icon-180.png'),
+                    "sizes" => "180x180",
+                    "type" => "image/png"
+                ],
+                [
+                    "src" => setting('app-icon') ?: url('/icon.png'),
+                    "sizes" => "256x256",
+                    "type" => "image/png"
+                ],
+                [
+                    "src" => url('favicon.ico'),
+                    "sizes" => "48x48",
+                    "type" => "image/vnd.microsoft.icon"
+                ],
+            ],
+        ];
+    }
+}
--- a/app/App/helpers.php
+++ b/app/App/helpers.php
@ -1,6 +1,7 @@
 <?php

 use BookStack\App\Model;
+use BookStack\Facades\Theme;
 use BookStack\Permissions\PermissionApplicator;
 use BookStack\Settings\SettingService;
 use BookStack\Users\Models\User;
@ -35,37 +36,21 @@ function versioned_asset(string $file = ''): string
 */
 function user(): User
 {
-    return auth()->user() ?: User::getDefault();
-}
-
-/**
- * Check if current user is a signed in user.
- */
-function signedInUser(): bool
-{
-    return auth()->user() && !auth()->user()->isDefault();
-}
-
-/**
- * Check if the current user has general access.
- */
-function hasAppAccess(): bool
-{
-    return !auth()->guest() || setting('app-public');
+    return auth()->user() ?: User::getGuest();
 }

 /**
 * Check if the current user has a permission. If an ownable element
 * is passed in the jointPermissions are checked against that particular item.
 */
-function userCan(string $permission, Model $ownable = null): bool
+function userCan(string $permission, ?Model $ownable = null): bool
 {
-    if ($ownable === null) {
-        return user() && user()->can($permission);
+    if (is_null($ownable)) {
+        return user()->can($permission);
    }

    // Check permission on ownable item
-    $permissions = app(PermissionApplicator::class);
+    $permissions = app()->make(PermissionApplicator::class);

    return $permissions->checkOwnableUserAccess($ownable, $permission);
 }
@ -76,7 +61,7 @@ function userCan(string $permission, Model $ownable = null): bool
 */
 function userCanOnAny(string $action, string $entityClass = ''): bool
 {
-    $permissions = app(PermissionApplicator::class);
+    $permissions = app()->make(PermissionApplicator::class);

    return $permissions->checkUserHasEntityPermissionOnAny($action, $entityClass);
 }
@ -86,9 +71,9 @@ function userCanOnAny(string $action, string $entityClass = ''): bool
 *
 * @return mixed|SettingService
 */
-function setting(string $key = null, $default = null)
+function setting(?string $key = null, mixed $default = null): mixed
 {
-    $settingService = resolve(SettingService::class);
+    $settingService = app()->make(SettingService::class);

    if (is_null($key)) {
        return $settingService;
@ -104,76 +89,10 @@ function setting(string $key = null, $default = null)
 */
 function theme_path(string $path = ''): ?string
 {
-    $theme = config('view.theme');
-
+    $theme = Theme::getTheme();
    if (!$theme) {
        return null;
    }

    return base_path('themes/' . $theme . ($path ? DIRECTORY_SEPARATOR . $path : $path));
 }
-
-/**
- * Get fetch an SVG icon as a string.
- * Checks for icons defined within a custom theme before defaulting back
- * to the 'resources/assets/icons' folder.
- *
- * Returns an empty string if icon file not found.
- */
-function icon(string $name, array $attrs = []): string
-{
-    $attrs = array_merge([
-        'class'     => 'svg-icon',
-        'data-icon' => $name,
-        'role'      => 'presentation',
-    ], $attrs);
-    $attrString = ' ';
-    foreach ($attrs as $attrName => $attr) {
-        $attrString .= $attrName . '="' . $attr . '" ';
-    }
-
-    $iconPath = resource_path('icons/' . $name . '.svg');
-    $themeIconPath = theme_path('icons/' . $name . '.svg');
-
-    if ($themeIconPath && file_exists($themeIconPath)) {
-        $iconPath = $themeIconPath;
-    } elseif (!file_exists($iconPath)) {
-        return '';
-    }
-
-    $fileContents = file_get_contents($iconPath);
-
-    return  str_replace('<svg', '<svg' . $attrString, $fileContents);
-}
-
-/**
- * Generate a URL with multiple parameters for sorting purposes.
- * Works out the logic to set the correct sorting direction
- * Discards empty parameters and allows overriding.
- */
-function sortUrl(string $path, array $data, array $overrideData = []): string
-{
-    $queryStringSections = [];
-    $queryData = array_merge($data, $overrideData);
-
-    // Change sorting direction is already sorted on current attribute
-    if (isset($overrideData['sort']) && $overrideData['sort'] === $data['sort']) {
-        $queryData['order'] = ($data['order'] === 'asc') ? 'desc' : 'asc';
-    } elseif (isset($overrideData['sort'])) {
-        $queryData['order'] = 'asc';
-    }
-
-    foreach ($queryData as $name => $value) {
-        $trimmedVal = trim($value);
-        if ($trimmedVal === '') {
-            continue;
-        }
-        $queryStringSections[] = urlencode($name) . '=' . urlencode($trimmedVal);
-    }
-
-    if (count($queryStringSections) === 0) {
-        return url($path);
-    }
-
-    return url($path . '?' . implode('&', $queryStringSections));
-}
--- a/app/Config/app.php
+++ b/app/Config/app.php
@ -9,6 +9,7 @@
 */

 use Illuminate\Support\Facades\Facade;
+use Illuminate\Support\ServiceProvider;

 return [

@ -83,10 +84,10 @@ return [
    'timezone' => env('APP_TIMEZONE', 'UTC'),

    // Default locale to use
+    // A default variant is also stored since Laravel can overwrite
+    // app.locale when dynamically setting the locale in-app.
    'locale' => env('APP_LANG', 'en'),
-
-    // Locales available
-    'locales' => ['en', 'ar', 'bg', 'bs', 'ca', 'cs', 'cy', 'da', 'de', 'de_informal', 'el', 'es', 'es_AR', 'et', 'eu', 'fa', 'fr', 'he', 'hr', 'hu', 'id', 'it', 'ja', 'ka', 'ko', 'lt', 'lv', 'nl', 'nb', 'pt', 'pt_BR', 'sk', 'sl', 'sv', 'pl',  'ro', 'ru', 'tr', 'uk', 'uz', 'vi', 'zh_CN', 'zh_TW'],
+    'default_locale' => env('APP_LANG', 'en'),

    //  Application Fallback Locale
    'fallback_locale' => 'en',
@ -94,9 +95,6 @@ return [
    // Faker Locale
    'faker_locale' => 'en_GB',

-    // Enable right-to-left text control.
-    'rtl' => false,
-
    // Auto-detect the locale for public users
    // For public users their locale can be guessed by headers sent by their
    // browser. This is usually set by users in their browser settings.
@ -116,47 +114,20 @@ return [
    ],

    // Application Service Providers
-    'providers' => [
-
-        // Laravel Framework Service Providers...
-        Illuminate\Auth\AuthServiceProvider::class,
-        Illuminate\Broadcasting\BroadcastServiceProvider::class,
-        Illuminate\Bus\BusServiceProvider::class,
-        Illuminate\Cache\CacheServiceProvider::class,
-        Illuminate\Foundation\Providers\ConsoleSupportServiceProvider::class,
-        Illuminate\Cookie\CookieServiceProvider::class,
-        Illuminate\Database\DatabaseServiceProvider::class,
-        Illuminate\Encryption\EncryptionServiceProvider::class,
-        Illuminate\Filesystem\FilesystemServiceProvider::class,
-        Illuminate\Foundation\Providers\FoundationServiceProvider::class,
-        Illuminate\Hashing\HashServiceProvider::class,
-        Illuminate\Mail\MailServiceProvider::class,
-        Illuminate\Notifications\NotificationServiceProvider::class,
-        Illuminate\Pagination\PaginationServiceProvider::class,
-        Illuminate\Pipeline\PipelineServiceProvider::class,
-        Illuminate\Queue\QueueServiceProvider::class,
-        Illuminate\Redis\RedisServiceProvider::class,
-        Illuminate\Auth\Passwords\PasswordResetServiceProvider::class,
-        Illuminate\Session\SessionServiceProvider::class,
-        Illuminate\Validation\ValidationServiceProvider::class,
-        Illuminate\View\ViewServiceProvider::class,
-
+    'providers' => ServiceProvider::defaultProviders()->merge([
        // Third party service providers
-        Barryvdh\DomPDF\ServiceProvider::class,
-        Barryvdh\Snappy\ServiceProvider::class,
-        Intervention\Image\ImageServiceProvider::class,
        SocialiteProviders\Manager\ServiceProvider::class,

        // BookStack custom service providers
-        \BookStack\App\Providers\ThemeServiceProvider::class,
-        \BookStack\App\Providers\AppServiceProvider::class,
-        \BookStack\App\Providers\AuthServiceProvider::class,
-        \BookStack\App\Providers\EventServiceProvider::class,
-        \BookStack\App\Providers\RouteServiceProvider::class,
-        \BookStack\App\Providers\TranslationServiceProvider::class,
-        \BookStack\App\Providers\ValidationRuleServiceProvider::class,
-        \BookStack\App\Providers\ViewTweaksServiceProvider::class,
-    ],
+        BookStack\App\Providers\ThemeServiceProvider::class,
+        BookStack\App\Providers\AppServiceProvider::class,
+        BookStack\App\Providers\AuthServiceProvider::class,
+        BookStack\App\Providers\EventServiceProvider::class,
+        BookStack\App\Providers\RouteServiceProvider::class,
+        BookStack\App\Providers\TranslationServiceProvider::class,
+        BookStack\App\Providers\ValidationRuleServiceProvider::class,
+        BookStack\App\Providers\ViewTweaksServiceProvider::class,
+    ])->toArray(),

    // Class Aliases
    // This array of class aliases to be registered on application start.
@ -164,9 +135,6 @@ return [
        // Laravel Packages
        'Socialite'    => Laravel\Socialite\Facades\Socialite::class,

-        // Third Party
-        'ImageTool' => Intervention\Image\Facades\Image::class,
-
        // Custom BookStack
        'Activity'    => BookStack\Facades\Activity::class,
        'Theme'       => BookStack\Facades\Theme::class,
--- a/app/Config/broadcasting.php
+++ b/app/Config/broadcasting.php
@ -1,37 +0,0 @@
-<?php
-
-/**
- * Broadcasting configuration options.
- *
- * Changes to these config files are not supported by BookStack and may break upon updates.
- * Configuration should be altered via the `.env` file or environment variables.
- * Do not edit this file unless you're happy to maintain any changes yourself.
- */
-
-return [
-
-    // Default Broadcaster
-    // This option controls the default broadcaster that will be used by the
-    // framework when an event needs to be broadcast. This can be set to
-    // any of the connections defined in the "connections" array below.
-    'default' => 'null',
-
-    // Broadcast Connections
-    // Here you may define all of the broadcast connections that will be used
-    // to broadcast events to other systems or over websockets. Samples of
-    // each available type of connection are provided inside this array.
-    'connections' => [
-
-        // Default options removed since we don't use broadcasting.
-
-        'log' => [
-            'driver' => 'log',
-        ],
-
-        'null' => [
-            'driver' => 'null',
-        ],
-
-    ],
-
-];
--- a/app/Config/cache.php
+++ b/app/Config/cache.php
@ -35,10 +35,6 @@ return [
    // Available caches stores
    'stores' => [

-        'apc' => [
-            'driver' => 'apc',
-        ],
-
        'array' => [
            'driver'    => 'array',
            'serialize' => false,
@ -49,11 +45,13 @@ return [
            'table'           => 'cache',
            'connection'      => null,
            'lock_connection' => null,
+            'lock_table'      => null,
        ],

        'file' => [
            'driver' => 'file',
            'path'   => storage_path('framework/cache'),
+            'lock_path' => storage_path('framework/cache'),
        ],

        'memcached' => [
--- a/app/Config/clockwork.php
+++ b/app/Config/clockwork.php
@ -173,6 +173,8 @@ return [

        // List of URIs that should not be collected
        'except' => [
+            '/uploads/images/.*', // BookStack image requests
+
            '/horizon/.*', // Laravel Horizon requests
            '/telescope/.*', // Laravel Telescope requests
            '/_debugbar/.*', // Laravel DebugBar requests
--- a/app/Config/database.php
+++ b/app/Config/database.php
@ -40,12 +40,16 @@ if (env('REDIS_SERVERS', false)) {

 // MYSQL
 // Split out port from host if set
-$mysql_host = env('DB_HOST', 'localhost');
-$mysql_host_exploded = explode(':', $mysql_host);
-$mysql_port = env('DB_PORT', 3306);
-if (count($mysql_host_exploded) > 1) {
-    $mysql_host = $mysql_host_exploded[0];
-    $mysql_port = intval($mysql_host_exploded[1]);
+$mysqlHost = env('DB_HOST', 'localhost');
+$mysqlHostExploded = explode(':', $mysqlHost);
+$mysqlPort = env('DB_PORT', 3306);
+$mysqlHostIpv6 = str_starts_with($mysqlHost, '[');
+if ($mysqlHostIpv6 && str_contains($mysqlHost, ']:')) {
+    $mysqlHost = implode(':', array_slice($mysqlHostExploded, 0, -1));
+    $mysqlPort = intval(end($mysqlHostExploded));
+} else if (!$mysqlHostIpv6 && count($mysqlHostExploded) > 1) {
+    $mysqlHost = $mysqlHostExploded[0];
+    $mysqlPort = intval($mysqlHostExploded[1]);
 }

 return [
@ -61,12 +65,12 @@ return [
        'mysql' => [
            'driver'         => 'mysql',
            'url'            => env('DATABASE_URL'),
-            'host'           => $mysql_host,
+            'host'           => $mysqlHost,
            'database'       => env('DB_DATABASE', 'forge'),
            'username'       => env('DB_USERNAME', 'forge'),
            'password'       => env('DB_PASSWORD', ''),
            'unix_socket'    => env('DB_SOCKET', ''),
-            'port'           => $mysql_port,
+            'port'           => $mysqlPort,
            'charset'        => 'utf8mb4',
            'collation'      => 'utf8mb4_unicode_ci',
            // Prefixes are only semi-supported and may be unstable
@ -88,7 +92,7 @@ return [
            'database'       => 'bookstack-test',
            'username'       => env('MYSQL_USER', 'bookstack-test'),
            'password'       => env('MYSQL_PASSWORD', 'bookstack-test'),
-            'port'           => $mysql_port,
+            'port'           => $mysqlPort,
            'charset'        => 'utf8mb4',
            'collation'      => 'utf8mb4_unicode_ci',
            'prefix'         => '',
--- a/app/Config/exports.php
+++ b/app/Config/exports.php
@ -1,23 +1,49 @@
 <?php

 /**
- * DOMPDF configuration options.
+ * Export configuration options.
 *
 * Changes to these config files are not supported by BookStack and may break upon updates.
 * Configuration should be altered via the `.env` file or environment variables.
 * Do not edit this file unless you're happy to maintain any changes yourself.
 */

+$snappyPaperSizeMap = [
+    'a4'     => 'A4',
+    'letter' => 'Letter',
+];
+
 $dompdfPaperSizeMap = [
    'a4'     => 'a4',
    'letter' => 'letter',
 ];

+$exportPageSize = env('EXPORT_PAGE_SIZE', 'a4');
+
 return [

-    'show_warnings' => false,   // Throw an Exception on warnings from dompdf
+    // Set a command which can be used to convert a HTML file into a PDF file.
+    // When false this will not be used.
+    // String values represent the command to be called for conversion.
+    // Supports '{input_html_path}' and '{output_pdf_path}' placeholder values.
+    // Example: EXPORT_PDF_COMMAND="/scripts/convert.sh {input_html_path} {output_pdf_path}"
+    'pdf_command' => env('EXPORT_PDF_COMMAND', false),

-    'options'       => [
+    // The amount of time allowed for PDF generation command to run
+    // before the process times out and is stopped.
+    'pdf_command_timeout' => env('EXPORT_PDF_COMMAND_TIMEOUT', 15),
+
+    // 2024-04: Snappy/WKHTMLtoPDF now considered deprecated in regard to BookStack support.
+    'snappy' => [
+        'pdf_binary' => env('WKHTMLTOPDF', false),
+        'options' => [
+            'print-media-type' => true,
+            'outline'   => true,
+            'page-size' => $snappyPaperSizeMap[$exportPageSize] ?? 'A4',
+        ],
+    ],
+
+    'dompdf' => [
        /**
         * The location of the DOMPDF font directory.
         *
@ -88,6 +114,7 @@ return [
         * @var array
         */
        'allowed_protocols' => [
+            "data://" => ["rules" => []],
            'file://'  => ['rules' => []],
            'http://'  => ['rules' => []],
            'https://' => ['rules' => []],
@ -101,7 +128,7 @@ return [
        /**
         * Whether to enable font subsetting or not.
         */
-        'enable_fontsubsetting' => false,
+        'enable_font_subsetting' => false,

        /**
         * The PDF rendering backend to use.
@ -165,7 +192,7 @@ return [
         *
         * @see CPDF_Adapter::PAPER_SIZES for valid sizes ('letter', 'legal', 'A4', etc.)
         */
-        'default_paper_size' => $dompdfPaperSizeMap[env('EXPORT_PAGE_SIZE', 'a4')] ?? 'a4',
+        'default_paper_size' => $dompdfPaperSizeMap[$exportPageSize] ?? 'a4',

        /**
         * The default paper orientation.
@ -268,15 +295,6 @@ return [
         */
        'font_height_ratio' => 1.1,

-        /**
-         * Enable CSS float.
-         *
-         * Allows people to disabled CSS float support
-         *
-         * @var bool
-         */
-        'enable_css_float' => true,
-
        /**
         * Use the HTML5 Lib parser.
         *
@ -286,5 +304,4 @@ return [
         */
        'enable_html5_parser' => true,
    ],
-
 ];
--- a/app/Config/filesystems.php
+++ b/app/Config/filesystems.php
@ -33,12 +33,14 @@ return [
            'driver'     => 'local',
            'root'       => public_path(),
            'visibility' => 'public',
+            'serve'      => false,
            'throw'      => true,
        ],

        'local_secure_attachments' => [
            'driver' => 'local',
            'root'   => storage_path('uploads/files/'),
+            'serve'  => false,
            'throw'  => true,
        ],

@ -46,6 +48,7 @@ return [
            'driver'     => 'local',
            'root'       => storage_path('uploads/images/'),
            'visibility' => 'public',
+            'serve'      => false,
            'throw'      => true,
        ],

@ -58,6 +61,7 @@ return [
            'endpoint'                => env('STORAGE_S3_ENDPOINT', null),
            'use_path_style_endpoint' => env('STORAGE_S3_ENDPOINT', null) !== null,
            'throw'                   => true,
+            'stream_reads'            => false,
        ],

    ],
--- a/app/Config/hashing.php
+++ b/app/Config/hashing.php
@ -21,7 +21,8 @@ return [
    // passwords are hashed using the Bcrypt algorithm. This will allow you
    // to control the amount of time it takes to hash the given password.
    'bcrypt' => [
-        'rounds' => env('BCRYPT_ROUNDS', 10),
+        'rounds' => env('BCRYPT_ROUNDS', 12),
+        'verify' => true,
    ],

    // Argon Options
--- a/app/Config/logging.php
+++ b/app/Config/logging.php
@ -4,6 +4,7 @@ use Monolog\Formatter\LineFormatter;
 use Monolog\Handler\ErrorLogHandler;
 use Monolog\Handler\NullHandler;
 use Monolog\Handler\StreamHandler;
+use Monolog\Processor\PsrLogMessageProcessor;

 /**
 * Logging configuration options.
@ -49,6 +50,7 @@ return [
            'path'   => storage_path('logs/laravel.log'),
            'level'  => 'debug',
            'days'   => 14,
+            'replace_placeholders' => true,
        ],

        'daily' => [
@ -56,6 +58,7 @@ return [
            'path'   => storage_path('logs/laravel.log'),
            'level'  => 'debug',
            'days'   => 7,
+            'replace_placeholders' => true,
        ],

        'stderr' => [
@ -65,16 +68,20 @@ return [
            'with'    => [
                'stream' => 'php://stderr',
            ],
+            'processors' => [PsrLogMessageProcessor::class],
        ],

        'syslog' => [
            'driver' => 'syslog',
            'level'  => 'debug',
+            'facility' => LOG_USER,
+            'replace_placeholders' => true,
        ],

        'errorlog' => [
            'driver' => 'errorlog',
            'level'  => 'debug',
+            'replace_placeholders' => true,
        ],

        // Custom errorlog implementation that logs out a plain,
@ -88,6 +95,7 @@ return [
            'formatter_with' => [
                'format' => '%message%',
            ],
+            'replace_placeholders' => true,
        ],

        'null' => [
--- a/app/Config/mail.php
+++ b/app/Config/mail.php
@ -22,7 +22,7 @@ return [

    // Global "From" address & name
    'from' => [
-        'address' => env('MAIL_FROM', 'mail@bookstackapp.com'),
+        'address' => env('MAIL_FROM', 'bookstack@example.com'),
        'name'    => env('MAIL_FROM_NAME', 'BookStack'),
    ],

@ -38,7 +38,7 @@ return [
            'password' => env('MAIL_PASSWORD'),
            'verify_peer' => env('MAIL_VERIFY_SSL', true),
            'timeout' => null,
-            'local_domain' => env('MAIL_EHLO_DOMAIN'),
+            'local_domain' => null,
            'tls_required' => ($mailEncryption === 'tls' || $mailEncryption === 'ssl'),
        ],

@ -64,12 +64,4 @@ return [
            ],
        ],
    ],
-
-    // Email markdown configuration
-    'markdown' => [
-        'theme' => 'default',
-        'paths' => [
-            resource_path('views/vendor/mail'),
-        ],
-    ],
 ];
--- a/app/Config/oidc.php
+++ b/app/Config/oidc.php
@ -9,7 +9,7 @@ return [
    'dump_user_details' => env('OIDC_DUMP_USER_DETAILS', false),

    // Claim, within an OpenId token, to find the user's display name
-    'display_name_claims' => explode('|', env('OIDC_DISPLAY_NAME_CLAIMS', 'name')),
+    'display_name_claims' => env('OIDC_DISPLAY_NAME_CLAIMS', 'name'),

    // Claim, within an OpenID token, to use to connect a BookStack user to the OIDC user.
    'external_id_claim' => env('OIDC_EXTERNAL_ID_CLAIM', 'sub'),
@ -35,6 +35,13 @@ return [
    // OAuth2 endpoints.
    'authorization_endpoint' => env('OIDC_AUTH_ENDPOINT', null),
    'token_endpoint'         => env('OIDC_TOKEN_ENDPOINT', null),
+    'userinfo_endpoint'      => env('OIDC_USERINFO_ENDPOINT', null),
+
+    // OIDC RP-Initiated Logout endpoint URL.
+    // A false value force-disables RP-Initiated Logout.
+    // A true value gets the URL from discovery, if active.
+    // A string value is used as the URL.
+    'end_session_endpoint' => env('OIDC_END_SESSION_ENDPOINT', false),

    // Add extra scopes, upon those required, to the OIDC authentication request
    // Multiple values can be provided comma seperated.
@ -45,6 +52,6 @@ return [
    'user_to_groups' => env('OIDC_USER_TO_GROUPS', false),
    // Attribute, within a OIDC ID token, to find group names within
    'groups_claim' => env('OIDC_GROUPS_CLAIM', 'groups'),
-    // When syncing groups, remove any groups that no longer match. Otherwise sync only adds new groups.
+    // When syncing groups, remove any groups that no longer match. Otherwise, sync only adds new groups.
    'remove_from_groups' => env('OIDC_REMOVE_FROM_GROUPS', false),
 ];
--- a/app/Config/queue.php
+++ b/app/Config/queue.php
@ -23,6 +23,7 @@ return [

        'database' => [
            'driver'       => 'database',
+            'connection'   => null,
            'table'        => 'jobs',
            'queue'        => 'default',
            'retry_after'  => 90,
@ -40,6 +41,12 @@ return [

    ],

+    // Job batching
+    'batching' => [
+        'database' => 'mysql',
+        'table' => 'job_batches',
+    ],
+
    // Failed queue job logging
    'failed' => [
        'driver'   => 'database-uuids',
--- a/Show More
+++ b/Show More