From b80522e486cf68c9743ff5f4a5cbdaf6628ce2f1 Mon Sep 17 00:00:00 2001
From: Takagi <1103069291@qq.com>
Date: Thu, 5 Sep 2024 15:29:47 +0800
Subject: [PATCH 001/185] docs: add documentation for formkit select
 allowCreate property (#6590)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/kind documentation
/area docs

#### What this PR does / why we need it:

补充 formkit select 组件中关于 allowCreate 属性的文档

#### Which issue(s) this PR fixes:

Fixes halo-dev/docs#408

#### Does this PR introduce a user-facing change?
```release-note
None
```
---
 ui/docs/custom-formkit-input/README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ui/docs/custom-formkit-input/README.md b/ui/docs/custom-formkit-input/README.md
index 15b40e508e..3fb5c4b3ae 100644
--- a/ui/docs/custom-formkit-input/README.md
+++ b/ui/docs/custom-formkit-input/README.md
@@ -65,7 +65,7 @@
     4. `remote`：标识当前是否由用户自定义的远程数据源。
     5. `remoteOption`：当 `remote` 为 `true` 时，此配置项必须存在，用于为 Select 组件提供处理搜索及查询键值对的方法。
     6. `remoteOptimize`：是否开启远程数据源优化，默认为 `true`。开启后，将会对远程数据源进行优化，减少请求次数。仅在动态数据源下有效。
-    7. `allowCreate`：是否允许创建新选项，默认为 `false`。仅在静态数据源下有效。
+    7. `allowCreate`：是否允许创建新选项，默认为 `false`。仅在静态数据源下有效，需要同时开启 `searchable`。
     8. `clearable`：是否允许清空选项，默认为 `false`。
     9. `multiple`：是否多选，默认为 `false`。
     10. `maxCount`：多选时最大可选数量，默认为 `Infinity`。仅在多选时有效。

From 51609abc57da2f4cced04ca6d83dab1e585ed19f Mon Sep 17 00:00:00 2001
From: Takagi <1103069291@qq.com>
Date: Fri, 6 Sep 2024 17:23:52 +0800
Subject: [PATCH 002/185] pref: add parameter to formkit select component for
 remote search by specific field (#6591)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/kind improvment
/area ui
/milestone 2.20.x

#### What this PR does / why we need it:

为 Formkit Select 组件增加 `fieldSelectorKey` 字段，用于在使用 `fieldSelector` 字段远程查询时，指定查询所使用的 Key。

例如指定 `fieldSelectorKey` 为 `metadata.name` 则接口调用时的参数为 `fieldSelector: metadata.name=(admin)`。

#### How to test it?

测试在远程搜索时，`fieldSelector` 的查询 key 是否为设置的内容。

#### Which issue(s) this PR fixes:

Fixes #6589

#### Does this PR introduce a user-facing change?
```release-note
为 Formkit Select 组件远程查询增加指定 Key 的字段。
```
---
 ui/docs/custom-formkit-input/README.md      |  3 ++-
 ui/src/formkit/inputs/select/SelectMain.vue | 22 ++++++++++++++-------
 2 files changed, 17 insertions(+), 8 deletions(-)

diff --git a/ui/docs/custom-formkit-input/README.md b/ui/docs/custom-formkit-input/README.md
index 3fb5c4b3ae..5be4f70e1a 100644
--- a/ui/docs/custom-formkit-input/README.md
+++ b/ui/docs/custom-formkit-input/README.md
@@ -231,10 +231,11 @@ const handleSelectPostAuthorRemote = {
     itemsField: items
     labelField: post.spec.title
     valueField: post.metadata.name
+    fieldSelectorKey: metadata.name
 ```
 
 > [!NOTE]
-> 当远程数据具有分页时，可能会出现默认选项不在第一页的情况，此时 Select 组件将会发送另一个查询请求，以获取默认选项的数据。此接口会携带如下参数 `fieldSelector: ${requestOption.valueField}=(value1,value2,value3)`。
+> 当远程数据具有分页时，可能会出现默认选项不在第一页的情况，此时 Select 组件将会发送另一个查询请求，以获取默认选项的数据。此接口会携带如下参数 `fieldSelector: ${requestOption.fieldSelectorKey}=(value1,value2,value3)`。
 
 > 其中，value1, value2, value3 为默认选项的值。返回值与查询一致，通过 `requestOption` 解析。
 
diff --git a/ui/src/formkit/inputs/select/SelectMain.vue b/ui/src/formkit/inputs/select/SelectMain.vue
index 9744df0a0a..d50606ca22 100644
--- a/ui/src/formkit/inputs/select/SelectMain.vue
+++ b/ui/src/formkit/inputs/select/SelectMain.vue
@@ -1,5 +1,10 @@
 <script lang="ts" setup>
 import type { FormKitFrameworkContext } from "@formkit/core";
+import { axiosInstance } from "@halo-dev/api-client";
+import { useDebounceFn } from "@vueuse/core";
+import { useFuse } from "@vueuse/integrations/useFuse";
+import type { AxiosRequestConfig } from "axios";
+import { get, has, type PropertyPath } from "lodash-es";
 import {
   computed,
   onMounted,
@@ -10,11 +15,6 @@ import {
   type PropType,
 } from "vue";
 import SelectContainer from "./SelectContainer.vue";
-import { axiosInstance } from "@halo-dev/api-client";
-import { get, has, type PropertyPath } from "lodash-es";
-import { useDebounceFn } from "@vueuse/core";
-import { useFuse } from "@vueuse/integrations/useFuse";
-import type { AxiosRequestConfig } from "axios";
 
 export interface SelectProps {
   /**
@@ -159,6 +159,12 @@ export interface SelectActionRequest {
    * Field name for value, default is `value`.
    */
   valueField?: PropertyPath;
+
+  /**
+   * When using value to query detailed information, the default query
+   * parameter key for fieldSelector is `metadata.name`.
+   */
+  fieldSelectorKey?: PropertyPath;
 }
 
 const props = defineProps({
@@ -209,6 +215,8 @@ const initSelectProps = () => {
       itemsField: "items",
       labelField: "label",
       valueField: "value",
+      totalField: "total",
+      fieldSelectorKey: "metadata.name",
       pageField: "page",
       sizeField: "size",
       parseData: undefined,
@@ -481,13 +489,13 @@ const fetchRemoteMappedOptions = async (
   };
   if (requestConfig.method === "GET") {
     requestConfig.params = {
-      fieldSelector: `${selectProps.requestOption?.valueField?.toString()}=(${unmappedSelectValues.join(
+      fieldSelector: `${selectProps.requestOption?.fieldSelectorKey?.toString()}=(${unmappedSelectValues.join(
         ","
       )})`,
     };
   } else {
     requestConfig.data = {
-      fieldSelector: `${selectProps.requestOption?.valueField?.toString()}=(${unmappedSelectValues.join(
+      fieldSelector: `${selectProps.requestOption?.fieldSelectorKey?.toString()}=(${unmappedSelectValues.join(
         ","
       )})`,
     };

From 6cdd2a7588609c02bbfff37b75f6ad7871ab1e0c Mon Sep 17 00:00:00 2001
From: Takagi <1103069291@qq.com>
Date: Fri, 6 Sep 2024 17:25:52 +0800
Subject: [PATCH 003/185] fix: resolve issue with disabled property in options
 not working (#6595)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/kind bug
/area ui

#### What this PR does / why we need it:

解决 formkit select 组件中，option 使用 `attrs: { disabled: true }` 无效的问题。

#### How to test it?

测试在 formkit select 组件中，option 设置 disabled 属性是否有效。

#### Which issue(s) this PR fixes:

Fixed #6592

#### Does this PR introduce a user-facing change?
```release-note
解决 formkit select 组件的 Option 设置 disabled 无效的问题
```
---
 ui/src/formkit/inputs/select/SelectMain.vue   |  5 +----
 ui/src/formkit/inputs/select/SelectOption.vue | 15 ++++++++++-----
 ui/src/formkit/inputs/select/isFalse.ts       |  3 +++
 3 files changed, 14 insertions(+), 9 deletions(-)
 create mode 100644 ui/src/formkit/inputs/select/isFalse.ts

diff --git a/ui/src/formkit/inputs/select/SelectMain.vue b/ui/src/formkit/inputs/select/SelectMain.vue
index d50606ca22..71ee100bd2 100644
--- a/ui/src/formkit/inputs/select/SelectMain.vue
+++ b/ui/src/formkit/inputs/select/SelectMain.vue
@@ -14,6 +14,7 @@ import {
   watch,
   type PropType,
 } from "vue";
+import { isFalse } from "./isFalse";
 import SelectContainer from "./SelectContainer.vue";
 
 export interface SelectProps {
@@ -238,10 +239,6 @@ const initSelectProps = () => {
   }
 };
 
-const isFalse = (value: string | boolean | undefined | null) => {
-  return [undefined, null, "false", false].includes(value);
-};
-
 const isLoading = ref(false);
 const isFetchingMore = ref(false);
 const page = ref(1);
diff --git a/ui/src/formkit/inputs/select/SelectOption.vue b/ui/src/formkit/inputs/select/SelectOption.vue
index d09a2d989e..41d248193d 100644
--- a/ui/src/formkit/inputs/select/SelectOption.vue
+++ b/ui/src/formkit/inputs/select/SelectOption.vue
@@ -4,6 +4,7 @@ import { vScroll } from "@vueuse/components";
 import { useEventListener, type UseScrollReturn } from "@vueuse/core";
 import { computed, ref, watch } from "vue";
 import SelectOptionItem from "./SelectOptionItem.vue";
+import { isFalse } from "./isFalse";
 
 const props = defineProps<{
   options: Array<Record<string, unknown> & { label: string; value: string }>;
@@ -81,7 +82,7 @@ const handleSelected = (index: number) => {
     }
   }
   selectedIndex.value = index;
-  if (option) {
+  if (option && !isDisabled(option)) {
     emit("selected", option);
   }
 };
@@ -112,11 +113,15 @@ const reachMaximumLimit = computed(() => {
   return false;
 });
 
-const isDisabled = (option: { label: string; value: string }) => {
+const isDisabled = (
+  option: Record<string, unknown> & { label: string; value: string }
+) => {
+  const attrs = option.attrs as Record<string, unknown>;
   return (
-    reachMaximumLimit.value &&
-    selectedValues.value &&
-    !selectedValues.value.includes(option.value)
+    (reachMaximumLimit.value &&
+      selectedValues.value &&
+      !selectedValues.value.includes(option.value)) ||
+    !isFalse(attrs?.disabled as string | boolean | undefined)
   );
 };
 
diff --git a/ui/src/formkit/inputs/select/isFalse.ts b/ui/src/formkit/inputs/select/isFalse.ts
new file mode 100644
index 0000000000..918ab0811c
--- /dev/null
+++ b/ui/src/formkit/inputs/select/isFalse.ts
@@ -0,0 +1,3 @@
+export const isFalse = (value: string | boolean | undefined | null) => {
+  return [undefined, null, "false", false].includes(value);
+};

From 2ea063d37f847542b73b3a2bebf0c299ff50b755 Mon Sep 17 00:00:00 2001
From: guqing <38999863+guqing@users.noreply.github.com>
Date: Fri, 6 Sep 2024 17:27:52 +0800
Subject: [PATCH 004/185] fix: skip thumbnail generation for GIF images (#6597)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?
/kind bug
/area core
/milestone 2.20.x

#### What this PR does / why we need it:
修复 GIF 缩略图生成只会保留第一帧的问题

#### Which issue(s) this PR fixes:
Fixes #6596

#### Does this PR introduce a user-facing change?
```release-note
修复 GIF 缩略图生成只会保留第一帧的问题
```
---
 .../core/attachment/ThumbnailGenerator.java   | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/application/src/main/java/run/halo/app/core/attachment/ThumbnailGenerator.java b/application/src/main/java/run/halo/app/core/attachment/ThumbnailGenerator.java
index 1bf189d903..59f543e759 100644
--- a/application/src/main/java/run/halo/app/core/attachment/ThumbnailGenerator.java
+++ b/application/src/main/java/run/halo/app/core/attachment/ThumbnailGenerator.java
@@ -13,12 +13,14 @@
 import java.nio.file.Path;
 import java.util.Iterator;
 import java.util.Optional;
+import java.util.Set;
 import javax.imageio.ImageIO;
 import javax.imageio.ImageReader;
 import javax.imageio.stream.ImageInputStream;
 import lombok.AllArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 import org.imgscalr.Scalr;
+import org.springframework.lang.NonNull;
 
 @Slf4j
 @AllArgsConstructor
@@ -29,6 +31,8 @@ public class ThumbnailGenerator {
      */
     static final int MAX_FILE_SIZE = 30 * 1024 * 1024;
 
+    private static final Set<String> UNSUPPORTED_FORMATS = Set.of("gif", "svg", "webp");
+
     private final ImageDownloader imageDownloader = new ImageDownloader();
     private final ThumbnailSize size;
     private final Path storePath;
@@ -70,13 +74,16 @@ private void generateThumbnail(Path tempImagePath) throws IOException {
         if (file.length() > MAX_FILE_SIZE) {
             throw new IOException("File size exceeds the limit: " + MAX_FILE_SIZE);
         }
-        var formatNameOpt = getFormatName(file);
+        String formatName = getFormatName(file)
+            .orElseThrow(() -> new UnsupportedOperationException("Unknown format"));
+        if (isUnsupportedFormat(formatName)) {
+            throw new UnsupportedOperationException("Unsupported image format for: " + formatName);
+        }
+
         var img = ImageIO.read(file);
         if (img == null) {
-            throw new UnsupportedOperationException(
-                "Unsupported image format for: " + formatNameOpt.orElse("unknown"));
+            throw new UnsupportedOperationException("Cannot read image file: " + file);
         }
-        var formatName = formatNameOpt.orElse("jpg");
         var thumbnailFile = getThumbnailFile(formatName);
         if (img.getWidth() <= size.getWidth()) {
             Files.copy(tempImagePath, thumbnailFile.toPath(), REPLACE_EXISTING);
@@ -87,6 +94,10 @@ private void generateThumbnail(Path tempImagePath) throws IOException {
         ImageIO.write(thumbnail, formatName, thumbnailFile);
     }
 
+    private static boolean isUnsupportedFormat(@NonNull String formatName) {
+        return UNSUPPORTED_FORMATS.contains(formatName.toLowerCase());
+    }
+
     private File getThumbnailFile(String formatName) {
         return Optional.of(storePath)
             .map(path -> {

From cf2837d744e025bf9d02f08c2ffebac638a4e8b2 Mon Sep 17 00:00:00 2001
From: Takagi <1103069291@qq.com>
Date: Fri, 6 Sep 2024 17:45:51 +0800
Subject: [PATCH 005/185] fix: formkit select component not emitting event or
 updating selection on value change (#6602)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/kind bug
/area ui
/milestone 2.20.x

#### What this PR does / why we need it:

重新修改 formkit select 初始化值的监听方式，用于当 value 发生变化时，使选项值可以发生变化。

另外在更新数据时，如果数据发生变化，则发出 `onChange` 事件。

> 需要注意的是，通过 v-modal 传入默认值，再将此值改为 `undefined` 时无法触发 `watch` 及 formkit 的 `input` 事件，原因暂时未知，将此值设置为 `""` 即可正常触发。

#### How to test it?

由于此 PR 改动了初始化的方式，因此需要全量测试所有使用 `Select` 组件的位置。包括多选与单选，本地源与远程源。确保功能符合预期。

#### Which issue(s) this PR fixes:

Fixes #6594

#### Does this PR introduce a user-facing change?
```release-note
解决 Formkit Select 组件在值变更时不会发出事件及修改选项值的问题。
```
---
 .../formkit/inputs/select/SelectContainer.vue | 10 +--
 ui/src/formkit/inputs/select/SelectMain.vue   | 62 +++++++++++++------
 ui/src/formkit/inputs/select/isFalse.ts       |  6 +-
 3 files changed, 53 insertions(+), 25 deletions(-)

diff --git a/ui/src/formkit/inputs/select/SelectContainer.vue b/ui/src/formkit/inputs/select/SelectContainer.vue
index 7c6679b20e..0602309a6c 100644
--- a/ui/src/formkit/inputs/select/SelectContainer.vue
+++ b/ui/src/formkit/inputs/select/SelectContainer.vue
@@ -2,18 +2,18 @@
 import { IconArrowDownLine, IconCloseCircle } from "@halo-dev/components";
 import {
   computed,
+  defineEmits,
   nextTick,
   onMounted,
+  onUnmounted,
   ref,
-  defineEmits,
   type PropType,
-  onUnmounted,
 } from "vue";
 
-import SelectSelector from "./SelectSelector.vue";
+import { Dropdown } from "floating-vue";
 import MultipleSelectSelector from "./MultipleSelectSelector.vue";
 import SelectDropdownContainer from "./SelectDropdownContainer.vue";
-import { Dropdown } from "floating-vue";
+import SelectSelector from "./SelectSelector.vue";
 
 const props = defineProps({
   multiple: {
@@ -95,7 +95,7 @@ const inputRef = ref<HTMLInputElement | null>();
 const searchKeyword = ref<string>("");
 const isDropdownVisible = ref<boolean>(false);
 const selectedOptions = computed({
-  get: () => props.selected,
+  get: () => [...props.selected],
   set: (value) => {
     emit("update", value);
   },
diff --git a/ui/src/formkit/inputs/select/SelectMain.vue b/ui/src/formkit/inputs/select/SelectMain.vue
index 71ee100bd2..44ef2ae4dc 100644
--- a/ui/src/formkit/inputs/select/SelectMain.vue
+++ b/ui/src/formkit/inputs/select/SelectMain.vue
@@ -45,7 +45,7 @@ export interface SelectProps {
   remoteOptimize?: boolean;
 
   /**
-   * Allows the creation of new options, only available in local mode.
+   * Allows the creation of new options, only available in local mode. Default is false.
    */
   allowCreate?: boolean;
 
@@ -209,7 +209,7 @@ const initSelectProps = () => {
   selectProps.maxCount = nodeProps.maxCount ?? NaN;
   selectProps.placeholder = nodeProps.placeholder ?? "";
   selectProps.action = nodeProps.action ?? "";
-  selectProps.remoteOptimize = nodeProps.remoteOptimize ?? true;
+  selectProps.remoteOptimize = !isFalse(nodeProps.remoteOptimize, true);
   selectProps.requestOption = {
     ...{
       method: "GET",
@@ -225,12 +225,12 @@ const initSelectProps = () => {
     ...(nodeProps.requestOption ?? {}),
   };
   selectProps.multiple = !isFalse(nodeProps.multiple);
-  selectProps.sortable = !isFalse(nodeProps.sortable);
+  selectProps.sortable = !isFalse(nodeProps.sortable, true);
   selectProps.remote = !isFalse(nodeProps.remote);
   selectProps.allowCreate = !isFalse(nodeProps.allowCreate);
   selectProps.clearable = !isFalse(nodeProps.clearable);
   selectProps.searchable = !isFalse(nodeProps.searchable);
-  selectProps.autoSelect = !isFalse(nodeProps.autoSelect) || true;
+  selectProps.autoSelect = !isFalse(nodeProps.autoSelect, true);
   if (selectProps.remote) {
     if (!nodeProps.remoteOption) {
       throw new Error("remoteOption is required when remote is true.");
@@ -543,14 +543,25 @@ const getAutoSelectedOption = ():
   });
 };
 
-const stopSelectedWatch = watch(
-  () => [options.value, props.context.value],
-  async () => {
-    if (options.value) {
+watch(
+  () => props.context.value,
+  async (newValue) => {
+    const selectedValues = selectOptions.value?.map((item) => item.value) || [];
+    if (selectedValues.length > 0 && selectedValues.includes(newValue)) {
+      return;
+    }
+    const selectedOption = await fetchSelectedOptions();
+    selectOptions.value = selectedOption;
+  }
+);
+
+watch(
+  () => options.value,
+  async (newOptions) => {
+    if (newOptions && newOptions.length > 0) {
       const selectedOption = await fetchSelectedOptions();
       if (selectedOption) {
         selectOptions.value = selectedOption;
-        return;
       }
       const isAutoSelect =
         selectProps.autoSelect &&
@@ -562,12 +573,12 @@ const stopSelectedWatch = watch(
         // Automatically select the first option when the selected value is empty.
         const autoSelectedOption = getAutoSelectedOption();
         if (autoSelectedOption) {
-          selectOptions.value = [autoSelectedOption];
-          handleUpdate(selectOptions.value);
+          handleUpdate([autoSelectedOption]);
         }
       }
     }
-  }
+  },
+  { once: true }
 );
 
 // When attr options are processed asynchronously, it is necessary to monitor
@@ -581,14 +592,27 @@ watch(
   }
 );
 
-const handleSelectedUpdate = (
-  value: Array<{ label: string; value: string }>
-) => {
-  stopSelectedWatch();
-  handleUpdate(value);
+const handleUpdate = async (value: Array<{ label: string; value: string }>) => {
+  const oldSelectValue = selectOptions.value;
+  if (
+    oldSelectValue &&
+    value.length === oldSelectValue.length &&
+    value.every((item, index) => item.value === oldSelectValue[index].value)
+  ) {
+    return;
+  }
+  const newValue = value.map((item) => {
+    return {
+      label: item.label,
+      value: item.value,
+    };
+  });
+  handleSetNodeValue(newValue);
+  await props.context.node.settled;
+  props.context.attrs.onChange?.(newValue);
 };
 
-const handleUpdate = (value: Array<{ label: string; value: string }>) => {
+const handleSetNodeValue = (value: Array<{ label: string; value: string }>) => {
   const values = value.map((item) => item.value);
   selectOptions.value = value;
   if (selectProps.multiple) {
@@ -725,7 +749,7 @@ const handleNextPage = async () => {
     :clearable="selectProps.clearable"
     :searchable="selectProps.searchable"
     :auto-select="selectProps.autoSelect"
-    @update="handleSelectedUpdate"
+    @update="handleUpdate"
     @search="handleSearch"
     @load-more="handleNextPage"
   />
diff --git a/ui/src/formkit/inputs/select/isFalse.ts b/ui/src/formkit/inputs/select/isFalse.ts
index 918ab0811c..40840924b2 100644
--- a/ui/src/formkit/inputs/select/isFalse.ts
+++ b/ui/src/formkit/inputs/select/isFalse.ts
@@ -1,3 +1,7 @@
-export const isFalse = (value: string | boolean | undefined | null) => {
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+export const isFalse = (value: any, onlyBoolean = false) => {
+  if (onlyBoolean) {
+    return [false, "false"].includes(value);
+  }
   return [undefined, null, "false", false].includes(value);
 };

From 93ffb7d8eaef9d53bc4fdaf2f5b42cc75bba0fd8 Mon Sep 17 00:00:00 2001
From: John Niang <johnniang@foxmail.com>
Date: Fri, 6 Sep 2024 22:01:52 +0800
Subject: [PATCH 006/185] Prevent null role while getting permissions (#6612)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/kind bug
/area core
/milestone 2.20.x

#### What this PR does / why we need it:

This PR filters blank role name while granting roles for an user to prevent null role in permissions.

#### Which issue(s) this PR fixes:

Fixes https://github.com/halo-dev/halo/issues/6604

#### Does this PR introduce a user-facing change?

```release-note
修复取消用户角色后无法正常渲染用户列表的问题
```
---
 .../run/halo/app/core/extension/endpoint/UserEndpoint.java  | 6 +++++-
 .../halo/app/core/extension/service/UserServiceImpl.java    | 1 +
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/application/src/main/java/run/halo/app/core/extension/endpoint/UserEndpoint.java b/application/src/main/java/run/halo/app/core/extension/endpoint/UserEndpoint.java
index 74d2bb0b5b..d8bc8bd980 100644
--- a/application/src/main/java/run/halo/app/core/extension/endpoint/UserEndpoint.java
+++ b/application/src/main/java/run/halo/app/core/extension/endpoint/UserEndpoint.java
@@ -771,7 +771,11 @@ private Mono<ListResult<ListedUser>> toListedUser(ListResult<User> listResult) {
                             .map(user -> {
                                 var username = user.getMetadata().getName();
                                 var roles = Optional.ofNullable(usernameRolesMap.get(username))
-                                    .map(roleNames -> roleNames.stream().map(roleMap::get).toList())
+                                    .map(roleNames -> roleNames.stream()
+                                        .map(roleMap::get)
+                                        .filter(Objects::nonNull)
+                                        .toList()
+                                    )
                                     .orElseGet(List::of);
                                 return new ListedUser(user, roles);
                             })
diff --git a/application/src/main/java/run/halo/app/core/extension/service/UserServiceImpl.java b/application/src/main/java/run/halo/app/core/extension/service/UserServiceImpl.java
index eb55946376..5d9f85fcd0 100644
--- a/application/src/main/java/run/halo/app/core/extension/service/UserServiceImpl.java
+++ b/application/src/main/java/run/halo/app/core/extension/service/UserServiceImpl.java
@@ -133,6 +133,7 @@ public Mono<User> grantRoles(String username, Set<String> roles) {
                         var mutableRoles = new HashSet<>(roles);
                         mutableRoles.removeAll(existingRoles);
                         return mutableRoles.stream()
+                            .filter(StringUtils::hasText)
                             .map(roleName -> RoleBinding.create(username, roleName));
                     }).flatMap(client::create))
                     .then(Mono.defer(() -> {

From 3c785cb7c814b88d561198bf4885263c87dd2c21 Mon Sep 17 00:00:00 2001
From: Takagi <1103069291@qq.com>
Date: Tue, 10 Sep 2024 15:56:10 +0800
Subject: [PATCH 007/185] fix: correct boolean value display issue in formkit
 selector component (#6624)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/kind bug
/area ui
/milestone 2.20.x

#### What this PR does / why we need it:

解决 Formkit Selector 在值为布尔或者数字类型时，回显时内容不正常的问题。

#### How to test it?

测试当 FormKit Select 组件的值为布尔或者数字时，回显的内容是否正常。

#### Does this PR introduce a user-facing change?
```release-note
修复 FormKit Select 组件中布尔值的显示问题。
```
---
 ui/src/formkit/inputs/select/SelectMain.vue | 23 +++++++++++++++------
 1 file changed, 17 insertions(+), 6 deletions(-)

diff --git a/ui/src/formkit/inputs/select/SelectMain.vue b/ui/src/formkit/inputs/select/SelectMain.vue
index 44ef2ae4dc..b5cbabae4c 100644
--- a/ui/src/formkit/inputs/select/SelectMain.vue
+++ b/ui/src/formkit/inputs/select/SelectMain.vue
@@ -555,6 +555,22 @@ watch(
   }
 );
 
+const enableAutoSelect = () => {
+  if (!selectProps.autoSelect) {
+    return false;
+  }
+  if (selectProps.multiple || selectProps.placeholder) {
+    return false;
+  }
+
+  const value = props.context.node.value;
+  if (value === void 0 || value === null) {
+    return true;
+  }
+
+  return false;
+};
+
 watch(
   () => options.value,
   async (newOptions) => {
@@ -563,13 +579,8 @@ watch(
       if (selectedOption) {
         selectOptions.value = selectedOption;
       }
-      const isAutoSelect =
-        selectProps.autoSelect &&
-        !selectProps.multiple &&
-        !selectProps.placeholder &&
-        !props.context.node.value;
 
-      if (isAutoSelect) {
+      if (enableAutoSelect()) {
         // Automatically select the first option when the selected value is empty.
         const autoSelectedOption = getAutoSelectedOption();
         if (autoSelectedOption) {

From b02ab8d8099cdebb2e2b7a51f676a96ad04ea02c Mon Sep 17 00:00:00 2001
From: Takagi <1103069291@qq.com>
Date: Tue, 10 Sep 2024 16:16:10 +0800
Subject: [PATCH 008/185] fix: resolve incorrect display of options in formkit
 selector with async data (#6629)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/kind bug
/area ui
/milestone 2.20.x

#### What this PR does / why we need it:

为 formkit select 组件优化逻辑，目前将可以监听到 options 的变化，用于在变化时设置值。用于解决当 options 是异步获取，而 value 是初始设置时，无法显示正常的 label。

#### How to test it?

测试 options 比设置 value 晚时，数据能否正常显示 label。

#### Does this PR introduce a user-facing change?
```release-note
解决当 formkit select 组件中的 options 延迟设置时无法正常回显的问题。
```
---
 .../inputs/select/SelectDropdownContainer.vue   |  9 ++++++---
 ui/src/formkit/inputs/select/SelectMain.vue     | 17 ++++++++++++-----
 2 files changed, 18 insertions(+), 8 deletions(-)

diff --git a/ui/src/formkit/inputs/select/SelectDropdownContainer.vue b/ui/src/formkit/inputs/select/SelectDropdownContainer.vue
index 1a3438017e..2ef8a6b3bd 100644
--- a/ui/src/formkit/inputs/select/SelectDropdownContainer.vue
+++ b/ui/src/formkit/inputs/select/SelectDropdownContainer.vue
@@ -43,9 +43,12 @@ const filterOptions = computed(() => {
   }
 
   const options = props.options.filter((option) => {
-    return option.label
-      .toLocaleLowerCase()
-      .includes(keyword.toLocaleLowerCase());
+    if (option.label) {
+      return option.label
+        .toLocaleLowerCase()
+        .includes(keyword.toLocaleLowerCase());
+    }
+    return false;
   });
 
   if (props.allowCreate) {
diff --git a/ui/src/formkit/inputs/select/SelectMain.vue b/ui/src/formkit/inputs/select/SelectMain.vue
index b5cbabae4c..54658d722a 100644
--- a/ui/src/formkit/inputs/select/SelectMain.vue
+++ b/ui/src/formkit/inputs/select/SelectMain.vue
@@ -555,6 +555,18 @@ watch(
   }
 );
 
+watch(
+  () => options.value,
+  async (newOptions) => {
+    if (newOptions && newOptions.length > 0) {
+      const selectedOption = await fetchSelectedOptions();
+      if (selectedOption) {
+        selectOptions.value = selectedOption;
+      }
+    }
+  }
+);
+
 const enableAutoSelect = () => {
   if (!selectProps.autoSelect) {
     return false;
@@ -575,11 +587,6 @@ watch(
   () => options.value,
   async (newOptions) => {
     if (newOptions && newOptions.length > 0) {
-      const selectedOption = await fetchSelectedOptions();
-      if (selectedOption) {
-        selectOptions.value = selectedOption;
-      }
-
       if (enableAutoSelect()) {
         // Automatically select the first option when the selected value is empty.
         const autoSelectedOption = getAutoSelectedOption();

From 39545a1e4c1fdce312fb47b82969eea3b5c6493c Mon Sep 17 00:00:00 2001
From: guqing <38999863+guqing@users.noreply.github.com>
Date: Tue, 10 Sep 2024 17:28:10 +0800
Subject: [PATCH 009/185] refactor: optimize request headers when generating
 thumbnails from URI (#6628)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?
/kind improvement
/area core
/milestone 2.20.x

#### What this PR does / why we need it:
优化根据 URI 生成缩略图时的请求头

1. 由于之前 attachment 的 permalink 是 `URI.toString` 会导致根据 permalink 索引查询附件可能由于编码问题无法查询到导致生成缩略图只能根据 URI 生成
2. 可能配置了 nginx 判断请求头不允许脚本请求如导致根据 URI 访问图片无法访问导致无法生成，如
```
if ($http_user agent ~*(python curlljava wget go-http-client httpclient okhttp)){
}
```

Fixes #6627

#### Does this PR introduce a user-facing change?
```release-note
None
```
---
 .../halo/app/core/attachment/ThumbnailGenerator.java  |  7 ++++++-
 .../attachment/reconciler/AttachmentReconciler.java   |  2 +-
 .../reconciler/LocalThumbnailsReconciler.java         |  4 ++++
 .../app/core/attachment/ThumbnailGeneratorTest.java   | 11 ++++++++---
 4 files changed, 19 insertions(+), 5 deletions(-)

diff --git a/application/src/main/java/run/halo/app/core/attachment/ThumbnailGenerator.java b/application/src/main/java/run/halo/app/core/attachment/ThumbnailGenerator.java
index 59f543e759..ad822f05cb 100644
--- a/application/src/main/java/run/halo/app/core/attachment/ThumbnailGenerator.java
+++ b/application/src/main/java/run/halo/app/core/attachment/ThumbnailGenerator.java
@@ -6,6 +6,7 @@
 import java.io.FileOutputStream;
 import java.io.IOException;
 import java.io.InputStream;
+import java.net.HttpURLConnection;
 import java.net.MalformedURLException;
 import java.net.URISyntaxException;
 import java.net.URL;
@@ -172,7 +173,11 @@ Path downloadFileInternal(URL url) throws IOException {
             File tempFile = File.createTempFile("halo-image-thumb-", ".tmp");
             long totalBytesDownloaded = 0;
             var tempFilePath = tempFile.toPath();
-            try (InputStream inputStream = url.openStream();
+            HttpURLConnection connection = (HttpURLConnection) url.openConnection();
+            connection.setRequestProperty("User-Agent",
+                "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)"
+                    + " Chrome/92.0.4515.131 Safari/537.36");
+            try (InputStream inputStream = connection.getInputStream();
                  FileOutputStream outputStream = new FileOutputStream(tempFile)) {
 
                 byte[] buffer = new byte[4096];
diff --git a/application/src/main/java/run/halo/app/core/attachment/reconciler/AttachmentReconciler.java b/application/src/main/java/run/halo/app/core/attachment/reconciler/AttachmentReconciler.java
index 0441390cc5..fa5b722ba4 100644
--- a/application/src/main/java/run/halo/app/core/attachment/reconciler/AttachmentReconciler.java
+++ b/application/src/main/java/run/halo/app/core/attachment/reconciler/AttachmentReconciler.java
@@ -58,7 +58,7 @@ public Result reconcile(Request request) {
             var annotations = attachment.getMetadata().getAnnotations();
             if (annotations != null) {
                 attachmentService.getPermalink(attachment)
-                    .map(URI::toString)
+                    .map(URI::toASCIIString)
                     .switchIfEmpty(Mono.fromSupplier(() -> {
                         // Only for back-compatibility
                         return annotations.get(Constant.EXTERNAL_LINK_ANNO_KEY);
diff --git a/application/src/main/java/run/halo/app/core/attachment/reconciler/LocalThumbnailsReconciler.java b/application/src/main/java/run/halo/app/core/attachment/reconciler/LocalThumbnailsReconciler.java
index 1f1eb7b38f..ce2d90f82f 100644
--- a/application/src/main/java/run/halo/app/core/attachment/reconciler/LocalThumbnailsReconciler.java
+++ b/application/src/main/java/run/halo/app/core/attachment/reconciler/LocalThumbnailsReconciler.java
@@ -27,6 +27,7 @@
 import run.halo.app.core.extension.attachment.Constant;
 import run.halo.app.core.extension.attachment.LocalThumbnail;
 import run.halo.app.extension.ExtensionClient;
+import run.halo.app.extension.ExtensionUtil;
 import run.halo.app.extension.ListOptions;
 import run.halo.app.extension.PageRequestImpl;
 import run.halo.app.extension.controller.Controller;
@@ -47,6 +48,9 @@ public class LocalThumbnailsReconciler implements Reconciler<Reconciler.Request>
     public Result reconcile(Request request) {
         client.fetch(LocalThumbnail.class, request.name())
             .ifPresent(thumbnail -> {
+                if (ExtensionUtil.isDeleted(thumbnail)) {
+                    return;
+                }
                 if (shouldGenerate(thumbnail)) {
                     requestGenerateThumbnail(thumbnail);
                     nullSafeAnnotations(thumbnail).remove(REQUEST_TO_GENERATE_ANNO);
diff --git a/application/src/test/java/run/halo/app/core/attachment/ThumbnailGeneratorTest.java b/application/src/test/java/run/halo/app/core/attachment/ThumbnailGeneratorTest.java
index e50da39ba9..a87dca8867 100644
--- a/application/src/test/java/run/halo/app/core/attachment/ThumbnailGeneratorTest.java
+++ b/application/src/test/java/run/halo/app/core/attachment/ThumbnailGeneratorTest.java
@@ -4,11 +4,13 @@
 import static org.assertj.core.api.Assertions.assertThatThrownBy;
 import static org.mockito.Mockito.doAnswer;
 import static org.mockito.Mockito.doReturn;
+import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.spy;
 
 import java.io.ByteArrayInputStream;
 import java.io.IOException;
 import java.io.InputStream;
+import java.net.HttpURLConnection;
 import java.net.URL;
 import java.nio.file.Files;
 import java.nio.file.Path;
@@ -57,7 +59,9 @@ void testDownloadImage_Success() throws Exception {
             String mockImageData = "fakeImageData";
             InputStream mockInputStream = new ByteArrayInputStream(mockImageData.getBytes());
 
-            doAnswer(invocation -> mockInputStream).when(spyImageUrl).openStream();
+            var urlConnection = mock(HttpURLConnection.class);
+            doAnswer(invocation -> urlConnection).when(spyImageUrl).openConnection();
+            doReturn(mockInputStream).when(urlConnection).getInputStream();
 
             var path = imageDownloader.downloadFileInternal(spyImageUrl);
             assertThat(path).isNotNull();
@@ -81,8 +85,9 @@ void downloadImage_FileSizeLimitExceeded() throws Exception {
             var fileSizeByte = ThumbnailGenerator.MAX_FILE_SIZE + 10;
             byte[] largeImageData = new byte[fileSizeByte];
             InputStream mockInputStream = new ByteArrayInputStream(largeImageData);
-
-            doReturn(mockInputStream).when(spyImageUrl).openStream();
+            var urlConnection = mock(HttpURLConnection.class);
+            doAnswer(invocation -> urlConnection).when(spyImageUrl).openConnection();
+            doReturn(mockInputStream).when(urlConnection).getInputStream();
             assertThatThrownBy(() -> imageDownloader.downloadFileInternal(spyImageUrl))
                 .isInstanceOf(IOException.class)
                 .hasMessageContaining("File size exceeds the limit");

From a36822c861413e3fbe163a7376c2b957f5c75d9f Mon Sep 17 00:00:00 2001
From: John Niang <johnniang@foxmail.com>
Date: Thu, 12 Sep 2024 10:34:20 +0800
Subject: [PATCH 010/185] Expose CryptoService and RateLimiterRegistry to
 plugins (#6638)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/kind feature
/area core
/area plugin
/milestone 2.20.x

#### What this PR does / why we need it:

Currently, we are refactoring login and logout pages to make them extensible. If plugins want to realize a new authentication method, the CryptoService and RateLimiterRegistry may be used to authenticate.

So this PR exposes the two beans to plugins. No side effect will be introduced.

#### Does this PR introduce a user-facing change?

```release-note
【开发相关】允许在插件使用 CryptoService 和 RateLimiterRegistry
```
---
 .../app/security/authentication/CryptoService.java     |  0
 .../app/plugin/SharedApplicationContextFactory.java    | 10 ++++++++++
 2 files changed, 10 insertions(+)
 rename {application => api}/src/main/java/run/halo/app/security/authentication/CryptoService.java (100%)

diff --git a/application/src/main/java/run/halo/app/security/authentication/CryptoService.java b/api/src/main/java/run/halo/app/security/authentication/CryptoService.java
similarity index 100%
rename from application/src/main/java/run/halo/app/security/authentication/CryptoService.java
rename to api/src/main/java/run/halo/app/security/authentication/CryptoService.java
diff --git a/application/src/main/java/run/halo/app/plugin/SharedApplicationContextFactory.java b/application/src/main/java/run/halo/app/plugin/SharedApplicationContextFactory.java
index 90b146114d..c0236917b5 100644
--- a/application/src/main/java/run/halo/app/plugin/SharedApplicationContextFactory.java
+++ b/application/src/main/java/run/halo/app/plugin/SharedApplicationContextFactory.java
@@ -1,5 +1,6 @@
 package run.halo.app.plugin;
 
+import io.github.resilience4j.ratelimiter.RateLimiterRegistry;
 import org.springframework.cache.CacheManager;
 import org.springframework.context.ApplicationContext;
 import org.springframework.context.support.GenericApplicationContext;
@@ -16,6 +17,7 @@
 import run.halo.app.notification.NotificationReasonEmitter;
 import run.halo.app.plugin.extensionpoint.ExtensionGetter;
 import run.halo.app.security.LoginHandlerEnhancer;
+import run.halo.app.security.authentication.CryptoService;
 
 /**
  * Utility for creating shared application context.
@@ -69,6 +71,14 @@ public static ApplicationContext create(ApplicationContext rootContext) {
             );
         beanFactory.registerSingleton("extensionGetter",
             rootContext.getBean(ExtensionGetter.class));
+        rootContext.getBeanProvider(CryptoService.class)
+            .ifUnique(
+                cryptoService -> beanFactory.registerSingleton("cryptoService", cryptoService)
+            );
+        rootContext.getBeanProvider(RateLimiterRegistry.class)
+            .ifUnique(rateLimiterRegistry ->
+                beanFactory.registerSingleton("rateLimiterRegistry", rateLimiterRegistry)
+            );
         // TODO add more shared instance here
 
         sharedContext.refresh();

From ba18f7010b3cd206b784018eae6093a71393fb24 Mon Sep 17 00:00:00 2001
From: John Niang <johnniang@foxmail.com>
Date: Thu, 12 Sep 2024 11:02:21 +0800
Subject: [PATCH 011/185] Update attachment permalink only when handler is
 available (#6641)

---
 .../reconciler/AttachmentReconciler.java      | 21 ++++++++-----------
 1 file changed, 9 insertions(+), 12 deletions(-)

diff --git a/application/src/main/java/run/halo/app/core/attachment/reconciler/AttachmentReconciler.java b/application/src/main/java/run/halo/app/core/attachment/reconciler/AttachmentReconciler.java
index fa5b722ba4..cc99fb226c 100644
--- a/application/src/main/java/run/halo/app/core/attachment/reconciler/AttachmentReconciler.java
+++ b/application/src/main/java/run/halo/app/core/attachment/reconciler/AttachmentReconciler.java
@@ -14,7 +14,6 @@
 import org.apache.commons.lang3.StringUtils;
 import org.springframework.stereotype.Component;
 import reactor.core.publisher.Flux;
-import reactor.core.publisher.Mono;
 import run.halo.app.core.attachment.AttachmentUtils;
 import run.halo.app.core.attachment.ThumbnailService;
 import run.halo.app.core.attachment.ThumbnailSize;
@@ -28,6 +27,7 @@
 import run.halo.app.extension.controller.ControllerBuilder;
 import run.halo.app.extension.controller.Reconciler;
 import run.halo.app.extension.controller.Reconciler.Request;
+import run.halo.app.extension.controller.RequeueException;
 
 @Slf4j
 @Component
@@ -57,18 +57,15 @@ public Result reconcile(Request request) {
 
             var annotations = attachment.getMetadata().getAnnotations();
             if (annotations != null) {
-                attachmentService.getPermalink(attachment)
+                var permalink = attachmentService.getPermalink(attachment)
                     .map(URI::toASCIIString)
-                    .switchIfEmpty(Mono.fromSupplier(() -> {
-                        // Only for back-compatibility
-                        return annotations.get(Constant.EXTERNAL_LINK_ANNO_KEY);
-                    }))
-                    .doOnNext(permalink -> {
-                        log.debug("Set permalink {} for attachment {}", permalink, request.name());
-                        var status = nullSafeStatus(attachment);
-                        status.setPermalink(permalink);
-                    })
-                    .blockOptional();
+                    .blockOptional()
+                    .orElseThrow(() -> new RequeueException(new Result(true, null),
+                        "Attachment handler is unavailable, requeue the request"
+                    ));
+                log.debug("Set permalink {} for attachment {}", permalink, request.name());
+                var status = nullSafeStatus(attachment);
+                status.setPermalink(permalink);
             }
             var permalink = nullSafeStatus(attachment).getPermalink();
             if (StringUtils.isNotBlank(permalink) && AttachmentUtils.isImage(attachment)) {

From 697963d628ecaf0143727586a65aa45b76eda0da Mon Sep 17 00:00:00 2001
From: Ryan Wang <i@ryanc.cc>
Date: Thu, 12 Sep 2024 13:28:20 +0800
Subject: [PATCH 012/185] feat: add menu select form item (#6642)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/area ui
/kind feature
/milestone 2.20.x

#### What this PR does / why we need it:

为 FormKit 添加菜单选择输入类型

<img width="549" alt="image" src="https://github.com/user-attachments/assets/b5e40c1d-908f-4cdc-89d5-76f9b67ae298">

#### Does this PR introduce a user-facing change?

```release-note
为 FormKit 添加菜单选择输入类型
```
---
 ui/docs/custom-formkit-input/README.md |  1 +
 ui/src/formkit/formkit.config.ts       |  7 ++++---
 ui/src/formkit/inputs/menu-select.ts   | 25 +++++++++++++++++++++++++
 3 files changed, 30 insertions(+), 3 deletions(-)
 create mode 100644 ui/src/formkit/inputs/menu-select.ts

diff --git a/ui/docs/custom-formkit-input/README.md b/ui/docs/custom-formkit-input/README.md
index 5be4f70e1a..72a4c8de2c 100644
--- a/ui/docs/custom-formkit-input/README.md
+++ b/ui/docs/custom-formkit-input/README.md
@@ -38,6 +38,7 @@
     9. removeControl: 是否显示删除按钮，默认为 `true`
 - `menuCheckbox`：选择一组菜单
 - `menuRadio`：选择一个菜单
+- `menuSelect`: 通用菜单选择组件，支持单选、多选、排序
 - `menuItemSelect`：选择菜单项
 - `postSelect`：选择文章
 - `singlePageSelect`：选择自定义页面
diff --git a/ui/src/formkit/formkit.config.ts b/ui/src/formkit/formkit.config.ts
index 0428c45612..93108633fa 100644
--- a/ui/src/formkit/formkit.config.ts
+++ b/ui/src/formkit/formkit.config.ts
@@ -1,5 +1,5 @@
 import { en, zh } from "@formkit/i18n";
-import { group as nativeGroup } from "@formkit/inputs";
+import { group as nativeGroup, select as nativeSelect } from "@formkit/inputs";
 import { generateClasses } from "@formkit/themes";
 import type { DefaultConfigOptions } from "@formkit/vue";
 import { attachment } from "./inputs/attachment";
@@ -19,14 +19,14 @@ import { postSelect } from "./inputs/post-select";
 import { repeater } from "./inputs/repeater";
 import { roleSelect } from "./inputs/role-select";
 import { secret } from "./inputs/secret";
+import { select } from "./inputs/select";
 import { singlePageSelect } from "./inputs/singlePage-select";
 import { tagCheckbox } from "./inputs/tag-checkbox";
 import { tagSelect } from "./inputs/tag-select";
 import { verificationForm } from "./inputs/verify-form";
-import { select as nativeSelect } from "@formkit/inputs";
-import { select } from "./inputs/select";
 import theme from "./theme";
 
+import { menuSelect } from "./inputs/menu-select";
 import { userSelect } from "./inputs/user-select";
 import autoScrollToErrors from "./plugins/auto-scroll-to-errors";
 import passwordPreventAutocomplete from "./plugins/password-prevent-autocomplete";
@@ -58,6 +58,7 @@ const config: DefaultConfigOptions = {
     menuCheckbox,
     menuItemSelect,
     menuRadio,
+    menuSelect,
     nativeGroup,
     password,
     postSelect,
diff --git a/ui/src/formkit/inputs/menu-select.ts b/ui/src/formkit/inputs/menu-select.ts
new file mode 100644
index 0000000000..1ffc864659
--- /dev/null
+++ b/ui/src/formkit/inputs/menu-select.ts
@@ -0,0 +1,25 @@
+import type { FormKitNode, FormKitTypeDefinition } from "@formkit/core";
+import { coreApiClient } from "@halo-dev/api-client";
+import { select } from "./select";
+
+function optionsHandler(node: FormKitNode) {
+  node.on("created", async () => {
+    const { data } = await coreApiClient.menu.listMenu();
+
+    if (node.context) {
+      node.context.attrs.options = data.items.map((menu) => {
+        return {
+          value: menu.metadata.name,
+          label: menu.spec.displayName,
+        };
+      });
+    }
+  });
+}
+
+export const menuSelect: FormKitTypeDefinition = {
+  ...select,
+  props: [...(select.props as string[])],
+  forceTypeProp: "select",
+  features: [optionsHandler],
+};

From 6a5e9c49320081ee1aa9761f924d99abeea6aedf Mon Sep 17 00:00:00 2001
From: John Niang <johnniang@foxmail.com>
Date: Thu, 12 Sep 2024 17:12:22 +0800
Subject: [PATCH 013/185] Fix the problem of resolving locale context by
 language parameter (#6647)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/kind bug
/area theme
/milestone 2.20.x

#### What this PR does / why we need it:

If we pass a query `language` while requesting index page, we will get the wrong header `Content-Language`. Please see the result below:

```bash
http https://www.halo.run/\?language\=zh-CN -p h

HTTP/1.1 200 OK
Content-Language: und
...
```

After fixing, we will get the right header `Content-Language`.

```bash
http http://localhost:8090/\?language\=zh-CN -p h

HTTP/1.1 200 OK
Content-Language: zh-CN
...
```

#### Does this PR introduce a user-facing change?

```release-note
修复主题端区域和语言解析错误的问题
```
---
 .../java/run/halo/app/theme/ThemeLocaleContextResolver.java   | 2 +-
 .../run/halo/app/theme/ThemeLocaleContextResolverTest.java    | 4 ++++
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/application/src/main/java/run/halo/app/theme/ThemeLocaleContextResolver.java b/application/src/main/java/run/halo/app/theme/ThemeLocaleContextResolver.java
index cf82601a5f..65d7e2289c 100644
--- a/application/src/main/java/run/halo/app/theme/ThemeLocaleContextResolver.java
+++ b/application/src/main/java/run/halo/app/theme/ThemeLocaleContextResolver.java
@@ -51,7 +51,7 @@ private Locale getLocale(ServerWebExchange exchange) {
 
         Locale locale;
         if (StringUtils.isNotBlank(language)) {
-            locale = new Locale(language);
+            locale = Locale.forLanguageTag(language);
         } else if (exchange.getAttribute(LOCALE_REQUEST_ATTRIBUTE_NAME) != null) {
             locale = exchange.getAttribute(LOCALE_REQUEST_ATTRIBUTE_NAME);
         } else {
diff --git a/application/src/test/java/run/halo/app/theme/ThemeLocaleContextResolverTest.java b/application/src/test/java/run/halo/app/theme/ThemeLocaleContextResolverTest.java
index 8ab62e89e2..8662382e49 100644
--- a/application/src/test/java/run/halo/app/theme/ThemeLocaleContextResolverTest.java
+++ b/application/src/test/java/run/halo/app/theme/ThemeLocaleContextResolverTest.java
@@ -62,6 +62,10 @@ public void resolveFromParam() {
             .isEqualTo(ENGLISH);
         assertThat(this.resolver.resolveLocaleContext(exchangeForParam("zh")).getLocale())
             .isEqualTo(CHINESE);
+        assertThat(this.resolver.resolveLocaleContext(exchangeForParam("zh-CN")).getLocale())
+            .isEqualTo(CHINA);
+        assertThat(this.resolver.resolveLocaleContext(exchangeForParam("zh-cn")).getLocale())
+            .isEqualTo(CHINA);
     }
 
     @Test

From 07d200b45b67035b8ed5ec1d7957eaf59e24b453 Mon Sep 17 00:00:00 2001
From: guqing <38999863+guqing@users.noreply.github.com>
Date: Thu, 12 Sep 2024 17:13:19 +0800
Subject: [PATCH 014/185] Trigger attachment status update on storage policy
 config change (#6639)

---
 .../app/core/extension/attachment/Policy.java |   1 +
 .../PolicyConfigChangeDetector.java           | 141 ++++++++++++++++++
 .../reconciler/PolicyReconciler.java          |  44 ++++++
 .../extensions/attachment-local-policy.yaml   |   4 +-
 .../PolicyConfigChangeDetectorTest.java       |  65 ++++++++
 5 files changed, 254 insertions(+), 1 deletion(-)
 create mode 100644 application/src/main/java/run/halo/app/core/attachment/PolicyConfigChangeDetector.java
 create mode 100644 application/src/main/java/run/halo/app/core/attachment/reconciler/PolicyReconciler.java
 create mode 100644 application/src/test/java/run/halo/app/core/attachment/PolicyConfigChangeDetectorTest.java

diff --git a/api/src/main/java/run/halo/app/core/extension/attachment/Policy.java b/api/src/main/java/run/halo/app/core/extension/attachment/Policy.java
index 450548a9f0..de90f29273 100644
--- a/api/src/main/java/run/halo/app/core/extension/attachment/Policy.java
+++ b/api/src/main/java/run/halo/app/core/extension/attachment/Policy.java
@@ -16,6 +16,7 @@
 @GVK(group = Constant.GROUP, version = Constant.VERSION, kind = KIND,
     plural = "policies", singular = "policy")
 public class Policy extends AbstractExtension {
+    public static final String POLICY_OWNER_LABEL = "storage.halo.run/policy-owner";
 
     public static final String KIND = "Policy";
 
diff --git a/application/src/main/java/run/halo/app/core/attachment/PolicyConfigChangeDetector.java b/application/src/main/java/run/halo/app/core/attachment/PolicyConfigChangeDetector.java
new file mode 100644
index 0000000000..e8c43bbb92
--- /dev/null
+++ b/application/src/main/java/run/halo/app/core/attachment/PolicyConfigChangeDetector.java
@@ -0,0 +1,141 @@
+package run.halo.app.core.attachment;
+
+import static run.halo.app.extension.index.query.QueryFactory.equal;
+
+import java.time.Duration;
+import java.time.Instant;
+import java.util.List;
+import lombok.RequiredArgsConstructor;
+import org.springframework.context.SmartLifecycle;
+import org.springframework.data.domain.Sort;
+import org.springframework.stereotype.Component;
+import run.halo.app.core.extension.attachment.Attachment;
+import run.halo.app.core.extension.attachment.Policy;
+import run.halo.app.extension.ConfigMap;
+import run.halo.app.extension.ExtensionClient;
+import run.halo.app.extension.ExtensionMatcher;
+import run.halo.app.extension.GroupVersionKind;
+import run.halo.app.extension.ListOptions;
+import run.halo.app.extension.MetadataUtil;
+import run.halo.app.extension.controller.Controller;
+import run.halo.app.extension.controller.ControllerBuilder;
+import run.halo.app.extension.controller.DefaultController;
+import run.halo.app.extension.controller.DefaultQueue;
+import run.halo.app.extension.controller.Reconciler;
+import run.halo.app.extension.controller.RequestQueue;
+
+/**
+ * <p>Detects changes to {@link ConfigMap} that are referenced by {@link Policy} and updates the
+ * {@link Attachment} with the {@link Policy} reference to reflect the change.</p>
+ * <p>Without this, the link to the attachment corresponding to the storage policy configuration
+ * change may not be correctly updated and only the service can be restarted.</p>
+ *
+ * @author guqing
+ * @since 2.20.0
+ */
+@Component
+@RequiredArgsConstructor
+public class PolicyConfigChangeDetector implements Reconciler<Reconciler.Request> {
+    static final String POLICY_UPDATED_AT = "storage.halo.run/policy-updated-at";
+    private final GroupVersionKind attachmentGvk = GroupVersionKind.fromExtension(Attachment.class);
+    private final ExtensionClient client;
+    private final AttachmentUpdateTrigger attachmentUpdateTrigger;
+
+    @Override
+    public Result reconcile(Request request) {
+        client.fetch(ConfigMap.class, request.name())
+            .ifPresent(configMap -> {
+                var labels = configMap.getMetadata().getLabels();
+                if (labels == null || !labels.containsKey(Policy.POLICY_OWNER_LABEL)) {
+                    return;
+                }
+                var policyName = labels.get(Policy.POLICY_OWNER_LABEL);
+                var attachmentNames = client.indexedQueryEngine()
+                    .retrieveAll(attachmentGvk, ListOptions.builder()
+                            .andQuery(equal("spec.policyName", policyName))
+                            .build(),
+                        Sort.unsorted()
+                    );
+                attachmentUpdateTrigger.addAll(attachmentNames);
+            });
+        return Result.doNotRetry();
+    }
+
+    @Override
+    public Controller setupWith(ControllerBuilder builder) {
+        ExtensionMatcher matcher = extension -> {
+            var configMap = (ConfigMap) extension;
+            var labels = configMap.getMetadata().getLabels();
+            return labels != null && labels.containsKey(Policy.POLICY_OWNER_LABEL);
+        };
+        return builder
+            .extension(new ConfigMap())
+            .syncAllOnStart(false)
+            .onAddMatcher(matcher)
+            .onUpdateMatcher(matcher)
+            .onDeleteMatcher(matcher)
+            .build();
+    }
+
+    @Component
+    static class AttachmentUpdateTrigger implements Reconciler<String>, SmartLifecycle {
+        private final RequestQueue<String> queue;
+
+        private final Controller controller;
+
+        private volatile boolean running = false;
+
+        private final ExtensionClient client;
+
+        public AttachmentUpdateTrigger(ExtensionClient client) {
+            this.client = client;
+            this.queue = new DefaultQueue<>(Instant::now);
+            this.controller = this.setupWith(null);
+        }
+
+        @Override
+        public Result reconcile(String name) {
+            client.fetch(Attachment.class, name).ifPresent(attachment -> {
+                var annotations = MetadataUtil.nullSafeAnnotations(attachment);
+                annotations.put(POLICY_UPDATED_AT, Instant.now().toString());
+                client.update(attachment);
+            });
+            return Result.doNotRetry();
+        }
+
+        void addAll(List<String> names) {
+            for (String name : names) {
+                queue.addImmediately(name);
+            }
+        }
+
+        @Override
+        public Controller setupWith(ControllerBuilder builder) {
+            return new DefaultController<>(
+                "PolicyChangeAttachmentUpdater",
+                this,
+                queue,
+                null,
+                Duration.ofMillis(100),
+                Duration.ofMinutes(10)
+            );
+        }
+
+        @Override
+        public void start() {
+            controller.start();
+            running = true;
+        }
+
+        @Override
+        public void stop() {
+            running = false;
+            controller.dispose();
+        }
+
+        @Override
+        public boolean isRunning() {
+            return running;
+        }
+    }
+}
diff --git a/application/src/main/java/run/halo/app/core/attachment/reconciler/PolicyReconciler.java b/application/src/main/java/run/halo/app/core/attachment/reconciler/PolicyReconciler.java
new file mode 100644
index 0000000000..000b5bd102
--- /dev/null
+++ b/application/src/main/java/run/halo/app/core/attachment/reconciler/PolicyReconciler.java
@@ -0,0 +1,44 @@
+package run.halo.app.core.attachment.reconciler;
+
+import lombok.RequiredArgsConstructor;
+import org.springframework.stereotype.Component;
+import run.halo.app.core.extension.attachment.Policy;
+import run.halo.app.extension.ConfigMap;
+import run.halo.app.extension.ExtensionClient;
+import run.halo.app.extension.MetadataUtil;
+import run.halo.app.extension.controller.Controller;
+import run.halo.app.extension.controller.ControllerBuilder;
+import run.halo.app.extension.controller.Reconciler;
+
+@Component
+@RequiredArgsConstructor
+public class PolicyReconciler implements Reconciler<Reconciler.Request> {
+    private final ExtensionClient client;
+
+    @Override
+    public Result reconcile(Request request) {
+        client.fetch(Policy.class, request.name())
+            .ifPresent(this::checkOwnerLabel);
+        return Result.doNotRetry();
+    }
+
+    private void checkOwnerLabel(Policy policy) {
+        var policyName = policy.getMetadata().getName();
+        var configMapName = policy.getSpec().getConfigMapName();
+        client.fetch(ConfigMap.class, configMapName)
+            .ifPresent(configMap -> {
+                var labels = MetadataUtil.nullSafeLabels(configMap);
+                labels.put(Policy.POLICY_OWNER_LABEL, policyName);
+                client.update(configMap);
+            });
+    }
+
+    @Override
+    public Controller setupWith(ControllerBuilder builder) {
+        return builder
+            .extension(new Policy())
+            // sync on start for compatible with previous data
+            .syncAllOnStart(true)
+            .build();
+    }
+}
diff --git a/application/src/main/resources/extensions/attachment-local-policy.yaml b/application/src/main/resources/extensions/attachment-local-policy.yaml
index c4a331c723..faba8b06f3 100644
--- a/application/src/main/resources/extensions/attachment-local-policy.yaml
+++ b/application/src/main/resources/extensions/attachment-local-policy.yaml
@@ -19,6 +19,8 @@ apiVersion: v1alpha1
 kind: ConfigMap
 metadata:
   name: default-policy-config
+  labels:
+    storage.halo.run/policy-owner: default-policy
 data:
   default: "{\"location\":\"\"}"
 ---
@@ -38,7 +40,7 @@ spec:
         - $formkit: text
           name: maxFileSize
           label: 最大单文件大小
-          validation: [['matches', '/^(0|[1-9]\d*)(?:[KMG]B)?$/']]
+          validation: [ [ 'matches', '/^(0|[1-9]\d*)(?:[KMG]B)?$/' ] ]
           validation-visibility: "live"
           validation-messages:
             matches: "输入格式错误，遵循：整数 + 大写的单位（KB, MB, GB）"
diff --git a/application/src/test/java/run/halo/app/core/attachment/PolicyConfigChangeDetectorTest.java b/application/src/test/java/run/halo/app/core/attachment/PolicyConfigChangeDetectorTest.java
new file mode 100644
index 0000000000..9954a7962e
--- /dev/null
+++ b/application/src/test/java/run/halo/app/core/attachment/PolicyConfigChangeDetectorTest.java
@@ -0,0 +1,65 @@
+package run.halo.app.core.attachment;
+
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.spy;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+import run.halo.app.core.extension.attachment.Attachment;
+import run.halo.app.core.extension.attachment.Policy;
+import run.halo.app.extension.ConfigMap;
+import run.halo.app.extension.ExtensionClient;
+import run.halo.app.extension.GroupVersionKind;
+import run.halo.app.extension.Metadata;
+import run.halo.app.extension.controller.Reconciler;
+import run.halo.app.extension.index.IndexedQueryEngine;
+
+/**
+ * Tests for {@link PolicyConfigChangeDetector}.
+ *
+ * @author guqing
+ * @since 2.20.0
+ */
+@ExtendWith(MockitoExtension.class)
+class PolicyConfigChangeDetectorTest {
+
+    @Mock
+    private PolicyConfigChangeDetector.AttachmentUpdateTrigger updateTrigger;
+
+    @Mock
+    private ExtensionClient client;
+
+    @InjectMocks
+    private PolicyConfigChangeDetector policyConfigChangeDetector;
+
+    @Test
+    void reconcileTest() {
+        final var spyDetector = spy(policyConfigChangeDetector);
+
+        var configMap = new ConfigMap();
+        configMap.setMetadata(new Metadata());
+        configMap.getMetadata().setLabels(Map.of(Policy.POLICY_OWNER_LABEL, "fake-policy"));
+
+        when(client.fetch(eq(ConfigMap.class), eq("fake-config")))
+            .thenReturn(Optional.of(configMap));
+
+        var indexQueryEngine = mock(IndexedQueryEngine.class);
+        when(client.indexedQueryEngine()).thenReturn(indexQueryEngine);
+        when(indexQueryEngine.retrieveAll(eq(GroupVersionKind.fromExtension(Attachment.class)),
+            any(), any())).thenReturn(List.of("fake-attachment"));
+
+        spyDetector.reconcile(new Reconciler.Request("fake-config"));
+
+        verify(updateTrigger).addAll(List.of("fake-attachment"));
+    }
+}

From 7ed859cefb1165cd9789af1728a06cf272957fea Mon Sep 17 00:00:00 2001
From: guqing <38999863+guqing@users.noreply.github.com>
Date: Fri, 13 Sep 2024 10:14:25 +0800
Subject: [PATCH 015/185] refactor: prevent replies to comments that are
 pending approval (#6622)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?
/kind improvement
/area core
/milestone 2.20.x

#### What this PR does / why we need it:
不允许回复未通过审核的评论

#### Does this PR introduce a user-facing change?
```release-note
禁止非管理员回复未通过审核的评论
```
---
 .../app/content/comment/ReplyServiceImpl.java | 64 +++++++++++--------
 .../exception/RequestRestrictedException.java | 24 +++++++
 .../resources/config/i18n/messages.properties |  2 +
 .../config/i18n/messages_zh.properties        |  2 +
 4 files changed, 67 insertions(+), 25 deletions(-)
 create mode 100644 application/src/main/java/run/halo/app/infra/exception/RequestRestrictedException.java

diff --git a/application/src/main/java/run/halo/app/content/comment/ReplyServiceImpl.java b/application/src/main/java/run/halo/app/content/comment/ReplyServiceImpl.java
index a59bbd3479..26b99e63e9 100644
--- a/application/src/main/java/run/halo/app/content/comment/ReplyServiceImpl.java
+++ b/application/src/main/java/run/halo/app/content/comment/ReplyServiceImpl.java
@@ -1,5 +1,6 @@
 package run.halo.app.content.comment;
 
+import static org.apache.commons.lang3.BooleanUtils.isTrue;
 import static run.halo.app.extension.index.query.QueryFactory.and;
 import static run.halo.app.extension.index.query.QueryFactory.equal;
 import static run.halo.app.extension.index.query.QueryFactory.isNull;
@@ -8,8 +9,8 @@
 import java.time.Instant;
 import java.util.ArrayList;
 import java.util.function.Function;
+import java.util.function.Supplier;
 import java.util.function.UnaryOperator;
-import org.apache.commons.lang3.BooleanUtils;
 import org.apache.commons.lang3.StringUtils;
 import org.reactivestreams.Publisher;
 import org.springframework.dao.OptimisticLockingFailureException;
@@ -29,6 +30,7 @@
 import run.halo.app.extension.PageRequestImpl;
 import run.halo.app.extension.ReactiveExtensionClient;
 import run.halo.app.extension.router.selector.FieldSelector;
+import run.halo.app.infra.exception.RequestRestrictedException;
 import run.halo.app.metrics.CounterService;
 
 /**
@@ -40,6 +42,9 @@
 @Service
 public class ReplyServiceImpl extends AbstractCommentService implements ReplyService {
 
+    private final Supplier<RequestRestrictedException> requestRestrictedExceptionSupplier =
+        () -> new RequestRestrictedException("problemDetail.comment.waitingForApproval");
+
     public ReplyServiceImpl(RoleService roleService, ReactiveExtensionClient client,
         UserService userService, CounterService counterService) {
         super(roleService, client, userService, counterService);
@@ -48,26 +53,32 @@ public ReplyServiceImpl(RoleService roleService, ReactiveExtensionClient client,
     @Override
     public Mono<Reply> create(String commentName, Reply reply) {
         return client.get(Comment.class, commentName)
-            .flatMap(comment -> prepareReply(commentName, reply)
-                .flatMap(client::create)
-                .flatMap(createdReply -> {
-                    var quotedReply = createdReply.getSpec().getQuoteReply();
-                    if (StringUtils.isBlank(quotedReply)) {
-                        return Mono.just(createdReply);
-                    }
-                    return approveReply(quotedReply)
-                        .thenReturn(createdReply);
-                })
-                .flatMap(createdReply -> approveComment(comment)
-                    .thenReturn(createdReply)
-                )
-            );
+            .flatMap(this::approveComment)
+            .filter(comment -> isTrue(comment.getSpec().getApproved()))
+            .switchIfEmpty(Mono.error(requestRestrictedExceptionSupplier))
+            .flatMap(comment -> prepareReply(commentName, reply))
+            .flatMap(this::doCreateReply);
+    }
+
+    private Mono<Reply> doCreateReply(Reply prepared) {
+        var quotedReply = prepared.getSpec().getQuoteReply();
+        if (StringUtils.isBlank(quotedReply)) {
+            return client.create(prepared);
+        }
+        return approveReply(quotedReply)
+            .filter(reply -> isTrue(reply.getSpec().getApproved()))
+            .switchIfEmpty(Mono.error(requestRestrictedExceptionSupplier))
+            .flatMap(approvedQuoteReply -> client.create(prepared));
     }
 
     private Mono<Comment> approveComment(Comment comment) {
         return hasCommentManagePermission()
-            .filter(Boolean::booleanValue)
-            .flatMap(hasPermission -> doApproveComment(comment));
+            .flatMap(hasPermission -> {
+                if (hasPermission) {
+                    return doApproveComment(comment);
+                }
+                return Mono.just(comment);
+            });
     }
 
     private Mono<Comment> doApproveComment(Comment comment) {
@@ -81,14 +92,18 @@ private Mono<Comment> doApproveComment(Comment comment) {
                 e -> updateCommentWithRetry(comment.getMetadata().getName(), updateFunc));
     }
 
-    private Mono<Void> approveReply(String replyName) {
+    private Mono<Reply> approveReply(String replyName) {
         return hasCommentManagePermission()
-            .filter(Boolean::booleanValue)
-            .flatMap(hasPermission -> doApproveReply(replyName));
+            .flatMap(hasPermission -> {
+                if (hasPermission) {
+                    return doApproveReply(replyName);
+                }
+                return client.get(Reply.class, replyName);
+            });
     }
 
-    private Mono<Void> doApproveReply(String replyName) {
-        return Mono.defer(() -> client.fetch(Reply.class, replyName)
+    private Mono<Reply> doApproveReply(String replyName) {
+        return Mono.defer(() -> client.get(Reply.class, replyName)
                 .flatMap(reply -> {
                     reply.getSpec().setApproved(true);
                     reply.getSpec().setApprovedTime(Instant.now());
@@ -96,8 +111,7 @@ private Mono<Void> doApproveReply(String replyName) {
                 })
             )
             .retryWhen(Retry.backoff(8, Duration.ofMillis(100))
-                .filter(OptimisticLockingFailureException.class::isInstance))
-            .then();
+                .filter(OptimisticLockingFailureException.class::isInstance));
     }
 
     private Mono<Comment> updateCommentWithRetry(String name, UnaryOperator<Comment> updateFunc) {
@@ -123,7 +137,7 @@ private Mono<Reply> prepareReply(String commentName, Reply reply) {
         if (reply.getSpec().getApproved() == null) {
             reply.getSpec().setApproved(false);
         }
-        if (BooleanUtils.isTrue(reply.getSpec().getApproved())
+        if (isTrue(reply.getSpec().getApproved())
             && reply.getSpec().getApprovedTime() == null) {
             reply.getSpec().setApprovedTime(Instant.now());
         }
diff --git a/application/src/main/java/run/halo/app/infra/exception/RequestRestrictedException.java b/application/src/main/java/run/halo/app/infra/exception/RequestRestrictedException.java
new file mode 100644
index 0000000000..1d86edffca
--- /dev/null
+++ b/application/src/main/java/run/halo/app/infra/exception/RequestRestrictedException.java
@@ -0,0 +1,24 @@
+package run.halo.app.infra.exception;
+
+/**
+ * <p>{@link RequestRestrictedException} indicates that the client's request was denied because
+ * it did not meet certain required conditions.</p>
+ * <p>Typically, this exception is thrown when a user attempts to perform an action that
+ * requires prior approval or validation, such as replying to a comment that has not yet been
+ * approved.</p>
+ * <p>The server understands the request but refuses to process it due to the lack of
+ * necessary approval.</p>
+ *
+ * @author guqing
+ * @since 2.20.0
+ */
+public class RequestRestrictedException extends AccessDeniedException {
+
+    public RequestRestrictedException(String reason) {
+        super(reason);
+    }
+
+    public RequestRestrictedException(String reason, String detailCode, Object[] detailArgs) {
+        super(reason, detailCode, detailArgs);
+    }
+}
diff --git a/application/src/main/resources/config/i18n/messages.properties b/application/src/main/resources/config/i18n/messages.properties
index 8d1bf19bd2..8a2e0dca03 100644
--- a/application/src/main/resources/config/i18n/messages.properties
+++ b/application/src/main/resources/config/i18n/messages.properties
@@ -14,6 +14,7 @@ problemDetail.title.run.halo.app.infra.exception.AttachmentAlreadyExistsExceptio
 problemDetail.title.run.halo.app.infra.exception.FileTypeNotAllowedException=File Type Not Allowed
 problemDetail.title.run.halo.app.infra.exception.FileSizeExceededException=File Size Exceeded
 problemDetail.title.run.halo.app.infra.exception.AccessDeniedException=Access Denied
+problemDetail.title.run.halo.app.infra.exception.RequestRestrictedException=Request Restricted
 problemDetail.title.reactor.core.Exceptions.RetryExhaustedException=Retry Exhausted
 problemDetail.title.run.halo.app.infra.exception.ThemeInstallationException=Theme Install Error
 problemDetail.title.run.halo.app.infra.exception.ThemeUpgradeException=Theme Upgrade Error
@@ -79,5 +80,6 @@ problemDetail.conflict=Conflict detected, please check the data and retry.
 problemDetail.migration.backup.notFound=The backup file does not exist or has been deleted.
 problemDetail.attachment.upload.fileSizeExceeded=Make sure the file size is less than {0}.
 problemDetail.attachment.upload.fileTypeNotSupported=Unsupported upload of {0} type files.
+problemDetail.comment.waitingForApproval=Comment is awaiting approval.
 
 title.visibility.identification.private=(Private)
\ No newline at end of file
diff --git a/application/src/main/resources/config/i18n/messages_zh.properties b/application/src/main/resources/config/i18n/messages_zh.properties
index 818f7e35e9..fa5699ea06 100644
--- a/application/src/main/resources/config/i18n/messages_zh.properties
+++ b/application/src/main/resources/config/i18n/messages_zh.properties
@@ -5,6 +5,7 @@ problemDetail.title.run.halo.app.infra.exception.PluginInstallationException=插
 problemDetail.title.run.halo.app.infra.exception.AttachmentAlreadyExistsException=附件已存在
 problemDetail.title.run.halo.app.infra.exception.FileTypeNotAllowedException=文件类型不允许
 problemDetail.title.run.halo.app.infra.exception.FileSizeExceededException=文件大小超出限制
+problemDetail.title.run.halo.app.infra.exception.RequestRestrictedException=请求受限
 problemDetail.title.run.halo.app.infra.exception.DuplicateNameException=名称重复
 problemDetail.title.run.halo.app.infra.exception.PluginAlreadyExistsException=插件已存在
 problemDetail.title.run.halo.app.infra.exception.ThemeInstallationException=主题安装失败
@@ -51,5 +52,6 @@ problemDetail.conflict=检测到冲突，请检查数据后重试。
 problemDetail.migration.backup.notFound=备份文件不存在或已删除。
 problemDetail.attachment.upload.fileSizeExceeded=最大支持上传 {0} 大小的文件。
 problemDetail.attachment.upload.fileTypeNotSupported=不支持上传 {0} 类型的文件。
+problemDetail.comment.waitingForApproval=评论审核中。
 
 title.visibility.identification.private=（私有）
\ No newline at end of file

From 25eec1ec4f8391566f642b3fa2d73cf12fb88382 Mon Sep 17 00:00:00 2001
From: Takagi <1103069291@qq.com>
Date: Fri, 13 Sep 2024 10:22:26 +0800
Subject: [PATCH 016/185] pref: improve hover and pre-selection state for
 formkit select (#6607)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/kind improvement
/area ui
/milestone 2.20.x

#### What this PR does / why we need it:

优化了 Formkit 中的 selec 组件，使得其使用快捷键与鼠标选中的预选状态始终只有一个。且在多选状态下按回车时，不再预选跳转至第一个选项。

#### How to test it?

在多选状态下测试使用键盘进行预选及使用鼠标 hover 进行预选的状态是否符合预期。

#### Which issue(s) this PR fixes:

Fixes #6600

#### Does this PR introduce a user-facing change?
```release-note
优化 Formkit select 组件在多选状态下的待选中状态。
```
---
 ui/src/formkit/inputs/select/SelectOption.vue | 54 +++++++++++++++++--
 1 file changed, 51 insertions(+), 3 deletions(-)

diff --git a/ui/src/formkit/inputs/select/SelectOption.vue b/ui/src/formkit/inputs/select/SelectOption.vue
index 41d248193d..b1f782d5bb 100644
--- a/ui/src/formkit/inputs/select/SelectOption.vue
+++ b/ui/src/formkit/inputs/select/SelectOption.vue
@@ -27,6 +27,8 @@ const emit = defineEmits<{
 
 const selectedIndex = ref<number>(0);
 const selectOptionRef = ref<HTMLElement>();
+const oldEvent = ref<MouseEvent | undefined>();
+const isCursorHidden = ref(false);
 
 const selectedValues = computed(() =>
   props.selectedOptions?.map((option) => option.value)
@@ -46,6 +48,9 @@ const getSelectedIndex = () => {
 };
 
 const handleKeydown = (event: KeyboardEvent) => {
+  if (selectOptionRef.value) {
+    isCursorHidden.value = true;
+  }
   const key = event.key;
   if (key === "ArrowUp") {
     selectedIndex.value =
@@ -138,7 +143,7 @@ const handleOptionScroll = (state: UseScrollReturn) => {
 };
 
 watch(
-  () => props.options,
+  props.options,
   () => {
     selectedIndex.value = getSelectedIndex();
   },
@@ -153,6 +158,48 @@ watch(
     handleScrollIntoView();
   }
 );
+
+/**
+ * check if cursor is changed
+ *
+ * @param newEvent
+ * @param oldEvent
+ */
+const isCursorChanged = (
+  newEvent: MouseEvent,
+  oldEvent: MouseEvent | undefined
+) => {
+  if (!oldEvent) {
+    return true;
+  }
+  return (
+    newEvent.screenX !== oldEvent.screenX ||
+    newEvent.screenY !== oldEvent.screenY
+  );
+};
+
+const handleMouseover = (event: MouseEvent) => {
+  if (isCursorHidden.value) {
+    if (!oldEvent.value) {
+      oldEvent.value = event;
+    }
+
+    if (isCursorChanged(event, oldEvent.value)) {
+      isCursorHidden.value = false;
+      oldEvent.value = undefined;
+    }
+    return;
+  }
+  const target = event.target as HTMLElement;
+  if (
+    target.classList.contains("select-option-item") &&
+    target instanceof HTMLElement
+  ) {
+    const parentElement = target.parentElement as HTMLElement;
+    const index = Array.from(parentElement.children).indexOf(target);
+    selectedIndex.value = index;
+  }
+};
 </script>
 
 <template>
@@ -160,17 +207,18 @@ watch(
     id="select-option"
     ref="selectOptionRef"
     v-scroll="[handleOptionScroll, { throttle: 10 }]"
-    class="select max-h-64 cursor-pointer overflow-y-auto p-1.5"
+    class="select max-h-64 overflow-y-auto p-1.5"
+    :class="[isCursorHidden ? 'cursor-none' : 'cursor-pointer']"
     role="list"
     tabindex="-1"
     @keydown="handleKeydown"
+    @mouseover="handleMouseover"
   >
     <template v-for="(option, index) in options" :key="option.value">
       <SelectOptionItem
         class="select-option-item"
         :option="option"
         :class="{
-          'hover:bg-zinc-100': !isDisabled(option),
           'bg-zinc-100': !isDisabled(option) && selectedIndex === index,
           'selected !bg-zinc-200/60':
             selectedValues && selectedValues.includes(option.value),

From 8ab8a440b6f1c496ce875c711454b24c62a7186d Mon Sep 17 00:00:00 2001
From: John Niang <johnniang@foxmail.com>
Date: Fri, 13 Sep 2024 15:44:26 +0800
Subject: [PATCH 017/185] Simplify ThemeLocaleContextResolver (#6651)

#### What type of PR is this?

/kind improvement
/area theme
/milestone 2.20.x

#### What this PR does / why we need it:

This PR simplifies ThemeLocaleContextResolver by removing unused attributes.

In another PR <https://github.com/halo-dev/halo/pull/6647>, fixed locale resolution for query parameter `language`. This PR fixes locale resolution for cookie `language` as well.

Please see the results below:

```bash
http https://www.halo.run/ Cookie:language=zh-CN -p h

HTTP/1.1 200 OK
Content-Language: und
```

```bash
http http://localhost:8090 Cookie:language=zh-CN -p h

HTTP/1.1 200 OK
Content-Language: zh-CN
```

#### Does this PR introduce a user-facing change?

```release-note
None
```
---
 .../app/theme/ThemeLocaleContextResolver.java | 82 +++++++------------
 .../theme/ThemeLocaleContextResolverTest.java |  4 +-
 2 files changed, 30 insertions(+), 56 deletions(-)

diff --git a/application/src/main/java/run/halo/app/theme/ThemeLocaleContextResolver.java b/application/src/main/java/run/halo/app/theme/ThemeLocaleContextResolver.java
index 65d7e2289c..9220690a3c 100644
--- a/application/src/main/java/run/halo/app/theme/ThemeLocaleContextResolver.java
+++ b/application/src/main/java/run/halo/app/theme/ThemeLocaleContextResolver.java
@@ -1,15 +1,15 @@
 package run.halo.app.theme;
 
 import java.util.Locale;
+import java.util.Optional;
 import java.util.TimeZone;
-import java.util.function.Function;
 import lombok.extern.slf4j.Slf4j;
 import org.apache.commons.lang3.StringUtils;
 import org.springframework.context.i18n.LocaleContext;
 import org.springframework.context.i18n.SimpleTimeZoneAwareLocaleContext;
 import org.springframework.http.HttpCookie;
+import org.springframework.http.server.reactive.ServerHttpRequest;
 import org.springframework.lang.NonNull;
-import org.springframework.lang.Nullable;
 import org.springframework.stereotype.Component;
 import org.springframework.web.server.ServerWebExchange;
 import org.springframework.web.server.adapter.WebHttpHandlerBuilder;
@@ -22,71 +22,45 @@
 @Slf4j
 @Component(WebHttpHandlerBuilder.LOCALE_CONTEXT_RESOLVER_BEAN_NAME)
 public class ThemeLocaleContextResolver extends AcceptHeaderLocaleContextResolver {
-    public static final String TIME_ZONE_REQUEST_ATTRIBUTE_NAME =
-        ThemeLocaleContextResolver.class.getName() + ".TIME_ZONE";
-    public static final String LOCALE_REQUEST_ATTRIBUTE_NAME =
-        ThemeLocaleContextResolver.class.getName() + ".LOCALE";
 
-    public static final String DEFAULT_PARAMETER_NAME = "language";
-    public static final String TIME_ZONE_COOKIE_NAME = "time_zone";
+    public static final String LANGUAGE_PARAMETER_NAME = "language";
+
+    public static final String LANGUAGE_COOKIE_NAME = LANGUAGE_PARAMETER_NAME;
 
-    private final Function<ServerWebExchange, TimeZone> defaultTimeZoneFunction =
-        exchange -> getDefaultTimeZone();
+    public static final String TIME_ZONE_COOKIE_NAME = "time_zone";
 
     @Override
     @NonNull
     public LocaleContext resolveLocaleContext(@NonNull ServerWebExchange exchange) {
-        parseLocaleCookieIfNecessary(exchange);
+        var request = exchange.getRequest();
+        var locale = getLocaleFromQueryParameter(request)
+            .or(() -> getLocaleFromCookie(request))
+            .orElseGet(() -> super.resolveLocaleContext(exchange).getLocale());
 
-        Locale locale = getLocale(exchange);
+        var timeZone = getTimeZoneFromCookie(request)
+            .orElseGet(TimeZone::getDefault);
 
-        return new SimpleTimeZoneAwareLocaleContext(locale,
-            exchange.getAttribute(TIME_ZONE_REQUEST_ATTRIBUTE_NAME));
+        return new SimpleTimeZoneAwareLocaleContext(locale, timeZone);
     }
 
-    @Nullable
-    private Locale getLocale(ServerWebExchange exchange) {
-        String language = exchange.getRequest().getQueryParams()
-            .getFirst(DEFAULT_PARAMETER_NAME);
-
-        Locale locale;
-        if (StringUtils.isNotBlank(language)) {
-            locale = Locale.forLanguageTag(language);
-        } else if (exchange.getAttribute(LOCALE_REQUEST_ATTRIBUTE_NAME) != null) {
-            locale = exchange.getAttribute(LOCALE_REQUEST_ATTRIBUTE_NAME);
-        } else {
-            locale = super.resolveLocaleContext(exchange).getLocale();
-        }
-        return locale;
+    private Optional<Locale> getLocaleFromCookie(ServerHttpRequest request) {
+        return Optional.ofNullable(request.getCookies().getFirst(LANGUAGE_COOKIE_NAME))
+            .map(HttpCookie::getValue)
+            .filter(StringUtils::isNotBlank)
+            .map(Locale::forLanguageTag);
     }
 
-    private TimeZone getDefaultTimeZone() {
-        return TimeZone.getDefault();
+    private Optional<Locale> getLocaleFromQueryParameter(ServerHttpRequest request) {
+        return Optional.ofNullable(request.getQueryParams().getFirst(LANGUAGE_PARAMETER_NAME))
+            .filter(StringUtils::isNotBlank)
+            .map(Locale::forLanguageTag);
     }
 
-    private void parseLocaleCookieIfNecessary(ServerWebExchange exchange) {
-        if (exchange.getAttribute(TIME_ZONE_REQUEST_ATTRIBUTE_NAME) == null) {
-            TimeZone timeZone = null;
-            HttpCookie cookie = exchange.getRequest()
-                .getCookies()
-                .getFirst(TIME_ZONE_COOKIE_NAME);
-            if (cookie != null) {
-                String value = cookie.getValue();
-                timeZone = TimeZone.getTimeZone(value);
-            }
-            exchange.getAttributes().put(TIME_ZONE_REQUEST_ATTRIBUTE_NAME,
-                (timeZone != null ? timeZone : this.defaultTimeZoneFunction.apply(exchange)));
-        }
-
-        if (exchange.getAttribute(LOCALE_REQUEST_ATTRIBUTE_NAME) == null) {
-            HttpCookie cookie = exchange.getRequest()
-                .getCookies()
-                .getFirst(DEFAULT_PARAMETER_NAME);
-            if (cookie != null) {
-                String value = cookie.getValue();
-                exchange.getAttributes()
-                    .put(LOCALE_REQUEST_ATTRIBUTE_NAME, new Locale(value));
-            }
-        }
+    private Optional<TimeZone> getTimeZoneFromCookie(ServerHttpRequest request) {
+        return Optional.ofNullable(request.getCookies().getFirst(TIME_ZONE_COOKIE_NAME))
+            .map(HttpCookie::getValue)
+            .filter(StringUtils::isNotBlank)
+            .map(TimeZone::getTimeZone);
     }
+
 }
diff --git a/application/src/test/java/run/halo/app/theme/ThemeLocaleContextResolverTest.java b/application/src/test/java/run/halo/app/theme/ThemeLocaleContextResolverTest.java
index 8662382e49..a1ada782e3 100644
--- a/application/src/test/java/run/halo/app/theme/ThemeLocaleContextResolverTest.java
+++ b/application/src/test/java/run/halo/app/theme/ThemeLocaleContextResolverTest.java
@@ -12,7 +12,7 @@
 import static java.util.Locale.UK;
 import static java.util.Locale.US;
 import static org.assertj.core.api.Assertions.assertThat;
-import static run.halo.app.theme.ThemeLocaleContextResolver.DEFAULT_PARAMETER_NAME;
+import static run.halo.app.theme.ThemeLocaleContextResolver.LANGUAGE_COOKIE_NAME;
 import static run.halo.app.theme.ThemeLocaleContextResolver.TIME_ZONE_COOKIE_NAME;
 
 import java.util.Arrays;
@@ -187,7 +187,7 @@ private ServerWebExchange exchangeTimeZone(Locale... locales) {
         return MockServerWebExchange.from(
             MockServerHttpRequest.get("").acceptLanguageAsLocales(locales)
                 .cookie(new HttpCookie(TIME_ZONE_COOKIE_NAME, "America/Adak"))
-                .cookie(new HttpCookie(DEFAULT_PARAMETER_NAME, "en")));
+                .cookie(new HttpCookie(LANGUAGE_COOKIE_NAME, "en")));
     }
 
     private ServerWebExchange exchangeForParam(String language) {

From 46793af0bd51fc7fad7ca3ce9c30718c4584965e Mon Sep 17 00:00:00 2001
From: Ryan Wang <i@ryanc.cc>
Date: Fri, 13 Sep 2024 17:40:26 +0800
Subject: [PATCH 018/185] fix: correct ordered list styling issue in editor
 (#6656)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/area ui
/kind bug
/milestone 2.20.x

#### What this PR does / why we need it:

修复编辑器中有序列表的样式问题。

#### Which issue(s) this PR fixes:

Fixes #6615

#### Does this PR introduce a user-facing change?

```release-note
修复编辑器中有序列表的样式问题。
```
---
 ui/packages/editor/src/styles/base.scss | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/ui/packages/editor/src/styles/base.scss b/ui/packages/editor/src/styles/base.scss
index c591fc182b..a558a2905b 100644
--- a/ui/packages/editor/src/styles/base.scss
+++ b/ui/packages/editor/src/styles/base.scss
@@ -75,7 +75,8 @@
         }
       }
 
-      ul {
+      ul,
+      ol {
         list-style-type: revert-layer;
       }
 

From c5f9c766bb2e04e7e5f8bf0f16c279c8b8af158b Mon Sep 17 00:00:00 2001
From: John Niang <johnniang@foxmail.com>
Date: Sat, 14 Sep 2024 10:48:29 +0800
Subject: [PATCH 019/185] Support changing locale using query language (#6658)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/kind improvement
/area core
/milestone 2.20.x

#### What this PR does / why we need it:

This PR adds support changing locale using query `language`. After passing the query, we will automatically respond a cookie `language` back to browser.

Please see the result below:

```bash
http http://localhost:8090/\?language\=zh-CN Accept:text/html -p h

HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Content-Language: zh-CN
Content-Type: text/html
Expires: 0
Pragma: no-cache
Referrer-Policy: strict-origin-when-cross-origin
Vary: Origin
Vary: Access-Control-Request-Method
Vary: Access-Control-Request-Headers
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 0
content-encoding: gzip
content-length: 4765
set-cookie: language=zh-CN; Path=/; Secure
set-cookie: XSRF-TOKEN=f0f2c972-0024-4575-aef2-0609356b4757; Path=/
```

#### Does this PR introduce a user-facing change?

```release-note
支持利用参数 language 切换地域语言
```
---
 .../app/webfilter/LocaleChangeWebFilter.java  | 59 ++++++++++++
 .../webfilter/LocaleChangeWebFilterTest.java  | 90 +++++++++++++++++++
 2 files changed, 149 insertions(+)
 create mode 100644 application/src/main/java/run/halo/app/webfilter/LocaleChangeWebFilter.java
 create mode 100644 application/src/test/java/run/halo/app/webfilter/LocaleChangeWebFilterTest.java

diff --git a/application/src/main/java/run/halo/app/webfilter/LocaleChangeWebFilter.java b/application/src/main/java/run/halo/app/webfilter/LocaleChangeWebFilter.java
new file mode 100644
index 0000000000..3329d34f3f
--- /dev/null
+++ b/application/src/main/java/run/halo/app/webfilter/LocaleChangeWebFilter.java
@@ -0,0 +1,59 @@
+package run.halo.app.webfilter;
+
+import static run.halo.app.theme.ThemeLocaleContextResolver.LANGUAGE_COOKIE_NAME;
+import static run.halo.app.theme.ThemeLocaleContextResolver.LANGUAGE_PARAMETER_NAME;
+
+import java.util.Locale;
+import java.util.Set;
+import org.springframework.http.HttpMethod;
+import org.springframework.http.MediaType;
+import org.springframework.http.ResponseCookie;
+import org.springframework.lang.NonNull;
+import org.springframework.security.web.server.util.matcher.AndServerWebExchangeMatcher;
+import org.springframework.security.web.server.util.matcher.MediaTypeServerWebExchangeMatcher;
+import org.springframework.security.web.server.util.matcher.ServerWebExchangeMatcher;
+import org.springframework.security.web.server.util.matcher.ServerWebExchangeMatcher.MatchResult;
+import org.springframework.security.web.server.util.matcher.ServerWebExchangeMatchers;
+import org.springframework.stereotype.Component;
+import org.springframework.util.StringUtils;
+import org.springframework.web.server.ServerWebExchange;
+import org.springframework.web.server.WebFilter;
+import org.springframework.web.server.WebFilterChain;
+import reactor.core.publisher.Mono;
+
+@Component
+public class LocaleChangeWebFilter implements WebFilter {
+
+    private final ServerWebExchangeMatcher matcher;
+
+    public LocaleChangeWebFilter() {
+        var pathMatcher = ServerWebExchangeMatchers.pathMatchers(HttpMethod.GET, "/**");
+        var textHtmlMatcher = new MediaTypeServerWebExchangeMatcher(MediaType.TEXT_HTML);
+        textHtmlMatcher.setIgnoredMediaTypes(Set.of(MediaType.ALL));
+        matcher = new AndServerWebExchangeMatcher(pathMatcher, textHtmlMatcher);
+    }
+
+    @Override
+    @NonNull
+    public Mono<Void> filter(ServerWebExchange exchange, WebFilterChain chain) {
+        var request = exchange.getRequest();
+        return matcher.matches(exchange)
+            .filter(MatchResult::isMatch)
+            .doOnNext(result -> {
+                var language = request
+                    .getQueryParams()
+                    .getFirst(LANGUAGE_PARAMETER_NAME);
+                if (StringUtils.hasText(language)) {
+                    var locale = Locale.forLanguageTag(language);
+                    exchange.getResponse()
+                        .addCookie(ResponseCookie.from(LANGUAGE_COOKIE_NAME, locale.toLanguageTag())
+                            .path("/")
+                            .secure(true)
+                            .build()
+                        );
+                }
+            })
+            .then(Mono.defer(() -> chain.filter(exchange)));
+    }
+
+}
diff --git a/application/src/test/java/run/halo/app/webfilter/LocaleChangeWebFilterTest.java b/application/src/test/java/run/halo/app/webfilter/LocaleChangeWebFilterTest.java
new file mode 100644
index 0000000000..0ec207fa83
--- /dev/null
+++ b/application/src/test/java/run/halo/app/webfilter/LocaleChangeWebFilterTest.java
@@ -0,0 +1,90 @@
+package run.halo.app.webfilter;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+
+import java.util.stream.Stream;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.MethodSource;
+import org.springframework.http.MediaType;
+import org.springframework.mock.http.server.reactive.MockServerHttpRequest;
+import org.springframework.mock.web.server.MockServerWebExchange;
+import org.springframework.web.server.WebFilterChain;
+import reactor.core.publisher.Mono;
+
+class LocaleChangeWebFilterTest {
+
+    LocaleChangeWebFilter filter;
+
+    @BeforeEach
+    void setUp() {
+        filter = new LocaleChangeWebFilter();
+    }
+
+    @Test
+    void shouldRespondLanguageCookie() {
+        WebFilterChain webFilterChain = filterExchange -> {
+            var languageCookie = filterExchange.getResponse().getCookies().getFirst("language");
+            assertNotNull(languageCookie);
+            assertEquals("zh-CN", languageCookie.getValue());
+            return Mono.empty();
+        };
+        var exchange = MockServerWebExchange.from(MockServerHttpRequest.get("/home")
+            .accept(MediaType.TEXT_HTML)
+            .queryParam("language", "zh-CN")
+            .build()
+        );
+        this.filter.filter(exchange, webFilterChain).block();
+    }
+
+    @Test
+    void shouldRespondLanguageCookieWithUndefinedLanguageTag() {
+        WebFilterChain webFilterChain = filterExchange -> {
+            var languageCookie = filterExchange.getResponse().getCookies().getFirst("language");
+            assertNotNull(languageCookie);
+            assertEquals("und", languageCookie.getValue());
+            return Mono.empty();
+        };
+        var exchange = MockServerWebExchange.from(MockServerHttpRequest.get("/home")
+            .accept(MediaType.TEXT_HTML)
+            .queryParam("language", "invalid_language_tag")
+            .build()
+        );
+        this.filter.filter(exchange, webFilterChain).block();
+    }
+
+    @ParameterizedTest
+    @MethodSource("provideInvalidRequest")
+    void shouldNotRespondLanguageCookieIfRequestNotMatch(MockServerHttpRequest mockRequest) {
+        WebFilterChain webFilterChain = filterExchange -> {
+            var languageCookie = filterExchange.getResponse().getCookies().getFirst("language");
+            assertNull(languageCookie);
+            return Mono.empty();
+        };
+        var exchange = MockServerWebExchange.from(mockRequest);
+        this.filter.filter(exchange, webFilterChain).block();
+    }
+
+    static Stream<MockServerHttpRequest> provideInvalidRequest() {
+        return Stream.of(
+            MockServerHttpRequest.get("/home")
+                .accept(MediaType.ALL)
+                .queryParam("language", "zh-CN")
+                .build(),
+            MockServerHttpRequest.get("/home")
+                .accept(MediaType.APPLICATION_JSON)
+                .queryParam("language", "zh-CN")
+                .build(),
+            MockServerHttpRequest.post("/home")
+                .accept(MediaType.TEXT_HTML)
+                .queryParam("language", "zh-CN")
+                .build(),
+            MockServerHttpRequest.get("/home")
+                .accept(MediaType.TEXT_HTML)
+                .build()
+        );
+    }
+}
\ No newline at end of file

From a9c0ecebe36230f116d084185653320b1e77b3a1 Mon Sep 17 00:00:00 2001
From: John Niang <johnniang@foxmail.com>
Date: Sat, 14 Sep 2024 10:52:30 +0800
Subject: [PATCH 020/185] Support resolving i18n message with standard way
 (#6648)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/kind feature
/area theme
/sig docs
/milestone 2.20.x

#### What this PR does / why we need it:

After this PR, we can define i18n message files next to the template file.

```yaml
i18n:
    default.properties
templates:
    index.html
    index.properties # Higher properties than default.properties
    index_zh.properties # Higher properties than index.properties
    index_zh_CN.properties # Higher priority than index_zh.properties
```

It's convenient for plugins that define the template files.

See https://www.thymeleaf.org/doc/tutorials/3.1/usingthymeleaf.html#standard-message-resolver for more.

#### Does this PR introduce a user-facing change?

```release-note
支持在主题中通过 Thymeleaf 默认行为实现国际化
```
---
 .../halo/app/theme/message/ThemeMessageResolver.java   | 10 +++++++++-
 .../theme/message/ThemeMessageResolutionUtilsTest.java |  8 ++++----
 .../message/ThemeMessageResolverIntegrationTest.java   |  5 ++++-
 .../resources/themes/default/i18n/default.properties   |  3 ++-
 .../test/resources/themes/default/i18n/zh.properties   |  1 +
 .../test/resources/themes/default/templates/index.html |  2 +-
 .../themes/default/templates/index.properties          |  1 +
 .../themes/default/templates/index_zh.properties       |  1 +
 8 files changed, 23 insertions(+), 8 deletions(-)
 create mode 100644 application/src/test/resources/themes/default/i18n/zh.properties
 create mode 100644 application/src/test/resources/themes/default/templates/index.properties
 create mode 100644 application/src/test/resources/themes/default/templates/index_zh.properties

diff --git a/application/src/main/java/run/halo/app/theme/message/ThemeMessageResolver.java b/application/src/main/java/run/halo/app/theme/message/ThemeMessageResolver.java
index 673770023b..18c9819fc6 100644
--- a/application/src/main/java/run/halo/app/theme/message/ThemeMessageResolver.java
+++ b/application/src/main/java/run/halo/app/theme/message/ThemeMessageResolver.java
@@ -1,7 +1,10 @@
 package run.halo.app.theme.message;
 
+import java.util.Collections;
+import java.util.HashMap;
 import java.util.Locale;
 import java.util.Map;
+import java.util.Optional;
 import org.thymeleaf.messageresolver.StandardMessageResolver;
 import org.thymeleaf.templateresource.ITemplateResource;
 import run.halo.app.theme.ThemeContext;
@@ -22,7 +25,12 @@ public ThemeMessageResolver(ThemeContext theme) {
     protected Map<String, String> resolveMessagesForTemplate(String template,
         ITemplateResource templateResource,
         Locale locale) {
-        return ThemeMessageResolutionUtils.resolveMessagesForTemplate(locale, theme);
+        var properties = new HashMap<String, String>();
+        Optional.ofNullable(ThemeMessageResolutionUtils.resolveMessagesForTemplate(locale, theme))
+            .ifPresent(properties::putAll);
+        Optional.ofNullable(super.resolveMessagesForTemplate(template, templateResource, locale))
+            .ifPresent(properties::putAll);
+        return Collections.unmodifiableMap(properties);
     }
 
     @Override
diff --git a/application/src/test/java/run/halo/app/theme/message/ThemeMessageResolutionUtilsTest.java b/application/src/test/java/run/halo/app/theme/message/ThemeMessageResolutionUtilsTest.java
index 924f1edcff..b7966673bf 100644
--- a/application/src/test/java/run/halo/app/theme/message/ThemeMessageResolutionUtilsTest.java
+++ b/application/src/test/java/run/halo/app/theme/message/ThemeMessageResolutionUtilsTest.java
@@ -29,16 +29,16 @@ void setUp() throws FileNotFoundException {
     void resolveMessagesForTemplateForDefault() throws URISyntaxException {
         Map<String, String> properties =
             ThemeMessageResolutionUtils.resolveMessagesForTemplate(Locale.CHINESE, getTheme());
-        assertThat(properties).hasSize(1);
-        assertThat(properties).containsEntry("index.welcome", "欢迎来到首页");
+        assertThat(properties).isEqualTo(Map.of("index.welcome", "欢迎来到首页",
+            "title", "来自 i18n/zh.properties 的标题"));
     }
 
     @Test
     void resolveMessagesForTemplateForEnglish() throws URISyntaxException {
         Map<String, String> properties =
             ThemeMessageResolutionUtils.resolveMessagesForTemplate(Locale.ENGLISH, getTheme());
-        assertThat(properties).hasSize(1);
-        assertThat(properties).containsEntry("index.welcome", "Welcome to the index");
+        assertThat(properties).isEqualTo(Map.of("index.welcome", "Welcome to the index",
+            "title", "这是来自 i18n/default.properties 的标题"));
     }
 
     @Test
diff --git a/application/src/test/java/run/halo/app/theme/message/ThemeMessageResolverIntegrationTest.java b/application/src/test/java/run/halo/app/theme/message/ThemeMessageResolverIntegrationTest.java
index 6948c4e96c..4c461ff6b8 100644
--- a/application/src/test/java/run/halo/app/theme/message/ThemeMessageResolverIntegrationTest.java
+++ b/application/src/test/java/run/halo/app/theme/message/ThemeMessageResolverIntegrationTest.java
@@ -93,6 +93,9 @@ void shouldUseDefaultWhenLanguageNotSupport() {
             .expectStatus()
             .isOk()
             .expectBody()
+            // make sure the "templates/index.properties" file is precedence over the
+            // "i18n/default.properties".
+            .xpath("/html/head/title").isEqualTo("Title from index.properties")
             .xpath("/html/body/div[1]").isEqualTo("foo")
             .xpath("/html/body/div[2]").isEqualTo("欢迎来到首页");
     }
@@ -105,7 +108,7 @@ void switchTheme() throws URISyntaxException {
             .expectStatus()
             .isOk()
             .expectBody()
-            .xpath("/html/head/title").isEqualTo("Title")
+            .xpath("/html/head/title").isEqualTo("来自 index_zh.properties 的标题")
             .xpath("/html/body/div[1]").isEqualTo("zh")
             .xpath("/html/body/div[2]").isEqualTo("欢迎来到首页")
         ;
diff --git a/application/src/test/resources/themes/default/i18n/default.properties b/application/src/test/resources/themes/default/i18n/default.properties
index 0321c81406..3527949999 100644
--- a/application/src/test/resources/themes/default/i18n/default.properties
+++ b/application/src/test/resources/themes/default/i18n/default.properties
@@ -1 +1,2 @@
-index.welcome=\u6B22\u8FCE\u6765\u5230\u9996\u9875
\ No newline at end of file
+index.welcome=欢迎来到首页
+title=这是来自 i18n/default.properties 的标题
diff --git a/application/src/test/resources/themes/default/i18n/zh.properties b/application/src/test/resources/themes/default/i18n/zh.properties
new file mode 100644
index 0000000000..dbc13ede32
--- /dev/null
+++ b/application/src/test/resources/themes/default/i18n/zh.properties
@@ -0,0 +1 @@
+title=来自 i18n/zh.properties 的标题
diff --git a/application/src/test/resources/themes/default/templates/index.html b/application/src/test/resources/themes/default/templates/index.html
index 7d38411c43..08c0bc4309 100644
--- a/application/src/test/resources/themes/default/templates/index.html
+++ b/application/src/test/resources/themes/default/templates/index.html
@@ -2,7 +2,7 @@
 <html lang="en">
 <head>
     <meta charset="UTF-8"/>
-    <title>Title</title>
+    <title th:text="#{title}">Title</title>
 </head>
 <body>
 index
diff --git a/application/src/test/resources/themes/default/templates/index.properties b/application/src/test/resources/themes/default/templates/index.properties
new file mode 100644
index 0000000000..44e41acd8c
--- /dev/null
+++ b/application/src/test/resources/themes/default/templates/index.properties
@@ -0,0 +1 @@
+title=Title from index.properties
diff --git a/application/src/test/resources/themes/default/templates/index_zh.properties b/application/src/test/resources/themes/default/templates/index_zh.properties
new file mode 100644
index 0000000000..300ca1cfc8
--- /dev/null
+++ b/application/src/test/resources/themes/default/templates/index_zh.properties
@@ -0,0 +1 @@
+title=来自 index_zh.properties 的标题

From 3fda9e6db4fb0025068bcae55d9449fdc5f50b7c Mon Sep 17 00:00:00 2001
From: guqing <38999863+guqing@users.noreply.github.com>
Date: Sat, 14 Sep 2024 15:16:31 +0800
Subject: [PATCH 021/185] refactor: remove trailing slash in site url for
 notification (#6660)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?
/kind improvement
/area core
/milestone 2.20.x

#### What this PR does / why we need it:
修复 external-url 配置带了尾部斜杠导致邮件通知的查看通知链接无法访问的问题

#### Which issue(s) this PR fixes:
Fixes #6655

#### Does this PR introduce a user-facing change?
```release-note
修复 external-url 配置带了尾部斜杠导致邮件通知的查看通知链接无法访问的问题
```
---
 .../DefaultNotificationTemplateRender.java    |  7 ++++-
 ...DefaultNotificationTemplateRenderTest.java | 28 +++++++++++++++++--
 2 files changed, 32 insertions(+), 3 deletions(-)

diff --git a/application/src/main/java/run/halo/app/notification/DefaultNotificationTemplateRender.java b/application/src/main/java/run/halo/app/notification/DefaultNotificationTemplateRender.java
index b15ff738e7..08c150523a 100644
--- a/application/src/main/java/run/halo/app/notification/DefaultNotificationTemplateRender.java
+++ b/application/src/main/java/run/halo/app/notification/DefaultNotificationTemplateRender.java
@@ -5,7 +5,9 @@
 import java.util.HashMap;
 import java.util.Locale;
 import java.util.Map;
+import java.util.Optional;
 import lombok.RequiredArgsConstructor;
+import org.apache.commons.lang3.StringUtils;
 import org.springframework.stereotype.Component;
 import org.thymeleaf.TemplateEngine;
 import org.thymeleaf.context.Context;
@@ -40,13 +42,16 @@ public class DefaultNotificationTemplateRender implements NotificationTemplateRe
     @Override
     public Mono<String> render(String template, Map<String, Object> model) {
         var context = new Context(Locale.getDefault(), model);
+        var externalUrl = Optional.ofNullable(externalUrlSupplier.getRaw())
+            .map(url -> StringUtils.removeEnd(url.toString(), "/"))
+            .orElse(StringUtils.EMPTY);
         var globalAttributeMono = getBasicSetting()
             .doOnNext(basic -> {
                 var site = new HashMap<>();
                 site.put("title", basic.getTitle());
                 site.put("logo", basic.getLogo());
                 site.put("subtitle", basic.getSubtitle());
-                site.put("url", externalUrlSupplier.getRaw());
+                site.put("url", externalUrl);
                 context.setVariable("site", site);
             });
         return Mono.when(globalAttributeMono)
diff --git a/application/src/test/java/run/halo/app/notification/DefaultNotificationTemplateRenderTest.java b/application/src/test/java/run/halo/app/notification/DefaultNotificationTemplateRenderTest.java
index e4d10336f2..5925740120 100644
--- a/application/src/test/java/run/halo/app/notification/DefaultNotificationTemplateRenderTest.java
+++ b/application/src/test/java/run/halo/app/notification/DefaultNotificationTemplateRenderTest.java
@@ -9,6 +9,7 @@
 
 import java.net.MalformedURLException;
 import java.net.URI;
+import java.net.URL;
 import java.util.Map;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
@@ -88,7 +89,7 @@ void render() {
                       以下是回复的具体内容：
                       
                       这是回复的内容
-   
+                       
                     Halo
                     http://localhost:8090
                     祝好！
@@ -101,4 +102,27 @@ void render() {
             eq(SystemSetting.Basic.class));
         verify(externalUrlSupplier).getRaw();
     }
-}
+
+    @Test
+    void siteUrlTest() throws MalformedURLException {
+        when(environmentFetcher.fetch(eq(SystemSetting.Basic.GROUP), eq(SystemSetting.Basic.class)))
+            .thenReturn(Mono.just(new SystemSetting.Basic()));
+
+        var template = "<a th:href=\"|${site.url}/uc/notifications|\">查看通知</a>";
+        var expected = "<a href=\"http://localhost:8090/uc/notifications\">查看通知</a>";
+
+        when(externalUrlSupplier.getRaw()).thenReturn(new URL("http://localhost:8090/"));
+        templateRender.render(template,
+                Map.of())
+            .as(StepVerifier::create)
+            .expectNext(expected)
+            .verifyComplete();
+
+        when(externalUrlSupplier.getRaw()).thenReturn(new URL("http://localhost:8090"));
+        templateRender.render(template,
+                Map.of())
+            .as(StepVerifier::create)
+            .expectNext(expected)
+            .verifyComplete();
+    }
+}
\ No newline at end of file

From a634065d48396006212891cbc534c63cf2b57964 Mon Sep 17 00:00:00 2001
From: guqing <i@guqing.email>
Date: Sat, 14 Sep 2024 16:08:50 +0800
Subject: [PATCH 022/185] feat: support JSON-based retrieval and update for
 theme and plugin configs

---
 api-docs/openapi/v3_0/aggregated.json         | 139 +++++++++++++++++-
 .../v3_0/apis_console.api_v1alpha1.json       | 139 +++++++++++++++++-
 .../extension/endpoint/PluginEndpoint.java    |  76 +++++++++-
 .../service/SettingConfigService.java         |  19 +++
 .../impl/SettingConfigServiceImpl.java        |  57 +++++++
 .../core/extension/theme/SettingUtils.java    |  25 +++-
 .../core/extension/theme/ThemeEndpoint.java   |  74 +++++++++-
 .../extensions/role-template-plugin.yaml      |   6 +-
 .../extensions/role-template-theme.yaml       |   6 +-
 .../endpoint/PluginEndpointTest.java          |  38 +++++
 .../extension/theme/ThemeEndpointTest.java    |  44 +++++-
 11 files changed, 603 insertions(+), 20 deletions(-)
 create mode 100644 application/src/main/java/run/halo/app/core/extension/service/SettingConfigService.java
 create mode 100644 application/src/main/java/run/halo/app/core/extension/service/impl/SettingConfigServiceImpl.java

diff --git a/api-docs/openapi/v3_0/aggregated.json b/api-docs/openapi/v3_0/aggregated.json
index 7006547132..0c4adcb15a 100644
--- a/api-docs/openapi/v3_0/aggregated.json
+++ b/api-docs/openapi/v3_0/aggregated.json
@@ -2871,7 +2871,7 @@
     },
     "/apis/api.console.halo.run/v1alpha1/plugins/{name}/config": {
       "get": {
-        "description": "Fetch configMap of plugin by configured configMapName.",
+        "description": "Fetch configMap of plugin by configured configMapName. it is deprecated since 2.20.0",
         "operationId": "fetchPluginConfig",
         "parameters": [
           {
@@ -2900,7 +2900,8 @@
         ]
       },
       "put": {
-        "description": "Update the configMap of plugin setting.",
+        "deprecated": true,
+        "description": "Update the configMap of plugin setting, it is deprecated since 2.20.0",
         "operationId": "updatePluginConfig",
         "parameters": [
           {
@@ -2939,6 +2940,70 @@
         ]
       }
     },
+    "/apis/api.console.halo.run/v1alpha1/plugins/{name}/json-config": {
+      "get": {
+        "description": "Fetch converted json config of plugin by configured configMapName.",
+        "operationId": "fetchPluginJsonConfig",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "name",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "default": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "type": "object"
+                }
+              }
+            },
+            "description": "default response"
+          }
+        },
+        "tags": [
+          "PluginV1alpha1Console"
+        ]
+      },
+      "put": {
+        "description": "Update the config of plugin setting.",
+        "operationId": "updatePluginJsonConfig",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "name",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "204": {
+            "content": {},
+            "description": "No Content"
+          }
+        },
+        "tags": [
+          "PluginV1alpha1Console"
+        ]
+      }
+    },
     "/apis/api.console.halo.run/v1alpha1/plugins/{name}/plugin-state": {
       "put": {
         "description": "Change the running state of a plugin by name.",
@@ -4545,7 +4610,8 @@
     },
     "/apis/api.console.halo.run/v1alpha1/themes/{name}/config": {
       "get": {
-        "description": "Fetch configMap of theme by configured configMapName.",
+        "deprecated": true,
+        "description": "Fetch configMap of theme by configured configMapName. It is deprecated.",
         "operationId": "fetchThemeConfig",
         "parameters": [
           {
@@ -4574,7 +4640,8 @@
         ]
       },
       "put": {
-        "description": "Update the configMap of theme setting.",
+        "deprecated": true,
+        "description": "Update the configMap of theme setting. It is deprecated.",
         "operationId": "updateThemeConfig",
         "parameters": [
           {
@@ -4637,6 +4704,70 @@
         ]
       }
     },
+    "/apis/api.console.halo.run/v1alpha1/themes/{name}/json-config": {
+      "get": {
+        "description": "Fetch converted json config of theme by configured configMapName.",
+        "operationId": "fetchThemeJsonConfig",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "name",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "default": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "type": "object"
+                }
+              }
+            },
+            "description": "default response"
+          }
+        },
+        "tags": [
+          "ThemeV1alpha1Console"
+        ]
+      },
+      "put": {
+        "description": "Update the configMap of theme setting.",
+        "operationId": "updateThemeJsonConfig",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "name",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "204": {
+            "content": {},
+            "description": "No Content"
+          }
+        },
+        "tags": [
+          "ThemeV1alpha1Console"
+        ]
+      }
+    },
     "/apis/api.console.halo.run/v1alpha1/themes/{name}/reload": {
       "put": {
         "description": "Reload theme setting.",
diff --git a/api-docs/openapi/v3_0/apis_console.api_v1alpha1.json b/api-docs/openapi/v3_0/apis_console.api_v1alpha1.json
index 9ff6d788c3..eaca77f802 100644
--- a/api-docs/openapi/v3_0/apis_console.api_v1alpha1.json
+++ b/api-docs/openapi/v3_0/apis_console.api_v1alpha1.json
@@ -738,7 +738,7 @@
     },
     "/apis/api.console.halo.run/v1alpha1/plugins/{name}/config": {
       "get": {
-        "description": "Fetch configMap of plugin by configured configMapName.",
+        "description": "Fetch configMap of plugin by configured configMapName. it is deprecated since 2.20.0",
         "operationId": "fetchPluginConfig",
         "parameters": [
           {
@@ -767,7 +767,8 @@
         ]
       },
       "put": {
-        "description": "Update the configMap of plugin setting.",
+        "deprecated": true,
+        "description": "Update the configMap of plugin setting, it is deprecated since 2.20.0",
         "operationId": "updatePluginConfig",
         "parameters": [
           {
@@ -806,6 +807,70 @@
         ]
       }
     },
+    "/apis/api.console.halo.run/v1alpha1/plugins/{name}/json-config": {
+      "get": {
+        "description": "Fetch converted json config of plugin by configured configMapName.",
+        "operationId": "fetchPluginJsonConfig",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "name",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "default": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "type": "object"
+                }
+              }
+            },
+            "description": "default response"
+          }
+        },
+        "tags": [
+          "PluginV1alpha1Console"
+        ]
+      },
+      "put": {
+        "description": "Update the config of plugin setting.",
+        "operationId": "updatePluginJsonConfig",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "name",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "204": {
+            "content": {},
+            "description": "No Content"
+          }
+        },
+        "tags": [
+          "PluginV1alpha1Console"
+        ]
+      }
+    },
     "/apis/api.console.halo.run/v1alpha1/plugins/{name}/plugin-state": {
       "put": {
         "description": "Change the running state of a plugin by name.",
@@ -2412,7 +2477,8 @@
     },
     "/apis/api.console.halo.run/v1alpha1/themes/{name}/config": {
       "get": {
-        "description": "Fetch configMap of theme by configured configMapName.",
+        "deprecated": true,
+        "description": "Fetch configMap of theme by configured configMapName. It is deprecated.",
         "operationId": "fetchThemeConfig",
         "parameters": [
           {
@@ -2441,7 +2507,8 @@
         ]
       },
       "put": {
-        "description": "Update the configMap of theme setting.",
+        "deprecated": true,
+        "description": "Update the configMap of theme setting. It is deprecated.",
         "operationId": "updateThemeConfig",
         "parameters": [
           {
@@ -2504,6 +2571,70 @@
         ]
       }
     },
+    "/apis/api.console.halo.run/v1alpha1/themes/{name}/json-config": {
+      "get": {
+        "description": "Fetch converted json config of theme by configured configMapName.",
+        "operationId": "fetchThemeJsonConfig",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "name",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "default": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "type": "object"
+                }
+              }
+            },
+            "description": "default response"
+          }
+        },
+        "tags": [
+          "ThemeV1alpha1Console"
+        ]
+      },
+      "put": {
+        "description": "Update the configMap of theme setting.",
+        "operationId": "updateThemeJsonConfig",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "name",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "204": {
+            "content": {},
+            "description": "No Content"
+          }
+        },
+        "tags": [
+          "ThemeV1alpha1Console"
+        ]
+      }
+    },
     "/apis/api.console.halo.run/v1alpha1/themes/{name}/reload": {
       "put": {
         "description": "Reload theme setting.",
diff --git a/application/src/main/java/run/halo/app/core/extension/endpoint/PluginEndpoint.java b/application/src/main/java/run/halo/app/core/extension/endpoint/PluginEndpoint.java
index a05a216bdd..eadd73c9f0 100644
--- a/application/src/main/java/run/halo/app/core/extension/endpoint/PluginEndpoint.java
+++ b/application/src/main/java/run/halo/app/core/extension/endpoint/PluginEndpoint.java
@@ -17,6 +17,7 @@
 import static run.halo.app.extension.router.QueryParamBuildUtil.sortParameter;
 import static run.halo.app.infra.utils.FileUtils.deleteFileSilently;
 
+import com.fasterxml.jackson.databind.node.ObjectNode;
 import io.swagger.v3.oas.annotations.enums.ParameterIn;
 import io.swagger.v3.oas.annotations.media.Schema;
 import java.io.FileNotFoundException;
@@ -41,6 +42,7 @@
 import org.springframework.dao.OptimisticLockingFailureException;
 import org.springframework.data.domain.Sort;
 import org.springframework.http.CacheControl;
+import org.springframework.http.HttpStatus;
 import org.springframework.http.MediaType;
 import org.springframework.http.codec.multipart.FilePart;
 import org.springframework.http.codec.multipart.FormFieldPart;
@@ -61,6 +63,7 @@
 import run.halo.app.core.extension.Plugin;
 import run.halo.app.core.extension.Setting;
 import run.halo.app.core.extension.service.PluginService;
+import run.halo.app.core.extension.service.SettingConfigService;
 import run.halo.app.core.extension.theme.SettingUtils;
 import run.halo.app.extension.ConfigMap;
 import run.halo.app.extension.ListOptions;
@@ -80,6 +83,8 @@ public class PluginEndpoint implements CustomEndpoint, InitializingBean {
 
     private final ReactiveUrlDataBufferFetcher reactiveUrlDataBufferFetcher;
 
+    private final SettingConfigService settingConfigService;
+
     private final WebProperties webProperties;
 
     private final Scheduler scheduler = Schedulers.boundedElastic();
@@ -91,10 +96,12 @@ public class PluginEndpoint implements CustomEndpoint, InitializingBean {
     public PluginEndpoint(ReactiveExtensionClient client,
         PluginService pluginService,
         ReactiveUrlDataBufferFetcher reactiveUrlDataBufferFetcher,
+        SettingConfigService settingConfigService,
         WebProperties webProperties) {
         this.client = client;
         this.pluginService = pluginService;
         this.reactiveUrlDataBufferFetcher = reactiveUrlDataBufferFetcher;
+        this.settingConfigService = settingConfigService;
         this.webProperties = webProperties;
     }
 
@@ -157,9 +164,28 @@ public RouterFunction<ServerResponse> endpoint() {
                         .content(contentBuilder().mediaType(MediaType.MULTIPART_FORM_DATA_VALUE)
                             .schema(schemaBuilder().implementation(InstallRequest.class))))
             )
+            .PUT("plugins/{name}/json-config", this::updatePluginJsonConfig,
+                builder -> builder.operationId("updatePluginJsonConfig")
+                    .description("Update the config of plugin setting.")
+                    .tag(tag)
+                    .parameter(parameterBuilder()
+                        .name("name")
+                        .in(ParameterIn.PATH)
+                        .required(true)
+                        .implementation(String.class)
+                    )
+                    .requestBody(requestBodyBuilder()
+                        .required(true)
+                        .content(contentBuilder().mediaType(MediaType.APPLICATION_JSON_VALUE)
+                            .schema(schemaBuilder().implementation(ObjectNode.class))))
+                    .response(responseBuilder()
+                        .responseCode(String.valueOf(HttpStatus.NO_CONTENT.value()))
+                        .implementation(Void.class))
+            )
             .PUT("plugins/{name}/config", this::updatePluginConfig,
                 builder -> builder.operationId("updatePluginConfig")
-                    .description("Update the configMap of plugin setting.")
+                    .description(
+                        "Update the configMap of plugin setting, it is deprecated since 2.20.0")
                     .tag(tag)
                     .parameter(parameterBuilder()
                         .name("name")
@@ -167,6 +193,7 @@ public RouterFunction<ServerResponse> endpoint() {
                         .required(true)
                         .implementation(String.class)
                     )
+                    .deprecated(true)
                     .requestBody(requestBodyBuilder()
                         .required(true)
                         .content(contentBuilder().mediaType(MediaType.APPLICATION_JSON_VALUE)
@@ -243,7 +270,9 @@ public RouterFunction<ServerResponse> endpoint() {
             )
             .GET("plugins/{name}/config", this::fetchPluginConfig,
                 builder -> builder.operationId("fetchPluginConfig")
-                    .description("Fetch configMap of plugin by configured configMapName.")
+                    .description(
+                        "Fetch configMap of plugin by configured configMapName. it is deprecated "
+                            + "since 2.20.0")
                     .tag(tag)
                     .parameter(parameterBuilder()
                         .name("name")
@@ -254,6 +283,20 @@ public RouterFunction<ServerResponse> endpoint() {
                     .response(responseBuilder()
                         .implementation(ConfigMap.class))
             )
+            .GET("plugins/{name}/json-config", this::fetchPluginJsonConfig,
+                builder -> builder.operationId("fetchPluginJsonConfig")
+                    .description(
+                        "Fetch converted json config of plugin by configured configMapName.")
+                    .tag(tag)
+                    .parameter(parameterBuilder()
+                        .name("name")
+                        .in(ParameterIn.PATH)
+                        .required(true)
+                        .implementation(String.class)
+                    )
+                    .response(responseBuilder()
+                        .implementation(ObjectNode.class))
+            )
             .GET("plugin-presets", this::listPresets,
                 builder -> builder.operationId("ListPluginPresets")
                     .description("List all plugin presets in the system.")
@@ -275,6 +318,35 @@ public RouterFunction<ServerResponse> endpoint() {
             .build();
     }
 
+    private Mono<ServerResponse> fetchPluginJsonConfig(ServerRequest request) {
+        final var name = request.pathVariable("name");
+        return client.fetch(Plugin.class, name)
+            .mapNotNull(plugin -> plugin.getSpec().getConfigMapName())
+            .flatMap(settingConfigService::fetchConfig)
+            .flatMap(json -> ServerResponse.ok().bodyValue(json));
+    }
+
+    private Mono<ServerResponse> updatePluginJsonConfig(ServerRequest request) {
+        final var pluginName = request.pathVariable("name");
+        return client.fetch(Plugin.class, pluginName)
+            .doOnNext(plugin -> {
+                String configMapName = plugin.getSpec().getConfigMapName();
+                if (!StringUtils.hasText(configMapName)) {
+                    throw new ServerWebInputException(
+                        "Unable to complete the request because the plugin configMapName is blank");
+                }
+            })
+            .flatMap(plugin -> {
+                final String configMapName = plugin.getSpec().getConfigMapName();
+                return request.bodyToMono(ObjectNode.class)
+                    .switchIfEmpty(
+                        Mono.error(new ServerWebInputException("Required request body is missing")))
+                    .flatMap(configMapJsonData ->
+                        settingConfigService.upsertConfig(configMapName, configMapJsonData));
+            })
+            .then(ServerResponse.noContent().build());
+    }
+
     Mono<ServerResponse> changePluginRunningState(ServerRequest request) {
         final var name = request.pathVariable("name");
         return request.bodyToMono(RunningStateRequest.class)
diff --git a/application/src/main/java/run/halo/app/core/extension/service/SettingConfigService.java b/application/src/main/java/run/halo/app/core/extension/service/SettingConfigService.java
new file mode 100644
index 0000000000..99bfce199a
--- /dev/null
+++ b/application/src/main/java/run/halo/app/core/extension/service/SettingConfigService.java
@@ -0,0 +1,19 @@
+package run.halo.app.core.extension.service;
+
+import com.fasterxml.jackson.databind.node.ObjectNode;
+import reactor.core.publisher.Mono;
+import run.halo.app.core.extension.Setting;
+import run.halo.app.extension.ConfigMap;
+
+/**
+ * {@link Setting} related {@link ConfigMap} service.
+ *
+ * @author guqing
+ * @since 2.20.0
+ */
+public interface SettingConfigService {
+
+    Mono<Void> upsertConfig(String configMapName, ObjectNode configJsonData);
+
+    Mono<ObjectNode> fetchConfig(String configMapName);
+}
diff --git a/application/src/main/java/run/halo/app/core/extension/service/impl/SettingConfigServiceImpl.java b/application/src/main/java/run/halo/app/core/extension/service/impl/SettingConfigServiceImpl.java
new file mode 100644
index 0000000000..bb97003580
--- /dev/null
+++ b/application/src/main/java/run/halo/app/core/extension/service/impl/SettingConfigServiceImpl.java
@@ -0,0 +1,57 @@
+package run.halo.app.core.extension.service.impl;
+
+import com.fasterxml.jackson.databind.node.ObjectNode;
+import java.time.Duration;
+import lombok.RequiredArgsConstructor;
+import org.springframework.dao.OptimisticLockingFailureException;
+import org.springframework.stereotype.Component;
+import org.springframework.util.Assert;
+import reactor.core.publisher.Mono;
+import reactor.util.retry.Retry;
+import run.halo.app.core.extension.Setting;
+import run.halo.app.core.extension.service.SettingConfigService;
+import run.halo.app.core.extension.theme.SettingUtils;
+import run.halo.app.extension.ConfigMap;
+import run.halo.app.extension.Metadata;
+import run.halo.app.extension.ReactiveExtensionClient;
+
+/**
+ * {@link Setting} related {@link ConfigMap} service implementation.
+ *
+ * @author guqing
+ * @since 2.20.0
+ */
+@Component
+@RequiredArgsConstructor
+public class SettingConfigServiceImpl implements SettingConfigService {
+    private final ReactiveExtensionClient client;
+
+    @Override
+    public Mono<Void> upsertConfig(String configMapName, ObjectNode configJsonData) {
+        Assert.notNull(configMapName, "Config map name must not be null");
+        Assert.notNull(configJsonData, "Config json data must not be null");
+        var data = SettingUtils.settingConfigJsonToMap(configJsonData);
+        return Mono.defer(() -> client.fetch(ConfigMap.class, configMapName)
+                .flatMap(persisted -> {
+                    persisted.setData(data);
+                    return client.update(persisted);
+                }))
+            .retryWhen(Retry.backoff(5, Duration.ofMillis(100))
+                .filter(OptimisticLockingFailureException.class::isInstance)
+            )
+            .switchIfEmpty(Mono.defer(() -> {
+                var configMap = new ConfigMap();
+                configMap.setMetadata(new Metadata());
+                configMap.getMetadata().setName(configMapName);
+                configMap.setData(data);
+                return client.create(configMap);
+            }))
+            .then();
+    }
+
+    @Override
+    public Mono<ObjectNode> fetchConfig(String configMapName) {
+        return client.fetch(ConfigMap.class, configMapName)
+            .map(SettingUtils::settingConfigToJson);
+    }
+}
diff --git a/application/src/main/java/run/halo/app/core/extension/theme/SettingUtils.java b/application/src/main/java/run/halo/app/core/extension/theme/SettingUtils.java
index 0a3b33bdfb..9c92e82bb8 100644
--- a/application/src/main/java/run/halo/app/core/extension/theme/SettingUtils.java
+++ b/application/src/main/java/run/halo/app/core/extension/theme/SettingUtils.java
@@ -129,7 +129,30 @@ public static Map<String, String> mergePatch(Map<String, String> modified,
         }
     }
 
-    JsonNode mapToJsonNode(Map<String, String> map) {
+    /**
+     * Convert {@link Setting} related configMap data to JsonNode.
+     *
+     * @param configMap {@link ConfigMap} instance
+     * @return JsonNode
+     */
+    public static ObjectNode settingConfigToJson(ConfigMap configMap) {
+        if (configMap.getData() == null) {
+            return JsonNodeFactory.instance.objectNode();
+        }
+        return mapToJsonNode(configMap.getData());
+    }
+
+    /**
+     * Convert the result of {@link #settingConfigToJson(ConfigMap)} in reverse to Map.
+     *
+     * @param node JsonNode object
+     * @return {@link ConfigMap#getData()}
+     */
+    public static Map<String, String> settingConfigJsonToMap(ObjectNode node) {
+        return jsonNodeToStringMap(node);
+    }
+
+    ObjectNode mapToJsonNode(Map<String, String> map) {
         ObjectNode objectNode = JsonNodeFactory.instance.objectNode();
         map.forEach((k, v) -> {
             if (isJson(v)) {
diff --git a/application/src/main/java/run/halo/app/core/extension/theme/ThemeEndpoint.java b/application/src/main/java/run/halo/app/core/extension/theme/ThemeEndpoint.java
index 9cc4210925..90ebad7a9c 100644
--- a/application/src/main/java/run/halo/app/core/extension/theme/ThemeEndpoint.java
+++ b/application/src/main/java/run/halo/app/core/extension/theme/ThemeEndpoint.java
@@ -9,6 +9,7 @@
 import static org.springframework.http.HttpStatus.NO_CONTENT;
 import static org.springframework.web.reactive.function.server.RequestPredicates.contentType;
 
+import com.fasterxml.jackson.databind.node.ObjectNode;
 import io.swagger.v3.oas.annotations.enums.ParameterIn;
 import io.swagger.v3.oas.annotations.media.Schema;
 import java.net.URI;
@@ -38,6 +39,7 @@
 import run.halo.app.core.extension.Setting;
 import run.halo.app.core.extension.Theme;
 import run.halo.app.core.extension.endpoint.CustomEndpoint;
+import run.halo.app.core.extension.service.SettingConfigService;
 import run.halo.app.extension.ConfigMap;
 import run.halo.app.extension.ListResult;
 import run.halo.app.extension.ReactiveExtensionClient;
@@ -73,6 +75,8 @@ public class ThemeEndpoint implements CustomEndpoint {
 
     private final ReactiveUrlDataBufferFetcher urlDataBufferFetcher;
 
+    private final SettingConfigService settingConfigService;
+
     @Override
     public RouterFunction<ServerResponse> endpoint() {
         var tag = "ThemeV1alpha1Console";
@@ -161,8 +165,9 @@ public RouterFunction<ServerResponse> endpoint() {
             )
             .PUT("themes/{name}/config", this::updateThemeConfig,
                 builder -> builder.operationId("updateThemeConfig")
-                    .description("Update the configMap of theme setting.")
+                    .description("Update the configMap of theme setting. It is deprecated.")
                     .tag(tag)
+                    .deprecated(true)
                     .parameter(parameterBuilder()
                         .name("name")
                         .in(ParameterIn.PATH)
@@ -176,6 +181,24 @@ public RouterFunction<ServerResponse> endpoint() {
                     .response(responseBuilder()
                         .implementation(ConfigMap.class))
             )
+            .PUT("themes/{name}/json-config", this::updateThemeJsonConfig,
+                builder -> builder.operationId("updateThemeJsonConfig")
+                    .description("Update the configMap of theme setting.")
+                    .tag(tag)
+                    .parameter(parameterBuilder()
+                        .name("name")
+                        .in(ParameterIn.PATH)
+                        .required(true)
+                        .implementation(String.class)
+                    )
+                    .requestBody(requestBodyBuilder()
+                        .required(true)
+                        .content(contentBuilder().mediaType(MediaType.APPLICATION_JSON_VALUE)
+                            .schema(schemaBuilder().implementation(ObjectNode.class))))
+                    .response(responseBuilder()
+                        .responseCode(String.valueOf(NO_CONTENT.value()))
+                        .implementation(Void.class))
+            )
             .PUT("themes/{name}/activation", this::activateTheme,
                 builder -> builder.operationId("activateTheme")
                     .description("Activate a theme by name.")
@@ -235,8 +258,10 @@ public RouterFunction<ServerResponse> endpoint() {
             )
             .GET("themes/{name}/config", this::fetchThemeConfig,
                 builder -> builder.operationId("fetchThemeConfig")
-                    .description("Fetch configMap of theme by configured configMapName.")
+                    .description(
+                        "Fetch configMap of theme by configured configMapName. It is deprecated.")
                     .tag(tag)
+                    .deprecated(true)
                     .parameter(parameterBuilder()
                         .name("name")
                         .in(ParameterIn.PATH)
@@ -246,9 +271,52 @@ public RouterFunction<ServerResponse> endpoint() {
                     .response(responseBuilder()
                         .implementation(ConfigMap.class))
             )
+            .GET("themes/{name}/json-config", this::fetchThemeJsonConfig,
+                builder -> builder.operationId("fetchThemeJsonConfig")
+                    .description(
+                        "Fetch converted json config of theme by configured configMapName.")
+                    .tag(tag)
+                    .parameter(parameterBuilder()
+                        .name("name")
+                        .in(ParameterIn.PATH)
+                        .required(true)
+                        .implementation(String.class)
+                    )
+                    .response(responseBuilder()
+                        .implementation(ObjectNode.class))
+            )
             .build();
     }
 
+    private Mono<ServerResponse> fetchThemeJsonConfig(ServerRequest request) {
+        return themeNameInPathVariableOrActivated(request)
+            .flatMap(themeName -> client.fetch(Theme.class, themeName))
+            .mapNotNull(theme -> theme.getSpec().getConfigMapName())
+            .flatMap(settingConfigService::fetchConfig)
+            .flatMap(json -> ServerResponse.ok().bodyValue(json));
+    }
+
+    private Mono<ServerResponse> updateThemeJsonConfig(ServerRequest request) {
+        final var themeName = request.pathVariable("name");
+        return client.fetch(Theme.class, themeName)
+            .doOnNext(theme -> {
+                String configMapName = theme.getSpec().getConfigMapName();
+                if (StringUtils.isBlank(configMapName)) {
+                    throw new ServerWebInputException(
+                        "Unable to complete the request because the theme configMapName is blank.");
+                }
+            })
+            .flatMap(theme -> {
+                final var configMapName = theme.getSpec().getConfigMapName();
+                return request.bodyToMono(ObjectNode.class)
+                    .switchIfEmpty(
+                        Mono.error(new ServerWebInputException("Required request body is missing")))
+                    .flatMap(configJsonData ->
+                        settingConfigService.upsertConfig(configMapName, configJsonData));
+            })
+            .then(ServerResponse.noContent().build());
+    }
+
     private Mono<ServerResponse> invalidateCache(ServerRequest request) {
         final var name = request.pathVariable("name");
         return client.get(Theme.class, name)
@@ -306,6 +374,7 @@ private Mono<ServerResponse> activateTheme(ServerRequest request) {
             .flatMap(activatedTheme -> ServerResponse.ok().bodyValue(activatedTheme));
     }
 
+    @Deprecated(since = "2.20.0", forRemoval = true)
     private Mono<ServerResponse> updateThemeConfig(ServerRequest request) {
         final var themeName = request.pathVariable("name");
         return client.fetch(Theme.class, themeName)
@@ -343,6 +412,7 @@ private Mono<ServerResponse> updateThemeConfig(ServerRequest request) {
             .flatMap(configMap -> ServerResponse.ok().bodyValue(configMap));
     }
 
+    @Deprecated(since = "2.20.0", forRemoval = true)
     private Mono<ServerResponse> fetchThemeConfig(ServerRequest request) {
         return themeNameInPathVariableOrActivated(request)
             .flatMap(themeName -> client.fetch(Theme.class, themeName))
diff --git a/application/src/main/resources/extensions/role-template-plugin.yaml b/application/src/main/resources/extensions/role-template-plugin.yaml
index 82ff040a29..8bdd23e394 100644
--- a/application/src/main/resources/extensions/role-template-plugin.yaml
+++ b/application/src/main/resources/extensions/role-template-plugin.yaml
@@ -16,8 +16,8 @@ rules:
     resources: [ "plugins" ]
     verbs: [ "create", "patch", "update", "delete", "deletecollection" ]
   - apiGroups: [ "api.console.halo.run" ]
-    resources: [ "plugins/upgrade", "plugins/resetconfig", "plugins/config", "plugins/reload",
-                 "plugins/install-from-uri", "plugins/upgrade-from-uri", "plugins/plugin-state" ]
+    resources: [ "plugins/upgrade", "plugins/resetconfig", "plugins/config", "plugins/json-config",
+                 "plugins/reload", "plugins/install-from-uri", "plugins/upgrade-from-uri", "plugins/plugin-state" ]
     verbs: [ "*" ]
   - apiGroups: [ "api.console.halo.run" ]
     resources: [ "plugin-presets" ]
@@ -41,5 +41,5 @@ rules:
     resources: [ "plugins" ]
     verbs: [ "get", "list" ]
   - apiGroups: [ "api.console.halo.run" ]
-    resources: [ "plugins", "plugins/setting", "plugins/config" ]
+    resources: [ "plugins", "plugins/setting", "plugins/config", "plugins/json-config" ]
     verbs: [ "get", "list" ]
diff --git a/application/src/main/resources/extensions/role-template-theme.yaml b/application/src/main/resources/extensions/role-template-theme.yaml
index 6b6c375bf5..ea46fecbaa 100644
--- a/application/src/main/resources/extensions/role-template-theme.yaml
+++ b/application/src/main/resources/extensions/role-template-theme.yaml
@@ -15,8 +15,8 @@ rules:
     resources: [ "themes" ]
     verbs: [ "*" ]
   - apiGroups: [ "api.console.halo.run" ]
-    resources: [ "themes", "themes/reload", "themes/resetconfig", "themes/config", "themes/activation",
-                 "themes/install-from-uri", "themes/upgrade-from-uri", "themes/invalidate-cache" ]
+    resources: [ "themes", "themes/reload", "themes/resetconfig", "themes/config", "themes/json-config",
+                 "themes/activation", "themes/install-from-uri", "themes/upgrade-from-uri", "themes/invalidate-cache" ]
     verbs: [ "*" ]
   - nonResourceURLs: [ "/apis/api.console.halo.run/themes/install" ]
     verbs: [ "create" ]
@@ -37,6 +37,6 @@ rules:
     resources: [ "themes" ]
     verbs: [ "get", "list" ]
   - apiGroups: [ "api.console.halo.run" ]
-    resources: [ "themes", "themes/activation", "themes/setting", "themes/config" ]
+    resources: [ "themes", "themes/activation", "themes/setting", "themes/config", "themes/json-config" ]
     verbs: [ "get", "list" ]
 
diff --git a/application/src/test/java/run/halo/app/core/extension/endpoint/PluginEndpointTest.java b/application/src/test/java/run/halo/app/core/extension/endpoint/PluginEndpointTest.java
index 3de56eb726..5e53efd144 100644
--- a/application/src/test/java/run/halo/app/core/extension/endpoint/PluginEndpointTest.java
+++ b/application/src/test/java/run/halo/app/core/extension/endpoint/PluginEndpointTest.java
@@ -22,6 +22,7 @@
 import java.nio.file.Paths;
 import java.time.Instant;
 import java.util.List;
+import java.util.Map;
 import lombok.extern.slf4j.Slf4j;
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeEach;
@@ -45,6 +46,7 @@
 import run.halo.app.core.extension.Plugin;
 import run.halo.app.core.extension.Setting;
 import run.halo.app.core.extension.service.PluginService;
+import run.halo.app.core.extension.service.SettingConfigService;
 import run.halo.app.extension.ConfigMap;
 import run.halo.app.extension.ListOptions;
 import run.halo.app.extension.ListResult;
@@ -67,6 +69,9 @@ class PluginEndpointTest {
     @Mock
     PluginService pluginService;
 
+    @Mock
+    SettingConfigService settingConfigService;
+
     @Spy
     WebProperties webProperties = new WebProperties();
 
@@ -278,6 +283,22 @@ void updateWhenConfigMapNameMatch() {
                 .exchange()
                 .expectStatus().isOk();
         }
+
+        @Test
+        void updateJsonConfigTest() {
+            Plugin plugin = createPlugin("fake-plugin");
+            plugin.getSpec().setConfigMapName("fake-config-map");
+
+            when(client.fetch(eq(Plugin.class), eq("fake-plugin"))).thenReturn(Mono.just(plugin));
+            when(settingConfigService.upsertConfig(eq("fake-config-map"), any()))
+                .thenReturn(Mono.empty());
+
+            webClient.put()
+                .uri("/plugins/fake-plugin/json-config")
+                .body(Mono.just(Map.of()), Map.class)
+                .exchange()
+                .expectStatus().is2xxSuccessful();
+        }
     }
 
     @Nested
@@ -325,6 +346,23 @@ void fetchConfig() {
             verify(client).fetch(eq(ConfigMap.class), eq("fake-config"));
             verify(client).fetch(eq(Plugin.class), eq("fake"));
         }
+
+        @Test
+        void fetchJsonConfig() {
+            Plugin plugin = createPlugin("fake");
+            plugin.getSpec().setConfigMapName("fake-config");
+
+            when(settingConfigService.fetchConfig(eq("fake-config")))
+                .thenReturn(Mono.empty());
+            when(client.fetch(eq(Plugin.class), eq("fake"))).thenReturn(Mono.just(plugin));
+            webClient.get()
+                .uri("/plugins/fake/json-config")
+                .exchange()
+                .expectStatus().isOk();
+
+            verify(settingConfigService).fetchConfig(eq("fake-config"));
+            verify(client).fetch(eq(Plugin.class), eq("fake"));
+        }
     }
 
     Plugin createPlugin(String name) {
diff --git a/application/src/test/java/run/halo/app/core/extension/theme/ThemeEndpointTest.java b/application/src/test/java/run/halo/app/core/extension/theme/ThemeEndpointTest.java
index 4fc3194bbe..ba529755ce 100644
--- a/application/src/test/java/run/halo/app/core/extension/theme/ThemeEndpointTest.java
+++ b/application/src/test/java/run/halo/app/core/extension/theme/ThemeEndpointTest.java
@@ -14,6 +14,7 @@
 import java.net.URI;
 import java.nio.file.Files;
 import java.nio.file.Path;
+import java.util.Map;
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Nested;
@@ -33,6 +34,7 @@
 import reactor.core.publisher.Mono;
 import run.halo.app.core.extension.Setting;
 import run.halo.app.core.extension.Theme;
+import run.halo.app.core.extension.service.SettingConfigService;
 import run.halo.app.extension.ConfigMap;
 import run.halo.app.extension.Metadata;
 import run.halo.app.extension.ReactiveExtensionClient;
@@ -69,6 +71,9 @@ class ThemeEndpointTest {
     @Mock
     private ReactiveUrlDataBufferFetcher urlDataBufferFetcher;
 
+    @Mock
+    private SettingConfigService settingConfigService;
+
     @InjectMocks
     ThemeEndpoint themeEndpoint;
 
@@ -298,8 +303,25 @@ void updateWhenConfigMapNameMatch() {
                 .exchange()
                 .expectStatus().isOk();
         }
-    }
 
+        @Test
+        void updateJsonConfigTest() {
+            Theme theme = new Theme();
+            theme.setMetadata(new Metadata());
+            theme.setSpec(new Theme.ThemeSpec());
+            theme.getSpec().setConfigMapName("fake-config-map");
+
+            when(client.fetch(eq(Theme.class), eq("fake-theme"))).thenReturn(Mono.just(theme));
+            when(settingConfigService.upsertConfig(eq("fake-config-map"), any()))
+                .thenReturn(Mono.empty());
+
+            webTestClient.put()
+                .uri("/themes/fake-theme/json-config")
+                .body(Mono.just(Map.of()), Map.class)
+                .exchange()
+                .expectStatus().is2xxSuccessful();
+        }
+    }
 
     @Test
     void fetchActivatedTheme() {
@@ -360,4 +382,24 @@ void fetchThemeConfig() {
         verify(client).fetch(eq(ConfigMap.class), eq("fake-config"));
         verify(client).fetch(eq(Theme.class), eq("fake"));
     }
+
+    @Test
+    void fetchThemeJsonConfigTest() {
+        Theme theme = new Theme();
+        theme.setMetadata(new Metadata());
+        theme.getMetadata().setName("fake");
+        theme.setSpec(new Theme.ThemeSpec());
+        theme.getSpec().setConfigMapName("fake-config");
+
+        when(settingConfigService.fetchConfig(eq("fake-config"))).thenReturn(Mono.empty());
+
+        when(client.fetch(eq(Theme.class), eq("fake"))).thenReturn(Mono.just(theme));
+        webTestClient.get()
+            .uri("/themes/fake/json-config")
+            .exchange()
+            .expectStatus().isOk();
+
+        verify(settingConfigService).fetchConfig(eq("fake-config"));
+        verify(client).fetch(eq(Theme.class), eq("fake"));
+    }
 }
\ No newline at end of file

From 749c80cb964f37006cee4008207f3ff6f904681a Mon Sep 17 00:00:00 2001
From: guqing <38999863+guqing@users.noreply.github.com>
Date: Wed, 18 Sep 2024 12:18:49 +0800
Subject: [PATCH 023/185] chore: cleanup subscription integration test (#6671)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?
/kind cleanup
/area core
/milestone 2.20.x

#### What this PR does / why we need it:
删除 SubscriptionServiceIntegrationTest 类。因为当前测试类不经常性出错，暂时无法排查原因。

#### Does this PR introduce a user-facing change?
```release-note
None
```
---
 .../SubscriptionServiceIntegrationTest.java   | 171 ------------------
 1 file changed, 171 deletions(-)
 delete mode 100644 application/src/test/java/run/halo/app/notification/SubscriptionServiceIntegrationTest.java

diff --git a/application/src/test/java/run/halo/app/notification/SubscriptionServiceIntegrationTest.java b/application/src/test/java/run/halo/app/notification/SubscriptionServiceIntegrationTest.java
deleted file mode 100644
index 6a55506f7d..0000000000
--- a/application/src/test/java/run/halo/app/notification/SubscriptionServiceIntegrationTest.java
+++ /dev/null
@@ -1,171 +0,0 @@
-package run.halo.app.notification;
-
-import static org.assertj.core.api.Assertions.assertThat;
-import static org.mockito.ArgumentMatchers.any;
-import static org.mockito.Mockito.atLeast;
-import static org.mockito.Mockito.verify;
-import static run.halo.app.extension.index.query.QueryFactory.isNull;
-
-import java.util.ArrayList;
-import java.util.List;
-import org.junit.jupiter.api.AfterEach;
-import org.junit.jupiter.api.BeforeEach;
-import org.junit.jupiter.api.Nested;
-import org.junit.jupiter.api.Test;
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.boot.test.context.SpringBootTest;
-import org.springframework.boot.test.mock.mockito.SpyBean;
-import org.springframework.test.annotation.DirtiesContext;
-import reactor.core.publisher.Flux;
-import reactor.core.publisher.Mono;
-import reactor.test.StepVerifier;
-import run.halo.app.core.extension.notification.Subscription;
-import run.halo.app.extension.Extension;
-import run.halo.app.extension.ExtensionStoreUtil;
-import run.halo.app.extension.ListOptions;
-import run.halo.app.extension.PageRequestImpl;
-import run.halo.app.extension.ReactiveExtensionClient;
-import run.halo.app.extension.SchemeManager;
-import run.halo.app.extension.index.IndexerFactory;
-import run.halo.app.extension.router.selector.FieldSelector;
-import run.halo.app.extension.store.ReactiveExtensionStoreClient;
-import run.halo.app.infra.utils.JsonUtils;
-
-/**
- * Integration tests for {@link SubscriptionService}.
- *
- * @author guqing
- * @since 2.15.0
- */
-@DirtiesContext
-@SpringBootTest
-class SubscriptionServiceIntegrationTest {
-
-    @Autowired
-    private SchemeManager schemeManager;
-
-    @SpyBean
-    private ReactiveExtensionClient client;
-
-    @Autowired
-    private ReactiveExtensionStoreClient storeClient;
-
-    @Autowired
-    private IndexerFactory indexerFactory;
-
-    Mono<Extension> deleteImmediately(Extension extension) {
-        var name = extension.getMetadata().getName();
-        var scheme = schemeManager.get(extension.getClass());
-        // un-index
-        var indexer = indexerFactory.getIndexer(extension.groupVersionKind());
-        indexer.unIndexRecord(extension.getMetadata().getName());
-
-        // delete from db
-        var storeName = ExtensionStoreUtil.buildStoreName(scheme, name);
-        return storeClient.delete(storeName, extension.getMetadata().getVersion())
-            .thenReturn(extension);
-    }
-
-    @Nested
-    class RemoveInitialBatchTest {
-        static int size = 310;
-        private final List<Subscription> storedSubscriptions = subscriptionsForStore();
-
-        @Autowired
-        private SubscriptionService subscriptionService;
-
-        @BeforeEach
-        void setUp() {
-            Flux.fromIterable(storedSubscriptions)
-                .flatMap(comment -> client.create(comment))
-                .as(StepVerifier::create)
-                .expectNextCount(storedSubscriptions.size())
-                .verifyComplete();
-        }
-
-        @AfterEach
-        void tearDown() {
-            Flux.fromIterable(storedSubscriptions)
-                .flatMap(SubscriptionServiceIntegrationTest.this::deleteImmediately)
-                .as(StepVerifier::create)
-                .expectNextCount(storedSubscriptions.size())
-                .verifyComplete();
-        }
-
-        private List<Subscription> subscriptionsForStore() {
-            List<Subscription> subscriptions = new ArrayList<>(size);
-            for (int i = 0; i < size; i++) {
-                var subscription = createSubscription();
-                subscription.getMetadata().setName("subscription-" + i);
-                subscriptions.add(subscription);
-            }
-            return subscriptions;
-        }
-
-        @Test
-        void removeTest() {
-            var subscriber = new Subscription.Subscriber();
-            subscriber.setName("admin");
-            var interestReason = new Subscription.InterestReason();
-            interestReason.setReasonType("new-comment-on-post");
-            var subject = new Subscription.ReasonSubject();
-            subject.setApiVersion("content.halo.run/v1alpha1");
-            subject.setKind("Post");
-            interestReason.setSubject(subject);
-
-            subscriptionService.remove(subscriber, interestReason).block();
-
-            verify(client, atLeast(size)).delete(any(Subscription.class));
-            assertCleanedUp();
-        }
-
-        @Test
-        void removeBySubscriberTest() {
-            var subscriber = new Subscription.Subscriber();
-            subscriber.setName("admin");
-
-            subscriptionService.remove(subscriber).block();
-            verify(client, atLeast(size)).delete(any(Subscription.class));
-            assertCleanedUp();
-        }
-
-        private void assertCleanedUp() {
-            var listOptions = new ListOptions();
-            listOptions.setFieldSelector(FieldSelector.of(isNull("metadata.deletionTimestamp")));
-            client.listBy(Subscription.class, listOptions, PageRequestImpl.ofSize(1))
-                .as(StepVerifier::create)
-                .consumeNextWith(result -> {
-                    assertThat(result.getTotal()).isEqualTo(0);
-                    assertThat(result.getItems()).isEmpty();
-                })
-                .verifyComplete();
-        }
-    }
-
-    Subscription createSubscription() {
-        return JsonUtils.jsonToObject("""
-            {
-                "spec": {
-                    "subscriber": {
-                        "name": "admin"
-                    },
-                    "unsubscribeToken": "423530c9-bec7-446e-b73b-dd98ac00ba2b",
-                    "reason": {
-                        "reasonType": "new-comment-on-post",
-                        "subject": {
-                            "name": "5152aea5-c2e8-4717-8bba-2263d46e19d5",
-                            "apiVersion": "content.halo.run/v1alpha1",
-                            "kind": "Post"
-                        }
-                    },
-                    "disabled": false
-                },
-                "apiVersion": "notification.halo.run/v1alpha1",
-                "kind": "Subscription",
-                "metadata": {
-                    "generateName": "subscription-"
-                }
-            }
-            """, Subscription.class);
-    }
-}
\ No newline at end of file

From ded5b4135f66e0f4b711a86a071fb73fe5076313 Mon Sep 17 00:00:00 2001
From: John Niang <johnniang@foxmail.com>
Date: Wed, 18 Sep 2024 16:22:50 +0800
Subject: [PATCH 024/185] Generate JS and CSS bundle with fixed buffer size
 (#6573)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/kind improvement
/area core
/milestone 2.20.x

#### What this PR does / why we need it:

If we are running Halo instance in machine with small memory available, the JS/CSS bundle might  not be accessible.

This RP refactors generation of JS and CSS bundle with fixed buffer size rather than length of original resources.

```java
2024-09-02T15:01:27.667+08:00  WARN 62039 --- [boundedElastic-3] reactor.core.Exceptions                  : throwIfFatal detected a jvm fatal exception, which is thrown and logged below:

java.lang.OutOfMemoryError: Java heap space
        at java.base/java.nio.HeapByteBuffer.<init>(HeapByteBuffer.java:64) ~[na:na]
        at java.base/java.nio.ByteBuffer.allocate(ByteBuffer.java:363) ~[na:na]
        at org.springframework.core.io.buffer.DefaultDataBuffer.allocate(DefaultDataBuffer.java:234) ~[spring-core-6.1.12.jar:6.1.12]
        at org.springframework.core.io.buffer.DefaultDataBuffer.setCapacity(DefaultDataBuffer.java:196) ~[spring-core-6.1.12.jar:6.1.12]
        at org.springframework.core.io.buffer.DefaultDataBuffer.ensureWritable(DefaultDataBuffer.java:228) ~[spring-core-6.1.12.jar:6.1.12]
        at org.springframework.core.io.buffer.DefaultDataBuffer.write(DefaultDataBuffer.java:296) ~[spring-core-6.1.12.jar:6.1.12]
        at org.springframework.core.io.buffer.DefaultDataBuffer.write(DefaultDataBuffer.java:289) ~[spring-core-6.1.12.jar:6.1.12]
        at org.springframework.core.io.buffer.DefaultDataBuffer.write(DefaultDataBuffer.java:43) ~[spring-core-6.1.12.jar:6.1.12]
        at run.halo.app.core.extension.service.impl.PluginServiceImpl.lambda$uglifyJsBundle$17(PluginServiceImpl.java:257) ~[classes/:na]
        at run.halo.app.core.extension.service.impl.PluginServiceImpl$$Lambda$4661/0x000000c80214e298.accept(Unknown Source) ~[na:na]
        at reactor.core.publisher.FluxPeekFuseable$PeekFuseableSubscriber.onNext(FluxPeekFuseable.java:196) ~[reactor-core-3.6.9.jar:3.6.9]
        at reactor.core.publisher.FluxUsing$UsingFuseableSubscriber.onNext(FluxUsing.java:353) ~[reactor-core-3.6.9.jar:3.6.9]
        at reactor.core.publisher.FluxGenerate$GenerateSubscription.next(FluxGenerate.java:178) ~[reactor-core-3.6.9.jar:3.6.9]
        at org.springframework.core.io.buffer.DataBufferUtils$ReadableByteChannelGenerator.accept(DataBufferUtils.java:1002) ~[spring-core-6.1.12.jar:6.1.12]
        at org.springframework.core.io.buffer.DataBufferUtils$ReadableByteChannelGenerator.accept(DataBufferUtils.java:974) ~[spring-core-6.1.12.jar:6.1.12]
        at reactor.core.publisher.FluxGenerate.lambda$new$1(FluxGenerate.java:58) ~[reactor-core-3.6.9.jar:3.6.9]
        at reactor.core.publisher.FluxGenerate$$Lambda$4155/0x000000c802069228.apply(Unknown Source) ~[na:na]
        at reactor.core.publisher.FluxGenerate$GenerateSubscription.slowPath(FluxGenerate.java:271) ~[reactor-core-3.6.9.jar:3.6.9]
        at reactor.core.publisher.FluxGenerate$GenerateSubscription.request(FluxGenerate.java:213) ~[reactor-core-3.6.9.jar:3.6.9]
        at reactor.core.publisher.FluxUsing$UsingFuseableSubscriber.request(FluxUsing.java:320) ~[reactor-core-3.6.9.jar:3.6.9]
        at reactor.core.publisher.FluxPeekFuseable$PeekFuseableSubscriber.request(FluxPeekFuseable.java:144) ~[reactor-core-3.6.9.jar:3.6.9]
        at reactor.core.publisher.FluxFlatMap$FlatMapInner.onSubscribe(FluxFlatMap.java:968) ~[reactor-core-3.6.9.jar:3.6.9]
        at reactor.core.publisher.FluxPeekFuseable$PeekFuseableSubscriber.onSubscribe(FluxPeekFuseable.java:178) ~[reactor-core-3.6.9.jar:3.6.9]
        at reactor.core.publisher.FluxUsing$UsingFuseableSubscriber.onSubscribe(FluxUsing.java:347) ~[reactor-core-3.6.9.jar:3.6.9]
        at reactor.core.publisher.FluxGenerate.subscribe(FluxGenerate.java:85) ~[reactor-core-3.6.9.jar:3.6.9]
        at reactor.core.publisher.FluxUsing.subscribe(FluxUsing.java:102) ~[reactor-core-3.6.9.jar:3.6.9]
        at reactor.core.publisher.Flux.subscribe(Flux.java:8848) ~[reactor-core-3.6.9.jar:3.6.9]
        at reactor.core.publisher.FluxFlatMap$FlatMapMain.onNext(FluxFlatMap.java:430) ~[reactor-core-3.6.9.jar:3.6.9]
        at reactor.core.publisher.FluxHandleFuseable$HandleFuseableSubscriber.tryOnNext(FluxHandleFuseable.java:135) ~[reactor-core-3.6.9.jar:3.6.9]
        at reactor.core.publisher.FluxIterable$IterableSubscriptionConditional.slowPath(FluxIterable.java:664) ~[reactor-core-3.6.9.jar:3.6.9]
        at reactor.core.publisher.FluxIterable$IterableSubscriptionConditional.request(FluxIterable.java:623) ~[reactor-core-3.6.9.jar:3.6.9]
        at reactor.core.publisher.FluxHandleFuseable$HandleFuseableSubscriber.request(FluxHandleFuseable.java:260) ~[reactor-core-3.6.9.jar:3.6.9]

2024-09-02T15:01:27.681+08:00 DEBUG 62039 --- [boundedElastic-3] a.w.r.e.AbstractErrorWebExceptionHandler : [131a559b-102] Resolved [OutOfMemoryError: Java heap space] for HTTP GET /apis/api.console.halo.run/v1alpha1/plugins/-/bundle.js
2024-09-02T15:01:27.681+08:00 ERROR 62039 --- [boundedElastic-3] a.w.r.e.AbstractErrorWebExceptionHandler : [131a559b-102]  500 Server Error for HTTP GET "/apis/api.console.halo.run/v1alpha1/plugins/-/bundle.js?v=1725260408176"

java.lang.OutOfMemoryError: Java heap space
        at java.base/java.nio.HeapByteBuffer.<init>(HeapByteBuffer.java:64) ~[na:na]
```

#### Does this PR introduce a user-facing change?

```release-note
优化在内存紧张时 Console 端无法加载插件资源的问题
```
---
 .../service/impl/PluginServiceImpl.java       | 111 ++++++++++--------
 1 file changed, 62 insertions(+), 49 deletions(-)

diff --git a/application/src/main/java/run/halo/app/core/extension/service/impl/PluginServiceImpl.java b/application/src/main/java/run/halo/app/core/extension/service/impl/PluginServiceImpl.java
index 817ea1d054..991250aac0 100644
--- a/application/src/main/java/run/halo/app/core/extension/service/impl/PluginServiceImpl.java
+++ b/application/src/main/java/run/halo/app/core/extension/service/impl/PluginServiceImpl.java
@@ -40,6 +40,7 @@
 import org.springframework.util.Assert;
 import org.springframework.util.CollectionUtils;
 import org.springframework.util.FileSystemUtils;
+import org.springframework.util.StreamUtils;
 import org.springframework.web.server.ServerWebInputException;
 import reactor.core.Exceptions;
 import reactor.core.publisher.Flux;
@@ -229,61 +230,73 @@ public Mono<Plugin> reload(String name) {
     @Override
     public Flux<DataBuffer> uglifyJsBundle() {
         var startedPlugins = List.copyOf(pluginManager.getStartedPlugins());
-        String plugins = """
-            this.enabledPlugins = [%s]
-            """.formatted(startedPlugins.stream()
-            .map(plugin -> """
-                {
-                  "name": "%s",
-                  "version": "%s"
-                }
-                """.formatted(plugin.getPluginId(), plugin.getDescriptor().getVersion())
-            )
-            .collect(Collectors.joining(", ")));
-        return Flux.fromIterable(startedPlugins)
-            .mapNotNull(pluginWrapper -> {
-                var pluginName = pluginWrapper.getPluginId();
-                return BundleResourceUtils.getJsBundleResource(pluginManager, pluginName,
-                    BundleResourceUtils.JS_BUNDLE);
-            })
-            .flatMap(resource -> {
-                try {
-                    // Specifying bufferSize as resource content length is
-                    // to append line breaks at the end of each plugin
-                    return DataBufferUtils.read(resource, DefaultDataBufferFactory.sharedInstance,
-                            (int) resource.contentLength())
-                        .doOnNext(dataBuffer -> {
-                            // add a new line after each plugin bundle to avoid syntax error
-                            dataBuffer.write("\n".getBytes(StandardCharsets.UTF_8));
-                        });
-                } catch (IOException e) {
-                    log.error("Failed to read plugin bundle resource", e);
-                    return Flux.empty();
+        var dataBufferFactory = DefaultDataBufferFactory.sharedInstance;
+        var end = Mono.fromSupplier(
+            () -> {
+                var sb = new StringBuilder("this.enabledPlugins = [");
+                var iterator = startedPlugins.iterator();
+                while (iterator.hasNext()) {
+                    var plugin = iterator.next();
+                    sb.append("""
+                        {"name":"%s","version":"%s"}\
+                        """
+                        .formatted(
+                            plugin.getPluginId(),
+                            plugin.getDescriptor().getVersion()
+                        )
+                    );
+                    if (iterator.hasNext()) {
+                        sb.append(',');
+                    }
                 }
-            })
-            .concatWith(Flux.defer(() -> {
-                var dataBuffer = DefaultDataBufferFactory.sharedInstance
-                    .wrap(plugins.getBytes(StandardCharsets.UTF_8));
-                return Flux.just(dataBuffer);
-            }));
+                sb.append(']');
+                return dataBufferFactory.wrap(sb.toString().getBytes(StandardCharsets.UTF_8));
+            });
+        var body = Flux.fromIterable(startedPlugins)
+            .sort(Comparator.comparing(PluginWrapper::getPluginId))
+            .concatMap(pluginWrapper -> {
+                var pluginId = pluginWrapper.getPluginId();
+                return Mono.<Resource>fromSupplier(
+                        () -> BundleResourceUtils.getJsBundleResource(
+                            pluginManager, pluginId, BundleResourceUtils.JS_BUNDLE
+                        )
+                    )
+                    .filter(Resource::isReadable)
+                    .flatMapMany(resource -> {
+                        var head = Mono.<DataBuffer>fromSupplier(
+                            () -> dataBufferFactory.wrap(
+                                ("// Generated from plugin " + pluginId + "\n").getBytes()
+                            ));
+                        var content = DataBufferUtils.read(
+                            resource, dataBufferFactory, StreamUtils.BUFFER_SIZE
+                        );
+                        var tail = Mono.fromSupplier(() -> dataBufferFactory.wrap("\n".getBytes()));
+                        return Flux.concat(head, content, tail);
+                    });
+            });
+        return Flux.concat(body, end);
     }
 
     @Override
     public Flux<DataBuffer> uglifyCssBundle() {
         return Flux.fromIterable(pluginManager.getStartedPlugins())
-            .mapNotNull(pluginWrapper -> {
-                String pluginName = pluginWrapper.getPluginId();
-                return BundleResourceUtils.getJsBundleResource(pluginManager, pluginName,
-                    BundleResourceUtils.CSS_BUNDLE);
-            })
-            .flatMap(resource -> {
-                try {
-                    return DataBufferUtils.read(resource, DefaultDataBufferFactory.sharedInstance,
-                        (int) resource.contentLength());
-                } catch (IOException e) {
-                    log.error("Failed to read plugin css bundle resource", e);
-                    return Flux.empty();
-                }
+            .sort(Comparator.comparing(PluginWrapper::getPluginId))
+            .concatMap(pluginWrapper -> {
+                var pluginId = pluginWrapper.getPluginId();
+                var dataBufferFactory = DefaultDataBufferFactory.sharedInstance;
+                return Mono.<Resource>fromSupplier(() -> BundleResourceUtils.getJsBundleResource(
+                        pluginManager, pluginId, BundleResourceUtils.CSS_BUNDLE
+                    ))
+                    .filter(Resource::isReadable)
+                    .flatMapMany(resource -> {
+                        var head = Mono.<DataBuffer>fromSupplier(() -> dataBufferFactory.wrap(
+                            ("/* Generated from plugin " + pluginId + " */\n").getBytes()
+                        ));
+                        var content = DataBufferUtils.read(
+                            resource, dataBufferFactory, StreamUtils.BUFFER_SIZE);
+                        var tail = Mono.fromSupplier(() -> dataBufferFactory.wrap("\n".getBytes()));
+                        return Flux.concat(head, content, tail);
+                    });
             });
     }
 

From 07077f7d0c2ba0ad564c33b149dffeab693a2b37 Mon Sep 17 00:00:00 2001
From: John Niang <johnniang@foxmail.com>
Date: Thu, 19 Sep 2024 10:56:53 +0800
Subject: [PATCH 025/185] Provide ElementTagProcessor to handle element tag in
 plugin (#6670)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/kind feature
/area plugin

#### What this PR does / why we need it:

This PR provides an interface ElementTagProcessor to make plugin handle element tag easily. e.g.:

```java
public class ImgTagProcessor implements ElementTagPostProcessor {

    @Override
    public Mono<Void> process(ITemplateContext context, IProcessableElementTag tag,
        IElementTagStructureHandler structureHandler) {
        var elementName = tag.getElementDefinition().getElementName();
        if (!Objects.equals("img", elementName.getElementName())) {
            return Mono.empty();
        }
        var srcAttr = tag.getAttribute("src");
        if (srcAttr == null) {
            return Mono.empty();
        }
        var newSrc = srcAttr.getValue();
        // TODO rewrite src
        structureHandler.setAttribute("src", newSrc);
        return Mono.empty();
    }

}
```

After PR merged, plugins https://github.com/webp-sh/halo-plugin-webp-cloud and https://github.com/guqing/plugin-cloudinary can be refined with new method.

#### Does this PR introduce a user-facing change?

```release-note
支持在插件中操作渲染结果
```
---
 .../extensionpoint/ExtensionGetter.java       |  11 ++
 .../dialect/ElementTagPostProcessor.java      |  41 +++++
 .../DefaultExtensionGetter.java               |  13 ++
 .../dialect/HaloPostTemplateHandler.java      |  69 ++++++++
 .../theme/dialect/HaloProcessorDialect.java   |  19 ++-
 .../DefaultExtensionGetterTest.java           |  18 +++
 .../ReactiveFinderExpressionParserTests.java  |  11 +-
 .../CommentElementTagProcessorTest.java       |   7 +
 .../dialect/HaloPostTemplateHandlerTest.java  | 153 ++++++++++++++++++
 9 files changed, 339 insertions(+), 3 deletions(-)
 create mode 100644 api/src/main/java/run/halo/app/theme/dialect/ElementTagPostProcessor.java
 create mode 100644 application/src/main/java/run/halo/app/theme/dialect/HaloPostTemplateHandler.java
 create mode 100644 application/src/test/java/run/halo/app/theme/dialect/HaloPostTemplateHandlerTest.java

diff --git a/api/src/main/java/run/halo/app/plugin/extensionpoint/ExtensionGetter.java b/api/src/main/java/run/halo/app/plugin/extensionpoint/ExtensionGetter.java
index 58615ec72c..964bf1a78d 100644
--- a/api/src/main/java/run/halo/app/plugin/extensionpoint/ExtensionGetter.java
+++ b/api/src/main/java/run/halo/app/plugin/extensionpoint/ExtensionGetter.java
@@ -1,5 +1,6 @@
 package run.halo.app.plugin.extensionpoint;
 
+import java.util.List;
 import org.pf4j.ExtensionPoint;
 import reactor.core.publisher.Flux;
 import reactor.core.publisher.Mono;
@@ -34,4 +35,14 @@ public interface ExtensionGetter {
      * @return a bunch of extension points.
      */
     <T extends ExtensionPoint> Flux<T> getExtensions(Class<T> extensionPointClass);
+
+    /**
+     * Get all extensions according to extension point class.
+     *
+     * @param extensionPointClass extension point class
+     * @param <T> type of extension point
+     * @return a bunch of extension points.
+     */
+    <T extends ExtensionPoint> List<T> getExtensionList(Class<T> extensionPointClass);
+
 }
diff --git a/api/src/main/java/run/halo/app/theme/dialect/ElementTagPostProcessor.java b/api/src/main/java/run/halo/app/theme/dialect/ElementTagPostProcessor.java
new file mode 100644
index 0000000000..77a295faae
--- /dev/null
+++ b/api/src/main/java/run/halo/app/theme/dialect/ElementTagPostProcessor.java
@@ -0,0 +1,41 @@
+package run.halo.app.theme.dialect;
+
+import org.pf4j.ExtensionPoint;
+import org.thymeleaf.context.ITemplateContext;
+import org.thymeleaf.model.IProcessableElementTag;
+import reactor.core.publisher.Mono;
+
+/**
+ * An extension point for post-processing element tag.
+ *
+ * @author johnniang
+ * @since 2.20.0
+ */
+public interface ElementTagPostProcessor extends ExtensionPoint {
+
+    /**
+     * <p>
+     * Execute the processor.
+     * </p>
+     * <p>
+     * The {@link IProcessableElementTag} object argument is immutable, so all modifications to
+     * this object or any
+     * instructions to be given to the engine should be done through the specified
+     * {@link org.thymeleaf.model.IModelFactory} model factory in context.
+     * </p>
+     * <p>
+     * Don't forget to return the new tag after processing or
+     * {@link reactor.core.publisher.Mono#empty()} if not processable.
+     * </p>
+     *
+     * @param context the template context.
+     * @param tag the event this processor is executing on.
+     * @return a {@link reactor.core.publisher.Mono} that will complete when processing finishes
+     * or empty mono if not support.
+     */
+    Mono<IProcessableElementTag> process(
+        ITemplateContext context,
+        final IProcessableElementTag tag
+    );
+
+}
diff --git a/application/src/main/java/run/halo/app/plugin/extensionpoint/DefaultExtensionGetter.java b/application/src/main/java/run/halo/app/plugin/extensionpoint/DefaultExtensionGetter.java
index 9f5404ab3d..e6c162879d 100644
--- a/application/src/main/java/run/halo/app/plugin/extensionpoint/DefaultExtensionGetter.java
+++ b/application/src/main/java/run/halo/app/plugin/extensionpoint/DefaultExtensionGetter.java
@@ -2,7 +2,10 @@
 
 import static run.halo.app.extension.index.query.QueryFactory.equal;
 
+import java.util.LinkedList;
+import java.util.List;
 import java.util.Objects;
+import java.util.Optional;
 import lombok.RequiredArgsConstructor;
 import org.pf4j.ExtensionPoint;
 import org.pf4j.PluginManager;
@@ -41,6 +44,16 @@ public <T extends ExtensionPoint> Flux<T> getExtensions(Class<T> extensionPoint)
             .sort(new AnnotationAwareOrderComparator());
     }
 
+    @Override
+    public <T extends ExtensionPoint> List<T> getExtensionList(Class<T> extensionPoint) {
+        var extensions = new LinkedList<T>();
+        Optional.ofNullable(pluginManager.getExtensions(extensionPoint))
+            .ifPresent(extensions::addAll);
+        extensions.addAll(beanFactory.getBeanProvider(extensionPoint).orderedStream().toList());
+        extensions.sort(new AnnotationAwareOrderComparator());
+        return extensions;
+    }
+
     @Override
     public <T extends ExtensionPoint> Mono<T> getEnabledExtension(Class<T> extensionPoint) {
         return getEnabledExtensions(extensionPoint).next();
diff --git a/application/src/main/java/run/halo/app/theme/dialect/HaloPostTemplateHandler.java b/application/src/main/java/run/halo/app/theme/dialect/HaloPostTemplateHandler.java
new file mode 100644
index 0000000000..1eebd67fea
--- /dev/null
+++ b/application/src/main/java/run/halo/app/theme/dialect/HaloPostTemplateHandler.java
@@ -0,0 +1,69 @@
+package run.halo.app.theme.dialect;
+
+import static org.thymeleaf.spring6.context.SpringContextUtils.getApplicationContext;
+
+import java.time.Duration;
+import java.util.List;
+import java.util.Objects;
+import java.util.Optional;
+import org.springframework.lang.NonNull;
+import org.springframework.util.CollectionUtils;
+import org.thymeleaf.context.ITemplateContext;
+import org.thymeleaf.engine.AbstractTemplateHandler;
+import org.thymeleaf.model.IOpenElementTag;
+import org.thymeleaf.model.IProcessableElementTag;
+import org.thymeleaf.model.IStandaloneElementTag;
+import reactor.core.publisher.Mono;
+import run.halo.app.plugin.extensionpoint.ExtensionGetter;
+
+/**
+ * Template post-handler.
+ *
+ * @author johnniang
+ * @since 2.20.0
+ */
+public class HaloPostTemplateHandler extends AbstractTemplateHandler {
+
+    private List<ElementTagPostProcessor> postProcessors = List.of();
+
+    @Override
+    public void setContext(ITemplateContext context) {
+        super.setContext(context);
+        this.postProcessors = Optional.ofNullable(getApplicationContext(context))
+            .map(appContext -> appContext.getBeanProvider(ExtensionGetter.class).getIfUnique())
+            .map(extensionGetter -> extensionGetter.getExtensionList(ElementTagPostProcessor.class))
+            .orElseGet(List::of);
+    }
+
+    @Override
+    public void handleStandaloneElement(IStandaloneElementTag standaloneElementTag) {
+        var processedTag = handleElementTag(standaloneElementTag);
+        super.handleStandaloneElement((IStandaloneElementTag) processedTag);
+    }
+
+    @Override
+    public void handleOpenElement(IOpenElementTag openElementTag) {
+        var processedTag = handleElementTag(openElementTag);
+        super.handleOpenElement((IOpenElementTag) processedTag);
+    }
+
+    @NonNull
+    private IProcessableElementTag handleElementTag(
+        @NonNull IProcessableElementTag processableElementTag
+    ) {
+        IProcessableElementTag processedTag = processableElementTag;
+        if (!CollectionUtils.isEmpty(postProcessors)) {
+            var tagProcessorChain = Mono.just(processableElementTag);
+            var context = getContext();
+            for (ElementTagPostProcessor elementTagPostProcessor : postProcessors) {
+                tagProcessorChain = tagProcessorChain.flatMap(
+                    tag -> elementTagPostProcessor.process(context, tag).defaultIfEmpty(tag)
+                );
+            }
+            processedTag =
+                Objects.requireNonNull(tagProcessorChain.defaultIfEmpty(processableElementTag)
+                    .block(Duration.ofMinutes(1)));
+        }
+        return processedTag;
+    }
+}
diff --git a/application/src/main/java/run/halo/app/theme/dialect/HaloProcessorDialect.java b/application/src/main/java/run/halo/app/theme/dialect/HaloProcessorDialect.java
index 6d61b3c48e..a88296531c 100644
--- a/application/src/main/java/run/halo/app/theme/dialect/HaloProcessorDialect.java
+++ b/application/src/main/java/run/halo/app/theme/dialect/HaloProcessorDialect.java
@@ -1,10 +1,15 @@
 package run.halo.app.theme.dialect;
 
+import static org.thymeleaf.templatemode.TemplateMode.HTML;
+
 import java.util.HashSet;
 import java.util.Set;
 import org.thymeleaf.dialect.AbstractProcessorDialect;
 import org.thymeleaf.dialect.IExpressionObjectDialect;
+import org.thymeleaf.dialect.IPostProcessorDialect;
 import org.thymeleaf.expression.IExpressionObjectFactory;
+import org.thymeleaf.postprocessor.IPostProcessor;
+import org.thymeleaf.postprocessor.PostProcessor;
 import org.thymeleaf.processor.IProcessor;
 import org.thymeleaf.standard.StandardDialect;
 
@@ -14,8 +19,8 @@
  * @author guqing
  * @since 2.0.0
  */
-public class HaloProcessorDialect extends AbstractProcessorDialect implements
-    IExpressionObjectDialect {
+public class HaloProcessorDialect extends AbstractProcessorDialect
+    implements IExpressionObjectDialect, IPostProcessorDialect {
     private static final String DIALECT_NAME = "haloThemeProcessorDialect";
 
     private static final IExpressionObjectFactory HALO_EXPRESSION_OBJECTS_FACTORY =
@@ -43,4 +48,14 @@ public Set<IProcessor> getProcessors(String dialectPrefix) {
     public IExpressionObjectFactory getExpressionObjectFactory() {
         return HALO_EXPRESSION_OBJECTS_FACTORY;
     }
+
+    @Override
+    public int getDialectPostProcessorPrecedence() {
+        return Integer.MAX_VALUE;
+    }
+
+    @Override
+    public Set<IPostProcessor> getPostProcessors() {
+        return Set.of(new PostProcessor(HTML, HaloPostTemplateHandler.class, Integer.MAX_VALUE));
+    }
 }
diff --git a/application/src/test/java/run/halo/app/plugin/extensionpoint/DefaultExtensionGetterTest.java b/application/src/test/java/run/halo/app/plugin/extensionpoint/DefaultExtensionGetterTest.java
index bab1b6e7df..b876aa10c7 100644
--- a/application/src/test/java/run/halo/app/plugin/extensionpoint/DefaultExtensionGetterTest.java
+++ b/application/src/test/java/run/halo/app/plugin/extensionpoint/DefaultExtensionGetterTest.java
@@ -1,5 +1,6 @@
 package run.halo.app.plugin.extensionpoint;
 
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.ArgumentMatchers.same;
 import static org.mockito.Mockito.mock;
@@ -44,6 +45,9 @@ class DefaultExtensionGetterTest {
     @Mock
     BeanFactory beanFactory;
 
+    @Mock
+    ObjectProvider<FakeExtensionPoint> extensionPointObjectProvider;
+
     @InjectMocks
     DefaultExtensionGetter getter;
 
@@ -209,6 +213,20 @@ void shouldGetMultiInstanceExtensionWhileExtensionPointEnabledNotSet() {
             .verifyComplete();
     }
 
+    @Test
+    void shouldGetExtensionsFromPluginManagerAndApplicationContext() {
+        var extensionFromPlugin = new FakeExtensionPointDefaultImpl();
+        var extensionFromAppContext = new FakeExtensionPointImpl();
+        when(pluginManager.getExtensions(FakeExtensionPoint.class))
+            .thenReturn(List.of(extensionFromPlugin));
+        when(beanFactory.getBeanProvider(FakeExtensionPoint.class))
+            .thenReturn(extensionPointObjectProvider);
+        when(extensionPointObjectProvider.orderedStream())
+            .thenReturn(Stream.of(extensionFromAppContext));
+        var extensions = getter.getExtensionList(FakeExtensionPoint.class);
+        assertEquals(List.of(extensionFromAppContext, extensionFromPlugin), extensions);
+    }
+
     interface FakeExtensionPoint extends ExtensionPoint {
 
     }
diff --git a/application/src/test/java/run/halo/app/theme/ReactiveFinderExpressionParserTests.java b/application/src/test/java/run/halo/app/theme/ReactiveFinderExpressionParserTests.java
index cd6f5bd02d..346aa9945a 100644
--- a/application/src/test/java/run/halo/app/theme/ReactiveFinderExpressionParserTests.java
+++ b/application/src/test/java/run/halo/app/theme/ReactiveFinderExpressionParserTests.java
@@ -3,6 +3,7 @@
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.mockito.ArgumentMatchers.eq;
 import static org.mockito.Mockito.lenient;
+import static org.mockito.Mockito.when;
 
 import com.fasterxml.jackson.databind.JsonNode;
 import com.fasterxml.jackson.databind.node.ArrayNode;
@@ -14,6 +15,7 @@
 import org.junit.jupiter.api.extension.ExtendWith;
 import org.mockito.Mock;
 import org.mockito.junit.jupiter.MockitoExtension;
+import org.springframework.beans.factory.ObjectProvider;
 import org.springframework.context.ApplicationContext;
 import org.thymeleaf.IEngineConfiguration;
 import org.thymeleaf.TemplateEngine;
@@ -29,6 +31,7 @@
 import run.halo.app.infra.SystemConfigurableEnvironmentFetcher;
 import run.halo.app.infra.SystemSetting;
 import run.halo.app.infra.utils.JsonUtils;
+import run.halo.app.plugin.extensionpoint.ExtensionGetter;
 import run.halo.app.theme.dialect.HaloProcessorDialect;
 
 /**
@@ -44,6 +47,9 @@ public class ReactiveFinderExpressionParserTests {
     @Mock
     private ApplicationContext applicationContext;
 
+    @Mock
+    private ObjectProvider<ExtensionGetter> extensionGetterProvider;
+
     @Mock
     private SystemConfigurableEnvironmentFetcher environmentFetcher;
 
@@ -62,6 +68,9 @@ public IStandardVariableExpressionEvaluator getVariableExpressionEvaluator() {
         templateEngine.addTemplateResolver(new TestTemplateResolver());
         lenient().when(applicationContext.getBean(eq(SystemConfigurableEnvironmentFetcher.class)))
             .thenReturn(environmentFetcher);
+        when(applicationContext.getBeanProvider(ExtensionGetter.class))
+            .thenReturn(extensionGetterProvider);
+        when(extensionGetterProvider.getIfUnique()).thenReturn(null);
         lenient().when(environmentFetcher.fetchComment())
             .thenReturn(Mono.just(new SystemSetting.Comment()));
     }
@@ -155,7 +164,7 @@ protected ITemplateResource computeTemplateResource(IEngineConfiguration configu
                     var mapMono = /*[[${target.mapMono.foo}]]*/;
                     var arrayNodeMono = /*[[${target.arrayNodeMono.get(0).foo}]]*/;
                 </script>
-                 """);
+                """);
         }
 
     }
diff --git a/application/src/test/java/run/halo/app/theme/dialect/CommentElementTagProcessorTest.java b/application/src/test/java/run/halo/app/theme/dialect/CommentElementTagProcessorTest.java
index 2a0726b2e7..a348af54d8 100644
--- a/application/src/test/java/run/halo/app/theme/dialect/CommentElementTagProcessorTest.java
+++ b/application/src/test/java/run/halo/app/theme/dialect/CommentElementTagProcessorTest.java
@@ -13,6 +13,7 @@
 import org.junit.jupiter.api.extension.ExtendWith;
 import org.mockito.Mock;
 import org.mockito.junit.jupiter.MockitoExtension;
+import org.springframework.beans.factory.ObjectProvider;
 import org.springframework.context.ApplicationContext;
 import org.thymeleaf.IEngineConfiguration;
 import org.thymeleaf.TemplateEngine;
@@ -48,6 +49,9 @@ class CommentElementTagProcessorTest {
     @Mock
     private ExtensionGetter extensionGetter;
 
+    @Mock
+    private ObjectProvider<ExtensionGetter>  extensionGetterProvider;
+
     @Mock
     private SystemConfigurableEnvironmentFetcher environmentFetcher;
 
@@ -61,6 +65,9 @@ void setUp() {
         templateEngine.addTemplateResolver(new TestTemplateResolver());
         lenient().when(applicationContext.getBean(eq(ExtensionGetter.class)))
             .thenReturn(extensionGetter);
+        when(applicationContext.getBeanProvider(ExtensionGetter.class))
+            .thenReturn(extensionGetterProvider);
+        when(extensionGetterProvider.getIfUnique()).thenReturn(null);
     }
 
     @Test
diff --git a/application/src/test/java/run/halo/app/theme/dialect/HaloPostTemplateHandlerTest.java b/application/src/test/java/run/halo/app/theme/dialect/HaloPostTemplateHandlerTest.java
new file mode 100644
index 0000000000..20c32f90b3
--- /dev/null
+++ b/application/src/test/java/run/halo/app/theme/dialect/HaloPostTemplateHandlerTest.java
@@ -0,0 +1,153 @@
+package run.halo.app.theme.dialect;
+
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+import static org.thymeleaf.spring6.expression.ThymeleafEvaluationContext.THYMELEAF_EVALUATION_CONTEXT_CONTEXT_VARIABLE_NAME;
+
+import java.util.List;
+import java.util.stream.Stream;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.MethodSource;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+import org.springframework.beans.factory.ObjectProvider;
+import org.springframework.context.ApplicationContext;
+import org.thymeleaf.context.ITemplateContext;
+import org.thymeleaf.engine.ITemplateHandler;
+import org.thymeleaf.model.IOpenElementTag;
+import org.thymeleaf.model.IStandaloneElementTag;
+import org.thymeleaf.spring6.expression.ThymeleafEvaluationContext;
+import reactor.core.publisher.Mono;
+import run.halo.app.plugin.extensionpoint.ExtensionGetter;
+
+@ExtendWith(MockitoExtension.class)
+class HaloPostTemplateHandlerTest {
+
+    HaloPostTemplateHandler postHandler;
+
+    @Mock
+    ITemplateContext templateContext;
+
+    @Mock
+    ITemplateHandler next;
+
+    @Mock
+    ApplicationContext applicationContext;
+
+    @Mock
+    IStandaloneElementTag standaloneElementTag;
+
+    @Mock
+    IOpenElementTag openElementTag;
+
+    @Mock
+    ObjectProvider<ExtensionGetter> extensionGetterProvider;
+
+    @Mock
+    ExtensionGetter extensionGetter;
+
+
+    @BeforeEach
+    void setUp() {
+        postHandler = new HaloPostTemplateHandler();
+        var evaluationContext = mock(ThymeleafEvaluationContext.class);
+        when(evaluationContext.getApplicationContext()).thenReturn(applicationContext);
+        when(templateContext.getVariable(THYMELEAF_EVALUATION_CONTEXT_CONTEXT_VARIABLE_NAME))
+            .thenReturn(evaluationContext);
+        when(applicationContext.getBeanProvider(ExtensionGetter.class))
+            .thenReturn(extensionGetterProvider);
+        when(extensionGetterProvider.getIfUnique()).thenReturn(extensionGetter);
+    }
+
+    @ParameterizedTest
+    @MethodSource("provideEmptyElementTagProcessors")
+    void shouldHandleStandaloneElementIfNoElementTagProcessors(
+        List<ElementTagPostProcessor> processors
+    ) {
+        when(extensionGetter.getExtensionList(ElementTagPostProcessor.class))
+            .thenReturn(processors);
+
+        postHandler.setContext(templateContext);
+        postHandler.setNext(next);
+        postHandler.handleStandaloneElement(standaloneElementTag);
+        verify(next).handleStandaloneElement(standaloneElementTag);
+    }
+
+    @Test
+    void shouldHandleStandaloneElementIfOneElementTagProcessorProvided() {
+        var processor = mock(ElementTagPostProcessor.class);
+        var newTag = mock(IStandaloneElementTag.class);
+        when(processor.process(templateContext, standaloneElementTag))
+            .thenReturn(Mono.just(newTag));
+        when(extensionGetter.getExtensionList(ElementTagPostProcessor.class))
+            .thenReturn(List.of(processor));
+
+        postHandler.setContext(templateContext);
+        postHandler.setNext(next);
+        postHandler.handleStandaloneElement(standaloneElementTag);
+        verify(next).handleStandaloneElement(newTag);
+    }
+
+    @Test
+    void shouldHandleStandaloneElementIfTagTypeChanged() {
+        var processor = mock(ElementTagPostProcessor.class);
+        var newTag = mock(IStandaloneElementTag.class);
+        when(processor.process(templateContext, standaloneElementTag))
+            .thenReturn(Mono.just(newTag));
+        when(extensionGetter.getExtensionList(ElementTagPostProcessor.class))
+            .thenReturn(List.of(processor));
+
+        postHandler.setContext(templateContext);
+        postHandler.setNext(next);
+        postHandler.handleStandaloneElement(standaloneElementTag);
+        verify(next).handleStandaloneElement(newTag);
+    }
+
+    @Test
+    void shouldHandleStandaloneElementIfMoreElementTagProcessorsProvided() {
+        var processor1 = mock(ElementTagPostProcessor.class);
+        var processor2 = mock(ElementTagPostProcessor.class);
+        var newTag1 = mock(IStandaloneElementTag.class);
+        var newTag2 = mock(IStandaloneElementTag.class);
+        when(processor1.process(templateContext, standaloneElementTag))
+            .thenReturn(Mono.just(newTag1));
+        when(processor2.process(templateContext, newTag1))
+            .thenReturn(Mono.just(newTag2));
+        when(extensionGetter.getExtensionList(ElementTagPostProcessor.class))
+            .thenReturn(List.of(processor1, processor2));
+
+        postHandler.setContext(templateContext);
+        postHandler.setNext(next);
+        postHandler.handleStandaloneElement(standaloneElementTag);
+        verify(next).handleStandaloneElement(newTag2);
+    }
+
+    @Test
+    void shouldNotHandleIfProcessedTagTypeChanged() {
+        var processor = mock(ElementTagPostProcessor.class);
+        var newTag = mock(IOpenElementTag.class);
+        when(processor.process(templateContext, standaloneElementTag))
+            .thenReturn(Mono.just(newTag));
+        when(extensionGetter.getExtensionList(ElementTagPostProcessor.class))
+            .thenReturn(List.of(processor));
+
+        postHandler.setContext(templateContext);
+        postHandler.setNext(next);
+        assertThrows(ClassCastException.class,
+            () -> postHandler.handleStandaloneElement(standaloneElementTag)
+        );
+    }
+
+    static Stream<List<ElementTagPostProcessor>> provideEmptyElementTagProcessors() {
+        return Stream.of(
+            null,
+            List.of()
+        );
+    }
+
+}
\ No newline at end of file

From dcadd38843038916752df915a9a161e951b42e07 Mon Sep 17 00:00:00 2001
From: guqing <38999863+guqing@users.noreply.github.com>
Date: Thu, 19 Sep 2024 15:20:54 +0800
Subject: [PATCH 026/185] feat: add Halo version variable to theme model
 (#6677)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?
/kind feature
/milestone 2.20.x
/area theme

#### What this PR does / why we need it:
主题支持通过 `${site.version}` 得到 Halo 版本号

#### Which issue(s) this PR fixes:
Fixes #6676

#### Does this PR introduce a user-facing change?
```release-note
主题支持通过 `${site.version}` 得到 Halo 版本号
```
---
 .../app/theme/SiteSettingVariablesAcquirer.java     |  5 ++++-
 .../halo/app/theme/finders/vo/SiteSettingVo.java    |  3 +++
 .../app/theme/SiteSettingVariablesAcquirerTest.java | 13 ++++++++++++-
 3 files changed, 19 insertions(+), 2 deletions(-)

diff --git a/application/src/main/java/run/halo/app/theme/SiteSettingVariablesAcquirer.java b/application/src/main/java/run/halo/app/theme/SiteSettingVariablesAcquirer.java
index d5145ae8e2..72271a42e4 100644
--- a/application/src/main/java/run/halo/app/theme/SiteSettingVariablesAcquirer.java
+++ b/application/src/main/java/run/halo/app/theme/SiteSettingVariablesAcquirer.java
@@ -7,6 +7,7 @@
 import reactor.core.publisher.Mono;
 import run.halo.app.infra.ExternalUrlSupplier;
 import run.halo.app.infra.SystemConfigurableEnvironmentFetcher;
+import run.halo.app.infra.SystemVersionSupplier;
 import run.halo.app.theme.finders.vo.SiteSettingVo;
 
 /**
@@ -21,6 +22,7 @@ public class SiteSettingVariablesAcquirer implements ViewContextBasedVariablesAc
 
     private final SystemConfigurableEnvironmentFetcher environmentFetcher;
     private final ExternalUrlSupplier externalUrlSupplier;
+    private final SystemVersionSupplier systemVersionSupplier;
 
     @Override
     public Mono<Map<String, Object>> acquire(ServerWebExchange exchange) {
@@ -28,7 +30,8 @@ public Mono<Map<String, Object>> acquire(ServerWebExchange exchange) {
             .filter(configMap -> configMap.getData() != null)
             .map(configMap -> {
                 SiteSettingVo siteSettingVo = SiteSettingVo.from(configMap)
-                    .withUrl(externalUrlSupplier.getURL(exchange.getRequest()));
+                    .withUrl(externalUrlSupplier.getURL(exchange.getRequest()))
+                    .withVersion(systemVersionSupplier.get().toString());
                 return Map.of("site", siteSettingVo);
             });
     }
diff --git a/application/src/main/java/run/halo/app/theme/finders/vo/SiteSettingVo.java b/application/src/main/java/run/halo/app/theme/finders/vo/SiteSettingVo.java
index 485ee1a115..558dbb3c50 100644
--- a/application/src/main/java/run/halo/app/theme/finders/vo/SiteSettingVo.java
+++ b/application/src/main/java/run/halo/app/theme/finders/vo/SiteSettingVo.java
@@ -25,6 +25,9 @@ public class SiteSettingVo {
     @With
     URL url;
 
+    @With
+    String version;
+
     String subtitle;
 
     String logo;
diff --git a/application/src/test/java/run/halo/app/theme/SiteSettingVariablesAcquirerTest.java b/application/src/test/java/run/halo/app/theme/SiteSettingVariablesAcquirerTest.java
index 8fd8066abc..11d6dce143 100644
--- a/application/src/test/java/run/halo/app/theme/SiteSettingVariablesAcquirerTest.java
+++ b/application/src/test/java/run/halo/app/theme/SiteSettingVariablesAcquirerTest.java
@@ -6,6 +6,7 @@
 import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.when;
 
+import com.github.zafarkhaja.semver.Version;
 import java.net.MalformedURLException;
 import java.net.URL;
 import java.util.Map;
@@ -20,6 +21,7 @@
 import run.halo.app.extension.ConfigMap;
 import run.halo.app.infra.ExternalUrlSupplier;
 import run.halo.app.infra.SystemConfigurableEnvironmentFetcher;
+import run.halo.app.infra.SystemVersionSupplier;
 import run.halo.app.theme.finders.vo.SiteSettingVo;
 
 /**
@@ -32,6 +34,10 @@
 public class SiteSettingVariablesAcquirerTest {
     @Mock
     private ExternalUrlSupplier externalUrlSupplier;
+
+    @Mock
+    private SystemVersionSupplier systemVersionSupplier;
+
     @Mock
     private SystemConfigurableEnvironmentFetcher environmentFetcher;
 
@@ -45,6 +51,7 @@ void acquireWhenExternalUrlSet() throws MalformedURLException {
 
         var url = new URL("https://halo.run");
         when(externalUrlSupplier.getURL(any())).thenReturn(url);
+        when(systemVersionSupplier.get()).thenReturn(Version.parse("0.0.0-alpha.1"));
         when(environmentFetcher.getConfigMap()).thenReturn(Mono.just(configMap));
 
         siteSettingVariablesAcquirer.acquire(mock(ServerWebExchange.class))
@@ -52,9 +59,13 @@ void acquireWhenExternalUrlSet() throws MalformedURLException {
             .consumeNextWith(result -> {
                 assertThat(result).containsKey("site");
                 assertThat(result.get("site")).isInstanceOf(SiteSettingVo.class);
-                assertThat((SiteSettingVo) result.get("site"))
+                var site = (SiteSettingVo) result.get("site");
+                assertThat(site)
                     .extracting(SiteSettingVo::getUrl)
                     .isEqualTo(url);
+                assertThat(site)
+                    .extracting(SiteSettingVo::getVersion)
+                    .isEqualTo("0.0.0-alpha.1");
             })
             .verifyComplete();
         verify(externalUrlSupplier).getURL(any());

From 1c3191777856e5703bbe9473d378994ea8a76582 Mon Sep 17 00:00:00 2001
From: guqing <38999863+guqing@users.noreply.github.com>
Date: Thu, 19 Sep 2024 15:50:55 +0800
Subject: [PATCH 027/185] chore: replace deprecated Version methods with
 updated API (#6678)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?
/milestone 2.20.x
/area core

#### What this PR does / why we need it:
替换 Version 过时方法的引用为新 API

#### Does this PR introduce a user-facing change?
```release-note
None
```
---
 .../app/core/extension/service/impl/PluginServiceImpl.java    | 2 +-
 .../java/run/halo/app/infra/DefaultSystemVersionSupplier.java | 4 ++--
 .../src/main/java/run/halo/app/infra/utils/VersionUtils.java  | 2 +-
 .../halo/app/core/extension/endpoint/PluginEndpointTest.java  | 2 +-
 .../app/core/extension/reconciler/ThemeReconcilerTest.java    | 4 ++--
 .../core/extension/service/impl/PluginServiceImplTest.java    | 2 +-
 .../halo/app/core/extension/theme/ThemeServiceImplTest.java   | 2 +-
 .../run/halo/app/infra/DefaultSystemVersionSupplierTest.java  | 2 +-
 8 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/application/src/main/java/run/halo/app/core/extension/service/impl/PluginServiceImpl.java b/application/src/main/java/run/halo/app/core/extension/service/impl/PluginServiceImpl.java
index 991250aac0..266f0df396 100644
--- a/application/src/main/java/run/halo/app/core/extension/service/impl/PluginServiceImpl.java
+++ b/application/src/main/java/run/halo/app/core/extension/service/impl/PluginServiceImpl.java
@@ -476,7 +476,7 @@ private void satisfiesRequiresVersion(Plugin newPlugin) {
         Version version = systemVersion.get();
         // validate the plugin version
         // only use the nominal system version to compare, the format is like MAJOR.MINOR.PATCH
-        String systemVersion = version.getNormalVersion();
+        String systemVersion = version.toStableVersion().toString();
         String requires = newPlugin.getSpec().getRequires();
         if (!VersionUtils.satisfiesRequires(systemVersion, requires)) {
             throw new UnsatisfiedAttributeValueException(String.format(
diff --git a/application/src/main/java/run/halo/app/infra/DefaultSystemVersionSupplier.java b/application/src/main/java/run/halo/app/infra/DefaultSystemVersionSupplier.java
index f91b48e732..806070a6bf 100644
--- a/application/src/main/java/run/halo/app/infra/DefaultSystemVersionSupplier.java
+++ b/application/src/main/java/run/halo/app/infra/DefaultSystemVersionSupplier.java
@@ -26,9 +26,9 @@ public DefaultSystemVersionSupplier(ObjectProvider<BuildProperties> buildPropert
     public Version get() {
         var properties = buildProperties.getIfUnique();
         if (properties == null) {
-            return Version.valueOf(DEFAULT_VERSION);
+            return Version.parse(DEFAULT_VERSION);
         }
         var projectVersion = Objects.toString(properties.getVersion(), DEFAULT_VERSION);
-        return Version.valueOf(projectVersion);
+        return Version.parse(projectVersion);
     }
 }
diff --git a/application/src/main/java/run/halo/app/infra/utils/VersionUtils.java b/application/src/main/java/run/halo/app/infra/utils/VersionUtils.java
index 09441ac08e..2f537b9441 100644
--- a/application/src/main/java/run/halo/app/infra/utils/VersionUtils.java
+++ b/application/src/main/java/run/halo/app/infra/utils/VersionUtils.java
@@ -41,7 +41,7 @@ public static boolean checkVersionConstraint(String version, String constraint)
         try {
             return StringUtils.isBlank(constraint)
                 || "*".equals(constraint)
-                || Version.valueOf(version).satisfies(constraint);
+                || Version.parse(version).satisfies(constraint);
         } catch (Exception e) {
             throw new ServerWebInputException("Illegal requires version expression.", null, e);
         }
diff --git a/application/src/test/java/run/halo/app/core/extension/endpoint/PluginEndpointTest.java b/application/src/test/java/run/halo/app/core/extension/endpoint/PluginEndpointTest.java
index 3de56eb726..2ff443606a 100644
--- a/application/src/test/java/run/halo/app/core/extension/endpoint/PluginEndpointTest.java
+++ b/application/src/test/java/run/halo/app/core/extension/endpoint/PluginEndpointTest.java
@@ -183,7 +183,7 @@ void setUp() throws URISyntaxException, IOException {
             webClient = WebTestClient.bindToRouterFunction(endpoint.endpoint())
                 .build();
 
-            lenient().when(systemVersionSupplier.get()).thenReturn(Version.valueOf("0.0.0"));
+            lenient().when(systemVersionSupplier.get()).thenReturn(Version.parse("0.0.0"));
             tempDirectory = Files.createTempDirectory("halo-test-plugin-upgrade-");
             plugin002 = tempDirectory.resolve("plugin-0.0.2.jar");
 
diff --git a/application/src/test/java/run/halo/app/core/extension/reconciler/ThemeReconcilerTest.java b/application/src/test/java/run/halo/app/core/extension/reconciler/ThemeReconcilerTest.java
index b18f928a8b..e95044c8cd 100644
--- a/application/src/test/java/run/halo/app/core/extension/reconciler/ThemeReconcilerTest.java
+++ b/application/src/test/java/run/halo/app/core/extension/reconciler/ThemeReconcilerTest.java
@@ -74,7 +74,7 @@ class ThemeReconcilerTest {
     @BeforeEach
     void setUp() throws IOException {
         defaultTheme = ResourceUtils.getFile("classpath:themes/default");
-        lenient().when(systemVersionSupplier.get()).thenReturn(Version.valueOf("0.0.0"));
+        lenient().when(systemVersionSupplier.get()).thenReturn(Version.parse("0.0.0"));
     }
 
     @Test
@@ -190,7 +190,7 @@ void reconcileDeleteRetryWhenThrowException() {
 
     @Test
     void reconcileStatus() {
-        when(systemVersionSupplier.get()).thenReturn(Version.valueOf("2.3.0"));
+        when(systemVersionSupplier.get()).thenReturn(Version.parse("2.3.0"));
         Path testWorkDir = tempDirectory.resolve("reconcile-delete");
         when(themeRoot.get()).thenReturn(testWorkDir);
 
diff --git a/application/src/test/java/run/halo/app/core/extension/service/impl/PluginServiceImplTest.java b/application/src/test/java/run/halo/app/core/extension/service/impl/PluginServiceImplTest.java
index 2e79ce0fe5..d90303fa1c 100644
--- a/application/src/test/java/run/halo/app/core/extension/service/impl/PluginServiceImplTest.java
+++ b/application/src/test/java/run/halo/app/core/extension/service/impl/PluginServiceImplTest.java
@@ -123,7 +123,7 @@ void setUp() throws URISyntaxException, IOException {
                 getClass().getClassLoader().getResource("plugin/plugin-0.0.2")).toURI();
             FileUtils.jar(Paths.get(fakePluingUri), tempDirectory.resolve("plugin-0.0.2.jar"));
 
-            lenient().when(systemVersionSupplier.get()).thenReturn(Version.valueOf("0.0.0"));
+            lenient().when(systemVersionSupplier.get()).thenReturn(Version.parse("0.0.0"));
         }
 
         @Test
diff --git a/application/src/test/java/run/halo/app/core/extension/theme/ThemeServiceImplTest.java b/application/src/test/java/run/halo/app/core/extension/theme/ThemeServiceImplTest.java
index 045b5f14e7..6ef808b8da 100644
--- a/application/src/test/java/run/halo/app/core/extension/theme/ThemeServiceImplTest.java
+++ b/application/src/test/java/run/halo/app/core/extension/theme/ThemeServiceImplTest.java
@@ -78,7 +78,7 @@ void setUp() throws IOException {
         // init the folder
         Files.createDirectory(themeRoot.get());
 
-        lenient().when(systemVersionSupplier.get()).thenReturn(Version.valueOf("0.0.0"));
+        lenient().when(systemVersionSupplier.get()).thenReturn(Version.parse("0.0.0"));
     }
 
     @AfterEach
diff --git a/application/src/test/java/run/halo/app/infra/DefaultSystemVersionSupplierTest.java b/application/src/test/java/run/halo/app/infra/DefaultSystemVersionSupplierTest.java
index 6be7f0a5f1..217de47a9e 100644
--- a/application/src/test/java/run/halo/app/infra/DefaultSystemVersionSupplierTest.java
+++ b/application/src/test/java/run/halo/app/infra/DefaultSystemVersionSupplierTest.java
@@ -60,6 +60,6 @@ void getWhenBuildPropertiesAndVersionNotEmpty() {
         when(buildPropertiesProvider.getIfUnique()).thenReturn(buildProperties);
         version = systemVersionSupplier.get();
         assertThat(version.toString()).isEqualTo("2.0.0-SNAPSHOT");
-        assertThat(version.getPreReleaseVersion()).isEqualTo("SNAPSHOT");
+        assertThat(version.preReleaseVersion().orElseThrow()).isEqualTo("SNAPSHOT");
     }
 }
\ No newline at end of file

From fb9aff00cad2904f4c4fe7e2067b37cb8afd8c23 Mon Sep 17 00:00:00 2001
From: John Niang <johnniang@foxmail.com>
Date: Thu, 19 Sep 2024 18:16:55 +0800
Subject: [PATCH 028/185] Add chunked transfer support for rendering templates
 (#6580)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/kind improvement
/area core
/milestone 2.20.x

#### What this PR does / why we need it:

This PR adds chunked transfer support for rendering templates, which means that the max memory used by rendering template will be max chunk size instead of size of rendering result.

Users can define the max chunk size like below:

```yaml
spring:
  thymeleaf:
    reactive:
      maxChunkSize: 8KB # Setting to 0 will disable the chunked response.
```

#### Special notes for your reviewer:

1. Try to start Halo instance
2. Execute the command like below and see if the response headers contain `transfer-encoding: chunked`:

    ```bash
	http http://localhost:8090/ -p h
	HTTP/1.1 200 OK
	Cache-Control: no-cache, no-store, max-age=0, must-revalidate
	Content-Language: en-CN
	Content-Type: text/html
	Expires: 0
	Pragma: no-cache
	Referrer-Policy: strict-origin-when-cross-origin
	Vary: Origin
	Vary: Access-Control-Request-Method
	Vary: Access-Control-Request-Headers
	X-Content-Type-Options: nosniff
	X-Frame-Options: SAMEORIGIN
	X-XSS-Protection: 0
	content-encoding: gzip
	set-cookie: XSRF-TOKEN=1e677724-ce82-4b63-911c-f78b22cd9169; Path=/
	transfer-encoding: chunked
	```

#### Does this PR introduce a user-facing change?

```release-note
优化模板渲染时所需的内存
```
---
 .../run/halo/app/theme/HaloViewResolver.java  | 45 +++++++++++++++++--
 .../app/theme/engine/HaloTemplateEngine.java  | 13 +++++-
 .../src/main/resources/application.yaml       |  3 ++
 3 files changed, 56 insertions(+), 5 deletions(-)

diff --git a/application/src/main/java/run/halo/app/theme/HaloViewResolver.java b/application/src/main/java/run/halo/app/theme/HaloViewResolver.java
index 540e54512d..3446240d03 100644
--- a/application/src/main/java/run/halo/app/theme/HaloViewResolver.java
+++ b/application/src/main/java/run/halo/app/theme/HaloViewResolver.java
@@ -6,11 +6,16 @@
 import java.util.Map;
 import java.util.Optional;
 import org.attoparser.ParseException;
+import org.springframework.beans.factory.InitializingBean;
 import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.boot.autoconfigure.thymeleaf.ThymeleafProperties;
+import org.springframework.boot.context.properties.PropertyMapper;
 import org.springframework.context.ApplicationContext;
+import org.springframework.core.Ordered;
 import org.springframework.http.MediaType;
 import org.springframework.lang.NonNull;
 import org.springframework.stereotype.Component;
+import org.springframework.util.unit.DataSize;
 import org.springframework.web.ErrorResponse;
 import org.springframework.web.reactive.result.view.View;
 import org.springframework.web.server.ServerWebExchange;
@@ -24,13 +29,16 @@
 import run.halo.app.theme.router.ModelConst;
 
 @Component("thymeleafReactiveViewResolver")
-public class HaloViewResolver extends ThymeleafReactiveViewResolver {
+public class HaloViewResolver extends ThymeleafReactiveViewResolver implements InitializingBean {
 
     private final FinderRegistry finderRegistry;
 
-    public HaloViewResolver(FinderRegistry finderRegistry) {
-        setViewClass(HaloView.class);
+    private final ThymeleafProperties thymeleafProperties;
+
+    public HaloViewResolver(FinderRegistry finderRegistry,
+        ThymeleafProperties thymeleafProperties) {
         this.finderRegistry = finderRegistry;
+        this.thymeleafProperties = thymeleafProperties;
     }
 
     @Override
@@ -44,6 +52,37 @@ protected Mono<View> loadView(String viewName, Locale locale) {
             });
     }
 
+    @Override
+    public void afterPropertiesSet() throws Exception {
+        setViewClass(HaloView.class);
+        var map = PropertyMapper.get();
+        map.from(thymeleafProperties::getEncoding)
+            .whenNonNull()
+            .to(this::setDefaultCharset);
+        map.from(thymeleafProperties::getExcludedViewNames)
+            .whenNonNull()
+            .to(this::setExcludedViewNames);
+        map.from(thymeleafProperties::getViewNames)
+            .whenNonNull()
+            .to(this::setViewNames);
+
+        var reactive = thymeleafProperties.getReactive();
+        map.from(reactive::getMediaTypes)
+            .whenNonNull()
+            .to(this::setSupportedMediaTypes);
+        map.from(reactive::getFullModeViewNames)
+            .whenNonNull()
+            .to(this::setFullModeViewNames);
+        map.from(reactive::getChunkedModeViewNames)
+            .whenNonNull()
+            .to(this::setChunkedModeViewNames);
+        map.from(reactive::getMaxChunkSize)
+            .asInt(DataSize::toBytes)
+            .when(size -> size > 0)
+            .to(this::setResponseMaxChunkSizeBytes);
+        setOrder(Ordered.LOWEST_PRECEDENCE - 5);
+    }
+
     public static class HaloView extends ThymeleafReactiveView {
 
         @Autowired
diff --git a/application/src/main/java/run/halo/app/theme/engine/HaloTemplateEngine.java b/application/src/main/java/run/halo/app/theme/engine/HaloTemplateEngine.java
index fcbd3c3e19..c890d57dfd 100644
--- a/application/src/main/java/run/halo/app/theme/engine/HaloTemplateEngine.java
+++ b/application/src/main/java/run/halo/app/theme/engine/HaloTemplateEngine.java
@@ -42,10 +42,19 @@ public Publisher<DataBuffer> processStream(String template, Set<String> markupSe
         // We have to subscribe on blocking thread, because some blocking operations will be present
         // while processing.
         if (publisher instanceof Mono<DataBuffer> mono) {
-            return mono.subscribeOn(Schedulers.boundedElastic());
+            return mono.subscribeOn(Schedulers.boundedElastic())
+                // We should switch back to non-blocking thread.
+                // See https://github.com/spring-projects/spring-framework/issues/26958
+                // for more details.
+                .publishOn(Schedulers.parallel());
         }
         if (publisher instanceof Flux<DataBuffer> flux) {
-            return flux.subscribeOn(Schedulers.boundedElastic());
+            return flux
+                .subscribeOn(Schedulers.boundedElastic())
+                // We should switch back to non-blocking thread.
+                // See https://github.com/spring-projects/spring-framework/issues/26958
+                // for more details.
+                .publishOn(Schedulers.parallel());
         }
         return publisher;
     }
diff --git a/application/src/main/resources/application.yaml b/application/src/main/resources/application.yaml
index a24b43d73c..681a94adc3 100644
--- a/application/src/main/resources/application.yaml
+++ b/application/src/main/resources/application.yaml
@@ -27,6 +27,9 @@ spring:
       cache:
         cachecontrol:
           max-age: 365d
+  thymeleaf:
+    reactive:
+      maxChunkSize: 8KB
   cache:
     type: caffeine
     caffeine:

From a87dedd916314bc81fa319adc6a024b14bf81c92 Mon Sep 17 00:00:00 2001
From: John Niang <johnniang@foxmail.com>
Date: Fri, 20 Sep 2024 11:14:58 +0800
Subject: [PATCH 029/185] Make ApplicationContext inaccessible in
 ITemplateContext (#6680)

#### What type of PR is this?

/kind improvement
/area core
/area plugin
/milestone 2.20.x

#### What this PR does / why we need it:

This PR disables access to ApplicationContext using ITemplateContext.

#### Does this PR introduce a user-facing change?

```release-note
None
```
---
 .../dialect/CommentElementTagProcessor.java   |   2 +-
 .../dialect/GlobalHeadInjectionProcessor.java |   4 +-
 .../dialect/HaloPostTemplateHandler.java      |   3 +-
 .../theme/dialect/SecureTemplateContext.java  | 159 ++++++++++++++++++
 .../TemplateFooterElementTagProcessor.java    |   4 +-
 .../dialect/HaloPostTemplateHandlerTest.java  |  10 +-
 6 files changed, 172 insertions(+), 10 deletions(-)
 create mode 100644 application/src/main/java/run/halo/app/theme/dialect/SecureTemplateContext.java

diff --git a/application/src/main/java/run/halo/app/theme/dialect/CommentElementTagProcessor.java b/application/src/main/java/run/halo/app/theme/dialect/CommentElementTagProcessor.java
index 96b9935c1e..f449f2e696 100644
--- a/application/src/main/java/run/halo/app/theme/dialect/CommentElementTagProcessor.java
+++ b/application/src/main/java/run/halo/app/theme/dialect/CommentElementTagProcessor.java
@@ -45,6 +45,6 @@ protected void doProcess(ITemplateContext context, IProcessableElementTag tag,
             structureHandler.replaceWith("", false);
             return;
         }
-        commentWidget.render(context, tag, structureHandler);
+        commentWidget.render(new SecureTemplateContext(context), tag, structureHandler);
     }
 }
diff --git a/application/src/main/java/run/halo/app/theme/dialect/GlobalHeadInjectionProcessor.java b/application/src/main/java/run/halo/app/theme/dialect/GlobalHeadInjectionProcessor.java
index 6be5c52bbf..a346d42e0b 100644
--- a/application/src/main/java/run/halo/app/theme/dialect/GlobalHeadInjectionProcessor.java
+++ b/application/src/main/java/run/halo/app/theme/dialect/GlobalHeadInjectionProcessor.java
@@ -71,7 +71,9 @@ protected void doProcess(ITemplateContext context, IModel model,
 
         // apply processors to modelToInsert
         getTemplateHeadProcessors(context)
-            .concatMap(processor -> processor.process(context, modelToInsert, structureHandler))
+            .concatMap(processor -> processor.process(
+                new SecureTemplateContext(context), modelToInsert, structureHandler)
+            )
             .then()
             .block();
 
diff --git a/application/src/main/java/run/halo/app/theme/dialect/HaloPostTemplateHandler.java b/application/src/main/java/run/halo/app/theme/dialect/HaloPostTemplateHandler.java
index 1eebd67fea..25755a457a 100644
--- a/application/src/main/java/run/halo/app/theme/dialect/HaloPostTemplateHandler.java
+++ b/application/src/main/java/run/halo/app/theme/dialect/HaloPostTemplateHandler.java
@@ -57,7 +57,8 @@ private IProcessableElementTag handleElementTag(
             var context = getContext();
             for (ElementTagPostProcessor elementTagPostProcessor : postProcessors) {
                 tagProcessorChain = tagProcessorChain.flatMap(
-                    tag -> elementTagPostProcessor.process(context, tag).defaultIfEmpty(tag)
+                    tag -> elementTagPostProcessor.process(new SecureTemplateContext(context), tag)
+                        .defaultIfEmpty(tag)
                 );
             }
             processedTag =
diff --git a/application/src/main/java/run/halo/app/theme/dialect/SecureTemplateContext.java b/application/src/main/java/run/halo/app/theme/dialect/SecureTemplateContext.java
new file mode 100644
index 0000000000..3fe8d04036
--- /dev/null
+++ b/application/src/main/java/run/halo/app/theme/dialect/SecureTemplateContext.java
@@ -0,0 +1,159 @@
+package run.halo.app.theme.dialect;
+
+import static org.thymeleaf.spring6.expression.ThymeleafEvaluationContext.THYMELEAF_EVALUATION_CONTEXT_CONTEXT_VARIABLE_NAME;
+
+import java.util.List;
+import java.util.Locale;
+import java.util.Map;
+import java.util.Objects;
+import java.util.Set;
+import java.util.stream.Collectors;
+import org.thymeleaf.IEngineConfiguration;
+import org.thymeleaf.context.ITemplateContext;
+import org.thymeleaf.context.IdentifierSequences;
+import org.thymeleaf.engine.TemplateData;
+import org.thymeleaf.expression.IExpressionObjects;
+import org.thymeleaf.inline.IInliner;
+import org.thymeleaf.model.IModelFactory;
+import org.thymeleaf.model.IProcessableElementTag;
+import org.thymeleaf.templatemode.TemplateMode;
+
+/**
+ * Secure template context.
+ *
+ * @author johnniang
+ * @since 2.20.0
+ */
+class SecureTemplateContext implements ITemplateContext {
+
+    private static final Set<String> DANGEROUS_VARIABLES =
+        Set.of(THYMELEAF_EVALUATION_CONTEXT_CONTEXT_VARIABLE_NAME);
+
+    private final ITemplateContext delegate;
+
+    public SecureTemplateContext(ITemplateContext delegate) {
+        this.delegate = delegate;
+    }
+
+    @Override
+    public TemplateData getTemplateData() {
+        return delegate.getTemplateData();
+    }
+
+    @Override
+    public TemplateMode getTemplateMode() {
+        return delegate.getTemplateMode();
+    }
+
+    @Override
+    public List<TemplateData> getTemplateStack() {
+        return delegate.getTemplateStack();
+    }
+
+    @Override
+    public List<IProcessableElementTag> getElementStack() {
+        return delegate.getElementStack();
+    }
+
+    @Override
+    public Map<String, Object> getTemplateResolutionAttributes() {
+        return delegate.getTemplateResolutionAttributes();
+    }
+
+    @Override
+    public IModelFactory getModelFactory() {
+        return delegate.getModelFactory();
+    }
+
+    @Override
+    public boolean hasSelectionTarget() {
+        return delegate.hasSelectionTarget();
+    }
+
+    @Override
+    public Object getSelectionTarget() {
+        return delegate.getSelectionTarget();
+    }
+
+    @Override
+    public IInliner getInliner() {
+        return delegate.getInliner();
+    }
+
+    @Override
+    public String getMessage(
+        Class<?> origin,
+        String key,
+        Object[] messageParameters,
+        boolean useAbsentMessageRepresentation
+    ) {
+        return delegate.getMessage(origin, key, messageParameters, useAbsentMessageRepresentation);
+    }
+
+    @Override
+    public String buildLink(String base, Map<String, Object> parameters) {
+        return delegate.buildLink(base, parameters);
+    }
+
+    @Override
+    public IdentifierSequences getIdentifierSequences() {
+        return delegate.getIdentifierSequences();
+    }
+
+    @Override
+    public IEngineConfiguration getConfiguration() {
+        return delegate.getConfiguration();
+    }
+
+    @Override
+    public IExpressionObjects getExpressionObjects() {
+        return delegate.getExpressionObjects();
+    }
+
+    @Override
+    public Locale getLocale() {
+        return delegate.getLocale();
+    }
+
+    @Override
+    public boolean containsVariable(String name) {
+        if (DANGEROUS_VARIABLES.contains(name)) {
+            return false;
+        }
+        return delegate.containsVariable(name);
+    }
+
+    @Override
+    public Set<String> getVariableNames() {
+        return delegate.getVariableNames()
+            .stream()
+            .filter(name -> !DANGEROUS_VARIABLES.contains(name))
+            .collect(Collectors.toSet());
+    }
+
+    @Override
+    public Object getVariable(String name) {
+        if (DANGEROUS_VARIABLES.contains(name)) {
+            return null;
+        }
+        return delegate.getVariable(name);
+    }
+
+    @Override
+    public boolean equals(Object o) {
+        if (this == o) {
+            return true;
+        }
+        if (o == null || getClass() != o.getClass()) {
+            return false;
+        }
+
+        SecureTemplateContext that = (SecureTemplateContext) o;
+        return Objects.equals(delegate, that.delegate);
+    }
+
+    @Override
+    public int hashCode() {
+        return Objects.hashCode(delegate);
+    }
+}
diff --git a/application/src/main/java/run/halo/app/theme/dialect/TemplateFooterElementTagProcessor.java b/application/src/main/java/run/halo/app/theme/dialect/TemplateFooterElementTagProcessor.java
index 74239b1f2e..26a286b26a 100644
--- a/application/src/main/java/run/halo/app/theme/dialect/TemplateFooterElementTagProcessor.java
+++ b/application/src/main/java/run/halo/app/theme/dialect/TemplateFooterElementTagProcessor.java
@@ -58,8 +58,8 @@ protected void doProcess(ITemplateContext context, IProcessableElementTag tag,
         modelToInsert.add(context.getModelFactory().createText(globalFooterText));
 
         getTemplateFooterProcessors(context)
-            .concatMap(processor -> processor.process(context, tag,
-                structureHandler, modelToInsert)
+            .concatMap(processor -> processor.process(
+                new SecureTemplateContext(context), tag, structureHandler, modelToInsert)
             )
             .then()
             .block();
diff --git a/application/src/test/java/run/halo/app/theme/dialect/HaloPostTemplateHandlerTest.java b/application/src/test/java/run/halo/app/theme/dialect/HaloPostTemplateHandlerTest.java
index 20c32f90b3..9d6266f2d7 100644
--- a/application/src/test/java/run/halo/app/theme/dialect/HaloPostTemplateHandlerTest.java
+++ b/application/src/test/java/run/halo/app/theme/dialect/HaloPostTemplateHandlerTest.java
@@ -82,7 +82,7 @@ void shouldHandleStandaloneElementIfNoElementTagProcessors(
     void shouldHandleStandaloneElementIfOneElementTagProcessorProvided() {
         var processor = mock(ElementTagPostProcessor.class);
         var newTag = mock(IStandaloneElementTag.class);
-        when(processor.process(templateContext, standaloneElementTag))
+        when(processor.process(new SecureTemplateContext(templateContext), standaloneElementTag))
             .thenReturn(Mono.just(newTag));
         when(extensionGetter.getExtensionList(ElementTagPostProcessor.class))
             .thenReturn(List.of(processor));
@@ -97,7 +97,7 @@ void shouldHandleStandaloneElementIfOneElementTagProcessorProvided() {
     void shouldHandleStandaloneElementIfTagTypeChanged() {
         var processor = mock(ElementTagPostProcessor.class);
         var newTag = mock(IStandaloneElementTag.class);
-        when(processor.process(templateContext, standaloneElementTag))
+        when(processor.process(new SecureTemplateContext(templateContext), standaloneElementTag))
             .thenReturn(Mono.just(newTag));
         when(extensionGetter.getExtensionList(ElementTagPostProcessor.class))
             .thenReturn(List.of(processor));
@@ -114,9 +114,9 @@ void shouldHandleStandaloneElementIfMoreElementTagProcessorsProvided() {
         var processor2 = mock(ElementTagPostProcessor.class);
         var newTag1 = mock(IStandaloneElementTag.class);
         var newTag2 = mock(IStandaloneElementTag.class);
-        when(processor1.process(templateContext, standaloneElementTag))
+        when(processor1.process(new SecureTemplateContext(templateContext), standaloneElementTag))
             .thenReturn(Mono.just(newTag1));
-        when(processor2.process(templateContext, newTag1))
+        when(processor2.process(new SecureTemplateContext(templateContext), newTag1))
             .thenReturn(Mono.just(newTag2));
         when(extensionGetter.getExtensionList(ElementTagPostProcessor.class))
             .thenReturn(List.of(processor1, processor2));
@@ -131,7 +131,7 @@ void shouldHandleStandaloneElementIfMoreElementTagProcessorsProvided() {
     void shouldNotHandleIfProcessedTagTypeChanged() {
         var processor = mock(ElementTagPostProcessor.class);
         var newTag = mock(IOpenElementTag.class);
-        when(processor.process(templateContext, standaloneElementTag))
+        when(processor.process(new SecureTemplateContext(templateContext), standaloneElementTag))
             .thenReturn(Mono.just(newTag));
         when(extensionGetter.getExtensionList(ElementTagPostProcessor.class))
             .thenReturn(List.of(processor));

From df195b12f2801b1de7119bd3552afa796ac44889 Mon Sep 17 00:00:00 2001
From: John Niang <johnniang@foxmail.com>
Date: Fri, 20 Sep 2024 11:16:59 +0800
Subject: [PATCH 030/185] Make ApplicationContext inaccessible in
 ServerWebExchange (#6679)

#### What type of PR is this?

/kind improvement
/area core
/area plugin
/milestone 2.20.x

#### What this PR does / why we need it:

Plugins can implement their own RouterFunctions and ControllerMappings, but those might expose root ApplicationContext for plugins, which is not expected.

So this PR fixes the insecure access to root ApplicationContext.

#### Does this PR introduce a user-facing change?

```release-note
None
```
---
 .../run/halo/app/config/WebFluxConfig.java    | 16 ++++++++++
 .../SecureRequestMappingHandlerAdapter.java   | 26 ++++++++++++++++
 .../halo/app/infra/SecureServerRequest.java   | 31 +++++++++++++++++++
 .../app/infra/SecureServerWebExchange.java    | 25 +++++++++++++++
 .../app/plugin/AggregatedRouterFunction.java  |  3 +-
 .../DefaultPluginRouterFunctionRegistry.java  |  4 ++-
 6 files changed, 103 insertions(+), 2 deletions(-)
 create mode 100644 application/src/main/java/run/halo/app/infra/SecureRequestMappingHandlerAdapter.java
 create mode 100644 application/src/main/java/run/halo/app/infra/SecureServerRequest.java
 create mode 100644 application/src/main/java/run/halo/app/infra/SecureServerWebExchange.java

diff --git a/application/src/main/java/run/halo/app/config/WebFluxConfig.java b/application/src/main/java/run/halo/app/config/WebFluxConfig.java
index 1a864ca635..22a8b50e15 100644
--- a/application/src/main/java/run/halo/app/config/WebFluxConfig.java
+++ b/application/src/main/java/run/halo/app/config/WebFluxConfig.java
@@ -12,6 +12,7 @@
 import java.util.Objects;
 import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
 import org.springframework.boot.autoconfigure.web.WebProperties;
+import org.springframework.boot.autoconfigure.web.reactive.WebFluxRegistrations;
 import org.springframework.context.ApplicationContext;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
@@ -33,6 +34,7 @@
 import org.springframework.web.reactive.function.server.ServerResponse;
 import org.springframework.web.reactive.resource.EncodedResourceResolver;
 import org.springframework.web.reactive.resource.PathResourceResolver;
+import org.springframework.web.reactive.result.method.annotation.RequestMappingHandlerAdapter;
 import org.springframework.web.reactive.result.view.ViewResolutionResultHandler;
 import org.springframework.web.reactive.result.view.ViewResolver;
 import reactor.core.publisher.Mono;
@@ -41,6 +43,7 @@
 import run.halo.app.core.endpoint.WebSocketHandlerMapping;
 import run.halo.app.core.extension.endpoint.CustomEndpoint;
 import run.halo.app.core.extension.endpoint.CustomEndpointsBuilder;
+import run.halo.app.infra.SecureRequestMappingHandlerAdapter;
 import run.halo.app.infra.properties.AttachmentProperties;
 import run.halo.app.infra.properties.HaloProperties;
 import run.halo.app.plugin.extensionpoint.ExtensionGetter;
@@ -67,6 +70,19 @@ public WebFluxConfig(ObjectMapper objectMapper,
         this.applicationContext = applicationContext;
     }
 
+    @Bean
+    WebFluxRegistrations webFluxRegistrations() {
+        return new WebFluxRegistrations() {
+            @Override
+            public RequestMappingHandlerAdapter getRequestMappingHandlerAdapter() {
+                // Because we have no chance to customize ServerWebExchangeMethodArgumentResolver,
+                // we have to use SecureRequestMappingHandlerAdapter to replace a secure
+                // ServerWebExchange.
+                return new SecureRequestMappingHandlerAdapter();
+            }
+        };
+    }
+
     @Bean
     ServerResponse.Context context(CodecConfigurer codec,
         ViewResolutionResultHandler resultHandler) {
diff --git a/application/src/main/java/run/halo/app/infra/SecureRequestMappingHandlerAdapter.java b/application/src/main/java/run/halo/app/infra/SecureRequestMappingHandlerAdapter.java
new file mode 100644
index 0000000000..78b75531de
--- /dev/null
+++ b/application/src/main/java/run/halo/app/infra/SecureRequestMappingHandlerAdapter.java
@@ -0,0 +1,26 @@
+package run.halo.app.infra;
+
+import org.springframework.lang.NonNull;
+import org.springframework.web.reactive.HandlerResult;
+import org.springframework.web.reactive.result.method.annotation.RequestMappingHandlerAdapter;
+import org.springframework.web.server.ServerWebExchange;
+import reactor.core.publisher.Mono;
+
+/**
+ * Secure request mapping handler adapter.
+ *
+ * @author johnniang
+ * @since 2.20.0
+ */
+public class SecureRequestMappingHandlerAdapter extends RequestMappingHandlerAdapter {
+
+    @Override
+    @NonNull
+    public Mono<HandlerResult> handle(
+        @NonNull ServerWebExchange exchange,
+        @NonNull Object handler
+    ) {
+        return super.handle(new SecureServerWebExchange(exchange), handler);
+    }
+
+}
diff --git a/application/src/main/java/run/halo/app/infra/SecureServerRequest.java b/application/src/main/java/run/halo/app/infra/SecureServerRequest.java
new file mode 100644
index 0000000000..851b8140c6
--- /dev/null
+++ b/application/src/main/java/run/halo/app/infra/SecureServerRequest.java
@@ -0,0 +1,31 @@
+package run.halo.app.infra;
+
+import org.springframework.lang.NonNull;
+import org.springframework.web.reactive.function.server.ServerRequest;
+import org.springframework.web.reactive.function.server.support.ServerRequestWrapper;
+import org.springframework.web.server.ServerWebExchange;
+
+/**
+ * Secure server request without application context available.
+ *
+ * @author johnniang
+ * @since 2.20.0
+ */
+public class SecureServerRequest extends ServerRequestWrapper {
+
+    /**
+     * Create a new {@code ServerRequestWrapper} that wraps the given request.
+     *
+     * @param delegate the request to wrap
+     */
+    public SecureServerRequest(ServerRequest delegate) {
+        super(delegate);
+    }
+
+    @Override
+    @NonNull
+    public ServerWebExchange exchange() {
+        return new SecureServerWebExchange(super.exchange());
+    }
+
+}
diff --git a/application/src/main/java/run/halo/app/infra/SecureServerWebExchange.java b/application/src/main/java/run/halo/app/infra/SecureServerWebExchange.java
new file mode 100644
index 0000000000..4d244532fb
--- /dev/null
+++ b/application/src/main/java/run/halo/app/infra/SecureServerWebExchange.java
@@ -0,0 +1,25 @@
+package run.halo.app.infra;
+
+import org.springframework.context.ApplicationContext;
+import org.springframework.web.server.ServerWebExchange;
+import org.springframework.web.server.ServerWebExchangeDecorator;
+
+/**
+ * Secure server web exchange without application context available.
+ *
+ * @author johnniang
+ * @since 2.20.0
+ */
+public class SecureServerWebExchange extends ServerWebExchangeDecorator {
+
+    public SecureServerWebExchange(ServerWebExchange delegate) {
+        super(delegate);
+    }
+
+    @Override
+    public ApplicationContext getApplicationContext() {
+        // Always return null to prevent access to application context
+        return null;
+    }
+
+}
diff --git a/application/src/main/java/run/halo/app/plugin/AggregatedRouterFunction.java b/application/src/main/java/run/halo/app/plugin/AggregatedRouterFunction.java
index 396c2d49d6..6dbbbd4848 100644
--- a/application/src/main/java/run/halo/app/plugin/AggregatedRouterFunction.java
+++ b/application/src/main/java/run/halo/app/plugin/AggregatedRouterFunction.java
@@ -9,6 +9,7 @@
 import reactor.core.publisher.Mono;
 import run.halo.app.core.extension.endpoint.CustomEndpoint;
 import run.halo.app.core.extension.endpoint.CustomEndpointsBuilder;
+import run.halo.app.infra.SecureServerRequest;
 
 /**
  * Aggregated router function built from all custom endpoints.
@@ -28,7 +29,7 @@ public AggregatedRouterFunction(ObjectProvider<CustomEndpoint> customEndpoints)
 
     @Override
     public Mono<HandlerFunction<ServerResponse>> route(ServerRequest request) {
-        return aggregated.route(request);
+        return aggregated.route(new SecureServerRequest(request));
     }
 
     @Override
diff --git a/application/src/main/java/run/halo/app/plugin/DefaultPluginRouterFunctionRegistry.java b/application/src/main/java/run/halo/app/plugin/DefaultPluginRouterFunctionRegistry.java
index 602fd56063..547a07a547 100644
--- a/application/src/main/java/run/halo/app/plugin/DefaultPluginRouterFunctionRegistry.java
+++ b/application/src/main/java/run/halo/app/plugin/DefaultPluginRouterFunctionRegistry.java
@@ -11,6 +11,7 @@
 import org.springframework.web.reactive.function.server.ServerResponse;
 import reactor.core.publisher.Flux;
 import reactor.core.publisher.Mono;
+import run.halo.app.infra.SecureServerRequest;
 
 /**
  * A composite {@link RouterFunction} implementation for plugin.
@@ -31,8 +32,9 @@ public DefaultPluginRouterFunctionRegistry() {
     @Override
     @NonNull
     public Mono<HandlerFunction<ServerResponse>> route(@NonNull ServerRequest request) {
+        var secureRequest = new SecureServerRequest(request);
         return Flux.fromIterable(this.routerFunctions)
-            .concatMap(routerFunction -> routerFunction.route(request))
+            .concatMap(routerFunction -> routerFunction.route(secureRequest))
             .next();
     }
 

From 0dcab3271222bfaf525b179403be3c867f47bf11 Mon Sep 17 00:00:00 2001
From: guqing <i@guqing.email>
Date: Mon, 23 Sep 2024 15:55:16 +0800
Subject: [PATCH 031/185] feat: add API to fetch system configs by group

---
 .../core/endpoint/SystemConfigEndpoint.java   | 61 +++++++++++++++++++
 .../extensions/role-template-menu.yaml        |  4 ++
 2 files changed, 65 insertions(+)
 create mode 100644 application/src/main/java/run/halo/app/core/endpoint/SystemConfigEndpoint.java

diff --git a/application/src/main/java/run/halo/app/core/endpoint/SystemConfigEndpoint.java b/application/src/main/java/run/halo/app/core/endpoint/SystemConfigEndpoint.java
new file mode 100644
index 0000000000..57734e3367
--- /dev/null
+++ b/application/src/main/java/run/halo/app/core/endpoint/SystemConfigEndpoint.java
@@ -0,0 +1,61 @@
+package run.halo.app.core.endpoint;
+
+import static org.springdoc.core.fn.builders.apiresponse.Builder.responseBuilder;
+import static org.springdoc.core.fn.builders.content.Builder.contentBuilder;
+import static org.springdoc.core.fn.builders.parameter.Builder.parameterBuilder;
+
+import com.fasterxml.jackson.databind.node.JsonNodeFactory;
+import com.fasterxml.jackson.databind.node.ObjectNode;
+import io.swagger.v3.oas.annotations.enums.ParameterIn;
+import lombok.RequiredArgsConstructor;
+import org.springdoc.webflux.core.fn.SpringdocRouteBuilder;
+import org.springframework.http.MediaType;
+import org.springframework.stereotype.Component;
+import org.springframework.web.reactive.function.server.RouterFunction;
+import org.springframework.web.reactive.function.server.ServerRequest;
+import org.springframework.web.reactive.function.server.ServerResponse;
+import reactor.core.publisher.Mono;
+import run.halo.app.core.extension.endpoint.CustomEndpoint;
+import run.halo.app.extension.GroupVersion;
+import run.halo.app.infra.SystemConfigurableEnvironmentFetcher;
+
+@Component
+@RequiredArgsConstructor
+public class SystemConfigEndpoint implements CustomEndpoint {
+    private final SystemConfigurableEnvironmentFetcher configurableEnvironmentFetcher;
+
+    @Override
+    public RouterFunction<ServerResponse> endpoint() {
+        final var tag = "SystemConfigV1alpha1Console";
+        return SpringdocRouteBuilder.route()
+            .GET("/systemconfigs/{group}", this::getConfigByGroup,
+                builder -> builder.operationId("getSystemConfigByGroup")
+                    .description("Get system config by group")
+                    .tag(tag)
+                    .response(responseBuilder()
+                        .content(contentBuilder()
+                            .mediaType(MediaType.APPLICATION_JSON_VALUE)
+                        )
+                        .implementation(ObjectNode.class))
+                    .parameter(parameterBuilder()
+                        .in(ParameterIn.PATH)
+                        .name("group")
+                        .required(true)
+                        .description("Group of the system config")
+                    )
+            )
+            .build();
+    }
+
+    private Mono<ServerResponse> getConfigByGroup(ServerRequest request) {
+        final var group = request.pathVariable("group");
+        return configurableEnvironmentFetcher.fetch(group, ObjectNode.class)
+            .switchIfEmpty(Mono.fromSupplier(JsonNodeFactory.instance::objectNode))
+            .flatMap(json -> ServerResponse.ok().bodyValue(json));
+    }
+
+    @Override
+    public GroupVersion groupVersion() {
+        return new GroupVersion("console.api.halo.run", "v1alpha1");
+    }
+}
diff --git a/application/src/main/resources/extensions/role-template-menu.yaml b/application/src/main/resources/extensions/role-template-menu.yaml
index 24a4d71df2..9ac9608679 100644
--- a/application/src/main/resources/extensions/role-template-menu.yaml
+++ b/application/src/main/resources/extensions/role-template-menu.yaml
@@ -30,3 +30,7 @@ rules:
   - apiGroups: [ "" ]
     resources: [ "menus", "menuitems" ]
     verbs: [ "get", "list" ]
+  - apiGroups: [ "console.api.halo.run" ]
+    resources: [ "systemconfigs" ]
+    resourceNames: [ "menu" ]
+    verbs: [ "get" ]

From 8b3bde050f28d4b423f65fd2b6326631cafa5b2f Mon Sep 17 00:00:00 2001
From: John Niang <johnniang@foxmail.com>
Date: Mon, 23 Sep 2024 16:47:15 +0800
Subject: [PATCH 032/185] Refactor ReactivePropertyAccessor by wrapping
 existing PropertyAccessor (#6686)

#### What type of PR is this?

/kind improvement
/area core
/area theme

#### What this PR does / why we need it:

This PR removes ReactivePropertyAccessor because it use `AstUtils#getPropertyAccessorsToTry` which is already hidden  in [the commit](https://github.com/spring-projects/spring-framework/commit/33fbd7141d46c281cdc0a26d4bdeb21b00bdb5d3#diff-deaf3517fbd66f40a8717877a8328dee0fb2581dfb6be487f327dc73ea33b5b5). If we upgraded to Spring Boot 3.4.0-M3, the code in ReactivePropertyAccessor would be broken.

More importantly, I believe there is one issue with the current implementation although it can resolve the reactive issue.
- The PropertyAccessor modified the process flow of SPEL

This PR provides some wrappers to wrap existing PropertyAccessor and MethodResolver to evaluate reactive return value.

#### Does this PR introduce a user-facing change?

```release-note
None
```
---
 .../halo/app/infra/utils/ReactiveUtils.java   |  62 ++++++
 .../app/theme/ReactivePropertyAccessor.java   | 118 ----------
 ...activeSpelVariableExpressionEvaluator.java |  33 ++-
 .../dialect/EvaluationContextEnhancer.java    | 210 ++++++++++++++++++
 .../theme/dialect/HaloProcessorDialect.java   |   2 +-
 ...dePropertyAccessorBoundariesProcessor.java |  49 ----
 .../ReactiveFinderExpressionParserTests.java  |   1 -
 7 files changed, 288 insertions(+), 187 deletions(-)
 create mode 100644 application/src/main/java/run/halo/app/infra/utils/ReactiveUtils.java
 delete mode 100644 application/src/main/java/run/halo/app/theme/ReactivePropertyAccessor.java
 create mode 100644 application/src/main/java/run/halo/app/theme/dialect/EvaluationContextEnhancer.java
 delete mode 100644 application/src/main/java/run/halo/app/theme/dialect/JsonNodePropertyAccessorBoundariesProcessor.java

diff --git a/application/src/main/java/run/halo/app/infra/utils/ReactiveUtils.java b/application/src/main/java/run/halo/app/infra/utils/ReactiveUtils.java
new file mode 100644
index 0000000000..c87b0e03b6
--- /dev/null
+++ b/application/src/main/java/run/halo/app/infra/utils/ReactiveUtils.java
@@ -0,0 +1,62 @@
+package run.halo.app.infra.utils;
+
+import java.time.Duration;
+import org.springframework.lang.NonNull;
+import org.springframework.lang.Nullable;
+import reactor.core.publisher.Flux;
+import reactor.core.publisher.Mono;
+
+/**
+ * Utility class for reactive.
+ *
+ * @author johnniang
+ * @since 2.20.0
+ */
+public enum ReactiveUtils {
+    ;
+
+    private static final Duration DEFAULT_TIMEOUT = Duration.ofMinutes(1);
+
+    /**
+     * Resolve reactive value by blocking operation.
+     *
+     * @param value the normal value or reactive value
+     * @return the resolved value
+     */
+    @Nullable
+    public static Object blockReactiveValue(@Nullable Object value) {
+        return blockReactiveValue(value, DEFAULT_TIMEOUT);
+    }
+
+    /**
+     * Resolve reactive value by blocking operation.
+     *
+     * @param value the normal value or reactive value
+     * @param timeout the timeout of blocking operation
+     * @return the resolved value
+     */
+    @Nullable
+    public static Object blockReactiveValue(@Nullable Object value, @NonNull Duration timeout) {
+        if (value == null) {
+            return null;
+        }
+        Class<?> clazz = value.getClass();
+        if (Mono.class.isAssignableFrom(clazz)) {
+            return ((Mono<?>) value).blockOptional(timeout).orElse(null);
+        }
+        if (Flux.class.isAssignableFrom(clazz)) {
+            return ((Flux<?>) value).collectList().block(timeout);
+        }
+        return value;
+    }
+
+    /**
+     * Check if the class is a reactive type.
+     *
+     * @param clazz the class to check
+     * @return true if the class is a reactive type, false otherwise
+     */
+    public static boolean isReactiveType(@NonNull Class<?> clazz) {
+        return Mono.class.isAssignableFrom(clazz) || Flux.class.isAssignableFrom(clazz);
+    }
+}
diff --git a/application/src/main/java/run/halo/app/theme/ReactivePropertyAccessor.java b/application/src/main/java/run/halo/app/theme/ReactivePropertyAccessor.java
deleted file mode 100644
index db847d24b7..0000000000
--- a/application/src/main/java/run/halo/app/theme/ReactivePropertyAccessor.java
+++ /dev/null
@@ -1,118 +0,0 @@
-package run.halo.app.theme;
-
-import java.util.List;
-import org.springframework.expression.AccessException;
-import org.springframework.expression.EvaluationContext;
-import org.springframework.expression.PropertyAccessor;
-import org.springframework.expression.TypedValue;
-import org.springframework.expression.spel.ast.AstUtils;
-import org.springframework.integration.json.JsonPropertyAccessor;
-import org.springframework.lang.NonNull;
-import org.springframework.lang.Nullable;
-import reactor.core.publisher.Flux;
-import reactor.core.publisher.Mono;
-
-/**
- * A SpEL PropertyAccessor that knows how to read properties from {@link Mono} or {@link Flux}
- * object. It first converts the target to the actual value and then calls other
- * {@link PropertyAccessor}s to parse the result, If it still cannot be resolved,
- * {@link JsonPropertyAccessor} will be used to resolve finally.
- *
- * @author guqing
- * @since 2.0.0
- */
-public class ReactivePropertyAccessor implements PropertyAccessor {
-
-    @Override
-    public Class<?>[] getSpecificTargetClasses() {
-        return null;
-    }
-
-    @Override
-    public boolean canRead(@NonNull EvaluationContext context, Object target, @NonNull String name)
-        throws AccessException {
-        if (isReactiveType(target)) {
-            return true;
-        }
-        var propertyAccessors =
-            getPropertyAccessorsToTry(target.getClass(), context.getPropertyAccessors());
-        for (PropertyAccessor propertyAccessor : propertyAccessors) {
-            if (propertyAccessor.canRead(context, target, name)) {
-                return true;
-            }
-        }
-        return false;
-    }
-
-    @Override
-    @NonNull
-    public TypedValue read(@NonNull EvaluationContext context, Object target, @NonNull String name)
-        throws AccessException {
-        if (target == null) {
-            return TypedValue.NULL;
-        }
-        Object value = blockingGetForReactive(target);
-
-        List<PropertyAccessor> propertyAccessorsToTry =
-            getPropertyAccessorsToTry(value, context.getPropertyAccessors());
-        for (PropertyAccessor propertyAccessor : propertyAccessorsToTry) {
-            try {
-                TypedValue result = propertyAccessor.read(context, value, name);
-                return new TypedValue(blockingGetForReactive(result.getValue()));
-            } catch (AccessException e) {
-                // ignore this
-            }
-        }
-
-        throw new AccessException("Cannot read property '" + name + "' from [" + value + "]");
-    }
-
-    @Nullable
-    private static Object blockingGetForReactive(@Nullable Object target) {
-        if (target == null) {
-            return null;
-        }
-        Class<?> clazz = target.getClass();
-        Object value = target;
-        if (Mono.class.isAssignableFrom(clazz)) {
-            value = ((Mono<?>) target).block();
-        } else if (Flux.class.isAssignableFrom(clazz)) {
-            value = ((Flux<?>) target).collectList().block();
-        }
-        return value;
-    }
-
-    private boolean isReactiveType(Object target) {
-        if (target == null) {
-            return true;
-        }
-        Class<?> clazz = target.getClass();
-        return Mono.class.isAssignableFrom(clazz)
-            || Flux.class.isAssignableFrom(clazz);
-    }
-
-    private List<PropertyAccessor> getPropertyAccessorsToTry(
-        @Nullable Object contextObject, List<PropertyAccessor> propertyAccessors) {
-
-        Class<?> targetType = (contextObject != null ? contextObject.getClass() : null);
-
-        List<PropertyAccessor> resolvers =
-            AstUtils.getPropertyAccessorsToTry(targetType, propertyAccessors);
-        // remove this resolver to avoid infinite loop
-        resolvers.remove(this);
-        return resolvers;
-    }
-
-    @Override
-    public boolean canWrite(@NonNull EvaluationContext context, Object target, @NonNull String name)
-        throws AccessException {
-        return false;
-    }
-
-    @Override
-    public void write(@NonNull EvaluationContext context, Object target, @NonNull String name,
-        Object newValue)
-        throws AccessException {
-        throw new UnsupportedOperationException("Write is not supported");
-    }
-}
diff --git a/application/src/main/java/run/halo/app/theme/ReactiveSpelVariableExpressionEvaluator.java b/application/src/main/java/run/halo/app/theme/ReactiveSpelVariableExpressionEvaluator.java
index 1794497789..b961f0eea1 100644
--- a/application/src/main/java/run/halo/app/theme/ReactiveSpelVariableExpressionEvaluator.java
+++ b/application/src/main/java/run/halo/app/theme/ReactiveSpelVariableExpressionEvaluator.java
@@ -1,12 +1,12 @@
 package run.halo.app.theme;
 
+import java.util.Optional;
 import org.thymeleaf.context.IExpressionContext;
 import org.thymeleaf.spring6.expression.SPELVariableExpressionEvaluator;
 import org.thymeleaf.standard.expression.IStandardVariableExpression;
 import org.thymeleaf.standard.expression.IStandardVariableExpressionEvaluator;
 import org.thymeleaf.standard.expression.StandardExpressionExecutionContext;
-import reactor.core.publisher.Flux;
-import reactor.core.publisher.Mono;
+import run.halo.app.infra.utils.ReactiveUtils;
 
 /**
  * Reactive SPEL variable expression evaluator.
@@ -17,28 +17,25 @@
 public class ReactiveSpelVariableExpressionEvaluator
     implements IStandardVariableExpressionEvaluator {
 
-    private final SPELVariableExpressionEvaluator delegate =
-        SPELVariableExpressionEvaluator.INSTANCE;
+    private final IStandardVariableExpressionEvaluator delegate;
 
     public static final ReactiveSpelVariableExpressionEvaluator INSTANCE =
         new ReactiveSpelVariableExpressionEvaluator();
 
+    public ReactiveSpelVariableExpressionEvaluator(IStandardVariableExpressionEvaluator delegate) {
+        this.delegate = delegate;
+    }
+
+    public ReactiveSpelVariableExpressionEvaluator() {
+        this(SPELVariableExpressionEvaluator.INSTANCE);
+    }
+
     @Override
     public Object evaluate(IExpressionContext context, IStandardVariableExpression expression,
         StandardExpressionExecutionContext expContext) {
-        Object returnValue = delegate.evaluate(context, expression, expContext);
-        if (returnValue == null) {
-            return null;
-        }
-
-        Class<?> clazz = returnValue.getClass();
-        // Note that: 3 instanceof Foo -> syntax error
-        if (Mono.class.isAssignableFrom(clazz)) {
-            return ((Mono<?>) returnValue).block();
-        }
-        if (Flux.class.isAssignableFrom(clazz)) {
-            return ((Flux<?>) returnValue).collectList().block();
-        }
-        return returnValue;
+        var returnValue = delegate.evaluate(context, expression, expContext);
+        return Optional.ofNullable(returnValue)
+            .map(ReactiveUtils::blockReactiveValue)
+            .orElse(null);
     }
 }
diff --git a/application/src/main/java/run/halo/app/theme/dialect/EvaluationContextEnhancer.java b/application/src/main/java/run/halo/app/theme/dialect/EvaluationContextEnhancer.java
new file mode 100644
index 0000000000..2d01e48b65
--- /dev/null
+++ b/application/src/main/java/run/halo/app/theme/dialect/EvaluationContextEnhancer.java
@@ -0,0 +1,210 @@
+package run.halo.app.theme.dialect;
+
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Objects;
+import java.util.Optional;
+import java.util.stream.Collectors;
+import org.springframework.core.convert.TypeDescriptor;
+import org.springframework.expression.AccessException;
+import org.springframework.expression.EvaluationContext;
+import org.springframework.expression.MethodExecutor;
+import org.springframework.expression.MethodResolver;
+import org.springframework.expression.PropertyAccessor;
+import org.springframework.expression.TypedValue;
+import org.springframework.expression.spel.support.ReflectivePropertyAccessor;
+import org.springframework.integration.json.JsonPropertyAccessor;
+import org.springframework.lang.Nullable;
+import org.thymeleaf.context.ITemplateContext;
+import org.thymeleaf.model.ITemplateEnd;
+import org.thymeleaf.model.ITemplateStart;
+import org.thymeleaf.processor.templateboundaries.AbstractTemplateBoundariesProcessor;
+import org.thymeleaf.processor.templateboundaries.ITemplateBoundariesStructureHandler;
+import org.thymeleaf.spring6.expression.ThymeleafEvaluationContext;
+import org.thymeleaf.standard.StandardDialect;
+import org.thymeleaf.templatemode.TemplateMode;
+import run.halo.app.infra.utils.ReactiveUtils;
+
+/**
+ * Enhance the evaluation context to support reactive types.
+ *
+ * @author guqing
+ * @author johnniang
+ * @since 2.20.0
+ */
+public class EvaluationContextEnhancer extends AbstractTemplateBoundariesProcessor {
+
+    private static final int PRECEDENCE = StandardDialect.PROCESSOR_PRECEDENCE;
+
+    private static final JsonPropertyAccessor JSON_PROPERTY_ACCESSOR = new JsonPropertyAccessor();
+
+    public EvaluationContextEnhancer() {
+        super(TemplateMode.HTML, PRECEDENCE);
+    }
+
+    @Override
+    public void doProcessTemplateStart(ITemplateContext context, ITemplateStart templateStart,
+        ITemplateBoundariesStructureHandler structureHandler) {
+        var evluationContextObject = context.getVariable(
+            ThymeleafEvaluationContext.THYMELEAF_EVALUATION_CONTEXT_CONTEXT_VARIABLE_NAME
+        );
+        if (evluationContextObject instanceof ThymeleafEvaluationContext evaluationContext) {
+            evaluationContext.addPropertyAccessor(JSON_PROPERTY_ACCESSOR);
+            ReactiveReflectivePropertyAccessor.wrap(evaluationContext);
+            ReactiveMethodResolver.wrap(evaluationContext);
+        }
+    }
+
+    @Override
+    public void doProcessTemplateEnd(ITemplateContext context, ITemplateEnd templateEnd,
+        ITemplateBoundariesStructureHandler structureHandler) {
+        // nothing to do
+    }
+
+    /**
+     * A {@link PropertyAccessor} that wraps the original {@link ReflectivePropertyAccessor} and
+     * blocks the reactive value.
+     */
+    private static class ReactiveReflectivePropertyAccessor
+        extends ReflectivePropertyAccessor {
+        private final ReflectivePropertyAccessor delegate;
+
+        private ReactiveReflectivePropertyAccessor(ReflectivePropertyAccessor delegate) {
+            this.delegate = delegate;
+        }
+
+        @Override
+        public boolean canRead(EvaluationContext context, Object target, String name)
+            throws AccessException {
+            if (target == null) {
+                // For backward compatibility
+                return true;
+            }
+            return this.delegate.canRead(context, target, name);
+        }
+
+        @Override
+        public TypedValue read(EvaluationContext context, Object target, String name)
+            throws AccessException {
+            if (target == null) {
+                // For backward compatibility
+                return TypedValue.NULL;
+            }
+            var typedValue = delegate.read(context, target, name);
+            return Optional.of(typedValue)
+                .filter(tv ->
+                    Objects.nonNull(tv.getValue())
+                        && Objects.nonNull(tv.getTypeDescriptor())
+                        && ReactiveUtils.isReactiveType(tv.getTypeDescriptor().getType())
+                )
+                .map(tv -> new TypedValue(ReactiveUtils.blockReactiveValue(tv.getValue())))
+                .orElse(typedValue);
+        }
+
+        @Override
+        public boolean canWrite(EvaluationContext context, Object target, String name)
+            throws AccessException {
+            return delegate.canWrite(context, target, name);
+        }
+
+        @Override
+        public void write(EvaluationContext context, Object target, String name, Object newValue)
+            throws AccessException {
+            delegate.write(context, target, name, newValue);
+        }
+
+        @Override
+        public Class<?>[] getSpecificTargetClasses() {
+            return delegate.getSpecificTargetClasses();
+        }
+
+        @Override
+        public PropertyAccessor createOptimalAccessor(EvaluationContext context, Object target,
+            String name) {
+            var optimalAccessor = delegate.createOptimalAccessor(context, target, name);
+            if (optimalAccessor instanceof OptimalPropertyAccessor optimalPropertyAccessor) {
+                if (ReactiveUtils.isReactiveType(optimalPropertyAccessor.getPropertyType())) {
+                    return this;
+                }
+                return optimalPropertyAccessor;
+            }
+            return this;
+        }
+
+        static void wrap(ThymeleafEvaluationContext evaluationContext) {
+            var wrappedPropertyAccessors = evaluationContext.getPropertyAccessors()
+                .stream()
+                .map(propertyAccessor -> {
+                    if (propertyAccessor instanceof ReflectivePropertyAccessor reflectiveAccessor) {
+                        return new ReactiveReflectivePropertyAccessor(reflectiveAccessor);
+                    }
+                    return propertyAccessor;
+                })
+                // make the list mutable
+                .collect(Collectors.toCollection(ArrayList::new));
+            evaluationContext.setPropertyAccessors(wrappedPropertyAccessors);
+        }
+
+        @Override
+        public boolean equals(Object obj) {
+            return delegate.equals(obj);
+        }
+
+        @Override
+        public int hashCode() {
+            return delegate.hashCode();
+        }
+
+    }
+
+    /**
+     * A {@link MethodResolver} that wraps the original {@link MethodResolver} and blocks the
+     * reactive value.
+     *
+     * @param delegate the original {@link MethodResolver}
+     */
+    private record ReactiveMethodResolver(MethodResolver delegate) implements MethodResolver {
+
+        @Override
+        @Nullable
+        public MethodExecutor resolve(EvaluationContext context, Object targetObject, String name,
+            List<TypeDescriptor> argumentTypes) throws AccessException {
+            var executor = delegate.resolve(context, targetObject, name, argumentTypes);
+            return Optional.ofNullable(executor).map(ReactiveMethodExecutor::new).orElse(null);
+        }
+
+        static void wrap(ThymeleafEvaluationContext evaluationContext) {
+            var wrappedMethodResolvers = evaluationContext.getMethodResolvers()
+                .stream()
+                .<MethodResolver>map(ReactiveMethodResolver::new)
+                // make the list mutable
+                .collect(Collectors.toCollection(ArrayList::new));
+            evaluationContext.setMethodResolvers(wrappedMethodResolvers);
+        }
+
+    }
+
+    /**
+     * A {@link MethodExecutor} that wraps the original {@link MethodExecutor} and blocks the
+     * reactive value.
+     *
+     * @param delegate the original {@link MethodExecutor}
+     */
+    private record ReactiveMethodExecutor(MethodExecutor delegate) implements MethodExecutor {
+
+        @Override
+        public TypedValue execute(EvaluationContext context, Object target, Object... arguments)
+            throws AccessException {
+            var typedValue = delegate.execute(context, target, arguments);
+            return Optional.of(typedValue)
+                .filter(tv ->
+                    Objects.nonNull(tv.getValue())
+                        && Objects.nonNull(tv.getTypeDescriptor())
+                        && ReactiveUtils.isReactiveType(tv.getTypeDescriptor().getType())
+                )
+                .map(tv -> new TypedValue(ReactiveUtils.blockReactiveValue(tv.getValue())))
+                .orElse(typedValue);
+        }
+
+    }
+}
diff --git a/application/src/main/java/run/halo/app/theme/dialect/HaloProcessorDialect.java b/application/src/main/java/run/halo/app/theme/dialect/HaloProcessorDialect.java
index a88296531c..a355f5ae88 100644
--- a/application/src/main/java/run/halo/app/theme/dialect/HaloProcessorDialect.java
+++ b/application/src/main/java/run/halo/app/theme/dialect/HaloProcessorDialect.java
@@ -38,7 +38,7 @@ public Set<IProcessor> getProcessors(String dialectPrefix) {
         // add more processors
         processors.add(new GlobalHeadInjectionProcessor(dialectPrefix));
         processors.add(new TemplateFooterElementTagProcessor(dialectPrefix));
-        processors.add(new JsonNodePropertyAccessorBoundariesProcessor());
+        processors.add(new EvaluationContextEnhancer());
         processors.add(new CommentElementTagProcessor(dialectPrefix));
         processors.add(new CommentEnabledVariableProcessor());
         return processors;
diff --git a/application/src/main/java/run/halo/app/theme/dialect/JsonNodePropertyAccessorBoundariesProcessor.java b/application/src/main/java/run/halo/app/theme/dialect/JsonNodePropertyAccessorBoundariesProcessor.java
deleted file mode 100644
index 0ab86fffe4..0000000000
--- a/application/src/main/java/run/halo/app/theme/dialect/JsonNodePropertyAccessorBoundariesProcessor.java
+++ /dev/null
@@ -1,49 +0,0 @@
-package run.halo.app.theme.dialect;
-
-import org.springframework.integration.json.JsonPropertyAccessor;
-import org.thymeleaf.context.ITemplateContext;
-import org.thymeleaf.model.ITemplateEnd;
-import org.thymeleaf.model.ITemplateStart;
-import org.thymeleaf.processor.templateboundaries.AbstractTemplateBoundariesProcessor;
-import org.thymeleaf.processor.templateboundaries.ITemplateBoundariesStructureHandler;
-import org.thymeleaf.spring6.expression.ThymeleafEvaluationContext;
-import org.thymeleaf.standard.StandardDialect;
-import org.thymeleaf.templatemode.TemplateMode;
-import run.halo.app.theme.ReactivePropertyAccessor;
-
-/**
- * A template boundaries processor for add {@link JsonPropertyAccessor} to
- * {@link ThymeleafEvaluationContext}.
- *
- * @author guqing
- * @since 2.0.0
- */
-public class JsonNodePropertyAccessorBoundariesProcessor
-    extends AbstractTemplateBoundariesProcessor {
-    private static final int PRECEDENCE = StandardDialect.PROCESSOR_PRECEDENCE;
-    private static final JsonPropertyAccessor JSON_PROPERTY_ACCESSOR = new JsonPropertyAccessor();
-    private static final ReactivePropertyAccessor REACTIVE_PROPERTY_ACCESSOR =
-        new ReactivePropertyAccessor();
-
-    public JsonNodePropertyAccessorBoundariesProcessor() {
-        super(TemplateMode.HTML, PRECEDENCE);
-    }
-
-    @Override
-    public void doProcessTemplateStart(ITemplateContext context, ITemplateStart templateStart,
-        ITemplateBoundariesStructureHandler structureHandler) {
-        ThymeleafEvaluationContext evaluationContext =
-            (ThymeleafEvaluationContext) context.getVariable(
-                ThymeleafEvaluationContext.THYMELEAF_EVALUATION_CONTEXT_CONTEXT_VARIABLE_NAME);
-        if (evaluationContext != null) {
-            evaluationContext.addPropertyAccessor(JSON_PROPERTY_ACCESSOR);
-            evaluationContext.addPropertyAccessor(REACTIVE_PROPERTY_ACCESSOR);
-        }
-    }
-
-    @Override
-    public void doProcessTemplateEnd(ITemplateContext context, ITemplateEnd templateEnd,
-        ITemplateBoundariesStructureHandler structureHandler) {
-        // nothing to do
-    }
-}
diff --git a/application/src/test/java/run/halo/app/theme/ReactiveFinderExpressionParserTests.java b/application/src/test/java/run/halo/app/theme/ReactiveFinderExpressionParserTests.java
index 346aa9945a..20010b0f33 100644
--- a/application/src/test/java/run/halo/app/theme/ReactiveFinderExpressionParserTests.java
+++ b/application/src/test/java/run/halo/app/theme/ReactiveFinderExpressionParserTests.java
@@ -38,7 +38,6 @@
  * Tests expression parser for reactive return value.
  *
  * @author guqing
- * @see ReactivePropertyAccessor
  * @see ReactiveSpelVariableExpressionEvaluator
  * @since 2.0.0
  */

From 03368281cc73e91c26fe2105263d243bf2e99247 Mon Sep 17 00:00:00 2001
From: guqing <38999863+guqing@users.noreply.github.com>
Date: Mon, 23 Sep 2024 17:59:03 +0800
Subject: [PATCH 033/185] chore: reorganize package structure in application
 project (#6691)

* chore: reorganize package structure in application project
---
 .../app/content/comment/AbstractCommentService.java    |  4 ++--
 .../halo/app/content/comment/CommentServiceImpl.java   |  4 ++--
 .../run/halo/app/content/comment/ReplyServiceImpl.java |  4 ++--
 .../run/halo/app/content/impl/PostServiceImpl.java     |  2 +-
 .../halo/app/content/impl/SinglePageServiceImpl.java   |  2 +-
 .../app/core/attachment/LocalThumbnailService.java     |  2 +-
 .../attachment/endpoint/AttachmentEndpoint.java        |  2 +-
 .../endpoint/LocalAttachmentUploadHandler.java         |  3 ++-
 .../extension}/LocalThumbnail.java                     |  2 +-
 .../attachment => attachment/extension}/Thumbnail.java |  2 +-
 .../attachment/impl/LocalThumbnailServiceImpl.java     |  2 +-
 .../app/core/attachment/impl/ThumbnailServiceImpl.java |  2 +-
 .../reconciler/LocalThumbnailsReconciler.java          |  4 ++--
 .../app/core/endpoint/WebSocketHandlerMapping.java     |  2 +-
 .../console}/AuthProviderEndpoint.java                 |  3 ++-
 .../endpoint => endpoint/console}/CommentEndpoint.java |  3 ++-
 .../console}/CustomEndpointsBuilder.java               |  3 ++-
 .../endpoint => endpoint/console}/PluginEndpoint.java  |  7 ++++---
 .../endpoint => endpoint/console}/PostEndpoint.java    |  3 ++-
 .../endpoint => endpoint/console}/ReplyEndpoint.java   |  3 ++-
 .../console}/SinglePageEndpoint.java                   |  3 ++-
 .../endpoint => endpoint/console}/StatsEndpoint.java   |  3 ++-
 .../console}/SystemInitializationEndpoint.java         |  3 ++-
 .../endpoint => endpoint/console}/TagEndpoint.java     |  3 ++-
 .../endpoint => endpoint/console}/TrackerEndpoint.java |  3 ++-
 .../endpoint => endpoint/console}/UserEndpoint.java    |  9 +++++----
 .../endpoint/theme}/CategoryQueryEndpoint.java         |  4 ++--
 .../endpoint/theme}/CommentFinderEndpoint.java         |  2 +-
 .../endpoint/theme}/MenuQueryEndpoint.java             |  2 +-
 .../endpoint/theme}/PluginQueryEndpoint.java           |  2 +-
 .../endpoint/theme}/PostPublicQuery.java               |  2 +-
 .../endpoint/theme}/PostQueryEndpoint.java             |  2 +-
 .../endpoint/theme}/PublicApiUtils.java                |  2 +-
 .../endpoint/theme}/PublicUserEndpoint.java            |  8 ++++----
 .../endpoint/theme}/SinglePageQueryEndpoint.java       |  2 +-
 .../endpoint/theme}/SiteStatsQueryEndpoint.java        |  2 +-
 .../endpoint/theme}/TagQueryEndpoint.java              |  2 +-
 .../endpoint/theme}/ThumbnailEndpoint.java             |  2 +-
 .../endpoint/uc}/UcPostAttachmentEndpoint.java         |  2 +-
 .../content => core/endpoint/uc}/UcPostEndpoint.java   |  2 +-
 .../endpoint/uc}/UcSnapshotEndpoint.java               |  2 +-
 .../reconciler/AnnotationSettingReconciler.java        |  2 +-
 .../reconciler/AuthProviderReconciler.java             |  2 +-
 .../{extension => }/reconciler/CategoryReconciler.java |  2 +-
 .../{extension => }/reconciler/CommentReconciler.java  |  2 +-
 .../{extension => }/reconciler/MenuItemReconciler.java |  2 +-
 .../{extension => }/reconciler/PluginReconciler.java   |  4 ++--
 .../reconciler/PostCounterReconciler.java              |  2 +-
 .../{extension => }/reconciler/PostReconciler.java     |  2 +-
 .../{extension => }/reconciler/ReplyReconciler.java    |  2 +-
 .../reconciler/ReverseProxyReconciler.java             |  2 +-
 .../{extension => }/reconciler/RoleReconciler.java     |  2 +-
 .../reconciler/SinglePageReconciler.java               |  2 +-
 .../reconciler/SystemSettingReconciler.java            |  2 +-
 .../core/{extension => }/reconciler/TagReconciler.java |  2 +-
 .../{extension => }/reconciler/ThemeReconciler.java    |  4 ++--
 .../{extension => }/reconciler/UserReconciler.java     |  6 +++---
 .../service/DefaultRoleService.java                    |  2 +-
 .../service/EmailPasswordRecoveryService.java          |  2 +-
 .../service/EmailVerificationService.java              |  2 +-
 .../core/{extension => user}/service/RoleService.java  |  2 +-
 .../core/{extension => user}/service/UserService.java  |  2 +-
 .../{extension => user}/service/UserServiceImpl.java   |  2 +-
 .../service/impl/DefaultAttachmentService.java         |  2 +-
 .../service/impl/EmailPasswordRecoveryServiceImpl.java |  6 +++---
 .../service/impl/EmailVerificationServiceImpl.java     |  6 +++---
 .../run/halo/app/infra/DefaultThemeInitializer.java    |  4 ++--
 .../java/run/halo/app/infra/SchemeInitializer.java     |  4 ++--
 .../{ => infra}/actuator/DatabaseInfoContributor.java  |  2 +-
 .../app/{ => infra}/actuator/GlobalInfoEndpoint.java   |  2 +-
 .../halo/app/{ => infra}/actuator/RestartEndpoint.java |  2 +-
 .../app/{ => infra}/config/ExtensionConfiguration.java |  2 +-
 .../halo/app/{ => infra}/config/HaloConfiguration.java |  2 +-
 .../run/halo/app/{ => infra}/config/SwaggerConfig.java |  2 +-
 .../run/halo/app/{ => infra}/config/WebFluxConfig.java | 10 +++++-----
 .../{ => infra}/config/WebServerSecurityConfig.java    |  6 +++---
 .../run/halo/app/{ => infra}/console/ProxyFilter.java  |  2 +-
 .../{ => infra}/console/WebSocketRequestPredicate.java |  4 ++--
 .../console/WebSocketServerWebExchangeMatcher.java     |  4 ++--
 .../halo/app/{ => infra}/console/WebSocketUtils.java   |  2 +-
 .../extension/theme => infra/utils}/SettingUtils.java  |  4 +---
 .../webfilter/AdditionalWebFilterChainProxy.java       |  2 +-
 .../{ => infra}/webfilter/LocaleChangeWebFilter.java   |  2 +-
 .../run/halo/app/plugin/AggregatedRouterFunction.java  |  2 +-
 .../extension/service => plugin}/PluginService.java    |  2 +-
 .../service/impl => plugin}/PluginServiceImpl.java     |  9 +--------
 .../halo/app/security/DefaultUserDetailService.java    |  4 ++--
 .../pat/impl/UserScopedPatHandlerImpl.java             |  2 +-
 .../twofactor/TwoFactorAuthEndpoint.java               |  2 +-
 .../security/authorization/DefaultRuleResolver.java    |  2 +-
 .../authorization/RequestInfoAuthorizationManager.java |  2 +-
 .../app/security/authorization/RequestInfoFactory.java |  2 +-
 .../theme => theme/endpoint}/ThemeEndpoint.java        |  4 +++-
 .../finders/impl/CommentPublicQueryServiceImpl.java    |  2 +-
 .../app/theme/finders/impl/ContributorFinderImpl.java  |  2 +-
 .../theme => theme/service}/ThemeService.java          |  2 +-
 .../theme => theme/service}/ThemeServiceImpl.java      |  9 +++++----
 .../extension/theme => theme/service}/ThemeUtils.java  |  8 +++++---
 .../halo/app/config/ExtensionConfigurationTest.java    |  2 +-
 .../java/run/halo/app/config/WebFluxConfigTest.java    |  2 +-
 .../console/WebSocketServerWebExchangeMatcherTest.java |  1 +
 .../java/run/halo/app/console/WebSocketUtilsTest.java  |  1 +
 .../run/halo/app/content/PostIntegrationTests.java     |  2 +-
 .../app/content/comment/CommentServiceImplTest.java    |  4 ++--
 .../attachment/impl/LocalThumbnailServiceImplTest.java |  2 +-
 .../core/attachment/impl/ThumbnailServiceImplTest.java |  2 +-
 .../console}/EmailVerificationCodeTest.java            |  6 +++---
 .../console}/PluginEndpointTest.java                   |  4 ++--
 .../console}/PostEndpointTest.java                     |  2 +-
 .../console}/SinglePageEndpointTest.java               |  2 +-
 .../console}/SystemInitializationEndpointTest.java     |  4 ++--
 .../endpoint => endpoint/console}/TagEndpointTest.java |  2 +-
 .../console}/UserEndpointIntegrationTest.java          |  4 ++--
 .../console}/UserEndpointTest.java                     |  6 +++---
 .../endpoint/theme}/CategoryQueryEndpointTest.java     |  2 +-
 .../endpoint/theme}/CommentFinderEndpointTest.java     |  2 +-
 .../endpoint/theme}/MenuQueryEndpointTest.java         |  2 +-
 .../endpoint/theme}/PluginQueryEndpointTest.java       |  2 +-
 .../endpoint/theme}/PostQueryEndpointTest.java         |  2 +-
 .../endpoint/theme}/PublicApiUtilsTest.java            |  2 +-
 .../endpoint/theme}/PublicUserEndpointTest.java        |  4 ++--
 .../endpoint/theme}/SinglePageQueryEndpointTest.java   |  2 +-
 .../endpoint/theme}/ThumbnailEndpointTest.java         |  2 +-
 .../attachment/endpoint/AttachmentEndpointTest.java    |  3 ++-
 .../reconciler/CommentReconcilerTest.java              |  3 ++-
 .../reconciler/MenuItemReconcilerTest.java             |  3 ++-
 .../reconciler/PluginReconcilerTest.java               |  3 ++-
 .../{extension => }/reconciler/PostReconcilerTest.java |  3 ++-
 .../reconciler/ReverseProxyReconcilerTest.java         |  3 ++-
 .../reconciler/SinglePageReconcilerTest.java           |  3 ++-
 .../reconciler/SystemSettingReconcilerTest.java        |  3 ++-
 .../{extension => }/reconciler/TagReconcilerTest.java  |  3 ++-
 .../reconciler/ThemeReconcilerTest.java                |  3 ++-
 .../{extension => }/reconciler/UserReconcilerTest.java |  5 +++--
 .../service/DefaultRoleServiceTest.java                |  3 ++-
 .../service/UserServiceImplTest.java                   |  4 +++-
 .../impl/EmailPasswordRecoveryServiceImplTest.java     |  3 ++-
 .../service/impl/EmailVerificationServiceImplTest.java |  5 +++--
 .../theme => infra/utils}/SettingUtilsTest.java        |  3 +--
 .../service/impl => plugin}/PluginServiceImplTest.java |  6 +-----
 .../app/security/DefaultUserDetailServiceTest.java     |  4 ++--
 .../app/security/authorization/AuthorizationTest.java  |  2 +-
 .../authorization/DefaultRuleResolverTest.java         |  2 +-
 .../theme => theme/endpoint}/ThemeEndpointTest.java    |  3 ++-
 .../impl/CommentPublicQueryServiceImplTest.java        |  2 +-
 .../theme => theme/service}/ThemeServiceImplTest.java  |  2 +-
 .../halo/app/webfilter/LocaleChangeWebFilterTest.java  |  1 +
 147 files changed, 231 insertions(+), 207 deletions(-)
 rename application/src/main/java/run/halo/app/core/{extension => }/attachment/endpoint/AttachmentEndpoint.java (99%)
 rename application/src/main/java/run/halo/app/core/{extension => }/attachment/endpoint/LocalAttachmentUploadHandler.java (99%)
 rename application/src/main/java/run/halo/app/core/{extension/attachment => attachment/extension}/LocalThumbnail.java (98%)
 rename application/src/main/java/run/halo/app/core/{extension/attachment => attachment/extension}/Thumbnail.java (96%)
 rename application/src/main/java/run/halo/app/core/{extension/endpoint => endpoint/console}/AuthProviderEndpoint.java (97%)
 rename application/src/main/java/run/halo/app/core/{extension/endpoint => endpoint/console}/CommentEndpoint.java (98%)
 rename application/src/main/java/run/halo/app/core/{extension/endpoint => endpoint/console}/CustomEndpointsBuilder.java (94%)
 rename application/src/main/java/run/halo/app/core/{extension/endpoint => endpoint/console}/PluginEndpoint.java (99%)
 rename application/src/main/java/run/halo/app/core/{extension/endpoint => endpoint/console}/PostEndpoint.java (99%)
 rename application/src/main/java/run/halo/app/core/{extension/endpoint => endpoint/console}/ReplyEndpoint.java (94%)
 rename application/src/main/java/run/halo/app/core/{extension/endpoint => endpoint/console}/SinglePageEndpoint.java (99%)
 rename application/src/main/java/run/halo/app/core/{extension/endpoint => endpoint/console}/StatsEndpoint.java (97%)
 rename application/src/main/java/run/halo/app/core/{extension/endpoint => endpoint/console}/SystemInitializationEndpoint.java (98%)
 rename application/src/main/java/run/halo/app/core/{extension/endpoint => endpoint/console}/TagEndpoint.java (97%)
 rename application/src/main/java/run/halo/app/core/{extension/endpoint => endpoint/console}/TrackerEndpoint.java (98%)
 rename application/src/main/java/run/halo/app/core/{extension/endpoint => endpoint/console}/UserEndpoint.java (99%)
 rename application/src/main/java/run/halo/app/{theme/endpoint => core/endpoint/theme}/CategoryQueryEndpoint.java (97%)
 rename application/src/main/java/run/halo/app/{theme/endpoint => core/endpoint/theme}/CommentFinderEndpoint.java (99%)
 rename application/src/main/java/run/halo/app/{theme/endpoint => core/endpoint/theme}/MenuQueryEndpoint.java (98%)
 rename application/src/main/java/run/halo/app/{theme/endpoint => core/endpoint/theme}/PluginQueryEndpoint.java (98%)
 rename application/src/main/java/run/halo/app/{theme/endpoint => core/endpoint/theme}/PostPublicQuery.java (92%)
 rename application/src/main/java/run/halo/app/{theme/endpoint => core/endpoint/theme}/PostQueryEndpoint.java (99%)
 rename application/src/main/java/run/halo/app/{theme/endpoint => core/endpoint/theme}/PublicApiUtils.java (98%)
 rename application/src/main/java/run/halo/app/{theme/endpoint => core/endpoint/theme}/PublicUserEndpoint.java (98%)
 rename application/src/main/java/run/halo/app/{theme/endpoint => core/endpoint/theme}/SinglePageQueryEndpoint.java (98%)
 rename application/src/main/java/run/halo/app/{theme/endpoint => core/endpoint/theme}/SiteStatsQueryEndpoint.java (97%)
 rename application/src/main/java/run/halo/app/{theme/endpoint => core/endpoint/theme}/TagQueryEndpoint.java (99%)
 rename application/src/main/java/run/halo/app/{theme/endpoint => core/endpoint/theme}/ThumbnailEndpoint.java (99%)
 rename application/src/main/java/run/halo/app/{endpoint/uc/content => core/endpoint/uc}/UcPostAttachmentEndpoint.java (99%)
 rename application/src/main/java/run/halo/app/{endpoint/uc/content => core/endpoint/uc}/UcPostEndpoint.java (99%)
 rename application/src/main/java/run/halo/app/{endpoint/uc/content => core/endpoint/uc}/UcSnapshotEndpoint.java (99%)
 rename application/src/main/java/run/halo/app/core/{extension => }/reconciler/AnnotationSettingReconciler.java (97%)
 rename application/src/main/java/run/halo/app/core/{extension => }/reconciler/AuthProviderReconciler.java (97%)
 rename application/src/main/java/run/halo/app/core/{extension => }/reconciler/CategoryReconciler.java (98%)
 rename application/src/main/java/run/halo/app/core/{extension => }/reconciler/CommentReconciler.java (99%)
 rename application/src/main/java/run/halo/app/core/{extension => }/reconciler/MenuItemReconciler.java (99%)
 rename application/src/main/java/run/halo/app/core/{extension => }/reconciler/PluginReconciler.java (99%)
 rename application/src/main/java/run/halo/app/core/{extension => }/reconciler/PostCounterReconciler.java (97%)
 rename application/src/main/java/run/halo/app/core/{extension => }/reconciler/PostReconciler.java (99%)
 rename application/src/main/java/run/halo/app/core/{extension => }/reconciler/ReplyReconciler.java (98%)
 rename application/src/main/java/run/halo/app/core/{extension => }/reconciler/ReverseProxyReconciler.java (98%)
 rename application/src/main/java/run/halo/app/core/{extension => }/reconciler/RoleReconciler.java (97%)
 rename application/src/main/java/run/halo/app/core/{extension => }/reconciler/SinglePageReconciler.java (99%)
 rename application/src/main/java/run/halo/app/core/{extension => }/reconciler/SystemSettingReconciler.java (99%)
 rename application/src/main/java/run/halo/app/core/{extension => }/reconciler/TagReconciler.java (98%)
 rename application/src/main/java/run/halo/app/core/{extension => }/reconciler/ThemeReconciler.java (98%)
 rename application/src/main/java/run/halo/app/core/{extension => }/reconciler/UserReconciler.java (97%)
 rename application/src/main/java/run/halo/app/core/{extension => user}/service/DefaultRoleService.java (99%)
 rename application/src/main/java/run/halo/app/core/{extension => user}/service/EmailPasswordRecoveryService.java (96%)
 rename application/src/main/java/run/halo/app/core/{extension => user}/service/EmailVerificationService.java (96%)
 rename application/src/main/java/run/halo/app/core/{extension => user}/service/RoleService.java (96%)
 rename application/src/main/java/run/halo/app/core/{extension => user}/service/UserService.java (94%)
 rename application/src/main/java/run/halo/app/core/{extension => user}/service/UserServiceImpl.java (99%)
 rename application/src/main/java/run/halo/app/core/{extension => user}/service/impl/DefaultAttachmentService.java (99%)
 rename application/src/main/java/run/halo/app/core/{extension => user}/service/impl/EmailPasswordRecoveryServiceImpl.java (97%)
 rename application/src/main/java/run/halo/app/core/{extension => user}/service/impl/EmailVerificationServiceImpl.java (98%)
 rename application/src/main/java/run/halo/app/{ => infra}/actuator/DatabaseInfoContributor.java (97%)
 rename application/src/main/java/run/halo/app/{ => infra}/actuator/GlobalInfoEndpoint.java (99%)
 rename application/src/main/java/run/halo/app/{ => infra}/actuator/RestartEndpoint.java (98%)
 rename application/src/main/java/run/halo/app/{ => infra}/config/ExtensionConfiguration.java (97%)
 rename application/src/main/java/run/halo/app/{ => infra}/config/HaloConfiguration.java (97%)
 rename application/src/main/java/run/halo/app/{ => infra}/config/SwaggerConfig.java (99%)
 rename application/src/main/java/run/halo/app/{ => infra}/config/WebFluxConfig.java (97%)
 rename application/src/main/java/run/halo/app/{ => infra}/config/WebServerSecurityConfig.java (97%)
 rename application/src/main/java/run/halo/app/{ => infra}/console/ProxyFilter.java (98%)
 rename application/src/main/java/run/halo/app/{ => infra}/console/WebSocketRequestPredicate.java (78%)
 rename application/src/main/java/run/halo/app/{ => infra}/console/WebSocketServerWebExchangeMatcher.java (85%)
 rename application/src/main/java/run/halo/app/{ => infra}/console/WebSocketUtils.java (94%)
 rename application/src/main/java/run/halo/app/{core/extension/theme => infra/utils}/SettingUtils.java (97%)
 rename application/src/main/java/run/halo/app/{ => infra}/webfilter/AdditionalWebFilterChainProxy.java (97%)
 rename application/src/main/java/run/halo/app/{ => infra}/webfilter/LocaleChangeWebFilter.java (98%)
 rename application/src/main/java/run/halo/app/{core/extension/service => plugin}/PluginService.java (98%)
 rename application/src/main/java/run/halo/app/{core/extension/service/impl => plugin}/PluginServiceImpl.java (98%)
 rename application/src/main/java/run/halo/app/{core/extension/theme => theme/endpoint}/ThemeEndpoint.java (99%)
 rename application/src/main/java/run/halo/app/{core/extension/theme => theme/service}/ThemeService.java (92%)
 rename application/src/main/java/run/halo/app/{core/extension/theme => theme/service}/ThemeServiceImpl.java (98%)
 rename application/src/main/java/run/halo/app/{core/extension/theme => theme/service}/ThemeUtils.java (97%)
 rename application/src/test/java/run/halo/app/core/{extension/endpoint => endpoint/console}/EmailVerificationCodeTest.java (96%)
 rename application/src/test/java/run/halo/app/core/{extension/endpoint => endpoint/console}/PluginEndpointTest.java (99%)
 rename application/src/test/java/run/halo/app/core/{extension/endpoint => endpoint/console}/PostEndpointTest.java (99%)
 rename application/src/test/java/run/halo/app/core/{extension/endpoint => endpoint/console}/SinglePageEndpointTest.java (98%)
 rename application/src/test/java/run/halo/app/core/{extension/endpoint => endpoint/console}/SystemInitializationEndpointTest.java (95%)
 rename application/src/test/java/run/halo/app/core/{extension/endpoint => endpoint/console}/TagEndpointTest.java (98%)
 rename application/src/test/java/run/halo/app/core/{extension/endpoint => endpoint/console}/UserEndpointIntegrationTest.java (97%)
 rename application/src/test/java/run/halo/app/core/{extension/endpoint => endpoint/console}/UserEndpointTest.java (99%)
 rename application/src/test/java/run/halo/app/{theme/endpoint => core/endpoint/theme}/CategoryQueryEndpointTest.java (98%)
 rename application/src/test/java/run/halo/app/{theme/endpoint => core/endpoint/theme}/CommentFinderEndpointTest.java (99%)
 rename application/src/test/java/run/halo/app/{theme/endpoint => core/endpoint/theme}/MenuQueryEndpointTest.java (98%)
 rename application/src/test/java/run/halo/app/{theme/endpoint => core/endpoint/theme}/PluginQueryEndpointTest.java (97%)
 rename application/src/test/java/run/halo/app/{theme/endpoint => core/endpoint/theme}/PostQueryEndpointTest.java (98%)
 rename application/src/test/java/run/halo/app/{theme/endpoint => core/endpoint/theme}/PublicApiUtilsTest.java (97%)
 rename application/src/test/java/run/halo/app/{theme/endpoint => core/endpoint/theme}/PublicUserEndpointTest.java (97%)
 rename application/src/test/java/run/halo/app/{theme/endpoint => core/endpoint/theme}/SinglePageQueryEndpointTest.java (98%)
 rename application/src/test/java/run/halo/app/{theme/endpoint => core/endpoint/theme}/ThumbnailEndpointTest.java (97%)
 rename application/src/test/java/run/halo/app/core/{extension => }/reconciler/CommentReconcilerTest.java (97%)
 rename application/src/test/java/run/halo/app/core/{extension => }/reconciler/MenuItemReconcilerTest.java (98%)
 rename application/src/test/java/run/halo/app/core/{extension => }/reconciler/PluginReconcilerTest.java (99%)
 rename application/src/test/java/run/halo/app/core/{extension => }/reconciler/PostReconcilerTest.java (99%)
 rename application/src/test/java/run/halo/app/core/{extension => }/reconciler/ReverseProxyReconcilerTest.java (95%)
 rename application/src/test/java/run/halo/app/core/{extension => }/reconciler/SinglePageReconcilerTest.java (99%)
 rename application/src/test/java/run/halo/app/core/{extension => }/reconciler/SystemSettingReconcilerTest.java (98%)
 rename application/src/test/java/run/halo/app/core/{extension => }/reconciler/TagReconcilerTest.java (97%)
 rename application/src/test/java/run/halo/app/core/{extension => }/reconciler/ThemeReconcilerTest.java (99%)
 rename application/src/test/java/run/halo/app/core/{extension => }/reconciler/UserReconcilerTest.java (96%)
 rename application/src/test/java/run/halo/app/core/{extension => user}/service/DefaultRoleServiceTest.java (99%)
 rename application/src/test/java/run/halo/app/core/{extension => user}/service/UserServiceImplTest.java (99%)
 rename application/src/test/java/run/halo/app/core/{extension => user}/service/impl/EmailPasswordRecoveryServiceImplTest.java (96%)
 rename application/src/test/java/run/halo/app/core/{extension => user}/service/impl/EmailVerificationServiceImplTest.java (94%)
 rename application/src/test/java/run/halo/app/{core/extension/theme => infra/utils}/SettingUtilsTest.java (98%)
 rename application/src/test/java/run/halo/app/{core/extension/service/impl => plugin}/PluginServiceImplTest.java (98%)
 rename application/src/test/java/run/halo/app/{core/extension/theme => theme/endpoint}/ThemeEndpointTest.java (99%)
 rename application/src/test/java/run/halo/app/{core/extension/theme => theme/service}/ThemeServiceImplTest.java (99%)

diff --git a/application/src/main/java/run/halo/app/content/comment/AbstractCommentService.java b/application/src/main/java/run/halo/app/content/comment/AbstractCommentService.java
index 175d1817f4..3ebc08df8f 100644
--- a/application/src/main/java/run/halo/app/content/comment/AbstractCommentService.java
+++ b/application/src/main/java/run/halo/app/content/comment/AbstractCommentService.java
@@ -8,8 +8,8 @@
 import run.halo.app.core.extension.User;
 import run.halo.app.core.extension.content.Comment;
 import run.halo.app.core.extension.content.Reply;
-import run.halo.app.core.extension.service.RoleService;
-import run.halo.app.core.extension.service.UserService;
+import run.halo.app.core.user.service.RoleService;
+import run.halo.app.core.user.service.UserService;
 import run.halo.app.extension.ReactiveExtensionClient;
 import run.halo.app.metrics.CounterService;
 import run.halo.app.metrics.MeterUtils;
diff --git a/application/src/main/java/run/halo/app/content/comment/CommentServiceImpl.java b/application/src/main/java/run/halo/app/content/comment/CommentServiceImpl.java
index a7510bdab2..76e985aae7 100644
--- a/application/src/main/java/run/halo/app/content/comment/CommentServiceImpl.java
+++ b/application/src/main/java/run/halo/app/content/comment/CommentServiceImpl.java
@@ -17,8 +17,8 @@
 import reactor.core.publisher.Mono;
 import reactor.util.retry.Retry;
 import run.halo.app.core.extension.content.Comment;
-import run.halo.app.core.extension.service.RoleService;
-import run.halo.app.core.extension.service.UserService;
+import run.halo.app.core.user.service.RoleService;
+import run.halo.app.core.user.service.UserService;
 import run.halo.app.extension.Extension;
 import run.halo.app.extension.ListOptions;
 import run.halo.app.extension.ListResult;
diff --git a/application/src/main/java/run/halo/app/content/comment/ReplyServiceImpl.java b/application/src/main/java/run/halo/app/content/comment/ReplyServiceImpl.java
index 26b99e63e9..54687b9292 100644
--- a/application/src/main/java/run/halo/app/content/comment/ReplyServiceImpl.java
+++ b/application/src/main/java/run/halo/app/content/comment/ReplyServiceImpl.java
@@ -22,8 +22,8 @@
 import reactor.util.retry.Retry;
 import run.halo.app.core.extension.content.Comment;
 import run.halo.app.core.extension.content.Reply;
-import run.halo.app.core.extension.service.RoleService;
-import run.halo.app.core.extension.service.UserService;
+import run.halo.app.core.user.service.RoleService;
+import run.halo.app.core.user.service.UserService;
 import run.halo.app.extension.ListOptions;
 import run.halo.app.extension.ListResult;
 import run.halo.app.extension.PageRequest;
diff --git a/application/src/main/java/run/halo/app/content/impl/PostServiceImpl.java b/application/src/main/java/run/halo/app/content/impl/PostServiceImpl.java
index bf535a9fa1..b8a12c0f04 100644
--- a/application/src/main/java/run/halo/app/content/impl/PostServiceImpl.java
+++ b/application/src/main/java/run/halo/app/content/impl/PostServiceImpl.java
@@ -34,7 +34,7 @@
 import run.halo.app.core.extension.content.Post;
 import run.halo.app.core.extension.content.Snapshot;
 import run.halo.app.core.extension.content.Tag;
-import run.halo.app.core.extension.service.UserService;
+import run.halo.app.core.user.service.UserService;
 import run.halo.app.extension.ListOptions;
 import run.halo.app.extension.ListResult;
 import run.halo.app.extension.MetadataOperator;
diff --git a/application/src/main/java/run/halo/app/content/impl/SinglePageServiceImpl.java b/application/src/main/java/run/halo/app/content/impl/SinglePageServiceImpl.java
index ab055b67da..868ca69dfc 100644
--- a/application/src/main/java/run/halo/app/content/impl/SinglePageServiceImpl.java
+++ b/application/src/main/java/run/halo/app/content/impl/SinglePageServiceImpl.java
@@ -28,7 +28,7 @@
 import run.halo.app.core.extension.content.Post;
 import run.halo.app.core.extension.content.SinglePage;
 import run.halo.app.core.extension.content.Snapshot;
-import run.halo.app.core.extension.service.UserService;
+import run.halo.app.core.user.service.UserService;
 import run.halo.app.extension.ListResult;
 import run.halo.app.extension.ReactiveExtensionClient;
 import run.halo.app.extension.Ref;
diff --git a/application/src/main/java/run/halo/app/core/attachment/LocalThumbnailService.java b/application/src/main/java/run/halo/app/core/attachment/LocalThumbnailService.java
index 050650ddb3..a372446e85 100644
--- a/application/src/main/java/run/halo/app/core/attachment/LocalThumbnailService.java
+++ b/application/src/main/java/run/halo/app/core/attachment/LocalThumbnailService.java
@@ -6,7 +6,7 @@
 import org.springframework.core.io.Resource;
 import org.springframework.lang.NonNull;
 import reactor.core.publisher.Mono;
-import run.halo.app.core.extension.attachment.LocalThumbnail;
+import run.halo.app.core.attachment.extension.LocalThumbnail;
 import run.halo.app.infra.ExternalLinkProcessor;
 import run.halo.app.infra.exception.NotFoundException;
 
diff --git a/application/src/main/java/run/halo/app/core/extension/attachment/endpoint/AttachmentEndpoint.java b/application/src/main/java/run/halo/app/core/attachment/endpoint/AttachmentEndpoint.java
similarity index 99%
rename from application/src/main/java/run/halo/app/core/extension/attachment/endpoint/AttachmentEndpoint.java
rename to application/src/main/java/run/halo/app/core/attachment/endpoint/AttachmentEndpoint.java
index 3e9c5b35d4..a79e0f3268 100644
--- a/application/src/main/java/run/halo/app/core/extension/attachment/endpoint/AttachmentEndpoint.java
+++ b/application/src/main/java/run/halo/app/core/attachment/endpoint/AttachmentEndpoint.java
@@ -1,4 +1,4 @@
-package run.halo.app.core.extension.attachment.endpoint;
+package run.halo.app.core.attachment.endpoint;
 
 import static io.swagger.v3.oas.annotations.media.Schema.RequiredMode.REQUIRED;
 import static org.springdoc.core.fn.builders.apiresponse.Builder.responseBuilder;
diff --git a/application/src/main/java/run/halo/app/core/extension/attachment/endpoint/LocalAttachmentUploadHandler.java b/application/src/main/java/run/halo/app/core/attachment/endpoint/LocalAttachmentUploadHandler.java
similarity index 99%
rename from application/src/main/java/run/halo/app/core/extension/attachment/endpoint/LocalAttachmentUploadHandler.java
rename to application/src/main/java/run/halo/app/core/attachment/endpoint/LocalAttachmentUploadHandler.java
index b0db21fc81..f13408cea7 100644
--- a/application/src/main/java/run/halo/app/core/extension/attachment/endpoint/LocalAttachmentUploadHandler.java
+++ b/application/src/main/java/run/halo/app/core/attachment/endpoint/LocalAttachmentUploadHandler.java
@@ -1,4 +1,4 @@
-package run.halo.app.core.extension.attachment.endpoint;
+package run.halo.app.core.attachment.endpoint;
 
 import static java.nio.file.StandardOpenOption.CREATE_NEW;
 import static run.halo.app.infra.utils.FileNameUtils.randomFileName;
@@ -41,6 +41,7 @@
 import run.halo.app.core.extension.attachment.Attachment.AttachmentSpec;
 import run.halo.app.core.extension.attachment.Constant;
 import run.halo.app.core.extension.attachment.Policy;
+import run.halo.app.core.extension.attachment.endpoint.AttachmentHandler;
 import run.halo.app.extension.ConfigMap;
 import run.halo.app.extension.Metadata;
 import run.halo.app.infra.ExternalUrlSupplier;
diff --git a/application/src/main/java/run/halo/app/core/extension/attachment/LocalThumbnail.java b/application/src/main/java/run/halo/app/core/attachment/extension/LocalThumbnail.java
similarity index 98%
rename from application/src/main/java/run/halo/app/core/extension/attachment/LocalThumbnail.java
rename to application/src/main/java/run/halo/app/core/attachment/extension/LocalThumbnail.java
index a4378853a4..97ee3974b1 100644
--- a/application/src/main/java/run/halo/app/core/extension/attachment/LocalThumbnail.java
+++ b/application/src/main/java/run/halo/app/core/attachment/extension/LocalThumbnail.java
@@ -1,4 +1,4 @@
-package run.halo.app.core.extension.attachment;
+package run.halo.app.core.attachment.extension;
 
 import static io.swagger.v3.oas.annotations.media.Schema.RequiredMode.NOT_REQUIRED;
 import static io.swagger.v3.oas.annotations.media.Schema.RequiredMode.REQUIRED;
diff --git a/application/src/main/java/run/halo/app/core/extension/attachment/Thumbnail.java b/application/src/main/java/run/halo/app/core/attachment/extension/Thumbnail.java
similarity index 96%
rename from application/src/main/java/run/halo/app/core/extension/attachment/Thumbnail.java
rename to application/src/main/java/run/halo/app/core/attachment/extension/Thumbnail.java
index 759a362f52..0228cc99d9 100644
--- a/application/src/main/java/run/halo/app/core/extension/attachment/Thumbnail.java
+++ b/application/src/main/java/run/halo/app/core/attachment/extension/Thumbnail.java
@@ -1,4 +1,4 @@
-package run.halo.app.core.extension.attachment;
+package run.halo.app.core.attachment.extension;
 
 import static io.swagger.v3.oas.annotations.media.Schema.RequiredMode.REQUIRED;
 
diff --git a/application/src/main/java/run/halo/app/core/attachment/impl/LocalThumbnailServiceImpl.java b/application/src/main/java/run/halo/app/core/attachment/impl/LocalThumbnailServiceImpl.java
index 747606253c..5b25d4b012 100644
--- a/application/src/main/java/run/halo/app/core/attachment/impl/LocalThumbnailServiceImpl.java
+++ b/application/src/main/java/run/halo/app/core/attachment/impl/LocalThumbnailServiceImpl.java
@@ -38,7 +38,7 @@
 import run.halo.app.core.attachment.ThumbnailGenerator;
 import run.halo.app.core.attachment.ThumbnailSigner;
 import run.halo.app.core.attachment.ThumbnailSize;
-import run.halo.app.core.extension.attachment.LocalThumbnail;
+import run.halo.app.core.attachment.extension.LocalThumbnail;
 import run.halo.app.extension.ListOptions;
 import run.halo.app.extension.ListResult;
 import run.halo.app.extension.Metadata;
diff --git a/application/src/main/java/run/halo/app/core/attachment/impl/ThumbnailServiceImpl.java b/application/src/main/java/run/halo/app/core/attachment/impl/ThumbnailServiceImpl.java
index 11cc3cadf7..a499ebc006 100644
--- a/application/src/main/java/run/halo/app/core/attachment/impl/ThumbnailServiceImpl.java
+++ b/application/src/main/java/run/halo/app/core/attachment/impl/ThumbnailServiceImpl.java
@@ -20,7 +20,7 @@
 import run.halo.app.core.attachment.ThumbnailService;
 import run.halo.app.core.attachment.ThumbnailSigner;
 import run.halo.app.core.attachment.ThumbnailSize;
-import run.halo.app.core.extension.attachment.Thumbnail;
+import run.halo.app.core.attachment.extension.Thumbnail;
 import run.halo.app.extension.ListOptions;
 import run.halo.app.extension.ListResult;
 import run.halo.app.extension.Metadata;
diff --git a/application/src/main/java/run/halo/app/core/attachment/reconciler/LocalThumbnailsReconciler.java b/application/src/main/java/run/halo/app/core/attachment/reconciler/LocalThumbnailsReconciler.java
index ce2d90f82f..900f57ff20 100644
--- a/application/src/main/java/run/halo/app/core/attachment/reconciler/LocalThumbnailsReconciler.java
+++ b/application/src/main/java/run/halo/app/core/attachment/reconciler/LocalThumbnailsReconciler.java
@@ -1,7 +1,7 @@
 package run.halo.app.core.attachment.reconciler;
 
 import static org.springframework.data.domain.Sort.Order.desc;
-import static run.halo.app.core.extension.attachment.LocalThumbnail.REQUEST_TO_GENERATE_ANNO;
+import static run.halo.app.core.attachment.extension.LocalThumbnail.REQUEST_TO_GENERATE_ANNO;
 import static run.halo.app.extension.MetadataUtil.nullSafeAnnotations;
 import static run.halo.app.extension.index.query.QueryFactory.and;
 import static run.halo.app.extension.index.query.QueryFactory.equal;
@@ -23,9 +23,9 @@
 import run.halo.app.core.attachment.AttachmentUtils;
 import run.halo.app.core.attachment.LocalThumbnailService;
 import run.halo.app.core.attachment.ThumbnailGenerator;
+import run.halo.app.core.attachment.extension.LocalThumbnail;
 import run.halo.app.core.extension.attachment.Attachment;
 import run.halo.app.core.extension.attachment.Constant;
-import run.halo.app.core.extension.attachment.LocalThumbnail;
 import run.halo.app.extension.ExtensionClient;
 import run.halo.app.extension.ExtensionUtil;
 import run.halo.app.extension.ListOptions;
diff --git a/application/src/main/java/run/halo/app/core/endpoint/WebSocketHandlerMapping.java b/application/src/main/java/run/halo/app/core/endpoint/WebSocketHandlerMapping.java
index 0105c03b38..c76fa0de25 100644
--- a/application/src/main/java/run/halo/app/core/endpoint/WebSocketHandlerMapping.java
+++ b/application/src/main/java/run/halo/app/core/endpoint/WebSocketHandlerMapping.java
@@ -19,7 +19,7 @@
 import org.springframework.web.server.ServerWebExchange;
 import org.springframework.web.util.pattern.PathPattern;
 import reactor.core.publisher.Mono;
-import run.halo.app.console.WebSocketUtils;
+import run.halo.app.infra.console.WebSocketUtils;
 
 public class WebSocketHandlerMapping extends AbstractHandlerMapping
     implements WebSocketEndpointManager, InitializingBean {
diff --git a/application/src/main/java/run/halo/app/core/extension/endpoint/AuthProviderEndpoint.java b/application/src/main/java/run/halo/app/core/endpoint/console/AuthProviderEndpoint.java
similarity index 97%
rename from application/src/main/java/run/halo/app/core/extension/endpoint/AuthProviderEndpoint.java
rename to application/src/main/java/run/halo/app/core/endpoint/console/AuthProviderEndpoint.java
index a58b922fe5..e1ecbbc1be 100644
--- a/application/src/main/java/run/halo/app/core/extension/endpoint/AuthProviderEndpoint.java
+++ b/application/src/main/java/run/halo/app/core/endpoint/console/AuthProviderEndpoint.java
@@ -1,4 +1,4 @@
-package run.halo.app.core.extension.endpoint;
+package run.halo.app.core.endpoint.console;
 
 import static org.springdoc.core.fn.builders.apiresponse.Builder.responseBuilder;
 import static org.springdoc.core.fn.builders.parameter.Builder.parameterBuilder;
@@ -12,6 +12,7 @@
 import org.springframework.web.reactive.function.server.ServerResponse;
 import reactor.core.publisher.Mono;
 import run.halo.app.core.extension.AuthProvider;
+import run.halo.app.core.extension.endpoint.CustomEndpoint;
 import run.halo.app.security.AuthProviderService;
 import run.halo.app.security.ListedAuthProvider;
 
diff --git a/application/src/main/java/run/halo/app/core/extension/endpoint/CommentEndpoint.java b/application/src/main/java/run/halo/app/core/endpoint/console/CommentEndpoint.java
similarity index 98%
rename from application/src/main/java/run/halo/app/core/extension/endpoint/CommentEndpoint.java
rename to application/src/main/java/run/halo/app/core/endpoint/console/CommentEndpoint.java
index 18c904c539..e1efd293bf 100644
--- a/application/src/main/java/run/halo/app/core/extension/endpoint/CommentEndpoint.java
+++ b/application/src/main/java/run/halo/app/core/endpoint/console/CommentEndpoint.java
@@ -1,4 +1,4 @@
-package run.halo.app.core.extension.endpoint;
+package run.halo.app.core.endpoint.console;
 
 import static org.springdoc.core.fn.builders.apiresponse.Builder.responseBuilder;
 import static org.springdoc.core.fn.builders.content.Builder.contentBuilder;
@@ -23,6 +23,7 @@
 import run.halo.app.content.comment.ReplyService;
 import run.halo.app.core.extension.content.Comment;
 import run.halo.app.core.extension.content.Reply;
+import run.halo.app.core.extension.endpoint.CustomEndpoint;
 import run.halo.app.extension.ListResult;
 import run.halo.app.infra.utils.HaloUtils;
 import run.halo.app.infra.utils.IpAddressUtils;
diff --git a/application/src/main/java/run/halo/app/core/extension/endpoint/CustomEndpointsBuilder.java b/application/src/main/java/run/halo/app/core/endpoint/console/CustomEndpointsBuilder.java
similarity index 94%
rename from application/src/main/java/run/halo/app/core/extension/endpoint/CustomEndpointsBuilder.java
rename to application/src/main/java/run/halo/app/core/endpoint/console/CustomEndpointsBuilder.java
index 6b8d7cf064..b328709a64 100644
--- a/application/src/main/java/run/halo/app/core/extension/endpoint/CustomEndpointsBuilder.java
+++ b/application/src/main/java/run/halo/app/core/endpoint/console/CustomEndpointsBuilder.java
@@ -1,4 +1,4 @@
-package run.halo.app.core.extension.endpoint;
+package run.halo.app.core.endpoint.console;
 
 import java.util.HashMap;
 import java.util.LinkedList;
@@ -9,6 +9,7 @@
 import org.springframework.web.reactive.function.server.RouterFunction;
 import org.springframework.web.reactive.function.server.ServerResponse;
 import reactor.core.publisher.Mono;
+import run.halo.app.core.extension.endpoint.CustomEndpoint;
 import run.halo.app.extension.GroupVersion;
 
 public class CustomEndpointsBuilder {
diff --git a/application/src/main/java/run/halo/app/core/extension/endpoint/PluginEndpoint.java b/application/src/main/java/run/halo/app/core/endpoint/console/PluginEndpoint.java
similarity index 99%
rename from application/src/main/java/run/halo/app/core/extension/endpoint/PluginEndpoint.java
rename to application/src/main/java/run/halo/app/core/endpoint/console/PluginEndpoint.java
index a05a216bdd..2f3dea989b 100644
--- a/application/src/main/java/run/halo/app/core/extension/endpoint/PluginEndpoint.java
+++ b/application/src/main/java/run/halo/app/core/endpoint/console/PluginEndpoint.java
@@ -1,4 +1,4 @@
-package run.halo.app.core.extension.endpoint;
+package run.halo.app.core.endpoint.console;
 
 import static io.swagger.v3.oas.annotations.media.Schema.RequiredMode.NOT_REQUIRED;
 import static io.swagger.v3.oas.annotations.media.Schema.RequiredMode.REQUIRED;
@@ -60,15 +60,16 @@
 import reactor.util.retry.Retry;
 import run.halo.app.core.extension.Plugin;
 import run.halo.app.core.extension.Setting;
-import run.halo.app.core.extension.service.PluginService;
-import run.halo.app.core.extension.theme.SettingUtils;
+import run.halo.app.core.extension.endpoint.CustomEndpoint;
 import run.halo.app.extension.ConfigMap;
 import run.halo.app.extension.ListOptions;
 import run.halo.app.extension.ReactiveExtensionClient;
 import run.halo.app.extension.router.IListRequest;
 import run.halo.app.extension.router.SortableRequest;
 import run.halo.app.infra.ReactiveUrlDataBufferFetcher;
+import run.halo.app.infra.utils.SettingUtils;
 import run.halo.app.plugin.PluginNotFoundException;
+import run.halo.app.plugin.PluginService;
 
 @Slf4j
 @Component
diff --git a/application/src/main/java/run/halo/app/core/extension/endpoint/PostEndpoint.java b/application/src/main/java/run/halo/app/core/endpoint/console/PostEndpoint.java
similarity index 99%
rename from application/src/main/java/run/halo/app/core/extension/endpoint/PostEndpoint.java
rename to application/src/main/java/run/halo/app/core/endpoint/console/PostEndpoint.java
index 07049041ad..689a0f2018 100644
--- a/application/src/main/java/run/halo/app/core/extension/endpoint/PostEndpoint.java
+++ b/application/src/main/java/run/halo/app/core/endpoint/console/PostEndpoint.java
@@ -1,4 +1,4 @@
-package run.halo.app.core.extension.endpoint;
+package run.halo.app.core.endpoint.console;
 
 import static org.springdoc.core.fn.builders.apiresponse.Builder.responseBuilder;
 import static org.springdoc.core.fn.builders.content.Builder.contentBuilder;
@@ -37,6 +37,7 @@
 import run.halo.app.content.PostRequest;
 import run.halo.app.content.PostService;
 import run.halo.app.core.extension.content.Post;
+import run.halo.app.core.extension.endpoint.CustomEndpoint;
 import run.halo.app.extension.ListResult;
 import run.halo.app.extension.MetadataUtil;
 import run.halo.app.extension.ReactiveExtensionClient;
diff --git a/application/src/main/java/run/halo/app/core/extension/endpoint/ReplyEndpoint.java b/application/src/main/java/run/halo/app/core/endpoint/console/ReplyEndpoint.java
similarity index 94%
rename from application/src/main/java/run/halo/app/core/extension/endpoint/ReplyEndpoint.java
rename to application/src/main/java/run/halo/app/core/endpoint/console/ReplyEndpoint.java
index 61e2fb589a..29a6cd9cc6 100644
--- a/application/src/main/java/run/halo/app/core/extension/endpoint/ReplyEndpoint.java
+++ b/application/src/main/java/run/halo/app/core/endpoint/console/ReplyEndpoint.java
@@ -1,4 +1,4 @@
-package run.halo.app.core.extension.endpoint;
+package run.halo.app.core.endpoint.console;
 
 import static org.springdoc.core.fn.builders.apiresponse.Builder.responseBuilder;
 
@@ -12,6 +12,7 @@
 import run.halo.app.content.comment.ReplyQuery;
 import run.halo.app.content.comment.ReplyService;
 import run.halo.app.core.extension.content.Reply;
+import run.halo.app.core.extension.endpoint.CustomEndpoint;
 import run.halo.app.extension.ListResult;
 
 /**
diff --git a/application/src/main/java/run/halo/app/core/extension/endpoint/SinglePageEndpoint.java b/application/src/main/java/run/halo/app/core/endpoint/console/SinglePageEndpoint.java
similarity index 99%
rename from application/src/main/java/run/halo/app/core/extension/endpoint/SinglePageEndpoint.java
rename to application/src/main/java/run/halo/app/core/endpoint/console/SinglePageEndpoint.java
index 0c86c01649..56f8ce014b 100644
--- a/application/src/main/java/run/halo/app/core/extension/endpoint/SinglePageEndpoint.java
+++ b/application/src/main/java/run/halo/app/core/endpoint/console/SinglePageEndpoint.java
@@ -1,4 +1,4 @@
-package run.halo.app.core.extension.endpoint;
+package run.halo.app.core.endpoint.console;
 
 import static org.springdoc.core.fn.builders.apiresponse.Builder.responseBuilder;
 import static org.springdoc.core.fn.builders.content.Builder.contentBuilder;
@@ -33,6 +33,7 @@
 import run.halo.app.content.SinglePageService;
 import run.halo.app.core.extension.content.Post;
 import run.halo.app.core.extension.content.SinglePage;
+import run.halo.app.core.extension.endpoint.CustomEndpoint;
 import run.halo.app.extension.ListResult;
 import run.halo.app.extension.MetadataUtil;
 import run.halo.app.extension.ReactiveExtensionClient;
diff --git a/application/src/main/java/run/halo/app/core/extension/endpoint/StatsEndpoint.java b/application/src/main/java/run/halo/app/core/endpoint/console/StatsEndpoint.java
similarity index 97%
rename from application/src/main/java/run/halo/app/core/extension/endpoint/StatsEndpoint.java
rename to application/src/main/java/run/halo/app/core/endpoint/console/StatsEndpoint.java
index 84881b73d3..6be262e688 100644
--- a/application/src/main/java/run/halo/app/core/extension/endpoint/StatsEndpoint.java
+++ b/application/src/main/java/run/halo/app/core/endpoint/console/StatsEndpoint.java
@@ -1,4 +1,4 @@
-package run.halo.app.core.extension.endpoint;
+package run.halo.app.core.endpoint.console;
 
 import static org.springdoc.core.fn.builders.apiresponse.Builder.responseBuilder;
 import static run.halo.app.extension.index.query.QueryFactory.and;
@@ -15,6 +15,7 @@
 import run.halo.app.core.extension.Counter;
 import run.halo.app.core.extension.User;
 import run.halo.app.core.extension.content.Post;
+import run.halo.app.core.extension.endpoint.CustomEndpoint;
 import run.halo.app.extension.ListOptions;
 import run.halo.app.extension.PageRequestImpl;
 import run.halo.app.extension.ReactiveExtensionClient;
diff --git a/application/src/main/java/run/halo/app/core/extension/endpoint/SystemInitializationEndpoint.java b/application/src/main/java/run/halo/app/core/endpoint/console/SystemInitializationEndpoint.java
similarity index 98%
rename from application/src/main/java/run/halo/app/core/extension/endpoint/SystemInitializationEndpoint.java
rename to application/src/main/java/run/halo/app/core/endpoint/console/SystemInitializationEndpoint.java
index 37477cc816..4bb6b21b37 100644
--- a/application/src/main/java/run/halo/app/core/extension/endpoint/SystemInitializationEndpoint.java
+++ b/application/src/main/java/run/halo/app/core/endpoint/console/SystemInitializationEndpoint.java
@@ -1,4 +1,4 @@
-package run.halo.app.core.extension.endpoint;
+package run.halo.app.core.endpoint.console;
 
 import static io.swagger.v3.oas.annotations.media.Schema.RequiredMode.REQUIRED;
 import static org.springdoc.core.fn.builders.apiresponse.Builder.responseBuilder;
@@ -25,6 +25,7 @@
 import org.springframework.web.server.ServerWebInputException;
 import reactor.core.publisher.Mono;
 import reactor.util.retry.Retry;
+import run.halo.app.core.extension.endpoint.CustomEndpoint;
 import run.halo.app.extension.ConfigMap;
 import run.halo.app.extension.ReactiveExtensionClient;
 import run.halo.app.infra.InitializationStateGetter;
diff --git a/application/src/main/java/run/halo/app/core/extension/endpoint/TagEndpoint.java b/application/src/main/java/run/halo/app/core/endpoint/console/TagEndpoint.java
similarity index 97%
rename from application/src/main/java/run/halo/app/core/extension/endpoint/TagEndpoint.java
rename to application/src/main/java/run/halo/app/core/endpoint/console/TagEndpoint.java
index ca768092fe..612113413f 100644
--- a/application/src/main/java/run/halo/app/core/extension/endpoint/TagEndpoint.java
+++ b/application/src/main/java/run/halo/app/core/endpoint/console/TagEndpoint.java
@@ -1,4 +1,4 @@
-package run.halo.app.core.extension.endpoint;
+package run.halo.app.core.endpoint.console;
 
 import static org.springdoc.core.fn.builders.apiresponse.Builder.responseBuilder;
 import static org.springdoc.core.fn.builders.parameter.Builder.parameterBuilder;
@@ -19,6 +19,7 @@
 import org.springframework.web.reactive.function.server.ServerResponse;
 import reactor.core.publisher.Mono;
 import run.halo.app.core.extension.content.Tag;
+import run.halo.app.core.extension.endpoint.CustomEndpoint;
 import run.halo.app.extension.ListOptions;
 import run.halo.app.extension.ListResult;
 import run.halo.app.extension.PageRequestImpl;
diff --git a/application/src/main/java/run/halo/app/core/extension/endpoint/TrackerEndpoint.java b/application/src/main/java/run/halo/app/core/endpoint/console/TrackerEndpoint.java
similarity index 98%
rename from application/src/main/java/run/halo/app/core/extension/endpoint/TrackerEndpoint.java
rename to application/src/main/java/run/halo/app/core/endpoint/console/TrackerEndpoint.java
index 8ada7725f2..a69a30150c 100644
--- a/application/src/main/java/run/halo/app/core/extension/endpoint/TrackerEndpoint.java
+++ b/application/src/main/java/run/halo/app/core/endpoint/console/TrackerEndpoint.java
@@ -1,4 +1,4 @@
-package run.halo.app.core.extension.endpoint;
+package run.halo.app.core.endpoint.console;
 
 import static org.springdoc.core.fn.builders.apiresponse.Builder.responseBuilder;
 import static org.springdoc.core.fn.builders.content.Builder.contentBuilder;
@@ -16,6 +16,7 @@
 import org.springframework.web.reactive.function.server.ServerRequest;
 import org.springframework.web.reactive.function.server.ServerResponse;
 import reactor.core.publisher.Mono;
+import run.halo.app.core.extension.endpoint.CustomEndpoint;
 import run.halo.app.event.post.DownvotedEvent;
 import run.halo.app.event.post.UpvotedEvent;
 import run.halo.app.event.post.VisitedEvent;
diff --git a/application/src/main/java/run/halo/app/core/extension/endpoint/UserEndpoint.java b/application/src/main/java/run/halo/app/core/endpoint/console/UserEndpoint.java
similarity index 99%
rename from application/src/main/java/run/halo/app/core/extension/endpoint/UserEndpoint.java
rename to application/src/main/java/run/halo/app/core/endpoint/console/UserEndpoint.java
index d8bc8bd980..8a907e84c2 100644
--- a/application/src/main/java/run/halo/app/core/extension/endpoint/UserEndpoint.java
+++ b/application/src/main/java/run/halo/app/core/endpoint/console/UserEndpoint.java
@@ -1,4 +1,4 @@
-package run.halo.app.core.extension.endpoint;
+package run.halo.app.core.endpoint.console;
 
 import static io.swagger.v3.oas.annotations.media.Schema.RequiredMode.REQUIRED;
 import static org.apache.commons.lang3.ObjectUtils.defaultIfNull;
@@ -70,10 +70,11 @@
 import run.halo.app.core.extension.Role;
 import run.halo.app.core.extension.User;
 import run.halo.app.core.extension.attachment.Attachment;
+import run.halo.app.core.extension.endpoint.CustomEndpoint;
 import run.halo.app.core.extension.service.AttachmentService;
-import run.halo.app.core.extension.service.EmailVerificationService;
-import run.halo.app.core.extension.service.RoleService;
-import run.halo.app.core.extension.service.UserService;
+import run.halo.app.core.user.service.EmailVerificationService;
+import run.halo.app.core.user.service.RoleService;
+import run.halo.app.core.user.service.UserService;
 import run.halo.app.extension.ListOptions;
 import run.halo.app.extension.ListResult;
 import run.halo.app.extension.Metadata;
diff --git a/application/src/main/java/run/halo/app/theme/endpoint/CategoryQueryEndpoint.java b/application/src/main/java/run/halo/app/core/endpoint/theme/CategoryQueryEndpoint.java
similarity index 97%
rename from application/src/main/java/run/halo/app/theme/endpoint/CategoryQueryEndpoint.java
rename to application/src/main/java/run/halo/app/core/endpoint/theme/CategoryQueryEndpoint.java
index 1183211a33..85587ad405 100644
--- a/application/src/main/java/run/halo/app/theme/endpoint/CategoryQueryEndpoint.java
+++ b/application/src/main/java/run/halo/app/core/endpoint/theme/CategoryQueryEndpoint.java
@@ -1,8 +1,8 @@
-package run.halo.app.theme.endpoint;
+package run.halo.app.core.endpoint.theme;
 
 import static org.springdoc.core.fn.builders.apiresponse.Builder.responseBuilder;
 import static org.springdoc.core.fn.builders.parameter.Builder.parameterBuilder;
-import static run.halo.app.theme.endpoint.PublicApiUtils.toAnotherListResult;
+import static run.halo.app.core.endpoint.theme.PublicApiUtils.toAnotherListResult;
 
 import io.swagger.v3.oas.annotations.enums.ParameterIn;
 import lombok.RequiredArgsConstructor;
diff --git a/application/src/main/java/run/halo/app/theme/endpoint/CommentFinderEndpoint.java b/application/src/main/java/run/halo/app/core/endpoint/theme/CommentFinderEndpoint.java
similarity index 99%
rename from application/src/main/java/run/halo/app/theme/endpoint/CommentFinderEndpoint.java
rename to application/src/main/java/run/halo/app/core/endpoint/theme/CommentFinderEndpoint.java
index edfd4c4ae3..2e4169ff1b 100644
--- a/application/src/main/java/run/halo/app/theme/endpoint/CommentFinderEndpoint.java
+++ b/application/src/main/java/run/halo/app/core/endpoint/theme/CommentFinderEndpoint.java
@@ -1,4 +1,4 @@
-package run.halo.app.theme.endpoint;
+package run.halo.app.core.endpoint.theme;
 
 import static io.swagger.v3.oas.annotations.media.Schema.RequiredMode.REQUIRED;
 import static org.apache.commons.lang3.BooleanUtils.isFalse;
diff --git a/application/src/main/java/run/halo/app/theme/endpoint/MenuQueryEndpoint.java b/application/src/main/java/run/halo/app/core/endpoint/theme/MenuQueryEndpoint.java
similarity index 98%
rename from application/src/main/java/run/halo/app/theme/endpoint/MenuQueryEndpoint.java
rename to application/src/main/java/run/halo/app/core/endpoint/theme/MenuQueryEndpoint.java
index b43eff0492..f0ac37df10 100644
--- a/application/src/main/java/run/halo/app/theme/endpoint/MenuQueryEndpoint.java
+++ b/application/src/main/java/run/halo/app/core/endpoint/theme/MenuQueryEndpoint.java
@@ -1,4 +1,4 @@
-package run.halo.app.theme.endpoint;
+package run.halo.app.core.endpoint.theme;
 
 import static org.springdoc.core.fn.builders.apiresponse.Builder.responseBuilder;
 import static org.springdoc.core.fn.builders.parameter.Builder.parameterBuilder;
diff --git a/application/src/main/java/run/halo/app/theme/endpoint/PluginQueryEndpoint.java b/application/src/main/java/run/halo/app/core/endpoint/theme/PluginQueryEndpoint.java
similarity index 98%
rename from application/src/main/java/run/halo/app/theme/endpoint/PluginQueryEndpoint.java
rename to application/src/main/java/run/halo/app/core/endpoint/theme/PluginQueryEndpoint.java
index 2de30247dd..d649f79619 100644
--- a/application/src/main/java/run/halo/app/theme/endpoint/PluginQueryEndpoint.java
+++ b/application/src/main/java/run/halo/app/core/endpoint/theme/PluginQueryEndpoint.java
@@ -1,4 +1,4 @@
-package run.halo.app.theme.endpoint;
+package run.halo.app.core.endpoint.theme;
 
 import static org.springdoc.core.fn.builders.apiresponse.Builder.responseBuilder;
 import static org.springdoc.core.fn.builders.parameter.Builder.parameterBuilder;
diff --git a/application/src/main/java/run/halo/app/theme/endpoint/PostPublicQuery.java b/application/src/main/java/run/halo/app/core/endpoint/theme/PostPublicQuery.java
similarity index 92%
rename from application/src/main/java/run/halo/app/theme/endpoint/PostPublicQuery.java
rename to application/src/main/java/run/halo/app/core/endpoint/theme/PostPublicQuery.java
index c880186a14..2817481087 100644
--- a/application/src/main/java/run/halo/app/theme/endpoint/PostPublicQuery.java
+++ b/application/src/main/java/run/halo/app/core/endpoint/theme/PostPublicQuery.java
@@ -1,4 +1,4 @@
-package run.halo.app.theme.endpoint;
+package run.halo.app.core.endpoint.theme;
 
 import org.springdoc.core.fn.builders.operation.Builder;
 import org.springframework.web.server.ServerWebExchange;
diff --git a/application/src/main/java/run/halo/app/theme/endpoint/PostQueryEndpoint.java b/application/src/main/java/run/halo/app/core/endpoint/theme/PostQueryEndpoint.java
similarity index 99%
rename from application/src/main/java/run/halo/app/theme/endpoint/PostQueryEndpoint.java
rename to application/src/main/java/run/halo/app/core/endpoint/theme/PostQueryEndpoint.java
index 9136eea7ef..9588265f90 100644
--- a/application/src/main/java/run/halo/app/theme/endpoint/PostQueryEndpoint.java
+++ b/application/src/main/java/run/halo/app/core/endpoint/theme/PostQueryEndpoint.java
@@ -1,4 +1,4 @@
-package run.halo.app.theme.endpoint;
+package run.halo.app.core.endpoint.theme;
 
 import static org.springdoc.core.fn.builders.apiresponse.Builder.responseBuilder;
 import static org.springdoc.core.fn.builders.parameter.Builder.parameterBuilder;
diff --git a/application/src/main/java/run/halo/app/theme/endpoint/PublicApiUtils.java b/application/src/main/java/run/halo/app/core/endpoint/theme/PublicApiUtils.java
similarity index 98%
rename from application/src/main/java/run/halo/app/theme/endpoint/PublicApiUtils.java
rename to application/src/main/java/run/halo/app/core/endpoint/theme/PublicApiUtils.java
index 142b72055c..5a622e85d1 100644
--- a/application/src/main/java/run/halo/app/theme/endpoint/PublicApiUtils.java
+++ b/application/src/main/java/run/halo/app/core/endpoint/theme/PublicApiUtils.java
@@ -1,4 +1,4 @@
-package run.halo.app.theme.endpoint;
+package run.halo.app.core.endpoint.theme;
 
 import java.util.Collection;
 import java.util.List;
diff --git a/application/src/main/java/run/halo/app/theme/endpoint/PublicUserEndpoint.java b/application/src/main/java/run/halo/app/core/endpoint/theme/PublicUserEndpoint.java
similarity index 98%
rename from application/src/main/java/run/halo/app/theme/endpoint/PublicUserEndpoint.java
rename to application/src/main/java/run/halo/app/core/endpoint/theme/PublicUserEndpoint.java
index 9ebd7b22a8..862aad3343 100644
--- a/application/src/main/java/run/halo/app/theme/endpoint/PublicUserEndpoint.java
+++ b/application/src/main/java/run/halo/app/core/endpoint/theme/PublicUserEndpoint.java
@@ -1,4 +1,4 @@
-package run.halo.app.theme.endpoint;
+package run.halo.app.core.endpoint.theme;
 
 import static io.swagger.v3.oas.annotations.media.Schema.RequiredMode.NOT_REQUIRED;
 import static io.swagger.v3.oas.annotations.media.Schema.RequiredMode.REQUIRED;
@@ -30,9 +30,9 @@
 import reactor.core.publisher.Mono;
 import run.halo.app.core.extension.User;
 import run.halo.app.core.extension.endpoint.CustomEndpoint;
-import run.halo.app.core.extension.service.EmailPasswordRecoveryService;
-import run.halo.app.core.extension.service.EmailVerificationService;
-import run.halo.app.core.extension.service.UserService;
+import run.halo.app.core.user.service.EmailPasswordRecoveryService;
+import run.halo.app.core.user.service.EmailVerificationService;
+import run.halo.app.core.user.service.UserService;
 import run.halo.app.extension.GroupVersion;
 import run.halo.app.infra.SystemConfigurableEnvironmentFetcher;
 import run.halo.app.infra.SystemSetting;
diff --git a/application/src/main/java/run/halo/app/theme/endpoint/SinglePageQueryEndpoint.java b/application/src/main/java/run/halo/app/core/endpoint/theme/SinglePageQueryEndpoint.java
similarity index 98%
rename from application/src/main/java/run/halo/app/theme/endpoint/SinglePageQueryEndpoint.java
rename to application/src/main/java/run/halo/app/core/endpoint/theme/SinglePageQueryEndpoint.java
index 933f3516da..8813cd273c 100644
--- a/application/src/main/java/run/halo/app/theme/endpoint/SinglePageQueryEndpoint.java
+++ b/application/src/main/java/run/halo/app/core/endpoint/theme/SinglePageQueryEndpoint.java
@@ -1,4 +1,4 @@
-package run.halo.app.theme.endpoint;
+package run.halo.app.core.endpoint.theme;
 
 import static org.springdoc.core.fn.builders.apiresponse.Builder.responseBuilder;
 import static org.springdoc.core.fn.builders.parameter.Builder.parameterBuilder;
diff --git a/application/src/main/java/run/halo/app/theme/endpoint/SiteStatsQueryEndpoint.java b/application/src/main/java/run/halo/app/core/endpoint/theme/SiteStatsQueryEndpoint.java
similarity index 97%
rename from application/src/main/java/run/halo/app/theme/endpoint/SiteStatsQueryEndpoint.java
rename to application/src/main/java/run/halo/app/core/endpoint/theme/SiteStatsQueryEndpoint.java
index 40792d06ba..13ed5c0a70 100644
--- a/application/src/main/java/run/halo/app/theme/endpoint/SiteStatsQueryEndpoint.java
+++ b/application/src/main/java/run/halo/app/core/endpoint/theme/SiteStatsQueryEndpoint.java
@@ -1,4 +1,4 @@
-package run.halo.app.theme.endpoint;
+package run.halo.app.core.endpoint.theme;
 
 import static org.springdoc.core.fn.builders.apiresponse.Builder.responseBuilder;
 
diff --git a/application/src/main/java/run/halo/app/theme/endpoint/TagQueryEndpoint.java b/application/src/main/java/run/halo/app/core/endpoint/theme/TagQueryEndpoint.java
similarity index 99%
rename from application/src/main/java/run/halo/app/theme/endpoint/TagQueryEndpoint.java
rename to application/src/main/java/run/halo/app/core/endpoint/theme/TagQueryEndpoint.java
index a54120d7a4..b25f3cdae4 100644
--- a/application/src/main/java/run/halo/app/theme/endpoint/TagQueryEndpoint.java
+++ b/application/src/main/java/run/halo/app/core/endpoint/theme/TagQueryEndpoint.java
@@ -1,4 +1,4 @@
-package run.halo.app.theme.endpoint;
+package run.halo.app.core.endpoint.theme;
 
 import static org.springdoc.core.fn.builders.apiresponse.Builder.responseBuilder;
 import static org.springdoc.core.fn.builders.parameter.Builder.parameterBuilder;
diff --git a/application/src/main/java/run/halo/app/theme/endpoint/ThumbnailEndpoint.java b/application/src/main/java/run/halo/app/core/endpoint/theme/ThumbnailEndpoint.java
similarity index 99%
rename from application/src/main/java/run/halo/app/theme/endpoint/ThumbnailEndpoint.java
rename to application/src/main/java/run/halo/app/core/endpoint/theme/ThumbnailEndpoint.java
index aeb332b0d9..012bdd249c 100644
--- a/application/src/main/java/run/halo/app/theme/endpoint/ThumbnailEndpoint.java
+++ b/application/src/main/java/run/halo/app/core/endpoint/theme/ThumbnailEndpoint.java
@@ -1,4 +1,4 @@
-package run.halo.app.theme.endpoint;
+package run.halo.app.core.endpoint.theme;
 
 import static io.swagger.v3.oas.annotations.media.Schema.RequiredMode.REQUIRED;
 import static org.springdoc.core.fn.builders.apiresponse.Builder.responseBuilder;
diff --git a/application/src/main/java/run/halo/app/endpoint/uc/content/UcPostAttachmentEndpoint.java b/application/src/main/java/run/halo/app/core/endpoint/uc/UcPostAttachmentEndpoint.java
similarity index 99%
rename from application/src/main/java/run/halo/app/endpoint/uc/content/UcPostAttachmentEndpoint.java
rename to application/src/main/java/run/halo/app/core/endpoint/uc/UcPostAttachmentEndpoint.java
index 47063a4551..0e04701a77 100644
--- a/application/src/main/java/run/halo/app/endpoint/uc/content/UcPostAttachmentEndpoint.java
+++ b/application/src/main/java/run/halo/app/core/endpoint/uc/UcPostAttachmentEndpoint.java
@@ -1,4 +1,4 @@
-package run.halo.app.endpoint.uc.content;
+package run.halo.app.core.endpoint.uc;
 
 import static io.swagger.v3.oas.annotations.media.Schema.RequiredMode.NOT_REQUIRED;
 import static io.swagger.v3.oas.annotations.media.Schema.RequiredMode.REQUIRED;
diff --git a/application/src/main/java/run/halo/app/endpoint/uc/content/UcPostEndpoint.java b/application/src/main/java/run/halo/app/core/endpoint/uc/UcPostEndpoint.java
similarity index 99%
rename from application/src/main/java/run/halo/app/endpoint/uc/content/UcPostEndpoint.java
rename to application/src/main/java/run/halo/app/core/endpoint/uc/UcPostEndpoint.java
index 0b30aec497..a969e64e82 100644
--- a/application/src/main/java/run/halo/app/endpoint/uc/content/UcPostEndpoint.java
+++ b/application/src/main/java/run/halo/app/core/endpoint/uc/UcPostEndpoint.java
@@ -1,4 +1,4 @@
-package run.halo.app.endpoint.uc.content;
+package run.halo.app.core.endpoint.uc;
 
 import static org.springdoc.core.fn.builders.apiresponse.Builder.responseBuilder;
 import static org.springdoc.core.fn.builders.parameter.Builder.parameterBuilder;
diff --git a/application/src/main/java/run/halo/app/endpoint/uc/content/UcSnapshotEndpoint.java b/application/src/main/java/run/halo/app/core/endpoint/uc/UcSnapshotEndpoint.java
similarity index 99%
rename from application/src/main/java/run/halo/app/endpoint/uc/content/UcSnapshotEndpoint.java
rename to application/src/main/java/run/halo/app/core/endpoint/uc/UcSnapshotEndpoint.java
index 1f196bc66c..f674d84ccd 100644
--- a/application/src/main/java/run/halo/app/endpoint/uc/content/UcSnapshotEndpoint.java
+++ b/application/src/main/java/run/halo/app/core/endpoint/uc/UcSnapshotEndpoint.java
@@ -1,4 +1,4 @@
-package run.halo.app.endpoint.uc.content;
+package run.halo.app.core.endpoint.uc;
 
 import static org.springdoc.core.fn.builders.apiresponse.Builder.responseBuilder;
 import static org.springdoc.core.fn.builders.parameter.Builder.parameterBuilder;
diff --git a/application/src/main/java/run/halo/app/core/extension/reconciler/AnnotationSettingReconciler.java b/application/src/main/java/run/halo/app/core/reconciler/AnnotationSettingReconciler.java
similarity index 97%
rename from application/src/main/java/run/halo/app/core/extension/reconciler/AnnotationSettingReconciler.java
rename to application/src/main/java/run/halo/app/core/reconciler/AnnotationSettingReconciler.java
index 8b6fce8324..fb314e260d 100644
--- a/application/src/main/java/run/halo/app/core/extension/reconciler/AnnotationSettingReconciler.java
+++ b/application/src/main/java/run/halo/app/core/reconciler/AnnotationSettingReconciler.java
@@ -1,4 +1,4 @@
-package run.halo.app.core.extension.reconciler;
+package run.halo.app.core.reconciler;
 
 import java.util.Map;
 import lombok.AllArgsConstructor;
diff --git a/application/src/main/java/run/halo/app/core/extension/reconciler/AuthProviderReconciler.java b/application/src/main/java/run/halo/app/core/reconciler/AuthProviderReconciler.java
similarity index 97%
rename from application/src/main/java/run/halo/app/core/extension/reconciler/AuthProviderReconciler.java
rename to application/src/main/java/run/halo/app/core/reconciler/AuthProviderReconciler.java
index 5176f8a3fe..b43c2fdaf9 100644
--- a/application/src/main/java/run/halo/app/core/extension/reconciler/AuthProviderReconciler.java
+++ b/application/src/main/java/run/halo/app/core/reconciler/AuthProviderReconciler.java
@@ -1,4 +1,4 @@
-package run.halo.app.core.extension.reconciler;
+package run.halo.app.core.reconciler;
 
 import lombok.RequiredArgsConstructor;
 import org.apache.commons.lang3.BooleanUtils;
diff --git a/application/src/main/java/run/halo/app/core/extension/reconciler/CategoryReconciler.java b/application/src/main/java/run/halo/app/core/reconciler/CategoryReconciler.java
similarity index 98%
rename from application/src/main/java/run/halo/app/core/extension/reconciler/CategoryReconciler.java
rename to application/src/main/java/run/halo/app/core/reconciler/CategoryReconciler.java
index d4abf4862f..a64d462fa0 100644
--- a/application/src/main/java/run/halo/app/core/extension/reconciler/CategoryReconciler.java
+++ b/application/src/main/java/run/halo/app/core/reconciler/CategoryReconciler.java
@@ -1,4 +1,4 @@
-package run.halo.app.core.extension.reconciler;
+package run.halo.app.core.reconciler;
 
 import static run.halo.app.extension.ExtensionUtil.addFinalizers;
 import static run.halo.app.extension.ExtensionUtil.removeFinalizers;
diff --git a/application/src/main/java/run/halo/app/core/extension/reconciler/CommentReconciler.java b/application/src/main/java/run/halo/app/core/reconciler/CommentReconciler.java
similarity index 99%
rename from application/src/main/java/run/halo/app/core/extension/reconciler/CommentReconciler.java
rename to application/src/main/java/run/halo/app/core/reconciler/CommentReconciler.java
index 4e9ce5237e..abcca19475 100644
--- a/application/src/main/java/run/halo/app/core/extension/reconciler/CommentReconciler.java
+++ b/application/src/main/java/run/halo/app/core/reconciler/CommentReconciler.java
@@ -1,4 +1,4 @@
-package run.halo.app.core.extension.reconciler;
+package run.halo.app.core.reconciler;
 
 import static org.apache.commons.lang3.ObjectUtils.defaultIfNull;
 import static run.halo.app.extension.ExtensionUtil.addFinalizers;
diff --git a/application/src/main/java/run/halo/app/core/extension/reconciler/MenuItemReconciler.java b/application/src/main/java/run/halo/app/core/reconciler/MenuItemReconciler.java
similarity index 99%
rename from application/src/main/java/run/halo/app/core/extension/reconciler/MenuItemReconciler.java
rename to application/src/main/java/run/halo/app/core/reconciler/MenuItemReconciler.java
index 9d27680367..ba267bb5f7 100644
--- a/application/src/main/java/run/halo/app/core/extension/reconciler/MenuItemReconciler.java
+++ b/application/src/main/java/run/halo/app/core/reconciler/MenuItemReconciler.java
@@ -1,4 +1,4 @@
-package run.halo.app.core.extension.reconciler;
+package run.halo.app.core.reconciler;
 
 import java.time.Duration;
 import java.util.Objects;
diff --git a/application/src/main/java/run/halo/app/core/extension/reconciler/PluginReconciler.java b/application/src/main/java/run/halo/app/core/reconciler/PluginReconciler.java
similarity index 99%
rename from application/src/main/java/run/halo/app/core/extension/reconciler/PluginReconciler.java
rename to application/src/main/java/run/halo/app/core/reconciler/PluginReconciler.java
index 145c7df775..5a5a2ecd21 100644
--- a/application/src/main/java/run/halo/app/core/extension/reconciler/PluginReconciler.java
+++ b/application/src/main/java/run/halo/app/core/reconciler/PluginReconciler.java
@@ -1,4 +1,4 @@
-package run.halo.app.core.extension.reconciler;
+package run.halo.app.core.reconciler;
 
 import static run.halo.app.core.extension.Plugin.PluginStatus.nullSafeConditions;
 import static run.halo.app.extension.ExtensionUtil.addFinalizers;
@@ -44,7 +44,6 @@
 import run.halo.app.core.extension.Plugin;
 import run.halo.app.core.extension.ReverseProxy;
 import run.halo.app.core.extension.Setting;
-import run.halo.app.core.extension.theme.SettingUtils;
 import run.halo.app.extension.ConfigMap;
 import run.halo.app.extension.ExtensionClient;
 import run.halo.app.extension.ExtensionUtil;
@@ -59,6 +58,7 @@
 import run.halo.app.infra.ConditionList;
 import run.halo.app.infra.ConditionStatus;
 import run.halo.app.infra.utils.PathUtils;
+import run.halo.app.infra.utils.SettingUtils;
 import run.halo.app.infra.utils.YamlUnstructuredLoader;
 import run.halo.app.plugin.PluginConst;
 import run.halo.app.plugin.PluginProperties;
diff --git a/application/src/main/java/run/halo/app/core/extension/reconciler/PostCounterReconciler.java b/application/src/main/java/run/halo/app/core/reconciler/PostCounterReconciler.java
similarity index 97%
rename from application/src/main/java/run/halo/app/core/extension/reconciler/PostCounterReconciler.java
rename to application/src/main/java/run/halo/app/core/reconciler/PostCounterReconciler.java
index a6986a54c7..24f8ada281 100644
--- a/application/src/main/java/run/halo/app/core/extension/reconciler/PostCounterReconciler.java
+++ b/application/src/main/java/run/halo/app/core/reconciler/PostCounterReconciler.java
@@ -1,4 +1,4 @@
-package run.halo.app.core.extension.reconciler;
+package run.halo.app.core.reconciler;
 
 import static run.halo.app.extension.index.query.QueryFactory.startsWith;
 
diff --git a/application/src/main/java/run/halo/app/core/extension/reconciler/PostReconciler.java b/application/src/main/java/run/halo/app/core/reconciler/PostReconciler.java
similarity index 99%
rename from application/src/main/java/run/halo/app/core/extension/reconciler/PostReconciler.java
rename to application/src/main/java/run/halo/app/core/reconciler/PostReconciler.java
index 29d546944f..5018b89aa7 100644
--- a/application/src/main/java/run/halo/app/core/extension/reconciler/PostReconciler.java
+++ b/application/src/main/java/run/halo/app/core/reconciler/PostReconciler.java
@@ -1,4 +1,4 @@
-package run.halo.app.core.extension.reconciler;
+package run.halo.app.core.reconciler;
 
 import static java.nio.charset.StandardCharsets.UTF_8;
 import static org.apache.commons.lang3.BooleanUtils.TRUE;
diff --git a/application/src/main/java/run/halo/app/core/extension/reconciler/ReplyReconciler.java b/application/src/main/java/run/halo/app/core/reconciler/ReplyReconciler.java
similarity index 98%
rename from application/src/main/java/run/halo/app/core/extension/reconciler/ReplyReconciler.java
rename to application/src/main/java/run/halo/app/core/reconciler/ReplyReconciler.java
index 3dc0b89c91..9a3886dc96 100644
--- a/application/src/main/java/run/halo/app/core/extension/reconciler/ReplyReconciler.java
+++ b/application/src/main/java/run/halo/app/core/reconciler/ReplyReconciler.java
@@ -1,4 +1,4 @@
-package run.halo.app.core.extension.reconciler;
+package run.halo.app.core.reconciler;
 
 import static org.apache.commons.lang3.ObjectUtils.defaultIfNull;
 import static run.halo.app.extension.ExtensionUtil.addFinalizers;
diff --git a/application/src/main/java/run/halo/app/core/extension/reconciler/ReverseProxyReconciler.java b/application/src/main/java/run/halo/app/core/reconciler/ReverseProxyReconciler.java
similarity index 98%
rename from application/src/main/java/run/halo/app/core/extension/reconciler/ReverseProxyReconciler.java
rename to application/src/main/java/run/halo/app/core/reconciler/ReverseProxyReconciler.java
index e0a34ca771..7c2620baad 100644
--- a/application/src/main/java/run/halo/app/core/extension/reconciler/ReverseProxyReconciler.java
+++ b/application/src/main/java/run/halo/app/core/reconciler/ReverseProxyReconciler.java
@@ -1,4 +1,4 @@
-package run.halo.app.core.extension.reconciler;
+package run.halo.app.core.reconciler;
 
 import java.util.HashSet;
 import java.util.Map;
diff --git a/application/src/main/java/run/halo/app/core/extension/reconciler/RoleReconciler.java b/application/src/main/java/run/halo/app/core/reconciler/RoleReconciler.java
similarity index 97%
rename from application/src/main/java/run/halo/app/core/extension/reconciler/RoleReconciler.java
rename to application/src/main/java/run/halo/app/core/reconciler/RoleReconciler.java
index e3d631139e..2473004642 100644
--- a/application/src/main/java/run/halo/app/core/extension/reconciler/RoleReconciler.java
+++ b/application/src/main/java/run/halo/app/core/reconciler/RoleReconciler.java
@@ -1,4 +1,4 @@
-package run.halo.app.core.extension.reconciler;
+package run.halo.app.core.reconciler;
 
 import static java.util.Objects.deepEquals;
 
diff --git a/application/src/main/java/run/halo/app/core/extension/reconciler/SinglePageReconciler.java b/application/src/main/java/run/halo/app/core/reconciler/SinglePageReconciler.java
similarity index 99%
rename from application/src/main/java/run/halo/app/core/extension/reconciler/SinglePageReconciler.java
rename to application/src/main/java/run/halo/app/core/reconciler/SinglePageReconciler.java
index b803b6df5b..d35a3cef65 100644
--- a/application/src/main/java/run/halo/app/core/extension/reconciler/SinglePageReconciler.java
+++ b/application/src/main/java/run/halo/app/core/reconciler/SinglePageReconciler.java
@@ -1,4 +1,4 @@
-package run.halo.app.core.extension.reconciler;
+package run.halo.app.core.reconciler;
 
 import static java.nio.charset.StandardCharsets.UTF_8;
 import static org.springframework.web.util.UriUtils.encodePath;
diff --git a/application/src/main/java/run/halo/app/core/extension/reconciler/SystemSettingReconciler.java b/application/src/main/java/run/halo/app/core/reconciler/SystemSettingReconciler.java
similarity index 99%
rename from application/src/main/java/run/halo/app/core/extension/reconciler/SystemSettingReconciler.java
rename to application/src/main/java/run/halo/app/core/reconciler/SystemSettingReconciler.java
index f3f7638fd5..ea920d839a 100644
--- a/application/src/main/java/run/halo/app/core/extension/reconciler/SystemSettingReconciler.java
+++ b/application/src/main/java/run/halo/app/core/reconciler/SystemSettingReconciler.java
@@ -1,4 +1,4 @@
-package run.halo.app.core.extension.reconciler;
+package run.halo.app.core.reconciler;
 
 import java.util.HashMap;
 import java.util.HashSet;
diff --git a/application/src/main/java/run/halo/app/core/extension/reconciler/TagReconciler.java b/application/src/main/java/run/halo/app/core/reconciler/TagReconciler.java
similarity index 98%
rename from application/src/main/java/run/halo/app/core/extension/reconciler/TagReconciler.java
rename to application/src/main/java/run/halo/app/core/reconciler/TagReconciler.java
index 1318e6c28d..4660597909 100644
--- a/application/src/main/java/run/halo/app/core/extension/reconciler/TagReconciler.java
+++ b/application/src/main/java/run/halo/app/core/reconciler/TagReconciler.java
@@ -1,4 +1,4 @@
-package run.halo.app.core.extension.reconciler;
+package run.halo.app.core.reconciler;
 
 import static run.halo.app.extension.ExtensionUtil.addFinalizers;
 import static run.halo.app.extension.ExtensionUtil.removeFinalizers;
diff --git a/application/src/main/java/run/halo/app/core/extension/reconciler/ThemeReconciler.java b/application/src/main/java/run/halo/app/core/reconciler/ThemeReconciler.java
similarity index 98%
rename from application/src/main/java/run/halo/app/core/extension/reconciler/ThemeReconciler.java
rename to application/src/main/java/run/halo/app/core/reconciler/ThemeReconciler.java
index 0899e0a5e6..e0e086b9c8 100644
--- a/application/src/main/java/run/halo/app/core/extension/reconciler/ThemeReconciler.java
+++ b/application/src/main/java/run/halo/app/core/reconciler/ThemeReconciler.java
@@ -1,4 +1,4 @@
-package run.halo.app.core.extension.reconciler;
+package run.halo.app.core.reconciler;
 
 import static org.apache.commons.lang3.ObjectUtils.defaultIfNull;
 
@@ -17,7 +17,6 @@
 import run.halo.app.core.extension.AnnotationSetting;
 import run.halo.app.core.extension.Setting;
 import run.halo.app.core.extension.Theme;
-import run.halo.app.core.extension.theme.SettingUtils;
 import run.halo.app.extension.ExtensionClient;
 import run.halo.app.extension.MetadataUtil;
 import run.halo.app.extension.controller.Controller;
@@ -30,6 +29,7 @@
 import run.halo.app.infra.ThemeRootGetter;
 import run.halo.app.infra.exception.ThemeUninstallException;
 import run.halo.app.infra.utils.JsonUtils;
+import run.halo.app.infra.utils.SettingUtils;
 import run.halo.app.infra.utils.VersionUtils;
 
 /**
diff --git a/application/src/main/java/run/halo/app/core/extension/reconciler/UserReconciler.java b/application/src/main/java/run/halo/app/core/reconciler/UserReconciler.java
similarity index 97%
rename from application/src/main/java/run/halo/app/core/extension/reconciler/UserReconciler.java
rename to application/src/main/java/run/halo/app/core/reconciler/UserReconciler.java
index c74d087b16..397b89afd3 100644
--- a/application/src/main/java/run/halo/app/core/extension/reconciler/UserReconciler.java
+++ b/application/src/main/java/run/halo/app/core/reconciler/UserReconciler.java
@@ -1,4 +1,4 @@
-package run.halo.app.core.extension.reconciler;
+package run.halo.app.core.reconciler;
 
 import static run.halo.app.extension.ExtensionUtil.addFinalizers;
 import static run.halo.app.extension.ExtensionUtil.defaultSort;
@@ -23,8 +23,8 @@
 import run.halo.app.core.extension.UserConnection;
 import run.halo.app.core.extension.attachment.Attachment;
 import run.halo.app.core.extension.service.AttachmentService;
-import run.halo.app.core.extension.service.RoleService;
-import run.halo.app.core.extension.service.UserService;
+import run.halo.app.core.user.service.RoleService;
+import run.halo.app.core.user.service.UserService;
 import run.halo.app.extension.ExtensionClient;
 import run.halo.app.extension.ListOptions;
 import run.halo.app.extension.controller.Controller;
diff --git a/application/src/main/java/run/halo/app/core/extension/service/DefaultRoleService.java b/application/src/main/java/run/halo/app/core/user/service/DefaultRoleService.java
similarity index 99%
rename from application/src/main/java/run/halo/app/core/extension/service/DefaultRoleService.java
rename to application/src/main/java/run/halo/app/core/user/service/DefaultRoleService.java
index b029541130..0ac6672d34 100644
--- a/application/src/main/java/run/halo/app/core/extension/service/DefaultRoleService.java
+++ b/application/src/main/java/run/halo/app/core/user/service/DefaultRoleService.java
@@ -1,4 +1,4 @@
-package run.halo.app.core.extension.service;
+package run.halo.app.core.user.service;
 
 import static run.halo.app.extension.ExtensionUtil.defaultSort;
 import static run.halo.app.extension.ExtensionUtil.notDeleting;
diff --git a/application/src/main/java/run/halo/app/core/extension/service/EmailPasswordRecoveryService.java b/application/src/main/java/run/halo/app/core/user/service/EmailPasswordRecoveryService.java
similarity index 96%
rename from application/src/main/java/run/halo/app/core/extension/service/EmailPasswordRecoveryService.java
rename to application/src/main/java/run/halo/app/core/user/service/EmailPasswordRecoveryService.java
index 3e1a97723a..a586589f05 100644
--- a/application/src/main/java/run/halo/app/core/extension/service/EmailPasswordRecoveryService.java
+++ b/application/src/main/java/run/halo/app/core/user/service/EmailPasswordRecoveryService.java
@@ -1,4 +1,4 @@
-package run.halo.app.core.extension.service;
+package run.halo.app.core.user.service;
 
 import reactor.core.publisher.Mono;
 import run.halo.app.infra.exception.AccessDeniedException;
diff --git a/application/src/main/java/run/halo/app/core/extension/service/EmailVerificationService.java b/application/src/main/java/run/halo/app/core/user/service/EmailVerificationService.java
similarity index 96%
rename from application/src/main/java/run/halo/app/core/extension/service/EmailVerificationService.java
rename to application/src/main/java/run/halo/app/core/user/service/EmailVerificationService.java
index 762f92afe1..f2c2336884 100644
--- a/application/src/main/java/run/halo/app/core/extension/service/EmailVerificationService.java
+++ b/application/src/main/java/run/halo/app/core/user/service/EmailVerificationService.java
@@ -1,4 +1,4 @@
-package run.halo.app.core.extension.service;
+package run.halo.app.core.user.service;
 
 import reactor.core.publisher.Mono;
 import run.halo.app.infra.exception.EmailVerificationFailed;
diff --git a/application/src/main/java/run/halo/app/core/extension/service/RoleService.java b/application/src/main/java/run/halo/app/core/user/service/RoleService.java
similarity index 96%
rename from application/src/main/java/run/halo/app/core/extension/service/RoleService.java
rename to application/src/main/java/run/halo/app/core/user/service/RoleService.java
index d22beff912..b6d108047b 100644
--- a/application/src/main/java/run/halo/app/core/extension/service/RoleService.java
+++ b/application/src/main/java/run/halo/app/core/user/service/RoleService.java
@@ -1,4 +1,4 @@
-package run.halo.app.core.extension.service;
+package run.halo.app.core.user.service;
 
 import java.util.Collection;
 import java.util.Map;
diff --git a/application/src/main/java/run/halo/app/core/extension/service/UserService.java b/application/src/main/java/run/halo/app/core/user/service/UserService.java
similarity index 94%
rename from application/src/main/java/run/halo/app/core/extension/service/UserService.java
rename to application/src/main/java/run/halo/app/core/user/service/UserService.java
index f252d15360..5a2b8135a7 100644
--- a/application/src/main/java/run/halo/app/core/extension/service/UserService.java
+++ b/application/src/main/java/run/halo/app/core/user/service/UserService.java
@@ -1,4 +1,4 @@
-package run.halo.app.core.extension.service;
+package run.halo.app.core.user.service;
 
 import java.util.Set;
 import reactor.core.publisher.Flux;
diff --git a/application/src/main/java/run/halo/app/core/extension/service/UserServiceImpl.java b/application/src/main/java/run/halo/app/core/user/service/UserServiceImpl.java
similarity index 99%
rename from application/src/main/java/run/halo/app/core/extension/service/UserServiceImpl.java
rename to application/src/main/java/run/halo/app/core/user/service/UserServiceImpl.java
index 5d9f85fcd0..9290b3ec48 100644
--- a/application/src/main/java/run/halo/app/core/extension/service/UserServiceImpl.java
+++ b/application/src/main/java/run/halo/app/core/user/service/UserServiceImpl.java
@@ -1,4 +1,4 @@
-package run.halo.app.core.extension.service;
+package run.halo.app.core.user.service;
 
 import static org.springframework.data.domain.Sort.Order.asc;
 import static org.springframework.data.domain.Sort.Order.desc;
diff --git a/application/src/main/java/run/halo/app/core/extension/service/impl/DefaultAttachmentService.java b/application/src/main/java/run/halo/app/core/user/service/impl/DefaultAttachmentService.java
similarity index 99%
rename from application/src/main/java/run/halo/app/core/extension/service/impl/DefaultAttachmentService.java
rename to application/src/main/java/run/halo/app/core/user/service/impl/DefaultAttachmentService.java
index 50486eb2cb..525ed17e75 100644
--- a/application/src/main/java/run/halo/app/core/extension/service/impl/DefaultAttachmentService.java
+++ b/application/src/main/java/run/halo/app/core/user/service/impl/DefaultAttachmentService.java
@@ -1,4 +1,4 @@
-package run.halo.app.core.extension.service.impl;
+package run.halo.app.core.user.service.impl;
 
 import java.net.URI;
 import java.net.URL;
diff --git a/application/src/main/java/run/halo/app/core/extension/service/impl/EmailPasswordRecoveryServiceImpl.java b/application/src/main/java/run/halo/app/core/user/service/impl/EmailPasswordRecoveryServiceImpl.java
similarity index 97%
rename from application/src/main/java/run/halo/app/core/extension/service/impl/EmailPasswordRecoveryServiceImpl.java
rename to application/src/main/java/run/halo/app/core/user/service/impl/EmailPasswordRecoveryServiceImpl.java
index 4fbe8c859e..ac66225ee6 100644
--- a/application/src/main/java/run/halo/app/core/extension/service/impl/EmailPasswordRecoveryServiceImpl.java
+++ b/application/src/main/java/run/halo/app/core/user/service/impl/EmailPasswordRecoveryServiceImpl.java
@@ -1,4 +1,4 @@
-package run.halo.app.core.extension.service.impl;
+package run.halo.app.core.user.service.impl;
 
 import com.google.common.cache.Cache;
 import com.google.common.cache.CacheBuilder;
@@ -18,8 +18,8 @@
 import run.halo.app.core.extension.User;
 import run.halo.app.core.extension.notification.Reason;
 import run.halo.app.core.extension.notification.Subscription;
-import run.halo.app.core.extension.service.EmailPasswordRecoveryService;
-import run.halo.app.core.extension.service.UserService;
+import run.halo.app.core.user.service.EmailPasswordRecoveryService;
+import run.halo.app.core.user.service.UserService;
 import run.halo.app.extension.GroupVersion;
 import run.halo.app.extension.ReactiveExtensionClient;
 import run.halo.app.infra.ExternalLinkProcessor;
diff --git a/application/src/main/java/run/halo/app/core/extension/service/impl/EmailVerificationServiceImpl.java b/application/src/main/java/run/halo/app/core/user/service/impl/EmailVerificationServiceImpl.java
similarity index 98%
rename from application/src/main/java/run/halo/app/core/extension/service/impl/EmailVerificationServiceImpl.java
rename to application/src/main/java/run/halo/app/core/user/service/impl/EmailVerificationServiceImpl.java
index 857b4647cc..b362a96c81 100644
--- a/application/src/main/java/run/halo/app/core/extension/service/impl/EmailVerificationServiceImpl.java
+++ b/application/src/main/java/run/halo/app/core/user/service/impl/EmailVerificationServiceImpl.java
@@ -1,4 +1,4 @@
-package run.halo.app.core.extension.service.impl;
+package run.halo.app.core.user.service.impl;
 
 import com.google.common.cache.Cache;
 import com.google.common.cache.CacheBuilder;
@@ -19,8 +19,8 @@
 import run.halo.app.core.extension.User;
 import run.halo.app.core.extension.notification.Reason;
 import run.halo.app.core.extension.notification.Subscription;
-import run.halo.app.core.extension.service.EmailVerificationService;
-import run.halo.app.core.extension.service.UserService;
+import run.halo.app.core.user.service.EmailVerificationService;
+import run.halo.app.core.user.service.UserService;
 import run.halo.app.extension.GroupVersion;
 import run.halo.app.extension.MetadataUtil;
 import run.halo.app.extension.ReactiveExtensionClient;
diff --git a/application/src/main/java/run/halo/app/infra/DefaultThemeInitializer.java b/application/src/main/java/run/halo/app/infra/DefaultThemeInitializer.java
index b186923665..31af2d0a05 100644
--- a/application/src/main/java/run/halo/app/infra/DefaultThemeInitializer.java
+++ b/application/src/main/java/run/halo/app/infra/DefaultThemeInitializer.java
@@ -10,10 +10,10 @@
 import org.springframework.stereotype.Component;
 import org.springframework.util.ResourceUtils;
 import org.springframework.util.StreamUtils;
-import run.halo.app.core.extension.theme.ThemeService;
 import run.halo.app.infra.properties.HaloProperties;
 import run.halo.app.infra.properties.ThemeProperties;
 import run.halo.app.infra.utils.FileUtils;
+import run.halo.app.theme.service.ThemeService;
 
 @Slf4j
 @Component
@@ -44,7 +44,7 @@ public void onApplicationEvent(ApplicationStartedEvent event) {
             // TODO Checking if any themes are installed here in the future might be better?
             if (!FileUtils.isEmpty(themeRoot)) {
                 log.debug("Skipped initializing default theme because there are themes "
-                          + "inside theme root");
+                    + "inside theme root");
                 return;
             }
             log.info("Initializing default theme from {}", location);
diff --git a/application/src/main/java/run/halo/app/infra/SchemeInitializer.java b/application/src/main/java/run/halo/app/infra/SchemeInitializer.java
index fbc933e213..036fc1bc34 100644
--- a/application/src/main/java/run/halo/app/infra/SchemeInitializer.java
+++ b/application/src/main/java/run/halo/app/infra/SchemeInitializer.java
@@ -20,6 +20,8 @@
 import org.springframework.lang.NonNull;
 import org.springframework.stereotype.Component;
 import run.halo.app.content.Stats;
+import run.halo.app.core.attachment.extension.LocalThumbnail;
+import run.halo.app.core.attachment.extension.Thumbnail;
 import run.halo.app.core.extension.AnnotationSetting;
 import run.halo.app.core.extension.AuthProvider;
 import run.halo.app.core.extension.Counter;
@@ -38,10 +40,8 @@
 import run.halo.app.core.extension.UserConnection.UserConnectionSpec;
 import run.halo.app.core.extension.attachment.Attachment;
 import run.halo.app.core.extension.attachment.Group;
-import run.halo.app.core.extension.attachment.LocalThumbnail;
 import run.halo.app.core.extension.attachment.Policy;
 import run.halo.app.core.extension.attachment.PolicyTemplate;
-import run.halo.app.core.extension.attachment.Thumbnail;
 import run.halo.app.core.extension.content.Category;
 import run.halo.app.core.extension.content.Comment;
 import run.halo.app.core.extension.content.Post;
diff --git a/application/src/main/java/run/halo/app/actuator/DatabaseInfoContributor.java b/application/src/main/java/run/halo/app/infra/actuator/DatabaseInfoContributor.java
similarity index 97%
rename from application/src/main/java/run/halo/app/actuator/DatabaseInfoContributor.java
rename to application/src/main/java/run/halo/app/infra/actuator/DatabaseInfoContributor.java
index e0aa0b5cd1..66d88d783f 100644
--- a/application/src/main/java/run/halo/app/actuator/DatabaseInfoContributor.java
+++ b/application/src/main/java/run/halo/app/infra/actuator/DatabaseInfoContributor.java
@@ -1,4 +1,4 @@
-package run.halo.app.actuator;
+package run.halo.app.infra.actuator;
 
 import io.r2dbc.spi.Connection;
 import io.r2dbc.spi.ConnectionFactory;
diff --git a/application/src/main/java/run/halo/app/actuator/GlobalInfoEndpoint.java b/application/src/main/java/run/halo/app/infra/actuator/GlobalInfoEndpoint.java
similarity index 99%
rename from application/src/main/java/run/halo/app/actuator/GlobalInfoEndpoint.java
rename to application/src/main/java/run/halo/app/infra/actuator/GlobalInfoEndpoint.java
index 36ede07f18..9d53a2d525 100644
--- a/application/src/main/java/run/halo/app/actuator/GlobalInfoEndpoint.java
+++ b/application/src/main/java/run/halo/app/infra/actuator/GlobalInfoEndpoint.java
@@ -1,4 +1,4 @@
-package run.halo.app.actuator;
+package run.halo.app.infra.actuator;
 
 import static org.apache.commons.lang3.BooleanUtils.isTrue;
 
diff --git a/application/src/main/java/run/halo/app/actuator/RestartEndpoint.java b/application/src/main/java/run/halo/app/infra/actuator/RestartEndpoint.java
similarity index 98%
rename from application/src/main/java/run/halo/app/actuator/RestartEndpoint.java
rename to application/src/main/java/run/halo/app/infra/actuator/RestartEndpoint.java
index 02289ee342..2155850d33 100644
--- a/application/src/main/java/run/halo/app/actuator/RestartEndpoint.java
+++ b/application/src/main/java/run/halo/app/infra/actuator/RestartEndpoint.java
@@ -1,4 +1,4 @@
-package run.halo.app.actuator;
+package run.halo.app.infra.actuator;
 
 import java.io.Closeable;
 import java.io.IOException;
diff --git a/application/src/main/java/run/halo/app/config/ExtensionConfiguration.java b/application/src/main/java/run/halo/app/infra/config/ExtensionConfiguration.java
similarity index 97%
rename from application/src/main/java/run/halo/app/config/ExtensionConfiguration.java
rename to application/src/main/java/run/halo/app/infra/config/ExtensionConfiguration.java
index b9133cd9c0..cb4d8d4e11 100644
--- a/application/src/main/java/run/halo/app/config/ExtensionConfiguration.java
+++ b/application/src/main/java/run/halo/app/infra/config/ExtensionConfiguration.java
@@ -1,4 +1,4 @@
-package run.halo.app.config;
+package run.halo.app.infra.config;
 
 import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
 import org.springframework.context.annotation.Bean;
diff --git a/application/src/main/java/run/halo/app/config/HaloConfiguration.java b/application/src/main/java/run/halo/app/infra/config/HaloConfiguration.java
similarity index 97%
rename from application/src/main/java/run/halo/app/config/HaloConfiguration.java
rename to application/src/main/java/run/halo/app/infra/config/HaloConfiguration.java
index b3fa4a0822..37c98a8d52 100644
--- a/application/src/main/java/run/halo/app/config/HaloConfiguration.java
+++ b/application/src/main/java/run/halo/app/infra/config/HaloConfiguration.java
@@ -1,4 +1,4 @@
-package run.halo.app.config;
+package run.halo.app.infra.config;
 
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.databind.MapperFeature;
diff --git a/application/src/main/java/run/halo/app/config/SwaggerConfig.java b/application/src/main/java/run/halo/app/infra/config/SwaggerConfig.java
similarity index 99%
rename from application/src/main/java/run/halo/app/config/SwaggerConfig.java
rename to application/src/main/java/run/halo/app/infra/config/SwaggerConfig.java
index 5cd98b346d..00337a47c6 100644
--- a/application/src/main/java/run/halo/app/config/SwaggerConfig.java
+++ b/application/src/main/java/run/halo/app/infra/config/SwaggerConfig.java
@@ -1,4 +1,4 @@
-package run.halo.app.config;
+package run.halo.app.infra.config;
 
 import static org.springdoc.core.utils.Constants.SPRINGDOC_ENABLED;
 
diff --git a/application/src/main/java/run/halo/app/config/WebFluxConfig.java b/application/src/main/java/run/halo/app/infra/config/WebFluxConfig.java
similarity index 97%
rename from application/src/main/java/run/halo/app/config/WebFluxConfig.java
rename to application/src/main/java/run/halo/app/infra/config/WebFluxConfig.java
index 22a8b50e15..49109f079b 100644
--- a/application/src/main/java/run/halo/app/config/WebFluxConfig.java
+++ b/application/src/main/java/run/halo/app/infra/config/WebFluxConfig.java
@@ -1,4 +1,4 @@
-package run.halo.app.config;
+package run.halo.app.infra.config;
 
 import static org.springframework.util.ResourceUtils.FILE_URL_PREFIX;
 import static org.springframework.web.reactive.function.server.RequestPredicates.accept;
@@ -38,16 +38,16 @@
 import org.springframework.web.reactive.result.view.ViewResolutionResultHandler;
 import org.springframework.web.reactive.result.view.ViewResolver;
 import reactor.core.publisher.Mono;
-import run.halo.app.console.ProxyFilter;
-import run.halo.app.console.WebSocketRequestPredicate;
 import run.halo.app.core.endpoint.WebSocketHandlerMapping;
+import run.halo.app.core.endpoint.console.CustomEndpointsBuilder;
 import run.halo.app.core.extension.endpoint.CustomEndpoint;
-import run.halo.app.core.extension.endpoint.CustomEndpointsBuilder;
 import run.halo.app.infra.SecureRequestMappingHandlerAdapter;
+import run.halo.app.infra.console.ProxyFilter;
+import run.halo.app.infra.console.WebSocketRequestPredicate;
 import run.halo.app.infra.properties.AttachmentProperties;
 import run.halo.app.infra.properties.HaloProperties;
+import run.halo.app.infra.webfilter.AdditionalWebFilterChainProxy;
 import run.halo.app.plugin.extensionpoint.ExtensionGetter;
-import run.halo.app.webfilter.AdditionalWebFilterChainProxy;
 
 @Configuration
 public class WebFluxConfig implements WebFluxConfigurer {
diff --git a/application/src/main/java/run/halo/app/config/WebServerSecurityConfig.java b/application/src/main/java/run/halo/app/infra/config/WebServerSecurityConfig.java
similarity index 97%
rename from application/src/main/java/run/halo/app/config/WebServerSecurityConfig.java
rename to application/src/main/java/run/halo/app/infra/config/WebServerSecurityConfig.java
index 06c191707d..79f3c014e8 100644
--- a/application/src/main/java/run/halo/app/config/WebServerSecurityConfig.java
+++ b/application/src/main/java/run/halo/app/infra/config/WebServerSecurityConfig.java
@@ -1,4 +1,4 @@
-package run.halo.app.config;
+package run.halo.app.infra.config;
 
 import static org.springframework.security.config.Customizer.withDefaults;
 import static org.springframework.security.web.server.authentication.ServerWebExchangeDelegatingReactiveAuthenticationManagerResolver.builder;
@@ -22,8 +22,8 @@
 import org.springframework.session.config.annotation.web.server.EnableSpringWebSession;
 import org.springframework.web.reactive.function.server.RouterFunction;
 import org.springframework.web.reactive.function.server.ServerResponse;
-import run.halo.app.core.extension.service.RoleService;
-import run.halo.app.core.extension.service.UserService;
+import run.halo.app.core.user.service.RoleService;
+import run.halo.app.core.user.service.UserService;
 import run.halo.app.extension.ReactiveExtensionClient;
 import run.halo.app.infra.AnonymousUserConst;
 import run.halo.app.infra.properties.HaloProperties;
diff --git a/application/src/main/java/run/halo/app/console/ProxyFilter.java b/application/src/main/java/run/halo/app/infra/console/ProxyFilter.java
similarity index 98%
rename from application/src/main/java/run/halo/app/console/ProxyFilter.java
rename to application/src/main/java/run/halo/app/infra/console/ProxyFilter.java
index 854d810ab1..707be01b10 100644
--- a/application/src/main/java/run/halo/app/console/ProxyFilter.java
+++ b/application/src/main/java/run/halo/app/infra/console/ProxyFilter.java
@@ -1,4 +1,4 @@
-package run.halo.app.console;
+package run.halo.app.infra.console;
 
 import lombok.extern.slf4j.Slf4j;
 import org.springframework.core.io.buffer.DataBuffer;
diff --git a/application/src/main/java/run/halo/app/console/WebSocketRequestPredicate.java b/application/src/main/java/run/halo/app/infra/console/WebSocketRequestPredicate.java
similarity index 78%
rename from application/src/main/java/run/halo/app/console/WebSocketRequestPredicate.java
rename to application/src/main/java/run/halo/app/infra/console/WebSocketRequestPredicate.java
index 647f98ecba..8d3914e02a 100644
--- a/application/src/main/java/run/halo/app/console/WebSocketRequestPredicate.java
+++ b/application/src/main/java/run/halo/app/infra/console/WebSocketRequestPredicate.java
@@ -1,6 +1,6 @@
-package run.halo.app.console;
+package run.halo.app.infra.console;
 
-import static run.halo.app.console.WebSocketUtils.isWebSocketUpgrade;
+import static run.halo.app.infra.console.WebSocketUtils.isWebSocketUpgrade;
 
 import org.springframework.web.reactive.function.server.RequestPredicate;
 import org.springframework.web.reactive.function.server.ServerRequest;
diff --git a/application/src/main/java/run/halo/app/console/WebSocketServerWebExchangeMatcher.java b/application/src/main/java/run/halo/app/infra/console/WebSocketServerWebExchangeMatcher.java
similarity index 85%
rename from application/src/main/java/run/halo/app/console/WebSocketServerWebExchangeMatcher.java
rename to application/src/main/java/run/halo/app/infra/console/WebSocketServerWebExchangeMatcher.java
index 17bdbde51c..e9e9bd04ed 100644
--- a/application/src/main/java/run/halo/app/console/WebSocketServerWebExchangeMatcher.java
+++ b/application/src/main/java/run/halo/app/infra/console/WebSocketServerWebExchangeMatcher.java
@@ -1,8 +1,8 @@
-package run.halo.app.console;
+package run.halo.app.infra.console;
 
 import static org.springframework.security.web.server.util.matcher.ServerWebExchangeMatcher.MatchResult.match;
 import static org.springframework.security.web.server.util.matcher.ServerWebExchangeMatcher.MatchResult.notMatch;
-import static run.halo.app.console.WebSocketUtils.isWebSocketUpgrade;
+import static run.halo.app.infra.console.WebSocketUtils.isWebSocketUpgrade;
 
 import org.springframework.security.web.server.util.matcher.ServerWebExchangeMatcher;
 import org.springframework.web.server.ServerWebExchange;
diff --git a/application/src/main/java/run/halo/app/console/WebSocketUtils.java b/application/src/main/java/run/halo/app/infra/console/WebSocketUtils.java
similarity index 94%
rename from application/src/main/java/run/halo/app/console/WebSocketUtils.java
rename to application/src/main/java/run/halo/app/infra/console/WebSocketUtils.java
index 29ba096aeb..afec871646 100644
--- a/application/src/main/java/run/halo/app/console/WebSocketUtils.java
+++ b/application/src/main/java/run/halo/app/infra/console/WebSocketUtils.java
@@ -1,4 +1,4 @@
-package run.halo.app.console;
+package run.halo.app.infra.console;
 
 import java.util.Objects;
 import org.springframework.http.HttpHeaders;
diff --git a/application/src/main/java/run/halo/app/core/extension/theme/SettingUtils.java b/application/src/main/java/run/halo/app/infra/utils/SettingUtils.java
similarity index 97%
rename from application/src/main/java/run/halo/app/core/extension/theme/SettingUtils.java
rename to application/src/main/java/run/halo/app/infra/utils/SettingUtils.java
index 0a3b33bdfb..0cd30461cc 100644
--- a/application/src/main/java/run/halo/app/core/extension/theme/SettingUtils.java
+++ b/application/src/main/java/run/halo/app/infra/utils/SettingUtils.java
@@ -1,4 +1,4 @@
-package run.halo.app.core.extension.theme;
+package run.halo.app.infra.utils;
 
 import static org.apache.commons.lang3.ObjectUtils.defaultIfNull;
 
@@ -21,8 +21,6 @@
 import run.halo.app.extension.ConfigMap;
 import run.halo.app.extension.ExtensionClient;
 import run.halo.app.extension.Metadata;
-import run.halo.app.infra.utils.JsonParseException;
-import run.halo.app.infra.utils.JsonUtils;
 
 @UtilityClass
 public class SettingUtils {
diff --git a/application/src/main/java/run/halo/app/webfilter/AdditionalWebFilterChainProxy.java b/application/src/main/java/run/halo/app/infra/webfilter/AdditionalWebFilterChainProxy.java
similarity index 97%
rename from application/src/main/java/run/halo/app/webfilter/AdditionalWebFilterChainProxy.java
rename to application/src/main/java/run/halo/app/infra/webfilter/AdditionalWebFilterChainProxy.java
index 7a8ce77ead..57fea8dcae 100644
--- a/application/src/main/java/run/halo/app/webfilter/AdditionalWebFilterChainProxy.java
+++ b/application/src/main/java/run/halo/app/infra/webfilter/AdditionalWebFilterChainProxy.java
@@ -1,4 +1,4 @@
-package run.halo.app.webfilter;
+package run.halo.app.infra.webfilter;
 
 import lombok.Setter;
 import org.springframework.core.annotation.AnnotationAwareOrderComparator;
diff --git a/application/src/main/java/run/halo/app/webfilter/LocaleChangeWebFilter.java b/application/src/main/java/run/halo/app/infra/webfilter/LocaleChangeWebFilter.java
similarity index 98%
rename from application/src/main/java/run/halo/app/webfilter/LocaleChangeWebFilter.java
rename to application/src/main/java/run/halo/app/infra/webfilter/LocaleChangeWebFilter.java
index 3329d34f3f..1da379c13e 100644
--- a/application/src/main/java/run/halo/app/webfilter/LocaleChangeWebFilter.java
+++ b/application/src/main/java/run/halo/app/infra/webfilter/LocaleChangeWebFilter.java
@@ -1,4 +1,4 @@
-package run.halo.app.webfilter;
+package run.halo.app.infra.webfilter;
 
 import static run.halo.app.theme.ThemeLocaleContextResolver.LANGUAGE_COOKIE_NAME;
 import static run.halo.app.theme.ThemeLocaleContextResolver.LANGUAGE_PARAMETER_NAME;
diff --git a/application/src/main/java/run/halo/app/plugin/AggregatedRouterFunction.java b/application/src/main/java/run/halo/app/plugin/AggregatedRouterFunction.java
index 6dbbbd4848..7c09cdd4a4 100644
--- a/application/src/main/java/run/halo/app/plugin/AggregatedRouterFunction.java
+++ b/application/src/main/java/run/halo/app/plugin/AggregatedRouterFunction.java
@@ -7,8 +7,8 @@
 import org.springframework.web.reactive.function.server.ServerRequest;
 import org.springframework.web.reactive.function.server.ServerResponse;
 import reactor.core.publisher.Mono;
+import run.halo.app.core.endpoint.console.CustomEndpointsBuilder;
 import run.halo.app.core.extension.endpoint.CustomEndpoint;
-import run.halo.app.core.extension.endpoint.CustomEndpointsBuilder;
 import run.halo.app.infra.SecureServerRequest;
 
 /**
diff --git a/application/src/main/java/run/halo/app/core/extension/service/PluginService.java b/application/src/main/java/run/halo/app/plugin/PluginService.java
similarity index 98%
rename from application/src/main/java/run/halo/app/core/extension/service/PluginService.java
rename to application/src/main/java/run/halo/app/plugin/PluginService.java
index 7c86444899..193318cd68 100644
--- a/application/src/main/java/run/halo/app/core/extension/service/PluginService.java
+++ b/application/src/main/java/run/halo/app/plugin/PluginService.java
@@ -1,4 +1,4 @@
-package run.halo.app.core.extension.service;
+package run.halo.app.plugin;
 
 import java.nio.file.Path;
 import org.springframework.core.io.Resource;
diff --git a/application/src/main/java/run/halo/app/core/extension/service/impl/PluginServiceImpl.java b/application/src/main/java/run/halo/app/plugin/PluginServiceImpl.java
similarity index 98%
rename from application/src/main/java/run/halo/app/core/extension/service/impl/PluginServiceImpl.java
rename to application/src/main/java/run/halo/app/plugin/PluginServiceImpl.java
index 266f0df396..25383e89d4 100644
--- a/application/src/main/java/run/halo/app/core/extension/service/impl/PluginServiceImpl.java
+++ b/application/src/main/java/run/halo/app/plugin/PluginServiceImpl.java
@@ -1,4 +1,4 @@
-package run.halo.app.core.extension.service.impl;
+package run.halo.app.plugin;
 
 import static java.nio.file.StandardCopyOption.REPLACE_EXISTING;
 import static java.nio.file.StandardOpenOption.CREATE;
@@ -49,7 +49,6 @@
 import reactor.core.scheduler.Schedulers;
 import reactor.util.retry.Retry;
 import run.halo.app.core.extension.Plugin;
-import run.halo.app.core.extension.service.PluginService;
 import run.halo.app.extension.ReactiveExtensionClient;
 import run.halo.app.infra.SystemVersionSupplier;
 import run.halo.app.infra.exception.PluginAlreadyExistsException;
@@ -60,12 +59,6 @@
 import run.halo.app.infra.exception.UnsatisfiedAttributeValueException;
 import run.halo.app.infra.utils.FileUtils;
 import run.halo.app.infra.utils.VersionUtils;
-import run.halo.app.plugin.PluginConst;
-import run.halo.app.plugin.PluginUtils;
-import run.halo.app.plugin.PluginsRootGetter;
-import run.halo.app.plugin.SpringPluginManager;
-import run.halo.app.plugin.YamlPluginDescriptorFinder;
-import run.halo.app.plugin.YamlPluginFinder;
 import run.halo.app.plugin.resources.BundleResourceUtils;
 
 @Slf4j
diff --git a/application/src/main/java/run/halo/app/security/DefaultUserDetailService.java b/application/src/main/java/run/halo/app/security/DefaultUserDetailService.java
index b1bf1e5648..8bea434bec 100644
--- a/application/src/main/java/run/halo/app/security/DefaultUserDetailService.java
+++ b/application/src/main/java/run/halo/app/security/DefaultUserDetailService.java
@@ -13,8 +13,8 @@
 import org.springframework.security.core.userdetails.User;
 import org.springframework.security.core.userdetails.UserDetails;
 import reactor.core.publisher.Mono;
-import run.halo.app.core.extension.service.RoleService;
-import run.halo.app.core.extension.service.UserService;
+import run.halo.app.core.user.service.RoleService;
+import run.halo.app.core.user.service.UserService;
 import run.halo.app.infra.exception.UserNotFoundException;
 import run.halo.app.security.authentication.login.HaloUser;
 import run.halo.app.security.authentication.twofactor.TwoFactorUtils;
diff --git a/application/src/main/java/run/halo/app/security/authentication/pat/impl/UserScopedPatHandlerImpl.java b/application/src/main/java/run/halo/app/security/authentication/pat/impl/UserScopedPatHandlerImpl.java
index a7dfd8b010..108479968d 100644
--- a/application/src/main/java/run/halo/app/security/authentication/pat/impl/UserScopedPatHandlerImpl.java
+++ b/application/src/main/java/run/halo/app/security/authentication/pat/impl/UserScopedPatHandlerImpl.java
@@ -29,7 +29,7 @@
 import org.springframework.web.reactive.function.server.ServerResponse;
 import org.springframework.web.server.ServerWebInputException;
 import reactor.core.publisher.Mono;
-import run.halo.app.core.extension.service.RoleService;
+import run.halo.app.core.user.service.RoleService;
 import run.halo.app.extension.ExtensionUtil;
 import run.halo.app.extension.Metadata;
 import run.halo.app.extension.ReactiveExtensionClient;
diff --git a/application/src/main/java/run/halo/app/security/authentication/twofactor/TwoFactorAuthEndpoint.java b/application/src/main/java/run/halo/app/security/authentication/twofactor/TwoFactorAuthEndpoint.java
index 991faadffa..f874f5eb75 100644
--- a/application/src/main/java/run/halo/app/security/authentication/twofactor/TwoFactorAuthEndpoint.java
+++ b/application/src/main/java/run/halo/app/security/authentication/twofactor/TwoFactorAuthEndpoint.java
@@ -25,7 +25,7 @@
 import reactor.core.publisher.Mono;
 import run.halo.app.core.extension.User;
 import run.halo.app.core.extension.endpoint.CustomEndpoint;
-import run.halo.app.core.extension.service.UserService;
+import run.halo.app.core.user.service.UserService;
 import run.halo.app.extension.GroupVersion;
 import run.halo.app.extension.ReactiveExtensionClient;
 import run.halo.app.infra.ExternalUrlSupplier;
diff --git a/application/src/main/java/run/halo/app/security/authorization/DefaultRuleResolver.java b/application/src/main/java/run/halo/app/security/authorization/DefaultRuleResolver.java
index 00cfdc14a2..0294d55de4 100644
--- a/application/src/main/java/run/halo/app/security/authorization/DefaultRuleResolver.java
+++ b/application/src/main/java/run/halo/app/security/authorization/DefaultRuleResolver.java
@@ -7,7 +7,7 @@
 import org.springframework.security.core.Authentication;
 import org.springframework.util.CollectionUtils;
 import reactor.core.publisher.Mono;
-import run.halo.app.core.extension.service.RoleService;
+import run.halo.app.core.user.service.RoleService;
 
 /**
  * @author guqing
diff --git a/application/src/main/java/run/halo/app/security/authorization/RequestInfoAuthorizationManager.java b/application/src/main/java/run/halo/app/security/authorization/RequestInfoAuthorizationManager.java
index f450af7c47..d01fef7da9 100644
--- a/application/src/main/java/run/halo/app/security/authorization/RequestInfoAuthorizationManager.java
+++ b/application/src/main/java/run/halo/app/security/authorization/RequestInfoAuthorizationManager.java
@@ -8,7 +8,7 @@
 import org.springframework.security.core.Authentication;
 import org.springframework.security.web.server.authorization.AuthorizationContext;
 import reactor.core.publisher.Mono;
-import run.halo.app.core.extension.service.RoleService;
+import run.halo.app.core.user.service.RoleService;
 
 @Slf4j
 public class RequestInfoAuthorizationManager
diff --git a/application/src/main/java/run/halo/app/security/authorization/RequestInfoFactory.java b/application/src/main/java/run/halo/app/security/authorization/RequestInfoFactory.java
index 4f629f6a7c..b908c9e8e9 100644
--- a/application/src/main/java/run/halo/app/security/authorization/RequestInfoFactory.java
+++ b/application/src/main/java/run/halo/app/security/authorization/RequestInfoFactory.java
@@ -6,7 +6,7 @@
 import org.apache.commons.lang3.StringUtils;
 import org.springframework.http.server.PathContainer;
 import org.springframework.http.server.reactive.ServerHttpRequest;
-import run.halo.app.console.WebSocketUtils;
+import run.halo.app.infra.console.WebSocketUtils;
 
 /**
  * Creates {@link RequestInfo} from {@link ServerHttpRequest}.
diff --git a/application/src/main/java/run/halo/app/core/extension/theme/ThemeEndpoint.java b/application/src/main/java/run/halo/app/theme/endpoint/ThemeEndpoint.java
similarity index 99%
rename from application/src/main/java/run/halo/app/core/extension/theme/ThemeEndpoint.java
rename to application/src/main/java/run/halo/app/theme/endpoint/ThemeEndpoint.java
index 9cc4210925..8e21ae818a 100644
--- a/application/src/main/java/run/halo/app/core/extension/theme/ThemeEndpoint.java
+++ b/application/src/main/java/run/halo/app/theme/endpoint/ThemeEndpoint.java
@@ -1,4 +1,4 @@
-package run.halo.app.core.extension.theme;
+package run.halo.app.theme.endpoint;
 
 import static io.swagger.v3.oas.annotations.media.Schema.RequiredMode.REQUIRED;
 import static org.springdoc.core.fn.builders.apiresponse.Builder.responseBuilder;
@@ -49,6 +49,8 @@
 import run.halo.app.infra.exception.NotFoundException;
 import run.halo.app.infra.utils.JsonUtils;
 import run.halo.app.theme.TemplateEngineManager;
+import run.halo.app.theme.service.ThemeService;
+import run.halo.app.theme.service.ThemeUtils;
 
 /**
  * Endpoint for managing themes.
diff --git a/application/src/main/java/run/halo/app/theme/finders/impl/CommentPublicQueryServiceImpl.java b/application/src/main/java/run/halo/app/theme/finders/impl/CommentPublicQueryServiceImpl.java
index 3a39a80c29..be5f9e91f1 100644
--- a/application/src/main/java/run/halo/app/theme/finders/impl/CommentPublicQueryServiceImpl.java
+++ b/application/src/main/java/run/halo/app/theme/finders/impl/CommentPublicQueryServiceImpl.java
@@ -27,7 +27,7 @@
 import run.halo.app.core.extension.User;
 import run.halo.app.core.extension.content.Comment;
 import run.halo.app.core.extension.content.Reply;
-import run.halo.app.core.extension.service.UserService;
+import run.halo.app.core.user.service.UserService;
 import run.halo.app.extension.AbstractExtension;
 import run.halo.app.extension.ListOptions;
 import run.halo.app.extension.ListResult;
diff --git a/application/src/main/java/run/halo/app/theme/finders/impl/ContributorFinderImpl.java b/application/src/main/java/run/halo/app/theme/finders/impl/ContributorFinderImpl.java
index 3d05eef7f0..0f0649a04c 100644
--- a/application/src/main/java/run/halo/app/theme/finders/impl/ContributorFinderImpl.java
+++ b/application/src/main/java/run/halo/app/theme/finders/impl/ContributorFinderImpl.java
@@ -4,7 +4,7 @@
 import lombok.RequiredArgsConstructor;
 import reactor.core.publisher.Flux;
 import reactor.core.publisher.Mono;
-import run.halo.app.core.extension.service.UserService;
+import run.halo.app.core.user.service.UserService;
 import run.halo.app.theme.finders.ContributorFinder;
 import run.halo.app.theme.finders.Finder;
 import run.halo.app.theme.finders.vo.ContributorVo;
diff --git a/application/src/main/java/run/halo/app/core/extension/theme/ThemeService.java b/application/src/main/java/run/halo/app/theme/service/ThemeService.java
similarity index 92%
rename from application/src/main/java/run/halo/app/core/extension/theme/ThemeService.java
rename to application/src/main/java/run/halo/app/theme/service/ThemeService.java
index a3954a3fc3..007b4d3e58 100644
--- a/application/src/main/java/run/halo/app/core/extension/theme/ThemeService.java
+++ b/application/src/main/java/run/halo/app/theme/service/ThemeService.java
@@ -1,4 +1,4 @@
-package run.halo.app.core.extension.theme;
+package run.halo.app.theme.service;
 
 import org.reactivestreams.Publisher;
 import org.springframework.core.io.buffer.DataBuffer;
diff --git a/application/src/main/java/run/halo/app/core/extension/theme/ThemeServiceImpl.java b/application/src/main/java/run/halo/app/theme/service/ThemeServiceImpl.java
similarity index 98%
rename from application/src/main/java/run/halo/app/core/extension/theme/ThemeServiceImpl.java
rename to application/src/main/java/run/halo/app/theme/service/ThemeServiceImpl.java
index a3abfed085..c1abe453de 100644
--- a/application/src/main/java/run/halo/app/core/extension/theme/ThemeServiceImpl.java
+++ b/application/src/main/java/run/halo/app/theme/service/ThemeServiceImpl.java
@@ -1,12 +1,12 @@
-package run.halo.app.core.extension.theme;
+package run.halo.app.theme.service;
 
 import static org.springframework.util.FileSystemUtils.copyRecursively;
-import static run.halo.app.core.extension.theme.ThemeUtils.loadThemeManifest;
-import static run.halo.app.core.extension.theme.ThemeUtils.locateThemeManifest;
-import static run.halo.app.core.extension.theme.ThemeUtils.unzipThemeTo;
 import static run.halo.app.infra.utils.FileUtils.createTempDir;
 import static run.halo.app.infra.utils.FileUtils.deleteRecursivelyAndSilently;
 import static run.halo.app.infra.utils.FileUtils.unzip;
+import static run.halo.app.theme.service.ThemeUtils.loadThemeManifest;
+import static run.halo.app.theme.service.ThemeUtils.locateThemeManifest;
+import static run.halo.app.theme.service.ThemeUtils.unzipThemeTo;
 
 import java.nio.file.Path;
 import java.time.Duration;
@@ -41,6 +41,7 @@
 import run.halo.app.infra.ThemeRootGetter;
 import run.halo.app.infra.exception.ThemeUpgradeException;
 import run.halo.app.infra.exception.UnsatisfiedAttributeValueException;
+import run.halo.app.infra.utils.SettingUtils;
 import run.halo.app.infra.utils.VersionUtils;
 
 @Slf4j
diff --git a/application/src/main/java/run/halo/app/core/extension/theme/ThemeUtils.java b/application/src/main/java/run/halo/app/theme/service/ThemeUtils.java
similarity index 97%
rename from application/src/main/java/run/halo/app/core/extension/theme/ThemeUtils.java
rename to application/src/main/java/run/halo/app/theme/service/ThemeUtils.java
index a0276a36e1..0b6449c5d3 100644
--- a/application/src/main/java/run/halo/app/core/extension/theme/ThemeUtils.java
+++ b/application/src/main/java/run/halo/app/theme/service/ThemeUtils.java
@@ -1,4 +1,4 @@
-package run.halo.app.core.extension.theme;
+package run.halo.app.theme.service;
 
 import static org.springframework.util.FileSystemUtils.copyRecursively;
 import static run.halo.app.infra.utils.FileUtils.createTempDir;
@@ -16,6 +16,7 @@
 import java.util.Set;
 import java.util.stream.BaseStream;
 import java.util.stream.Stream;
+import lombok.experimental.UtilityClass;
 import lombok.extern.slf4j.Slf4j;
 import org.reactivestreams.Publisher;
 import org.springframework.core.io.FileSystemResource;
@@ -38,11 +39,12 @@
 import run.halo.app.infra.utils.YamlUnstructuredLoader;
 
 @Slf4j
-class ThemeUtils {
+@UtilityClass
+public class ThemeUtils {
     private static final String THEME_TMP_PREFIX = "halo-theme-";
     private static final String[] THEME_MANIFESTS = {"theme.yaml", "theme.yml"};
 
-    static Flux<Theme> listAllThemesFromThemeDir(Path themesDir) {
+    public static Flux<Theme> listAllThemesFromThemeDir(Path themesDir) {
         return walkThemesFromPath(themesDir)
             .filter(Files::isDirectory)
             .map(ThemeUtils::findThemeManifest)
diff --git a/application/src/test/java/run/halo/app/config/ExtensionConfigurationTest.java b/application/src/test/java/run/halo/app/config/ExtensionConfigurationTest.java
index ee0ad619e1..9cc8a81408 100644
--- a/application/src/test/java/run/halo/app/config/ExtensionConfigurationTest.java
+++ b/application/src/test/java/run/halo/app/config/ExtensionConfigurationTest.java
@@ -26,7 +26,7 @@
 import org.springframework.test.web.reactive.server.WebTestClient;
 import reactor.core.publisher.Flux;
 import run.halo.app.core.extension.Role;
-import run.halo.app.core.extension.service.RoleService;
+import run.halo.app.core.user.service.RoleService;
 import run.halo.app.extension.ExtensionClient;
 import run.halo.app.extension.FakeExtension;
 import run.halo.app.extension.GroupVersionKind;
diff --git a/application/src/test/java/run/halo/app/config/WebFluxConfigTest.java b/application/src/test/java/run/halo/app/config/WebFluxConfigTest.java
index e60e2870c6..70f2db955c 100644
--- a/application/src/test/java/run/halo/app/config/WebFluxConfigTest.java
+++ b/application/src/test/java/run/halo/app/config/WebFluxConfigTest.java
@@ -25,7 +25,7 @@
 import reactor.test.StepVerifier;
 import run.halo.app.core.endpoint.WebSocketEndpoint;
 import run.halo.app.core.extension.Role;
-import run.halo.app.core.extension.service.RoleService;
+import run.halo.app.core.user.service.RoleService;
 import run.halo.app.extension.GroupVersion;
 import run.halo.app.extension.Metadata;
 
diff --git a/application/src/test/java/run/halo/app/console/WebSocketServerWebExchangeMatcherTest.java b/application/src/test/java/run/halo/app/console/WebSocketServerWebExchangeMatcherTest.java
index cf2944bc2c..11c40030c0 100644
--- a/application/src/test/java/run/halo/app/console/WebSocketServerWebExchangeMatcherTest.java
+++ b/application/src/test/java/run/halo/app/console/WebSocketServerWebExchangeMatcherTest.java
@@ -8,6 +8,7 @@
 import org.springframework.mock.http.server.reactive.MockServerHttpRequest;
 import org.springframework.mock.web.server.MockServerWebExchange;
 import reactor.test.StepVerifier;
+import run.halo.app.infra.console.WebSocketServerWebExchangeMatcher;
 
 class WebSocketServerWebExchangeMatcherTest {
 
diff --git a/application/src/test/java/run/halo/app/console/WebSocketUtilsTest.java b/application/src/test/java/run/halo/app/console/WebSocketUtilsTest.java
index aac0fd1bc9..225a6e91f0 100644
--- a/application/src/test/java/run/halo/app/console/WebSocketUtilsTest.java
+++ b/application/src/test/java/run/halo/app/console/WebSocketUtilsTest.java
@@ -6,6 +6,7 @@
 import org.junit.jupiter.api.Nested;
 import org.junit.jupiter.api.Test;
 import org.springframework.http.HttpHeaders;
+import run.halo.app.infra.console.WebSocketUtils;
 
 class WebSocketUtilsTest {
 
diff --git a/application/src/test/java/run/halo/app/content/PostIntegrationTests.java b/application/src/test/java/run/halo/app/content/PostIntegrationTests.java
index 629f3bbf9d..6eb47e1c4f 100644
--- a/application/src/test/java/run/halo/app/content/PostIntegrationTests.java
+++ b/application/src/test/java/run/halo/app/content/PostIntegrationTests.java
@@ -19,7 +19,7 @@
 import reactor.core.publisher.Flux;
 import run.halo.app.core.extension.Role;
 import run.halo.app.core.extension.content.Post;
-import run.halo.app.core.extension.service.RoleService;
+import run.halo.app.core.user.service.RoleService;
 import run.halo.app.extension.Metadata;
 import run.halo.app.extension.MetadataOperator;
 import run.halo.app.infra.utils.JsonUtils;
diff --git a/application/src/test/java/run/halo/app/content/comment/CommentServiceImplTest.java b/application/src/test/java/run/halo/app/content/comment/CommentServiceImplTest.java
index ac23f1e13b..3e706594da 100644
--- a/application/src/test/java/run/halo/app/content/comment/CommentServiceImplTest.java
+++ b/application/src/test/java/run/halo/app/content/comment/CommentServiceImplTest.java
@@ -35,8 +35,8 @@
 import run.halo.app.core.extension.User;
 import run.halo.app.core.extension.content.Comment;
 import run.halo.app.core.extension.content.Post;
-import run.halo.app.core.extension.service.RoleService;
-import run.halo.app.core.extension.service.UserService;
+import run.halo.app.core.user.service.RoleService;
+import run.halo.app.core.user.service.UserService;
 import run.halo.app.extension.ListOptions;
 import run.halo.app.extension.ListResult;
 import run.halo.app.extension.Metadata;
diff --git a/application/src/test/java/run/halo/app/core/attachment/impl/LocalThumbnailServiceImplTest.java b/application/src/test/java/run/halo/app/core/attachment/impl/LocalThumbnailServiceImplTest.java
index 6643d3837c..54d3d2c432 100644
--- a/application/src/test/java/run/halo/app/core/attachment/impl/LocalThumbnailServiceImplTest.java
+++ b/application/src/test/java/run/halo/app/core/attachment/impl/LocalThumbnailServiceImplTest.java
@@ -24,7 +24,7 @@
 import reactor.test.StepVerifier;
 import run.halo.app.core.attachment.AttachmentRootGetter;
 import run.halo.app.core.attachment.ThumbnailSize;
-import run.halo.app.core.extension.attachment.LocalThumbnail;
+import run.halo.app.core.attachment.extension.LocalThumbnail;
 import run.halo.app.extension.ListResult;
 import run.halo.app.extension.PageRequest;
 import run.halo.app.extension.ReactiveExtensionClient;
diff --git a/application/src/test/java/run/halo/app/core/attachment/impl/ThumbnailServiceImplTest.java b/application/src/test/java/run/halo/app/core/attachment/impl/ThumbnailServiceImplTest.java
index 7a22f73d4a..5461fc8742 100644
--- a/application/src/test/java/run/halo/app/core/attachment/impl/ThumbnailServiceImplTest.java
+++ b/application/src/test/java/run/halo/app/core/attachment/impl/ThumbnailServiceImplTest.java
@@ -29,7 +29,7 @@
 import run.halo.app.core.attachment.ThumbnailProvider;
 import run.halo.app.core.attachment.ThumbnailSigner;
 import run.halo.app.core.attachment.ThumbnailSize;
-import run.halo.app.core.extension.attachment.Thumbnail;
+import run.halo.app.core.attachment.extension.Thumbnail;
 import run.halo.app.extension.ListOptions;
 import run.halo.app.extension.PageRequest;
 import run.halo.app.extension.ReactiveExtensionClient;
diff --git a/application/src/test/java/run/halo/app/core/extension/endpoint/EmailVerificationCodeTest.java b/application/src/test/java/run/halo/app/core/endpoint/console/EmailVerificationCodeTest.java
similarity index 96%
rename from application/src/test/java/run/halo/app/core/extension/endpoint/EmailVerificationCodeTest.java
rename to application/src/test/java/run/halo/app/core/endpoint/console/EmailVerificationCodeTest.java
index ee3838c103..683e6552c2 100644
--- a/application/src/test/java/run/halo/app/core/extension/endpoint/EmailVerificationCodeTest.java
+++ b/application/src/test/java/run/halo/app/core/endpoint/console/EmailVerificationCodeTest.java
@@ -1,4 +1,4 @@
-package run.halo.app.core.extension.endpoint;
+package run.halo.app.core.endpoint.console;
 
 import static org.mockito.ArgumentMatchers.anyString;
 import static org.mockito.ArgumentMatchers.eq;
@@ -23,8 +23,8 @@
 import org.springframework.test.web.reactive.server.WebTestClient;
 import reactor.core.publisher.Mono;
 import run.halo.app.core.extension.User;
-import run.halo.app.core.extension.service.EmailVerificationService;
-import run.halo.app.core.extension.service.UserService;
+import run.halo.app.core.user.service.EmailVerificationService;
+import run.halo.app.core.user.service.UserService;
 import run.halo.app.extension.Metadata;
 import run.halo.app.extension.ReactiveExtensionClient;
 
diff --git a/application/src/test/java/run/halo/app/core/extension/endpoint/PluginEndpointTest.java b/application/src/test/java/run/halo/app/core/endpoint/console/PluginEndpointTest.java
similarity index 99%
rename from application/src/test/java/run/halo/app/core/extension/endpoint/PluginEndpointTest.java
rename to application/src/test/java/run/halo/app/core/endpoint/console/PluginEndpointTest.java
index 2ff443606a..7d931cba6c 100644
--- a/application/src/test/java/run/halo/app/core/extension/endpoint/PluginEndpointTest.java
+++ b/application/src/test/java/run/halo/app/core/endpoint/console/PluginEndpointTest.java
@@ -1,4 +1,4 @@
-package run.halo.app.core.extension.endpoint;
+package run.halo.app.core.endpoint.console;
 
 import static java.util.Objects.requireNonNull;
 import static org.mockito.ArgumentMatchers.any;
@@ -44,7 +44,6 @@
 import reactor.core.publisher.Mono;
 import run.halo.app.core.extension.Plugin;
 import run.halo.app.core.extension.Setting;
-import run.halo.app.core.extension.service.PluginService;
 import run.halo.app.extension.ConfigMap;
 import run.halo.app.extension.ListOptions;
 import run.halo.app.extension.ListResult;
@@ -53,6 +52,7 @@
 import run.halo.app.extension.ReactiveExtensionClient;
 import run.halo.app.infra.SystemVersionSupplier;
 import run.halo.app.infra.utils.FileUtils;
+import run.halo.app.plugin.PluginService;
 
 @Slf4j
 @ExtendWith(MockitoExtension.class)
diff --git a/application/src/test/java/run/halo/app/core/extension/endpoint/PostEndpointTest.java b/application/src/test/java/run/halo/app/core/endpoint/console/PostEndpointTest.java
similarity index 99%
rename from application/src/test/java/run/halo/app/core/extension/endpoint/PostEndpointTest.java
rename to application/src/test/java/run/halo/app/core/endpoint/console/PostEndpointTest.java
index 7933535bdc..0d47549620 100644
--- a/application/src/test/java/run/halo/app/core/extension/endpoint/PostEndpointTest.java
+++ b/application/src/test/java/run/halo/app/core/endpoint/console/PostEndpointTest.java
@@ -1,4 +1,4 @@
-package run.halo.app.core.extension.endpoint;
+package run.halo.app.core.endpoint.console;
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.mockito.ArgumentMatchers.any;
diff --git a/application/src/test/java/run/halo/app/core/extension/endpoint/SinglePageEndpointTest.java b/application/src/test/java/run/halo/app/core/endpoint/console/SinglePageEndpointTest.java
similarity index 98%
rename from application/src/test/java/run/halo/app/core/extension/endpoint/SinglePageEndpointTest.java
rename to application/src/test/java/run/halo/app/core/endpoint/console/SinglePageEndpointTest.java
index 9e3fcd8734..cb911c4c25 100644
--- a/application/src/test/java/run/halo/app/core/extension/endpoint/SinglePageEndpointTest.java
+++ b/application/src/test/java/run/halo/app/core/endpoint/console/SinglePageEndpointTest.java
@@ -1,4 +1,4 @@
-package run.halo.app.core.extension.endpoint;
+package run.halo.app.core.endpoint.console;
 
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.ArgumentMatchers.eq;
diff --git a/application/src/test/java/run/halo/app/core/extension/endpoint/SystemInitializationEndpointTest.java b/application/src/test/java/run/halo/app/core/endpoint/console/SystemInitializationEndpointTest.java
similarity index 95%
rename from application/src/test/java/run/halo/app/core/extension/endpoint/SystemInitializationEndpointTest.java
rename to application/src/test/java/run/halo/app/core/endpoint/console/SystemInitializationEndpointTest.java
index 82cf8a24df..cd2238e863 100644
--- a/application/src/test/java/run/halo/app/core/extension/endpoint/SystemInitializationEndpointTest.java
+++ b/application/src/test/java/run/halo/app/core/endpoint/console/SystemInitializationEndpointTest.java
@@ -1,4 +1,4 @@
-package run.halo.app.core.extension.endpoint;
+package run.halo.app.core.endpoint.console;
 
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.Mockito.verify;
@@ -13,7 +13,7 @@
 import org.mockito.junit.jupiter.MockitoExtension;
 import org.springframework.test.web.reactive.server.WebTestClient;
 import reactor.core.publisher.Mono;
-import run.halo.app.core.extension.endpoint.SystemInitializationEndpoint.SystemInitializationRequest;
+import run.halo.app.core.endpoint.console.SystemInitializationEndpoint.SystemInitializationRequest;
 import run.halo.app.extension.ConfigMap;
 import run.halo.app.extension.ReactiveExtensionClient;
 import run.halo.app.infra.InitializationStateGetter;
diff --git a/application/src/test/java/run/halo/app/core/extension/endpoint/TagEndpointTest.java b/application/src/test/java/run/halo/app/core/endpoint/console/TagEndpointTest.java
similarity index 98%
rename from application/src/test/java/run/halo/app/core/extension/endpoint/TagEndpointTest.java
rename to application/src/test/java/run/halo/app/core/endpoint/console/TagEndpointTest.java
index 1eb32141d3..c1e08dbe50 100644
--- a/application/src/test/java/run/halo/app/core/extension/endpoint/TagEndpointTest.java
+++ b/application/src/test/java/run/halo/app/core/endpoint/console/TagEndpointTest.java
@@ -1,4 +1,4 @@
-package run.halo.app.core.extension.endpoint;
+package run.halo.app.core.endpoint.console;
 
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.ArgumentMatchers.same;
diff --git a/application/src/test/java/run/halo/app/core/extension/endpoint/UserEndpointIntegrationTest.java b/application/src/test/java/run/halo/app/core/endpoint/console/UserEndpointIntegrationTest.java
similarity index 97%
rename from application/src/test/java/run/halo/app/core/extension/endpoint/UserEndpointIntegrationTest.java
rename to application/src/test/java/run/halo/app/core/endpoint/console/UserEndpointIntegrationTest.java
index b83f2f6db1..29cfae3242 100644
--- a/application/src/test/java/run/halo/app/core/extension/endpoint/UserEndpointIntegrationTest.java
+++ b/application/src/test/java/run/halo/app/core/endpoint/console/UserEndpointIntegrationTest.java
@@ -1,4 +1,4 @@
-package run.halo.app.core.extension.endpoint;
+package run.halo.app.core.endpoint.console;
 
 import static org.mockito.ArgumentMatchers.anySet;
 import static org.mockito.Mockito.when;
@@ -22,7 +22,7 @@
 import reactor.core.publisher.Mono;
 import run.halo.app.core.extension.Role;
 import run.halo.app.core.extension.User;
-import run.halo.app.core.extension.service.RoleService;
+import run.halo.app.core.user.service.RoleService;
 import run.halo.app.extension.Metadata;
 import run.halo.app.extension.ReactiveExtensionClient;
 
diff --git a/application/src/test/java/run/halo/app/core/extension/endpoint/UserEndpointTest.java b/application/src/test/java/run/halo/app/core/endpoint/console/UserEndpointTest.java
similarity index 99%
rename from application/src/test/java/run/halo/app/core/extension/endpoint/UserEndpointTest.java
rename to application/src/test/java/run/halo/app/core/endpoint/console/UserEndpointTest.java
index 655c9370c2..b762262586 100644
--- a/application/src/test/java/run/halo/app/core/extension/endpoint/UserEndpointTest.java
+++ b/application/src/test/java/run/halo/app/core/endpoint/console/UserEndpointTest.java
@@ -1,4 +1,4 @@
-package run.halo.app.core.extension.endpoint;
+package run.halo.app.core.endpoint.console;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.mockito.ArgumentMatchers.any;
@@ -37,8 +37,8 @@
 import run.halo.app.core.extension.User;
 import run.halo.app.core.extension.attachment.Attachment;
 import run.halo.app.core.extension.service.AttachmentService;
-import run.halo.app.core.extension.service.RoleService;
-import run.halo.app.core.extension.service.UserService;
+import run.halo.app.core.user.service.RoleService;
+import run.halo.app.core.user.service.UserService;
 import run.halo.app.extension.ListResult;
 import run.halo.app.extension.Metadata;
 import run.halo.app.extension.PageRequest;
diff --git a/application/src/test/java/run/halo/app/theme/endpoint/CategoryQueryEndpointTest.java b/application/src/test/java/run/halo/app/core/endpoint/theme/CategoryQueryEndpointTest.java
similarity index 98%
rename from application/src/test/java/run/halo/app/theme/endpoint/CategoryQueryEndpointTest.java
rename to application/src/test/java/run/halo/app/core/endpoint/theme/CategoryQueryEndpointTest.java
index 9ba60c6647..2f19d170e9 100644
--- a/application/src/test/java/run/halo/app/theme/endpoint/CategoryQueryEndpointTest.java
+++ b/application/src/test/java/run/halo/app/core/endpoint/theme/CategoryQueryEndpointTest.java
@@ -1,4 +1,4 @@
-package run.halo.app.theme.endpoint;
+package run.halo.app.core.endpoint.theme;
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.mockito.ArgumentMatchers.any;
diff --git a/application/src/test/java/run/halo/app/theme/endpoint/CommentFinderEndpointTest.java b/application/src/test/java/run/halo/app/core/endpoint/theme/CommentFinderEndpointTest.java
similarity index 99%
rename from application/src/test/java/run/halo/app/theme/endpoint/CommentFinderEndpointTest.java
rename to application/src/test/java/run/halo/app/core/endpoint/theme/CommentFinderEndpointTest.java
index 997b4d3c8d..80f1bc01d2 100644
--- a/application/src/test/java/run/halo/app/theme/endpoint/CommentFinderEndpointTest.java
+++ b/application/src/test/java/run/halo/app/core/endpoint/theme/CommentFinderEndpointTest.java
@@ -1,4 +1,4 @@
-package run.halo.app.theme.endpoint;
+package run.halo.app.core.endpoint.theme;
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.mockito.ArgumentMatchers.any;
diff --git a/application/src/test/java/run/halo/app/theme/endpoint/MenuQueryEndpointTest.java b/application/src/test/java/run/halo/app/core/endpoint/theme/MenuQueryEndpointTest.java
similarity index 98%
rename from application/src/test/java/run/halo/app/theme/endpoint/MenuQueryEndpointTest.java
rename to application/src/test/java/run/halo/app/core/endpoint/theme/MenuQueryEndpointTest.java
index a6dbb503ae..27e1c8e5df 100644
--- a/application/src/test/java/run/halo/app/theme/endpoint/MenuQueryEndpointTest.java
+++ b/application/src/test/java/run/halo/app/core/endpoint/theme/MenuQueryEndpointTest.java
@@ -1,4 +1,4 @@
-package run.halo.app.theme.endpoint;
+package run.halo.app.core.endpoint.theme;
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.mockito.ArgumentMatchers.eq;
diff --git a/application/src/test/java/run/halo/app/theme/endpoint/PluginQueryEndpointTest.java b/application/src/test/java/run/halo/app/core/endpoint/theme/PluginQueryEndpointTest.java
similarity index 97%
rename from application/src/test/java/run/halo/app/theme/endpoint/PluginQueryEndpointTest.java
rename to application/src/test/java/run/halo/app/core/endpoint/theme/PluginQueryEndpointTest.java
index 739b92ca9c..4b60a60918 100644
--- a/application/src/test/java/run/halo/app/theme/endpoint/PluginQueryEndpointTest.java
+++ b/application/src/test/java/run/halo/app/core/endpoint/theme/PluginQueryEndpointTest.java
@@ -1,4 +1,4 @@
-package run.halo.app.theme.endpoint;
+package run.halo.app.core.endpoint.theme;
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.mockito.Mockito.when;
diff --git a/application/src/test/java/run/halo/app/theme/endpoint/PostQueryEndpointTest.java b/application/src/test/java/run/halo/app/core/endpoint/theme/PostQueryEndpointTest.java
similarity index 98%
rename from application/src/test/java/run/halo/app/theme/endpoint/PostQueryEndpointTest.java
rename to application/src/test/java/run/halo/app/core/endpoint/theme/PostQueryEndpointTest.java
index f39f1396b3..94a984f469 100644
--- a/application/src/test/java/run/halo/app/theme/endpoint/PostQueryEndpointTest.java
+++ b/application/src/test/java/run/halo/app/core/endpoint/theme/PostQueryEndpointTest.java
@@ -1,4 +1,4 @@
-package run.halo.app.theme.endpoint;
+package run.halo.app.core.endpoint.theme;
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.mockito.ArgumentMatchers.any;
diff --git a/application/src/test/java/run/halo/app/theme/endpoint/PublicApiUtilsTest.java b/application/src/test/java/run/halo/app/core/endpoint/theme/PublicApiUtilsTest.java
similarity index 97%
rename from application/src/test/java/run/halo/app/theme/endpoint/PublicApiUtilsTest.java
rename to application/src/test/java/run/halo/app/core/endpoint/theme/PublicApiUtilsTest.java
index 56979ed7d2..f7b32b72ef 100644
--- a/application/src/test/java/run/halo/app/theme/endpoint/PublicApiUtilsTest.java
+++ b/application/src/test/java/run/halo/app/core/endpoint/theme/PublicApiUtilsTest.java
@@ -1,4 +1,4 @@
-package run.halo.app.theme.endpoint;
+package run.halo.app.core.endpoint.theme;
 
 import static org.assertj.core.api.Assertions.assertThat;
 
diff --git a/application/src/test/java/run/halo/app/theme/endpoint/PublicUserEndpointTest.java b/application/src/test/java/run/halo/app/core/endpoint/theme/PublicUserEndpointTest.java
similarity index 97%
rename from application/src/test/java/run/halo/app/theme/endpoint/PublicUserEndpointTest.java
rename to application/src/test/java/run/halo/app/core/endpoint/theme/PublicUserEndpointTest.java
index 8acdefcc09..b37a20da98 100644
--- a/application/src/test/java/run/halo/app/theme/endpoint/PublicUserEndpointTest.java
+++ b/application/src/test/java/run/halo/app/core/endpoint/theme/PublicUserEndpointTest.java
@@ -1,4 +1,4 @@
-package run.halo.app.theme.endpoint;
+package run.halo.app.core.endpoint.theme;
 
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.ArgumentMatchers.anyString;
@@ -20,7 +20,7 @@
 import org.springframework.test.web.reactive.server.WebTestClient;
 import reactor.core.publisher.Mono;
 import run.halo.app.core.extension.User;
-import run.halo.app.core.extension.service.UserService;
+import run.halo.app.core.user.service.UserService;
 import run.halo.app.extension.Metadata;
 import run.halo.app.infra.SystemConfigurableEnvironmentFetcher;
 import run.halo.app.infra.SystemSetting;
diff --git a/application/src/test/java/run/halo/app/theme/endpoint/SinglePageQueryEndpointTest.java b/application/src/test/java/run/halo/app/core/endpoint/theme/SinglePageQueryEndpointTest.java
similarity index 98%
rename from application/src/test/java/run/halo/app/theme/endpoint/SinglePageQueryEndpointTest.java
rename to application/src/test/java/run/halo/app/core/endpoint/theme/SinglePageQueryEndpointTest.java
index 4b56b11653..83ebb9ebf3 100644
--- a/application/src/test/java/run/halo/app/theme/endpoint/SinglePageQueryEndpointTest.java
+++ b/application/src/test/java/run/halo/app/core/endpoint/theme/SinglePageQueryEndpointTest.java
@@ -1,4 +1,4 @@
-package run.halo.app.theme.endpoint;
+package run.halo.app.core.endpoint.theme;
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.mockito.ArgumentMatchers.eq;
diff --git a/application/src/test/java/run/halo/app/theme/endpoint/ThumbnailEndpointTest.java b/application/src/test/java/run/halo/app/core/endpoint/theme/ThumbnailEndpointTest.java
similarity index 97%
rename from application/src/test/java/run/halo/app/theme/endpoint/ThumbnailEndpointTest.java
rename to application/src/test/java/run/halo/app/core/endpoint/theme/ThumbnailEndpointTest.java
index 18f3414e82..6d02dac6c7 100644
--- a/application/src/test/java/run/halo/app/theme/endpoint/ThumbnailEndpointTest.java
+++ b/application/src/test/java/run/halo/app/core/endpoint/theme/ThumbnailEndpointTest.java
@@ -1,4 +1,4 @@
-package run.halo.app.theme.endpoint;
+package run.halo.app.core.endpoint.theme;
 
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.Mockito.when;
diff --git a/application/src/test/java/run/halo/app/core/extension/attachment/endpoint/AttachmentEndpointTest.java b/application/src/test/java/run/halo/app/core/extension/attachment/endpoint/AttachmentEndpointTest.java
index 6e95e5e79d..fb0a1ba56a 100644
--- a/application/src/test/java/run/halo/app/core/extension/attachment/endpoint/AttachmentEndpointTest.java
+++ b/application/src/test/java/run/halo/app/core/extension/attachment/endpoint/AttachmentEndpointTest.java
@@ -28,11 +28,12 @@
 import org.springframework.web.reactive.function.BodyInserters;
 import reactor.core.publisher.Flux;
 import reactor.core.publisher.Mono;
+import run.halo.app.core.attachment.endpoint.AttachmentEndpoint;
 import run.halo.app.core.extension.attachment.Attachment;
 import run.halo.app.core.extension.attachment.Group;
 import run.halo.app.core.extension.attachment.Policy;
 import run.halo.app.core.extension.attachment.Policy.PolicySpec;
-import run.halo.app.core.extension.service.impl.DefaultAttachmentService;
+import run.halo.app.core.user.service.impl.DefaultAttachmentService;
 import run.halo.app.extension.ConfigMap;
 import run.halo.app.extension.ListResult;
 import run.halo.app.extension.Metadata;
diff --git a/application/src/test/java/run/halo/app/core/extension/reconciler/CommentReconcilerTest.java b/application/src/test/java/run/halo/app/core/reconciler/CommentReconcilerTest.java
similarity index 97%
rename from application/src/test/java/run/halo/app/core/extension/reconciler/CommentReconcilerTest.java
rename to application/src/test/java/run/halo/app/core/reconciler/CommentReconcilerTest.java
index 1f6af9ec04..3a1e0bd605 100644
--- a/application/src/test/java/run/halo/app/core/extension/reconciler/CommentReconcilerTest.java
+++ b/application/src/test/java/run/halo/app/core/reconciler/CommentReconcilerTest.java
@@ -1,4 +1,4 @@
-package run.halo.app.core.extension.reconciler;
+package run.halo.app.core.reconciler;
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.mockito.ArgumentMatchers.any;
@@ -21,6 +21,7 @@
 import reactor.core.publisher.Mono;
 import run.halo.app.content.comment.ReplyService;
 import run.halo.app.core.extension.content.Comment;
+import run.halo.app.core.reconciler.CommentReconciler;
 import run.halo.app.extension.ExtensionClient;
 import run.halo.app.extension.ListOptions;
 import run.halo.app.extension.ListResult;
diff --git a/application/src/test/java/run/halo/app/core/extension/reconciler/MenuItemReconcilerTest.java b/application/src/test/java/run/halo/app/core/reconciler/MenuItemReconcilerTest.java
similarity index 98%
rename from application/src/test/java/run/halo/app/core/extension/reconciler/MenuItemReconcilerTest.java
rename to application/src/test/java/run/halo/app/core/reconciler/MenuItemReconcilerTest.java
index aec1993265..ece57b13ac 100644
--- a/application/src/test/java/run/halo/app/core/extension/reconciler/MenuItemReconcilerTest.java
+++ b/application/src/test/java/run/halo/app/core/reconciler/MenuItemReconcilerTest.java
@@ -1,4 +1,4 @@
-package run.halo.app.core.extension.reconciler;
+package run.halo.app.core.reconciler;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertFalse;
@@ -24,6 +24,7 @@
 import run.halo.app.core.extension.MenuItem.MenuItemSpec;
 import run.halo.app.core.extension.content.Category;
 import run.halo.app.core.extension.content.SinglePage;
+import run.halo.app.core.reconciler.MenuItemReconciler;
 import run.halo.app.extension.ExtensionClient;
 import run.halo.app.extension.Metadata;
 import run.halo.app.extension.Ref;
diff --git a/application/src/test/java/run/halo/app/core/extension/reconciler/PluginReconcilerTest.java b/application/src/test/java/run/halo/app/core/reconciler/PluginReconcilerTest.java
similarity index 99%
rename from application/src/test/java/run/halo/app/core/extension/reconciler/PluginReconcilerTest.java
rename to application/src/test/java/run/halo/app/core/reconciler/PluginReconcilerTest.java
index 92652fb542..a22492cfcd 100644
--- a/application/src/test/java/run/halo/app/core/extension/reconciler/PluginReconcilerTest.java
+++ b/application/src/test/java/run/halo/app/core/reconciler/PluginReconcilerTest.java
@@ -1,4 +1,4 @@
-package run.halo.app.core.extension.reconciler;
+package run.halo.app.core.reconciler;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertFalse;
@@ -48,6 +48,7 @@
 import run.halo.app.core.extension.Plugin;
 import run.halo.app.core.extension.ReverseProxy;
 import run.halo.app.core.extension.Setting;
+import run.halo.app.core.reconciler.PluginReconciler;
 import run.halo.app.extension.ConfigMap;
 import run.halo.app.extension.ExtensionClient;
 import run.halo.app.extension.Metadata;
diff --git a/application/src/test/java/run/halo/app/core/extension/reconciler/PostReconcilerTest.java b/application/src/test/java/run/halo/app/core/reconciler/PostReconcilerTest.java
similarity index 99%
rename from application/src/test/java/run/halo/app/core/extension/reconciler/PostReconcilerTest.java
rename to application/src/test/java/run/halo/app/core/reconciler/PostReconcilerTest.java
index b701523537..3dd75e5164 100644
--- a/application/src/test/java/run/halo/app/core/extension/reconciler/PostReconcilerTest.java
+++ b/application/src/test/java/run/halo/app/core/reconciler/PostReconcilerTest.java
@@ -1,4 +1,4 @@
-package run.halo.app.core.extension.reconciler;
+package run.halo.app.core.reconciler;
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.mockito.ArgumentMatchers.any;
@@ -33,6 +33,7 @@
 import run.halo.app.core.extension.content.Post;
 import run.halo.app.core.extension.content.Snapshot;
 import run.halo.app.core.extension.notification.Subscription;
+import run.halo.app.core.reconciler.PostReconciler;
 import run.halo.app.event.post.PostPublishedEvent;
 import run.halo.app.extension.ExtensionClient;
 import run.halo.app.extension.controller.Reconciler;
diff --git a/application/src/test/java/run/halo/app/core/extension/reconciler/ReverseProxyReconcilerTest.java b/application/src/test/java/run/halo/app/core/reconciler/ReverseProxyReconcilerTest.java
similarity index 95%
rename from application/src/test/java/run/halo/app/core/extension/reconciler/ReverseProxyReconcilerTest.java
rename to application/src/test/java/run/halo/app/core/reconciler/ReverseProxyReconcilerTest.java
index 0f88e2392d..30b22eca53 100644
--- a/application/src/test/java/run/halo/app/core/extension/reconciler/ReverseProxyReconcilerTest.java
+++ b/application/src/test/java/run/halo/app/core/reconciler/ReverseProxyReconcilerTest.java
@@ -1,4 +1,4 @@
-package run.halo.app.core.extension.reconciler;
+package run.halo.app.core.reconciler;
 
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.ArgumentMatchers.anyString;
@@ -19,6 +19,7 @@
 import org.mockito.Mock;
 import org.mockito.junit.jupiter.MockitoExtension;
 import run.halo.app.core.extension.ReverseProxy;
+import run.halo.app.core.reconciler.ReverseProxyReconciler;
 import run.halo.app.extension.ExtensionClient;
 import run.halo.app.extension.Metadata;
 import run.halo.app.extension.controller.Reconciler;
diff --git a/application/src/test/java/run/halo/app/core/extension/reconciler/SinglePageReconcilerTest.java b/application/src/test/java/run/halo/app/core/reconciler/SinglePageReconcilerTest.java
similarity index 99%
rename from application/src/test/java/run/halo/app/core/extension/reconciler/SinglePageReconcilerTest.java
rename to application/src/test/java/run/halo/app/core/reconciler/SinglePageReconcilerTest.java
index 486efadadc..6b7ce7fbb9 100644
--- a/application/src/test/java/run/halo/app/core/extension/reconciler/SinglePageReconcilerTest.java
+++ b/application/src/test/java/run/halo/app/core/reconciler/SinglePageReconcilerTest.java
@@ -1,4 +1,4 @@
-package run.halo.app.core.extension.reconciler;
+package run.halo.app.core.reconciler;
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.mockito.ArgumentMatchers.any;
@@ -34,6 +34,7 @@
 import run.halo.app.core.extension.content.SinglePage;
 import run.halo.app.core.extension.content.Snapshot;
 import run.halo.app.core.extension.notification.Subscription;
+import run.halo.app.core.reconciler.SinglePageReconciler;
 import run.halo.app.extension.ExtensionClient;
 import run.halo.app.extension.Metadata;
 import run.halo.app.extension.controller.Reconciler;
diff --git a/application/src/test/java/run/halo/app/core/extension/reconciler/SystemSettingReconcilerTest.java b/application/src/test/java/run/halo/app/core/reconciler/SystemSettingReconcilerTest.java
similarity index 98%
rename from application/src/test/java/run/halo/app/core/extension/reconciler/SystemSettingReconcilerTest.java
rename to application/src/test/java/run/halo/app/core/reconciler/SystemSettingReconcilerTest.java
index 61edc6aa43..24a1518bdf 100644
--- a/application/src/test/java/run/halo/app/core/extension/reconciler/SystemSettingReconcilerTest.java
+++ b/application/src/test/java/run/halo/app/core/reconciler/SystemSettingReconcilerTest.java
@@ -1,4 +1,4 @@
-package run.halo.app.core.extension.reconciler;
+package run.halo.app.core.reconciler;
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.mockito.ArgumentMatchers.any;
@@ -18,6 +18,7 @@
 import org.mockito.Mock;
 import org.mockito.junit.jupiter.MockitoExtension;
 import org.springframework.context.ApplicationContext;
+import run.halo.app.core.reconciler.SystemSettingReconciler;
 import run.halo.app.extension.ConfigMap;
 import run.halo.app.extension.ExtensionClient;
 import run.halo.app.extension.Metadata;
diff --git a/application/src/test/java/run/halo/app/core/extension/reconciler/TagReconcilerTest.java b/application/src/test/java/run/halo/app/core/reconciler/TagReconcilerTest.java
similarity index 97%
rename from application/src/test/java/run/halo/app/core/extension/reconciler/TagReconcilerTest.java
rename to application/src/test/java/run/halo/app/core/reconciler/TagReconcilerTest.java
index d88fe3ca9f..522e76c3fe 100644
--- a/application/src/test/java/run/halo/app/core/extension/reconciler/TagReconcilerTest.java
+++ b/application/src/test/java/run/halo/app/core/reconciler/TagReconcilerTest.java
@@ -1,4 +1,4 @@
-package run.halo.app.core.extension.reconciler;
+package run.halo.app.core.reconciler;
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.mockito.ArgumentMatchers.any;
@@ -18,6 +18,7 @@
 import org.mockito.junit.jupiter.MockitoExtension;
 import run.halo.app.content.permalinks.TagPermalinkPolicy;
 import run.halo.app.core.extension.content.Tag;
+import run.halo.app.core.reconciler.TagReconciler;
 import run.halo.app.extension.ExtensionClient;
 import run.halo.app.extension.Metadata;
 
diff --git a/application/src/test/java/run/halo/app/core/extension/reconciler/ThemeReconcilerTest.java b/application/src/test/java/run/halo/app/core/reconciler/ThemeReconcilerTest.java
similarity index 99%
rename from application/src/test/java/run/halo/app/core/extension/reconciler/ThemeReconcilerTest.java
rename to application/src/test/java/run/halo/app/core/reconciler/ThemeReconcilerTest.java
index e95044c8cd..ec6eea8533 100644
--- a/application/src/test/java/run/halo/app/core/extension/reconciler/ThemeReconcilerTest.java
+++ b/application/src/test/java/run/halo/app/core/reconciler/ThemeReconcilerTest.java
@@ -1,4 +1,4 @@
-package run.halo.app.core.extension.reconciler;
+package run.halo.app.core.reconciler;
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.AssertionsForClassTypes.assertThatThrownBy;
@@ -35,6 +35,7 @@
 import run.halo.app.core.extension.AnnotationSetting;
 import run.halo.app.core.extension.Setting;
 import run.halo.app.core.extension.Theme;
+import run.halo.app.core.reconciler.ThemeReconciler;
 import run.halo.app.extension.ConfigMap;
 import run.halo.app.extension.ExtensionClient;
 import run.halo.app.extension.Metadata;
diff --git a/application/src/test/java/run/halo/app/core/extension/reconciler/UserReconcilerTest.java b/application/src/test/java/run/halo/app/core/reconciler/UserReconcilerTest.java
similarity index 96%
rename from application/src/test/java/run/halo/app/core/extension/reconciler/UserReconcilerTest.java
rename to application/src/test/java/run/halo/app/core/reconciler/UserReconcilerTest.java
index f54997d698..7aca878e9e 100644
--- a/application/src/test/java/run/halo/app/core/extension/reconciler/UserReconcilerTest.java
+++ b/application/src/test/java/run/halo/app/core/reconciler/UserReconcilerTest.java
@@ -1,4 +1,4 @@
-package run.halo.app.core.extension.reconciler;
+package run.halo.app.core.reconciler;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.mockito.ArgumentMatchers.any;
@@ -21,7 +21,8 @@
 import reactor.core.publisher.Flux;
 import reactor.core.publisher.Mono;
 import run.halo.app.core.extension.User;
-import run.halo.app.core.extension.service.RoleService;
+import run.halo.app.core.reconciler.UserReconciler;
+import run.halo.app.core.user.service.RoleService;
 import run.halo.app.extension.ExtensionClient;
 import run.halo.app.extension.Metadata;
 import run.halo.app.extension.controller.Reconciler;
diff --git a/application/src/test/java/run/halo/app/core/extension/service/DefaultRoleServiceTest.java b/application/src/test/java/run/halo/app/core/user/service/DefaultRoleServiceTest.java
similarity index 99%
rename from application/src/test/java/run/halo/app/core/extension/service/DefaultRoleServiceTest.java
rename to application/src/test/java/run/halo/app/core/user/service/DefaultRoleServiceTest.java
index 2498b0e105..ccd13f203c 100644
--- a/application/src/test/java/run/halo/app/core/extension/service/DefaultRoleServiceTest.java
+++ b/application/src/test/java/run/halo/app/core/user/service/DefaultRoleServiceTest.java
@@ -1,4 +1,4 @@
-package run.halo.app.core.extension.service;
+package run.halo.app.core.user.service;
 
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.ArgumentMatchers.same;
@@ -29,6 +29,7 @@
 import reactor.test.StepVerifier;
 import run.halo.app.core.extension.Role;
 import run.halo.app.core.extension.RoleBinding;
+import run.halo.app.core.user.service.DefaultRoleService;
 import run.halo.app.extension.ListOptions;
 import run.halo.app.extension.Metadata;
 import run.halo.app.extension.ReactiveExtensionClient;
diff --git a/application/src/test/java/run/halo/app/core/extension/service/UserServiceImplTest.java b/application/src/test/java/run/halo/app/core/user/service/UserServiceImplTest.java
similarity index 99%
rename from application/src/test/java/run/halo/app/core/extension/service/UserServiceImplTest.java
rename to application/src/test/java/run/halo/app/core/user/service/UserServiceImplTest.java
index 8b63e0435c..08a400a7a2 100644
--- a/application/src/test/java/run/halo/app/core/extension/service/UserServiceImplTest.java
+++ b/application/src/test/java/run/halo/app/core/user/service/UserServiceImplTest.java
@@ -1,4 +1,4 @@
-package run.halo.app.core.extension.service;
+package run.halo.app.core.user.service;
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.junit.jupiter.api.Assertions.assertEquals;
@@ -34,6 +34,8 @@
 import run.halo.app.core.extension.RoleBinding;
 import run.halo.app.core.extension.RoleBinding.Subject;
 import run.halo.app.core.extension.User;
+import run.halo.app.core.user.service.RoleService;
+import run.halo.app.core.user.service.UserServiceImpl;
 import run.halo.app.event.user.PasswordChangedEvent;
 import run.halo.app.extension.Metadata;
 import run.halo.app.extension.ReactiveExtensionClient;
diff --git a/application/src/test/java/run/halo/app/core/extension/service/impl/EmailPasswordRecoveryServiceImplTest.java b/application/src/test/java/run/halo/app/core/user/service/impl/EmailPasswordRecoveryServiceImplTest.java
similarity index 96%
rename from application/src/test/java/run/halo/app/core/extension/service/impl/EmailPasswordRecoveryServiceImplTest.java
rename to application/src/test/java/run/halo/app/core/user/service/impl/EmailPasswordRecoveryServiceImplTest.java
index 1d95fced07..37804408ef 100644
--- a/application/src/test/java/run/halo/app/core/extension/service/impl/EmailPasswordRecoveryServiceImplTest.java
+++ b/application/src/test/java/run/halo/app/core/user/service/impl/EmailPasswordRecoveryServiceImplTest.java
@@ -1,4 +1,4 @@
-package run.halo.app.core.extension.service.impl;
+package run.halo.app.core.user.service.impl;
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatThrownBy;
@@ -7,6 +7,7 @@
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.ExtendWith;
 import org.mockito.junit.jupiter.MockitoExtension;
+import run.halo.app.core.user.service.impl.EmailPasswordRecoveryServiceImpl;
 import run.halo.app.infra.exception.RateLimitExceededException;
 
 /**
diff --git a/application/src/test/java/run/halo/app/core/extension/service/impl/EmailVerificationServiceImplTest.java b/application/src/test/java/run/halo/app/core/user/service/impl/EmailVerificationServiceImplTest.java
similarity index 94%
rename from application/src/test/java/run/halo/app/core/extension/service/impl/EmailVerificationServiceImplTest.java
rename to application/src/test/java/run/halo/app/core/user/service/impl/EmailVerificationServiceImplTest.java
index 81a99bf028..ab3f3369d9 100644
--- a/application/src/test/java/run/halo/app/core/extension/service/impl/EmailVerificationServiceImplTest.java
+++ b/application/src/test/java/run/halo/app/core/user/service/impl/EmailVerificationServiceImplTest.java
@@ -1,13 +1,14 @@
-package run.halo.app.core.extension.service.impl;
+package run.halo.app.core.user.service.impl;
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatThrownBy;
-import static run.halo.app.core.extension.service.impl.EmailVerificationServiceImpl.MAX_ATTEMPTS;
+import static run.halo.app.core.user.service.impl.EmailVerificationServiceImpl.MAX_ATTEMPTS;
 
 import org.junit.jupiter.api.Nested;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.ExtendWith;
 import org.mockito.junit.jupiter.MockitoExtension;
+import run.halo.app.core.user.service.impl.EmailVerificationServiceImpl;
 import run.halo.app.infra.exception.EmailVerificationFailed;
 
 /**
diff --git a/application/src/test/java/run/halo/app/core/extension/theme/SettingUtilsTest.java b/application/src/test/java/run/halo/app/infra/utils/SettingUtilsTest.java
similarity index 98%
rename from application/src/test/java/run/halo/app/core/extension/theme/SettingUtilsTest.java
rename to application/src/test/java/run/halo/app/infra/utils/SettingUtilsTest.java
index bbed171190..32ee6b6f48 100644
--- a/application/src/test/java/run/halo/app/core/extension/theme/SettingUtilsTest.java
+++ b/application/src/test/java/run/halo/app/infra/utils/SettingUtilsTest.java
@@ -1,4 +1,4 @@
-package run.halo.app.core.extension.theme;
+package run.halo.app.infra.utils;
 
 import static org.assertj.core.api.Assertions.assertThat;
 
@@ -7,7 +7,6 @@
 import org.junit.jupiter.api.Test;
 import org.skyscreamer.jsonassert.JSONAssert;
 import run.halo.app.core.extension.Setting;
-import run.halo.app.infra.utils.JsonUtils;
 
 /**
  * Tests for {@link SettingUtils}.
diff --git a/application/src/test/java/run/halo/app/core/extension/service/impl/PluginServiceImplTest.java b/application/src/test/java/run/halo/app/plugin/PluginServiceImplTest.java
similarity index 98%
rename from application/src/test/java/run/halo/app/core/extension/service/impl/PluginServiceImplTest.java
rename to application/src/test/java/run/halo/app/plugin/PluginServiceImplTest.java
index d90303fa1c..bb38bd0fd9 100644
--- a/application/src/test/java/run/halo/app/core/extension/service/impl/PluginServiceImplTest.java
+++ b/application/src/test/java/run/halo/app/plugin/PluginServiceImplTest.java
@@ -1,4 +1,4 @@
-package run.halo.app.core.extension.service.impl;
+package run.halo.app.plugin;
 
 import static java.nio.charset.StandardCharsets.UTF_8;
 import static java.util.Objects.requireNonNull;
@@ -57,10 +57,6 @@
 import run.halo.app.infra.SystemVersionSupplier;
 import run.halo.app.infra.exception.PluginAlreadyExistsException;
 import run.halo.app.infra.utils.FileUtils;
-import run.halo.app.plugin.PluginConst;
-import run.halo.app.plugin.PluginsRootGetter;
-import run.halo.app.plugin.SpringPluginManager;
-import run.halo.app.plugin.YamlPluginFinder;
 
 @ExtendWith(MockitoExtension.class)
 class PluginServiceImplTest {
diff --git a/application/src/test/java/run/halo/app/security/DefaultUserDetailServiceTest.java b/application/src/test/java/run/halo/app/security/DefaultUserDetailServiceTest.java
index 123f4362b6..58cc144c24 100644
--- a/application/src/test/java/run/halo/app/security/DefaultUserDetailServiceTest.java
+++ b/application/src/test/java/run/halo/app/security/DefaultUserDetailServiceTest.java
@@ -23,8 +23,8 @@
 import reactor.core.publisher.Mono;
 import reactor.test.StepVerifier;
 import run.halo.app.core.extension.Role;
-import run.halo.app.core.extension.service.RoleService;
-import run.halo.app.core.extension.service.UserService;
+import run.halo.app.core.user.service.RoleService;
+import run.halo.app.core.user.service.UserService;
 import run.halo.app.extension.Metadata;
 import run.halo.app.infra.exception.UserNotFoundException;
 
diff --git a/application/src/test/java/run/halo/app/security/authorization/AuthorizationTest.java b/application/src/test/java/run/halo/app/security/authorization/AuthorizationTest.java
index 23d2e7998a..21a6758d75 100644
--- a/application/src/test/java/run/halo/app/security/authorization/AuthorizationTest.java
+++ b/application/src/test/java/run/halo/app/security/authorization/AuthorizationTest.java
@@ -35,7 +35,7 @@
 import reactor.core.publisher.Mono;
 import run.halo.app.core.extension.Role;
 import run.halo.app.core.extension.Role.PolicyRule;
-import run.halo.app.core.extension.service.RoleService;
+import run.halo.app.core.user.service.RoleService;
 import run.halo.app.extension.ExtensionClient;
 import run.halo.app.extension.Metadata;
 import run.halo.app.infra.AnonymousUserConst;
diff --git a/application/src/test/java/run/halo/app/security/authorization/DefaultRuleResolverTest.java b/application/src/test/java/run/halo/app/security/authorization/DefaultRuleResolverTest.java
index a311bac5de..bc91cd9d1a 100644
--- a/application/src/test/java/run/halo/app/security/authorization/DefaultRuleResolverTest.java
+++ b/application/src/test/java/run/halo/app/security/authorization/DefaultRuleResolverTest.java
@@ -21,7 +21,7 @@
 import reactor.test.StepVerifier;
 import run.halo.app.core.extension.Role;
 import run.halo.app.core.extension.Role.PolicyRule;
-import run.halo.app.core.extension.service.RoleService;
+import run.halo.app.core.user.service.RoleService;
 import run.halo.app.extension.Metadata;
 
 @ExtendWith(MockitoExtension.class)
diff --git a/application/src/test/java/run/halo/app/core/extension/theme/ThemeEndpointTest.java b/application/src/test/java/run/halo/app/theme/endpoint/ThemeEndpointTest.java
similarity index 99%
rename from application/src/test/java/run/halo/app/core/extension/theme/ThemeEndpointTest.java
rename to application/src/test/java/run/halo/app/theme/endpoint/ThemeEndpointTest.java
index 4fc3194bbe..751966ebe8 100644
--- a/application/src/test/java/run/halo/app/core/extension/theme/ThemeEndpointTest.java
+++ b/application/src/test/java/run/halo/app/theme/endpoint/ThemeEndpointTest.java
@@ -1,4 +1,4 @@
-package run.halo.app.core.extension.theme;
+package run.halo.app.theme.endpoint;
 
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.ArgumentMatchers.eq;
@@ -41,6 +41,7 @@
 import run.halo.app.infra.SystemSetting;
 import run.halo.app.infra.ThemeRootGetter;
 import run.halo.app.theme.TemplateEngineManager;
+import run.halo.app.theme.service.ThemeService;
 
 /**
  * Tests for {@link ThemeEndpoint}.
diff --git a/application/src/test/java/run/halo/app/theme/finders/impl/CommentPublicQueryServiceImplTest.java b/application/src/test/java/run/halo/app/theme/finders/impl/CommentPublicQueryServiceImplTest.java
index f1c883340f..0a4a8060d2 100644
--- a/application/src/test/java/run/halo/app/theme/finders/impl/CommentPublicQueryServiceImplTest.java
+++ b/application/src/test/java/run/halo/app/theme/finders/impl/CommentPublicQueryServiceImplTest.java
@@ -24,7 +24,7 @@
 import run.halo.app.core.extension.User;
 import run.halo.app.core.extension.content.Comment;
 import run.halo.app.core.extension.content.Post;
-import run.halo.app.core.extension.service.UserService;
+import run.halo.app.core.user.service.UserService;
 import run.halo.app.extension.GroupVersionKind;
 import run.halo.app.extension.ListResult;
 import run.halo.app.extension.Metadata;
diff --git a/application/src/test/java/run/halo/app/core/extension/theme/ThemeServiceImplTest.java b/application/src/test/java/run/halo/app/theme/service/ThemeServiceImplTest.java
similarity index 99%
rename from application/src/test/java/run/halo/app/core/extension/theme/ThemeServiceImplTest.java
rename to application/src/test/java/run/halo/app/theme/service/ThemeServiceImplTest.java
index 6ef808b8da..184e38a573 100644
--- a/application/src/test/java/run/halo/app/core/extension/theme/ThemeServiceImplTest.java
+++ b/application/src/test/java/run/halo/app/theme/service/ThemeServiceImplTest.java
@@ -1,4 +1,4 @@
-package run.halo.app.core.extension.theme;
+package run.halo.app.theme.service;
 
 import static java.nio.file.Files.createTempDirectory;
 import static org.assertj.core.api.Assertions.assertThat;
diff --git a/application/src/test/java/run/halo/app/webfilter/LocaleChangeWebFilterTest.java b/application/src/test/java/run/halo/app/webfilter/LocaleChangeWebFilterTest.java
index 0ec207fa83..417bc132ec 100644
--- a/application/src/test/java/run/halo/app/webfilter/LocaleChangeWebFilterTest.java
+++ b/application/src/test/java/run/halo/app/webfilter/LocaleChangeWebFilterTest.java
@@ -14,6 +14,7 @@
 import org.springframework.mock.web.server.MockServerWebExchange;
 import org.springframework.web.server.WebFilterChain;
 import reactor.core.publisher.Mono;
+import run.halo.app.infra.webfilter.LocaleChangeWebFilter;
 
 class LocaleChangeWebFilterTest {
 

From dd2080c3aeb1186c4152e83c122d3c6b7efb9caf Mon Sep 17 00:00:00 2001
From: guqing <i@guqing.email>
Date: Tue, 24 Sep 2024 12:10:30 +0800
Subject: [PATCH 034/185] feat: add API to update system config by group

---
 .../core/endpoint/SystemConfigEndpoint.java   | 41 +++++++++++++++++++
 .../extensions/role-template-menu.yaml        |  4 ++
 2 files changed, 45 insertions(+)

diff --git a/application/src/main/java/run/halo/app/core/endpoint/SystemConfigEndpoint.java b/application/src/main/java/run/halo/app/core/endpoint/SystemConfigEndpoint.java
index 57734e3367..d6ceb690f1 100644
--- a/application/src/main/java/run/halo/app/core/endpoint/SystemConfigEndpoint.java
+++ b/application/src/main/java/run/halo/app/core/endpoint/SystemConfigEndpoint.java
@@ -3,26 +3,34 @@
 import static org.springdoc.core.fn.builders.apiresponse.Builder.responseBuilder;
 import static org.springdoc.core.fn.builders.content.Builder.contentBuilder;
 import static org.springdoc.core.fn.builders.parameter.Builder.parameterBuilder;
+import static org.springdoc.core.fn.builders.requestbody.Builder.requestBodyBuilder;
 
 import com.fasterxml.jackson.databind.node.JsonNodeFactory;
 import com.fasterxml.jackson.databind.node.ObjectNode;
 import io.swagger.v3.oas.annotations.enums.ParameterIn;
+import java.time.Duration;
 import lombok.RequiredArgsConstructor;
 import org.springdoc.webflux.core.fn.SpringdocRouteBuilder;
+import org.springframework.dao.OptimisticLockingFailureException;
+import org.springframework.http.HttpStatus;
 import org.springframework.http.MediaType;
 import org.springframework.stereotype.Component;
 import org.springframework.web.reactive.function.server.RouterFunction;
 import org.springframework.web.reactive.function.server.ServerRequest;
 import org.springframework.web.reactive.function.server.ServerResponse;
 import reactor.core.publisher.Mono;
+import reactor.util.retry.Retry;
 import run.halo.app.core.extension.endpoint.CustomEndpoint;
 import run.halo.app.extension.GroupVersion;
+import run.halo.app.extension.ReactiveExtensionClient;
 import run.halo.app.infra.SystemConfigurableEnvironmentFetcher;
+import run.halo.app.infra.utils.JsonUtils;
 
 @Component
 @RequiredArgsConstructor
 public class SystemConfigEndpoint implements CustomEndpoint {
     private final SystemConfigurableEnvironmentFetcher configurableEnvironmentFetcher;
+    private final ReactiveExtensionClient client;
 
     @Override
     public RouterFunction<ServerResponse> endpoint() {
@@ -44,9 +52,42 @@ public RouterFunction<ServerResponse> endpoint() {
                         .description("Group of the system config")
                     )
             )
+            .PUT("/systemconfigs/{group}", this::updateConfigByGroup,
+                builder -> builder.operationId("updateSystemConfigByGroup")
+                    .description("Update system config by group")
+                    .tag(tag)
+                    .parameter(parameterBuilder()
+                        .in(ParameterIn.PATH)
+                        .name("group")
+                        .required(true)
+                        .description("Group of the system config")
+                    )
+                    .requestBody(requestBodyBuilder()
+                        .implementation(ObjectNode.class)
+                    )
+                    .response(responseBuilder()
+                        .responseCode(String.valueOf(HttpStatus.NO_CONTENT))
+                        .implementation(Void.class)
+                    )
+            )
             .build();
     }
 
+    private Mono<ServerResponse> updateConfigByGroup(ServerRequest request) {
+        final var group = request.pathVariable("group");
+        return request.bodyToMono(ObjectNode.class)
+            .flatMap(objectNode -> configurableEnvironmentFetcher.getConfigMap()
+                .flatMap(configMap -> {
+                    var data = configMap.getData();
+                    data.put(group, JsonUtils.objectToJson(objectNode));
+                    return client.update(configMap);
+                })
+            )
+            .retryWhen(Retry.backoff(5, Duration.ofMillis(100))
+                .filter(OptimisticLockingFailureException.class::isInstance))
+            .then(ServerResponse.noContent().build());
+    }
+
     private Mono<ServerResponse> getConfigByGroup(ServerRequest request) {
         final var group = request.pathVariable("group");
         return configurableEnvironmentFetcher.fetch(group, ObjectNode.class)
diff --git a/application/src/main/resources/extensions/role-template-menu.yaml b/application/src/main/resources/extensions/role-template-menu.yaml
index 9ac9608679..a94f33e35b 100644
--- a/application/src/main/resources/extensions/role-template-menu.yaml
+++ b/application/src/main/resources/extensions/role-template-menu.yaml
@@ -14,6 +14,10 @@ rules:
   - apiGroups: [ "" ]
     resources: [ "menus", "menuitems" ]
     verbs: [ "*" ]
+  - apiGroups: [ "console.api.halo.run" ]
+    resources: [ "systemconfigs" ]
+    resourceNames: [ "menu" ]
+    verbs: [ "update" ]
 ---
 apiVersion: v1alpha1
 kind: "Role"

From c945a9443cbf59900a8e945b60719de7b97413c5 Mon Sep 17 00:00:00 2001
From: Ryan Wang <i@ryanc.cc>
Date: Tue, 24 Sep 2024 12:50:25 +0800
Subject: [PATCH 035/185] Refine UI

---
 api-docs/openapi/v3_0/aggregated.json         |  66 +++++
 .../v3_0/apis_console.api_v1alpha1.json       |  66 +++++
 .../interface/menus/components/MenuList.vue   |  42 ++-
 ui/packages/api-client/entry/api-client.ts    |  11 +-
 .../api-client/src/.openapi-generator/FILES   |   1 +
 ui/packages/api-client/src/api.ts             |   1 +
 .../api/system-config-v1alpha1-console-api.ts | 246 ++++++++++++++++++
 7 files changed, 407 insertions(+), 26 deletions(-)
 create mode 100644 ui/packages/api-client/src/api/system-config-v1alpha1-console-api.ts

diff --git a/api-docs/openapi/v3_0/aggregated.json b/api-docs/openapi/v3_0/aggregated.json
index 7006547132..dfdd9790f2 100644
--- a/api-docs/openapi/v3_0/aggregated.json
+++ b/api-docs/openapi/v3_0/aggregated.json
@@ -7434,6 +7434,72 @@
         ]
       }
     },
+    "/apis/console.api.halo.run/v1alpha1/systemconfigs/{group}": {
+      "get": {
+        "description": "Get system config by group",
+        "operationId": "getSystemConfigByGroup",
+        "parameters": [
+          {
+            "description": "Group of the system config",
+            "in": "path",
+            "name": "group",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "default": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "type": "object"
+                }
+              },
+              "application/json": {}
+            },
+            "description": "default response"
+          }
+        },
+        "tags": [
+          "SystemConfigV1alpha1Console"
+        ]
+      },
+      "put": {
+        "description": "Update system config by group",
+        "operationId": "updateSystemConfigByGroup",
+        "parameters": [
+          {
+            "description": "Group of the system config",
+            "in": "path",
+            "name": "group",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "*/*": {
+              "schema": {
+                "type": "object"
+              }
+            }
+          }
+        },
+        "responses": {
+          "204 NO_CONTENT": {
+            "content": {},
+            "description": "default response"
+          }
+        },
+        "tags": [
+          "SystemConfigV1alpha1Console"
+        ]
+      }
+    },
     "/apis/console.api.migration.halo.run/v1alpha1/backup-files": {
       "get": {
         "description": "Get backup files from backup root.",
diff --git a/api-docs/openapi/v3_0/apis_console.api_v1alpha1.json b/api-docs/openapi/v3_0/apis_console.api_v1alpha1.json
index 9ff6d788c3..de0068c621 100644
--- a/api-docs/openapi/v3_0/apis_console.api_v1alpha1.json
+++ b/api-docs/openapi/v3_0/apis_console.api_v1alpha1.json
@@ -3136,6 +3136,72 @@
         ]
       }
     },
+    "/apis/console.api.halo.run/v1alpha1/systemconfigs/{group}": {
+      "get": {
+        "description": "Get system config by group",
+        "operationId": "getSystemConfigByGroup",
+        "parameters": [
+          {
+            "description": "Group of the system config",
+            "in": "path",
+            "name": "group",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "default": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "type": "object"
+                }
+              },
+              "application/json": {}
+            },
+            "description": "default response"
+          }
+        },
+        "tags": [
+          "SystemConfigV1alpha1Console"
+        ]
+      },
+      "put": {
+        "description": "Update system config by group",
+        "operationId": "updateSystemConfigByGroup",
+        "parameters": [
+          {
+            "description": "Group of the system config",
+            "in": "path",
+            "name": "group",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "*/*": {
+              "schema": {
+                "type": "object"
+              }
+            }
+          }
+        },
+        "responses": {
+          "204 NO_CONTENT": {
+            "content": {},
+            "description": "default response"
+          }
+        },
+        "tags": [
+          "SystemConfigV1alpha1Console"
+        ]
+      }
+    },
     "/apis/console.api.migration.halo.run/v1alpha1/backup-files": {
       "get": {
         "description": "Get backup files from backup root.",
diff --git a/ui/console-src/modules/interface/menus/components/MenuList.vue b/ui/console-src/modules/interface/menus/components/MenuList.vue
index cd4fb1e1e2..352ec73b81 100644
--- a/ui/console-src/modules/interface/menus/components/MenuList.vue
+++ b/ui/console-src/modules/interface/menus/components/MenuList.vue
@@ -1,7 +1,7 @@
 <script lang="ts" setup>
 import { usePermission } from "@/utils/permission";
 import type { Menu } from "@halo-dev/api-client";
-import { coreApiClient } from "@halo-dev/api-client";
+import { consoleApiClient, coreApiClient } from "@halo-dev/api-client";
 import {
   Dialog,
   Toast,
@@ -22,6 +22,10 @@ import { onMounted, ref } from "vue";
 import { useI18n } from "vue-i18n";
 import MenuEditingModal from "./MenuEditingModal.vue";
 
+interface SystemMenuConfig {
+  primary: string;
+}
+
 const { currentUserHasPermission } = usePermission();
 const { t } = useI18n();
 
@@ -65,10 +69,10 @@ const {
     }
   },
   refetchInterval(data) {
-    const deletingMenus = data?.filter(
+    const hasDeletingMenu = data?.some(
       (menu) => !!menu.metadata.deletionTimestamp
     );
-    return deletingMenus?.length ? 1000 : false;
+    return hasDeletingMenu ? 1000 : false;
   },
 });
 
@@ -138,35 +142,25 @@ onMounted(async () => {
 const { data: primaryMenuName, refetch: refetchPrimaryMenuName } = useQuery({
   queryKey: ["primary-menu-name"],
   queryFn: async () => {
-    const { data } = await coreApiClient.configMap.getConfigMap({
-      name: "system",
-    });
-
-    if (!data.data?.menu) {
-      return "";
-    }
+    const { data } =
+      await consoleApiClient.configMap.system.getSystemConfigByGroup({
+        group: "menu",
+      });
 
-    const menuConfig = JSON.parse(data.data.menu);
+    const { primary } = (data as SystemMenuConfig) || {};
 
-    return menuConfig.primary;
+    return primary;
   },
 });
 
 const handleSetPrimaryMenu = async (menu: Menu) => {
-  const { data: systemConfigMap } = await coreApiClient.configMap.getConfigMap({
-    name: "system",
+  await consoleApiClient.configMap.system.updateSystemConfigByGroup({
+    group: "menu",
+    body: {
+      primary: menu.metadata.name,
+    },
   });
 
-  if (systemConfigMap.data) {
-    const menuConfigToUpdate = JSON.parse(systemConfigMap.data?.menu || "{}");
-    menuConfigToUpdate.primary = menu.metadata.name;
-    systemConfigMap.data["menu"] = JSON.stringify(menuConfigToUpdate);
-
-    await coreApiClient.configMap.updateConfigMap({
-      name: "system",
-      configMap: systemConfigMap,
-    });
-  }
   await refetchPrimaryMenuName();
 
   Toast.success(t("core.menu.operations.set_primary.toast_success"));
diff --git a/ui/packages/api-client/entry/api-client.ts b/ui/packages/api-client/entry/api-client.ts
index 2b63f9ab53..917a2bc0fd 100644
--- a/ui/packages/api-client/entry/api-client.ts
+++ b/ui/packages/api-client/entry/api-client.ts
@@ -55,6 +55,7 @@ import {
   SnapshotV1alpha1Api,
   SnapshotV1alpha1UcApi,
   SubscriptionV1alpha1Api,
+  SystemConfigV1alpha1ConsoleApi,
   SystemV1alpha1ConsoleApi,
   SystemV1alpha1PublicApi,
   TagV1alpha1Api,
@@ -320,6 +321,13 @@ function createConsoleApiClient(axiosInstance: AxiosInstance) {
     theme: {
       theme: new ThemeV1alpha1ConsoleApi(undefined, baseURL, axiosInstance),
     },
+    configMap: {
+      system: new SystemConfigV1alpha1ConsoleApi(
+        undefined,
+        baseURL,
+        axiosInstance
+      ),
+    },
   };
 }
 
@@ -448,6 +456,5 @@ export {
   createPublicApiClient,
   createUcApiClient,
   defaultPublicApiClient as publicApiClient,
-  defaultUcApiClient as ucApiClient
+  defaultUcApiClient as ucApiClient,
 };
-
diff --git a/ui/packages/api-client/src/.openapi-generator/FILES b/ui/packages/api-client/src/.openapi-generator/FILES
index 0a78264347..ef20b505ae 100644
--- a/ui/packages/api-client/src/.openapi-generator/FILES
+++ b/ui/packages/api-client/src/.openapi-generator/FILES
@@ -65,6 +65,7 @@ api/single-page-v1alpha1-public-api.ts
 api/snapshot-v1alpha1-api.ts
 api/snapshot-v1alpha1-uc-api.ts
 api/subscription-v1alpha1-api.ts
+api/system-config-v1alpha1-console-api.ts
 api/system-v1alpha1-console-api.ts
 api/system-v1alpha1-public-api.ts
 api/tag-v1alpha1-api.ts
diff --git a/ui/packages/api-client/src/api.ts b/ui/packages/api-client/src/api.ts
index a91ddcf6cf..77ff213779 100644
--- a/ui/packages/api-client/src/api.ts
+++ b/ui/packages/api-client/src/api.ts
@@ -77,6 +77,7 @@ export * from './api/single-page-v1alpha1-public-api';
 export * from './api/snapshot-v1alpha1-api';
 export * from './api/snapshot-v1alpha1-uc-api';
 export * from './api/subscription-v1alpha1-api';
+export * from './api/system-config-v1alpha1-console-api';
 export * from './api/system-v1alpha1-console-api';
 export * from './api/system-v1alpha1-public-api';
 export * from './api/tag-v1alpha1-api';
diff --git a/ui/packages/api-client/src/api/system-config-v1alpha1-console-api.ts b/ui/packages/api-client/src/api/system-config-v1alpha1-console-api.ts
new file mode 100644
index 0000000000..edc76f3662
--- /dev/null
+++ b/ui/packages/api-client/src/api/system-config-v1alpha1-console-api.ts
@@ -0,0 +1,246 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * Halo
+ * No description provided (generated by Openapi Generator https://github.com/openapitools/openapi-generator)
+ *
+ * The version of the OpenAPI document: 2.20.0-SNAPSHOT
+ * 
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+
+import type { Configuration } from '../configuration';
+import type { AxiosPromise, AxiosInstance, RawAxiosRequestConfig } from 'axios';
+import globalAxios from 'axios';
+// Some imports not used depending on template conditions
+// @ts-ignore
+import { DUMMY_BASE_URL, assertParamExists, setApiKeyToObject, setBasicAuthToObject, setBearerAuthToObject, setOAuthToObject, setSearchParams, serializeDataIfNeeded, toPathString, createRequestFunction } from '../common';
+// @ts-ignore
+import { BASE_PATH, COLLECTION_FORMATS, RequestArgs, BaseAPI, RequiredError, operationServerMap } from '../base';
+/**
+ * SystemConfigV1alpha1ConsoleApi - axios parameter creator
+ * @export
+ */
+export const SystemConfigV1alpha1ConsoleApiAxiosParamCreator = function (configuration?: Configuration) {
+    return {
+        /**
+         * Get system config by group
+         * @param {string} group Group of the system config
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        getSystemConfigByGroup: async (group: string, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            // verify required parameter 'group' is not null or undefined
+            assertParamExists('getSystemConfigByGroup', 'group', group)
+            const localVarPath = `/apis/console.api.halo.run/v1alpha1/systemconfigs/{group}`
+                .replace(`{${"group"}}`, encodeURIComponent(String(group)));
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+
+            const localVarRequestOptions = { method: 'GET', ...baseOptions, ...options};
+            const localVarHeaderParameter = {} as any;
+            const localVarQueryParameter = {} as any;
+
+            // authentication basicAuth required
+            // http basic authentication required
+            setBasicAuthToObject(localVarRequestOptions, configuration)
+
+            // authentication bearerAuth required
+            // http bearer authentication required
+            await setBearerAuthToObject(localVarHeaderParameter, configuration)
+
+
+    
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
+
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+        /**
+         * Update system config by group
+         * @param {string} group Group of the system config
+         * @param {object} [body] 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        updateSystemConfigByGroup: async (group: string, body?: object, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            // verify required parameter 'group' is not null or undefined
+            assertParamExists('updateSystemConfigByGroup', 'group', group)
+            const localVarPath = `/apis/console.api.halo.run/v1alpha1/systemconfigs/{group}`
+                .replace(`{${"group"}}`, encodeURIComponent(String(group)));
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+
+            const localVarRequestOptions = { method: 'PUT', ...baseOptions, ...options};
+            const localVarHeaderParameter = {} as any;
+            const localVarQueryParameter = {} as any;
+
+            // authentication basicAuth required
+            // http basic authentication required
+            setBasicAuthToObject(localVarRequestOptions, configuration)
+
+            // authentication bearerAuth required
+            // http bearer authentication required
+            await setBearerAuthToObject(localVarHeaderParameter, configuration)
+
+
+    
+            localVarHeaderParameter['Content-Type'] = 'application/json';
+
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
+            localVarRequestOptions.data = serializeDataIfNeeded(body, localVarRequestOptions, configuration)
+
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+    }
+};
+
+/**
+ * SystemConfigV1alpha1ConsoleApi - functional programming interface
+ * @export
+ */
+export const SystemConfigV1alpha1ConsoleApiFp = function(configuration?: Configuration) {
+    const localVarAxiosParamCreator = SystemConfigV1alpha1ConsoleApiAxiosParamCreator(configuration)
+    return {
+        /**
+         * Get system config by group
+         * @param {string} group Group of the system config
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async getSystemConfigByGroup(group: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<object>> {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.getSystemConfigByGroup(group, options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['SystemConfigV1alpha1ConsoleApi.getSystemConfigByGroup']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
+        /**
+         * Update system config by group
+         * @param {string} group Group of the system config
+         * @param {object} [body] 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async updateSystemConfigByGroup(group: string, body?: object, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<void>> {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.updateSystemConfigByGroup(group, body, options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['SystemConfigV1alpha1ConsoleApi.updateSystemConfigByGroup']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
+    }
+};
+
+/**
+ * SystemConfigV1alpha1ConsoleApi - factory interface
+ * @export
+ */
+export const SystemConfigV1alpha1ConsoleApiFactory = function (configuration?: Configuration, basePath?: string, axios?: AxiosInstance) {
+    const localVarFp = SystemConfigV1alpha1ConsoleApiFp(configuration)
+    return {
+        /**
+         * Get system config by group
+         * @param {SystemConfigV1alpha1ConsoleApiGetSystemConfigByGroupRequest} requestParameters Request parameters.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        getSystemConfigByGroup(requestParameters: SystemConfigV1alpha1ConsoleApiGetSystemConfigByGroupRequest, options?: RawAxiosRequestConfig): AxiosPromise<object> {
+            return localVarFp.getSystemConfigByGroup(requestParameters.group, options).then((request) => request(axios, basePath));
+        },
+        /**
+         * Update system config by group
+         * @param {SystemConfigV1alpha1ConsoleApiUpdateSystemConfigByGroupRequest} requestParameters Request parameters.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        updateSystemConfigByGroup(requestParameters: SystemConfigV1alpha1ConsoleApiUpdateSystemConfigByGroupRequest, options?: RawAxiosRequestConfig): AxiosPromise<void> {
+            return localVarFp.updateSystemConfigByGroup(requestParameters.group, requestParameters.body, options).then((request) => request(axios, basePath));
+        },
+    };
+};
+
+/**
+ * Request parameters for getSystemConfigByGroup operation in SystemConfigV1alpha1ConsoleApi.
+ * @export
+ * @interface SystemConfigV1alpha1ConsoleApiGetSystemConfigByGroupRequest
+ */
+export interface SystemConfigV1alpha1ConsoleApiGetSystemConfigByGroupRequest {
+    /**
+     * Group of the system config
+     * @type {string}
+     * @memberof SystemConfigV1alpha1ConsoleApiGetSystemConfigByGroup
+     */
+    readonly group: string
+}
+
+/**
+ * Request parameters for updateSystemConfigByGroup operation in SystemConfigV1alpha1ConsoleApi.
+ * @export
+ * @interface SystemConfigV1alpha1ConsoleApiUpdateSystemConfigByGroupRequest
+ */
+export interface SystemConfigV1alpha1ConsoleApiUpdateSystemConfigByGroupRequest {
+    /**
+     * Group of the system config
+     * @type {string}
+     * @memberof SystemConfigV1alpha1ConsoleApiUpdateSystemConfigByGroup
+     */
+    readonly group: string
+
+    /**
+     * 
+     * @type {object}
+     * @memberof SystemConfigV1alpha1ConsoleApiUpdateSystemConfigByGroup
+     */
+    readonly body?: object
+}
+
+/**
+ * SystemConfigV1alpha1ConsoleApi - object-oriented interface
+ * @export
+ * @class SystemConfigV1alpha1ConsoleApi
+ * @extends {BaseAPI}
+ */
+export class SystemConfigV1alpha1ConsoleApi extends BaseAPI {
+    /**
+     * Get system config by group
+     * @param {SystemConfigV1alpha1ConsoleApiGetSystemConfigByGroupRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof SystemConfigV1alpha1ConsoleApi
+     */
+    public getSystemConfigByGroup(requestParameters: SystemConfigV1alpha1ConsoleApiGetSystemConfigByGroupRequest, options?: RawAxiosRequestConfig) {
+        return SystemConfigV1alpha1ConsoleApiFp(this.configuration).getSystemConfigByGroup(requestParameters.group, options).then((request) => request(this.axios, this.basePath));
+    }
+
+    /**
+     * Update system config by group
+     * @param {SystemConfigV1alpha1ConsoleApiUpdateSystemConfigByGroupRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof SystemConfigV1alpha1ConsoleApi
+     */
+    public updateSystemConfigByGroup(requestParameters: SystemConfigV1alpha1ConsoleApiUpdateSystemConfigByGroupRequest, options?: RawAxiosRequestConfig) {
+        return SystemConfigV1alpha1ConsoleApiFp(this.configuration).updateSystemConfigByGroup(requestParameters.group, requestParameters.body, options).then((request) => request(this.axios, this.basePath));
+    }
+}
+

From 035207b8dbe3683eec59a4a803ab2b5939062231 Mon Sep 17 00:00:00 2001
From: Ryan Wang <i@ryanc.cc>
Date: Tue, 24 Sep 2024 14:57:20 +0800
Subject: [PATCH 036/185] chore: remove unused code related to system configMap
 (#6695)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/area ui
/kind cleanup
/milestone 2.20.x

#### What this PR does / why we need it:

清理 UI 中关于获取 system configmap 的无用代码，目前观察到已经没有任何地方在使用这个数据。

#### Does this PR introduce a user-facing change?

```release-note
None
```
---
 ui/console-src/main.ts                        |  5 ----
 .../modules/system/settings/tabs/Setting.vue  |  5 +---
 ui/console-src/stores/system-configmap.ts     | 29 -------------------
 3 files changed, 1 insertion(+), 38 deletions(-)
 delete mode 100644 ui/console-src/stores/system-configmap.ts

diff --git a/ui/console-src/main.ts b/ui/console-src/main.ts
index 5c5c7e5668..e05d17c4d2 100644
--- a/ui/console-src/main.ts
+++ b/ui/console-src/main.ts
@@ -19,7 +19,6 @@ import {
   setupCoreModules,
   setupPluginModules,
 } from "@console/setup/setupModules";
-import { useSystemConfigMapStore } from "@console/stores/system-configmap";
 import { useThemeStore } from "@console/stores/theme";
 
 const app = createApp(App);
@@ -97,10 +96,6 @@ async function initApp() {
       console.error("Failed to load plugins", e);
     }
 
-    // load system configMap
-    const systemConfigMapStore = useSystemConfigMapStore();
-    await systemConfigMapStore.fetchSystemConfigMap();
-
     if (globalInfoStore.globalInfo?.userInitialized) {
       await loadActivatedTheme();
     }
diff --git a/ui/console-src/modules/system/settings/tabs/Setting.vue b/ui/console-src/modules/system/settings/tabs/Setting.vue
index a897b1170a..e2df8c1fbf 100644
--- a/ui/console-src/modules/system/settings/tabs/Setting.vue
+++ b/ui/console-src/modules/system/settings/tabs/Setting.vue
@@ -9,7 +9,6 @@ import { Toast, VButton } from "@halo-dev/components";
 // hooks
 import { useGlobalInfoStore } from "@/stores/global-info";
 import { useSettingFormConvert } from "@console/composables/use-setting-form";
-import { useSystemConfigMapStore } from "@console/stores/system-configmap";
 import type { ConfigMap, Setting } from "@halo-dev/api-client";
 import { coreApiClient } from "@halo-dev/api-client";
 import { useQuery, useQueryClient } from "@tanstack/vue-query";
@@ -18,7 +17,6 @@ import { useI18n } from "vue-i18n";
 const SYSTEM_CONFIGMAP_NAME = "system";
 
 const { t } = useI18n();
-const systemConfigMapStore = useSystemConfigMapStore();
 const queryClient = useQueryClient();
 
 const group = inject<Ref<string>>("activeTab", ref("basic"));
@@ -52,7 +50,7 @@ const handleSaveConfigMap = async () => {
     return;
   }
 
-  const { data } = await coreApiClient.configMap.updateConfigMap({
+  await coreApiClient.configMap.updateConfigMap({
     name: SYSTEM_CONFIGMAP_NAME,
     configMap: configMapToUpdate,
   });
@@ -61,7 +59,6 @@ const handleSaveConfigMap = async () => {
 
   queryClient.invalidateQueries({ queryKey: ["system-configMap"] });
   await useGlobalInfoStore().fetchGlobalInfo();
-  systemConfigMapStore.configMap = data;
 
   saving.value = false;
 };
diff --git a/ui/console-src/stores/system-configmap.ts b/ui/console-src/stores/system-configmap.ts
deleted file mode 100644
index 18ed50c5e9..0000000000
--- a/ui/console-src/stores/system-configmap.ts
+++ /dev/null
@@ -1,29 +0,0 @@
-import type { ConfigMap } from "@halo-dev/api-client";
-import { coreApiClient } from "@halo-dev/api-client";
-import { defineStore } from "pinia";
-
-interface SystemConfigMapState {
-  configMap?: ConfigMap;
-}
-
-export const useSystemConfigMapStore = defineStore({
-  id: "system-configmap",
-  state: (): SystemConfigMapState => ({
-    configMap: undefined,
-  }),
-  actions: {
-    async fetchSystemConfigMap() {
-      try {
-        const { data } = await coreApiClient.configMap.getConfigMap(
-          {
-            name: "system",
-          },
-          { mute: true }
-        );
-        this.configMap = data;
-      } catch (error) {
-        console.error("Failed to fetch system configMap", error);
-      }
-    },
-  },
-});

From 86b95ccfd031fd6a3f42654020c6fc7edc191fff Mon Sep 17 00:00:00 2001
From: John Niang <johnniang@foxmail.com>
Date: Tue, 24 Sep 2024 15:01:22 +0800
Subject: [PATCH 037/185] Upgrade to Spring Boot 3.4.0-M3 (#6687)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/kind cleanup
/area core
/milestone 2.20.x

#### What this PR does / why we need it:

This PR upgrades to [Spring Boot 3.4.0-M3](https://github.com/spring-projects/spring-boot/releases/tag/v3.4.0-M3).

1. Fix the compilation error of OptimalPropertyAccess because the class has been privated in [this commit](https://github.com/spring-projects/spring-framework/commit/b4315940212b8e955215ffe09bafde228daa6eac).
2. Fix exception `org.mockito.exceptions.misusing.UnnecessaryStubbingException` for some unit tests after upgrading.
3. Replace deprecated annotations `@MockBean` and `@SpyBean` with `@MockitoBean` and `@MockitoSpyBean` respectively.

#### Does this PR introduce a user-facing change?

```release-note
升级 Spring Boot 至 3.4.0-M3
```
---
 .../dialect/EvaluationContextEnhancer.java    |  3 +-
 .../config/ExtensionConfigurationTest.java    |  4 +-
 .../halo/app/config/WebFluxConfigTest.java    |  4 +-
 .../content/CategoryPostCountUpdaterTest.java |  4 +-
 .../app/content/PostIntegrationTests.java     |  4 +-
 .../CommentServiceImplIntegrationTest.java    |  6 +-
 .../comment/CommentServiceImplTest.java       | 65 ++++++++-----------
 .../ReplyServiceImplIntegrationTest.java      |  6 +-
 .../console/EmailVerificationCodeTest.java    | 48 ++++++++------
 .../console/UserEndpointIntegrationTest.java  |  4 +-
 ...ltPluginApplicationContextFactoryTest.java |  4 +-
 .../app/plugin/DefaultSettingFetcherTest.java |  4 +-
 .../security/AuthProviderServiceImplTest.java | 19 +++---
 .../security/SuperAdminInitializerTest.java   |  4 +-
 .../authorization/AuthorizationTest.java      |  8 +--
 .../halo/app/theme/ThemeIntegrationTest.java  |  4 +-
 .../halo/app/theme/ViewNameResolverTest.java  | 26 ++++----
 .../dialect/GeneratorMetaProcessorTest.java   |  6 +-
 .../CommentPublicQueryServiceImplTest.java    | 12 ++--
 .../ThemeMessageResolverIntegrationTest.java  |  6 +-
 .../router/PreviewRouterFunctionTest.java     | 35 ++++++----
 build.gradle                                  |  2 +-
 22 files changed, 140 insertions(+), 138 deletions(-)

diff --git a/application/src/main/java/run/halo/app/theme/dialect/EvaluationContextEnhancer.java b/application/src/main/java/run/halo/app/theme/dialect/EvaluationContextEnhancer.java
index 2d01e48b65..36a390d379 100644
--- a/application/src/main/java/run/halo/app/theme/dialect/EvaluationContextEnhancer.java
+++ b/application/src/main/java/run/halo/app/theme/dialect/EvaluationContextEnhancer.java
@@ -12,6 +12,7 @@
 import org.springframework.expression.MethodResolver;
 import org.springframework.expression.PropertyAccessor;
 import org.springframework.expression.TypedValue;
+import org.springframework.expression.spel.CompilablePropertyAccessor;
 import org.springframework.expression.spel.support.ReflectivePropertyAccessor;
 import org.springframework.integration.json.JsonPropertyAccessor;
 import org.springframework.lang.Nullable;
@@ -122,7 +123,7 @@ public Class<?>[] getSpecificTargetClasses() {
         public PropertyAccessor createOptimalAccessor(EvaluationContext context, Object target,
             String name) {
             var optimalAccessor = delegate.createOptimalAccessor(context, target, name);
-            if (optimalAccessor instanceof OptimalPropertyAccessor optimalPropertyAccessor) {
+            if (optimalAccessor instanceof CompilablePropertyAccessor optimalPropertyAccessor) {
                 if (ReactiveUtils.isReactiveType(optimalPropertyAccessor.getPropertyType())) {
                     return this;
                 }
diff --git a/application/src/test/java/run/halo/app/config/ExtensionConfigurationTest.java b/application/src/test/java/run/halo/app/config/ExtensionConfigurationTest.java
index 9cc8a81408..3c3078fc41 100644
--- a/application/src/test/java/run/halo/app/config/ExtensionConfigurationTest.java
+++ b/application/src/test/java/run/halo/app/config/ExtensionConfigurationTest.java
@@ -19,10 +19,10 @@
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.boot.test.autoconfigure.web.reactive.AutoConfigureWebTestClient;
 import org.springframework.boot.test.context.SpringBootTest;
-import org.springframework.boot.test.mock.mockito.MockBean;
 import org.springframework.http.MediaType;
 import org.springframework.security.test.context.support.WithMockUser;
 import org.springframework.test.annotation.DirtiesContext;
+import org.springframework.test.context.bean.override.mockito.MockitoBean;
 import org.springframework.test.web.reactive.server.WebTestClient;
 import reactor.core.publisher.Flux;
 import run.halo.app.core.extension.Role;
@@ -47,7 +47,7 @@ class ExtensionConfigurationTest {
     @Autowired
     SchemeManager schemeManager;
 
-    @MockBean
+    @MockitoBean
     RoleService roleService;
 
     @BeforeEach
diff --git a/application/src/test/java/run/halo/app/config/WebFluxConfigTest.java b/application/src/test/java/run/halo/app/config/WebFluxConfigTest.java
index 70f2db955c..40030c6432 100644
--- a/application/src/test/java/run/halo/app/config/WebFluxConfigTest.java
+++ b/application/src/test/java/run/halo/app/config/WebFluxConfigTest.java
@@ -13,10 +13,10 @@
 import org.springframework.boot.test.autoconfigure.web.reactive.AutoConfigureWebTestClient;
 import org.springframework.boot.test.context.SpringBootTest;
 import org.springframework.boot.test.context.TestConfiguration;
-import org.springframework.boot.test.mock.mockito.SpyBean;
 import org.springframework.boot.test.web.server.LocalServerPort;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Import;
+import org.springframework.test.context.bean.override.mockito.MockitoSpyBean;
 import org.springframework.test.web.reactive.server.WebTestClient;
 import org.springframework.web.reactive.socket.WebSocketHandler;
 import org.springframework.web.reactive.socket.WebSocketMessage;
@@ -38,7 +38,7 @@ class WebFluxConfigTest {
     @Autowired
     WebTestClient webClient;
 
-    @SpyBean
+    @MockitoSpyBean
     RoleService roleService;
 
     @LocalServerPort
diff --git a/application/src/test/java/run/halo/app/content/CategoryPostCountUpdaterTest.java b/application/src/test/java/run/halo/app/content/CategoryPostCountUpdaterTest.java
index 8b0fab57cd..7ee6fae5b1 100644
--- a/application/src/test/java/run/halo/app/content/CategoryPostCountUpdaterTest.java
+++ b/application/src/test/java/run/halo/app/content/CategoryPostCountUpdaterTest.java
@@ -12,8 +12,8 @@
 import org.mockito.ArgumentCaptor;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.boot.test.context.SpringBootTest;
-import org.springframework.boot.test.mock.mockito.SpyBean;
 import org.springframework.test.annotation.DirtiesContext;
+import org.springframework.test.context.bean.override.mockito.MockitoSpyBean;
 import reactor.core.publisher.Flux;
 import reactor.core.publisher.Mono;
 import reactor.test.StepVerifier;
@@ -46,7 +46,7 @@ class CategoryPostCountServiceIntegrationTest {
         @Autowired
         private SchemeManager schemeManager;
 
-        @SpyBean
+        @MockitoSpyBean
         private ExtensionClient client;
 
         @Autowired
diff --git a/application/src/test/java/run/halo/app/content/PostIntegrationTests.java b/application/src/test/java/run/halo/app/content/PostIntegrationTests.java
index 6eb47e1c4f..76e301d35a 100644
--- a/application/src/test/java/run/halo/app/content/PostIntegrationTests.java
+++ b/application/src/test/java/run/halo/app/content/PostIntegrationTests.java
@@ -12,9 +12,9 @@
 import org.springframework.boot.test.autoconfigure.jdbc.AutoConfigureTestDatabase;
 import org.springframework.boot.test.autoconfigure.web.reactive.AutoConfigureWebTestClient;
 import org.springframework.boot.test.context.SpringBootTest;
-import org.springframework.boot.test.mock.mockito.MockBean;
 import org.springframework.http.MediaType;
 import org.springframework.security.test.context.support.WithMockUser;
+import org.springframework.test.context.bean.override.mockito.MockitoBean;
 import org.springframework.test.web.reactive.server.WebTestClient;
 import reactor.core.publisher.Flux;
 import run.halo.app.core.extension.Role;
@@ -39,7 +39,7 @@ public class PostIntegrationTests {
     @Autowired
     private WebTestClient webTestClient;
 
-    @MockBean
+    @MockitoBean
     RoleService roleService;
 
     @BeforeEach
diff --git a/application/src/test/java/run/halo/app/content/comment/CommentServiceImplIntegrationTest.java b/application/src/test/java/run/halo/app/content/comment/CommentServiceImplIntegrationTest.java
index 0b16005515..ce77779e07 100644
--- a/application/src/test/java/run/halo/app/content/comment/CommentServiceImplIntegrationTest.java
+++ b/application/src/test/java/run/halo/app/content/comment/CommentServiceImplIntegrationTest.java
@@ -14,8 +14,8 @@
 import org.junit.jupiter.api.Test;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.boot.test.context.SpringBootTest;
-import org.springframework.boot.test.mock.mockito.SpyBean;
 import org.springframework.test.annotation.DirtiesContext;
+import org.springframework.test.context.bean.override.mockito.MockitoSpyBean;
 import reactor.core.publisher.Flux;
 import reactor.core.publisher.Mono;
 import reactor.test.StepVerifier;
@@ -48,7 +48,7 @@ class CommentRemoveTest {
         @Autowired
         private SchemeManager schemeManager;
 
-        @SpyBean
+        @MockitoSpyBean
         private ReactiveExtensionClient reactiveClient;
 
         @Autowired
@@ -57,7 +57,7 @@ class CommentRemoveTest {
         @Autowired
         private IndexerFactory indexerFactory;
 
-        @SpyBean
+        @MockitoSpyBean
         private CommentServiceImpl commentService;
 
         Mono<Extension> deleteImmediately(Extension extension) {
diff --git a/application/src/test/java/run/halo/app/content/comment/CommentServiceImplTest.java b/application/src/test/java/run/halo/app/content/comment/CommentServiceImplTest.java
index 3e706594da..f9a2f0bbb6 100644
--- a/application/src/test/java/run/halo/app/content/comment/CommentServiceImplTest.java
+++ b/application/src/test/java/run/halo/app/content/comment/CommentServiceImplTest.java
@@ -2,7 +2,6 @@
 
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.ArgumentMatchers.eq;
-import static org.mockito.Mockito.lenient;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.times;
 import static org.mockito.Mockito.verify;
@@ -12,7 +11,6 @@
 import java.util.Map;
 import java.util.Set;
 import org.json.JSONException;
-import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.ExtendWith;
 import org.mockito.ArgumentCaptor;
@@ -61,53 +59,25 @@
 class CommentServiceImplTest {
 
     @Mock
-    private SystemConfigurableEnvironmentFetcher environmentFetcher;
+    SystemConfigurableEnvironmentFetcher environmentFetcher;
 
     @Mock
-    private ReactiveExtensionClient client;
+    ReactiveExtensionClient client;
 
     @Mock
-    private UserService userService;
+    UserService userService;
 
     @Mock
-    private RoleService roleService;
+    RoleService roleService;
 
     @Mock
-    private ExtensionGetter extensionGetter;
+    ExtensionGetter extensionGetter;
 
     @InjectMocks
-    private CommentServiceImpl commentService;
+    CommentServiceImpl commentService;
 
     @Mock
-    private CounterService counterService;
-
-    @BeforeEach
-    void setUp() {
-        SystemSetting.Comment commentSetting = getCommentSetting();
-        lenient().when(environmentFetcher.fetchComment()).thenReturn(Mono.just(commentSetting));
-
-        ListResult<Comment> comments = new ListResult<>(1, 10, 3, comments());
-        when(client.listBy(eq(Comment.class), any(ListOptions.class), any(PageRequest.class)))
-            .thenReturn(Mono.just(comments));
-
-        when(userService.getUserOrGhost(eq("A-owner")))
-            .thenReturn(Mono.just(createUser("A-owner")));
-        when(userService.getUserOrGhost(eq("B-owner")))
-            .thenReturn(Mono.just(createUser("B-owner")));
-        when(client.fetch(eq(User.class), eq("C-owner")))
-            .thenReturn(Mono.empty());
-
-        when(roleService.contains(Set.of("USER"),
-            Set.of(AuthorityUtils.COMMENT_MANAGEMENT_ROLE_NAME)))
-            .thenReturn(Mono.just(false));
-
-        PostCommentSubject postCommentSubject = Mockito.mock(PostCommentSubject.class);
-        when(extensionGetter.getExtensions(CommentSubject.class))
-            .thenReturn(Flux.just(postCommentSubject));
-
-        when(postCommentSubject.supports(any())).thenReturn(true);
-        when(postCommentSubject.get(eq("fake-post"))).thenReturn(Mono.just(post()));
-    }
+    CounterService counterService;
 
     private static User createUser(String name) {
         User user = new User();
@@ -122,10 +92,21 @@ private static User createUser(String name) {
 
     @Test
     void listComment() {
+        var comments = new ListResult<Comment>(1, 10, 3, comments());
+        when(client.listBy(eq(Comment.class), any(ListOptions.class), any(PageRequest.class)))
+            .thenReturn(Mono.just(comments));
+
+        PostCommentSubject postCommentSubject = Mockito.mock(PostCommentSubject.class);
+        when(extensionGetter.getExtensions(CommentSubject.class))
+            .thenReturn(Flux.just(postCommentSubject));
+
+        when(postCommentSubject.supports(any())).thenReturn(true);
+        when(postCommentSubject.get(eq("fake-post"))).thenReturn(Mono.just(post()));
+
         when(userService.getUserOrGhost(any()))
             .thenReturn(Mono.just(ghostUser()));
-        when(userService.getUserOrGhost("A-owner"))
-            .thenReturn(Mono.just(createUser("A-owner")));
+        // when(userService.getUserOrGhost("A-owner"))
+        //     .thenReturn(Mono.just(createUser("A-owner")));
         when(userService.getUserOrGhost("B-owner"))
             .thenReturn(Mono.just(createUser("B-owner")));
 
@@ -170,6 +151,12 @@ void listComment() {
     @Test
     @WithMockUser(username = "B-owner")
     void create() throws JSONException {
+        var commentSetting = getCommentSetting();
+        when(environmentFetcher.fetchComment()).thenReturn(Mono.just(commentSetting));
+        when(roleService.contains(Set.of("USER"),
+            Set.of(AuthorityUtils.COMMENT_MANAGEMENT_ROLE_NAME)))
+            .thenReturn(Mono.just(false));
+
         CommentRequest commentRequest = new CommentRequest();
         commentRequest.setRaw("fake-raw");
         commentRequest.setContent("fake-content");
diff --git a/application/src/test/java/run/halo/app/content/comment/ReplyServiceImplIntegrationTest.java b/application/src/test/java/run/halo/app/content/comment/ReplyServiceImplIntegrationTest.java
index c2365bdf7a..01c4c435c7 100644
--- a/application/src/test/java/run/halo/app/content/comment/ReplyServiceImplIntegrationTest.java
+++ b/application/src/test/java/run/halo/app/content/comment/ReplyServiceImplIntegrationTest.java
@@ -14,8 +14,8 @@
 import org.junit.jupiter.api.Test;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.boot.test.context.SpringBootTest;
-import org.springframework.boot.test.mock.mockito.SpyBean;
 import org.springframework.test.annotation.DirtiesContext;
+import org.springframework.test.context.bean.override.mockito.MockitoSpyBean;
 import reactor.core.publisher.Flux;
 import reactor.core.publisher.Mono;
 import reactor.test.StepVerifier;
@@ -56,7 +56,7 @@ private List<Reply> createReplies(int size) {
         @Autowired
         private SchemeManager schemeManager;
 
-        @SpyBean
+        @MockitoSpyBean
         private ReactiveExtensionClient reactiveClient;
 
         @Autowired
@@ -65,7 +65,7 @@ private List<Reply> createReplies(int size) {
         @Autowired
         private IndexerFactory indexerFactory;
 
-        @SpyBean
+        @MockitoSpyBean
         private ReplyServiceImpl replyService;
 
         Mono<Extension> deleteImmediately(Extension extension) {
diff --git a/application/src/test/java/run/halo/app/core/endpoint/console/EmailVerificationCodeTest.java b/application/src/test/java/run/halo/app/core/endpoint/console/EmailVerificationCodeTest.java
index 683e6552c2..e5691d09c3 100644
--- a/application/src/test/java/run/halo/app/core/endpoint/console/EmailVerificationCodeTest.java
+++ b/application/src/test/java/run/halo/app/core/endpoint/console/EmailVerificationCodeTest.java
@@ -1,15 +1,11 @@
 package run.halo.app.core.endpoint.console;
 
 import static org.mockito.ArgumentMatchers.anyString;
-import static org.mockito.ArgumentMatchers.eq;
-import static org.mockito.Mockito.doReturn;
-import static org.mockito.Mockito.spy;
 import static org.mockito.Mockito.when;
-import static org.springframework.security.test.web.reactive.server.SecurityMockServerConfigurers.csrf;
+import static org.springframework.security.test.web.reactive.server.SecurityMockServerConfigurers.springSecurity;
 
 import io.github.resilience4j.ratelimiter.RateLimiterConfig;
 import io.github.resilience4j.ratelimiter.RateLimiterRegistry;
-import io.github.resilience4j.reactor.ratelimiter.operator.RateLimiterOperator;
 import java.time.Duration;
 import java.util.Map;
 import org.junit.jupiter.api.BeforeEach;
@@ -39,47 +35,49 @@
 @ExtendWith(SpringExtension.class)
 @WithMockUser(username = "fake-user", password = "fake-password")
 class EmailVerificationCodeTest {
+
     WebTestClient webClient;
+
     @Mock
     ReactiveExtensionClient client;
+
     @Mock
     EmailVerificationService emailVerificationService;
 
     @Mock
     UserService userService;
 
+    @Mock
+    RateLimiterRegistry rateLimiterRegistry;
+
     @InjectMocks
     UserEndpoint endpoint;
 
     @BeforeEach
     void setUp() {
-        var spyUserEndpoint = spy(endpoint);
+        webClient = WebTestClient.bindToRouterFunction(endpoint.endpoint())
+            .apply(springSecurity())
+            .build();
+    }
+
+    @Test
+    void sendEmailVerificationCode() {
         var config = RateLimiterConfig.custom()
             .limitRefreshPeriod(Duration.ofSeconds(10))
             .limitForPeriod(1)
             .build();
         var sendCodeRateLimiter = RateLimiterRegistry.of(config)
             .rateLimiter("send-email-verification-code-fake-user:hi@halo.run");
-        doReturn(RateLimiterOperator.of(sendCodeRateLimiter)).when(spyUserEndpoint)
-            .sendEmailVerificationCodeRateLimiter(eq("fake-user"), eq("hi@halo.run"));
-
-        var verifyEmailRateLimiter = RateLimiterRegistry.of(config)
-            .rateLimiter("verify-email-fake-user");
-        doReturn(RateLimiterOperator.of(verifyEmailRateLimiter)).when(spyUserEndpoint)
-            .verificationEmailRateLimiter(eq("fake-user"));
+        when(rateLimiterRegistry.rateLimiter(
+            "send-email-verification-code-fake-user:hi@halo.run",
+            "send-email-verification-code")
+        ).thenReturn(sendCodeRateLimiter);
 
-        webClient = WebTestClient.bindToRouterFunction(spyUserEndpoint.endpoint()).build()
-            .mutateWith(csrf());
-    }
-
-    @Test
-    void sendEmailVerificationCode() {
         var user = new User();
         user.setMetadata(new Metadata());
         user.getMetadata().setName("fake-user");
         user.setSpec(new User.UserSpec());
         user.getSpec().setEmail("hi@halo.run");
-        when(client.get(eq(User.class), eq("fake-user"))).thenReturn(Mono.just(user));
         when(emailVerificationService.sendVerificationCode(anyString(), anyString()))
             .thenReturn(Mono.empty());
         webClient.post()
@@ -100,6 +98,16 @@ void sendEmailVerificationCode() {
 
     @Test
     void verifyEmail() {
+        var config = RateLimiterConfig.custom()
+            .limitRefreshPeriod(Duration.ofSeconds(10))
+            .limitForPeriod(1)
+            .build();
+
+        var verifyEmailRateLimiter = RateLimiterRegistry.of(config)
+            .rateLimiter("verify-email-fake-user");
+        when(rateLimiterRegistry.rateLimiter("verify-email-fake-user", "verify-email"))
+            .thenReturn(verifyEmailRateLimiter);
+
         when(emailVerificationService.verify(anyString(), anyString()))
             .thenReturn(Mono.empty());
         when(userService.confirmPassword(anyString(), anyString()))
diff --git a/application/src/test/java/run/halo/app/core/endpoint/console/UserEndpointIntegrationTest.java b/application/src/test/java/run/halo/app/core/endpoint/console/UserEndpointIntegrationTest.java
index 29cfae3242..db061b28e4 100644
--- a/application/src/test/java/run/halo/app/core/endpoint/console/UserEndpointIntegrationTest.java
+++ b/application/src/test/java/run/halo/app/core/endpoint/console/UserEndpointIntegrationTest.java
@@ -14,9 +14,9 @@
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.boot.test.autoconfigure.web.reactive.AutoConfigureWebTestClient;
 import org.springframework.boot.test.context.SpringBootTest;
-import org.springframework.boot.test.mock.mockito.MockBean;
 import org.springframework.security.test.context.support.WithMockUser;
 import org.springframework.test.annotation.DirtiesContext;
+import org.springframework.test.context.bean.override.mockito.MockitoBean;
 import org.springframework.test.web.reactive.server.WebTestClient;
 import reactor.core.publisher.Flux;
 import reactor.core.publisher.Mono;
@@ -37,7 +37,7 @@ public class UserEndpointIntegrationTest {
     @Autowired
     ReactiveExtensionClient client;
 
-    @MockBean
+    @MockitoBean
     RoleService roleService;
 
     @BeforeEach
diff --git a/application/src/test/java/run/halo/app/plugin/DefaultPluginApplicationContextFactoryTest.java b/application/src/test/java/run/halo/app/plugin/DefaultPluginApplicationContextFactoryTest.java
index 0f37a595ea..bf2e4a494a 100644
--- a/application/src/test/java/run/halo/app/plugin/DefaultPluginApplicationContextFactoryTest.java
+++ b/application/src/test/java/run/halo/app/plugin/DefaultPluginApplicationContextFactoryTest.java
@@ -9,13 +9,13 @@
 import org.junit.jupiter.api.Test;
 import org.pf4j.PluginWrapper;
 import org.springframework.boot.test.context.SpringBootTest;
-import org.springframework.boot.test.mock.mockito.SpyBean;
+import org.springframework.test.context.bean.override.mockito.MockitoSpyBean;
 import run.halo.app.search.SearchService;
 
 @SpringBootTest
 class DefaultPluginApplicationContextFactoryTest {
 
-    @SpyBean
+    @MockitoSpyBean
     SpringPluginManager pluginManager;
 
     DefaultPluginApplicationContextFactory factory;
diff --git a/application/src/test/java/run/halo/app/plugin/DefaultSettingFetcherTest.java b/application/src/test/java/run/halo/app/plugin/DefaultSettingFetcherTest.java
index 5e7f0d2ee0..2a70af35b7 100644
--- a/application/src/test/java/run/halo/app/plugin/DefaultSettingFetcherTest.java
+++ b/application/src/test/java/run/halo/app/plugin/DefaultSettingFetcherTest.java
@@ -23,11 +23,11 @@
 import org.mockito.Spy;
 import org.mockito.junit.jupiter.MockitoExtension;
 import org.skyscreamer.jsonassert.JSONAssert;
-import org.springframework.boot.test.mock.mockito.MockBean;
 import org.springframework.cache.Cache;
 import org.springframework.cache.CacheManager;
 import org.springframework.cache.concurrent.ConcurrentMapCache;
 import org.springframework.context.ApplicationContext;
+import org.springframework.test.context.bean.override.mockito.MockitoBean;
 import reactor.core.publisher.Mono;
 import run.halo.app.core.extension.Plugin;
 import run.halo.app.extension.ConfigMap;
@@ -55,7 +55,7 @@ class DefaultSettingFetcherTest {
     @Mock
     private CacheManager cacheManager;
 
-    @MockBean
+    @MockitoBean
     private final PluginContext pluginContext = PluginContext.builder()
         .name("fake")
         .configMapName("fake-config")
diff --git a/application/src/test/java/run/halo/app/security/AuthProviderServiceImplTest.java b/application/src/test/java/run/halo/app/security/AuthProviderServiceImplTest.java
index 6487ee3750..5b41cce60d 100644
--- a/application/src/test/java/run/halo/app/security/AuthProviderServiceImplTest.java
+++ b/application/src/test/java/run/halo/app/security/AuthProviderServiceImplTest.java
@@ -37,11 +37,12 @@
  */
 @ExtendWith(SpringExtension.class)
 class AuthProviderServiceImplTest {
+
     @Mock
-    private ReactiveExtensionClient client;
+    ReactiveExtensionClient client;
 
     @InjectMocks
-    private AuthProviderServiceImpl authProviderService;
+    AuthProviderServiceImpl authProviderService;
 
     @Test
     void testEnable() {
@@ -57,14 +58,12 @@ void testEnable() {
         when(client.fetch(eq(ConfigMap.class), eq(SystemSetting.SYSTEM_CONFIG)))
             .thenReturn(Mono.just(configMap));
 
-        AuthProvider local = createAuthProvider("local");
-        local.getMetadata().getLabels().put(AuthProvider.PRIVILEGED_LABEL, "true");
-        when(client.list(eq(AuthProvider.class), any(), any())).thenReturn(Flux.just(local));
-
         // Call the method being tested
-        Mono<AuthProvider> result = authProviderService.enable("github");
+        authProviderService.enable("github")
+            .as(StepVerifier::create)
+            .expectNext(authProvider)
+            .verifyComplete();
 
-        assertEquals(authProvider, result.block());
         ConfigMap value = captor.getValue();
         String providerSettingStr = value.getData().get(SystemSetting.AuthProvider.GROUP);
         Set<String> enabled =
@@ -84,7 +83,7 @@ void testDisable() {
 
         AuthProvider local = createAuthProvider("local");
         local.getMetadata().getLabels().put(AuthProvider.PRIVILEGED_LABEL, "true");
-        when(client.list(eq(AuthProvider.class), any(), any())).thenReturn(Flux.just(local));
+        // when(client.list(eq(AuthProvider.class), any(), any())).thenReturn(Flux.just(local));
 
         ArgumentCaptor<ConfigMap> captor = ArgumentCaptor.forClass(ConfigMap.class);
         when(client.update(captor.capture())).thenReturn(Mono.empty());
@@ -155,7 +154,7 @@ void listAll() {
                                 "supportsBinding": false,
                                 "privileged": false
                             },{
-                                                        
+                            
                                 "name": "gitee",
                                 "displayName": "gitee",
                                 "enabled": false,
diff --git a/application/src/test/java/run/halo/app/security/SuperAdminInitializerTest.java b/application/src/test/java/run/halo/app/security/SuperAdminInitializerTest.java
index 909bee4f7c..f646ad040b 100644
--- a/application/src/test/java/run/halo/app/security/SuperAdminInitializerTest.java
+++ b/application/src/test/java/run/halo/app/security/SuperAdminInitializerTest.java
@@ -10,8 +10,8 @@
 import org.springframework.boot.test.autoconfigure.jdbc.AutoConfigureTestDatabase;
 import org.springframework.boot.test.autoconfigure.web.reactive.AutoConfigureWebTestClient;
 import org.springframework.boot.test.context.SpringBootTest;
-import org.springframework.boot.test.mock.mockito.SpyBean;
 import org.springframework.security.crypto.password.PasswordEncoder;
+import org.springframework.test.context.bean.override.mockito.MockitoSpyBean;
 import org.springframework.test.web.reactive.server.WebTestClient;
 import run.halo.app.core.extension.Role;
 import run.halo.app.core.extension.RoleBinding;
@@ -28,7 +28,7 @@
 @AutoConfigureTestDatabase
 class SuperAdminInitializerTest {
 
-    @SpyBean
+    @MockitoSpyBean
     ReactiveExtensionClient client;
 
     @Autowired
diff --git a/application/src/test/java/run/halo/app/security/authorization/AuthorizationTest.java b/application/src/test/java/run/halo/app/security/authorization/AuthorizationTest.java
index 21a6758d75..49912b316d 100644
--- a/application/src/test/java/run/halo/app/security/authorization/AuthorizationTest.java
+++ b/application/src/test/java/run/halo/app/security/authorization/AuthorizationTest.java
@@ -17,7 +17,6 @@
 import org.springframework.boot.test.autoconfigure.web.reactive.AutoConfigureWebTestClient;
 import org.springframework.boot.test.context.SpringBootTest;
 import org.springframework.boot.test.context.TestConfiguration;
-import org.springframework.boot.test.mock.mockito.SpyBean;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Import;
 import org.springframework.http.MediaType;
@@ -26,6 +25,7 @@
 import org.springframework.security.core.userdetails.ReactiveUserDetailsService;
 import org.springframework.security.test.context.support.WithMockUser;
 import org.springframework.test.annotation.DirtiesContext;
+import org.springframework.test.context.bean.override.mockito.MockitoSpyBean;
 import org.springframework.test.web.reactive.server.WebTestClient;
 import org.springframework.web.reactive.function.server.RouterFunction;
 import org.springframework.web.reactive.function.server.RouterFunctions;
@@ -49,13 +49,13 @@ class AuthorizationTest {
     @Autowired
     WebTestClient webClient;
 
-    @SpyBean
+    @MockitoSpyBean
     ReactiveUserDetailsService userDetailsService;
 
-    @SpyBean
+    @MockitoSpyBean
     ReactiveUserDetailsPasswordService userDetailsPasswordService;
 
-    @SpyBean
+    @MockitoSpyBean
     RoleService roleService;
 
     @Autowired
diff --git a/application/src/test/java/run/halo/app/theme/ThemeIntegrationTest.java b/application/src/test/java/run/halo/app/theme/ThemeIntegrationTest.java
index fd0505382f..32f90d23c6 100644
--- a/application/src/test/java/run/halo/app/theme/ThemeIntegrationTest.java
+++ b/application/src/test/java/run/halo/app/theme/ThemeIntegrationTest.java
@@ -11,11 +11,11 @@
 import org.springframework.boot.test.autoconfigure.web.reactive.AutoConfigureWebTestClient;
 import org.springframework.boot.test.context.SpringBootTest;
 import org.springframework.boot.test.context.TestConfiguration;
-import org.springframework.boot.test.mock.mockito.MockBean;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Import;
 import org.springframework.http.MediaType;
 import org.springframework.test.annotation.DirtiesContext;
+import org.springframework.test.context.bean.override.mockito.MockitoBean;
 import org.springframework.test.web.reactive.server.WebTestClient;
 import org.springframework.web.reactive.function.server.RouterFunction;
 import org.springframework.web.reactive.function.server.RouterFunctions;
@@ -36,7 +36,7 @@ public class ThemeIntegrationTest {
     @Autowired
     WebTestClient webClient;
 
-    @MockBean
+    @MockitoBean
     InitializationStateGetter initializationStateGetter;
 
     @Autowired
diff --git a/application/src/test/java/run/halo/app/theme/ViewNameResolverTest.java b/application/src/test/java/run/halo/app/theme/ViewNameResolverTest.java
index 2c8c6021b6..14c656a648 100644
--- a/application/src/test/java/run/halo/app/theme/ViewNameResolverTest.java
+++ b/application/src/test/java/run/halo/app/theme/ViewNameResolverTest.java
@@ -2,14 +2,13 @@
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatThrownBy;
-import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.Mockito.when;
 
-import java.io.File;
 import java.io.IOException;
 import java.net.URI;
 import java.net.URISyntaxException;
 import java.nio.file.Files;
+import java.nio.file.Path;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.ExtendWith;
@@ -35,40 +34,41 @@
 class ViewNameResolverTest {
 
     @Mock
-    private ThemeResolver themeResolver;
+    ThemeResolver themeResolver;
 
     @Mock
-    private ThymeleafProperties thymeleafProperties;
+    ThymeleafProperties thymeleafProperties;
 
     @InjectMocks
-    private DefaultViewNameResolver viewNameResolver;
+    DefaultViewNameResolver viewNameResolver;
 
     @TempDir
-    private File themePath;
+    Path themePath;
 
     @BeforeEach
     void setUp() throws IOException {
         when(thymeleafProperties.getSuffix()).thenReturn(ThymeleafProperties.DEFAULT_SUFFIX);
+    }
 
-        var templatesPath = themePath.toPath().resolve("templates");
+    @Test
+    void resolveViewNameOrDefault() throws URISyntaxException, IOException {
+        var templatesPath = themePath.resolve("templates");
         if (!Files.exists(templatesPath)) {
             Files.createDirectory(templatesPath);
         }
         Files.createFile(templatesPath.resolve("post_news.html"));
         Files.createFile(templatesPath.resolve("post_docs.html"));
 
-        when(themeResolver.getTheme(any()))
+
+        var exchange = Mockito.mock(ServerWebExchange.class);
+        when(themeResolver.getTheme(exchange))
             .thenReturn(Mono.fromSupplier(() -> ThemeContext.builder()
                 .name("fake-theme")
-                .path(themePath.toPath())
+                .path(themePath)
                 .active(true)
                 .build())
             );
-    }
 
-    @Test
-    void resolveViewNameOrDefault() throws URISyntaxException {
-        ServerWebExchange exchange = Mockito.mock(ServerWebExchange.class);
         MockServerRequest request = MockServerRequest.builder()
             .uri(new URI("/")).method(HttpMethod.GET)
             .exchange(exchange)
diff --git a/application/src/test/java/run/halo/app/theme/dialect/GeneratorMetaProcessorTest.java b/application/src/test/java/run/halo/app/theme/dialect/GeneratorMetaProcessorTest.java
index a732d7aecd..92d2bf7a13 100644
--- a/application/src/test/java/run/halo/app/theme/dialect/GeneratorMetaProcessorTest.java
+++ b/application/src/test/java/run/halo/app/theme/dialect/GeneratorMetaProcessorTest.java
@@ -11,7 +11,7 @@
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.boot.test.autoconfigure.web.reactive.AutoConfigureWebTestClient;
 import org.springframework.boot.test.context.SpringBootTest;
-import org.springframework.boot.test.mock.mockito.MockBean;
+import org.springframework.test.context.bean.override.mockito.MockitoBean;
 import org.springframework.test.web.reactive.server.WebTestClient;
 import org.springframework.util.ResourceUtils;
 import org.springframework.web.server.ServerWebExchange;
@@ -27,10 +27,10 @@ class GeneratorMetaProcessorTest {
     @Autowired
     WebTestClient webClient;
 
-    @MockBean
+    @MockitoBean
     InitializationStateGetter initializationStateGetter;
 
-    @MockBean
+    @MockitoBean
     ThemeResolver themeResolver;
 
     @BeforeEach
diff --git a/application/src/test/java/run/halo/app/theme/finders/impl/CommentPublicQueryServiceImplTest.java b/application/src/test/java/run/halo/app/theme/finders/impl/CommentPublicQueryServiceImplTest.java
index 0a4a8060d2..54fbf17eaa 100644
--- a/application/src/test/java/run/halo/app/theme/finders/impl/CommentPublicQueryServiceImplTest.java
+++ b/application/src/test/java/run/halo/app/theme/finders/impl/CommentPublicQueryServiceImplTest.java
@@ -44,21 +44,19 @@
 class CommentPublicQueryServiceImplTest {
 
     @Mock
-    private ReactiveExtensionClient client;
+    ReactiveExtensionClient client;
+
     @Mock
-    private UserService userService;
+    UserService userService;
 
     @Mock
-    private CounterService counterService;
+    CounterService counterService;
 
     @InjectMocks
-    private CommentPublicQueryServiceImpl commentPublicQueryService;
+    CommentPublicQueryServiceImpl commentPublicQueryService;
 
     @BeforeEach
     void setUp() {
-        User ghost = createUser();
-        ghost.getMetadata().setName("ghost");
-        when(userService.getUserOrGhost(eq("ghost"))).thenReturn(Mono.just(ghost));
         when(userService.getUserOrGhost(eq("fake-user"))).thenReturn(Mono.just(createUser()));
     }
 
diff --git a/application/src/test/java/run/halo/app/theme/message/ThemeMessageResolverIntegrationTest.java b/application/src/test/java/run/halo/app/theme/message/ThemeMessageResolverIntegrationTest.java
index 4c461ff6b8..ad7c7b7cf8 100644
--- a/application/src/test/java/run/halo/app/theme/message/ThemeMessageResolverIntegrationTest.java
+++ b/application/src/test/java/run/halo/app/theme/message/ThemeMessageResolverIntegrationTest.java
@@ -13,9 +13,9 @@
 import org.springframework.boot.test.autoconfigure.web.reactive.AutoConfigureWebTestClient;
 import org.springframework.boot.test.context.SpringBootTest;
 import org.springframework.boot.test.context.TestConfiguration;
-import org.springframework.boot.test.mock.mockito.SpyBean;
 import org.springframework.context.annotation.Bean;
 import org.springframework.http.MediaType;
+import org.springframework.test.context.bean.override.mockito.MockitoSpyBean;
 import org.springframework.test.web.reactive.server.WebTestClient;
 import org.springframework.util.ResourceUtils;
 import org.springframework.web.reactive.function.server.RequestPredicates;
@@ -38,14 +38,14 @@
 @AutoConfigureWebTestClient
 public class ThemeMessageResolverIntegrationTest {
 
-    @SpyBean
+    @MockitoSpyBean
     private ThemeResolver themeResolver;
 
     private URL defaultThemeUrl;
 
     private URL otherThemeUrl;
 
-    @SpyBean
+    @MockitoSpyBean
     private InitializationStateGetter initializationStateGetter;
 
     @Autowired
diff --git a/application/src/test/java/run/halo/app/theme/router/PreviewRouterFunctionTest.java b/application/src/test/java/run/halo/app/theme/router/PreviewRouterFunctionTest.java
index 683401a1d2..baed96cb4a 100644
--- a/application/src/test/java/run/halo/app/theme/router/PreviewRouterFunctionTest.java
+++ b/application/src/test/java/run/halo/app/theme/router/PreviewRouterFunctionTest.java
@@ -43,36 +43,40 @@
 @ExtendWith(SpringExtension.class)
 class PreviewRouterFunctionTest {
     @Mock
-    private ReactiveExtensionClient client;
+    ReactiveExtensionClient client;
 
     @Mock
-    private PostPublicQueryService postPublicQueryService;
+    PostPublicQueryService postPublicQueryService;
 
     @Mock
-    private ViewNameResolver viewNameResolver;
+    ViewNameResolver viewNameResolver;
 
     @Mock
-    private ViewResolver viewResolver;
+    ViewResolver viewResolver;
 
     @Mock
-    private PostService postService;
+    PostService postService;
 
     @Mock
-    private SinglePageConversionService singlePageConversionService;
+    SinglePageConversionService singlePageConversionService;
 
     @InjectMocks
-    private PreviewRouterFunction previewRouterFunction;
+    PreviewRouterFunction previewRouterFunction;
 
-    private WebTestClient webTestClient;
+    WebTestClient webTestClient;
 
     @BeforeEach
-    public void setUp() {
+    void setUp() {
         webTestClient = WebTestClient.bindToRouterFunction(previewRouterFunction.previewRouter())
             .handlerStrategies(HandlerStrategies.builder()
                 .viewResolver(viewResolver)
                 .build())
             .build();
+    }
 
+    @Test
+    @WithMockUser(username = "testuser")
+    void previewPost() {
         when(viewResolver.resolveViewName(any(), any()))
             .thenReturn(Mono.just(new EmptyView() {
                 @Override
@@ -81,11 +85,7 @@ public Mono<Void> render(Map<String, ?> model, MediaType contentType,
                     return super.render(model, contentType, exchange);
                 }
             }));
-    }
 
-    @Test
-    @WithMockUser(username = "testuser")
-    public void previewPost() {
         Post post = new Post();
         post.setMetadata(new Metadata());
         post.getMetadata().setName("post1");
@@ -123,6 +123,15 @@ public void previewPostWhenUnAuthenticated() {
     @Test
     @WithMockUser(username = "testuser")
     public void previewSinglePage() {
+        when(viewResolver.resolveViewName(any(), any()))
+            .thenReturn(Mono.just(new EmptyView() {
+                @Override
+                public Mono<Void> render(Map<String, ?> model, MediaType contentType,
+                    ServerWebExchange exchange) {
+                    return super.render(model, contentType, exchange);
+                }
+            }));
+
         SinglePage singlePage = new SinglePage();
         singlePage.setMetadata(new Metadata());
         singlePage.getMetadata().setName("page1");
diff --git a/build.gradle b/build.gradle
index ec0f114240..e94ecb0b40 100644
--- a/build.gradle
+++ b/build.gradle
@@ -1,5 +1,5 @@
 plugins {
-    id 'org.springframework.boot' version '3.3.3' apply false
+    id 'org.springframework.boot' version '3.4.0-M3' apply false
     id 'io.spring.dependency-management' version '1.1.6' apply false
     id "com.gorylenko.gradle-git-properties" version "2.4.1" apply false
     id "de.undercouch.download" version "5.6.0" apply false

From f6409a0cb0574c49d4fb9da0f73fa7deca4e0e97 Mon Sep 17 00:00:00 2001
From: guqing <38999863+guqing@users.noreply.github.com>
Date: Wed, 25 Sep 2024 10:59:25 +0800
Subject: [PATCH 038/185] fix: correct file mime type validation parameter to
 restore functionality (#6673)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?
/kind bug
/area core
/milestone 2.20.x

#### What this PR does / why we need it:
修复文件上传时类型校验失效的问题

此问题由 #6390 导致

#### Does this PR introduce a user-facing change?
```release-note
修复文件上传时类型校验失效的问题
```
---
 .../LocalAttachmentUploadHandler.java         | 33 +++++++++++--------
 1 file changed, 20 insertions(+), 13 deletions(-)

diff --git a/application/src/main/java/run/halo/app/core/attachment/endpoint/LocalAttachmentUploadHandler.java b/application/src/main/java/run/halo/app/core/attachment/endpoint/LocalAttachmentUploadHandler.java
index f13408cea7..bb48574d4d 100644
--- a/application/src/main/java/run/halo/app/core/attachment/endpoint/LocalAttachmentUploadHandler.java
+++ b/application/src/main/java/run/halo/app/core/attachment/endpoint/LocalAttachmentUploadHandler.java
@@ -6,6 +6,7 @@
 import static run.halo.app.infra.utils.FileUtils.deleteFileSilently;
 
 import java.io.IOException;
+import java.io.InputStream;
 import java.net.URI;
 import java.nio.charset.StandardCharsets;
 import java.nio.file.FileAlreadyExistsException;
@@ -25,6 +26,7 @@
 import org.springframework.core.io.buffer.DataBufferUtils;
 import org.springframework.http.MediaType;
 import org.springframework.http.codec.multipart.FilePart;
+import org.springframework.lang.NonNull;
 import org.springframework.stereotype.Component;
 import org.springframework.util.CollectionUtils;
 import org.springframework.util.StringUtils;
@@ -156,19 +158,14 @@ private Mono<Void> validateFile(FilePart file, PolicySetting setting) {
             var typeValidator = file.content()
                 .next()
                 .handle((dataBuffer, sink) -> {
-                    var mimeType = "Unknown";
-                    try {
-                        mimeType = FileTypeDetectUtils.detectMimeType(dataBuffer.asInputStream());
-                        var isAllow = setting.getAllowedFileTypes()
-                            .stream()
-                            .map(FileCategoryMatcher::of)
-                            .anyMatch(matcher -> matcher.match(file.filename()));
-                        if (isAllow) {
-                            sink.next(dataBuffer);
-                            return;
-                        }
-                    } catch (IOException e) {
-                        log.warn("Failed to detect file type", e);
+                    var mimeType = detectMimeType(dataBuffer.asInputStream());
+                    var isAllow = setting.getAllowedFileTypes()
+                        .stream()
+                        .map(FileCategoryMatcher::of)
+                        .anyMatch(matcher -> matcher.match(mimeType));
+                    if (isAllow) {
+                        sink.next(dataBuffer);
+                        return;
                     }
                     sink.error(new FileTypeNotAllowedException("File type is not allowed",
                         "problemDetail.attachment.upload.fileTypeNotSupported",
@@ -180,6 +177,16 @@ private Mono<Void> validateFile(FilePart file, PolicySetting setting) {
         return Mono.when(validations);
     }
 
+    @NonNull
+    private String detectMimeType(InputStream inputStream) {
+        try {
+            return FileTypeDetectUtils.detectMimeType(inputStream);
+        } catch (IOException e) {
+            log.warn("Failed to detect file type", e);
+            return "Unknown";
+        }
+    }
+
     @Override
     public Mono<Attachment> delete(DeleteContext deleteContext) {
         return Mono.just(deleteContext)

From 7e911e9738b5051fa6c195f6b41171da9bbdc523 Mon Sep 17 00:00:00 2001
From: Ryan Wang <i@ryanc.cc>
Date: Wed, 25 Sep 2024 16:15:56 +0800
Subject: [PATCH 039/185] Refine UI

---
 .../modules/interface/themes/ThemeSetting.vue |  63 +++---
 .../plugins/components/tabs/Setting.vue       |  56 +++--
 .../src/api/plugin-v1alpha1-console-api.ts    | 208 ++++++++++++++++-
 .../src/api/theme-v1alpha1-console-api.ts     | 212 +++++++++++++++++-
 4 files changed, 468 insertions(+), 71 deletions(-)

diff --git a/ui/console-src/modules/interface/themes/ThemeSetting.vue b/ui/console-src/modules/interface/themes/ThemeSetting.vue
index 7f207c82b7..a3f4f730a1 100644
--- a/ui/console-src/modules/interface/themes/ThemeSetting.vue
+++ b/ui/console-src/modules/interface/themes/ThemeSetting.vue
@@ -1,19 +1,13 @@
 <script lang="ts" setup>
-// core libs
-import { computed, inject, ref, toRaw } from "vue";
-
-// components
-import { Toast, VButton } from "@halo-dev/components";
-
-// types
-import type { ConfigMap, Setting, Theme } from "@halo-dev/api-client";
-import type { Ref } from "vue";
-
-// hooks
 import StickyBlock from "@/components/sticky-block/StickyBlock.vue";
-import { useSettingFormConvert } from "@console/composables/use-setting-form";
+import type { FormKitSchemaCondition, FormKitSchemaNode } from "@formkit/core";
+import type { Setting, Theme } from "@halo-dev/api-client";
 import { consoleApiClient } from "@halo-dev/api-client";
+import { Toast, VButton } from "@halo-dev/components";
 import { useQuery, useQueryClient } from "@tanstack/vue-query";
+import { cloneDeep, set } from "lodash-es";
+import type { Ref } from "vue";
+import { computed, inject, ref, toRaw } from "vue";
 import { useI18n } from "vue-i18n";
 
 const { t } = useI18n();
@@ -26,10 +20,10 @@ const setting = inject<Ref<Setting | undefined>>("setting", ref());
 
 const saving = ref(false);
 
-const { data: configMap, suspense } = useQuery<ConfigMap>({
-  queryKey: ["theme-configMap", selectedTheme],
+const { data: configMapData, suspense } = useQuery({
+  queryKey: ["core:theme:configMap:data", selectedTheme],
   queryFn: async () => {
-    const { data } = await consoleApiClient.theme.theme.fetchThemeConfig({
+    const { data } = await consoleApiClient.theme.theme.fetchThemeJsonConfig({
       name: selectedTheme?.value?.metadata.name as string,
     });
     return data;
@@ -39,30 +33,37 @@ const { data: configMap, suspense } = useQuery<ConfigMap>({
   }),
 });
 
-const { configMapFormData, formSchema, convertToSave } = useSettingFormConvert(
-  setting,
-  configMap,
-  group
-);
+const currentConfigMapGroupData = computed(() => {
+  return configMapData.value?.[group.value];
+});
 
-const handleSaveConfigMap = async () => {
-  saving.value = true;
+const formSchema = computed(() => {
+  if (!setting.value) {
+    return;
+  }
+  const { forms } = setting.value.spec;
+  return forms.find((item) => item.group === group?.value)?.formSchema as (
+    | FormKitSchemaCondition
+    | FormKitSchemaNode
+  )[];
+});
 
-  const configMapToUpdate = convertToSave();
+const handleSaveConfigMap = async (data: object) => {
+  saving.value = true;
 
-  if (!configMapToUpdate || !selectedTheme?.value) {
+  if (!selectedTheme?.value) {
     saving.value = false;
     return;
   }
 
-  await consoleApiClient.theme.theme.updateThemeConfig({
+  await consoleApiClient.theme.theme.updateThemeJsonConfig({
     name: selectedTheme?.value?.metadata.name,
-    configMap: configMapToUpdate,
+    body: set(cloneDeep(configMapData.value) || {}, group.value, data),
   });
 
   Toast.success(t("core.common.toast.save_success"));
 
-  queryClient.invalidateQueries({ queryKey: ["theme-configMap"] });
+  queryClient.invalidateQueries({ queryKey: ["core:theme:configMap:data"] });
 
   saving.value = false;
 };
@@ -73,18 +74,16 @@ await suspense();
   <Transition mode="out-in" name="fade">
     <div class="p-4">
       <FormKit
-        v-if="group && formSchema && configMapFormData?.[group]"
+        v-if="group && formSchema && currentConfigMapGroupData"
         :id="group"
-        v-model="configMapFormData[group]"
+        :value="currentConfigMapGroupData || {}"
         :name="group"
-        :actions="false"
-        :preserve="true"
         type="form"
         @submit="handleSaveConfigMap"
       >
         <FormKitSchema
           :schema="toRaw(formSchema)"
-          :data="configMapFormData[group]"
+          :data="toRaw(currentConfigMapGroupData)"
         />
       </FormKit>
       <StickyBlock
diff --git a/ui/console-src/modules/system/plugins/components/tabs/Setting.vue b/ui/console-src/modules/system/plugins/components/tabs/Setting.vue
index 460a82f5bf..c83f0ee428 100644
--- a/ui/console-src/modules/system/plugins/components/tabs/Setting.vue
+++ b/ui/console-src/modules/system/plugins/components/tabs/Setting.vue
@@ -1,10 +1,11 @@
 <script lang="ts" setup>
 import StickyBlock from "@/components/sticky-block/StickyBlock.vue";
-import { useSettingFormConvert } from "@console/composables/use-setting-form";
-import type { ConfigMap, Plugin, Setting } from "@halo-dev/api-client";
+import type { FormKitSchemaCondition, FormKitSchemaNode } from "@formkit/core";
+import type { Plugin, Setting } from "@halo-dev/api-client";
 import { consoleApiClient } from "@halo-dev/api-client";
 import { Toast, VButton } from "@halo-dev/components";
 import { useQuery, useQueryClient } from "@tanstack/vue-query";
+import { cloneDeep, set } from "lodash-es";
 import { computed, inject, ref, toRaw, type Ref } from "vue";
 import { useI18n } from "vue-i18n";
 
@@ -16,12 +17,14 @@ const plugin = inject<Ref<Plugin | undefined>>("plugin");
 const setting = inject<Ref<Setting | undefined>>("setting", ref());
 const saving = ref(false);
 
-const { data: configMap } = useQuery<ConfigMap>({
-  queryKey: ["plugin-configMap", plugin],
+const { data: configMapData } = useQuery({
+  queryKey: ["core:plugin:configMap:data", plugin],
   queryFn: async () => {
-    const { data } = await consoleApiClient.plugin.plugin.fetchPluginConfig({
-      name: plugin?.value?.metadata.name as string,
-    });
+    const { data } = await consoleApiClient.plugin.plugin.fetchPluginJsonConfig(
+      {
+        name: plugin?.value?.metadata.name as string,
+      }
+    );
     return data;
   },
   enabled: computed(() => {
@@ -29,28 +32,37 @@ const { data: configMap } = useQuery<ConfigMap>({
   }),
 });
 
-const { configMapFormData, formSchema, convertToSave } = useSettingFormConvert(
-  setting,
-  configMap,
-  group
-);
+const currentConfigMapGroupData = computed(() => {
+  return configMapData.value?.[group.value];
+});
+
+const formSchema = computed(() => {
+  if (!setting.value) {
+    return;
+  }
+  const { forms } = setting.value.spec;
+  return forms.find((item) => item.group === group?.value)?.formSchema as (
+    | FormKitSchemaCondition
+    | FormKitSchemaNode
+  )[];
+});
 
-const handleSaveConfigMap = async () => {
+const handleSaveConfigMap = async (data: object) => {
   saving.value = true;
-  const configMapToUpdate = convertToSave();
-  if (!configMapToUpdate || !plugin?.value) {
+
+  if (!plugin?.value) {
     saving.value = false;
     return;
   }
 
-  await consoleApiClient.plugin.plugin.updatePluginConfig({
+  await consoleApiClient.plugin.plugin.updatePluginJsonConfig({
     name: plugin.value.metadata.name,
-    configMap: configMapToUpdate,
+    body: set(cloneDeep(configMapData.value) || {}, group.value, data),
   });
 
   Toast.success(t("core.common.toast.save_success"));
 
-  queryClient.invalidateQueries({ queryKey: ["plugin-configMap"] });
+  queryClient.invalidateQueries({ queryKey: ["core:plugin:configMap:data"] });
 
   saving.value = false;
 };
@@ -60,18 +72,16 @@ const handleSaveConfigMap = async () => {
     <div class="rounded-b-base bg-white p-4">
       <div>
         <FormKit
-          v-if="group && formSchema && configMapFormData?.[group]"
+          v-if="group && formSchema && currentConfigMapGroupData"
           :id="group"
-          v-model="configMapFormData[group]"
+          :value="currentConfigMapGroupData"
           :name="group"
-          :actions="false"
-          :preserve="true"
           type="form"
           @submit="handleSaveConfigMap"
         >
           <FormKitSchema
             :schema="toRaw(formSchema)"
-            :data="configMapFormData[group]"
+            :data="toRaw(currentConfigMapGroupData)"
           />
         </FormKit>
       </div>
diff --git a/ui/packages/api-client/src/api/plugin-v1alpha1-console-api.ts b/ui/packages/api-client/src/api/plugin-v1alpha1-console-api.ts
index efde5318e8..dcf3317b41 100644
--- a/ui/packages/api-client/src/api/plugin-v1alpha1-console-api.ts
+++ b/ui/packages/api-client/src/api/plugin-v1alpha1-console-api.ts
@@ -163,7 +163,7 @@ export const PluginV1alpha1ConsoleApiAxiosParamCreator = function (configuration
             };
         },
         /**
-         * Fetch configMap of plugin by configured configMapName.
+         * Fetch configMap of plugin by configured configMapName. it is deprecated since 2.20.0
          * @param {string} name 
          * @param {*} [options] Override http request option.
          * @throws {RequiredError}
@@ -194,6 +194,47 @@ export const PluginV1alpha1ConsoleApiAxiosParamCreator = function (configuration
 
 
     
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
+
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+        /**
+         * Fetch converted json config of plugin by configured configMapName.
+         * @param {string} name 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        fetchPluginJsonConfig: async (name: string, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            // verify required parameter 'name' is not null or undefined
+            assertParamExists('fetchPluginJsonConfig', 'name', name)
+            const localVarPath = `/apis/api.console.halo.run/v1alpha1/plugins/{name}/json-config`
+                .replace(`{${"name"}}`, encodeURIComponent(String(name)));
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+
+            const localVarRequestOptions = { method: 'GET', ...baseOptions, ...options};
+            const localVarHeaderParameter = {} as any;
+            const localVarQueryParameter = {} as any;
+
+            // authentication basicAuth required
+            // http basic authentication required
+            setBasicAuthToObject(localVarRequestOptions, configuration)
+
+            // authentication bearerAuth required
+            // http bearer authentication required
+            await setBearerAuthToObject(localVarHeaderParameter, configuration)
+
+
+    
             setSearchParams(localVarUrlObj, localVarQueryParameter);
             let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
             localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
@@ -535,10 +576,11 @@ export const PluginV1alpha1ConsoleApiAxiosParamCreator = function (configuration
             };
         },
         /**
-         * Update the configMap of plugin setting.
+         * Update the configMap of plugin setting, it is deprecated since 2.20.0
          * @param {string} name 
          * @param {ConfigMap} configMap 
          * @param {*} [options] Override http request option.
+         * @deprecated
          * @throws {RequiredError}
          */
         updatePluginConfig: async (name: string, configMap: ConfigMap, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
@@ -581,6 +623,53 @@ export const PluginV1alpha1ConsoleApiAxiosParamCreator = function (configuration
                 options: localVarRequestOptions,
             };
         },
+        /**
+         * Update the config of plugin setting.
+         * @param {string} name 
+         * @param {object} body 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        updatePluginJsonConfig: async (name: string, body: object, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            // verify required parameter 'name' is not null or undefined
+            assertParamExists('updatePluginJsonConfig', 'name', name)
+            // verify required parameter 'body' is not null or undefined
+            assertParamExists('updatePluginJsonConfig', 'body', body)
+            const localVarPath = `/apis/api.console.halo.run/v1alpha1/plugins/{name}/json-config`
+                .replace(`{${"name"}}`, encodeURIComponent(String(name)));
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+
+            const localVarRequestOptions = { method: 'PUT', ...baseOptions, ...options};
+            const localVarHeaderParameter = {} as any;
+            const localVarQueryParameter = {} as any;
+
+            // authentication basicAuth required
+            // http basic authentication required
+            setBasicAuthToObject(localVarRequestOptions, configuration)
+
+            // authentication bearerAuth required
+            // http bearer authentication required
+            await setBearerAuthToObject(localVarHeaderParameter, configuration)
+
+
+    
+            localVarHeaderParameter['Content-Type'] = 'application/json';
+
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
+            localVarRequestOptions.data = serializeDataIfNeeded(body, localVarRequestOptions, configuration)
+
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
         /**
          * Upgrade a plugin by uploading a Jar file
          * @param {string} name 
@@ -734,7 +823,7 @@ export const PluginV1alpha1ConsoleApiFp = function(configuration?: Configuration
             return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
         },
         /**
-         * Fetch configMap of plugin by configured configMapName.
+         * Fetch configMap of plugin by configured configMapName. it is deprecated since 2.20.0
          * @param {string} name 
          * @param {*} [options] Override http request option.
          * @throws {RequiredError}
@@ -745,6 +834,18 @@ export const PluginV1alpha1ConsoleApiFp = function(configuration?: Configuration
             const localVarOperationServerBasePath = operationServerMap['PluginV1alpha1ConsoleApi.fetchPluginConfig']?.[localVarOperationServerIndex]?.url;
             return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
         },
+        /**
+         * Fetch converted json config of plugin by configured configMapName.
+         * @param {string} name 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async fetchPluginJsonConfig(name: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<object>> {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.fetchPluginJsonConfig(name, options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['PluginV1alpha1ConsoleApi.fetchPluginJsonConfig']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
         /**
          * Fetch setting of plugin.
          * @param {string} name 
@@ -837,10 +938,11 @@ export const PluginV1alpha1ConsoleApiFp = function(configuration?: Configuration
             return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
         },
         /**
-         * Update the configMap of plugin setting.
+         * Update the configMap of plugin setting, it is deprecated since 2.20.0
          * @param {string} name 
          * @param {ConfigMap} configMap 
          * @param {*} [options] Override http request option.
+         * @deprecated
          * @throws {RequiredError}
          */
         async updatePluginConfig(name: string, configMap: ConfigMap, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<ConfigMap>> {
@@ -849,6 +951,19 @@ export const PluginV1alpha1ConsoleApiFp = function(configuration?: Configuration
             const localVarOperationServerBasePath = operationServerMap['PluginV1alpha1ConsoleApi.updatePluginConfig']?.[localVarOperationServerIndex]?.url;
             return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
         },
+        /**
+         * Update the config of plugin setting.
+         * @param {string} name 
+         * @param {object} body 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async updatePluginJsonConfig(name: string, body: object, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<void>> {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.updatePluginJsonConfig(name, body, options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['PluginV1alpha1ConsoleApi.updatePluginJsonConfig']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
         /**
          * Upgrade a plugin by uploading a Jar file
          * @param {string} name 
@@ -913,7 +1028,7 @@ export const PluginV1alpha1ConsoleApiFactory = function (configuration?: Configu
             return localVarFp.fetchJsBundle(options).then((request) => request(axios, basePath));
         },
         /**
-         * Fetch configMap of plugin by configured configMapName.
+         * Fetch configMap of plugin by configured configMapName. it is deprecated since 2.20.0
          * @param {PluginV1alpha1ConsoleApiFetchPluginConfigRequest} requestParameters Request parameters.
          * @param {*} [options] Override http request option.
          * @throws {RequiredError}
@@ -921,6 +1036,15 @@ export const PluginV1alpha1ConsoleApiFactory = function (configuration?: Configu
         fetchPluginConfig(requestParameters: PluginV1alpha1ConsoleApiFetchPluginConfigRequest, options?: RawAxiosRequestConfig): AxiosPromise<ConfigMap> {
             return localVarFp.fetchPluginConfig(requestParameters.name, options).then((request) => request(axios, basePath));
         },
+        /**
+         * Fetch converted json config of plugin by configured configMapName.
+         * @param {PluginV1alpha1ConsoleApiFetchPluginJsonConfigRequest} requestParameters Request parameters.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        fetchPluginJsonConfig(requestParameters: PluginV1alpha1ConsoleApiFetchPluginJsonConfigRequest, options?: RawAxiosRequestConfig): AxiosPromise<object> {
+            return localVarFp.fetchPluginJsonConfig(requestParameters.name, options).then((request) => request(axios, basePath));
+        },
         /**
          * Fetch setting of plugin.
          * @param {PluginV1alpha1ConsoleApiFetchPluginSettingRequest} requestParameters Request parameters.
@@ -984,14 +1108,24 @@ export const PluginV1alpha1ConsoleApiFactory = function (configuration?: Configu
             return localVarFp.resetPluginConfig(requestParameters.name, options).then((request) => request(axios, basePath));
         },
         /**
-         * Update the configMap of plugin setting.
+         * Update the configMap of plugin setting, it is deprecated since 2.20.0
          * @param {PluginV1alpha1ConsoleApiUpdatePluginConfigRequest} requestParameters Request parameters.
          * @param {*} [options] Override http request option.
+         * @deprecated
          * @throws {RequiredError}
          */
         updatePluginConfig(requestParameters: PluginV1alpha1ConsoleApiUpdatePluginConfigRequest, options?: RawAxiosRequestConfig): AxiosPromise<ConfigMap> {
             return localVarFp.updatePluginConfig(requestParameters.name, requestParameters.configMap, options).then((request) => request(axios, basePath));
         },
+        /**
+         * Update the config of plugin setting.
+         * @param {PluginV1alpha1ConsoleApiUpdatePluginJsonConfigRequest} requestParameters Request parameters.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        updatePluginJsonConfig(requestParameters: PluginV1alpha1ConsoleApiUpdatePluginJsonConfigRequest, options?: RawAxiosRequestConfig): AxiosPromise<void> {
+            return localVarFp.updatePluginJsonConfig(requestParameters.name, requestParameters.body, options).then((request) => request(axios, basePath));
+        },
         /**
          * Upgrade a plugin by uploading a Jar file
          * @param {PluginV1alpha1ConsoleApiUpgradePluginRequest} requestParameters Request parameters.
@@ -1048,6 +1182,20 @@ export interface PluginV1alpha1ConsoleApiFetchPluginConfigRequest {
     readonly name: string
 }
 
+/**
+ * Request parameters for fetchPluginJsonConfig operation in PluginV1alpha1ConsoleApi.
+ * @export
+ * @interface PluginV1alpha1ConsoleApiFetchPluginJsonConfigRequest
+ */
+export interface PluginV1alpha1ConsoleApiFetchPluginJsonConfigRequest {
+    /**
+     * 
+     * @type {string}
+     * @memberof PluginV1alpha1ConsoleApiFetchPluginJsonConfig
+     */
+    readonly name: string
+}
+
 /**
  * Request parameters for fetchPluginSetting operation in PluginV1alpha1ConsoleApi.
  * @export
@@ -1209,6 +1357,27 @@ export interface PluginV1alpha1ConsoleApiUpdatePluginConfigRequest {
     readonly configMap: ConfigMap
 }
 
+/**
+ * Request parameters for updatePluginJsonConfig operation in PluginV1alpha1ConsoleApi.
+ * @export
+ * @interface PluginV1alpha1ConsoleApiUpdatePluginJsonConfigRequest
+ */
+export interface PluginV1alpha1ConsoleApiUpdatePluginJsonConfigRequest {
+    /**
+     * 
+     * @type {string}
+     * @memberof PluginV1alpha1ConsoleApiUpdatePluginJsonConfig
+     */
+    readonly name: string
+
+    /**
+     * 
+     * @type {object}
+     * @memberof PluginV1alpha1ConsoleApiUpdatePluginJsonConfig
+     */
+    readonly body: object
+}
+
 /**
  * Request parameters for upgradePlugin operation in PluginV1alpha1ConsoleApi.
  * @export
@@ -1304,7 +1473,7 @@ export class PluginV1alpha1ConsoleApi extends BaseAPI {
     }
 
     /**
-     * Fetch configMap of plugin by configured configMapName.
+     * Fetch configMap of plugin by configured configMapName. it is deprecated since 2.20.0
      * @param {PluginV1alpha1ConsoleApiFetchPluginConfigRequest} requestParameters Request parameters.
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
@@ -1314,6 +1483,17 @@ export class PluginV1alpha1ConsoleApi extends BaseAPI {
         return PluginV1alpha1ConsoleApiFp(this.configuration).fetchPluginConfig(requestParameters.name, options).then((request) => request(this.axios, this.basePath));
     }
 
+    /**
+     * Fetch converted json config of plugin by configured configMapName.
+     * @param {PluginV1alpha1ConsoleApiFetchPluginJsonConfigRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof PluginV1alpha1ConsoleApi
+     */
+    public fetchPluginJsonConfig(requestParameters: PluginV1alpha1ConsoleApiFetchPluginJsonConfigRequest, options?: RawAxiosRequestConfig) {
+        return PluginV1alpha1ConsoleApiFp(this.configuration).fetchPluginJsonConfig(requestParameters.name, options).then((request) => request(this.axios, this.basePath));
+    }
+
     /**
      * Fetch setting of plugin.
      * @param {PluginV1alpha1ConsoleApiFetchPluginSettingRequest} requestParameters Request parameters.
@@ -1391,9 +1571,10 @@ export class PluginV1alpha1ConsoleApi extends BaseAPI {
     }
 
     /**
-     * Update the configMap of plugin setting.
+     * Update the configMap of plugin setting, it is deprecated since 2.20.0
      * @param {PluginV1alpha1ConsoleApiUpdatePluginConfigRequest} requestParameters Request parameters.
      * @param {*} [options] Override http request option.
+     * @deprecated
      * @throws {RequiredError}
      * @memberof PluginV1alpha1ConsoleApi
      */
@@ -1401,6 +1582,17 @@ export class PluginV1alpha1ConsoleApi extends BaseAPI {
         return PluginV1alpha1ConsoleApiFp(this.configuration).updatePluginConfig(requestParameters.name, requestParameters.configMap, options).then((request) => request(this.axios, this.basePath));
     }
 
+    /**
+     * Update the config of plugin setting.
+     * @param {PluginV1alpha1ConsoleApiUpdatePluginJsonConfigRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof PluginV1alpha1ConsoleApi
+     */
+    public updatePluginJsonConfig(requestParameters: PluginV1alpha1ConsoleApiUpdatePluginJsonConfigRequest, options?: RawAxiosRequestConfig) {
+        return PluginV1alpha1ConsoleApiFp(this.configuration).updatePluginJsonConfig(requestParameters.name, requestParameters.body, options).then((request) => request(this.axios, this.basePath));
+    }
+
     /**
      * Upgrade a plugin by uploading a Jar file
      * @param {PluginV1alpha1ConsoleApiUpgradePluginRequest} requestParameters Request parameters.
diff --git a/ui/packages/api-client/src/api/theme-v1alpha1-console-api.ts b/ui/packages/api-client/src/api/theme-v1alpha1-console-api.ts
index 2e1fa3df53..08cc168ec2 100644
--- a/ui/packages/api-client/src/api/theme-v1alpha1-console-api.ts
+++ b/ui/packages/api-client/src/api/theme-v1alpha1-console-api.ts
@@ -118,9 +118,10 @@ export const ThemeV1alpha1ConsoleApiAxiosParamCreator = function (configuration?
             };
         },
         /**
-         * Fetch configMap of theme by configured configMapName.
+         * Fetch configMap of theme by configured configMapName. It is deprecated.
          * @param {string} name 
          * @param {*} [options] Override http request option.
+         * @deprecated
          * @throws {RequiredError}
          */
         fetchThemeConfig: async (name: string, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
@@ -149,6 +150,47 @@ export const ThemeV1alpha1ConsoleApiAxiosParamCreator = function (configuration?
 
 
     
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
+
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+        /**
+         * Fetch converted json config of theme by configured configMapName.
+         * @param {string} name 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        fetchThemeJsonConfig: async (name: string, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            // verify required parameter 'name' is not null or undefined
+            assertParamExists('fetchThemeJsonConfig', 'name', name)
+            const localVarPath = `/apis/api.console.halo.run/v1alpha1/themes/{name}/json-config`
+                .replace(`{${"name"}}`, encodeURIComponent(String(name)));
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+
+            const localVarRequestOptions = { method: 'GET', ...baseOptions, ...options};
+            const localVarHeaderParameter = {} as any;
+            const localVarQueryParameter = {} as any;
+
+            // authentication basicAuth required
+            // http basic authentication required
+            setBasicAuthToObject(localVarRequestOptions, configuration)
+
+            // authentication bearerAuth required
+            // http bearer authentication required
+            await setBearerAuthToObject(localVarHeaderParameter, configuration)
+
+
+    
             setSearchParams(localVarUrlObj, localVarQueryParameter);
             let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
             localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
@@ -465,10 +507,11 @@ export const ThemeV1alpha1ConsoleApiAxiosParamCreator = function (configuration?
             };
         },
         /**
-         * Update the configMap of theme setting.
+         * Update the configMap of theme setting. It is deprecated.
          * @param {string} name 
          * @param {ConfigMap} configMap 
          * @param {*} [options] Override http request option.
+         * @deprecated
          * @throws {RequiredError}
          */
         updateThemeConfig: async (name: string, configMap: ConfigMap, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
@@ -511,6 +554,53 @@ export const ThemeV1alpha1ConsoleApiAxiosParamCreator = function (configuration?
                 options: localVarRequestOptions,
             };
         },
+        /**
+         * Update the configMap of theme setting.
+         * @param {string} name 
+         * @param {object} body 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        updateThemeJsonConfig: async (name: string, body: object, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            // verify required parameter 'name' is not null or undefined
+            assertParamExists('updateThemeJsonConfig', 'name', name)
+            // verify required parameter 'body' is not null or undefined
+            assertParamExists('updateThemeJsonConfig', 'body', body)
+            const localVarPath = `/apis/api.console.halo.run/v1alpha1/themes/{name}/json-config`
+                .replace(`{${"name"}}`, encodeURIComponent(String(name)));
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+
+            const localVarRequestOptions = { method: 'PUT', ...baseOptions, ...options};
+            const localVarHeaderParameter = {} as any;
+            const localVarQueryParameter = {} as any;
+
+            // authentication basicAuth required
+            // http basic authentication required
+            setBasicAuthToObject(localVarRequestOptions, configuration)
+
+            // authentication bearerAuth required
+            // http bearer authentication required
+            await setBearerAuthToObject(localVarHeaderParameter, configuration)
+
+
+    
+            localVarHeaderParameter['Content-Type'] = 'application/json';
+
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
+            localVarRequestOptions.data = serializeDataIfNeeded(body, localVarRequestOptions, configuration)
+
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
         /**
          * Upgrade theme
          * @param {string} name 
@@ -644,9 +734,10 @@ export const ThemeV1alpha1ConsoleApiFp = function(configuration?: Configuration)
             return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
         },
         /**
-         * Fetch configMap of theme by configured configMapName.
+         * Fetch configMap of theme by configured configMapName. It is deprecated.
          * @param {string} name 
          * @param {*} [options] Override http request option.
+         * @deprecated
          * @throws {RequiredError}
          */
         async fetchThemeConfig(name: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<ConfigMap>> {
@@ -655,6 +746,18 @@ export const ThemeV1alpha1ConsoleApiFp = function(configuration?: Configuration)
             const localVarOperationServerBasePath = operationServerMap['ThemeV1alpha1ConsoleApi.fetchThemeConfig']?.[localVarOperationServerIndex]?.url;
             return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
         },
+        /**
+         * Fetch converted json config of theme by configured configMapName.
+         * @param {string} name 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async fetchThemeJsonConfig(name: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<object>> {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.fetchThemeJsonConfig(name, options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['ThemeV1alpha1ConsoleApi.fetchThemeJsonConfig']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
         /**
          * Fetch setting of theme.
          * @param {string} name 
@@ -743,10 +846,11 @@ export const ThemeV1alpha1ConsoleApiFp = function(configuration?: Configuration)
             return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
         },
         /**
-         * Update the configMap of theme setting.
+         * Update the configMap of theme setting. It is deprecated.
          * @param {string} name 
          * @param {ConfigMap} configMap 
          * @param {*} [options] Override http request option.
+         * @deprecated
          * @throws {RequiredError}
          */
         async updateThemeConfig(name: string, configMap: ConfigMap, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<ConfigMap>> {
@@ -755,6 +859,19 @@ export const ThemeV1alpha1ConsoleApiFp = function(configuration?: Configuration)
             const localVarOperationServerBasePath = operationServerMap['ThemeV1alpha1ConsoleApi.updateThemeConfig']?.[localVarOperationServerIndex]?.url;
             return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
         },
+        /**
+         * Update the configMap of theme setting.
+         * @param {string} name 
+         * @param {object} body 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async updateThemeJsonConfig(name: string, body: object, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<void>> {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.updateThemeJsonConfig(name, body, options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['ThemeV1alpha1ConsoleApi.updateThemeJsonConfig']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
         /**
          * Upgrade theme
          * @param {string} name 
@@ -809,14 +926,24 @@ export const ThemeV1alpha1ConsoleApiFactory = function (configuration?: Configur
             return localVarFp.fetchActivatedTheme(options).then((request) => request(axios, basePath));
         },
         /**
-         * Fetch configMap of theme by configured configMapName.
+         * Fetch configMap of theme by configured configMapName. It is deprecated.
          * @param {ThemeV1alpha1ConsoleApiFetchThemeConfigRequest} requestParameters Request parameters.
          * @param {*} [options] Override http request option.
+         * @deprecated
          * @throws {RequiredError}
          */
         fetchThemeConfig(requestParameters: ThemeV1alpha1ConsoleApiFetchThemeConfigRequest, options?: RawAxiosRequestConfig): AxiosPromise<ConfigMap> {
             return localVarFp.fetchThemeConfig(requestParameters.name, options).then((request) => request(axios, basePath));
         },
+        /**
+         * Fetch converted json config of theme by configured configMapName.
+         * @param {ThemeV1alpha1ConsoleApiFetchThemeJsonConfigRequest} requestParameters Request parameters.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        fetchThemeJsonConfig(requestParameters: ThemeV1alpha1ConsoleApiFetchThemeJsonConfigRequest, options?: RawAxiosRequestConfig): AxiosPromise<object> {
+            return localVarFp.fetchThemeJsonConfig(requestParameters.name, options).then((request) => request(axios, basePath));
+        },
         /**
          * Fetch setting of theme.
          * @param {ThemeV1alpha1ConsoleApiFetchThemeSettingRequest} requestParameters Request parameters.
@@ -880,14 +1007,24 @@ export const ThemeV1alpha1ConsoleApiFactory = function (configuration?: Configur
             return localVarFp.resetThemeConfig(requestParameters.name, options).then((request) => request(axios, basePath));
         },
         /**
-         * Update the configMap of theme setting.
+         * Update the configMap of theme setting. It is deprecated.
          * @param {ThemeV1alpha1ConsoleApiUpdateThemeConfigRequest} requestParameters Request parameters.
          * @param {*} [options] Override http request option.
+         * @deprecated
          * @throws {RequiredError}
          */
         updateThemeConfig(requestParameters: ThemeV1alpha1ConsoleApiUpdateThemeConfigRequest, options?: RawAxiosRequestConfig): AxiosPromise<ConfigMap> {
             return localVarFp.updateThemeConfig(requestParameters.name, requestParameters.configMap, options).then((request) => request(axios, basePath));
         },
+        /**
+         * Update the configMap of theme setting.
+         * @param {ThemeV1alpha1ConsoleApiUpdateThemeJsonConfigRequest} requestParameters Request parameters.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        updateThemeJsonConfig(requestParameters: ThemeV1alpha1ConsoleApiUpdateThemeJsonConfigRequest, options?: RawAxiosRequestConfig): AxiosPromise<void> {
+            return localVarFp.updateThemeJsonConfig(requestParameters.name, requestParameters.body, options).then((request) => request(axios, basePath));
+        },
         /**
          * Upgrade theme
          * @param {ThemeV1alpha1ConsoleApiUpgradeThemeRequest} requestParameters Request parameters.
@@ -937,6 +1074,20 @@ export interface ThemeV1alpha1ConsoleApiFetchThemeConfigRequest {
     readonly name: string
 }
 
+/**
+ * Request parameters for fetchThemeJsonConfig operation in ThemeV1alpha1ConsoleApi.
+ * @export
+ * @interface ThemeV1alpha1ConsoleApiFetchThemeJsonConfigRequest
+ */
+export interface ThemeV1alpha1ConsoleApiFetchThemeJsonConfigRequest {
+    /**
+     * 
+     * @type {string}
+     * @memberof ThemeV1alpha1ConsoleApiFetchThemeJsonConfig
+     */
+    readonly name: string
+}
+
 /**
  * Request parameters for fetchThemeSetting operation in ThemeV1alpha1ConsoleApi.
  * @export
@@ -1070,6 +1221,27 @@ export interface ThemeV1alpha1ConsoleApiUpdateThemeConfigRequest {
     readonly configMap: ConfigMap
 }
 
+/**
+ * Request parameters for updateThemeJsonConfig operation in ThemeV1alpha1ConsoleApi.
+ * @export
+ * @interface ThemeV1alpha1ConsoleApiUpdateThemeJsonConfigRequest
+ */
+export interface ThemeV1alpha1ConsoleApiUpdateThemeJsonConfigRequest {
+    /**
+     * 
+     * @type {string}
+     * @memberof ThemeV1alpha1ConsoleApiUpdateThemeJsonConfig
+     */
+    readonly name: string
+
+    /**
+     * 
+     * @type {object}
+     * @memberof ThemeV1alpha1ConsoleApiUpdateThemeJsonConfig
+     */
+    readonly body: object
+}
+
 /**
  * Request parameters for upgradeTheme operation in ThemeV1alpha1ConsoleApi.
  * @export
@@ -1141,9 +1313,10 @@ export class ThemeV1alpha1ConsoleApi extends BaseAPI {
     }
 
     /**
-     * Fetch configMap of theme by configured configMapName.
+     * Fetch configMap of theme by configured configMapName. It is deprecated.
      * @param {ThemeV1alpha1ConsoleApiFetchThemeConfigRequest} requestParameters Request parameters.
      * @param {*} [options] Override http request option.
+     * @deprecated
      * @throws {RequiredError}
      * @memberof ThemeV1alpha1ConsoleApi
      */
@@ -1151,6 +1324,17 @@ export class ThemeV1alpha1ConsoleApi extends BaseAPI {
         return ThemeV1alpha1ConsoleApiFp(this.configuration).fetchThemeConfig(requestParameters.name, options).then((request) => request(this.axios, this.basePath));
     }
 
+    /**
+     * Fetch converted json config of theme by configured configMapName.
+     * @param {ThemeV1alpha1ConsoleApiFetchThemeJsonConfigRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof ThemeV1alpha1ConsoleApi
+     */
+    public fetchThemeJsonConfig(requestParameters: ThemeV1alpha1ConsoleApiFetchThemeJsonConfigRequest, options?: RawAxiosRequestConfig) {
+        return ThemeV1alpha1ConsoleApiFp(this.configuration).fetchThemeJsonConfig(requestParameters.name, options).then((request) => request(this.axios, this.basePath));
+    }
+
     /**
      * Fetch setting of theme.
      * @param {ThemeV1alpha1ConsoleApiFetchThemeSettingRequest} requestParameters Request parameters.
@@ -1228,9 +1412,10 @@ export class ThemeV1alpha1ConsoleApi extends BaseAPI {
     }
 
     /**
-     * Update the configMap of theme setting.
+     * Update the configMap of theme setting. It is deprecated.
      * @param {ThemeV1alpha1ConsoleApiUpdateThemeConfigRequest} requestParameters Request parameters.
      * @param {*} [options] Override http request option.
+     * @deprecated
      * @throws {RequiredError}
      * @memberof ThemeV1alpha1ConsoleApi
      */
@@ -1238,6 +1423,17 @@ export class ThemeV1alpha1ConsoleApi extends BaseAPI {
         return ThemeV1alpha1ConsoleApiFp(this.configuration).updateThemeConfig(requestParameters.name, requestParameters.configMap, options).then((request) => request(this.axios, this.basePath));
     }
 
+    /**
+     * Update the configMap of theme setting.
+     * @param {ThemeV1alpha1ConsoleApiUpdateThemeJsonConfigRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof ThemeV1alpha1ConsoleApi
+     */
+    public updateThemeJsonConfig(requestParameters: ThemeV1alpha1ConsoleApiUpdateThemeJsonConfigRequest, options?: RawAxiosRequestConfig) {
+        return ThemeV1alpha1ConsoleApiFp(this.configuration).updateThemeJsonConfig(requestParameters.name, requestParameters.body, options).then((request) => request(this.axios, this.basePath));
+    }
+
     /**
      * Upgrade theme
      * @param {ThemeV1alpha1ConsoleApiUpgradeThemeRequest} requestParameters Request parameters.

From fd40770ebc2c11bc3c06563a17ac19d6120af164 Mon Sep 17 00:00:00 2001
From: Ryan Wang <i@ryanc.cc>
Date: Thu, 26 Sep 2024 16:11:31 +0800
Subject: [PATCH 040/185] chore: bump vue version to 3.5 (#6696)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/area ui
/kind improvement
/milestone 2.20.x

#### What this PR does / why we need it:

升级 UI 项目的 Vue 版本至 3.5.x。

#### Does this PR introduce a user-facing change?

```release-note
升级 UI 项目的 Vue 版本至 3.5.x。
```
---
 .../components/CategoryEditingModal.vue       |   2 +-
 .../components/preview/ThemePreviewModal.vue  |   3 +-
 .../components/UserPasswordChangeModal.vue    |   1 +
 ui/console-src/views/system/Setup.vue         |   1 +
 ui/package.json                               |   8 +-
 ui/packages/api-client/package.json           |   2 +-
 ui/packages/components/package.json           |   4 +-
 .../src/components/dialog/Dialog.stories.ts   |   1 +
 .../components/dropdown/Draopdown.stories.ts  |  17 +-
 .../src/components/dropdown/Dropdown.vue      |   2 +-
 .../src/components/dropdown/DropdownItem.vue  |   2 +-
 ui/packages/components/tsconfig.app.json      |   2 +-
 ui/packages/editor/package.json               |   4 +-
 ui/packages/shared/package.json               |   4 +-
 ui/pnpm-lock.yaml                             | 628 ++++++++++--------
 ui/src/components/image/LazyImage.vue         |  10 +-
 ui/src/components/video/LazyVideo.vue         |   8 +-
 ui/tsconfig.app.json                          |   1 -
 .../posts/components/PostSettingForm.vue      |   1 +
 .../components/PasswordChangeModal.vue        |   1 +
 .../PersonalAccessTokenCreationModal.vue      |   1 +
 21 files changed, 389 insertions(+), 314 deletions(-)

diff --git a/ui/console-src/modules/contents/posts/categories/components/CategoryEditingModal.vue b/ui/console-src/modules/contents/posts/categories/components/CategoryEditingModal.vue
index 6067169eb0..03bf861d06 100644
--- a/ui/console-src/modules/contents/posts/categories/components/CategoryEditingModal.vue
+++ b/ui/console-src/modules/contents/posts/categories/components/CategoryEditingModal.vue
@@ -27,7 +27,7 @@ const props = withDefaults(
   defineProps<{
     category?: Category;
     parentCategory?: Category;
-    isChildLevelCategory: boolean;
+    isChildLevelCategory?: boolean;
   }>(),
   {
     category: undefined,
diff --git a/ui/console-src/modules/interface/themes/components/preview/ThemePreviewModal.vue b/ui/console-src/modules/interface/themes/components/preview/ThemePreviewModal.vue
index d7864dd53b..bbe9272db7 100644
--- a/ui/console-src/modules/interface/themes/components/preview/ThemePreviewModal.vue
+++ b/ui/console-src/modules/interface/themes/components/preview/ThemePreviewModal.vue
@@ -1,4 +1,5 @@
 <script lang="ts" setup>
+import StickyBlock from "@/components/sticky-block/StickyBlock.vue";
 import { useSettingFormConvert } from "@console/composables/use-setting-form";
 import { useThemeStore } from "@console/stores/theme";
 import type {
@@ -28,7 +29,6 @@ import { storeToRefs } from "pinia";
 import { computed, markRaw, onMounted, ref, toRaw } from "vue";
 import { useI18n } from "vue-i18n";
 import ThemePreviewListItem from "./ThemePreviewListItem.vue";
-import StickyBlock from "@/components/sticky-block/StickyBlock.vue";
 
 const props = withDefaults(
   defineProps<{
@@ -304,6 +304,7 @@ const iframeClasses = computed(() => {
             @after-leave="switching = false"
           >
             <div v-show="settingsVisible" class="mb-20">
+              <!-- @vue-skip -->
               <VTabbar
                 v-model:active-id="activeSettingTab"
                 :items="settingTabs"
diff --git a/ui/console-src/modules/system/users/components/UserPasswordChangeModal.vue b/ui/console-src/modules/system/users/components/UserPasswordChangeModal.vue
index 1af2058edf..15ae82248c 100644
--- a/ui/console-src/modules/system/users/components/UserPasswordChangeModal.vue
+++ b/ui/console-src/modules/system/users/components/UserPasswordChangeModal.vue
@@ -66,6 +66,7 @@ const handleChangePassword = async () => {
     :title="$t('core.user.change_password_modal.title')"
     @close="emit('close')"
   >
+    <!-- @vue-ignore -->
     <FormKit
       id="password-form"
       v-model="formState"
diff --git a/ui/console-src/views/system/Setup.vue b/ui/console-src/views/system/Setup.vue
index 8a5f7bb5fa..d1da4df5ae 100644
--- a/ui/console-src/views/system/Setup.vue
+++ b/ui/console-src/views/system/Setup.vue
@@ -50,6 +50,7 @@ const inputClasses = {
     <IconLogo class="mb-8 flex-none" />
 
     <div class="flex w-72 flex-col">
+      <!-- @vue-ignore -->
       <FormKit
         id="setup-form"
         v-model="formState"
diff --git a/ui/package.json b/ui/package.json
index 6c5af2e395..b50b25b0af 100644
--- a/ui/package.json
+++ b/ui/package.json
@@ -100,7 +100,7 @@
     "short-unique-id": "^5.0.2",
     "transliteration": "^2.3.5",
     "ua-parser-js": "^1.0.38",
-    "vue": "^3.4.27",
+    "vue": "^3.5.8",
     "vue-demi": "^0.14.7",
     "vue-draggable-plus": "^0.4.1",
     "vue-grid-layout": "3.0.0-beta1",
@@ -122,7 +122,7 @@
     "@types/qs": "^6.9.7",
     "@types/randomstring": "^1.1.8",
     "@types/ua-parser-js": "^0.7.39",
-    "@vitejs/plugin-vue": "^5.1.2",
+    "@vitejs/plugin-vue": "^5.1.4",
     "@vitejs/plugin-vue-jsx": "^4.0.1",
     "@vitest/ui": "^0.34.1",
     "@vue/compiler-sfc": "^3.4.27",
@@ -151,7 +151,7 @@
     "tailwindcss": "^3.2.7",
     "tailwindcss-safe-area": "^0.2.2",
     "tailwindcss-themer": "^2.0.3",
-    "typescript": "~5.5.4",
+    "typescript": "~5.6.2",
     "unplugin-icons": "^0.19.2",
     "vite": "^5.4.1",
     "vite-plugin-externals": "^0.6.2",
@@ -160,6 +160,6 @@
     "vite-plugin-static-copy": "^1.0.6",
     "vite-plugin-vue-devtools": "^7.3.8",
     "vitest": "^0.34.1",
-    "vue-tsc": "^2.0.29"
+    "vue-tsc": "^2.1.6"
   }
 }
diff --git a/ui/packages/api-client/package.json b/ui/packages/api-client/package.json
index 7e781c6849..2a08afd2b5 100644
--- a/ui/packages/api-client/package.json
+++ b/ui/packages/api-client/package.json
@@ -50,7 +50,7 @@
     "rimraf": "^5.0.7",
     "typescript": "~5.5.4",
     "unbuild": "^0.7.6",
-    "vite-plugin-dts": "^4.0.3"
+    "vite-plugin-dts": "^4.2.2"
   },
   "peerDependencies": {
     "axios": "^1.7.x"
diff --git a/ui/packages/components/package.json b/ui/packages/components/package.json
index 2296e08ced..b8ab022570 100644
--- a/ui/packages/components/package.json
+++ b/ui/packages/components/package.json
@@ -58,10 +58,10 @@
     "react-dom": "^18.2.0",
     "storybook": "^7.6.3",
     "unplugin-icons": "^0.14.15",
-    "vite-plugin-dts": "^4.0.3"
+    "vite-plugin-dts": "^4.2.2"
   },
   "peerDependencies": {
-    "vue": "^3.4.27",
+    "vue": "^3.5.8",
     "vue-router": "^4.3.2"
   },
   "exports": {
diff --git a/ui/packages/components/src/components/dialog/Dialog.stories.ts b/ui/packages/components/src/components/dialog/Dialog.stories.ts
index 7ab6390a01..e423c49dd7 100644
--- a/ui/packages/components/src/components/dialog/Dialog.stories.ts
+++ b/ui/packages/components/src/components/dialog/Dialog.stories.ts
@@ -12,6 +12,7 @@ const meta: Meta<typeof VDialog> = {
     height: 400,
     setup() {
       const showDialog = () => {
+        // @ts-ignore
         args.visible = true;
       };
 
diff --git a/ui/packages/components/src/components/dropdown/Draopdown.stories.ts b/ui/packages/components/src/components/dropdown/Draopdown.stories.ts
index 73c918891b..4aa6d58e19 100644
--- a/ui/packages/components/src/components/dropdown/Draopdown.stories.ts
+++ b/ui/packages/components/src/components/dropdown/Draopdown.stories.ts
@@ -18,9 +18,12 @@ const meta: Meta<typeof VDropdown> = {
     template: `
     <div style="height: 300px">
       <VDropdown>
-        ${args.default}
+        <VButton>Hello</VButton>
         <template #popper>
-          ${args.popper}
+          <VDropdownItem>删除</VDropdownItem>
+          <VDropdownDivider></VDropdownDivider>
+          <VDropdownItem>删除</VDropdownItem>
+          <VDropdownItem>编辑</VDropdownItem>
         </template>
       </VDropdown>
     </div>
@@ -34,13 +37,5 @@ export default meta;
 type Story = StoryObj<typeof VDropdown>;
 
 export const Default: Story = {
-  args: {
-    default: `<VButton>Hello</VButton>`,
-    popper: `
-      <VDropdownItem>删除</VDropdownItem>
-      <VDropdownDivider></VDropdownDivider>
-      <VDropdownItem>删除</VDropdownItem>
-      <VDropdownItem>编辑</VDropdownItem>
-    `,
-  },
+  args: {},
 };
diff --git a/ui/packages/components/src/components/dropdown/Dropdown.vue b/ui/packages/components/src/components/dropdown/Dropdown.vue
index 7c4b1fb643..76d723ed9d 100644
--- a/ui/packages/components/src/components/dropdown/Dropdown.vue
+++ b/ui/packages/components/src/components/dropdown/Dropdown.vue
@@ -41,7 +41,7 @@ defineExpose({
 </script>
 
 <template>
-  <!-- @vue-ignore -->
+  <!-- @vue-skip -->
   <FloatingDropdown
     ref="dropdownRef"
     :placement="placement"
diff --git a/ui/packages/components/src/components/dropdown/DropdownItem.vue b/ui/packages/components/src/components/dropdown/DropdownItem.vue
index 699cdb23fe..9b8a349238 100644
--- a/ui/packages/components/src/components/dropdown/DropdownItem.vue
+++ b/ui/packages/components/src/components/dropdown/DropdownItem.vue
@@ -6,7 +6,7 @@ const props = withDefaults(
   defineProps<{
     selected?: boolean;
     disabled?: boolean;
-    type: "default" | "danger";
+    type?: "default" | "danger";
   }>(),
   {
     selected: false,
diff --git a/ui/packages/components/tsconfig.app.json b/ui/packages/components/tsconfig.app.json
index 7ef1c2a5a2..7ce4e8690e 100644
--- a/ui/packages/components/tsconfig.app.json
+++ b/ui/packages/components/tsconfig.app.json
@@ -1,7 +1,7 @@
 {
   "extends": "@vue/tsconfig/tsconfig.dom.json",
   "include": ["env.d.ts", "src/**/*", "src/**/*.vue"],
-  "exclude": ["src/**/__tests__/*"],
+  "exclude": ["src/**/__tests__/*", "node_modules"],
   "compilerOptions": {
     "composite": true,
     "baseUrl": ".",
diff --git a/ui/packages/editor/package.json b/ui/packages/editor/package.json
index 4c36109cde..10bedb02c2 100644
--- a/ui/packages/editor/package.json
+++ b/ui/packages/editor/package.json
@@ -87,9 +87,9 @@
     "@iconify/json": "^2.2.117",
     "@types/linkifyjs": "^2.1.7",
     "release-it": "^16.1.5",
-    "vite-plugin-dts": "^4.0.3"
+    "vite-plugin-dts": "^4.2.2"
   },
   "peerDependencies": {
-    "vue": "^3.4.27"
+    "vue": "^3.5.8"
   }
 }
diff --git a/ui/packages/shared/package.json b/ui/packages/shared/package.json
index 2c9c74f684..46b01f01fd 100644
--- a/ui/packages/shared/package.json
+++ b/ui/packages/shared/package.json
@@ -38,10 +38,10 @@
   "homepage": "https://github.com/halo-dev/halo/tree/main/ui/packages/shared#readme",
   "license": "MIT",
   "devDependencies": {
-    "vite-plugin-dts": "^4.0.3"
+    "vite-plugin-dts": "^4.2.2"
   },
   "peerDependencies": {
-    "vue": "^3.4.27",
+    "vue": "^3.5.8",
     "vue-router": "^4.3.2"
   },
   "dependencies": {
diff --git a/ui/pnpm-lock.yaml b/ui/pnpm-lock.yaml
index 90be96766e..2a4278190e 100644
--- a/ui/pnpm-lock.yaml
+++ b/ui/pnpm-lock.yaml
@@ -64,7 +64,7 @@ importers:
         version: 1.5.9
       '@formkit/vue':
         specifier: ^1.5.9
-        version: 1.5.9(tailwindcss@3.3.0(postcss@8.4.21))(typescript@5.5.4)
+        version: 1.5.9(tailwindcss@3.3.0(postcss@8.4.21))(typescript@5.6.2)
       '@halo-dev/api-client':
         specifier: workspace:*
         version: link:packages/api-client
@@ -79,7 +79,7 @@ importers:
         version: link:packages/editor
       '@tanstack/vue-query':
         specifier: ^4.29.1
-        version: 4.29.1(vue@3.4.27(typescript@5.5.4))
+        version: 4.29.1(vue@3.5.8(typescript@5.6.2))
       '@tiptap/extension-character-count':
         specifier: ^2.6.5
         version: 2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))(@tiptap/pm@2.6.5)
@@ -109,25 +109,25 @@ importers:
         version: 3.3.3(@uppy/core@3.11.3)
       '@uppy/vue':
         specifier: ^1.1.2
-        version: 1.1.2(@uppy/core@3.11.3)(@uppy/dashboard@3.8.3(@uppy/core@3.11.3))(@uppy/drag-drop@3.1.0(@uppy/core@3.11.3))(@uppy/file-input@3.1.2(@uppy/core@3.11.3))(@uppy/progress-bar@3.1.1(@uppy/core@3.11.3))(@uppy/status-bar@3.3.3(@uppy/core@3.11.3))(vue@3.4.27(typescript@5.5.4))
+        version: 1.1.2(@uppy/core@3.11.3)(@uppy/dashboard@3.8.3(@uppy/core@3.11.3))(@uppy/drag-drop@3.1.0(@uppy/core@3.11.3))(@uppy/file-input@3.1.2(@uppy/core@3.11.3))(@uppy/progress-bar@3.1.1(@uppy/core@3.11.3))(@uppy/status-bar@3.3.3(@uppy/core@3.11.3))(vue@3.5.8(typescript@5.6.2))
       '@uppy/xhr-upload':
         specifier: 3.6.0
         version: 3.6.0(@uppy/core@3.11.3)
       '@vueuse/components':
         specifier: ^10.9.0
-        version: 10.9.0(vue@3.4.27(typescript@5.5.4))
+        version: 10.9.0(vue@3.5.8(typescript@5.6.2))
       '@vueuse/core':
         specifier: ^10.9.0
-        version: 10.9.0(vue@3.4.27(typescript@5.5.4))
+        version: 10.9.0(vue@3.5.8(typescript@5.6.2))
       '@vueuse/integrations':
         specifier: ^10.9.0
-        version: 10.9.0(axios@1.7.2)(fuse.js@6.6.2)(qrcode@1.5.3)(sortablejs@1.14.0)(vue@3.4.27(typescript@5.5.4))
+        version: 10.9.0(axios@1.7.2)(fuse.js@6.6.2)(qrcode@1.5.3)(sortablejs@1.14.0)(vue@3.5.8(typescript@5.6.2))
       '@vueuse/router':
         specifier: ^10.9.0
-        version: 10.9.0(vue-router@4.3.2(vue@3.4.27(typescript@5.5.4)))(vue@3.4.27(typescript@5.5.4))
+        version: 10.9.0(vue-router@4.3.2(vue@3.5.8(typescript@5.6.2)))(vue@3.5.8(typescript@5.6.2))
       '@vueuse/shared':
         specifier: ^10.9.0
-        version: 10.9.0(vue@3.4.27(typescript@5.5.4))
+        version: 10.9.0(vue@3.5.8(typescript@5.6.2))
       axios:
         specifier: ^1.7.x
         version: 1.7.2(debug@4.3.2)
@@ -148,7 +148,7 @@ importers:
         version: 5.6.0
       floating-vue:
         specifier: ^5.2.2
-        version: 5.2.2(vue@3.4.27(typescript@5.5.4))
+        version: 5.2.2(vue@3.5.8(typescript@5.6.2))
       fuse.js:
         specifier: ^6.6.2
         version: 6.6.2
@@ -163,13 +163,13 @@ importers:
         version: 2.5.0
       overlayscrollbars-vue:
         specifier: ^0.5.7
-        version: 0.5.7(overlayscrollbars@2.5.0)(vue@3.4.27(typescript@5.5.4))
+        version: 0.5.7(overlayscrollbars@2.5.0)(vue@3.5.8(typescript@5.6.2))
       path-browserify:
         specifier: ^1.0.1
         version: 1.0.1
       pinia:
         specifier: ^2.1.6
-        version: 2.1.6(typescript@5.5.4)(vue@3.4.27(typescript@5.5.4))
+        version: 2.1.6(typescript@5.6.2)(vue@3.5.8(typescript@5.6.2))
       pretty-bytes:
         specifier: ^6.0.0
         version: 6.0.0
@@ -189,11 +189,11 @@ importers:
         specifier: ^1.0.38
         version: 1.0.38
       vue:
-        specifier: ^3.4.27
-        version: 3.4.27(typescript@5.5.4)
+        specifier: ^3.5.8
+        version: 3.5.8(typescript@5.6.2)
       vue-demi:
         specifier: ^0.14.7
-        version: 0.14.7(vue@3.4.27(typescript@5.5.4))
+        version: 0.14.7(vue@3.5.8(typescript@5.6.2))
       vue-draggable-plus:
         specifier: ^0.4.1
         version: 0.4.1(@types/sortablejs@1.15.8)
@@ -202,10 +202,10 @@ importers:
         version: 3.0.0-beta1(@interactjs/core@1.10.17(@interactjs/utils@1.10.17))(@interactjs/utils@1.10.17)
       vue-i18n:
         specifier: ^9.13.1
-        version: 9.13.1(vue@3.4.27(typescript@5.5.4))
+        version: 9.13.1(vue@3.5.8(typescript@5.6.2))
       vue-router:
         specifier: ^4.3.2
-        version: 4.3.2(vue@3.4.27(typescript@5.5.4))
+        version: 4.3.2(vue@3.5.8(typescript@5.6.2))
     devDependencies:
       '@changesets/cli':
         specifier: ^2.25.2
@@ -215,7 +215,7 @@ importers:
         version: 2.2.235
       '@intlify/unplugin-vue-i18n':
         specifier: ^4.0.0
-        version: 4.0.0(rollup@4.17.2)(vue-i18n@9.13.1(vue@3.4.27(typescript@5.5.4)))
+        version: 4.0.0(rollup@4.17.2)(vue-i18n@9.13.1(vue@3.5.8(typescript@5.6.2)))
       '@rushstack/eslint-patch':
         specifier: ^1.3.2
         version: 1.3.2
@@ -250,11 +250,11 @@ importers:
         specifier: ^0.7.39
         version: 0.7.39
       '@vitejs/plugin-vue':
-        specifier: ^5.1.2
-        version: 5.1.2(vite@5.4.1(@types/node@18.13.0)(less@4.2.0)(sass@1.60.0)(terser@5.31.0))(vue@3.4.27(typescript@5.5.4))
+        specifier: ^5.1.4
+        version: 5.1.4(vite@5.4.1(@types/node@18.13.0)(less@4.2.0)(sass@1.60.0)(terser@5.31.0))(vue@3.5.8(typescript@5.6.2))
       '@vitejs/plugin-vue-jsx':
         specifier: ^4.0.1
-        version: 4.0.1(vite@5.4.1(@types/node@18.13.0)(less@4.2.0)(sass@1.60.0)(terser@5.31.0))(vue@3.4.27(typescript@5.5.4))
+        version: 4.0.1(vite@5.4.1(@types/node@18.13.0)(less@4.2.0)(sass@1.60.0)(terser@5.31.0))(vue@3.5.8(typescript@5.6.2))
       '@vitest/ui':
         specifier: ^0.34.1
         version: 0.34.1(vitest@0.34.1)
@@ -266,7 +266,7 @@ importers:
         version: 7.1.0(eslint@8.43.0)(prettier@2.8.8)
       '@vue/eslint-config-typescript':
         specifier: ^11.0.3
-        version: 11.0.3(eslint-plugin-vue@9.17.0(eslint@8.43.0))(eslint@8.43.0)(typescript@5.5.4)
+        version: 11.0.3(eslint-plugin-vue@9.17.0(eslint@8.43.0))(eslint@8.43.0)(typescript@5.6.2)
       '@vue/test-utils':
         specifier: ^2.4.6
         version: 2.4.6
@@ -337,8 +337,8 @@ importers:
         specifier: ^2.0.3
         version: 2.0.3(tailwindcss@3.3.0(postcss@8.4.21))
       typescript:
-        specifier: ~5.5.4
-        version: 5.5.4
+        specifier: ~5.6.2
+        version: 5.6.2
       unplugin-icons:
         specifier: ^0.19.2
         version: 0.19.2(@vue/compiler-sfc@3.4.27)(vue-template-compiler@2.7.14)
@@ -359,13 +359,13 @@ importers:
         version: 1.0.6(vite@5.4.1(@types/node@18.13.0)(less@4.2.0)(sass@1.60.0)(terser@5.31.0))
       vite-plugin-vue-devtools:
         specifier: ^7.3.8
-        version: 7.3.8(rollup@4.17.2)(vite@5.4.1(@types/node@18.13.0)(less@4.2.0)(sass@1.60.0)(terser@5.31.0))(vue@3.4.27(typescript@5.5.4))
+        version: 7.3.8(rollup@4.17.2)(vite@5.4.1(@types/node@18.13.0)(less@4.2.0)(sass@1.60.0)(terser@5.31.0))(vue@3.5.8(typescript@5.6.2))
       vitest:
         specifier: ^0.34.1
         version: 0.34.1(@vitest/ui@0.34.1)(jsdom@20.0.3)(less@4.2.0)(sass@1.60.0)(terser@5.31.0)
       vue-tsc:
-        specifier: ^2.0.29
-        version: 2.0.29(typescript@5.5.4)
+        specifier: ^2.1.6
+        version: 2.1.6(typescript@5.6.2)
 
   packages/api-client:
     dependencies:
@@ -395,20 +395,20 @@ importers:
         specifier: ^0.7.6
         version: 0.7.6
       vite-plugin-dts:
-        specifier: ^4.0.3
-        version: 4.0.3(@types/node@20.14.2)(rollup@2.79.1)(typescript@5.5.4)(vite@5.4.1(@types/node@20.14.2)(less@4.2.0)(sass@1.60.0)(terser@5.31.0))
+        specifier: ^4.2.2
+        version: 4.2.2(@types/node@20.14.2)(rollup@2.79.1)(typescript@5.5.4)(vite@5.4.1(@types/node@20.14.2)(less@4.2.0)(sass@1.60.0)(terser@5.31.0))
 
   packages/components:
     dependencies:
       floating-vue:
         specifier: ^5.2.2
-        version: 5.2.2(vue@3.4.27(typescript@5.5.4))
+        version: 5.2.2(vue@3.5.8(typescript@5.6.2))
       vue:
-        specifier: ^3.4.27
-        version: 3.4.27(typescript@5.5.4)
+        specifier: ^3.5.8
+        version: 3.5.8(typescript@5.6.2)
       vue-router:
         specifier: ^4.3.2
-        version: 4.3.2(vue@3.4.27(typescript@5.5.4))
+        version: 4.3.2(vue@3.5.8(typescript@5.6.2))
     devDependencies:
       '@iconify-json/ri':
         specifier: ^1.1.15
@@ -424,7 +424,7 @@ importers:
         version: 7.6.3(react@18.2.0)
       '@storybook/addon-styling':
         specifier: ^1.3.7
-        version: 1.3.7(@types/react@18.2.41)(less@4.2.0)(postcss@8.4.38)(react-dom@18.2.0(react@18.2.0))(react@18.2.0)(sass@1.60.0)(typescript@5.5.4)(webpack@5.89.0(esbuild@0.18.20))
+        version: 1.3.7(@types/react@18.2.41)(less@4.2.0)(postcss@8.4.38)(react-dom@18.2.0(react@18.2.0))(react@18.2.0)(sass@1.60.0)(typescript@5.6.2)(webpack@5.89.0(esbuild@0.18.20))
       '@storybook/blocks':
         specifier: ^7.6.3
         version: 7.6.3(@types/react@18.2.41)(react-dom@18.2.0(react@18.2.0))(react@18.2.0)
@@ -433,13 +433,13 @@ importers:
         version: 0.0.14-next.2
       '@storybook/vue3':
         specifier: ^7.6.3
-        version: 7.6.3(@vue/compiler-core@3.4.27)(vue@3.4.27(typescript@5.5.4))
+        version: 7.6.3(@vue/compiler-core@3.5.8)(vue@3.5.8(typescript@5.6.2))
       '@storybook/vue3-vite':
         specifier: ^7.6.3
-        version: 7.6.3(@vue/compiler-core@3.4.27)(typescript@5.5.4)(vite@5.4.1(@types/node@20.14.2)(less@4.2.0)(sass@1.60.0)(terser@5.31.0))(vue@3.4.27(typescript@5.5.4))
+        version: 7.6.3(@vue/compiler-core@3.5.8)(typescript@5.6.2)(vite@5.4.1(@types/node@20.14.2)(less@4.2.0)(sass@1.60.0)(terser@5.31.0))(vue@3.5.8(typescript@5.6.2))
       eslint-plugin-storybook:
         specifier: ^0.6.15
-        version: 0.6.15(eslint@8.43.0)(typescript@5.5.4)
+        version: 0.6.15(eslint@8.43.0)(typescript@5.6.2)
       react:
         specifier: ^18.2.0
         version: 18.2.0
@@ -451,16 +451,16 @@ importers:
         version: 7.6.3
       unplugin-icons:
         specifier: ^0.14.15
-        version: 0.14.15(@vue/compiler-sfc@3.4.27)(vue-template-compiler@2.7.14)
+        version: 0.14.15(@vue/compiler-sfc@3.5.8)(vue-template-compiler@2.7.14)
       vite-plugin-dts:
-        specifier: ^4.0.3
-        version: 4.0.3(@types/node@20.14.2)(rollup@4.17.2)(typescript@5.5.4)(vite@5.4.1(@types/node@20.14.2)(less@4.2.0)(sass@1.60.0)(terser@5.31.0))
+        specifier: ^4.2.2
+        version: 4.2.2(@types/node@20.14.2)(rollup@4.17.2)(typescript@5.6.2)(vite@5.4.1(@types/node@20.14.2)(less@4.2.0)(sass@1.60.0)(terser@5.31.0))
 
   packages/editor:
     dependencies:
       '@ckpack/vue-color':
         specifier: ^1.5.0
-        version: 1.5.0(vue@3.4.27(typescript@5.5.4))
+        version: 1.5.0(vue@3.5.8(typescript@5.6.2))
       '@tiptap/core':
         specifier: ^2.6.5
         version: 2.6.5(@tiptap/pm@2.6.5)
@@ -568,10 +568,10 @@ importers:
         version: 2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))(@tiptap/pm@2.6.5)
       '@tiptap/vue-3':
         specifier: ^2.6.5
-        version: 2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))(@tiptap/pm@2.6.5)(vue@3.4.27(typescript@5.5.4))
+        version: 2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))(@tiptap/pm@2.6.5)(vue@3.5.8(typescript@5.6.2))
       floating-vue:
         specifier: ^5.2.2
-        version: 5.2.2(vue@3.4.27(typescript@5.5.4))
+        version: 5.2.2(vue@3.5.8(typescript@5.6.2))
       github-markdown-css:
         specifier: ^5.2.0
         version: 5.2.0
@@ -585,8 +585,8 @@ importers:
         specifier: ^6.3.7
         version: 6.3.7
       vue:
-        specifier: ^3.4.27
-        version: 3.4.27(typescript@5.5.4)
+        specifier: ^3.5.8
+        version: 3.5.8(typescript@5.6.2)
     devDependencies:
       '@iconify/json':
         specifier: ^2.2.117
@@ -596,10 +596,10 @@ importers:
         version: 2.1.7
       release-it:
         specifier: ^16.1.5
-        version: 16.2.1(typescript@5.5.4)
+        version: 16.2.1(typescript@5.6.2)
       vite-plugin-dts:
-        specifier: ^4.0.3
-        version: 4.0.3(@types/node@20.14.2)(rollup@4.17.2)(typescript@5.5.4)(vite@5.4.1(@types/node@20.14.2)(less@4.2.0)(sass@1.60.0)(terser@5.31.0))
+        specifier: ^4.2.2
+        version: 4.2.2(@types/node@20.14.2)(rollup@4.17.2)(typescript@5.6.2)(vite@5.4.1(@types/node@20.14.2)(less@4.2.0)(sass@1.60.0)(terser@5.31.0))
 
   packages/shared:
     dependencies:
@@ -607,15 +607,15 @@ importers:
         specifier: workspace:*
         version: link:../api-client
       vue:
-        specifier: ^3.4.27
-        version: 3.4.27(typescript@5.5.4)
+        specifier: ^3.5.8
+        version: 3.5.8(typescript@5.6.2)
       vue-router:
         specifier: ^4.3.2
-        version: 4.3.2(vue@3.4.27(typescript@5.5.4))
+        version: 4.3.2(vue@3.5.8(typescript@5.6.2))
     devDependencies:
       vite-plugin-dts:
-        specifier: ^4.0.3
-        version: 4.0.3(@types/node@20.14.2)(rollup@4.17.2)(typescript@5.5.4)(vite@5.4.1(@types/node@20.14.2)(less@4.2.0)(sass@1.60.0)(terser@5.31.0))
+        specifier: ^4.2.2
+        version: 4.2.2(@types/node@20.14.2)(rollup@4.17.2)(typescript@5.6.2)(vite@5.4.1(@types/node@20.14.2)(less@4.2.0)(sass@1.60.0)(terser@5.31.0))
 
   packages/ui-plugin-bundler-kit:
     dependencies:
@@ -2659,11 +2659,11 @@ packages:
     peerDependencies:
       react: '>=16'
 
-  '@microsoft/api-extractor-model@7.29.4':
-    resolution: {integrity: sha512-LHOMxmT8/tU1IiiiHOdHFF83Qsi+V8d0kLfscG4EvQE9cafiR8blOYr8SfkQKWB1wgEilQgXJX3MIA4vetDLZw==}
+  '@microsoft/api-extractor-model@7.29.6':
+    resolution: {integrity: sha512-gC0KGtrZvxzf/Rt9oMYD2dHvtN/1KPEYsrQPyMKhLHnlVuO/f4AFN3E4toqZzD2pt4LhkKoYmL2H9tX3yCOyRw==}
 
-  '@microsoft/api-extractor@7.47.4':
-    resolution: {integrity: sha512-HKm+P4VNzWwvq1Ey+Jfhhj/3MjsD+ka2hbt8L5AcRM95lu1MFOYnz3XlU7Gr79Q/ZhOb7W/imAKeYrOI0bFydg==}
+  '@microsoft/api-extractor@7.47.7':
+    resolution: {integrity: sha512-fNiD3G55ZJGhPOBPMKD/enozj8yxJSYyVJWxRWdcUtw842rvthDHJgUWq9gXQTensFlMHv2wGuCjjivPv53j0A==}
     hasBin: true
 
   '@microsoft/tsdoc-config@0.17.0':
@@ -3282,8 +3282,8 @@ packages:
   '@rushstack/eslint-patch@1.3.2':
     resolution: {integrity: sha512-V+MvGwaHH03hYhY+k6Ef/xKd6RYlc4q8WBx+2ANmipHJcKuktNcI/NgEsJgdSUF6Lw32njT6OnrRsKYCdgHjYw==}
 
-  '@rushstack/node-core-library@5.5.1':
-    resolution: {integrity: sha512-ZutW56qIzH8xIOlfyaLQJFx+8IBqdbVCZdnj+XT1MorQ1JqqxHse8vbCpEM+2MjsrqcbxcgDIbfggB1ZSQ2A3g==}
+  '@rushstack/node-core-library@5.7.0':
+    resolution: {integrity: sha512-Ff9Cz/YlWu9ce4dmqNBZpA45AEya04XaBFIjV7xTVeEf+y/kTjEasmozqFELXlNG4ROdevss75JrrZ5WgufDkQ==}
     peerDependencies:
       '@types/node': '*'
     peerDependenciesMeta:
@@ -3293,16 +3293,16 @@ packages:
   '@rushstack/rig-package@0.5.3':
     resolution: {integrity: sha512-olzSSjYrvCNxUFZowevC3uz8gvKr3WTpHQ7BkpjtRpA3wK+T0ybep/SRUMfr195gBzJm5gaXw0ZMgjIyHqJUow==}
 
-  '@rushstack/terminal@0.13.3':
-    resolution: {integrity: sha512-fc3zjXOw8E0pXS5t9vTiIPx9gHA0fIdTXsu9mT4WbH+P3mYvnrX0iAQ5a6NvyK1+CqYWBTw/wVNx7SDJkI+WYQ==}
+  '@rushstack/terminal@0.14.0':
+    resolution: {integrity: sha512-juTKMAMpTIJKudeFkG5slD8Z/LHwNwGZLtU441l/u82XdTBfsP+LbGKJLCNwP5se+DMCT55GB8x9p6+C4UL7jw==}
     peerDependencies:
       '@types/node': '*'
     peerDependenciesMeta:
       '@types/node':
         optional: true
 
-  '@rushstack/ts-command-line@4.22.3':
-    resolution: {integrity: sha512-edMpWB3QhFFZ4KtSzS8WNjBgR4PXPPOVrOHMbb7kNpmQ1UFS9HdVtjCXg1H5fG+xYAbeE+TMPcVPUyX2p84STA==}
+  '@rushstack/ts-command-line@4.22.6':
+    resolution: {integrity: sha512-QSRqHT/IfoC5nk9zn6+fgyqOPXHME0BfchII9EUPR19pocsNp/xSbeBCbD3PIR2Lg+Q5qk7OFqk1VhWPMdKHJg==}
 
   '@sideway/address@4.1.4':
     resolution: {integrity: sha512-7vwq+rOHVWjyXxVlR76Agnvhy8I9rpzjosTESvmhNeXOXdZZB15Fl+TI9x1SiHZH5Jv2wTGduSxFDIaq0m3DUw==}
@@ -4187,8 +4187,8 @@ packages:
       vite: ^4.0.0
       vue: ^3.2.25
 
-  '@vitejs/plugin-vue@5.1.2':
-    resolution: {integrity: sha512-nY9IwH12qeiJqumTCLJLE7IiNx7HZ39cbHaysEUd+Myvbz9KAqd2yq+U01Kab1R/H1BmiyM2ShTYlNH32Fzo3A==}
+  '@vitejs/plugin-vue@5.1.4':
+    resolution: {integrity: sha512-N2XSI2n3sQqp5w7Y/AN/L2XDjBIRGqXko+eDp42sydYSBeJuSm5a1sLf8zakmo8u7tA8NmBgoDLA1HeOESjp9A==}
     engines: {node: ^18.0.0 || >=20.0.0}
     peerDependencies:
       vite: ^5.0.0
@@ -4217,23 +4217,14 @@ packages:
   '@vitest/utils@0.34.6':
     resolution: {integrity: sha512-IG5aDD8S6zlvloDsnzHw0Ut5xczlF+kv2BOTo+iXfPr54Yhi5qbVOgGB1hZaVq4iJ4C/MZ2J0y15IlsV/ZcI0A==}
 
-  '@volar/language-core@2.4.0':
-    resolution: {integrity: sha512-FTla+khE+sYK0qJP+6hwPAAUwiNHVMph4RUXpxf/FIPKUP61NFrVZorml4mjFShnueR2y9/j8/vnh09YwVdH7A==}
-
-  '@volar/language-core@2.4.0-alpha.18':
-    resolution: {integrity: sha512-JAYeJvYQQROmVRtSBIczaPjP3DX4QW1fOqW1Ebs0d3Y3EwSNRglz03dSv0Dm61dzd0Yx3WgTW3hndDnTQqgmyg==}
-
-  '@volar/source-map@2.4.0':
-    resolution: {integrity: sha512-2ceY8/NEZvN6F44TXw2qRP6AQsvCYhV2bxaBPWxV9HqIfkbRydSksTFObCF1DBDNBfKiZTS8G/4vqV6cvjdOIQ==}
+  '@volar/language-core@2.4.5':
+    resolution: {integrity: sha512-F4tA0DCO5Q1F5mScHmca0umsi2ufKULAnMOVBfMsZdT4myhVl4WdKRwCaKcfOkIEuyrAVvtq1ESBdZ+rSyLVww==}
 
-  '@volar/source-map@2.4.0-alpha.18':
-    resolution: {integrity: sha512-MTeCV9MUwwsH0sNFiZwKtFrrVZUK6p8ioZs3xFzHc2cvDXHWlYN3bChdQtwKX+FY2HG6H3CfAu1pKijolzIQ8g==}
+  '@volar/source-map@2.4.5':
+    resolution: {integrity: sha512-varwD7RaKE2J/Z+Zu6j3mNNJbNT394qIxXwdvz/4ao/vxOfyClZpSDtLKkwWmecinkOVos5+PWkWraelfMLfpw==}
 
-  '@volar/typescript@2.4.0':
-    resolution: {integrity: sha512-9zx3lQWgHmVd+JRRAHUSRiEhe4TlzL7U7e6ulWXOxHH/WNYxzKwCvZD7WYWEZFdw4dHfTD9vUR0yPQO6GilCaQ==}
-
-  '@volar/typescript@2.4.0-alpha.18':
-    resolution: {integrity: sha512-sXh5Y8sqGUkgxpMWUGvRXggxYHAVxg0Pa1C42lQZuPDrW6vHJPR0VCK8Sr7WJsAW530HuNQT/ZIskmXtxjybMQ==}
+  '@volar/typescript@2.4.5':
+    resolution: {integrity: sha512-mcT1mHvLljAEtHviVcBuOyAwwMKz1ibXTi5uYtP/pf4XxoAzpdkQ+Br2IC0NPCvLCbjPZmbf3I0udndkfB1CDg==}
 
   '@vue/babel-helper-vue-transform-on@1.1.5':
     resolution: {integrity: sha512-SgUymFpMoAyWeYWLAY+MkCK3QEROsiUnfaw5zxOVD/M64KQs8D/4oK6Q5omVA2hnvEOE0SCkH2TZxs/jnnUj7w==}
@@ -4262,15 +4253,27 @@ packages:
   '@vue/compiler-core@3.4.27':
     resolution: {integrity: sha512-E+RyqY24KnyDXsCuQrI+mlcdW3ALND6U7Gqa/+bVwbcpcR3BRRIckFoz7Qyd4TTlnugtwuI7YgjbvsLmxb+yvg==}
 
+  '@vue/compiler-core@3.5.8':
+    resolution: {integrity: sha512-Uzlxp91EPjfbpeO5KtC0KnXPkuTfGsNDeaKQJxQN718uz+RqDYarEf7UhQJGK+ZYloD2taUbHTI2J4WrUaZQNA==}
+
   '@vue/compiler-dom@3.4.27':
     resolution: {integrity: sha512-kUTvochG/oVgE1w5ViSr3KUBh9X7CWirebA3bezTbB5ZKBQZwR2Mwj9uoSKRMFcz4gSMzzLXBPD6KpCLb9nvWw==}
 
+  '@vue/compiler-dom@3.5.8':
+    resolution: {integrity: sha512-GUNHWvoDSbSa5ZSHT9SnV5WkStWfzJwwTd6NMGzilOE/HM5j+9EB9zGXdtu/fCNEmctBqMs6C9SvVPpVPuk1Eg==}
+
   '@vue/compiler-sfc@3.4.27':
     resolution: {integrity: sha512-nDwntUEADssW8e0rrmE0+OrONwmRlegDA1pD6QhVeXxjIytV03yDqTey9SBDiALsvAd5U4ZrEKbMyVXhX6mCGA==}
 
+  '@vue/compiler-sfc@3.5.8':
+    resolution: {integrity: sha512-taYpngQtSysrvO9GULaOSwcG5q821zCoIQBtQQSx7Uf7DxpR6CIHR90toPr9QfDD2mqHQPCSgoWBvJu0yV9zjg==}
+
   '@vue/compiler-ssr@3.4.27':
     resolution: {integrity: sha512-CVRzSJIltzMG5FcidsW0jKNQnNRYC8bT21VegyMMtHmhW3UOI7knmUehzswXLrExDLE6lQCZdrhD4ogI7c+vuw==}
 
+  '@vue/compiler-ssr@3.5.8':
+    resolution: {integrity: sha512-W96PtryNsNG9u0ZnN5Q5j27Z/feGrFV6zy9q5tzJVyJaLiwYxvC0ek4IXClZygyhjm+XKM7WD9pdKi/wIRVC/Q==}
+
   '@vue/compiler-vue2@2.7.16':
     resolution: {integrity: sha512-qYC3Psj9S/mfu9uVi5WvNZIzq+xnXMhOwbTFKKDD7b1lhpnn71jXSFdTQ+WsIEk0ONCd7VV2IMm7ONl6tbQ86A==}
 
@@ -4308,31 +4311,34 @@ packages:
       typescript:
         optional: true
 
-  '@vue/language-core@2.0.29':
-    resolution: {integrity: sha512-o2qz9JPjhdoVj8D2+9bDXbaI4q2uZTHQA/dbyZT4Bj1FR9viZxDJnLcKVHfxdn6wsOzRgpqIzJEEmSSvgMvDTQ==}
+  '@vue/language-core@2.1.6':
+    resolution: {integrity: sha512-MW569cSky9R/ooKMh6xa2g1D0AtRKbL56k83dzus/bx//RDJk24RHWkMzbAlXjMdDNyxAaagKPRquBIxkxlCkg==}
     peerDependencies:
       typescript: '*'
     peerDependenciesMeta:
       typescript:
         optional: true
 
-  '@vue/reactivity@3.4.27':
-    resolution: {integrity: sha512-kK0g4NknW6JX2yySLpsm2jlunZJl2/RJGZ0H9ddHdfBVHcNzxmQ0sS0b09ipmBoQpY8JM2KmUw+a6sO8Zo+zIA==}
+  '@vue/reactivity@3.5.8':
+    resolution: {integrity: sha512-mlgUyFHLCUZcAYkqvzYnlBRCh0t5ZQfLYit7nukn1GR96gc48Bp4B7OIcSfVSvlG1k3BPfD+p22gi1t2n9tsXg==}
 
-  '@vue/runtime-core@3.4.27':
-    resolution: {integrity: sha512-7aYA9GEbOOdviqVvcuweTLe5Za4qBZkUY7SvET6vE8kyypxVgaT1ixHLg4urtOlrApdgcdgHoTZCUuTGap/5WA==}
+  '@vue/runtime-core@3.5.8':
+    resolution: {integrity: sha512-fJuPelh64agZ8vKkZgp5iCkPaEqFJsYzxLk9vSC0X3G8ppknclNDr61gDc45yBGTaN5Xqc1qZWU3/NoaBMHcjQ==}
 
-  '@vue/runtime-dom@3.4.27':
-    resolution: {integrity: sha512-ScOmP70/3NPM+TW9hvVAz6VWWtZJqkbdf7w6ySsws+EsqtHvkhxaWLecrTorFxsawelM5Ys9FnDEMt6BPBDS0Q==}
+  '@vue/runtime-dom@3.5.8':
+    resolution: {integrity: sha512-DpAUz+PKjTZPUOB6zJgkxVI3GuYc2iWZiNeeHQUw53kdrparSTG6HeXUrYDjaam8dVsCdvQxDz6ZWxnyjccUjQ==}
 
-  '@vue/server-renderer@3.4.27':
-    resolution: {integrity: sha512-dlAMEuvmeA3rJsOMJ2J1kXU7o7pOxgsNHVr9K8hB3ImIkSuBrIdy0vF66h8gf8Tuinf1TK3mPAz2+2sqyf3KzA==}
+  '@vue/server-renderer@3.5.8':
+    resolution: {integrity: sha512-7AmC9/mEeV9mmXNVyUIm1a1AjUhyeeGNbkLh39J00E7iPeGks8OGRB5blJiMmvqSh8SkaS7jkLWSpXtxUCeagA==}
     peerDependencies:
-      vue: 3.4.27
+      vue: 3.5.8
 
   '@vue/shared@3.4.27':
     resolution: {integrity: sha512-DL3NmY2OFlqmYYrzp39yi3LDkKxa5vZVwxWdQ3rG0ekuWscHraeIbnI8t+aZK7qhYqEqWKTUdijadunb9pnrgA==}
 
+  '@vue/shared@3.5.8':
+    resolution: {integrity: sha512-mJleSWbAGySd2RJdX1RBtcrUBX6snyOc0qHpgk3lGi4l9/P/3ny3ELqFWqYdkXIwwNN/kdm8nD9ky8o6l/Lx2A==}
+
   '@vue/test-utils@2.4.6':
     resolution: {integrity: sha512-FMxEjOpYNYiFe0GkaHsnJPXFHxQ6m4t8vI/ElPGpMWxZKpmRvQ33OIrvRXemy6yha03RxhOlQuy+gZMC3CQSow==}
 
@@ -8195,6 +8201,9 @@ packages:
   picocolors@1.0.1:
     resolution: {integrity: sha512-anP1Z8qwhkbmu7MFP5iTt+wQKXgwzf7zTyGlcdzabySa9vd0Xt392U0rVmz9poOaBj0uHJKyyo9/upk0HrEQew==}
 
+  picocolors@1.1.0:
+    resolution: {integrity: sha512-TQ92mBOW0l3LeMeyLV6mzy/kWr8lkd/hp3mTg7wYK7zJhuBStmGMBG0BdeDZS/dZx1IukaX6Bk11zcln25o1Aw==}
+
   picomatch@2.3.1:
     resolution: {integrity: sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA==}
     engines: {node: '>=8.6'}
@@ -8366,6 +8375,10 @@ packages:
     resolution: {integrity: sha512-TesUflQ0WKZqAvg52PWL6kHgLKP6xB6heTOdoYM0Wt2UHyxNa4K25EZZMgKns3BH1RLVbZCREPpLY0rhnNoHVQ==}
     engines: {node: ^10 || ^12 || >=14}
 
+  postcss@8.4.47:
+    resolution: {integrity: sha512-56rxCq7G/XfB4EkXq9Egn5GCqugWvDFjafDOThIdMBsI15iqPqR5r15TfSr1YPYeEI19YeaXMCbY6u88Y76GLQ==}
+    engines: {node: ^10 || ^12 || >=14}
+
   preact@10.11.2:
     resolution: {integrity: sha512-skAwGDFmgxhq1DCBHke/9e12ewkhc7WYwjuhHB8HHS8zkdtITXLRmUMTeol2ldxvLwYtwbFeifZ9uDDWuyL4Iw==}
 
@@ -9219,6 +9232,10 @@ packages:
     resolution: {integrity: sha512-itJW8lvSA0TXEphiRoawsCksnlf8SyvmFzIhltqAHluXd88pkCd+cXJVHTDwdCr0IzwptSm035IHQktUu1QUMg==}
     engines: {node: '>=0.10.0'}
 
+  source-map-js@1.2.1:
+    resolution: {integrity: sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==}
+    engines: {node: '>=0.10.0'}
+
   source-map-support@0.5.21:
     resolution: {integrity: sha512-uBHU3L3czsIyYXKX88fdrGovxdSCoTGDRZ6SYXtSRxLZUzHg5P/66Ht6uoUlHu9EZod+inXhKo3qQgwXUT/y1w==}
 
@@ -9767,6 +9784,11 @@ packages:
     engines: {node: '>=14.17'}
     hasBin: true
 
+  typescript@5.6.2:
+    resolution: {integrity: sha512-NW8ByodCSNCwZeghjN3o+JX5OFH0Ojg6sadjEKY4huZ52TqbJTJnDo5+Tw98lSy63NZvi4n+ez5m2u5d4PkZyw==}
+    engines: {node: '>=14.17'}
+    hasBin: true
+
   ua-parser-js@1.0.38:
     resolution: {integrity: sha512-Aq5ppTOfvrCMgAPneW1HfWj66Xi7XL+/mIy996R1/CLS/rcyJQm6QZdsKrUeivDFQ+Oc9Wyuwor8Ze8peEoUoQ==}
 
@@ -10012,8 +10034,8 @@ packages:
     engines: {node: '>=v14.18.0'}
     hasBin: true
 
-  vite-plugin-dts@4.0.3:
-    resolution: {integrity: sha512-+xnTsaONwU2kV6zhRjtbRJSGN41uFR/whqmcb4k4fftLFDJElxthp0PP5Fq8gMeM9ytWMt1yk5gGgekLREWYQQ==}
+  vite-plugin-dts@4.2.2:
+    resolution: {integrity: sha512-USwTMReZFf8yXV+cKkm4WOMqmFjbReAvkyxON5xzdnZzJEBnFgax6BBDZIGGr9WMJYvhHdpaIHLrOjXDcla4OA==}
     engines: {node: ^14.18.0 || >=16.0.0}
     peerDependencies:
       typescript: '*'
@@ -10169,8 +10191,8 @@ packages:
   vue-component-type-helpers@2.0.19:
     resolution: {integrity: sha512-cN3f1aTxxKo4lzNeQAkVopswuImUrb5Iurll9Gaw5cqpnbTAxtEMM1mgi6ou4X79OCyqYv1U1mzBHJkzmiK82w==}
 
-  vue-component-type-helpers@2.1.2:
-    resolution: {integrity: sha512-URuxnrOhO9lUG4LOAapGWBaa/WOLDzzyAbL+uKZqT7RS+PFy0cdXI2mUSh7GaMts6vtHaeVbGk7trd0FPJi65Q==}
+  vue-component-type-helpers@2.1.6:
+    resolution: {integrity: sha512-ng11B8B/ZADUMMOsRbqv0arc442q7lifSubD0v8oDXIFoMg/mXwAPUunrroIDkY+mcD0dHKccdaznSVp8EoX3w==}
 
   vue-demi@0.13.11:
     resolution: {integrity: sha512-IR8HoEEGM65YY3ZJYAjMlKygDQn25D5ajNFNoKh9RSDMQtlzCxtfQjdQgv9jjK+m3377SsJXY8ysq8kLCZL25A==}
@@ -10247,14 +10269,14 @@ packages:
   vue-template-compiler@2.7.14:
     resolution: {integrity: sha512-zyA5Y3ArvVG0NacJDkkzJuPQDF8RFeRlzV2vLeSnhSpieO6LK2OVbdLPi5MPPs09Ii+gMO8nY4S3iKQxBxDmWQ==}
 
-  vue-tsc@2.0.29:
-    resolution: {integrity: sha512-MHhsfyxO3mYShZCGYNziSbc63x7cQ5g9kvijV7dRe1TTXBRLxXyL0FnXWpUF1xII2mJ86mwYpYsUmMwkmerq7Q==}
+  vue-tsc@2.1.6:
+    resolution: {integrity: sha512-f98dyZp5FOukcYmbFpuSCJ4Z0vHSOSmxGttZJCsFeX0M4w/Rsq0s4uKXjcSRsZqsRgQa6z7SfuO+y0HVICE57Q==}
     hasBin: true
     peerDependencies:
       typescript: '>=5.0.0'
 
-  vue@3.4.27:
-    resolution: {integrity: sha512-8s/56uK6r01r1icG/aEOHqyMVxd1bkYcSe9j8HcKtr/xTOFWvnzIVTehNW+5Yt89f+DLBe4A569pnZLS5HzAMA==}
+  vue@3.5.8:
+    resolution: {integrity: sha512-hvuvuCy51nP/1fSRvrrIqTLSvrSyz2Pq+KQ8S8SXCxTWVE0nMaOnSDnSOxV1eYmGfvK7mqiwvd1C59CEEz7dAQ==}
     peerDependencies:
       typescript: '*'
     peerDependenciesMeta:
@@ -12313,11 +12335,11 @@ snapshots:
       human-id: 1.0.2
       prettier: 2.8.8
 
-  '@ckpack/vue-color@1.5.0(vue@3.4.27(typescript@5.5.4))':
+  '@ckpack/vue-color@1.5.0(vue@3.5.8(typescript@5.6.2))':
     dependencies:
       '@ctrl/tinycolor': 3.6.1
       material-colors: 1.2.6
-      vue: 3.4.27(typescript@5.5.4)
+      vue: 3.5.8(typescript@5.6.2)
 
   '@codemirror/autocomplete@6.3.0(@codemirror/language@6.3.1)(@codemirror/state@6.1.4)(@codemirror/view@6.5.1)(@lezer/common@1.0.1)':
     dependencies:
@@ -12740,7 +12762,7 @@ snapshots:
       '@formkit/observer': 1.5.9
       '@formkit/utils': 1.5.9
 
-  '@formkit/vue@1.5.9(tailwindcss@3.3.0(postcss@8.4.21))(typescript@5.5.4)':
+  '@formkit/vue@1.5.9(tailwindcss@3.3.0(postcss@8.4.21))(typescript@5.6.2)':
     dependencies:
       '@formkit/core': 1.5.9
       '@formkit/dev': 1.5.9
@@ -12751,7 +12773,7 @@ snapshots:
       '@formkit/themes': 1.5.9(tailwindcss@3.3.0(postcss@8.4.21))
       '@formkit/utils': 1.5.9
       '@formkit/validation': 1.5.9
-      vue: 3.4.27(typescript@5.5.4)
+      vue: 3.5.8(typescript@5.6.2)
     transitivePeerDependencies:
       - tailwindcss
       - typescript
@@ -12917,7 +12939,7 @@ snapshots:
 
   '@interactjs/utils@1.10.17': {}
 
-  '@intlify/bundle-utils@8.0.0(vue-i18n@9.13.1(vue@3.4.27(typescript@5.5.4)))':
+  '@intlify/bundle-utils@8.0.0(vue-i18n@9.13.1(vue@3.5.8(typescript@5.6.2)))':
     dependencies:
       '@intlify/message-compiler': 9.13.1
       '@intlify/shared': 9.13.1
@@ -12929,7 +12951,7 @@ snapshots:
       source-map-js: 1.2.0
       yaml-eslint-parser: 1.2.2
     optionalDependencies:
-      vue-i18n: 9.13.1(vue@3.4.27(typescript@5.5.4))
+      vue-i18n: 9.13.1(vue@3.5.8(typescript@5.6.2))
 
   '@intlify/core-base@9.13.1':
     dependencies:
@@ -12943,9 +12965,9 @@ snapshots:
 
   '@intlify/shared@9.13.1': {}
 
-  '@intlify/unplugin-vue-i18n@4.0.0(rollup@4.17.2)(vue-i18n@9.13.1(vue@3.4.27(typescript@5.5.4)))':
+  '@intlify/unplugin-vue-i18n@4.0.0(rollup@4.17.2)(vue-i18n@9.13.1(vue@3.5.8(typescript@5.6.2)))':
     dependencies:
-      '@intlify/bundle-utils': 8.0.0(vue-i18n@9.13.1(vue@3.4.27(typescript@5.5.4)))
+      '@intlify/bundle-utils': 8.0.0(vue-i18n@9.13.1(vue@3.5.8(typescript@5.6.2)))
       '@intlify/shared': 9.13.1
       '@rollup/pluginutils': 5.1.0(rollup@4.17.2)
       '@vue/compiler-sfc': 3.4.27
@@ -12958,7 +12980,7 @@ snapshots:
       source-map-js: 1.2.0
       unplugin: 1.5.1
     optionalDependencies:
-      vue-i18n: 9.13.1(vue@3.4.27(typescript@5.5.4))
+      vue-i18n: 9.13.1(vue@3.5.8(typescript@5.6.2))
     transitivePeerDependencies:
       - rollup
       - supports-color
@@ -13124,23 +13146,23 @@ snapshots:
       '@types/react': 18.2.41
       react: 18.2.0
 
-  '@microsoft/api-extractor-model@7.29.4(@types/node@20.14.2)':
+  '@microsoft/api-extractor-model@7.29.6(@types/node@20.14.2)':
     dependencies:
       '@microsoft/tsdoc': 0.15.0
       '@microsoft/tsdoc-config': 0.17.0
-      '@rushstack/node-core-library': 5.5.1(@types/node@20.14.2)
+      '@rushstack/node-core-library': 5.7.0(@types/node@20.14.2)
     transitivePeerDependencies:
       - '@types/node'
 
-  '@microsoft/api-extractor@7.47.4(@types/node@20.14.2)':
+  '@microsoft/api-extractor@7.47.7(@types/node@20.14.2)':
     dependencies:
-      '@microsoft/api-extractor-model': 7.29.4(@types/node@20.14.2)
+      '@microsoft/api-extractor-model': 7.29.6(@types/node@20.14.2)
       '@microsoft/tsdoc': 0.15.0
       '@microsoft/tsdoc-config': 0.17.0
-      '@rushstack/node-core-library': 5.5.1(@types/node@20.14.2)
+      '@rushstack/node-core-library': 5.7.0(@types/node@20.14.2)
       '@rushstack/rig-package': 0.5.3
-      '@rushstack/terminal': 0.13.3(@types/node@20.14.2)
-      '@rushstack/ts-command-line': 4.22.3(@types/node@20.14.2)
+      '@rushstack/terminal': 0.14.0(@types/node@20.14.2)
+      '@rushstack/ts-command-line': 4.22.6(@types/node@20.14.2)
       lodash: 4.17.21
       minimatch: 3.0.8
       resolve: 1.22.8
@@ -13786,7 +13808,7 @@ snapshots:
 
   '@rushstack/eslint-patch@1.3.2': {}
 
-  '@rushstack/node-core-library@5.5.1(@types/node@20.14.2)':
+  '@rushstack/node-core-library@5.7.0(@types/node@20.14.2)':
     dependencies:
       ajv: 8.13.0
       ajv-draft-04: 1.0.0(ajv@8.13.0)
@@ -13804,16 +13826,16 @@ snapshots:
       resolve: 1.22.8
       strip-json-comments: 3.1.1
 
-  '@rushstack/terminal@0.13.3(@types/node@20.14.2)':
+  '@rushstack/terminal@0.14.0(@types/node@20.14.2)':
     dependencies:
-      '@rushstack/node-core-library': 5.5.1(@types/node@20.14.2)
+      '@rushstack/node-core-library': 5.7.0(@types/node@20.14.2)
       supports-color: 8.1.1
     optionalDependencies:
       '@types/node': 20.14.2
 
-  '@rushstack/ts-command-line@4.22.3(@types/node@20.14.2)':
+  '@rushstack/ts-command-line@4.22.6(@types/node@20.14.2)':
     dependencies:
-      '@rushstack/terminal': 0.13.3(@types/node@20.14.2)
+      '@rushstack/terminal': 0.14.0(@types/node@20.14.2)
       '@types/argparse': 1.0.38
       argparse: 1.0.10
       string-argv: 0.3.1
@@ -13943,7 +13965,7 @@ snapshots:
       '@storybook/global': 5.0.0
       ts-dedent: 2.2.0
 
-  '@storybook/addon-styling@1.3.7(@types/react@18.2.41)(less@4.2.0)(postcss@8.4.38)(react-dom@18.2.0(react@18.2.0))(react@18.2.0)(sass@1.60.0)(typescript@5.5.4)(webpack@5.89.0(esbuild@0.18.20))':
+  '@storybook/addon-styling@1.3.7(@types/react@18.2.41)(less@4.2.0)(postcss@8.4.38)(react-dom@18.2.0(react@18.2.0))(react@18.2.0)(sass@1.60.0)(typescript@5.6.2)(webpack@5.89.0(esbuild@0.18.20))':
     dependencies:
       '@babel/template': 7.22.15
       '@babel/types': 7.23.5
@@ -13958,7 +13980,7 @@ snapshots:
       '@storybook/types': 7.6.3
       css-loader: 6.8.1(webpack@5.89.0(esbuild@0.18.20))
       less-loader: 11.1.3(less@4.2.0)(webpack@5.89.0(esbuild@0.18.20))
-      postcss-loader: 7.3.3(postcss@8.4.38)(typescript@5.5.4)(webpack@5.89.0(esbuild@0.18.20))
+      postcss-loader: 7.3.3(postcss@8.4.38)(typescript@5.6.2)(webpack@5.89.0(esbuild@0.18.20))
       prettier: 2.8.8
       resolve-url-loader: 5.0.0
       sass-loader: 13.3.2(sass@1.60.0)(webpack@5.89.0(esbuild@0.18.20))
@@ -14049,7 +14071,7 @@ snapshots:
       - encoding
       - supports-color
 
-  '@storybook/builder-vite@7.6.3(typescript@5.5.4)(vite@5.4.1(@types/node@20.14.2)(less@4.2.0)(sass@1.60.0)(terser@5.31.0))':
+  '@storybook/builder-vite@7.6.3(typescript@5.6.2)(vite@5.4.1(@types/node@20.14.2)(less@4.2.0)(sass@1.60.0)(terser@5.31.0))':
     dependencies:
       '@storybook/channels': 7.6.3
       '@storybook/client-logger': 7.6.3
@@ -14069,7 +14091,7 @@ snapshots:
       rollup: 3.28.0
       vite: 5.4.1(@types/node@20.14.2)(less@4.2.0)(sass@1.60.0)(terser@5.31.0)
     optionalDependencies:
-      typescript: 5.5.4
+      typescript: 5.6.2
     transitivePeerDependencies:
       - encoding
       - supports-color
@@ -14413,15 +14435,15 @@ snapshots:
       '@types/express': 4.17.21
       file-system-cache: 2.3.0
 
-  '@storybook/vue3-vite@7.6.3(@vue/compiler-core@3.4.27)(typescript@5.5.4)(vite@5.4.1(@types/node@20.14.2)(less@4.2.0)(sass@1.60.0)(terser@5.31.0))(vue@3.4.27(typescript@5.5.4))':
+  '@storybook/vue3-vite@7.6.3(@vue/compiler-core@3.5.8)(typescript@5.6.2)(vite@5.4.1(@types/node@20.14.2)(less@4.2.0)(sass@1.60.0)(terser@5.31.0))(vue@3.5.8(typescript@5.6.2))':
     dependencies:
-      '@storybook/builder-vite': 7.6.3(typescript@5.5.4)(vite@5.4.1(@types/node@20.14.2)(less@4.2.0)(sass@1.60.0)(terser@5.31.0))
+      '@storybook/builder-vite': 7.6.3(typescript@5.6.2)(vite@5.4.1(@types/node@20.14.2)(less@4.2.0)(sass@1.60.0)(terser@5.31.0))
       '@storybook/core-server': 7.6.3
-      '@storybook/vue3': 7.6.3(@vue/compiler-core@3.4.27)(vue@3.4.27(typescript@5.5.4))
-      '@vitejs/plugin-vue': 4.2.3(vite@5.4.1(@types/node@20.14.2)(less@4.2.0)(sass@1.60.0)(terser@5.31.0))(vue@3.4.27(typescript@5.5.4))
+      '@storybook/vue3': 7.6.3(@vue/compiler-core@3.5.8)(vue@3.5.8(typescript@5.6.2))
+      '@vitejs/plugin-vue': 4.2.3(vite@5.4.1(@types/node@20.14.2)(less@4.2.0)(sass@1.60.0)(terser@5.31.0))(vue@3.5.8(typescript@5.6.2))
       magic-string: 0.30.2
       vite: 5.4.1(@types/node@20.14.2)(less@4.2.0)(sass@1.60.0)(terser@5.31.0)
-      vue-docgen-api: 4.75.1(vue@3.4.27(typescript@5.5.4))
+      vue-docgen-api: 4.75.1(vue@3.5.8(typescript@5.6.2))
     transitivePeerDependencies:
       - '@preact/preset-vite'
       - '@vue/compiler-core'
@@ -14433,19 +14455,19 @@ snapshots:
       - vite-plugin-glimmerx
       - vue
 
-  '@storybook/vue3@7.6.3(@vue/compiler-core@3.4.27)(vue@3.4.27(typescript@5.5.4))':
+  '@storybook/vue3@7.6.3(@vue/compiler-core@3.5.8)(vue@3.5.8(typescript@5.6.2))':
     dependencies:
       '@storybook/core-client': 7.6.3
       '@storybook/docs-tools': 7.6.3
       '@storybook/global': 5.0.0
       '@storybook/preview-api': 7.6.3
       '@storybook/types': 7.6.3
-      '@vue/compiler-core': 3.4.27
+      '@vue/compiler-core': 3.5.8
       lodash: 4.17.21
       ts-dedent: 2.2.0
       type-fest: 2.19.0
-      vue: 3.4.27(typescript@5.5.4)
-      vue-component-type-helpers: 2.1.2
+      vue: 3.5.8(typescript@5.6.2)
+      vue-component-type-helpers: 2.1.6
     transitivePeerDependencies:
       - encoding
       - supports-color
@@ -14480,13 +14502,13 @@ snapshots:
 
   '@tanstack/query-core@4.29.1': {}
 
-  '@tanstack/vue-query@4.29.1(vue@3.4.27(typescript@5.5.4))':
+  '@tanstack/vue-query@4.29.1(vue@3.5.8(typescript@5.6.2))':
     dependencies:
       '@tanstack/match-sorter-utils': 8.7.6
       '@tanstack/query-core': 4.29.1
       '@vue/devtools-api': 6.5.0
-      vue: 3.4.27(typescript@5.5.4)
-      vue-demi: 0.13.11(vue@3.4.27(typescript@5.5.4))
+      vue: 3.5.8(typescript@5.6.2)
+      vue-demi: 0.13.11(vue@3.5.8(typescript@5.6.2))
 
   '@testing-library/dom@8.20.1':
     dependencies:
@@ -14689,13 +14711,13 @@ snapshots:
       '@tiptap/core': 2.6.5(@tiptap/pm@2.6.5)
       '@tiptap/pm': 2.6.5
 
-  '@tiptap/vue-3@2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))(@tiptap/pm@2.6.5)(vue@3.4.27(typescript@5.5.4))':
+  '@tiptap/vue-3@2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))(@tiptap/pm@2.6.5)(vue@3.5.8(typescript@5.6.2))':
     dependencies:
       '@tiptap/core': 2.6.5(@tiptap/pm@2.6.5)
       '@tiptap/extension-bubble-menu': 2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))(@tiptap/pm@2.6.5)
       '@tiptap/extension-floating-menu': 2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))(@tiptap/pm@2.6.5)
       '@tiptap/pm': 2.6.5
-      vue: 3.4.27(typescript@5.5.4)
+      vue: 3.5.8(typescript@5.6.2)
 
   '@tootallnate/once@2.0.0': {}
 
@@ -14938,34 +14960,34 @@ snapshots:
       '@types/node': 18.19.34
     optional: true
 
-  '@typescript-eslint/eslint-plugin@5.59.6(@typescript-eslint/parser@5.59.6(eslint@8.43.0)(typescript@5.5.4))(eslint@8.43.0)(typescript@5.5.4)':
+  '@typescript-eslint/eslint-plugin@5.59.6(@typescript-eslint/parser@5.59.6(eslint@8.43.0)(typescript@5.6.2))(eslint@8.43.0)(typescript@5.6.2)':
     dependencies:
       '@eslint-community/regexpp': 4.5.1
-      '@typescript-eslint/parser': 5.59.6(eslint@8.43.0)(typescript@5.5.4)
+      '@typescript-eslint/parser': 5.59.6(eslint@8.43.0)(typescript@5.6.2)
       '@typescript-eslint/scope-manager': 5.59.6
-      '@typescript-eslint/type-utils': 5.59.6(eslint@8.43.0)(typescript@5.5.4)
-      '@typescript-eslint/utils': 5.59.6(eslint@8.43.0)(typescript@5.5.4)
+      '@typescript-eslint/type-utils': 5.59.6(eslint@8.43.0)(typescript@5.6.2)
+      '@typescript-eslint/utils': 5.59.6(eslint@8.43.0)(typescript@5.6.2)
       debug: 4.3.6(supports-color@8.1.1)
       eslint: 8.43.0
       grapheme-splitter: 1.0.4
       ignore: 5.2.0
       natural-compare-lite: 1.4.0
       semver: 7.5.4
-      tsutils: 3.21.0(typescript@5.5.4)
+      tsutils: 3.21.0(typescript@5.6.2)
     optionalDependencies:
-      typescript: 5.5.4
+      typescript: 5.6.2
     transitivePeerDependencies:
       - supports-color
 
-  '@typescript-eslint/parser@5.59.6(eslint@8.43.0)(typescript@5.5.4)':
+  '@typescript-eslint/parser@5.59.6(eslint@8.43.0)(typescript@5.6.2)':
     dependencies:
       '@typescript-eslint/scope-manager': 5.59.6
       '@typescript-eslint/types': 5.59.6
-      '@typescript-eslint/typescript-estree': 5.59.6(typescript@5.5.4)
+      '@typescript-eslint/typescript-estree': 5.59.6(typescript@5.6.2)
       debug: 4.3.6(supports-color@8.1.1)
       eslint: 8.43.0
     optionalDependencies:
-      typescript: 5.5.4
+      typescript: 5.6.2
     transitivePeerDependencies:
       - supports-color
 
@@ -14974,21 +14996,21 @@ snapshots:
       '@typescript-eslint/types': 5.59.6
       '@typescript-eslint/visitor-keys': 5.59.6
 
-  '@typescript-eslint/type-utils@5.59.6(eslint@8.43.0)(typescript@5.5.4)':
+  '@typescript-eslint/type-utils@5.59.6(eslint@8.43.0)(typescript@5.6.2)':
     dependencies:
-      '@typescript-eslint/typescript-estree': 5.59.6(typescript@5.5.4)
-      '@typescript-eslint/utils': 5.59.6(eslint@8.43.0)(typescript@5.5.4)
+      '@typescript-eslint/typescript-estree': 5.59.6(typescript@5.6.2)
+      '@typescript-eslint/utils': 5.59.6(eslint@8.43.0)(typescript@5.6.2)
       debug: 4.3.6(supports-color@8.1.1)
       eslint: 8.43.0
-      tsutils: 3.21.0(typescript@5.5.4)
+      tsutils: 3.21.0(typescript@5.6.2)
     optionalDependencies:
-      typescript: 5.5.4
+      typescript: 5.6.2
     transitivePeerDependencies:
       - supports-color
 
   '@typescript-eslint/types@5.59.6': {}
 
-  '@typescript-eslint/typescript-estree@5.59.6(typescript@5.5.4)':
+  '@typescript-eslint/typescript-estree@5.59.6(typescript@5.6.2)':
     dependencies:
       '@typescript-eslint/types': 5.59.6
       '@typescript-eslint/visitor-keys': 5.59.6
@@ -14996,20 +15018,20 @@ snapshots:
       globby: 11.1.0
       is-glob: 4.0.3
       semver: 7.5.4
-      tsutils: 3.21.0(typescript@5.5.4)
+      tsutils: 3.21.0(typescript@5.6.2)
     optionalDependencies:
-      typescript: 5.5.4
+      typescript: 5.6.2
     transitivePeerDependencies:
       - supports-color
 
-  '@typescript-eslint/utils@5.59.6(eslint@8.43.0)(typescript@5.5.4)':
+  '@typescript-eslint/utils@5.59.6(eslint@8.43.0)(typescript@5.6.2)':
     dependencies:
       '@eslint-community/eslint-utils': 4.4.0(eslint@8.43.0)
       '@types/json-schema': 7.0.11
       '@types/semver': 7.3.13
       '@typescript-eslint/scope-manager': 5.59.6
       '@typescript-eslint/types': 5.59.6
-      '@typescript-eslint/typescript-estree': 5.59.6(typescript@5.5.4)
+      '@typescript-eslint/typescript-estree': 5.59.6(typescript@5.6.2)
       eslint: 8.43.0
       eslint-scope: 5.1.1
       semver: 7.5.4
@@ -15121,11 +15143,11 @@ snapshots:
       lodash: 4.17.21
       preact: 10.11.2
 
-  '@uppy/vue@1.1.2(@uppy/core@3.11.3)(@uppy/dashboard@3.8.3(@uppy/core@3.11.3))(@uppy/drag-drop@3.1.0(@uppy/core@3.11.3))(@uppy/file-input@3.1.2(@uppy/core@3.11.3))(@uppy/progress-bar@3.1.1(@uppy/core@3.11.3))(@uppy/status-bar@3.3.3(@uppy/core@3.11.3))(vue@3.4.27(typescript@5.5.4))':
+  '@uppy/vue@1.1.2(@uppy/core@3.11.3)(@uppy/dashboard@3.8.3(@uppy/core@3.11.3))(@uppy/drag-drop@3.1.0(@uppy/core@3.11.3))(@uppy/file-input@3.1.2(@uppy/core@3.11.3))(@uppy/progress-bar@3.1.1(@uppy/core@3.11.3))(@uppy/status-bar@3.3.3(@uppy/core@3.11.3))(vue@3.5.8(typescript@5.6.2))':
     dependencies:
       '@uppy/core': 3.11.3
       shallow-equal: 1.2.1
-      vue: 3.4.27(typescript@5.5.4)
+      vue: 3.5.8(typescript@5.6.2)
     optionalDependencies:
       '@uppy/dashboard': 3.8.3(@uppy/core@3.11.3)
       '@uppy/drag-drop': 3.1.0(@uppy/core@3.11.3)
@@ -15140,25 +15162,25 @@ snapshots:
       '@uppy/utils': 5.9.0
       nanoid: 4.0.0
 
-  '@vitejs/plugin-vue-jsx@4.0.1(vite@5.4.1(@types/node@18.13.0)(less@4.2.0)(sass@1.60.0)(terser@5.31.0))(vue@3.4.27(typescript@5.5.4))':
+  '@vitejs/plugin-vue-jsx@4.0.1(vite@5.4.1(@types/node@18.13.0)(less@4.2.0)(sass@1.60.0)(terser@5.31.0))(vue@3.5.8(typescript@5.6.2))':
     dependencies:
       '@babel/core': 7.25.2
       '@babel/plugin-transform-typescript': 7.25.2(@babel/core@7.25.2)
       '@vue/babel-plugin-jsx': 1.2.2(@babel/core@7.25.2)
       vite: 5.4.1(@types/node@18.13.0)(less@4.2.0)(sass@1.60.0)(terser@5.31.0)
-      vue: 3.4.27(typescript@5.5.4)
+      vue: 3.5.8(typescript@5.6.2)
     transitivePeerDependencies:
       - supports-color
 
-  '@vitejs/plugin-vue@4.2.3(vite@5.4.1(@types/node@20.14.2)(less@4.2.0)(sass@1.60.0)(terser@5.31.0))(vue@3.4.27(typescript@5.5.4))':
+  '@vitejs/plugin-vue@4.2.3(vite@5.4.1(@types/node@20.14.2)(less@4.2.0)(sass@1.60.0)(terser@5.31.0))(vue@3.5.8(typescript@5.6.2))':
     dependencies:
       vite: 5.4.1(@types/node@20.14.2)(less@4.2.0)(sass@1.60.0)(terser@5.31.0)
-      vue: 3.4.27(typescript@5.5.4)
+      vue: 3.5.8(typescript@5.6.2)
 
-  '@vitejs/plugin-vue@5.1.2(vite@5.4.1(@types/node@18.13.0)(less@4.2.0)(sass@1.60.0)(terser@5.31.0))(vue@3.4.27(typescript@5.5.4))':
+  '@vitejs/plugin-vue@5.1.4(vite@5.4.1(@types/node@18.13.0)(less@4.2.0)(sass@1.60.0)(terser@5.31.0))(vue@3.5.8(typescript@5.6.2))':
     dependencies:
       vite: 5.4.1(@types/node@18.13.0)(less@4.2.0)(sass@1.60.0)(terser@5.31.0)
-      vue: 3.4.27(typescript@5.5.4)
+      vue: 3.5.8(typescript@5.6.2)
 
   '@vitest/expect@0.34.1':
     dependencies:
@@ -15205,27 +15227,15 @@ snapshots:
       loupe: 2.3.6
       pretty-format: 29.6.2
 
-  '@volar/language-core@2.4.0':
-    dependencies:
-      '@volar/source-map': 2.4.0
-
-  '@volar/language-core@2.4.0-alpha.18':
+  '@volar/language-core@2.4.5':
     dependencies:
-      '@volar/source-map': 2.4.0-alpha.18
+      '@volar/source-map': 2.4.5
 
-  '@volar/source-map@2.4.0': {}
+  '@volar/source-map@2.4.5': {}
 
-  '@volar/source-map@2.4.0-alpha.18': {}
-
-  '@volar/typescript@2.4.0':
+  '@volar/typescript@2.4.5':
     dependencies:
-      '@volar/language-core': 2.4.0
-      path-browserify: 1.0.1
-      vscode-uri: 3.0.8
-
-  '@volar/typescript@2.4.0-alpha.18':
-    dependencies:
-      '@volar/language-core': 2.4.0-alpha.18
+      '@volar/language-core': 2.4.5
       path-browserify: 1.0.1
       vscode-uri: 3.0.8
 
@@ -15283,11 +15293,24 @@ snapshots:
       estree-walker: 2.0.2
       source-map-js: 1.2.0
 
+  '@vue/compiler-core@3.5.8':
+    dependencies:
+      '@babel/parser': 7.25.3
+      '@vue/shared': 3.5.8
+      entities: 4.5.0
+      estree-walker: 2.0.2
+      source-map-js: 1.2.0
+
   '@vue/compiler-dom@3.4.27':
     dependencies:
       '@vue/compiler-core': 3.4.27
       '@vue/shared': 3.4.27
 
+  '@vue/compiler-dom@3.5.8':
+    dependencies:
+      '@vue/compiler-core': 3.5.8
+      '@vue/shared': 3.5.8
+
   '@vue/compiler-sfc@3.4.27':
     dependencies:
       '@babel/parser': 7.24.5
@@ -15300,11 +15323,28 @@ snapshots:
       postcss: 8.4.38
       source-map-js: 1.2.0
 
+  '@vue/compiler-sfc@3.5.8':
+    dependencies:
+      '@babel/parser': 7.25.3
+      '@vue/compiler-core': 3.5.8
+      '@vue/compiler-dom': 3.5.8
+      '@vue/compiler-ssr': 3.5.8
+      '@vue/shared': 3.5.8
+      estree-walker: 2.0.2
+      magic-string: 0.30.11
+      postcss: 8.4.47
+      source-map-js: 1.2.0
+
   '@vue/compiler-ssr@3.4.27':
     dependencies:
       '@vue/compiler-dom': 3.4.27
       '@vue/shared': 3.4.27
 
+  '@vue/compiler-ssr@3.5.8':
+    dependencies:
+      '@vue/compiler-dom': 3.5.8
+      '@vue/shared': 3.5.8
+
   '@vue/compiler-vue2@2.7.16':
     dependencies:
       de-indent: 1.0.2
@@ -15314,7 +15354,7 @@ snapshots:
 
   '@vue/devtools-api@6.6.1': {}
 
-  '@vue/devtools-core@7.3.8(vite@5.4.1(@types/node@18.13.0)(less@4.2.0)(sass@1.60.0)(terser@5.31.0))(vue@3.4.27(typescript@5.5.4))':
+  '@vue/devtools-core@7.3.8(vite@5.4.1(@types/node@18.13.0)(less@4.2.0)(sass@1.60.0)(terser@5.31.0))(vue@3.5.8(typescript@5.6.2))':
     dependencies:
       '@vue/devtools-kit': 7.3.8
       '@vue/devtools-shared': 7.3.8
@@ -15322,7 +15362,7 @@ snapshots:
       nanoid: 3.3.7
       pathe: 1.1.2
       vite-hot-client: 0.2.3(vite@5.4.1(@types/node@18.13.0)(less@4.2.0)(sass@1.60.0)(terser@5.31.0))
-      vue: 3.4.27(typescript@5.5.4)
+      vue: 3.5.8(typescript@5.6.2)
     transitivePeerDependencies:
       - vite
 
@@ -15347,24 +15387,24 @@ snapshots:
       eslint-plugin-prettier: 4.2.1(eslint-config-prettier@8.10.0(eslint@8.43.0))(eslint@8.43.0)(prettier@2.8.8)
       prettier: 2.8.8
 
-  '@vue/eslint-config-typescript@11.0.3(eslint-plugin-vue@9.17.0(eslint@8.43.0))(eslint@8.43.0)(typescript@5.5.4)':
+  '@vue/eslint-config-typescript@11.0.3(eslint-plugin-vue@9.17.0(eslint@8.43.0))(eslint@8.43.0)(typescript@5.6.2)':
     dependencies:
-      '@typescript-eslint/eslint-plugin': 5.59.6(@typescript-eslint/parser@5.59.6(eslint@8.43.0)(typescript@5.5.4))(eslint@8.43.0)(typescript@5.5.4)
-      '@typescript-eslint/parser': 5.59.6(eslint@8.43.0)(typescript@5.5.4)
+      '@typescript-eslint/eslint-plugin': 5.59.6(@typescript-eslint/parser@5.59.6(eslint@8.43.0)(typescript@5.6.2))(eslint@8.43.0)(typescript@5.6.2)
+      '@typescript-eslint/parser': 5.59.6(eslint@8.43.0)(typescript@5.6.2)
       eslint: 8.43.0
       eslint-plugin-vue: 9.17.0(eslint@8.43.0)
       vue-eslint-parser: 9.3.0(eslint@8.43.0)
     optionalDependencies:
-      typescript: 5.5.4
+      typescript: 5.6.2
     transitivePeerDependencies:
       - supports-color
 
-  '@vue/language-core@2.0.29(typescript@5.5.4)':
+  '@vue/language-core@2.1.6(typescript@5.5.4)':
     dependencies:
-      '@volar/language-core': 2.4.0-alpha.18
-      '@vue/compiler-dom': 3.4.27
+      '@volar/language-core': 2.4.5
+      '@vue/compiler-dom': 3.5.8
       '@vue/compiler-vue2': 2.7.16
-      '@vue/shared': 3.4.27
+      '@vue/shared': 3.5.8
       computeds: 0.0.1
       minimatch: 9.0.3
       muggle-string: 0.4.1
@@ -15372,29 +15412,45 @@ snapshots:
     optionalDependencies:
       typescript: 5.5.4
 
-  '@vue/reactivity@3.4.27':
+  '@vue/language-core@2.1.6(typescript@5.6.2)':
     dependencies:
-      '@vue/shared': 3.4.27
+      '@volar/language-core': 2.4.5
+      '@vue/compiler-dom': 3.5.8
+      '@vue/compiler-vue2': 2.7.16
+      '@vue/shared': 3.5.8
+      computeds: 0.0.1
+      minimatch: 9.0.3
+      muggle-string: 0.4.1
+      path-browserify: 1.0.1
+    optionalDependencies:
+      typescript: 5.6.2
 
-  '@vue/runtime-core@3.4.27':
+  '@vue/reactivity@3.5.8':
     dependencies:
-      '@vue/reactivity': 3.4.27
-      '@vue/shared': 3.4.27
+      '@vue/shared': 3.5.8
 
-  '@vue/runtime-dom@3.4.27':
+  '@vue/runtime-core@3.5.8':
     dependencies:
-      '@vue/runtime-core': 3.4.27
-      '@vue/shared': 3.4.27
+      '@vue/reactivity': 3.5.8
+      '@vue/shared': 3.5.8
+
+  '@vue/runtime-dom@3.5.8':
+    dependencies:
+      '@vue/reactivity': 3.5.8
+      '@vue/runtime-core': 3.5.8
+      '@vue/shared': 3.5.8
       csstype: 3.1.3
 
-  '@vue/server-renderer@3.4.27(vue@3.4.27(typescript@5.5.4))':
+  '@vue/server-renderer@3.5.8(vue@3.5.8(typescript@5.6.2))':
     dependencies:
-      '@vue/compiler-ssr': 3.4.27
-      '@vue/shared': 3.4.27
-      vue: 3.4.27(typescript@5.5.4)
+      '@vue/compiler-ssr': 3.5.8
+      '@vue/shared': 3.5.8
+      vue: 3.5.8(typescript@5.6.2)
 
   '@vue/shared@3.4.27': {}
 
+  '@vue/shared@3.5.8': {}
+
   '@vue/test-utils@2.4.6':
     dependencies:
       js-beautify: 1.14.9
@@ -15402,30 +15458,30 @@ snapshots:
 
   '@vue/tsconfig@0.5.1': {}
 
-  '@vueuse/components@10.9.0(vue@3.4.27(typescript@5.5.4))':
+  '@vueuse/components@10.9.0(vue@3.5.8(typescript@5.6.2))':
     dependencies:
-      '@vueuse/core': 10.9.0(vue@3.4.27(typescript@5.5.4))
-      '@vueuse/shared': 10.9.0(vue@3.4.27(typescript@5.5.4))
-      vue-demi: 0.14.7(vue@3.4.27(typescript@5.5.4))
+      '@vueuse/core': 10.9.0(vue@3.5.8(typescript@5.6.2))
+      '@vueuse/shared': 10.9.0(vue@3.5.8(typescript@5.6.2))
+      vue-demi: 0.14.7(vue@3.5.8(typescript@5.6.2))
     transitivePeerDependencies:
       - '@vue/composition-api'
       - vue
 
-  '@vueuse/core@10.9.0(vue@3.4.27(typescript@5.5.4))':
+  '@vueuse/core@10.9.0(vue@3.5.8(typescript@5.6.2))':
     dependencies:
       '@types/web-bluetooth': 0.0.20
       '@vueuse/metadata': 10.9.0
-      '@vueuse/shared': 10.9.0(vue@3.4.27(typescript@5.5.4))
-      vue-demi: 0.14.7(vue@3.4.27(typescript@5.5.4))
+      '@vueuse/shared': 10.9.0(vue@3.5.8(typescript@5.6.2))
+      vue-demi: 0.14.7(vue@3.5.8(typescript@5.6.2))
     transitivePeerDependencies:
       - '@vue/composition-api'
       - vue
 
-  '@vueuse/integrations@10.9.0(axios@1.7.2)(fuse.js@6.6.2)(qrcode@1.5.3)(sortablejs@1.14.0)(vue@3.4.27(typescript@5.5.4))':
+  '@vueuse/integrations@10.9.0(axios@1.7.2)(fuse.js@6.6.2)(qrcode@1.5.3)(sortablejs@1.14.0)(vue@3.5.8(typescript@5.6.2))':
     dependencies:
-      '@vueuse/core': 10.9.0(vue@3.4.27(typescript@5.5.4))
-      '@vueuse/shared': 10.9.0(vue@3.4.27(typescript@5.5.4))
-      vue-demi: 0.14.7(vue@3.4.27(typescript@5.5.4))
+      '@vueuse/core': 10.9.0(vue@3.5.8(typescript@5.6.2))
+      '@vueuse/shared': 10.9.0(vue@3.5.8(typescript@5.6.2))
+      vue-demi: 0.14.7(vue@3.5.8(typescript@5.6.2))
     optionalDependencies:
       axios: 1.7.2(debug@4.3.2)
       fuse.js: 6.6.2
@@ -15437,18 +15493,18 @@ snapshots:
 
   '@vueuse/metadata@10.9.0': {}
 
-  '@vueuse/router@10.9.0(vue-router@4.3.2(vue@3.4.27(typescript@5.5.4)))(vue@3.4.27(typescript@5.5.4))':
+  '@vueuse/router@10.9.0(vue-router@4.3.2(vue@3.5.8(typescript@5.6.2)))(vue@3.5.8(typescript@5.6.2))':
     dependencies:
-      '@vueuse/shared': 10.9.0(vue@3.4.27(typescript@5.5.4))
-      vue-demi: 0.14.7(vue@3.4.27(typescript@5.5.4))
-      vue-router: 4.3.2(vue@3.4.27(typescript@5.5.4))
+      '@vueuse/shared': 10.9.0(vue@3.5.8(typescript@5.6.2))
+      vue-demi: 0.14.7(vue@3.5.8(typescript@5.6.2))
+      vue-router: 4.3.2(vue@3.5.8(typescript@5.6.2))
     transitivePeerDependencies:
       - '@vue/composition-api'
       - vue
 
-  '@vueuse/shared@10.9.0(vue@3.4.27(typescript@5.5.4))':
+  '@vueuse/shared@10.9.0(vue@3.5.8(typescript@5.6.2))':
     dependencies:
-      vue-demi: 0.14.7(vue@3.4.27(typescript@5.5.4))
+      vue-demi: 0.14.7(vue@3.5.8(typescript@5.6.2))
     transitivePeerDependencies:
       - '@vue/composition-api'
       - vue
@@ -16414,14 +16470,14 @@ snapshots:
 
   core-util-is@1.0.3: {}
 
-  cosmiconfig@8.3.6(typescript@5.5.4):
+  cosmiconfig@8.3.6(typescript@5.6.2):
     dependencies:
       import-fresh: 3.3.0
       js-yaml: 4.1.0
       parse-json: 5.2.0
       path-type: 4.0.0
     optionalDependencies:
-      typescript: 5.5.4
+      typescript: 5.6.2
 
   crelt@1.0.5: {}
 
@@ -17260,10 +17316,10 @@ snapshots:
     optionalDependencies:
       eslint-config-prettier: 8.10.0(eslint@8.43.0)
 
-  eslint-plugin-storybook@0.6.15(eslint@8.43.0)(typescript@5.5.4):
+  eslint-plugin-storybook@0.6.15(eslint@8.43.0)(typescript@5.6.2):
     dependencies:
       '@storybook/csf': 0.0.1
-      '@typescript-eslint/utils': 5.59.6(eslint@8.43.0)(typescript@5.5.4)
+      '@typescript-eslint/utils': 5.59.6(eslint@8.43.0)(typescript@5.6.2)
       eslint: 8.43.0
       requireindex: 1.2.0
       ts-dedent: 2.2.0
@@ -17648,11 +17704,11 @@ snapshots:
 
   flatted@3.2.7: {}
 
-  floating-vue@5.2.2(vue@3.4.27(typescript@5.5.4)):
+  floating-vue@5.2.2(vue@3.5.8(typescript@5.6.2)):
     dependencies:
       '@floating-ui/dom': 1.1.1
-      vue: 3.4.27(typescript@5.5.4)
-      vue-resize: 2.0.0-alpha.1(vue@3.4.27(typescript@5.5.4))
+      vue: 3.5.8(typescript@5.6.2)
+      vue-resize: 2.0.0-alpha.1(vue@3.5.8(typescript@5.6.2))
 
   flow-parser@0.223.2: {}
 
@@ -19473,10 +19529,10 @@ snapshots:
 
   outdent@0.5.0: {}
 
-  overlayscrollbars-vue@0.5.7(overlayscrollbars@2.5.0)(vue@3.4.27(typescript@5.5.4)):
+  overlayscrollbars-vue@0.5.7(overlayscrollbars@2.5.0)(vue@3.5.8(typescript@5.6.2)):
     dependencies:
       overlayscrollbars: 2.5.0
-      vue: 3.4.27(typescript@5.5.4)
+      vue: 3.5.8(typescript@5.6.2)
 
   overlayscrollbars@2.5.0: {}
 
@@ -19664,6 +19720,8 @@ snapshots:
 
   picocolors@1.0.1: {}
 
+  picocolors@1.1.0: {}
+
   picomatch@2.3.1: {}
 
   pidtree@0.3.1: {}
@@ -19676,13 +19734,13 @@ snapshots:
 
   pify@4.0.1: {}
 
-  pinia@2.1.6(typescript@5.5.4)(vue@3.4.27(typescript@5.5.4)):
+  pinia@2.1.6(typescript@5.6.2)(vue@3.5.8(typescript@5.6.2)):
     dependencies:
       '@vue/devtools-api': 6.5.0
-      vue: 3.4.27(typescript@5.5.4)
-      vue-demi: 0.14.7(vue@3.4.27(typescript@5.5.4))
+      vue: 3.5.8(typescript@5.6.2)
+      vue-demi: 0.14.7(vue@3.5.8(typescript@5.6.2))
     optionalDependencies:
-      typescript: 5.5.4
+      typescript: 5.6.2
 
   pirates@4.0.5: {}
 
@@ -19743,9 +19801,9 @@ snapshots:
     optionalDependencies:
       postcss: 8.4.21
 
-  postcss-loader@7.3.3(postcss@8.4.38)(typescript@5.5.4)(webpack@5.89.0(esbuild@0.18.20)):
+  postcss-loader@7.3.3(postcss@8.4.38)(typescript@5.6.2)(webpack@5.89.0(esbuild@0.18.20)):
     dependencies:
-      cosmiconfig: 8.3.6(typescript@5.5.4)
+      cosmiconfig: 8.3.6(typescript@5.6.2)
       jiti: 1.18.2
       postcss: 8.4.38
       semver: 7.5.4
@@ -19824,6 +19882,12 @@ snapshots:
       picocolors: 1.0.1
       source-map-js: 1.2.0
 
+  postcss@8.4.47:
+    dependencies:
+      nanoid: 3.3.7
+      picocolors: 1.1.0
+      source-map-js: 1.2.1
+
   preact@10.11.2: {}
 
   preferred-pm@3.0.3:
@@ -20366,13 +20430,13 @@ snapshots:
 
   relateurl@0.2.7: {}
 
-  release-it@16.2.1(typescript@5.5.4):
+  release-it@16.2.1(typescript@5.6.2):
     dependencies:
       '@iarna/toml': 2.2.5
       '@octokit/rest': 19.0.13
       async-retry: 1.3.3
       chalk: 5.3.0
-      cosmiconfig: 8.3.6(typescript@5.5.4)
+      cosmiconfig: 8.3.6(typescript@5.6.2)
       execa: 7.2.0
       git-url-parse: 13.1.0
       globby: 13.2.2
@@ -20848,6 +20912,8 @@ snapshots:
 
   source-map-js@1.2.0: {}
 
+  source-map-js@1.2.1: {}
+
   source-map-support@0.5.21:
     dependencies:
       buffer-from: 1.1.2
@@ -21330,10 +21396,10 @@ snapshots:
 
   tslib@2.6.2: {}
 
-  tsutils@3.21.0(typescript@5.5.4):
+  tsutils@3.21.0(typescript@5.6.2):
     dependencies:
       tslib: 1.14.1
-      typescript: 5.5.4
+      typescript: 5.6.2
 
   tty-table@4.1.6:
     dependencies:
@@ -21453,6 +21519,8 @@ snapshots:
 
   typescript@5.5.4: {}
 
+  typescript@5.6.2: {}
+
   ua-parser-js@1.0.38: {}
 
   uc.micro@2.0.0: {}
@@ -21555,7 +21623,7 @@ snapshots:
 
   unpipe@1.0.0: {}
 
-  unplugin-icons@0.14.15(@vue/compiler-sfc@3.4.27)(vue-template-compiler@2.7.14):
+  unplugin-icons@0.14.15(@vue/compiler-sfc@3.5.8)(vue-template-compiler@2.7.14):
     dependencies:
       '@antfu/install-pkg': 0.1.1
       '@antfu/utils': 0.7.6
@@ -21565,7 +21633,7 @@ snapshots:
       local-pkg: 0.4.3
       unplugin: 1.5.1
     optionalDependencies:
-      '@vue/compiler-sfc': 3.4.27
+      '@vue/compiler-sfc': 3.5.8
       vue-template-compiler: 2.7.14
     transitivePeerDependencies:
       - supports-color
@@ -21735,19 +21803,18 @@ snapshots:
       - supports-color
       - terser
 
-  vite-plugin-dts@4.0.3(@types/node@20.14.2)(rollup@2.79.1)(typescript@5.5.4)(vite@5.4.1(@types/node@20.14.2)(less@4.2.0)(sass@1.60.0)(terser@5.31.0)):
+  vite-plugin-dts@4.2.2(@types/node@20.14.2)(rollup@2.79.1)(typescript@5.5.4)(vite@5.4.1(@types/node@20.14.2)(less@4.2.0)(sass@1.60.0)(terser@5.31.0)):
     dependencies:
-      '@microsoft/api-extractor': 7.47.4(@types/node@20.14.2)
+      '@microsoft/api-extractor': 7.47.7(@types/node@20.14.2)
       '@rollup/pluginutils': 5.1.0(rollup@2.79.1)
-      '@volar/typescript': 2.4.0
-      '@vue/language-core': 2.0.29(typescript@5.5.4)
+      '@volar/typescript': 2.4.5
+      '@vue/language-core': 2.1.6(typescript@5.5.4)
       compare-versions: 6.1.1
       debug: 4.3.6(supports-color@8.1.1)
       kolorist: 1.8.0
       local-pkg: 0.5.0
       magic-string: 0.30.11
       typescript: 5.5.4
-      vue-tsc: 2.0.29(typescript@5.5.4)
     optionalDependencies:
       vite: 5.4.1(@types/node@20.14.2)(less@4.2.0)(sass@1.60.0)(terser@5.31.0)
     transitivePeerDependencies:
@@ -21755,19 +21822,18 @@ snapshots:
       - rollup
       - supports-color
 
-  vite-plugin-dts@4.0.3(@types/node@20.14.2)(rollup@4.17.2)(typescript@5.5.4)(vite@5.4.1(@types/node@20.14.2)(less@4.2.0)(sass@1.60.0)(terser@5.31.0)):
+  vite-plugin-dts@4.2.2(@types/node@20.14.2)(rollup@4.17.2)(typescript@5.6.2)(vite@5.4.1(@types/node@20.14.2)(less@4.2.0)(sass@1.60.0)(terser@5.31.0)):
     dependencies:
-      '@microsoft/api-extractor': 7.47.4(@types/node@20.14.2)
+      '@microsoft/api-extractor': 7.47.7(@types/node@20.14.2)
       '@rollup/pluginutils': 5.1.0(rollup@4.17.2)
-      '@volar/typescript': 2.4.0
-      '@vue/language-core': 2.0.29(typescript@5.5.4)
+      '@volar/typescript': 2.4.5
+      '@vue/language-core': 2.1.6(typescript@5.6.2)
       compare-versions: 6.1.1
       debug: 4.3.6(supports-color@8.1.1)
       kolorist: 1.8.0
       local-pkg: 0.5.0
       magic-string: 0.30.11
-      typescript: 5.5.4
-      vue-tsc: 2.0.29(typescript@5.5.4)
+      typescript: 5.6.2
     optionalDependencies:
       vite: 5.4.1(@types/node@20.14.2)(less@4.2.0)(sass@1.60.0)(terser@5.31.0)
     transitivePeerDependencies:
@@ -21834,9 +21900,9 @@ snapshots:
       picocolors: 1.0.1
       vite: 5.4.1(@types/node@18.13.0)(less@4.2.0)(sass@1.60.0)(terser@5.31.0)
 
-  vite-plugin-vue-devtools@7.3.8(rollup@4.17.2)(vite@5.4.1(@types/node@18.13.0)(less@4.2.0)(sass@1.60.0)(terser@5.31.0))(vue@3.4.27(typescript@5.5.4)):
+  vite-plugin-vue-devtools@7.3.8(rollup@4.17.2)(vite@5.4.1(@types/node@18.13.0)(less@4.2.0)(sass@1.60.0)(terser@5.31.0))(vue@3.5.8(typescript@5.6.2)):
     dependencies:
-      '@vue/devtools-core': 7.3.8(vite@5.4.1(@types/node@18.13.0)(less@4.2.0)(sass@1.60.0)(terser@5.31.0))(vue@3.4.27(typescript@5.5.4))
+      '@vue/devtools-core': 7.3.8(vite@5.4.1(@types/node@18.13.0)(less@4.2.0)(sass@1.60.0)(terser@5.31.0))(vue@3.5.8(typescript@5.6.2))
       '@vue/devtools-kit': 7.3.8
       '@vue/devtools-shared': 7.3.8
       execa: 8.0.1
@@ -21958,17 +22024,17 @@ snapshots:
 
   vue-component-type-helpers@2.0.19: {}
 
-  vue-component-type-helpers@2.1.2: {}
+  vue-component-type-helpers@2.1.6: {}
 
-  vue-demi@0.13.11(vue@3.4.27(typescript@5.5.4)):
+  vue-demi@0.13.11(vue@3.5.8(typescript@5.6.2)):
     dependencies:
-      vue: 3.4.27(typescript@5.5.4)
+      vue: 3.5.8(typescript@5.6.2)
 
-  vue-demi@0.14.7(vue@3.4.27(typescript@5.5.4)):
+  vue-demi@0.14.7(vue@3.5.8(typescript@5.6.2)):
     dependencies:
-      vue: 3.4.27(typescript@5.5.4)
+      vue: 3.5.8(typescript@5.6.2)
 
-  vue-docgen-api@4.75.1(vue@3.4.27(typescript@5.5.4)):
+  vue-docgen-api@4.75.1(vue@3.5.8(typescript@5.6.2)):
     dependencies:
       '@babel/parser': 7.24.5
       '@babel/types': 7.24.5
@@ -21980,8 +22046,8 @@ snapshots:
       pug: 3.0.2
       recast: 0.23.4
       ts-map: 1.0.3
-      vue: 3.4.27(typescript@5.5.4)
-      vue-inbrowser-compiler-independent-utils: 4.71.1(vue@3.4.27(typescript@5.5.4))
+      vue: 3.5.8(typescript@5.6.2)
+      vue-inbrowser-compiler-independent-utils: 4.71.1(vue@3.5.8(typescript@5.6.2))
 
   vue-draggable-plus@0.4.1(@types/sortablejs@1.15.8):
     dependencies:
@@ -22026,25 +22092,25 @@ snapshots:
       - '@interactjs/core'
       - '@interactjs/utils'
 
-  vue-i18n@9.13.1(vue@3.4.27(typescript@5.5.4)):
+  vue-i18n@9.13.1(vue@3.5.8(typescript@5.6.2)):
     dependencies:
       '@intlify/core-base': 9.13.1
       '@intlify/shared': 9.13.1
       '@vue/devtools-api': 6.5.0
-      vue: 3.4.27(typescript@5.5.4)
+      vue: 3.5.8(typescript@5.6.2)
 
-  vue-inbrowser-compiler-independent-utils@4.71.1(vue@3.4.27(typescript@5.5.4)):
+  vue-inbrowser-compiler-independent-utils@4.71.1(vue@3.5.8(typescript@5.6.2)):
     dependencies:
-      vue: 3.4.27(typescript@5.5.4)
+      vue: 3.5.8(typescript@5.6.2)
 
-  vue-resize@2.0.0-alpha.1(vue@3.4.27(typescript@5.5.4)):
+  vue-resize@2.0.0-alpha.1(vue@3.5.8(typescript@5.6.2)):
     dependencies:
-      vue: 3.4.27(typescript@5.5.4)
+      vue: 3.5.8(typescript@5.6.2)
 
-  vue-router@4.3.2(vue@3.4.27(typescript@5.5.4)):
+  vue-router@4.3.2(vue@3.5.8(typescript@5.6.2)):
     dependencies:
       '@vue/devtools-api': 6.6.1
-      vue: 3.4.27(typescript@5.5.4)
+      vue: 3.5.8(typescript@5.6.2)
 
   vue-template-compiler@2.7.14:
     dependencies:
@@ -22052,22 +22118,22 @@ snapshots:
       he: 1.2.0
     optional: true
 
-  vue-tsc@2.0.29(typescript@5.5.4):
+  vue-tsc@2.1.6(typescript@5.6.2):
     dependencies:
-      '@volar/typescript': 2.4.0-alpha.18
-      '@vue/language-core': 2.0.29(typescript@5.5.4)
+      '@volar/typescript': 2.4.5
+      '@vue/language-core': 2.1.6(typescript@5.6.2)
       semver: 7.5.4
-      typescript: 5.5.4
+      typescript: 5.6.2
 
-  vue@3.4.27(typescript@5.5.4):
+  vue@3.5.8(typescript@5.6.2):
     dependencies:
-      '@vue/compiler-dom': 3.4.27
-      '@vue/compiler-sfc': 3.4.27
-      '@vue/runtime-dom': 3.4.27
-      '@vue/server-renderer': 3.4.27(vue@3.4.27(typescript@5.5.4))
-      '@vue/shared': 3.4.27
+      '@vue/compiler-dom': 3.5.8
+      '@vue/compiler-sfc': 3.5.8
+      '@vue/runtime-dom': 3.5.8
+      '@vue/server-renderer': 3.5.8(vue@3.5.8(typescript@5.6.2))
+      '@vue/shared': 3.5.8
     optionalDependencies:
-      typescript: 5.5.4
+      typescript: 5.6.2
 
   w3c-keyname@2.2.6: {}
 
diff --git a/ui/src/components/image/LazyImage.vue b/ui/src/components/image/LazyImage.vue
index dd953856a2..a1ce0bd8e8 100644
--- a/ui/src/components/image/LazyImage.vue
+++ b/ui/src/components/image/LazyImage.vue
@@ -3,12 +3,12 @@ import { onMounted, ref } from "vue";
 
 const props = withDefaults(
   defineProps<{
-    src: string;
+    src?: string;
     alt?: string;
     classes?: string | string[];
   }>(),
   {
-    src: "",
+    src: undefined,
     alt: "",
     classes: "",
   }
@@ -18,8 +18,12 @@ const isLoading = ref(false);
 const error = ref(false);
 
 const loadImage = async () => {
+  if (!props.src) {
+    throw new Error("src is required");
+  }
+
   const image = new Image();
-  image.src = props.src;
+  image.src = props.src || "";
   return new Promise((resolve, reject) => {
     image.onload = () => resolve(image);
     image.onerror = (err) => reject(err);
diff --git a/ui/src/components/video/LazyVideo.vue b/ui/src/components/video/LazyVideo.vue
index 5f717eaab7..e8dc6e3b70 100644
--- a/ui/src/components/video/LazyVideo.vue
+++ b/ui/src/components/video/LazyVideo.vue
@@ -3,11 +3,11 @@ import { onMounted, ref } from "vue";
 
 const props = withDefaults(
   defineProps<{
-    src: string;
+    src?: string;
     classes?: string | string[];
   }>(),
   {
-    src: "",
+    src: undefined,
     classes: "",
   }
 );
@@ -16,6 +16,10 @@ const isLoading = ref(false);
 const error = ref(false);
 
 const loadVideo = async () => {
+  if (!props.src) {
+    throw new Error("src is required");
+  }
+
   const video = document.createElement("video");
   video.src = props.src;
   return new Promise((resolve, reject) => {
diff --git a/ui/tsconfig.app.json b/ui/tsconfig.app.json
index cabcd19535..ddd9ec9a9a 100644
--- a/ui/tsconfig.app.json
+++ b/ui/tsconfig.app.json
@@ -17,7 +17,6 @@
       "@uc/*": ["./uc-src/*"],
       "@console/*": ["./console-src/*"]
     },
-    "noStrictGenericChecks": true,
     "ignoreDeprecations": "5.0",
     "types": ["unplugin-icons/types/vue"]
   }
diff --git a/ui/uc-src/modules/contents/posts/components/PostSettingForm.vue b/ui/uc-src/modules/contents/posts/components/PostSettingForm.vue
index ba3997f608..881c0ad50f 100644
--- a/ui/uc-src/modules/contents/posts/components/PostSettingForm.vue
+++ b/ui/uc-src/modules/contents/posts/components/PostSettingForm.vue
@@ -78,6 +78,7 @@ const publishTimeHelp = computed(() => {
 </script>
 
 <template>
+  <!-- @vue-ignore -->
   <FormKit
     id="post-setting-form"
     v-model="internalFormState"
diff --git a/ui/uc-src/modules/profile/components/PasswordChangeModal.vue b/ui/uc-src/modules/profile/components/PasswordChangeModal.vue
index f688893e96..5f5ed02f9a 100644
--- a/ui/uc-src/modules/profile/components/PasswordChangeModal.vue
+++ b/ui/uc-src/modules/profile/components/PasswordChangeModal.vue
@@ -56,6 +56,7 @@ const handleChangePassword = async () => {
     :title="$t('core.uc_profile.change_password_modal.title')"
     @close="emit('close')"
   >
+    <!-- @vue-ignore -->
     <FormKit
       id="password-form"
       v-model="formState"
diff --git a/ui/uc-src/modules/profile/components/PersonalAccessTokenCreationModal.vue b/ui/uc-src/modules/profile/components/PersonalAccessTokenCreationModal.vue
index 3a0ecb5f49..d71ed17b52 100644
--- a/ui/uc-src/modules/profile/components/PersonalAccessTokenCreationModal.vue
+++ b/ui/uc-src/modules/profile/components/PersonalAccessTokenCreationModal.vue
@@ -120,6 +120,7 @@ const { mutate, isLoading } = useMutation({
           </div>
         </div>
         <div class="mt-5 divide-y divide-gray-100 md:col-span-3 md:mt-0">
+          <!-- @vue-ignore -->
           <FormKit
             id="pat-creation-form"
             v-model="formState.spec"

From 9710201aa4f7081eabb3c54b12c39f77538aa662 Mon Sep 17 00:00:00 2001
From: John Niang <johnniang@foxmail.com>
Date: Thu, 26 Sep 2024 16:43:30 +0800
Subject: [PATCH 041/185] Support obtaining ServerWebExchange in ContextView
 (#6705)

#### What type of PR is this?

/kind feature
/area core
/milestone 2.20.x

#### What this PR does / why we need it:

This PR registers a ServerWebExchangeContextFilter to make ServerWebExchange available under ContextView. The usage example is as follows:

```java
Mono.deferContextual(contextView -> {
    var exchange = ServerWebExchangeContextFilter.getExchange(contextView);
    assertTrue(exchange.isPresent());
    return mono;
})
```

#### Does this PR introduce a user-facing change?

```release-note
None
```
---
 .../halo/app/infra/config/WebFluxConfig.java  |  8 ++++
 .../halo/app/config/WebFluxConfigTest.java    | 41 ++++++++++++++++++-
 2 files changed, 48 insertions(+), 1 deletion(-)

diff --git a/application/src/main/java/run/halo/app/infra/config/WebFluxConfig.java b/application/src/main/java/run/halo/app/infra/config/WebFluxConfig.java
index 49109f079b..dcf576c46c 100644
--- a/application/src/main/java/run/halo/app/infra/config/WebFluxConfig.java
+++ b/application/src/main/java/run/halo/app/infra/config/WebFluxConfig.java
@@ -26,6 +26,7 @@
 import org.springframework.http.codec.json.Jackson2JsonDecoder;
 import org.springframework.http.codec.json.Jackson2JsonEncoder;
 import org.springframework.lang.NonNull;
+import org.springframework.web.filter.reactive.ServerWebExchangeContextFilter;
 import org.springframework.web.reactive.config.ResourceHandlerRegistration;
 import org.springframework.web.reactive.config.ResourceHandlerRegistry;
 import org.springframework.web.reactive.config.WebFluxConfigurer;
@@ -252,4 +253,11 @@ AdditionalWebFilterChainProxy additionalWebFilterChainProxy(ExtensionGetter exte
         return new AdditionalWebFilterChainProxy(extensionGetter);
     }
 
+    @Bean
+    // We expect this filter to be executed before AdditionalWebFilterChainProxy
+    @Order(-102)
+    ServerWebExchangeContextFilter serverWebExchangeContextFilter() {
+        return new ServerWebExchangeContextFilter();
+    }
+
 }
diff --git a/application/src/test/java/run/halo/app/config/WebFluxConfigTest.java b/application/src/test/java/run/halo/app/config/WebFluxConfigTest.java
index 40030c6432..55b7fec6f1 100644
--- a/application/src/test/java/run/halo/app/config/WebFluxConfigTest.java
+++ b/application/src/test/java/run/halo/app/config/WebFluxConfigTest.java
@@ -1,6 +1,7 @@
 package run.halo.app.config;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.mockito.Mockito.when;
 
 import java.net.URI;
@@ -18,10 +19,15 @@
 import org.springframework.context.annotation.Import;
 import org.springframework.test.context.bean.override.mockito.MockitoSpyBean;
 import org.springframework.test.web.reactive.server.WebTestClient;
+import org.springframework.web.filter.reactive.ServerWebExchangeContextFilter;
+import org.springframework.web.reactive.function.server.RouterFunction;
+import org.springframework.web.reactive.function.server.RouterFunctions;
+import org.springframework.web.reactive.function.server.ServerResponse;
 import org.springframework.web.reactive.socket.WebSocketHandler;
 import org.springframework.web.reactive.socket.WebSocketMessage;
 import org.springframework.web.reactive.socket.client.ReactorNettyWebSocketClient;
 import reactor.core.publisher.Flux;
+import reactor.core.publisher.Mono;
 import reactor.test.StepVerifier;
 import run.halo.app.core.endpoint.WebSocketEndpoint;
 import run.halo.app.core.extension.Role;
@@ -31,7 +37,10 @@
 
 @SpringBootTest(properties = "halo.console.location=classpath:/console/", webEnvironment =
     SpringBootTest.WebEnvironment.RANDOM_PORT)
-@Import(WebFluxConfigTest.WebSocketSupportTest.TestWebSocketConfiguration.class)
+@Import({
+    WebFluxConfigTest.WebSocketSupportTest.TestWebSocketConfiguration.class,
+    WebFluxConfigTest.ServerWebExchangeContextFilterTest.TestConfig.class
+})
 @AutoConfigureWebTestClient
 class WebFluxConfigTest {
 
@@ -154,4 +163,34 @@ void shouldRespond404WhenThemeResourceNotFound() {
                 .expectStatus().isNotFound();
         }
     }
+
+
+    @Nested
+    class ServerWebExchangeContextFilterTest {
+
+        @TestConfiguration
+        static class TestConfig {
+
+            @Bean
+            RouterFunction<ServerResponse> assertServerWebExchangeRoute() {
+                return RouterFunctions.route()
+                    .GET("/assert-server-web-exchange",
+                        request -> Mono.deferContextual(contextView -> {
+                            var exchange = ServerWebExchangeContextFilter.getExchange(contextView);
+                            assertTrue(exchange.isPresent());
+                            return ServerResponse.ok().build();
+                        }))
+                    .build();
+            }
+
+        }
+
+        @Test
+        void shouldGetExchangeFromContextView() {
+            webClient.get().uri("/assert-server-web-exchange")
+                .exchange()
+                .expectStatus().isOk();
+        }
+
+    }
 }
\ No newline at end of file

From 565dc1cbc8a73fc09c5309f12e799c6d0e834209 Mon Sep 17 00:00:00 2001
From: Ryan Wang <i@ryanc.cc>
Date: Thu, 26 Sep 2024 16:47:31 +0800
Subject: [PATCH 042/185] refactor: unified empty state UI action button styles
 (#6704)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/area ui
/kind improvement
/milestone 2.20.x

#### What this PR does / why we need it:

统一空状态界面中操作按钮的风格。

#### Does this PR introduce a user-facing change?

```release-note
统一空状态界面中操作按钮的风格。
```
---
 .../modules/contents/comments/CommentList.vue          |  8 +++-----
 .../modules/contents/pages/DeletedSinglePageList.vue   |  2 +-
 .../modules/contents/pages/SinglePageList.vue          |  2 +-
 .../modules/contents/posts/DeletedPostList.vue         |  2 +-
 ui/console-src/modules/contents/posts/PostList.vue     |  2 +-
 .../modules/contents/posts/categories/CategoryList.vue |  2 +-
 ui/console-src/modules/contents/posts/tags/TagList.vue |  2 +-
 ui/console-src/modules/interface/menus/Menus.vue       |  2 +-
 .../modules/interface/menus/components/MenuList.vue    |  9 +++------
 .../themes/components/list-tabs/InstalledThemes.vue    |  2 +-
 .../themes/components/list-tabs/NotInstalledThemes.vue | 10 ++++------
 .../modules/interface/themes/layouts/ThemeLayout.vue   |  2 +-
 ui/uc-src/modules/contents/posts/PostList.vue          |  2 +-
 .../modules/profile/tabs/PersonalAccessTokens.vue      |  2 +-
 14 files changed, 21 insertions(+), 28 deletions(-)

diff --git a/ui/console-src/modules/contents/comments/CommentList.vue b/ui/console-src/modules/contents/comments/CommentList.vue
index 047be82162..74e54c55b4 100644
--- a/ui/console-src/modules/contents/comments/CommentList.vue
+++ b/ui/console-src/modules/contents/comments/CommentList.vue
@@ -364,11 +364,9 @@ const handleApproveInBatch = async () => {
           :title="$t('core.comment.empty.title')"
         >
           <template #actions>
-            <VSpace>
-              <VButton @click="refetch">
-                {{ $t("core.common.buttons.refresh") }}
-              </VButton>
-            </VSpace>
+            <VButton @click="refetch">
+              {{ $t("core.common.buttons.refresh") }}
+            </VButton>
           </template>
         </VEmpty>
       </Transition>
diff --git a/ui/console-src/modules/contents/pages/DeletedSinglePageList.vue b/ui/console-src/modules/contents/pages/DeletedSinglePageList.vue
index 90a9a052e3..2d5bd8b9d8 100644
--- a/ui/console-src/modules/contents/pages/DeletedSinglePageList.vue
+++ b/ui/console-src/modules/contents/pages/DeletedSinglePageList.vue
@@ -281,7 +281,7 @@ watch(
               <VButton
                 v-permission="['system:singlepages:view']"
                 :route="{ name: 'SinglePages' }"
-                type="primary"
+                type="secondary"
               >
                 {{ $t("core.common.buttons.back") }}
               </VButton>
diff --git a/ui/console-src/modules/contents/pages/SinglePageList.vue b/ui/console-src/modules/contents/pages/SinglePageList.vue
index 77b25c0ae6..f33e6f583c 100644
--- a/ui/console-src/modules/contents/pages/SinglePageList.vue
+++ b/ui/console-src/modules/contents/pages/SinglePageList.vue
@@ -432,7 +432,7 @@ watch(selectedPageNames, (newValue) => {
               <VButton
                 v-permission="['system:singlepages:manage']"
                 :route="{ name: 'SinglePageEditor' }"
-                type="primary"
+                type="secondary"
               >
                 <template #icon>
                   <IconAddCircle class="h-full w-full" />
diff --git a/ui/console-src/modules/contents/posts/DeletedPostList.vue b/ui/console-src/modules/contents/posts/DeletedPostList.vue
index 29e50b2b1f..85090a37b2 100644
--- a/ui/console-src/modules/contents/posts/DeletedPostList.vue
+++ b/ui/console-src/modules/contents/posts/DeletedPostList.vue
@@ -280,7 +280,7 @@ watch(
               <VButton @click="refetch">
                 {{ $t("core.common.buttons.refresh") }}
               </VButton>
-              <VButton :route="{ name: 'Posts' }" type="primary">
+              <VButton :route="{ name: 'Posts' }" type="secondary">
                 {{ $t("core.common.buttons.back") }}
               </VButton>
             </VSpace>
diff --git a/ui/console-src/modules/contents/posts/PostList.vue b/ui/console-src/modules/contents/posts/PostList.vue
index 01c36facb2..13a80bf1ce 100644
--- a/ui/console-src/modules/contents/posts/PostList.vue
+++ b/ui/console-src/modules/contents/posts/PostList.vue
@@ -563,7 +563,7 @@ watch(
               <VButton
                 v-permission="['system:posts:manage']"
                 :route="{ name: 'PostEditor' }"
-                type="primary"
+                type="secondary"
               >
                 <template #icon>
                   <IconAddCircle class="h-full w-full" />
diff --git a/ui/console-src/modules/contents/posts/categories/CategoryList.vue b/ui/console-src/modules/contents/posts/categories/CategoryList.vue
index 43ba0e83a6..4acc22c862 100644
--- a/ui/console-src/modules/contents/posts/categories/CategoryList.vue
+++ b/ui/console-src/modules/contents/posts/categories/CategoryList.vue
@@ -117,7 +117,7 @@ const handleUpdateInBatch = useDebounceFn(async () => {
               </VButton>
               <VButton
                 v-permission="['system:posts:manage']"
-                type="primary"
+                type="secondary"
                 @click="creationModal = true"
               >
                 <template #icon>
diff --git a/ui/console-src/modules/contents/posts/tags/TagList.vue b/ui/console-src/modules/contents/posts/tags/TagList.vue
index 6391286358..528bcaac71 100644
--- a/ui/console-src/modules/contents/posts/tags/TagList.vue
+++ b/ui/console-src/modules/contents/posts/tags/TagList.vue
@@ -267,7 +267,7 @@ watch(selectedTagNames, (newVal) => {
               <VButton @click="() => handleFetchTags">
                 {{ $t("core.common.buttons.refresh") }}
               </VButton>
-              <VButton type="primary" @click="editingModal = true">
+              <VButton type="secondary" @click="editingModal = true">
                 <template #icon>
                   <IconAddCircle class="h-full w-full" />
                 </template>
diff --git a/ui/console-src/modules/interface/menus/Menus.vue b/ui/console-src/modules/interface/menus/Menus.vue
index 40e7b2a5b3..9823031ca5 100644
--- a/ui/console-src/modules/interface/menus/Menus.vue
+++ b/ui/console-src/modules/interface/menus/Menus.vue
@@ -259,7 +259,7 @@ const handleDelete = async (menuItem: MenuTreeItem) => {
                   </VButton>
                   <VButton
                     v-permission="['system:menus:manage']"
-                    type="primary"
+                    type="secondary"
                     @click="menuItemEditingModal = true"
                   >
                     <template #icon>
diff --git a/ui/console-src/modules/interface/menus/components/MenuList.vue b/ui/console-src/modules/interface/menus/components/MenuList.vue
index cd4fb1e1e2..79925a01dc 100644
--- a/ui/console-src/modules/interface/menus/components/MenuList.vue
+++ b/ui/console-src/modules/interface/menus/components/MenuList.vue
@@ -12,7 +12,6 @@ import {
   VEntity,
   VEntityField,
   VLoading,
-  VSpace,
   VStatusDot,
   VTag,
 } from "@halo-dev/components";
@@ -187,11 +186,9 @@ const handleSetPrimaryMenu = async (menu: Menu) => {
         :title="$t('core.menu.empty.title')"
       >
         <template #actions>
-          <VSpace>
-            <VButton size="sm" @click="refetch()">
-              {{ $t("core.common.buttons.refresh") }}
-            </VButton>
-          </VSpace>
+          <VButton size="sm" @click="refetch()">
+            {{ $t("core.common.buttons.refresh") }}
+          </VButton>
         </template>
       </VEmpty>
     </Transition>
diff --git a/ui/console-src/modules/interface/themes/components/list-tabs/InstalledThemes.vue b/ui/console-src/modules/interface/themes/components/list-tabs/InstalledThemes.vue
index 401608f4f7..d2524316a0 100644
--- a/ui/console-src/modules/interface/themes/components/list-tabs/InstalledThemes.vue
+++ b/ui/console-src/modules/interface/themes/components/list-tabs/InstalledThemes.vue
@@ -81,7 +81,7 @@ const handleOpenPreview = (theme: Theme) => {
             </VButton>
             <VButton
               v-permission="['system:themes:manage']"
-              type="primary"
+              type="secondary"
               @click="activeTabId = 'local-upload'"
             >
               <template #icon>
diff --git a/ui/console-src/modules/interface/themes/components/list-tabs/NotInstalledThemes.vue b/ui/console-src/modules/interface/themes/components/list-tabs/NotInstalledThemes.vue
index 3a5e451cd9..008f75a15c 100644
--- a/ui/console-src/modules/interface/themes/components/list-tabs/NotInstalledThemes.vue
+++ b/ui/console-src/modules/interface/themes/components/list-tabs/NotInstalledThemes.vue
@@ -1,7 +1,7 @@
 <script lang="ts" setup>
 import type { Theme } from "@halo-dev/api-client";
 import { consoleApiClient } from "@halo-dev/api-client";
-import { VButton, VEmpty, VLoading, VSpace } from "@halo-dev/components";
+import { VButton, VEmpty, VLoading } from "@halo-dev/components";
 import { useQuery } from "@tanstack/vue-query";
 import ThemeListItem from "../ThemeListItem.vue";
 
@@ -29,11 +29,9 @@ const {
     <Transition v-else-if="!themes?.length" appear name="fade">
       <VEmpty :title="$t('core.theme.list_modal.not_installed_empty.title')">
         <template #actions>
-          <VSpace>
-            <VButton :loading="isFetching" @click="refetch">
-              {{ $t("core.common.buttons.refresh") }}
-            </VButton>
-          </VSpace>
+          <VButton :loading="isFetching" @click="refetch">
+            {{ $t("core.common.buttons.refresh") }}
+          </VButton>
         </template>
       </VEmpty>
     </Transition>
diff --git a/ui/console-src/modules/interface/themes/layouts/ThemeLayout.vue b/ui/console-src/modules/interface/themes/layouts/ThemeLayout.vue
index 98cb1fa4b1..99ee219d69 100644
--- a/ui/console-src/modules/interface/themes/layouts/ThemeLayout.vue
+++ b/ui/console-src/modules/interface/themes/layouts/ThemeLayout.vue
@@ -235,7 +235,7 @@ onMounted(() => {
             <VButton @click="themesModal = true">
               {{ $t("core.theme.common.buttons.install") }}
             </VButton>
-            <VButton type="primary" @click="themesModal = true">
+            <VButton type="secondary" @click="themesModal = true">
               <template #icon>
                 <IconExchange class="h-full w-full" />
               </template>
diff --git a/ui/uc-src/modules/contents/posts/PostList.vue b/ui/uc-src/modules/contents/posts/PostList.vue
index d059cc6938..b625407827 100644
--- a/ui/uc-src/modules/contents/posts/PostList.vue
+++ b/ui/uc-src/modules/contents/posts/PostList.vue
@@ -175,7 +175,7 @@ const {
               <VButton
                 v-permission="['system:posts:manage']"
                 :route="{ name: 'PostEditor' }"
-                type="primary"
+                type="secondary"
               >
                 <template #icon>
                   <IconAddCircle class="h-full w-full" />
diff --git a/ui/uc-src/modules/profile/tabs/PersonalAccessTokens.vue b/ui/uc-src/modules/profile/tabs/PersonalAccessTokens.vue
index 9d2bcba5f8..b9cafddfd4 100644
--- a/ui/uc-src/modules/profile/tabs/PersonalAccessTokens.vue
+++ b/ui/uc-src/modules/profile/tabs/PersonalAccessTokens.vue
@@ -56,7 +56,7 @@ const creationModal = ref(false);
           <VButton @click="refetch">
             {{ $t("core.common.buttons.refresh") }}
           </VButton>
-          <VButton type="primary" @click="creationModal = true">
+          <VButton type="secondary" @click="creationModal = true">
             <template #icon>
               <IconAddCircle class="h-full w-full" />
             </template>

From a860cb5ad81b59111c1495ba48a1350cdec21380 Mon Sep 17 00:00:00 2001
From: Ryan Wang <i@ryanc.cc>
Date: Thu, 26 Sep 2024 16:49:33 +0800
Subject: [PATCH 043/185] refactor: simplify page title of deleted page (#6708)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/kind improvement
/area ui
/milestone 2.20.x

#### What this PR does / why we need it:

简化页面回收站的页面标题。

#### Does this PR introduce a user-facing change?

```release-note
简化页面回收站的页面标题。
```
---
 ui/src/locales/zh-CN.yaml | 2 +-
 ui/src/locales/zh-TW.yaml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/ui/src/locales/zh-CN.yaml b/ui/src/locales/zh-CN.yaml
index d2c08b7209..388d34aea2 100644
--- a/ui/src/locales/zh-CN.yaml
+++ b/ui/src/locales/zh-CN.yaml
@@ -485,7 +485,7 @@ core:
         cover:
           label: 封面图
   deleted_page:
-    title: 自定义页面回收站
+    title: 页面回收站
     empty:
       title: 没有自定义页面被放入回收站
       message: 你可以尝试刷新或者返回自定义页面管理
diff --git a/ui/src/locales/zh-TW.yaml b/ui/src/locales/zh-TW.yaml
index 6c658c7f9d..76bbcfaa10 100644
--- a/ui/src/locales/zh-TW.yaml
+++ b/ui/src/locales/zh-TW.yaml
@@ -465,7 +465,7 @@ core:
         cover:
           label: 封面圖
   deleted_page:
-    title: 自定義頁面回收站
+    title: 頁面回收站
     empty:
       title: 沒有自定義頁面被放入回收站
       message: 你可以嘗試刷新或者返回自定義頁面管理

From 56cb22ac31239869c922dca48f96d2382e733e6f Mon Sep 17 00:00:00 2001
From: Ryan Wang <i@ryanc.cc>
Date: Fri, 27 Sep 2024 13:03:35 +0800
Subject: [PATCH 044/185] refactor: remove async loading logic for editor
 (#6707)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/area ui
/kind improvement
/milestone 2.20.x

#### What this PR does / why we need it:

取消异步加载默认编辑器，在之前的版本中，由于编辑器体积较大，所以做了异步加载的处理，但近期的版本中，为了让插件可以使用编辑器或者扩展编辑器，已经将编辑器依赖作为全局加载，如果这个时候还是异步加载编辑器组件的话，进入编辑页面的时候出现短暂的灰屏闪烁。

#### Does this PR introduce a user-facing change?

```release-note
优化默认编辑器的加载方式，防止出现灰屏闪烁的问题。
```
---
 ui/src/components/editor/utils/upload.ts          |  4 ++--
 ui/src/composables/use-editor-extension-points.ts | 12 +++---------
 2 files changed, 5 insertions(+), 11 deletions(-)

diff --git a/ui/src/components/editor/utils/upload.ts b/ui/src/components/editor/utils/upload.ts
index f812e0bd50..4ca9a4ce85 100644
--- a/ui/src/components/editor/utils/upload.ts
+++ b/ui/src/components/editor/utils/upload.ts
@@ -12,8 +12,6 @@ export interface FileProps {
   editor: CoreEditor;
 }
 
-const { currentUserHasPermission } = usePermission();
-
 /**
  * Handles file events, determining if the file is an image and triggering the appropriate upload process.
  *
@@ -21,6 +19,8 @@ const { currentUserHasPermission } = usePermission();
  * @returns {boolean} - True if a file is handled, otherwise false
  */
 export const handleFileEvent = ({ file, editor }: FileProps) => {
+  const { currentUserHasPermission } = usePermission();
+
   if (!file) {
     return false;
   }
diff --git a/ui/src/composables/use-editor-extension-points.ts b/ui/src/composables/use-editor-extension-points.ts
index 7f90e42d3f..54fc3611a1 100644
--- a/ui/src/composables/use-editor-extension-points.ts
+++ b/ui/src/composables/use-editor-extension-points.ts
@@ -1,8 +1,8 @@
 import Logo from "@/assets/logo.png";
+import DefaultEditor from "@/components/editor/DefaultEditor.vue";
 import { usePluginModuleStore } from "@/stores/plugin";
-import { VLoading } from "@halo-dev/components";
 import type { EditorProvider } from "@halo-dev/console-shared";
-import { defineAsyncComponent, markRaw, ref, type Ref } from "vue";
+import { markRaw, ref, type Ref } from "vue";
 import { useI18n } from "vue-i18n";
 
 interface useEditorExtensionPointsReturn {
@@ -19,13 +19,7 @@ export function useEditorExtensionPoints(): useEditorExtensionPointsReturn {
     {
       name: "default",
       displayName: t("core.plugin.extension_points.editor.providers.default"),
-      component: markRaw(
-        defineAsyncComponent({
-          loader: () => import("@/components/editor/DefaultEditor.vue"),
-          loadingComponent: VLoading,
-          delay: 200,
-        })
-      ),
+      component: markRaw(DefaultEditor),
       rawType: "HTML",
       logo: Logo,
     },

From 1f9610686b2ee45ecdfe3a23f60e4b643fbd1401 Mon Sep 17 00:00:00 2001
From: JohnNiang <johnniang@foxmail.com>
Date: Sat, 28 Sep 2024 17:37:36 +0800
Subject: [PATCH 045/185] Add backend support for customizing login and logout
 pages

Signed-off-by: JohnNiang <johnniang@foxmail.com>
---
 .../halo/app/core/extension/AuthProvider.java |  15 +
 .../run/halo/app/extension/Unstructured.java  |   8 +-
 .../halo/app/infra/ExternalLinkProcessor.java |  18 ++
 .../run/halo/app/infra/SystemSetting.java     |   4 +-
 application/build.gradle                      |   6 +-
 .../endpoint/theme/PublicUserEndpoint.java    | 285 ------------------
 .../service/EmailPasswordRecoveryService.java |   8 +-
 .../service/InMemoryResetTokenRepository.java |  54 ++++
 .../service/InvalidResetTokenException.java   |  17 ++
 .../app/core/user/service/ResetToken.java     |  15 +
 .../user/service/ResetTokenRepository.java    |  38 +++
 .../app/core/user/service/SignUpData.java     |  57 ++++
 .../app/core/user/service/UserService.java    |   2 +-
 .../core/user/service/UserServiceImpl.java    |  77 +++--
 .../EmailPasswordRecoveryServiceImpl.java     | 181 +++++------
 .../impl/EmailVerificationServiceImpl.java    |  15 +-
 .../app/extension/JSONExtensionConverter.java |  10 +-
 .../infra/DefaultExternalLinkProcessor.java   |  34 +++
 .../halo/app/infra/actuator/GlobalInfo.java   |  62 ++++
 .../infra/actuator/GlobalInfoEndpoint.java    | 163 +---------
 .../app/infra/actuator/GlobalInfoService.java |  20 ++
 .../infra/actuator/GlobalInfoServiceImpl.java | 147 +++++++++
 .../infra/config/WebServerSecurityConfig.java |  40 ++-
 .../RequestBodyValidationException.java       |   2 +
 .../app/security/AuthProviderService.java     |   4 +
 .../app/security/AuthProviderServiceImpl.java |  36 ++-
 ...DefaultServerAuthenticationEntryPoint.java |  39 ++-
 .../security/LoginHandlerEnhancerImpl.java    |   8 +-
 .../security/LogoutSecurityConfigurer.java    |  26 +-
 .../exception/TooManyRequestsException.java   |  21 ++
 .../exception/TwoFactorAuthException.java     |  15 +
 .../login/LoginAuthenticationConverter.java   |   9 +-
 .../login/LoginSecurityConfigurer.java        |  21 +-
 ...sswordDelegatingAuthenticationManager.java |  12 +-
 .../login/UsernamePasswordHandler.java        |  40 ++-
 .../rememberme/RememberMeRequestCache.java    |  39 +++
 .../TokenBasedRememberMeServices.java         |  34 +--
 .../WebSessionRememberMeRequestCache.java     |  71 +++++
 .../DefaultTwoFactorAuthResponseHandler.java  |  56 ----
 .../TotpAuthenticationSuccessHandler.java     |  29 ++
 .../TwoFactorAuthResponseHandler.java         |  10 -
 .../TwoFactorAuthSecurityConfigurer.java      |  39 ++-
 .../twofactor/TwoFactorAuthentication.java    |   4 +-
 .../TwoFactorAuthorizationManager.java        |  22 +-
 .../totp/TotpAuthenticationFilter.java        | 137 ---------
 .../totp/TotpAuthenticationManager.java       |  69 +++++
 .../totp/TotpCodeAuthenticationConverter.java |  52 ++++
 .../RequestInfoAuthorizationManager.java      |  29 +-
 .../preauth/PreAuthLoginEndpoint.java         |  94 ++++++
 .../preauth/PreAuthPasswordResetEndpoint.java | 186 ++++++++++++
 .../preauth/PreAuthSignUpEndpoint.java        | 157 ++++++++++
 .../preauth/PreAuthTwoFactorEndpoint.java     |  27 ++
 .../app/theme/finders/vo/SiteSettingVo.java   |   2 +-
 .../message/ThemeMessageResolutionUtils.java  | 116 -------
 .../theme/message/ThemeMessageResolver.java   |   9 -
 .../src/main/resources/application.yaml       |   8 +-
 .../resources/extensions/authproviders.yaml   |   6 +-
 .../theme/PublicUserEndpointTest.java         |  92 ------
 .../user/service/UserServiceImplTest.java     |  45 ++-
 .../EmailPasswordRecoveryServiceImplTest.java |  69 -----
 .../DefaultExternalLinkProcessorTest.java     |  76 ++++-
 .../security/AuthProviderServiceImplTest.java |   8 +-
 ...ultServerAuthenticationEntryPointTest.java |  17 +-
 .../security/SuperAdminInitializerTest.java   |  62 ----
 .../LoginAuthenticationConverterTest.java     |   4 +-
 .../authorization/AuthorizationTest.java      |  28 +-
 .../ThemeMessageResolutionUtilsTest.java      |   8 -
 67 files changed, 1782 insertions(+), 1332 deletions(-)
 delete mode 100644 application/src/main/java/run/halo/app/core/endpoint/theme/PublicUserEndpoint.java
 create mode 100644 application/src/main/java/run/halo/app/core/user/service/InMemoryResetTokenRepository.java
 create mode 100644 application/src/main/java/run/halo/app/core/user/service/InvalidResetTokenException.java
 create mode 100644 application/src/main/java/run/halo/app/core/user/service/ResetToken.java
 create mode 100644 application/src/main/java/run/halo/app/core/user/service/ResetTokenRepository.java
 create mode 100644 application/src/main/java/run/halo/app/core/user/service/SignUpData.java
 create mode 100644 application/src/main/java/run/halo/app/infra/actuator/GlobalInfo.java
 create mode 100644 application/src/main/java/run/halo/app/infra/actuator/GlobalInfoService.java
 create mode 100644 application/src/main/java/run/halo/app/infra/actuator/GlobalInfoServiceImpl.java
 create mode 100644 application/src/main/java/run/halo/app/security/authentication/exception/TooManyRequestsException.java
 create mode 100644 application/src/main/java/run/halo/app/security/authentication/exception/TwoFactorAuthException.java
 create mode 100644 application/src/main/java/run/halo/app/security/authentication/rememberme/RememberMeRequestCache.java
 create mode 100644 application/src/main/java/run/halo/app/security/authentication/rememberme/WebSessionRememberMeRequestCache.java
 delete mode 100644 application/src/main/java/run/halo/app/security/authentication/twofactor/DefaultTwoFactorAuthResponseHandler.java
 create mode 100644 application/src/main/java/run/halo/app/security/authentication/twofactor/TotpAuthenticationSuccessHandler.java
 delete mode 100644 application/src/main/java/run/halo/app/security/authentication/twofactor/TwoFactorAuthResponseHandler.java
 delete mode 100644 application/src/main/java/run/halo/app/security/authentication/twofactor/totp/TotpAuthenticationFilter.java
 create mode 100644 application/src/main/java/run/halo/app/security/authentication/twofactor/totp/TotpAuthenticationManager.java
 create mode 100644 application/src/main/java/run/halo/app/security/authentication/twofactor/totp/TotpCodeAuthenticationConverter.java
 create mode 100644 application/src/main/java/run/halo/app/security/preauth/PreAuthLoginEndpoint.java
 create mode 100644 application/src/main/java/run/halo/app/security/preauth/PreAuthPasswordResetEndpoint.java
 create mode 100644 application/src/main/java/run/halo/app/security/preauth/PreAuthSignUpEndpoint.java
 create mode 100644 application/src/main/java/run/halo/app/security/preauth/PreAuthTwoFactorEndpoint.java
 delete mode 100644 application/src/test/java/run/halo/app/core/endpoint/theme/PublicUserEndpointTest.java
 delete mode 100644 application/src/test/java/run/halo/app/security/SuperAdminInitializerTest.java

diff --git a/api/src/main/java/run/halo/app/core/extension/AuthProvider.java b/api/src/main/java/run/halo/app/core/extension/AuthProvider.java
index 5f496c687f..256072b78a 100644
--- a/api/src/main/java/run/halo/app/core/extension/AuthProvider.java
+++ b/api/src/main/java/run/halo/app/core/extension/AuthProvider.java
@@ -48,6 +48,15 @@ public static class AuthProviderSpec {
         @Schema(requiredMode = REQUIRED, description = "Authentication url of the auth provider")
         private String authenticationUrl;
 
+        private String method = "GET";
+
+        private boolean rememberMeSupport = false;
+
+        /**
+         * Auth type: form or oauth2.
+         */
+        private AuthType authType;
+
         private String bindingUrl;
 
         private String unbindUrl;
@@ -77,4 +86,10 @@ public static class ConfigMapRef {
         @Schema(requiredMode = REQUIRED, minLength = 1)
         private String name;
     }
+
+    public enum AuthType {
+        FORM,
+        OAUTH2,
+        ;
+    }
 }
diff --git a/api/src/main/java/run/halo/app/extension/Unstructured.java b/api/src/main/java/run/halo/app/extension/Unstructured.java
index 2ea80b5c5a..6335fd198c 100644
--- a/api/src/main/java/run/halo/app/extension/Unstructured.java
+++ b/api/src/main/java/run/halo/app/extension/Unstructured.java
@@ -5,6 +5,7 @@
 import com.fasterxml.jackson.databind.DeserializationContext;
 import com.fasterxml.jackson.databind.JsonDeserializer;
 import com.fasterxml.jackson.databind.JsonSerializer;
+import com.fasterxml.jackson.databind.MapperFeature;
 import com.fasterxml.jackson.databind.ObjectMapper;
 import com.fasterxml.jackson.databind.SerializerProvider;
 import com.fasterxml.jackson.databind.annotation.JsonDeserialize;
@@ -35,7 +36,12 @@
 @SuppressWarnings("rawtypes")
 public class Unstructured implements Extension {
 
-    public static final ObjectMapper OBJECT_MAPPER = Json.mapper();
+    @SuppressWarnings("deprecation")
+    public static final ObjectMapper OBJECT_MAPPER = Json.mapper()
+        // We don't want to change the default mapper
+        // so we copy a new one and configure it
+        .copy()
+        .enable(MapperFeature.ACCEPT_CASE_INSENSITIVE_ENUMS);
 
     private final Map data;
 
diff --git a/api/src/main/java/run/halo/app/infra/ExternalLinkProcessor.java b/api/src/main/java/run/halo/app/infra/ExternalLinkProcessor.java
index ea653c709b..99dae5bcbd 100644
--- a/api/src/main/java/run/halo/app/infra/ExternalLinkProcessor.java
+++ b/api/src/main/java/run/halo/app/infra/ExternalLinkProcessor.java
@@ -1,5 +1,9 @@
 package run.halo.app.infra;
 
+import java.net.URI;
+import org.springframework.http.HttpRequest;
+import reactor.core.publisher.Mono;
+
 /**
  * {@link ExternalLinkProcessor} to process an in-site link to an external link.
  *
@@ -17,4 +21,18 @@ public interface ExternalLinkProcessor {
      * @return processed link or original link
      */
     String processLink(String link);
+
+    /**
+     * Process the URI to an external URL.
+     * <p>
+     * If the URI is an in-site link, then process it to an external link with
+     * {@link ExternalUrlSupplier#getRaw()} or {@link ExternalUrlSupplier#getURL(HttpRequest)},
+     * otherwise return the original URI.
+     * </p>
+     *
+     * @param uri uri to process
+     * @return processed URI or original URI
+     */
+    Mono<URI> processLink(URI uri);
+
 }
diff --git a/api/src/main/java/run/halo/app/infra/SystemSetting.java b/api/src/main/java/run/halo/app/infra/SystemSetting.java
index c548486249..9beabb6c4f 100644
--- a/api/src/main/java/run/halo/app/infra/SystemSetting.java
+++ b/api/src/main/java/run/halo/app/infra/SystemSetting.java
@@ -67,8 +67,8 @@ public static class Basic {
     @Data
     public static class User {
         public static final String GROUP = "user";
-        Boolean allowRegistration;
-        Boolean mustVerifyEmailOnRegistration;
+        boolean allowRegistration;
+        boolean mustVerifyEmailOnRegistration;
         String defaultRole;
         String avatarPolicy;
     }
diff --git a/application/build.gradle b/application/build.gradle
index f0cc3488bf..cffbdfd6a9 100644
--- a/application/build.gradle
+++ b/application/build.gradle
@@ -80,6 +80,10 @@ dependencies {
     testImplementation 'org.springframework.boot:spring-boot-starter-test'
     testImplementation 'org.springframework.security:spring-security-test'
     testImplementation 'io.projectreactor:reactor-test'
+
+    // webjars
+    runtimeOnly 'org.webjars.npm:jsencrypt:3.3.2'
+    runtimeOnly 'org.webjars.npm:normalize.css:8.0.1'
 }
 
 tasks.register('createChecksums', Checksum) {
@@ -164,4 +168,4 @@ tasks.named('generateOpenApiDocs') {
     outputs.upToDateWhen {
         false
     }
-}
+}
\ No newline at end of file
diff --git a/application/src/main/java/run/halo/app/core/endpoint/theme/PublicUserEndpoint.java b/application/src/main/java/run/halo/app/core/endpoint/theme/PublicUserEndpoint.java
deleted file mode 100644
index 862aad3343..0000000000
--- a/application/src/main/java/run/halo/app/core/endpoint/theme/PublicUserEndpoint.java
+++ /dev/null
@@ -1,285 +0,0 @@
-package run.halo.app.core.endpoint.theme;
-
-import static io.swagger.v3.oas.annotations.media.Schema.RequiredMode.NOT_REQUIRED;
-import static io.swagger.v3.oas.annotations.media.Schema.RequiredMode.REQUIRED;
-import static org.springdoc.core.fn.builders.apiresponse.Builder.responseBuilder;
-import static org.springdoc.core.fn.builders.parameter.Builder.parameterBuilder;
-import static org.springdoc.core.fn.builders.requestbody.Builder.requestBodyBuilder;
-
-import io.github.resilience4j.ratelimiter.RateLimiterRegistry;
-import io.github.resilience4j.ratelimiter.RequestNotPermitted;
-import io.github.resilience4j.reactor.ratelimiter.operator.RateLimiterOperator;
-import io.swagger.v3.oas.annotations.enums.ParameterIn;
-import io.swagger.v3.oas.annotations.media.Schema;
-import lombok.RequiredArgsConstructor;
-import org.apache.commons.lang3.BooleanUtils;
-import org.apache.commons.lang3.StringUtils;
-import org.springdoc.webflux.core.fn.SpringdocRouteBuilder;
-import org.springframework.http.HttpStatus;
-import org.springframework.http.MediaType;
-import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
-import org.springframework.security.core.context.SecurityContextImpl;
-import org.springframework.security.core.userdetails.ReactiveUserDetailsService;
-import org.springframework.security.web.server.context.ServerSecurityContextRepository;
-import org.springframework.stereotype.Component;
-import org.springframework.web.reactive.function.server.RouterFunction;
-import org.springframework.web.reactive.function.server.ServerRequest;
-import org.springframework.web.reactive.function.server.ServerResponse;
-import org.springframework.web.server.ServerWebExchange;
-import org.springframework.web.server.ServerWebInputException;
-import reactor.core.publisher.Mono;
-import run.halo.app.core.extension.User;
-import run.halo.app.core.extension.endpoint.CustomEndpoint;
-import run.halo.app.core.user.service.EmailPasswordRecoveryService;
-import run.halo.app.core.user.service.EmailVerificationService;
-import run.halo.app.core.user.service.UserService;
-import run.halo.app.extension.GroupVersion;
-import run.halo.app.infra.SystemConfigurableEnvironmentFetcher;
-import run.halo.app.infra.SystemSetting;
-import run.halo.app.infra.ValidationUtils;
-import run.halo.app.infra.exception.AccessDeniedException;
-import run.halo.app.infra.exception.EmailVerificationFailed;
-import run.halo.app.infra.exception.RateLimitExceededException;
-import run.halo.app.infra.utils.IpAddressUtils;
-
-/**
- * User endpoint for unauthenticated user.
- *
- * @author guqing
- * @since 2.4.0
- */
-@Component
-@RequiredArgsConstructor
-public class PublicUserEndpoint implements CustomEndpoint {
-    private final UserService userService;
-    private final ServerSecurityContextRepository securityContextRepository;
-    private final ReactiveUserDetailsService reactiveUserDetailsService;
-    private final EmailPasswordRecoveryService emailPasswordRecoveryService;
-    private final RateLimiterRegistry rateLimiterRegistry;
-    private final SystemConfigurableEnvironmentFetcher environmentFetcher;
-    private final EmailVerificationService emailVerificationService;
-
-    @Override
-    public RouterFunction<ServerResponse> endpoint() {
-        var tag = "UserV1alpha1Public";
-        return SpringdocRouteBuilder.route()
-            .POST("/users/-/signup", this::signUp,
-                builder -> builder.operationId("SignUp")
-                    .description("Sign up a new user")
-                    .tag(tag)
-                    .requestBody(requestBodyBuilder().required(true)
-                        .implementation(SignUpRequest.class)
-                    )
-                    .response(responseBuilder().implementation(User.class))
-            )
-            .POST("/users/-/send-register-verify-email", this::sendRegisterVerifyEmail,
-                builder -> builder.operationId("SendRegisterVerifyEmail")
-                    .description(
-                        "Send registration verification email, which can be called when "
-                            + "mustVerifyEmailOnRegistration in user settings is true"
-                    )
-                    .tag(tag)
-                    .requestBody(requestBodyBuilder()
-                        .required(true)
-                        .implementation(RegisterVerifyEmailRequest.class)
-                    )
-                    .response(responseBuilder()
-                        .responseCode(HttpStatus.NO_CONTENT.toString())
-                        .implementation(Void.class)
-                    )
-            )
-            .POST("/users/-/send-password-reset-email", this::sendPasswordResetEmail,
-                builder -> builder.operationId("SendPasswordResetEmail")
-                    .description("Send password reset email when forgot password")
-                    .tag(tag)
-                    .requestBody(requestBodyBuilder()
-                        .required(true)
-                        .implementation(PasswordResetEmailRequest.class)
-                    )
-                    .response(responseBuilder()
-                        .responseCode(HttpStatus.NO_CONTENT.toString())
-                        .implementation(Void.class))
-            )
-            .PUT("/users/{name}/reset-password", this::resetPasswordByToken,
-                builder -> builder.operationId("ResetPasswordByToken")
-                    .description("Reset password by token")
-                    .tag(tag)
-                    .parameter(parameterBuilder()
-                        .name("name")
-                        .description("The name of the user")
-                        .required(true)
-                        .in(ParameterIn.PATH)
-                    )
-                    .requestBody(requestBodyBuilder()
-                        .required(true)
-                        .implementation(ResetPasswordRequest.class)
-                    )
-                    .response(responseBuilder()
-                        .responseCode(HttpStatus.NO_CONTENT.toString())
-                        .implementation(Void.class)
-                    )
-            )
-            .build();
-    }
-
-    private Mono<ServerResponse> resetPasswordByToken(ServerRequest request) {
-        var username = request.pathVariable("name");
-        return request.bodyToMono(ResetPasswordRequest.class)
-            .doOnNext(resetReq -> {
-                if (StringUtils.isBlank(resetReq.token())) {
-                    throw new ServerWebInputException("Token must not be blank");
-                }
-                if (StringUtils.isBlank(resetReq.newPassword())) {
-                    throw new ServerWebInputException("New password must not be blank");
-                }
-            })
-            .switchIfEmpty(
-                Mono.error(() -> new ServerWebInputException("Request body must not be empty"))
-            )
-            .flatMap(resetReq -> {
-                var token = resetReq.token();
-                var newPassword = resetReq.newPassword();
-                return emailPasswordRecoveryService.changePassword(username, newPassword, token);
-            })
-            .then(ServerResponse.noContent().build());
-    }
-
-    record PasswordResetEmailRequest(@Schema(requiredMode = REQUIRED) String username,
-                                     @Schema(requiredMode = REQUIRED) String email) {
-    }
-
-    record ResetPasswordRequest(@Schema(requiredMode = REQUIRED, minLength = 6) String newPassword,
-                                @Schema(requiredMode = REQUIRED) String token) {
-    }
-
-    record RegisterVerifyEmailRequest(@Schema(requiredMode = REQUIRED) String email) {
-    }
-
-    private Mono<ServerResponse> sendPasswordResetEmail(ServerRequest request) {
-        return request.bodyToMono(PasswordResetEmailRequest.class)
-            .flatMap(passwordResetRequest -> {
-                var username = passwordResetRequest.username();
-                var email = passwordResetRequest.email();
-                return Mono.just(passwordResetRequest)
-                    .transformDeferred(sendResetPasswordEmailRateLimiter(username, email))
-                    .flatMap(
-                        r -> emailPasswordRecoveryService.sendPasswordResetEmail(username, email))
-                    .onErrorMap(RequestNotPermitted.class, RateLimitExceededException::new);
-            })
-            .then(ServerResponse.noContent().build());
-    }
-
-    <T> RateLimiterOperator<T> sendResetPasswordEmailRateLimiter(String username, String email) {
-        String rateLimiterKey = "send-reset-password-email-" + username + ":" + email;
-        var rateLimiter =
-            rateLimiterRegistry.rateLimiter(rateLimiterKey, "send-reset-password-email");
-        return RateLimiterOperator.of(rateLimiter);
-    }
-
-    @Override
-    public GroupVersion groupVersion() {
-        return GroupVersion.parseAPIVersion("api.halo.run/v1alpha1");
-    }
-
-    private Mono<ServerResponse> signUp(ServerRequest request) {
-        return request.bodyToMono(SignUpRequest.class)
-            .doOnNext(signUpRequest -> signUpRequest.user().getSpec().setEmailVerified(false))
-            .flatMap(signUpRequest -> environmentFetcher.fetch(SystemSetting.User.GROUP,
-                    SystemSetting.User.class)
-                .map(user -> BooleanUtils.isTrue(user.getMustVerifyEmailOnRegistration()))
-                .defaultIfEmpty(false)
-                .flatMap(mustVerifyEmailOnRegistration -> {
-                    if (!mustVerifyEmailOnRegistration) {
-                        return Mono.just(signUpRequest);
-                    }
-                    if (!StringUtils.isNumeric(signUpRequest.verifyCode)) {
-                        return Mono.error(new EmailVerificationFailed());
-                    }
-                    return emailVerificationService.verifyRegisterVerificationCode(
-                            signUpRequest.user().getSpec().getEmail(),
-                            signUpRequest.verifyCode)
-                        .flatMap(verified -> {
-                            if (BooleanUtils.isNotTrue(verified)) {
-                                return Mono.error(new EmailVerificationFailed());
-                            }
-                            signUpRequest.user().getSpec().setEmailVerified(true);
-                            return Mono.just(signUpRequest);
-                        });
-                })
-            )
-            .flatMap(signUpRequest ->
-                userService.signUp(signUpRequest.user(), signUpRequest.password())
-            )
-            .flatMap(user -> authenticate(user.getMetadata().getName(), request.exchange())
-                .thenReturn(user)
-            )
-            .flatMap(user -> ServerResponse.ok()
-                .contentType(MediaType.APPLICATION_JSON)
-                .bodyValue(user)
-            )
-            .transformDeferred(getRateLimiterForSignUp(request.exchange()))
-            .onErrorMap(RequestNotPermitted.class, RateLimitExceededException::new);
-    }
-
-    private Mono<ServerResponse> sendRegisterVerifyEmail(ServerRequest request) {
-        return request.bodyToMono(RegisterVerifyEmailRequest.class)
-            .switchIfEmpty(Mono.error(
-                () -> new ServerWebInputException("Required request body is missing."))
-            )
-            .map(emailReq -> {
-                var email = emailReq.email();
-                if (!ValidationUtils.isValidEmail(email)) {
-                    throw new ServerWebInputException("Invalid email address.");
-                }
-                return email;
-            })
-            .flatMap(email -> environmentFetcher.fetch(SystemSetting.User.GROUP,
-                    SystemSetting.User.class)
-                .map(config -> BooleanUtils.isTrue(config.getMustVerifyEmailOnRegistration()))
-                .defaultIfEmpty(false)
-                .doOnNext(mustVerifyEmailOnRegistration -> {
-                    if (!mustVerifyEmailOnRegistration) {
-                        throw new AccessDeniedException("Email verification is not required.");
-                    }
-                })
-                .transformDeferred(sendRegisterEmailVerificationCodeRateLimiter(email))
-                .flatMap(s -> emailVerificationService.sendRegisterVerificationCode(email)
-                    .onErrorMap(RequestNotPermitted.class, RateLimitExceededException::new))
-                .onErrorMap(RequestNotPermitted.class, RateLimitExceededException::new)
-            )
-            .then(ServerResponse.ok().build());
-    }
-
-    private <T> RateLimiterOperator<T> getRateLimiterForSignUp(ServerWebExchange exchange) {
-        var clientIp = IpAddressUtils.getClientIp(exchange.getRequest());
-        var rateLimiter = rateLimiterRegistry.rateLimiter("signup-from-ip-" + clientIp,
-            "signup");
-        return RateLimiterOperator.of(rateLimiter);
-    }
-
-    private Mono<Void> authenticate(String username, ServerWebExchange exchange) {
-        return reactiveUserDetailsService.findByUsername(username)
-            .flatMap(userDetails -> {
-                SecurityContextImpl securityContext = new SecurityContextImpl();
-                UsernamePasswordAuthenticationToken authentication =
-                    new UsernamePasswordAuthenticationToken(userDetails.getUsername(),
-                        userDetails.getPassword(), userDetails.getAuthorities());
-                securityContext.setAuthentication(authentication);
-                return securityContextRepository.save(exchange, securityContext);
-            });
-    }
-
-    private <T> RateLimiterOperator<T> sendRegisterEmailVerificationCodeRateLimiter(String email) {
-        String rateLimiterKey = "send-register-verify-email:" + email;
-        var rateLimiter =
-            rateLimiterRegistry.rateLimiter(rateLimiterKey, "send-email-verification-code");
-        return RateLimiterOperator.of(rateLimiter);
-    }
-
-    record SignUpRequest(@Schema(requiredMode = REQUIRED) User user,
-                         @Schema(requiredMode = REQUIRED, minLength = 6) String password,
-                         @Schema(requiredMode = NOT_REQUIRED, minLength = 6, maxLength = 6)
-                         String verifyCode
-    ) {
-    }
-}
diff --git a/application/src/main/java/run/halo/app/core/user/service/EmailPasswordRecoveryService.java b/application/src/main/java/run/halo/app/core/user/service/EmailPasswordRecoveryService.java
index a586589f05..2770cec886 100644
--- a/application/src/main/java/run/halo/app/core/user/service/EmailPasswordRecoveryService.java
+++ b/application/src/main/java/run/halo/app/core/user/service/EmailPasswordRecoveryService.java
@@ -22,17 +22,21 @@ public interface EmailPasswordRecoveryService {
      */
     Mono<Void> sendPasswordResetEmail(String username, String email);
 
+    Mono<Void> sendPasswordResetEmail(String email);
+
     /**
      * <p>Reset password by token.</p>
      * if the token is invalid, it will return {@link Mono#error(Throwable)}}
      * if the token is valid, but the username is not the same, it will return
      * {@link Mono#error(Throwable)}
      *
-     * @param username username to reset password
      * @param newPassword new password
      * @param token token to validate the user
      * @return {@link Mono#empty()} if the token is invalid or the username is not the same.
      * @throws AccessDeniedException if the token is invalid
      */
-    Mono<Void> changePassword(String username, String newPassword, String token);
+    Mono<Void> changePassword(String newPassword, String token);
+
+    Mono<ResetToken> getValidResetToken(String token);
+
 }
diff --git a/application/src/main/java/run/halo/app/core/user/service/InMemoryResetTokenRepository.java b/application/src/main/java/run/halo/app/core/user/service/InMemoryResetTokenRepository.java
new file mode 100644
index 0000000000..1c8b3a2ac9
--- /dev/null
+++ b/application/src/main/java/run/halo/app/core/user/service/InMemoryResetTokenRepository.java
@@ -0,0 +1,54 @@
+package run.halo.app.core.user.service;
+
+import com.github.benmanes.caffeine.cache.Cache;
+import com.github.benmanes.caffeine.cache.Caffeine;
+import java.time.Duration;
+import java.util.Objects;
+import org.springframework.dao.DuplicateKeyException;
+import org.springframework.stereotype.Component;
+import reactor.core.publisher.Mono;
+
+/**
+ * In-memory reset token repository.
+ *
+ * @author johnniang
+ * @since 2.20.0
+ */
+@Component
+public class InMemoryResetTokenRepository implements ResetTokenRepository {
+
+    /**
+     * Key: Token Hash.
+     */
+    private final Cache<String, ResetToken> tokens;
+
+    public InMemoryResetTokenRepository() {
+        this.tokens = Caffeine.newBuilder()
+            .expireAfterWrite(Duration.ofDays(1))
+            .maximumSize(10000)
+            .build();
+    }
+
+    @Override
+    public Mono<Void> save(ResetToken resetToken) {
+        return Mono.defer(() -> {
+            var savedResetToken = tokens.get(resetToken.tokenHash(), k -> resetToken);
+            if (Objects.equals(savedResetToken, resetToken)) {
+                return Mono.empty();
+            }
+            // should never happen
+            return Mono.error(new DuplicateKeyException("Reset token already exists"));
+        });
+    }
+
+    @Override
+    public Mono<ResetToken> findByTokenHash(String tokenHash) {
+        return Mono.fromSupplier(() -> tokens.getIfPresent(tokenHash));
+    }
+
+    @Override
+    public Mono<Void> removeByTokenHash(String tokenHash) {
+        return Mono.fromRunnable(() -> tokens.invalidate(tokenHash));
+    }
+
+}
diff --git a/application/src/main/java/run/halo/app/core/user/service/InvalidResetTokenException.java b/application/src/main/java/run/halo/app/core/user/service/InvalidResetTokenException.java
new file mode 100644
index 0000000000..597c90af66
--- /dev/null
+++ b/application/src/main/java/run/halo/app/core/user/service/InvalidResetTokenException.java
@@ -0,0 +1,17 @@
+package run.halo.app.core.user.service;
+
+import org.springframework.web.server.ServerWebInputException;
+
+/**
+ * Invalid reset token exception.
+ *
+ * @author johnniang
+ * @since 2.20.0
+ */
+public class InvalidResetTokenException extends ServerWebInputException {
+
+    public InvalidResetTokenException() {
+        super("Invalid reset token");
+    }
+
+}
diff --git a/application/src/main/java/run/halo/app/core/user/service/ResetToken.java b/application/src/main/java/run/halo/app/core/user/service/ResetToken.java
new file mode 100644
index 0000000000..31a4161059
--- /dev/null
+++ b/application/src/main/java/run/halo/app/core/user/service/ResetToken.java
@@ -0,0 +1,15 @@
+package run.halo.app.core.user.service;
+
+import java.time.Instant;
+
+/**
+ * Reset token data.
+ *
+ * @param tokenHash The token hash
+ * @param username The username
+ * @param expiresAt The expires at
+ * @author johnniang
+ * @since 2.20.0
+ */
+public record ResetToken(String tokenHash, String username, Instant expiresAt) {
+}
diff --git a/application/src/main/java/run/halo/app/core/user/service/ResetTokenRepository.java b/application/src/main/java/run/halo/app/core/user/service/ResetTokenRepository.java
new file mode 100644
index 0000000000..0dcc67b3e6
--- /dev/null
+++ b/application/src/main/java/run/halo/app/core/user/service/ResetTokenRepository.java
@@ -0,0 +1,38 @@
+package run.halo.app.core.user.service;
+
+import reactor.core.publisher.Mono;
+
+/**
+ * Reset token repository.
+ *
+ * @author johnniang
+ * @since 2.20.0
+ */
+public interface ResetTokenRepository {
+
+    /**
+     * Save reset token.
+     *
+     * @param resetToken reset token
+     * @return empty mono if saved successfully.
+     * @throws org.springframework.dao.DuplicateKeyException if token already exists.
+     */
+    Mono<Void> save(ResetToken resetToken);
+
+    /**
+     * Find reset token by token hash.
+     *
+     * @param tokenHash token hash
+     * @return reset token if found, or empty mono.
+     */
+    Mono<ResetToken> findByTokenHash(String tokenHash);
+
+    /**
+     * Remove reset token by token hash.
+     *
+     * @param tokenHash token hash
+     * @return empty mono if removed successfully.
+     */
+    Mono<Void> removeByTokenHash(String tokenHash);
+
+}
diff --git a/application/src/main/java/run/halo/app/core/user/service/SignUpData.java b/application/src/main/java/run/halo/app/core/user/service/SignUpData.java
new file mode 100644
index 0000000000..d609fa0cc8
--- /dev/null
+++ b/application/src/main/java/run/halo/app/core/user/service/SignUpData.java
@@ -0,0 +1,57 @@
+package run.halo.app.core.user.service;
+
+import jakarta.validation.constraints.Email;
+import jakarta.validation.constraints.NotBlank;
+import java.util.Optional;
+import lombok.Data;
+import org.springframework.util.MultiValueMap;
+import org.springframework.util.StringUtils;
+
+/**
+ * Sign up data.
+ *
+ * @author johnniang
+ * @since 2.20.0
+ */
+@Data
+public class SignUpData {
+
+    @NotBlank
+    private String username;
+
+    @NotBlank
+    private String displayName;
+
+    @Email
+    private String email;
+
+    private String emailCode;
+
+    @NotBlank
+    private String password;
+
+    public static SignUpData of(MultiValueMap<String, String> formData) {
+        var form = new SignUpData();
+        Optional.ofNullable(formData.getFirst("username"))
+            .filter(StringUtils::hasText)
+            .ifPresent(form::setUsername);
+
+        Optional.ofNullable(formData.getFirst("displayName"))
+            .filter(StringUtils::hasText)
+            .ifPresent(form::setDisplayName);
+
+        Optional.ofNullable(formData.getFirst("email"))
+            .filter(StringUtils::hasText)
+            .ifPresent(form::setEmail);
+
+        Optional.ofNullable(formData.getFirst("password"))
+            .filter(StringUtils::hasText)
+            .ifPresent(form::setPassword);
+
+        Optional.ofNullable(formData.getFirst("emailCode"))
+            .filter(StringUtils::hasText)
+            .ifPresent(form::setEmailCode);
+
+        return form;
+    }
+}
diff --git a/application/src/main/java/run/halo/app/core/user/service/UserService.java b/application/src/main/java/run/halo/app/core/user/service/UserService.java
index 5a2b8135a7..58039c2f21 100644
--- a/application/src/main/java/run/halo/app/core/user/service/UserService.java
+++ b/application/src/main/java/run/halo/app/core/user/service/UserService.java
@@ -17,7 +17,7 @@ public interface UserService {
 
     Mono<User> grantRoles(String username, Set<String> roles);
 
-    Mono<User> signUp(User user, String password);
+    Mono<User> signUp(SignUpData signUpData);
 
     Mono<User> createUser(User user, Set<String> roles);
 
diff --git a/application/src/main/java/run/halo/app/core/user/service/UserServiceImpl.java b/application/src/main/java/run/halo/app/core/user/service/UserServiceImpl.java
index 9290b3ec48..982765cfb4 100644
--- a/application/src/main/java/run/halo/app/core/user/service/UserServiceImpl.java
+++ b/application/src/main/java/run/halo/app/core/user/service/UserServiceImpl.java
@@ -1,7 +1,6 @@
 package run.halo.app.core.user.service;
 
-import static org.springframework.data.domain.Sort.Order.asc;
-import static org.springframework.data.domain.Sort.Order.desc;
+import static run.halo.app.extension.ExtensionUtil.defaultSort;
 import static run.halo.app.extension.index.query.QueryFactory.equal;
 
 import java.time.Clock;
@@ -12,10 +11,8 @@
 import java.util.Optional;
 import java.util.Set;
 import lombok.RequiredArgsConstructor;
-import org.apache.commons.lang3.BooleanUtils;
 import org.springframework.context.ApplicationEventPublisher;
 import org.springframework.dao.OptimisticLockingFailureException;
-import org.springframework.data.domain.Sort;
 import org.springframework.security.crypto.password.PasswordEncoder;
 import org.springframework.stereotype.Service;
 import org.springframework.util.Assert;
@@ -30,18 +27,20 @@
 import run.halo.app.core.extension.User;
 import run.halo.app.event.user.PasswordChangedEvent;
 import run.halo.app.extension.ListOptions;
+import run.halo.app.extension.Metadata;
 import run.halo.app.extension.ReactiveExtensionClient;
 import run.halo.app.extension.exception.ExtensionNotFoundException;
 import run.halo.app.extension.router.selector.FieldSelector;
 import run.halo.app.infra.SystemConfigurableEnvironmentFetcher;
 import run.halo.app.infra.SystemSetting;
-import run.halo.app.infra.exception.AccessDeniedException;
 import run.halo.app.infra.exception.DuplicateNameException;
+import run.halo.app.infra.exception.EmailVerificationFailed;
 import run.halo.app.infra.exception.UserNotFoundException;
 
 @Service
 @RequiredArgsConstructor
 public class UserServiceImpl implements UserService {
+
     public static final String GHOST_USER_NAME = "ghost";
 
     private final ReactiveExtensionClient client;
@@ -54,6 +53,8 @@ public class UserServiceImpl implements UserService {
 
     private final RoleService roleService;
 
+    private final EmailVerificationService emailVerificationService;
+
     private Clock clock = Clock.systemUTC();
 
     void setClock(Clock clock) {
@@ -147,29 +148,49 @@ public Mono<User> grantRoles(String username, Set<String> roles) {
     }
 
     @Override
-    public Mono<User> signUp(User user, String password) {
-        if (!StringUtils.hasText(password)) {
-            throw new IllegalArgumentException("Password must not be blank");
-        }
+    public Mono<User> signUp(SignUpData signUpData) {
         return environmentFetcher.fetch(SystemSetting.User.GROUP, SystemSetting.User.class)
-            .switchIfEmpty(Mono.error(new IllegalStateException("User setting is not configured")))
-            .flatMap(userSetting -> {
-                Boolean allowRegistration = userSetting.getAllowRegistration();
-                if (BooleanUtils.isFalse(allowRegistration)) {
-                    return Mono.error(new AccessDeniedException("Registration is not allowed",
-                        "problemDetail.user.signUpFailed.disallowed",
-                        null));
-                }
-                String defaultRole = userSetting.getDefaultRole();
-                if (!StringUtils.hasText(defaultRole)) {
-                    return Mono.error(new AccessDeniedException(
-                        "Default registration role is not configured by admin",
-                        "problemDetail.user.signUpFailed.disallowed",
-                        null));
+            .filter(SystemSetting.User::isAllowRegistration)
+            .switchIfEmpty(Mono.error(() -> new ServerWebInputException(
+                "The registration is not allowed by the administrator."
+            )))
+            .filter(setting -> StringUtils.hasText(setting.getDefaultRole()))
+            .switchIfEmpty(Mono.error(() -> new ServerWebInputException(
+                "The default role is not configured by the administrator."
+            )))
+            .flatMap(setting -> {
+                var user = new User();
+                user.setMetadata(new Metadata());
+                var metadata = user.getMetadata();
+                metadata.setName(signUpData.getUsername());
+                user.setSpec(new User.UserSpec());
+                var spec = user.getSpec();
+                spec.setPassword(passwordEncoder.encode(signUpData.getPassword()));
+                spec.setEmailVerified(false);
+                spec.setRegisteredAt(clock.instant());
+                spec.setEmail(signUpData.getEmail());
+                spec.setDisplayName(signUpData.getDisplayName());
+                Mono<Void> verifyEmail = Mono.empty();
+                if (setting.isMustVerifyEmailOnRegistration()) {
+                    if (!StringUtils.hasText(signUpData.getEmailCode())) {
+                        return Mono.error(
+                            new EmailVerificationFailed("Email captcha is required", null)
+                        );
+                    }
+                    verifyEmail = emailVerificationService.verifyRegisterVerificationCode(
+                            signUpData.getEmail(), signUpData.getEmailCode()
+                        )
+                        .filter(Boolean::booleanValue)
+                        .switchIfEmpty(Mono.error(() ->
+                            new EmailVerificationFailed("Invalid email captcha.", null)
+                        ))
+                        .doOnNext(spec::setEmailVerified)
+                        .then();
                 }
-                String encodedPassword = passwordEncoder.encode(password);
-                user.getSpec().setPassword(encodedPassword);
-                return createUser(user, Set.of(defaultRole));
+                return verifyEmail.then(Mono.defer(() -> {
+                    var defaultRole = setting.getDefaultRole();
+                    return createUser(user, Set.of(defaultRole));
+                }));
             });
     }
 
@@ -225,9 +246,7 @@ public Mono<Boolean> confirmPassword(String username, String rawPassword) {
     public Flux<User> listByEmail(String email) {
         var listOptions = new ListOptions();
         listOptions.setFieldSelector(FieldSelector.of(equal("spec.email", email)));
-        return client.listAll(User.class, listOptions, Sort.by(desc("metadata.creationTimestamp"),
-            asc("metadata.name"))
-        );
+        return client.listAll(User.class, listOptions, defaultSort());
     }
 
     @Override
diff --git a/application/src/main/java/run/halo/app/core/user/service/impl/EmailPasswordRecoveryServiceImpl.java b/application/src/main/java/run/halo/app/core/user/service/impl/EmailPasswordRecoveryServiceImpl.java
index ac66225ee6..290acb0850 100644
--- a/application/src/main/java/run/halo/app/core/user/service/impl/EmailPasswordRecoveryServiceImpl.java
+++ b/application/src/main/java/run/halo/app/core/user/service/impl/EmailPasswordRecoveryServiceImpl.java
@@ -1,30 +1,28 @@
 package run.halo.app.core.user.service.impl;
 
-import com.google.common.cache.Cache;
-import com.google.common.cache.CacheBuilder;
+import java.time.Clock;
 import java.time.Duration;
-import java.util.concurrent.TimeUnit;
-import java.util.concurrent.atomic.AtomicInteger;
-import lombok.Data;
 import lombok.RequiredArgsConstructor;
-import lombok.experimental.Accessors;
 import org.apache.commons.lang3.RandomStringUtils;
 import org.apache.commons.lang3.StringUtils;
 import org.springframework.dao.OptimisticLockingFailureException;
+import org.springframework.security.core.token.Sha512DigestUtils;
 import org.springframework.stereotype.Component;
 import org.springframework.util.Assert;
+import org.springframework.web.util.UriComponentsBuilder;
 import reactor.core.publisher.Mono;
 import reactor.util.retry.Retry;
 import run.halo.app.core.extension.User;
 import run.halo.app.core.extension.notification.Reason;
 import run.halo.app.core.extension.notification.Subscription;
 import run.halo.app.core.user.service.EmailPasswordRecoveryService;
+import run.halo.app.core.user.service.InvalidResetTokenException;
+import run.halo.app.core.user.service.ResetToken;
+import run.halo.app.core.user.service.ResetTokenRepository;
 import run.halo.app.core.user.service.UserService;
 import run.halo.app.extension.GroupVersion;
 import run.halo.app.extension.ReactiveExtensionClient;
 import run.halo.app.infra.ExternalLinkProcessor;
-import run.halo.app.infra.exception.AccessDeniedException;
-import run.halo.app.infra.exception.RateLimitExceededException;
 import run.halo.app.notification.NotificationCenter;
 import run.halo.app.notification.NotificationReasonEmitter;
 import run.halo.app.notification.UserIdentity;
@@ -38,17 +36,21 @@
 @Component
 @RequiredArgsConstructor
 public class EmailPasswordRecoveryServiceImpl implements EmailPasswordRecoveryService {
+
     public static final int MAX_ATTEMPTS = 5;
     public static final long LINK_EXPIRATION_MINUTES = 30;
+    private static final Duration RESET_TOKEN_LIFE_TIME =
+        Duration.ofMinutes(LINK_EXPIRATION_MINUTES);
     static final String RESET_PASSWORD_BY_EMAIL_REASON_TYPE = "reset-password-by-email";
 
-    private final ResetPasswordVerificationManager resetPasswordVerificationManager =
-        new ResetPasswordVerificationManager();
     private final ExternalLinkProcessor externalLinkProcessor;
     private final ReactiveExtensionClient client;
     private final NotificationReasonEmitter reasonEmitter;
     private final NotificationCenter notificationCenter;
     private final UserService userService;
+    private final ResetTokenRepository resetTokenRepository;
+
+    private Clock clock = Clock.systemDefaultZone();
 
     @Override
     public Mono<Void> sendPasswordResetEmail(String username, String email) {
@@ -66,22 +68,35 @@ public Mono<Void> sendPasswordResetEmail(String username, String email) {
     }
 
     @Override
-    public Mono<Void> changePassword(String username, String newPassword, String token) {
-        Assert.state(StringUtils.isNotBlank(username), "Username must not be blank");
+    public Mono<Void> sendPasswordResetEmail(String email) {
+        if (StringUtils.isBlank(email)) {
+            return Mono.empty();
+        }
+        return userService.listByEmail(email)
+            .filter(user -> user.getSpec().isEmailVerified())
+            .next()
+            .flatMap(user -> sendResetPasswordNotification(user.getMetadata().getName(), email));
+    }
+
+    @Override
+    public Mono<Void> changePassword(String newPassword, String token) {
         Assert.state(StringUtils.isNotBlank(newPassword), "NewPassword must not be blank");
         Assert.state(StringUtils.isNotBlank(token), "Token for reset password must not be blank");
-        var verified = resetPasswordVerificationManager.verifyToken(username, token);
-        if (!verified) {
-            return Mono.error(AccessDeniedException::new);
-        }
-        return userService.updateWithRawPassword(username, newPassword)
-            .retryWhen(Retry.backoff(8, Duration.ofMillis(100))
-                .filter(OptimisticLockingFailureException.class::isInstance))
-            .flatMap(user -> {
-                resetPasswordVerificationManager.removeToken(username);
-                return unSubscribeResetPasswordEmailNotification(user.getSpec().getEmail());
-            })
-            .then();
+        var tokenHash = hashToken(token);
+        return getValidResetToken(token).flatMap(resetToken ->
+            userService.updateWithRawPassword(resetToken.username(), newPassword)
+                .flatMap(user -> unSubscribeResetPasswordEmailNotification(
+                    user.getSpec().getEmail())
+                )
+                .then(resetTokenRepository.removeByTokenHash(tokenHash))
+        );
+    }
+
+    @Override
+    public Mono<ResetToken> getValidResetToken(String token) {
+        return resetTokenRepository.findByTokenHash(hashToken(token))
+            .filter(resetToken -> clock.instant().isBefore(resetToken.expiresAt()))
+            .switchIfEmpty(Mono.error(InvalidResetTokenException::new));
     }
 
     Mono<Void> unSubscribeResetPasswordEmailNotification(String email) {
@@ -95,26 +110,33 @@ Mono<Void> unSubscribeResetPasswordEmailNotification(String email) {
                 .filter(OptimisticLockingFailureException.class::isInstance));
     }
 
-    Mono<Void> sendResetPasswordNotification(String username, String email) {
-        var token = resetPasswordVerificationManager.generateToken(username);
-        var link = getResetPasswordLink(username, token);
-
-        var subscribeNotification = autoSubscribeResetPasswordEmailNotification(email);
-        var interestReasonSubject = createInterestReason(email).getSubject();
-        var emitReasonMono = reasonEmitter.emit(RESET_PASSWORD_BY_EMAIL_REASON_TYPE,
-            builder -> builder.attribute("expirationAtMinutes", LINK_EXPIRATION_MINUTES)
-                .attribute("username", username)
-                .attribute("link", link)
-                .author(UserIdentity.of(username))
-                .subject(Reason.Subject.builder()
-                    .apiVersion(interestReasonSubject.getApiVersion())
-                    .kind(interestReasonSubject.getKind())
-                    .name(interestReasonSubject.getName())
-                    .title("使用邮箱地址重置密码：" + email)
-                    .build()
-                )
-        );
-        return Mono.when(subscribeNotification).then(emitReasonMono);
+    private Mono<Void> sendResetPasswordNotification(String username, String email) {
+        var token = generateToken();
+        var tokenHash = hashToken(token);
+        var expiresAt = clock.instant().plus(RESET_TOKEN_LIFE_TIME);
+        var uri = UriComponentsBuilder.fromUriString("/")
+            .pathSegment("password-reset", token)
+            .build(true)
+            .toUri();
+        var resetToken = new ResetToken(tokenHash, username, expiresAt);
+        return resetTokenRepository.save(resetToken)
+            .then(externalLinkProcessor.processLink(uri).flatMap(link -> {
+                var interestReasonSubject = createInterestReason(email).getSubject();
+                var emitReasonMono = reasonEmitter.emit(RESET_PASSWORD_BY_EMAIL_REASON_TYPE,
+                    builder -> builder.attribute("expirationAtMinutes", LINK_EXPIRATION_MINUTES)
+                        .attribute("username", username)
+                        .attribute("link", link)
+                        .author(UserIdentity.of(username))
+                        .subject(Reason.Subject.builder()
+                            .apiVersion(interestReasonSubject.getApiVersion())
+                            .kind(interestReasonSubject.getKind())
+                            .name(interestReasonSubject.getName())
+                            .title("使用邮箱地址重置密码：" + email)
+                            .build()
+                        )
+                );
+                return autoSubscribeResetPasswordEmailNotification(email).then(emitReasonMono);
+            }));
     }
 
     Mono<Void> autoSubscribeResetPasswordEmailNotification(String email) {
@@ -136,73 +158,12 @@ Subscription.InterestReason createInterestReason(String email) {
         return interestReason;
     }
 
-    private String getResetPasswordLink(String username, String token) {
-        return externalLinkProcessor.processLink(
-            "/uc/reset-password/" + username + "?reset_password_token=" + token);
+    private static String hashToken(String token) {
+        return Sha512DigestUtils.shaHex(token);
     }
 
-    static class ResetPasswordVerificationManager {
-        private final Cache<String, Verification> userTokenCache =
-            CacheBuilder.newBuilder()
-                .expireAfterWrite(LINK_EXPIRATION_MINUTES, TimeUnit.MINUTES)
-                .maximumSize(10000)
-                .build();
-
-        private final Cache<String, Boolean>
-            blackListCache = CacheBuilder.newBuilder()
-            .expireAfterWrite(Duration.ofHours(2))
-            .maximumSize(1000)
-            .build();
-
-        public boolean verifyToken(String username, String token) {
-            var verification = userTokenCache.getIfPresent(username);
-            if (verification == null) {
-                // expired or not generated
-                return false;
-            }
-            if (blackListCache.getIfPresent(username) != null) {
-                // in blacklist
-                throw new RateLimitExceededException(null);
-            }
-            synchronized (verification) {
-                if (verification.getAttempts().get() >= MAX_ATTEMPTS) {
-                    // add to blacklist to prevent brute force attack
-                    blackListCache.put(username, true);
-                    return false;
-                }
-                if (!verification.getToken().equals(token)) {
-                    verification.getAttempts().incrementAndGet();
-                    return false;
-                }
-            }
-            return true;
-        }
-
-        public void removeToken(String username) {
-            userTokenCache.invalidate(username);
-        }
-
-        public String generateToken(String username) {
-            Assert.state(StringUtils.isNotBlank(username), "Username must not be blank");
-            var verification = new Verification();
-            verification.setToken(RandomStringUtils.randomAlphanumeric(20));
-            verification.setAttempts(new AtomicInteger(0));
-            userTokenCache.put(username, verification);
-            return verification.getToken();
-        }
-
-        /**
-         * Only for test.
-         */
-        boolean contains(String username) {
-            return userTokenCache.getIfPresent(username) != null;
-        }
-
-        @Data
-        @Accessors(chain = true)
-        static class Verification {
-            private String token;
-            private AtomicInteger attempts;
-        }
+    private static String generateToken() {
+        return RandomStringUtils.secure().nextAlphanumeric(64);
     }
+
 }
diff --git a/application/src/main/java/run/halo/app/core/user/service/impl/EmailVerificationServiceImpl.java b/application/src/main/java/run/halo/app/core/user/service/impl/EmailVerificationServiceImpl.java
index b362a96c81..01dfeff7cd 100644
--- a/application/src/main/java/run/halo/app/core/user/service/impl/EmailVerificationServiceImpl.java
+++ b/application/src/main/java/run/halo/app/core/user/service/impl/EmailVerificationServiceImpl.java
@@ -15,15 +15,18 @@
 import org.springframework.util.Assert;
 import org.springframework.web.server.ServerWebInputException;
 import reactor.core.publisher.Mono;
+import reactor.core.scheduler.Schedulers;
 import reactor.util.retry.Retry;
 import run.halo.app.core.extension.User;
 import run.halo.app.core.extension.notification.Reason;
 import run.halo.app.core.extension.notification.Subscription;
 import run.halo.app.core.user.service.EmailVerificationService;
-import run.halo.app.core.user.service.UserService;
+import run.halo.app.extension.ExtensionUtil;
 import run.halo.app.extension.GroupVersion;
+import run.halo.app.extension.ListOptions;
 import run.halo.app.extension.MetadataUtil;
 import run.halo.app.extension.ReactiveExtensionClient;
+import run.halo.app.extension.index.query.QueryFactory;
 import run.halo.app.infra.exception.EmailVerificationFailed;
 import run.halo.app.notification.NotificationCenter;
 import run.halo.app.notification.NotificationReasonEmitter;
@@ -47,7 +50,6 @@ public class EmailVerificationServiceImpl implements EmailVerificationService {
     private final ReactiveExtensionClient client;
     private final NotificationReasonEmitter reasonEmitter;
     private final NotificationCenter notificationCenter;
-    private final UserService userService;
 
     @Override
     public Mono<Void> sendVerificationCode(String username, String email) {
@@ -121,7 +123,10 @@ private Mono<Void> verifyUserEmail(User user, String code) {
     }
 
     Mono<Boolean> isEmailInUse(String username, String emailToVerify) {
-        return userService.listByEmail(emailToVerify)
+        var listOptions = ListOptions.builder()
+            .andQuery(QueryFactory.equal("spec.email", emailToVerify))
+            .build();
+        return client.listAll(User.class, listOptions, ExtensionUtil.defaultSort())
             .filter(user -> user.getSpec().isEmailVerified())
             .filter(user -> !user.getMetadata().getName().equals(username))
             .hasElements();
@@ -137,7 +142,9 @@ public Mono<Void> sendRegisterVerificationCode(String email) {
     public Mono<Boolean> verifyRegisterVerificationCode(String email, String code) {
         Assert.state(StringUtils.isNotBlank(email), "Username must not be blank");
         Assert.state(StringUtils.isNotBlank(code), "Code must not be blank");
-        return Mono.just(emailVerificationManager.verifyCode(email, email, code));
+        return Mono.fromSupplier(() -> emailVerificationManager.verifyCode(email, email, code))
+            // Why use boundedElastic? Because the verification uses synchronized block.
+            .subscribeOn(Schedulers.boundedElastic());
     }
 
     Mono<Void> sendVerificationNotification(String username, String email) {
diff --git a/application/src/main/java/run/halo/app/extension/JSONExtensionConverter.java b/application/src/main/java/run/halo/app/extension/JSONExtensionConverter.java
index 8aa2304357..67238b9827 100644
--- a/application/src/main/java/run/halo/app/extension/JSONExtensionConverter.java
+++ b/application/src/main/java/run/halo/app/extension/JSONExtensionConverter.java
@@ -3,14 +3,15 @@
 import static org.openapi4j.core.validation.ValidationSeverity.ERROR;
 import static org.springframework.util.StringUtils.arrayToCommaDelimitedString;
 import static run.halo.app.extension.ExtensionStoreUtil.buildStoreName;
+import static run.halo.app.extension.Unstructured.OBJECT_MAPPER;
 
 import com.fasterxml.jackson.databind.JsonNode;
 import com.fasterxml.jackson.databind.ObjectMapper;
-import io.swagger.v3.core.util.Json;
 import java.io.IOException;
 import java.net.MalformedURLException;
 import java.net.URL;
 import java.util.Optional;
+import lombok.Getter;
 import lombok.extern.slf4j.Slf4j;
 import org.openapi4j.core.exception.ResolutionException;
 import org.openapi4j.core.model.v3.OAI3;
@@ -36,17 +37,14 @@
 @Component
 public class JSONExtensionConverter implements ExtensionConverter {
 
+    @Getter
     public final ObjectMapper objectMapper;
 
     private final SchemeManager schemeManager;
 
     public JSONExtensionConverter(SchemeManager schemeManager) {
         this.schemeManager = schemeManager;
-        this.objectMapper = Json.mapper();
-    }
-
-    public ObjectMapper getObjectMapper() {
-        return objectMapper;
+        this.objectMapper = OBJECT_MAPPER;
     }
 
     @Override
diff --git a/application/src/main/java/run/halo/app/infra/DefaultExternalLinkProcessor.java b/application/src/main/java/run/halo/app/infra/DefaultExternalLinkProcessor.java
index 50f7bc7d0e..c1c0bd963b 100644
--- a/application/src/main/java/run/halo/app/infra/DefaultExternalLinkProcessor.java
+++ b/application/src/main/java/run/halo/app/infra/DefaultExternalLinkProcessor.java
@@ -1,8 +1,14 @@
 package run.halo.app.infra;
 
+import java.net.URI;
+import java.net.URISyntaxException;
+import java.util.Optional;
 import lombok.RequiredArgsConstructor;
 import org.apache.commons.lang3.StringUtils;
 import org.springframework.stereotype.Component;
+import org.springframework.web.filter.reactive.ServerWebExchangeContextFilter;
+import org.springframework.web.util.UriComponentsBuilder;
+import reactor.core.publisher.Mono;
 import run.halo.app.infra.utils.PathUtils;
 
 /**
@@ -25,6 +31,34 @@ public String processLink(String link) {
         return append(externalLink.toString(), link);
     }
 
+    @Override
+    public Mono<URI> processLink(URI uri) {
+        if (uri.isAbsolute()) {
+            return Mono.just(uri);
+        }
+        return Mono.deferContextual(contextView -> Mono.fromSupplier(
+            () -> ServerWebExchangeContextFilter.getExchange(contextView)
+                .map(exchange -> externalUrlSupplier.getURL(exchange.getRequest()))
+                .or(() -> Optional.ofNullable(externalUrlSupplier.getRaw()))
+                .map(externalUrl -> {
+                    try {
+                        var uriComponents = UriComponentsBuilder.fromUriString(uri.toASCIIString())
+                            .build(true);
+                        return UriComponentsBuilder.fromUri(externalUrl.toURI())
+                            .pathSegment(uriComponents.getPathSegments().toArray(new String[0]))
+                            .queryParams(uriComponents.getQueryParams())
+                            .fragment(uriComponents.getFragment())
+                            .build(true)
+                            .toUri();
+                    } catch (URISyntaxException e) {
+                        // should never happen
+                        return uri;
+                    }
+                })
+                .orElse(uri)
+        ));
+    }
+
     String append(String externalLink, String link) {
         return StringUtils.removeEnd(externalLink, "/")
             + StringUtils.prependIfMissing(link, "/");
diff --git a/application/src/main/java/run/halo/app/infra/actuator/GlobalInfo.java b/application/src/main/java/run/halo/app/infra/actuator/GlobalInfo.java
new file mode 100644
index 0000000000..30c5c36feb
--- /dev/null
+++ b/application/src/main/java/run/halo/app/infra/actuator/GlobalInfo.java
@@ -0,0 +1,62 @@
+package run.halo.app.infra.actuator;
+
+import java.net.URL;
+import java.util.List;
+import java.util.Locale;
+import java.util.TimeZone;
+import lombok.Data;
+
+/**
+ * Global info.
+ *
+ * @author johnniang
+ * @since 2.20.0
+ */
+@Data
+public class GlobalInfo {
+
+    private URL externalUrl;
+
+    private boolean useAbsolutePermalink;
+
+    private TimeZone timeZone;
+
+    private Locale locale;
+
+    private boolean allowComments;
+
+    private boolean allowAnonymousComments;
+
+    private boolean allowRegistration;
+
+    private String favicon;
+
+    private boolean userInitialized;
+
+    private boolean dataInitialized;
+
+    private String postSlugGenerationStrategy;
+
+    private List<SocialAuthProvider> socialAuthProviders;
+
+    private Boolean mustVerifyEmailOnRegistration;
+
+    private String siteTitle;
+
+    @Data
+    public static class SocialAuthProvider {
+        private String name;
+
+        private String displayName;
+
+        private String description;
+
+        private String logo;
+
+        private String website;
+
+        private String authenticationUrl;
+
+        private String bindingUrl;
+    }
+}
diff --git a/application/src/main/java/run/halo/app/infra/actuator/GlobalInfoEndpoint.java b/application/src/main/java/run/halo/app/infra/actuator/GlobalInfoEndpoint.java
index 9d53a2d525..dec60c0cc6 100644
--- a/application/src/main/java/run/halo/app/infra/actuator/GlobalInfoEndpoint.java
+++ b/application/src/main/java/run/halo/app/infra/actuator/GlobalInfoEndpoint.java
@@ -1,171 +1,26 @@
 package run.halo.app.infra.actuator;
 
-import static org.apache.commons.lang3.BooleanUtils.isTrue;
-
-import java.net.URL;
-import java.util.List;
-import java.util.Locale;
-import java.util.TimeZone;
-import lombok.Data;
-import lombok.RequiredArgsConstructor;
-import org.apache.commons.lang3.StringUtils;
-import org.springframework.beans.factory.ObjectProvider;
+import java.time.Duration;
 import org.springframework.boot.actuate.endpoint.annotation.ReadOperation;
 import org.springframework.boot.actuate.endpoint.web.annotation.WebEndpoint;
 import org.springframework.stereotype.Component;
-import run.halo.app.extension.ConfigMap;
-import run.halo.app.infra.InitializationStateGetter;
-import run.halo.app.infra.SystemConfigurableEnvironmentFetcher;
-import run.halo.app.infra.SystemSetting;
-import run.halo.app.infra.SystemSetting.Basic;
-import run.halo.app.infra.SystemSetting.Comment;
-import run.halo.app.infra.SystemSetting.User;
-import run.halo.app.infra.properties.HaloProperties;
-import run.halo.app.security.AuthProviderService;
 
+/**
+ * Global info endpoint.
+ */
 @WebEndpoint(id = "globalinfo")
 @Component
-@RequiredArgsConstructor
 public class GlobalInfoEndpoint {
 
-    private final ObjectProvider<SystemConfigurableEnvironmentFetcher> systemConfigFetcher;
-
-    private final HaloProperties haloProperties;
-
-    private final AuthProviderService authProviderService;
+    private final GlobalInfoService globalInfoService;
 
-    private final InitializationStateGetter initializationStateGetter;
+    public GlobalInfoEndpoint(GlobalInfoService globalInfoService) {
+        this.globalInfoService = globalInfoService;
+    }
 
     @ReadOperation
     public GlobalInfo globalInfo() {
-        final var info = new GlobalInfo();
-        info.setExternalUrl(haloProperties.getExternalUrl());
-        info.setUseAbsolutePermalink(haloProperties.isUseAbsolutePermalink());
-        info.setLocale(Locale.getDefault());
-        info.setTimeZone(TimeZone.getDefault());
-        info.setUserInitialized(initializationStateGetter.userInitialized()
-            .blockOptional().orElse(false));
-        info.setDataInitialized(initializationStateGetter.dataInitialized()
-            .blockOptional().orElse(false));
-        handleSocialAuthProvider(info);
-        systemConfigFetcher.ifAvailable(fetcher -> fetcher.getConfigMapBlocking()
-            .ifPresent(configMap -> {
-                handleCommentSetting(info, configMap);
-                handleUserSetting(info, configMap);
-                handleBasicSetting(info, configMap);
-                handlePostSlugGenerationStrategy(info, configMap);
-            }));
-        return info;
-    }
-
-    @Data
-    public static class GlobalInfo {
-        private URL externalUrl;
-
-        private boolean useAbsolutePermalink;
-
-        private TimeZone timeZone;
-
-        private Locale locale;
-
-        private boolean allowComments;
-
-        private boolean allowAnonymousComments;
-
-        private boolean allowRegistration;
-
-        private String favicon;
-
-        private boolean userInitialized;
-
-        private boolean dataInitialized;
-
-        private String postSlugGenerationStrategy;
-
-        private List<SocialAuthProvider> socialAuthProviders;
-
-        private Boolean mustVerifyEmailOnRegistration;
-
-        private String siteTitle;
-    }
-
-    @Data
-    public static class SocialAuthProvider {
-        private String name;
-
-        private String displayName;
-
-        private String description;
-
-        private String logo;
-
-        private String website;
-
-        private String authenticationUrl;
-
-        private String bindingUrl;
-    }
-
-    private void handleCommentSetting(GlobalInfo info, ConfigMap configMap) {
-        var comment = SystemSetting.get(configMap, Comment.GROUP, Comment.class);
-        if (comment == null) {
-            info.setAllowComments(true);
-            info.setAllowAnonymousComments(true);
-        } else {
-            info.setAllowComments(comment.getEnable() != null && comment.getEnable());
-            info.setAllowAnonymousComments(
-                comment.getSystemUserOnly() == null || !comment.getSystemUserOnly());
-        }
-    }
-
-    private void handleUserSetting(GlobalInfo info, ConfigMap configMap) {
-        var userSetting = SystemSetting.get(configMap, User.GROUP, User.class);
-        if (userSetting == null) {
-            info.setAllowRegistration(false);
-            info.setMustVerifyEmailOnRegistration(false);
-        } else {
-            info.setAllowRegistration(
-                userSetting.getAllowRegistration() != null && userSetting.getAllowRegistration());
-            info.setMustVerifyEmailOnRegistration(userSetting.getMustVerifyEmailOnRegistration());
-        }
-    }
-
-    private void handlePostSlugGenerationStrategy(GlobalInfo info, ConfigMap configMap) {
-        var post = SystemSetting.get(configMap, SystemSetting.Post.GROUP, SystemSetting.Post.class);
-        if (post != null) {
-            info.setPostSlugGenerationStrategy(post.getSlugGenerationStrategy());
-        }
-    }
-
-    private void handleBasicSetting(GlobalInfo info, ConfigMap configMap) {
-        var basic = SystemSetting.get(configMap, Basic.GROUP, Basic.class);
-        if (basic != null) {
-            info.setFavicon(basic.getFavicon());
-            info.setSiteTitle(basic.getTitle());
-        }
-    }
-
-    private void handleSocialAuthProvider(GlobalInfo info) {
-        List<SocialAuthProvider> providers = authProviderService.listAll()
-            .map(listedAuthProviders -> listedAuthProviders.stream()
-                .filter(provider -> isTrue(provider.getEnabled()))
-                .filter(provider -> StringUtils.isNotBlank(provider.getBindingUrl()))
-                .map(provider -> {
-                    SocialAuthProvider socialAuthProvider = new SocialAuthProvider();
-                    socialAuthProvider.setName(provider.getName());
-                    socialAuthProvider.setDisplayName(provider.getDisplayName());
-                    socialAuthProvider.setDescription(provider.getDescription());
-                    socialAuthProvider.setLogo(provider.getLogo());
-                    socialAuthProvider.setWebsite(provider.getWebsite());
-                    socialAuthProvider.setAuthenticationUrl(provider.getAuthenticationUrl());
-                    socialAuthProvider.setBindingUrl(provider.getBindingUrl());
-                    return socialAuthProvider;
-                })
-                .toList()
-            )
-            .block();
-
-        info.setSocialAuthProviders(providers);
+        return globalInfoService.getGlobalInfo().block(Duration.ofMinutes(1));
     }
 
 }
diff --git a/application/src/main/java/run/halo/app/infra/actuator/GlobalInfoService.java b/application/src/main/java/run/halo/app/infra/actuator/GlobalInfoService.java
new file mode 100644
index 0000000000..7f5ef15d1a
--- /dev/null
+++ b/application/src/main/java/run/halo/app/infra/actuator/GlobalInfoService.java
@@ -0,0 +1,20 @@
+package run.halo.app.infra.actuator;
+
+import reactor.core.publisher.Mono;
+
+/**
+ * Global info service.
+ *
+ * @author johnniang
+ * @since 2.20.0
+ */
+public interface GlobalInfoService {
+
+    /**
+     * Get global info.
+     *
+     * @return global info
+     */
+    Mono<GlobalInfo> getGlobalInfo();
+
+}
diff --git a/application/src/main/java/run/halo/app/infra/actuator/GlobalInfoServiceImpl.java b/application/src/main/java/run/halo/app/infra/actuator/GlobalInfoServiceImpl.java
new file mode 100644
index 0000000000..f671f0c975
--- /dev/null
+++ b/application/src/main/java/run/halo/app/infra/actuator/GlobalInfoServiceImpl.java
@@ -0,0 +1,147 @@
+package run.halo.app.infra.actuator;
+
+import static org.apache.commons.lang3.BooleanUtils.isTrue;
+
+import java.util.ArrayList;
+import java.util.Locale;
+import java.util.Optional;
+import java.util.TimeZone;
+import org.apache.commons.lang3.StringUtils;
+import org.reactivestreams.Publisher;
+import org.springframework.beans.factory.ObjectProvider;
+import org.springframework.stereotype.Service;
+import reactor.core.publisher.Mono;
+import run.halo.app.extension.ConfigMap;
+import run.halo.app.infra.InitializationStateGetter;
+import run.halo.app.infra.SystemConfigurableEnvironmentFetcher;
+import run.halo.app.infra.SystemSetting;
+import run.halo.app.infra.properties.HaloProperties;
+import run.halo.app.security.AuthProviderService;
+
+/**
+ * Global info service implementation.
+ *
+ * @author johnniang
+ * @since 2.20.0
+ */
+@Service
+public class GlobalInfoServiceImpl implements GlobalInfoService {
+
+    private final HaloProperties haloProperties;
+
+    private final AuthProviderService authProviderService;
+
+    private final InitializationStateGetter initializationStateGetter;
+
+    private final ObjectProvider<SystemConfigurableEnvironmentFetcher>
+        systemConfigFetcher;
+
+    public GlobalInfoServiceImpl(HaloProperties haloProperties,
+        AuthProviderService authProviderService,
+        InitializationStateGetter initializationStateGetter,
+        ObjectProvider<SystemConfigurableEnvironmentFetcher> systemConfigFetcher) {
+        this.haloProperties = haloProperties;
+        this.authProviderService = authProviderService;
+        this.initializationStateGetter = initializationStateGetter;
+        this.systemConfigFetcher = systemConfigFetcher;
+    }
+
+    @Override
+    public Mono<GlobalInfo> getGlobalInfo() {
+        final var info = new GlobalInfo();
+        info.setExternalUrl(haloProperties.getExternalUrl());
+        info.setUseAbsolutePermalink(haloProperties.isUseAbsolutePermalink());
+        info.setLocale(Locale.getDefault());
+        info.setTimeZone(TimeZone.getDefault());
+
+        var publishers = new ArrayList<Publisher<?>>(4);
+        publishers.add(
+            initializationStateGetter.userInitialized().doOnNext(info::setUserInitialized)
+        );
+        publishers.add(
+            initializationStateGetter.dataInitialized().doOnNext(info::setDataInitialized)
+        );
+        publishers.add(handleSocialAuthProvider(info));
+        publishers.add(handleSettings(info));
+        return Mono.when(publishers).then(Mono.just(info));
+    }
+
+    private Mono<Void> handleSettings(GlobalInfo info) {
+        return Optional.ofNullable(systemConfigFetcher.getIfUnique())
+            .map(fetcher -> fetcher.getConfigMap()
+                .doOnNext(configMap -> {
+                    handleCommentSetting(info, configMap);
+                    handleUserSetting(info, configMap);
+                    handleBasicSetting(info, configMap);
+                    handlePostSlugGenerationStrategy(info, configMap);
+                })
+                .then()
+            )
+            .orElseGet(Mono::empty);
+    }
+
+    private void handleCommentSetting(GlobalInfo info, ConfigMap configMap) {
+        var comment =
+            SystemSetting.get(configMap, SystemSetting.Comment.GROUP, SystemSetting.Comment.class);
+        if (comment == null) {
+            info.setAllowComments(true);
+            info.setAllowAnonymousComments(true);
+        } else {
+            info.setAllowComments(comment.getEnable() != null && comment.getEnable());
+            info.setAllowAnonymousComments(
+                comment.getSystemUserOnly() == null || !comment.getSystemUserOnly());
+        }
+    }
+
+    private void handleUserSetting(GlobalInfo info, ConfigMap configMap) {
+        var userSetting =
+            SystemSetting.get(configMap, SystemSetting.User.GROUP, SystemSetting.User.class);
+        if (userSetting == null) {
+            info.setAllowRegistration(false);
+            info.setMustVerifyEmailOnRegistration(false);
+        } else {
+            info.setAllowRegistration(userSetting.isAllowRegistration());
+            info.setMustVerifyEmailOnRegistration(userSetting.isMustVerifyEmailOnRegistration());
+        }
+    }
+
+    private void handlePostSlugGenerationStrategy(GlobalInfo info,
+        ConfigMap configMap) {
+        var post = SystemSetting.get(configMap, SystemSetting.Post.GROUP, SystemSetting.Post.class);
+        if (post != null) {
+            info.setPostSlugGenerationStrategy(post.getSlugGenerationStrategy());
+        }
+    }
+
+    private void handleBasicSetting(GlobalInfo info, ConfigMap configMap) {
+        var basic =
+            SystemSetting.get(configMap, SystemSetting.Basic.GROUP, SystemSetting.Basic.class);
+        if (basic != null) {
+            info.setFavicon(basic.getFavicon());
+            info.setSiteTitle(basic.getTitle());
+        }
+    }
+
+    private Mono<Void> handleSocialAuthProvider(GlobalInfo info) {
+        return authProviderService.listAll()
+            .map(listedAuthProviders -> listedAuthProviders.stream()
+                .filter(provider -> isTrue(provider.getEnabled()))
+                .filter(provider -> StringUtils.isNotBlank(provider.getBindingUrl()))
+                .map(provider -> {
+                    GlobalInfo.SocialAuthProvider socialAuthProvider =
+                        new GlobalInfo.SocialAuthProvider();
+                    socialAuthProvider.setName(provider.getName());
+                    socialAuthProvider.setDisplayName(provider.getDisplayName());
+                    socialAuthProvider.setDescription(provider.getDescription());
+                    socialAuthProvider.setLogo(provider.getLogo());
+                    socialAuthProvider.setWebsite(provider.getWebsite());
+                    socialAuthProvider.setAuthenticationUrl(provider.getAuthenticationUrl());
+                    socialAuthProvider.setBindingUrl(provider.getBindingUrl());
+                    return socialAuthProvider;
+                })
+                .toList()
+            )
+            .doOnNext(info::setSocialAuthProviders)
+            .then();
+    }
+}
diff --git a/application/src/main/java/run/halo/app/infra/config/WebServerSecurityConfig.java b/application/src/main/java/run/halo/app/infra/config/WebServerSecurityConfig.java
index 79f3c014e8..9de837d9c0 100644
--- a/application/src/main/java/run/halo/app/infra/config/WebServerSecurityConfig.java
+++ b/application/src/main/java/run/halo/app/infra/config/WebServerSecurityConfig.java
@@ -11,6 +11,7 @@
 import org.springframework.boot.autoconfigure.web.ServerProperties;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
+import org.springframework.http.HttpMethod;
 import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity;
 import org.springframework.security.config.web.server.ServerHttpSecurity;
 import org.springframework.security.crypto.factory.PasswordEncoderFactories;
@@ -18,10 +19,10 @@
 import org.springframework.security.web.server.SecurityWebFilterChain;
 import org.springframework.security.web.server.context.ServerSecurityContextRepository;
 import org.springframework.security.web.server.context.WebSessionServerSecurityContextRepository;
+import org.springframework.security.web.server.util.matcher.AndServerWebExchangeMatcher;
+import org.springframework.security.web.server.util.matcher.NegatedServerWebExchangeMatcher;
 import org.springframework.session.MapSession;
 import org.springframework.session.config.annotation.web.server.EnableSpringWebSession;
-import org.springframework.web.reactive.function.server.RouterFunction;
-import org.springframework.web.reactive.function.server.ServerResponse;
 import run.halo.app.core.user.service.RoleService;
 import run.halo.app.core.user.service.UserService;
 import run.halo.app.extension.ReactiveExtensionClient;
@@ -31,7 +32,6 @@
 import run.halo.app.security.authentication.CryptoService;
 import run.halo.app.security.authentication.SecurityConfigurer;
 import run.halo.app.security.authentication.impl.RsaKeyService;
-import run.halo.app.security.authentication.login.PublicKeyRouteBuilder;
 import run.halo.app.security.authentication.pat.PatAuthenticationManager;
 import run.halo.app.security.authentication.pat.PatServerWebExchangeMatcher;
 import run.halo.app.security.authentication.twofactor.TwoFactorAuthorizationManager;
@@ -59,20 +59,33 @@ SecurityWebFilterChain filterChain(ServerHttpSecurity http,
         CryptoService cryptoService,
         HaloProperties haloProperties) {
 
-        http.securityMatcher(pathMatchers("/**"))
+        var pathMatcher = pathMatchers("/**");
+        var staticResourcesMatcher = pathMatchers(HttpMethod.GET,
+            "/themes/{themeName}/assets/{*resourcePaths}",
+            "/plugins/{pluginName}/assets/**",
+            "/console/**",
+            "/uc/**",
+            "/upload/**",
+            "/webjars/**",
+            "/js/**",
+            "/styles/**",
+            "/halo-tracker.js",
+            "/images/**"
+        );
+
+        var securityMatcher = new AndServerWebExchangeMatcher(pathMatcher,
+            new NegatedServerWebExchangeMatcher(staticResourcesMatcher));
+
+        http.securityMatcher(securityMatcher)
             .authorizeExchange(spec -> spec.pathMatchers(
                     "/api/**",
                     "/apis/**",
                     "/oauth2/**",
-                    "/login/**",
-                    "/logout",
                     "/actuator/**"
                 )
-                .access(
-                    new TwoFactorAuthorizationManager(
-                        new RequestInfoAuthorizationManager(roleService)
-                    )
-                )
+                .access(new RequestInfoAuthorizationManager(roleService))
+                .pathMatchers("/challenges/two-factor/**")
+                .access(new TwoFactorAuthorizationManager())
                 .anyExchange().permitAll())
             .anonymous(spec -> {
                 spec.authorities(AnonymousUserConst.Role);
@@ -140,11 +153,6 @@ PasswordEncoder passwordEncoder() {
         return PasswordEncoderFactories.createDelegatingPasswordEncoder();
     }
 
-    @Bean
-    RouterFunction<ServerResponse> publicKeyRoute(CryptoService cryptoService) {
-        return new PublicKeyRouteBuilder(cryptoService).build();
-    }
-
     @Bean
     CryptoService cryptoService(HaloProperties haloProperties) {
         return new RsaKeyService(haloProperties.getWorkDir().resolve("keys"));
diff --git a/application/src/main/java/run/halo/app/infra/exception/RequestBodyValidationException.java b/application/src/main/java/run/halo/app/infra/exception/RequestBodyValidationException.java
index 353f2fb997..4bcdbefce7 100644
--- a/application/src/main/java/run/halo/app/infra/exception/RequestBodyValidationException.java
+++ b/application/src/main/java/run/halo/app/infra/exception/RequestBodyValidationException.java
@@ -3,6 +3,7 @@
 import java.util.ArrayList;
 import java.util.List;
 import java.util.Locale;
+import lombok.Getter;
 import org.springframework.context.MessageSource;
 import org.springframework.context.MessageSourceResolvable;
 import org.springframework.http.ProblemDetail;
@@ -11,6 +12,7 @@
 import org.springframework.web.server.ServerWebInputException;
 import org.springframework.web.util.BindErrorUtils;
 
+@Getter
 public class RequestBodyValidationException extends ServerWebInputException {
 
     private final Errors errors;
diff --git a/application/src/main/java/run/halo/app/security/AuthProviderService.java b/application/src/main/java/run/halo/app/security/AuthProviderService.java
index c996db4d30..6bd8093dd9 100644
--- a/application/src/main/java/run/halo/app/security/AuthProviderService.java
+++ b/application/src/main/java/run/halo/app/security/AuthProviderService.java
@@ -1,6 +1,7 @@
 package run.halo.app.security;
 
 import java.util.List;
+import reactor.core.publisher.Flux;
 import reactor.core.publisher.Mono;
 import run.halo.app.core.extension.AuthProvider;
 
@@ -17,4 +18,7 @@ public interface AuthProviderService {
     Mono<AuthProvider> disable(String name);
 
     Mono<List<ListedAuthProvider>> listAll();
+
+    Flux<AuthProvider> getEnabledProviders();
+
 }
diff --git a/application/src/main/java/run/halo/app/security/AuthProviderServiceImpl.java b/application/src/main/java/run/halo/app/security/AuthProviderServiceImpl.java
index 4b318ed56c..d6838bd575 100644
--- a/application/src/main/java/run/halo/app/security/AuthProviderServiceImpl.java
+++ b/application/src/main/java/run/halo/app/security/AuthProviderServiceImpl.java
@@ -19,9 +19,12 @@
 import run.halo.app.core.extension.AuthProvider;
 import run.halo.app.core.extension.UserConnection;
 import run.halo.app.extension.ConfigMap;
+import run.halo.app.extension.ExtensionUtil;
+import run.halo.app.extension.ListOptions;
 import run.halo.app.extension.Metadata;
 import run.halo.app.extension.MetadataUtil;
 import run.halo.app.extension.ReactiveExtensionClient;
+import run.halo.app.extension.index.query.QueryFactory;
 import run.halo.app.infra.SystemSetting;
 import run.halo.app.infra.utils.JsonUtils;
 
@@ -56,10 +59,10 @@ public Mono<AuthProvider> disable(String name) {
 
     @Override
     public Mono<List<ListedAuthProvider>> listAll() {
-        return client.list(AuthProvider.class, provider ->
-                    provider.getMetadata().getDeletionTimestamp() == null,
-                defaultComparator()
-            )
+        var listOptions = ListOptions.builder()
+            .andQuery(ExtensionUtil.notDeleting())
+            .build();
+        return client.listAll(AuthProvider.class, listOptions, ExtensionUtil.defaultSort())
             .map(this::convertTo)
             .collectList()
             .flatMap(providers -> listMyConnections()
@@ -86,6 +89,17 @@ public Mono<List<ListedAuthProvider>> listAll() {
             );
     }
 
+    @Override
+    public Flux<AuthProvider> getEnabledProviders() {
+        return fetchEnabledAuthProviders().flatMapMany(enabledNames -> {
+            var listOptions = ListOptions.builder()
+                .andQuery(QueryFactory.in("metadata.name", enabledNames))
+                .andQuery(ExtensionUtil.notDeleting())
+                .build();
+            return client.listAll(AuthProvider.class, listOptions, ExtensionUtil.defaultSort());
+        });
+    }
+
     private Mono<Set<String>> fetchEnabledAuthProviders() {
         return client.fetch(ConfigMap.class, SystemSetting.SYSTEM_CONFIG)
             .map(configMap -> {
@@ -97,12 +111,14 @@ private Mono<Set<String>> fetchEnabledAuthProviders() {
     Flux<UserConnection> listMyConnections() {
         return ReactiveSecurityContextHolder.getContext()
             .map(securityContext -> securityContext.getAuthentication().getName())
-            .flatMapMany(username -> client.list(UserConnection.class,
-                    persisted -> persisted.getSpec().getUsername().equals(username),
-                    Comparator.comparing(item -> item.getMetadata()
-                        .getCreationTimestamp())
-                )
-            );
+            .flatMapMany(username -> {
+                var listOptions = ListOptions.builder()
+                    .andQuery(QueryFactory.equal("spec.username", username))
+                    .andQuery(ExtensionUtil.notDeleting())
+                    .build();
+                return client.listAll(UserConnection.class, listOptions,
+                    ExtensionUtil.defaultSort());
+            });
     }
 
     private static Comparator<AuthProvider> defaultComparator() {
diff --git a/application/src/main/java/run/halo/app/security/DefaultServerAuthenticationEntryPoint.java b/application/src/main/java/run/halo/app/security/DefaultServerAuthenticationEntryPoint.java
index 9e0af48e5f..869e5fa428 100644
--- a/application/src/main/java/run/halo/app/security/DefaultServerAuthenticationEntryPoint.java
+++ b/application/src/main/java/run/halo/app/security/DefaultServerAuthenticationEntryPoint.java
@@ -4,6 +4,9 @@
 import org.springframework.http.HttpStatus;
 import org.springframework.security.core.AuthenticationException;
 import org.springframework.security.web.server.ServerAuthenticationEntryPoint;
+import org.springframework.security.web.server.authentication.RedirectServerAuthenticationEntryPoint;
+import org.springframework.security.web.server.util.matcher.ServerWebExchangeMatcher;
+import org.springframework.security.web.server.util.matcher.ServerWebExchangeMatcher.MatchResult;
 import org.springframework.web.server.ServerWebExchange;
 import reactor.core.publisher.Mono;
 
@@ -17,15 +20,37 @@
  */
 public class DefaultServerAuthenticationEntryPoint implements ServerAuthenticationEntryPoint {
 
+    private final ServerWebExchangeMatcher xhrMatcher = exchange -> {
+        if (exchange.getRequest().getHeaders().getOrEmpty("X-Requested-With")
+            .contains("XMLHttpRequest")) {
+            return MatchResult.match();
+        }
+        return MatchResult.notMatch();
+    };
+
+    private final RedirectServerAuthenticationEntryPoint redirectEntryPoint;
+
+    public DefaultServerAuthenticationEntryPoint() {
+        this.redirectEntryPoint =
+            new RedirectServerAuthenticationEntryPoint("/login?authentication_required");
+    }
+
     @Override
     public Mono<Void> commence(ServerWebExchange exchange, AuthenticationException ex) {
-        return Mono.defer(() -> {
-            var response = exchange.getResponse();
-            var wwwAuthenticate = "FormLogin realm=\"console\"";
-            response.getHeaders().set(HttpHeaders.WWW_AUTHENTICATE, wwwAuthenticate);
-            response.setStatusCode(HttpStatus.UNAUTHORIZED);
-            return response.setComplete();
-        });
+        return xhrMatcher.matches(exchange)
+            .filter(MatchResult::isMatch)
+            .switchIfEmpty(
+                Mono.defer(() -> this.redirectEntryPoint.commence(exchange, ex)).then(Mono.empty())
+            )
+            .flatMap(match -> Mono.defer(
+                () -> {
+                    var response = exchange.getResponse();
+                    var wwwAuthenticate = "FormLogin realm=\"console\"";
+                    response.getHeaders().set(HttpHeaders.WWW_AUTHENTICATE, wwwAuthenticate);
+                    response.setStatusCode(HttpStatus.UNAUTHORIZED);
+                    return response.setComplete();
+                }).then(Mono.empty())
+            );
     }
 
 }
diff --git a/application/src/main/java/run/halo/app/security/LoginHandlerEnhancerImpl.java b/application/src/main/java/run/halo/app/security/LoginHandlerEnhancerImpl.java
index bb72c7ca0e..c4497927fe 100644
--- a/application/src/main/java/run/halo/app/security/LoginHandlerEnhancerImpl.java
+++ b/application/src/main/java/run/halo/app/security/LoginHandlerEnhancerImpl.java
@@ -6,7 +6,9 @@
 import org.springframework.stereotype.Component;
 import org.springframework.web.server.ServerWebExchange;
 import reactor.core.publisher.Mono;
+import run.halo.app.security.authentication.rememberme.RememberMeRequestCache;
 import run.halo.app.security.authentication.rememberme.RememberMeServices;
+import run.halo.app.security.authentication.rememberme.WebSessionRememberMeRequestCache;
 import run.halo.app.security.device.DeviceService;
 
 /**
@@ -24,11 +26,15 @@ public class LoginHandlerEnhancerImpl implements LoginHandlerEnhancer {
 
     private final DeviceService deviceService;
 
+    private final RememberMeRequestCache rememberMeRequestCache =
+        new WebSessionRememberMeRequestCache();
+
     @Override
     public Mono<Void> onLoginSuccess(ServerWebExchange exchange,
         Authentication successfulAuthentication) {
         return rememberMeServices.loginSuccess(exchange, successfulAuthentication)
-            .then(deviceService.loginSuccess(exchange, successfulAuthentication));
+            .then(deviceService.loginSuccess(exchange, successfulAuthentication))
+            .then(rememberMeRequestCache.removeRememberMe(exchange));
     }
 
     @Override
diff --git a/application/src/main/java/run/halo/app/security/LogoutSecurityConfigurer.java b/application/src/main/java/run/halo/app/security/LogoutSecurityConfigurer.java
index 79c3974d60..1cf8effe5b 100644
--- a/application/src/main/java/run/halo/app/security/LogoutSecurityConfigurer.java
+++ b/application/src/main/java/run/halo/app/security/LogoutSecurityConfigurer.java
@@ -1,11 +1,12 @@
 package run.halo.app.security;
 
-import static org.springframework.security.config.web.server.SecurityWebFiltersOrder.LOGOUT_PAGE_GENERATING;
 import static run.halo.app.security.authentication.WebExchangeMatchers.ignoringMediaTypeAll;
 
 import java.net.URI;
+import java.util.Map;
 import lombok.RequiredArgsConstructor;
 import org.springframework.context.ApplicationContext;
+import org.springframework.context.annotation.Bean;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.MediaType;
 import org.springframework.security.config.web.server.ServerHttpSecurity;
@@ -15,8 +16,10 @@
 import org.springframework.security.web.server.authentication.logout.RedirectServerLogoutSuccessHandler;
 import org.springframework.security.web.server.authentication.logout.ServerLogoutHandler;
 import org.springframework.security.web.server.authentication.logout.ServerLogoutSuccessHandler;
-import org.springframework.security.web.server.ui.LogoutPageGeneratingWebFilter;
 import org.springframework.stereotype.Component;
+import org.springframework.web.reactive.function.server.RouterFunction;
+import org.springframework.web.reactive.function.server.RouterFunctions;
+import org.springframework.web.reactive.function.server.ServerResponse;
 import reactor.core.publisher.Mono;
 import run.halo.app.security.authentication.SecurityConfigurer;
 import run.halo.app.security.authentication.rememberme.RememberMeServices;
@@ -31,8 +34,8 @@ public class LogoutSecurityConfigurer implements SecurityConfigurer {
     public void configure(ServerHttpSecurity http) {
         var serverLogoutHandlers = getLogoutHandlers();
         http.logout(
-            logout -> logout.logoutSuccessHandler(new LogoutSuccessHandler(serverLogoutHandlers)));
-        http.addFilterAt(new LogoutPageGeneratingWebFilter(), LOGOUT_PAGE_GENERATING);
+            logout -> logout.logoutSuccessHandler(new LogoutSuccessHandler(serverLogoutHandlers))
+        );
     }
 
     private class LogoutSuccessHandler implements ServerLogoutSuccessHandler {
@@ -42,7 +45,7 @@ private class LogoutSuccessHandler implements ServerLogoutSuccessHandler {
 
         public LogoutSuccessHandler(ServerLogoutHandler... logoutHandler) {
             var defaultHandler = new RedirectServerLogoutSuccessHandler();
-            defaultHandler.setLogoutSuccessUrl(URI.create("/console/?logout"));
+            defaultHandler.setLogoutSuccessUrl(URI.create("/login?logout"));
             this.defaultHandler = defaultHandler;
             if (logoutHandler.length == 1) {
                 this.logoutHandler = logoutHandler[0];
@@ -51,6 +54,19 @@ public LogoutSuccessHandler(ServerLogoutHandler... logoutHandler) {
             }
         }
 
+        @Bean
+        RouterFunction<ServerResponse> logoutPage() {
+            return RouterFunctions.route()
+                .GET("/logout", request -> {
+                    var exchange = request.exchange();
+                    var contextPath = exchange.getRequest().getPath().contextPath().value();
+                    return ServerResponse.ok().render("logout", Map.of(
+                        "action", contextPath + "/logout"
+                    ));
+                })
+                .build();
+        }
+
         @Override
         public Mono<Void> onLogoutSuccess(WebFilterExchange exchange,
             Authentication authentication) {
diff --git a/application/src/main/java/run/halo/app/security/authentication/exception/TooManyRequestsException.java b/application/src/main/java/run/halo/app/security/authentication/exception/TooManyRequestsException.java
new file mode 100644
index 0000000000..9e0f4382e1
--- /dev/null
+++ b/application/src/main/java/run/halo/app/security/authentication/exception/TooManyRequestsException.java
@@ -0,0 +1,21 @@
+package run.halo.app.security.authentication.exception;
+
+import org.springframework.lang.Nullable;
+import org.springframework.security.core.AuthenticationException;
+import run.halo.app.infra.exception.RateLimitExceededException;
+
+/**
+ * Too many requests exception while authenticating. Because
+ * {@link RateLimitExceededException} is not a subclass of
+ * {@link AuthenticationException}, we need to create a new exception class to map it.
+ *
+ * @author johnniang
+ * @since 2.20.0
+ */
+public class TooManyRequestsException extends AuthenticationException {
+
+    public TooManyRequestsException(@Nullable Throwable throwable) {
+        super("Too many requests.", throwable);
+    }
+
+}
diff --git a/application/src/main/java/run/halo/app/security/authentication/exception/TwoFactorAuthException.java b/application/src/main/java/run/halo/app/security/authentication/exception/TwoFactorAuthException.java
new file mode 100644
index 0000000000..fb37664b1f
--- /dev/null
+++ b/application/src/main/java/run/halo/app/security/authentication/exception/TwoFactorAuthException.java
@@ -0,0 +1,15 @@
+package run.halo.app.security.authentication.exception;
+
+import org.springframework.security.core.AuthenticationException;
+
+public class TwoFactorAuthException extends AuthenticationException {
+
+    public TwoFactorAuthException(String msg, Throwable cause) {
+        super(msg, cause);
+    }
+
+    public TwoFactorAuthException(String msg) {
+        super(msg);
+    }
+
+}
diff --git a/application/src/main/java/run/halo/app/security/authentication/login/LoginAuthenticationConverter.java b/application/src/main/java/run/halo/app/security/authentication/login/LoginAuthenticationConverter.java
index 9a3bfb7e12..26df92cbf0 100644
--- a/application/src/main/java/run/halo/app/security/authentication/login/LoginAuthenticationConverter.java
+++ b/application/src/main/java/run/halo/app/security/authentication/login/LoginAuthenticationConverter.java
@@ -13,9 +13,9 @@
 import org.springframework.security.web.server.authentication.ServerFormLoginAuthenticationConverter;
 import org.springframework.web.server.ServerWebExchange;
 import reactor.core.publisher.Mono;
-import run.halo.app.infra.exception.RateLimitExceededException;
 import run.halo.app.infra.utils.IpAddressUtils;
 import run.halo.app.security.authentication.CryptoService;
+import run.halo.app.security.authentication.exception.TooManyRequestsException;
 
 @Slf4j
 public class LoginAuthenticationConverter extends ServerFormLoginAuthenticationConverter {
@@ -35,6 +35,9 @@ public Mono<Authentication> convert(ServerWebExchange exchange) {
         return super.convert(exchange)
             // validate the password
             .<Authentication>flatMap(token -> {
+                if (token.getCredentials() == null) {
+                    return Mono.error(new BadCredentialsException("Empty credentials."));
+                }
                 var credentials = (String) token.getCredentials();
                 byte[] credentialsBytes;
                 try {
@@ -51,7 +54,9 @@ public Mono<Authentication> convert(ServerWebExchange exchange) {
                         new String(decryptedCredentials, UTF_8)));
             })
             .transformDeferred(createIpBasedRateLimiter(exchange))
-            .onErrorMap(RequestNotPermitted.class, RateLimitExceededException::new);
+            // We have to remap the exception to an AuthenticationException
+            // for using in failure handler
+            .onErrorMap(RequestNotPermitted.class, TooManyRequestsException::new);
     }
 
     private <T> RateLimiterOperator<T> createIpBasedRateLimiter(ServerWebExchange exchange) {
diff --git a/application/src/main/java/run/halo/app/security/authentication/login/LoginSecurityConfigurer.java b/application/src/main/java/run/halo/app/security/authentication/login/LoginSecurityConfigurer.java
index 8fff496451..fb49212d88 100644
--- a/application/src/main/java/run/halo/app/security/authentication/login/LoginSecurityConfigurer.java
+++ b/application/src/main/java/run/halo/app/security/authentication/login/LoginSecurityConfigurer.java
@@ -9,18 +9,23 @@
 import org.springframework.security.authentication.UserDetailsRepositoryReactiveAuthenticationManager;
 import org.springframework.security.config.web.server.SecurityWebFiltersOrder;
 import org.springframework.security.config.web.server.ServerHttpSecurity;
+import org.springframework.security.core.Authentication;
 import org.springframework.security.core.userdetails.ReactiveUserDetailsPasswordService;
 import org.springframework.security.core.userdetails.ReactiveUserDetailsService;
 import org.springframework.security.crypto.password.PasswordEncoder;
+import org.springframework.security.web.server.WebFilterExchange;
 import org.springframework.security.web.server.authentication.AuthenticationWebFilter;
 import org.springframework.security.web.server.context.ServerSecurityContextRepository;
 import org.springframework.security.web.server.util.matcher.ServerWebExchangeMatchers;
 import org.springframework.stereotype.Component;
 import org.springframework.web.reactive.function.server.ServerResponse;
+import reactor.core.publisher.Mono;
 import run.halo.app.plugin.extensionpoint.ExtensionGetter;
+import run.halo.app.security.HaloUserDetails;
 import run.halo.app.security.LoginHandlerEnhancer;
 import run.halo.app.security.authentication.CryptoService;
 import run.halo.app.security.authentication.SecurityConfigurer;
+import run.halo.app.security.authentication.twofactor.TwoFactorAuthentication;
 
 @Component
 public class LoginSecurityConfigurer implements SecurityConfigurer {
@@ -66,10 +71,20 @@ public LoginSecurityConfigurer(ObservationRegistry observationRegistry,
 
     @Override
     public void configure(ServerHttpSecurity http) {
-        var filter = new AuthenticationWebFilter(authenticationManager());
+        var filter = new AuthenticationWebFilter(authenticationManager()) {
+            @Override
+            protected Mono<Void> onAuthenticationSuccess(Authentication authentication,
+                WebFilterExchange webFilterExchange) {
+                // check if 2FA is enabled after authenticating successfully.
+                if (authentication.getPrincipal() instanceof HaloUserDetails userDetails
+                    && userDetails.isTwoFactorAuthEnabled()) {
+                    authentication = new TwoFactorAuthentication(authentication);
+                }
+                return super.onAuthenticationSuccess(authentication, webFilterExchange);
+            }
+        };
         var requiresMatcher = ServerWebExchangeMatchers.pathMatchers(HttpMethod.POST, "/login");
-        var handler =
-            new UsernamePasswordHandler(context, messageSource, loginHandlerEnhancer);
+        var handler = new UsernamePasswordHandler(context, messageSource, loginHandlerEnhancer);
         var authConverter = new LoginAuthenticationConverter(cryptoService, rateLimiterRegistry);
         filter.setRequiresAuthenticationMatcher(requiresMatcher);
         filter.setAuthenticationFailureHandler(handler);
diff --git a/application/src/main/java/run/halo/app/security/authentication/login/UsernamePasswordDelegatingAuthenticationManager.java b/application/src/main/java/run/halo/app/security/authentication/login/UsernamePasswordDelegatingAuthenticationManager.java
index 912d9a5267..5ddf5e78c5 100644
--- a/application/src/main/java/run/halo/app/security/authentication/login/UsernamePasswordDelegatingAuthenticationManager.java
+++ b/application/src/main/java/run/halo/app/security/authentication/login/UsernamePasswordDelegatingAuthenticationManager.java
@@ -6,8 +6,6 @@
 import org.springframework.security.core.AuthenticationException;
 import reactor.core.publisher.Mono;
 import run.halo.app.plugin.extensionpoint.ExtensionGetter;
-import run.halo.app.security.HaloUserDetails;
-import run.halo.app.security.authentication.twofactor.TwoFactorAuthentication;
 
 @Slf4j
 public class UsernamePasswordDelegatingAuthenticationManager
@@ -40,14 +38,6 @@ public Mono<Authentication> authenticate(Authentication authentication) {
             )
             .switchIfEmpty(
                 Mono.defer(() -> defaultAuthenticationManager.authenticate(authentication))
-            )
-            // check if MFA is enabled after authenticated
-            .map(a -> {
-                if (a.getPrincipal() instanceof HaloUserDetails user
-                    && user.isTwoFactorAuthEnabled()) {
-                    a = new TwoFactorAuthentication(a);
-                }
-                return a;
-            });
+            );
     }
 }
diff --git a/application/src/main/java/run/halo/app/security/authentication/login/UsernamePasswordHandler.java b/application/src/main/java/run/halo/app/security/authentication/login/UsernamePasswordHandler.java
index 33ce5b04db..a04a90208a 100644
--- a/application/src/main/java/run/halo/app/security/authentication/login/UsernamePasswordHandler.java
+++ b/application/src/main/java/run/halo/app/security/authentication/login/UsernamePasswordHandler.java
@@ -5,13 +5,17 @@
 import static run.halo.app.infra.exception.Exceptions.createErrorResponse;
 import static run.halo.app.security.authentication.WebExchangeMatchers.ignoringMediaTypeAll;
 
+import java.net.URI;
+import lombok.Setter;
 import lombok.extern.slf4j.Slf4j;
 import org.springframework.context.MessageSource;
+import org.springframework.security.authentication.BadCredentialsException;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.AuthenticationException;
 import org.springframework.security.core.CredentialsContainer;
+import org.springframework.security.web.server.DefaultServerRedirectStrategy;
+import org.springframework.security.web.server.ServerRedirectStrategy;
 import org.springframework.security.web.server.WebFilterExchange;
-import org.springframework.security.web.server.authentication.RedirectServerAuthenticationFailureHandler;
 import org.springframework.security.web.server.authentication.RedirectServerAuthenticationSuccessHandler;
 import org.springframework.security.web.server.authentication.ServerAuthenticationFailureHandler;
 import org.springframework.security.web.server.authentication.ServerAuthenticationSuccessHandler;
@@ -21,6 +25,9 @@
 import org.springframework.web.server.ServerWebExchange;
 import reactor.core.publisher.Mono;
 import run.halo.app.security.LoginHandlerEnhancer;
+import run.halo.app.security.authentication.exception.TooManyRequestsException;
+import run.halo.app.security.authentication.rememberme.RememberMeRequestCache;
+import run.halo.app.security.authentication.rememberme.WebSessionRememberMeRequestCache;
 import run.halo.app.security.authentication.twofactor.TwoFactorAuthentication;
 
 @Slf4j
@@ -33,8 +40,10 @@ public class UsernamePasswordHandler implements ServerAuthenticationSuccessHandl
 
     private final LoginHandlerEnhancer loginHandlerEnhancer;
 
-    private final ServerAuthenticationFailureHandler defaultFailureHandler =
-        new RedirectServerAuthenticationFailureHandler("/console?error#/login");
+    private final ServerRedirectStrategy redirectStrategy = new DefaultServerRedirectStrategy();
+
+    @Setter
+    private RememberMeRequestCache rememberMeRequestCache = new WebSessionRememberMeRequestCache();
 
     private final ServerAuthenticationSuccessHandler defaultSuccessHandler =
         new RedirectServerAuthenticationSuccessHandler("/console/");
@@ -54,10 +63,17 @@ public Mono<Void> onAuthenticationFailure(WebFilterExchange webFilterExchange,
             .then(ignoringMediaTypeAll(APPLICATION_JSON)
                 .matches(exchange)
                 .filter(ServerWebExchangeMatcher.MatchResult::isMatch)
-                .switchIfEmpty(
-                    defaultFailureHandler.onAuthenticationFailure(webFilterExchange, exception)
-                        // Skip the handleAuthenticationException.
-                        .then(Mono.empty())
+                .switchIfEmpty(Mono.defer(
+                    () -> {
+                        URI location = URI.create("/login?error");
+                        if (exception instanceof BadCredentialsException) {
+                            location = URI.create("/login?error=invalid-credential");
+                        }
+                        if (exception instanceof TooManyRequestsException) {
+                            location = URI.create("/login?error=rate-limit-exceeded");
+                        }
+                        return redirectStrategy.sendRedirect(exchange, location);
+                    }).then(Mono.empty())
                 )
                 .flatMap(matchResult -> handleAuthenticationException(exception, exchange)));
     }
@@ -66,10 +82,12 @@ public Mono<Void> onAuthenticationFailure(WebFilterExchange webFilterExchange,
     public Mono<Void> onAuthenticationSuccess(WebFilterExchange webFilterExchange,
         Authentication authentication) {
         if (authentication instanceof TwoFactorAuthentication) {
-            // continue filtering for authorization
-            return loginHandlerEnhancer.onLoginSuccess(webFilterExchange.getExchange(),
-                    authentication)
-                .then(webFilterExchange.getChain().filter(webFilterExchange.getExchange()));
+            return rememberMeRequestCache.saveRememberMe(webFilterExchange.getExchange())
+                // Do not use RedirectServerAuthenticationSuccessHandler to redirect
+                // because it will use request cache to redirect
+                .then(redirectStrategy.sendRedirect(webFilterExchange.getExchange(),
+                    URI.create("/challenges/two-factor/totp"))
+                );
         }
 
         if (authentication instanceof CredentialsContainer container) {
diff --git a/application/src/main/java/run/halo/app/security/authentication/rememberme/RememberMeRequestCache.java b/application/src/main/java/run/halo/app/security/authentication/rememberme/RememberMeRequestCache.java
new file mode 100644
index 0000000000..846afb8215
--- /dev/null
+++ b/application/src/main/java/run/halo/app/security/authentication/rememberme/RememberMeRequestCache.java
@@ -0,0 +1,39 @@
+package run.halo.app.security.authentication.rememberme;
+
+import org.springframework.web.server.ServerWebExchange;
+import reactor.core.publisher.Mono;
+
+/**
+ * An interface for caching remember-me parameter in request for further handling. Especially
+ * useful for two-factor authentication.
+ *
+ * @author johnniang
+ * @since 2.20.0
+ */
+public interface RememberMeRequestCache {
+
+    /**
+     * Save remember-me parameter or form into cache.
+     *
+     * @param exchange exchange
+     * @return empty to return
+     */
+    Mono<Void> saveRememberMe(ServerWebExchange exchange);
+
+    /**
+     * Check if remember-me parameter exists in cache.
+     *
+     * @param exchange exchange
+     * @return true if remember-me exists, false otherwise
+     */
+    Mono<Boolean> isRememberMe(ServerWebExchange exchange);
+
+    /**
+     * Remove remember-me parameter from cache.
+     *
+     * @param exchange exchange
+     * @return empty to return
+     */
+    Mono<Void> removeRememberMe(ServerWebExchange exchange);
+
+}
diff --git a/application/src/main/java/run/halo/app/security/authentication/rememberme/TokenBasedRememberMeServices.java b/application/src/main/java/run/halo/app/security/authentication/rememberme/TokenBasedRememberMeServices.java
index 17e67308f0..4f1e9c0dac 100644
--- a/application/src/main/java/run/halo/app/security/authentication/rememberme/TokenBasedRememberMeServices.java
+++ b/application/src/main/java/run/halo/app/security/authentication/rememberme/TokenBasedRememberMeServices.java
@@ -1,8 +1,5 @@
 package run.halo.app.security.authentication.rememberme;
 
-import static org.apache.commons.lang3.BooleanUtils.isTrue;
-import static org.apache.commons.lang3.BooleanUtils.toBoolean;
-
 import java.net.URLDecoder;
 import java.net.URLEncoder;
 import java.nio.charset.StandardCharsets;
@@ -58,17 +55,13 @@
 @RequiredArgsConstructor
 public class TokenBasedRememberMeServices implements ServerLogoutHandler, RememberMeServices {
 
-    public static final int TWO_WEEKS_S = 1209600;
-
-    public static final String DEFAULT_PARAMETER = "remember-me";
-
     public static final String DEFAULT_ALGORITHM = "SHA-256";
 
     private static final String DELIMITER = ":";
 
     protected final CookieSignatureKeyResolver cookieSignatureKeyResolver;
 
-    protected final ReactiveUserDetailsService userDetailsService;
+    private final ReactiveUserDetailsService userDetailsService;
 
     protected final RememberMeCookieResolver rememberMeCookieResolver;
 
@@ -76,6 +69,8 @@ public class TokenBasedRememberMeServices implements ServerLogoutHandler, Rememb
 
     private GrantedAuthoritiesMapper authoritiesMapper = new NullAuthoritiesMapper();
 
+    private RememberMeRequestCache rememberMeRequestCache = new WebSessionRememberMeRequestCache();
+
     private static boolean equals(String expected, String actual) {
         byte[] expectedBytes = bytesUtf8(expected);
         byte[] actualBytes = bytesUtf8(actual);
@@ -214,11 +209,12 @@ public Mono<Void> loginFail(ServerWebExchange exchange) {
     @Override
     public Mono<Void> loginSuccess(ServerWebExchange exchange,
         Authentication successfulAuthentication) {
-        if (!rememberMeRequested(exchange)) {
-            log.debug("Remember-me login not requested.");
-            return Mono.empty();
-        }
-        return onLoginSuccess(exchange, successfulAuthentication);
+        return rememberMeRequestCache.isRememberMe(exchange)
+            .filter(Boolean::booleanValue)
+            .switchIfEmpty(Mono.fromRunnable(() -> {
+                log.debug("Remember-me login not requested.");
+            }))
+            .flatMap(rememberMe -> onLoginSuccess(exchange, successfulAuthentication));
     }
 
     protected Mono<Void> onLoginSuccess(ServerWebExchange exchange,
@@ -282,18 +278,6 @@ protected long calculateExpireTime(ServerWebExchange exchange,
         return Instant.now().plusSeconds(tokenLifetime).toEpochMilli();
     }
 
-    protected boolean rememberMeRequested(ServerWebExchange exchange) {
-        String rememberMe = exchange.getRequest().getQueryParams().getFirst(DEFAULT_PARAMETER);
-        if (isTrue(toBoolean(rememberMe))) {
-            return true;
-        }
-        if (log.isDebugEnabled()) {
-            log.debug("Did not send remember-me cookie (principal did not set parameter '{}')",
-                DEFAULT_PARAMETER);
-        }
-        return false;
-    }
-
     protected String[] decodeCookie(String cookieValue) throws InvalidCookieException {
         int paddingCount = 4 - (cookieValue.length() % 4);
         if (paddingCount < 4) {
diff --git a/application/src/main/java/run/halo/app/security/authentication/rememberme/WebSessionRememberMeRequestCache.java b/application/src/main/java/run/halo/app/security/authentication/rememberme/WebSessionRememberMeRequestCache.java
new file mode 100644
index 0000000000..5c6f629a02
--- /dev/null
+++ b/application/src/main/java/run/halo/app/security/authentication/rememberme/WebSessionRememberMeRequestCache.java
@@ -0,0 +1,71 @@
+package run.halo.app.security.authentication.rememberme;
+
+import static java.lang.Boolean.parseBoolean;
+
+import org.springframework.web.server.ServerWebExchange;
+import org.springframework.web.server.WebSession;
+import reactor.core.publisher.Mono;
+
+/**
+ * An implementation of {@link RememberMeRequestCache} that stores remember-me parameter in
+ * {@link WebSession}.
+ *
+ * @author johnniang
+ * @since 2.20.0
+ */
+public class WebSessionRememberMeRequestCache implements RememberMeRequestCache {
+
+    private static final String SESSION_ATTRIBUTE_NAME =
+        RememberMeRequestCache.class + ".REMEMBER_ME";
+
+    private static final String DEFAULT_PARAMETER = "remember-me";
+
+    @Override
+    public Mono<Void> saveRememberMe(ServerWebExchange exchange) {
+        return resolveFromQuery(exchange)
+            .filter(Boolean::booleanValue)
+            .switchIfEmpty(resolveFromForm(exchange))
+            .filter(Boolean::booleanValue)
+            .flatMap(rememberMe -> exchange.getSession().doOnNext(
+                session -> session.getAttributes().put(SESSION_ATTRIBUTE_NAME, rememberMe))
+            )
+            .then();
+    }
+
+    @Override
+    public Mono<Boolean> isRememberMe(ServerWebExchange exchange) {
+        return resolveFromQuery(exchange)
+            .filter(Boolean::booleanValue)
+            .switchIfEmpty(resolveFromForm(exchange))
+            .filter(Boolean::booleanValue)
+            .switchIfEmpty(resolveFromSession(exchange))
+            .defaultIfEmpty(false);
+    }
+
+    @Override
+    public Mono<Void> removeRememberMe(ServerWebExchange exchange) {
+        return exchange.getSession()
+            .doOnNext(session -> session.getAttributes().remove(SESSION_ATTRIBUTE_NAME))
+            .then();
+    }
+
+    private Mono<Boolean> resolveFromQuery(ServerWebExchange exchange) {
+        return Mono.just(
+            parseBoolean(exchange.getRequest().getQueryParams().getFirst(DEFAULT_PARAMETER))
+        );
+    }
+
+    private Mono<Boolean> resolveFromForm(ServerWebExchange exchange) {
+        return exchange.getFormData()
+            .map(form -> parseBoolean(form.getFirst(DEFAULT_PARAMETER)))
+            .filter(Boolean::booleanValue);
+    }
+
+    private Mono<Boolean> resolveFromSession(ServerWebExchange exchange) {
+        return exchange.getSession()
+            .map(session -> {
+                var rememberMeObject = session.getAttribute(SESSION_ATTRIBUTE_NAME);
+                return rememberMeObject instanceof Boolean rememberMe ? rememberMe : false;
+            });
+    }
+}
diff --git a/application/src/main/java/run/halo/app/security/authentication/twofactor/DefaultTwoFactorAuthResponseHandler.java b/application/src/main/java/run/halo/app/security/authentication/twofactor/DefaultTwoFactorAuthResponseHandler.java
deleted file mode 100644
index 9de2be00fe..0000000000
--- a/application/src/main/java/run/halo/app/security/authentication/twofactor/DefaultTwoFactorAuthResponseHandler.java
+++ /dev/null
@@ -1,56 +0,0 @@
-package run.halo.app.security.authentication.twofactor;
-
-import java.net.URI;
-import org.springframework.context.MessageSource;
-import org.springframework.security.web.server.DefaultServerRedirectStrategy;
-import org.springframework.security.web.server.ServerRedirectStrategy;
-import org.springframework.security.web.server.util.matcher.ServerWebExchangeMatcher;
-import org.springframework.stereotype.Component;
-import org.springframework.web.reactive.function.server.ServerResponse;
-import org.springframework.web.server.ServerWebExchange;
-import reactor.core.publisher.Mono;
-import run.halo.app.infra.exception.Exceptions;
-
-@Component
-public class DefaultTwoFactorAuthResponseHandler implements TwoFactorAuthResponseHandler {
-
-    private final ServerRedirectStrategy redirectStrategy = new DefaultServerRedirectStrategy();
-
-    private static final String REDIRECT_LOCATION = "/console/login/mfa";
-
-    private final MessageSource messageSource;
-
-    private final ServerResponse.Context context;
-
-    private static final ServerWebExchangeMatcher XHR_MATCHER = exchange -> {
-        if (exchange.getRequest().getHeaders().getOrEmpty("X-Requested-With")
-            .contains("XMLHttpRequest")) {
-            return ServerWebExchangeMatcher.MatchResult.match();
-        }
-        return ServerWebExchangeMatcher.MatchResult.notMatch();
-    };
-
-    public DefaultTwoFactorAuthResponseHandler(MessageSource messageSource,
-        ServerResponse.Context context) {
-        this.messageSource = messageSource;
-        this.context = context;
-    }
-
-    @Override
-    public Mono<Void> handle(ServerWebExchange exchange) {
-        return XHR_MATCHER.matches(exchange)
-            .filter(ServerWebExchangeMatcher.MatchResult::isMatch)
-            .switchIfEmpty(Mono.defer(
-                () -> redirectStrategy.sendRedirect(exchange, URI.create(REDIRECT_LOCATION))
-                    .then(Mono.empty())))
-            .flatMap(isXhr -> {
-                var errorResponse = Exceptions.createErrorResponse(
-                    new TwoFactorAuthRequiredException(URI.create(REDIRECT_LOCATION)),
-                    null, exchange, messageSource);
-                return ServerResponse.status(errorResponse.getStatusCode())
-                    .bodyValue(errorResponse.getBody())
-                    .flatMap(response -> response.writeTo(exchange, context));
-            });
-    }
-
-}
diff --git a/application/src/main/java/run/halo/app/security/authentication/twofactor/TotpAuthenticationSuccessHandler.java b/application/src/main/java/run/halo/app/security/authentication/twofactor/TotpAuthenticationSuccessHandler.java
new file mode 100644
index 0000000000..391bf16e9c
--- /dev/null
+++ b/application/src/main/java/run/halo/app/security/authentication/twofactor/TotpAuthenticationSuccessHandler.java
@@ -0,0 +1,29 @@
+package run.halo.app.security.authentication.twofactor;
+
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.web.server.WebFilterExchange;
+import org.springframework.security.web.server.authentication.RedirectServerAuthenticationSuccessHandler;
+import org.springframework.security.web.server.authentication.ServerAuthenticationSuccessHandler;
+import reactor.core.publisher.Mono;
+import run.halo.app.security.LoginHandlerEnhancer;
+
+@Slf4j
+public class TotpAuthenticationSuccessHandler implements ServerAuthenticationSuccessHandler {
+
+    private final LoginHandlerEnhancer loginEnhancer;
+
+    private final ServerAuthenticationSuccessHandler successHandler =
+        new RedirectServerAuthenticationSuccessHandler("/uc");
+
+    public TotpAuthenticationSuccessHandler(LoginHandlerEnhancer loginEnhancer) {
+        this.loginEnhancer = loginEnhancer;
+    }
+
+    @Override
+    public Mono<Void> onAuthenticationSuccess(WebFilterExchange webFilterExchange,
+        Authentication authentication) {
+        return loginEnhancer.onLoginSuccess(webFilterExchange.getExchange(), authentication)
+            .then(successHandler.onAuthenticationSuccess(webFilterExchange, authentication));
+    }
+}
diff --git a/application/src/main/java/run/halo/app/security/authentication/twofactor/TwoFactorAuthResponseHandler.java b/application/src/main/java/run/halo/app/security/authentication/twofactor/TwoFactorAuthResponseHandler.java
deleted file mode 100644
index a4216a4831..0000000000
--- a/application/src/main/java/run/halo/app/security/authentication/twofactor/TwoFactorAuthResponseHandler.java
+++ /dev/null
@@ -1,10 +0,0 @@
-package run.halo.app.security.authentication.twofactor;
-
-import org.springframework.web.server.ServerWebExchange;
-import reactor.core.publisher.Mono;
-
-public interface TwoFactorAuthResponseHandler {
-
-    Mono<Void> handle(ServerWebExchange exchange);
-
-}
diff --git a/application/src/main/java/run/halo/app/security/authentication/twofactor/TwoFactorAuthSecurityConfigurer.java b/application/src/main/java/run/halo/app/security/authentication/twofactor/TwoFactorAuthSecurityConfigurer.java
index d8dd6a770a..1799e12da9 100644
--- a/application/src/main/java/run/halo/app/security/authentication/twofactor/TwoFactorAuthSecurityConfigurer.java
+++ b/application/src/main/java/run/halo/app/security/authentication/twofactor/TwoFactorAuthSecurityConfigurer.java
@@ -1,15 +1,19 @@
 package run.halo.app.security.authentication.twofactor;
 
-import org.springframework.context.MessageSource;
+import static org.springframework.security.web.server.util.matcher.ServerWebExchangeMatchers.pathMatchers;
+
+import org.springframework.http.HttpMethod;
 import org.springframework.security.config.web.server.SecurityWebFiltersOrder;
 import org.springframework.security.config.web.server.ServerHttpSecurity;
+import org.springframework.security.web.server.authentication.AuthenticationWebFilter;
+import org.springframework.security.web.server.authentication.RedirectServerAuthenticationFailureHandler;
 import org.springframework.security.web.server.context.ServerSecurityContextRepository;
 import org.springframework.stereotype.Component;
-import org.springframework.web.reactive.function.server.ServerResponse;
 import run.halo.app.security.LoginHandlerEnhancer;
 import run.halo.app.security.authentication.SecurityConfigurer;
 import run.halo.app.security.authentication.twofactor.totp.TotpAuthService;
-import run.halo.app.security.authentication.twofactor.totp.TotpAuthenticationFilter;
+import run.halo.app.security.authentication.twofactor.totp.TotpAuthenticationManager;
+import run.halo.app.security.authentication.twofactor.totp.TotpCodeAuthenticationConverter;
 
 @Component
 public class TwoFactorAuthSecurityConfigurer implements SecurityConfigurer {
@@ -18,30 +22,33 @@ public class TwoFactorAuthSecurityConfigurer implements SecurityConfigurer {
 
     private final TotpAuthService totpAuthService;
 
-    private final ServerResponse.Context context;
-
-    private final MessageSource messageSource;
-
     private final LoginHandlerEnhancer loginHandlerEnhancer;
 
     public TwoFactorAuthSecurityConfigurer(
         ServerSecurityContextRepository securityContextRepository,
-        TotpAuthService totpAuthService,
-        ServerResponse.Context context,
-        MessageSource messageSource,
-        LoginHandlerEnhancer loginHandlerEnhancer
+        TotpAuthService totpAuthService, LoginHandlerEnhancer loginHandlerEnhancer
     ) {
         this.securityContextRepository = securityContextRepository;
         this.totpAuthService = totpAuthService;
-        this.context = context;
-        this.messageSource = messageSource;
         this.loginHandlerEnhancer = loginHandlerEnhancer;
     }
 
     @Override
     public void configure(ServerHttpSecurity http) {
-        var filter = new TotpAuthenticationFilter(securityContextRepository, totpAuthService,
-            context, messageSource, loginHandlerEnhancer);
-        http.addFilterAfter(filter, SecurityWebFiltersOrder.AUTHENTICATION);
+        var authManager = new TotpAuthenticationManager(totpAuthService);
+        var filter = new AuthenticationWebFilter(authManager);
+        filter.setRequiresAuthenticationMatcher(
+            pathMatchers(HttpMethod.POST, "/challenges/two-factor/totp")
+        );
+        filter.setSecurityContextRepository(securityContextRepository);
+        filter.setServerAuthenticationConverter(new TotpCodeAuthenticationConverter());
+        filter.setAuthenticationSuccessHandler(
+            new TotpAuthenticationSuccessHandler(loginHandlerEnhancer)
+        );
+        filter.setAuthenticationFailureHandler(
+            new RedirectServerAuthenticationFailureHandler("/challenges/two-factor/totp?error")
+        );
+        http.addFilterAt(filter, SecurityWebFiltersOrder.AUTHENTICATION);
     }
+
 }
diff --git a/application/src/main/java/run/halo/app/security/authentication/twofactor/TwoFactorAuthentication.java b/application/src/main/java/run/halo/app/security/authentication/twofactor/TwoFactorAuthentication.java
index 45a27e66b0..b9da3183ea 100644
--- a/application/src/main/java/run/halo/app/security/authentication/twofactor/TwoFactorAuthentication.java
+++ b/application/src/main/java/run/halo/app/security/authentication/twofactor/TwoFactorAuthentication.java
@@ -38,8 +38,8 @@ public Object getPrincipal() {
 
     @Override
     public boolean isAuthenticated() {
-        // return true for accessing anonymous resources
-        return true;
+        // for further authentication
+        return false;
     }
 
     public Authentication getPrevious() {
diff --git a/application/src/main/java/run/halo/app/security/authentication/twofactor/TwoFactorAuthorizationManager.java b/application/src/main/java/run/halo/app/security/authentication/twofactor/TwoFactorAuthorizationManager.java
index f716717a46..f61cb9390b 100644
--- a/application/src/main/java/run/halo/app/security/authentication/twofactor/TwoFactorAuthorizationManager.java
+++ b/application/src/main/java/run/halo/app/security/authentication/twofactor/TwoFactorAuthorizationManager.java
@@ -1,6 +1,5 @@
 package run.halo.app.security.authentication.twofactor;
 
-import java.net.URI;
 import org.springframework.security.authorization.AuthorizationDecision;
 import org.springframework.security.authorization.ReactiveAuthorizationManager;
 import org.springframework.security.core.Authentication;
@@ -10,27 +9,12 @@
 public class TwoFactorAuthorizationManager
     implements ReactiveAuthorizationManager<AuthorizationContext> {
 
-    private final ReactiveAuthorizationManager<AuthorizationContext> delegate;
-
-    private static final URI REDIRECT_LOCATION = URI.create("/console/login?2fa=totp");
-
-    public TwoFactorAuthorizationManager(
-        ReactiveAuthorizationManager<AuthorizationContext> delegate) {
-        this.delegate = delegate;
-    }
-
     @Override
     public Mono<AuthorizationDecision> check(Mono<Authentication> authentication,
         AuthorizationContext context) {
-        return authentication.flatMap(a -> {
-            Mono<AuthorizationDecision> checked = delegate.check(Mono.just(a), context);
-            if (a instanceof TwoFactorAuthentication) {
-                checked = checked.filter(AuthorizationDecision::isGranted)
-                    .switchIfEmpty(
-                        Mono.error(() -> new TwoFactorAuthRequiredException(REDIRECT_LOCATION)));
-            }
-            return checked;
-        });
+        return authentication.map(TwoFactorAuthentication.class::isInstance)
+            .defaultIfEmpty(false)
+            .map(AuthorizationDecision::new);
     }
 
 }
diff --git a/application/src/main/java/run/halo/app/security/authentication/twofactor/totp/TotpAuthenticationFilter.java b/application/src/main/java/run/halo/app/security/authentication/twofactor/totp/TotpAuthenticationFilter.java
deleted file mode 100644
index b2140007dd..0000000000
--- a/application/src/main/java/run/halo/app/security/authentication/twofactor/totp/TotpAuthenticationFilter.java
+++ /dev/null
@@ -1,137 +0,0 @@
-package run.halo.app.security.authentication.twofactor.totp;
-
-import static org.springframework.security.web.server.util.matcher.ServerWebExchangeMatchers.pathMatchers;
-
-import lombok.extern.slf4j.Slf4j;
-import org.apache.commons.lang3.StringUtils;
-import org.springframework.context.MessageSource;
-import org.springframework.http.HttpMethod;
-import org.springframework.security.authentication.ReactiveAuthenticationManager;
-import org.springframework.security.core.Authentication;
-import org.springframework.security.core.AuthenticationException;
-import org.springframework.security.core.CredentialsContainer;
-import org.springframework.security.core.context.ReactiveSecurityContextHolder;
-import org.springframework.security.core.context.SecurityContext;
-import org.springframework.security.web.server.authentication.AuthenticationWebFilter;
-import org.springframework.security.web.server.authentication.ServerAuthenticationConverter;
-import org.springframework.security.web.server.context.ServerSecurityContextRepository;
-import org.springframework.web.reactive.function.server.ServerResponse;
-import org.springframework.web.server.ServerWebExchange;
-import reactor.core.publisher.Mono;
-import run.halo.app.security.HaloUserDetails;
-import run.halo.app.security.LoginHandlerEnhancer;
-import run.halo.app.security.authentication.login.UsernamePasswordHandler;
-import run.halo.app.security.authentication.twofactor.TwoFactorAuthentication;
-
-@Slf4j
-public class TotpAuthenticationFilter extends AuthenticationWebFilter {
-
-    public TotpAuthenticationFilter(
-        ServerSecurityContextRepository securityContextRepository,
-        TotpAuthService totpAuthService,
-        ServerResponse.Context context,
-        MessageSource messageSource,
-        LoginHandlerEnhancer loginHandlerEnhancer
-    ) {
-        super(new TwoFactorAuthManager(totpAuthService));
-
-        setSecurityContextRepository(securityContextRepository);
-        setRequiresAuthenticationMatcher(pathMatchers(HttpMethod.POST, "/login/2fa/totp"));
-        setServerAuthenticationConverter(new TotpCodeAuthenticationConverter());
-
-        var handler = new UsernamePasswordHandler(context, messageSource, loginHandlerEnhancer);
-        setAuthenticationSuccessHandler(handler);
-        setAuthenticationFailureHandler(handler);
-    }
-
-    private static class TotpCodeAuthenticationConverter implements ServerAuthenticationConverter {
-
-        private final String codeParameter = "code";
-
-        @Override
-        public Mono<Authentication> convert(ServerWebExchange exchange) {
-            // Check the request is authenticated before.
-            return ReactiveSecurityContextHolder.getContext()
-                .map(SecurityContext::getAuthentication)
-                .filter(TwoFactorAuthentication.class::isInstance)
-                .switchIfEmpty(Mono.error(
-                    () -> new TwoFactorAuthException("MFA Authentication required.")))
-                .flatMap(authentication -> exchange.getFormData())
-                .handle((formData, sink) -> {
-                    var codeStr = formData.getFirst(codeParameter);
-                    if (StringUtils.isBlank(codeStr)) {
-                        sink.error(new TwoFactorAuthException("Empty code parameter."));
-                        return;
-                    }
-                    try {
-                        var code = Integer.parseInt(codeStr);
-                        sink.next(new TotpAuthenticationToken(code));
-                    } catch (NumberFormatException e) {
-                        sink.error(
-                            new TwoFactorAuthException("Invalid code parameter " + codeStr + '.'));
-                    }
-                });
-        }
-    }
-
-    private static class TwoFactorAuthException extends AuthenticationException {
-
-        public TwoFactorAuthException(String msg, Throwable cause) {
-            super(msg, cause);
-        }
-
-        public TwoFactorAuthException(String msg) {
-            super(msg);
-        }
-
-    }
-
-    private static class TwoFactorAuthManager implements ReactiveAuthenticationManager {
-
-        private final TotpAuthService totpAuthService;
-
-        private TwoFactorAuthManager(TotpAuthService totpAuthService) {
-            this.totpAuthService = totpAuthService;
-        }
-
-        @Override
-        public Mono<Authentication> authenticate(Authentication authentication) {
-            // it should be TotpAuthenticationToken
-            var code = (Integer) authentication.getCredentials();
-            log.debug("Got TOTP code {}", code);
-
-            // get user details
-            return ReactiveSecurityContextHolder.getContext()
-                .map(SecurityContext::getAuthentication)
-                .cast(TwoFactorAuthentication.class)
-                .map(TwoFactorAuthentication::getPrevious)
-                .flatMap(previousAuth -> {
-                    var principal = previousAuth.getPrincipal();
-                    if (!(principal instanceof HaloUserDetails user)) {
-                        return Mono.error(
-                            new TwoFactorAuthException("Invalid authentication principal.")
-                        );
-                    }
-                    var totpEncryptedSecret = user.getTotpEncryptedSecret();
-                    if (StringUtils.isBlank(totpEncryptedSecret)) {
-                        return Mono.error(
-                            new TwoFactorAuthException("TOTP secret not configured.")
-                        );
-                    }
-                    var rawSecret = totpAuthService.decryptSecret(totpEncryptedSecret);
-                    var validated = totpAuthService.validateTotp(rawSecret, code);
-                    if (!validated) {
-                        return Mono.error(new TwoFactorAuthException("Invalid TOTP code " + code));
-                    }
-                    if (log.isDebugEnabled()) {
-                        log.debug("TOTP authentication for {} with code {} successfully.",
-                            previousAuth.getName(), code);
-                    }
-                    if (previousAuth instanceof CredentialsContainer container) {
-                        container.eraseCredentials();
-                    }
-                    return Mono.just(previousAuth);
-                });
-        }
-    }
-}
diff --git a/application/src/main/java/run/halo/app/security/authentication/twofactor/totp/TotpAuthenticationManager.java b/application/src/main/java/run/halo/app/security/authentication/twofactor/totp/TotpAuthenticationManager.java
new file mode 100644
index 0000000000..e9fffb96f8
--- /dev/null
+++ b/application/src/main/java/run/halo/app/security/authentication/twofactor/totp/TotpAuthenticationManager.java
@@ -0,0 +1,69 @@
+package run.halo.app.security.authentication.twofactor.totp;
+
+import lombok.extern.slf4j.Slf4j;
+import org.apache.commons.lang3.StringUtils;
+import org.springframework.security.authentication.ReactiveAuthenticationManager;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.CredentialsContainer;
+import org.springframework.security.core.context.ReactiveSecurityContextHolder;
+import org.springframework.security.core.context.SecurityContext;
+import reactor.core.publisher.Mono;
+import run.halo.app.security.HaloUserDetails;
+import run.halo.app.security.authentication.exception.TwoFactorAuthException;
+import run.halo.app.security.authentication.twofactor.TwoFactorAuthentication;
+
+/**
+ * TOTP authentication manager.
+ *
+ * @author johnniang
+ */
+@Slf4j
+public class TotpAuthenticationManager implements ReactiveAuthenticationManager {
+
+    private final TotpAuthService totpAuthService;
+
+    public TotpAuthenticationManager(TotpAuthService totpAuthService) {
+        this.totpAuthService = totpAuthService;
+    }
+
+    @Override
+    public Mono<Authentication> authenticate(Authentication authentication) {
+        // it should be TotpAuthenticationToken
+        var code = (Integer) authentication.getCredentials();
+        log.debug("Got TOTP code {}", code);
+
+        // get user details
+        return ReactiveSecurityContextHolder.getContext()
+            .map(SecurityContext::getAuthentication)
+            .cast(TwoFactorAuthentication.class)
+            .map(TwoFactorAuthentication::getPrevious)
+            .flatMap(previousAuth -> {
+                var principal = previousAuth.getPrincipal();
+                if (!(principal instanceof HaloUserDetails user)) {
+                    return Mono.error(
+                        new TwoFactorAuthException("Invalid authentication principal.")
+                    );
+                }
+                var totpEncryptedSecret = user.getTotpEncryptedSecret();
+                if (StringUtils.isBlank(totpEncryptedSecret)) {
+                    return Mono.error(
+                        new TwoFactorAuthException("TOTP secret not configured.")
+                    );
+                }
+                var rawSecret = totpAuthService.decryptSecret(totpEncryptedSecret);
+                var validated = totpAuthService.validateTotp(rawSecret, code);
+                if (!validated) {
+                    return Mono.error(new TwoFactorAuthException("Invalid TOTP code " + code));
+                }
+                if (log.isDebugEnabled()) {
+                    log.debug(
+                        "TOTP authentication for {} with code {} successfully.",
+                        previousAuth.getName(), code);
+                }
+                if (previousAuth instanceof CredentialsContainer container) {
+                    container.eraseCredentials();
+                }
+                return Mono.just(previousAuth);
+            });
+    }
+}
diff --git a/application/src/main/java/run/halo/app/security/authentication/twofactor/totp/TotpCodeAuthenticationConverter.java b/application/src/main/java/run/halo/app/security/authentication/twofactor/totp/TotpCodeAuthenticationConverter.java
new file mode 100644
index 0000000000..9adc9061f7
--- /dev/null
+++ b/application/src/main/java/run/halo/app/security/authentication/twofactor/totp/TotpCodeAuthenticationConverter.java
@@ -0,0 +1,52 @@
+package run.halo.app.security.authentication.twofactor.totp;
+
+import org.apache.commons.lang3.StringUtils;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.context.ReactiveSecurityContextHolder;
+import org.springframework.security.core.context.SecurityContext;
+import org.springframework.security.web.server.authentication.ServerAuthenticationConverter;
+import org.springframework.web.server.ServerWebExchange;
+import reactor.core.publisher.Mono;
+import run.halo.app.security.authentication.exception.TwoFactorAuthException;
+import run.halo.app.security.authentication.twofactor.TwoFactorAuthentication;
+
+/**
+ * TOTP code authentication converter.
+ *
+ * @author johnniang
+ */
+public class TotpCodeAuthenticationConverter implements ServerAuthenticationConverter {
+
+    private final String codeParameter = "code";
+
+    @Override
+    public Mono<Authentication> convert(ServerWebExchange exchange) {
+        // Check the request is authenticated before.
+        return ReactiveSecurityContextHolder.getContext()
+            .map(SecurityContext::getAuthentication)
+            .filter(TwoFactorAuthentication.class::isInstance)
+            .switchIfEmpty(Mono.error(
+                () -> new TwoFactorAuthException(
+                    "MFA Authentication required."
+                ))
+            )
+            .flatMap(authentication -> exchange.getFormData())
+            .handle((formData, sink) -> {
+                var codeStr = formData.getFirst(codeParameter);
+                if (StringUtils.isBlank(codeStr)) {
+                    sink.error(new TwoFactorAuthException(
+                        "Empty code parameter."
+                    ));
+                    return;
+                }
+                try {
+                    var code = Integer.parseInt(codeStr);
+                    sink.next(new TotpAuthenticationToken(code));
+                } catch (NumberFormatException e) {
+                    sink.error(new TwoFactorAuthException(
+                        "Invalid code parameter " + codeStr + '.')
+                    );
+                }
+            });
+    }
+}
diff --git a/application/src/main/java/run/halo/app/security/authorization/RequestInfoAuthorizationManager.java b/application/src/main/java/run/halo/app/security/authorization/RequestInfoAuthorizationManager.java
index d01fef7da9..d55fafe445 100644
--- a/application/src/main/java/run/halo/app/security/authorization/RequestInfoAuthorizationManager.java
+++ b/application/src/main/java/run/halo/app/security/authorization/RequestInfoAuthorizationManager.java
@@ -2,7 +2,6 @@
 
 import java.util.List;
 import lombok.extern.slf4j.Slf4j;
-import org.springframework.http.server.reactive.ServerHttpRequest;
 import org.springframework.security.authorization.AuthorizationDecision;
 import org.springframework.security.authorization.ReactiveAuthorizationManager;
 import org.springframework.security.core.Authentication;
@@ -12,7 +11,7 @@
 
 @Slf4j
 public class RequestInfoAuthorizationManager
-        implements ReactiveAuthorizationManager<AuthorizationContext> {
+    implements ReactiveAuthorizationManager<AuthorizationContext> {
 
     private final AuthorizationRuleResolver ruleResolver;
 
@@ -22,19 +21,19 @@ public RequestInfoAuthorizationManager(RoleService roleService) {
 
     @Override
     public Mono<AuthorizationDecision> check(Mono<Authentication> authentication,
-                                             AuthorizationContext context) {
-        ServerHttpRequest request = context.getExchange().getRequest();
-        RequestInfo requestInfo = RequestInfoFactory.INSTANCE.newRequestInfo(request);
-
-        return authentication.flatMap(auth -> this.ruleResolver.visitRules(auth, requestInfo)
-                .doOnNext(visitor -> showErrorMessage(visitor.getErrors()))
-                .filter(AuthorizingVisitor::isAllowed)
-                .map(visitor -> new AuthorizationDecision(isGranted(auth)))
-                .switchIfEmpty(Mono.fromSupplier(() -> new AuthorizationDecision(false))));
-    }
-
-    private boolean isGranted(Authentication authentication) {
-        return authentication != null && authentication.isAuthenticated();
+        AuthorizationContext context) {
+        var request = context.getExchange().getRequest();
+        var requestInfo = RequestInfoFactory.INSTANCE.newRequestInfo(request);
+
+        // We allow anonymous user to access some resources
+        // so we don't invoke AuthenticationTrustResolver.isAuthenticated
+        // to check if the user is authenticated
+        return authentication.filter(Authentication::isAuthenticated)
+            .flatMap(auth -> ruleResolver.visitRules(auth, requestInfo))
+            .doOnNext(visitor -> showErrorMessage(visitor.getErrors()))
+            .map(AuthorizingVisitor::isAllowed)
+            .defaultIfEmpty(false)
+            .map(AuthorizationDecision::new);
     }
 
     private void showErrorMessage(List<Throwable> errors) {
diff --git a/application/src/main/java/run/halo/app/security/preauth/PreAuthLoginEndpoint.java b/application/src/main/java/run/halo/app/security/preauth/PreAuthLoginEndpoint.java
new file mode 100644
index 0000000000..aaa5e8e764
--- /dev/null
+++ b/application/src/main/java/run/halo/app/security/preauth/PreAuthLoginEndpoint.java
@@ -0,0 +1,94 @@
+package run.halo.app.security.preauth;
+
+import static org.springframework.web.reactive.function.server.RequestPredicates.path;
+
+import java.util.Base64;
+import java.util.Map;
+import java.util.Objects;
+import java.util.Optional;
+import org.apache.commons.lang3.StringUtils;
+import org.springframework.context.annotation.Bean;
+import org.springframework.stereotype.Component;
+import org.springframework.web.reactive.function.server.RouterFunction;
+import org.springframework.web.reactive.function.server.RouterFunctions;
+import org.springframework.web.reactive.function.server.ServerResponse;
+import org.springframework.web.server.ServerWebInputException;
+import reactor.core.publisher.Mono;
+import run.halo.app.core.extension.AuthProvider;
+import run.halo.app.infra.actuator.GlobalInfoService;
+import run.halo.app.plugin.PluginConst;
+import run.halo.app.security.AuthProviderService;
+import run.halo.app.security.authentication.CryptoService;
+
+/**
+ * Pre-auth login endpoints.
+ *
+ * @author johnniang
+ * @since 2.20.0
+ */
+@Component
+class PreAuthLoginEndpoint {
+
+    private final CryptoService cryptoService;
+
+    private final GlobalInfoService globalInfoService;
+
+    private final AuthProviderService authProviderService;
+
+    PreAuthLoginEndpoint(CryptoService cryptoService, GlobalInfoService globalInfoService,
+        AuthProviderService authProviderService) {
+        this.cryptoService = cryptoService;
+        this.globalInfoService = globalInfoService;
+        this.authProviderService = authProviderService;
+    }
+
+    @Bean
+    RouterFunction<ServerResponse> preAuthLoginEndpoints() {
+        return RouterFunctions.nest(path("/login"), RouterFunctions.route()
+            .GET("", request -> {
+                var exchange = request.exchange();
+                var contextPath = exchange.getRequest().getPath().contextPath().value();
+                var publicKey = cryptoService.readPublicKey()
+                    .map(key -> Base64.getEncoder().encodeToString(key));
+                var globalInfo = globalInfoService.getGlobalInfo().cache();
+                var loginMethod = request.queryParam("method").orElse("local");
+                var authProviders = authProviderService.getEnabledProviders().cache();
+                var authProvider = authProviders
+                    .filter(ap -> Objects.equals(loginMethod, ap.getMetadata().getName()))
+                    .next()
+                    .switchIfEmpty(Mono.error(() -> new ServerWebInputException(
+                        "Invalid login method " + loginMethod)
+                    ))
+                    .cache();
+
+                var fragmentTemplateName = authProvider.map(ap -> {
+                    var templateName = "login_" + ap.getMetadata().getName();
+                    return Optional.ofNullable(ap.getMetadata().getLabels())
+                        .map(labels -> labels.get(PluginConst.PLUGIN_NAME_LABEL_NAME))
+                        .filter(StringUtils::isNotBlank)
+                        .map(pluginName -> String.join(":", "plugin", pluginName, templateName))
+                        .orElse(templateName);
+                });
+
+                var socialAuthProviders = authProviders
+                    .filter(ap -> !AuthProvider.AuthType.FORM.equals(ap.getSpec().getAuthType()))
+                    .cache();
+                var formAuthProviders = authProviders
+                    .filter(ap -> AuthProvider.AuthType.FORM.equals(ap.getSpec().getAuthType()))
+                    .filter(ap -> !Objects.equals(loginMethod, ap.getMetadata().getName()))
+                    .cache();
+
+                return ServerResponse.ok().render("login", Map.of(
+                    "action", contextPath + "/login",
+                    "publicKey", publicKey,
+                    "globalInfo", globalInfo,
+                    "authProvider", authProvider,
+                    "fragmentTemplateName", fragmentTemplateName,
+                    "socialAuthProviders", socialAuthProviders,
+                    "formAuthProviders", formAuthProviders
+                    // TODO Add more models here
+                ));
+            })
+            .build());
+    }
+}
diff --git a/application/src/main/java/run/halo/app/security/preauth/PreAuthPasswordResetEndpoint.java b/application/src/main/java/run/halo/app/security/preauth/PreAuthPasswordResetEndpoint.java
new file mode 100644
index 0000000000..dc49b05c90
--- /dev/null
+++ b/application/src/main/java/run/halo/app/security/preauth/PreAuthPasswordResetEndpoint.java
@@ -0,0 +1,186 @@
+package run.halo.app.security.preauth;
+
+import static org.springframework.web.reactive.function.server.RequestPredicates.contentType;
+import static org.springframework.web.reactive.function.server.RequestPredicates.path;
+
+import io.github.resilience4j.ratelimiter.RateLimiterRegistry;
+import io.github.resilience4j.ratelimiter.RequestNotPermitted;
+import io.github.resilience4j.reactor.ratelimiter.operator.RateLimiterOperator;
+import java.net.URI;
+import java.util.Locale;
+import java.util.Map;
+import java.util.Objects;
+import java.util.Optional;
+import org.apache.commons.lang3.StringUtils;
+import org.springframework.context.MessageSource;
+import org.springframework.context.annotation.Bean;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.MediaType;
+import org.springframework.http.server.reactive.ServerHttpRequest;
+import org.springframework.stereotype.Component;
+import org.springframework.web.reactive.function.server.RouterFunction;
+import org.springframework.web.reactive.function.server.RouterFunctions;
+import org.springframework.web.reactive.function.server.ServerResponse;
+import run.halo.app.core.user.service.EmailPasswordRecoveryService;
+import run.halo.app.core.user.service.InvalidResetTokenException;
+import run.halo.app.infra.exception.RateLimitExceededException;
+import run.halo.app.infra.utils.IpAddressUtils;
+
+/**
+ * Pre-auth password reset endpoint.
+ *
+ * @author johnniang
+ * @since 2.20.0
+ */
+@Component
+class PreAuthPasswordResetEndpoint {
+
+    private final EmailPasswordRecoveryService emailPasswordRecoveryService;
+
+    private final MessageSource messageSource;
+
+    private final RateLimiterRegistry rateLimiterRegistry;
+
+    public PreAuthPasswordResetEndpoint(EmailPasswordRecoveryService emailPasswordRecoveryService,
+        MessageSource messageSource,
+        RateLimiterRegistry rateLimiterRegistry
+    ) {
+        this.emailPasswordRecoveryService = emailPasswordRecoveryService;
+        this.messageSource = messageSource;
+        this.rateLimiterRegistry = rateLimiterRegistry;
+    }
+
+    @Bean
+    RouterFunction<ServerResponse> preAuthPasswordResetEndpoints() {
+        return RouterFunctions.nest(path("/password-reset"), RouterFunctions.route()
+            .GET("", request -> ServerResponse.ok().render("password-reset"))
+            .GET("/{resetToken}",
+                request -> {
+                    var token = request.pathVariable("resetToken");
+                    return emailPasswordRecoveryService.getValidResetToken(token)
+                        .flatMap(resetToken -> {
+                            // TODO Check the 2FA of the user
+                            return ServerResponse.ok().render("password-reset-link", Map.of(
+                                "username", resetToken.username()
+                            ));
+                        })
+                        .onErrorResume(InvalidResetTokenException.class,
+                            e -> ServerResponse.status(HttpStatus.FOUND)
+                                .location(URI.create("/password-reset"))
+                                .build()
+                                .transformDeferred(rateLimiterForPasswordResetVerification(
+                                    request.exchange().getRequest()
+                                ))
+                                .onErrorMap(
+                                    RequestNotPermitted.class, RateLimitExceededException::new
+                                )
+                        );
+                }
+            )
+            .POST("/{resetToken}", request -> {
+                var token = request.pathVariable("resetToken");
+                return request.formData()
+                    .flatMap(formData -> {
+                        var locale = Optional.ofNullable(
+                                request.exchange().getLocaleContext().getLocale()
+                            )
+                            .orElseGet(Locale::getDefault);
+                        var password = formData.getFirst("password");
+                        var confirmPassword = formData.getFirst("confirmPassword");
+                        if (StringUtils.isBlank(password)) {
+                            var error = messageSource.getMessage(
+                                "passwordReset.password.blank",
+                                null,
+                                "Password can't be blank",
+                                locale
+                            );
+                            return ServerResponse.ok().render("password-reset-link", Map.of(
+                                "error", error
+                            ));
+                        }
+                        if (!Objects.equals(password, confirmPassword)) {
+                            var error = messageSource.getMessage(
+                                "passwordReset.confirmPassword.mismatch",
+                                null,
+                                "Password and confirm password mismatch",
+                                locale
+                            );
+                            return ServerResponse.ok().render("password-reset-link", Map.of(
+                                "error", error
+                            ));
+                        }
+                        return emailPasswordRecoveryService.changePassword(password, token)
+                            .then(ServerResponse.status(HttpStatus.FOUND)
+                                .location(URI.create("/login?passwordReset"))
+                                .build()
+                            )
+                            .onErrorResume(InvalidResetTokenException.class, e -> {
+                                var error = messageSource.getMessage(
+                                    "passwordReset.resetToken.invalid",
+                                    null,
+                                    "Invalid reset token",
+                                    locale
+                                );
+                                return ServerResponse.ok().render("password-reset-link", Map.of(
+                                    "error", error
+                                )).transformDeferred(rateLimiterForPasswordResetVerification(
+                                    request.exchange().getRequest()
+                                )).onErrorMap(
+                                    RequestNotPermitted.class, RateLimitExceededException::new
+                                );
+                            });
+                    });
+            })
+            .POST("", contentType(MediaType.APPLICATION_FORM_URLENCODED),
+                request -> {
+                    // get username and email
+                    return request.formData()
+                        .flatMap(formData -> {
+                            var locale = Optional.ofNullable(
+                                    request.exchange().getLocaleContext().getLocale()
+                                )
+                                .orElseGet(Locale::getDefault);
+                            var email = formData.getFirst("email");
+                            if (StringUtils.isBlank(email)) {
+                                var error = messageSource.getMessage(
+                                    "passwordReset.email.blank",
+                                    null,
+                                    "Email can't be blank",
+                                    locale
+                                );
+                                return ServerResponse.ok().render("password-reset", Map.of(
+                                    "error", error
+                                ));
+                            }
+                            return emailPasswordRecoveryService.sendPasswordResetEmail(email)
+                                .then(ServerResponse.ok().render("password-reset", Map.of(
+                                    "sent", true
+                                )))
+                                .transformDeferred(rateLimiterForSendPasswordResetEmail(
+                                    request.exchange().getRequest()
+                                ))
+                                .onErrorMap(
+                                    RequestNotPermitted.class, RateLimitExceededException::new
+                                );
+                        });
+                })
+            .build());
+    }
+
+
+    <T> RateLimiterOperator<T> rateLimiterForSendPasswordResetEmail(ServerHttpRequest request) {
+        var clientIp = IpAddressUtils.getClientIp(request);
+        var rateLimiterKey = "send-password-reset-email-from-" + clientIp;
+        var rateLimiter =
+            rateLimiterRegistry.rateLimiter(rateLimiterKey, "send-password-reset-email");
+        return RateLimiterOperator.of(rateLimiter);
+    }
+
+    <T> RateLimiterOperator<T> rateLimiterForPasswordResetVerification(ServerHttpRequest request) {
+        var clientIp = IpAddressUtils.getClientIp(request);
+        var rateLimiterKey = "password-reset-email-verify-from-" + clientIp;
+        var rateLimiter =
+            rateLimiterRegistry.rateLimiter(rateLimiterKey, "password-reset-verification");
+        return RateLimiterOperator.of(rateLimiter);
+    }
+}
diff --git a/application/src/main/java/run/halo/app/security/preauth/PreAuthSignUpEndpoint.java b/application/src/main/java/run/halo/app/security/preauth/PreAuthSignUpEndpoint.java
new file mode 100644
index 0000000000..39c0bfc432
--- /dev/null
+++ b/application/src/main/java/run/halo/app/security/preauth/PreAuthSignUpEndpoint.java
@@ -0,0 +1,157 @@
+package run.halo.app.security.preauth;
+
+import static org.springframework.http.MediaType.APPLICATION_FORM_URLENCODED;
+import static org.springframework.http.MediaType.APPLICATION_JSON;
+import static org.springframework.web.reactive.function.server.RequestPredicates.contentType;
+import static org.springframework.web.reactive.function.server.RequestPredicates.path;
+
+import io.github.resilience4j.ratelimiter.RateLimiterRegistry;
+import io.github.resilience4j.ratelimiter.RequestNotPermitted;
+import io.github.resilience4j.reactor.ratelimiter.operator.RateLimiterOperator;
+import jakarta.validation.constraints.Email;
+import jakarta.validation.constraints.NotBlank;
+import java.net.URI;
+import lombok.Data;
+import org.springframework.context.annotation.Bean;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.server.reactive.ServerHttpRequest;
+import org.springframework.stereotype.Component;
+import org.springframework.validation.BeanPropertyBindingResult;
+import org.springframework.validation.FieldError;
+import org.springframework.validation.Validator;
+import org.springframework.web.reactive.function.server.RouterFunction;
+import org.springframework.web.reactive.function.server.RouterFunctions;
+import org.springframework.web.reactive.function.server.ServerResponse;
+import reactor.core.publisher.Mono;
+import run.halo.app.core.user.service.EmailVerificationService;
+import run.halo.app.core.user.service.SignUpData;
+import run.halo.app.core.user.service.UserService;
+import run.halo.app.infra.actuator.GlobalInfoService;
+import run.halo.app.infra.exception.DuplicateNameException;
+import run.halo.app.infra.exception.EmailVerificationFailed;
+import run.halo.app.infra.exception.RateLimitExceededException;
+import run.halo.app.infra.exception.RequestBodyValidationException;
+import run.halo.app.infra.utils.IpAddressUtils;
+
+/**
+ * Pre-auth sign up endpoint.
+ *
+ * @author johnniang
+ * @since 2.20.0
+ */
+@Component
+class PreAuthSignUpEndpoint {
+
+    private final GlobalInfoService globalInfoService;
+
+    private final Validator validator;
+
+    private final UserService userService;
+
+    private final EmailVerificationService emailVerificationService;
+
+    private final RateLimiterRegistry rateLimiterRegistry;
+
+    PreAuthSignUpEndpoint(GlobalInfoService globalInfoService,
+        Validator validator,
+        UserService userService,
+        EmailVerificationService emailVerificationService,
+        RateLimiterRegistry rateLimiterRegistry) {
+        this.globalInfoService = globalInfoService;
+        this.validator = validator;
+        this.userService = userService;
+        this.emailVerificationService = emailVerificationService;
+        this.rateLimiterRegistry = rateLimiterRegistry;
+    }
+
+    @Bean
+    RouterFunction<ServerResponse> preAuthSignUpEndpoints() {
+        return RouterFunctions.nest(path("/signup"), RouterFunctions.route()
+            .GET("", request -> {
+                var signUpData = new SignUpData();
+                var bindingResult = new BeanPropertyBindingResult(signUpData, "form");
+                var model = bindingResult.getModel();
+                model.put("globalInfo", globalInfoService.getGlobalInfo());
+                return ServerResponse.ok().render("signup", model);
+            })
+            .POST(
+                "",
+                contentType(APPLICATION_FORM_URLENCODED),
+                request -> request.formData()
+                    .map(SignUpData::of)
+                    .flatMap(signUpData -> {
+                        // sign up
+                        var bindingResult = new BeanPropertyBindingResult(signUpData, "form");
+                        var model = bindingResult.getModel();
+                        model.put("globalInfo", globalInfoService.getGlobalInfo());
+                        validator.validate(signUpData, bindingResult);
+                        if (bindingResult.hasErrors()) {
+                            return ServerResponse.ok().render("signup", model);
+                        }
+                        return userService.signUp(signUpData)
+                            .flatMap(user -> ServerResponse.status(HttpStatus.FOUND)
+                                .location(URI.create("/login?signup"))
+                                .build()
+                            )
+                            .doOnError(t -> {
+                                model.put("error", "unknown");
+                                model.put("errorMessage", t.getMessage());
+                            })
+                            .doOnError(EmailVerificationFailed.class,
+                                e -> {
+                                    bindingResult.addError(new FieldError("form",
+                                        "emailCode",
+                                        signUpData.getEmailCode(),
+                                        true,
+                                        // TODO Refine i18n
+                                        new String[] {"signup.error.email-captcha.invalid"},
+                                        null,
+                                        "Invalid Email Code"));
+                                }
+                            )
+                            .doOnError(RateLimitExceededException.class,
+                                e -> model.put("error", "rate-limit-exceeded")
+                            )
+                            .doOnError(DuplicateNameException.class,
+                                e -> model.put("error", "duplicate-username")
+                            )
+                            .onErrorResume(e -> ServerResponse.ok().render("signup", model));
+                    })
+            )
+            .POST("/send-email-code", contentType(APPLICATION_JSON),
+                request -> request.bodyToMono(SendEmailCodeBody.class)
+                    .flatMap(body -> {
+                        var bindingResult = new BeanPropertyBindingResult(body, "body");
+                        validator.validate(body, bindingResult);
+                        if (bindingResult.hasErrors()) {
+                            return Mono.error(new RequestBodyValidationException(bindingResult));
+                        }
+                        var email = body.getEmail();
+                        return emailVerificationService.sendRegisterVerificationCode(email)
+                            .transformDeferred(
+                                rateLimiterForSendingEmailCode(request.exchange().getRequest())
+                            )
+                            .onErrorMap(RequestNotPermitted.class, RateLimitExceededException::new);
+                    })
+                    .then(ServerResponse.accepted().build()))
+            .build());
+    }
+
+    private <T> RateLimiterOperator<T> rateLimiterForSendingEmailCode(ServerHttpRequest request) {
+        var clientIp = IpAddressUtils.getClientIp(request);
+        var rateLimiterKey = "send-email-code-for-signing-up-from-" + clientIp;
+        var rateLimiter =
+            rateLimiterRegistry.rateLimiter(rateLimiterKey, "send-email-verification-code");
+        return RateLimiterOperator.of(rateLimiter);
+    }
+
+
+    @Data
+    public static class SendEmailCodeBody {
+
+        @Email
+        @NotBlank
+        String email;
+
+    }
+}
diff --git a/application/src/main/java/run/halo/app/security/preauth/PreAuthTwoFactorEndpoint.java b/application/src/main/java/run/halo/app/security/preauth/PreAuthTwoFactorEndpoint.java
new file mode 100644
index 0000000000..8fea7bdd14
--- /dev/null
+++ b/application/src/main/java/run/halo/app/security/preauth/PreAuthTwoFactorEndpoint.java
@@ -0,0 +1,27 @@
+package run.halo.app.security.preauth;
+
+import org.springframework.context.annotation.Bean;
+import org.springframework.stereotype.Component;
+import org.springframework.web.reactive.function.server.RouterFunction;
+import org.springframework.web.reactive.function.server.RouterFunctions;
+import org.springframework.web.reactive.function.server.ServerResponse;
+
+/**
+ * Pre-auth two-factor endpoints.
+ *
+ * @author johnniang
+ * @since 2.20.0
+ */
+@Component
+class PreAuthTwoFactorEndpoint {
+
+    @Bean
+    RouterFunction<ServerResponse> preAuthTwoFactorEndpoints() {
+        return RouterFunctions.route()
+            .GET("/challenges/two-factor/totp",
+                request -> ServerResponse.ok().render("challenges/two-factor/totp")
+            )
+            .build();
+    }
+
+}
diff --git a/application/src/main/java/run/halo/app/theme/finders/vo/SiteSettingVo.java b/application/src/main/java/run/halo/app/theme/finders/vo/SiteSettingVo.java
index 558dbb3c50..de56c2b430 100644
--- a/application/src/main/java/run/halo/app/theme/finders/vo/SiteSettingVo.java
+++ b/application/src/main/java/run/halo/app/theme/finders/vo/SiteSettingVo.java
@@ -73,7 +73,7 @@ public static SiteSettingVo from(ConfigMap configMap) {
             .subtitle(basicSetting.getSubtitle())
             .logo(basicSetting.getLogo())
             .favicon(basicSetting.getFavicon())
-            .allowRegistration(userSetting.getAllowRegistration())
+            .allowRegistration(userSetting.isAllowRegistration())
             .post(PostSetting.builder()
                 .postPageSize(postSetting.getPostPageSize())
                 .archivePageSize(postSetting.getArchivePageSize())
diff --git a/application/src/main/java/run/halo/app/theme/message/ThemeMessageResolutionUtils.java b/application/src/main/java/run/halo/app/theme/message/ThemeMessageResolutionUtils.java
index d6943dfb9d..db89e286bc 100644
--- a/application/src/main/java/run/halo/app/theme/message/ThemeMessageResolutionUtils.java
+++ b/application/src/main/java/run/halo/app/theme/message/ThemeMessageResolutionUtils.java
@@ -9,7 +9,6 @@
 import java.io.InputStream;
 import java.io.InputStreamReader;
 import java.io.Reader;
-import java.text.MessageFormat;
 import java.util.ArrayList;
 import java.util.Collections;
 import java.util.HashMap;
@@ -32,7 +31,6 @@ public class ThemeMessageResolutionUtils {
     private static final Map<String, String> EMPTY_MESSAGES = Collections.emptyMap();
     private static final String PROPERTIES_FILE_EXTENSION = ".properties";
     private static final String LOCATION = "i18n";
-    private static final Object[] EMPTY_MESSAGE_PARAMETERS = new Object[0];
 
     @Nullable
     private static Reader messageReader(String messageResourceName, ThemeContext theme)
@@ -96,91 +94,6 @@ public static Map<String, String> resolveMessagesForTemplate(final Locale locale
         return Collections.unmodifiableMap(combinedMessages);
     }
 
-    public static Map<String, String> resolveMessagesForOrigin(final Class<?> origin,
-        final Locale locale) {
-
-        final Map<String, String> combinedMessages = new HashMap<>(20);
-
-        Class<?> currentClass = origin;
-        combinedMessages.putAll(resolveMessagesForSpecificClass(currentClass, locale));
-
-        while (!currentClass.getSuperclass().equals(Object.class)) {
-
-            currentClass = currentClass.getSuperclass();
-            final Map<String, String> messagesForCurrentClass =
-                resolveMessagesForSpecificClass(currentClass, locale);
-            for (final String messageKey : messagesForCurrentClass.keySet()) {
-                if (!combinedMessages.containsKey(messageKey)) {
-                    combinedMessages.put(messageKey, messagesForCurrentClass.get(messageKey));
-                }
-            }
-        }
-
-        return Collections.unmodifiableMap(combinedMessages);
-
-    }
-
-
-    private static Map<String, String> resolveMessagesForSpecificClass(
-        final Class<?> originClass, final Locale locale) {
-
-
-        final ClassLoader originClassLoader = originClass.getClassLoader();
-
-        // Compute all the resource names we should use: *_gl_ES-gheada.properties, *_gl_ES
-        // .properties, _gl.properties...
-        // The order here is important: as we will let values from more specific files
-        // overwrite those in less specific,
-        // (e.g. a value for gl_ES will have more precedence than a value for gl). So we will
-        // iterate these resource
-        // names from less specific to more specific.
-        final List<String> messageResourceNames =
-            computeMessageResourceNamesFromBase(locale);
-
-        // Build the combined messages
-        Map<String, String> combinedMessages = null;
-        for (final String messageResourceName : messageResourceNames) {
-
-            final InputStream inputStream =
-                originClassLoader.getResourceAsStream(messageResourceName);
-            if (inputStream != null) {
-
-                // At this point we cannot be specified a character encoding (that's only for
-                // template resolution),
-                // so we will use the standard character encoding for .properties files,
-                // which is ISO-8859-1
-                // (see Properties#load(InputStream) javadoc).
-                final InputStreamReader messageResourceReader =
-                    new InputStreamReader(inputStream);
-
-                final Properties messageProperties =
-                    readMessagesResource(messageResourceReader);
-                if (messageProperties != null && !messageProperties.isEmpty()) {
-
-                    if (combinedMessages == null) {
-                        combinedMessages = new HashMap<>(20);
-                    }
-
-                    for (final Map.Entry<Object, Object> propertyEntry :
-                        messageProperties.entrySet()) {
-                        combinedMessages.put((String) propertyEntry.getKey(),
-                            (String) propertyEntry.getValue());
-                    }
-
-                }
-
-            }
-
-        }
-
-        if (combinedMessages == null) {
-            return EMPTY_MESSAGES;
-        }
-
-        return Collections.unmodifiableMap(combinedMessages);
-    }
-
-
     private static List<String> computeMessageResourceNamesFromBase(final Locale locale) {
 
         final List<String> resourceNames = new ArrayList<>(5);
@@ -229,33 +142,4 @@ private static Properties readMessagesResource(final Reader propertiesReader) {
         return properties;
     }
 
-    public static String formatMessage(final Locale locale, final String message,
-        final Object[] messageParameters) {
-        if (message == null) {
-            return null;
-        }
-        if (!isFormatCandidate(message)) {
-            // trying to avoid creating MessageFormat if not needed
-            return message;
-        }
-        final MessageFormat messageFormat = new MessageFormat(message, locale);
-        return messageFormat.format(
-            (messageParameters != null ? messageParameters : EMPTY_MESSAGE_PARAMETERS));
-    }
-
-    /*
-     * This will allow us to determine whether a message might actually contain parameter
-     * placeholders.
-     */
-    private static boolean isFormatCandidate(final String message) {
-        char c;
-        int n = message.length();
-        while (n-- != 0) {
-            c = message.charAt(n);
-            if (c == '}' || c == '\'') {
-                return true;
-            }
-        }
-        return false;
-    }
 }
diff --git a/application/src/main/java/run/halo/app/theme/message/ThemeMessageResolver.java b/application/src/main/java/run/halo/app/theme/message/ThemeMessageResolver.java
index 18c9819fc6..17f141108e 100644
--- a/application/src/main/java/run/halo/app/theme/message/ThemeMessageResolver.java
+++ b/application/src/main/java/run/halo/app/theme/message/ThemeMessageResolver.java
@@ -33,13 +33,4 @@ protected Map<String, String> resolveMessagesForTemplate(String template,
         return Collections.unmodifiableMap(properties);
     }
 
-    @Override
-    protected Map<String, String> resolveMessagesForOrigin(Class<?> origin, Locale locale) {
-        return ThemeMessageResolutionUtils.resolveMessagesForOrigin(origin, locale);
-    }
-
-    @Override
-    protected String formatMessage(Locale locale, String message, Object[] messageParameters) {
-        return ThemeMessageResolutionUtils.formatMessage(locale, message, messageParameters);
-    }
 }
diff --git a/application/src/main/resources/application.yaml b/application/src/main/resources/application.yaml
index 681a94adc3..b2869a3e11 100644
--- a/application/src/main/resources/application.yaml
+++ b/application/src/main/resources/application.yaml
@@ -96,7 +96,11 @@ resilience4j.ratelimiter:
       limitForPeriod: 3
       limitRefreshPeriod: 1h
       timeoutDuration: 0s
-    send-reset-password-email:
-      limitForPeriod: 2
+    send-password-reset-email:
+      limitForPeriod: 10
+      limitRefreshPeriod: 1m
+      timeoutDuration: 0s
+    password-reset-verification:
+      limitForPeriod: 10
       limitRefreshPeriod: 1m
       timeoutDuration: 0s
diff --git a/application/src/main/resources/extensions/authproviders.yaml b/application/src/main/resources/extensions/authproviders.yaml
index 58e3369c6f..87cad00e27 100644
--- a/application/src/main/resources/extensions/authproviders.yaml
+++ b/application/src/main/resources/extensions/authproviders.yaml
@@ -9,8 +9,10 @@ metadata:
     - system-protection
 spec:
   displayName: Local
-  enabled: true
   description: Built-in authentication for Halo.
-  logo: https://www.halo.run/logo
+  logo: /images/logo.png
   website: https://www.halo.run
   authenticationUrl: /login
+  method: post
+  rememberMeSupport: true
+  authType: form
diff --git a/application/src/test/java/run/halo/app/core/endpoint/theme/PublicUserEndpointTest.java b/application/src/test/java/run/halo/app/core/endpoint/theme/PublicUserEndpointTest.java
deleted file mode 100644
index b37a20da98..0000000000
--- a/application/src/test/java/run/halo/app/core/endpoint/theme/PublicUserEndpointTest.java
+++ /dev/null
@@ -1,92 +0,0 @@
-package run.halo.app.core.endpoint.theme;
-
-import static org.mockito.ArgumentMatchers.any;
-import static org.mockito.ArgumentMatchers.anyString;
-import static org.mockito.ArgumentMatchers.eq;
-import static org.mockito.Mockito.mock;
-import static org.mockito.Mockito.verify;
-import static org.mockito.Mockito.when;
-
-import io.github.resilience4j.ratelimiter.RateLimiter;
-import io.github.resilience4j.ratelimiter.RateLimiterRegistry;
-import org.junit.jupiter.api.BeforeEach;
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.extension.ExtendWith;
-import org.mockito.InjectMocks;
-import org.mockito.Mock;
-import org.mockito.junit.jupiter.MockitoExtension;
-import org.springframework.security.core.userdetails.ReactiveUserDetailsService;
-import org.springframework.security.web.server.context.ServerSecurityContextRepository;
-import org.springframework.test.web.reactive.server.WebTestClient;
-import reactor.core.publisher.Mono;
-import run.halo.app.core.extension.User;
-import run.halo.app.core.user.service.UserService;
-import run.halo.app.extension.Metadata;
-import run.halo.app.infra.SystemConfigurableEnvironmentFetcher;
-import run.halo.app.infra.SystemSetting;
-
-/**
- * Tests for {@link PublicUserEndpoint}.
- *
- * @author guqing
- * @since 2.4.0
- */
-@ExtendWith(MockitoExtension.class)
-class PublicUserEndpointTest {
-    @Mock
-    private UserService userService;
-    @Mock
-    private ServerSecurityContextRepository securityContextRepository;
-    @Mock
-    private ReactiveUserDetailsService reactiveUserDetailsService;
-    @Mock
-    SystemConfigurableEnvironmentFetcher environmentFetcher;
-    @Mock
-    RateLimiterRegistry rateLimiterRegistry;
-
-    @InjectMocks
-    private PublicUserEndpoint publicUserEndpoint;
-
-    private WebTestClient webClient;
-
-    @BeforeEach
-    void setUp() {
-        webClient = WebTestClient.bindToRouterFunction(publicUserEndpoint.endpoint())
-            .build();
-    }
-
-    @Test
-    void signUp() {
-        User user = new User();
-        user.setMetadata(new Metadata());
-        user.getMetadata().setName("fake-user");
-        user.setSpec(new User.UserSpec());
-        user.getSpec().setDisplayName("hello");
-        user.getSpec().setBio("bio");
-
-        when(userService.signUp(any(User.class), anyString())).thenReturn(Mono.just(user));
-        when(securityContextRepository.save(any(), any())).thenReturn(Mono.empty());
-        when(reactiveUserDetailsService.findByUsername(anyString())).thenReturn(Mono.just(
-            org.springframework.security.core.userdetails.User.withUsername("fake-user")
-                .password("123456")
-                .authorities("test-role")
-                .build()));
-        SystemSetting.User userSetting = mock(SystemSetting.User.class);
-        when(environmentFetcher.fetch(SystemSetting.User.GROUP, SystemSetting.User.class))
-            .thenReturn(Mono.just(userSetting));
-
-        when(rateLimiterRegistry.rateLimiter("signup-from-ip-127.0.0.1", "signup"))
-            .thenReturn(RateLimiter.ofDefaults("signup"));
-
-        webClient.post()
-            .uri("/users/-/signup")
-            .header("X-Forwarded-For", "127.0.0.1")
-            .bodyValue(new PublicUserEndpoint.SignUpRequest(user, "fake-password", ""))
-            .exchange()
-            .expectStatus().isOk();
-
-        verify(userService).signUp(any(User.class), anyString());
-        verify(securityContextRepository).save(any(), any());
-        verify(reactiveUserDetailsService).findByUsername(eq("fake-user"));
-    }
-}
\ No newline at end of file
diff --git a/application/src/test/java/run/halo/app/core/user/service/UserServiceImplTest.java b/application/src/test/java/run/halo/app/core/user/service/UserServiceImplTest.java
index 08a400a7a2..93a93da7d1 100644
--- a/application/src/test/java/run/halo/app/core/user/service/UserServiceImplTest.java
+++ b/application/src/test/java/run/halo/app/core/user/service/UserServiceImplTest.java
@@ -2,6 +2,8 @@
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertInstanceOf;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.ArgumentMatchers.anySet;
 import static org.mockito.ArgumentMatchers.anyString;
@@ -27,6 +29,7 @@
 import org.mockito.junit.jupiter.MockitoExtension;
 import org.springframework.context.ApplicationEventPublisher;
 import org.springframework.security.crypto.password.PasswordEncoder;
+import org.springframework.web.server.ServerWebInputException;
 import reactor.core.publisher.Flux;
 import reactor.core.publisher.Mono;
 import reactor.test.StepVerifier;
@@ -34,15 +37,12 @@
 import run.halo.app.core.extension.RoleBinding;
 import run.halo.app.core.extension.RoleBinding.Subject;
 import run.halo.app.core.extension.User;
-import run.halo.app.core.user.service.RoleService;
-import run.halo.app.core.user.service.UserServiceImpl;
 import run.halo.app.event.user.PasswordChangedEvent;
 import run.halo.app.extension.Metadata;
 import run.halo.app.extension.ReactiveExtensionClient;
 import run.halo.app.extension.exception.ExtensionNotFoundException;
 import run.halo.app.infra.SystemConfigurableEnvironmentFetcher;
 import run.halo.app.infra.SystemSetting;
-import run.halo.app.infra.exception.AccessDeniedException;
 import run.halo.app.infra.exception.DuplicateNameException;
 import run.halo.app.infra.exception.UserNotFoundException;
 
@@ -302,11 +302,14 @@ void signUpWhenRegistrationNotAllowed() {
                 eq(SystemSetting.User.class)))
                 .thenReturn(Mono.just(userSetting));
 
-            User fakeUser = fakeSignUpUser("fake-user", "fake-password");
+            var signUpData = createSignUpData("fake-user", "fake-password");
 
-            userService.signUp(fakeUser, "fake-password")
+            userService.signUp(signUpData)
                 .as(StepVerifier::create)
-                .expectError(AccessDeniedException.class)
+                .consumeErrorWith(e -> {
+                    assertInstanceOf(ServerWebInputException.class, e);
+                    assertTrue(e.getMessage().contains("registration is not allowed"));
+                })
                 .verify();
         }
 
@@ -318,11 +321,14 @@ void signUpWhenRegistrationDefaultRoleNotConfigured() {
                 eq(SystemSetting.User.class)))
                 .thenReturn(Mono.just(userSetting));
 
-            User fakeUser = fakeSignUpUser("fake-user", "fake-password");
+            var signUpData = createSignUpData("fake-user", "fake-password");
 
-            userService.signUp(fakeUser, "fake-password")
+            userService.signUp(signUpData)
                 .as(StepVerifier::create)
-                .expectError(AccessDeniedException.class)
+                .consumeErrorWith(e -> {
+                    assertInstanceOf(ServerWebInputException.class, e);
+                    assertTrue(e.getMessage().contains("default role is not configured"));
+                })
                 .verify();
         }
 
@@ -336,11 +342,10 @@ void signUpWhenRegistrationUsernameExists() {
                 .thenReturn(Mono.just(userSetting));
             when(passwordEncoder.encode(eq("fake-password"))).thenReturn("fake-password");
             when(client.fetch(eq(User.class), eq("fake-user")))
-                .thenReturn(Mono.just(fakeSignUpUser("test", "test")));
-
-            User fakeUser = fakeSignUpUser("fake-user", "fake-password");
+                .thenReturn(Mono.just(createFakeUser("test", "test")));
 
-            userService.signUp(fakeUser, "fake-password")
+            var signUpData = createSignUpData("fake-user", "fake-password");
+            userService.signUp(signUpData)
                 .as(StepVerifier::create)
                 .expectError(DuplicateNameException.class)
                 .verify();
@@ -358,7 +363,8 @@ void signUpWhenRegistrationSuccessfully() {
             when(client.fetch(eq(User.class), eq("fake-user")))
                 .thenReturn(Mono.empty());
 
-            User fakeUser = fakeSignUpUser("fake-user", "fake-password");
+            User fakeUser = createFakeUser("fake-user", "fake-password");
+            var signUpData = createSignUpData("fake-user", "fake-password");
 
             when(client.fetch(eq(Role.class), anyString())).thenReturn(Mono.just(new Role()));
             when(client.create(any(User.class))).thenReturn(Mono.just(fakeUser));
@@ -366,7 +372,7 @@ void signUpWhenRegistrationSuccessfully() {
             doReturn(Mono.just(fakeUser)).when(spyUserService).grantRoles(eq("fake-user"),
                 anySet());
 
-            spyUserService.signUp(fakeUser, "fake-password")
+            spyUserService.signUp(signUpData)
                 .as(StepVerifier::create)
                 .consumeNextWith(user -> {
                     assertThat(user.getMetadata().getName()).isEqualTo("fake-user");
@@ -378,7 +384,7 @@ void signUpWhenRegistrationSuccessfully() {
             verify(spyUserService).grantRoles(eq("fake-user"), anySet());
         }
 
-        User fakeSignUpUser(String name, String password) {
+        User createFakeUser(String name, String password) {
             User user = new User();
             user.setMetadata(new Metadata());
             user.getMetadata().setName(name);
@@ -386,6 +392,13 @@ User fakeSignUpUser(String name, String password) {
             user.getSpec().setPassword(password);
             return user;
         }
+
+        SignUpData createSignUpData(String name, String password) {
+            SignUpData signUpData = new SignUpData();
+            signUpData.setUsername(name);
+            signUpData.setPassword(password);
+            return signUpData;
+        }
     }
 
     @Test
diff --git a/application/src/test/java/run/halo/app/core/user/service/impl/EmailPasswordRecoveryServiceImplTest.java b/application/src/test/java/run/halo/app/core/user/service/impl/EmailPasswordRecoveryServiceImplTest.java
index 37804408ef..589312724e 100644
--- a/application/src/test/java/run/halo/app/core/user/service/impl/EmailPasswordRecoveryServiceImplTest.java
+++ b/application/src/test/java/run/halo/app/core/user/service/impl/EmailPasswordRecoveryServiceImplTest.java
@@ -1,14 +1,7 @@
 package run.halo.app.core.user.service.impl;
 
-import static org.assertj.core.api.Assertions.assertThat;
-import static org.assertj.core.api.Assertions.assertThatThrownBy;
-
-import org.junit.jupiter.api.Nested;
-import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.ExtendWith;
 import org.mockito.junit.jupiter.MockitoExtension;
-import run.halo.app.core.user.service.impl.EmailPasswordRecoveryServiceImpl;
-import run.halo.app.infra.exception.RateLimitExceededException;
 
 /**
  * Tests for {@link EmailPasswordRecoveryServiceImpl}.
@@ -19,66 +12,4 @@
 @ExtendWith(MockitoExtension.class)
 class EmailPasswordRecoveryServiceImplTest {
 
-    @Nested
-    class ResetPasswordVerificationManagerTest {
-        @Test
-        public void generateTokenTest() {
-            var verificationManager =
-                new EmailPasswordRecoveryServiceImpl.ResetPasswordVerificationManager();
-            verificationManager.generateToken("fake-user");
-            var result = verificationManager.contains("fake-user");
-            assertThat(result).isTrue();
-
-            verificationManager.generateToken("guqing");
-            result = verificationManager.contains("guqing");
-            assertThat(result).isTrue();
-
-            result = verificationManager.contains("123");
-            assertThat(result).isFalse();
-        }
-    }
-
-    @Test
-    public void removeTest() {
-        var verificationManager =
-            new EmailPasswordRecoveryServiceImpl.ResetPasswordVerificationManager();
-        verificationManager.generateToken("fake-user");
-        var result = verificationManager.contains("fake-user");
-
-        verificationManager.removeToken("fake-user");
-        result = verificationManager.contains("fake-user");
-        assertThat(result).isFalse();
-    }
-
-    @Test
-    void verifyTokenTestNormal() {
-        String username = "guqing";
-        var verificationManager =
-            new EmailPasswordRecoveryServiceImpl.ResetPasswordVerificationManager();
-        var result = verificationManager.verifyToken(username, "fake-code");
-        assertThat(result).isFalse();
-
-        var token = verificationManager.generateToken(username);
-        result = verificationManager.verifyToken(username, "fake-code");
-        assertThat(result).isFalse();
-
-        result = verificationManager.verifyToken(username, token);
-        assertThat(result).isTrue();
-    }
-
-    @Test
-    void verifyTokenFailedAfterMaxAttempts() {
-        String username = "guqing";
-        var verificationManager =
-            new EmailPasswordRecoveryServiceImpl.ResetPasswordVerificationManager();
-        var token = verificationManager.generateToken(username);
-        for (int i = 0; i <= EmailPasswordRecoveryServiceImpl.MAX_ATTEMPTS; i++) {
-            var result = verificationManager.verifyToken(username, "fake-code");
-            assertThat(result).isFalse();
-        }
-
-        assertThatThrownBy(() -> verificationManager.verifyToken(username, token))
-            .isInstanceOf(RateLimitExceededException.class)
-            .hasMessage("429 TOO_MANY_REQUESTS \"You have exceeded your quota\"");
-    }
 }
\ No newline at end of file
diff --git a/application/src/test/java/run/halo/app/infra/DefaultExternalLinkProcessorTest.java b/application/src/test/java/run/halo/app/infra/DefaultExternalLinkProcessorTest.java
index 98b09cf0ed..357dacb488 100644
--- a/application/src/test/java/run/halo/app/infra/DefaultExternalLinkProcessorTest.java
+++ b/application/src/test/java/run/halo/app/infra/DefaultExternalLinkProcessorTest.java
@@ -1,15 +1,26 @@
 package run.halo.app.infra;
 
 import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.Mockito.lenient;
+import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.when;
+import static org.springframework.web.filter.reactive.ServerWebExchangeContextFilter.EXCHANGE_CONTEXT_ATTRIBUTE;
 
 import java.net.MalformedURLException;
 import java.net.URI;
+import java.net.URL;
+import java.util.stream.Stream;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.ExtendWith;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.Arguments;
+import org.junit.jupiter.params.provider.MethodSource;
 import org.mockito.InjectMocks;
 import org.mockito.Mock;
 import org.mockito.junit.jupiter.MockitoExtension;
+import org.springframework.http.server.reactive.ServerHttpRequest;
+import org.springframework.web.server.ServerWebExchange;
+import reactor.test.StepVerifier;
 
 /**
  * Tests for {@link DefaultExternalLinkProcessor}.
@@ -26,9 +37,10 @@ class DefaultExternalLinkProcessorTest {
     @InjectMocks
     DefaultExternalLinkProcessor externalLinkProcessor;
 
+
     @Test
     void processWhenLinkIsEmpty() {
-        assertThat(externalLinkProcessor.processLink(null)).isNull();
+        assertThat(externalLinkProcessor.processLink((String) null)).isNull();
         assertThat(externalLinkProcessor.processLink("")).isEmpty();
     }
 
@@ -48,4 +60,66 @@ void process() throws MalformedURLException {
         assertThat(externalLinkProcessor.processLink("https://halo.run/test"))
             .isEqualTo("https://halo.run/test");
     }
+
+    @ParameterizedTest
+    @MethodSource("processUriTestWithoutServerWebExchangeArguments")
+    void processUriWithoutServerWebExchange(String link, String expectedLink)
+        throws MalformedURLException {
+        lenient().when(externalUrlSupplier.getRaw())
+            .thenReturn(new URL("https://www.halo.run/context-path"));
+        externalLinkProcessor.processLink(URI.create(link))
+            .as(StepVerifier::create)
+            .expectNext(URI.create(expectedLink))
+            .verifyComplete();
+    }
+
+    static Stream<Arguments> processUriTestWithoutServerWebExchangeArguments() {
+        return Stream.of(
+            Arguments.of("http://localhost:8090/halo", "http://localhost:8090/halo"),
+            Arguments.of("/halo", "https://www.halo.run/context-path/halo"),
+            Arguments.of("halo", "https://www.halo.run/context-path/halo"),
+            Arguments.of("/halo?query", "https://www.halo.run/context-path/halo?query"),
+            Arguments.of(
+                "/halo?query#fragment", "https://www.halo.run/context-path/halo?query#fragment"
+            ),
+            Arguments.of("/halo/subpath", "https://www.halo.run/context-path/halo/subpath"),
+            Arguments.of("/halo/中文", "https://www.halo.run/context-path/halo/%E4%B8%AD%E6%96%87"),
+            Arguments.of("/halo/ooo%2Fooo", "https://www.halo.run/context-path/halo/ooo%2Fooo")
+        );
+    }
+
+    @ParameterizedTest
+    @MethodSource("processUriTestWithServerWebExchangeArguments")
+    void processUriWithServerWebExchange(String link, String expectLink)
+        throws MalformedURLException {
+        lenient().when(externalUrlSupplier.getRaw())
+            .thenReturn(URI.create("https://www.halo.run").toURL());
+        var request = mock(ServerHttpRequest.class);
+        var exchange = mock(ServerWebExchange.class);
+        lenient().when(exchange.getRequest()).thenReturn(request);
+        lenient().when(externalUrlSupplier.getURL(request)).thenReturn(
+            new URL("https://antoher.halo.run/context-path"));
+        externalLinkProcessor.processLink(URI.create(link))
+            .contextWrite(context -> context.put(EXCHANGE_CONTEXT_ATTRIBUTE, exchange))
+            .as(StepVerifier::create)
+            .expectNext(URI.create(expectLink))
+            .verifyComplete();
+    }
+
+    static Stream<Arguments> processUriTestWithServerWebExchangeArguments() {
+        return Stream.of(
+            Arguments.of("http://localhost:8090/halo?query#fragment",
+                "http://localhost:8090/halo?query#fragment"),
+            Arguments.of("/halo", "https://antoher.halo.run/context-path/halo"),
+            Arguments.of("halo", "https://antoher.halo.run/context-path/halo"),
+            Arguments.of("/halo?query", "https://antoher.halo.run/context-path/halo?query"),
+            Arguments.of("/halo?query#fragment",
+                "https://antoher.halo.run/context-path/halo?query#fragment"),
+            Arguments.of("/halo/subpath", "https://antoher.halo.run/context-path/halo/subpath"),
+            Arguments.of("/halo/中文",
+                "https://antoher.halo.run/context-path/halo/%E4%B8%AD%E6%96%87"),
+            Arguments.of("/halo/ooo%2Fooo", "https://antoher.halo.run/context-path/halo/ooo%2Fooo")
+        );
+    }
+
 }
diff --git a/application/src/test/java/run/halo/app/security/AuthProviderServiceImplTest.java b/application/src/test/java/run/halo/app/security/AuthProviderServiceImplTest.java
index 5b41cce60d..3c25919ed7 100644
--- a/application/src/test/java/run/halo/app/security/AuthProviderServiceImplTest.java
+++ b/application/src/test/java/run/halo/app/security/AuthProviderServiceImplTest.java
@@ -4,6 +4,7 @@
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.ArgumentMatchers.same;
 import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.when;
 
@@ -16,6 +17,7 @@
 import org.mockito.InjectMocks;
 import org.mockito.Mock;
 import org.skyscreamer.jsonassert.JSONAssert;
+import org.springframework.data.domain.Sort;
 import org.springframework.security.test.context.support.WithMockUser;
 import org.springframework.test.context.junit.jupiter.SpringExtension;
 import reactor.core.publisher.Flux;
@@ -24,6 +26,7 @@
 import run.halo.app.core.extension.AuthProvider;
 import run.halo.app.core.extension.UserConnection;
 import run.halo.app.extension.ConfigMap;
+import run.halo.app.extension.ListOptions;
 import run.halo.app.extension.Metadata;
 import run.halo.app.extension.ReactiveExtensionClient;
 import run.halo.app.infra.SystemSetting;
@@ -121,9 +124,10 @@ void listAll() {
 
         AuthProvider gitee = createAuthProvider("gitee");
 
-        when(client.list(eq(AuthProvider.class), any(), any()))
+        when(client.listAll(same(AuthProvider.class), any(ListOptions.class), any(Sort.class)))
             .thenReturn(Flux.just(github, gitlab, gitee));
-        when(client.list(eq(UserConnection.class), any(), any())).thenReturn(Flux.empty());
+        when(client.listAll(same(UserConnection.class), any(ListOptions.class), any(Sort.class)))
+            .thenReturn(Flux.empty());
 
         ConfigMap configMap = new ConfigMap();
         configMap.setData(new HashMap<>());
diff --git a/application/src/test/java/run/halo/app/security/DefaultServerAuthenticationEntryPointTest.java b/application/src/test/java/run/halo/app/security/DefaultServerAuthenticationEntryPointTest.java
index f473bfca63..7ede071f7c 100644
--- a/application/src/test/java/run/halo/app/security/DefaultServerAuthenticationEntryPointTest.java
+++ b/application/src/test/java/run/halo/app/security/DefaultServerAuthenticationEntryPointTest.java
@@ -3,6 +3,7 @@
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.springframework.http.HttpHeaders.WWW_AUTHENTICATE;
 
+import java.net.URI;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.ExtendWith;
 import org.mockito.InjectMocks;
@@ -19,8 +20,9 @@ class DefaultServerAuthenticationEntryPointTest {
     DefaultServerAuthenticationEntryPoint entryPoint;
 
     @Test
-    void commence() {
+    void commenceForXhrRequest() {
         var mockReq = MockServerHttpRequest.get("/protected")
+            .header("X-Requested-With", "XMLHttpRequest")
             .build();
         var mockExchange = MockServerWebExchange.builder(mockReq)
             .build();
@@ -32,4 +34,17 @@ void commence() {
         assertEquals("FormLogin realm=\"console\"", headers.getFirst(WWW_AUTHENTICATE));
     }
 
+    @Test
+    void commenceForNormalRequest() {
+        var mockReq = MockServerHttpRequest.get("/protected")
+            .build();
+        var mockExchange = MockServerWebExchange.builder(mockReq)
+            .build();
+        var commenceMono = entryPoint.commence(mockExchange,
+            new AuthenticationCredentialsNotFoundException("Not Found"));
+        StepVerifier.create(commenceMono)
+            .verifyComplete();
+        assertEquals(URI.create("/login?authentication_required"),
+            mockExchange.getResponse().getHeaders().getLocation());
+    }
 }
\ No newline at end of file
diff --git a/application/src/test/java/run/halo/app/security/SuperAdminInitializerTest.java b/application/src/test/java/run/halo/app/security/SuperAdminInitializerTest.java
deleted file mode 100644
index f646ad040b..0000000000
--- a/application/src/test/java/run/halo/app/security/SuperAdminInitializerTest.java
+++ /dev/null
@@ -1,62 +0,0 @@
-package run.halo.app.security;
-
-import static org.mockito.ArgumentMatchers.argThat;
-import static org.mockito.Mockito.times;
-import static org.mockito.Mockito.verify;
-
-import org.junit.jupiter.api.Disabled;
-import org.junit.jupiter.api.Test;
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.boot.test.autoconfigure.jdbc.AutoConfigureTestDatabase;
-import org.springframework.boot.test.autoconfigure.web.reactive.AutoConfigureWebTestClient;
-import org.springframework.boot.test.context.SpringBootTest;
-import org.springframework.security.crypto.password.PasswordEncoder;
-import org.springframework.test.context.bean.override.mockito.MockitoSpyBean;
-import org.springframework.test.web.reactive.server.WebTestClient;
-import run.halo.app.core.extension.Role;
-import run.halo.app.core.extension.RoleBinding;
-import run.halo.app.core.extension.User;
-import run.halo.app.extension.ReactiveExtensionClient;
-
-@Disabled
-@SpringBootTest(properties = {"halo.security.initializer.disabled=false",
-    "halo.security.initializer.super-admin-username=fake-admin",
-    "halo.security.initializer.super-admin-password=fake-password",
-    "halo.required-extension-disabled=true",
-    "halo.theme.initializer.disabled=true"})
-@AutoConfigureWebTestClient
-@AutoConfigureTestDatabase
-class SuperAdminInitializerTest {
-
-    @MockitoSpyBean
-    ReactiveExtensionClient client;
-
-    @Autowired
-    WebTestClient webClient;
-
-    @Autowired
-    PasswordEncoder encoder;
-
-    @Test
-    void checkSuperAdminInitialization() {
-        verify(client, times(1)).create(argThat(extension -> {
-            if (extension instanceof User user) {
-                return "fake-admin".equals(user.getMetadata().getName())
-                    && encoder.matches("fake-password", user.getSpec().getPassword());
-            }
-            return false;
-        }));
-        verify(client, times(1)).create(argThat(extension -> {
-            if (extension instanceof Role role) {
-                return "super-role".equals(role.getMetadata().getName());
-            }
-            return false;
-        }));
-        verify(client, times(1)).create(argThat(extension -> {
-            if (extension instanceof RoleBinding roleBinding) {
-                return "fake-admin-super-role-binding".equals(roleBinding.getMetadata().getName());
-            }
-            return false;
-        }));
-    }
-}
diff --git a/application/src/test/java/run/halo/app/security/authentication/login/LoginAuthenticationConverterTest.java b/application/src/test/java/run/halo/app/security/authentication/login/LoginAuthenticationConverterTest.java
index a40207b96f..445895a348 100644
--- a/application/src/test/java/run/halo/app/security/authentication/login/LoginAuthenticationConverterTest.java
+++ b/application/src/test/java/run/halo/app/security/authentication/login/LoginAuthenticationConverterTest.java
@@ -27,8 +27,8 @@
 import org.springframework.web.server.ServerWebExchange;
 import reactor.core.publisher.Mono;
 import reactor.test.StepVerifier;
-import run.halo.app.infra.exception.RateLimitExceededException;
 import run.halo.app.security.authentication.CryptoService;
+import run.halo.app.security.authentication.exception.TooManyRequestsException;
 
 @ExtendWith(MockitoExtension.class)
 class LoginAuthenticationConverterTest {
@@ -77,7 +77,7 @@ void shouldTriggerRateLimit() {
         when(rateLimiterRegistry.rateLimiter("authentication-from-ip-unknown", "authentication"))
             .thenReturn(rateLimiter);
         StepVerifier.create(converter.convert(exchange))
-            .expectError(RateLimitExceededException.class)
+            .expectError(TooManyRequestsException.class)
             .verify();
 
         verify(cryptoService, never()).decrypt(password.getBytes());
diff --git a/application/src/test/java/run/halo/app/security/authorization/AuthorizationTest.java b/application/src/test/java/run/halo/app/security/authorization/AuthorizationTest.java
index 49912b316d..2dce90adce 100644
--- a/application/src/test/java/run/halo/app/security/authorization/AuthorizationTest.java
+++ b/application/src/test/java/run/halo/app/security/authorization/AuthorizationTest.java
@@ -70,12 +70,18 @@ void setUp() {
     void anonymousUserAccessProtectedApi() {
         when(userDetailsService.findByUsername(eq(AnonymousUserConst.PRINCIPAL)))
             .thenReturn(Mono.empty());
-        when(roleService.listDependenciesFlux(anySet())).thenReturn(Flux.empty());
 
-        webClient.get().uri("/apis/fake.halo.run/v1/posts").exchange().expectStatus()
-            .isUnauthorized();
+        webClient.get().uri("/apis/fake.halo.run/v1/posts")
+            .header("X-Requested-With", "XMLHttpRequest")
+            .exchange()
+            .expectStatus().isUnauthorized();
 
-        verify(roleService).listDependenciesFlux(anySet());
+        webClient.get().uri("/apis/fake.halo.run/v1/posts")
+            .exchange()
+            .expectStatus().isFound()
+            .expectHeader().location("/login?authentication_required");
+
+        verify(roleService, times(2)).listDependenciesFlux(anySet());
     }
 
     @Test
@@ -97,13 +103,19 @@ void anonymousUserAccessAuthenticationFreeApi() {
             .isOk()
             .expectBody(String.class).isEqualTo("returned posts");
 
-        verify(roleService).listDependenciesFlux(anySet());
-
-        webClient.get().uri("/apis/fake.halo.run/v1/posts/hello-halo").exchange()
+        webClient.get().uri("/apis/fake.halo.run/v1/posts/hello-halo")
+            .header("X-Requested-With", "XMLHttpRequest")
+            .exchange()
             .expectStatus()
             .isUnauthorized();
 
-        verify(roleService, times(2)).listDependenciesFlux(anySet());
+        webClient.get().uri("/apis/fake.halo.run/v1/posts/hello-halo")
+            .exchange()
+            .expectStatus()
+            .isFound()
+            .expectHeader().location("/login?authentication_required");
+
+        verify(roleService, times(3)).listDependenciesFlux(anySet());
     }
 
     @Test
diff --git a/application/src/test/java/run/halo/app/theme/message/ThemeMessageResolutionUtilsTest.java b/application/src/test/java/run/halo/app/theme/message/ThemeMessageResolutionUtilsTest.java
index b7966673bf..f504f5904e 100644
--- a/application/src/test/java/run/halo/app/theme/message/ThemeMessageResolutionUtilsTest.java
+++ b/application/src/test/java/run/halo/app/theme/message/ThemeMessageResolutionUtilsTest.java
@@ -41,14 +41,6 @@ void resolveMessagesForTemplateForEnglish() throws URISyntaxException {
             "title", "这是来自 i18n/default.properties 的标题"));
     }
 
-    @Test
-    void messageFormat() {
-        String s =
-            ThemeMessageResolutionUtils.formatMessage(Locale.ENGLISH, "Welcome {0} to the index",
-                new Object[] {"Halo"});
-        assertThat(s).isEqualTo("Welcome Halo to the index");
-    }
-
     ThemeContext getTheme() throws URISyntaxException {
         return ThemeContext.builder()
             .name("default")

From 8547ffe6138498ffccd086ac098fbc33f8739314 Mon Sep 17 00:00:00 2001
From: Ryan Wang <i@ryanc.cc>
Date: Sat, 28 Sep 2024 17:38:32 +0800
Subject: [PATCH 046/185] Add frontend support for customizing login and logout
 pages

Signed-off-by: JohnNiang <johnniang@foxmail.com>
---
 .../src/main/resources/static/images/logo.png | Bin 0 -> 11144 bytes
 .../main/resources/static/images/wordmark.svg |   1 +
 .../src/main/resources/static/js/main.js      | 154 +++++++
 .../src/main/resources/static/styles/main.css | 410 ++++++++++++++++++
 .../templates/challenges/two-factor/totp.html |  43 ++
 .../challenges/two-factor/totp.properties     |   4 +
 .../challenges/two-factor/totp_en.properties  |   4 +
 .../gateway_modules/common_fragments.html     | 110 +++++
 .../common_fragments.properties               |   1 +
 .../common_fragments_en.properties            |   1 +
 .../gateway_modules/input_fragments.html      |  31 ++
 .../templates/gateway_modules/layout.html     |  23 +
 .../gateway_modules/login_fragments.html      |  95 ++++
 .../login_fragments.properties                |  13 +
 .../login_fragments_en.properties             |  13 +
 .../src/main/resources/templates/login.html   |  20 +
 .../main/resources/templates/login.properties |   1 +
 .../main/resources/templates/login_email.html |  37 ++
 .../resources/templates/login_en.properties   |   1 +
 .../main/resources/templates/login_local.html |  56 +++
 .../templates/login_local.properties          |   3 +
 .../templates/login_local_en.properties       |   3 +
 .../src/main/resources/templates/logout.html  |  18 +
 .../resources/templates/logout.properties     |   3 +
 .../resources/templates/logout_en.properties  |   3 +
 .../templates/password-reset-link.html        |  39 ++
 .../templates/password-reset-link.properties  |   5 +
 .../password-reset-link_en.properties         |   5 +
 .../resources/templates/password-reset.html   |  36 ++
 .../templates/password-reset.properties       |   6 +
 .../templates/password-reset_en.properties    |   6 +
 .../src/main/resources/templates/signup.html  | 202 +++++++++
 .../resources/templates/signup.properties     |  13 +
 .../resources/templates/signup_en.properties  |   9 +
 ui/console-src/layouts/BasicLayout.vue        |   2 +-
 ui/console-src/main.ts                        |   4 +-
 ui/src/utils/cookie.ts                        |   4 +
 ui/uc-src/layouts/BasicLayout.vue             |   2 +-
 ui/uc-src/main.ts                             |   4 +-
 ui/uc-src/router/guards/auth-check.ts         |   2 +-
 40 files changed, 1380 insertions(+), 7 deletions(-)
 create mode 100644 application/src/main/resources/static/images/logo.png
 create mode 100644 application/src/main/resources/static/images/wordmark.svg
 create mode 100644 application/src/main/resources/static/js/main.js
 create mode 100644 application/src/main/resources/static/styles/main.css
 create mode 100644 application/src/main/resources/templates/challenges/two-factor/totp.html
 create mode 100644 application/src/main/resources/templates/challenges/two-factor/totp.properties
 create mode 100644 application/src/main/resources/templates/challenges/two-factor/totp_en.properties
 create mode 100644 application/src/main/resources/templates/gateway_modules/common_fragments.html
 create mode 100644 application/src/main/resources/templates/gateway_modules/common_fragments.properties
 create mode 100644 application/src/main/resources/templates/gateway_modules/common_fragments_en.properties
 create mode 100644 application/src/main/resources/templates/gateway_modules/input_fragments.html
 create mode 100644 application/src/main/resources/templates/gateway_modules/layout.html
 create mode 100644 application/src/main/resources/templates/gateway_modules/login_fragments.html
 create mode 100644 application/src/main/resources/templates/gateway_modules/login_fragments.properties
 create mode 100644 application/src/main/resources/templates/gateway_modules/login_fragments_en.properties
 create mode 100644 application/src/main/resources/templates/login.html
 create mode 100644 application/src/main/resources/templates/login.properties
 create mode 100644 application/src/main/resources/templates/login_email.html
 create mode 100644 application/src/main/resources/templates/login_en.properties
 create mode 100644 application/src/main/resources/templates/login_local.html
 create mode 100644 application/src/main/resources/templates/login_local.properties
 create mode 100644 application/src/main/resources/templates/login_local_en.properties
 create mode 100644 application/src/main/resources/templates/logout.html
 create mode 100644 application/src/main/resources/templates/logout.properties
 create mode 100644 application/src/main/resources/templates/logout_en.properties
 create mode 100644 application/src/main/resources/templates/password-reset-link.html
 create mode 100644 application/src/main/resources/templates/password-reset-link.properties
 create mode 100644 application/src/main/resources/templates/password-reset-link_en.properties
 create mode 100644 application/src/main/resources/templates/password-reset.html
 create mode 100644 application/src/main/resources/templates/password-reset.properties
 create mode 100644 application/src/main/resources/templates/password-reset_en.properties
 create mode 100644 application/src/main/resources/templates/signup.html
 create mode 100644 application/src/main/resources/templates/signup.properties
 create mode 100644 application/src/main/resources/templates/signup_en.properties
 create mode 100644 ui/src/utils/cookie.ts

diff --git a/application/src/main/resources/static/images/logo.png b/application/src/main/resources/static/images/logo.png
new file mode 100644
index 0000000000000000000000000000000000000000..135bb98e534133802f1dd50204dae618915673ef
GIT binary patch
literal 11144
zcmXY1bx_n_wEyldu`KP<Agpw^5)w;;w5WgxEC>Qh2}r{(CEX%nP!b~2N(xIO-Kf+O
z(%rfH{Jr;P?wtGie9mXioIlQ;xpU`68yRR(!dPGc08r{^tKSCz&_4(Qppbvti&C=(
z007oA(tDuskHVs^0pnT{mp{P$+JE?e>36{Rzx5B3|Cjy#e-RdW_0RMFIO;zPi@N$p
z|I`21|9?*MX#78sJo<WleVsrcfJ}e<)4`A1z~)$xNj)s=1Y+3*3qJ)tX#Df%4|(Jz
zEadpVA`us`h%>;b2K=N07Jg2KIe^&ok%b(=!q5H{gjn|wJsp7hu9JE!khsl~y*?ug
z-Xja#f%<R$>l_-mO%{Fv4cLO%4Uq-yk-qv%^lX$Y;*|LL6sgZD8G0Y;w*f)@goPdv
zyUY+djzc5QiJgCudan@K50ku{C-qt)a+-j>z9dQ{kVan+yUdYBo{`2}!lJK<Ud)ij
zUcn+SNaOLO2?P>19O>&*61REc1Ohbb0-Qu3i@qWY-Y1T|goU0!9DhTc{y<}|iQ}%w
z(0e5Ai==VakY`iG@z;=;b4bE9D49U)I!_XP4h=s6CtQK!F60yT7nat+@t0uxNuua8
zP~vq#(+Ww{xk2J;LHkit|0WscXmS1I==iv4^u#pxh&b|ec6OF5j$r<7ziDunCUB=|
z?2IOO5AHNk(0NjT-821kN{czLjvmoZ+cW!cK<E4$m3`=)He`^pX^^zxkbgwyHUkOW
z^UD}Ee7gs?=`t-mXYj;5iys5~{Y85BUtAKpCXaO99I%J&t*oq6bu0}{%yA~3SM{F+
zR~#(<U004+N-A4?U9?~lGQje*lhm^PZPUsA!4dq~aD;(R*uQz=@Vakc0xT{PrJ8G~
zi@g#*J{}qA?QLkNC{Is*Wog2|=p(_9|K2tN0QmcL)Kwn%{+Tgrbe%@haMNmQP_&Cv
zOlz<g&|nsB=7fGex>W+Mpid%*NmWzp558gky)M}_J^jHlrIyvBv#t@7n9aelbFtrz
z4zFwp@V&aKyu7RAoPD7@bmesaEyHKd@MGQ5NY9!$=}g-)Ekez8#YcQ$Z7lx5^W5*t
z9;Epvg~Juyp2A)%P6=Fvvs_#+1(P0)j(bus<(;ri<<FPCK?TIVc$xSs!^OS>FYc1M
z5c(Cm)+}VSb9y$?)~y{u;@f~pCY5cBiifHa5wTe@)#h^>^T(3>t<AIGsb{I3-jP(A
zT^ej|!MIGrL)$tdIGH}&x!qYovtk3&Y)F>Btvlj3qF|b9SM%<W=c&ZOb{%2d5}O_z
zc(d26U;e>Y9wEzToAus8%5#x;)w?q@IREyuM5eiQlVOXYpX|w_))V%r++s7%4UE3*
z?ot%9aP?wN9b^92smZW(t{<59exc5$_9mx5!tsoNER>%&wP2??!<^@Z;E-k50E#JO
z*ctNDh@$?JE0uM$7g%0~WMnNfYg#a^oSDD8ZLNhx?}-uDQz3SlflIWMaE{`WwzE4{
z24C~KH_Hm-o5}m{GCY^zxO+?p_GL{-=dbKGOCWfe(-J<m1Xq7Lwr=dW2IyvK`)J$K
zxWD!CvvVHscPdofci~jyufrH7EPC8}XE0X7pP62j{(P~S+&R%Z75p<F$%Rc4Bc>qI
zO=0CSjamQrT<$(ZV~#8KuAE}6aEX@qFT*^cs?$b07uw`-!8%{Xd@a9~qJ8Q2NL%L5
zrL}P`frL4Romtn_tnFkjY!Fr>E2W)km`$^2ZxNFK+<%~-D?{mM<sq{Mo3z#TBw{*E
z-$@cVrqiG`e6Q#3ICo*XU-+c$Wty44UFpI=vLGn-SYDGpf*7Osf?IOkgo#f^<^(wU
zd-K<BUt=ZpE!*4Zhe(&zUD*YrMpVOnBS1`ZNDI|RiSjTyI~k=C(z~}UCp>C9O%u@@
z<v!v{9>2cJTyz?-Rlf12-1hvHX5|{#@Z;kxVY(73zbg5`-w(d2tC8P^JaG|4ioQCp
zUeo-}6U83BFd!{ais}#fWWro(^3ghik1ofwu(u(1(l|Xt^3%`9JTb)wFthkG`wx*X
za@<DXW09DRfvWEL7T&(RNhfPRUnTJDgu^RaRrkVemT=aey^aP0NY%I~o*1KdH;`Q|
z1ch|)Pn9GyG=Ja$pyWMdV*gec!}H8GOZ*g0;>TX|)3hos@0r|v8}=iQKRE-k9}{&P
z==u#S;BvQSmNT>`8Hr`zv@aNKG>?~n-Nj7`U12J4Odb2s?9#GDM_YJh7GkORy`Rx6
zYx-?TIJ_q+tCiwbwt-j?>Q+N%ra#EeP}&ew{XH%AOPJ0k^~IgY%0Ge}jgdcdMS@a!
zm@Hk)JJVEp&9o1{F>(f@swg~lw5Rw|b^4jR9~T9#?I<*|(TTPQ(5{;?@tFjk)oI7j
zEswdd6z>Y_+N_(x3{>b*gNM$NrL7^aq8rO<`zv)>Z=^akqiJJeEQM+&)(U<<5p2>i
zX#O;r1G{9Hq?ENnw0tz_FU(b=tAVmJj`%dXy*3MXa>(4`HAa=Sa@S*Bd4i2YgN~M0
zPCNJ&!KQ%@L$4)kGM=t`|4OAC^iJjUdBT~J!{BugbDtstsMR>DQdgk&=U$YtD{nSa
zL<fo3f?T>5aC$EO?Rq+`-+Q!d21#`66ToNRT|OBkr;ajf*dt4`^3)MZ^u@6KEHeL~
z!AIC&aZpg`_?551>FdW-X}S;bo_IdSuNcML3NT6_k8M^o=aa=V9nl>5uSnu6s)2~X
zKw=Z}<M6i3SNsz;_vD^z#S3@I?FWjJ<g{B+n91F+yMKFZ2Bxj14*!_K=OI6O<B&Yk
zs?-uHS_0B4+_iSOh>N?kFnYn2Koa@pZBR2qwU0*Bj*Q!6mEdg}^+SQOC&k04x*f?-
zQxb3psO4!!yfUsg!W<TZ2qkCS3B<iv&-OD=RPg>YY21-owo!6#RkCQUY-gEQ?78<R
z_B(Xj!%F>EF$Qs`t)mjdx7n^EhKpGF06C-@`j1|RzkbGGzN&kXsH>AP5-J4M>y}Q#
z8P0+0r~R2y@{Ke)Dx|c_GDw-$5=q@0TrnoOmQ=(#JtjOE@DE&YwNwto4{>Si%ioVW
zUhx8Tn3~}a=tOd85oWkRO#K!TPO#3S5roN0SFwc4%+zV8tT|1V*)sJMPHzZEKBWkF
zp8S@f=R=IVP_GVaWK4)b+J4Dmxq-JU#T$_TZ3d9H4Gwlv`dV%Hfa7CMnw2=Ud~$iz
z<x>guME@x0fRa>QE1BwrbB(78lc&oE<omYVQo84I!y`^QI92{fEE%MO#O0J(u(yC}
zhlPm_4IQ;VI*OM}vRd2-BFE@eGcFV+l&5$HEz`>4hcSEAAL>qhLl?J5;9?+snZq{R
zH1q^>MQN8?MwU+F5+9u@xSlRT5NHtiLp{SM^9DnEU=dd~sCn1BU^I^_z<r22Nr8pf
zba;x^Vym4Ype-}qMV?n0%81?{5;}!B%SMnDqnCO#b<q78dC&y9h6b)UuVe0@eTOf|
zlSuMsd9BafI@s2>VA|k<*Y{M)LVwZ6SX(hhj<i~5LdQPG#YCkMw~<8~McpNvbEqwQ
z0kwz-6AVM$h475<=A4mc+_x32IYy0^iPKLtVXev5IL-M5W+gltAf~b9>P6yr<bJ)U
zd43X3uXR$%w=Aa;sh+Fntk+5u%_$y7;OGYxsujssRk!8b%nP>Gy~r`pD3{~?eWLYu
zzyXwLvd=DvRlJ;&kLx=V5_TY=SLP7<RFd!qZO$M~oq`vL!xk7%oqm2}o3Z&kr^FEy
z>?rym?0PGr#3m<$M0mpG9QFXuOddBb!S(3Z=66oEH;{@cA?do>zeq9tzYOc-1IEe6
z!xqeOghisy>0YRj2MFOV59f~2sG^a@1Dv^^*}!lEBIwCuvMjQ5^PjioF5X)V!=*g}
z?A{e43i)z!NQ9$}E$w^U-p}R7NZnp7PjRu2qH|<{+Rk6c-1p_-g-YRoQ+}#;&Y5(c
zZ_^@oy?zTn>)KJe9e<*8ZfiM^#ZC~RN`~w!^Z1R`v+>`<DlqOd=Hcm;nQv5(RNP|5
zZ+v(usRAelRxN$N>8IM54NK!zAncmMT~&R5J;NtA?mzdpSGh8$;36%$LTF5mfF`4x
z`X~Zk8=Hdj4JTdQ<==pa&hiC}w!GUy$#c4Xi2o{XLmAFLrM=@RC#rSF)@dXY@)5j%
znzrRk!Cgi7ZMYk;5|gcAmidH2Tch-gEl01OviY>WUskI<y8OkK-blKfaV-+4_Q^wS
z+#JTM2MB@N<?K!xmAfS*D|90szO<vN5x@WI+hNW}qD*j*;ukCUXVEXJ$e)j8V->T~
zL4_DeB1JE{7F3kfb@*cFNBS9wm9^qEa4CIvgrur4WnqATnWtfYt;VH?`g=~$E55ZB
z_eWI3DUt5fHJo)VH~ZO~%%cW0?lf*_`Wi_faHmNS{g^iq!zF7j3I6f@(hsV!+F#(d
z5Bm!bo%xgGaewz#D(2_sOfj*qo5J7aPS<|TfAMMk@AiD|S1N8dOWs_4H51BfN8gDX
z!#NgY80KH><W~w&%!udXM$SJehJ&ou>uL58Ur!UQ<*Z=4&Sb_D%&16BJL8<^`*@AT
z+gS^pMQ`y1yD{d_j_j$p-xvj7k@p_-bQUCG5-_4mhKA|x%OSV2D<ZdMrQ^Rj-`ZAW
z4<5T8--#sUC?jjjXZ(59@rc0a_6}rwqE;zx>?_E=H@1trU>#5V@nf{L`bStzyU`8j
z0NH0ZG@sBD5~t*SecC?<$kAMo=jtOXS#Wxx<liWM!#ZRsKVe%AH|{a+Zd}|;)fWJo
zrVT<Or~J>5D@l}QKyHml%=MExu%32y+Yb}~xf5ngCN&ciJU5(#OFSvf#)!R>{LIai
z$H{ajAdeRrw)&mN6^=T}6*_x&5O*)>;qZ5)mk~sJhF&N{LZXXFweTZ!RYw^#)P%Vr
z+O8i-ayru-_*Sh)OVoPJ_l%QC7|K#C)Qn`H)li4jcc4_nrIf@?RETLMB*v5xOlOCs
z8<F<&Yl9b9t!=%b{+%Gy#L3Z7|IKFld6L8$#qrBXuxOZgWaes)vXel~Lrff!?9ol*
zSMNUb`6mTQ3oC+Zve*wIb&N2c0xH(PsFn*&^sO(_QO-=yL>)B7aD-qh#}T^#iN|0?
z&WuA>h0&!1pwg(VD)ovU_J-e{8x`}579)x)<bO%wI&9Zfy-k}*%TE!i6q@6CuWV93
zfc-Yfb3361lbmHr;!&j2jbU0$DI`x!2E!E<9EI_7ue)Io#*f(*9GnViC|#W*sz6%g
zHdX7;e`7BtcMpnC9?}8+b}|q-^MpgC9;X!D)W%);JsOQt5@Y!l_!hEj@nV9*i%6V~
zmb0>yJU<XiWim-z_i^h(aEv<{aT>gJ5edUi4Mk&MWXq8DbCUFliszql8?47SVMsEn
z+c~svIPbsSp@Yi$Y|4EKUuz^cim+2Y=R|;DWuF`AEr^mBq4swR^7-%HTPM$vqhZcH
zJB;xWV?u|lf~HswUgweMYkhig6C|pODHcF}AitM9<g$m^{K;XSOjMzh)1G&a!xI&r
zX&}LDOG9MpE-@Ia19~j9pV^e2EsCxZ#7IK_8o6kfS`EW-7q2ux5kM!1ZkuZ9&G;hL
z*?fOlRw7Byh;H%iV=~D5gh%KpIPzy&VQ3(BV<F~jPelu}(kKP;!^Gw|W7`ohHUtg3
zdsd(U#JQ7tsflaRKdS4lH2)@8eKCikT3v%|0Y<~BfV?W-oO;Nw5vfha1DR6&8_J7i
zymP-zW5iy4>EAW)N;|ND3uDBlGJ-r$E^K{wtbho9yojPHJ_PtT5q%1eC1r<tA@3^@
z;Y`mpny!1Y07H$r=TfXC)Q;(Og4koCXP9OMIy9+;gP|@~k|@xe*nq%Z>W@`P_`P)(
zzSz<VdEbb*7zG|?;@;Z;{SnHyuqK7E#3BTB<D6Pp2RD-b(wo5uVh?#j^pdzxnH$MH
z@Q{R9b@G|YmLJd}D$fi{QVzx1ut9gUq=<5uwRqb8l`L~*K-^f_jmC`f4^xJQ96Z%+
zKJ6zWi%BXQO85%lRyM>C)%id4Dvecb*Nl2sV`_dVupN6F6s`&Ahfk8<AyOG4O?+nX
zpbeobika)E{PjKnghIgY+q~-tv0L%^+V-p<jbXBkEN8r-mxfQ*BOLn(WY9$<ez8qv
z9F9B-dE54q#93L^F9dk)yARHsNZu03x~Sknau2C~<aW2Ynly0ACl!ZbH{6SX{-;{v
z-SrvY)iNNWz)xR#S@n92FkJ>>)1$EiD{CNcr(V~4*s($f=mf~aZ{+Sk#n!#XB?hex
zG$V1nDIFfrqz|or`R;mLAFkjQL_J^O#Hd?;%qlD~sl}QfUN5ua&xtSCS=5=H$b!yx
zmb8V>h%K^qk<_2!-hBl-x)oHv=^~e={O*S#Ov)A_kI`>3pqIbTJue{a5GMg7qpAE*
zEeugw3XK6<QsWrA46Ga_Z#_zy-`zi8>_uYgF0lz<ZvBI}UZvz8w&QDq3?KuvMt0hx
zWaJp?3vjXB!+2uVDrc$^DMnZT-3vvzQ<?&M+}pT8!5Dl}C$_St>ehAxP(*31?l`HI
z6&p{&N|Z!CPGfey$q1hzm4q@~&#F^!BOJL0QAGhZe{2jfGme|31wA;~sBlXVCk1!`
zwCzoE^ArOO?W;Po`n3uu;7ltmF*zLaY{QZ9KdK(JPrU$R6z?5YZ*(YGViVPy=U^|W
z0JJ)wE5rjXSyZVu9-TymkpklKj5@nT_3AI&3D*2TMgM)&X*Y2am-PC=0(<2WXqkfs
z-HDv00Dp&d-N7bBsx&6Iq+ffQAd9=>2k_VmCs<$v!kQ2CiJ#Oq!9GTV=2ryZvx9{;
zEv3EHIDMhTu|aM$oAZ<G&!-A5OwS9U2V)4tjaFHT1Nh68knnwu$eiZ`H#cXD<#K*L
zN2T*B4K)ZNcVt^`V4t&>z6hX6PLj&u!*nVSYmtvXM7}_jEA~|Xn#zwA1Hn~5@A;Dz
zSGhki>D+ei^rwIhQ+p+q%oOWT1o5mvaZO)X?U;nGo`U0MC@y6<qk=yJL}!X?<TRvY
zn}>+AMsN_QhGTJ4E1wN|y9#lN9;cnlW=7KDDD=I|2C)^4mT!n&vuy4#fWmp%-bMpg
zW)#|Fs>E{GkGt7DB7kTrvQCb&Rla=r>n#%FW47D+CEp%m#%z{}bCHUIf0jX4=gv@I
zB?i<Bs4GjG?d_O^(O$Vx;S*Y71IL4*Pj6c&ARYNsg+TYT02MKglN4^uKy{M6l`t`s
zn4)og#WfsgA$<YH&E%+Lk_-sDbNph5ptP-u@-l!@cH%XN2heCs+vInc2nCvjz}n&M
z+Q0gU!djjn`BW|*2}=UMUK;N~eAIy&bPps-6JW}9rHuLraPQtW#c~37D{1?M5raV6
z^*Nr9L>h&L!ybd)P`PA+AA>kaIvznM*$}5H*eWK1r6`b~ybfv-<Ww8i33=A~9pRgD
zWxgn6JG^SYlHn32I>3N85IGdMNwgEHoTbczyoac{A+4*zNB@=@*E#i&CIFzuc!pYF
zpuxp5>v)=6sJjKFV7#+JFJFaplW*(?eQ-r7aR-F>yIzPHagWmZJH`r3vmb`1tuF8&
zwZ$fnsNLlTE!-+R>hSg2bXu(?&7GSd-{!Z&r-BC|4Gd4FxdApT1eZSG?#Z;KBfcPq
z8>|KLJ^6NK!+@XlotffYm44xZr7#-O&uu=7Hu|tyKg?k{fpJFZq3n0Ir$lC5^;@71
zO%~9-FaIW^=%*!!svY|l!L(EE)|H8uy%J}8dz8)t!MVnqoiYtvFP!|ox9rRkKmOF>
zV{h<TGm!n!x%IN6@pSiwSWA2cID8Hb%@F|>5efhZn;3FKh8eKoeFr{`tRBp0LNzfB
zKb83!@6u5=e;ShbF~}OTsue7w)O_?1%Y|vnw)CT_NOWuO>Io5nFnJP7U&!ookr2hg
z_WNGePb>~W5lsqbX-w<w;pAJb*|apfXgjd<OKMcah!_N+icrLL?~6hAj9X~x*&B0o
z?THcBafBSIwQa*kyUBzfgohX|0pQ*WP=9r~tGY6b%3J`rsW0v#W;v+b3HaGY!dIZY
z#|n<EJmtYGxD5?=XZ6ifrCq^&FHd*z-RwvZ)Q6xR2>19o7;;Eq_qc0Tlo2CvzI2^`
z)y<yNojcWXp_2h{R7?#)p==k*H-LA551JP`cP2xW1i>^illp|5-;P4lI&KMsI$+f+
zTF`_ugz8phc_pQ^tJ~%-J^_%2-7y0&@#lt{ZrN#W);oqX_IIDug`n~A<T)=F+J3V#
z+4Qq+S>uu@M(X6*9&>PD54RQ)386qT(K*<0+2*v^584lnT37x9GTOp~blbU!0#bp6
zE6$HTlH`fce4)+tCEn<bZ!nQjy*>Jf>sDQqnP7$}(XAbdf2s_Q{;YbxH*n4~K}uvo
z{ge9Tvu6jZZL5k71}nNpa30pD2(4I9Cs_ttm>Xl#d`#H76!MIB&1HHdkl3hA%$Mcf
z!Y=N#NSPk+KU+N(259M8-*xAb%lGi5vZCn42~>L@3<*bjrjZI(A@HEj7PGF~=jB>C
z51wM9rGrS=f@xoKz}b{<AU2c}kz&CVb}IIvXag#`&U2QW8@Q{+s~h7&$Utx_<jeJP
z%W(qxk)zeXmpmm0$Rceq3(m#in2`4sb0lT-Is5wCEY&N!7PpB&jk8Vv;5ifI(Jh>q
z*->9HLFt?sCqq7Na-7Z8*;41l0@=ADhg@+XKPe|-n(!jYDb}nv0(GxVuQE?PkPBMr
zFiC_7COL#^f30#X$!)oPow7$v)khF>0vqo<Vr<k>z6P2&LCaVeBnEaBx;;wa97f7}
z!uw%tY(lnDjW1DRhrkNqRuyY4?=K3;W&pyKORR<Qg8NesjgjTKT^MV@+yruJd?sjL
zf-RYV)9odU?tcRgU`8X0>xOuEkjaly2e52Np$y<3=3sI~%is$}iu(UWr-<P{2gUk{
z;Qt)ieWs8#ge)qGk7ai&Yl!m#;8_^5&CT=N+UU{~Kh@`q9cWT!FkN3?UK4e>ph)7p
zULPzUver8DTHxxk1^v(u;oF<0t8@DIc7OT6JNkoA&yr>wMddps$c>gCkT5)_r*-wb
z3DU5|fTZ+KN#0j%xdh^Y*l$NEzTpfKYNuyfzas)8+5=bT?SRTeFw;3YUoVjWZAm9+
z6ep17Y{`(aqp$+fKR_IZaPdiHyfO$mKSWTtWCl5?RS?F1v+RkYi4X*`7U7CttJ#Eg
zZsjUmwfRoF;o58{>A=6V@!xqN)VeNUfq#7Tt-i$fJQ|S=DF^fWO652W{sQ){Da}fQ
zYpymuK}P$ABMvkH4+sUD>tiGXI|u1S9J=XGIkY53@#GLu+2+ytcCn+JmU+K3&tp$W
z>6zF={5w+pYBI<UCrMpiXHMV!1~o(Wj%zQc3jqwMgwP{|yB_W1*e(&nPkYnun{Lrx
zsn(0#&aIVFk-f*Cpk<(<G@JyQx5h^(C9+_N_{-CJTF_}fLJdzhA~~<p#=5tBt_n2J
z)#l|AC_UAiQ<w9sdkdB8Be@?HpVkGQGwV-(lwGpsMW3H|bO0jg5Ym>K@!DHf!LM9!
z9P0Bi9QB538GGLI7>inI$xoKe8hzbI`Iq@5Sad12U~G-0n$lW{nxz7AGk5?$_kv?X
z`f@t$>owJx$x*f-DDLA~`TSrU-_ylVH*YrFmeacIU`^uPtw>7WBeU6W-HDLrUUp}s
zN`W^ek!J;OVzP@`@(iyD=9l8wwV;zRRP8~_tT^QRW~M~ld#VD<vk>s@-O%aFVvu>F
z<A!;X<`C8J$fgQ}hT$mgM`iWzBkNbS0>KNwQDMR7M<mX|7d6k~#c|RsGKjN$j<rn6
zWVm^@CIvEtV*y=oF!h}st$;X57)lHtoL30S!MR1_r;qJOn#50pj%cpBmBJb8HK|yK
z!^(U(q*K}PBDTkkzB@1G%`R5Hq2Yg=-);MUrSO%F2A#57tB}HPdAGAj;`Ha!6@^+#
z%iu~uw>k~+#jlml(#|bBIK1}xAZ26KvJUy@D=}Ox$%Gt(Zc6b$iaMV}Z|c3Le0!lQ
zYRlc(OvAfNCP1+G(_lq0B4eiANRKghHR<pu28|80cY9%U4%sy2cO8)%=|58HUUp6$
z1+2UuEVloy-cc>(@NDY)?q$HBT%*|-UbK>&P<e`1#J+ezK(@f~Wh`=EI78YQx;;H8
z@4&u4<qWk{F^9P778yviQd8bi3yiIyuP<u~{P~bmcMfB47FX8jQMB~i@FJq+PM{P{
z;%sm8?<w2F1K><_&*yKCdz`ZKXo^8_-I`LpNTD-%1`h3Y$rCBqYDDIt#uWnBgODJ1
zH+qzJmCNysdfj}#`mA43D{0W|8$W!=wC5x3j5)~WMn;%0fm>+%SO>p75B|wKynvjN
zfZ!iTrtDU2_ymrYpEzutTs2nl|0KBXms7~5tx=|A4(46OMHN~f&|}80X1|yY=WA0p
zjt+(2{Jc+F`90m*obI8y2u_R;4H`44EvhXVn{Ig{qnWb9A&#x4Zh5oUIvK*Av4&4u
z``P@r1-5OSr%`{VMS=>+5fA11@>xT`4YM)7KVLp|vg5Fb>6;6zQNFrwNj^87y)1Sw
zE9aCVqZ=z}id&n1$-ncH1t4G3_Hw2V;@v~KOj)YYV<sOcH*_Yklh1#d&q5avPCp-;
zw%Cf*^?gXOzQ@JCN}K*eB<m+QvDy985A^e4AO_1;k@gs+g^KQ|y`8r+Kg3#L<x`_H
zW_RVo;f7@l6bF3Khg0{O$D}B&4B{x{NtWN?iKp;z{+())rg!?6U`3arpxN$_CJ-Iw
zFJa<O3bou3)E}3L`*M=qxy<;QvSlC!cBb3QEUt{U$%01^xRhALk@Y?!m#lR%dzXOq
z1PA-o^WX=$p+|fobye+{pXvY+qlGnZbK<HK<E~sU<~)g5d5NP0!|zevYq}c%Dn36q
zRX&=#OjCu!tap_IEB0|SJ^X-&)izwzcvO^fnFAS+??IyHb$UM5J=UnSO7TlQxXSR4
zhzI}qqIGg$UvM=ScIWDQ3GLt@Z@$i`0x@N4=cbOq$HE9_;$IG~?41VUia}YovHJpn
zT}qe27Hc8aUsboKUa4IaMEG0J_!EbdV*h?gB_p}w3F={@`P%mwH<L`@hm2o<O^N0{
zUi<I9n3Sb?@Ogn=TJF=%1<|!4<UoW*q;7As!;tzslJb}HoyBL8dO{{YLO;M9vtSn`
z&<HW#i)_lJ-?!6tTFL;s#8CCQCDNO|U8#JAB-x;MKudk&Z^7%_Q`+BX5=Ale9_wF@
z9r4`ST3qIDqD;^dhjv%iQwEX)p6v?`CTSe*ZkLqV2Q)PYvAl}Eq$AcU_lRCy3_m$4
zc9n##3o%{lgRN|SSwCeKz{En6N4y&{L?uRpV%E!4AfxGy0r0i)W72w4x@&i0?%=Ms
zi}RX+xQEvz1dWL|IH6-J{Deprn$28`>UV1XNxEbELcx0w9zHst0K@K(L7o^Ud<E7b
zs1@@cUe+#}F19jC`klgtA1k%2wZw!aN-nqLH-UmapfBKfeq5q7id^wAXee;*`>XsT
zQr{;S4!`5-2i6WtYBtykd^5;#vPiiDy>B~=>6XM)ru_LnLAaREP`i*oN(SC{6Kjnu
z>K-N70EwaPtIfl&)G3)OZZrRgv96D7326o~ofQZdm!7958YbxfJB(&~>dXAk<{q{G
zo29Q`TxxG!e<KPq!9H0lAidp}f{D>ReEDDq1JAm3wqAK~8A&O-KbAOHiFk<aRlZt#
zItZi%)BJYRL62bwZx7s54`YMPMc*b^mz>`ej~*K#18)t#8`Z~?_S+?VI4|M)xJ*$|
zK6O;Q&L^csP=h@FboJ$o6+7Q%A<Q}v><E7SOy)S7FP^ebG>*;6^vU<_Y$yFwx!|jY
zQc&;<LgU}g{^5AVMQT<|hv)^#1hI|E;TOnSaH8-;80(1%SEo-ASDW<+k~l6Pfmh#3
zHgGF=MS>(LaMgh>N9?D<FiZ2=Jm9dJIe%%*oHWI@WrdHVaJ1~jPuJF<O_IDmKNkIF
zcI97vx`bDT7`&H7W8C~xrEp_{*xFa*@*fOW-qn(ekf&}pnDAX(a8RCgxlYt*(h`l}
z#XNibP}J2pl?Y^yjf!1<92z05jWn78aaG01+`?m?fUENC@^Pf0ydXlxVM)oQJ+n`d
zOk-ry@_^UzX4apQGMTY1D>t@_d0jZl8exqdlT*H$E$I-RCmcGVjdft+j^^O9Z{*nf
z+}DhwL3F712&7`lmp5)`JL~4zMm*kqxa_X@v#t;d5=vs)GOkkXPWR7-uQq6amz7PD
zjXlZEQ7ca`$-p>VqV16PPAj74i_7=88vql3z$^E#b))|KmTeyPa1Jjr3<APh$d&Z<
zhaE`s@>|pOpQ!_7E9-#r?Y<+s$o2Xlv(5H8xZAC_IgxSaF^^Em2;`;AuMi1djv^Qa
z|L&x31-^H3AaqoYz9`buch|4W3lZ1TY?t>BKd4j~79tV7fm9<uaTVwkf}>*bW(~V^
z$iZMsnd>`h^FPWTM0iM2XrRpcp2@Z^XXPTI$uDU+Qri9`MDRkfC}b@vydEXfEdU;W
z72S84?9D+qG9{g!5&2T7pvPTi24^6va4u^V*TMXuYAW}_?z}bhA^90mRsv{@OmEQT
zI1}-Y_&jXw72xml|D#(z%79wp>>ilt5(M`b+Dg8w=iK&zVW@KsLVM}<Qf-onCOs>S
z`^CHLiKl_omo{ymlf%7(L2(Jy&z@RNV$jt~Q0-NqISh8qq0mwO(CR~lbl1W62eRQz
z!rIaGFeQ5^w3u>+oH(i_f=7!=FfMm6>D8W3GO#Ak4pcZK+O|9bIiAOb*RJ1zes2(N
zAgbe55>Wu>0SO_`-D`b5vxq7lJtx~^-d2PB;IruCZe{?R9ZFiwS%~g`qXE7`9zI;!
z6N`Ak2{gD}w9H$}|5LGjtJdraW-jw|2y2?O+P4)?_+Z$xCxvB_mIRWsjpGk*c<UFu
zMI3}!#U;P+)lLU$3aej2=V}j$&)^$}=@m1?W0mhS-2Tz%Q)Llha@St@)GYIX4)Y91
zH`d+=6c^ED&%XxG8|gkImL>ZvW0vz5X4zkd?%yWFpH6%l3bN>ac~{SwvRYCku8(Ze
zHUI9`<_sL0VGqw9q{oG2D-2G7(#y#m=36S97H4-4=~LL734}|+?b&|Q?hUY=%^-Hr
zATgvpR#whIoOwt6JzJ18o5p+YEiz{ty}}Or5R&O97!BeV3pHB-yxOu{)im6%6XG~4
z5P+s-J*6(T!YqAO+=!yxEb=aSyZJ4Oq>8(G;qI}YxHLNl#Y;&;qtC<NhD)h%(6WNQ
zMX269T93hGf1?+*p!TRbI{W*gltZ*}p^hH$U%+t$*p*I;Q$UP4*M?nhUO>QGDg;7U
z!~y@0kgyw{)Ih7Yy4_33Z{9Cu&{aj;foOa-Qn=Inm?*h7y#8zc%91FX+zO`JytR?@
zwoq)g{Tgq<a*fn0?Kl0}R#)K^$j~8AbNyc3Dju@eq7=-F<KONV#xfR<`ZsNq)R!-%
z+{x8t8XzBfe)rS;@?7by&Kup?Z7b!C`j5(vHjZRP6HZD01;<pClv-vX`qr<2d9zl4
zc0khz-Yyu^m3HgN8?9=va-L?1InUAaZ%%54rY{`remgr@vM9#hJd*QZ?qAB3B7Gt8
z2=!Xd?tT)|rUc4gDsH7%(UjzBDd<k5N@eyMLH^Fykh&s^OCx|%EB=&zVr7*-=w4`K
zUBgF>n%Jdl(4WqIJg~j!i^h1r>@brr7r$fcBZ8-VUin1j*zf4utK#7>eWG0Yn;#{K
zX^vXo^RWu_%O2f&F0G-w*#u!uM8*5j@i^5+IP|i`+Ip?{lxUJ6u;E!YoS#+WS9I>L
zuz)*Bc^1f495b-`)TzM|jkpx}Cm#O@^Zie)m&I4q?o_n3!S*#4fv37lcZ0jUOPHM9
zmH6vR6l2Cdtm+t<sI40Ymih{>$}upFD6Ys9uQHcQ3gq&bUgnC2P_6Y(#LHP4#m4sx
zyZkiJu0GU4C@pTj|C?f>n!gp+B%dOAR~1z`#XU=_&q{$x?dQZ<=So0+jP_qB%lpf<
zEP8&JqMWCiSbEZ0YWZ$zf$wXTF|9I}>uSWl1v~RMStvxsH%gUGJ?2Oy=*gZUfiPwH
z!%1@7cc8VEzTZLrnGfGIw>+@@NJ0c?c^F4JTsM|tzu+LAaB1=<j$Tr(tToKfCu`<A
zvsQI+yxUPv8ijC0EX?Dv|AR&KuWSy-bOMFeB+*kr%n(X%*`YW$O(}bUr|6g>yR`e>
zToifl=8ACr4UgF0ZT6;(<j5zdG0*ne_(*)c6QfB}4#y{m#Ny+qOf@GxJOUW~6*5cj
z@v1*^pkI8%-OyU{bPcF9dnN3fTid(#62-iQhDO|LE%I+=K0to9QPErtWm9R#Z{7RC
zT$wlLRe)d)i+k@B7Zbuztm$+=<#CxDJ;dVPXNUKek?_g&N@P*NVxNMIlELResb0EB
zU-bCFuiSzvud(v3KYEkzl|}O+*S6M$j0}VZ_n$@;lh3mi^gZk=7!K)08+pHBRt$dT
zy|7rv?B*00uyEJ?tD8~b=Je&Z?G(=S^!skoAu*Y1d5!qs4cC8PAORf>1NAahROtTz
DOTHoo

literal 0
HcmV?d00001

diff --git a/application/src/main/resources/static/images/wordmark.svg b/application/src/main/resources/static/images/wordmark.svg
new file mode 100644
index 0000000000..be75721541
--- /dev/null
+++ b/application/src/main/resources/static/images/wordmark.svg
@@ -0,0 +1 @@
+<svg  clip-rule="evenodd" fill-rule="evenodd" stroke-linejoin="round" stroke-miterlimit="2" viewBox="0 0 2144 877" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" class="mb-8 flex-none"><linearGradient id="uicons-hepky0qzdn" gradientTransform="matrix(0 -848.921 848.921 0 1308.8 875.397)" gradientUnits="userSpaceOnUse" x1="0" x2="1" y1="0" y2="0"><stop offset="0" stop-color="#0050b5"></stop><stop offset="1" stop-color="#0b87fd"></stop></linearGradient><linearGradient id="uicons-9a00r6vh1r" gradientTransform="matrix(0 472.459 -473.895 0 587.619 -.861651)" gradientUnits="userSpaceOnUse" x1="0" x2="1" y1="0" y2="0"><stop offset="0" stop-color="#0048af"></stop><stop offset="1" stop-color="#003580"></stop></linearGradient><linearGradient id="uicons-payvanzieq" gradientTransform="matrix(0 898.506 -901.236 0 162.421 -12.1337)" gradientUnits="userSpaceOnUse" x1="0" x2="1" y1="0" y2="0"><stop offset="0" stop-color="#0b89ff"></stop><stop offset="1" stop-color="#004eb2"></stop></linearGradient><g fill="url(#uicons-hepky0qzdn)"><path d="m1028.16 339.331c148.249 0 268.609 120.36 268.609 268.609s-120.36 268.608-268.609 268.608-268.608-120.359-268.608-268.608 120.359-268.609 268.608-268.609zm0 119.152c82.488 0 149.457 66.969 149.457 149.457 0 82.487-66.969 149.456-149.457 149.456-82.487 0-149.456-66.969-149.456-149.456 0-82.488 66.969-149.457 149.456-149.457z"></path><path d="m1874.58 339.331c148.249 0 268.608 120.36 268.608 268.609s-120.359 268.608-268.608 268.608-268.609-120.359-268.609-268.608 120.36-268.609 268.609-268.609zm0 119.152c82.487 0 149.456 66.969 149.456 149.457 0 82.487-66.969 149.456-149.456 149.456-82.488 0-149.457-66.969-149.457-149.456 0-82.488 66.969-149.457 149.457-149.457z"></path><path d="m1309.27 377.585c0-10.083-7.222-18.719-17.146-20.504-19.618-3.528-51.9-9.334-74.172-13.34-6.073-1.092-12.318.564-17.052 4.522-4.734 3.959-7.469 9.812-7.469 15.983v491.469c0 5.525 2.195 10.824 6.102 14.731s9.206 6.102 14.731 6.102h74.173c5.525 0 10.824-2.195 14.731-6.102s6.102-9.206 6.102-14.731c0-84.425 0-400.286 0-478.13z"></path><path d="m1542.59 72.033c0-8.288-3.292-16.237-9.153-22.097-5.86-5.861-13.809-9.153-22.097-9.153-23.867 0-56.609 0-80.477 0-8.288 0-16.236 3.292-22.097 9.153-5.86 5.86-9.153 13.809-9.153 22.097v773.265c0 8.288 3.293 16.237 9.153 22.097 5.861 5.861 13.809 9.153 22.097 9.153h80.477c8.288 0 16.237-3.292 22.097-9.153 5.861-5.86 9.153-13.809 9.153-22.097 0-131.79 0-641.475 0-773.265z" fill-rule="nonzero"></path></g><path d="m506.409 822.063c0 13.815 5.494 27.062 15.271 36.821 9.777 9.76 23.034 15.23 36.848 15.206 18.674-.034 39.711-.072 58.369-.105 28.696-.052 51.932-23.329 51.932-52.026v-769.586c0-13.798-5.481-27.031-15.238-36.788-9.756-9.757-22.99-15.238-36.788-15.238h-58.368c-13.798 0-27.031 5.481-36.788 15.238s-15.238 22.99-15.238 36.788z" fill="url(#uicons-9a00r6vh1r)" fill-rule="nonzero"></path><path d="m616.746 322.662c13.813 0 27.061 5.487 36.829 15.255 9.767 9.768 15.254 23.015 15.254 36.829v447.062c0 13.814-5.487 27.061-15.254 36.829-9.768 9.767-23.016 15.255-36.829 15.255-18.632 0-39.622 0-58.254 0-13.813 0-27.061-5.488-36.828-15.255-9.768-9.768-15.255-23.015-15.255-36.829 0-68.223 0-187.159 0-255.383 0-13.813-5.487-27.061-15.255-36.828-9.767-9.768-23.015-15.255-36.828-15.255-129.249 0-454.326 0-454.326 0v-191.68z" fill="#0051b0" fill-rule="nonzero"></path><path d="m0 822.101c0 13.817 5.497 27.067 15.277 36.827 9.781 9.76 23.043 15.229 36.86 15.199 18.675-.04 39.713-.085 58.368-.124 28.69-.062 51.916-23.337 51.916-52.027 0-155.205 0-614.509 0-769.714 0-28.69-23.226-51.965-51.916-52.026-18.655-.04-39.693-.085-58.368-.125-13.817-.029-27.079 5.439-36.86 15.199-9.78 9.76-15.277 23.01-15.277 36.827v769.964z" fill="url(#uicons-payvanzieq)" fill-rule="nonzero"></path></svg>
\ No newline at end of file
diff --git a/application/src/main/resources/static/js/main.js b/application/src/main/resources/static/js/main.js
new file mode 100644
index 0000000000..2db2e606b1
--- /dev/null
+++ b/application/src/main/resources/static/js/main.js
@@ -0,0 +1,154 @@
+const Toast = (function () {
+    let container;
+
+    function getContainer() {
+        if (container) return container;
+
+        container = document.createElement("div");
+        container.style.cssText = `
+      position: fixed;
+      top: 20px;
+      left: 50%;
+      transform: translateX(-50%);
+      z-index: 9999;
+    `;
+
+        if (document.body) {
+            document.body.appendChild(container);
+        } else {
+            document.addEventListener("DOMContentLoaded", () => {
+                document.body.appendChild(container);
+            });
+        }
+
+        return container;
+    }
+
+    class ToastMessage {
+        constructor(message, type) {
+            this.message = message;
+            this.type = type;
+            this.element = null;
+            this.create();
+        }
+
+        create() {
+            this.element = document.createElement("div");
+            this.element.textContent = this.message;
+            this.element.style.cssText = `
+        background-color: ${this.type === "success" ? "#4CAF50" : "#F44336"};
+        color: white;
+        padding: 12px 24px;
+        border-radius: 4px;
+        margin-bottom: 10px;
+        box-shadow: 0 2px 5px rgba(0,0,0,0.2);
+        opacity: 0;
+        transition: opacity 0.3s ease-in-out;
+      `;
+            getContainer().appendChild(this.element);
+
+            setTimeout(() => {
+                this.element.style.opacity = "1";
+            }, 10);
+
+            setTimeout(() => {
+                this.remove();
+            }, 3000);
+        }
+
+        remove() {
+            this.element.style.opacity = "0";
+            setTimeout(() => {
+                const parent = this.element.parentNode;
+                if (parent) {
+                    parent.removeChild(this.element);
+                }
+            }, 300);
+        }
+    }
+
+    function showToast(message, type) {
+        if (document.readyState === "loading") {
+            document.addEventListener("DOMContentLoaded", () => {
+                new ToastMessage(message, type);
+            });
+        } else {
+            new ToastMessage(message, type);
+        }
+    }
+
+    return {
+        success: function (message) {
+            showToast(message, "success");
+        },
+        error: function (message) {
+            showToast(message, "error");
+        },
+    };
+})();
+
+function sendVerificationCode(button, sendRequest) {
+    let timer;
+    const countdown = 60;
+
+    button.addEventListener("click", () => {
+        button.disabled = true;
+        sendRequest()
+            .then(() => {
+                startCountdown();
+                Toast.success("发送成功");
+            })
+            .catch((e) => {
+                button.disabled = false;
+                if (e instanceof Error) {
+                    Toast.error(e.message);
+                } else {
+                    Toast.error("发送失败，请稍后再试");
+                }
+            });
+    });
+
+    function startCountdown() {
+        let remainingTime = countdown;
+        button.disabled = true;
+        button.classList.add("disabled");
+
+        timer = setInterval(() => {
+            if (remainingTime > 0) {
+                button.textContent = `${remainingTime}s`;
+                remainingTime--;
+            } else {
+                clearInterval(timer);
+                button.textContent = "Send";
+                button.disabled = false;
+                button.classList.remove("disabled");
+            }
+        }, 1000);
+    }
+}
+
+document.addEventListener("DOMContentLoaded", () => {
+    const passwordContainers = document.querySelectorAll(".toggle-password-display-flag");
+
+    passwordContainers.forEach((container) => {
+        const passwordInput = container.querySelector('input[type="password"]');
+        const toggleButton = container.querySelector(".toggle-password-button");
+        const displayIcon = container.querySelector(".password-display-icon");
+        const hiddenIcon = container.querySelector(".password-hidden-icon");
+
+        if (passwordInput && toggleButton && displayIcon && hiddenIcon) {
+            toggleButton.addEventListener("click", () => {
+                if (passwordInput.type === "password") {
+                    passwordInput.type = "text";
+                    displayIcon.style.display = "none";
+                    hiddenIcon.style.display = "block";
+                } else {
+                    passwordInput.type = "password";
+                    displayIcon.style.display = "block";
+                    hiddenIcon.style.display = "none";
+                }
+            });
+        }
+    });
+});
+
diff --git a/application/src/main/resources/static/styles/main.css b/application/src/main/resources/static/styles/main.css
new file mode 100644
index 0000000000..9d062b0007
--- /dev/null
+++ b/application/src/main/resources/static/styles/main.css
@@ -0,0 +1,410 @@
+/* Base */
+.gateway-page {
+    width: 100vw;
+    height: 100vh;
+    background-color: #f5f5f5;
+    overflow: auto;
+}
+
+.gateway-wrapper,
+.gateway-wrapper:before,
+.gateway-wrapper:after {
+    box-sizing: border-box;
+    border-width: 0;
+    border-style: solid;
+}
+
+.gateway-wrapper *,
+.gateway-wrapper *:before,
+.gateway-wrapper *:after {
+    box-sizing: border-box;
+    border-width: 0;
+    border-style: solid;
+}
+
+.gateway-wrapper {
+    --color-primary: #4ccba0;
+    --color-secondary: #0e1731;
+    --color-link: #1f75cb;
+    --color-text: #374151;
+    --color-border: #d1d5db;
+    --rounded-sm: 0.125em;
+    --rounded-base: 0.25em;
+    --rounded-lg: 0.5em;
+    --spacing-xl: 1.25em;
+    --spacing-lg: 1em;
+    --spacing-md: 0.875em;
+    --spacing-sm: 0.5em;
+    --text-md: 0.875em;
+}
+
+.gateway-wrapper {
+    margin: 0 auto;
+    max-width: 28em;
+    padding: 5% 1em;
+    font-family:
+        ui-sans-serif,
+        system-ui,
+        -apple-system,
+        BlinkMacSystemFont,
+        Segoe UI,
+        Roboto,
+        Helvetica Neue,
+        Arial,
+        Noto Sans,
+        sans-serif,
+        "Apple Color Emoji",
+        "Segoe UI Emoji",
+        Segoe UI Symbol,
+        "Noto Color Emoji";
+}
+
+/* Form */
+.halo-form-wrapper {
+    border-radius: var(--rounded-lg);
+    background: #fff;
+    padding: 1.5em;
+}
+
+.form-title {
+    all: unset;
+    margin-bottom: 1em;
+    display: block;
+    font-weight: 500;
+    font-size: 1.75em;
+}
+
+.halo-form .form-item {
+    display: flex;
+    flex-direction: column;
+    margin-bottom: 1.3em;
+    width: 100%;
+}
+
+.halo-form .form-item:last-child {
+    margin-bottom: 0;
+}
+
+.halo-form .form-item-group {
+    gap: var(--spacing-lg);
+    display: flex;
+    align-items: center;
+    margin-bottom: 1.3em;
+}
+
+.halo-form .form-item-group .form-item {
+    margin-bottom: 0;
+}
+
+.halo-form .form-input {
+    border-radius: var(--rounded-base);
+    border: 1px solid var(--color-border);
+    height: 2.5em;
+    background: #fff;
+    padding: 0 0.75rem;
+}
+
+.halo-form .form-input:focus-within {
+    border-color: var(--color-primary);
+    outline: 2px solid transparent;
+    outline-offset: "2px";
+}
+
+.halo-form .form-item input {
+    appearance: none;
+    -webkit-appearance: none;
+    -moz-appearance: none;
+    display: block;
+    font-size: 1em;
+    box-shadow: none;
+    width: 100%;
+    height: 100%;
+    background: transparent;
+}
+
+.halo-form .form-item input:focus {
+    outline: none;
+}
+
+.halo-form .form-input-stack {
+    display: flex;
+    align-items: center;
+    gap: 0.5em;
+}
+
+.halo-form .form-input-stack-icon {
+    display: inline-flex;
+    align-items: center;
+    color: var(--color-text);
+    cursor: pointer;
+}
+
+.halo-form .form-input-stack-select {
+    all: unset;
+    color: var(--color-text);
+    font-size: var(--text-md);
+    padding-right: 1.85em;
+    display: inline-flex;
+    align-items: center;
+    background: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='1em' height='1em' viewBox='0 0 24 24'%3E%3Cpath fill='%23000' d='m12 13.171l4.95-4.95l1.414 1.415L12 16L5.636 9.636L7.05 8.222z'/%3E%3C/svg%3E");
+    background-repeat: no-repeat;
+    background-position: right 0.3em center;
+}
+
+.halo-form .form-input-stack-text {
+    color: var(--color-text);
+    font-size: var(--text-md);
+}
+
+.halo-form .form-item label {
+    color: var(--color-text);
+    margin-bottom: 0.5em;
+}
+
+.halo-form .form-item .form-label-group {
+    margin-bottom: 0.5em;
+    display: flex;
+    justify-content: space-between;
+    align-items: center;
+}
+
+.halo-form .form-item .form-label-group label {
+    margin-bottom: 0;
+}
+
+.halo-form .form-item-extra-link {
+    color: var(--color-link);
+    font-size: var(--text-md);
+    text-decoration: none;
+}
+
+.halo-form .form-item-compact {
+    gap: var(--spacing-sm);
+    margin-bottom: 1.5em;
+    display: flex;
+    align-items: center;
+}
+
+.halo-form .form-item-compact label {
+    color: var(--color-text);
+    font-size: var(--text-md);
+}
+
+.halo-form button[type="submit"] {
+    background: var(--color-secondary);
+    border-radius: var(--rounded-base);
+    height: 2.5em;
+    color: #fff;
+    border: none;
+    cursor: pointer;
+}
+
+.halo-form button[type="submit"]:hover {
+    opacity: 0.8;
+}
+
+.halo-form button[type="submit"]:active {
+    opacity: 0.9;
+}
+
+.halo-form button[disabled] {
+    cursor: not-allowed !important;
+}
+
+.halo-form input[type="checkbox"] {
+    border: 1px solid var(--color-border);
+    border-radius: var(--rounded-sm);
+    appearance: none;
+    -webkit-appearance: none;
+    -moz-appearance: none;
+    padding: 0;
+    print-color-adjust: exact;
+    display: inline-block;
+    vertical-align: middle;
+    background-origin: border-box;
+    user-select: none;
+    flex-shrink: 0;
+    height: 1em;
+    width: 1em;
+    color: #2563eb;
+    background-color: #fff;
+}
+
+.halo-form input[type="checkbox"]:focus {
+    outline: 2px solid transparent;
+    outline-offset: 2px;
+    box-shadow:
+        rgb(255, 255, 255) 0px 0px 0px 2px,
+        rgb(37, 99, 235) 0px 0px 0px 4px,
+        rgba(0, 0, 0, 0) 0px 0px 0px 0px;
+}
+
+.halo-form input[type="checkbox"]:checked {
+    border-color: transparent;
+    background-color: currentColor;
+    background-size: 100% 100%;
+    background-position: center;
+    background-repeat: no-repeat;
+    background-image: url("data:image/svg+xml,%3csvg viewBox='0 0 16 16' fill='white' xmlns='http://www.w3.org/2000/svg'%3e%3cpath d='M12.207 4.793a1 1 0 010 1.414l-5 5a1 1 0 01-1.414 0l-2-2a1 1 0 011.414-1.414L6.5 9.086l4.293-4.293a1 1 0 011.414 0z'/%3e%3c/svg%3e");
+}
+
+.halo-form .form-input-group {
+    gap: var(--spacing-sm);
+    display: grid;
+    grid-template-columns: repeat(3, minmax(0, 1fr));
+    align-items: center;
+}
+
+.halo-form .form-input {
+    grid-column: span 2 / span 2;
+}
+
+.halo-form .form-input-group button {
+    border-radius: var(--rounded-base);
+    border: 1px solid var(--color-border);
+    color: var(--color-text);
+    font-size: var(--text-md);
+    grid-column: span 1 / span 1;
+    height: 100%;
+    cursor: pointer;
+    background: #fff;
+}
+
+.halo-form .form-input-group button:hover {
+    color: #333;
+    background: #f3f4f6;
+}
+
+.halo-form .form-input-group button:active {
+    background: #f9fafb;
+}
+
+.auth-provider-items {
+    all: unset;
+    gap: var(--spacing-md);
+    margin: 0;
+    display: flex;
+    flex-wrap: wrap;
+    justify-content: center;
+}
+
+.auth-provider-items li {
+    all: unset;
+    border-radius: var(--rounded-lg);
+    overflow: hidden;
+    border: 1px solid #e5e7eb;
+    transition-property: all;
+    transition-timing-function: cubic-bezier(0.4, 0, 0.2, 1);
+    transition-duration: 0.15s;
+}
+
+.auth-provider-items li a {
+    gap: var(--spacing-sm);
+    padding: 0.7em 1em;
+    display: flex;
+    align-items: center;
+    color: #1f2937;
+    text-decoration: none;
+    font-size: 0.8em;
+}
+
+.auth-provider-items li img {
+    width: 1.5em;
+    height: 1.5em;
+}
+
+.auth-provider-items li:hover {
+    border-color: var(--color-primary);
+    background: #f3f4f6;
+}
+
+.auth-provider-items li:hover a {
+    color: #111827;
+}
+
+.auth-provider-items li:focus-within {
+    border-color: var(--color-primary);
+}
+
+.divider-wrapper {
+    color: var(--color-text);
+    font-size: var(--text-md);
+    gap: var(--spacing-lg);
+    display: flex;
+    align-items: center;
+    margin: 1.5em 0;
+}
+
+.divider-wrapper hr {
+    flex-grow: 1;
+    overflow: hidden;
+    border: 0;
+    border-top: 1px solid #f3f4f6;
+}
+
+.alert {
+    border: 1px solid #e5e7eb;
+    border-radius: var(--rounded-base);
+    margin-bottom: var(--spacing-xl);
+    padding: var(--spacing-md) var(--spacing-xl);
+    font-size: var(--text-md);
+    overflow: hidden;
+    position: relative;
+    color: var(--color-text);
+}
+
+.alert::before {
+    content: "";
+    position: absolute;
+    height: 100%;
+    left: 0;
+    background: #d1d5db;
+    width: 0.25em;
+    top: 0;
+}
+
+.alert-warning {
+    border-color: #fde047;
+}
+
+.alert-warning::before {
+    background: #ea580c;
+}
+
+.alert-error {
+    border-color: #fca5a5;
+}
+
+.alert-error::before {
+    background: #dc2626;
+}
+
+.alert-success {
+    border-color: #86efac;
+}
+
+.alert-success::before {
+    background: #16a34a;
+}
+
+.alert-info {
+    border-color: #7dd3fc;
+}
+
+.alert-info::before {
+    background: #0284c7;
+}
+
+@media (forced-colors: active) {
+    .halo-form input[type="checkbox"]:checked {
+        -webkit-appearance: auto;
+        -moz-appearance: auto;
+        appearance: auto;
+    }
+}
+
+@media only screen and (max-width: 768px) {
+    .halo-form .form-item-group {
+        flex-direction: column;
+    }
+}
diff --git a/application/src/main/resources/templates/challenges/two-factor/totp.html b/application/src/main/resources/templates/challenges/two-factor/totp.html
new file mode 100644
index 0000000000..96baa8d8c2
--- /dev/null
+++ b/application/src/main/resources/templates/challenges/two-factor/totp.html
@@ -0,0 +1,43 @@
+<!doctype html>
+<html
+    xmlns:th="https://www.thymeleaf.org"
+    th:replace="~{gateway_modules/layout :: layout(title = |#{title} - ${site.title}|, head = null, body = ~{::body})}"
+>
+    <th:block th:fragment="body">
+        <div class="gateway-wrapper">
+            <div th:replace="~{gateway_modules/common_fragments::haloLogo}"></div>
+            <div class="halo-form-wrapper">
+                <h1 class="form-title" th:text="#{title}"></h1>
+                <form
+                    class="halo-form"
+                    th:action="@{/challenges/two-factor/totp}"
+                    name="two-factor-form"
+                    id="two-factor-form"
+                    method="post"
+                >
+                    <div class="alert alert-error" role="alert" th:if="${param.error.size() > 0}">
+                        <strong th:text="#{messages.invalidError}"></strong>
+                    </div>
+                    <div class="form-item">
+                        <label for="code" th:text="#{form.code.label}"></label>
+                        <div class="form-input">
+                            <input
+                                type="text"
+                                inputmode="numeric"
+                                id="code"
+                                name="code"
+                                autocomplete="one-time-code"
+                                pattern="\d{6}"
+                                autofocus
+                                required
+                            />
+                        </div>
+                    </div>
+                    <div class="form-item">
+                        <button type="submit" th:text="#{form.submit}"></button>
+                    </div>
+                </form>
+            </div>
+        </div>
+    </th:block>
+</html>
diff --git a/application/src/main/resources/templates/challenges/two-factor/totp.properties b/application/src/main/resources/templates/challenges/two-factor/totp.properties
new file mode 100644
index 0000000000..46f96ed978
--- /dev/null
+++ b/application/src/main/resources/templates/challenges/two-factor/totp.properties
@@ -0,0 +1,4 @@
+title=两步验证
+messages.invalidError=错误的验证码
+form.code.label=验证码
+form.submit=验证
diff --git a/application/src/main/resources/templates/challenges/two-factor/totp_en.properties b/application/src/main/resources/templates/challenges/two-factor/totp_en.properties
new file mode 100644
index 0000000000..bffc96863a
--- /dev/null
+++ b/application/src/main/resources/templates/challenges/two-factor/totp_en.properties
@@ -0,0 +1,4 @@
+title=Two-Factor Authentication
+messages.invalidError=Invalid TOTP code
+form.code.label=TOTP Code
+form.submit=Verify
diff --git a/application/src/main/resources/templates/gateway_modules/common_fragments.html b/application/src/main/resources/templates/gateway_modules/common_fragments.html
new file mode 100644
index 0000000000..75d718ca33
--- /dev/null
+++ b/application/src/main/resources/templates/gateway_modules/common_fragments.html
@@ -0,0 +1,110 @@
+<th:block th:fragment="basicStaticResources">
+    <script th:inline="javascript">
+        const resources = {
+            title: `[(#{title})]`,
+        };
+    </script>
+
+    <link rel="stylesheet" href="/webjars/normalize.css/8.0.1/normalize.css" />
+    <link rel="stylesheet" th:href="|/styles/main.css?v=${site.version}|" />
+
+    <script src="/js/main.js"></script>
+</th:block>
+
+<div th:remove="tag" th:fragment="languageSwitcher">
+    <style>
+        .language-switcher {
+            display: flex;
+            align-items: center;
+            justify-content: center;
+            margin: 2em 0;
+            gap: 0.625rem;
+        }
+
+        .language-switcher label {
+            color: var(--color-text);
+            display: inline-flex;
+        }
+
+        .language-switcher select {
+            all: unset;
+            border: 1px solid var(--color-border);
+            font-size: var(--text-md);
+            height: 2em;
+            border-radius: var(--rounded-lg);
+            outline: none;
+            padding: 0 2em 0 0.5em;
+            display: inline-flex;
+            align-items: center;
+            color: var(--color-text);
+            background-color: var(--color-text);
+            background: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='1em' height='1em' viewBox='0 0 24 24'%3E%3Cpath fill='%23000' d='m12 13.171l4.95-4.95l1.414 1.415L12 16L5.636 9.636L7.05 8.222z'/%3E%3C/svg%3E");
+            background-repeat: no-repeat;
+            background-position: right 0.45rem center;
+        }
+
+        .language-switcher select:focus {
+            border-color: var(--color-primary);
+        }
+    </style>
+    <div class="language-switcher">
+        <label>
+            <svg viewBox="0 0 24 24" width="1.2em" height="1.2em">
+                <path
+                    fill="currentColor"
+                    d="m12.87 15.07l-2.54-2.51l.03-.03A17.5 17.5 0 0 0 14.07 6H17V4h-7V2H8v2H1v2h11.17C11.5 7.92 10.44 9.75 9 11.35C8.07 10.32 7.3 9.19 6.69 8h-2c.73 1.63 1.73 3.17 2.98 4.56l-5.09 5.02L4 19l5-5l3.11 3.11zM18.5 10h-2L12 22h2l1.12-3h4.75L21 22h2zm-2.62 7l1.62-4.33L19.12 17z"
+                ></path>
+            </svg>
+        </label>
+        <select id="language-select" onchange="changeLanguage()">
+            <option value="en" th:selected="${#locale.toLanguageTag} == 'en'">English</option>
+            <option value="es" th:selected="${#locale.toLanguageTag} == 'es'">Español</option>
+            <option value="zh-CN" th:selected="${#locale.toLanguageTag} == 'zh-CN'">简体中文</option>
+            <option value="zh-TW" th:selected="${#locale.toLanguageTag} == 'zh-TW'">繁体中文</option>
+        </select>
+        <script type="text/javascript">
+            function changeLanguage() {
+                const selectedLanguage = document.getElementById("language-select").value;
+                const currentURL = new URL(window.location.href);
+                currentURL.searchParams.set("language", selectedLanguage);
+                window.location.href = currentURL.toString();
+            }
+        </script>
+    </div>
+</div>
+
+<div th:remove="tag" th:fragment="haloLogo">
+    <style>
+        .halo-logo {
+            width: 100%;
+            display: flex;
+            justify-content: center;
+            margin-bottom: 2em;
+        }
+
+        .halo-logo img {
+            width: 6em;
+        }
+    </style>
+    <div class="halo-logo">
+        <img src="/images/wordmark.svg" />
+    </div>
+</div>
+
+<div th:remove="tag" th:fragment="socialAuthProviders">
+    <th:block th:unless="${#lists.isEmpty(socialAuthProviders)}">
+        <div class="divider-wrapper">
+            <hr />
+            <th:block th:text="#{socialLogin.label}"></th:block>
+            <hr />
+        </div>
+        <ul class="auth-provider-items">
+            <li th:each="provider : ${socialAuthProviders}">
+                <a th:href="${provider.spec.authenticationUrl}">
+                    <img th:src="${provider.spec.logo}" />
+                    <span th:text="${provider.spec.displayName}"></span>
+                </a>
+            </li>
+        </ul>
+    </th:block>
+</div>
diff --git a/application/src/main/resources/templates/gateway_modules/common_fragments.properties b/application/src/main/resources/templates/gateway_modules/common_fragments.properties
new file mode 100644
index 0000000000..6617dd0d7b
--- /dev/null
+++ b/application/src/main/resources/templates/gateway_modules/common_fragments.properties
@@ -0,0 +1 @@
+socialLogin.label=社交登录
\ No newline at end of file
diff --git a/application/src/main/resources/templates/gateway_modules/common_fragments_en.properties b/application/src/main/resources/templates/gateway_modules/common_fragments_en.properties
new file mode 100644
index 0000000000..a10abbb87c
--- /dev/null
+++ b/application/src/main/resources/templates/gateway_modules/common_fragments_en.properties
@@ -0,0 +1 @@
+socialLogin.label=Social Login
\ No newline at end of file
diff --git a/application/src/main/resources/templates/gateway_modules/input_fragments.html b/application/src/main/resources/templates/gateway_modules/input_fragments.html
new file mode 100644
index 0000000000..ffffb5cd6a
--- /dev/null
+++ b/application/src/main/resources/templates/gateway_modules/input_fragments.html
@@ -0,0 +1,31 @@
+<div th:remove="tag" th:fragment="password(id,name,required,minlength,enableToggle)">
+    <div class="form-input" th:classappend="${enableToggle ? 'form-input-stack toggle-password-display-flag' : ''}">
+        <input
+            th:id="${id}"
+            th:name="${name}"
+            type="password"
+            autocomplete="off"
+            spellcheck="false"
+            autocorrect="off"
+            autocapitalize="off"
+            th:required="${required}"
+            th:minlength="${minlength}"
+        />
+
+        <div th:if="${enableToggle}" class="form-input-stack-icon toggle-password-button">
+            <svg class="password-hidden-icon" style="display: none" viewBox="0 0 24 24" width="1em" height="1em">
+                <path
+                    fill="currentColor"
+                    d="M12 3c5.392 0 9.878 3.88 10.819 9c-.94 5.12-5.427 9-10.819 9c-5.392 0-9.878-3.88-10.818-9C2.122 6.88 6.608 3 12 3Zm0 16a9.005 9.005 0 0 0 8.778-7a9.005 9.005 0 0 0-17.555 0A9.005 9.005 0 0 0 12 19Zm0-2.5a4.5 4.5 0 1 1 0-9a4.5 4.5 0 0 1 0 9Zm0-2a2.5 2.5 0 1 0 0-5a2.5 2.5 0 0 0 0 5Z"
+                ></path>
+            </svg>
+
+            <svg class="password-display-icon" viewBox="0 0 24 24" width="1em" height="1em">
+                <path
+                    fill="currentColor"
+                    d="M17.883 19.297A10.949 10.949 0 0 1 12 21c-5.392 0-9.878-3.88-10.818-9A10.982 10.982 0 0 1 4.52 5.935L1.394 2.808l1.414-1.414l19.799 19.798l-1.414 1.415l-3.31-3.31ZM5.936 7.35A8.965 8.965 0 0 0 3.223 12a9.005 9.005 0 0 0 13.201 5.838l-2.028-2.028A4.5 4.5 0 0 1 8.19 9.604L5.936 7.35Zm6.978 6.978l-3.242-3.241a2.5 2.5 0 0 0 3.241 3.241Zm7.893 2.265l-1.431-1.431A8.935 8.935 0 0 0 20.778 12A9.005 9.005 0 0 0 9.552 5.338L7.974 3.76C9.221 3.27 10.58 3 12 3c5.392 0 9.878 3.88 10.819 9a10.947 10.947 0 0 1-2.012 4.593Zm-9.084-9.084a4.5 4.5 0 0 1 4.769 4.769l-4.77-4.77Z"
+                ></path>
+            </svg>
+        </div>
+    </div>
+</div>
diff --git a/application/src/main/resources/templates/gateway_modules/layout.html b/application/src/main/resources/templates/gateway_modules/layout.html
new file mode 100644
index 0000000000..126838d12a
--- /dev/null
+++ b/application/src/main/resources/templates/gateway_modules/layout.html
@@ -0,0 +1,23 @@
+<!doctype html>
+<html th:lang="${#locale.toLanguageTag}" th:fragment="layout (title,head,body)">
+    <head>
+        <meta charset="UTF-8" />
+        <meta content="IE=edge" http-equiv="X-UA-Compatible" />
+        <meta content="webkit" name="renderer" />
+        <meta
+            content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no, viewport-fit=cover"
+            name="viewport"
+        />
+        <meta content="noindex,nofollow" name="robots" />
+        <title th:text="${title}"></title>
+
+        <th:block th:replace="~{gateway_modules/common_fragments::basicStaticResources}"></th:block>
+
+        <th:block th:if="${head != null}">
+            <th:block th:replace="${head}" />
+        </th:block>
+    </head>
+    <body class="gateway-page">
+        <th:block th:replace="${body}" />
+    </body>
+</html>
diff --git a/application/src/main/resources/templates/gateway_modules/login_fragments.html b/application/src/main/resources/templates/gateway_modules/login_fragments.html
new file mode 100644
index 0000000000..87e8fe64ca
--- /dev/null
+++ b/application/src/main/resources/templates/gateway_modules/login_fragments.html
@@ -0,0 +1,95 @@
+<!-- Those fragments are only for login template-->
+<form
+        th:fragment="form"
+        class="halo-form"
+        name="login-form"
+        id="login-form"
+        th:action="${authProvider.spec.authenticationUrl}"
+        th:method="${authProvider.spec.method}"
+>
+    <div class="alert alert-error" role="alert" th:if="${param.error.size() > 0}" th:with="error = ${param.error[0]}">
+        <strong th:if="${error == 'invalid-credential'}">
+            <span th:text="#{error.invalid-credential}"></span>
+        </strong>
+        <strong th:if="${error == 'rate-limit-exceeded'}">
+            <span th:text="#{error.rate-limit-exceeded}"></span>
+        </strong>
+    </div>
+    <div class="alert" role="alert" th:if="${param.logout.size() > 0}">
+        <strong th:text="#{messages.logoutSuccess}"></strong>
+    </div>
+    <div class="alert" role="alert" th:if="${param.signup.size() > 0}">
+        <strong th:text="#{messages.signupSuccess}"> </strong>
+    </div>
+
+    <div th:replace="~{__${fragmentTemplateName}__::form}"></div>
+
+    <div th:if="${authProvider.spec.rememberMeSupport}" class="form-item-compact">
+        <input type="checkbox" id="remember-me" name="remember-me" value="true"/>
+        <label for="remember-me" th:text="#{form.rememberMe.label}"></label>
+    </div>
+
+    <div class="form-item">
+        <button type="submit" th:text="#{form.submit}"></button>
+    </div>
+</form>
+
+<div th:remove="tag" th:fragment="formAuthProviders">
+    <th:block th:unless="${#lists.isEmpty(formAuthProviders)}">
+        <div class="divider-wrapper">
+            <hr/>
+            <th:block th:text="#{otherLogin.label}"></th:block>
+            <hr/>
+        </div>
+        <ul class="auth-provider-items">
+            <li th:each="provider : ${formAuthProviders}">
+                <a th:href="'/login?method=' + ${provider.metadata.name}">
+                    <img th:src="${provider.spec.logo}"/>
+                    <span th:text="${provider.spec.displayName}"></span>
+                </a>
+            </li>
+        </ul>
+    </th:block>
+</div>
+
+<div th:remove="tag" th:fragment="miscellaneous">
+    <style>
+        .signup-notice,
+        .returntosite-notice {
+            font-size: var(--text-md);
+            color: var(--color-text);
+            text-align: center;
+            margin: 1em 0;
+        }
+
+        .signup-notice a {
+            color: var(--color-link);
+        }
+
+        .returntosite-notice a {
+            color: var(--color-text);
+            display: inline-flex;
+            align-items: center;
+            gap: 0.3em;
+        }
+
+        .returntosite-notice a,
+        .signup-notice a {
+            text-decoration: none;
+        }
+    </style>
+    <div th:if="${globalInfo.allowRegistration}" class="signup-notice">
+        <div>
+            <th:block th:text="#{signup.description}"></th:block>
+            <a th:href="@{/signup}" th:text="#{signup.link}"></a>
+        </div>
+    </div>
+    <div class="returntosite-notice">
+        <a th:href="@{/}">
+            <svg viewBox="0 0 24 24" width="1.2em" height="1.2em">
+                <path fill="currentColor" d="M21 11H6.83l3.58-3.59L9 6l-6 6l6 6l1.41-1.42L6.83 13H21z"></path>
+            </svg>
+            <span th:text="#{returnToSite}"></span>
+        </a>
+    </div>
+</div>
diff --git a/application/src/main/resources/templates/gateway_modules/login_fragments.properties b/application/src/main/resources/templates/gateway_modules/login_fragments.properties
new file mode 100644
index 0000000000..5752dae82f
--- /dev/null
+++ b/application/src/main/resources/templates/gateway_modules/login_fragments.properties
@@ -0,0 +1,13 @@
+messages.loginError=无效的凭证。
+messages.logoutSuccess=登出成功。
+messages.signupSuccess=恭喜！注册成功，请立即登录。
+
+error.invalid-credential=无效的凭证。
+error.rate-limit-exceeded=请求过于频繁，请稍后再试。
+
+form.rememberMe.label=保持登录会话
+form.submit=登录
+otherLogin.label=其他登录方式
+signup.description=没有账号？
+signup.link=立即注册
+returnToSite=返回网站
\ No newline at end of file
diff --git a/application/src/main/resources/templates/gateway_modules/login_fragments_en.properties b/application/src/main/resources/templates/gateway_modules/login_fragments_en.properties
new file mode 100644
index 0000000000..d3b5b33f46
--- /dev/null
+++ b/application/src/main/resources/templates/gateway_modules/login_fragments_en.properties
@@ -0,0 +1,13 @@
+messages.loginError=Invalid credentials.
+messages.logoutSuccess=Logout successfully.
+messages.signupSuccess=Congratulations! Sign up successfully, please sign in now.
+
+error.invalid-credential=Invalid credentials.
+error.rate-limit-exceeded=Too many requests, please try again later.
+
+form.rememberMe.label=Remember me
+form.submit=Login
+otherLogin.label=Other Login
+signup.description=Don't have an account?
+signup.link=Sign up
+returnToSite=Return to site
\ No newline at end of file
diff --git a/application/src/main/resources/templates/login.html b/application/src/main/resources/templates/login.html
new file mode 100644
index 0000000000..47d8084593
--- /dev/null
+++ b/application/src/main/resources/templates/login.html
@@ -0,0 +1,20 @@
+<!doctype html>
+<html
+    xmlns:th="https://www.thymeleaf.org"
+    th:replace="~{gateway_modules/layout :: layout(title = |#{title} - ${site.title}|, head = null, body = ~{::body})}"
+>
+    <th:block th:fragment="body">
+        <div class="gateway-wrapper">
+            <div th:replace="~{gateway_modules/common_fragments::haloLogo}"></div>
+
+            <div class="halo-form-wrapper">
+                <form th:replace="~{gateway_modules/login_fragments::form}"></form>
+                <div th:replace="~{gateway_modules/login_fragments::formAuthProviders}"></div>
+                <div th:replace="~{gateway_modules/common_fragments::socialAuthProviders}"></div>
+            </div>
+
+            <div th:replace="~{gateway_modules/login_fragments::miscellaneous}"></div>
+            <div th:replace="~{gateway_modules/common_fragments::languageSwitcher}"></div>
+        </div>
+    </th:block>
+</html>
\ No newline at end of file
diff --git a/application/src/main/resources/templates/login.properties b/application/src/main/resources/templates/login.properties
new file mode 100644
index 0000000000..26367c07cb
--- /dev/null
+++ b/application/src/main/resources/templates/login.properties
@@ -0,0 +1 @@
+title=登录
\ No newline at end of file
diff --git a/application/src/main/resources/templates/login_email.html b/application/src/main/resources/templates/login_email.html
new file mode 100644
index 0000000000..cbdda6d645
--- /dev/null
+++ b/application/src/main/resources/templates/login_email.html
@@ -0,0 +1,37 @@
+<div th:remove="tag" th:fragment="form">
+    <div class="form-item">
+        <label for="email"> Email </label>
+
+        <div class="form-input">
+            <input
+                type="email"
+                id="email"
+                name="email"
+                autocomplete="off"
+                spellcheck="false"
+                autocorrect="off"
+                autocapitalize="off"
+                required
+                autofocus
+            />
+        </div>
+    </div>
+    <div class="form-item">
+        <label for="code"> Code </label>
+        <div class="form-input-group">
+            <div class="form-input">
+                <input
+                    type="text"
+                    id="code"
+                    name="code"
+                    autocomplete="off"
+                    spellcheck="false"
+                    autocorrect="off"
+                    autocapitalize="off"
+                    required
+                />
+            </div>
+            <button type="button">Send</button>
+        </div>
+    </div>
+</div>
\ No newline at end of file
diff --git a/application/src/main/resources/templates/login_en.properties b/application/src/main/resources/templates/login_en.properties
new file mode 100644
index 0000000000..eb0443eed6
--- /dev/null
+++ b/application/src/main/resources/templates/login_en.properties
@@ -0,0 +1 @@
+title=Login
diff --git a/application/src/main/resources/templates/login_local.html b/application/src/main/resources/templates/login_local.html
new file mode 100644
index 0000000000..3ae24d4001
--- /dev/null
+++ b/application/src/main/resources/templates/login_local.html
@@ -0,0 +1,56 @@
+<div th:remove="tag" th:fragment="form">
+    <script src="/webjars/jsencrypt/3.3.2/bin/jsencrypt.min.js" defer></script>
+    <script th:inline="javascript" type="text/javascript">
+        const publicKey = /*[[${publicKey}]]*/ "";
+
+        // Encrypt function
+        function encryptPassword(password) {
+            const encrypt = new JSEncrypt();
+            encrypt.setPublicKey(publicKey);
+            return encrypt.encrypt(password);
+        }
+
+        document.addEventListener("DOMContentLoaded", function () {
+            const loginForm = document.getElementById("login-form");
+            loginForm.addEventListener("submit", function (event) {
+                const passwordInput = document.getElementById("password");
+                const password = passwordInput.value;
+                passwordInput.value = encryptPassword(password);
+            });
+        });
+    </script>
+
+    <div class="form-item">
+        <label for="username" th:text="#{form.username.label}"> </label>
+
+        <div class="form-input">
+            <input
+                id="username"
+                name="username"
+                type="text"
+                autocomplete="off"
+                spellcheck="false"
+                autocorrect="off"
+                autocapitalize="off"
+                required
+                autofocus
+            />
+        </div>
+    </div>
+    <div class="form-item">
+        <div class="form-label-group">
+            <label for="password" th:text="#{form.password.label}"> </label>
+            <a
+                class="form-item-extra-link"
+                tabindex="-1"
+                th:href="@{/password-reset}"
+                th:text="#{form.password.forgot}"
+            >
+            </a>
+        </div>
+
+        <th:block
+            th:replace="~{gateway_modules/input_fragments :: password(id = 'password', name = 'password', required = 'true', minlength = null, enableToggle = true)}"
+        ></th:block>
+    </div>
+</div>
diff --git a/application/src/main/resources/templates/login_local.properties b/application/src/main/resources/templates/login_local.properties
new file mode 100644
index 0000000000..8163bfd74d
--- /dev/null
+++ b/application/src/main/resources/templates/login_local.properties
@@ -0,0 +1,3 @@
+form.username.label=用户名
+form.password.label=密码
+form.password.forgot=忘记密码？
diff --git a/application/src/main/resources/templates/login_local_en.properties b/application/src/main/resources/templates/login_local_en.properties
new file mode 100644
index 0000000000..d0fbb09017
--- /dev/null
+++ b/application/src/main/resources/templates/login_local_en.properties
@@ -0,0 +1,3 @@
+form.username.label=Username
+form.password.label=Password
+form.password.forgot=Forgot your password?
diff --git a/application/src/main/resources/templates/logout.html b/application/src/main/resources/templates/logout.html
new file mode 100644
index 0000000000..cafcd1b7f4
--- /dev/null
+++ b/application/src/main/resources/templates/logout.html
@@ -0,0 +1,18 @@
+<!doctype html>
+<html
+    xmlns:th="https://www.thymeleaf.org"
+    th:replace="~{gateway_modules/layout:: layout(title = |#{title} - ${site.title}|, head = null, body = ~{::body})}"
+>
+    <th:block th:fragment="body">
+        <div class="gateway-wrapper">
+            <div class="halo-form-wrapper">
+                <h1 class="form-title" th:text="#{form.title}"></h1>
+                <form class="halo-form" id="logout-form" name="logout-form" th:action="@{/logout}" method="post">
+                    <div class="form-item">
+                        <button type="submit" th:text="#{form.submit}"></button>
+                    </div>
+                </form>
+            </div>
+        </div>
+    </th:block>
+</html>
\ No newline at end of file
diff --git a/application/src/main/resources/templates/logout.properties b/application/src/main/resources/templates/logout.properties
new file mode 100644
index 0000000000..4ff553242b
--- /dev/null
+++ b/application/src/main/resources/templates/logout.properties
@@ -0,0 +1,3 @@
+title=退出登录
+form.title=确定要退出登录吗？
+form.submit=退出登录
diff --git a/application/src/main/resources/templates/logout_en.properties b/application/src/main/resources/templates/logout_en.properties
new file mode 100644
index 0000000000..3ad1587f0b
--- /dev/null
+++ b/application/src/main/resources/templates/logout_en.properties
@@ -0,0 +1,3 @@
+title=Logout
+form.title=Are you sure want to log out?
+form.submit=Logout
\ No newline at end of file
diff --git a/application/src/main/resources/templates/password-reset-link.html b/application/src/main/resources/templates/password-reset-link.html
new file mode 100644
index 0000000000..2a40d4d81b
--- /dev/null
+++ b/application/src/main/resources/templates/password-reset-link.html
@@ -0,0 +1,39 @@
+<!doctype html>
+<html
+    xmlns:th="https://www.thymeleaf.org"
+    th:replace="~{gateway_modules/layout:: layout(title = |#{title(${username})} - ${site.title}|, head = null, body = ~{::body})}"
+>
+    <th:block th:fragment="body">
+        <div class="gateway-wrapper">
+            <div th:replace="~{gateway_modules/common_fragments::haloLogo}"></div>
+            <div class="halo-form-wrapper">
+                <h1 class="form-title" th:text="#{title(${username})}"></h1>
+                <p style="color: red" role="alert" th:if="${error}" th:text="${error}"></p>
+                <form
+                    class="halo-form"
+                    th:action="@{/password-reset/{resetToken}(resetToken=${resetToken})}"
+                    method="post"
+                >
+                    <div class="form-item">
+                        <label for="password" th:text="#{form.password.label}">Password</label>
+                        <th:block
+                            th:replace="~{gateway_modules/input_fragments :: password(id = 'password', name = 'password', required = 'true', minlength = 6, enableToggle = true)}"
+                        ></th:block>
+                    </div>
+                    <div class="form-item">
+                        <label for="confirmPassword" th:text="#{form.confirmPassword.label}">Confirm Password</label>
+                        <th:block
+                            th:replace="~{gateway_modules/input_fragments :: password(id = 'confirmPassword', name = 'confirmPassword', required = 'true', minlength = 6, enableToggle = true)}"
+                        ></th:block>
+                    </div>
+                    <div class="form-item">
+                        <p th:text="#{form.password.tips}"></p>
+                    </div>
+                    <div class="form-item">
+                        <button type="submit" th:text="#{form.submit}">Change password</button>
+                    </div>
+                </form>
+            </div>
+        </div>
+    </th:block>
+</html>
\ No newline at end of file
diff --git a/application/src/main/resources/templates/password-reset-link.properties b/application/src/main/resources/templates/password-reset-link.properties
new file mode 100644
index 0000000000..a401763b38
--- /dev/null
+++ b/application/src/main/resources/templates/password-reset-link.properties
@@ -0,0 +1,5 @@
+title=为 {0} 修改密码
+form.password.label=密码
+form.confirmPassword.label=确认密码
+form.password.tips=密码必须至少包含 8 个字符，并且至少包含一个大写字母、一个小写字母、一个数字和一个特殊字符。
+form.submit=修改密码
diff --git a/application/src/main/resources/templates/password-reset-link_en.properties b/application/src/main/resources/templates/password-reset-link_en.properties
new file mode 100644
index 0000000000..3075f3b839
--- /dev/null
+++ b/application/src/main/resources/templates/password-reset-link_en.properties
@@ -0,0 +1,5 @@
+title=Change password for @{0}
+form.password.label=Password
+form.confirmPassword.label=Confirm Password
+form.password.tips=Password must be at least 8 characters long and contain at least one uppercase letter, one lowercase letter, one number, and one special character.
+form.submit=Change password
diff --git a/application/src/main/resources/templates/password-reset.html b/application/src/main/resources/templates/password-reset.html
new file mode 100644
index 0000000000..3e198e1427
--- /dev/null
+++ b/application/src/main/resources/templates/password-reset.html
@@ -0,0 +1,36 @@
+<!doctype html>
+<html
+    xmlns:th="https://www.thymeleaf.org"
+    th:replace="~{gateway_modules/layout:: layout(title = |#{title} - ${site.title}|, head = null, body = ~{::body})}"
+>
+    <th:block th:fragment="body">
+        <div class="gateway-wrapper">
+            <div th:replace="~{gateway_modules/common_fragments::haloLogo}"></div>
+            <div class="halo-form-wrapper">
+                <h1 class="form-title" th:text="${sent} ? #{sent.title} : #{title}"></h1>
+                <div class="alert alert-error" th:if="${error}">
+                    <strong th:text="${error}"></strong>
+                </div>
+                <form th:if="${sent}" method="get" action="/login" class="halo-form">
+                    <div class="form-item">
+                        <div class="alert" th:text="#{sent.form.message}"></div>
+                    </div>
+                    <div class="form-item">
+                        <button type="submit" th:text="#{sent.form.submit}"></button>
+                    </div>
+                </form>
+                <form th:unless="${sent}" class="halo-form" th:action="@{/password-reset}" method="post">
+                    <div class="form-item">
+                        <label for="email" th:text="#{form.email.label}"></label>
+                        <div class="form-input">
+                            <input type="email" id="email" name="email" autofocus required />
+                        </div>
+                    </div>
+                    <div class="form-item">
+                        <button type="submit" th:text="#{form.submit}"></button>
+                    </div>
+                </form>
+            </div>
+        </div>
+    </th:block>
+</html>
diff --git a/application/src/main/resources/templates/password-reset.properties b/application/src/main/resources/templates/password-reset.properties
new file mode 100644
index 0000000000..f008656fcf
--- /dev/null
+++ b/application/src/main/resources/templates/password-reset.properties
@@ -0,0 +1,6 @@
+title=重置密码
+form.email.label=电子邮箱
+form.submit=提交
+sent.form.submit=返回到登录页面
+sent.form.message=检查您的电子邮件中是否有重置密码的链接。如果几分钟内没有出现，请检查您的垃圾邮件文件夹。
+sent.title=已发送重置密码的邮件
\ No newline at end of file
diff --git a/application/src/main/resources/templates/password-reset_en.properties b/application/src/main/resources/templates/password-reset_en.properties
new file mode 100644
index 0000000000..36555ac691
--- /dev/null
+++ b/application/src/main/resources/templates/password-reset_en.properties
@@ -0,0 +1,6 @@
+title=Reset password
+form.email.label=Email
+form.submit=Submit
+sent.form.submit=Return to login
+sent.form.message=Check your email for a link to reset your password. If it doesn’t appear within a few minutes, check your spam folder.
+sent.title=Password reset email has been sent
\ No newline at end of file
diff --git a/application/src/main/resources/templates/signup.html b/application/src/main/resources/templates/signup.html
new file mode 100644
index 0000000000..01186b5ae3
--- /dev/null
+++ b/application/src/main/resources/templates/signup.html
@@ -0,0 +1,202 @@
+<!doctype html>
+<html
+        xmlns:th="https://www.thymeleaf.org"
+        th:replace="~{gateway_modules/layout :: layout(title = |#{title} - ${site.title}|, head = ~{::head}, body = ~{::body})}"
+>
+<th:block th:fragment="head">
+    <style>
+        .signup-page-wrapper {
+            max-width: 35em;
+        }
+    </style>
+</th:block>
+<th:block th:fragment="body">
+    <div class="gateway-wrapper signup-page-wrapper">
+        <div th:replace="~{gateway_modules/common_fragments::haloLogo}"></div>
+        <div class="halo-form-wrapper">
+            <h1 class="form-title" th:text="#{title}"></h1>
+            <p class="alert alert=erro" role="alert" th:if="${error == 'invalid-email-code'}">
+                <span th:text="#{error.invalid-email-code}">Invalid email code</span>
+            </p>
+            <p class="alert alert=erro" role="alert" th:if="${error == 'rate-limit-exceeded'}">
+                <span th:text="#{error.rate-limit-exceeded}">Rate limit exceeded</span>
+            </p>
+            <p class="alert alert=erro" role="alert" th:if="${error == 'duplicate-name'}">
+                <span th:text="#{error.duplicate-name}">Duplicate name</span>
+            </p>
+            <form class="halo-form" name="signup-form" id="signup-form" th:action="@{/signup}" th:object="${form}"
+                  method="post">
+                <div class="form-item-group">
+                    <div class="form-item">
+                        <label for="username" th:text="#{form.username.label}"></label>
+                        <div class="form-input">
+                            <input
+                                    type="text"
+                                    id="username"
+                                    name="username"
+                                    autocomplete="off"
+                                    spellcheck="false"
+                                    autocorrect="off"
+                                    autocapitalize="off"
+                                    autofocus
+                                    required
+                                    th:field="*{username}"
+                            />
+                        </div>
+                        <p class="alert alert-error"
+                           th:if="${#fields.hasErrors('username')}"
+                           th:errors="*{username}">
+                        </p>
+                    </div>
+
+                    <div class="form-item">
+                        <label for="displayName" th:text="#{form.displayName.label}"></label>
+                        <div class="form-input">
+                            <input
+                                    type="text"
+                                    id="displayName"
+                                    name="displayName"
+                                    autocomplete="off"
+                                    spellcheck="false"
+                                    autocorrect="off"
+                                    autocapitalize="off"
+                                    required
+                                    th:field="*{displayName}"
+                            />
+                        </div>
+                        <p class="alert alert-error"
+                           th:if="${#fields.hasErrors('displayName')}"
+                           th:errors="*{displayName}">
+                        </p>
+                    </div>
+                </div>
+
+                <div class="form-item-group">
+                    <div class="form-item">
+                        <label for="email" th:text="#{form.email.label}"></label>
+                        <div class="form-input">
+                            <input
+                                    type="email"
+                                    id="email"
+                                    name="email"
+                                    autocomplete="off"
+                                    spellcheck="false"
+                                    autocorrect="off"
+                                    autocapitalize="off"
+                                    required
+                                    th:field="*{email}"
+                            />
+                        </div>
+                        <p class="alert alert-error"
+                           th:if="${#fields.hasErrors('email')}"
+                           th:errors="*{email}">
+                        </p>
+                    </div>
+
+                    <div class="form-item" th:if="${globalInfo.mustVerifyEmailOnRegistration}">
+                        <label for="emailCode" th:text="#{form.emailCode.label}"></label>
+                        <div class="form-input-group">
+                            <div class="form-input">
+                                <input
+                                        type="text"
+                                        inputmode="numeric"
+                                        pattern="\d*"
+                                        id="emailCode"
+                                        name="emailCode"
+                                        required
+                                />
+                            </div>
+
+                            <button
+                                    id="emailCodeSendButton"
+                                    type="button"
+                                    th:text="#{form.emailCode.sendButton}"
+                            ></button>
+                        </div>
+                        <p class="alert alert-error"
+                           th:if="${#fields.hasErrors('emailCode')}"
+                           th:errors="*{emailCode}">
+                        </p>
+                    </div>
+                </div>
+
+                <div class="form-item">
+                    <label for="password" th:text="#{form.password.label}"></label>
+                    <th:block
+                            th:replace="~{gateway_modules/input_fragments :: password(id = 'password', name = 'password', required = 'true', minlength = 6, enableToggle = true)}"
+                    ></th:block>
+                    <p class="alert alert-error"
+                       th:if="${#fields.hasErrors('password')}"
+                       th:errors="*{password}">
+                    </p>
+                </div>
+
+                <div class="form-item">
+                    <label for="confirmPassword" th:text="#{form.confirmPassword.label}"></label>
+                    <th:block
+                            th:replace="~{gateway_modules/input_fragments :: password(id = 'confirmPassword', name = null, required = 'true', minlength = 6, enableToggle = true)}"
+                    ></th:block>
+                    <p class="alert alert-error"
+                       th:if="${#fields.hasErrors('confirmPassword')}"
+                       th:errors="*{confirmPassword}">
+                    </p>
+                </div>
+
+                <div class="form-item">
+                    <button type="submit" th:text="#{form.submit}"></button>
+                </div>
+            </form>
+
+            <div th:replace="~{gateway_modules/common_fragments::socialAuthProviders}"></div>
+        </div>
+    </div>
+    <script th:inline="javascript">
+        document.addEventListener("DOMContentLoaded", function () {
+            function sendRequest() {
+                return new Promise((resolve, reject) => {
+                    const email = document.getElementById("email").value;
+
+                    if (!email) {
+                        throw new Error("请先输入邮箱地址");
+                    }
+
+                    fetch("/signup/send-email-code", {
+                        method: "POST",
+                        body: JSON.stringify({ email: email }),
+                        headers: {
+                            "Content-Type": "application/json",
+                            [[${_csrf.headerName}]]: [[${_csrf.token}]],
+                        },
+                    })
+                        .then((response) => {
+                            if (response.ok) {
+                                resolve(response);
+                            }
+                            reject(response);
+                        })
+                        .catch((e) => {
+                            reject(e);
+                        });
+                });
+            }
+
+            const emailCodeSendButton = document.getElementById("emailCodeSendButton");
+            sendVerificationCode(emailCodeSendButton, sendRequest);
+
+            var password = document.getElementById("password"),
+                confirm_password = document.getElementById("confirmPassword");
+
+            function validatePassword() {
+                if (password.value != confirm_password.value) {
+                    confirm_password.setCustomValidity("Passwords Don't Match");
+                } else {
+                    confirm_password.setCustomValidity("");
+                }
+            }
+
+            password.onchange = validatePassword;
+            confirm_password.onkeyup = validatePassword;
+        });
+    </script>
+</th:block>
+</html>
\ No newline at end of file
diff --git a/application/src/main/resources/templates/signup.properties b/application/src/main/resources/templates/signup.properties
new file mode 100644
index 0000000000..ce6a56c6d9
--- /dev/null
+++ b/application/src/main/resources/templates/signup.properties
@@ -0,0 +1,13 @@
+title=注册
+form.username.label=用户名
+form.displayName.label=名称
+form.email.label=电子邮箱
+form.emailCode.label=邮箱验证码
+form.emailCode.sendButton=发送
+form.password.label=密码
+form.confirmPassword.label=确认密码
+form.submit=注册
+
+error.invalid-email-code=无效的邮箱验证码
+error.duplicate-name=用户名已经被注册
+error.rate-limit-exceeded=请求过于频繁，请稍后再试
diff --git a/application/src/main/resources/templates/signup_en.properties b/application/src/main/resources/templates/signup_en.properties
new file mode 100644
index 0000000000..bdbb222060
--- /dev/null
+++ b/application/src/main/resources/templates/signup_en.properties
@@ -0,0 +1,9 @@
+title=Sign up
+form.username.label=Username
+form.displayName.label=Display name
+form.email.label=Email
+form.emailCode.label=Email Code
+form.emailCode.sendButton=Send
+form.password.label=Password
+form.confirmPassword.label=Confirm password
+form.submit=Sign up
\ No newline at end of file
diff --git a/ui/console-src/layouts/BasicLayout.vue b/ui/console-src/layouts/BasicLayout.vue
index b1fc71be74..1e6ffcbf6a 100644
--- a/ui/console-src/layouts/BasicLayout.vue
+++ b/ui/console-src/layouts/BasicLayout.vue
@@ -57,7 +57,7 @@ const handleLogout = () => {
         document.cookie =
           "XSRF-TOKEN=; Path=/; Expires=Thu, 01 Jan 1970 00:00:01 GMT;";
 
-        router.replace({ name: "Login" });
+        window.location.href = "/login";
       } catch (error) {
         console.error("Failed to logout", error);
       }
diff --git a/ui/console-src/main.ts b/ui/console-src/main.ts
index e05d17c4d2..45ee188188 100644
--- a/ui/console-src/main.ts
+++ b/ui/console-src/main.ts
@@ -14,6 +14,7 @@ import { setupVueQuery } from "@/setup/setupVueQuery";
 import { useGlobalInfoStore } from "@/stores/global-info";
 import { useRoleStore } from "@/stores/role";
 import { useUserStore } from "@/stores/user";
+import { getCookie } from "@/utils/cookie";
 import { hasPermission } from "@/utils/permission";
 import {
   setupCoreModules,
@@ -78,8 +79,7 @@ async function initApp() {
     await userStore.fetchCurrentUser();
 
     // set locale
-    i18n.global.locale.value =
-      localStorage.getItem("locale") || getBrowserLanguage();
+    i18n.global.locale.value = getCookie("language") || getBrowserLanguage();
 
     const globalInfoStore = useGlobalInfoStore();
     await globalInfoStore.fetchGlobalInfo();
diff --git a/ui/src/utils/cookie.ts b/ui/src/utils/cookie.ts
new file mode 100644
index 0000000000..5b376aa443
--- /dev/null
+++ b/ui/src/utils/cookie.ts
@@ -0,0 +1,4 @@
+export function getCookie(name: string) {
+  const match = document.cookie.match(new RegExp("(^| )" + name + "=([^;]+)"));
+  return match ? match[2] : null;
+}
diff --git a/ui/uc-src/layouts/BasicLayout.vue b/ui/uc-src/layouts/BasicLayout.vue
index 5db0136d32..be079413a3 100644
--- a/ui/uc-src/layouts/BasicLayout.vue
+++ b/ui/uc-src/layouts/BasicLayout.vue
@@ -53,7 +53,7 @@ const handleLogout = () => {
         document.cookie =
           "XSRF-TOKEN=; Path=/; Expires=Thu, 01 Jan 1970 00:00:01 GMT;";
 
-        window.location.href = "/console/login";
+        window.location.href = "/login";
       } catch (error) {
         console.error("Failed to logout", error);
       }
diff --git a/ui/uc-src/main.ts b/ui/uc-src/main.ts
index 0715438433..d79ac85364 100644
--- a/ui/uc-src/main.ts
+++ b/ui/uc-src/main.ts
@@ -6,6 +6,7 @@ import { setupVueQuery } from "@/setup/setupVueQuery";
 import { useGlobalInfoStore } from "@/stores/global-info";
 import { useRoleStore } from "@/stores/role";
 import { useUserStore } from "@/stores/user";
+import { getCookie } from "@/utils/cookie";
 import { hasPermission } from "@/utils/permission";
 import { consoleApiClient } from "@halo-dev/api-client";
 import router from "@uc/router";
@@ -66,8 +67,7 @@ async function initApp() {
     await userStore.fetchCurrentUser();
 
     // set locale
-    i18n.global.locale.value =
-      localStorage.getItem("locale") || getBrowserLanguage();
+    i18n.global.locale.value = getCookie("language") || getBrowserLanguage();
 
     const globalInfoStore = useGlobalInfoStore();
     await globalInfoStore.fetchGlobalInfo();
diff --git a/ui/uc-src/router/guards/auth-check.ts b/ui/uc-src/router/guards/auth-check.ts
index 322a7be26b..9ff1c02d53 100644
--- a/ui/uc-src/router/guards/auth-check.ts
+++ b/ui/uc-src/router/guards/auth-check.ts
@@ -13,7 +13,7 @@ export function setupAuthCheckGuard(router: Router) {
     const userStore = useUserStore();
 
     if (userStore.isAnonymous) {
-      window.location.href = `/console/login?redirect_uri=${encodeURIComponent(
+      window.location.href = `/login?redirect_uri=${encodeURIComponent(
         window.location.href
       )}`;
       return;

From d5233963fbc90b2b337ec41cd60bb73d144ae51e Mon Sep 17 00:00:00 2001
From: Ryan Wang <i@ryanc.cc>
Date: Sat, 28 Sep 2024 18:19:41 +0800
Subject: [PATCH 047/185] refactor: remove login-related pages from UI project
 (#6712)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/area ui
/kind improvement
/milestone 2.20.x

#### What this PR does / why we need it:

移除 UI 项目中和登录、注册相关的页面和代码，后续将由后端统一提供：https://github.com/halo-dev/halo/pull/6488

相关 issue：https://github.com/halo-dev/halo/issues/5214

#### Which issue(s) this PR fixes:

Fixes https://github.com/halo-dev/halo/issues/5214

#### Does this PR introduce a user-facing change?

```release-note
None
```
---
 ui/console-src/layouts/BasicLayout.vue        |   2 -
 ui/console-src/router/guards/auth-check.ts    |  69 +----
 ui/console-src/router/guards/check-states.ts  |   2 +-
 ui/console-src/router/guards/permission.ts    |   2 +-
 ui/console-src/router/routes.config.ts        |  52 ----
 ui/console-src/views/system/Binding.vue       |  87 ------
 ui/console-src/views/system/Login.vue         |  85 ------
 ui/console-src/views/system/Redirect.vue      |  41 ---
 ui/console-src/views/system/ResetPassword.vue |  81 ------
 ui/src/components/login/LoginForm.vue         | 188 -------------
 ui/src/components/login/LoginModal.vue        |  37 ---
 ui/src/components/login/MfaForm.vue           |  93 -------
 .../login/SocialAuthProviderItem.vue          |  81 ------
 .../components/login/SocialAuthProviders.vue  |  34 ---
 ui/src/components/signup/SignupForm.vue       | 260 ------------------
 ui/src/layouts/GatewayLayout.vue              |  13 -
 ui/src/locales/en.yaml                        | 102 -------
 ui/src/locales/es.yaml                        |  58 ----
 ui/src/locales/zh-CN.yaml                     |  98 -------
 ui/src/locales/zh-TW.yaml                     |  98 -------
 ui/src/setup/setupApiClient.ts                |   5 +-
 ui/src/stores/user.ts                         |   2 -
 ui/uc-src/layouts/BasicLayout.vue             |   2 -
 ui/uc-src/router/routes.config.ts             |  16 --
 ui/uc-src/views/ResetPassword.vue             | 108 --------
 25 files changed, 9 insertions(+), 1607 deletions(-)
 delete mode 100644 ui/console-src/views/system/Binding.vue
 delete mode 100644 ui/console-src/views/system/Login.vue
 delete mode 100644 ui/console-src/views/system/Redirect.vue
 delete mode 100644 ui/console-src/views/system/ResetPassword.vue
 delete mode 100644 ui/src/components/login/LoginForm.vue
 delete mode 100644 ui/src/components/login/LoginModal.vue
 delete mode 100644 ui/src/components/login/MfaForm.vue
 delete mode 100644 ui/src/components/login/SocialAuthProviderItem.vue
 delete mode 100644 ui/src/components/login/SocialAuthProviders.vue
 delete mode 100644 ui/src/components/signup/SignupForm.vue
 delete mode 100644 ui/src/layouts/GatewayLayout.vue
 delete mode 100644 ui/uc-src/views/ResetPassword.vue

diff --git a/ui/console-src/layouts/BasicLayout.vue b/ui/console-src/layouts/BasicLayout.vue
index 1e6ffcbf6a..fa0f29e355 100644
--- a/ui/console-src/layouts/BasicLayout.vue
+++ b/ui/console-src/layouts/BasicLayout.vue
@@ -1,6 +1,5 @@
 <script lang="ts" setup>
 import GlobalSearchModal from "@/components/global-search/GlobalSearchModal.vue";
-import LoginModal from "@/components/login/LoginModal.vue";
 import { RoutesMenu } from "@/components/menu/RoutesMenu";
 import { useRouteMenuGenerator } from "@/composables/use-route-menu-generator";
 import { rbacAnnotations } from "@/constants/annotations";
@@ -303,7 +302,6 @@ onMounted(() => {
     v-if="globalSearchVisible"
     @close="globalSearchVisible = false"
   />
-  <LoginModal />
 </template>
 
 <style lang="scss">
diff --git a/ui/console-src/router/guards/auth-check.ts b/ui/console-src/router/guards/auth-check.ts
index 203ae12f19..314a8c014e 100644
--- a/ui/console-src/router/guards/auth-check.ts
+++ b/ui/console-src/router/guards/auth-check.ts
@@ -1,11 +1,10 @@
-import { rbacAnnotations } from "@/constants/annotations";
 import { useUserStore } from "@/stores/user";
 import type { Router } from "vue-router";
 
-const whiteList = ["Setup", "Login", "Binding", "ResetPassword", "Redirect"];
+const whiteList = ["Setup"];
 
 export function setupAuthCheckGuard(router: Router) {
-  router.beforeEach((to, from, next) => {
+  router.beforeEach((to, _, next) => {
     const userStore = useUserStore();
 
     if (userStore.isAnonymous) {
@@ -13,67 +12,9 @@ export function setupAuthCheckGuard(router: Router) {
         next();
         return;
       }
-
-      next({
-        name: "Login",
-        query: {
-          redirect_uri: encodeURIComponent(window.location.href),
-        },
-      });
-      return;
-    } else {
-      if (to.name === "Login") {
-        if (to.query.redirect_uri) {
-          next({
-            name: "Redirect",
-            query: {
-              redirect_uri: to.query.redirect_uri,
-            },
-          });
-          return;
-        }
-
-        const roleHasRedirectOnLogin = userStore.currentRoles?.find(
-          (role) =>
-            role.metadata.annotations?.[rbacAnnotations.REDIRECT_ON_LOGIN]
-        );
-
-        if (roleHasRedirectOnLogin) {
-          window.location.href =
-            roleHasRedirectOnLogin.metadata.annotations?.[
-              rbacAnnotations.REDIRECT_ON_LOGIN
-            ] || "/uc";
-          return;
-        }
-
-        next({
-          name: "Dashboard",
-        });
-        return;
-      }
-
-      if (to.name && whiteList.includes(to.name as string)) {
-        next();
-        return;
-      }
-
-      // Check allow access console
-      const { currentRoles } = userStore;
-
-      const hasDisallowAccessConsoleRole = currentRoles?.some((role) => {
-        return (
-          role.metadata.annotations?.[
-            rbacAnnotations.DISALLOW_ACCESS_CONSOLE
-          ] === "true"
-        );
-      });
-
-      if (hasDisallowAccessConsoleRole) {
-        window.location.href = "/uc";
-        return;
-      }
-
-      next();
+      window.location.href = `/login?redirect_uri=${encodeURIComponent(
+        window.location.href
+      )}`;
       return;
     }
 
diff --git a/ui/console-src/router/guards/check-states.ts b/ui/console-src/router/guards/check-states.ts
index 442c24d834..4bfad5b019 100644
--- a/ui/console-src/router/guards/check-states.ts
+++ b/ui/console-src/router/guards/check-states.ts
@@ -3,7 +3,7 @@ import { useUserStore } from "@/stores/user";
 import type { Router } from "vue-router";
 
 export function setupCheckStatesGuard(router: Router) {
-  router.beforeEach(async (to, from, next) => {
+  router.beforeEach(async (to, _, next) => {
     const userStore = useUserStore();
     const { globalInfo } = useGlobalInfoStore();
     const { userInitialized, dataInitialized } = globalInfo || {};
diff --git a/ui/console-src/router/guards/permission.ts b/ui/console-src/router/guards/permission.ts
index 0094f9cf8c..b513e9e0e0 100644
--- a/ui/console-src/router/guards/permission.ts
+++ b/ui/console-src/router/guards/permission.ts
@@ -3,7 +3,7 @@ import { hasPermission } from "@/utils/permission";
 import type { Router } from "vue-router";
 
 export function setupPermissionGuard(router: Router) {
-  router.beforeEach((to, from, next) => {
+  router.beforeEach((to, _, next) => {
     const roleStore = useRoleStore();
     const { uiPermissions } = roleStore.permissions;
     const { meta } = to;
diff --git a/ui/console-src/router/routes.config.ts b/ui/console-src/router/routes.config.ts
index ffa2d21c2e..d5fadd287b 100644
--- a/ui/console-src/router/routes.config.ts
+++ b/ui/console-src/router/routes.config.ts
@@ -1,11 +1,6 @@
-import GatewayLayout from "@/layouts/GatewayLayout.vue";
 import Forbidden from "@/views/exceptions/Forbidden.vue";
 import NotFound from "@/views/exceptions/NotFound.vue";
 import BasicLayout from "@console/layouts/BasicLayout.vue";
-import Binding from "@console/views/system/Binding.vue";
-import Login from "@console/views/system/Login.vue";
-import Redirect from "@console/views/system/Redirect.vue";
-import ResetPassword from "@console/views/system/ResetPassword.vue";
 import Setup from "@console/views/system/Setup.vue";
 import SetupInitialData from "@console/views/system/SetupInitialData.vue";
 import type { RouteRecordRaw } from "vue-router";
@@ -27,34 +22,6 @@ export const routes: Array<RouteRecordRaw> = [
       },
     ],
   },
-  {
-    path: "/login",
-    component: GatewayLayout,
-    children: [
-      {
-        path: "",
-        name: "Login",
-        component: Login,
-        meta: {
-          title: "core.login.title",
-        },
-      },
-    ],
-  },
-  {
-    path: "/binding/:provider",
-    component: GatewayLayout,
-    children: [
-      {
-        path: "",
-        name: "Binding",
-        component: Binding,
-        meta: {
-          title: "core.binding.title",
-        },
-      },
-    ],
-  },
   {
     path: "/setup",
     component: Setup,
@@ -71,25 +38,6 @@ export const routes: Array<RouteRecordRaw> = [
       title: "core.setup.title",
     },
   },
-  {
-    path: "/redirect",
-    name: "Redirect",
-    component: Redirect,
-  },
-  {
-    path: "/reset-password",
-    component: GatewayLayout,
-    children: [
-      {
-        path: "",
-        name: "ResetPassword",
-        component: ResetPassword,
-        meta: {
-          title: "core.reset_password.title",
-        },
-      },
-    ],
-  },
 ];
 
 export default routes;
diff --git a/ui/console-src/views/system/Binding.vue b/ui/console-src/views/system/Binding.vue
deleted file mode 100644
index aed3ea40a0..0000000000
--- a/ui/console-src/views/system/Binding.vue
+++ /dev/null
@@ -1,87 +0,0 @@
-<script lang="ts" setup>
-import LoginForm from "@/components/login/LoginForm.vue";
-import SignupForm from "@/components/signup/SignupForm.vue";
-import { useUserStore } from "@/stores/user";
-import { useGlobalInfoFetch } from "@console/composables/use-global-info";
-import router from "@console/router";
-import { Toast } from "@halo-dev/components";
-import { useRouteQuery } from "@vueuse/router";
-import { computed, onBeforeMount, onMounted } from "vue";
-import { useI18n } from "vue-i18n";
-import { useRoute } from "vue-router";
-
-const userStore = useUserStore();
-const route = useRoute();
-const { t } = useI18n();
-
-onBeforeMount(() => {
-  if (!userStore.isAnonymous) {
-    router.push({ name: "Dashboard" });
-  }
-});
-
-const { globalInfo } = useGlobalInfoFetch();
-
-onMounted(() => {
-  Toast.warning(t("core.binding.common.toast.mounted"));
-});
-
-function handleBinding() {
-  const authProvider = globalInfo.value?.socialAuthProviders.find(
-    (p) => p.name === route.params.provider
-  );
-
-  if (!authProvider?.bindingUrl) {
-    Toast.error(t("core.binding.operations.bind.toast_failed"));
-    return;
-  }
-
-  window.location.href = authProvider?.bindingUrl;
-
-  Toast.success(t("core.binding.operations.bind.toast_success"));
-}
-
-const type = useRouteQuery<string>("type", "");
-
-function handleChangeType() {
-  type.value = type.value === "signup" ? "" : "signup";
-}
-
-const isLoginType = computed(() => type.value !== "signup");
-</script>
-<template>
-  <div class="flex w-72 flex-col">
-    <SignupForm
-      v-if="type === 'signup'"
-      button-text="core.binding.operations.signup_and_bind.button"
-      @succeed="handleBinding"
-    />
-    <LoginForm
-      v-else
-      button-text="core.binding.operations.login_and_bind.button"
-      @succeed="handleBinding"
-    />
-    <div
-      v-if="globalInfo?.allowRegistration"
-      class="flex justify-center gap-1 pt-3.5 text-xs"
-    >
-      <span class="text-slate-500">
-        {{
-          isLoginType
-            ? $t("core.login.operations.signup.label")
-            : $t("core.login.operations.return_login.label")
-        }}
-      </span>
-      <span
-        class="cursor-pointer text-secondary hover:text-gray-600"
-        @click="handleChangeType"
-      >
-        {{
-          isLoginType
-            ? $t("core.login.operations.signup.button")
-            : $t("core.login.operations.return_login.button")
-        }}
-      </span>
-    </div>
-  </div>
-</template>
diff --git a/ui/console-src/views/system/Login.vue b/ui/console-src/views/system/Login.vue
deleted file mode 100644
index 76d70bacc4..0000000000
--- a/ui/console-src/views/system/Login.vue
+++ /dev/null
@@ -1,85 +0,0 @@
-<script lang="ts" setup>
-import LocaleChange from "@/components/common/LocaleChange.vue";
-import LoginForm from "@/components/login/LoginForm.vue";
-import SocialAuthProviders from "@/components/login/SocialAuthProviders.vue";
-import SignupForm from "@/components/signup/SignupForm.vue";
-import { useAppTitle } from "@/composables/use-title";
-import { useGlobalInfoFetch } from "@console/composables/use-global-info";
-import { useRouteQuery } from "@vueuse/router";
-import { computed } from "vue";
-import MdiKeyboardBackspace from "~icons/mdi/keyboard-backspace";
-
-const { globalInfo } = useGlobalInfoFetch();
-
-const SIGNUP_TYPE = "signup";
-
-function onLoginSucceed() {
-  window.location.reload();
-}
-
-function onSignupSucceed() {
-  window.location.href = "/uc";
-}
-
-const type = useRouteQuery<string>("type", "");
-
-function handleChangeType() {
-  type.value = type.value === SIGNUP_TYPE ? "" : SIGNUP_TYPE;
-}
-
-const isLoginType = computed(() => type.value !== SIGNUP_TYPE);
-
-useAppTitle(
-  computed(
-    () => `core.${type.value === SIGNUP_TYPE ? SIGNUP_TYPE : "login"}.title`
-  )
-);
-</script>
-<template>
-  <div class="flex w-72 flex-col">
-    <SignupForm v-if="type === 'signup'" @succeed="onSignupSucceed" />
-    <LoginForm v-else @succeed="onLoginSucceed" />
-    <SocialAuthProviders />
-    <div class="flex justify-center gap-2 pt-3.5 text-xs">
-      <div v-if="globalInfo?.allowRegistration" class="space-x-0.5">
-        <span class="text-slate-500">
-          {{
-            isLoginType
-              ? $t("core.login.operations.signup.label")
-              : $t("core.login.operations.return_login.label")
-          }},
-        </span>
-        <span
-          class="cursor-pointer text-secondary hover:text-gray-600"
-          @click="handleChangeType"
-        >
-          {{
-            isLoginType
-              ? $t("core.login.operations.signup.button")
-              : $t("core.login.operations.return_login.button")
-          }}
-        </span>
-      </div>
-      <RouterLink
-        :to="{ name: 'ResetPassword' }"
-        class="text-secondary hover:text-gray-600"
-      >
-        {{ $t("core.login.operations.reset_password.button") }}
-      </RouterLink>
-    </div>
-    <div class="flex justify-center pt-3.5">
-      <a
-        class="inline-flex items-center gap-0.5 text-xs text-gray-600 hover:text-gray-900"
-        href="/"
-      >
-        <MdiKeyboardBackspace class="!h-3.5 !w-3.5" />
-        <span> {{ $t("core.login.operations.return_site") }} </span>
-      </a>
-    </div>
-  </div>
-  <div
-    class="bottom-0 mb-10 mt-auto flex items-center justify-center gap-2.5 pt-3.5"
-  >
-    <LocaleChange />
-  </div>
-</template>
diff --git a/ui/console-src/views/system/Redirect.vue b/ui/console-src/views/system/Redirect.vue
deleted file mode 100644
index 639a4ff691..0000000000
--- a/ui/console-src/views/system/Redirect.vue
+++ /dev/null
@@ -1,41 +0,0 @@
-<script lang="ts" setup>
-import { useRoute, useRouter } from "vue-router";
-
-const route = useRoute();
-const router = useRouter();
-
-if (allowRedirect()) {
-  window.location.href = decodeURIComponent(route.query.redirect_uri as string);
-} else {
-  router.push({
-    name: "Dashboard",
-  });
-}
-
-function allowRedirect() {
-  const redirect_uri = decodeURIComponent(route.query.redirect_uri as string);
-
-  if (!redirect_uri || redirect_uri === window.location.href) {
-    return false;
-  }
-
-  if (redirect_uri.startsWith("/")) {
-    return true;
-  }
-
-  if (
-    redirect_uri.startsWith("https://") ||
-    redirect_uri.startsWith("http://")
-  ) {
-    const url = new URL(redirect_uri);
-    if (url.origin === window.location.origin) {
-      return true;
-    }
-  }
-
-  return false;
-}
-</script>
-<template>
-  <div id="loader"></div>
-</template>
diff --git a/ui/console-src/views/system/ResetPassword.vue b/ui/console-src/views/system/ResetPassword.vue
deleted file mode 100644
index 3486127804..0000000000
--- a/ui/console-src/views/system/ResetPassword.vue
+++ /dev/null
@@ -1,81 +0,0 @@
-<script lang="ts" setup>
-import { publicApiClient } from "@halo-dev/api-client";
-import { Toast, VButton } from "@halo-dev/components";
-import { ref } from "vue";
-import { useI18n } from "vue-i18n";
-
-const { t } = useI18n();
-
-interface ResetPasswordForm {
-  email: string;
-  username: string;
-}
-
-const loading = ref(false);
-
-async function onSubmit(data: ResetPasswordForm) {
-  try {
-    loading.value = true;
-    await publicApiClient.user.sendPasswordResetEmail({
-      passwordResetEmailRequest: {
-        email: data.email,
-        username: data.username,
-      },
-    });
-
-    Toast.success(t("core.reset_password.operations.send.toast_success"));
-  } catch (error) {
-    console.error("Failed to send password reset email", error);
-  } finally {
-    loading.value = false;
-  }
-}
-
-const inputClasses = {
-  outer: "!py-3 first:!pt-0 last:!pb-0",
-};
-</script>
-
-<template>
-  <div class="flex w-72 flex-col">
-    <FormKit
-      id="reset-password-form"
-      name="reset-password-form"
-      type="form"
-      :classes="{
-        form: '!divide-none',
-      }"
-      :config="{ validationVisibility: 'submit' }"
-      @submit="onSubmit"
-      @keyup.enter="$formkit.submit('reset-password-form')"
-    >
-      <FormKit
-        :classes="inputClasses"
-        name="username"
-        :placeholder="$t('core.reset_password.fields.username.label')"
-        :validation-label="$t('core.reset_password.fields.username.label')"
-        :autofocus="true"
-        type="text"
-        validation="required"
-      ></FormKit>
-      <FormKit
-        :classes="inputClasses"
-        name="email"
-        :placeholder="$t('core.reset_password.fields.email.label')"
-        :validation-label="$t('core.reset_password.fields.email.label')"
-        :autofocus="true"
-        type="text"
-        validation="required"
-      ></FormKit>
-    </FormKit>
-    <VButton
-      class="mt-8"
-      block
-      :loading="loading"
-      type="secondary"
-      @click="$formkit.submit('reset-password-form')"
-    >
-      {{ $t("core.reset_password.operations.send.label") }}
-    </VButton>
-  </div>
-</template>
diff --git a/ui/src/components/login/LoginForm.vue b/ui/src/components/login/LoginForm.vue
deleted file mode 100644
index 3e0e0d421b..0000000000
--- a/ui/src/components/login/LoginForm.vue
+++ /dev/null
@@ -1,188 +0,0 @@
-<script lang="ts" setup>
-import { ERROR_MFA_REQUIRED_TYPE } from "@/constants/error-types";
-import { setFocus } from "@/formkit/utils/focus";
-import { useUserStore } from "@/stores/user";
-import { randomUUID } from "@/utils/id";
-import { reset, submitForm } from "@formkit/core";
-import { consoleApiClient } from "@halo-dev/api-client";
-import { Toast, VButton } from "@halo-dev/components";
-import axios, { AxiosError } from "axios";
-import { JSEncrypt } from "jsencrypt";
-import qs from "qs";
-import { onMounted, ref } from "vue";
-import { useI18n } from "vue-i18n";
-import MfaForm from "./MfaForm.vue";
-
-const { t } = useI18n();
-
-withDefaults(
-  defineProps<{
-    buttonText?: string;
-  }>(),
-  {
-    buttonText: "core.login.button",
-  }
-);
-
-const emit = defineEmits<{
-  (event: "succeed"): void;
-}>();
-
-const userStore = useUserStore();
-
-const _csrf = ref("");
-
-const loading = ref(false);
-
-const handleGenerateToken = async () => {
-  const token = randomUUID();
-  _csrf.value = token;
-  const expires = new Date();
-  expires.setFullYear(expires.getFullYear() + 1);
-  document.cookie = `XSRF-TOKEN=${token}; Path=/; SameSite=Lax; expires=${expires.toUTCString()}`;
-};
-
-async function handleLogin(data: {
-  username: string;
-  password: string;
-  rememberMe: boolean;
-}) {
-  try {
-    loading.value = true;
-
-    const { data: publicKey } = await consoleApiClient.login.getPublicKey();
-
-    const encrypt = new JSEncrypt();
-    encrypt.setPublicKey(publicKey.base64Format as string);
-
-    await axios.post(
-      `/login?remember-me=${data.rememberMe}`,
-      qs.stringify({
-        _csrf: _csrf.value,
-        username: data.username,
-        password: encrypt.encrypt(data.password),
-      }),
-      {
-        withCredentials: true,
-        headers: {
-          "Content-Type": "application/x-www-form-urlencoded",
-          "X-Requested-With": "XMLHttpRequest",
-        },
-      }
-    );
-
-    await userStore.fetchCurrentUser();
-
-    emit("succeed");
-  } catch (e: unknown) {
-    console.error("Failed to login", e);
-
-    if (e instanceof AxiosError) {
-      if (/Network Error/.test(e.message)) {
-        Toast.error(t("core.common.toast.network_error"));
-        return;
-      }
-
-      if (e.response?.status === 403) {
-        Toast.warning(t("core.login.operations.submit.toast_csrf"), {
-          duration: 5000,
-        });
-        await handleGenerateToken();
-        return;
-      }
-
-      const {
-        title: errorTitle,
-        detail: errorDetail,
-        type: errorType,
-      } = e.response?.data || {};
-
-      if (errorType === ERROR_MFA_REQUIRED_TYPE) {
-        mfaRequired.value = true;
-        return;
-      }
-
-      if (errorTitle || errorDetail) {
-        Toast.error(errorDetail || errorTitle);
-      } else {
-        Toast.error(t("core.common.toast.unknown_error"));
-      }
-    } else {
-      Toast.error(t("core.common.toast.unknown_error"));
-    }
-
-    reset("passwordInput");
-    setFocus("passwordInput");
-  } finally {
-    loading.value = false;
-  }
-}
-
-onMounted(() => {
-  handleGenerateToken();
-});
-
-const inputClasses = {
-  outer: "!py-3 first:!pt-0 last:!pb-0",
-};
-
-// mfa
-const mfaRequired = ref(false);
-</script>
-
-<template>
-  <template v-if="!mfaRequired">
-    <FormKit
-      id="login-form"
-      name="login-form"
-      :actions="false"
-      type="form"
-      :classes="{
-        form: '!divide-none',
-      }"
-      :config="{ validationVisibility: 'submit' }"
-      @submit="handleLogin"
-      @keyup.enter="submitForm('login-form')"
-    >
-      <FormKit
-        :classes="inputClasses"
-        name="username"
-        :placeholder="$t('core.login.fields.username.placeholder')"
-        :validation-label="$t('core.login.fields.username.placeholder')"
-        :autofocus="true"
-        type="text"
-        validation="required"
-      >
-      </FormKit>
-      <FormKit
-        id="passwordInput"
-        :classes="inputClasses"
-        name="password"
-        :placeholder="$t('core.login.fields.password.placeholder')"
-        :validation-label="$t('core.login.fields.password.placeholder')"
-        type="password"
-        validation="required"
-        autocomplete="current-password"
-      >
-      </FormKit>
-
-      <FormKit
-        type="checkbox"
-        :label="$t('core.login.fields.remember_me.label')"
-        name="rememberMe"
-        :value="false"
-        :classes="inputClasses"
-      ></FormKit>
-    </FormKit>
-    <VButton
-      class="mt-6"
-      block
-      :loading="loading"
-      type="secondary"
-      @click="submitForm('login-form')"
-    >
-      {{ $t(buttonText) }}
-    </VButton>
-  </template>
-  <MfaForm v-else @succeed="$emit('succeed')" />
-</template>
diff --git a/ui/src/components/login/LoginModal.vue b/ui/src/components/login/LoginModal.vue
deleted file mode 100644
index 8e8b8195e0..0000000000
--- a/ui/src/components/login/LoginModal.vue
+++ /dev/null
@@ -1,37 +0,0 @@
-<script lang="ts" setup>
-import LoginForm from "@/components/login/LoginForm.vue";
-import { useUserStore } from "@/stores/user";
-import { Toast, VModal } from "@halo-dev/components";
-import { ref } from "vue";
-import { useI18n } from "vue-i18n";
-import SocialAuthProviders from "./SocialAuthProviders.vue";
-
-const userStore = useUserStore();
-const { t } = useI18n();
-
-const modal = ref<InstanceType<typeof VModal> | null>(null);
-
-const onLoginSucceed = () => {
-  modal.value?.close();
-  Toast.success(t("core.login.operations.submit.toast_success"));
-};
-
-function onClose() {
-  userStore.loginModalVisible = false;
-}
-</script>
-
-<template>
-  <VModal
-    v-if="userStore.loginModalVisible"
-    ref="modal"
-    :mount-to-body="true"
-    :width="400"
-    :centered="true"
-    :title="$t('core.login.modal.title')"
-    @close="onClose"
-  >
-    <LoginForm v-if="userStore.loginModalVisible" @succeed="onLoginSucceed" />
-    <SocialAuthProviders />
-  </VModal>
-</template>
diff --git a/ui/src/components/login/MfaForm.vue b/ui/src/components/login/MfaForm.vue
deleted file mode 100644
index fae66a66ce..0000000000
--- a/ui/src/components/login/MfaForm.vue
+++ /dev/null
@@ -1,93 +0,0 @@
-<script lang="ts" setup>
-import { setFocus } from "@/formkit/utils/focus";
-import { submitForm } from "@formkit/core";
-import { Toast, VButton } from "@halo-dev/components";
-import axios from "axios";
-import qs from "qs";
-import { onMounted, ref } from "vue";
-import { useI18n } from "vue-i18n";
-
-const { t } = useI18n();
-
-const emit = defineEmits<{
-  (event: "succeed"): void;
-}>();
-
-const loading = ref(false);
-
-async function onSubmit({ code }: { code: string }) {
-  try {
-    loading.value = true;
-
-    const _csrf = document.cookie
-      .split("; ")
-      .find((row) => row.startsWith("XSRF-TOKEN"))
-      ?.split("=")[1];
-
-    if (!_csrf) {
-      Toast.warning("CSRF token not found");
-      return;
-    }
-    await axios.post(
-      `/login/2fa/totp`,
-      qs.stringify({
-        code,
-        _csrf,
-      }),
-      {
-        withCredentials: true,
-        headers: {
-          "Content-Type": "application/x-www-form-urlencoded",
-          "X-Requested-With": "XMLHttpRequest",
-        },
-      }
-    );
-
-    emit("succeed");
-  } catch (error) {
-    Toast.error(t("core.common.toast.validation_failed"));
-  } finally {
-    loading.value = false;
-  }
-}
-
-onMounted(() => {
-  setFocus("code");
-});
-</script>
-
-<template>
-  <FormKit
-    id="mfa-form"
-    name="mfa-form"
-    type="form"
-    :classes="{
-      form: '!divide-none',
-    }"
-    :config="{ validationVisibility: 'submit' }"
-    @submit="onSubmit"
-    @keyup.enter="submitForm('mfa-form')"
-  >
-    <FormKit
-      id="code"
-      :classes="{
-        outer: '!py-0',
-      }"
-      name="code"
-      :placeholder="$t('core.login.2fa.fields.code.placeholder')"
-      :validation-label="$t('core.login.2fa.fields.code.label')"
-      type="text"
-      validation="required"
-    >
-    </FormKit>
-  </FormKit>
-  <VButton
-    :loading="loading"
-    class="mt-8"
-    block
-    type="secondary"
-    @click="submitForm('mfa-form')"
-  >
-    {{ $t("core.common.buttons.verify") }}
-  </VButton>
-</template>
diff --git a/ui/src/components/login/SocialAuthProviderItem.vue b/ui/src/components/login/SocialAuthProviderItem.vue
deleted file mode 100644
index 3306f53bea..0000000000
--- a/ui/src/components/login/SocialAuthProviderItem.vue
+++ /dev/null
@@ -1,81 +0,0 @@
-<script lang="ts" setup>
-import type { SocialAuthProvider } from "@/types";
-import { useRouteQuery } from "@vueuse/router";
-import type { Ref } from "vue";
-import { inject, ref } from "vue";
-
-const props = withDefaults(
-  defineProps<{
-    authProvider: SocialAuthProvider;
-  }>(),
-  {}
-);
-
-const REDIRECT_URI_QUERY_PARAM = "login_redirect_uri";
-
-const loading = ref(false);
-
-const redirect_uri = useRouteQuery<string>("redirect_uri", "");
-const disabled = inject<Ref<boolean>>("disabled");
-
-function handleSocialLogin() {
-  if (disabled) {
-    disabled.value = true;
-  }
-
-  loading.value = true;
-
-  let authenticationUrl = props.authProvider.authenticationUrl;
-
-  if (redirect_uri.value) {
-    authenticationUrl = `${authenticationUrl}?${REDIRECT_URI_QUERY_PARAM}=${redirect_uri.value}`;
-  }
-
-  window.location.href = authenticationUrl;
-}
-</script>
-
-<template>
-  <button
-    class="group inline-flex select-none flex-row items-center gap-2 rounded bg-white px-2.5 py-1.5 ring-1 ring-gray-200 transition-all hover:bg-gray-100 hover:shadow hover:ring-gray-900"
-    :class="{
-      'cursor-not-allowed opacity-80 hover:shadow-none hover:ring-gray-200':
-        disabled,
-    }"
-    :disabled="disabled"
-    @click="handleSocialLogin"
-  >
-    <svg
-      v-if="loading"
-      class="h-4 w-4 animate-spin"
-      fill="none"
-      viewBox="0 0 24 24"
-      xmlns="http://www.w3.org/2000/svg"
-    >
-      <circle
-        class="opacity-25"
-        cx="12"
-        cy="12"
-        r="10"
-        stroke="currentColor"
-        stroke-width="4"
-      ></circle>
-      <path
-        class="opacity-75"
-        d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z"
-        fill="currentColor"
-      ></path>
-    </svg>
-
-    <img
-      v-else
-      :alt="authProvider.displayName"
-      class="h-4 w-4 rounded-full"
-      :src="authProvider.logo"
-    />
-
-    <span class="text-xs text-gray-800 group-hover:text-gray-900">
-      {{ authProvider.displayName }}
-    </span>
-  </button>
-</template>
diff --git a/ui/src/components/login/SocialAuthProviders.vue b/ui/src/components/login/SocialAuthProviders.vue
deleted file mode 100644
index bc7b275c1a..0000000000
--- a/ui/src/components/login/SocialAuthProviders.vue
+++ /dev/null
@@ -1,34 +0,0 @@
-<script lang="ts" setup>
-import type { Ref } from "vue";
-import { provide, ref } from "vue";
-
-// auth providers
-import { useGlobalInfoFetch } from "@console/composables/use-global-info";
-import SocialAuthProviderItem from "./SocialAuthProviderItem.vue";
-
-const { globalInfo } = useGlobalInfoFetch();
-
-provide<Ref<boolean>>("disabled", ref(false));
-</script>
-
-<template>
-  <Transition v-if="globalInfo?.socialAuthProviders.length" appear name="fade">
-    <div>
-      <div
-        class="my-4 flex items-center before:ml-1 before:mt-0.5 before:flex-1 before:border-t before:border-gray-200 after:mr-1 after:mt-0.5 after:flex-1 after:border-t after:border-gray-200"
-      >
-        <p class="mx-4 mb-0 text-center text-xs dark:text-neutral-600">
-          {{ $t("core.components.social_auth_providers.title") }}
-        </p>
-      </div>
-      <ul class="flex flex-row flex-wrap justify-center gap-2">
-        <li
-          v-for="(socialAuthProvider, index) in globalInfo.socialAuthProviders"
-          :key="index"
-        >
-          <SocialAuthProviderItem :auth-provider="socialAuthProvider" />
-        </li>
-      </ul>
-    </div>
-  </Transition>
-</template>
diff --git a/ui/src/components/signup/SignupForm.vue b/ui/src/components/signup/SignupForm.vue
deleted file mode 100644
index 22faad4b99..0000000000
--- a/ui/src/components/signup/SignupForm.vue
+++ /dev/null
@@ -1,260 +0,0 @@
-<script lang="ts" setup>
-import { useGlobalInfoStore } from "@/stores/global-info";
-import { submitForm } from "@formkit/core";
-import { publicApiClient } from "@halo-dev/api-client";
-import { Toast, VButton } from "@halo-dev/components";
-import { useMutation } from "@tanstack/vue-query";
-import { useRouteQuery } from "@vueuse/router";
-import { useIntervalFn } from "@vueuse/shared";
-import { computed, onMounted, reactive, ref, type ComputedRef } from "vue";
-import { useI18n } from "vue-i18n";
-
-const { t } = useI18n();
-
-withDefaults(
-  defineProps<{
-    buttonText?: string;
-  }>(),
-  {
-    buttonText: "core.signup.operations.submit.button",
-  }
-);
-
-const formState = ref({
-  password: "",
-  user: {
-    apiVersion: "v1alpha1",
-    kind: "User",
-    metadata: {
-      name: "",
-    },
-    spec: {
-      avatar: "",
-      displayName: "",
-      email: "",
-    },
-  },
-  verifyCode: "",
-});
-const loading = ref(false);
-
-const emit = defineEmits<{
-  (event: "succeed"): void;
-}>();
-
-const login = useRouteQuery<string>("login");
-const name = useRouteQuery<string>("name");
-const globalInfoStore = useGlobalInfoStore();
-const signUpCond = reactive({
-  mustVerifyEmailOnRegistration: false,
-});
-
-onMounted(() => {
-  signUpCond.mustVerifyEmailOnRegistration =
-    globalInfoStore.globalInfo?.mustVerifyEmailOnRegistration || false;
-  if (login.value) {
-    formState.value.user.metadata.name = login.value;
-  }
-  if (name.value) {
-    formState.value.user.spec.displayName = name.value;
-  }
-});
-const emailRegex = new RegExp("^[\\w\\-.]+@([\\w-]+\\.)+[\\w-]{2,}$");
-const emailValidation: ComputedRef<
-  // please see https://github.com/formkit/formkit/blob/bd5cf1c378d358ed3aba7b494713af20b6c909ab/packages/inputs/src/props.ts#L660
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
-  string | Array<[rule: string, ...args: any]>
-> = computed(() => {
-  if (signUpCond.mustVerifyEmailOnRegistration)
-    return [["required"], ["matches", emailRegex]];
-  else return "required|email|length:0,100";
-});
-
-const handleSignup = async () => {
-  try {
-    loading.value = true;
-
-    await publicApiClient.user.signUp({
-      signUpRequest: formState.value,
-    });
-
-    Toast.success(t("core.signup.operations.submit.toast_success"));
-
-    emit("succeed");
-  } catch (error) {
-    console.error("Failed to sign up", error);
-  } finally {
-    loading.value = false;
-  }
-};
-
-const inputClasses = {
-  outer: "!py-3 first:!pt-0 last:!pb-0",
-};
-
-// the code below is copied from console/uc-src/modules/profile/components/EmailVerifyModal.vue
-const timer = ref(0);
-const { pause, resume, isActive } = useIntervalFn(
-  () => {
-    if (timer.value <= 0) {
-      pause();
-    } else {
-      timer.value--;
-    }
-  },
-  1000,
-  {
-    immediate: false,
-  }
-);
-
-const { mutate: sendVerifyCode, isLoading: isSending } = useMutation({
-  mutationKey: ["send-verify-code"],
-  mutationFn: async () => {
-    if (!formState.value.user.spec.email.match(emailRegex)) {
-      Toast.error(t("core.signup.fields.email.matchFailed"));
-      throw new Error("email is illegal");
-    }
-    return await publicApiClient.user.sendRegisterVerifyEmail({
-      registerVerifyEmailRequest: {
-        email: formState.value.user.spec.email,
-      },
-    });
-  },
-  onSuccess() {
-    Toast.success(
-      t("core.signup.fields.verify_code.operations.send_code.toast_success")
-    );
-    timer.value = 60;
-    resume();
-  },
-});
-
-const sendVerifyCodeButtonText = computed(() => {
-  if (isSending.value) {
-    return t(
-      "core.signup.fields.verify_code.operations.send_code.buttons.sending"
-    );
-  }
-  return isActive.value
-    ? t(
-        "core.signup.fields.verify_code.operations.send_code.buttons.countdown",
-        {
-          timer: timer.value,
-        }
-      )
-    : t("core.signup.fields.verify_code.operations.send_code.buttons.send");
-});
-</script>
-
-<template>
-  <FormKit
-    id="signup-form"
-    name="signup-form"
-    :actions="false"
-    :classes="{
-      form: '!divide-none',
-    }"
-    type="form"
-    :config="{ validationVisibility: 'submit' }"
-    @submit="handleSignup"
-    @keyup.enter="submitForm('signup-form')"
-  >
-    <FormKit
-      v-model="formState.user.metadata.name"
-      name="username"
-      :placeholder="$t('core.signup.fields.username.placeholder')"
-      :validation-label="$t('core.signup.fields.username.placeholder')"
-      :classes="inputClasses"
-      :autofocus="true"
-      type="text"
-      :validation="[
-        ['required'],
-        ['length', '4', '63'],
-        [
-          'matches',
-          /^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$/,
-        ],
-      ]"
-      :validation-messages="{
-        matches: $t('core.user.editing_modal.fields.username.validation'),
-      }"
-    >
-    </FormKit>
-    <FormKit
-      v-model="formState.user.spec.displayName"
-      name="displayName"
-      :placeholder="$t('core.signup.fields.display_name.placeholder')"
-      :validation-label="$t('core.signup.fields.display_name.placeholder')"
-      :classes="inputClasses"
-      type="text"
-      validation="required"
-    >
-    </FormKit>
-    <FormKit
-      v-model="formState.user.spec.email"
-      :placeholder="$t('core.signup.fields.email.placeholder')"
-      :validation-label="$t('core.signup.fields.email.placeholder')"
-      type="email"
-      name="email"
-      :validation="emailValidation"
-      :validation-messages="{
-        matches: $t('core.signup.fields.email.matchFailed'),
-      }"
-    ></FormKit>
-    <FormKit
-      v-if="signUpCond.mustVerifyEmailOnRegistration"
-      v-model="formState.verifyCode"
-      type="number"
-      name="code"
-      :placeholder="$t('core.signup.fields.verify_code.placeholder')"
-      :validation-label="$t('core.signup.fields.verify_code.placeholder')"
-      validation="required"
-    >
-      <template #suffix>
-        <VButton
-          :loading="isSending"
-          :disabled="isActive"
-          class="rounded-none border-y-0 border-l border-r-0 tabular-nums"
-          @click="sendVerifyCode"
-        >
-          {{ sendVerifyCodeButtonText }}
-        </VButton>
-      </template>
-    </FormKit>
-    <FormKit
-      v-model="formState.password"
-      name="password"
-      :placeholder="$t('core.signup.fields.password.placeholder')"
-      :validation-label="$t('core.signup.fields.password.placeholder')"
-      :classes="inputClasses"
-      type="password"
-      validation="required:trim|length:5,100|matches:/^\S.*\S$/"
-      :validation-messages="{
-        matches: $t('core.formkit.validation.trim'),
-      }"
-    >
-    </FormKit>
-    <FormKit
-      name="password_confirm"
-      :placeholder="$t('core.signup.fields.password_confirm.placeholder')"
-      :validation-label="$t('core.signup.fields.password_confirm.placeholder')"
-      :classes="inputClasses"
-      type="password"
-      validation="confirm|required:trim|length:5,100|matches:/^\S.*\S$/"
-      :validation-messages="{
-        matches: $t('core.formkit.validation.trim'),
-      }"
-    >
-    </FormKit>
-  </FormKit>
-  <VButton
-    class="mt-8"
-    block
-    type="secondary"
-    :loading="loading"
-    @click="submitForm('signup-form')"
-  >
-    {{ $t(buttonText) }}
-  </VButton>
-</template>
diff --git a/ui/src/layouts/GatewayLayout.vue b/ui/src/layouts/GatewayLayout.vue
deleted file mode 100644
index 13a638b8fd..0000000000
--- a/ui/src/layouts/GatewayLayout.vue
+++ /dev/null
@@ -1,13 +0,0 @@
-<script lang="ts" setup>
-import IconLogo from "~icons/core/logo?width=5rem&height=2rem";
-</script>
-
-<template>
-  <div
-    class="flex h-screen flex-col items-center overflow-auto bg-white/90 pt-[30vh]"
-  >
-    <IconLogo class="mb-8 flex-none" />
-
-    <RouterView />
-  </div>
-</template>
diff --git a/ui/src/locales/en.yaml b/ui/src/locales/en.yaml
index 704f967291..b56a699ba4 100644
--- a/ui/src/locales/en.yaml
+++ b/ui/src/locales/en.yaml
@@ -1,78 +1,4 @@
 core:
-  login:
-    title: Login
-    fields:
-      username:
-        placeholder: Username
-      password:
-        placeholder: Password
-      remember_me:
-        label: Remember Me
-    operations:
-      submit:
-        toast_success: Login successful
-        toast_failed: Login failed, incorrect username or password
-        toast_csrf: CSRF Token expired, please try again
-      signup:
-        label: No account
-        button: Sign up
-      return_login:
-        label: Already have an account
-        button: Sign in
-      return_site: Return to site
-      reset_password:
-        button: Retrieve password
-    button: Login
-    modal:
-      title: Re-login
-    2fa:
-      fields:
-        code:
-          placeholder: Two-step verification code
-          label: Two-step verification code
-  signup:
-    title: Sign up
-    fields:
-      username:
-        placeholder: Username
-      display_name:
-        placeholder: Display name
-      email:
-        placeholder: Email
-        matchFailed: The email format is wrong or the service provider is not supported.
-      verify_code:
-        placeholder: Verification code
-        operations:
-          send_code:
-            buttons:
-              sending: sending
-              send: Send Code
-              countdown: resend after {timer} seconds
-            toast_success: verification code sent
-            toast_email_empty: please enter your email address
-      password:
-        placeholder: Password
-      password_confirm:
-        placeholder: Confirm password
-    operations:
-      submit:
-        button: Sign up
-        toast_success: Sign up successfully
-  binding:
-    title: Account binding
-    common:
-      toast:
-        mounted: >-
-          The current login method is not bound to an account, Please bind or
-          sign up a new account first
-    operations:
-      login_and_bind:
-        button: Login and Bind
-      signup_and_bind:
-        button: Signup and Bind
-      bind:
-        toast_success: Binding successfully
-        toast_failed: Binding failed, no enabled login method found
   sidebar:
     search:
       placeholder: Search
@@ -1657,8 +1583,6 @@ core:
       page_label: page
       size_label: items per page
       total_label: Total {total} items
-    social_auth_providers:
-      title: Third-party login
     app_download_alert:
       description: >-
         Themes and plugins for Halo can be downloaded at the following
@@ -1871,32 +1795,6 @@ core:
     setting_modal:
       title: Post settings
     title: My posts
-  uc_reset_password:
-    fields:
-      username:
-        label: username
-      password:
-        label: New Password
-      password_confirm:
-        label: Confirm Password
-    operations:
-      reset:
-        button: Reset Password
-        toast_success: Reset successful
-    title: Reset password
-  reset_password:
-    fields:
-      username:
-        label: Username
-      email:
-        label: email address
-    operations:
-      send:
-        label: Send verification email
-        toast_success: >-
-          If your username and email address match, we will send an email to
-          your email address.
-    title: Reset password
   tool:
     title: Tools
     empty:
diff --git a/ui/src/locales/es.yaml b/ui/src/locales/es.yaml
index 8107439eba..b74a7dce1a 100644
--- a/ui/src/locales/es.yaml
+++ b/ui/src/locales/es.yaml
@@ -1,60 +1,4 @@
 core:
-  login:
-    title: Inicio de sesión
-    fields:
-      username:
-        placeholder: Usuario
-      password:
-        placeholder: Contraseña
-    operations:
-      submit:
-        toast_success: Inicio de sesión exitoso
-        toast_failed: >-
-          Error en el inicio de sesión, nombre de usuario o contraseña
-          incorrectos
-        toast_csrf: Token CSRF no válido, por favor inténtalo de nuevo
-      signup:
-        label: No tienes una cuenta
-        button: Registrarse ahora
-      return_login:
-        label: Ya tienes una cuenta
-        button: Iniciar sesión ahora
-      return_site: Volver a la página de inicio
-    button: Iniciar sesión
-    modal:
-      title: Volver a iniciar sesión
-  signup:
-    title: Registrarse
-    fields:
-      username:
-        placeholder: Nombre de usuario
-      display_name:
-        placeholder: Nombre para mostrar
-      password:
-        placeholder: Contraseña
-      password_confirm:
-        placeholder: Confirmar contraseña
-    operations:
-      submit:
-        button: Registrarse
-        toast_success: Registrado exitosamente
-  binding:
-    title: Vinculación de cuentas
-    common:
-      toast:
-        mounted: >-
-          El método de inicio de sesión actual no está vinculado a una cuenta.
-          Por favor, vincula o registra una nueva cuenta primero.
-    operations:
-      login_and_bind:
-        button: Iniciar sesión y vincular
-      signup_and_bind:
-        button: Registrarse y vincular
-      bind:
-        toast_success: Vinculación exitosa
-        toast_failed: >-
-          Vinculación fallida, no se encontró ningún método de inicio de sesión
-          habilitado.
   sidebar:
     search:
       placeholder: Buscar
@@ -1285,8 +1229,6 @@ core:
       page_label: página
       size_label: elementos por página
       total_label: Total de {total} elementos
-    social_auth_providers:
-      title: Inicio de sesión de terceros
     app_download_alert:
       description: >-
         Los temas y complementos para Halo se pueden descargar en las siguientes
diff --git a/ui/src/locales/zh-CN.yaml b/ui/src/locales/zh-CN.yaml
index 388d34aea2..ab84cece98 100644
--- a/ui/src/locales/zh-CN.yaml
+++ b/ui/src/locales/zh-CN.yaml
@@ -1,76 +1,4 @@
 core:
-  login:
-    title: 登录
-    fields:
-      username:
-        placeholder: 用户名
-      password:
-        placeholder: 密码
-      remember_me:
-        label: 保持登录会话
-    operations:
-      submit:
-        toast_success: 登录成功
-        toast_failed: 登录失败，用户名或密码错误
-        toast_csrf: CSRF Token 失效，请重新尝试
-      signup:
-        label: 没有账号
-        button: 立即注册
-      return_login:
-        label: 已有账号
-        button: 立即登录
-      return_site: 返回到首页
-      reset_password:
-        button: 找回密码
-    button: 登录
-    modal:
-      title: 重新登录
-    2fa:
-      fields:
-        code:
-          placeholder: 请输入两步验证码
-          label: 两步验证码
-  signup:
-    title: 注册
-    fields:
-      username:
-        placeholder: 用户名
-      display_name:
-        placeholder: 名称
-      email:
-        placeholder: 电子邮箱
-        matchFailed: 邮箱格式错误或服务商不受支持
-      verify_code:
-        placeholder: 验证码
-        operations:
-          send_code:
-            buttons:
-              sending: 发送中
-              send: 发送验证码
-              countdown: "{timer} 秒后重发"
-            toast_success: 验证码已发送
-            toast_email_empty: 请输入电子邮箱
-      password:
-        placeholder: 密码
-      password_confirm:
-        placeholder: 确认密码
-    operations:
-      submit:
-        button: 注册
-        toast_success: 注册成功
-  binding:
-    title: 账号绑定
-    common:
-      toast:
-        mounted: 当前登录方式未绑定账号，请先绑定或注册新账号
-    operations:
-      login_and_bind:
-        button: 登录并绑定
-      signup_and_bind:
-        button: 注册并绑定
-      bind:
-        toast_success: 绑定成功
-        toast_failed: 绑定失败，没有找到已启用的登录方式
   sidebar:
     search:
       placeholder: 搜索
@@ -1413,30 +1341,6 @@ core:
         label: 密码
       confirm_password:
         label: 确认密码
-  reset_password:
-    title: 重置密码
-    fields:
-      username:
-        label: 用户名
-      email:
-        label: 邮箱地址
-    operations:
-      send:
-        label: 发送验证邮件
-        toast_success: 如果你的用户名和邮箱地址匹配，我们将会发送一封邮件到你的邮箱。
-  uc_reset_password:
-    title: 重置密码
-    fields:
-      username:
-        label: 用户名
-      password:
-        label: 新密码
-      password_confirm:
-        label: 确认密码
-    operations:
-      reset:
-        button: 重置密码
-        toast_success: 重置成功
   rbac:
     Attachments Management: 附件
     Attachment Manage: 附件管理
@@ -1575,8 +1479,6 @@ core:
       page_label: 页
       size_label: 条 / 页
       total_label: 共 {total} 项数据
-    social_auth_providers:
-      title: 三方登录
     app_download_alert:
       description: Halo 的主题和插件可以在以下地址下载：
       sources:
diff --git a/ui/src/locales/zh-TW.yaml b/ui/src/locales/zh-TW.yaml
index 76bbcfaa10..45b8cafa9b 100644
--- a/ui/src/locales/zh-TW.yaml
+++ b/ui/src/locales/zh-TW.yaml
@@ -1,76 +1,4 @@
 core:
-  login:
-    title: 登入
-    fields:
-      username:
-        placeholder: 用戶名
-      password:
-        placeholder: 密碼
-      remember_me:
-        label: 保持登入會話
-    operations:
-      submit:
-        toast_success: 登入成功
-        toast_failed: 登入失敗，用戶名或密碼錯誤
-        toast_csrf: CSRF Token 失效，請重新嘗試
-      signup:
-        label: 沒有帳號
-        button: 立即註冊
-      return_login:
-        label: 已有帳號
-        button: 立即登入
-      return_site: 返回到首頁
-      reset_password:
-        button: 找回密碼
-    button: 登入
-    modal:
-      title: 重新登入
-    2fa:
-      fields:
-        code:
-          placeholder: 請輸入兩步驟驗證碼
-          label: 兩步驟驗證碼
-  signup:
-    title: 註冊
-    fields:
-      username:
-        placeholder: 用戶名
-      display_name:
-        placeholder: 名稱
-      email:
-        placeholder: 電子郵箱
-        matchFailed: 郵箱格式錯誤或服務商不受支援
-      verify_code:
-        placeholder: 驗證碼
-        operations:
-          send_code:
-            buttons:
-              countdown: "{timer} 秒後重發"
-              send: 發送驗證碼
-              sending: 發送中
-            toast_email_empty: 請輸入電子郵件信箱
-            toast_success: 驗證碼已發送
-      password:
-        placeholder: 密碼
-      password_confirm:
-        placeholder: 確認密碼
-    operations:
-      submit:
-        button: 註冊
-        toast_success: 註冊成功
-  binding:
-    title: 帳號綁定
-    common:
-      toast:
-        mounted: 當前登入方式未綁定帳號，請先綁定或註冊新帳號
-    operations:
-      login_and_bind:
-        button: 登入並綁定
-      signup_and_bind:
-        button: 註冊並綁定
-      bind:
-        toast_success: 綁定成功
-        toast_failed: 綁定失敗，沒有找到已啟用的登入方式
   sidebar:
     search:
       placeholder: 搜尋
@@ -1530,8 +1458,6 @@ core:
       page_label: 頁
       size_label: 條 / 頁
       total_label: 共 {total} 項資料
-    social_auth_providers:
-      title: 三方登入
     app_download_alert:
       description: Halo 的主題和插件可以在以下地址下載：
       sources:
@@ -1735,30 +1661,6 @@ core:
     setting_modal:
       title: 文章設定
     title: 我的文章
-  uc_reset_password:
-    fields:
-      username:
-        label: 用戶名
-      password:
-        label: 新密碼
-      password_confirm:
-        label: 確認密碼
-    operations:
-      reset:
-        button: 重設密碼
-        toast_success: 重置成功
-    title: 重設密碼
-  reset_password:
-    fields:
-      username:
-        label: 使用者名稱
-      email:
-        label: 郵件地址
-    operations:
-      send:
-        label: 發送驗證郵件
-        toast_success: 如果你的用戶名和郵箱地址匹配，我們將會發送一封郵件到你的郵箱。
-    title: 重設密碼
   tool:
     title: 工具
     empty:
diff --git a/ui/src/setup/setupApiClient.ts b/ui/src/setup/setupApiClient.ts
index fdfd907daa..b4525e8cb6 100644
--- a/ui/src/setup/setupApiClient.ts
+++ b/ui/src/setup/setupApiClient.ts
@@ -1,5 +1,4 @@
 import { i18n } from "@/locales";
-import { useUserStore } from "@/stores/user";
 import { axiosInstance } from "@halo-dev/api-client";
 import { Toast } from "@halo-dev/components";
 import type { AxiosError } from "axios";
@@ -45,10 +44,10 @@ export function setupApiClient() {
       const { title, detail } = errorResponse.data;
 
       if (status === 401) {
-        const userStore = useUserStore();
-        userStore.loginModalVisible = true;
         Toast.warning(i18n.global.t("core.common.toast.login_expired"));
 
+        // TODO: show dialog
+
         return Promise.reject(error);
       }
 
diff --git a/ui/src/stores/user.ts b/ui/src/stores/user.ts
index 441851bb65..b50e0e4a5a 100644
--- a/ui/src/stores/user.ts
+++ b/ui/src/stores/user.ts
@@ -6,7 +6,6 @@ interface UserStoreState {
   currentUser?: User;
   currentRoles?: Role[];
   isAnonymous: boolean;
-  loginModalVisible: boolean;
 }
 
 export const useUserStore = defineStore("user", {
@@ -14,7 +13,6 @@ export const useUserStore = defineStore("user", {
     currentUser: undefined,
     currentRoles: [],
     isAnonymous: true,
-    loginModalVisible: false,
   }),
   actions: {
     async fetchCurrentUser() {
diff --git a/ui/uc-src/layouts/BasicLayout.vue b/ui/uc-src/layouts/BasicLayout.vue
index be079413a3..f9ff9528be 100644
--- a/ui/uc-src/layouts/BasicLayout.vue
+++ b/ui/uc-src/layouts/BasicLayout.vue
@@ -1,5 +1,4 @@
 <script lang="ts" setup>
-import LoginModal from "@/components/login/LoginModal.vue";
 import { RoutesMenu } from "@/components/menu/RoutesMenu";
 import { useRouteMenuGenerator } from "@/composables/use-route-menu-generator";
 import { rbacAnnotations } from "@/constants/annotations";
@@ -280,7 +279,6 @@ const disallowAccessConsole = computed(() => {
       </Teleport>
     </div>
   </div>
-  <LoginModal />
 </template>
 
 <style lang="scss">
diff --git a/ui/uc-src/router/routes.config.ts b/ui/uc-src/router/routes.config.ts
index e065b70326..4763b8c851 100644
--- a/ui/uc-src/router/routes.config.ts
+++ b/ui/uc-src/router/routes.config.ts
@@ -1,8 +1,6 @@
-import GatewayLayout from "@/layouts/GatewayLayout.vue";
 import Forbidden from "@/views/exceptions/Forbidden.vue";
 import NotFound from "@/views/exceptions/NotFound.vue";
 import BasicLayout from "@uc/layouts/BasicLayout.vue";
-import ResetPassword from "@uc/views/ResetPassword.vue";
 import type { RouteRecordRaw } from "vue-router";
 
 export const routes: Array<RouteRecordRaw> = [
@@ -22,20 +20,6 @@ export const routes: Array<RouteRecordRaw> = [
       },
     ],
   },
-  {
-    path: "/reset-password/:username",
-    component: GatewayLayout,
-    children: [
-      {
-        path: "",
-        name: "ResetPassword",
-        component: ResetPassword,
-        meta: {
-          title: "core.uc_reset_password.title",
-        },
-      },
-    ],
-  },
 ];
 
 export default routes;
diff --git a/ui/uc-src/views/ResetPassword.vue b/ui/uc-src/views/ResetPassword.vue
deleted file mode 100644
index cee578f0fd..0000000000
--- a/ui/uc-src/views/ResetPassword.vue
+++ /dev/null
@@ -1,108 +0,0 @@
-<script lang="ts" setup>
-import { publicApiClient } from "@halo-dev/api-client";
-import { Toast, VButton } from "@halo-dev/components";
-import { useRouteParams, useRouteQuery } from "@vueuse/router";
-import { ref } from "vue";
-import { useI18n } from "vue-i18n";
-
-const { t } = useI18n();
-
-const username = useRouteParams<string>("username");
-const token = useRouteQuery<string>("reset_password_token");
-
-interface ResetPasswordForm {
-  username: string;
-  password: string;
-}
-
-const loading = ref(false);
-
-async function onSubmit(data: ResetPasswordForm) {
-  try {
-    loading.value = true;
-
-    await publicApiClient.user.resetPasswordByToken({
-      name: data.username,
-      resetPasswordRequest: {
-        newPassword: data.password,
-        token: token.value,
-      },
-    });
-
-    Toast.success(t("core.uc_reset_password.operations.reset.toast_success"));
-
-    window.location.href = "/console/login";
-  } catch (error) {
-    console.error("Failed to reset password", error);
-  } finally {
-    loading.value = false;
-  }
-}
-
-const inputClasses = {
-  outer: "!py-3 first:!pt-0 last:!pb-0",
-};
-</script>
-
-<template>
-  <div class="flex w-72 flex-col">
-    <FormKit
-      id="reset-password-form"
-      name="reset-password-form"
-      type="form"
-      :classes="{
-        form: '!divide-none',
-      }"
-      :config="{ validationVisibility: 'submit' }"
-      @submit="onSubmit"
-      @keyup.enter="$formkit.submit('reset-password-form')"
-    >
-      <FormKit
-        :classes="inputClasses"
-        name="username"
-        :model-value="username"
-        :placeholder="$t('core.uc_reset_password.fields.username.label')"
-        :validation-label="$t('core.uc_reset_password.fields.username.label')"
-        :autofocus="true"
-        type="text"
-        disabled
-        validation="required"
-      ></FormKit>
-      <FormKit
-        :classes="inputClasses"
-        name="password"
-        type="password"
-        :placeholder="$t('core.uc_reset_password.fields.password.label')"
-        :validation-label="$t('core.uc_reset_password.fields.password.label')"
-        validation="required:trim|length:5,100|matches:/^\S.*\S$/"
-        :validation-messages="{
-          matches: $t('core.formkit.validation.trim'),
-        }"
-      ></FormKit>
-      <FormKit
-        :classes="inputClasses"
-        name="password_confirm"
-        type="password"
-        :placeholder="
-          $t('core.uc_reset_password.fields.password_confirm.label')
-        "
-        :validation-label="
-          $t('core.uc_reset_password.fields.password_confirm.label')
-        "
-        validation="confirm|required:trim|length:5,100|matches:/^\S.*\S$/"
-        :validation-messages="{
-          matches: $t('core.formkit.validation.trim'),
-        }"
-      ></FormKit>
-    </FormKit>
-    <VButton
-      class="mt-8"
-      block
-      :loading="loading"
-      type="secondary"
-      @click="$formkit.submit('reset-password-form')"
-    >
-      {{ $t("core.uc_reset_password.operations.reset.button") }}
-    </VButton>
-  </div>
-</template>

From 774678fd654110cabef030dec7714431e562f7b4 Mon Sep 17 00:00:00 2001
From: Ryan Wang <i@ryanc.cc>
Date: Sat, 28 Sep 2024 18:37:41 +0800
Subject: [PATCH 048/185] fix: resolve issue with editor not detecting image
 paste in Firefox (#6693)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/area ui
/kind bug
/milestone 2.20.x

#### What this PR does / why we need it:

修复在 FireFox 浏览器下的编辑器中无法通过粘贴文件上传的问题。

#### Which issue(s) this PR fixes:

Fixes #6684

#### Special notes for your reviewer:

在 FireFox 浏览器中，复制一张本地的图片，尝试在编辑器中粘贴，观察是否上传成功。

#### Does this PR introduce a user-facing change?

```release-note
修复在 FireFox 浏览器下的编辑器中无法通过粘贴文件上传的问题。
```
---
 ui/src/components/editor/extensions/upload/index.ts | 8 ++++++--
 ui/src/components/editor/utils/upload.ts            | 5 +++++
 2 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/ui/src/components/editor/extensions/upload/index.ts b/ui/src/components/editor/extensions/upload/index.ts
index a68a89723c..adca39cf7a 100644
--- a/ui/src/components/editor/extensions/upload/index.ts
+++ b/ui/src/components/editor/extensions/upload/index.ts
@@ -4,7 +4,10 @@ import {
   Plugin,
   PluginKey,
 } from "@halo-dev/richtext-editor";
-import { handleFileEvent } from "../../utils/upload";
+import {
+  containsFileClipboardIdentifier,
+  handleFileEvent,
+} from "../../utils/upload";
 
 export const Upload = Extension.create({
   name: "upload",
@@ -26,7 +29,8 @@ export const Upload = Extension.create({
             }
 
             const types = event.clipboardData.types;
-            if (!(types.length === 1 && types[0].toLowerCase() === "files")) {
+
+            if (!containsFileClipboardIdentifier(types)) {
               return false;
             }
 
diff --git a/ui/src/components/editor/utils/upload.ts b/ui/src/components/editor/utils/upload.ts
index 4ca9a4ce85..09cd04bc8e 100644
--- a/ui/src/components/editor/utils/upload.ts
+++ b/ui/src/components/editor/utils/upload.ts
@@ -142,3 +142,8 @@ export function fileToBase64(file: File): Promise<string> {
     reader.readAsDataURL(file);
   });
 }
+
+export function containsFileClipboardIdentifier(types: readonly string[]) {
+  const fileTypes = ["files", "application/x-moz-file", "public.file-url"];
+  return types.some((type) => fileTypes.includes(type.toLowerCase()));
+}

From 3fe1afb9523b537f6911f35851780302956f7ea8 Mon Sep 17 00:00:00 2001
From: Ryan Wang <i@ryanc.cc>
Date: Sat, 28 Sep 2024 18:39:42 +0800
Subject: [PATCH 049/185] fix: resolve issue with underline not displaying in
 input field (#6694)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/area ui
/kind bug
/milestone 2.20.x

#### What this PR does / why we need it:

修复部分设备或者浏览器下，输入框中的下划线可能无法正常显示的问题。

before:

<img width="678" alt="image" src="https://github.com/user-attachments/assets/11a34729-3bed-4898-b222-0027ac71830d">

after:

<img width="681" alt="image" src="https://github.com/user-attachments/assets/8065c36a-6c94-4ac9-b859-8369dcb7d1e3">


#### Which issue(s) this PR fixes:

Fixes #5651

#### Does this PR introduce a user-facing change?

```release-note
修复部分设备或者浏览器下，输入框中的下划线可能无法正常显示的问题。
```
---
 ui/src/formkit/theme.ts | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/ui/src/formkit/theme.ts b/ui/src/formkit/theme.ts
index 19f38ddeb3..e497484671 100644
--- a/ui/src/formkit/theme.ts
+++ b/ui/src/formkit/theme.ts
@@ -2,9 +2,8 @@ const textClassification = {
   label: "block text-sm font-medium text-gray-700 formkit-invalid:text-red-500",
   wrapper: "flex flex-col gap-4",
   inner:
-    "inline-flex items-center w-full relative box-border border border-gray-300 formkit-invalid:border-red-500 h-9 rounded-base overflow-hidden focus-within:border-primary focus-within:shadow-sm w-full sm:max-w-lg transition-all",
-  input:
-    "bg-white resize-none w-full text-black block transition-all h-full px-3 text-sm",
+    "bg-white inline-flex items-center w-full relative box-border border border-gray-300 formkit-invalid:border-red-500 h-9 rounded-base overflow-hidden focus-within:border-primary focus-within:shadow-sm w-full sm:max-w-lg transition-all",
+  input: "resize-none w-full text-black block transition-all px-3 text-sm",
 };
 
 const boxClassification = {

From a1fcd5171431861975e3c5044ad414fba5fee032 Mon Sep 17 00:00:00 2001
From: guqing <38999863+guqing@users.noreply.github.com>
Date: Sat, 28 Sep 2024 18:41:42 +0800
Subject: [PATCH 050/185] fix: thumbnail generation for URI string containing
 spaces (#6698)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?
/kind improvement
/area core
/milestone 2.20.x

#### What this PR does / why we need it:
修复文章封面图链接包含空格时主题端会因为生成缩略图错误而无法访问的问题

这是由于 URI string 中包含空格无法创建 URI 对象,目前将忽略这种非法参数,如果生成失败则直接返回原始 URI string

#### Which issue(s) this PR fixes:
Fixes #6690

#### Does this PR introduce a user-facing change?
```release-note
修复文章封面图链接包含空格时主题端会因为生成缩略图错误而无法访问的问题
```
---
 .../finders/impl/ThumbnailFinderImpl.java     | 10 +++-
 .../finders/impl/ThumbnailFinderImplTest.java | 54 +++++++++++++++++++
 2 files changed, 63 insertions(+), 1 deletion(-)
 create mode 100644 application/src/test/java/run/halo/app/theme/finders/impl/ThumbnailFinderImplTest.java

diff --git a/application/src/main/java/run/halo/app/theme/finders/impl/ThumbnailFinderImpl.java b/application/src/main/java/run/halo/app/theme/finders/impl/ThumbnailFinderImpl.java
index 19a7922ce2..e8eac936b8 100644
--- a/application/src/main/java/run/halo/app/theme/finders/impl/ThumbnailFinderImpl.java
+++ b/application/src/main/java/run/halo/app/theme/finders/impl/ThumbnailFinderImpl.java
@@ -2,12 +2,14 @@
 
 import java.net.URI;
 import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
 import reactor.core.publisher.Mono;
 import run.halo.app.core.attachment.ThumbnailService;
 import run.halo.app.core.attachment.ThumbnailSize;
 import run.halo.app.theme.finders.Finder;
 import run.halo.app.theme.finders.ThumbnailFinder;
 
+@Slf4j
 @Finder("thumbnail")
 @RequiredArgsConstructor
 public class ThumbnailFinderImpl implements ThumbnailFinder {
@@ -15,8 +17,14 @@ public class ThumbnailFinderImpl implements ThumbnailFinder {
 
     @Override
     public Mono<String> gen(String uriStr, String size) {
-        return thumbnailService.generate(URI.create(uriStr), ThumbnailSize.fromName(size))
+        return Mono.fromSupplier(() -> URI.create(uriStr))
+            .flatMap(uri -> thumbnailService.generate(uri, ThumbnailSize.fromName(size)))
             .map(URI::toString)
+            .onErrorResume(Throwable.class, e -> {
+                log.debug("Failed to generate thumbnail for [{}], error: [{}]", uriStr,
+                    e.getMessage());
+                return Mono.just(uriStr);
+            })
             .defaultIfEmpty(uriStr);
     }
 }
diff --git a/application/src/test/java/run/halo/app/theme/finders/impl/ThumbnailFinderImplTest.java b/application/src/test/java/run/halo/app/theme/finders/impl/ThumbnailFinderImplTest.java
new file mode 100644
index 0000000000..3fb8d6e3b9
--- /dev/null
+++ b/application/src/test/java/run/halo/app/theme/finders/impl/ThumbnailFinderImplTest.java
@@ -0,0 +1,54 @@
+package run.halo.app.theme.finders.impl;
+
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.Mockito.times;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import java.net.URI;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+import reactor.core.publisher.Mono;
+import reactor.test.StepVerifier;
+import run.halo.app.core.attachment.ThumbnailService;
+
+/**
+ * Tests for {@link ThumbnailFinderImpl}.
+ *
+ * @author guqing
+ * @since 2.20.0
+ */
+@ExtendWith(MockitoExtension.class)
+class ThumbnailFinderImplTest {
+
+    @Mock
+    ThumbnailService thumbnailService;
+
+    @InjectMocks
+    ThumbnailFinderImpl thumbnailFinder;
+
+    @Test
+    void shouldNotGenWhenUriIsInvalid() {
+        thumbnailFinder.gen("invalid uri", "l")
+            .as(StepVerifier::create)
+            .expectNext("invalid uri")
+            .verifyComplete();
+
+        verify(thumbnailService, times(0)).generate(any(), any());
+    }
+
+    @Test
+    void shouldGenWhenUriIsValid() {
+        when(thumbnailService.generate(any(), any()))
+            .thenReturn(Mono.just(URI.create("/test-thumb.jpg")));
+        thumbnailFinder.gen("/test.jpg", "l")
+            .as(StepVerifier::create)
+            .expectNext("/test-thumb.jpg")
+            .verifyComplete();
+
+        verify(thumbnailService).generate(any(), any());
+    }
+}

From a53aa786e1d994b9a11b9105317501298d5676f1 Mon Sep 17 00:00:00 2001
From: guqing <38999863+guqing@users.noreply.github.com>
Date: Sat, 28 Sep 2024 18:43:42 +0800
Subject: [PATCH 051/185] chore: reorganize package structure for content stats
 updater (#6699)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?
/milestone 2.20.x
/area core

#### What this PR does / why we need it:
将内容管理相关的数据更新类归档到 content 包下,如访问量和评论量统计

#### Does this PR introduce a user-facing change?
```release-note
None
```
---
 .../run/halo/app/content/comment/AbstractCommentService.java  | 4 ++--
 .../java/run/halo/app/content/comment/CommentServiceImpl.java | 2 +-
 .../java/run/halo/app/content/comment/ReplyServiceImpl.java   | 2 +-
 .../main/java/run/halo/app/content/impl/PostServiceImpl.java  | 4 ++--
 .../java/run/halo/app/content/impl/SinglePageServiceImpl.java | 4 ++--
 .../halo/app/{metrics => content/stats}/PostStatsUpdater.java | 2 +-
 .../app/{metrics => content/stats}/ReplyEventReconciler.java  | 2 +-
 .../run/halo/app/content/{ => stats}/TagPostCountUpdater.java | 3 ++-
 .../{metrics => content/stats}/VisitedEventReconciler.java    | 3 ++-
 .../app/{metrics => content/stats}/VotedEventReconciler.java  | 3 ++-
 .../halo/app/{metrics => core/counter}/CounterService.java    | 2 +-
 .../app/{metrics => core/counter}/CounterServiceImpl.java     | 2 +-
 .../run/halo/app/{metrics => core/counter}/MeterUtils.java    | 2 +-
 .../java/run/halo/app/core/reconciler/CommentReconciler.java  | 2 +-
 .../run/halo/app/core/reconciler/PostCounterReconciler.java   | 2 +-
 .../java/run/halo/app/core/reconciler/PostReconciler.java     | 4 ++--
 .../run/halo/app/core/reconciler/SinglePageReconciler.java    | 4 ++--
 .../java/run/halo/app/event/post/PostStatsChangedEvent.java   | 2 +-
 .../app/theme/finders/impl/CommentPublicQueryServiceImpl.java | 4 ++--
 .../app/theme/finders/impl/PostPublicQueryServiceImpl.java    | 4 ++--
 .../theme/finders/impl/SinglePageConversionServiceImpl.java   | 4 ++--
 .../run/halo/app/content/comment/CommentServiceImplTest.java  | 4 ++--
 .../halo/app/{metrics => core/counter}/MeterUtilsTest.java    | 2 +-
 .../halo/app/core/reconciler/SinglePageReconcilerTest.java    | 3 +--
 .../theme/finders/impl/CommentPublicQueryServiceImplTest.java | 2 +-
 .../run/halo/app/theme/finders/impl/PostFinderImplTest.java   | 2 +-
 26 files changed, 38 insertions(+), 36 deletions(-)
 rename application/src/main/java/run/halo/app/{metrics => content/stats}/PostStatsUpdater.java (98%)
 rename application/src/main/java/run/halo/app/{metrics => content/stats}/ReplyEventReconciler.java (99%)
 rename application/src/main/java/run/halo/app/content/{ => stats}/TagPostCountUpdater.java (98%)
 rename application/src/main/java/run/halo/app/{metrics => content/stats}/VisitedEventReconciler.java (98%)
 rename application/src/main/java/run/halo/app/{metrics => content/stats}/VotedEventReconciler.java (98%)
 rename application/src/main/java/run/halo/app/{metrics => core/counter}/CounterService.java (88%)
 rename application/src/main/java/run/halo/app/{metrics => core/counter}/CounterServiceImpl.java (95%)
 rename application/src/main/java/run/halo/app/{metrics => core/counter}/MeterUtils.java (99%)
 rename application/src/test/java/run/halo/app/{metrics => core/counter}/MeterUtilsTest.java (99%)

diff --git a/application/src/main/java/run/halo/app/content/comment/AbstractCommentService.java b/application/src/main/java/run/halo/app/content/comment/AbstractCommentService.java
index 3ebc08df8f..9c054ea399 100644
--- a/application/src/main/java/run/halo/app/content/comment/AbstractCommentService.java
+++ b/application/src/main/java/run/halo/app/content/comment/AbstractCommentService.java
@@ -5,14 +5,14 @@
 import org.springframework.security.core.context.ReactiveSecurityContextHolder;
 import org.springframework.util.Assert;
 import reactor.core.publisher.Mono;
+import run.halo.app.core.counter.CounterService;
+import run.halo.app.core.counter.MeterUtils;
 import run.halo.app.core.extension.User;
 import run.halo.app.core.extension.content.Comment;
 import run.halo.app.core.extension.content.Reply;
 import run.halo.app.core.user.service.RoleService;
 import run.halo.app.core.user.service.UserService;
 import run.halo.app.extension.ReactiveExtensionClient;
-import run.halo.app.metrics.CounterService;
-import run.halo.app.metrics.MeterUtils;
 import run.halo.app.security.authorization.AuthorityUtils;
 
 @RequiredArgsConstructor
diff --git a/application/src/main/java/run/halo/app/content/comment/CommentServiceImpl.java b/application/src/main/java/run/halo/app/content/comment/CommentServiceImpl.java
index 76e985aae7..202298d1cf 100644
--- a/application/src/main/java/run/halo/app/content/comment/CommentServiceImpl.java
+++ b/application/src/main/java/run/halo/app/content/comment/CommentServiceImpl.java
@@ -16,6 +16,7 @@
 import reactor.core.publisher.Flux;
 import reactor.core.publisher.Mono;
 import reactor.util.retry.Retry;
+import run.halo.app.core.counter.CounterService;
 import run.halo.app.core.extension.content.Comment;
 import run.halo.app.core.user.service.RoleService;
 import run.halo.app.core.user.service.UserService;
@@ -29,7 +30,6 @@
 import run.halo.app.extension.router.selector.FieldSelector;
 import run.halo.app.infra.SystemConfigurableEnvironmentFetcher;
 import run.halo.app.infra.exception.AccessDeniedException;
-import run.halo.app.metrics.CounterService;
 import run.halo.app.plugin.extensionpoint.ExtensionGetter;
 
 /**
diff --git a/application/src/main/java/run/halo/app/content/comment/ReplyServiceImpl.java b/application/src/main/java/run/halo/app/content/comment/ReplyServiceImpl.java
index 54687b9292..fc72507a2c 100644
--- a/application/src/main/java/run/halo/app/content/comment/ReplyServiceImpl.java
+++ b/application/src/main/java/run/halo/app/content/comment/ReplyServiceImpl.java
@@ -20,6 +20,7 @@
 import reactor.core.publisher.Flux;
 import reactor.core.publisher.Mono;
 import reactor.util.retry.Retry;
+import run.halo.app.core.counter.CounterService;
 import run.halo.app.core.extension.content.Comment;
 import run.halo.app.core.extension.content.Reply;
 import run.halo.app.core.user.service.RoleService;
@@ -31,7 +32,6 @@
 import run.halo.app.extension.ReactiveExtensionClient;
 import run.halo.app.extension.router.selector.FieldSelector;
 import run.halo.app.infra.exception.RequestRestrictedException;
-import run.halo.app.metrics.CounterService;
 
 /**
  * A default implementation of {@link ReplyService}.
diff --git a/application/src/main/java/run/halo/app/content/impl/PostServiceImpl.java b/application/src/main/java/run/halo/app/content/impl/PostServiceImpl.java
index b8a12c0f04..5e805ac9ac 100644
--- a/application/src/main/java/run/halo/app/content/impl/PostServiceImpl.java
+++ b/application/src/main/java/run/halo/app/content/impl/PostServiceImpl.java
@@ -30,6 +30,8 @@
 import run.halo.app.content.PostRequest;
 import run.halo.app.content.PostService;
 import run.halo.app.content.Stats;
+import run.halo.app.core.counter.CounterService;
+import run.halo.app.core.counter.MeterUtils;
 import run.halo.app.core.extension.content.Category;
 import run.halo.app.core.extension.content.Post;
 import run.halo.app.core.extension.content.Snapshot;
@@ -43,8 +45,6 @@
 import run.halo.app.extension.router.selector.FieldSelector;
 import run.halo.app.infra.Condition;
 import run.halo.app.infra.ConditionStatus;
-import run.halo.app.metrics.CounterService;
-import run.halo.app.metrics.MeterUtils;
 
 /**
  * A default implementation of {@link PostService}.
diff --git a/application/src/main/java/run/halo/app/content/impl/SinglePageServiceImpl.java b/application/src/main/java/run/halo/app/content/impl/SinglePageServiceImpl.java
index 868ca69dfc..5fafa17562 100644
--- a/application/src/main/java/run/halo/app/content/impl/SinglePageServiceImpl.java
+++ b/application/src/main/java/run/halo/app/content/impl/SinglePageServiceImpl.java
@@ -25,6 +25,8 @@
 import run.halo.app.content.SinglePageRequest;
 import run.halo.app.content.SinglePageService;
 import run.halo.app.content.Stats;
+import run.halo.app.core.counter.CounterService;
+import run.halo.app.core.counter.MeterUtils;
 import run.halo.app.core.extension.content.Post;
 import run.halo.app.core.extension.content.SinglePage;
 import run.halo.app.core.extension.content.Snapshot;
@@ -34,8 +36,6 @@
 import run.halo.app.extension.Ref;
 import run.halo.app.infra.Condition;
 import run.halo.app.infra.ConditionStatus;
-import run.halo.app.metrics.CounterService;
-import run.halo.app.metrics.MeterUtils;
 
 /**
  * Single page service implementation.
diff --git a/application/src/main/java/run/halo/app/metrics/PostStatsUpdater.java b/application/src/main/java/run/halo/app/content/stats/PostStatsUpdater.java
similarity index 98%
rename from application/src/main/java/run/halo/app/metrics/PostStatsUpdater.java
rename to application/src/main/java/run/halo/app/content/stats/PostStatsUpdater.java
index f417c6e1ca..2a61889743 100644
--- a/application/src/main/java/run/halo/app/metrics/PostStatsUpdater.java
+++ b/application/src/main/java/run/halo/app/content/stats/PostStatsUpdater.java
@@ -1,4 +1,4 @@
-package run.halo.app.metrics;
+package run.halo.app.content.stats;
 
 import java.time.Duration;
 import java.time.Instant;
diff --git a/application/src/main/java/run/halo/app/metrics/ReplyEventReconciler.java b/application/src/main/java/run/halo/app/content/stats/ReplyEventReconciler.java
similarity index 99%
rename from application/src/main/java/run/halo/app/metrics/ReplyEventReconciler.java
rename to application/src/main/java/run/halo/app/content/stats/ReplyEventReconciler.java
index 9f0c5f4624..3a20f7af84 100644
--- a/application/src/main/java/run/halo/app/metrics/ReplyEventReconciler.java
+++ b/application/src/main/java/run/halo/app/content/stats/ReplyEventReconciler.java
@@ -1,4 +1,4 @@
-package run.halo.app.metrics;
+package run.halo.app.content.stats;
 
 import static org.apache.commons.lang3.ObjectUtils.defaultIfNull;
 import static run.halo.app.extension.index.query.QueryFactory.and;
diff --git a/application/src/main/java/run/halo/app/content/TagPostCountUpdater.java b/application/src/main/java/run/halo/app/content/stats/TagPostCountUpdater.java
similarity index 98%
rename from application/src/main/java/run/halo/app/content/TagPostCountUpdater.java
rename to application/src/main/java/run/halo/app/content/stats/TagPostCountUpdater.java
index 481da4559e..6221b2b03b 100644
--- a/application/src/main/java/run/halo/app/content/TagPostCountUpdater.java
+++ b/application/src/main/java/run/halo/app/content/stats/TagPostCountUpdater.java
@@ -1,4 +1,4 @@
-package run.halo.app.content;
+package run.halo.app.content.stats;
 
 import static org.apache.commons.lang3.ObjectUtils.defaultIfNull;
 import static run.halo.app.extension.index.query.QueryFactory.and;
@@ -12,6 +12,7 @@
 import org.apache.commons.lang3.StringUtils;
 import org.springframework.context.event.EventListener;
 import org.springframework.stereotype.Component;
+import run.halo.app.content.AbstractEventReconciler;
 import run.halo.app.core.extension.content.Post;
 import run.halo.app.core.extension.content.Tag;
 import run.halo.app.core.extension.content.Tag.TagStatus;
diff --git a/application/src/main/java/run/halo/app/metrics/VisitedEventReconciler.java b/application/src/main/java/run/halo/app/content/stats/VisitedEventReconciler.java
similarity index 98%
rename from application/src/main/java/run/halo/app/metrics/VisitedEventReconciler.java
rename to application/src/main/java/run/halo/app/content/stats/VisitedEventReconciler.java
index 968777a2cb..42b1932dd0 100644
--- a/application/src/main/java/run/halo/app/metrics/VisitedEventReconciler.java
+++ b/application/src/main/java/run/halo/app/content/stats/VisitedEventReconciler.java
@@ -1,4 +1,4 @@
-package run.halo.app.metrics;
+package run.halo.app.content.stats;
 
 import java.time.Duration;
 import java.time.Instant;
@@ -14,6 +14,7 @@
 import org.springframework.scheduling.annotation.Async;
 import org.springframework.scheduling.annotation.Scheduled;
 import org.springframework.stereotype.Component;
+import run.halo.app.core.counter.MeterUtils;
 import run.halo.app.core.extension.Counter;
 import run.halo.app.event.post.VisitedEvent;
 import run.halo.app.extension.ExtensionClient;
diff --git a/application/src/main/java/run/halo/app/metrics/VotedEventReconciler.java b/application/src/main/java/run/halo/app/content/stats/VotedEventReconciler.java
similarity index 98%
rename from application/src/main/java/run/halo/app/metrics/VotedEventReconciler.java
rename to application/src/main/java/run/halo/app/content/stats/VotedEventReconciler.java
index 915d498f4b..ed60a4130d 100644
--- a/application/src/main/java/run/halo/app/metrics/VotedEventReconciler.java
+++ b/application/src/main/java/run/halo/app/content/stats/VotedEventReconciler.java
@@ -1,4 +1,4 @@
-package run.halo.app.metrics;
+package run.halo.app.content.stats;
 
 import java.time.Duration;
 import java.time.Instant;
@@ -10,6 +10,7 @@
 import org.springframework.context.event.EventListener;
 import org.springframework.scheduling.annotation.Async;
 import org.springframework.stereotype.Component;
+import run.halo.app.core.counter.MeterUtils;
 import run.halo.app.core.extension.Counter;
 import run.halo.app.event.post.DownvotedEvent;
 import run.halo.app.event.post.UpvotedEvent;
diff --git a/application/src/main/java/run/halo/app/metrics/CounterService.java b/application/src/main/java/run/halo/app/core/counter/CounterService.java
similarity index 88%
rename from application/src/main/java/run/halo/app/metrics/CounterService.java
rename to application/src/main/java/run/halo/app/core/counter/CounterService.java
index 8dcf3b9597..f3940c796f 100644
--- a/application/src/main/java/run/halo/app/metrics/CounterService.java
+++ b/application/src/main/java/run/halo/app/core/counter/CounterService.java
@@ -1,4 +1,4 @@
-package run.halo.app.metrics;
+package run.halo.app.core.counter;
 
 import reactor.core.publisher.Mono;
 import run.halo.app.core.extension.Counter;
diff --git a/application/src/main/java/run/halo/app/metrics/CounterServiceImpl.java b/application/src/main/java/run/halo/app/core/counter/CounterServiceImpl.java
similarity index 95%
rename from application/src/main/java/run/halo/app/metrics/CounterServiceImpl.java
rename to application/src/main/java/run/halo/app/core/counter/CounterServiceImpl.java
index 64727b5be2..d1be85fc77 100644
--- a/application/src/main/java/run/halo/app/metrics/CounterServiceImpl.java
+++ b/application/src/main/java/run/halo/app/core/counter/CounterServiceImpl.java
@@ -1,4 +1,4 @@
-package run.halo.app.metrics;
+package run.halo.app.core.counter;
 
 import org.springframework.stereotype.Service;
 import reactor.core.publisher.Mono;
diff --git a/application/src/main/java/run/halo/app/metrics/MeterUtils.java b/application/src/main/java/run/halo/app/core/counter/MeterUtils.java
similarity index 99%
rename from application/src/main/java/run/halo/app/metrics/MeterUtils.java
rename to application/src/main/java/run/halo/app/core/counter/MeterUtils.java
index c61c77345f..49b5356f31 100644
--- a/application/src/main/java/run/halo/app/metrics/MeterUtils.java
+++ b/application/src/main/java/run/halo/app/core/counter/MeterUtils.java
@@ -1,4 +1,4 @@
-package run.halo.app.metrics;
+package run.halo.app.core.counter;
 
 import io.micrometer.core.instrument.Counter;
 import io.micrometer.core.instrument.MeterRegistry;
diff --git a/application/src/main/java/run/halo/app/core/reconciler/CommentReconciler.java b/application/src/main/java/run/halo/app/core/reconciler/CommentReconciler.java
index abcca19475..a651a09b5a 100644
--- a/application/src/main/java/run/halo/app/core/reconciler/CommentReconciler.java
+++ b/application/src/main/java/run/halo/app/core/reconciler/CommentReconciler.java
@@ -18,6 +18,7 @@
 import org.springframework.stereotype.Component;
 import run.halo.app.content.comment.ReplyNotificationSubscriptionHelper;
 import run.halo.app.content.comment.ReplyService;
+import run.halo.app.core.counter.MeterUtils;
 import run.halo.app.core.extension.Counter;
 import run.halo.app.core.extension.content.Comment;
 import run.halo.app.core.extension.content.Constant;
@@ -36,7 +37,6 @@
 import run.halo.app.extension.controller.Reconciler;
 import run.halo.app.extension.index.query.Query;
 import run.halo.app.extension.router.selector.FieldSelector;
-import run.halo.app.metrics.MeterUtils;
 
 /**
  * Reconciler for {@link Comment}.
diff --git a/application/src/main/java/run/halo/app/core/reconciler/PostCounterReconciler.java b/application/src/main/java/run/halo/app/core/reconciler/PostCounterReconciler.java
index 24f8ada281..1e43f0c387 100644
--- a/application/src/main/java/run/halo/app/core/reconciler/PostCounterReconciler.java
+++ b/application/src/main/java/run/halo/app/core/reconciler/PostCounterReconciler.java
@@ -5,6 +5,7 @@
 import lombok.RequiredArgsConstructor;
 import org.springframework.context.ApplicationEventPublisher;
 import org.springframework.stereotype.Component;
+import run.halo.app.core.counter.MeterUtils;
 import run.halo.app.core.extension.Counter;
 import run.halo.app.core.extension.content.Post;
 import run.halo.app.event.post.PostStatsChangedEvent;
@@ -14,7 +15,6 @@
 import run.halo.app.extension.controller.ControllerBuilder;
 import run.halo.app.extension.controller.Reconciler;
 import run.halo.app.extension.router.selector.FieldSelector;
-import run.halo.app.metrics.MeterUtils;
 
 @Component
 @RequiredArgsConstructor
diff --git a/application/src/main/java/run/halo/app/core/reconciler/PostReconciler.java b/application/src/main/java/run/halo/app/core/reconciler/PostReconciler.java
index 5018b89aa7..9ada817e00 100644
--- a/application/src/main/java/run/halo/app/core/reconciler/PostReconciler.java
+++ b/application/src/main/java/run/halo/app/core/reconciler/PostReconciler.java
@@ -39,6 +39,8 @@
 import run.halo.app.content.PostService;
 import run.halo.app.content.comment.CommentService;
 import run.halo.app.content.permalinks.PostPermalinkPolicy;
+import run.halo.app.core.counter.CounterService;
+import run.halo.app.core.counter.MeterUtils;
 import run.halo.app.core.extension.content.Constant;
 import run.halo.app.core.extension.content.Post;
 import run.halo.app.core.extension.content.Post.PostPhase;
@@ -65,8 +67,6 @@
 import run.halo.app.infra.Condition;
 import run.halo.app.infra.ConditionStatus;
 import run.halo.app.infra.utils.HaloUtils;
-import run.halo.app.metrics.CounterService;
-import run.halo.app.metrics.MeterUtils;
 import run.halo.app.notification.NotificationCenter;
 import run.halo.app.plugin.extensionpoint.ExtensionGetter;
 
diff --git a/application/src/main/java/run/halo/app/core/reconciler/SinglePageReconciler.java b/application/src/main/java/run/halo/app/core/reconciler/SinglePageReconciler.java
index d35a3cef65..a09d2b6966 100644
--- a/application/src/main/java/run/halo/app/core/reconciler/SinglePageReconciler.java
+++ b/application/src/main/java/run/halo/app/core/reconciler/SinglePageReconciler.java
@@ -23,6 +23,8 @@
 import run.halo.app.content.NotificationReasonConst;
 import run.halo.app.content.SinglePageService;
 import run.halo.app.content.comment.CommentService;
+import run.halo.app.core.counter.CounterService;
+import run.halo.app.core.counter.MeterUtils;
 import run.halo.app.core.extension.content.Post;
 import run.halo.app.core.extension.content.SinglePage;
 import run.halo.app.core.extension.content.Snapshot;
@@ -43,8 +45,6 @@
 import run.halo.app.infra.ConditionStatus;
 import run.halo.app.infra.ExternalUrlSupplier;
 import run.halo.app.infra.utils.JsonUtils;
-import run.halo.app.metrics.CounterService;
-import run.halo.app.metrics.MeterUtils;
 import run.halo.app.notification.NotificationCenter;
 import run.halo.app.plugin.extensionpoint.ExtensionGetter;
 
diff --git a/application/src/main/java/run/halo/app/event/post/PostStatsChangedEvent.java b/application/src/main/java/run/halo/app/event/post/PostStatsChangedEvent.java
index aa936b821d..f574bca8e5 100644
--- a/application/src/main/java/run/halo/app/event/post/PostStatsChangedEvent.java
+++ b/application/src/main/java/run/halo/app/event/post/PostStatsChangedEvent.java
@@ -3,9 +3,9 @@
 import lombok.Getter;
 import org.apache.commons.lang3.StringUtils;
 import org.springframework.context.ApplicationEvent;
+import run.halo.app.core.counter.MeterUtils;
 import run.halo.app.core.extension.Counter;
 import run.halo.app.core.extension.content.Post;
-import run.halo.app.metrics.MeterUtils;
 
 @Getter
 public class PostStatsChangedEvent extends ApplicationEvent {
diff --git a/application/src/main/java/run/halo/app/theme/finders/impl/CommentPublicQueryServiceImpl.java b/application/src/main/java/run/halo/app/theme/finders/impl/CommentPublicQueryServiceImpl.java
index be5f9e91f1..c32cdcbc73 100644
--- a/application/src/main/java/run/halo/app/theme/finders/impl/CommentPublicQueryServiceImpl.java
+++ b/application/src/main/java/run/halo/app/theme/finders/impl/CommentPublicQueryServiceImpl.java
@@ -24,6 +24,8 @@
 import reactor.core.publisher.Flux;
 import reactor.core.publisher.Mono;
 import run.halo.app.content.comment.OwnerInfo;
+import run.halo.app.core.counter.CounterService;
+import run.halo.app.core.counter.MeterUtils;
 import run.halo.app.core.extension.User;
 import run.halo.app.core.extension.content.Comment;
 import run.halo.app.core.extension.content.Reply;
@@ -38,8 +40,6 @@
 import run.halo.app.extension.index.query.Query;
 import run.halo.app.extension.router.selector.FieldSelector;
 import run.halo.app.infra.AnonymousUserConst;
-import run.halo.app.metrics.CounterService;
-import run.halo.app.metrics.MeterUtils;
 import run.halo.app.theme.finders.CommentPublicQueryService;
 import run.halo.app.theme.finders.vo.CommentStatsVo;
 import run.halo.app.theme.finders.vo.CommentVo;
diff --git a/application/src/main/java/run/halo/app/theme/finders/impl/PostPublicQueryServiceImpl.java b/application/src/main/java/run/halo/app/theme/finders/impl/PostPublicQueryServiceImpl.java
index 201444d2cc..babe512a2f 100644
--- a/application/src/main/java/run/halo/app/theme/finders/impl/PostPublicQueryServiceImpl.java
+++ b/application/src/main/java/run/halo/app/theme/finders/impl/PostPublicQueryServiceImpl.java
@@ -11,13 +11,13 @@
 import reactor.core.publisher.Mono;
 import run.halo.app.content.ContentWrapper;
 import run.halo.app.content.PostService;
+import run.halo.app.core.counter.CounterService;
+import run.halo.app.core.counter.MeterUtils;
 import run.halo.app.core.extension.content.Post;
 import run.halo.app.extension.ListOptions;
 import run.halo.app.extension.ListResult;
 import run.halo.app.extension.PageRequest;
 import run.halo.app.extension.ReactiveExtensionClient;
-import run.halo.app.metrics.CounterService;
-import run.halo.app.metrics.MeterUtils;
 import run.halo.app.plugin.extensionpoint.ExtensionGetter;
 import run.halo.app.theme.ReactivePostContentHandler;
 import run.halo.app.theme.finders.CategoryFinder;
diff --git a/application/src/main/java/run/halo/app/theme/finders/impl/SinglePageConversionServiceImpl.java b/application/src/main/java/run/halo/app/theme/finders/impl/SinglePageConversionServiceImpl.java
index a7e497a097..23d485d432 100644
--- a/application/src/main/java/run/halo/app/theme/finders/impl/SinglePageConversionServiceImpl.java
+++ b/application/src/main/java/run/halo/app/theme/finders/impl/SinglePageConversionServiceImpl.java
@@ -19,14 +19,14 @@
 import reactor.core.publisher.Mono;
 import run.halo.app.content.ContentWrapper;
 import run.halo.app.content.SinglePageService;
+import run.halo.app.core.counter.CounterService;
+import run.halo.app.core.counter.MeterUtils;
 import run.halo.app.core.extension.content.SinglePage;
 import run.halo.app.extension.ListOptions;
 import run.halo.app.extension.ListResult;
 import run.halo.app.extension.PageRequest;
 import run.halo.app.extension.PageRequestImpl;
 import run.halo.app.extension.ReactiveExtensionClient;
-import run.halo.app.metrics.CounterService;
-import run.halo.app.metrics.MeterUtils;
 import run.halo.app.plugin.extensionpoint.ExtensionGetter;
 import run.halo.app.theme.ReactiveSinglePageContentHandler;
 import run.halo.app.theme.ReactiveSinglePageContentHandler.SinglePageContentContext;
diff --git a/application/src/test/java/run/halo/app/content/comment/CommentServiceImplTest.java b/application/src/test/java/run/halo/app/content/comment/CommentServiceImplTest.java
index f9a2f0bbb6..47a14342b9 100644
--- a/application/src/test/java/run/halo/app/content/comment/CommentServiceImplTest.java
+++ b/application/src/test/java/run/halo/app/content/comment/CommentServiceImplTest.java
@@ -29,6 +29,8 @@
 import reactor.core.publisher.Mono;
 import reactor.test.StepVerifier;
 import run.halo.app.content.TestPost;
+import run.halo.app.core.counter.CounterService;
+import run.halo.app.core.counter.MeterUtils;
 import run.halo.app.core.extension.Counter;
 import run.halo.app.core.extension.User;
 import run.halo.app.core.extension.content.Comment;
@@ -44,8 +46,6 @@
 import run.halo.app.infra.SystemConfigurableEnvironmentFetcher;
 import run.halo.app.infra.SystemSetting;
 import run.halo.app.infra.utils.JsonUtils;
-import run.halo.app.metrics.CounterService;
-import run.halo.app.metrics.MeterUtils;
 import run.halo.app.plugin.extensionpoint.ExtensionGetter;
 import run.halo.app.security.authorization.AuthorityUtils;
 
diff --git a/application/src/test/java/run/halo/app/metrics/MeterUtilsTest.java b/application/src/test/java/run/halo/app/core/counter/MeterUtilsTest.java
similarity index 99%
rename from application/src/test/java/run/halo/app/metrics/MeterUtilsTest.java
rename to application/src/test/java/run/halo/app/core/counter/MeterUtilsTest.java
index 8c83c68573..c7d5442720 100644
--- a/application/src/test/java/run/halo/app/metrics/MeterUtilsTest.java
+++ b/application/src/test/java/run/halo/app/core/counter/MeterUtilsTest.java
@@ -1,4 +1,4 @@
-package run.halo.app.metrics;
+package run.halo.app.core.counter;
 
 import static org.assertj.core.api.Assertions.assertThat;
 
diff --git a/application/src/test/java/run/halo/app/core/reconciler/SinglePageReconcilerTest.java b/application/src/test/java/run/halo/app/core/reconciler/SinglePageReconcilerTest.java
index 6b7ce7fbb9..8e2c7ac1df 100644
--- a/application/src/test/java/run/halo/app/core/reconciler/SinglePageReconcilerTest.java
+++ b/application/src/test/java/run/halo/app/core/reconciler/SinglePageReconcilerTest.java
@@ -30,16 +30,15 @@
 import run.halo.app.content.NotificationReasonConst;
 import run.halo.app.content.SinglePageService;
 import run.halo.app.content.TestPost;
+import run.halo.app.core.counter.CounterService;
 import run.halo.app.core.extension.content.Post;
 import run.halo.app.core.extension.content.SinglePage;
 import run.halo.app.core.extension.content.Snapshot;
 import run.halo.app.core.extension.notification.Subscription;
-import run.halo.app.core.reconciler.SinglePageReconciler;
 import run.halo.app.extension.ExtensionClient;
 import run.halo.app.extension.Metadata;
 import run.halo.app.extension.controller.Reconciler;
 import run.halo.app.infra.ExternalUrlSupplier;
-import run.halo.app.metrics.CounterService;
 import run.halo.app.notification.NotificationCenter;
 import run.halo.app.plugin.extensionpoint.ExtensionGetter;
 
diff --git a/application/src/test/java/run/halo/app/theme/finders/impl/CommentPublicQueryServiceImplTest.java b/application/src/test/java/run/halo/app/theme/finders/impl/CommentPublicQueryServiceImplTest.java
index 54fbf17eaa..a27a027059 100644
--- a/application/src/test/java/run/halo/app/theme/finders/impl/CommentPublicQueryServiceImplTest.java
+++ b/application/src/test/java/run/halo/app/theme/finders/impl/CommentPublicQueryServiceImplTest.java
@@ -20,6 +20,7 @@
 import org.skyscreamer.jsonassert.JSONAssert;
 import org.springframework.test.context.junit.jupiter.SpringExtension;
 import reactor.core.publisher.Mono;
+import run.halo.app.core.counter.CounterService;
 import run.halo.app.core.extension.Counter;
 import run.halo.app.core.extension.User;
 import run.halo.app.core.extension.content.Comment;
@@ -32,7 +33,6 @@
 import run.halo.app.extension.Ref;
 import run.halo.app.infra.AnonymousUserConst;
 import run.halo.app.infra.utils.JsonUtils;
-import run.halo.app.metrics.CounterService;
 
 /**
  * Tests for {@link CommentFinderImpl}.
diff --git a/application/src/test/java/run/halo/app/theme/finders/impl/PostFinderImplTest.java b/application/src/test/java/run/halo/app/theme/finders/impl/PostFinderImplTest.java
index b6d383cf1e..d119c2278e 100644
--- a/application/src/test/java/run/halo/app/theme/finders/impl/PostFinderImplTest.java
+++ b/application/src/test/java/run/halo/app/theme/finders/impl/PostFinderImplTest.java
@@ -19,12 +19,12 @@
 import org.springframework.data.domain.Sort;
 import reactor.core.publisher.Mono;
 import run.halo.app.content.PostService;
+import run.halo.app.core.counter.CounterService;
 import run.halo.app.core.extension.content.Post;
 import run.halo.app.extension.ListResult;
 import run.halo.app.extension.Metadata;
 import run.halo.app.extension.PageRequest;
 import run.halo.app.extension.ReactiveExtensionClient;
-import run.halo.app.metrics.CounterService;
 import run.halo.app.theme.finders.CategoryFinder;
 import run.halo.app.theme.finders.ContributorFinder;
 import run.halo.app.theme.finders.PostPublicQueryService;

From ca9adfc9d8937e160bcf6c0e51f2fadd4dbd8855 Mon Sep 17 00:00:00 2001
From: guqing <38999863+guqing@users.noreply.github.com>
Date: Sat, 28 Sep 2024 19:05:41 +0800
Subject: [PATCH 052/185] feat: add index build state as readiness check
 indicator (#6700)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?
/kind improvement
/area core
/milestone 2.20.x

#### What this PR does / why we need it:
将索引构建状态添加到就绪检测的指标中

#### Which issue(s) this PR fixes:
Fixes #6632

#### Does this PR introduce a user-facing change?
```release-note
将索引构建状态添加到就绪检测的指标中以优化就绪时访问出现索引不可用的问题
```
---
 .../ReactiveExtensionClientImpl.java          |  8 +++++++
 .../availability/IndexBuildState.java         |  8 +++++++
 .../IndexBuildStateHealthIndicator.java       | 22 +++++++++++++++++++
 3 files changed, 38 insertions(+)
 create mode 100644 application/src/main/java/run/halo/app/extension/availability/IndexBuildState.java
 create mode 100644 application/src/main/java/run/halo/app/extension/availability/IndexBuildStateHealthIndicator.java

diff --git a/application/src/main/java/run/halo/app/extension/ReactiveExtensionClientImpl.java b/application/src/main/java/run/halo/app/extension/ReactiveExtensionClientImpl.java
index 0962d64de2..38377c297e 100644
--- a/application/src/main/java/run/halo/app/extension/ReactiveExtensionClientImpl.java
+++ b/application/src/main/java/run/halo/app/extension/ReactiveExtensionClientImpl.java
@@ -19,6 +19,8 @@
 import lombok.NonNull;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
+import org.springframework.boot.availability.AvailabilityChangeEvent;
+import org.springframework.context.ApplicationEventPublisher;
 import org.springframework.context.event.ContextRefreshedEvent;
 import org.springframework.context.event.EventListener;
 import org.springframework.dao.DataIntegrityViolationException;
@@ -30,6 +32,7 @@
 import reactor.core.publisher.Flux;
 import reactor.core.publisher.Mono;
 import reactor.util.retry.Retry;
+import run.halo.app.extension.availability.IndexBuildState;
 import run.halo.app.extension.exception.ExtensionNotFoundException;
 import run.halo.app.extension.index.DefaultExtensionIterator;
 import run.halo.app.extension.index.ExtensionIterator;
@@ -443,6 +446,7 @@ class IndexBuildsManager {
         private final ExtensionConverter converter;
         private final ReactiveExtensionStoreClient client;
         private final SchemeWatcherManager schemeWatcherManager;
+        private final ApplicationEventPublisher eventPublisher;
 
         @NonNull
         private ExtensionIterator<Extension> createExtensionIterator(Scheme scheme) {
@@ -459,6 +463,8 @@ private ExtensionIterator<Extension> createExtensionIterator(Scheme scheme) {
 
         @EventListener(ContextRefreshedEvent.class)
         public void startBuildingIndex() {
+            AvailabilityChangeEvent.publish(eventPublisher, this, IndexBuildState.BUILDING);
+
             final long startTimeMs = System.currentTimeMillis();
             log.info("Start building index for all extensions, please wait...");
             schemeManager.schemes()
@@ -474,6 +480,8 @@ public void startBuildingIndex() {
                     indexerFactory.removeIndexer(scheme);
                 }
             });
+
+            AvailabilityChangeEvent.publish(eventPublisher, this, IndexBuildState.BUILT);
             log.info("Successfully built index in {}ms, Preparing to lunch application...",
                 System.currentTimeMillis() - startTimeMs);
         }
diff --git a/application/src/main/java/run/halo/app/extension/availability/IndexBuildState.java b/application/src/main/java/run/halo/app/extension/availability/IndexBuildState.java
new file mode 100644
index 0000000000..909d46bff8
--- /dev/null
+++ b/application/src/main/java/run/halo/app/extension/availability/IndexBuildState.java
@@ -0,0 +1,8 @@
+package run.halo.app.extension.availability;
+
+import org.springframework.boot.availability.AvailabilityState;
+
+public enum IndexBuildState implements AvailabilityState {
+    BUILDING,
+    BUILT;
+}
diff --git a/application/src/main/java/run/halo/app/extension/availability/IndexBuildStateHealthIndicator.java b/application/src/main/java/run/halo/app/extension/availability/IndexBuildStateHealthIndicator.java
new file mode 100644
index 0000000000..20c5a5dbca
--- /dev/null
+++ b/application/src/main/java/run/halo/app/extension/availability/IndexBuildStateHealthIndicator.java
@@ -0,0 +1,22 @@
+package run.halo.app.extension.availability;
+
+import org.springframework.boot.actuate.availability.AvailabilityStateHealthIndicator;
+import org.springframework.boot.actuate.health.Status;
+import org.springframework.boot.availability.ApplicationAvailability;
+import org.springframework.stereotype.Component;
+
+@Component
+public class IndexBuildStateHealthIndicator extends AvailabilityStateHealthIndicator {
+    /**
+     * Create a {@link IndexBuildStateHealthIndicator} instance by {@link ApplicationAvailability}.
+     * Mapping {@link IndexBuildState} to {@link Status}.
+     *
+     * @see IndexBuildState
+     */
+    public IndexBuildStateHealthIndicator(ApplicationAvailability availability) {
+        super(availability, IndexBuildState.class, (statusMappings) -> {
+            statusMappings.add(IndexBuildState.BUILT, Status.UP);
+            statusMappings.add(IndexBuildState.BUILDING, Status.OUT_OF_SERVICE);
+        });
+    }
+}

From f4e3c2503511109f53443282d6ccfc13b449c4f5 Mon Sep 17 00:00:00 2001
From: Ryan Wang <i@ryanc.cc>
Date: Sun, 29 Sep 2024 15:11:46 +0800
Subject: [PATCH 053/185] feat: remove the button for viewing passwords in the
 Edge browser (#6727)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/area core
/kind improvement
/milestone 2.20.x

#### What this PR does / why we need it:

移除在 Edge 浏览器中，为密码输入框添加显示密码明文按钮。

<img width="406" alt="image" src="https://github.com/user-attachments/assets/49801c25-d8dc-46db-9cba-302653af1951">

#### Does this PR introduce a user-facing change?

```release-note
None
```
---
 application/src/main/resources/static/styles/main.css | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/application/src/main/resources/static/styles/main.css b/application/src/main/resources/static/styles/main.css
index 9d062b0007..b449f94f93 100644
--- a/application/src/main/resources/static/styles/main.css
+++ b/application/src/main/resources/static/styles/main.css
@@ -408,3 +408,7 @@
         flex-direction: column;
     }
 }
+
+::-ms-reveal {
+    display: none;
+}
\ No newline at end of file

From 2c849d83614cd8d2276d3e85e1533034e5a68661 Mon Sep 17 00:00:00 2001
From: Ryan Wang <i@ryanc.cc>
Date: Sun, 29 Sep 2024 15:47:46 +0800
Subject: [PATCH 054/185] chore: regenerate api client for login-related
 (#6728)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/area core
/kind cleanup
/milestone 2.20.x

#### What this PR does / why we need it:

重新生成 OpenAPI 定义和 API Client，在 https://github.com/halo-dev/halo/pull/6488 中忘了重新生成。

#### Does this PR introduce a user-facing change?

```release-note
None
```
---
 api-docs/openapi/v3_0/aggregated.json         | 222 +--------
 .../v3_0/apis_console.api_v1alpha1.json       |  13 +
 .../v3_0/apis_extension.api_v1alpha1.json     |  13 +
 .../v3_0/apis_public.api_v1alpha1.json        | 298 ------------
 ui/packages/api-client/entry/api-client.ts    |   4 -
 .../api-client/src/.openapi-generator/FILES   |   7 -
 ui/packages/api-client/src/api.ts             |   2 -
 ui/packages/api-client/src/api/login-api.ts   | 128 -----
 .../src/api/user-v1alpha1-public-api.ts       | 438 ------------------
 .../src/models/auth-provider-spec.ts          |  26 ++
 ui/packages/api-client/src/models/index.ts    |   5 -
 .../models/password-reset-email-request.ts    |  36 --
 .../src/models/public-key-response.ts         |  30 --
 .../models/register-verify-email-request.ts   |  30 --
 .../src/models/reset-password-request.ts      |  36 --
 .../api-client/src/models/sign-up-request.ts  |  45 --
 16 files changed, 65 insertions(+), 1268 deletions(-)
 delete mode 100644 ui/packages/api-client/src/api/login-api.ts
 delete mode 100644 ui/packages/api-client/src/api/user-v1alpha1-public-api.ts
 delete mode 100644 ui/packages/api-client/src/models/password-reset-email-request.ts
 delete mode 100644 ui/packages/api-client/src/models/public-key-response.ts
 delete mode 100644 ui/packages/api-client/src/models/register-verify-email-request.ts
 delete mode 100644 ui/packages/api-client/src/models/reset-password-request.ts
 delete mode 100644 ui/packages/api-client/src/models/sign-up-request.ts

diff --git a/api-docs/openapi/v3_0/aggregated.json b/api-docs/openapi/v3_0/aggregated.json
index c113600923..bb1dc041a4 100644
--- a/api-docs/openapi/v3_0/aggregated.json
+++ b/api-docs/openapi/v3_0/aggregated.json
@@ -6512,123 +6512,6 @@
         ]
       }
     },
-    "/apis/api.halo.run/v1alpha1/users/-/send-password-reset-email": {
-      "post": {
-        "description": "Send password reset email when forgot password",
-        "operationId": "SendPasswordResetEmail",
-        "requestBody": {
-          "content": {
-            "*/*": {
-              "schema": {
-                "$ref": "#/components/schemas/PasswordResetEmailRequest"
-              }
-            }
-          },
-          "required": true
-        },
-        "responses": {
-          "204 NO_CONTENT": {
-            "content": {},
-            "description": "default response"
-          }
-        },
-        "tags": [
-          "UserV1alpha1Public"
-        ]
-      }
-    },
-    "/apis/api.halo.run/v1alpha1/users/-/send-register-verify-email": {
-      "post": {
-        "description": "Send registration verification email, which can be called when mustVerifyEmailOnRegistration in user settings is true",
-        "operationId": "SendRegisterVerifyEmail",
-        "requestBody": {
-          "content": {
-            "*/*": {
-              "schema": {
-                "$ref": "#/components/schemas/RegisterVerifyEmailRequest"
-              }
-            }
-          },
-          "required": true
-        },
-        "responses": {
-          "204 NO_CONTENT": {
-            "content": {},
-            "description": "default response"
-          }
-        },
-        "tags": [
-          "UserV1alpha1Public"
-        ]
-      }
-    },
-    "/apis/api.halo.run/v1alpha1/users/-/signup": {
-      "post": {
-        "description": "Sign up a new user",
-        "operationId": "SignUp",
-        "requestBody": {
-          "content": {
-            "*/*": {
-              "schema": {
-                "$ref": "#/components/schemas/SignUpRequest"
-              }
-            }
-          },
-          "required": true
-        },
-        "responses": {
-          "default": {
-            "content": {
-              "*/*": {
-                "schema": {
-                  "$ref": "#/components/schemas/User"
-                }
-              }
-            },
-            "description": "default response"
-          }
-        },
-        "tags": [
-          "UserV1alpha1Public"
-        ]
-      }
-    },
-    "/apis/api.halo.run/v1alpha1/users/{name}/reset-password": {
-      "put": {
-        "description": "Reset password by token",
-        "operationId": "ResetPasswordByToken",
-        "parameters": [
-          {
-            "description": "The name of the user",
-            "in": "path",
-            "name": "name",
-            "required": true,
-            "schema": {
-              "type": "string"
-            }
-          }
-        ],
-        "requestBody": {
-          "content": {
-            "*/*": {
-              "schema": {
-                "$ref": "#/components/schemas/ResetPasswordRequest"
-              }
-            }
-          },
-          "required": true
-        },
-        "responses": {
-          "204 NO_CONTENT": {
-            "content": {},
-            "description": "default response"
-          }
-        },
-        "tags": [
-          "UserV1alpha1Public"
-        ]
-      }
-    },
     "/apis/api.notification.halo.run/v1alpha1/notifiers/{name}/receiver-config": {
       "get": {
         "description": "Fetch receiver config of notifier",
@@ -15655,27 +15538,6 @@
           "PersonalAccessTokenV1alpha1Uc"
         ]
       }
-    },
-    "/login/public-key": {
-      "get": {
-        "description": "Read public key for encrypting password.",
-        "operationId": "GetPublicKey",
-        "responses": {
-          "default": {
-            "content": {
-              "*/*": {
-                "schema": {
-                  "$ref": "#/components/schemas/PublicKeyResponse"
-                }
-              }
-            },
-            "description": "default response"
-          }
-        },
-        "tags": [
-          "Login"
-        ]
-      }
     }
   },
   "components": {
@@ -16036,6 +15898,13 @@
         ],
         "type": "object",
         "properties": {
+          "authType": {
+            "type": "string",
+            "enum": [
+              "FORM",
+              "OAUTH2"
+            ]
+          },
           "authenticationUrl": {
             "type": "string",
             "description": "Authentication url of the auth provider"
@@ -16059,10 +15928,16 @@
           "logo": {
             "type": "string"
           },
+          "method": {
+            "type": "string"
+          },
           "priority": {
             "type": "integer",
             "format": "int32"
           },
+          "rememberMeSupport": {
+            "type": "boolean"
+          },
           "settingRef": {
             "$ref": "#/components/schemas/SettingRef"
           },
@@ -19844,21 +19719,6 @@
           }
         }
       },
-      "PasswordResetEmailRequest": {
-        "required": [
-          "email",
-          "username"
-        ],
-        "type": "object",
-        "properties": {
-          "email": {
-            "type": "string"
-          },
-          "username": {
-            "type": "string"
-          }
-        }
-      },
       "PatSpec": {
         "required": [
           "name",
@@ -20792,14 +20652,6 @@
           }
         }
       },
-      "PublicKeyResponse": {
-        "type": "object",
-        "properties": {
-          "base64Format": {
-            "type": "string"
-          }
-        }
-      },
       "Reason": {
         "required": [
           "apiVersion",
@@ -21184,17 +21036,6 @@
         },
         "description": "Extension reference object. The name is mandatory"
       },
-      "RegisterVerifyEmailRequest": {
-        "required": [
-          "email"
-        ],
-        "type": "object",
-        "properties": {
-          "email": {
-            "type": "string"
-          }
-        }
-      },
       "RememberMeToken": {
         "required": [
           "apiVersion",
@@ -21623,22 +21464,6 @@
           }
         }
       },
-      "ResetPasswordRequest": {
-        "required": [
-          "newPassword",
-          "token"
-        ],
-        "type": "object",
-        "properties": {
-          "newPassword": {
-            "minLength": 6,
-            "type": "string"
-          },
-          "token": {
-            "type": "string"
-          }
-        }
-      },
       "RestoreRequest": {
         "type": "object",
         "properties": {
@@ -22391,27 +22216,6 @@
           }
         }
       },
-      "SignUpRequest": {
-        "required": [
-          "password",
-          "user"
-        ],
-        "type": "object",
-        "properties": {
-          "password": {
-            "minLength": 6,
-            "type": "string"
-          },
-          "user": {
-            "$ref": "#/components/schemas/User"
-          },
-          "verifyCode": {
-            "maxLength": 6,
-            "minLength": 6,
-            "type": "string"
-          }
-        }
-      },
       "SinglePage": {
         "required": [
           "apiVersion",
diff --git a/api-docs/openapi/v3_0/apis_console.api_v1alpha1.json b/api-docs/openapi/v3_0/apis_console.api_v1alpha1.json
index 691189a058..8f2e91c2cb 100644
--- a/api-docs/openapi/v3_0/apis_console.api_v1alpha1.json
+++ b/api-docs/openapi/v3_0/apis_console.api_v1alpha1.json
@@ -3629,6 +3629,13 @@
         ],
         "type": "object",
         "properties": {
+          "authType": {
+            "type": "string",
+            "enum": [
+              "FORM",
+              "OAUTH2"
+            ]
+          },
           "authenticationUrl": {
             "type": "string",
             "description": "Authentication url of the auth provider"
@@ -3652,10 +3659,16 @@
           "logo": {
             "type": "string"
           },
+          "method": {
+            "type": "string"
+          },
           "priority": {
             "type": "integer",
             "format": "int32"
           },
+          "rememberMeSupport": {
+            "type": "boolean"
+          },
           "settingRef": {
             "$ref": "#/components/schemas/SettingRef"
           },
diff --git a/api-docs/openapi/v3_0/apis_extension.api_v1alpha1.json b/api-docs/openapi/v3_0/apis_extension.api_v1alpha1.json
index 342a5684a0..da95940039 100644
--- a/api-docs/openapi/v3_0/apis_extension.api_v1alpha1.json
+++ b/api-docs/openapi/v3_0/apis_extension.api_v1alpha1.json
@@ -8671,6 +8671,13 @@
         ],
         "type": "object",
         "properties": {
+          "authType": {
+            "type": "string",
+            "enum": [
+              "FORM",
+              "OAUTH2"
+            ]
+          },
           "authenticationUrl": {
             "type": "string",
             "description": "Authentication url of the auth provider"
@@ -8694,10 +8701,16 @@
           "logo": {
             "type": "string"
           },
+          "method": {
+            "type": "string"
+          },
           "priority": {
             "type": "integer",
             "format": "int32"
           },
+          "rememberMeSupport": {
+            "type": "boolean"
+          },
           "settingRef": {
             "$ref": "#/components/schemas/SettingRef"
           },
diff --git a/api-docs/openapi/v3_0/apis_public.api_v1alpha1.json b/api-docs/openapi/v3_0/apis_public.api_v1alpha1.json
index daa70428a1..2572b1c21b 100644
--- a/api-docs/openapi/v3_0/apis_public.api_v1alpha1.json
+++ b/api-docs/openapi/v3_0/apis_public.api_v1alpha1.json
@@ -506,123 +506,6 @@
           "MetricsV1alpha1Public"
         ]
       }
-    },
-    "/apis/api.halo.run/v1alpha1/users/-/send-password-reset-email": {
-      "post": {
-        "description": "Send password reset email when forgot password",
-        "operationId": "SendPasswordResetEmail",
-        "requestBody": {
-          "content": {
-            "*/*": {
-              "schema": {
-                "$ref": "#/components/schemas/PasswordResetEmailRequest"
-              }
-            }
-          },
-          "required": true
-        },
-        "responses": {
-          "204 NO_CONTENT": {
-            "content": {},
-            "description": "default response"
-          }
-        },
-        "tags": [
-          "UserV1alpha1Public"
-        ]
-      }
-    },
-    "/apis/api.halo.run/v1alpha1/users/-/send-register-verify-email": {
-      "post": {
-        "description": "Send registration verification email, which can be called when mustVerifyEmailOnRegistration in user settings is true",
-        "operationId": "SendRegisterVerifyEmail",
-        "requestBody": {
-          "content": {
-            "*/*": {
-              "schema": {
-                "$ref": "#/components/schemas/RegisterVerifyEmailRequest"
-              }
-            }
-          },
-          "required": true
-        },
-        "responses": {
-          "204 NO_CONTENT": {
-            "content": {},
-            "description": "default response"
-          }
-        },
-        "tags": [
-          "UserV1alpha1Public"
-        ]
-      }
-    },
-    "/apis/api.halo.run/v1alpha1/users/-/signup": {
-      "post": {
-        "description": "Sign up a new user",
-        "operationId": "SignUp",
-        "requestBody": {
-          "content": {
-            "*/*": {
-              "schema": {
-                "$ref": "#/components/schemas/SignUpRequest"
-              }
-            }
-          },
-          "required": true
-        },
-        "responses": {
-          "default": {
-            "content": {
-              "*/*": {
-                "schema": {
-                  "$ref": "#/components/schemas/User"
-                }
-              }
-            },
-            "description": "default response"
-          }
-        },
-        "tags": [
-          "UserV1alpha1Public"
-        ]
-      }
-    },
-    "/apis/api.halo.run/v1alpha1/users/{name}/reset-password": {
-      "put": {
-        "description": "Reset password by token",
-        "operationId": "ResetPasswordByToken",
-        "parameters": [
-          {
-            "description": "The name of the user",
-            "in": "path",
-            "name": "name",
-            "required": true,
-            "schema": {
-              "type": "string"
-            }
-          }
-        ],
-        "requestBody": {
-          "content": {
-            "*/*": {
-              "schema": {
-                "$ref": "#/components/schemas/ResetPasswordRequest"
-              }
-            }
-          },
-          "required": true
-        },
-        "responses": {
-          "204 NO_CONTENT": {
-            "content": {},
-            "description": "default response"
-          }
-        },
-        "tags": [
-          "UserV1alpha1Public"
-        ]
-      }
     }
   },
   "components": {
@@ -1244,33 +1127,6 @@
           }
         }
       },
-      "LoginHistory": {
-        "required": [
-          "loginAt",
-          "sourceIp",
-          "successful",
-          "userAgent"
-        ],
-        "type": "object",
-        "properties": {
-          "loginAt": {
-            "type": "string",
-            "format": "date-time"
-          },
-          "reason": {
-            "type": "string"
-          },
-          "sourceIp": {
-            "type": "string"
-          },
-          "successful": {
-            "type": "boolean"
-          },
-          "userAgent": {
-            "type": "string"
-          }
-        }
-      },
       "MenuItemSpec": {
         "type": "object",
         "properties": {
@@ -1488,21 +1344,6 @@
           }
         }
       },
-      "PasswordResetEmailRequest": {
-        "required": [
-          "email",
-          "username"
-        ],
-        "type": "object",
-        "properties": {
-          "email": {
-            "type": "string"
-          },
-          "username": {
-            "type": "string"
-          }
-        }
-      },
       "Ref": {
         "required": [
           "name"
@@ -1528,17 +1369,6 @@
         },
         "description": "Extension reference object. The name is mandatory"
       },
-      "RegisterVerifyEmailRequest": {
-        "required": [
-          "email"
-        ],
-        "type": "object",
-        "properties": {
-          "email": {
-            "type": "string"
-          }
-        }
-      },
       "RemoveOperation": {
         "required": [
           "op",
@@ -1800,22 +1630,6 @@
           }
         }
       },
-      "ResetPasswordRequest": {
-        "required": [
-          "newPassword",
-          "token"
-        ],
-        "type": "object",
-        "properties": {
-          "newPassword": {
-            "minLength": 6,
-            "type": "string"
-          },
-          "token": {
-            "type": "string"
-          }
-        }
-      },
       "SearchOption": {
         "required": [
           "keyword"
@@ -1904,27 +1718,6 @@
           }
         }
       },
-      "SignUpRequest": {
-        "required": [
-          "password",
-          "user"
-        ],
-        "type": "object",
-        "properties": {
-          "password": {
-            "minLength": 6,
-            "type": "string"
-          },
-          "user": {
-            "$ref": "#/components/schemas/User"
-          },
-          "verifyCode": {
-            "maxLength": 6,
-            "minLength": 6,
-            "type": "string"
-          }
-        }
-      },
       "SiteStatsVo": {
         "type": "object",
         "properties": {
@@ -1975,97 +1768,6 @@
           }
         }
       },
-      "User": {
-        "required": [
-          "apiVersion",
-          "kind",
-          "metadata",
-          "spec"
-        ],
-        "type": "object",
-        "properties": {
-          "apiVersion": {
-            "type": "string"
-          },
-          "kind": {
-            "type": "string"
-          },
-          "metadata": {
-            "$ref": "#/components/schemas/Metadata"
-          },
-          "spec": {
-            "$ref": "#/components/schemas/UserSpec"
-          },
-          "status": {
-            "$ref": "#/components/schemas/UserStatus"
-          }
-        }
-      },
-      "UserSpec": {
-        "required": [
-          "displayName",
-          "email"
-        ],
-        "type": "object",
-        "properties": {
-          "avatar": {
-            "type": "string"
-          },
-          "bio": {
-            "type": "string"
-          },
-          "disabled": {
-            "type": "boolean"
-          },
-          "displayName": {
-            "type": "string"
-          },
-          "email": {
-            "type": "string"
-          },
-          "emailVerified": {
-            "type": "boolean"
-          },
-          "loginHistoryLimit": {
-            "type": "integer",
-            "format": "int32"
-          },
-          "password": {
-            "type": "string"
-          },
-          "phone": {
-            "type": "string"
-          },
-          "registeredAt": {
-            "type": "string",
-            "format": "date-time"
-          },
-          "totpEncryptedSecret": {
-            "type": "string"
-          },
-          "twoFactorAuthEnabled": {
-            "type": "boolean"
-          }
-        }
-      },
-      "UserStatus": {
-        "type": "object",
-        "properties": {
-          "lastLoginAt": {
-            "type": "string",
-            "format": "date-time"
-          },
-          "loginHistories": {
-            "type": "array",
-            "items": {
-              "$ref": "#/components/schemas/LoginHistory"
-            }
-          },
-          "permalink": {
-            "type": "string"
-          }
-        }
-      },
       "VoteRequest": {
         "type": "object",
         "properties": {
diff --git a/ui/packages/api-client/entry/api-client.ts b/ui/packages/api-client/entry/api-client.ts
index 917a2bc0fd..4cae6d0436 100644
--- a/ui/packages/api-client/entry/api-client.ts
+++ b/ui/packages/api-client/entry/api-client.ts
@@ -19,7 +19,6 @@ import {
   ExtensionPointDefinitionV1alpha1Api,
   GroupV1alpha1Api,
   IndicesV1alpha1ConsoleApi,
-  LoginApi,
   MenuItemV1alpha1Api,
   MenuV1alpha1Api,
   MenuV1alpha1PublicApi,
@@ -66,7 +65,6 @@ import {
   UserConnectionV1alpha1Api,
   UserV1alpha1Api,
   UserV1alpha1ConsoleApi,
-  UserV1alpha1PublicApi,
 } from "../src";
 
 const defaultAxiosInstance = axios.create({
@@ -281,7 +279,6 @@ function createConsoleApiClient(axiosInstance: AxiosInstance) {
       baseURL,
       axiosInstance
     ),
-    login: new LoginApi(undefined, baseURL, axiosInstance),
     storage: {
       attachment: new AttachmentV1alpha1ConsoleApi(
         undefined,
@@ -431,7 +428,6 @@ function createPublicApiClient(axiosInstance: AxiosInstance) {
   return {
     menu: new MenuV1alpha1PublicApi(undefined, baseURL, axiosInstance),
     stats: new SystemV1alpha1PublicApi(undefined, baseURL, axiosInstance),
-    user: new UserV1alpha1PublicApi(undefined, baseURL, axiosInstance),
     content: {
       post: new PostV1alpha1PublicApi(undefined, baseURL, axiosInstance),
       comment: new CommentV1alpha1PublicApi(undefined, baseURL, axiosInstance),
diff --git a/ui/packages/api-client/src/.openapi-generator/FILES b/ui/packages/api-client/src/.openapi-generator/FILES
index ef20b505ae..fe7e5a16eb 100644
--- a/ui/packages/api-client/src/.openapi-generator/FILES
+++ b/ui/packages/api-client/src/.openapi-generator/FILES
@@ -25,7 +25,6 @@ api/group-v1alpha1-api.ts
 api/index-v1alpha1-public-api.ts
 api/indices-v1alpha1-console-api.ts
 api/local-thumbnail-v1alpha1-api.ts
-api/login-api.ts
 api/menu-item-v1alpha1-api.ts
 api/menu-v1alpha1-api.ts
 api/menu-v1alpha1-public-api.ts
@@ -79,7 +78,6 @@ api/two-factor-auth-v1alpha1-uc-api.ts
 api/user-connection-v1alpha1-api.ts
 api/user-v1alpha1-api.ts
 api/user-v1alpha1-console-api.ts
-api/user-v1alpha1-public-api.ts
 base.ts
 common.ts
 configuration.ts
@@ -217,7 +215,6 @@ models/notifier-info.ts
 models/notifier-setting-ref.ts
 models/owner-info.ts
 models/password-request.ts
-models/password-reset-email-request.ts
 models/pat-spec.ts
 models/personal-access-token-list.ts
 models/personal-access-token.ts
@@ -240,7 +237,6 @@ models/post-spec.ts
 models/post-status.ts
 models/post-vo.ts
 models/post.ts
-models/public-key-response.ts
 models/reason-attributes.ts
 models/reason-list.ts
 models/reason-property.ts
@@ -256,7 +252,6 @@ models/reason-type-spec.ts
 models/reason-type.ts
 models/reason.ts
 models/ref.ts
-models/register-verify-email-request.ts
 models/remember-me-token-list.ts
 models/remember-me-token-spec.ts
 models/remember-me-token.ts
@@ -269,7 +264,6 @@ models/reply-status.ts
 models/reply-vo-list.ts
 models/reply-vo.ts
 models/reply.ts
-models/reset-password-request.ts
 models/reverse-proxy-list.ts
 models/reverse-proxy-rule.ts
 models/reverse-proxy.ts
@@ -292,7 +286,6 @@ models/setting-list.ts
 models/setting-ref.ts
 models/setting-spec.ts
 models/setting.ts
-models/sign-up-request.ts
 models/single-page-list.ts
 models/single-page-request.ts
 models/single-page-spec.ts
diff --git a/ui/packages/api-client/src/api.ts b/ui/packages/api-client/src/api.ts
index 77ff213779..37b68fa218 100644
--- a/ui/packages/api-client/src/api.ts
+++ b/ui/packages/api-client/src/api.ts
@@ -37,7 +37,6 @@ export * from './api/group-v1alpha1-api';
 export * from './api/index-v1alpha1-public-api';
 export * from './api/indices-v1alpha1-console-api';
 export * from './api/local-thumbnail-v1alpha1-api';
-export * from './api/login-api';
 export * from './api/menu-item-v1alpha1-api';
 export * from './api/menu-v1alpha1-api';
 export * from './api/menu-v1alpha1-public-api';
@@ -91,5 +90,4 @@ export * from './api/two-factor-auth-v1alpha1-uc-api';
 export * from './api/user-connection-v1alpha1-api';
 export * from './api/user-v1alpha1-api';
 export * from './api/user-v1alpha1-console-api';
-export * from './api/user-v1alpha1-public-api';
 
diff --git a/ui/packages/api-client/src/api/login-api.ts b/ui/packages/api-client/src/api/login-api.ts
deleted file mode 100644
index ad409be6b9..0000000000
--- a/ui/packages/api-client/src/api/login-api.ts
+++ /dev/null
@@ -1,128 +0,0 @@
-/* tslint:disable */
-/* eslint-disable */
-/**
- * Halo
- * No description provided (generated by Openapi Generator https://github.com/openapitools/openapi-generator)
- *
- * The version of the OpenAPI document: 2.20.0-SNAPSHOT
- * 
- *
- * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
- * https://openapi-generator.tech
- * Do not edit the class manually.
- */
-
-
-import type { Configuration } from '../configuration';
-import type { AxiosPromise, AxiosInstance, RawAxiosRequestConfig } from 'axios';
-import globalAxios from 'axios';
-// Some imports not used depending on template conditions
-// @ts-ignore
-import { DUMMY_BASE_URL, assertParamExists, setApiKeyToObject, setBasicAuthToObject, setBearerAuthToObject, setOAuthToObject, setSearchParams, serializeDataIfNeeded, toPathString, createRequestFunction } from '../common';
-// @ts-ignore
-import { BASE_PATH, COLLECTION_FORMATS, RequestArgs, BaseAPI, RequiredError, operationServerMap } from '../base';
-// @ts-ignore
-import { PublicKeyResponse } from '../models';
-/**
- * LoginApi - axios parameter creator
- * @export
- */
-export const LoginApiAxiosParamCreator = function (configuration?: Configuration) {
-    return {
-        /**
-         * Read public key for encrypting password.
-         * @param {*} [options] Override http request option.
-         * @throws {RequiredError}
-         */
-        getPublicKey: async (options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
-            const localVarPath = `/login/public-key`;
-            // use dummy base URL string because the URL constructor only accepts absolute URLs.
-            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
-            let baseOptions;
-            if (configuration) {
-                baseOptions = configuration.baseOptions;
-            }
-
-            const localVarRequestOptions = { method: 'GET', ...baseOptions, ...options};
-            const localVarHeaderParameter = {} as any;
-            const localVarQueryParameter = {} as any;
-
-            // authentication basicAuth required
-            // http basic authentication required
-            setBasicAuthToObject(localVarRequestOptions, configuration)
-
-            // authentication bearerAuth required
-            // http bearer authentication required
-            await setBearerAuthToObject(localVarHeaderParameter, configuration)
-
-
-    
-            setSearchParams(localVarUrlObj, localVarQueryParameter);
-            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
-            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
-
-            return {
-                url: toPathString(localVarUrlObj),
-                options: localVarRequestOptions,
-            };
-        },
-    }
-};
-
-/**
- * LoginApi - functional programming interface
- * @export
- */
-export const LoginApiFp = function(configuration?: Configuration) {
-    const localVarAxiosParamCreator = LoginApiAxiosParamCreator(configuration)
-    return {
-        /**
-         * Read public key for encrypting password.
-         * @param {*} [options] Override http request option.
-         * @throws {RequiredError}
-         */
-        async getPublicKey(options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<PublicKeyResponse>> {
-            const localVarAxiosArgs = await localVarAxiosParamCreator.getPublicKey(options);
-            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
-            const localVarOperationServerBasePath = operationServerMap['LoginApi.getPublicKey']?.[localVarOperationServerIndex]?.url;
-            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
-        },
-    }
-};
-
-/**
- * LoginApi - factory interface
- * @export
- */
-export const LoginApiFactory = function (configuration?: Configuration, basePath?: string, axios?: AxiosInstance) {
-    const localVarFp = LoginApiFp(configuration)
-    return {
-        /**
-         * Read public key for encrypting password.
-         * @param {*} [options] Override http request option.
-         * @throws {RequiredError}
-         */
-        getPublicKey(options?: RawAxiosRequestConfig): AxiosPromise<PublicKeyResponse> {
-            return localVarFp.getPublicKey(options).then((request) => request(axios, basePath));
-        },
-    };
-};
-
-/**
- * LoginApi - object-oriented interface
- * @export
- * @class LoginApi
- * @extends {BaseAPI}
- */
-export class LoginApi extends BaseAPI {
-    /**
-     * Read public key for encrypting password.
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     * @memberof LoginApi
-     */
-    public getPublicKey(options?: RawAxiosRequestConfig) {
-        return LoginApiFp(this.configuration).getPublicKey(options).then((request) => request(this.axios, this.basePath));
-    }
-}
-
diff --git a/ui/packages/api-client/src/api/user-v1alpha1-public-api.ts b/ui/packages/api-client/src/api/user-v1alpha1-public-api.ts
deleted file mode 100644
index ed77275cd9..0000000000
--- a/ui/packages/api-client/src/api/user-v1alpha1-public-api.ts
+++ /dev/null
@@ -1,438 +0,0 @@
-/* tslint:disable */
-/* eslint-disable */
-/**
- * Halo
- * No description provided (generated by Openapi Generator https://github.com/openapitools/openapi-generator)
- *
- * The version of the OpenAPI document: 2.20.0-SNAPSHOT
- * 
- *
- * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
- * https://openapi-generator.tech
- * Do not edit the class manually.
- */
-
-
-import type { Configuration } from '../configuration';
-import type { AxiosPromise, AxiosInstance, RawAxiosRequestConfig } from 'axios';
-import globalAxios from 'axios';
-// Some imports not used depending on template conditions
-// @ts-ignore
-import { DUMMY_BASE_URL, assertParamExists, setApiKeyToObject, setBasicAuthToObject, setBearerAuthToObject, setOAuthToObject, setSearchParams, serializeDataIfNeeded, toPathString, createRequestFunction } from '../common';
-// @ts-ignore
-import { BASE_PATH, COLLECTION_FORMATS, RequestArgs, BaseAPI, RequiredError, operationServerMap } from '../base';
-// @ts-ignore
-import { PasswordResetEmailRequest } from '../models';
-// @ts-ignore
-import { RegisterVerifyEmailRequest } from '../models';
-// @ts-ignore
-import { ResetPasswordRequest } from '../models';
-// @ts-ignore
-import { SignUpRequest } from '../models';
-// @ts-ignore
-import { User } from '../models';
-/**
- * UserV1alpha1PublicApi - axios parameter creator
- * @export
- */
-export const UserV1alpha1PublicApiAxiosParamCreator = function (configuration?: Configuration) {
-    return {
-        /**
-         * Reset password by token
-         * @param {string} name The name of the user
-         * @param {ResetPasswordRequest} resetPasswordRequest 
-         * @param {*} [options] Override http request option.
-         * @throws {RequiredError}
-         */
-        resetPasswordByToken: async (name: string, resetPasswordRequest: ResetPasswordRequest, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
-            // verify required parameter 'name' is not null or undefined
-            assertParamExists('resetPasswordByToken', 'name', name)
-            // verify required parameter 'resetPasswordRequest' is not null or undefined
-            assertParamExists('resetPasswordByToken', 'resetPasswordRequest', resetPasswordRequest)
-            const localVarPath = `/apis/api.halo.run/v1alpha1/users/{name}/reset-password`
-                .replace(`{${"name"}}`, encodeURIComponent(String(name)));
-            // use dummy base URL string because the URL constructor only accepts absolute URLs.
-            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
-            let baseOptions;
-            if (configuration) {
-                baseOptions = configuration.baseOptions;
-            }
-
-            const localVarRequestOptions = { method: 'PUT', ...baseOptions, ...options};
-            const localVarHeaderParameter = {} as any;
-            const localVarQueryParameter = {} as any;
-
-            // authentication basicAuth required
-            // http basic authentication required
-            setBasicAuthToObject(localVarRequestOptions, configuration)
-
-            // authentication bearerAuth required
-            // http bearer authentication required
-            await setBearerAuthToObject(localVarHeaderParameter, configuration)
-
-
-    
-            localVarHeaderParameter['Content-Type'] = 'application/json';
-
-            setSearchParams(localVarUrlObj, localVarQueryParameter);
-            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
-            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
-            localVarRequestOptions.data = serializeDataIfNeeded(resetPasswordRequest, localVarRequestOptions, configuration)
-
-            return {
-                url: toPathString(localVarUrlObj),
-                options: localVarRequestOptions,
-            };
-        },
-        /**
-         * Send password reset email when forgot password
-         * @param {PasswordResetEmailRequest} passwordResetEmailRequest 
-         * @param {*} [options] Override http request option.
-         * @throws {RequiredError}
-         */
-        sendPasswordResetEmail: async (passwordResetEmailRequest: PasswordResetEmailRequest, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
-            // verify required parameter 'passwordResetEmailRequest' is not null or undefined
-            assertParamExists('sendPasswordResetEmail', 'passwordResetEmailRequest', passwordResetEmailRequest)
-            const localVarPath = `/apis/api.halo.run/v1alpha1/users/-/send-password-reset-email`;
-            // use dummy base URL string because the URL constructor only accepts absolute URLs.
-            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
-            let baseOptions;
-            if (configuration) {
-                baseOptions = configuration.baseOptions;
-            }
-
-            const localVarRequestOptions = { method: 'POST', ...baseOptions, ...options};
-            const localVarHeaderParameter = {} as any;
-            const localVarQueryParameter = {} as any;
-
-            // authentication basicAuth required
-            // http basic authentication required
-            setBasicAuthToObject(localVarRequestOptions, configuration)
-
-            // authentication bearerAuth required
-            // http bearer authentication required
-            await setBearerAuthToObject(localVarHeaderParameter, configuration)
-
-
-    
-            localVarHeaderParameter['Content-Type'] = 'application/json';
-
-            setSearchParams(localVarUrlObj, localVarQueryParameter);
-            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
-            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
-            localVarRequestOptions.data = serializeDataIfNeeded(passwordResetEmailRequest, localVarRequestOptions, configuration)
-
-            return {
-                url: toPathString(localVarUrlObj),
-                options: localVarRequestOptions,
-            };
-        },
-        /**
-         * Send registration verification email, which can be called when mustVerifyEmailOnRegistration in user settings is true
-         * @param {RegisterVerifyEmailRequest} registerVerifyEmailRequest 
-         * @param {*} [options] Override http request option.
-         * @throws {RequiredError}
-         */
-        sendRegisterVerifyEmail: async (registerVerifyEmailRequest: RegisterVerifyEmailRequest, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
-            // verify required parameter 'registerVerifyEmailRequest' is not null or undefined
-            assertParamExists('sendRegisterVerifyEmail', 'registerVerifyEmailRequest', registerVerifyEmailRequest)
-            const localVarPath = `/apis/api.halo.run/v1alpha1/users/-/send-register-verify-email`;
-            // use dummy base URL string because the URL constructor only accepts absolute URLs.
-            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
-            let baseOptions;
-            if (configuration) {
-                baseOptions = configuration.baseOptions;
-            }
-
-            const localVarRequestOptions = { method: 'POST', ...baseOptions, ...options};
-            const localVarHeaderParameter = {} as any;
-            const localVarQueryParameter = {} as any;
-
-            // authentication basicAuth required
-            // http basic authentication required
-            setBasicAuthToObject(localVarRequestOptions, configuration)
-
-            // authentication bearerAuth required
-            // http bearer authentication required
-            await setBearerAuthToObject(localVarHeaderParameter, configuration)
-
-
-    
-            localVarHeaderParameter['Content-Type'] = 'application/json';
-
-            setSearchParams(localVarUrlObj, localVarQueryParameter);
-            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
-            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
-            localVarRequestOptions.data = serializeDataIfNeeded(registerVerifyEmailRequest, localVarRequestOptions, configuration)
-
-            return {
-                url: toPathString(localVarUrlObj),
-                options: localVarRequestOptions,
-            };
-        },
-        /**
-         * Sign up a new user
-         * @param {SignUpRequest} signUpRequest 
-         * @param {*} [options] Override http request option.
-         * @throws {RequiredError}
-         */
-        signUp: async (signUpRequest: SignUpRequest, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
-            // verify required parameter 'signUpRequest' is not null or undefined
-            assertParamExists('signUp', 'signUpRequest', signUpRequest)
-            const localVarPath = `/apis/api.halo.run/v1alpha1/users/-/signup`;
-            // use dummy base URL string because the URL constructor only accepts absolute URLs.
-            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
-            let baseOptions;
-            if (configuration) {
-                baseOptions = configuration.baseOptions;
-            }
-
-            const localVarRequestOptions = { method: 'POST', ...baseOptions, ...options};
-            const localVarHeaderParameter = {} as any;
-            const localVarQueryParameter = {} as any;
-
-            // authentication basicAuth required
-            // http basic authentication required
-            setBasicAuthToObject(localVarRequestOptions, configuration)
-
-            // authentication bearerAuth required
-            // http bearer authentication required
-            await setBearerAuthToObject(localVarHeaderParameter, configuration)
-
-
-    
-            localVarHeaderParameter['Content-Type'] = 'application/json';
-
-            setSearchParams(localVarUrlObj, localVarQueryParameter);
-            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
-            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
-            localVarRequestOptions.data = serializeDataIfNeeded(signUpRequest, localVarRequestOptions, configuration)
-
-            return {
-                url: toPathString(localVarUrlObj),
-                options: localVarRequestOptions,
-            };
-        },
-    }
-};
-
-/**
- * UserV1alpha1PublicApi - functional programming interface
- * @export
- */
-export const UserV1alpha1PublicApiFp = function(configuration?: Configuration) {
-    const localVarAxiosParamCreator = UserV1alpha1PublicApiAxiosParamCreator(configuration)
-    return {
-        /**
-         * Reset password by token
-         * @param {string} name The name of the user
-         * @param {ResetPasswordRequest} resetPasswordRequest 
-         * @param {*} [options] Override http request option.
-         * @throws {RequiredError}
-         */
-        async resetPasswordByToken(name: string, resetPasswordRequest: ResetPasswordRequest, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<void>> {
-            const localVarAxiosArgs = await localVarAxiosParamCreator.resetPasswordByToken(name, resetPasswordRequest, options);
-            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
-            const localVarOperationServerBasePath = operationServerMap['UserV1alpha1PublicApi.resetPasswordByToken']?.[localVarOperationServerIndex]?.url;
-            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
-        },
-        /**
-         * Send password reset email when forgot password
-         * @param {PasswordResetEmailRequest} passwordResetEmailRequest 
-         * @param {*} [options] Override http request option.
-         * @throws {RequiredError}
-         */
-        async sendPasswordResetEmail(passwordResetEmailRequest: PasswordResetEmailRequest, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<void>> {
-            const localVarAxiosArgs = await localVarAxiosParamCreator.sendPasswordResetEmail(passwordResetEmailRequest, options);
-            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
-            const localVarOperationServerBasePath = operationServerMap['UserV1alpha1PublicApi.sendPasswordResetEmail']?.[localVarOperationServerIndex]?.url;
-            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
-        },
-        /**
-         * Send registration verification email, which can be called when mustVerifyEmailOnRegistration in user settings is true
-         * @param {RegisterVerifyEmailRequest} registerVerifyEmailRequest 
-         * @param {*} [options] Override http request option.
-         * @throws {RequiredError}
-         */
-        async sendRegisterVerifyEmail(registerVerifyEmailRequest: RegisterVerifyEmailRequest, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<void>> {
-            const localVarAxiosArgs = await localVarAxiosParamCreator.sendRegisterVerifyEmail(registerVerifyEmailRequest, options);
-            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
-            const localVarOperationServerBasePath = operationServerMap['UserV1alpha1PublicApi.sendRegisterVerifyEmail']?.[localVarOperationServerIndex]?.url;
-            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
-        },
-        /**
-         * Sign up a new user
-         * @param {SignUpRequest} signUpRequest 
-         * @param {*} [options] Override http request option.
-         * @throws {RequiredError}
-         */
-        async signUp(signUpRequest: SignUpRequest, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<User>> {
-            const localVarAxiosArgs = await localVarAxiosParamCreator.signUp(signUpRequest, options);
-            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
-            const localVarOperationServerBasePath = operationServerMap['UserV1alpha1PublicApi.signUp']?.[localVarOperationServerIndex]?.url;
-            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
-        },
-    }
-};
-
-/**
- * UserV1alpha1PublicApi - factory interface
- * @export
- */
-export const UserV1alpha1PublicApiFactory = function (configuration?: Configuration, basePath?: string, axios?: AxiosInstance) {
-    const localVarFp = UserV1alpha1PublicApiFp(configuration)
-    return {
-        /**
-         * Reset password by token
-         * @param {UserV1alpha1PublicApiResetPasswordByTokenRequest} requestParameters Request parameters.
-         * @param {*} [options] Override http request option.
-         * @throws {RequiredError}
-         */
-        resetPasswordByToken(requestParameters: UserV1alpha1PublicApiResetPasswordByTokenRequest, options?: RawAxiosRequestConfig): AxiosPromise<void> {
-            return localVarFp.resetPasswordByToken(requestParameters.name, requestParameters.resetPasswordRequest, options).then((request) => request(axios, basePath));
-        },
-        /**
-         * Send password reset email when forgot password
-         * @param {UserV1alpha1PublicApiSendPasswordResetEmailRequest} requestParameters Request parameters.
-         * @param {*} [options] Override http request option.
-         * @throws {RequiredError}
-         */
-        sendPasswordResetEmail(requestParameters: UserV1alpha1PublicApiSendPasswordResetEmailRequest, options?: RawAxiosRequestConfig): AxiosPromise<void> {
-            return localVarFp.sendPasswordResetEmail(requestParameters.passwordResetEmailRequest, options).then((request) => request(axios, basePath));
-        },
-        /**
-         * Send registration verification email, which can be called when mustVerifyEmailOnRegistration in user settings is true
-         * @param {UserV1alpha1PublicApiSendRegisterVerifyEmailRequest} requestParameters Request parameters.
-         * @param {*} [options] Override http request option.
-         * @throws {RequiredError}
-         */
-        sendRegisterVerifyEmail(requestParameters: UserV1alpha1PublicApiSendRegisterVerifyEmailRequest, options?: RawAxiosRequestConfig): AxiosPromise<void> {
-            return localVarFp.sendRegisterVerifyEmail(requestParameters.registerVerifyEmailRequest, options).then((request) => request(axios, basePath));
-        },
-        /**
-         * Sign up a new user
-         * @param {UserV1alpha1PublicApiSignUpRequest} requestParameters Request parameters.
-         * @param {*} [options] Override http request option.
-         * @throws {RequiredError}
-         */
-        signUp(requestParameters: UserV1alpha1PublicApiSignUpRequest, options?: RawAxiosRequestConfig): AxiosPromise<User> {
-            return localVarFp.signUp(requestParameters.signUpRequest, options).then((request) => request(axios, basePath));
-        },
-    };
-};
-
-/**
- * Request parameters for resetPasswordByToken operation in UserV1alpha1PublicApi.
- * @export
- * @interface UserV1alpha1PublicApiResetPasswordByTokenRequest
- */
-export interface UserV1alpha1PublicApiResetPasswordByTokenRequest {
-    /**
-     * The name of the user
-     * @type {string}
-     * @memberof UserV1alpha1PublicApiResetPasswordByToken
-     */
-    readonly name: string
-
-    /**
-     * 
-     * @type {ResetPasswordRequest}
-     * @memberof UserV1alpha1PublicApiResetPasswordByToken
-     */
-    readonly resetPasswordRequest: ResetPasswordRequest
-}
-
-/**
- * Request parameters for sendPasswordResetEmail operation in UserV1alpha1PublicApi.
- * @export
- * @interface UserV1alpha1PublicApiSendPasswordResetEmailRequest
- */
-export interface UserV1alpha1PublicApiSendPasswordResetEmailRequest {
-    /**
-     * 
-     * @type {PasswordResetEmailRequest}
-     * @memberof UserV1alpha1PublicApiSendPasswordResetEmail
-     */
-    readonly passwordResetEmailRequest: PasswordResetEmailRequest
-}
-
-/**
- * Request parameters for sendRegisterVerifyEmail operation in UserV1alpha1PublicApi.
- * @export
- * @interface UserV1alpha1PublicApiSendRegisterVerifyEmailRequest
- */
-export interface UserV1alpha1PublicApiSendRegisterVerifyEmailRequest {
-    /**
-     * 
-     * @type {RegisterVerifyEmailRequest}
-     * @memberof UserV1alpha1PublicApiSendRegisterVerifyEmail
-     */
-    readonly registerVerifyEmailRequest: RegisterVerifyEmailRequest
-}
-
-/**
- * Request parameters for signUp operation in UserV1alpha1PublicApi.
- * @export
- * @interface UserV1alpha1PublicApiSignUpRequest
- */
-export interface UserV1alpha1PublicApiSignUpRequest {
-    /**
-     * 
-     * @type {SignUpRequest}
-     * @memberof UserV1alpha1PublicApiSignUp
-     */
-    readonly signUpRequest: SignUpRequest
-}
-
-/**
- * UserV1alpha1PublicApi - object-oriented interface
- * @export
- * @class UserV1alpha1PublicApi
- * @extends {BaseAPI}
- */
-export class UserV1alpha1PublicApi extends BaseAPI {
-    /**
-     * Reset password by token
-     * @param {UserV1alpha1PublicApiResetPasswordByTokenRequest} requestParameters Request parameters.
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     * @memberof UserV1alpha1PublicApi
-     */
-    public resetPasswordByToken(requestParameters: UserV1alpha1PublicApiResetPasswordByTokenRequest, options?: RawAxiosRequestConfig) {
-        return UserV1alpha1PublicApiFp(this.configuration).resetPasswordByToken(requestParameters.name, requestParameters.resetPasswordRequest, options).then((request) => request(this.axios, this.basePath));
-    }
-
-    /**
-     * Send password reset email when forgot password
-     * @param {UserV1alpha1PublicApiSendPasswordResetEmailRequest} requestParameters Request parameters.
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     * @memberof UserV1alpha1PublicApi
-     */
-    public sendPasswordResetEmail(requestParameters: UserV1alpha1PublicApiSendPasswordResetEmailRequest, options?: RawAxiosRequestConfig) {
-        return UserV1alpha1PublicApiFp(this.configuration).sendPasswordResetEmail(requestParameters.passwordResetEmailRequest, options).then((request) => request(this.axios, this.basePath));
-    }
-
-    /**
-     * Send registration verification email, which can be called when mustVerifyEmailOnRegistration in user settings is true
-     * @param {UserV1alpha1PublicApiSendRegisterVerifyEmailRequest} requestParameters Request parameters.
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     * @memberof UserV1alpha1PublicApi
-     */
-    public sendRegisterVerifyEmail(requestParameters: UserV1alpha1PublicApiSendRegisterVerifyEmailRequest, options?: RawAxiosRequestConfig) {
-        return UserV1alpha1PublicApiFp(this.configuration).sendRegisterVerifyEmail(requestParameters.registerVerifyEmailRequest, options).then((request) => request(this.axios, this.basePath));
-    }
-
-    /**
-     * Sign up a new user
-     * @param {UserV1alpha1PublicApiSignUpRequest} requestParameters Request parameters.
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     * @memberof UserV1alpha1PublicApi
-     */
-    public signUp(requestParameters: UserV1alpha1PublicApiSignUpRequest, options?: RawAxiosRequestConfig) {
-        return UserV1alpha1PublicApiFp(this.configuration).signUp(requestParameters.signUpRequest, options).then((request) => request(this.axios, this.basePath));
-    }
-}
-
diff --git a/ui/packages/api-client/src/models/auth-provider-spec.ts b/ui/packages/api-client/src/models/auth-provider-spec.ts
index 0da332c6f3..7933629f01 100644
--- a/ui/packages/api-client/src/models/auth-provider-spec.ts
+++ b/ui/packages/api-client/src/models/auth-provider-spec.ts
@@ -26,6 +26,12 @@ import { SettingRef } from './setting-ref';
  * @interface AuthProviderSpec
  */
 export interface AuthProviderSpec {
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthProviderSpec
+     */
+    'authType'?: AuthProviderSpecAuthTypeEnum;
     /**
      * Authentication url of the auth provider
      * @type {string}
@@ -68,12 +74,24 @@ export interface AuthProviderSpec {
      * @memberof AuthProviderSpec
      */
     'logo'?: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthProviderSpec
+     */
+    'method'?: string;
     /**
      * 
      * @type {number}
      * @memberof AuthProviderSpec
      */
     'priority'?: number;
+    /**
+     * 
+     * @type {boolean}
+     * @memberof AuthProviderSpec
+     */
+    'rememberMeSupport'?: boolean;
     /**
      * 
      * @type {SettingRef}
@@ -94,3 +112,11 @@ export interface AuthProviderSpec {
     'website'?: string;
 }
 
+export const AuthProviderSpecAuthTypeEnum = {
+    Form: 'FORM',
+    Oauth2: 'OAUTH2'
+} as const;
+
+export type AuthProviderSpecAuthTypeEnum = typeof AuthProviderSpecAuthTypeEnum[keyof typeof AuthProviderSpecAuthTypeEnum];
+
+
diff --git a/ui/packages/api-client/src/models/index.ts b/ui/packages/api-client/src/models/index.ts
index d6c4372ece..cd721814af 100644
--- a/ui/packages/api-client/src/models/index.ts
+++ b/ui/packages/api-client/src/models/index.ts
@@ -129,7 +129,6 @@ export * from './notifier-info';
 export * from './notifier-setting-ref';
 export * from './owner-info';
 export * from './password-request';
-export * from './password-reset-email-request';
 export * from './pat-spec';
 export * from './personal-access-token';
 export * from './personal-access-token-list';
@@ -152,7 +151,6 @@ export * from './post-request';
 export * from './post-spec';
 export * from './post-status';
 export * from './post-vo';
-export * from './public-key-response';
 export * from './reason';
 export * from './reason-attributes';
 export * from './reason-list';
@@ -168,7 +166,6 @@ export * from './reason-type-notifier-matrix';
 export * from './reason-type-notifier-request';
 export * from './reason-type-spec';
 export * from './ref';
-export * from './register-verify-email-request';
 export * from './remember-me-token';
 export * from './remember-me-token-list';
 export * from './remember-me-token-spec';
@@ -181,7 +178,6 @@ export * from './reply-spec';
 export * from './reply-status';
 export * from './reply-vo';
 export * from './reply-vo-list';
-export * from './reset-password-request';
 export * from './reverse-proxy';
 export * from './reverse-proxy-list';
 export * from './reverse-proxy-rule';
@@ -204,7 +200,6 @@ export * from './setting-form';
 export * from './setting-list';
 export * from './setting-ref';
 export * from './setting-spec';
-export * from './sign-up-request';
 export * from './single-page';
 export * from './single-page-list';
 export * from './single-page-request';
diff --git a/ui/packages/api-client/src/models/password-reset-email-request.ts b/ui/packages/api-client/src/models/password-reset-email-request.ts
deleted file mode 100644
index d6aedbe246..0000000000
--- a/ui/packages/api-client/src/models/password-reset-email-request.ts
+++ /dev/null
@@ -1,36 +0,0 @@
-/* tslint:disable */
-/* eslint-disable */
-/**
- * Halo
- * No description provided (generated by Openapi Generator https://github.com/openapitools/openapi-generator)
- *
- * The version of the OpenAPI document: 2.20.0-SNAPSHOT
- * 
- *
- * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
- * https://openapi-generator.tech
- * Do not edit the class manually.
- */
-
-
-
-/**
- * 
- * @export
- * @interface PasswordResetEmailRequest
- */
-export interface PasswordResetEmailRequest {
-    /**
-     * 
-     * @type {string}
-     * @memberof PasswordResetEmailRequest
-     */
-    'email': string;
-    /**
-     * 
-     * @type {string}
-     * @memberof PasswordResetEmailRequest
-     */
-    'username': string;
-}
-
diff --git a/ui/packages/api-client/src/models/public-key-response.ts b/ui/packages/api-client/src/models/public-key-response.ts
deleted file mode 100644
index 1829449314..0000000000
--- a/ui/packages/api-client/src/models/public-key-response.ts
+++ /dev/null
@@ -1,30 +0,0 @@
-/* tslint:disable */
-/* eslint-disable */
-/**
- * Halo
- * No description provided (generated by Openapi Generator https://github.com/openapitools/openapi-generator)
- *
- * The version of the OpenAPI document: 2.20.0-SNAPSHOT
- * 
- *
- * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
- * https://openapi-generator.tech
- * Do not edit the class manually.
- */
-
-
-
-/**
- * 
- * @export
- * @interface PublicKeyResponse
- */
-export interface PublicKeyResponse {
-    /**
-     * 
-     * @type {string}
-     * @memberof PublicKeyResponse
-     */
-    'base64Format'?: string;
-}
-
diff --git a/ui/packages/api-client/src/models/register-verify-email-request.ts b/ui/packages/api-client/src/models/register-verify-email-request.ts
deleted file mode 100644
index 19f4e0ff20..0000000000
--- a/ui/packages/api-client/src/models/register-verify-email-request.ts
+++ /dev/null
@@ -1,30 +0,0 @@
-/* tslint:disable */
-/* eslint-disable */
-/**
- * Halo
- * No description provided (generated by Openapi Generator https://github.com/openapitools/openapi-generator)
- *
- * The version of the OpenAPI document: 2.20.0-SNAPSHOT
- * 
- *
- * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
- * https://openapi-generator.tech
- * Do not edit the class manually.
- */
-
-
-
-/**
- * 
- * @export
- * @interface RegisterVerifyEmailRequest
- */
-export interface RegisterVerifyEmailRequest {
-    /**
-     * 
-     * @type {string}
-     * @memberof RegisterVerifyEmailRequest
-     */
-    'email': string;
-}
-
diff --git a/ui/packages/api-client/src/models/reset-password-request.ts b/ui/packages/api-client/src/models/reset-password-request.ts
deleted file mode 100644
index ebe725ef6f..0000000000
--- a/ui/packages/api-client/src/models/reset-password-request.ts
+++ /dev/null
@@ -1,36 +0,0 @@
-/* tslint:disable */
-/* eslint-disable */
-/**
- * Halo
- * No description provided (generated by Openapi Generator https://github.com/openapitools/openapi-generator)
- *
- * The version of the OpenAPI document: 2.20.0-SNAPSHOT
- * 
- *
- * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
- * https://openapi-generator.tech
- * Do not edit the class manually.
- */
-
-
-
-/**
- * 
- * @export
- * @interface ResetPasswordRequest
- */
-export interface ResetPasswordRequest {
-    /**
-     * 
-     * @type {string}
-     * @memberof ResetPasswordRequest
-     */
-    'newPassword': string;
-    /**
-     * 
-     * @type {string}
-     * @memberof ResetPasswordRequest
-     */
-    'token': string;
-}
-
diff --git a/ui/packages/api-client/src/models/sign-up-request.ts b/ui/packages/api-client/src/models/sign-up-request.ts
deleted file mode 100644
index 6db669e86a..0000000000
--- a/ui/packages/api-client/src/models/sign-up-request.ts
+++ /dev/null
@@ -1,45 +0,0 @@
-/* tslint:disable */
-/* eslint-disable */
-/**
- * Halo
- * No description provided (generated by Openapi Generator https://github.com/openapitools/openapi-generator)
- *
- * The version of the OpenAPI document: 2.20.0-SNAPSHOT
- * 
- *
- * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
- * https://openapi-generator.tech
- * Do not edit the class manually.
- */
-
-
-// May contain unused imports in some cases
-// @ts-ignore
-import { User } from './user';
-
-/**
- * 
- * @export
- * @interface SignUpRequest
- */
-export interface SignUpRequest {
-    /**
-     * 
-     * @type {string}
-     * @memberof SignUpRequest
-     */
-    'password': string;
-    /**
-     * 
-     * @type {User}
-     * @memberof SignUpRequest
-     */
-    'user': User;
-    /**
-     * 
-     * @type {string}
-     * @memberof SignUpRequest
-     */
-    'verifyCode'?: string;
-}
-

From 1947a544f2597ea62011db9572d6c5273f9e921d Mon Sep 17 00:00:00 2001
From: Ryan Wang <i@ryanc.cc>
Date: Sun, 29 Sep 2024 16:15:46 +0800
Subject: [PATCH 055/185] feat: refine i18n resources for login-related page
 (#6726)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/area core
/kind improvement
/milestone 2.20.x

#### What this PR does / why we need it:

完善新登录相关页面的多语言资源文件。

#### Which issue(s) this PR fixes:

Fixes https://github.com/halo-dev/halo/issues/6721

#### Does this PR introduce a user-facing change?

```release-note
None
```
---
 .../src/main/resources/static/js/main.js      |   5 +-
 .../challenges/two-factor/totp.properties     |   2 +-
 .../challenges/two-factor/totp_es.properties  |   4 +
 .../two-factor/totp_zh_TW.properties          |   4 +
 .../gateway_modules/common_fragments.html     |  16 +-
 .../common_fragments.properties               |   4 +-
 .../common_fragments_en.properties            |   4 +-
 .../common_fragments_es.properties            |   3 +
 .../common_fragments_zh_TW.properties         |   3 +
 .../login_fragments_en.properties             |   2 +-
 .../login_fragments_es.properties             |  13 +
 .../login_fragments_zh_TW.properties          |  13 +
 .../resources/templates/login_es.properties   |   1 +
 .../templates/login_local_es.properties       |   3 +
 .../templates/login_local_zh_TW.properties    |   3 +
 .../templates/login_zh_TW.properties          |   1 +
 .../resources/templates/logout_es.properties  |   3 +
 .../templates/logout_zh_TW.properties         |   3 +
 .../templates/password-reset-link.html        |   4 +-
 .../password-reset-link_es.properties         |   5 +
 .../password-reset-link_zh_TW.properties      |   5 +
 .../resources/templates/password-reset.html   |   4 +-
 .../templates/password-reset_es.properties    |   6 +
 .../templates/password-reset_zh_TW.properties |   6 +
 .../src/main/resources/templates/signup.html  | 284 +++++++++---------
 .../resources/templates/signup.properties     |   3 +-
 .../resources/templates/signup_en.properties  |  15 +-
 .../resources/templates/signup_es.properties  |  14 +
 .../templates/signup_zh_TW.properties         |  14 +
 29 files changed, 289 insertions(+), 158 deletions(-)
 create mode 100644 application/src/main/resources/templates/challenges/two-factor/totp_es.properties
 create mode 100644 application/src/main/resources/templates/challenges/two-factor/totp_zh_TW.properties
 create mode 100644 application/src/main/resources/templates/gateway_modules/common_fragments_es.properties
 create mode 100644 application/src/main/resources/templates/gateway_modules/common_fragments_zh_TW.properties
 create mode 100644 application/src/main/resources/templates/gateway_modules/login_fragments_es.properties
 create mode 100644 application/src/main/resources/templates/gateway_modules/login_fragments_zh_TW.properties
 create mode 100644 application/src/main/resources/templates/login_es.properties
 create mode 100644 application/src/main/resources/templates/login_local_es.properties
 create mode 100644 application/src/main/resources/templates/login_local_zh_TW.properties
 create mode 100644 application/src/main/resources/templates/login_zh_TW.properties
 create mode 100644 application/src/main/resources/templates/logout_es.properties
 create mode 100644 application/src/main/resources/templates/logout_zh_TW.properties
 create mode 100644 application/src/main/resources/templates/password-reset-link_es.properties
 create mode 100644 application/src/main/resources/templates/password-reset-link_zh_TW.properties
 create mode 100644 application/src/main/resources/templates/password-reset_es.properties
 create mode 100644 application/src/main/resources/templates/password-reset_zh_TW.properties
 create mode 100644 application/src/main/resources/templates/signup_es.properties
 create mode 100644 application/src/main/resources/templates/signup_zh_TW.properties

diff --git a/application/src/main/resources/static/js/main.js b/application/src/main/resources/static/js/main.js
index 2db2e606b1..727b25abf4 100644
--- a/application/src/main/resources/static/js/main.js
+++ b/application/src/main/resources/static/js/main.js
@@ -96,14 +96,14 @@ function sendVerificationCode(button, sendRequest) {
         sendRequest()
             .then(() => {
                 startCountdown();
-                Toast.success("发送成功");
+                Toast.success(i18nResources.sendVerificationCodeSuccess);
             })
             .catch((e) => {
                 button.disabled = false;
                 if (e instanceof Error) {
                     Toast.error(e.message);
                 } else {
-                    Toast.error("发送失败，请稍后再试");
+                    Toast.error(i18nResources.sendVerificationCodeFailed);
                 }
             });
     });
@@ -151,4 +151,3 @@ document.addEventListener("DOMContentLoaded", () => {
         }
     });
 });
-
diff --git a/application/src/main/resources/templates/challenges/two-factor/totp.properties b/application/src/main/resources/templates/challenges/two-factor/totp.properties
index 46f96ed978..dfea51a906 100644
--- a/application/src/main/resources/templates/challenges/two-factor/totp.properties
+++ b/application/src/main/resources/templates/challenges/two-factor/totp.properties
@@ -1,4 +1,4 @@
 title=两步验证
 messages.invalidError=错误的验证码
 form.code.label=验证码
-form.submit=验证
+form.submit=验证
\ No newline at end of file
diff --git a/application/src/main/resources/templates/challenges/two-factor/totp_es.properties b/application/src/main/resources/templates/challenges/two-factor/totp_es.properties
new file mode 100644
index 0000000000..43e5e25e1c
--- /dev/null
+++ b/application/src/main/resources/templates/challenges/two-factor/totp_es.properties
@@ -0,0 +1,4 @@
+title=Autenticación en Dos Pasos
+messages.invalidError=Código de verificación incorrecto
+form.code.label=Código de Verificación
+form.submit=Verificar
\ No newline at end of file
diff --git a/application/src/main/resources/templates/challenges/two-factor/totp_zh_TW.properties b/application/src/main/resources/templates/challenges/two-factor/totp_zh_TW.properties
new file mode 100644
index 0000000000..a2be3bc9c4
--- /dev/null
+++ b/application/src/main/resources/templates/challenges/two-factor/totp_zh_TW.properties
@@ -0,0 +1,4 @@
+title=兩步驗證
+messages.invalidError=錯誤的驗證碼
+form.code.label=驗證碼
+form.submit=驗證
diff --git a/application/src/main/resources/templates/gateway_modules/common_fragments.html b/application/src/main/resources/templates/gateway_modules/common_fragments.html
index 75d718ca33..dc5df4b1bb 100644
--- a/application/src/main/resources/templates/gateway_modules/common_fragments.html
+++ b/application/src/main/resources/templates/gateway_modules/common_fragments.html
@@ -1,13 +1,14 @@
 <th:block th:fragment="basicStaticResources">
+    <link rel="stylesheet" href="/webjars/normalize.css/8.0.1/normalize.css" />
+    <link rel="stylesheet" th:href="|/styles/main.css?v=${site.version}|" />
+
     <script th:inline="javascript">
-        const resources = {
-            title: `[(#{title})]`,
+        const i18nResources = {
+            sendVerificationCodeSuccess: `[(#{js.sendVerificationCode.success})]`,
+            sendVerificationCodeFailed: `[(#{js.sendVerificationCode.failed})]`,
         };
     </script>
 
-    <link rel="stylesheet" href="/webjars/normalize.css/8.0.1/normalize.css" />
-    <link rel="stylesheet" th:href="|/styles/main.css?v=${site.version}|" />
-
     <script src="/js/main.js"></script>
 </th:block>
 
@@ -67,7 +68,10 @@
                 const selectedLanguage = document.getElementById("language-select").value;
                 const currentURL = new URL(window.location.href);
                 currentURL.searchParams.set("language", selectedLanguage);
-                window.location.href = currentURL.toString();
+
+                history.replaceState(null, "", currentURL.toString());
+
+                window.location.reload();
             }
         </script>
     </div>
diff --git a/application/src/main/resources/templates/gateway_modules/common_fragments.properties b/application/src/main/resources/templates/gateway_modules/common_fragments.properties
index 6617dd0d7b..f079f83e50 100644
--- a/application/src/main/resources/templates/gateway_modules/common_fragments.properties
+++ b/application/src/main/resources/templates/gateway_modules/common_fragments.properties
@@ -1 +1,3 @@
-socialLogin.label=社交登录
\ No newline at end of file
+socialLogin.label=社交登录
+js.sendVerificationCode.success=发送成功
+js.sendVerificationCode.failed=发送失败，请稍后再试
\ No newline at end of file
diff --git a/application/src/main/resources/templates/gateway_modules/common_fragments_en.properties b/application/src/main/resources/templates/gateway_modules/common_fragments_en.properties
index a10abbb87c..cb299c93a5 100644
--- a/application/src/main/resources/templates/gateway_modules/common_fragments_en.properties
+++ b/application/src/main/resources/templates/gateway_modules/common_fragments_en.properties
@@ -1 +1,3 @@
-socialLogin.label=Social Login
\ No newline at end of file
+socialLogin.label=Social Login
+js.sendVerificationCode.success=Sent Successfully
+js.sendVerificationCode.failed=Sending Failed, Please Try Again Later
\ No newline at end of file
diff --git a/application/src/main/resources/templates/gateway_modules/common_fragments_es.properties b/application/src/main/resources/templates/gateway_modules/common_fragments_es.properties
new file mode 100644
index 0000000000..cbda753fe4
--- /dev/null
+++ b/application/src/main/resources/templates/gateway_modules/common_fragments_es.properties
@@ -0,0 +1,3 @@
+socialLogin.label=Inicio de Sesión Social
+js.sendVerificationCode.success=Enviado con éxito
+js.sendVerificationCode.failed=Error al enviar, por favor intente nuevamente más tarde
\ No newline at end of file
diff --git a/application/src/main/resources/templates/gateway_modules/common_fragments_zh_TW.properties b/application/src/main/resources/templates/gateway_modules/common_fragments_zh_TW.properties
new file mode 100644
index 0000000000..d55ad22de9
--- /dev/null
+++ b/application/src/main/resources/templates/gateway_modules/common_fragments_zh_TW.properties
@@ -0,0 +1,3 @@
+socialLogin.label=社交登入
+js.sendVerificationCode.success=發送成功
+js.sendVerificationCode.failed=發送失敗，請稍後再試
\ No newline at end of file
diff --git a/application/src/main/resources/templates/gateway_modules/login_fragments_en.properties b/application/src/main/resources/templates/gateway_modules/login_fragments_en.properties
index d3b5b33f46..90daeec12b 100644
--- a/application/src/main/resources/templates/gateway_modules/login_fragments_en.properties
+++ b/application/src/main/resources/templates/gateway_modules/login_fragments_en.properties
@@ -1,6 +1,6 @@
 messages.loginError=Invalid credentials.
 messages.logoutSuccess=Logout successfully.
-messages.signupSuccess=Congratulations! Sign up successfully, please sign in now.
+messages.signupSuccess=Congratulations! Sign up successfully, please login now.
 
 error.invalid-credential=Invalid credentials.
 error.rate-limit-exceeded=Too many requests, please try again later.
diff --git a/application/src/main/resources/templates/gateway_modules/login_fragments_es.properties b/application/src/main/resources/templates/gateway_modules/login_fragments_es.properties
new file mode 100644
index 0000000000..ae350b0a6b
--- /dev/null
+++ b/application/src/main/resources/templates/gateway_modules/login_fragments_es.properties
@@ -0,0 +1,13 @@
+messages.loginError=Credenciales inválidas.
+messages.logoutSuccess=Cierre de sesión exitoso.
+messages.signupSuccess=¡Felicidades! Registro exitoso, por favor inicie sesión de inmediato.
+
+error.invalid-credential=Credenciales inválidas.
+error.rate-limit-exceeded=Demasiadas solicitudes, por favor intente nuevamente más tarde.
+
+form.rememberMe.label=Mantener sesión iniciada
+form.submit=Iniciar sesión
+otherLogin.label=Otras formas de inicio de sesión
+signup.description=¿No tienes una cuenta?
+signup.link=Regístrate ahora
+returnToSite=Volver al sitio
diff --git a/application/src/main/resources/templates/gateway_modules/login_fragments_zh_TW.properties b/application/src/main/resources/templates/gateway_modules/login_fragments_zh_TW.properties
new file mode 100644
index 0000000000..42fb89cc01
--- /dev/null
+++ b/application/src/main/resources/templates/gateway_modules/login_fragments_zh_TW.properties
@@ -0,0 +1,13 @@
+messages.loginError=無效的憑證。
+messages.logoutSuccess=登出成功。
+messages.signupSuccess=恭喜！註冊成功，請立即登入。
+
+error.invalid-credential=無效的憑證。
+error.rate-limit-exceeded=請求過於頻繁，請稍後再試。
+
+form.rememberMe.label=保持登入會話
+form.submit=登入
+otherLogin.label=其他登入方式
+signup.description=沒有帳號？
+signup.link=立即註冊
+returnToSite=返回網站
diff --git a/application/src/main/resources/templates/login_es.properties b/application/src/main/resources/templates/login_es.properties
new file mode 100644
index 0000000000..44915466c1
--- /dev/null
+++ b/application/src/main/resources/templates/login_es.properties
@@ -0,0 +1 @@
+title=Iniciar Sesión
diff --git a/application/src/main/resources/templates/login_local_es.properties b/application/src/main/resources/templates/login_local_es.properties
new file mode 100644
index 0000000000..a13f85b92d
--- /dev/null
+++ b/application/src/main/resources/templates/login_local_es.properties
@@ -0,0 +1,3 @@
+form.username.label=Nombre de Usuario
+form.password.label=Contraseña
+form.password.forgot=¿Olvidaste tu contraseña?
diff --git a/application/src/main/resources/templates/login_local_zh_TW.properties b/application/src/main/resources/templates/login_local_zh_TW.properties
new file mode 100644
index 0000000000..83af5dba38
--- /dev/null
+++ b/application/src/main/resources/templates/login_local_zh_TW.properties
@@ -0,0 +1,3 @@
+form.username.label=使用者名稱
+form.password.label=密碼
+form.password.forgot=忘記密碼？
\ No newline at end of file
diff --git a/application/src/main/resources/templates/login_zh_TW.properties b/application/src/main/resources/templates/login_zh_TW.properties
new file mode 100644
index 0000000000..9f1b2d337b
--- /dev/null
+++ b/application/src/main/resources/templates/login_zh_TW.properties
@@ -0,0 +1 @@
+title=登入
diff --git a/application/src/main/resources/templates/logout_es.properties b/application/src/main/resources/templates/logout_es.properties
new file mode 100644
index 0000000000..ab74ddb056
--- /dev/null
+++ b/application/src/main/resources/templates/logout_es.properties
@@ -0,0 +1,3 @@
+title=Cerrar Sesión
+form.title=¿Estás seguro de que deseas cerrar sesión?
+form.submit=Cerrar Sesión
diff --git a/application/src/main/resources/templates/logout_zh_TW.properties b/application/src/main/resources/templates/logout_zh_TW.properties
new file mode 100644
index 0000000000..8d8fddf093
--- /dev/null
+++ b/application/src/main/resources/templates/logout_zh_TW.properties
@@ -0,0 +1,3 @@
+title=退出登入
+form.title=確定要退出登入嗎？
+form.submit=退出登入
diff --git a/application/src/main/resources/templates/password-reset-link.html b/application/src/main/resources/templates/password-reset-link.html
index 2a40d4d81b..5ce127ab34 100644
--- a/application/src/main/resources/templates/password-reset-link.html
+++ b/application/src/main/resources/templates/password-reset-link.html
@@ -34,6 +34,8 @@ <h1 class="form-title" th:text="#{title(${username})}"></h1>
                     </div>
                 </form>
             </div>
+
+            <div th:replace="~{gateway_modules/common_fragments::languageSwitcher}"></div>
         </div>
     </th:block>
-</html>
\ No newline at end of file
+</html>
diff --git a/application/src/main/resources/templates/password-reset-link_es.properties b/application/src/main/resources/templates/password-reset-link_es.properties
new file mode 100644
index 0000000000..406600dace
--- /dev/null
+++ b/application/src/main/resources/templates/password-reset-link_es.properties
@@ -0,0 +1,5 @@
+title=Cambiar Contraseña para {0}
+form.password.label=Contraseña
+form.confirmPassword.label=Confirmar Contraseña
+form.password.tips=La contraseña debe tener al menos 8 caracteres e incluir al menos una letra mayúscula, una letra minúscula, un número y un carácter especial.
+form.submit=Cambiar Contraseña
diff --git a/application/src/main/resources/templates/password-reset-link_zh_TW.properties b/application/src/main/resources/templates/password-reset-link_zh_TW.properties
new file mode 100644
index 0000000000..6b6a4c5bcd
--- /dev/null
+++ b/application/src/main/resources/templates/password-reset-link_zh_TW.properties
@@ -0,0 +1,5 @@
+title=為 {0} 修改密碼
+form.password.label=密碼
+form.confirmPassword.label=確認密碼
+form.password.tips=密碼必須至少包含 8 個字元，並且至少包含一個大寫字母、一個小寫字母、一個數字和一個特殊字元。
+form.submit=修改密碼
diff --git a/application/src/main/resources/templates/password-reset.html b/application/src/main/resources/templates/password-reset.html
index 3e198e1427..782a9a3a34 100644
--- a/application/src/main/resources/templates/password-reset.html
+++ b/application/src/main/resources/templates/password-reset.html
@@ -31,6 +31,8 @@ <h1 class="form-title" th:text="${sent} ? #{sent.title} : #{title}"></h1>
                     </div>
                 </form>
             </div>
+
+            <div th:replace="~{gateway_modules/common_fragments::languageSwitcher}"></div>
         </div>
     </th:block>
-</html>
+</html>
\ No newline at end of file
diff --git a/application/src/main/resources/templates/password-reset_es.properties b/application/src/main/resources/templates/password-reset_es.properties
new file mode 100644
index 0000000000..671e3e29e2
--- /dev/null
+++ b/application/src/main/resources/templates/password-reset_es.properties
@@ -0,0 +1,6 @@
+title=Restablecer Contraseña
+form.email.label=Correo Electrónico
+form.submit=Enviar
+sent.form.submit=Volver a la Página de Inicio de Sesión
+sent.form.message=Revisa tu correo electrónico para ver el enlace de restablecimiento de contraseña. Si no aparece en unos minutos, revisa tu carpeta de spam.
+sent.title=Correo de Restablecimiento de Contraseña Enviado
diff --git a/application/src/main/resources/templates/password-reset_zh_TW.properties b/application/src/main/resources/templates/password-reset_zh_TW.properties
new file mode 100644
index 0000000000..9b773cd893
--- /dev/null
+++ b/application/src/main/resources/templates/password-reset_zh_TW.properties
@@ -0,0 +1,6 @@
+title=重置密碼
+form.email.label=電子郵件
+form.submit=提交
+sent.form.submit=返回到登入頁面
+sent.form.message=檢查您的電子郵件中是否有重置密碼的連結。如果幾分鐘內沒有出現，請檢查您的垃圾郵件資料夾。
+sent.title=已發送重置密碼的郵件
diff --git a/application/src/main/resources/templates/signup.html b/application/src/main/resources/templates/signup.html
index 01186b5ae3..c1937a2d80 100644
--- a/application/src/main/resources/templates/signup.html
+++ b/application/src/main/resources/templates/signup.html
@@ -1,36 +1,42 @@
 <!doctype html>
 <html
-        xmlns:th="https://www.thymeleaf.org"
-        th:replace="~{gateway_modules/layout :: layout(title = |#{title} - ${site.title}|, head = ~{::head}, body = ~{::body})}"
+    xmlns:th="https://www.thymeleaf.org"
+    th:replace="~{gateway_modules/layout :: layout(title = |#{title} - ${site.title}|, head = ~{::head}, body = ~{::body})}"
 >
-<th:block th:fragment="head">
-    <style>
-        .signup-page-wrapper {
-            max-width: 35em;
-        }
-    </style>
-</th:block>
-<th:block th:fragment="body">
-    <div class="gateway-wrapper signup-page-wrapper">
-        <div th:replace="~{gateway_modules/common_fragments::haloLogo}"></div>
-        <div class="halo-form-wrapper">
-            <h1 class="form-title" th:text="#{title}"></h1>
-            <p class="alert alert=erro" role="alert" th:if="${error == 'invalid-email-code'}">
-                <span th:text="#{error.invalid-email-code}">Invalid email code</span>
-            </p>
-            <p class="alert alert=erro" role="alert" th:if="${error == 'rate-limit-exceeded'}">
-                <span th:text="#{error.rate-limit-exceeded}">Rate limit exceeded</span>
-            </p>
-            <p class="alert alert=erro" role="alert" th:if="${error == 'duplicate-name'}">
-                <span th:text="#{error.duplicate-name}">Duplicate name</span>
-            </p>
-            <form class="halo-form" name="signup-form" id="signup-form" th:action="@{/signup}" th:object="${form}"
-                  method="post">
-                <div class="form-item-group">
-                    <div class="form-item">
-                        <label for="username" th:text="#{form.username.label}"></label>
-                        <div class="form-input">
-                            <input
+    <th:block th:fragment="head">
+        <style>
+            .signup-page-wrapper {
+                max-width: 35em;
+            }
+        </style>
+    </th:block>
+    <th:block th:fragment="body">
+        <div class="gateway-wrapper signup-page-wrapper">
+            <div th:replace="~{gateway_modules/common_fragments::haloLogo}"></div>
+            <div class="halo-form-wrapper">
+                <h1 class="form-title" th:text="#{title}"></h1>
+                <p class="alert alert=erro" role="alert" th:if="${error == 'invalid-email-code'}">
+                    <span th:text="#{error.invalid-email-code}">Invalid email code</span>
+                </p>
+                <p class="alert alert=erro" role="alert" th:if="${error == 'rate-limit-exceeded'}">
+                    <span th:text="#{error.rate-limit-exceeded}">Rate limit exceeded</span>
+                </p>
+                <p class="alert alert=erro" role="alert" th:if="${error == 'duplicate-name'}">
+                    <span th:text="#{error.duplicate-name}">Duplicate name</span>
+                </p>
+                <form
+                    class="halo-form"
+                    name="signup-form"
+                    id="signup-form"
+                    th:action="@{/signup}"
+                    th:object="${form}"
+                    method="post"
+                >
+                    <div class="form-item-group">
+                        <div class="form-item">
+                            <label for="username" th:text="#{form.username.label}"></label>
+                            <div class="form-input">
+                                <input
                                     type="text"
                                     id="username"
                                     name="username"
@@ -41,18 +47,19 @@ <h1 class="form-title" th:text="#{title}"></h1>
                                     autofocus
                                     required
                                     th:field="*{username}"
-                            />
+                                />
+                            </div>
+                            <p
+                                class="alert alert-error"
+                                th:if="${#fields.hasErrors('username')}"
+                                th:errors="*{username}"
+                            ></p>
                         </div>
-                        <p class="alert alert-error"
-                           th:if="${#fields.hasErrors('username')}"
-                           th:errors="*{username}">
-                        </p>
-                    </div>
 
-                    <div class="form-item">
-                        <label for="displayName" th:text="#{form.displayName.label}"></label>
-                        <div class="form-input">
-                            <input
+                        <div class="form-item">
+                            <label for="displayName" th:text="#{form.displayName.label}"></label>
+                            <div class="form-input">
+                                <input
                                     type="text"
                                     id="displayName"
                                     name="displayName"
@@ -62,20 +69,21 @@ <h1 class="form-title" th:text="#{title}"></h1>
                                     autocapitalize="off"
                                     required
                                     th:field="*{displayName}"
-                            />
+                                />
+                            </div>
+                            <p
+                                class="alert alert-error"
+                                th:if="${#fields.hasErrors('displayName')}"
+                                th:errors="*{displayName}"
+                            ></p>
                         </div>
-                        <p class="alert alert-error"
-                           th:if="${#fields.hasErrors('displayName')}"
-                           th:errors="*{displayName}">
-                        </p>
                     </div>
-                </div>
 
-                <div class="form-item-group">
-                    <div class="form-item">
-                        <label for="email" th:text="#{form.email.label}"></label>
-                        <div class="form-input">
-                            <input
+                    <div class="form-item-group">
+                        <div class="form-item">
+                            <label for="email" th:text="#{form.email.label}"></label>
+                            <div class="form-input">
+                                <input
                                     type="email"
                                     id="email"
                                     name="email"
@@ -85,118 +93,120 @@ <h1 class="form-title" th:text="#{title}"></h1>
                                     autocapitalize="off"
                                     required
                                     th:field="*{email}"
-                            />
+                                />
+                            </div>
+                            <p class="alert alert-error" th:if="${#fields.hasErrors('email')}" th:errors="*{email}"></p>
                         </div>
-                        <p class="alert alert-error"
-                           th:if="${#fields.hasErrors('email')}"
-                           th:errors="*{email}">
-                        </p>
-                    </div>
 
-                    <div class="form-item" th:if="${globalInfo.mustVerifyEmailOnRegistration}">
-                        <label for="emailCode" th:text="#{form.emailCode.label}"></label>
-                        <div class="form-input-group">
-                            <div class="form-input">
-                                <input
+                        <div class="form-item" th:if="${globalInfo.mustVerifyEmailOnRegistration}">
+                            <label for="emailCode" th:text="#{form.emailCode.label}"></label>
+                            <div class="form-input-group">
+                                <div class="form-input">
+                                    <input
                                         type="text"
                                         inputmode="numeric"
                                         pattern="\d*"
                                         id="emailCode"
                                         name="emailCode"
                                         required
-                                />
-                            </div>
+                                    />
+                                </div>
 
-                            <button
+                                <button
                                     id="emailCodeSendButton"
                                     type="button"
                                     th:text="#{form.emailCode.sendButton}"
-                            ></button>
+                                ></button>
+                            </div>
+                            <p
+                                class="alert alert-error"
+                                th:if="${#fields.hasErrors('emailCode')}"
+                                th:errors="*{emailCode}"
+                            ></p>
                         </div>
-                        <p class="alert alert-error"
-                           th:if="${#fields.hasErrors('emailCode')}"
-                           th:errors="*{emailCode}">
-                        </p>
                     </div>
-                </div>
 
-                <div class="form-item">
-                    <label for="password" th:text="#{form.password.label}"></label>
-                    <th:block
+                    <div class="form-item">
+                        <label for="password" th:text="#{form.password.label}"></label>
+                        <th:block
                             th:replace="~{gateway_modules/input_fragments :: password(id = 'password', name = 'password', required = 'true', minlength = 6, enableToggle = true)}"
-                    ></th:block>
-                    <p class="alert alert-error"
-                       th:if="${#fields.hasErrors('password')}"
-                       th:errors="*{password}">
-                    </p>
-                </div>
+                        ></th:block>
+                        <p
+                            class="alert alert-error"
+                            th:if="${#fields.hasErrors('password')}"
+                            th:errors="*{password}"
+                        ></p>
+                    </div>
 
-                <div class="form-item">
-                    <label for="confirmPassword" th:text="#{form.confirmPassword.label}"></label>
-                    <th:block
+                    <div class="form-item">
+                        <label for="confirmPassword" th:text="#{form.confirmPassword.label}"></label>
+                        <th:block
                             th:replace="~{gateway_modules/input_fragments :: password(id = 'confirmPassword', name = null, required = 'true', minlength = 6, enableToggle = true)}"
-                    ></th:block>
-                    <p class="alert alert-error"
-                       th:if="${#fields.hasErrors('confirmPassword')}"
-                       th:errors="*{confirmPassword}">
-                    </p>
-                </div>
+                        ></th:block>
+                        <!-- <p -->
+                        <!--     class="alert alert-error" -->
+                        <!--     th:if="${#fields.hasErrors('confirmPassword')}" -->
+                        <!--     th:errors="*{confirmPassword}" -->
+                        <!-- ></p> -->
+                    </div>
 
-                <div class="form-item">
-                    <button type="submit" th:text="#{form.submit}"></button>
-                </div>
-            </form>
+                    <div class="form-item">
+                        <button type="submit" th:text="#{form.submit}"></button>
+                    </div>
+                </form>
 
-            <div th:replace="~{gateway_modules/common_fragments::socialAuthProviders}"></div>
+                <div th:replace="~{gateway_modules/common_fragments::socialAuthProviders}"></div>
+            </div>
+
+            <div th:replace="~{gateway_modules/common_fragments::languageSwitcher}"></div>
         </div>
-    </div>
-    <script th:inline="javascript">
-        document.addEventListener("DOMContentLoaded", function () {
-            function sendRequest() {
-                return new Promise((resolve, reject) => {
-                    const email = document.getElementById("email").value;
+        <script th:inline="javascript">
+            document.addEventListener("DOMContentLoaded", function () {
+                function sendRequest() {
+                    return new Promise((resolve, reject) => {
+                        const email = document.getElementById("email").value;
 
-                    if (!email) {
-                        throw new Error("请先输入邮箱地址");
-                    }
+                        if (!email) {
+                            throw new Error(/*[[#{form.emailCode.send.emptyValidation}]]*/);
+                        }
 
-                    fetch("/signup/send-email-code", {
-                        method: "POST",
-                        body: JSON.stringify({ email: email }),
-                        headers: {
-                            "Content-Type": "application/json",
-                            [[${_csrf.headerName}]]: [[${_csrf.token}]],
-                        },
-                    })
-                        .then((response) => {
-                            if (response.ok) {
-                                resolve(response);
-                            }
-                            reject(response);
+                        fetch("/signup/send-email-code", {
+                            method: "POST",
+                            body: JSON.stringify({ email: email }),
+                            headers: {
+                                "Content-Type": "application/json",
+                                [[${_csrf.headerName}]]: [[${_csrf.token}]],
+                            },
                         })
-                        .catch((e) => {
-                            reject(e);
-                        });
-                });
-            }
+                            .then((response) => {
+                                if (response.ok) {
+                                    resolve(response);
+                                }
+                                reject(response);
+                            })
+                            .catch((e) => {
+                                reject(e);
+                            });
+                    });
+                }
 
-            const emailCodeSendButton = document.getElementById("emailCodeSendButton");
-            sendVerificationCode(emailCodeSendButton, sendRequest);
+                const emailCodeSendButton = document.getElementById("emailCodeSendButton");
+                sendVerificationCode(emailCodeSendButton, sendRequest);
 
-            var password = document.getElementById("password"),
-                confirm_password = document.getElementById("confirmPassword");
+                var password = document.getElementById("password"),
+                    confirm_password = document.getElementById("confirmPassword");
 
-            function validatePassword() {
-                if (password.value != confirm_password.value) {
-                    confirm_password.setCustomValidity("Passwords Don't Match");
-                } else {
-                    confirm_password.setCustomValidity("");
+                function validatePassword() {
+                    if (password.value != confirm_password.value) {
+                        confirm_password.setCustomValidity("Passwords Don't Match");
+                    } else {
+                        confirm_password.setCustomValidity("");
+                    }
                 }
-            }
 
-            password.onchange = validatePassword;
-            confirm_password.onkeyup = validatePassword;
-        });
-    </script>
-</th:block>
-</html>
\ No newline at end of file
+                password.onchange = validatePassword;
+                confirm_password.onkeyup = validatePassword;
+            });
+        </script>
+    </th:block>
+</html>
diff --git a/application/src/main/resources/templates/signup.properties b/application/src/main/resources/templates/signup.properties
index ce6a56c6d9..8e307cc798 100644
--- a/application/src/main/resources/templates/signup.properties
+++ b/application/src/main/resources/templates/signup.properties
@@ -4,10 +4,11 @@ form.displayName.label=名称
 form.email.label=电子邮箱
 form.emailCode.label=邮箱验证码
 form.emailCode.sendButton=发送
+form.emailCode.send.emptyValidation=请先输入邮箱地址
 form.password.label=密码
 form.confirmPassword.label=确认密码
 form.submit=注册
 
 error.invalid-email-code=无效的邮箱验证码
 error.duplicate-name=用户名已经被注册
-error.rate-limit-exceeded=请求过于频繁，请稍后再试
+error.rate-limit-exceeded=请求过于频繁，请稍后再试
\ No newline at end of file
diff --git a/application/src/main/resources/templates/signup_en.properties b/application/src/main/resources/templates/signup_en.properties
index bdbb222060..fed3c49659 100644
--- a/application/src/main/resources/templates/signup_en.properties
+++ b/application/src/main/resources/templates/signup_en.properties
@@ -1,9 +1,14 @@
-title=Sign up
+title=Sign Up
 form.username.label=Username
-form.displayName.label=Display name
+form.displayName.label=Display Name
 form.email.label=Email
-form.emailCode.label=Email Code
+form.emailCode.label=Email Verification Code
 form.emailCode.sendButton=Send
+form.emailCode.send.emptyValidation=Please enter your email address first
 form.password.label=Password
-form.confirmPassword.label=Confirm password
-form.submit=Sign up
\ No newline at end of file
+form.confirmPassword.label=Confirm Password
+form.submit=Sign Up
+
+error.invalid-email-code=Invalid Email Verification Code
+error.duplicate-name=Username is already taken
+error.rate-limit-exceeded=Too many requests, please try again later
\ No newline at end of file
diff --git a/application/src/main/resources/templates/signup_es.properties b/application/src/main/resources/templates/signup_es.properties
new file mode 100644
index 0000000000..747860645f
--- /dev/null
+++ b/application/src/main/resources/templates/signup_es.properties
@@ -0,0 +1,14 @@
+title=Registrarse
+form.username.label=Nombre de Usuario
+form.displayName.label=Nombre
+form.email.label=Correo Electrónico
+form.emailCode.label=Código de Verificación
+form.emailCode.sendButton=Enviar
+form.emailCode.send.emptyValidation=Por favor, introduce tu dirección de correo electrónico primero
+form.password.label=Contraseña
+form.confirmPassword.label=Confirmar Contraseña
+form.submit=Registrarse
+
+error.invalid-email-code=Código de verificación del correo inválido
+error.duplicate-name=El nombre de usuario ya está registrado
+error.rate-limit-exceeded=Demasiadas solicitudes, por favor intente nuevamente más tarde
\ No newline at end of file
diff --git a/application/src/main/resources/templates/signup_zh_TW.properties b/application/src/main/resources/templates/signup_zh_TW.properties
new file mode 100644
index 0000000000..597c7052b4
--- /dev/null
+++ b/application/src/main/resources/templates/signup_zh_TW.properties
@@ -0,0 +1,14 @@
+title=註冊
+form.username.label=使用者名稱
+form.displayName.label=名稱
+form.email.label=電子郵件
+form.emailCode.label=郵箱驗證碼
+form.emailCode.sendButton=發送
+form.emailCode.send.emptyValidation=請先輸入電子郵件地址
+form.password.label=密碼
+form.confirmPassword.label=確認密碼
+form.submit=註冊
+
+error.invalid-email-code=無效的郵箱驗證碼
+error.duplicate-name=使用者名稱已經被註冊
+error.rate-limit-exceeded=請求過於頻繁，請稍後再試
\ No newline at end of file

From cd90771bb729201d7a5b38e45187778b89118018 Mon Sep 17 00:00:00 2001
From: guqing <i@guqing.email>
Date: Sun, 29 Sep 2024 16:22:44 +0800
Subject: [PATCH 056/185] feat: add API for recycle users own posts

---
 .../run/halo/app/content/PostService.java     |  2 ++
 .../app/content/impl/PostServiceImpl.java     |  9 +++++++++
 .../app/core/endpoint/uc/UcPostEndpoint.java  | 16 ++++++++++++++-
 .../extensions/role-template-uc-content.yaml  | 20 ++++++++++++++++++-
 4 files changed, 45 insertions(+), 2 deletions(-)

diff --git a/application/src/main/java/run/halo/app/content/PostService.java b/application/src/main/java/run/halo/app/content/PostService.java
index cf4c0b44a3..d9344a3de5 100644
--- a/application/src/main/java/run/halo/app/content/PostService.java
+++ b/application/src/main/java/run/halo/app/content/PostService.java
@@ -50,4 +50,6 @@ public interface PostService {
     Mono<Post> revertToSpecifiedSnapshot(String postName, String snapshotName);
 
     Mono<ContentWrapper> deleteContent(String postName, String snapshotName);
+
+    Mono<Post> recycleBy(String postName, String username);
 }
diff --git a/application/src/main/java/run/halo/app/content/impl/PostServiceImpl.java b/application/src/main/java/run/halo/app/content/impl/PostServiceImpl.java
index 5e805ac9ac..7cdae00cc1 100644
--- a/application/src/main/java/run/halo/app/content/impl/PostServiceImpl.java
+++ b/application/src/main/java/run/halo/app/content/impl/PostServiceImpl.java
@@ -379,6 +379,15 @@ public Mono<ContentWrapper> deleteContent(String postName, String snapshotName)
             });
     }
 
+    @Override
+    public Mono<Post> recycleBy(String postName, String username) {
+        return getByUsername(postName, username)
+            .flatMap(post -> updatePostWithRetry(post, record -> {
+                record.getSpec().setDeleted(true);
+                return record;
+            }));
+    }
+
     private Mono<Post> updatePostWithRetry(Post post, UnaryOperator<Post> func) {
         return client.update(func.apply(post))
             .onErrorResume(OptimisticLockingFailureException.class,
diff --git a/application/src/main/java/run/halo/app/core/endpoint/uc/UcPostEndpoint.java b/application/src/main/java/run/halo/app/core/endpoint/uc/UcPostEndpoint.java
index a969e64e82..87ca780193 100644
--- a/application/src/main/java/run/halo/app/core/endpoint/uc/UcPostEndpoint.java
+++ b/application/src/main/java/run/halo/app/core/endpoint/uc/UcPostEndpoint.java
@@ -124,13 +124,27 @@ public RouterFunction<ServerResponse> endpoint() {
                         .operationId("UnpublishMyPost")
                         .description("Unpublish my post.")
                         .parameter(namePathParam)
-                        .response(responseBuilder().implementation(Post.class)))
+                        .response(responseBuilder().implementation(Post.class))
+                    )
+                    .DELETE("/{name}/recycle", this::recycleMyPost, builder -> builder.tag(tag)
+                        .operationId("RecycleMyPost")
+                        .description("Move my post to recycle bin.")
+                        .parameter(namePathParam)
+                        .response(responseBuilder().implementation(Post.class))
+                    )
                     .build(),
                 builder -> {
                 })
             .build();
     }
 
+    private Mono<ServerResponse> recycleMyPost(ServerRequest request) {
+        final var name = request.pathVariable("name");
+        return getCurrentUser()
+            .flatMap(username -> postService.recycleBy(name, username))
+            .flatMap(post -> ServerResponse.ok().bodyValue(post));
+    }
+
     private Mono<ServerResponse> getMyPostDraft(ServerRequest request) {
         var name = request.pathVariable("name");
         var patched = request.queryParam("patched").map(Boolean::valueOf).orElse(false);
diff --git a/application/src/main/resources/extensions/role-template-uc-content.yaml b/application/src/main/resources/extensions/role-template-uc-content.yaml
index 93f7bcd6b4..575d68e68e 100644
--- a/application/src/main/resources/extensions/role-template-uc-content.yaml
+++ b/application/src/main/resources/extensions/role-template-uc-content.yaml
@@ -39,7 +39,8 @@ metadata:
     # Currently, yaml definition does not support i18n, please see https://github.com/halo-dev/halo/issues/3573
     rbac.authorization.halo.run/display-name: "Post Author"
     rbac.authorization.halo.run/dependencies: |
-      [ "role-template-post-contributor", "role-template-post-publisher", "role-template-post-attachment-manager" ]
+      [ "role-template-post-contributor", "role-template-post-publisher", "role-template-recycle-my-post",
+        "role-template-post-attachment-manager" ]
 rules: [ ]
 
 ---
@@ -98,6 +99,23 @@ rules:
     resources: [ "posts/publish", "posts/unpublish" ]
     verbs: [ "update" ]
 
+---
+apiVersion: v1alpha1
+kind: Role
+metadata:
+  name: role-template-recycle-my-post
+  labels:
+    halo.run/role-template: "true"
+  annotations:
+    rbac.authorization.halo.run/module: "Posts Management"
+    rbac.authorization.halo.run/display-name: "Recycle My Post"
+    rbac.authorization.halo.run/ui-permissions: |
+      [ "uc:posts:recycle" ]
+rules:
+  - apiGroups: [ "uc.api.content.halo.run" ]
+    resources: [ "posts/recycle" ]
+    verbs: [ "delete" ]
+
 ---
 apiVersion: v1alpha1
 kind: Role

From 944d0a5cb4f78ef55a5a7367ed5f333baa7dc7bd Mon Sep 17 00:00:00 2001
From: Ryan Wang <i@ryanc.cc>
Date: Sun, 29 Sep 2024 17:42:10 +0800
Subject: [PATCH 057/185] feat: add supports for delete own posts in uc

Signed-off-by: Ryan Wang <i@ryanc.cc>
---
 api-docs/openapi/v3_0/aggregated.json         | 32 +++++++
 .../openapi/v3_0/apis_uc.api_v1alpha1.json    | 32 +++++++
 .../src/api/post-v1alpha1-uc-api.ts           | 87 +++++++++++++++++++
 ui/src/locales/en.yaml                        |  3 +
 ui/src/locales/zh-CN.yaml                     |  3 +
 ui/src/locales/zh-TW.yaml                     |  3 +
 .../posts/components/PostListItem.vue         | 26 +++++-
 7 files changed, 185 insertions(+), 1 deletion(-)

diff --git a/api-docs/openapi/v3_0/aggregated.json b/api-docs/openapi/v3_0/aggregated.json
index bb1dc041a4..7426653032 100644
--- a/api-docs/openapi/v3_0/aggregated.json
+++ b/api-docs/openapi/v3_0/aggregated.json
@@ -15117,6 +15117,38 @@
         ]
       }
     },
+    "/apis/uc.api.content.halo.run/v1alpha1/posts/{name}/recycle": {
+      "delete": {
+        "description": "Move my post to recycle bin.",
+        "operationId": "RecycleMyPost",
+        "parameters": [
+          {
+            "description": "Post name",
+            "in": "path",
+            "name": "name",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "default": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/Post"
+                }
+              }
+            },
+            "description": "default response"
+          }
+        },
+        "tags": [
+          "PostV1alpha1Uc"
+        ]
+      }
+    },
     "/apis/uc.api.content.halo.run/v1alpha1/posts/{name}/unpublish": {
       "put": {
         "description": "Unpublish my post.",
diff --git a/api-docs/openapi/v3_0/apis_uc.api_v1alpha1.json b/api-docs/openapi/v3_0/apis_uc.api_v1alpha1.json
index eece516c04..7c8eb55b5b 100644
--- a/api-docs/openapi/v3_0/apis_uc.api_v1alpha1.json
+++ b/api-docs/openapi/v3_0/apis_uc.api_v1alpha1.json
@@ -412,6 +412,38 @@
         ]
       }
     },
+    "/apis/uc.api.content.halo.run/v1alpha1/posts/{name}/recycle": {
+      "delete": {
+        "description": "Move my post to recycle bin.",
+        "operationId": "RecycleMyPost",
+        "parameters": [
+          {
+            "description": "Post name",
+            "in": "path",
+            "name": "name",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "default": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/Post"
+                }
+              }
+            },
+            "description": "default response"
+          }
+        },
+        "tags": [
+          "PostV1alpha1Uc"
+        ]
+      }
+    },
     "/apis/uc.api.content.halo.run/v1alpha1/posts/{name}/unpublish": {
       "put": {
         "description": "Unpublish my post.",
diff --git a/ui/packages/api-client/src/api/post-v1alpha1-uc-api.ts b/ui/packages/api-client/src/api/post-v1alpha1-uc-api.ts
index 1a2d08f138..34733b7f23 100644
--- a/ui/packages/api-client/src/api/post-v1alpha1-uc-api.ts
+++ b/ui/packages/api-client/src/api/post-v1alpha1-uc-api.ts
@@ -270,6 +270,47 @@ export const PostV1alpha1UcApiAxiosParamCreator = function (configuration?: Conf
 
 
     
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
+
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+        /**
+         * Move my post to recycle bin.
+         * @param {string} name Post name
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        recycleMyPost: async (name: string, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            // verify required parameter 'name' is not null or undefined
+            assertParamExists('recycleMyPost', 'name', name)
+            const localVarPath = `/apis/uc.api.content.halo.run/v1alpha1/posts/{name}/recycle`
+                .replace(`{${"name"}}`, encodeURIComponent(String(name)));
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+
+            const localVarRequestOptions = { method: 'DELETE', ...baseOptions, ...options};
+            const localVarHeaderParameter = {} as any;
+            const localVarQueryParameter = {} as any;
+
+            // authentication basicAuth required
+            // http basic authentication required
+            setBasicAuthToObject(localVarRequestOptions, configuration)
+
+            // authentication bearerAuth required
+            // http bearer authentication required
+            await setBearerAuthToObject(localVarHeaderParameter, configuration)
+
+
+    
             setSearchParams(localVarUrlObj, localVarQueryParameter);
             let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
             localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
@@ -488,6 +529,18 @@ export const PostV1alpha1UcApiFp = function(configuration?: Configuration) {
             const localVarOperationServerBasePath = operationServerMap['PostV1alpha1UcApi.publishMyPost']?.[localVarOperationServerIndex]?.url;
             return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
         },
+        /**
+         * Move my post to recycle bin.
+         * @param {string} name Post name
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async recycleMyPost(name: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<Post>> {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.recycleMyPost(name, options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['PostV1alpha1UcApi.recycleMyPost']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
         /**
          * Unpublish my post.
          * @param {string} name Post name
@@ -581,6 +634,15 @@ export const PostV1alpha1UcApiFactory = function (configuration?: Configuration,
         publishMyPost(requestParameters: PostV1alpha1UcApiPublishMyPostRequest, options?: RawAxiosRequestConfig): AxiosPromise<Post> {
             return localVarFp.publishMyPost(requestParameters.name, options).then((request) => request(axios, basePath));
         },
+        /**
+         * Move my post to recycle bin.
+         * @param {PostV1alpha1UcApiRecycleMyPostRequest} requestParameters Request parameters.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        recycleMyPost(requestParameters: PostV1alpha1UcApiRecycleMyPostRequest, options?: RawAxiosRequestConfig): AxiosPromise<Post> {
+            return localVarFp.recycleMyPost(requestParameters.name, options).then((request) => request(axios, basePath));
+        },
         /**
          * Unpublish my post.
          * @param {PostV1alpha1UcApiUnpublishMyPostRequest} requestParameters Request parameters.
@@ -737,6 +799,20 @@ export interface PostV1alpha1UcApiPublishMyPostRequest {
     readonly name: string
 }
 
+/**
+ * Request parameters for recycleMyPost operation in PostV1alpha1UcApi.
+ * @export
+ * @interface PostV1alpha1UcApiRecycleMyPostRequest
+ */
+export interface PostV1alpha1UcApiRecycleMyPostRequest {
+    /**
+     * Post name
+     * @type {string}
+     * @memberof PostV1alpha1UcApiRecycleMyPost
+     */
+    readonly name: string
+}
+
 /**
  * Request parameters for unpublishMyPost operation in PostV1alpha1UcApi.
  * @export
@@ -855,6 +931,17 @@ export class PostV1alpha1UcApi extends BaseAPI {
         return PostV1alpha1UcApiFp(this.configuration).publishMyPost(requestParameters.name, options).then((request) => request(this.axios, this.basePath));
     }
 
+    /**
+     * Move my post to recycle bin.
+     * @param {PostV1alpha1UcApiRecycleMyPostRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof PostV1alpha1UcApi
+     */
+    public recycleMyPost(requestParameters: PostV1alpha1UcApiRecycleMyPostRequest, options?: RawAxiosRequestConfig) {
+        return PostV1alpha1UcApiFp(this.configuration).recycleMyPost(requestParameters.name, options).then((request) => request(this.axios, this.basePath));
+    }
+
     /**
      * Unpublish my post.
      * @param {PostV1alpha1UcApiUnpublishMyPostRequest} requestParameters Request parameters.
diff --git a/ui/src/locales/en.yaml b/ui/src/locales/en.yaml
index b56a699ba4..d29e70972c 100644
--- a/ui/src/locales/en.yaml
+++ b/ui/src/locales/en.yaml
@@ -1790,6 +1790,9 @@ core:
       cancel_publish:
         description: Are you sure you want to cancel publishing?
         title: Cancel publish
+      delete:
+        title: Delete post
+        description: This action will move the post to the recycle bin, where it will be managed by the site administrator.
     publish_modal:
       title: Publish post
     setting_modal:
diff --git a/ui/src/locales/zh-CN.yaml b/ui/src/locales/zh-CN.yaml
index ab84cece98..a00b88c5eb 100644
--- a/ui/src/locales/zh-CN.yaml
+++ b/ui/src/locales/zh-CN.yaml
@@ -256,6 +256,9 @@ core:
       cancel_publish:
         title: 取消发布
         description: 确定要取消发布吗？
+      delete:
+        title: 删除文章
+        description: 该操作会将文章放入回收站，后续由网站管理员进行管理。
   post_editor:
     title: 文章编辑
     untitled: 未命名文章
diff --git a/ui/src/locales/zh-TW.yaml b/ui/src/locales/zh-TW.yaml
index 45b8cafa9b..f90e4b4f44 100644
--- a/ui/src/locales/zh-TW.yaml
+++ b/ui/src/locales/zh-TW.yaml
@@ -1656,6 +1656,9 @@ core:
       cancel_publish:
         description: 確定要取消發布嗎？
         title: 取消發布
+      delete:
+        title: 刪除文章
+        description: 該操作會將文章放入回收站，後續由網站管理員進行管理。
     publish_modal:
       title: 發布文章
     setting_modal:
diff --git a/ui/uc-src/modules/contents/posts/components/PostListItem.vue b/ui/uc-src/modules/contents/posts/components/PostListItem.vue
index a3229e7da4..b61c6b2ff7 100644
--- a/ui/uc-src/modules/contents/posts/components/PostListItem.vue
+++ b/ui/uc-src/modules/contents/posts/components/PostListItem.vue
@@ -92,6 +92,25 @@ function handleUnpublish() {
     },
   });
 }
+
+function handleDelete() {
+  Dialog.warning({
+    title: t("core.uc_post.operations.delete.title"),
+    description: t("core.uc_post.operations.delete.description"),
+    confirmType: "danger",
+    confirmText: t("core.common.buttons.confirm"),
+    cancelText: t("core.common.buttons.cancel"),
+    async onConfirm() {
+      await ucApiClient.content.post.recycleMyPost({
+        name: props.post.post.metadata.name,
+      });
+
+      Toast.success(t("core.common.toast.delete_success"));
+
+      queryClient.invalidateQueries({ queryKey: ["my-posts"] });
+    },
+  });
+}
 </script>
 
 <template>
@@ -246,11 +265,16 @@ function handleUnpublish() {
         {{ $t("core.common.buttons.edit") }}
       </VDropdownItem>
       <HasPermission v-if="!isPublished" :permissions="['uc:posts:publish']">
-        <VDropdownDivider />
         <VDropdownItem type="danger" @click="handleUnpublish">
           {{ $t("core.common.buttons.cancel_publish") }}
         </VDropdownItem>
       </HasPermission>
+      <HasPermission :permissions="['uc:posts:recycle']">
+        <VDropdownDivider />
+        <VDropdownItem type="danger" @click="handleDelete">
+          {{ $t("core.common.buttons.delete") }}
+        </VDropdownItem>
+      </HasPermission>
     </template>
   </VEntity>
 </template>

From 5b2bdfdf17352eff295aa60e8c94876555e9f5b4 Mon Sep 17 00:00:00 2001
From: Ryan Wang <i@ryanc.cc>
Date: Sun, 29 Sep 2024 17:57:49 +0800
Subject: [PATCH 058/185] Refine i18n

Signed-off-by: Ryan Wang <i@ryanc.cc>
---
 ui/src/locales/en.yaml    | 1 +
 ui/src/locales/zh-CN.yaml | 1 +
 ui/src/locales/zh-TW.yaml | 1 +
 3 files changed, 3 insertions(+)

diff --git a/ui/src/locales/en.yaml b/ui/src/locales/en.yaml
index d29e70972c..8982dc0d69 100644
--- a/ui/src/locales/en.yaml
+++ b/ui/src/locales/en.yaml
@@ -1519,6 +1519,7 @@ core:
     Post Author: Allows you to manage your own posts
     Post Contributor: Contributions allowed
     Post Publisher: Allow to publish own posts
+    Recycle My Post: Recycle My Post
   components:
     submit_button:
       computed_text: "{text} ({shortcut})"
diff --git a/ui/src/locales/zh-CN.yaml b/ui/src/locales/zh-CN.yaml
index a00b88c5eb..009e0ddfd4 100644
--- a/ui/src/locales/zh-CN.yaml
+++ b/ui/src/locales/zh-CN.yaml
@@ -1418,6 +1418,7 @@ core:
     Post Author: 允许管理自己的文章
     Post Attachment Manager: 允许在文章中上传图片
     Post Publisher: 允许发布自己的文章
+    Recycle My Post: 允许删除自己的文章
   components:
     submit_button:
       computed_text: "{text}（{shortcut}）"
diff --git a/ui/src/locales/zh-TW.yaml b/ui/src/locales/zh-TW.yaml
index f90e4b4f44..bd881b01c8 100644
--- a/ui/src/locales/zh-TW.yaml
+++ b/ui/src/locales/zh-TW.yaml
@@ -1394,6 +1394,7 @@ core:
     Post Author: 允許管理自己的文章
     Post Contributor: 允許投稿
     Post Publisher: 允許發布自己的文章
+    Recycle My Post: 允許刪除自己的文章
   components:
     submit_button:
       computed_text: "{text}（{shortcut}）"

From 83109d0568a8061f4ae24f0b2070bab522efdf81 Mon Sep 17 00:00:00 2001
From: John Niang <johnniang@foxmail.com>
Date: Sun, 29 Sep 2024 18:01:47 +0800
Subject: [PATCH 059/185] Fix the inaccessible problem of signup page (#6730)

#### What type of PR is this?

/kind bug
/area core
/milestone 2.20.x

#### What this PR does / why we need it:

This PR adds confirmPassword field into SignUpData for validation. So the signup page can be rendered correctly.

See https://github.com/halo-dev/halo/issues/6718 for more.

#### Which issue(s) this PR fixes:

Fixes https://github.com/halo-dev/halo/issues/6718

#### Special notes for your reviewer:

#### Does this PR introduce a user-facing change?

```release-note
None
```
---
 .../app/core/user/service/SignUpData.java     | 48 +++++++++++++++++++
 .../preauth/PreAuthSignUpEndpoint.java        |  3 +-
 .../resources/config/i18n/messages.properties |  4 +-
 .../config/i18n/messages_zh.properties        |  4 +-
 .../src/main/resources/templates/signup.html  | 12 ++---
 5 files changed, 61 insertions(+), 10 deletions(-)

diff --git a/application/src/main/java/run/halo/app/core/user/service/SignUpData.java b/application/src/main/java/run/halo/app/core/user/service/SignUpData.java
index d609fa0cc8..0b5c3cba88 100644
--- a/application/src/main/java/run/halo/app/core/user/service/SignUpData.java
+++ b/application/src/main/java/run/halo/app/core/user/service/SignUpData.java
@@ -1,7 +1,16 @@
 package run.halo.app.core.user.service;
 
+import jakarta.validation.Constraint;
+import jakarta.validation.ConstraintValidator;
+import jakarta.validation.ConstraintValidatorContext;
+import jakarta.validation.Payload;
 import jakarta.validation.constraints.Email;
 import jakarta.validation.constraints.NotBlank;
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+import java.util.Objects;
 import java.util.Optional;
 import lombok.Data;
 import org.springframework.util.MultiValueMap;
@@ -14,6 +23,7 @@
  * @since 2.20.0
  */
 @Data
+@SignUpData.SignUpDataConstraint
 public class SignUpData {
 
     @NotBlank
@@ -30,6 +40,9 @@ public class SignUpData {
     @NotBlank
     private String password;
 
+    @NotBlank
+    private String confirmPassword;
+
     public static SignUpData of(MultiValueMap<String, String> formData) {
         var form = new SignUpData();
         Optional.ofNullable(formData.getFirst("username"))
@@ -52,6 +65,41 @@ public static SignUpData of(MultiValueMap<String, String> formData) {
             .filter(StringUtils::hasText)
             .ifPresent(form::setEmailCode);
 
+        Optional.ofNullable(formData.getFirst("confirmPassword"))
+            .filter(StringUtils::hasText)
+            .ifPresent(form::setConfirmPassword);
+
         return form;
     }
+
+    @Target({ElementType.TYPE})
+    @Retention(RetentionPolicy.RUNTIME)
+    @Constraint(validatedBy = {SignUpDataConstraintValidator.class})
+    public @interface SignUpDataConstraint {
+
+        String message() default "";
+
+        Class<?>[] groups() default { };
+
+        Class<? extends Payload>[] payload() default { };
+
+    }
+
+    private static class SignUpDataConstraintValidator
+        implements ConstraintValidator<SignUpDataConstraint, SignUpData> {
+
+        @Override
+        public boolean isValid(SignUpData signUpData, ConstraintValidatorContext context) {
+            var isValid = Objects.equals(signUpData.getPassword(), signUpData.getConfirmPassword());
+            if (!isValid) {
+                context.disableDefaultConstraintViolation();
+                context.buildConstraintViolationWithTemplate(
+                        "{signup.error.confirm-password-not-match}"
+                    )
+                    .addPropertyNode("confirmPassword")
+                    .addConstraintViolation();
+            }
+            return isValid;
+        }
+    }
 }
diff --git a/application/src/main/java/run/halo/app/security/preauth/PreAuthSignUpEndpoint.java b/application/src/main/java/run/halo/app/security/preauth/PreAuthSignUpEndpoint.java
index 39c0bfc432..4566b03a84 100644
--- a/application/src/main/java/run/halo/app/security/preauth/PreAuthSignUpEndpoint.java
+++ b/application/src/main/java/run/halo/app/security/preauth/PreAuthSignUpEndpoint.java
@@ -103,8 +103,7 @@ RouterFunction<ServerResponse> preAuthSignUpEndpoints() {
                                         "emailCode",
                                         signUpData.getEmailCode(),
                                         true,
-                                        // TODO Refine i18n
-                                        new String[] {"signup.error.email-captcha.invalid"},
+                                        new String[] {"signup.error.email-code.invalid"},
                                         null,
                                         "Invalid Email Code"));
                                 }
diff --git a/application/src/main/resources/config/i18n/messages.properties b/application/src/main/resources/config/i18n/messages.properties
index 8a2e0dca03..d90b894f46 100644
--- a/application/src/main/resources/config/i18n/messages.properties
+++ b/application/src/main/resources/config/i18n/messages.properties
@@ -82,4 +82,6 @@ problemDetail.attachment.upload.fileSizeExceeded=Make sure the file size is less
 problemDetail.attachment.upload.fileTypeNotSupported=Unsupported upload of {0} type files.
 problemDetail.comment.waitingForApproval=Comment is awaiting approval.
 
-title.visibility.identification.private=(Private)
\ No newline at end of file
+title.visibility.identification.private=(Private)
+signup.error.confirm-password-not-match=The confirmation password does not match the password.
+signup.error.email-code.invalid=Invalid email code.
\ No newline at end of file
diff --git a/application/src/main/resources/config/i18n/messages_zh.properties b/application/src/main/resources/config/i18n/messages_zh.properties
index fa5699ea06..613e9f7c32 100644
--- a/application/src/main/resources/config/i18n/messages_zh.properties
+++ b/application/src/main/resources/config/i18n/messages_zh.properties
@@ -54,4 +54,6 @@ problemDetail.attachment.upload.fileSizeExceeded=最大支持上传 {0} 大小
 problemDetail.attachment.upload.fileTypeNotSupported=不支持上传 {0} 类型的文件。
 problemDetail.comment.waitingForApproval=评论审核中。
 
-title.visibility.identification.private=（私有）
\ No newline at end of file
+title.visibility.identification.private=（私有）
+signup.error.confirm-password-not-match=确认密码与密码不匹配。
+signup.error.email-code.invalid=邮箱验证码无效。
diff --git a/application/src/main/resources/templates/signup.html b/application/src/main/resources/templates/signup.html
index c1937a2d80..2276f5b701 100644
--- a/application/src/main/resources/templates/signup.html
+++ b/application/src/main/resources/templates/signup.html
@@ -141,13 +141,13 @@ <h1 class="form-title" th:text="#{title}"></h1>
                     <div class="form-item">
                         <label for="confirmPassword" th:text="#{form.confirmPassword.label}"></label>
                         <th:block
-                            th:replace="~{gateway_modules/input_fragments :: password(id = 'confirmPassword', name = null, required = 'true', minlength = 6, enableToggle = true)}"
+                            th:replace="~{gateway_modules/input_fragments :: password(id = 'confirmPassword', name = 'confirmPassword', required = 'true', minlength = 6, enableToggle = true)}"
                         ></th:block>
-                        <!-- <p -->
-                        <!--     class="alert alert-error" -->
-                        <!--     th:if="${#fields.hasErrors('confirmPassword')}" -->
-                        <!--     th:errors="*{confirmPassword}" -->
-                        <!-- ></p> -->
+                         <p
+                             class="alert alert-error"
+                             th:if="${#fields.hasErrors('confirmPassword')}"
+                             th:errors="*{confirmPassword}"
+                         ></p>
                     </div>
 
                     <div class="form-item">

From e77954313d7e3b23bff2e91004111e7ae4534a15 Mon Sep 17 00:00:00 2001
From: John Niang <johnniang@foxmail.com>
Date: Sun, 29 Sep 2024 18:19:47 +0800
Subject: [PATCH 060/185] Support binding OAuth2 user automatically (#6702)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/kind improvement
/area core
/milestone 2.20.x

#### What this PR does / why we need it:

This PR add support for binding OAuth2 user automatically. So we can remove the user-binding page.

Please note that those changes may break the OAuth2 and SocialLogin plugins.

#### Special notes for your reviewer:

Build OAuth2 plugin from <https://github.com/halo-sigs/plugin-oauth2/pull/64> or use [plugin-oauth2-1.0.4-SNAPSHOT.zip](https://github.com/user-attachments/files/17177592/plugin-oauth2-1.0.4-SNAPSHOT.zip) I built.

- Bind after logging in

1. Log in Halo with username and password method
2. Try to unbind OAuth2 user
3. Bind OAuth2 user again

- Initially bind without logging in

1. Go to login page
2. Log in with OAuth2 method and you will be redirected to login page
3. Log in with username and password method
4. See the result of binding

- Log in with OAuth2 method after binding

1. Go  to login page
2. Log in with OAuth2 method and you will be redirected to uc page directly

#### Does this PR introduce a user-facing change?

```release-note
支持自动绑定 OAuth2 登录用户
```
---
 .../app/core/extension/UserConnection.java    |  31 +----
 .../security/HttpBasicSecurityWebFilter.java  |  14 ++
 ...th2AuthorizationCodeSecurityWebFilter.java |  14 ++
 .../oauth2/HaloOAuth2AuthenticationToken.java |  96 +++++++++++++
 .../core/endpoint/console/UserEndpoint.java   |   3 +-
 .../user/service/UserConnectionService.java   |  35 +++++
 .../impl/UserConnectionServiceImpl.java       | 103 ++++++++++++++
 .../run/halo/app/infra/SchemeInitializer.java |  16 +++
 .../halo/app/infra/config/WebFluxConfig.java  |  49 +++----
 .../infra/config/WebServerSecurityConfig.java |  43 ++++--
 .../OAuth2UserAlreadyBoundException.java      |  23 ++++
 .../security/ExceptionSecurityConfigurer.java |  62 ++++++++-
 .../security/LoginHandlerEnhancerImpl.java    |  12 +-
 .../SecurityWebFiltersConfigurer.java         |  10 ++
 .../DefaultOAuth2LoginHandlerEnhancer.java    |  66 +++++++++
 .../oauth2/MapOAuth2AuthenticationFilter.java | 128 ++++++++++++++++++
 .../OAuth2AuthenticationTokenCache.java       |  41 ++++++
 .../oauth2/OAuth2LoginHandlerEnhancer.java    |  17 +++
 .../oauth2/OAuth2SecurityConfigurer.java      |  40 ++++++
 ...SessionOAuth2AuthenticationTokenCache.java |  42 ++++++
 .../TwoFactorAuthenticationEntryPoint.java    |  58 ++++++++
 .../TwoFactorAuthorizationManager.java        |  20 ---
 .../security/authorization/Attributes.java    |   6 -
 .../authorization/AttributesRecord.java       |  11 +-
 .../authorization/AuthorityUtils.java         |   2 +-
 .../authorization/DefaultRuleResolver.java    |   2 +-
 .../HaloOAuth2AuthenticationTokenMixin.java   |  31 +++++
 .../jackson2/HaloSecurityJackson2Module.java  |   9 +-
 .../TwoFactorAuthenticationMixin.java         |   4 +-
 .../dialect/HaloSpringSecurityDialect.java    |   5 +-
 .../resources/config/i18n/messages.properties |   2 +
 .../config/i18n/messages_zh.properties        |   3 +
 .../gateway_modules/login_fragments.html      |   5 +-
 .../login_fragments.properties                |   1 +
 .../login_fragments_en.properties             |   1 +
 .../halo/app/config/WebFluxConfigTest.java    |  39 ++++--
 .../authorization/AuthorityUtilsTest.java     |   2 +-
 .../DefaultRuleResolverTest.java              |   4 +-
 .../HaloSecurityJacksonModuleTest.java        |  22 ++-
 39 files changed, 936 insertions(+), 136 deletions(-)
 create mode 100644 api/src/main/java/run/halo/app/security/HttpBasicSecurityWebFilter.java
 create mode 100644 api/src/main/java/run/halo/app/security/OAuth2AuthorizationCodeSecurityWebFilter.java
 create mode 100644 api/src/main/java/run/halo/app/security/authentication/oauth2/HaloOAuth2AuthenticationToken.java
 create mode 100644 application/src/main/java/run/halo/app/core/user/service/UserConnectionService.java
 create mode 100644 application/src/main/java/run/halo/app/core/user/service/impl/UserConnectionServiceImpl.java
 create mode 100644 application/src/main/java/run/halo/app/infra/exception/OAuth2UserAlreadyBoundException.java
 create mode 100644 application/src/main/java/run/halo/app/security/authentication/oauth2/DefaultOAuth2LoginHandlerEnhancer.java
 create mode 100644 application/src/main/java/run/halo/app/security/authentication/oauth2/MapOAuth2AuthenticationFilter.java
 create mode 100644 application/src/main/java/run/halo/app/security/authentication/oauth2/OAuth2AuthenticationTokenCache.java
 create mode 100644 application/src/main/java/run/halo/app/security/authentication/oauth2/OAuth2LoginHandlerEnhancer.java
 create mode 100644 application/src/main/java/run/halo/app/security/authentication/oauth2/OAuth2SecurityConfigurer.java
 create mode 100644 application/src/main/java/run/halo/app/security/authentication/oauth2/WebSessionOAuth2AuthenticationTokenCache.java
 create mode 100644 application/src/main/java/run/halo/app/security/authentication/twofactor/TwoFactorAuthenticationEntryPoint.java
 delete mode 100644 application/src/main/java/run/halo/app/security/authentication/twofactor/TwoFactorAuthorizationManager.java
 create mode 100644 application/src/main/java/run/halo/app/security/jackson2/HaloOAuth2AuthenticationTokenMixin.java

diff --git a/api/src/main/java/run/halo/app/core/extension/UserConnection.java b/api/src/main/java/run/halo/app/core/extension/UserConnection.java
index 1b9fb728d6..8639ba6340 100644
--- a/api/src/main/java/run/halo/app/core/extension/UserConnection.java
+++ b/api/src/main/java/run/halo/app/core/extension/UserConnection.java
@@ -48,36 +48,9 @@ public static class UserConnectionSpec {
         private String providerUserId;
 
         /**
-         * The display name for the user's connection to the OAuth provider.
+         * The time when the user connection was last updated.
          */
-        @Schema(requiredMode = REQUIRED)
-        private String displayName;
-
-        /**
-         * The URL to the user's profile page on the OAuth provider.
-         * For example, the user's GitHub profile URL.
-         */
-        private String profileUrl;
-
-        /**
-         * The URL to the user's avatar image on the OAuth provider.
-         * For example, the user's GitHub avatar URL.
-         */
-        private String avatarUrl;
-
-        /**
-         * The access token provided by the OAuth provider.
-         */
-        @Schema(requiredMode = REQUIRED)
-        private String accessToken;
-
-        /**
-         * The refresh token provided by the OAuth provider (if applicable).
-         */
-        private String refreshToken;
-
-        private Instant expiresAt;
-
         private Instant updatedAt;
+
     }
 }
diff --git a/api/src/main/java/run/halo/app/security/HttpBasicSecurityWebFilter.java b/api/src/main/java/run/halo/app/security/HttpBasicSecurityWebFilter.java
new file mode 100644
index 0000000000..7043a10e48
--- /dev/null
+++ b/api/src/main/java/run/halo/app/security/HttpBasicSecurityWebFilter.java
@@ -0,0 +1,14 @@
+package run.halo.app.security;
+
+import org.pf4j.ExtensionPoint;
+import org.springframework.web.server.WebFilter;
+
+/**
+ * Security web filter for HTTP basic.
+ *
+ * @author johnniang
+ * @since 2.20.0
+ */
+public interface HttpBasicSecurityWebFilter extends WebFilter, ExtensionPoint {
+
+}
diff --git a/api/src/main/java/run/halo/app/security/OAuth2AuthorizationCodeSecurityWebFilter.java b/api/src/main/java/run/halo/app/security/OAuth2AuthorizationCodeSecurityWebFilter.java
new file mode 100644
index 0000000000..2aa0f28ebc
--- /dev/null
+++ b/api/src/main/java/run/halo/app/security/OAuth2AuthorizationCodeSecurityWebFilter.java
@@ -0,0 +1,14 @@
+package run.halo.app.security;
+
+import org.pf4j.ExtensionPoint;
+import org.springframework.web.server.WebFilter;
+
+/**
+ * Security web filter for OAuth2 authorization code.
+ *
+ * @author johnniang
+ * @since 2.20.0
+ */
+public interface OAuth2AuthorizationCodeSecurityWebFilter extends WebFilter, ExtensionPoint {
+
+}
diff --git a/api/src/main/java/run/halo/app/security/authentication/oauth2/HaloOAuth2AuthenticationToken.java b/api/src/main/java/run/halo/app/security/authentication/oauth2/HaloOAuth2AuthenticationToken.java
new file mode 100644
index 0000000000..fd344740c2
--- /dev/null
+++ b/api/src/main/java/run/halo/app/security/authentication/oauth2/HaloOAuth2AuthenticationToken.java
@@ -0,0 +1,96 @@
+package run.halo.app.security.authentication.oauth2;
+
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.Collections;
+import lombok.Getter;
+import org.springframework.security.authentication.AbstractAuthenticationToken;
+import org.springframework.security.core.GrantedAuthority;
+import org.springframework.security.core.userdetails.UserDetails;
+import org.springframework.security.oauth2.client.authentication.OAuth2AuthenticationToken;
+import org.springframework.security.oauth2.core.user.OAuth2User;
+
+/**
+ * Halo OAuth2 authentication token which combines {@link UserDetails} and original
+ * {@link OAuth2AuthenticationToken}.
+ *
+ * @author johnniang
+ * @since 2.20.0
+ */
+public class HaloOAuth2AuthenticationToken extends AbstractAuthenticationToken {
+
+    @Getter
+    private final UserDetails userDetails;
+
+    @Getter
+    private final OAuth2AuthenticationToken original;
+
+    /**
+     * Constructs an {@code HaloOAuth2AuthenticationToken} using {@link UserDetails} and original
+     * {@link OAuth2AuthenticationToken}.
+     *
+     * @param userDetails the {@link UserDetails}
+     * @param original the original {@link OAuth2AuthenticationToken}
+     */
+    public HaloOAuth2AuthenticationToken(UserDetails userDetails,
+        OAuth2AuthenticationToken original) {
+        super(combineAuthorities(userDetails, original));
+        this.userDetails = userDetails;
+        this.original = original;
+        setAuthenticated(true);
+    }
+
+    @Override
+    public String getName() {
+        return userDetails.getUsername();
+    }
+
+    @Override
+    public Collection<GrantedAuthority> getAuthorities() {
+        var originalAuthorities = super.getAuthorities();
+        var userDetailsAuthorities = getUserDetails().getAuthorities();
+        var authorities = new ArrayList<GrantedAuthority>(
+            originalAuthorities.size() + userDetailsAuthorities.size()
+        );
+        authorities.addAll(originalAuthorities);
+        authorities.addAll(userDetailsAuthorities);
+        return Collections.unmodifiableList(authorities);
+    }
+
+    @Override
+    public Object getCredentials() {
+        return "";
+    }
+
+    @Override
+    public OAuth2User getPrincipal() {
+        return original.getPrincipal();
+    }
+
+    /**
+     * Creates an authenticated {@link HaloOAuth2AuthenticationToken} using {@link UserDetails} and
+     * original {@link OAuth2AuthenticationToken}.
+     *
+     * @param userDetails the {@link UserDetails}
+     * @param original the original {@link OAuth2AuthenticationToken}
+     * @return an authenticated {@link HaloOAuth2AuthenticationToken}
+     */
+    public static HaloOAuth2AuthenticationToken authenticated(
+        UserDetails userDetails, OAuth2AuthenticationToken original
+    ) {
+        return new HaloOAuth2AuthenticationToken(userDetails, original);
+    }
+
+    private static Collection<? extends GrantedAuthority> combineAuthorities(
+        UserDetails userDetails, OAuth2AuthenticationToken original) {
+        var userDetailsAuthorities = userDetails.getAuthorities();
+        var originalAuthorities = original.getAuthorities();
+        var authorities = new ArrayList<GrantedAuthority>(
+            originalAuthorities.size() + userDetailsAuthorities.size()
+        );
+        authorities.addAll(originalAuthorities);
+        authorities.addAll(userDetailsAuthorities);
+        return Collections.unmodifiableList(authorities);
+    }
+
+}
diff --git a/application/src/main/java/run/halo/app/core/endpoint/console/UserEndpoint.java b/application/src/main/java/run/halo/app/core/endpoint/console/UserEndpoint.java
index 8a907e84c2..861390cb0a 100644
--- a/application/src/main/java/run/halo/app/core/endpoint/console/UserEndpoint.java
+++ b/application/src/main/java/run/halo/app/core/endpoint/console/UserEndpoint.java
@@ -88,7 +88,6 @@
 import run.halo.app.infra.exception.RateLimitExceededException;
 import run.halo.app.infra.exception.UnsatisfiedAttributeValueException;
 import run.halo.app.infra.utils.JsonUtils;
-import run.halo.app.security.authentication.twofactor.TwoFactorAuthentication;
 
 @Component
 @RequiredArgsConstructor
@@ -600,7 +599,7 @@ record ChangePasswordRequest(
     Mono<ServerResponse> me(ServerRequest request) {
         return ReactiveSecurityContextHolder.getContext()
             .map(SecurityContext::getAuthentication)
-            .filter(auth -> !(auth instanceof TwoFactorAuthentication))
+            .filter(Authentication::isAuthenticated)
             .flatMap(auth -> userService.getUser(auth.getName())
                 .flatMap(user -> {
                     var roleNames = authoritiesToRoles(auth.getAuthorities());
diff --git a/application/src/main/java/run/halo/app/core/user/service/UserConnectionService.java b/application/src/main/java/run/halo/app/core/user/service/UserConnectionService.java
new file mode 100644
index 0000000000..d695b07615
--- /dev/null
+++ b/application/src/main/java/run/halo/app/core/user/service/UserConnectionService.java
@@ -0,0 +1,35 @@
+package run.halo.app.core.user.service;
+
+import org.springframework.security.oauth2.core.user.OAuth2User;
+import reactor.core.publisher.Mono;
+import run.halo.app.core.extension.UserConnection;
+
+public interface UserConnectionService {
+
+    /**
+     * Create user connection.
+     *
+     * @param username Username
+     * @param registrationId Registration id
+     * @param oauth2User OAuth2 user
+     * @return Created user connection
+     */
+    Mono<UserConnection> createUserConnection(
+        String username,
+        String registrationId,
+        OAuth2User oauth2User
+    );
+
+    /**
+     * Update the user connection if present.
+     * If found, update updatedAt timestamp of the user connection.
+     *
+     * @param registrationId Registration id
+     * @param oauth2User OAuth2 user
+     * @return Updated user connection or empty
+     */
+    Mono<UserConnection> updateUserConnectionIfPresent(
+        String registrationId, OAuth2User oauth2User
+    );
+
+}
diff --git a/application/src/main/java/run/halo/app/core/user/service/impl/UserConnectionServiceImpl.java b/application/src/main/java/run/halo/app/core/user/service/impl/UserConnectionServiceImpl.java
new file mode 100644
index 0000000000..291fec60bf
--- /dev/null
+++ b/application/src/main/java/run/halo/app/core/user/service/impl/UserConnectionServiceImpl.java
@@ -0,0 +1,103 @@
+package run.halo.app.core.user.service.impl;
+
+import static run.halo.app.extension.ExtensionUtil.defaultSort;
+import static run.halo.app.extension.index.query.QueryFactory.and;
+import static run.halo.app.extension.index.query.QueryFactory.equal;
+
+import java.time.Clock;
+import java.util.HashMap;
+import java.util.Optional;
+import org.springframework.security.oauth2.core.user.OAuth2User;
+import org.springframework.stereotype.Service;
+import reactor.core.publisher.Mono;
+import run.halo.app.core.extension.UserConnection;
+import run.halo.app.core.extension.UserConnection.UserConnectionSpec;
+import run.halo.app.core.user.service.UserConnectionService;
+import run.halo.app.extension.ListOptions;
+import run.halo.app.extension.Metadata;
+import run.halo.app.extension.MetadataOperator;
+import run.halo.app.extension.ReactiveExtensionClient;
+import run.halo.app.infra.exception.OAuth2UserAlreadyBoundException;
+import run.halo.app.infra.utils.JsonUtils;
+
+@Service
+public class UserConnectionServiceImpl implements UserConnectionService {
+
+    private final ReactiveExtensionClient client;
+
+    private Clock clock = Clock.systemDefaultZone();
+
+    public UserConnectionServiceImpl(ReactiveExtensionClient client) {
+        this.client = client;
+    }
+
+    void setClock(Clock clock) {
+        this.clock = clock;
+    }
+
+    @Override
+    public Mono<UserConnection> createUserConnection(
+        String username,
+        String registrationId,
+        OAuth2User oauth2User
+    ) {
+        return getUserConnection(registrationId, username)
+            .flatMap(connection -> Mono.<UserConnection>error(
+                () -> new OAuth2UserAlreadyBoundException(connection))
+            )
+            .switchIfEmpty(Mono.defer(() -> {
+                var connection = new UserConnection();
+                connection.setMetadata(new Metadata());
+                var metadata = connection.getMetadata();
+                updateUserInfo(metadata, oauth2User);
+                metadata.setGenerateName(username + "-");
+                connection.setSpec(new UserConnectionSpec());
+                var spec = connection.getSpec();
+                spec.setUsername(username);
+                spec.setProviderUserId(oauth2User.getName());
+                spec.setRegistrationId(registrationId);
+                spec.setUpdatedAt(clock.instant());
+                return client.create(connection);
+            }));
+    }
+
+    private Mono<UserConnection> updateUserConnection(UserConnection connection,
+        OAuth2User oauth2User) {
+        connection.getSpec().setUpdatedAt(clock.instant());
+        updateUserInfo(connection.getMetadata(), oauth2User);
+        return client.update(connection);
+    }
+
+    private Mono<UserConnection> getUserConnection(String registrationId, String username) {
+        var listOptions = ListOptions.builder()
+            .fieldQuery(and(
+                equal("spec.registrationId", registrationId),
+                equal("spec.username", username)
+            ))
+            .build();
+        return client.listAll(UserConnection.class, listOptions, defaultSort()).next();
+    }
+
+    @Override
+    public Mono<UserConnection> updateUserConnectionIfPresent(String registrationId,
+        OAuth2User oauth2User) {
+        var listOptions = ListOptions.builder()
+            .fieldQuery(and(
+                equal("spec.registrationId", registrationId),
+                equal("spec.providerUserId", oauth2User.getName())
+            ))
+            .build();
+        return client.listAll(UserConnection.class, listOptions, defaultSort()).next()
+            .flatMap(connection -> updateUserConnection(connection, oauth2User));
+    }
+
+    private void updateUserInfo(MetadataOperator metadata, OAuth2User oauth2User) {
+        var annotations = Optional.ofNullable(metadata.getAnnotations())
+            .orElseGet(HashMap::new);
+        metadata.setAnnotations(annotations);
+        annotations.put(
+            "auth.halo.run/oauth2-user-info",
+            JsonUtils.objectToJson(oauth2User.getAttributes())
+        );
+    }
+}
diff --git a/application/src/main/java/run/halo/app/infra/SchemeInitializer.java b/application/src/main/java/run/halo/app/infra/SchemeInitializer.java
index 036fc1bc34..12e407be6a 100644
--- a/application/src/main/java/run/halo/app/infra/SchemeInitializer.java
+++ b/application/src/main/java/run/halo/app/infra/SchemeInitializer.java
@@ -630,6 +630,22 @@ public void onApplicationEvent(@NonNull ApplicationContextInitializedEvent event
                         .map(UserConnectionSpec::getUsername)
                         .orElse(null)
                 )));
+            is.add(new IndexSpec()
+                .setName("spec.registrationId")
+                .setIndexFunc(simpleAttribute(UserConnection.class,
+                    connection -> Optional.ofNullable(connection.getSpec())
+                        .map(UserConnectionSpec::getRegistrationId)
+                        .orElse(null)
+                ))
+            );
+            is.add(new IndexSpec()
+                .setName("spec.providerUserId")
+                .setIndexFunc(simpleAttribute(UserConnection.class,
+                    connection -> Optional.ofNullable(connection.getSpec())
+                        .map(UserConnectionSpec::getProviderUserId)
+                        .orElse(null)
+                ))
+            );
         });
 
         // security.halo.run
diff --git a/application/src/main/java/run/halo/app/infra/config/WebFluxConfig.java b/application/src/main/java/run/halo/app/infra/config/WebFluxConfig.java
index dcf576c46c..4acfecc70e 100644
--- a/application/src/main/java/run/halo/app/infra/config/WebFluxConfig.java
+++ b/application/src/main/java/run/halo/app/infra/config/WebFluxConfig.java
@@ -2,9 +2,7 @@
 
 import static org.springframework.util.ResourceUtils.FILE_URL_PREFIX;
 import static org.springframework.web.reactive.function.server.RequestPredicates.accept;
-import static org.springframework.web.reactive.function.server.RequestPredicates.method;
 import static org.springframework.web.reactive.function.server.RequestPredicates.path;
-import static org.springframework.web.reactive.function.server.RouterFunctions.route;
 import static run.halo.app.infra.utils.FileUtils.checkDirectoryTraversal;
 
 import com.fasterxml.jackson.databind.ObjectMapper;
@@ -18,7 +16,6 @@
 import org.springframework.context.annotation.Configuration;
 import org.springframework.core.annotation.Order;
 import org.springframework.http.CacheControl;
-import org.springframework.http.HttpMethod;
 import org.springframework.http.MediaType;
 import org.springframework.http.codec.CodecConfigurer;
 import org.springframework.http.codec.HttpMessageWriter;
@@ -30,15 +27,14 @@
 import org.springframework.web.reactive.config.ResourceHandlerRegistration;
 import org.springframework.web.reactive.config.ResourceHandlerRegistry;
 import org.springframework.web.reactive.config.WebFluxConfigurer;
-import org.springframework.web.reactive.function.BodyInserters;
 import org.springframework.web.reactive.function.server.RouterFunction;
+import org.springframework.web.reactive.function.server.RouterFunctions;
 import org.springframework.web.reactive.function.server.ServerResponse;
 import org.springframework.web.reactive.resource.EncodedResourceResolver;
 import org.springframework.web.reactive.resource.PathResourceResolver;
 import org.springframework.web.reactive.result.method.annotation.RequestMappingHandlerAdapter;
 import org.springframework.web.reactive.result.view.ViewResolutionResultHandler;
 import org.springframework.web.reactive.result.view.ViewResolver;
-import reactor.core.publisher.Mono;
 import run.halo.app.core.endpoint.WebSocketHandlerMapping;
 import run.halo.app.core.endpoint.console.CustomEndpointsBuilder;
 import run.halo.app.core.extension.endpoint.CustomEndpoint;
@@ -126,34 +122,33 @@ public WebSocketHandlerMapping webSocketHandlerMapping() {
     }
 
     @Bean
-    RouterFunction<ServerResponse> consoleIndexRedirection() {
-        var consolePredicate = method(HttpMethod.GET)
-            .and(path("/console/**").and(path("/console/assets/**").negate()))
+    RouterFunction<ServerResponse> consoleEndpoints() {
+        var consolePredicate = path("/console/**").and(path("/console/assets/**").negate())
             .and(accept(MediaType.TEXT_HTML))
             .and(new WebSocketRequestPredicate().negate());
-        return route(consolePredicate,
-            request -> this.serveIndex(haloProp.getConsole().getLocation() + "index.html"));
-    }
 
-    @Bean
-    RouterFunction<ServerResponse> ucIndexRedirect() {
-        var consolePredicate = method(HttpMethod.GET)
-            .and(path("/uc/**").and(path("/uc/assets/**").negate()))
+        var ucPredicate = path("/uc/**").and(path("/uc/assets/**").negate())
             .and(accept(MediaType.TEXT_HTML))
             .and(new WebSocketRequestPredicate().negate());
-        return route(consolePredicate,
-            request -> this.serveIndex(haloProp.getUc().getLocation() + "index.html"));
-    }
 
-    private Mono<ServerResponse> serveIndex(String indexLocation) {
-        var indexResource = applicationContext.getResource(indexLocation);
-        try {
-            return ServerResponse.ok()
-                .cacheControl(CacheControl.noStore())
-                .body(BodyInserters.fromResource(indexResource));
-        } catch (Throwable e) {
-            return Mono.error(e);
-        }
+        var consoleIndexHtml =
+            applicationContext.getResource(haloProp.getConsole().getLocation() + "index.html");
+
+        var ucIndexHtml =
+            applicationContext.getResource(haloProp.getUc().getLocation() + "index.html");
+
+        return RouterFunctions.route()
+            .GET(consolePredicate,
+                request -> ServerResponse.ok()
+                    .cacheControl(CacheControl.noStore())
+                    .bodyValue(consoleIndexHtml)
+            )
+            .GET(ucPredicate,
+                request -> ServerResponse.ok()
+                    .cacheControl(CacheControl.noStore())
+                    .bodyValue(ucIndexHtml)
+            )
+            .build();
     }
 
     @Override
diff --git a/application/src/main/java/run/halo/app/infra/config/WebServerSecurityConfig.java b/application/src/main/java/run/halo/app/infra/config/WebServerSecurityConfig.java
index 9de837d9c0..14925846fb 100644
--- a/application/src/main/java/run/halo/app/infra/config/WebServerSecurityConfig.java
+++ b/application/src/main/java/run/halo/app/infra/config/WebServerSecurityConfig.java
@@ -4,6 +4,7 @@
 import static org.springframework.security.web.server.authentication.ServerWebExchangeDelegatingReactiveAuthenticationManagerResolver.builder;
 import static org.springframework.security.web.server.util.matcher.ServerWebExchangeMatchers.pathMatchers;
 
+import java.util.Collections;
 import java.util.concurrent.ConcurrentHashMap;
 import lombok.RequiredArgsConstructor;
 import org.springframework.beans.factory.ObjectProvider;
@@ -12,17 +13,24 @@
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.http.HttpMethod;
+import org.springframework.http.MediaType;
+import org.springframework.security.authorization.AuthorizationDecision;
 import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity;
 import org.springframework.security.config.web.server.ServerHttpSecurity;
+import org.springframework.security.core.Authentication;
 import org.springframework.security.crypto.factory.PasswordEncoderFactories;
 import org.springframework.security.crypto.password.PasswordEncoder;
 import org.springframework.security.web.server.SecurityWebFilterChain;
 import org.springframework.security.web.server.context.ServerSecurityContextRepository;
 import org.springframework.security.web.server.context.WebSessionServerSecurityContextRepository;
 import org.springframework.security.web.server.util.matcher.AndServerWebExchangeMatcher;
+import org.springframework.security.web.server.util.matcher.MediaTypeServerWebExchangeMatcher;
 import org.springframework.security.web.server.util.matcher.NegatedServerWebExchangeMatcher;
+import org.springframework.security.web.server.util.matcher.ServerWebExchangeMatcher;
+import org.springframework.security.web.server.util.matcher.ServerWebExchangeMatchers;
 import org.springframework.session.MapSession;
 import org.springframework.session.config.annotation.web.server.EnableSpringWebSession;
+import reactor.core.publisher.Mono;
 import run.halo.app.core.user.service.RoleService;
 import run.halo.app.core.user.service.UserService;
 import run.halo.app.extension.ReactiveExtensionClient;
@@ -34,7 +42,7 @@
 import run.halo.app.security.authentication.impl.RsaKeyService;
 import run.halo.app.security.authentication.pat.PatAuthenticationManager;
 import run.halo.app.security.authentication.pat.PatServerWebExchangeMatcher;
-import run.halo.app.security.authentication.twofactor.TwoFactorAuthorizationManager;
+import run.halo.app.security.authorization.AuthorityUtils;
 import run.halo.app.security.authorization.RequestInfoAuthorizationManager;
 import run.halo.app.security.session.InMemoryReactiveIndexedSessionRepository;
 import run.halo.app.security.session.ReactiveIndexedSessionRepository;
@@ -63,8 +71,6 @@ SecurityWebFilterChain filterChain(ServerHttpSecurity http,
         var staticResourcesMatcher = pathMatchers(HttpMethod.GET,
             "/themes/{themeName}/assets/{*resourcePaths}",
             "/plugins/{pluginName}/assets/**",
-            "/console/**",
-            "/uc/**",
             "/upload/**",
             "/webjars/**",
             "/js/**",
@@ -80,15 +86,26 @@ SecurityWebFilterChain filterChain(ServerHttpSecurity http,
             .authorizeExchange(spec -> spec.pathMatchers(
                     "/api/**",
                     "/apis/**",
-                    "/oauth2/**",
                     "/actuator/**"
+                ).access(new RequestInfoAuthorizationManager(roleService))
+                .pathMatchers(
+                    "/login/**",
+                    "/challenges/**",
+                    "/password-reset/**",
+                    "/signup",
+                    "/logout"
+                ).permitAll()
+                .pathMatchers("/console/**", "/uc/**").authenticated()
+                .matchers(createHtmlMatcher()).access((authentication, context) ->
+                    // we only need to check the authentication is authenticated
+                    // because we treat anonymous user as authenticated
+                    authentication.map(Authentication::isAuthenticated)
+                        .map(AuthorizationDecision::new)
+                        .switchIfEmpty(Mono.fromSupplier(() -> new AuthorizationDecision(false)))
                 )
-                .access(new RequestInfoAuthorizationManager(roleService))
-                .pathMatchers("/challenges/two-factor/**")
-                .access(new TwoFactorAuthorizationManager())
                 .anyExchange().permitAll())
             .anonymous(spec -> {
-                spec.authorities(AnonymousUserConst.Role);
+                spec.authorities(AuthorityUtils.ROLE_PREFIX + AnonymousUserConst.Role);
                 spec.principal(AnonymousUserConst.PRINCIPAL);
             })
             .securityContextRepository(securityContextRepository)
@@ -158,4 +175,14 @@ CryptoService cryptoService(HaloProperties haloProperties) {
         return new RsaKeyService(haloProperties.getWorkDir().resolve("keys"));
     }
 
+    private static ServerWebExchangeMatcher createHtmlMatcher() {
+        ServerWebExchangeMatcher get =
+            ServerWebExchangeMatchers.pathMatchers(HttpMethod.GET, "/**");
+        ServerWebExchangeMatcher notFavicon = new NegatedServerWebExchangeMatcher(
+            ServerWebExchangeMatchers.pathMatchers("/favicon.*"));
+        MediaTypeServerWebExchangeMatcher html =
+            new MediaTypeServerWebExchangeMatcher(MediaType.TEXT_HTML);
+        html.setIgnoredMediaTypes(Collections.singleton(MediaType.ALL));
+        return new AndServerWebExchangeMatcher(get, notFavicon, html);
+    }
 }
diff --git a/application/src/main/java/run/halo/app/infra/exception/OAuth2UserAlreadyBoundException.java b/application/src/main/java/run/halo/app/infra/exception/OAuth2UserAlreadyBoundException.java
new file mode 100644
index 0000000000..3c5cca3458
--- /dev/null
+++ b/application/src/main/java/run/halo/app/infra/exception/OAuth2UserAlreadyBoundException.java
@@ -0,0 +1,23 @@
+package run.halo.app.infra.exception;
+
+import org.springframework.web.server.ServerWebInputException;
+import run.halo.app.core.extension.UserConnection;
+
+/**
+ * An exception that the user has been bound to another OAuth2 user.
+ *
+ * @author johnniang
+ * @since 2.20.0
+ */
+public class OAuth2UserAlreadyBoundException extends ServerWebInputException {
+
+    public OAuth2UserAlreadyBoundException(UserConnection connection) {
+        super("The user has been bound to another account", null, null, null, new Object[] {
+            connection.getSpec().getUsername(),
+            connection.getSpec().getProviderUserId(),
+            connection.getSpec().getRegistrationId(),
+            connection.getSpec().getUpdatedAt()
+        });
+    }
+
+}
diff --git a/application/src/main/java/run/halo/app/security/ExceptionSecurityConfigurer.java b/application/src/main/java/run/halo/app/security/ExceptionSecurityConfigurer.java
index bdb5979e75..f3f9c1e03a 100644
--- a/application/src/main/java/run/halo/app/security/ExceptionSecurityConfigurer.java
+++ b/application/src/main/java/run/halo/app/security/ExceptionSecurityConfigurer.java
@@ -1,21 +1,73 @@
 package run.halo.app.security;
 
+import java.util.ArrayList;
+import org.springframework.context.MessageSource;
+import org.springframework.http.HttpStatus;
 import org.springframework.security.config.web.server.ServerHttpSecurity;
 import org.springframework.security.oauth2.server.resource.web.access.server.BearerTokenServerAccessDeniedHandler;
+import org.springframework.security.oauth2.server.resource.web.server.authentication.ServerBearerTokenAuthenticationConverter;
+import org.springframework.security.web.server.DelegatingServerAuthenticationEntryPoint;
+import org.springframework.security.web.server.authentication.AuthenticationConverterServerWebExchangeMatcher;
+import org.springframework.security.web.server.authorization.HttpStatusServerAccessDeniedHandler;
+import org.springframework.security.web.server.authorization.ServerWebExchangeDelegatingServerAccessDeniedHandler;
+import org.springframework.security.web.server.util.matcher.ServerWebExchangeMatcher;
+import org.springframework.security.web.server.util.matcher.ServerWebExchangeMatchers;
 import org.springframework.stereotype.Component;
+import org.springframework.web.reactive.function.server.ServerResponse;
 import run.halo.app.security.authentication.SecurityConfigurer;
+import run.halo.app.security.authentication.twofactor.TwoFactorAuthenticationEntryPoint;
 
 @Component
 public class ExceptionSecurityConfigurer implements SecurityConfigurer {
 
+    private final MessageSource messageSource;
+
+    private final ServerResponse.Context context;
+
+    public ExceptionSecurityConfigurer(MessageSource messageSource,
+        ServerResponse.Context context) {
+        this.messageSource = messageSource;
+        this.context = context;
+    }
+
     @Override
     public void configure(ServerHttpSecurity http) {
         http.exceptionHandling(exception -> {
-            var accessDeniedHandler = new BearerTokenServerAccessDeniedHandler();
-            var entryPoint = new DefaultServerAuthenticationEntryPoint();
-            exception
-                .authenticationEntryPoint(entryPoint)
-                .accessDeniedHandler(accessDeniedHandler);
+            var accessDeniedHandlers =
+                new ArrayList<ServerWebExchangeDelegatingServerAccessDeniedHandler.DelegateEntry>(
+                    2
+                );
+            accessDeniedHandlers.add(
+                new ServerWebExchangeDelegatingServerAccessDeniedHandler.DelegateEntry(
+                    new AuthenticationConverterServerWebExchangeMatcher(
+                        new ServerBearerTokenAuthenticationConverter()
+                    ),
+                    new BearerTokenServerAccessDeniedHandler()
+                ));
+            accessDeniedHandlers.add(
+                new ServerWebExchangeDelegatingServerAccessDeniedHandler.DelegateEntry(
+                    ServerWebExchangeMatchers.anyExchange(),
+                    new HttpStatusServerAccessDeniedHandler(HttpStatus.FORBIDDEN)
+                )
+            );
+
+            var entryPoints =
+                new ArrayList<DelegatingServerAuthenticationEntryPoint.DelegateEntry>(3);
+            entryPoints.add(new DelegatingServerAuthenticationEntryPoint.DelegateEntry(
+                TwoFactorAuthenticationEntryPoint.MATCHER,
+                new TwoFactorAuthenticationEntryPoint(messageSource, context)
+            ));
+            entryPoints.add(new DelegatingServerAuthenticationEntryPoint.DelegateEntry(
+                exchange -> ServerWebExchangeMatcher.MatchResult.match(),
+                new DefaultServerAuthenticationEntryPoint()
+            ));
+
+            exception.authenticationEntryPoint(
+                    new DelegatingServerAuthenticationEntryPoint(entryPoints)
+                )
+                .accessDeniedHandler(
+                    new ServerWebExchangeDelegatingServerAccessDeniedHandler(accessDeniedHandlers)
+                );
         });
     }
 
diff --git a/application/src/main/java/run/halo/app/security/LoginHandlerEnhancerImpl.java b/application/src/main/java/run/halo/app/security/LoginHandlerEnhancerImpl.java
index c4497927fe..b23ed667e5 100644
--- a/application/src/main/java/run/halo/app/security/LoginHandlerEnhancerImpl.java
+++ b/application/src/main/java/run/halo/app/security/LoginHandlerEnhancerImpl.java
@@ -6,6 +6,7 @@
 import org.springframework.stereotype.Component;
 import org.springframework.web.server.ServerWebExchange;
 import reactor.core.publisher.Mono;
+import run.halo.app.security.authentication.oauth2.OAuth2LoginHandlerEnhancer;
 import run.halo.app.security.authentication.rememberme.RememberMeRequestCache;
 import run.halo.app.security.authentication.rememberme.RememberMeServices;
 import run.halo.app.security.authentication.rememberme.WebSessionRememberMeRequestCache;
@@ -29,12 +30,17 @@ public class LoginHandlerEnhancerImpl implements LoginHandlerEnhancer {
     private final RememberMeRequestCache rememberMeRequestCache =
         new WebSessionRememberMeRequestCache();
 
+    private final OAuth2LoginHandlerEnhancer oauth2LoginHandlerEnhancer;
+
     @Override
     public Mono<Void> onLoginSuccess(ServerWebExchange exchange,
         Authentication successfulAuthentication) {
-        return rememberMeServices.loginSuccess(exchange, successfulAuthentication)
-            .then(deviceService.loginSuccess(exchange, successfulAuthentication))
-            .then(rememberMeRequestCache.removeRememberMe(exchange));
+        return Mono.when(
+            rememberMeServices.loginSuccess(exchange, successfulAuthentication),
+            deviceService.loginSuccess(exchange, successfulAuthentication),
+            rememberMeRequestCache.removeRememberMe(exchange),
+            oauth2LoginHandlerEnhancer.loginSuccess(exchange, successfulAuthentication)
+        );
     }
 
     @Override
diff --git a/application/src/main/java/run/halo/app/security/SecurityWebFiltersConfigurer.java b/application/src/main/java/run/halo/app/security/SecurityWebFiltersConfigurer.java
index daef125f6a..9559b5b037 100644
--- a/application/src/main/java/run/halo/app/security/SecurityWebFiltersConfigurer.java
+++ b/application/src/main/java/run/halo/app/security/SecurityWebFiltersConfigurer.java
@@ -4,7 +4,9 @@
 import static org.springframework.security.config.web.server.SecurityWebFiltersOrder.AUTHENTICATION;
 import static org.springframework.security.config.web.server.SecurityWebFiltersOrder.FIRST;
 import static org.springframework.security.config.web.server.SecurityWebFiltersOrder.FORM_LOGIN;
+import static org.springframework.security.config.web.server.SecurityWebFiltersOrder.HTTP_BASIC;
 import static org.springframework.security.config.web.server.SecurityWebFiltersOrder.LAST;
+import static org.springframework.security.config.web.server.SecurityWebFiltersOrder.OAUTH2_AUTHORIZATION_CODE;
 
 import lombok.Setter;
 import org.pf4j.ExtensionPoint;
@@ -35,6 +37,10 @@ public void configure(ServerHttpSecurity http) {
                 new SecurityWebFilterChainProxy(BeforeSecurityWebFilter.class),
                 FIRST
             )
+            .addFilterAt(
+                new SecurityWebFilterChainProxy(HttpBasicSecurityWebFilter.class),
+                HTTP_BASIC
+            )
             .addFilterAt(
                 new SecurityWebFilterChainProxy(FormLoginSecurityWebFilter.class),
                 FORM_LOGIN
@@ -47,6 +53,10 @@ public void configure(ServerHttpSecurity http) {
                 new SecurityWebFilterChainProxy(AnonymousAuthenticationSecurityWebFilter.class),
                 ANONYMOUS_AUTHENTICATION
             )
+            .addFilterAt(
+                new SecurityWebFilterChainProxy(OAuth2AuthorizationCodeSecurityWebFilter.class),
+                OAUTH2_AUTHORIZATION_CODE
+            )
             .addFilterAt(
                 new SecurityWebFilterChainProxy(AfterSecurityWebFilter.class),
                 LAST
diff --git a/application/src/main/java/run/halo/app/security/authentication/oauth2/DefaultOAuth2LoginHandlerEnhancer.java b/application/src/main/java/run/halo/app/security/authentication/oauth2/DefaultOAuth2LoginHandlerEnhancer.java
new file mode 100644
index 0000000000..40ca4bdbfa
--- /dev/null
+++ b/application/src/main/java/run/halo/app/security/authentication/oauth2/DefaultOAuth2LoginHandlerEnhancer.java
@@ -0,0 +1,66 @@
+package run.halo.app.security.authentication.oauth2;
+
+import lombok.Setter;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.security.authentication.AuthenticationTrustResolver;
+import org.springframework.security.authentication.AuthenticationTrustResolverImpl;
+import org.springframework.security.core.Authentication;
+import org.springframework.stereotype.Component;
+import org.springframework.web.server.ServerWebExchange;
+import reactor.core.publisher.Mono;
+import run.halo.app.core.user.service.UserConnectionService;
+
+/**
+ * Default implementation of {@link OAuth2LoginHandlerEnhancer}.
+ *
+ * @author johnniang
+ * @since 2.20.0
+ */
+@Slf4j
+@Component
+public class DefaultOAuth2LoginHandlerEnhancer implements OAuth2LoginHandlerEnhancer {
+
+    private final UserConnectionService connectionService;
+
+    @Setter
+    private OAuth2AuthenticationTokenCache oauth2TokenCache =
+        new WebSessionOAuth2AuthenticationTokenCache();
+
+    private final AuthenticationTrustResolver authenticationTrustResolver =
+        new AuthenticationTrustResolverImpl();
+
+    public DefaultOAuth2LoginHandlerEnhancer(UserConnectionService connectionService) {
+        this.connectionService = connectionService;
+    }
+
+    @Override
+    public Mono<Void> loginSuccess(ServerWebExchange exchange, Authentication authentication) {
+        if (!authenticationTrustResolver.isFullyAuthenticated(authentication)) {
+            // Should never happen
+            // Remove token directly if not fully authenticated
+            return oauth2TokenCache.removeToken(exchange).then();
+        }
+        return oauth2TokenCache.getToken(exchange)
+            .flatMap(oauth2Token -> {
+                var oauth2User = oauth2Token.getPrincipal();
+                var username = authentication.getName();
+                var registrationId = oauth2Token.getAuthorizedClientRegistrationId();
+                return connectionService.updateUserConnectionIfPresent(registrationId, oauth2User)
+                    .doOnNext(connection -> {
+                        if (log.isDebugEnabled()) {
+                            log.debug(
+                                "User connection already exists, skip creating. connection: [{}]",
+                                connection
+                            );
+                        }
+                    })
+                    .switchIfEmpty(Mono.defer(() -> connectionService.createUserConnection(
+                        username,
+                        registrationId,
+                        oauth2User
+                    )))
+                    .then(oauth2TokenCache.removeToken(exchange));
+            });
+    }
+
+}
diff --git a/application/src/main/java/run/halo/app/security/authentication/oauth2/MapOAuth2AuthenticationFilter.java b/application/src/main/java/run/halo/app/security/authentication/oauth2/MapOAuth2AuthenticationFilter.java
new file mode 100644
index 0000000000..e4e5ba64c0
--- /dev/null
+++ b/application/src/main/java/run/halo/app/security/authentication/oauth2/MapOAuth2AuthenticationFilter.java
@@ -0,0 +1,128 @@
+package run.halo.app.security.authentication.oauth2;
+
+import static run.halo.app.security.authentication.oauth2.HaloOAuth2AuthenticationToken.authenticated;
+
+import java.net.URI;
+import lombok.Setter;
+import org.springframework.security.authentication.AuthenticationTrustResolver;
+import org.springframework.security.authentication.AuthenticationTrustResolverImpl;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.context.ReactiveSecurityContextHolder;
+import org.springframework.security.core.context.SecurityContext;
+import org.springframework.security.core.context.SecurityContextImpl;
+import org.springframework.security.core.userdetails.ReactiveUserDetailsService;
+import org.springframework.security.oauth2.client.authentication.OAuth2AuthenticationToken;
+import org.springframework.security.web.server.DefaultServerRedirectStrategy;
+import org.springframework.security.web.server.ServerRedirectStrategy;
+import org.springframework.security.web.server.WebFilterExchange;
+import org.springframework.security.web.server.authentication.logout.SecurityContextServerLogoutHandler;
+import org.springframework.security.web.server.authentication.logout.ServerLogoutHandler;
+import org.springframework.security.web.server.context.ServerSecurityContextRepository;
+import org.springframework.web.server.ServerWebExchange;
+import org.springframework.web.server.WebFilter;
+import org.springframework.web.server.WebFilterChain;
+import reactor.core.publisher.Mono;
+import run.halo.app.core.user.service.UserConnectionService;
+
+/**
+ * A filter to map OAuth2 authentication to authenticated user.
+ *
+ * @author johnniang
+ * @since 2.20.0
+ */
+class MapOAuth2AuthenticationFilter implements WebFilter {
+
+    private static final String PRE_AUTHENTICATION =
+        MapOAuth2AuthenticationFilter.class.getName() + ".PRE_AUTHENTICATION";
+
+    private final UserConnectionService connectionService;
+
+    private final ServerSecurityContextRepository securityContextRepository;
+
+    @Setter
+    private OAuth2AuthenticationTokenCache authenticationCache =
+        new WebSessionOAuth2AuthenticationTokenCache();
+
+    private final ReactiveUserDetailsService userDetailsService;
+
+    private final ServerLogoutHandler logoutHandler;
+
+    private final ServerRedirectStrategy redirectStrategy = new DefaultServerRedirectStrategy();
+
+    @Setter
+    private AuthenticationTrustResolver authenticationTrustResolver
+        = new AuthenticationTrustResolverImpl();
+
+    public MapOAuth2AuthenticationFilter(
+        ServerSecurityContextRepository securityContextRepository,
+        UserConnectionService connectionService,
+        ReactiveUserDetailsService userDetailsService) {
+        this.connectionService = connectionService;
+        this.securityContextRepository = securityContextRepository;
+        this.userDetailsService = userDetailsService;
+        var logoutHandler = new SecurityContextServerLogoutHandler();
+        logoutHandler.setSecurityContextRepository(securityContextRepository);
+        this.logoutHandler = logoutHandler;
+    }
+
+    @Override
+    public Mono<Void> filter(ServerWebExchange exchange, WebFilterChain chain) {
+        return ReactiveSecurityContextHolder.getContext()
+            .map(SecurityContext::getAuthentication)
+            .filter(authenticationTrustResolver::isAuthenticated)
+            .doOnNext(
+                // cache the pre-authentication
+                authentication -> exchange.getAttributes().put(PRE_AUTHENTICATION, authentication)
+            )
+            .then(chain.filter(exchange))
+            .then(Mono.defer(() -> ReactiveSecurityContextHolder.getContext()
+                .map(SecurityContext::getAuthentication)
+                .filter(OAuth2AuthenticationToken.class::isInstance)
+                .cast(OAuth2AuthenticationToken.class)
+                .flatMap(oauth2Token -> {
+                    var registrationId = oauth2Token.getAuthorizedClientRegistrationId();
+                    var oauth2User = oauth2Token.getPrincipal();
+                    // check the connection
+                    return connectionService.updateUserConnectionIfPresent(
+                            registrationId, oauth2User
+                        )
+                        .switchIfEmpty(Mono.defer(() -> {
+                            var preAuthenticationObject = exchange.getAttribute(PRE_AUTHENTICATION);
+                            if (preAuthenticationObject instanceof Authentication preAuth
+                                && authenticationTrustResolver.isAuthenticated(preAuth)) {
+                                // check the authentication again
+                                // try to bind the user automatically
+                                return connectionService.createUserConnection(
+                                    preAuth.getName(), registrationId, oauth2User
+                                );
+                            }
+                            // save the OAuth2Authentication into session
+                            return authenticationCache.saveToken(exchange, oauth2Token)
+                                .then(Mono.defer(() -> {
+                                    var webFilterExchange = new WebFilterExchange(exchange, chain);
+                                    // clear the security context
+                                    return logoutHandler.logout(webFilterExchange, oauth2Token);
+                                }))
+                                .then(Mono.defer(() -> redirectStrategy.sendRedirect(exchange,
+                                    URI.create("/login?oauth2_bind")
+                                )))
+                                // skip handling
+                                .then(Mono.empty());
+                        }))
+                        // user bound and remap the authentication
+                        .flatMap(connection ->
+                            userDetailsService.findByUsername(connection.getSpec().getUsername())
+                        )
+                        .map(userDetails -> authenticated(userDetails, oauth2Token))
+                        .flatMap(haloOAuth2Token -> {
+                            var securityContext = new SecurityContextImpl(haloOAuth2Token);
+                            return securityContextRepository.save(exchange, securityContext);
+                            // because this happens after the filter, there is no need to
+                            // write SecurityContext to the context
+                        });
+                })
+                .then())
+            );
+    }
+
+}
diff --git a/application/src/main/java/run/halo/app/security/authentication/oauth2/OAuth2AuthenticationTokenCache.java b/application/src/main/java/run/halo/app/security/authentication/oauth2/OAuth2AuthenticationTokenCache.java
new file mode 100644
index 0000000000..9c2bf964bd
--- /dev/null
+++ b/application/src/main/java/run/halo/app/security/authentication/oauth2/OAuth2AuthenticationTokenCache.java
@@ -0,0 +1,41 @@
+package run.halo.app.security.authentication.oauth2;
+
+import org.springframework.security.oauth2.client.authentication.OAuth2AuthenticationToken;
+import org.springframework.web.server.ServerWebExchange;
+import reactor.core.publisher.Mono;
+
+/**
+ * OAuth2 authentication token cache. Saving OAuth2AuthenticationToken is mainly for further binding
+ * to Halo user.
+ *
+ * @author johnniang
+ * @since 2.20.0
+ */
+public interface OAuth2AuthenticationTokenCache {
+
+    /**
+     * Save OAuth2AuthenticationToken into cache.
+     *
+     * @param exchange Server web exchange
+     * @param oauth2Token OAuth2AuthenticationToken
+     * @return empty
+     */
+    Mono<Void> saveToken(ServerWebExchange exchange, OAuth2AuthenticationToken oauth2Token);
+
+    /**
+     * Get OAuth2AuthenticationToken from cache.
+     *
+     * @param exchange Server web exchange
+     * @return an {@link OAuth2AuthenticationToken} if present, empty otherwise
+     */
+    Mono<OAuth2AuthenticationToken> getToken(ServerWebExchange exchange);
+
+    /**
+     * Remove OAuth2AuthenticationToken from cache.
+     *
+     * @param exchange Server web exchange
+     * @return empty
+     */
+    Mono<Void> removeToken(ServerWebExchange exchange);
+
+}
diff --git a/application/src/main/java/run/halo/app/security/authentication/oauth2/OAuth2LoginHandlerEnhancer.java b/application/src/main/java/run/halo/app/security/authentication/oauth2/OAuth2LoginHandlerEnhancer.java
new file mode 100644
index 0000000000..dbf9f8ec70
--- /dev/null
+++ b/application/src/main/java/run/halo/app/security/authentication/oauth2/OAuth2LoginHandlerEnhancer.java
@@ -0,0 +1,17 @@
+package run.halo.app.security.authentication.oauth2;
+
+import org.springframework.security.core.Authentication;
+import org.springframework.web.server.ServerWebExchange;
+import reactor.core.publisher.Mono;
+
+/**
+ * OAuth2 login handler enhancer.
+ *
+ * @author johnniang
+ * @since 2.20.0
+ */
+public interface OAuth2LoginHandlerEnhancer {
+
+    Mono<Void> loginSuccess(ServerWebExchange exchange, Authentication authentication);
+
+}
diff --git a/application/src/main/java/run/halo/app/security/authentication/oauth2/OAuth2SecurityConfigurer.java b/application/src/main/java/run/halo/app/security/authentication/oauth2/OAuth2SecurityConfigurer.java
new file mode 100644
index 0000000000..d4bf79f447
--- /dev/null
+++ b/application/src/main/java/run/halo/app/security/authentication/oauth2/OAuth2SecurityConfigurer.java
@@ -0,0 +1,40 @@
+package run.halo.app.security.authentication.oauth2;
+
+import org.springframework.security.config.web.server.SecurityWebFiltersOrder;
+import org.springframework.security.config.web.server.ServerHttpSecurity;
+import org.springframework.security.core.userdetails.ReactiveUserDetailsService;
+import org.springframework.security.web.server.context.ServerSecurityContextRepository;
+import org.springframework.stereotype.Component;
+import run.halo.app.core.user.service.UserConnectionService;
+import run.halo.app.security.authentication.SecurityConfigurer;
+
+/**
+ * OAuth2 security configurer.
+ *
+ * @author johnniang
+ * @since 2.20.0
+ */
+@Component
+class OAuth2SecurityConfigurer implements SecurityConfigurer {
+
+    private final ServerSecurityContextRepository securityContextRepository;
+
+    private final UserConnectionService connectionService;
+
+    private final ReactiveUserDetailsService userDetailsService;
+
+    public OAuth2SecurityConfigurer(ServerSecurityContextRepository securityContextRepository,
+        UserConnectionService connectionService, ReactiveUserDetailsService userDetailsService) {
+        this.securityContextRepository = securityContextRepository;
+        this.connectionService = connectionService;
+        this.userDetailsService = userDetailsService;
+    }
+
+    @Override
+    public void configure(ServerHttpSecurity http) {
+        var mapOAuth2Filter = new MapOAuth2AuthenticationFilter(
+            securityContextRepository, connectionService, userDetailsService
+        );
+        http.addFilterBefore(mapOAuth2Filter, SecurityWebFiltersOrder.AUTHENTICATION);
+    }
+}
diff --git a/application/src/main/java/run/halo/app/security/authentication/oauth2/WebSessionOAuth2AuthenticationTokenCache.java b/application/src/main/java/run/halo/app/security/authentication/oauth2/WebSessionOAuth2AuthenticationTokenCache.java
new file mode 100644
index 0000000000..44995a8f93
--- /dev/null
+++ b/application/src/main/java/run/halo/app/security/authentication/oauth2/WebSessionOAuth2AuthenticationTokenCache.java
@@ -0,0 +1,42 @@
+package run.halo.app.security.authentication.oauth2;
+
+import org.springframework.security.oauth2.client.authentication.OAuth2AuthenticationToken;
+import org.springframework.web.server.ServerWebExchange;
+import reactor.core.publisher.Mono;
+
+/**
+ * WebSession cache implementation of {@link OAuth2AuthenticationTokenCache}.
+ *
+ * @author johnniang
+ * @since 2.20.0
+ */
+public class WebSessionOAuth2AuthenticationTokenCache implements OAuth2AuthenticationTokenCache {
+
+    private static final String SESSION_ATTRIBUTE_KEY =
+        OAuth2AuthenticationTokenCache.class + ".OAUTH2_TOKEN";
+
+    @Override
+    public Mono<Void> saveToken(ServerWebExchange exchange, OAuth2AuthenticationToken oauth2Token) {
+        return exchange.getSession()
+            .doOnNext(session -> {
+                session.getAttributes().put(SESSION_ATTRIBUTE_KEY, oauth2Token);
+            })
+            .then();
+    }
+
+    @Override
+    public Mono<OAuth2AuthenticationToken> getToken(ServerWebExchange exchange) {
+        return exchange.getSession()
+            .mapNotNull(session -> session.getAttribute(SESSION_ATTRIBUTE_KEY))
+            .filter(OAuth2AuthenticationToken.class::isInstance)
+            .cast(OAuth2AuthenticationToken.class);
+    }
+
+    @Override
+    public Mono<Void> removeToken(ServerWebExchange exchange) {
+        return exchange.getSession()
+            .doOnNext(session -> session.getAttributes().remove(SESSION_ATTRIBUTE_KEY))
+            .then();
+    }
+
+}
diff --git a/application/src/main/java/run/halo/app/security/authentication/twofactor/TwoFactorAuthenticationEntryPoint.java b/application/src/main/java/run/halo/app/security/authentication/twofactor/TwoFactorAuthenticationEntryPoint.java
new file mode 100644
index 0000000000..b7af274a78
--- /dev/null
+++ b/application/src/main/java/run/halo/app/security/authentication/twofactor/TwoFactorAuthenticationEntryPoint.java
@@ -0,0 +1,58 @@
+package run.halo.app.security.authentication.twofactor;
+
+import java.net.URI;
+import org.springframework.context.MessageSource;
+import org.springframework.security.core.AuthenticationException;
+import org.springframework.security.web.server.ServerAuthenticationEntryPoint;
+import org.springframework.security.web.server.authentication.RedirectServerAuthenticationEntryPoint;
+import org.springframework.security.web.server.util.matcher.ServerWebExchangeMatcher;
+import org.springframework.web.reactive.function.server.ServerResponse;
+import org.springframework.web.server.ServerWebExchange;
+import reactor.core.publisher.Mono;
+import run.halo.app.infra.exception.Exceptions;
+
+public class TwoFactorAuthenticationEntryPoint implements ServerAuthenticationEntryPoint {
+
+    public static ServerWebExchangeMatcher MATCHER = exchange -> exchange.getPrincipal()
+        .filter(TwoFactorAuthentication.class::isInstance)
+        .flatMap(a -> ServerWebExchangeMatcher.MatchResult.match())
+        .switchIfEmpty(ServerWebExchangeMatcher.MatchResult.notMatch());
+
+    private static final String REDIRECT_LOCATION = "/challenges/two-factor/totp";
+
+    private final RedirectServerAuthenticationEntryPoint redirectEntryPoint =
+        new RedirectServerAuthenticationEntryPoint(REDIRECT_LOCATION);
+
+    private final MessageSource messageSource;
+
+    private final ServerResponse.Context context;
+
+    private static final ServerWebExchangeMatcher XHR_MATCHER = exchange -> {
+        if (exchange.getRequest().getHeaders().getOrEmpty("X-Requested-With")
+            .contains("XMLHttpRequest")) {
+            return ServerWebExchangeMatcher.MatchResult.match();
+        }
+        return ServerWebExchangeMatcher.MatchResult.notMatch();
+    };
+
+    public TwoFactorAuthenticationEntryPoint(MessageSource messageSource,
+        ServerResponse.Context context) {
+        this.messageSource = messageSource;
+        this.context = context;
+    }
+
+    @Override
+    public Mono<Void> commence(ServerWebExchange exchange, AuthenticationException ex) {
+        return XHR_MATCHER.matches(exchange)
+            .filter(ServerWebExchangeMatcher.MatchResult::isMatch)
+            .switchIfEmpty(redirectEntryPoint.commence(exchange, ex).then(Mono.empty()))
+            .flatMap(isXhr -> {
+                var errorResponse = Exceptions.createErrorResponse(
+                    new TwoFactorAuthRequiredException(URI.create(REDIRECT_LOCATION)),
+                    null, exchange, messageSource);
+                return ServerResponse.status(errorResponse.getStatusCode())
+                    .bodyValue(errorResponse.getBody())
+                    .flatMap(response -> response.writeTo(exchange, context));
+            });
+    }
+}
diff --git a/application/src/main/java/run/halo/app/security/authentication/twofactor/TwoFactorAuthorizationManager.java b/application/src/main/java/run/halo/app/security/authentication/twofactor/TwoFactorAuthorizationManager.java
deleted file mode 100644
index f61cb9390b..0000000000
--- a/application/src/main/java/run/halo/app/security/authentication/twofactor/TwoFactorAuthorizationManager.java
+++ /dev/null
@@ -1,20 +0,0 @@
-package run.halo.app.security.authentication.twofactor;
-
-import org.springframework.security.authorization.AuthorizationDecision;
-import org.springframework.security.authorization.ReactiveAuthorizationManager;
-import org.springframework.security.core.Authentication;
-import org.springframework.security.web.server.authorization.AuthorizationContext;
-import reactor.core.publisher.Mono;
-
-public class TwoFactorAuthorizationManager
-    implements ReactiveAuthorizationManager<AuthorizationContext> {
-
-    @Override
-    public Mono<AuthorizationDecision> check(Mono<Authentication> authentication,
-        AuthorizationContext context) {
-        return authentication.map(TwoFactorAuthentication.class::isInstance)
-            .defaultIfEmpty(false)
-            .map(AuthorizationDecision::new);
-    }
-
-}
diff --git a/application/src/main/java/run/halo/app/security/authorization/Attributes.java b/application/src/main/java/run/halo/app/security/authorization/Attributes.java
index a68317ba76..55cf3f3976 100644
--- a/application/src/main/java/run/halo/app/security/authorization/Attributes.java
+++ b/application/src/main/java/run/halo/app/security/authorization/Attributes.java
@@ -1,7 +1,5 @@
 package run.halo.app.security.authorization;
 
-import java.security.Principal;
-
 /**
  * Attributes is used by an Authorizer to get information about a request
  * that is used to make an authorization decision.
@@ -10,10 +8,6 @@
  * @since 2.0.0
  */
 public interface Attributes {
-    /**
-     * @return the UserDetails object to authorize
-     */
-    Principal getPrincipal();
 
     /**
      * @return the verb associated with API requests(this includes get, list,
diff --git a/application/src/main/java/run/halo/app/security/authorization/AttributesRecord.java b/application/src/main/java/run/halo/app/security/authorization/AttributesRecord.java
index 3fb6833671..af7eaf0637 100644
--- a/application/src/main/java/run/halo/app/security/authorization/AttributesRecord.java
+++ b/application/src/main/java/run/halo/app/security/authorization/AttributesRecord.java
@@ -1,23 +1,14 @@
 package run.halo.app.security.authorization;
 
-import java.security.Principal;
-
 /**
  * @author guqing
  * @since 2.0.0
  */
 public class AttributesRecord implements Attributes {
     private final RequestInfo requestInfo;
-    private final Principal principal;
 
-    public AttributesRecord(Principal principal, RequestInfo requestInfo) {
+    public AttributesRecord(RequestInfo requestInfo) {
         this.requestInfo = requestInfo;
-        this.principal = principal;
-    }
-
-    @Override
-    public Principal getPrincipal() {
-        return this.principal;
     }
 
     @Override
diff --git a/application/src/main/java/run/halo/app/security/authorization/AuthorityUtils.java b/application/src/main/java/run/halo/app/security/authorization/AuthorityUtils.java
index 64460ea9c2..75605e35f2 100644
--- a/application/src/main/java/run/halo/app/security/authorization/AuthorityUtils.java
+++ b/application/src/main/java/run/halo/app/security/authorization/AuthorityUtils.java
@@ -39,8 +39,8 @@ public static Set<String> authoritiesToRoles(
         Collection<? extends GrantedAuthority> authorities) {
         return authorities.stream()
             .map(GrantedAuthority::getAuthority)
+            .filter(authority -> StringUtils.startsWith(authority, ROLE_PREFIX))
             .map(authority -> {
-                authority = StringUtils.removeStart(authority, SCOPE_PREFIX);
                 authority = StringUtils.removeStart(authority, ROLE_PREFIX);
                 return authority;
             })
diff --git a/application/src/main/java/run/halo/app/security/authorization/DefaultRuleResolver.java b/application/src/main/java/run/halo/app/security/authorization/DefaultRuleResolver.java
index 0294d55de4..d13b774dc2 100644
--- a/application/src/main/java/run/halo/app/security/authorization/DefaultRuleResolver.java
+++ b/application/src/main/java/run/halo/app/security/authorization/DefaultRuleResolver.java
@@ -27,7 +27,7 @@ public DefaultRuleResolver(RoleService roleService) {
     public Mono<AuthorizingVisitor> visitRules(Authentication authentication,
         RequestInfo requestInfo) {
         var roleNames = AuthorityUtils.authoritiesToRoles(authentication.getAuthorities());
-        var record = new AttributesRecord(authentication, requestInfo);
+        var record = new AttributesRecord(requestInfo);
         var visitor = new AuthorizingVisitor(record);
 
         // If the request is an userspace scoped request,
diff --git a/application/src/main/java/run/halo/app/security/jackson2/HaloOAuth2AuthenticationTokenMixin.java b/application/src/main/java/run/halo/app/security/jackson2/HaloOAuth2AuthenticationTokenMixin.java
new file mode 100644
index 0000000000..eb6e807844
--- /dev/null
+++ b/application/src/main/java/run/halo/app/security/jackson2/HaloOAuth2AuthenticationTokenMixin.java
@@ -0,0 +1,31 @@
+package run.halo.app.security.jackson2;
+
+import com.fasterxml.jackson.annotation.JsonAutoDetect;
+import com.fasterxml.jackson.annotation.JsonCreator;
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import com.fasterxml.jackson.annotation.JsonTypeInfo;
+import org.springframework.security.core.userdetails.UserDetails;
+import org.springframework.security.oauth2.client.authentication.OAuth2AuthenticationToken;
+import run.halo.app.security.authentication.oauth2.HaloOAuth2AuthenticationToken;
+
+/**
+ * Mixin for {@link HaloOAuth2AuthenticationToken}.
+ *
+ * @author johnniang
+ * @since 2.20.0
+ */
+@JsonTypeInfo(use = JsonTypeInfo.Id.CLASS)
+@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY,
+    getterVisibility = JsonAutoDetect.Visibility.NONE,
+    isGetterVisibility = JsonAutoDetect.Visibility.NONE)
+@JsonIgnoreProperties(ignoreUnknown = true)
+abstract class HaloOAuth2AuthenticationTokenMixin {
+
+    @JsonCreator
+    HaloOAuth2AuthenticationTokenMixin(
+        @JsonProperty("userDetails") UserDetails userDetails,
+        @JsonProperty("original") OAuth2AuthenticationToken original
+    ) {
+    }
+}
diff --git a/application/src/main/java/run/halo/app/security/jackson2/HaloSecurityJackson2Module.java b/application/src/main/java/run/halo/app/security/jackson2/HaloSecurityJackson2Module.java
index ff3687f77f..5114386942 100644
--- a/application/src/main/java/run/halo/app/security/jackson2/HaloSecurityJackson2Module.java
+++ b/application/src/main/java/run/halo/app/security/jackson2/HaloSecurityJackson2Module.java
@@ -4,6 +4,7 @@
 import com.fasterxml.jackson.databind.module.SimpleModule;
 import org.springframework.security.jackson2.SecurityJackson2Modules;
 import run.halo.app.security.authentication.login.HaloUser;
+import run.halo.app.security.authentication.oauth2.HaloOAuth2AuthenticationToken;
 import run.halo.app.security.authentication.twofactor.TwoFactorAuthentication;
 
 /**
@@ -21,8 +22,12 @@ public HaloSecurityJackson2Module() {
     public void setupModule(SetupContext context) {
         SecurityJackson2Modules.enableDefaultTyping(context.getOwner());
         context.setMixInAnnotations(HaloUser.class, HaloUserMixin.class);
-        context.setMixInAnnotations(TwoFactorAuthentication.class,
-            TwoFactorAuthenticationMixin.class);
+        context.setMixInAnnotations(
+            TwoFactorAuthentication.class, TwoFactorAuthenticationMixin.class
+        );
+        context.setMixInAnnotations(
+            HaloOAuth2AuthenticationToken.class, HaloOAuth2AuthenticationTokenMixin.class
+        );
     }
 
 }
diff --git a/application/src/main/java/run/halo/app/security/jackson2/TwoFactorAuthenticationMixin.java b/application/src/main/java/run/halo/app/security/jackson2/TwoFactorAuthenticationMixin.java
index 71c1f737ea..d38ae936b9 100644
--- a/application/src/main/java/run/halo/app/security/jackson2/TwoFactorAuthenticationMixin.java
+++ b/application/src/main/java/run/halo/app/security/jackson2/TwoFactorAuthenticationMixin.java
@@ -20,6 +20,8 @@
 abstract class TwoFactorAuthenticationMixin {
 
     @JsonCreator
-    TwoFactorAuthenticationMixin(@JsonProperty("previous") Authentication previous) {
+    TwoFactorAuthenticationMixin(
+        @JsonProperty("previous") Authentication previous
+    ) {
     }
 }
diff --git a/application/src/main/java/run/halo/app/theme/dialect/HaloSpringSecurityDialect.java b/application/src/main/java/run/halo/app/theme/dialect/HaloSpringSecurityDialect.java
index 31f2b623a1..7c7a44082b 100644
--- a/application/src/main/java/run/halo/app/theme/dialect/HaloSpringSecurityDialect.java
+++ b/application/src/main/java/run/halo/app/theme/dialect/HaloSpringSecurityDialect.java
@@ -13,6 +13,7 @@
 import org.thymeleaf.extras.springsecurity6.dialect.SpringSecurityDialect;
 import org.thymeleaf.extras.springsecurity6.util.SpringSecurityContextUtils;
 import org.thymeleaf.extras.springsecurity6.util.SpringVersionUtils;
+import run.halo.app.security.authorization.AuthorityUtils;
 
 /**
  * HaloSpringSecurityDialect overwrites value of thymeleafSpringSecurityContext.
@@ -40,7 +41,9 @@ public void afterPropertiesSet() {
         // We have to build an anonymous authentication token here because the token won't be saved
         // into repository during anonymous authentication.
         var anonymousAuthentication =
-            new AnonymousAuthenticationToken("fallback", PRINCIPAL, createAuthorityList(Role));
+            new AnonymousAuthenticationToken(
+                "fallback", PRINCIPAL, createAuthorityList(AuthorityUtils.ROLE_PREFIX + Role)
+            );
         var anonymousSecurityContext = new SecurityContextImpl(anonymousAuthentication);
 
         final Function<ServerWebExchange, Object> secCtxInitializer =
diff --git a/application/src/main/resources/config/i18n/messages.properties b/application/src/main/resources/config/i18n/messages.properties
index d90b894f46..b053fc49c9 100644
--- a/application/src/main/resources/config/i18n/messages.properties
+++ b/application/src/main/resources/config/i18n/messages.properties
@@ -30,6 +30,7 @@ problemDetail.title.run.halo.app.infra.exception.PluginDependencyException$NotFo
 problemDetail.title.run.halo.app.infra.exception.PluginDependencyException$WrongVersionsException=Wrong Dependency Version
 problemDetail.title.run.halo.app.infra.exception.PluginDependentsNotDisabledException=Dependents Not Disabled
 problemDetail.title.run.halo.app.infra.exception.PluginDependenciesNotEnabledException=Dependencies Not Enabled
+problemDetail.title.run.halo.app.infra.exception.OAuth2UserAlreadyBoundException=User Already Bound Error
 problemDetail.title.internalServerError=Internal Server Error
 problemDetail.title.conflict=Conflict
 
@@ -55,6 +56,7 @@ problemDetail.run.halo.app.infra.exception.PluginDependencyException$NotFoundExc
 problemDetail.run.halo.app.infra.exception.PluginDependencyException$WrongVersionsException=Dependencies have wrong version: {0}.
 problemDetail.run.halo.app.infra.exception.PluginDependentsNotDisabledException=Plugin dependents {0} are not fully disabled, please disable them first.
 problemDetail.run.halo.app.infra.exception.PluginDependenciesNotEnabledException=Plugin dependencies {0} are not fully enabled, please enable them first.
+problemDetail.run.halo.app.infra.exception.OAuth2UserAlreadyBoundException=The user {0} has already been bound to another OAuth2 user, cannot automatically bind the current OAuth2 user.
 
 problemDetail.index.duplicateKey=The value of {0} already exists for unique index {1}, please rename it and retry.
 problemDetail.user.email.verify.maxAttempts=Too many verification attempts, please try again later.
diff --git a/application/src/main/resources/config/i18n/messages_zh.properties b/application/src/main/resources/config/i18n/messages_zh.properties
index 613e9f7c32..8655c96a08 100644
--- a/application/src/main/resources/config/i18n/messages_zh.properties
+++ b/application/src/main/resources/config/i18n/messages_zh.properties
@@ -18,6 +18,8 @@ problemDetail.title.run.halo.app.infra.exception.PluginDependencyException$NotFo
 problemDetail.title.run.halo.app.infra.exception.PluginDependencyException$WrongVersionsException=依赖版本错误
 problemDetail.title.run.halo.app.infra.exception.PluginDependentsNotDisabledException=子插件未禁用
 problemDetail.title.run.halo.app.infra.exception.PluginDependenciesNotEnabledException=依赖未启用
+problemDetail.title.run.halo.app.infra.exception.OAuth2UserAlreadyBoundException=用户已绑定错误
+
 problemDetail.title.internalServerError=服务器内部错误
 problemDetail.title.conflict=冲突
 
@@ -32,6 +34,7 @@ problemDetail.run.halo.app.infra.exception.PluginDependencyException$NotFoundExc
 problemDetail.run.halo.app.infra.exception.PluginDependencyException$WrongVersionsException=依赖版本有误：{0}。
 problemDetail.run.halo.app.infra.exception.PluginDependentsNotDisabledException=子插件 {0} 未完全禁用，请先禁用它们。
 problemDetail.run.halo.app.infra.exception.PluginDependenciesNotEnabledException=插件依赖 {0} 未完全启用，请先启用它们。
+problemDetail.run.halo.app.infra.exception.OAuth2UserAlreadyBoundException=用户 {0} 已经绑定到另一个 OAuth2 用户，无法自动绑定当前 OAuth2 用户。
 
 problemDetail.index.duplicateKey=唯一索引 {1} 中的值 {0} 已存在，请更名后重试。
 problemDetail.user.email.verify.maxAttempts=尝试次数过多，请稍候再试。
diff --git a/application/src/main/resources/templates/gateway_modules/login_fragments.html b/application/src/main/resources/templates/gateway_modules/login_fragments.html
index 87e8fe64ca..b9cdf7148b 100644
--- a/application/src/main/resources/templates/gateway_modules/login_fragments.html
+++ b/application/src/main/resources/templates/gateway_modules/login_fragments.html
@@ -19,7 +19,10 @@
         <strong th:text="#{messages.logoutSuccess}"></strong>
     </div>
     <div class="alert" role="alert" th:if="${param.signup.size() > 0}">
-        <strong th:text="#{messages.signupSuccess}"> </strong>
+        <strong th:text="#{messages.signupSuccess}"></strong>
+    </div>
+    <div class="alert" role="alert" th:if="${param.oauth2_bind.size() > 0}">
+        <strong th:text="#{messages.oauth2_bind}"></strong>
     </div>
 
     <div th:replace="~{__${fragmentTemplateName}__::form}"></div>
diff --git a/application/src/main/resources/templates/gateway_modules/login_fragments.properties b/application/src/main/resources/templates/gateway_modules/login_fragments.properties
index 5752dae82f..99ab4a3175 100644
--- a/application/src/main/resources/templates/gateway_modules/login_fragments.properties
+++ b/application/src/main/resources/templates/gateway_modules/login_fragments.properties
@@ -1,6 +1,7 @@
 messages.loginError=无效的凭证。
 messages.logoutSuccess=登出成功。
 messages.signupSuccess=恭喜！注册成功，请立即登录。
+messages.oauth2_bind=当前登录未绑定账号，请尝试通过其他方式登录，登录成功后会自动绑定账号。
 
 error.invalid-credential=无效的凭证。
 error.rate-limit-exceeded=请求过于频繁，请稍后再试。
diff --git a/application/src/main/resources/templates/gateway_modules/login_fragments_en.properties b/application/src/main/resources/templates/gateway_modules/login_fragments_en.properties
index 90daeec12b..dbe74bc626 100644
--- a/application/src/main/resources/templates/gateway_modules/login_fragments_en.properties
+++ b/application/src/main/resources/templates/gateway_modules/login_fragments_en.properties
@@ -1,5 +1,6 @@
 messages.loginError=Invalid credentials.
 messages.logoutSuccess=Logout successfully.
+messages.oauth2_bind=The current login is not bound to an account. Please try to log in through other methods. After successful login, the account will be automatically bound.
 messages.signupSuccess=Congratulations! Sign up successfully, please login now.
 
 error.invalid-credential=Invalid credentials.
diff --git a/application/src/test/java/run/halo/app/config/WebFluxConfigTest.java b/application/src/test/java/run/halo/app/config/WebFluxConfigTest.java
index 55b7fec6f1..dc94b34907 100644
--- a/application/src/test/java/run/halo/app/config/WebFluxConfigTest.java
+++ b/application/src/test/java/run/halo/app/config/WebFluxConfigTest.java
@@ -10,6 +10,8 @@
 import org.hamcrest.core.StringStartsWith;
 import org.junit.jupiter.api.Nested;
 import org.junit.jupiter.api.Test;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.ValueSource;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.boot.test.autoconfigure.web.reactive.AutoConfigureWebTestClient;
 import org.springframework.boot.test.context.SpringBootTest;
@@ -17,6 +19,7 @@
 import org.springframework.boot.test.web.server.LocalServerPort;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Import;
+import org.springframework.security.test.context.support.WithMockUser;
 import org.springframework.test.context.bean.override.mockito.MockitoSpyBean;
 import org.springframework.test.web.reactive.server.WebTestClient;
 import org.springframework.web.filter.reactive.ServerWebExchangeContextFilter;
@@ -121,23 +124,32 @@ public WebSocketHandler handler() {
     @Nested
     class ConsoleRequest {
 
+        @WithMockUser
+        @ParameterizedTest
+        @ValueSource(strings = {
+            "/console",
+            "/console/index",
+            "/console/index.html",
+            "/console/dashboard",
+            "/console/fake"
+        })
+        void shouldRequestConsoleIndex(String uri) {
+            webClient.get().uri(uri)
+                .exchange()
+                .expectStatus().isOk()
+                .expectBody(String.class).value(StringStartsWith.startsWith("console index"));
+        }
+
         @Test
-        void shouldRequestConsoleIndex() {
-            List.of(
-                    "/console",
-                    "/console/index",
-                    "/console/index.html",
-                    "/console/dashboard",
-                    "/console/fake"
-                )
-                .forEach(uri -> webClient.get().uri(uri)
-                    .exchange()
-                    .expectStatus().isOk()
-                    .expectBody(String.class).value(StringStartsWith.startsWith("console index"))
-                );
+        void shouldRedirectToLoginPageIfUnauthenticated() {
+            webClient.get().uri("/console")
+                .exchange()
+                .expectStatus().isFound()
+                .expectHeader().location("/login?authentication_required");
         }
 
         @Test
+        @WithMockUser
         void shouldRequestConsoleAssetsCorrectly() {
             webClient.get().uri("/console/assets/fake.txt")
                 .exchange()
@@ -146,6 +158,7 @@ void shouldRequestConsoleAssetsCorrectly() {
         }
 
         @Test
+        @WithMockUser
         void shouldResponseNotFoundWhenAssetsNotExist() {
             webClient.get().uri("/console/assets/not-found.txt")
                 .exchange()
diff --git a/application/src/test/java/run/halo/app/security/authorization/AuthorityUtilsTest.java b/application/src/test/java/run/halo/app/security/authorization/AuthorityUtilsTest.java
index f9266434b0..4ac5082d3d 100644
--- a/application/src/test/java/run/halo/app/security/authorization/AuthorityUtilsTest.java
+++ b/application/src/test/java/run/halo/app/security/authorization/AuthorityUtilsTest.java
@@ -29,7 +29,7 @@ void authoritiesToRolesTest() {
 
         var roles = authoritiesToRoles(authorities);
 
-        assertEquals(Set.of("admin", "owner", "manager", "faker", "system:read"), roles);
+        assertEquals(Set.of("admin", "owner", "manager"), roles);
     }
 
     @Test
diff --git a/application/src/test/java/run/halo/app/security/authorization/DefaultRuleResolverTest.java b/application/src/test/java/run/halo/app/security/authorization/DefaultRuleResolverTest.java
index bc91cd9d1a..9190fbafb6 100644
--- a/application/src/test/java/run/halo/app/security/authorization/DefaultRuleResolverTest.java
+++ b/application/src/test/java/run/halo/app/security/authorization/DefaultRuleResolverTest.java
@@ -37,7 +37,7 @@ class DefaultRuleResolverTest {
     void visitRules() {
         when(roleService.listDependenciesFlux(Set.of("ruleReadPost")))
             .thenReturn(Flux.just(mockRole()));
-        var fakeUser = new User("admin", "123456", createAuthorityList("ruleReadPost"));
+        var fakeUser = new User("admin", "123456", createAuthorityList("ROLE_ruleReadPost"));
         var authentication = authenticated(fakeUser, fakeUser.getPassword(),
             fakeUser.getAuthorities());
 
@@ -59,7 +59,7 @@ void visitRules() {
     void visitRulesForUserspaceScope() {
         when(roleService.listDependenciesFlux(Set.of("ruleReadPost")))
             .thenReturn(Flux.just(mockRole()));
-        var fakeUser = new User("admin", "123456", createAuthorityList("ruleReadPost"));
+        var fakeUser = new User("admin", "123456", createAuthorityList("ROLE_ruleReadPost"));
         var authentication =
             authenticated(fakeUser, fakeUser.getPassword(), fakeUser.getAuthorities());
         var cases = List.of(
diff --git a/application/src/test/java/run/halo/app/security/jackson2/HaloSecurityJacksonModuleTest.java b/application/src/test/java/run/halo/app/security/jackson2/HaloSecurityJacksonModuleTest.java
index 55804bbf7c..a548c25c69 100644
--- a/application/src/test/java/run/halo/app/security/jackson2/HaloSecurityJacksonModuleTest.java
+++ b/application/src/test/java/run/halo/app/security/jackson2/HaloSecurityJacksonModuleTest.java
@@ -4,6 +4,8 @@
 
 import com.fasterxml.jackson.core.JsonProcessingException;
 import com.fasterxml.jackson.databind.ObjectMapper;
+import java.util.List;
+import java.util.Map;
 import java.util.function.Function;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
@@ -14,7 +16,10 @@
 import org.springframework.security.core.context.SecurityContextImpl;
 import org.springframework.security.core.userdetails.User;
 import org.springframework.security.jackson2.SecurityJackson2Modules;
+import org.springframework.security.oauth2.client.authentication.OAuth2AuthenticationToken;
+import org.springframework.security.oauth2.core.user.DefaultOAuth2User;
 import run.halo.app.security.authentication.login.HaloUser;
+import run.halo.app.security.authentication.oauth2.HaloOAuth2AuthenticationToken;
 import run.halo.app.security.authentication.twofactor.TwoFactorAuthentication;
 
 class HaloSecurityJacksonModuleTest {
@@ -39,10 +44,21 @@ void codecHaloUserTest() throws JsonProcessingException {
 
     @Test
     void codecTwoFactorAuthenticationTokenTest() throws JsonProcessingException {
-        codecAssert(haloUser -> new TwoFactorAuthentication(
-            UsernamePasswordAuthenticationToken.authenticated(haloUser,
+        codecAssert(haloUser -> {
+            var authentication = UsernamePasswordAuthenticationToken.authenticated(haloUser,
                 haloUser.getPassword(),
-                haloUser.getAuthorities())));
+                haloUser.getAuthorities());
+            return new TwoFactorAuthentication(authentication);
+        });
+    }
+
+    @Test
+    void codecHaloOAuth2AuthenticationTokenTest() throws JsonProcessingException {
+        codecAssert(haloUser -> {
+            var oauth2User = new DefaultOAuth2User(List.of(), Map.of("name", "halo"), "name");
+            var oauth2Token = new OAuth2AuthenticationToken(oauth2User, List.of(), "github");
+            return new HaloOAuth2AuthenticationToken(haloUser, oauth2Token);
+        });
     }
 
     void codecAssert(Function<HaloUser, Authentication> authenticationConverter)

From 875a804a5645089dfd81e3b3bc643513e0036205 Mon Sep 17 00:00:00 2001
From: guqing <38999863+guqing@users.noreply.github.com>
Date: Sun, 29 Sep 2024 23:17:47 +0800
Subject: [PATCH 061/185] refactor: exclude thumbnail directories when backup
 (#6725)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?
/kind improvement
/area core
/milestone 2.20.x

#### What this PR does / why we need it:
备份时忽略缩略图目录

#### Which issue(s) this PR fixes:
Fixes #6717

#### Does this PR introduce a user-facing change?
```release-note
备份时忽略缩略图目录以减少文件大小
```
---
 .../java/run/halo/app/migration/impl/MigrationServiceImpl.java | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/application/src/main/java/run/halo/app/migration/impl/MigrationServiceImpl.java b/application/src/main/java/run/halo/app/migration/impl/MigrationServiceImpl.java
index 700bbd0766..9616382c5d 100644
--- a/application/src/main/java/run/halo/app/migration/impl/MigrationServiceImpl.java
+++ b/application/src/main/java/run/halo/app/migration/impl/MigrationServiceImpl.java
@@ -69,7 +69,8 @@ public class MigrationServiceImpl implements MigrationService, InitializingBean
         "mysql/**",
         "mysqlBackup/**",
         "**/.idea/**",
-        "**/.vscode/**"
+        "**/.vscode/**",
+        "attachments/thumbnails/**"
     );
 
     private final DateTimeFormatter dateTimeFormatter;

From 56804c9be11e6bcbc76c5603fd95dc7927ec7119 Mon Sep 17 00:00:00 2001
From: guqing <38999863+guqing@users.noreply.github.com>
Date: Mon, 30 Sep 2024 11:59:51 +0800
Subject: [PATCH 062/185] feat: add config option to allow disabling Basic
 authentication (#6689)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

 #### What type of PR is this?
/milestone 2.20.x
/area core
/kind improvement

#### What this PR does / why we need it:
允许通过 `halo.security.basic-auth.disabled=true` 配置来禁用 Basic Auth 认证

#### Which issue(s) this PR fixes:
Fixes #5408

#### Does this PR introduce a user-facing change?
```release-note
允许通过 `halo.security.basic-auth.disabled=true` 配置来禁用 Basic Auth 认证，在 2.20 版本生产环境下默认禁用了 Basic Auth
```
---
 .../halo/app/infra/config/WebServerSecurityConfig.java |  7 +++++--
 .../halo/app/infra/properties/SecurityProperties.java  | 10 ++++++++++
 application/src/main/resources/application-dev.yaml    |  3 +++
 3 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/application/src/main/java/run/halo/app/infra/config/WebServerSecurityConfig.java b/application/src/main/java/run/halo/app/infra/config/WebServerSecurityConfig.java
index 14925846fb..46e11007ad 100644
--- a/application/src/main/java/run/halo/app/infra/config/WebServerSecurityConfig.java
+++ b/application/src/main/java/run/halo/app/infra/config/WebServerSecurityConfig.java
@@ -1,6 +1,5 @@
 package run.halo.app.infra.config;
 
-import static org.springframework.security.config.Customizer.withDefaults;
 import static org.springframework.security.web.server.authentication.ServerWebExchangeDelegatingReactiveAuthenticationManagerResolver.builder;
 import static org.springframework.security.web.server.util.matcher.ServerWebExchangeMatchers.pathMatchers;
 
@@ -109,7 +108,11 @@ SecurityWebFilterChain filterChain(ServerHttpSecurity http,
                 spec.principal(AnonymousUserConst.PRINCIPAL);
             })
             .securityContextRepository(securityContextRepository)
-            .httpBasic(withDefaults())
+            .httpBasic(basic -> {
+                if (haloProperties.getSecurity().getBasicAuth().isDisabled()) {
+                    basic.disable();
+                }
+            })
             .oauth2ResourceServer(oauth2 -> {
                 var authManagerResolver = builder().add(
                         new PatServerWebExchangeMatcher(),
diff --git a/application/src/main/java/run/halo/app/infra/properties/SecurityProperties.java b/application/src/main/java/run/halo/app/infra/properties/SecurityProperties.java
index d67b49549a..e10d433853 100644
--- a/application/src/main/java/run/halo/app/infra/properties/SecurityProperties.java
+++ b/application/src/main/java/run/halo/app/infra/properties/SecurityProperties.java
@@ -18,6 +18,16 @@ public class SecurityProperties {
 
     private final TwoFactorAuthOptions twoFactorAuth = new TwoFactorAuthOptions();
 
+    private final BasicAuthOptions basicAuth = new BasicAuthOptions();
+
+    @Data
+    public static class BasicAuthOptions {
+        /**
+         * Whether basic authentication is disabled.
+         */
+        private boolean disabled = true;
+    }
+
     @Data
     public static class TwoFactorAuthOptions {
 
diff --git a/application/src/main/resources/application-dev.yaml b/application/src/main/resources/application-dev.yaml
index 4475d9699e..62a31d4a68 100644
--- a/application/src/main/resources/application-dev.yaml
+++ b/application/src/main/resources/application-dev.yaml
@@ -15,6 +15,9 @@ spring:
         use-last-modified: false
 
 halo:
+  security:
+    basic-auth:
+      disabled: false
   console:
     proxy:
       endpoint: http://localhost:3000/

From c80ceb460dcb29ee54565ad3f198628cf856ebc7 Mon Sep 17 00:00:00 2001
From: Ryan Wang <i@ryanc.cc>
Date: Mon, 30 Sep 2024 17:29:52 +0800
Subject: [PATCH 063/185] feat: add support for setting uniqueId in Dialog to
 prevent duplicate creation (#6737)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/area ui
/kind feature
/milestone 2.20.x

#### What this PR does / why we need it:

Dialog API 支持传入 uniqueId，以限制同一时间仅打开一个。

#### Which issue(s) this PR fixes:

Fixes https://github.com/halo-dev/halo/issues/6724

#### Does this PR introduce a user-facing change?

```release-note
Dialog API 支持传入 uniqueId，以限制同一时间仅打开一个。
```
---
 .../src/components/dialog/Dialog.stories.ts   | 10 ++--
 .../src/components/dialog/Dialog.vue          | 50 +++++++------------
 .../src/components/dialog/dialog-manager.ts   | 43 +++++++++++-----
 .../src/components/dialog/interface.ts        |  8 +--
 .../components/src/components/modal/Modal.vue |  1 +
 5 files changed, 56 insertions(+), 56 deletions(-)

diff --git a/ui/packages/components/src/components/dialog/Dialog.stories.ts b/ui/packages/components/src/components/dialog/Dialog.stories.ts
index e423c49dd7..e726a9afb6 100644
--- a/ui/packages/components/src/components/dialog/Dialog.stories.ts
+++ b/ui/packages/components/src/components/dialog/Dialog.stories.ts
@@ -1,6 +1,6 @@
 import type { Meta, StoryObj } from "@storybook/vue3";
 
-import { VDialog } from ".";
+import { Dialog, VDialog } from ".";
 import { VButton } from "../button";
 
 const meta: Meta<typeof VDialog> = {
@@ -12,8 +12,11 @@ const meta: Meta<typeof VDialog> = {
     height: 400,
     setup() {
       const showDialog = () => {
-        // @ts-ignore
-        args.visible = true;
+        Dialog.success({
+          title: "Hi",
+          // @ts-ignore
+          type: args.type,
+        });
       };
 
       return {
@@ -24,7 +27,6 @@ const meta: Meta<typeof VDialog> = {
     template: `
       <div style="height: 400px">
         <VButton @click="showDialog" >点击显示Dialog</VButton>
-        <VDialog v-bind="args" @onCancel="args.visible = false" />
       </div>
     `,
   }),
diff --git a/ui/packages/components/src/components/dialog/Dialog.vue b/ui/packages/components/src/components/dialog/Dialog.vue
index 94b2608fb2..8a5cb7cbbb 100644
--- a/ui/packages/components/src/components/dialog/Dialog.vue
+++ b/ui/packages/components/src/components/dialog/Dialog.vue
@@ -1,6 +1,5 @@
 <script lang="ts" setup>
-import type { Type as ButtonType } from "@/components/button/interface";
-import type { Type } from "@/components/dialog/interface";
+import type { DialogProps, Type } from "@/components/dialog/interface";
 import { markRaw, ref, type Component, type Raw } from "vue";
 import {
   IconCheckboxCircle,
@@ -12,36 +11,22 @@ import {
 import { VButton } from "../button";
 import { VModal } from "../modal";
 
-const props = withDefaults(
-  defineProps<{
-    type?: Type;
-    title?: string;
-    description?: string;
-    confirmText?: string;
-    confirmType?: ButtonType;
-    showCancel?: boolean;
-    cancelText?: string;
-    visible?: boolean;
-    onConfirm?: () => void;
-    onCancel?: () => void;
-  }>(),
-  {
-    type: "info",
-    title: "提示",
-    description: "",
-    confirmText: "确定",
-    confirmType: "primary",
-    showCancel: true,
-    cancelText: "取消",
-    visible: false,
-    onConfirm: () => {
-      return;
-    },
-    onCancel: () => {
-      return;
-    },
-  }
-);
+const props = withDefaults(defineProps<DialogProps>(), {
+  type: "info",
+  title: "提示",
+  description: "",
+  confirmText: "确定",
+  confirmType: "primary",
+  showCancel: true,
+  cancelText: "取消",
+  visible: false,
+  onConfirm: () => {
+    return;
+  },
+  onCancel: () => {
+    return;
+  },
+});
 
 const emit = defineEmits<{
   (event: "update:visible", visible: boolean): void;
@@ -102,6 +87,7 @@ const handleClose = () => {
     :visible="visible"
     :width="450"
     :layer-closable="true"
+    :data-unique-id="uniqueId"
     @close="handleCancel()"
   >
     <div class="flex justify-between items-start py-2 mb-2">
diff --git a/ui/packages/components/src/components/dialog/dialog-manager.ts b/ui/packages/components/src/components/dialog/dialog-manager.ts
index 37d2d740dd..5b90f7092c 100644
--- a/ui/packages/components/src/components/dialog/dialog-manager.ts
+++ b/ui/packages/components/src/components/dialog/dialog-manager.ts
@@ -19,17 +19,32 @@ const defaultProps: DialogProps = {
   visible: false,
 };
 
+const DIALOG_CONTAINER_CLASS = ".dialog-container";
+const MODAL_WRAPPER_CLASS = ".modal-wrapper";
+
+function getOrCreateContainer() {
+  let container = document.body.querySelector(DIALOG_CONTAINER_CLASS);
+  if (!container) {
+    container = document.createElement("div");
+    container.className = "dialog-container";
+    document.body.appendChild(container);
+  }
+  return container;
+}
+
 const dialog: DialogEntry = (userProps: DialogProps) => {
   const props = {
     ...defaultProps,
     ...userProps,
   };
 
-  let container = document.body.querySelector(".dialog-container");
-  if (!container) {
-    container = document.createElement("div");
-    container.className = "dialog-container";
-    document.body.appendChild(container);
+  const container = getOrCreateContainer();
+
+  if (
+    props.uniqueId &&
+    container.querySelector(`[data-unique-id="${props.uniqueId}"]`)
+  ) {
+    return;
   }
 
   const { vnode, container: hostContainer } = createVNodeComponent(
@@ -37,19 +52,21 @@ const dialog: DialogEntry = (userProps: DialogProps) => {
     props
   );
 
-  if (hostContainer.firstElementChild) {
+  hostContainer.firstElementChild &&
     container.appendChild(hostContainer.firstElementChild);
-  }
 
-  if (vnode.component?.props) {
-    vnode.component.props.visible = true;
-  }
+  vnode.component?.props && (vnode.component.props.visible = true);
 
   if (vnode?.props) {
-    // close emit
-
     vnode.props.onClose = () => {
-      container?.remove();
+      const modals = container.querySelectorAll(MODAL_WRAPPER_CLASS);
+
+      if (modals.length > 1) {
+        hostContainer.firstElementChild?.remove();
+      } else {
+        container.remove();
+      }
+
       render(null, hostContainer);
     };
   }
diff --git a/ui/packages/components/src/components/dialog/interface.ts b/ui/packages/components/src/components/dialog/interface.ts
index 9bfa31e05f..1da3989dfd 100644
--- a/ui/packages/components/src/components/dialog/interface.ts
+++ b/ui/packages/components/src/components/dialog/interface.ts
@@ -11,13 +11,7 @@ export interface DialogProps {
   showCancel?: boolean;
   confirmText?: string;
   cancelText?: string;
+  uniqueId?: string;
   onConfirm?: () => void;
   onCancel?: () => void;
 }
-
-type useDialogOptions = Omit<DialogProps, "visible" | "title"> & {
-  visible: boolean;
-  title: string;
-};
-
-export type useDialogUserOptions = Omit<useDialogOptions, "type" | "visible">;
diff --git a/ui/packages/components/src/components/modal/Modal.vue b/ui/packages/components/src/components/modal/Modal.vue
index 3c9ba85e90..019f1f496d 100644
--- a/ui/packages/components/src/components/modal/Modal.vue
+++ b/ui/packages/components/src/components/modal/Modal.vue
@@ -126,6 +126,7 @@ watch(
       class="modal-wrapper"
       role="dialog"
       tabindex="0"
+      v-bind="$attrs"
       @keyup.esc.stop="handleClose()"
     >
       <transition

From 8a9b954969a99e2a5ee2e1411573a8319c7e6137 Mon Sep 17 00:00:00 2001
From: John Niang <johnniang@foxmail.com>
Date: Mon, 30 Sep 2024 18:31:53 +0800
Subject: [PATCH 064/185] Support unbinding OAuth2User from Halo side (#6734)

#### What type of PR is this?

/kind feature
/area core
/milestone 2.20.x

#### What this PR does / why we need it:

This PR provides an endpoint for disconnecting user connection. After the user connection is disconnected, an event `UserConnectionDisconnectedEvent` will be published for plugins.

Now, OAuth2 plugin can simplify the authentication, binding  and unbinding logic, please see the AuthProvider configuration snippet below:

```diff
spec:
  authenticationUrl: /oauth2/authorization/github
- bindingUrl: /apis/api.plugin.halo.run/v1alpha1/plugins/plugin-oauth2/connect/github
+ bindingUrl: /oauth2/authorization/github
- unbindUrl: /apis/api.plugin.halo.run/v1alpha1/plugins/plugin-oauth2/disconnect/github
+ unbindUrl: /apis/uc.api.auth.halo.run/v1alpha1/user-connections/github/disconnect
```

Please note that, OAuth2 plugin can also define binding and unbinding endpoints by self.

#### Special notes for your reviewer:

OAuth2 test plugin:
[plugin-oauth2-1.0.4-SNAPSHOT.zip](https://github.com/user-attachments/files/17184215/plugin-oauth2-1.0.4-SNAPSHOT.zip)

#### Does this PR introduce a user-facing change?

```release-note
None
```
---
 .../user/UserConnectionDisconnectedEvent.java | 25 +++++++
 .../endpoint/uc/UserConnectionEndpoint.java   | 74 +++++++++++++++++++
 .../user/service/UserConnectionService.java   | 10 +++
 .../impl/UserConnectionServiceImpl.java       | 24 +++++-
 .../role-template-authenticated.yaml          |  3 +
 5 files changed, 135 insertions(+), 1 deletion(-)
 create mode 100644 api/src/main/java/run/halo/app/event/user/UserConnectionDisconnectedEvent.java
 create mode 100644 application/src/main/java/run/halo/app/core/endpoint/uc/UserConnectionEndpoint.java

diff --git a/api/src/main/java/run/halo/app/event/user/UserConnectionDisconnectedEvent.java b/api/src/main/java/run/halo/app/event/user/UserConnectionDisconnectedEvent.java
new file mode 100644
index 0000000000..65d3aa42a7
--- /dev/null
+++ b/api/src/main/java/run/halo/app/event/user/UserConnectionDisconnectedEvent.java
@@ -0,0 +1,25 @@
+package run.halo.app.event.user;
+
+import lombok.Getter;
+import org.springframework.context.ApplicationEvent;
+import run.halo.app.core.extension.UserConnection;
+import run.halo.app.plugin.SharedEvent;
+
+/**
+ * An event that will be triggered after a user connection is disconnected.
+ *
+ * @author johnniang
+ * @since 2.20.0
+ */
+@SharedEvent
+public class UserConnectionDisconnectedEvent extends ApplicationEvent {
+
+    @Getter
+    private final UserConnection userConnection;
+
+    public UserConnectionDisconnectedEvent(Object source, UserConnection userConnection) {
+        super(source);
+        this.userConnection = userConnection;
+    }
+
+}
diff --git a/application/src/main/java/run/halo/app/core/endpoint/uc/UserConnectionEndpoint.java b/application/src/main/java/run/halo/app/core/endpoint/uc/UserConnectionEndpoint.java
new file mode 100644
index 0000000000..f8fd923caa
--- /dev/null
+++ b/application/src/main/java/run/halo/app/core/endpoint/uc/UserConnectionEndpoint.java
@@ -0,0 +1,74 @@
+package run.halo.app.core.endpoint.uc;
+
+import static org.springdoc.core.fn.builders.apiresponse.Builder.responseBuilder;
+
+import io.swagger.v3.oas.annotations.enums.ParameterIn;
+import org.springdoc.core.fn.builders.parameter.Builder;
+import org.springdoc.webflux.core.fn.SpringdocRouteBuilder;
+import org.springframework.security.authentication.AuthenticationTrustResolver;
+import org.springframework.security.authentication.AuthenticationTrustResolverImpl;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.context.ReactiveSecurityContextHolder;
+import org.springframework.security.core.context.SecurityContext;
+import org.springframework.stereotype.Component;
+import org.springframework.web.reactive.function.server.RouterFunction;
+import org.springframework.web.reactive.function.server.ServerResponse;
+import run.halo.app.core.extension.UserConnection;
+import run.halo.app.core.extension.endpoint.CustomEndpoint;
+import run.halo.app.core.user.service.UserConnectionService;
+import run.halo.app.extension.GroupVersion;
+
+/**
+ * User connection endpoint.
+ *
+ * @author johnniang
+ * @since 2.20.0
+ */
+@Component
+public class UserConnectionEndpoint implements CustomEndpoint {
+
+    private final UserConnectionService connectionService;
+
+    private final AuthenticationTrustResolver authenticationTrustResolver =
+        new AuthenticationTrustResolverImpl();
+
+    public UserConnectionEndpoint(UserConnectionService connectionService) {
+        this.connectionService = connectionService;
+    }
+
+    @Override
+    public RouterFunction<ServerResponse> endpoint() {
+        var tag = "UserConnectionV1alpha1Uc";
+        return SpringdocRouteBuilder.route()
+            .PUT(
+                "/user-connections/{registerId}/disconnect",
+                request -> {
+                    var removedUserConnections = ReactiveSecurityContextHolder.getContext()
+                        .map(SecurityContext::getAuthentication)
+                        .filter(authenticationTrustResolver::isAuthenticated)
+                        .map(Authentication::getName)
+                        .flatMapMany(username -> connectionService.removeUserConnection(
+                            request.pathVariable("registerId"), username)
+                        );
+                    return ServerResponse.ok().body(removedUserConnections, UserConnection.class);
+                },
+                builder -> builder.operationId("DisconnectMyConnection")
+                    .description("Disconnect my connection from a third-party platform.")
+                    .tag(tag)
+                    .parameter(Builder.parameterBuilder()
+                        .in(ParameterIn.PATH)
+                        .name("registerId")
+                        .description("The registration ID of the third-party platform.")
+                        .required(true)
+                        .implementation(String.class)
+                    )
+                    .response(responseBuilder().implementationArray(UserConnection.class))
+            )
+            .build();
+    }
+
+    @Override
+    public GroupVersion groupVersion() {
+        return GroupVersion.parseAPIVersion("uc.api.auth.halo.run/v1alpha1");
+    }
+}
diff --git a/application/src/main/java/run/halo/app/core/user/service/UserConnectionService.java b/application/src/main/java/run/halo/app/core/user/service/UserConnectionService.java
index d695b07615..2bbb260c1f 100644
--- a/application/src/main/java/run/halo/app/core/user/service/UserConnectionService.java
+++ b/application/src/main/java/run/halo/app/core/user/service/UserConnectionService.java
@@ -1,6 +1,7 @@
 package run.halo.app.core.user.service;
 
 import org.springframework.security.oauth2.core.user.OAuth2User;
+import reactor.core.publisher.Flux;
 import reactor.core.publisher.Mono;
 import run.halo.app.core.extension.UserConnection;
 
@@ -32,4 +33,13 @@ Mono<UserConnection> updateUserConnectionIfPresent(
         String registrationId, OAuth2User oauth2User
     );
 
+    /**
+     * Remove user connection.
+     *
+     * @param registrationId Registration ID
+     * @param username Username
+     * @return A list of user connections
+     */
+    Flux<UserConnection> removeUserConnection(String registrationId, String username);
+
 }
diff --git a/application/src/main/java/run/halo/app/core/user/service/impl/UserConnectionServiceImpl.java b/application/src/main/java/run/halo/app/core/user/service/impl/UserConnectionServiceImpl.java
index 291fec60bf..2b6e414981 100644
--- a/application/src/main/java/run/halo/app/core/user/service/impl/UserConnectionServiceImpl.java
+++ b/application/src/main/java/run/halo/app/core/user/service/impl/UserConnectionServiceImpl.java
@@ -7,12 +7,15 @@
 import java.time.Clock;
 import java.util.HashMap;
 import java.util.Optional;
+import org.springframework.context.ApplicationEventPublisher;
 import org.springframework.security.oauth2.core.user.OAuth2User;
 import org.springframework.stereotype.Service;
+import reactor.core.publisher.Flux;
 import reactor.core.publisher.Mono;
 import run.halo.app.core.extension.UserConnection;
 import run.halo.app.core.extension.UserConnection.UserConnectionSpec;
 import run.halo.app.core.user.service.UserConnectionService;
+import run.halo.app.event.user.UserConnectionDisconnectedEvent;
 import run.halo.app.extension.ListOptions;
 import run.halo.app.extension.Metadata;
 import run.halo.app.extension.MetadataOperator;
@@ -25,10 +28,14 @@ public class UserConnectionServiceImpl implements UserConnectionService {
 
     private final ReactiveExtensionClient client;
 
+    private final ApplicationEventPublisher eventPublisher;
+
     private Clock clock = Clock.systemDefaultZone();
 
-    public UserConnectionServiceImpl(ReactiveExtensionClient client) {
+    public UserConnectionServiceImpl(ReactiveExtensionClient client,
+        ApplicationEventPublisher eventPublisher) {
         this.client = client;
+        this.eventPublisher = eventPublisher;
     }
 
     void setClock(Clock clock) {
@@ -91,6 +98,21 @@ public Mono<UserConnection> updateUserConnectionIfPresent(String registrationId,
             .flatMap(connection -> updateUserConnection(connection, oauth2User));
     }
 
+    @Override
+    public Flux<UserConnection> removeUserConnection(String registrationId, String username) {
+        var listOptions = ListOptions.builder()
+            .fieldQuery(and(
+                equal("spec.registrationId", registrationId),
+                equal("spec.username", username)
+            ))
+            .build();
+        return client.listAll(UserConnection.class, listOptions, defaultSort())
+            .flatMap(client::delete)
+            .doOnNext(deleted ->
+                eventPublisher.publishEvent(new UserConnectionDisconnectedEvent(this, deleted))
+            );
+    }
+
     private void updateUserInfo(MetadataOperator metadata, OAuth2User oauth2User) {
         var annotations = Optional.ofNullable(metadata.getAnnotations())
             .orElseGet(HashMap::new);
diff --git a/application/src/main/resources/extensions/role-template-authenticated.yaml b/application/src/main/resources/extensions/role-template-authenticated.yaml
index a5d9200bdd..6e0ae46071 100644
--- a/application/src/main/resources/extensions/role-template-authenticated.yaml
+++ b/application/src/main/resources/extensions/role-template-authenticated.yaml
@@ -29,6 +29,9 @@ rules:
     resources: [ "plugins/bundle.js", "plugins/bundle.css" ]
     resourceNames: [ "-" ]
     verbs: [ "get" ]
+  - apisGroups: [ "uc.api.auth.halo.run" ]
+    resources: [ "user-connections/disconnect" ]
+    verbs: [ "update" ]
 ---
 apiVersion: v1alpha1
 kind: "Role"

From db65dd3b3a4182eec1e3335285894b8cb4296efd Mon Sep 17 00:00:00 2001
From: John Niang <johnniang@foxmail.com>
Date: Mon, 30 Sep 2024 18:37:52 +0800
Subject: [PATCH 065/185] Support redirecting to page according to query after
 authenticated (#6736)

#### What type of PR is this?

/kind improvement
/area core
/milestone 2.20.0

#### What this PR does / why we need it:

This PR supports query `redirect_uri` to control where to redirect after authenticated.

#### Which issue(s) this PR fixes:

Fixes https://github.com/halo-dev/halo/issues/6720

#### Special notes for your reviewer:

Every step below needs you logging out.

1. Try to request <http://localhost:8090/console/login?redirect_uri=/xxx
2. Try to request <http://localhost:8090/login?redirect_uri=/xxx
3. Try to request <http://localhost:8090/console/posts

#### Does this PR introduce a user-facing change?

```release-note
None
```
---
 .../infra/config/WebServerSecurityConfig.java | 13 ++-
 .../SharedApplicationContextFactory.java      |  7 ++
 ...DefaultServerAuthenticationEntryPoint.java |  9 +-
 .../security/ExceptionSecurityConfigurer.java |  9 +-
 .../app/security/HaloServerRequestCache.java  | 86 +++++++++++++++++++
 .../TotpAuthenticationSuccessHandler.java     | 10 ++-
 .../TwoFactorAuthSecurityConfigurer.java      |  9 +-
 .../TwoFactorAuthenticationEntryPoint.java    | 18 ++--
 .../preauth/PreAuthLoginEndpoint.java         | 25 ++++--
 ...ultServerAuthenticationEntryPointTest.java |  8 ++
 .../security/HaloServerRequestCacheTest.java  | 74 ++++++++++++++++
 11 files changed, 241 insertions(+), 27 deletions(-)
 create mode 100644 application/src/main/java/run/halo/app/security/HaloServerRequestCache.java
 create mode 100644 application/src/test/java/run/halo/app/security/HaloServerRequestCacheTest.java

diff --git a/application/src/main/java/run/halo/app/infra/config/WebServerSecurityConfig.java b/application/src/main/java/run/halo/app/infra/config/WebServerSecurityConfig.java
index 46e11007ad..3842cee30f 100644
--- a/application/src/main/java/run/halo/app/infra/config/WebServerSecurityConfig.java
+++ b/application/src/main/java/run/halo/app/infra/config/WebServerSecurityConfig.java
@@ -22,6 +22,7 @@
 import org.springframework.security.web.server.SecurityWebFilterChain;
 import org.springframework.security.web.server.context.ServerSecurityContextRepository;
 import org.springframework.security.web.server.context.WebSessionServerSecurityContextRepository;
+import org.springframework.security.web.server.savedrequest.ServerRequestCache;
 import org.springframework.security.web.server.util.matcher.AndServerWebExchangeMatcher;
 import org.springframework.security.web.server.util.matcher.MediaTypeServerWebExchangeMatcher;
 import org.springframework.security.web.server.util.matcher.NegatedServerWebExchangeMatcher;
@@ -36,6 +37,7 @@
 import run.halo.app.infra.AnonymousUserConst;
 import run.halo.app.infra.properties.HaloProperties;
 import run.halo.app.security.DefaultUserDetailService;
+import run.halo.app.security.HaloServerRequestCache;
 import run.halo.app.security.authentication.CryptoService;
 import run.halo.app.security.authentication.SecurityConfigurer;
 import run.halo.app.security.authentication.impl.RsaKeyService;
@@ -64,7 +66,8 @@ SecurityWebFilterChain filterChain(ServerHttpSecurity http,
         ServerSecurityContextRepository securityContextRepository,
         ReactiveExtensionClient client,
         CryptoService cryptoService,
-        HaloProperties haloProperties) {
+        HaloProperties haloProperties,
+        ServerRequestCache serverRequestCache) {
 
         var pathMatcher = pathMatchers("/**");
         var staticResourcesMatcher = pathMatchers(HttpMethod.GET,
@@ -134,7 +137,8 @@ SecurityWebFilterChain filterChain(ServerHttpSecurity http,
                     haloProperties.getSecurity().getReferrerOptions().getPolicy())
                 )
                 .hsts(hstsSpec -> hstsSpec.includeSubdomains(false))
-            );
+            )
+            .requestCache(spec -> spec.requestCache(serverRequestCache));
 
         // Integrate with other configurers separately
         securityConfigurers.orderedStream()
@@ -142,6 +146,11 @@ SecurityWebFilterChain filterChain(ServerHttpSecurity http,
         return http.build();
     }
 
+    @Bean
+    ServerRequestCache serverRequestCache() {
+        return new HaloServerRequestCache();
+    }
+
     @Bean
     ServerSecurityContextRepository securityContextRepository() {
         return new WebSessionServerSecurityContextRepository();
diff --git a/application/src/main/java/run/halo/app/plugin/SharedApplicationContextFactory.java b/application/src/main/java/run/halo/app/plugin/SharedApplicationContextFactory.java
index c0236917b5..fb264197d5 100644
--- a/application/src/main/java/run/halo/app/plugin/SharedApplicationContextFactory.java
+++ b/application/src/main/java/run/halo/app/plugin/SharedApplicationContextFactory.java
@@ -5,6 +5,7 @@
 import org.springframework.context.ApplicationContext;
 import org.springframework.context.support.GenericApplicationContext;
 import org.springframework.security.web.server.context.ServerSecurityContextRepository;
+import org.springframework.security.web.server.savedrequest.ServerRequestCache;
 import run.halo.app.content.PostContentService;
 import run.halo.app.core.extension.service.AttachmentService;
 import run.halo.app.extension.DefaultSchemeManager;
@@ -79,6 +80,12 @@ public static ApplicationContext create(ApplicationContext rootContext) {
             .ifUnique(rateLimiterRegistry ->
                 beanFactory.registerSingleton("rateLimiterRegistry", rateLimiterRegistry)
             );
+
+        // Authentication plugins may need this RequestCache to handle successful login redirect
+        rootContext.getBeanProvider(ServerRequestCache.class)
+            .ifUnique(serverRequestCache ->
+                beanFactory.registerSingleton("serverRequestCache", serverRequestCache)
+            );
         // TODO add more shared instance here
 
         sharedContext.refresh();
diff --git a/application/src/main/java/run/halo/app/security/DefaultServerAuthenticationEntryPoint.java b/application/src/main/java/run/halo/app/security/DefaultServerAuthenticationEntryPoint.java
index 869e5fa428..24dfbf387a 100644
--- a/application/src/main/java/run/halo/app/security/DefaultServerAuthenticationEntryPoint.java
+++ b/application/src/main/java/run/halo/app/security/DefaultServerAuthenticationEntryPoint.java
@@ -5,6 +5,7 @@
 import org.springframework.security.core.AuthenticationException;
 import org.springframework.security.web.server.ServerAuthenticationEntryPoint;
 import org.springframework.security.web.server.authentication.RedirectServerAuthenticationEntryPoint;
+import org.springframework.security.web.server.savedrequest.ServerRequestCache;
 import org.springframework.security.web.server.util.matcher.ServerWebExchangeMatcher;
 import org.springframework.security.web.server.util.matcher.ServerWebExchangeMatcher.MatchResult;
 import org.springframework.web.server.ServerWebExchange;
@@ -30,9 +31,11 @@ public class DefaultServerAuthenticationEntryPoint implements ServerAuthenticati
 
     private final RedirectServerAuthenticationEntryPoint redirectEntryPoint;
 
-    public DefaultServerAuthenticationEntryPoint() {
-        this.redirectEntryPoint =
+    public DefaultServerAuthenticationEntryPoint(ServerRequestCache serverRequestCache) {
+        var entryPoint =
             new RedirectServerAuthenticationEntryPoint("/login?authentication_required");
+        entryPoint.setRequestCache(serverRequestCache);
+        this.redirectEntryPoint = entryPoint;
     }
 
     @Override
@@ -40,7 +43,7 @@ public Mono<Void> commence(ServerWebExchange exchange, AuthenticationException e
         return xhrMatcher.matches(exchange)
             .filter(MatchResult::isMatch)
             .switchIfEmpty(
-                Mono.defer(() -> this.redirectEntryPoint.commence(exchange, ex)).then(Mono.empty())
+                Mono.defer(() -> this.redirectEntryPoint.commence(exchange, ex).then(Mono.empty()))
             )
             .flatMap(match -> Mono.defer(
                 () -> {
diff --git a/application/src/main/java/run/halo/app/security/ExceptionSecurityConfigurer.java b/application/src/main/java/run/halo/app/security/ExceptionSecurityConfigurer.java
index f3f9c1e03a..8cf715d07e 100644
--- a/application/src/main/java/run/halo/app/security/ExceptionSecurityConfigurer.java
+++ b/application/src/main/java/run/halo/app/security/ExceptionSecurityConfigurer.java
@@ -10,6 +10,7 @@
 import org.springframework.security.web.server.authentication.AuthenticationConverterServerWebExchangeMatcher;
 import org.springframework.security.web.server.authorization.HttpStatusServerAccessDeniedHandler;
 import org.springframework.security.web.server.authorization.ServerWebExchangeDelegatingServerAccessDeniedHandler;
+import org.springframework.security.web.server.savedrequest.ServerRequestCache;
 import org.springframework.security.web.server.util.matcher.ServerWebExchangeMatcher;
 import org.springframework.security.web.server.util.matcher.ServerWebExchangeMatchers;
 import org.springframework.stereotype.Component;
@@ -24,10 +25,14 @@ public class ExceptionSecurityConfigurer implements SecurityConfigurer {
 
     private final ServerResponse.Context context;
 
+    private final ServerRequestCache serverRequestCache;
+
     public ExceptionSecurityConfigurer(MessageSource messageSource,
-        ServerResponse.Context context) {
+        ServerResponse.Context context,
+        ServerRequestCache serverRequestCache) {
         this.messageSource = messageSource;
         this.context = context;
+        this.serverRequestCache = serverRequestCache;
     }
 
     @Override
@@ -59,7 +64,7 @@ public void configure(ServerHttpSecurity http) {
             ));
             entryPoints.add(new DelegatingServerAuthenticationEntryPoint.DelegateEntry(
                 exchange -> ServerWebExchangeMatcher.MatchResult.match(),
-                new DefaultServerAuthenticationEntryPoint()
+                new DefaultServerAuthenticationEntryPoint(serverRequestCache)
             ));
 
             exception.authenticationEntryPoint(
diff --git a/application/src/main/java/run/halo/app/security/HaloServerRequestCache.java b/application/src/main/java/run/halo/app/security/HaloServerRequestCache.java
new file mode 100644
index 0000000000..0909d40201
--- /dev/null
+++ b/application/src/main/java/run/halo/app/security/HaloServerRequestCache.java
@@ -0,0 +1,86 @@
+package run.halo.app.security;
+
+import static org.springframework.security.web.server.util.matcher.ServerWebExchangeMatchers.pathMatchers;
+
+import java.net.URI;
+import java.util.Collections;
+import org.apache.commons.lang3.StringUtils;
+import org.springframework.http.HttpMethod;
+import org.springframework.http.MediaType;
+import org.springframework.http.server.RequestPath;
+import org.springframework.http.server.reactive.ServerHttpRequest;
+import org.springframework.security.web.server.savedrequest.WebSessionServerRequestCache;
+import org.springframework.security.web.server.util.matcher.AndServerWebExchangeMatcher;
+import org.springframework.security.web.server.util.matcher.MediaTypeServerWebExchangeMatcher;
+import org.springframework.security.web.server.util.matcher.NegatedServerWebExchangeMatcher;
+import org.springframework.security.web.server.util.matcher.ServerWebExchangeMatcher;
+import org.springframework.web.server.ServerWebExchange;
+import org.springframework.web.server.WebSession;
+import reactor.core.publisher.Mono;
+
+/**
+ * Halo server request cache implementation for saving redirect URI from query.
+ *
+ * @author johnniang
+ */
+public class HaloServerRequestCache extends WebSessionServerRequestCache {
+
+    /**
+     * Currently, we have no idea to customize the sessionAttributeName in
+     * WebSessionServerRequestCache, so we have to copy the attr into here.
+     */
+    private static final String DEFAULT_SAVED_REQUEST_ATTR = "SPRING_SECURITY_SAVED_REQUEST";
+
+    private static final String REDIRECT_URI_QUERY = "redirect_uri";
+
+    private final String sessionAttrName = DEFAULT_SAVED_REQUEST_ATTR;
+
+    public HaloServerRequestCache() {
+        super();
+        setSaveRequestMatcher(createDefaultRequestMatcher());
+    }
+
+    @Override
+    public Mono<Void> saveRequest(ServerWebExchange exchange) {
+        var redirectUriQuery = exchange.getRequest().getQueryParams().getFirst(REDIRECT_URI_QUERY);
+        if (StringUtils.isNotBlank(redirectUriQuery)) {
+            var redirectUri = URI.create(redirectUriQuery);
+            return saveRedirectUri(exchange, redirectUri);
+        }
+        return super.saveRequest(exchange);
+    }
+
+    @Override
+    public Mono<URI> getRedirectUri(ServerWebExchange exchange) {
+        return super.getRedirectUri(exchange);
+    }
+
+    @Override
+    public Mono<ServerHttpRequest> removeMatchingRequest(ServerWebExchange exchange) {
+        return super.removeMatchingRequest(exchange);
+    }
+
+    private Mono<Void> saveRedirectUri(ServerWebExchange exchange, URI redirectUri) {
+        var requestPath = exchange.getRequest().getPath();
+        var redirectPath = RequestPath.parse(redirectUri, requestPath.contextPath().value());
+        var query = redirectUri.getRawQuery();
+        var finalRedirect =
+            redirectPath.pathWithinApplication() + (query == null ? "" : "?" + query);
+        return exchange.getSession()
+            .map(WebSession::getAttributes)
+            .doOnNext(attributes -> attributes.put(this.sessionAttrName, finalRedirect))
+            .then();
+    }
+
+    private static ServerWebExchangeMatcher createDefaultRequestMatcher() {
+        var get = pathMatchers(HttpMethod.GET, "/**");
+        var notFavicon = new NegatedServerWebExchangeMatcher(
+            pathMatchers(
+                "/favicon.*", "/login/**", "/signup/**", "/password-reset/**", "/challenges/**"
+            ));
+        var html = new MediaTypeServerWebExchangeMatcher(MediaType.TEXT_HTML);
+        html.setIgnoredMediaTypes(Collections.singleton(MediaType.ALL));
+        return new AndServerWebExchangeMatcher(get, notFavicon, html);
+    }
+
+}
diff --git a/application/src/main/java/run/halo/app/security/authentication/twofactor/TotpAuthenticationSuccessHandler.java b/application/src/main/java/run/halo/app/security/authentication/twofactor/TotpAuthenticationSuccessHandler.java
index 391bf16e9c..8e67f7e8f7 100644
--- a/application/src/main/java/run/halo/app/security/authentication/twofactor/TotpAuthenticationSuccessHandler.java
+++ b/application/src/main/java/run/halo/app/security/authentication/twofactor/TotpAuthenticationSuccessHandler.java
@@ -5,6 +5,7 @@
 import org.springframework.security.web.server.WebFilterExchange;
 import org.springframework.security.web.server.authentication.RedirectServerAuthenticationSuccessHandler;
 import org.springframework.security.web.server.authentication.ServerAuthenticationSuccessHandler;
+import org.springframework.security.web.server.savedrequest.ServerRequestCache;
 import reactor.core.publisher.Mono;
 import run.halo.app.security.LoginHandlerEnhancer;
 
@@ -13,11 +14,14 @@ public class TotpAuthenticationSuccessHandler implements ServerAuthenticationSuc
 
     private final LoginHandlerEnhancer loginEnhancer;
 
-    private final ServerAuthenticationSuccessHandler successHandler =
-        new RedirectServerAuthenticationSuccessHandler("/uc");
+    private final ServerAuthenticationSuccessHandler successHandler;
 
-    public TotpAuthenticationSuccessHandler(LoginHandlerEnhancer loginEnhancer) {
+    public TotpAuthenticationSuccessHandler(LoginHandlerEnhancer loginEnhancer,
+        ServerRequestCache serverRequestCache) {
         this.loginEnhancer = loginEnhancer;
+        var successHandler = new RedirectServerAuthenticationSuccessHandler("/uc");
+        successHandler.setRequestCache(serverRequestCache);
+        this.successHandler = successHandler;
     }
 
     @Override
diff --git a/application/src/main/java/run/halo/app/security/authentication/twofactor/TwoFactorAuthSecurityConfigurer.java b/application/src/main/java/run/halo/app/security/authentication/twofactor/TwoFactorAuthSecurityConfigurer.java
index 1799e12da9..d392c0fc37 100644
--- a/application/src/main/java/run/halo/app/security/authentication/twofactor/TwoFactorAuthSecurityConfigurer.java
+++ b/application/src/main/java/run/halo/app/security/authentication/twofactor/TwoFactorAuthSecurityConfigurer.java
@@ -8,6 +8,7 @@
 import org.springframework.security.web.server.authentication.AuthenticationWebFilter;
 import org.springframework.security.web.server.authentication.RedirectServerAuthenticationFailureHandler;
 import org.springframework.security.web.server.context.ServerSecurityContextRepository;
+import org.springframework.security.web.server.savedrequest.ServerRequestCache;
 import org.springframework.stereotype.Component;
 import run.halo.app.security.LoginHandlerEnhancer;
 import run.halo.app.security.authentication.SecurityConfigurer;
@@ -24,13 +25,17 @@ public class TwoFactorAuthSecurityConfigurer implements SecurityConfigurer {
 
     private final LoginHandlerEnhancer loginHandlerEnhancer;
 
+    private final ServerRequestCache serverRequestCache;
+
     public TwoFactorAuthSecurityConfigurer(
         ServerSecurityContextRepository securityContextRepository,
-        TotpAuthService totpAuthService, LoginHandlerEnhancer loginHandlerEnhancer
+        TotpAuthService totpAuthService, LoginHandlerEnhancer loginHandlerEnhancer,
+        ServerRequestCache serverRequestCache
     ) {
         this.securityContextRepository = securityContextRepository;
         this.totpAuthService = totpAuthService;
         this.loginHandlerEnhancer = loginHandlerEnhancer;
+        this.serverRequestCache = serverRequestCache;
     }
 
     @Override
@@ -43,7 +48,7 @@ public void configure(ServerHttpSecurity http) {
         filter.setSecurityContextRepository(securityContextRepository);
         filter.setServerAuthenticationConverter(new TotpCodeAuthenticationConverter());
         filter.setAuthenticationSuccessHandler(
-            new TotpAuthenticationSuccessHandler(loginHandlerEnhancer)
+            new TotpAuthenticationSuccessHandler(loginHandlerEnhancer, serverRequestCache)
         );
         filter.setAuthenticationFailureHandler(
             new RedirectServerAuthenticationFailureHandler("/challenges/two-factor/totp?error")
diff --git a/application/src/main/java/run/halo/app/security/authentication/twofactor/TwoFactorAuthenticationEntryPoint.java b/application/src/main/java/run/halo/app/security/authentication/twofactor/TwoFactorAuthenticationEntryPoint.java
index b7af274a78..08b44887e4 100644
--- a/application/src/main/java/run/halo/app/security/authentication/twofactor/TwoFactorAuthenticationEntryPoint.java
+++ b/application/src/main/java/run/halo/app/security/authentication/twofactor/TwoFactorAuthenticationEntryPoint.java
@@ -3,8 +3,9 @@
 import java.net.URI;
 import org.springframework.context.MessageSource;
 import org.springframework.security.core.AuthenticationException;
+import org.springframework.security.web.server.DefaultServerRedirectStrategy;
 import org.springframework.security.web.server.ServerAuthenticationEntryPoint;
-import org.springframework.security.web.server.authentication.RedirectServerAuthenticationEntryPoint;
+import org.springframework.security.web.server.ServerRedirectStrategy;
 import org.springframework.security.web.server.util.matcher.ServerWebExchangeMatcher;
 import org.springframework.web.reactive.function.server.ServerResponse;
 import org.springframework.web.server.ServerWebExchange;
@@ -18,10 +19,13 @@ public class TwoFactorAuthenticationEntryPoint implements ServerAuthenticationEn
         .flatMap(a -> ServerWebExchangeMatcher.MatchResult.match())
         .switchIfEmpty(ServerWebExchangeMatcher.MatchResult.notMatch());
 
-    private static final String REDIRECT_LOCATION = "/challenges/two-factor/totp";
+    private static final URI REDIRECT_LOCATION = URI.create("/challenges/two-factor/totp");
 
-    private final RedirectServerAuthenticationEntryPoint redirectEntryPoint =
-        new RedirectServerAuthenticationEntryPoint(REDIRECT_LOCATION);
+    /**
+     * Because we don't want to cache the request before redirecting to the 2FA page,
+     * ServerRedirectStrategy is used to redirect the request.
+     */
+    private final ServerRedirectStrategy redirectStrategy = new DefaultServerRedirectStrategy();
 
     private final MessageSource messageSource;
 
@@ -45,10 +49,12 @@ public TwoFactorAuthenticationEntryPoint(MessageSource messageSource,
     public Mono<Void> commence(ServerWebExchange exchange, AuthenticationException ex) {
         return XHR_MATCHER.matches(exchange)
             .filter(ServerWebExchangeMatcher.MatchResult::isMatch)
-            .switchIfEmpty(redirectEntryPoint.commence(exchange, ex).then(Mono.empty()))
+            .switchIfEmpty(
+                redirectStrategy.sendRedirect(exchange, REDIRECT_LOCATION).then(Mono.empty())
+            )
             .flatMap(isXhr -> {
                 var errorResponse = Exceptions.createErrorResponse(
-                    new TwoFactorAuthRequiredException(URI.create(REDIRECT_LOCATION)),
+                    new TwoFactorAuthRequiredException(REDIRECT_LOCATION),
                     null, exchange, messageSource);
                 return ServerResponse.status(errorResponse.getStatusCode())
                     .bodyValue(errorResponse.getBody())
diff --git a/application/src/main/java/run/halo/app/security/preauth/PreAuthLoginEndpoint.java b/application/src/main/java/run/halo/app/security/preauth/PreAuthLoginEndpoint.java
index aaa5e8e764..b6c18b81a8 100644
--- a/application/src/main/java/run/halo/app/security/preauth/PreAuthLoginEndpoint.java
+++ b/application/src/main/java/run/halo/app/security/preauth/PreAuthLoginEndpoint.java
@@ -8,6 +8,7 @@
 import java.util.Optional;
 import org.apache.commons.lang3.StringUtils;
 import org.springframework.context.annotation.Bean;
+import org.springframework.security.web.server.savedrequest.ServerRequestCache;
 import org.springframework.stereotype.Component;
 import org.springframework.web.reactive.function.server.RouterFunction;
 import org.springframework.web.reactive.function.server.RouterFunctions;
@@ -18,6 +19,7 @@
 import run.halo.app.infra.actuator.GlobalInfoService;
 import run.halo.app.plugin.PluginConst;
 import run.halo.app.security.AuthProviderService;
+import run.halo.app.security.HaloServerRequestCache;
 import run.halo.app.security.authentication.CryptoService;
 
 /**
@@ -35,6 +37,8 @@ class PreAuthLoginEndpoint {
 
     private final AuthProviderService authProviderService;
 
+    private final ServerRequestCache serverRequestCache = new HaloServerRequestCache();
+
     PreAuthLoginEndpoint(CryptoService cryptoService, GlobalInfoService globalInfoService,
         AuthProviderService authProviderService) {
         this.cryptoService = cryptoService;
@@ -46,6 +50,7 @@ class PreAuthLoginEndpoint {
     RouterFunction<ServerResponse> preAuthLoginEndpoints() {
         return RouterFunctions.nest(path("/login"), RouterFunctions.route()
             .GET("", request -> {
+                // TODO get redirect URI and cache it
                 var exchange = request.exchange();
                 var contextPath = exchange.getRequest().getPath().contextPath().value();
                 var publicKey = cryptoService.readPublicKey()
@@ -78,15 +83,17 @@ RouterFunction<ServerResponse> preAuthLoginEndpoints() {
                     .filter(ap -> !Objects.equals(loginMethod, ap.getMetadata().getName()))
                     .cache();
 
-                return ServerResponse.ok().render("login", Map.of(
-                    "action", contextPath + "/login",
-                    "publicKey", publicKey,
-                    "globalInfo", globalInfo,
-                    "authProvider", authProvider,
-                    "fragmentTemplateName", fragmentTemplateName,
-                    "socialAuthProviders", socialAuthProviders,
-                    "formAuthProviders", formAuthProviders
-                    // TODO Add more models here
+                return serverRequestCache.saveRequest(exchange).then(Mono.defer(() ->
+                    ServerResponse.ok().render("login", Map.of(
+                        "action", contextPath + "/login",
+                        "publicKey", publicKey,
+                        "globalInfo", globalInfo,
+                        "authProvider", authProvider,
+                        "fragmentTemplateName", fragmentTemplateName,
+                        "socialAuthProviders", socialAuthProviders,
+                        "formAuthProviders", formAuthProviders
+                        // TODO Add more models here
+                    ))
                 ));
             })
             .build());
diff --git a/application/src/test/java/run/halo/app/security/DefaultServerAuthenticationEntryPointTest.java b/application/src/test/java/run/halo/app/security/DefaultServerAuthenticationEntryPointTest.java
index 7ede071f7c..cc0a6366b7 100644
--- a/application/src/test/java/run/halo/app/security/DefaultServerAuthenticationEntryPointTest.java
+++ b/application/src/test/java/run/halo/app/security/DefaultServerAuthenticationEntryPointTest.java
@@ -7,15 +7,22 @@
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.ExtendWith;
 import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.Mockito;
 import org.mockito.junit.jupiter.MockitoExtension;
 import org.springframework.mock.http.server.reactive.MockServerHttpRequest;
 import org.springframework.mock.web.server.MockServerWebExchange;
 import org.springframework.security.authentication.AuthenticationCredentialsNotFoundException;
+import org.springframework.security.web.server.savedrequest.ServerRequestCache;
+import reactor.core.publisher.Mono;
 import reactor.test.StepVerifier;
 
 @ExtendWith(MockitoExtension.class)
 class DefaultServerAuthenticationEntryPointTest {
 
+    @Mock
+    ServerRequestCache requestCache;
+
     @InjectMocks
     DefaultServerAuthenticationEntryPoint entryPoint;
 
@@ -40,6 +47,7 @@ void commenceForNormalRequest() {
             .build();
         var mockExchange = MockServerWebExchange.builder(mockReq)
             .build();
+        Mockito.when(requestCache.saveRequest(mockExchange)).thenReturn(Mono.empty());
         var commenceMono = entryPoint.commence(mockExchange,
             new AuthenticationCredentialsNotFoundException("Not Found"));
         StepVerifier.create(commenceMono)
diff --git a/application/src/test/java/run/halo/app/security/HaloServerRequestCacheTest.java b/application/src/test/java/run/halo/app/security/HaloServerRequestCacheTest.java
new file mode 100644
index 0000000000..02e130c7ef
--- /dev/null
+++ b/application/src/test/java/run/halo/app/security/HaloServerRequestCacheTest.java
@@ -0,0 +1,74 @@
+package run.halo.app.security;
+
+import java.net.URI;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.springframework.http.MediaType;
+import org.springframework.mock.http.server.reactive.MockServerHttpRequest;
+import org.springframework.mock.web.server.MockServerWebExchange;
+import org.springframework.web.server.session.DefaultWebSessionManager;
+import reactor.core.publisher.Mono;
+import reactor.test.StepVerifier;
+
+class HaloServerRequestCacheTest {
+
+    HaloServerRequestCache requestCache;
+
+    @BeforeEach
+    void setUp() {
+        requestCache = new HaloServerRequestCache();
+    }
+
+    @Test
+    void shouldNotSaveIfPageNotCacheable() {
+        var mockExchange =
+            MockServerWebExchange.from(MockServerHttpRequest.get("/login"));
+        requestCache.saveRequest(mockExchange)
+            .then(requestCache.getRedirectUri(mockExchange))
+            .as(StepVerifier::create)
+            .verifyComplete();
+    }
+
+    @Test
+    void shouldSaveIfPageCacheable() {
+        var mockExchange = MockServerWebExchange.from(
+            MockServerHttpRequest.get("/archives").accept(MediaType.TEXT_HTML)
+        );
+        requestCache.saveRequest(mockExchange)
+            .then(requestCache.getRedirectUri(mockExchange))
+            .as(StepVerifier::create)
+            .expectNext(URI.create("/archives"))
+            .verifyComplete();
+    }
+
+    @Test
+    void shouldSaveIfQueryPresent() {
+        var mockExchange =
+            MockServerWebExchange.from(MockServerHttpRequest.get("/login?redirect_uri=/halo?q=v"));
+        requestCache.saveRequest(mockExchange)
+            .then(requestCache.getRedirectUri(mockExchange))
+            .as(StepVerifier::create)
+            .expectNext(URI.create("/halo?q=v"));
+    }
+
+    @Test
+    void shouldRemoveIfRedirectUriFound() {
+        var sessionManager = new DefaultWebSessionManager();
+        var mockExchange =
+            MockServerWebExchange.builder(MockServerHttpRequest.get("/login?redirect_uri=/halo"))
+                .sessionManager(sessionManager)
+                .build();
+        var removeExchange = mockExchange.mutate()
+            .request(builder -> builder.uri(URI.create("/halo")))
+            .build();
+        requestCache.saveRequest(mockExchange)
+            .then(Mono.defer(() -> requestCache.removeMatchingRequest(removeExchange)))
+            .as(StepVerifier::create)
+            .assertNext(request -> {
+                Assertions.assertEquals(URI.create("/halo"), request.getURI());
+            })
+            .verifyComplete();
+    }
+
+}

From e11a494c96507c8d2ee43c5e4cb83fccb57766c1 Mon Sep 17 00:00:00 2001
From: Ryan Wang <i@ryanc.cc>
Date: Mon, 30 Sep 2024 19:01:52 +0800
Subject: [PATCH 066/185] feat: add login expiration notification (#6738)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/area ui
/kind improvement
/milestone 2.20.x

#### What this PR does / why we need it:

添加登录失效的引导。

<img width="1080" alt="image" src="https://github.com/user-attachments/assets/a84c0059-b0ef-4105-b8e9-ae6b3d39d89d">


#### Does this PR introduce a user-facing change?

```release-note
None
```
---
 ui/src/locales/en.yaml         |  2 ++
 ui/src/locales/zh-CN.yaml      |  2 ++
 ui/src/locales/zh-TW.yaml      |  2 ++
 ui/src/setup/setupApiClient.ts | 21 +++++++++++++++++----
 4 files changed, 23 insertions(+), 4 deletions(-)

diff --git a/ui/src/locales/en.yaml b/ui/src/locales/en.yaml
index b56a699ba4..2ae7613718 100644
--- a/ui/src/locales/en.yaml
+++ b/ui/src/locales/en.yaml
@@ -1748,11 +1748,13 @@ core:
       titles:
         tip: Tip
         warning: Warning
+        login_expired: Login expired
       descriptions:
         cannot_be_recovered: This operation is irreversible.
         editor_not_found: >-
           No editor found that matches the {raw_type} format. Please check if
           the editor plugin has been installed.
+        login_expired: The current session has expired. Click Confirm to go to the login page. Please ensure that the current content is saved. You can click Cancel to manually copy any unsaved content.
     filters:
       results:
         keyword: "Keyword: {keyword}"
diff --git a/ui/src/locales/zh-CN.yaml b/ui/src/locales/zh-CN.yaml
index ab84cece98..92783f828f 100644
--- a/ui/src/locales/zh-CN.yaml
+++ b/ui/src/locales/zh-CN.yaml
@@ -1635,9 +1635,11 @@ core:
       titles:
         tip: 提示
         warning: 警告
+        login_expired: 登录已过期
       descriptions:
         cannot_be_recovered: 该操作不可恢复。
         editor_not_found: 未找到符合 {raw_type} 格式的编辑器，请检查是否已安装编辑器插件。
+        login_expired: 当前登录已过期，点击确定跳转到登录页面，请确保当前内容已保存，你可以点击取消之后手动复制未保存的内容。
     filters:
       results:
         keyword: 关键词：{keyword}
diff --git a/ui/src/locales/zh-TW.yaml b/ui/src/locales/zh-TW.yaml
index 45b8cafa9b..3c82339717 100644
--- a/ui/src/locales/zh-TW.yaml
+++ b/ui/src/locales/zh-TW.yaml
@@ -1616,9 +1616,11 @@ core:
       titles:
         tip: 提示
         warning: 警告
+        login_expired: 登入已過期
       descriptions:
         cannot_be_recovered: 該操作不可恢復。
         editor_not_found: 未找到符合 {raw_type} 格式的編輯器，請檢查是否已安裝編輯器插件。
+        login_expired: 當前登入已過期，點擊確定跳轉到登入頁面，請確保當前內容已保存，你可以點擊取消之後手動複製未保存的內容。
     filters:
       results:
         keyword: 關鍵字：{keyword}
diff --git a/ui/src/setup/setupApiClient.ts b/ui/src/setup/setupApiClient.ts
index b4525e8cb6..c14a5653e5 100644
--- a/ui/src/setup/setupApiClient.ts
+++ b/ui/src/setup/setupApiClient.ts
@@ -1,6 +1,6 @@
 import { i18n } from "@/locales";
 import { axiosInstance } from "@halo-dev/api-client";
-import { Toast } from "@halo-dev/components";
+import { Dialog, Toast } from "@halo-dev/components";
 import type { AxiosError } from "axios";
 
 export interface ProblemDetail {
@@ -44,9 +44,22 @@ export function setupApiClient() {
       const { title, detail } = errorResponse.data;
 
       if (status === 401) {
-        Toast.warning(i18n.global.t("core.common.toast.login_expired"));
-
-        // TODO: show dialog
+        Dialog.warning({
+          title: i18n.global.t("core.common.dialog.titles.login_expired"),
+          description: i18n.global.t(
+            "core.common.dialog.descriptions.login_expired"
+          ),
+          confirmType: "secondary",
+          confirmText: i18n.global.t("core.common.buttons.confirm"),
+          cancelText: i18n.global.t("core.common.buttons.cancel"),
+          uniqueId: "login_expired",
+          onConfirm: () => {
+            const currentPath = `${location.pathname}${location.search}`;
+            location.href = `/login?redirect_uri=${encodeURIComponent(
+              currentPath
+            )}`;
+          },
+        });
 
         return Promise.reject(error);
       }

From 462fac0eb6b22e4c5de518650ce6e43bcdd7787d Mon Sep 17 00:00:00 2001
From: John Niang <johnniang@foxmail.com>
Date: Tue, 1 Oct 2024 23:34:00 +0800
Subject: [PATCH 067/185] Redirect to user center if authenticated users access
 login and signup pages (#6740)

#### What type of PR is this?

/kind improvement
/area core
/milestone 2.20.x

#### What this PR does / why we need it:

This PR make authenticated users redirect to user center if they are trying to access login and signup pages.

#### Special notes for your reviewer:

1. Log in Halo
2. Try to request <http://localhost:8090/login> or <http://localhost:8090/signup>.

#### Does this PR introduce a user-facing change?

```release-note
None
```
---
 .../infra/config/WebServerSecurityConfig.java |  3 ++
 .../security/ExceptionSecurityConfigurer.java | 19 ++++++++----
 .../security/RedirectAccessDeniedHandler.java | 31 +++++++++++++++++++
 .../NotAuthenticatedAuthorizationManager.java | 30 ++++++++++++++++++
 4 files changed, 77 insertions(+), 6 deletions(-)
 create mode 100644 application/src/main/java/run/halo/app/security/RedirectAccessDeniedHandler.java
 create mode 100644 application/src/main/java/run/halo/app/security/authorization/NotAuthenticatedAuthorizationManager.java

diff --git a/application/src/main/java/run/halo/app/infra/config/WebServerSecurityConfig.java b/application/src/main/java/run/halo/app/infra/config/WebServerSecurityConfig.java
index 3842cee30f..4385ae9741 100644
--- a/application/src/main/java/run/halo/app/infra/config/WebServerSecurityConfig.java
+++ b/application/src/main/java/run/halo/app/infra/config/WebServerSecurityConfig.java
@@ -44,6 +44,7 @@
 import run.halo.app.security.authentication.pat.PatAuthenticationManager;
 import run.halo.app.security.authentication.pat.PatServerWebExchangeMatcher;
 import run.halo.app.security.authorization.AuthorityUtils;
+import run.halo.app.security.authorization.NotAuthenticatedAuthorizationManager;
 import run.halo.app.security.authorization.RequestInfoAuthorizationManager;
 import run.halo.app.security.session.InMemoryReactiveIndexedSessionRepository;
 import run.halo.app.security.session.ReactiveIndexedSessionRepository;
@@ -90,6 +91,8 @@ SecurityWebFilterChain filterChain(ServerHttpSecurity http,
                     "/apis/**",
                     "/actuator/**"
                 ).access(new RequestInfoAuthorizationManager(roleService))
+                .pathMatchers(HttpMethod.GET, "/login", "/signup")
+                .access(new NotAuthenticatedAuthorizationManager())
                 .pathMatchers(
                     "/login/**",
                     "/challenges/**",
diff --git a/application/src/main/java/run/halo/app/security/ExceptionSecurityConfigurer.java b/application/src/main/java/run/halo/app/security/ExceptionSecurityConfigurer.java
index 8cf715d07e..940b232e4b 100644
--- a/application/src/main/java/run/halo/app/security/ExceptionSecurityConfigurer.java
+++ b/application/src/main/java/run/halo/app/security/ExceptionSecurityConfigurer.java
@@ -1,7 +1,11 @@
 package run.halo.app.security;
 
+import static org.springframework.security.web.server.util.matcher.ServerWebExchangeMatchers.anyExchange;
+import static org.springframework.security.web.server.util.matcher.ServerWebExchangeMatchers.pathMatchers;
+
 import java.util.ArrayList;
 import org.springframework.context.MessageSource;
+import org.springframework.http.HttpMethod;
 import org.springframework.http.HttpStatus;
 import org.springframework.security.config.web.server.ServerHttpSecurity;
 import org.springframework.security.oauth2.server.resource.web.access.server.BearerTokenServerAccessDeniedHandler;
@@ -11,8 +15,6 @@
 import org.springframework.security.web.server.authorization.HttpStatusServerAccessDeniedHandler;
 import org.springframework.security.web.server.authorization.ServerWebExchangeDelegatingServerAccessDeniedHandler;
 import org.springframework.security.web.server.savedrequest.ServerRequestCache;
-import org.springframework.security.web.server.util.matcher.ServerWebExchangeMatcher;
-import org.springframework.security.web.server.util.matcher.ServerWebExchangeMatchers;
 import org.springframework.stereotype.Component;
 import org.springframework.web.reactive.function.server.ServerResponse;
 import run.halo.app.security.authentication.SecurityConfigurer;
@@ -40,7 +42,7 @@ public void configure(ServerHttpSecurity http) {
         http.exceptionHandling(exception -> {
             var accessDeniedHandlers =
                 new ArrayList<ServerWebExchangeDelegatingServerAccessDeniedHandler.DelegateEntry>(
-                    2
+                    3
                 );
             accessDeniedHandlers.add(
                 new ServerWebExchangeDelegatingServerAccessDeniedHandler.DelegateEntry(
@@ -51,19 +53,24 @@ public void configure(ServerHttpSecurity http) {
                 ));
             accessDeniedHandlers.add(
                 new ServerWebExchangeDelegatingServerAccessDeniedHandler.DelegateEntry(
-                    ServerWebExchangeMatchers.anyExchange(),
+                    pathMatchers(HttpMethod.GET, "/login", "/signup"),
+                    new RedirectAccessDeniedHandler("/uc")
+                ));
+            accessDeniedHandlers.add(
+                new ServerWebExchangeDelegatingServerAccessDeniedHandler.DelegateEntry(
+                    anyExchange(),
                     new HttpStatusServerAccessDeniedHandler(HttpStatus.FORBIDDEN)
                 )
             );
 
             var entryPoints =
-                new ArrayList<DelegatingServerAuthenticationEntryPoint.DelegateEntry>(3);
+                new ArrayList<DelegatingServerAuthenticationEntryPoint.DelegateEntry>(2);
             entryPoints.add(new DelegatingServerAuthenticationEntryPoint.DelegateEntry(
                 TwoFactorAuthenticationEntryPoint.MATCHER,
                 new TwoFactorAuthenticationEntryPoint(messageSource, context)
             ));
             entryPoints.add(new DelegatingServerAuthenticationEntryPoint.DelegateEntry(
-                exchange -> ServerWebExchangeMatcher.MatchResult.match(),
+                anyExchange(),
                 new DefaultServerAuthenticationEntryPoint(serverRequestCache)
             ));
 
diff --git a/application/src/main/java/run/halo/app/security/RedirectAccessDeniedHandler.java b/application/src/main/java/run/halo/app/security/RedirectAccessDeniedHandler.java
new file mode 100644
index 0000000000..c75d37674d
--- /dev/null
+++ b/application/src/main/java/run/halo/app/security/RedirectAccessDeniedHandler.java
@@ -0,0 +1,31 @@
+package run.halo.app.security;
+
+import java.net.URI;
+import org.springframework.security.access.AccessDeniedException;
+import org.springframework.security.web.server.DefaultServerRedirectStrategy;
+import org.springframework.security.web.server.ServerRedirectStrategy;
+import org.springframework.security.web.server.authorization.ServerAccessDeniedHandler;
+import org.springframework.web.server.ServerWebExchange;
+import reactor.core.publisher.Mono;
+
+/**
+ * Redirect access denied handler.
+ *
+ * @author johnniang
+ * @since 2.20.0
+ */
+public class RedirectAccessDeniedHandler implements ServerAccessDeniedHandler {
+
+    private final ServerRedirectStrategy redirectStrategy = new DefaultServerRedirectStrategy();
+
+    private final URI redirectUri;
+
+    public RedirectAccessDeniedHandler(String redirectUri) {
+        this.redirectUri = URI.create(redirectUri);
+    }
+
+    @Override
+    public Mono<Void> handle(ServerWebExchange exchange, AccessDeniedException denied) {
+        return redirectStrategy.sendRedirect(exchange, redirectUri);
+    }
+}
diff --git a/application/src/main/java/run/halo/app/security/authorization/NotAuthenticatedAuthorizationManager.java b/application/src/main/java/run/halo/app/security/authorization/NotAuthenticatedAuthorizationManager.java
new file mode 100644
index 0000000000..c0435f5d0e
--- /dev/null
+++ b/application/src/main/java/run/halo/app/security/authorization/NotAuthenticatedAuthorizationManager.java
@@ -0,0 +1,30 @@
+package run.halo.app.security.authorization;
+
+import org.springframework.security.authentication.AuthenticationTrustResolver;
+import org.springframework.security.authentication.AuthenticationTrustResolverImpl;
+import org.springframework.security.authorization.AuthorizationDecision;
+import org.springframework.security.authorization.ReactiveAuthorizationManager;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.web.server.authorization.AuthorizationContext;
+import reactor.core.publisher.Mono;
+
+/**
+ * Authorization manager that checks if the user is not authenticated.
+ *
+ * @author johnniang
+ * @since 2.20.0
+ */
+public class NotAuthenticatedAuthorizationManager
+    implements ReactiveAuthorizationManager<AuthorizationContext> {
+
+    private final AuthenticationTrustResolver trustResolver = new AuthenticationTrustResolverImpl();
+
+    @Override
+    public Mono<AuthorizationDecision> check(Mono<Authentication> authentication,
+        AuthorizationContext object) {
+        return authentication.map(a -> !trustResolver.isAuthenticated(a))
+            .defaultIfEmpty(true)
+            .map(AuthorizationDecision::new);
+    }
+
+}

From 545a5a63ccfbac8d17fa590c2c809de4ef60fc92 Mon Sep 17 00:00:00 2001
From: Yttrium <cyttrium@sav.i.ng>
Date: Thu, 3 Oct 2024 18:01:39 +0800
Subject: [PATCH 068/185] fix: prevent hidden English characters in post title
 input (#6749)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/area ui
/kind improvement

#### What this PR does / why we need it:


#### Which issue(s) this PR fixes:

#6748

Fixes #6748
#### Special notes for your reviewer:

使英文标题中字母不被截断

![image](https://github.com/user-attachments/assets/10b677c1-a30a-4261-85fc-d2cf328b003e)

#### Does this PR introduce a user-facing change?

```release-note
修复文章编辑页面标题输入框中，英文字符可能会被隐藏的问题
```
---
 ui/src/components/editor/DefaultEditor.vue | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ui/src/components/editor/DefaultEditor.vue b/ui/src/components/editor/DefaultEditor.vue
index 120a20d2c2..dc20051bc0 100644
--- a/ui/src/components/editor/DefaultEditor.vue
+++ b/ui/src/components/editor/DefaultEditor.vue
@@ -484,7 +484,7 @@ function handleFocusEditor(event) {
           :value="title"
           type="text"
           :placeholder="$t('core.components.default_editor.title_placeholder')"
-          class="w-full border-x-0 !border-b border-t-0 !border-solid !border-gray-100 p-0 !py-2 text-4xl font-semibold placeholder:text-gray-300"
+          class="w-full border-x-0 !border-b border-t-0 !border-solid !border-gray-100 p-0 !py-2 text-4xl font-semibold placeholder:text-gray-300 leading-none"
           @input="onTitleInput"
           @keydown.enter="handleFocusEditor"
         />

From c22fab2b3484ee8d8f2255920859aeb104b1886a Mon Sep 17 00:00:00 2001
From: Ryan Wang <i@ryanc.cc>
Date: Fri, 4 Oct 2024 14:20:42 +0800
Subject: [PATCH 069/185] fix: correct formatting issues in DefaultEditor
 component (#6752)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/area ui
/kind cleanup

#### What this PR does / why we need it:

修复 DefaultEditor 组件中的格式问题。

#### Does this PR introduce a user-facing change?

```release-note
None
```
---
 ui/src/components/editor/DefaultEditor.vue | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ui/src/components/editor/DefaultEditor.vue b/ui/src/components/editor/DefaultEditor.vue
index dc20051bc0..a4ab847815 100644
--- a/ui/src/components/editor/DefaultEditor.vue
+++ b/ui/src/components/editor/DefaultEditor.vue
@@ -484,7 +484,7 @@ function handleFocusEditor(event) {
           :value="title"
           type="text"
           :placeholder="$t('core.components.default_editor.title_placeholder')"
-          class="w-full border-x-0 !border-b border-t-0 !border-solid !border-gray-100 p-0 !py-2 text-4xl font-semibold placeholder:text-gray-300 leading-none"
+          class="w-full border-x-0 !border-b border-t-0 !border-solid !border-gray-100 p-0 !py-2 text-4xl font-semibold leading-none placeholder:text-gray-300"
           @input="onTitleInput"
           @keydown.enter="handleFocusEditor"
         />

From 1cb8c040c5d856cebebda6ece1ce4d59c4f66b47 Mon Sep 17 00:00:00 2001
From: John Niang <johnniang@foxmail.com>
Date: Fri, 4 Oct 2024 14:40:42 +0800
Subject: [PATCH 070/185] Upgrade to Gradle 8.10.2 (#6755)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/kind improvement
/area core
/milestone 2.20.x

#### What this PR does / why we need it:

This PR upgrades to Gradle 8.10.2 regularly. See https://github.com/gradle/gradle/releases/tag/v8.10.2 for more.

#### Does this PR introduce a user-facing change?

```release-note
升级至 Gradle 8.10.2
```
---
 gradle/wrapper/gradle-wrapper.jar        | Bin 43462 -> 43453 bytes
 gradle/wrapper/gradle-wrapper.properties |   2 +-
 gradlew                                  |   2 +-
 3 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/gradle/wrapper/gradle-wrapper.jar b/gradle/wrapper/gradle-wrapper.jar
index d64cd4917707c1f8861d8cb53dd15194d4248596..e6441136f3d4ba8a0da8d277868979cfbc8ad796 100644
GIT binary patch
delta 34118
zcmY(qRX`kF)3u#IAjsf0xCD212@LM;?(PI<f(@>NyAue(f;$XO2=4Cg1P$=#e%|lo
zKk1`B>Q#GH)wNd-&cJofz}3=WfYndTeo)CyX{fOHsQjGa<{e=jamMNwjda<PyWE6-
zP~B#x7leo3nD`qQ)CqpqLwL&Nv*c_uf@6ZzDxH4Kk*=_Q!1=S4w`ejm#xafRiVQ9K
zD|NMG<SxpdU<&W$m3qe4z`XCn(ZbVn07Ju^@)#`N!0VN6<~T~KDoO4tX0Wnd#9^aG
zzw_kBWvKv8AX+m002<gC-eNM-rZnBB9F6nP%6MQjX4aHBE}ky4v9DAk%X3G|ZVInC
z0sH3o9G@FVA`%%F8RyEFms&lE|8}H=IL>tD={CN3>GNchOE9OGPIqr)3v>RcKWR3Z
zF-guIMjE2UF0Wqk1)21791y#}ciBI*bAenY*B<S7Lsj7;64caBml7(9sSP$#!4bz5
zfe$Y|L&2pF$!`g2EFBw-(C>MW_)AeSuM5}vz_~`+1i!Lo?XAEq{TlK5-efNFgHr6o
zD>^vB&%3ZGEWMS>`?tu!@66|uiDvS5`?bF=gIq3rkK(j<_TybyoaDHg8;Y#`;>tXI
z=tXo~e9{U!*hqTe#nZjW4z0mP8A9UUv1}C#R*@yu9G3k;`Me0-BA2&Aw6f`{Ozan2
z8c8Cs#dA-7V)ZwcGKH}jW!Ja&VaUc@mu5a@CObzNot?b{f+~+212lwF;!QKI16FDS
zodx>XN$sk9;t;)maB^s6sr^L32EbMV(uvW%or=|0@U6cU<cnXKOZI@-_2b|FP!$}s
zAe;S8Mg2+heB}qk71p?*lsuXu#LR?_0T)ujf|bz~>kE`_!<=LHLlRGJx@gQI=B(nn
z-GEjDE}*8>3U$n(t^(b^C$q<Dz5^v_5fDC=_*60>STI;}6q&ypp?-2rGpqg7b}pyT
zOARu2x><t9J4jOACSe7Cla*>0HB{&D(d3sp`+}ka+Pca5glh|c=M)Ujn_$ly^X6&u
z%Q4Y*LtB_>i6(YR!?{Os-(^J`(70lZ&Hp1I^?t@~SFL1!m0x6j|NM!-JTDk)%Q^R<
z@e?23FD&9_W{Bgtr&CG&*Oer3Z(Bu2EbV3T9FeQ|-vo5pwzwQ%g&=zFS7b{n6T2ZQ
z*!H(=z<{D9@c`K<z${~)Mo?=i!8kgh3^kh#gZ+tgX&gTG!eX0?^?c|0?IsnpYDup`
zE@9&nF#>mHO&DbUIzpg`+r5207}4D=_P$ONIc5lsFgn)UB-oUE#{r+|uHc^hzv_df
zV`n<Uy?gf){vC8%ni$H6BLQ|&nNh_JVuc@V<M{j`fPiV3mmYOH;{D(UIYmW$_M(id
zfz>8&qry%jXQ33}Bjqcim~BY1?KZ}x453Oh7G@fA(}+m(f$)TY%7n=MeLi{jJ7LMB
zt(mE*vFnep?YpkT_&WPV9*f>uSi#n#@STJmV&SLZnlLsWYI@y+Bs=gzcqche=&<e&
zH!*BfX&4XuI(sK|M6EWNz&xj!)?<o^!;`2$ksx0>cBH2WL)dkR!a95*Ri)JH_4c*-
zl4pPLl^as5_y&6RDE@@7342DNyF&GLJez#eMJjI}#pZN{Y8io{l*D+|f_Y&RQPia@
zNDL;SBERA|B#cjlNC@V<BMj^PW+*!uB6Kia#Q_k#D<Kdw%NW0h5PShX-Ateg=^YLq
zPqOC>U{2csOvB8$HzU$01Q?y)KEfos>W46VMh>P~oQC8k=26-Ku)@C|n^zDP!hO}Y
z_tF}0@*Ds!JMt>?4y|l3?`v#5*oV-=vL7}zehMON^=s1%q+n=^^Z{^mTs7}*->#YL
z)x-~SWE{e?YCarwU$=cS>VzmUh?Q&7?#Xrcce+jeZ|%0!l|H_=D_`77hBfd4Zqk&!
zq-Dnt_?5*$Wsw8zGd@?woEtfYZ2|9L8b>TO6>oMh%`B7iBb)-aCefM~q|S2Cc0t9T
zlu-ZXmM0wd$!gd-dTtik{bqyx32%f;`XUvbUWWJmpHfk8^PQIEsByJm+@+-aj4J#D
z4#Br3pO6z1eIC>X^yKk|<Bgti^oqrbEGF$Jw^;w14UYT$*kTROuXlF!RjFMV72W^U
zoMllbg+6ow&xKMI7=%s{uAdU)(;XWPXi7!aAo)eS$$~Y>PeVwX_4B+IYJyJyc3B`4
zPrM#raacGIzVOexcVB;fcsxS=s<vwC^XKnl?x{xO@E;np^jTyr6HSfEb6qXiZr9dg
z)?Uhot!j3J`wuMIE#*geg>1e&V;Xe$tw&KQ`YaCkHTKe*Al#velxV{3wxx}`7@isG
zp6{+s)CG%HF#JBAQ_jM%zCX5X;J%-*%&jVI?6KpYyzGbq7qf;&hFprh?E5Wyo=bZ)
z8YNycvMNGp1836!-?nihm6jI`^C`EeGryoNZO1AFTQhzFJOA%Q{X(sMYlzABt!&f{
zoDENSuoJQIg5Q#@BUsNJX2h>jkdx4<+ipUymWKFr;w+s>$laIIkfP6nU}r+?J9bZg
zUIxz>RX$kX=C4m(zh-Eg$BsJ4OL&_J38PbHW&7JmR27%efAkqqdvf)Am)VF$+U3WR
z-E#I9H6^)zHLKCs7|Zs<7Bo9VCS3@CDQ;{UTczoEprCKL3ZZW!ffmZFkcWU-V|_M2
zUA9~8tE9<5`59W-UgUmDFp11YlORl3mS3*2#ZHjv{*-1#uMV_oVTy{PY(}AqZv#wF
zJVks)%N6LaHF$$<6p8S8Lqn+5&t}DmLKiC~lE{jPZ39oj{wR&fe*LX-z0m}9ZnZ{U
z>3-5Bh{KKN^n5i!M79Aw5eY=`6fG#aW1_ZG;fw7JM69qk^*(rmO{|Z6rXy?l=K=#_
zE-zd*P|(sskasO(cZ5L~_{Mz&Y@@@Q)5_8l<6vB$<SnmTz>@226O+pDvkFaK8b>%2
zfMtgJ@+cN@w>3)(_uR;s8$sGONbYvoEZ3-)zZk4!`tNzd<0lwt{RAgplo*f@Z)uO`
zzd`ljSqKfHJOLx<Pf6T=jN-Y)-G`fh^*;28D6YUz?Jn$Qe<sb8Bqa)nI_IHAx#i9Y
z$j}`a&gQX1Vaa!Ea{Z|{=AEw)&>ya4_}T`k5Ok1Mpo#MSqf~&ia3uIy{zyuaF}pV6
z)@$ZG5LYh8Gge*LqM_|GiT1*J*uKes=Oku_gMj&;FS`*sfpM+ygN&yOla-^WtIU#$
zuw(_-?DS?6DY7IbON7J)p^IM?N>7x^3)(7wR4PZJu(teex%l>zKAUSNL@~{czc}bR
z)I{Xz<Lxhu3=iQUmF>XqZBU3a;7UQ~PvAx8g-3q-9AEd}1JrlfS8NdPc+!=HJ6Bs(
zCG!0;e0z-22(Uzw>hkEmC&<fdEY_MO4!XLJs6(n80jtDO!nnCLqs#Y_I0IE~UCPp@
zM_JDqY7&S(Y&QK^-o&47T#3E|`NAlIxvHf3kny;RvvXG3GAWOcnn~MYcAb70=&uwJ
zkt37-cyED3`=cXw-}?~Jre&#~t1kA3Jz_#Bn#jD975Ham#lXmn@!Xe|z!$O^A|8Ja
zxE40Kw#qS@4?x}td&6F5(NIU<?GmP1&i-wkqanUS(~JutQ=}J2g$roe>xj?{0p|kc
zM}MMXCF%RLLa#5jG`+}{pDL3M&|%3BlwOi?dq!)KUdv5__zR>u^o|QkYiqr(m3HxF
z6J*DyN#Jpooc$ok=b7{UAVM@<lCUruKn!C)jTs?G3tF=X?02t9ti$}%_-&Apkmnno
z%fbj!k#YwEr={VibqP-VP5rAcB3fluUzRfi(z01WI?#!N!mLc);E?^+GEin57qXIO
zg8kNfR~-pWXV>nwGsr6kozSddwulf5g1{B=0#2)zv!zLXQup^BZ4sv*sEsn)+MA?t
zEL<g?Ek3W6nR6!O+b*MM+O~eGu_sDZwCnE-jqq7Mvt4JiAYMi&B_$Kb75}|i#Oq?4
z^@)_zxi_9dEszN`mdX;tu;@!Yj!NQXjGcs`B*6!}Q`Xp8$`LBVWzdw?k{MZ=kF0i6
z0u$CdmQDt$g$6JM?JyEA2oW1N)I#|wQ>)}3*R?4(J~CpeSJPM!oZ~8<cg4cY=X|VM
z=^|PC37b4k-X|34t*R-GX&L@u*U|J4q?K3(MG@qFTXx0}+s2jwB%hz+*7-k{2(QHj
zQmM#6vaQDzB)m!b_6aC`nE*p#lagJ>;8s_=@6o`IA%{aEA9!GELRvOuncE`s7sH91
zmF=+T!Q6%){?lJn3`5}oW31(^Of|$r%`~gT{eimT7R~*Mg@x+tWM3KE>=Q>nkMG$U
za7r>Yz2LEaA|PsMafvJ(Y>Xzha?=>#B!sYfVob4k5Orb$INFdL@U0(J8Hj&kgWUlO
zPm+R07E+oq^4f4#HvEPANGWLL_!uF{nkHYE&BCH%l1FL_r(Nj@M)*VOD5S42Gk-yT
z^23oAMvpA57H(fkDGMx86Z}rtQhR^L!T2iS!<mO!Z%ty;Vm%l(OCwBkU1^sK>788E
z+^${W1V}J_NwdwdxpXAW8}#6o1(Uu|vhJvubFvQIH1bDl4J4iDJ+181KuDuHwvM?`
z%1@Tnq+7>p{O&p=@QT}4wT;HCb@i)&7int<0#bj8j0sfN3s6|a(l7Bj#7$hxX@~iP
z1HF8RFH}irky&eCN4T94VyK<n?6cO6O!>qGywEGY{Gt0Xl-`|dOU&{Q;Ao;sL>C6N
zXx1y^RZSaL-pG|JN;j9ADjo^XR}gce#seM4QB1?S`L*aB&QlbBIRegMnTkTCks7JU
z<0(b+^Q?HN1&$M1l&I@>HMS;!&bb()a}hhJzsmB?I`poqTrSoO>m_JE5U4=?o;OV6
zBZjt;*%1P>%2{UL=;a4(aI>PRk|mr&F^=v6Fr&xMj8fRCXE5Z2qdre&;$_RNid5!S
zm^XiLK25G6_j4dWkFqjtU7#s;b8h?BYFxV?OE?c~&ME`n`$ix_`mb^AWr+{<eR?ie
zu^n7F<r|0}4&z!1h-oy{4Bz+F69}Q`VpCh(8k$5~F}&!BM0MdLg4qhh@bV;%4Rw1m
zzqF@FV8+w9w|_OPDgrx*NZebP^m@hq4m*)5tuF1+`%o#G^#zx@w5ZsxZaUE7jzw;N
zhD*<Wl`rn3nq7+Ag+JpPe%(D1QRTS`qM+;}+_^&I$1>M9{^^Rl;~KREplwy2q;&xe
zUR0SjHzKVYzuqQ84w$NKVPGVHL_4I)Uw<$uL2-Ml#+5r2X{LLqc*p13<F6YTV#kWf
zqG&w9QQdWL4?_d~CQnBI;?0D)Qg}{>{;w#E*Kwb*1D|v?e;(<>vl@VjnFB^^Y;;b3
z=R@(uRj6D}-h6CCOxAdqn~_SG=bN%^9(Ac?zfRkO5x2VM0+@_qk?MDXvf<z0O)%s7
zMAFU0$m3HcbC#~2Hc64da@3O%^-=j9undudUI{}zbhknzUL#akDQiL_v_tyrinjEO
zI(3QAK0&1x_y)uNn}57R#|)d${jFV)^rH-I`D9H?s`)o)uI9hKceIT0a|7|+J9G4R
z?^G4wKj6MYf*wobKriuVpvC#r;9ThcHk6^a^xn2ODvRhy6<dTeve8{i!Cu=iTXW7{
z{?H_E?=z!{hGvD8B;Y6V{)tUgB~RL}OZbPv*z!^?TUpHIl7qWjaL~c+st5S>=@q_*
z3IM@)er6-OXyE1Z4sU3{8$Y$>8NcnU-nkyWD&2ZaqX1JF_JYL8y}>@V8A5%lX#U3E
zet5PJM`z79q9u5v(OE~{by|Jzlw2<0h`hKpOefhw=fgLTY9M8h+?37k@TWpzAb2Fc
zQMf^aVf!yXlK?@5d-re}!fuAWu0t57ZKSSacwRGJ$0uC}ZgxCTw>cjRk*xCt%w&hh
zoeiIgdz__&u~8s|_TZsGvJ7sjvBW<(C@}Y%#l_ID2&C`0;Eg2Z+pk;IK}4T@W6X5H
z`s?ayU-iF+aNr5--T-^~K~p;}D<LJ~4Vm)-6?_|)BF5gW4JSY7&(G|Av&E;#AyyV$
zSunlmXPqL`WNNYmTNMzV20flD83AxG;E^Ec8R;(;vdTi$02nI6(4u&=rI7r^2x}@}
zb^h(s^Hv9AwRzcBrk1j8D%Js|d7yM)>(*GWOAYDV9JEw!w8ZYzS3;W6*_`#aZw&9J
ziXhBKU3~zd$kKzCAP-=t&cFDeQR*_e*(excIUxKuD@;-twSlP6>wWQU)$|H3Cy+`=
z-#7OW!ZlYzZxkdQpfqVDFU3V2B_-eJS)Fi{fLtRz!K{~7TR~XilNCu=Z;{GIf9KYz
zf3h=Jo+1#_s>z$lc~e)l93h&RqW1VHYN;Yjwg#Qi0yzjN^M4cuL>Ew`_-_wRhi*!f
zLK6vTpgo^Bz?8AsU%#n}^EGigkG3FXen3M;hm#C38P@Zs4{!QZPAU=m7ZV&xKI<yS
zef9C7IM#)bKApw^nm2P0xPH)?)BN&sFvRw*IK$#0AfO}b<r{uW7o8y}SN)F@&yQm%
zn~nNb7d)eJ2BHvG2FG3z@j=payQlcc`;O$D3XPT3JFukw8Xr%@g@bkhB?@#$+AOw(
z(|@nqsNM;#gS0yC1MWhDA!W&4Ru~!5ks5Q~Pml#jZyfXEak(Em<WRqk+Ush$9swq)
zmPM%H4#Ov0YvR0-8rrI^layyN^pm(_yZ9(@AnNKHRrR<^fYJvzs{G9-d<-PIeZxic
zI!fz70I#*sa*eAVT<99Vxgy-<y1w@xbY}slZ7CHAcKSW+wgZc7BMb2FfqhW}?;;BY
zP!O(w$5_aUKLF$CVvI<PnooNWjt084FOTmh7FT(=9D-a~XGZP;^5(x4>_HWNt90Ef
zxClm)ZY?S|n**2cNYy-xBlLAVZ=~+!|7y`(fh+M$#4zl&T^gV8ZaG(RBD!`3?9xcK
zp2+aD(T%QIgrLx5au&TjG1AazI;`8m{K7^!@m>uGCSR;Ut{&?t%3AsF{>0Cm(Kf)2
z?4?|J+!BUg*P~C{?m<lX{_VAm$p$7Sy5n4)MhYq@8YJpQU2G)^4Cs_N!H_NDI5wLC
zuxU!+I__)7xJYF^Pf|zP9)c{~jt|)Y(3ss;D?4|k?Aspv4X!02;`uMjy{H&7#%Q@o
z<nV(d4I5h&#m8g~O!r&@N38SW3XQ`EjZh!<u+JXC85$B2rn?)m6Y00}q3o2FWUH%+
zxkU_~@oBdV%UzT$+qN=8G&dY}bCZ=N#`=O2mzStcgw{uTG7hdoSCO(-*C<hlyRW_D
zI1Ra`6kd?oLFBA13(Fk<4zU<VtAK2o$FG2w@>wPQ#)gDMmro20YVNsVx5oWQMkzQ?
zsQ<ZZLyAH1!oNzFM}TfglR)=rWx*=M9GIjB?ZFULc>%Y>%7_wkJqnSMuZjB9lBM(o
zWut|B7w48cn}4buUBbdPBW_J@H7g=szrKEpb|aE>!4rLm+sO9K%iI75y~2HkUo^iw
zJ3se$8$|W>3}?JU@3h@M^HEFNmvCp|+$-0M?RQ8SMoZ@38%!tz8f8-Ptb@106heiJ
z^Bx!`0=I<O1KwEC{Zqa_WBh?i$W#4Fd46V<qLHAqFT^%K_=ff(6##B-Ub(l(@oz>m
z1!NUhO=9ICM*+||b3a7w*Y#5*Q}K^ar+oMMtekF0JnO>hzHqZKH0&PZ^^M(j;vwf_
z@^|VMBpcw8;4E-9J{<clOdQ-gLs}yNpT|>(u7sHSyZpQbS&N{VQ%ZCh{c1UA5;?R}
z+52*X_tkDQ(s~#-6`z4|Y}3N#a&dgP4S_^tsV=oZ<Y0d)Rr;arA(GJ}DlJV*pmcys
z*Mk;Dg{B7HD(oM1AgV$?pZ(feakO5tAV~SCs_W%F(?;(4m+NEoby{|2mc0XI>r4A1
zaSoPN1czE(UIBrC_r$0HM?RyBGe#lTBL4~JW#A`P^#0wuK)C-2$B6TvM<GJr3h=;Q
z>i@@%K@JAT_IB^T7Zfqc8?<ppV&KJMBtJ-oMFyu3aJ37qp`YqlHwSWDi``;8R3fKH
z;())3jrugRTov;`f2|96Ol0~`tdom%2YtK*BEp7dW){Z1+eUuiY^^+%IXC`kb4D<x
zHzFJB;p^zZ4`bRwAwzCEy&SFu3-$>{wHcSVG_?{(wUG%zhCm=%qP~EqeqKI$9UivF
zv+5IUOs|%@ypo6b+i=xsZ=^G1yeWe)z6IX-EC`F=(|_GCNbHbNp(CZ*lpSu5n`FRA
zhnrc4w+Vh?r>her@Ba_jv0Omp#-H7avZb=j_A~B%V0&FNi#!S8cwn0(Gg-Gi_LMI{
zCg=<XfJ{>g@m{W@u?GQ|yp^yENd;M=W2s-k7Gw2Z(tsD5fTGF{iZ%Ccgjy6O!AB4x
z%&=6jB7^}pyftW2YQpOY1w@%wZy%}-l0qJlOSKZXnN2wo3|hujU+-U~blRF!^;Tan
z0w;Srh0|Q~6*tXf!5-rCD)OYE(%S|^WTpa1KHtpHZ{!;KdcM^#g8Z^+LkbiBHt85m
z;2xv#83lWB(kplfgqv@ZNDcHizwi4-8+WHA$U-HBN<XXr0~J?$Lai#_;trL)VA8+1
zU!;TqE~}9XS7A@|JfNqKkGav_MPU#1&?e(-M~ysHg+5_(nK1v-W}9=?Zer5AMLpDA
zz5CzT^brYv;fMsP%wz!?lZWTP?W}8@vv2IuVI?tan0C9Y`-Wjik0PN~x7}xCz5j)1
zoSKG<CGs%hfuQ;WLC{xnn)TVIkPvvNhsVT7>qsZ`hKcUI3zV3d1ngJP-AMRET*A{>
zb2A>Fk|L|WYV;Eu4>{a6ESi2r3aZL7x}eRc?cf|~bP)6b7%BnsR{Sa>K^0obn?yiJ
zCVvaZ&;d_6WEk${F1SN0{_`(#TuOOH1as&#&xN~+JDzX(D-WU_nLEI}T_VaeLA=bc
zl_UZS$nu#C1yH}YV>N2^9^zye{rDrn(rS99>Fh&jtNY7PP15q%g=RGnxACdCov47=
zwf^<OLlg}xVjt0)p-rbBn7T~vS^5_Drk~dEL?fU{>9zfJaL{y`R#~tvVL#*<`=`Qe
zj_@Me$6sIK=LMFbBrJps7vdaf_HeX?eC+P^{AgSvbEn?n<}NDWiQGQG4^ZOc|GskK
z$Ve2_n8gQ-KZ=s(f`_X!+vM5)4+QmOP()2Fe#IL2toZBf+)8gTVgDSTN1CkP<}!j7
z0SEl>PBg{MnPHkj4wj$mZ?m5x!1ePVEYI(L_sb0OZ*=M%yQb?L{UL(2_*CTVbRxBe
z@{)COwTK1}!*CK0Vi4~AB;HF(MmQf|dsoy(eiQ><S&flYs}X=qI6%JhOL}c}8ReE6
z>WTKcEQlnKOri5xYsqi61Y=I4kzAjn5~{IWrz_l))|<ryzIgBfLDnKw3JSt*BE7Yk
z@<X1~%_3&{c@EWKT@&!_5{hgsv0*uWq^Ag5&!#`hO30t*Ey!ZHlK~#2TL+u093@m<
zmh@mPLF@+cbRf2&AOJqqsB1zg;bVL&+4p#cS%+M6!rPy}l*roS@+s2E+JcG2%rRTv
z2!(JA6$64oDKq`kHYO({m<UUf<`TtSFw}vw1zYukXby+c34(E)w*pi_qs3N7vw>Ls
zvq7xgQs?Xx@`N?f7+3XKLyD~6DRJw*uj*j?yvT3}a;(j_?YOe%hUFcPGWRVBXzpMJ
zM43g6DLFqS9tcTLSg=^&N-y0dXL816v&-nqC0iXdg7kV|PY+js`<tQ)jQ;9->F8dm
z2PuHw&k+8*&9SPQ6f!^5q0&AH(i+z3I7a?8O+S5`g)>}fG|BM&ZnmL;rk)|u{1!aZ
zEZHpAMmK_v$GbrrWNP|^2^s*!0waLW=-h5PZa-4jWYUt(<b#|Bsx3P3#+uA4`mmgX
z9Kz|`zO$@)@d{sIynMxFy0ta)_!*pZfTlj%)9Ee4zRt~F_6}gJArZ1%_&ds}7FnKN
zT=p-*f9G3aBCWvVUn3v-@ZXvQrHP}1zTx3P<Jhsl2HrSYxUcBQibO?|u3Wl@z}_;u
z86>Hr@EA(m3Mc3^uDxwt-me^55FMA9^>hpp26MhqjLg#^Y7OIJ5%ZLdNx&uDgIIqc
zZRZl|n6TyV)0^DDyVtw*jlWkDY&Gw4q;k!UwqSL6&sW$B*5Rc?&)dt29bDB*b6IBY
z6SY6Unsf6AOQdEf=P1inu6(6hVZ0~v-<>;LAlcQ2u?wRWj5VczBT$Op#8IhppP-1t
zfz5H59Aa~yh7EN;BXJsLyjkjqARS5iIhDVPj<=4AJb}m6M@n{xYj3qsR*Q8;h<IbJ
zd)uk&8m`?q_q1NS{$84>VxDyC4vLI;;?^eENOb5QARj#nII5l$MtBCI@5u~(ylFi$
zw6-+$<K_|-Wlyt+M0?(Bv&pcNNg0svOYzThtqKx!i*Dc5NZvH&F*N23|J~!vMN;d~
z^=H()7fOiv1)6`d`Xlx->$XQ}Ca>FWT>q{k)g{Ml(Yv=6aDfe?m<nPFf#(N8Laf1%
zeJ4>|5|kbGtWS}fKWI+})F6`x@||0oJ<?@*&=4(53;s&f1=p}VJ=CsEx0>^(g|+xi
zqlPdy5;`g*i*C=Q(aGeDw!eQg&w>UUj^{o?PrlFI=34qAU2u@BgwrBiaM8zoDTFJ<
zh7nWpv>dr?q;4ZA?}V}|7qWz4W?6#S&m>hs4IwvCBe@-C>+oohsQZ^JC*RfDRm!?y
zS4$7oxcI|##ga*y5hV>J4a%HHl^t$pjY%caL%-FlRb<$A$E!ws?8hf0@(4HdgQ!@>
zds{&g$ocr9W4I84TMa9-(&^_B*&R%^=@?Ntxi|Ejnh;z=!|uVj&3fiTngDPg=0=P2
zB)3#%HetD84ayj??qrxsd<YW&s^_fNRPJu1Lu~ooseFw$wVknfo;k}<f4``0v~+Y_
zKU_m+@|S(3^pR^^<>9nqrBem(8^_u_UY{1@R_vK-0H9N7lBX5K(^O2=0#TtUUGSz{
z%g>qU8#a$DyZ~EMa|8*@`GOhCW3%DN%xuS91T7~iXRr)SG`%=Lfu%U~Z_<B8YLfje
zenkDPv?7UMn^wh-#5zYOX60}ftn+_;r9>`1b=lSi?qpD4$vLh$?HU6t0MydaowUpb
zQr{>_${AMesCEffZo`}K0^~x>RY_ZIG{(r39MP>@=aiM@C;K)jUcfQV8#?SDvq>9D
zI{XeKM%$$XP5`7p3K0T}x;qn)VMo>2t}Ib(6zui;k}<<~KibAb%p)**e>ln<=qyWU
zrRDy|UXFi9y~PdEFIAXejLA{K)6<)Q`?;Q5!KsuEw({!#Rl8*5_F{TP?u|5(Hijv(
ztAA^I5+$A*+*e0V0R~fc{ET-RAS3suZ}TRk3r)xqj~g_hxB`qIK5z(5wxYboz%46G
zq{izIz^5xW1Vq#%lhXaZL&)FJWp0VZNO%2&ADd?+J%K$fM#T_Eke1{dQsx48dUPUY
zLS+DWMJeUSjYL453f@HpRGU6Dv)rw+-c6xB>(=p4U%}<qNSa;?l%-Qbgo6H=D;<Ac
z37*~61%G;Rk9zKyD{WraYx|9VK1aeUEagvgL(r)WImH;+hu8m^8fk3iQO!R?vp|AU
z#xX(31o5DGMHtXZ9zytcGdR#e9xm`5)!T;H26%a+**oa@WGMf=BFxg~`r&GAS7$4y
z^2|*EV<Mt4fFFPU)O>_p>z^I@Ow9`nkUG21?cMIh9}hN?R-d)*6%pr6d@mcb*ixr7
z)>Lo<&2F}~>WT1ybm^9UO{6P9;m+fU^06_$o9gBWL9_}EMZFD=rLJ~&e?fhDnJNBI
zKM=-WR6g7HY5tHf=V~6~QIQ~rakNv<yXlZw2~R->csamU8m28YE=z8+G7K=h%)l6k
zmCpiDInKL6*e#)#Pt;ANmjf`8h-nEt&d}(SBZMI_A{BI#ck-_V7nx)K9_D9K<wX2&
ztb`!H<{xu+%$XOK7#l;ig9boZT>-p@?Zh81#b@{wS?wCcJ%og)8RF*-0z+~)6f#T`
zWqF7_CBcnn=S-1QykC*F0YTsKMVG49BuKQBH%WuDkEy%E?*x&tt%0m>>5^HCOq|ux
zuvFB)JPR-<R9*qK#QvOEy<g2y->W|%$24eEC^AtG3Gp4qdK%pjRijF5Sg3X}uaKEE
z-L5p5aVR!NTM8T`4|2QA@hXiLXRcJveWZ%YeFfV%mO5q#($TJ`*U>hicS+CMj%Ip#
zivoL;dd*araeJK9EA<(tihD50FHWbITBgF9<S1F59NBB@-km2xgxh^jmVKRZHCzb@
zldh9O@Tx{jgxfxH#W4wy6M0z_-aTt2G@3|Yp>E<33A+eMr2;cgI3Gg6<-2o|_g9|>
zv5}i93<J?21Jwu60De+%9&8yD$M-==IBwP;d{BC=F44-LGWWplT_ESz4ovU#BL|G}
zcmR56^)_SYTt?AM`r&<V0_9alA|EwbVwM(BT3!TE$hsCu`Gm;Rg~8}C&9f4B^0>2(
zYf<!;V`YfO6gj*4fZkUAr?-F@aA9;z9|jbBgt=33h^ojL5J7|FUPfqa-W2^EN+IwG
zyucPVo58FAeHt$Nq*Z0Lz|^v35)f<vIMOX%n{Czoseg>TE9?4#nQhP@a|zm#9FST2
z!y+p3B;p>KkUzH!K;GkBW}bWssz)9b>Ulg^)EDca;jDl+q=243BddS$hY^fC6lbpM
z(q_bo4V8~e<Zs<b7cyyni#U}G!!KTEURDqc{bMpk?5mA1@g$Y$Wx|caEJ@!TvSwmW
zqw6$6_V9}M--vO-=^ZBsJr^(lCyvX*KI4W@0G*bBPEKAYRH$kkkjj{cPznS-d|ZUy
zJ?>VeA?0LFD6ZtKcmOH^75#q$E<Zzyhezvuj?3@d%!~X4ws-!zRzAK#UFhVU?-K@7
z2G)}Z&^k%kMrWcDJ1~9s%Y7B4b*Q5pIQJtR#E8_m=dCI`iz(ByzI1@)w#x&yV;Dmb
zBR*c4ZqzdV6%u1E<qjcp>o%a&qvE8Zsqg=$p}u^|>DSWUP5i{6)LAYF4E2DfGZuMJ
zMwxxmkxQf}Q$V3&2w|$`9_SQS^2NVbTHh;atB>=A%!}k-f4*i$X8m}Ni^ppZXk<vI
zv4b?e{$fL=4CN|)0GXH{ZZE#0qrw?r2yJZjI_c{zf+uDL9gwdN)`!v>5_oYF>Gq(&
z0wy{LjJOu}69}~#UFPc;$7ka+=gl(FZCy4xEsk);+he>Nnl>hb5Ud-lj!CNicgd^2
z_Qgr_-&S7*#nLAI7r()P$`x~fy)+y=W~6aNh_humoZr7MWGSWJPLk}$#<b0qDKzby
zfsF}6hSD25(h&SI*1V<_%OA=AVAytldFr(qeYf$b2GB9jc!!oXb+YO|A>w_1n%(@?
z3FnHf1lbxKJbQ9c&i<$(wd{tUTX6DAKs@cXIOBv~!9i{wD@*|kwfX~sjKASrNFGvN
zrFc=!0Bb^OhR2f`%hrp2ibv#KUxl)Np1aixD9{^o=)*U%n%rTHX?FSWL^UGpHpY@7
z<FJKJ-x}kSNUZ~J=(sQmm|=Hgx6NDTIwxW%&M+qtaTFkwf2nmoB#ib#d`3q#i8x4D
z8SO1)?2${?@9$aGnmIq+`mJ>74U}KoIRwxI#>)Pn4($A`nw1%-D}`sGRZD8Z#lF$6
zOeA5)+W2qvA%m^|$WluUU-O+KtMqd;Pd58?qZj})MbxYGO<{z9U&t4D{S2G>e+J9K
ztFZ?}ya>SVOLp9hpW)}G%kTrg*KXXXsLkGdgHb+R-ZXqdkdQC0_)`?6mqo8(EU#d(
zy;u&aVPe6C=YgCRPV!mJ6R6kdY*`e+VGM~`VtC>{k27!9vAZT)x2~AiX5|m1Rq}_=
z;A9LX^nd$l-9&2%4s~p5r6ad-siV`HtxKF}l&xGSYJmP=z!?Mlwmwef$EQq~7;#OE
z)U5eS6dB~~1pkj#9(}T3j!((8Uf%!W49FfUAozijoxInUE7z`~U3Y^}xc3xp){#9D
z<^Tz2xw}@o@fdUZ@hnW#dX6gDOj4R8dV}Dw`u!h@*K)-NrxT8%2`T}EvOImNF_N1S
zy?uo6_ZS>Qga4Xme3j#aX+1qdFFE{NT0Wfusa$^;eL5xGE_66!5_N8!Z~jCAH2=${
z*goHjl|z|kbmIE{cl-PloSTtD+2=CDm~ZHRgXJ8~1(g4W=1c3=2eF#3tah7ho`zm4
z05P&?nyqq$nC?iJ-nK_iBo=u5l#|Ka3H7{UZ&O`~t-=triw=SE7ynzMAE{Mv-{7E_
zViZtA(0^wD{iCCcg@c{54Ro@U5p1QZq_XlEGtdBAQ9@nT?(zLO0#)q55G8_Ug~Xnu
zR-^1~hp|cy&52iogG@o?-^AD8Jb^;@&Ea5jEicDlze6%>?u$-eE};bQ`T6@(bED0J
zKYtdc?%9*<<$2LCBzVx9CA4<AoGdF)iT9-BV}&@WMK}bKMAdQBHB9zIg~33D9XqBR
zD>YV|q-qg*-{yQ;|0=KIgI6~z0DKTtajw2Oms3<u6JfE3d!7x4=<@msnH0k~j9dW|
zZtZ80d$e)`WiYJI%5C4$o_@ZG+NLyWNO7P{Rii0d%$QNbSHy)#lwN8boUCoV3)k>L
zn{C%{P`duw!(F@*P)lFy11|Z&x`E2<=$Ln38>UR~z6~za(3r;45k<v>QK_^QTX%!s
zNzoIFFH8|Y>YVrUL5#mgA-Jh>j7)n<Zx96$&fzU>)5}iVM4%_@^GSwEIBA2g-;43*
z*)i7u*xc8jo2z8&=8t7qo|B-rsGw)b8UXnu`RgE4u!(J8yIJi(5m3~aYsADcfZ!GG
zzqa7p=sg<o&$HnFk3_PIDT7^R*l|Uy*ErkWh5p!iw%95SEqgx*(#2u}$;yHXwBY|t
z$vJDd#N!Akn_xau{*4y#!iM@tZOc&Rc)@cg)>`V_KjiqI*LA-=T;uiNRB;BZZ)~88
z`C%p8%hIev2rxS12@doqsrjgMg3{<L-IS7j<nG-26~xHYI&`%4j=)ZUR_2Nwyo&s*
zJ_0X{=sXdnBCoNzt%@LBIlEx@{+A&hsZt3nyF&Gtc)9fXv28Q&PU0uzxK5QDQ^0tT
z@ll2`vK+vydWK?7I0;u%diXOvNZ*YxV6uZ=wi~x}imLLs*Slf$SL&G~13D2Praj;n
z{D>A&N8A?%Ui5vSHh7!iC^ltF&HqG~;=16=h0{ygy^@HxixUb1XYcR36SB}}o3nxu
z_IpEmGh_CK<+sUh@2zbK9MqO!S5cao=8LSQg0Zv4?ju%ww^mvc0WU$q@!oo#2bv24
z+?c}14L2vlDn%Y0!t*z=$*a!`*|uAVu&NO!z_arim$=btpUPR5XGCG0U3YU`v>yMr
z^zmTdcEa<e${0lJ(<4$dGj^YwOU!gy-6u%trv^j}K^#M&{&D1UGEa2nS)OMS>!APX
zYF>^Q-TP11;{VgtMqC}7>B^2gN-3KYl33gS-p%f!X<_Hr?`rG8{jb9jmuQA9U;BeG
zHj6Pk(UB5c6zwX%SNi*Py*)gk^?+729$bAN-EUd*RKN7{CM4`Q65a1qF*-QWACA&m
zrT)B(M}yih{2r!Tiv5Y&O&=H_OtaHUz96Npo_k0eN|!*s2mLe!Zkuv>^E8Xa43ZwH
zO<I&Nur7C^JWb9`H||S7lnGT!zTpho2vN69_#Qs?kjYy$`Q0!HKi(a7WFX@;&MNY~
zax>I058AZznYGrRJ+`*GmZzMi6yliFmGMge6^j?|PN%ARns!Eg$ufpcLc#1Ns!1@1
zvC7N8M$mRgnixwEtX{ypBS^n`k@t2cCh#_6L6WtQb8E~*Vu+Rr)YsKZRX~hzLG*BE
zaeU#LPo?RLm(Wzltk79Jd1Y$|6<Tz#Ab3VOQL!oqnu8!3Ev#T)CDpRjo9fjjgw)N!
zErQj*AF93?w7h)pV7lh%{nq{Sh43S}4qRhV$tBKz2Q3F#YC0?apCV-cr-&g)Ta?xA
zc-})no|s-UajuvdSqa3zR2cl82_%nvGFwn23tfy0+-dPTJzZ8#!t6MWix9bj!?+yg
zn$~Be?akwbUV?z=Y{qc>aWz1)wf1K1RtqS;qyQMy@H@B805vQ%wfSJB?m&&=^m4i*
z<RSh9mC|UV(AH!)v4!3^(;(w}isKaD1$r>YVH`zTTFbFtNFkAI`Khe4e^CdGZw;O0
zqkQe2|NG_y6D%h(|EZNf&77_!NU%0y={^E=*gKGQ=)LdKPM3zUlM@otH2X07Awv8o
zY8Y7a1^&Yy%b%m{mNQ5sWNMTIq96Wtr>a(hL>Qi&F(ckgKkyvM0IH<_<ah`2Jtc4H
zzJ5Z$n<rF%>}v~Fv-GqDa<PYPnU!!je;%S69V23AFX{jR^q$cSK5eU!uzK5~_gTvx
z=xC#ygr;Z7l0l}tE!ut;$3u!G=k}WM8nnSovw+>pig=3*ZMOx!%cYY)SKzo7ECyem
z9Mj3C)tCYM?C9YIlt1?zTJXNOo&oVxu&uXKJs7i+j8p*Qvu2PAnY}b`KStdpi`trk
ztAO}T8eOC%x)mu+4ps8sYZ=vYJp16SVWEEgQyFKSfWQ@O5id6GfL`|2<}hMXLPszS
zgK><z_7D{#_0cM38i3?q!q=1kU*<f=E!5q~OGR+n-!$_a1@<av6z8(-tT0T>NWOoR
zBRyKeUPevpqKKShD|MZ`R;~#PdNMB3LWjqFKNvH9k+;(`;-pyXM55?qaji#nl~K8m
z_MifoM*W*X9CQiXAOH{cZcP0;Bn10E1)T@62Um>et2ci!J2$5-_HPy(AGif+BJpJ^
ziHWynC_%-NlrFY+(f7HyVvbDIM$5ci_i3?22ZkF>Y8RPBhgx-7k3M2>6m5R24C|~I
z&RPh9xpMGzhN4b<n_$TKj6;x$6eSY#J<6z8-<<eXD{YGtPeh(eK>ii*ryWaN^d(`0
zTOADlU)g`1p+SVMNLztd)c+;XjXox(VHQwqzu>FROvf0`s&|NEv26}(TAe;@=FpZq
zaVs6mp>W0rM3Qg*6x5f_bPJd!6dQGmh?&v0rpBNfS$DW-{4L7#_~-eA@7<2BsZV=X
zo<jFL%Bl|~iN=_%v|5Y<#Gpc-_nu`zPSa3B)eyzNRYkS_S7#Vl4Sx`|M*FHkF=-_)
z(qT@$sP8*6(;+2_2GrUtq?WVOz@%!47omewB^Cj*+)_Y7c8o#IQ%W|Wg+5PNnR*6U
zqsrE$&lE5UYNkcwa9IkWJQ`K6q;9o~nXTNNt4ypA@SdwPa*k(~yPsQD9A`rvY6hIQ
zbB3Wq3J(Ip%Spgn<@)Zq04$gB8>w){3aATmLZOQrs>uzDkXOD=IiX;Ue*B(^4RF%H
zeaZ^*MWn4tBDj(wj114r(`)P96EHq4th-;tWiHhkp2rDlrklX}I@ib-nel0slFoQO
zOeTc<hn5|jpM}{BL^>;Rh7sMIebO`1%u)=GlEj+7HU;c|Nj>2j)J-kpR)s3#+9AiB
zd$hAk6;3pu9(GCR#)#>aCGPYq%r&i02$<m+xZvsp>0L9=7Al<uiMgWi00$%C&<=p;
z&DJ&!X-+7DOQ<NGx053X=x&OTuveGw;P#7I963O-cntp%n;x3upG6$bSZdIscXKZz
zE26w-ESTe#dx<IxxgOyxd~k92x!}?e7=&}7EIUABcs@v7J^4#tE1Z2`vYo|Zfx#?M
zXxRQAUwIpnrd%x;d2(+0wHKQb5LXCF5FM|~=&cF?)N_xB4Bl|JpPd+>IGY<wi6MrB
zwuAQco(edmX)&f$!qgzbDk@I5RR!7e{<pl6;0q^D9rH)D+xQ^qUHFjiVuuZ(dNLoE
zk610d0D=8c-t>dlUO5%eH&M!ZWD&6^NBAj0Y<LF!W8hneCvn#&X!jeuMxFNL9R6gV
ziYL0E$zuPwu-dNyWbfxdM|kfI7dtb9QzzTE{}sJ=aTD#{Kb((+@c&OeMaT<*ofYbx
z;1%phK@uKkWduA*1(PK@!{WoV6$&w4_0RR0*51~cnd9Q6WRU~~+iD70xHZv5yb^q9
zSl{&Z2jJC&)zq%KFf=>9ZDcPg@r@8Y&-}e!aq0S(`}NuQ({;aigCPnq75U9cBH&Y7
ze)W0aD>muAepOKgm7uPg3Dz7G%)nEqTUm_&^^3(>+eEI;$ia`m<pPp!PnmJ$ax-Ni
zriP82FsWaes>>m0QHEkTt^<h|Kl{fGlDwG;CQ*b4lzdo-V$nC8<LA?4QJ%$e&M1jF
zj4MPd95jth&|E!zZ*d9v(}1-nH2c9uw}SWz(o)!u-C;JXs?Old?KmR?ZVapLr)~kt
z-!pxZ2T4qAqb;DH9;hiuAcN#25{6pE|B@nn@LY@;@6X}9ZRu6|3F2X?Musq<a_n+z
zJMV<b3!3d+o(r5xln5wq$mvr`E9}w25J;Qi>=cx^JsBC68#H(3zc~Z$E9I)oSrF$3
zUClHXhMBZ|^1ikm3nL$Z@v|JRhud*IhOvx!6X<(YSX(9LG#yYuZeB{=7-MyPF;?_8
zy2i3iVKG2q!=JHN>~!#Bl{cwa6-yB@b<;8LSj}`f9pw7#x3yTD>C=>1S@H)~(n_K4
z2-yr{2?|1b#lS`qG@+823j;&UE5|2+EdU4nVw5=m>o_gj#K>>(*t=xI7{R)lJhLU{
z4IO6!x@1f$aDVIE@1a0lraN9!(j~_uGlks)!&davUFRNYHflp<|ENwAxsp~4Hun$Q
z$w>@YzXp#VX~)ZP8`_b_sTg(Gt7?oXJW%^Pf0UW%YM+OGjKS}X`yO~{7WH6nX8S6Z
ztl!5AnM2Lo*_}ZLvo%?iV;D2z>#qdpMx*xY2*GGlRzmHCom`VedAoR=(A1nO)Y>;5
zCK-~a;#g5yDgf7_phlkM@)C8s!xOu)N2UnQhif-v5kL$*t=X}L9EyBRq$V(sI{90>
z=ghTPGswRVbTW@dS2H|)QYTY&I$ljbpNPTc_T|FEJkSW7MV!JM4I(ksRqQ8)V5>}v
z2Sf^Z9_v;dKSp_orZm09jb8;C(vzFFJgoYuWRc|Tt_&3k({wPKiD|*m!<X$9n>+<d
zfwbu(US!ljdxEAm@8L<A)Zh;j$1@#3i1Hba7~+=OxccBV?z(KQ^KiX-VG5F8{s<bz
zFTJ%sXJxQmw1gpd<`@dDaxW+0z@mAqX^!9bM3;Rg{vJ$y`jrFPf<taTjgOUiGo`tq
zU8^ynJ_vtmGeduy1>za$(l*!gNRo{xtmqjy1=kGzFkTH=Nc>EL@1Um0BiN1)wBO$i
z6rG={bRcT|%A3s3xh!Bw?=L&_-X+6}L9i~xRj2}-)7fsoq0|;;PS%mcn%_#oV#kAp
zGw^23c8<Fs8D%<c4(Nre;Oy43eq_*f8CVI6Y}O$7=4|A%Bh)_#+dgnF@9B?PZV+FK
z@D@b4V?}Hxb;mfT&3=fp%aQ_W<BpQFv8~7WceKD?ShRTE&*xP)Rp+|r%gOH<b#|`R
zpMk-?U*1{fo}21TS!!|lrVyo(<X*MXXY2ANSehq$FQcbg%rc;PQLx;F?K=D0V>_0~
ze}v9(p};6HM0+qF5^^>BBEI3<e#!JG>d=2<KmW5$FDhY04Ol??L%ZUPasCO+Pj|h!
zL*;#e7cVT$<F2gg5E8<=1=Y;hH6lJKfJK6P>DW&O#|(;wg}?3?uO=w+{*)+^l_-gE
zSw8GV=4_%U4*OU^hibDV38{Qb7P#Y8zh@BM9pEM_o2FuFc2LWrW2jRRB<+IE)G=Vx
zuu?cp2-`hgqlsn|$nx@I%TC!`>bX^G00_oKboOGGXLgyLKXoo$^@L7v;GWqfUFw3<
zekKMWo0LR;TaFY}T<F_}BWybmURg`OY9TP`)1kkA_VfNgEb>t4!O$3MU@pqcw!0w0
zA}SnJ6Lb597|P5W8$OsEHTku2Kw<?~p>9y4V=hx*K%iSn!#LW9W#~OiWf^dXEP$^2
zaok=UyGwy3GRp)bm6Gqr>8-4h@3=2`Eto2|JE6Sufh?%U6;ut1v1d@#EfcQP2chCt
z+mB{Bk5~()7G>wM3KYf7Xh?LGbwg1uWLotmc_}Z_o;XOUDyfU?{9atAT$={v82^w9
z(MW$gINHt4xB3{bdbhRR%T}L?M<kc`={1@bX$@c}pX`50EN?1djSoIxW|Rhd4u^_G
z>cK?!zkLK3(e>zKyei(yq%Nsijm~LV|9mll-XHavFcc$teX7v);H>=oN-+E_Q{c|!
zp<Ol>JV~-9AH}jxf6IF!PxrB9is{_9s@PYth^`pb%DkwghLdAyDREz(csf9)HcVRq
z+2Vn~>{(S&_;bq_qA{v7XbU?yR7;~JrLfo;g$Lkm#ufO1P`QW_`zWW+4+7xzQZnO$
z5&GyJs4-VGb5MEDBc5=zxZh9xEVoY(|2yRv&!T7LAlIs@tw+4n?v1T8M>;hBv}2n)
zcqi+>M*U@uY>4N3eDSAH2Rg@dsl!1py>kO39GMP#qOHipL~*cCac2_vH^6x@xmO|E
zkWeyvl@P$2Iy*mCgVF+b{&|FY*5Ygi82<omgvyGTqv|QTz=sN}TZ6>37i)9YW#Fp&
z?TJTQW+7U)xCE*`Nsx^yaiJ0KSW}}jc-ub)8Z8x(|K7G>`&l<bpFP+cS)jO`N_V-8
zyz*&criMW3Tge5_hcWP_V8=SvD0*^&JQ8c;z^ZkOK$H-b5$|gm$@;EfT;;o$;h7dL
z>{Y&~W=q#^4Gf{}aJ%6kLXsmv6cr=Hi*uB`V26;dr<aSR^xo%$9+~>4C$WrPnHO>g
zg1@A%DvIWPDtXzll39kY6#%j;aN7grYJP9AlJgs3FnC?crv$wC7S4_Z?<_s0j;MmE
z75yQGul2=bY%`l__1X3jxju2$Ws%hNv75ywfAqjgFO7wFsFDOW^)q2%VIF~WhwEW0
z45z^+r+}sJ{q+>X-w(}OiD(!*&cy4X&yM`!L0Fe+_RUfs@=J{AH#K~gArqT=#DcGE
z<spTPWq%oqdho$J0xh~6Q=^v}j=vBe*gL+|ud>!FwY(h&+&811rVCVoOuK)Z<-$EX
zp`TzcUQC256@YWZ*GkE@P_et4D@qpM92fWA6c$MV=^qTu7&g)U?O~-fUR&xFqNiY1
zRd=|zUs_rmFZhKI|H}dcKhy%Okl(#y#QuMi81zsY56Y@757xBQqDNkd+XhLQhp2BB
zBF^aJ<Yyh7pM5zBvii~t`R`{~RErSl{}-#Xjol7q<MNou@wjO9-e0+&FnPZ^6y4Ll
zv-4#qZasZI63$>__D676wLu|yYo6jNJNw^B+Ce;DYK!f$!dNs1*?D^97u^jKS++7S
z5qE%zG#HY-SMUn^_yru=T6v`)CM%K<>_Z>tPe|js`c<|y7<QPU`KuA=GRt?21}m$3
z)egm^_v+KsYdG<vt|ej|@=R$E;WS|)lq&hvDYqCWcNQVq*yoxejj)Sgjj^Yjl?NcX
zDFDlAtM@eY^eKCIx3Bn3tvI+`G-P!;moJ^4fysp(P&5s?@p7p>?qol&)C=>uLWkg5
zmzNcSAG_sL)E9or;i+O}tY^70@h7+=bG1;YDlX{<4zF_?{)K5B&?^tKZ6<$SD%@>F
zY0cl2H7)%zKeDX%Eo7`ky^mzS)s;842cP{_;dzFuyd~Npb4u!bwkkhf8-^C2e3`<?
zuCMcKb49Z{nlgrGOONk{-i&aq@>q8>MuPhgiv0VxHxvrN9_`rJv&GX0fWz-L-Jg^B
zrTsm>)-~j0F1sV=^V?UUi{L2cp%YwpvHwwLaSsCIrGI#({{QfbgDxLKsUC6w@m?y}
zg?l=7aMX-RnMxvLn_4oSB|9t;)Qf2%m-GKo_07?N1l^ahJ+W<L;$&i*6MJG?J+W=u
zwrv{|+x8@xWb=KyXLo=7Po1iIr>f8C>h5~=-o1BJzV@5HBTB-ACNpsHnGt6_ku37M
z{vIEB^tR=--4SEg{jfF=gEogtGwi&A$mwk7E+SV$$ZuU}#F3Y7t}o{!w<wD={LS;b
zZLz-;o0$Q>4LJh8v4PW%8HfUK@dta#l*z@w*9Xzz(i)r#WXi`r1D#oBPtNM7M?Hkq
zhhS1)ea5(6VY45|)tCTr*@yc$^Zc!<pn44UDZ+IBYjAJ`-ggM&;kb0pvO!s`m^2xQ
zD2Cg>zQzsNXU?aRN6mh7zVu~i=qTrX^>de+f6HYfDsW@6PBlw0CsDBcOWUmt&st>Z
zYNJEsRCP1#g0+Htb=wITvexBY@fOpAmR7<uCg}62o&UsLHP(Phe;7?`HXB?HKdlV$
z;n1V`+Y7~g)l@mcyIJ}uTJ!G<@eKpC>?szQNR~nM)?sPWIj)0)jG-EF8U@nnBaQZy
z)ImpVYQL>lBejMDjlxA$#G4%y+^_>N;}r@Zoe2|u-9-x@vvD^ZWnV>Gm=pZa7REAf
zOnomhCxBaGZgT+4kiE%aS&lH2sI1mSCM<%)Cr*Sli;#!aXcUb&@Z|H<WEuC{@x3F<
zcu=w}m*tw?_*4~yqRvV|o9ns5GNSy=_8IwkLCEw54?sk2a(<Mdh^0{u1T=9t*NInH
zFsLj&_yjHc6;)bz9kl9!kgEUg^82nn>j{VPsJyClqD%>hy`Y7<pRj7bPY9jQyVGWO
zS%<st>z(GAS<aP)Y1uSg%`b@4p69s=<%Tt{igr8{?&jG%;a(i_%-UCF>s8Mqas3!D
zSQE83*%uctlD|p%4)v`arra4y>yP5m25V*_+n)Ry1v>z_Fz!TV6t+N?x?#iH$q=m=
z8&X{uW%LVRO87dVl=$Y*>dabJVq{o|Kx`7(D2$5DVX&}XGbg|Ua(*5b=;5qzW<SoC
zzQ#?BPpCI=6I*c_i^sgOQ>9;|w>m{hIO(Tu-z(ey8H=EMluJNyK4BJmGpX~ZM2O61
zk*O7js{-MBqwq>Urf0igN+6soGGc!Y?SP6hiX<gKeOf#K(fq=b1cjQoa=0h1Uc|1x
zrs@w%$10Lm8HWHTQsEqE(JV%p5=DhOaEnmC%>uJzZ1V4WZqE*?h;PG84gvG~dd<ZH
zbY$=c6i~~+P41czFCy_EI$dg`c<Pyn!p1u1+?ktG?l^rT?wPQ2A8drLUBX$i@QPw|
zqn``t@{_q6YANM!8WD%c{DkVuIAOr;O55VmO-cSXNNJ&(*COQc4ZZm^4K%c3mN$0E
zrov1s*jjy;dRKW=-Unr5Q~DZR{;p;L#!x#C2mnbI-cg1JPiV8@_y)_H7BEWiz!+s)
z0{psz93NN}c(aYN&3g{jLeCy{0X^`+?aBhSW*V;^{S7@L=6)4l+Fy-5Vm@KCM_5?x
z(92sH+oi*?$hATGUM-)1KM)NSn*XULvnqVli`x(wEF2!vUY3O~qogY>s6~484!kPM
zMP87IP?dhdc;%|cS&LxY*Ib6P3%p|9)E3IgRmhhwtUR3eRK6iZ_6fiGW}jnL4(I|t
ze`2yLvmuY42lNwO6>I#Son3$R4NOoP*WUm1R4jl#agtSLE}fSu-Z>{+*?<Ox|0|h?
ziVAXEejmb)TNIL)WMKcfBnN%2`pTyl?}<6Yv7aXa$?4(@S45I<K83!~!85D$T^sNt
z#G2I?J>pQIn7`s3LAz<sUxT1J#To$wq)LLuvyHUwXZGnH5bA&W>F#1pSxCAo?clr9
z9PUj#REq28*ZkJnxs$aK%8^5?P<_Q!#Z?%JH0FKVF;&zH3F#J^fz|a<d2t+(J$r8k
z@gS5dPqSn!bSO@C%)Xy-d?WBwvVYS>hl$Ycs~kFij_XP;U<`Fca<h#1CHf8w@jZxi
z4E}>DYyXYPM~&jEe1Xj1n;wyRdD;lmnq&FEro=;+Z$=v-&fYM9eK*S_D&oTXFW#b0
zRY}Y7R#bLzTfg9i7{s?=P9~qjA?$-U2p5;0?gPPu`1JY|*?*8IPO!eX>oiX=O#F!A
zl`S%e5Y(csR1f)I(iKMf-;5%_rPP7h&}5Fc(<tM)r%wv3LCm#xoQU~A@B|1<`oLmM
zFJo+&#d1H1oV@`@@judX4nHzi7~-Q3%iaTZO>8byKUH1*d7?9%QC<dVX!I)~1Vf#}
zwN9HFJ-qutr_)&Ld#X9pYCw5!Ln<R5Cw|Z|F-c$v`hl=tR{-56UrGfK9_2*yyZ@fO
z8nZ1uLsgGiL>|4aADj3L8yuo6GOv#%HDgU3bN(UHw1+(99&Om%f!DY(RYSf4&Uny%
zH}*&rEXc$W5+eyeEg|I|E-HnkIO0!$1sV7Z&NXxiCZJ@`kH4eEi5}q~!Vv5qQq{MI
zi4^`GYoUN-7Q(jy^SKXL4$G4K+FQXR)B}ee=pS0RyK=YC8c2bGnMA~rrOh&jd3_AT
zxVaq37w^-;OU3+C`Kko-Z%l_2FC^maa=Ae0Fm@PEtXEg@cX*oka1Lt&h@jES<6<l#
z+$g2<Asf=9S1fdM-Zf&z(e6fWKei}lbCaFL*0(Jmb1OHeueb>?o1Oi1C9>}7+U(Ve
zQ$=8RlzcnfCd59CsJ=gG^A!2Bb_PY~K2sSau{)?Ge03G7US&qrgV!3NUi>UHWZ*lo
zS;~0--vn{ot+7UWMV{a(X3rZ8Z06Ps3$-sd|CWE(Y#l`swvcDbMjuReGsoA`rmZ`^
z=AaArdbeU0EtwnOuzq@u5P1rlZ<sl{`#t>jH#gNgh6HIhG(>dX%4m{_!&DNTQE)8=
zXD-vcpcSi|DSm3aUMnrV;DQY?svz?9*#GT$NXb~Hem=24iy>7<t7QQV*?t4jd6F$+
zoVdvlUnbR4c30FRg<e9<@PVR%rHqJUA;fJYA($o}&dnWgkF9ZP7&B+X`n^IHYt(Lf
z2F5n3wJiK|+9K0rQqBtOu&~*tu?)dBq^i>xj367(!#RjnrHtrP-Q`T2W*PEvAR-=j
ztY2|#<|JvHNVnM-tNdoS_yRSo=yFqukTZmB$|>Vclj)o=Y<JL-iyAg07VsydL3{X*
z%2mLNnQsQbJh5(AD4t{|q}=<Sep&lQi`=uoh?ZK7-3Ggm7(e$G$$!eV5RX%BIxMx_
zcZ~)&tjIxU_5Hcg)fpWZ(znGWsvo-$Kg%Yi^j*N+;M7L5ByQ~FpSX7CHVVaMYgQ$F
zLE#|7`dM0nng{OAF}Qcjup5gR2}Yw<aDD&b!H-Me0}~kt6{J6Shasi;%3^mM=_Fj;
zCJmpL_-hPyxj$4N{M|RVj$&&&ZX8z~2^&gzl4o!r2Z8|PlPVdE08_x)A!qpcu0#xY
zXnk?%F^@+%cB0BC7MsbX<)>zC9!ph8)ZOH5X=%Aq|9gNgc}^KFVLht!Lyw54v5u&D
zW%vT%z`H{Ax>Ry+bD&QjHQke_wEA;oj(&E!s4|OURButQKSc7Ar-<s}yde;WAK~$P
z^Gqnxrogbi{lG5aFCO5?K&xA8mnwDs7h<9^6YcR8q^0TexEaqnTnUG7d`^9oo$h?D
zKq5j>PzIiFa8F@ezkaY2J9&PH+VI1!G+{JgsQ7%da*_Gr!exT*<Bi+ppC%q~o7ojT
zw%-XGzS*XV$!)J(aAPAYRAt79+7J$~+w?BI2Q1s93#u0$U9&Ct=DGGT|JFamN<I30
zezX;tHfoBvUeBbp68x?km4lTPls>OgJld)b-?cd)xI+|v_C`h(Cg`N~oj0`SQPTma
z{@vc8L^D-rBXwS#00jT#@=-n1H-C3hvg61r2jx#<RRl|hqSXC@053(FHh{sXK3n-p
z<$eTP-2N28_#nt+&me>ok&cr#BV~9JdPaVihyrGq*lb>bm$H6rIoc}ifaSn6mTD9%
z$FRJxbNozOo6y}!OUci1VBv-7{TYZ4GkOM@46Y9?8%mSH9?l&lU59)T#Fjg(h%6I}
z?ib<r4n}!XkXC&NufL;-hcHF&UUVnNQHeZ=Wv<~uyVX-uR$QEL_l&SGi$i}9x_ul>
zZ(xb8Rwr+vv>@$h{WglT2lL`#V=-9tP^c)cjvnz(g|VL^h8^CPVv12dE(o}WQ@0OP
z^2-&ssBXP^#Oh`X<d4_zj?ko>5@F+~$PCB6kK-T7sFUK|>$lNDSkvAy%{y2qgq-&v
zv}^&gm`wiYztWgMS<{^qQKYNV=>CQaOeglAY~EZvr}n~tW=yg)_+fzqF%~+*V_$3h
z2hDW`e$qR;QMg?(w<b_xzz9GLD(1{PR-OZ8-*QD}x+s!v>KE>%H_6ASS@6bkOi-m-
zg6B7AzD;gBS1%OD7|47a%3BykN{w}P!Wn-nQOfpKUpx8Mk{$IO62D!%U9$kr!e%T>
zlqQih?3(U&5%r!KZFZPd<X|#ogu*zbQE07H>bwZ0laAJCj!c&pEFVzrH&_&i<N3C?
zo@%)1zi#=6wREw)wQ(6!5<Zb2Qvw`@PmV*Wp>5m68Y_*J+-Qjlnz}Q{3oAD)`d14H
zKUGmbwC|beC9Mtp>SbL~NVrlctU3WBpHz(UeIa~_{u^_4OaHs_LQt>bUwcyD`_Bbh
zC=x|1vSjL)JvVHLw|xKynEvq2m)7O-6qdmjht7pZ*z|o%NA17v$9H*(5D5(MXiNo1
z72Tv}QASqr$!mY58s_Q{hHa9MY+QZ`2zX-FT@Kd?`8pczcV^9IeOKDG4WKqiP7N|S
z+O977=VQTk8k5dafK`vd(4?_3pBdB?YG9*Z=R@y|$S+d%1sJf-Ka++I&v9hH)h#}}
zw-MjQWJ?ME<7PR(G<1#*Z-&M?%=yzhQw$Lki(R+Pq$X~Q!9BO=fP9FyCIS8zE3n04
z8ScD%XmJnIv=pMTgt6VSxBXOZucndRE@7^aU0wefJYueY(Cb%?%0rz)zWEnsNsKhQ
z+&o6d^x=R;Pt7fUa_`JVb1HPHYbXg{Jvux|atQ^bV#_|>7QZNC<m56gmQTDz)Sv34
znQxO@_?jSZ-}u2#aunxbjO?K=1UNC4B}tiiM9CZDpDyu{zkOqqjq!7q99sz6e|N}H
zPQo%$KE#d!)5wiR%<;fHk2yH4+dlwL2Rr23RY5vDJ>~P^IKUThB6{kvz2pr2*Cyxj
zy37Nri8za8J!@Iw9rbt~#^<9zOaM8LOi$kPBcAGqPq-DB^-93Qeup{9@9&=zV6KQN
zL)ic5S%n1!F(7b>MQ973$~<0|9MY-G!?wk?j-cQhMQlM2n{&7JoTBGsP;=fC6CBJn
zxlpk^%x=B16rfb-W9pYV#9IRHQL9VG4?Uh>pN>2}0-MST2AB2pQjf*rT+TLCX-+&m
z9I{ic2ogXoh=HwdI#igr(JC>>NUP|M>SA?-ux<2&>Jyx>Iko!B<3vS}{g*dKqxYW7
z0i`&U#*v)jot+keO#G&wowD!VvD(j`Z9a*-_RALKn0b(KnZ37d#Db7royLhBW~*7o
zRa`=1fo9C4dgq;;R)JpP++a9^{xd)8``^fPW9!a%MCDYJc;3yicPs8IiQM>DhUX*;
zeIrxE#JRrr|D$@bKgOm4C9D+e!_hQKj3LC`Js)|Aijx=J!rlgnpKeF>b+QlKhI^4*
zf%Of^RmkW|xU|p#Lad44Y5LvIU<E*FXDgB**mKwp2!mq`hNR)=z0QQMaupuiAd7N|
zo&AY$ODOt<Q38Y^Ii6uZyvYkO%G!LUYf+Tw(6oPEJFUo(I+rIZ?v_|(9>IR>VGH8G
zz7ZEIREG%UOy4)C!$muX6StM4@Fsh&Goa}cj10RL(#>oGtr6<bK`a)SgxmFZVL)U~
z49v!>h~7tZDDQ_J>h)VmYlKK>9ns8w4tdx6LdN5xJQ9t-A<deKX4bX$^Jb$>BtTf_
zf1dKVv!mhhQFSN=ggf(#$)FtN-okyT&o6Ms+*u72Uf$5?4)78EErTECzweDUbbU))
zc*tt+9J~Pt%!M352Y5b`Mwrjn^Orp+)L_U1ORHJ}OUsB78YPcIRh4p5jzoDB7B*fb
z4v`bouQeCAW#z9b1?4(M3dcwNn2F2plwC^RVHl#h&b-8n#5^o+Ll20OlJ^gOYiK2<
z;MQuR!t!>`i}CAOa4a+Rh5IL|@kh4EdEL*O=3oGx4asg?XCTcUOQnmHs^6nLu6WcI
zSt9q7nl*?2TIikKNb?3JZBo$cW6)b#;ZKzi+(~D-%0Ec+QW=bZZm@w|prGiThO3dy
zU#TQ;RYQ+xU~*@Zj;Rf~z~iL8Da`RT!Z)b3ILBhnIl@VX9K0PSj5owH#*FJXX3vZ=
zg_Zyn^G&l!WR6wN9GWvt)sM?g2^CA8&F#&t2z<OchUXqZRy~h=2dtIHh}9X16StjX
zE*X$O$hrKjDx*fT_Kdt~%HxH)(Q<=+n-bsLpy;hW_+>3_MiluRqvNbV{Me6yZ&X-_
zd6#Xdh%+6tCmSNTdCBusV<OLU^zAuj3oC#*62FAg&jRV{eA?56gCxRYk9nH%WWtia
z(L;^ByCp%<7za*^^B&PIjiYnY$Gom{Mk62$4uvORBiduv?$8V_-U*iYK!Is}K=K4!
zRqXL>kRwJ_A~<^Nd6~MNOvS;YDix<nmp2CFVZb7>M43`|8e_bmc*UWi7TLA})`T_F
ztk&Nd=dgFUss#Ol$LXTRzP9l1JOSvAws~^X%(`ct$?2Im?UNpXjBec_-+8YK%rq#P
zT9=h8&gCtgx?<LJXBIGvqMB)2=D#1(E#`Gft|z7B(M_Jurie!W@A&*CdPfK%1_($Q
z&41z76E^&SjZfwJd{?_|K()<UmsT?~p*FNKwP__D#d_feWy|Ge{Dz}bgKej%s3<xl
zL=(7@V%Z6Ls;(9_^N&q~-}$9{nVk@Q(D|jMzcY@#rP>=Oj$Yr2j<c`drr*4eGwnY6
zpou_hH7hY!9S)PMQgqe-l!Y{7*V&uqvM#Fq)W)d?^1IAL-DK&GVzdmu_H<-MCk_GM
zy&hTx7mWj(2fxj^o94>I3`VVuZ`lH>*N+*K11CD&>>F)?(`yr~54vHJftY*z?EorK
zm`euBK<$(!XO%6-1=m>qqp6F`S@Pe3;pK5URT$8!Dd|;`eOWdmn916Ut5;iXWQoXE
z0qtwxlH=m_NONP3EY2eW{Qwr-X1V3;5tV;g7tlL4BRilT#Y&~o_!f;*hWxWmvA;Pg
zRb^Y$#PipnVlLXQIzKCuQP9IER0Ai4jZp+STb1Xq0w(nVn<3j(<#!vuc?7eJEZC<-
zPhM7ObhgabN2`pm($tu^MaBkRLzx&jdh;>BP|^$TyD1UHt9Qvr<czlD@G+^h_RO(*
zD$4@5T5mOOg&QM%!B(9nVM{bT<4ry`1>{ZcBs^l!JI4~d-Py$P5QOYO&8eQOFe)&G
zZm+?jOJioGs7MkkQBCzJSFJV6DiCav#kmdxc@IJ9j5m#&1)dhJt`y8{T!uxpBZ>&z
zD^V~%GEaODak5qGj|@cA7HSH{#jHW;Q0KRdTp@PJO#Q1gGI=((a1o%X*{knz&_`ym
zkRLikN^fQ%Gy1|~6%h^vx>ToJ(#aJDxoD8qyOD{CPbSvR*bC>Nm+mkw>6mD0mlD0X
zGepCc<fcI8GR5U|Yh-F^k<?4h>S_x7+6X7dH;%e`aIfPr-NXSqlu&?$Br1R}3lSF2
zWOXDtG;v#EVLSQ!>4323VX-<G6zshc*}#z*<OCtlCr=7_9N%0P@aw0NW3NYMY?UTk
zv23GF46nFqpVnQb;X)T9o|+e;#c6DHFd+rvvY`*?nmy>|E#qb+x%IxzUBDI~N23x?
zXUHfTTV#_f9T$-2FPG@t)rpc9u9!@h^!4=fL<UA2Sb|t&Ay-N0cvK7#l<pL<Ge|wZ
z<{l=m(jmt{aK61fo4#z+N%`p~HEyEO)J*8(AY!addNzdFY|eI)Y^jThWjX-+2s1gI
zR-J}6pgw5eaN{`!XN-3n?FAT?R1z;uAYmO-(xK(CQ<gbE!uo-ct({xjk-*(K3=4b2
zuZ;EzSTEFKBtAl-Y8l=R*0oyp4c|8Hu<A_TRga2_IR3O)Z#Sv=f)G{j@$4)Q>^kg9
zVv%&KY3!?bU*V4X)wNT%Chr;YK()=~lc%$auOB_|oH`H)Xot@1cmk{^qdt&1C55>k
zYnIkdoiAYW41<U-q!=TqI<2ry9=m3D#)D^9-z8@sblghCY~vfX?X5t$KPF5bE#--%
zE5hxIRaHx0Xj9^l7<qXiyd@3`cU<of!XEaJ1U@*tv-q;5CI7%jj1+;qoyl(u34Kyx
zTwi$K?X7Phe&4^6RRa`$h5KJCs<~Ar*~m>zrRBfqR?9r^cpWIEqfS;|R#bIs4$cqA
zoq~$yl8h{IXTSdSdH?;`ky6i%+Oc?HvwH+IS`%_a!d#CqQob9OTNIuhUnOQsX;nl_
z;1w99qO9lAb|guQ9?p4*9TmIZ5{su!h?v-jpOuShq!{AuHUYtmZ%brpgHl$BKLK_L
z6q5vZodM$)RE^NNO>{ZWPb%Ce111V4wIX}?DHA=uzTu0$1h8zy!SID~m5t)(ov$!6
zB^@fP#vpx3enbrbX=<eanFKywoTJQhG@2(niq0oP7<R5Z?3qzMSy}E7WYo#&>vzol
zj^Bg7V$Qa53#3Lptz<6Dz=!f+FvUBVIBtYPN{(%t(EcveSuxi3DI>XQ*<e7R(p~Iw
z59+#M)uYI&a@UPC1IMUQX*f(>$HX~O{KLK5Dh{H2ir87E^!(ye{9H&2U4kFxtKHkw
zZPOTIa*29KbXx-U4hj&iH<9Z@0wh8B6+>qQJn{>F0mGnrj|0_{nwN}Vw_C!rm0!dC
z>iRlEf}<+z<vi^;1*|;$>&?Z4o3?C>QrLBhXP!MV0L#CgF{>;ydIBd5A{bd-S+VFn
zLqq4a*HD%65IqQ5BxNz~vOGU=JJv|NG{OcW%2PU~MEfy6(bl#^TfT7+az5M-I`i&l
z#g!HUfN}j#adA-21x7jbP6F;`99c8Qt|`_@u@fbhZF+Wkmr;IdVHj+F=pDb4MY?fU
znDe##Hn)<n&2RRZwLB>{D}<>vVhYL#)+6p9eAT3T$?;-~bZU%l7MpPNh_mPc(h@79
z;LPOXk>e3nmIxl9lno5cI5G@Q!pE&hQ`s{$Ae4JhTebeTsj*|!6%0;g=wH?B1-p{P
z`In#EP12q6=xXU)LiD+mLidPrYGHaKbe5%|vzApq9(PI6I5XjlGf<_uyy59iw8W;k
zdLZ|8R8RWDc`#)n2?~}@5)vvksY9UaLW`FM=2s|<qH#E;S20;V52?wL&5dX{o72+Z
z0FywvdTk{!EC;eL4ha(sv&@IG+>vyg>Remm=QGthdNL87$nR&TKB*LB%*B}|HkG64
zZ|O4=Yq?Zwl>_KgIG@<Nm24#{ff*;8vIRUT2g{<33$-hCA*Ib8=7nT4{VJ-HH4MLV
zIT25bC`h^*$P3+Yx*l|$yU`O)`Mbhv0n7XuDy|BiR*M8CJI><8i{Zw#P3q_CVT7Dt
zoMwoI)BkpQj8u(m!>1dfOwin(50}VNiLA>A2OG&TBXcP=H(3I;!Wd<ZETqW($r$}b
zQAfz<3tM=bQ%n$55j+bugZnrB#mmMWnY_~$z$Liaj`bJ38rjM<FDunrR#<^_1JENt
zu+3j^HqtsLHiNherQg9BtTZ6*`5u=2BqRzR-k~&QM}H%8Wtp~yT(x{XA+v{;Lk0T_
z8ZN}a;s?PGwtWpK@H2sUmlJ{<9{&n|P#c&W@4~v-%@c<EWQ?t#KLSmY9bDL{#7T?~
z76PxY&TkxgEcPdAIhcw*XW%cHKY+7+aX(-B-5MrXK50f+^TJP!RT6=!f<geMB`%Fd
zpZqq;(7VECXEvcw|AQDRe)aU3W}r0&1CN{y>PFe?r_e{%>bc6(Zk?6~Ew&;#ZxBJ|
zAd1(sAHqlo_*rP;nTk)kAORe3cF<p$fDY|A3iAZP$ueYIxQXJ+7w98(0U(!3@$IXC
zkArCaQGgWCTUEiE#Ljn4e2+xH8Lo+U&pRkmvSNL+lo$iGII$|wCe1zIC^v<yjtGc?
zbPEkKJ&O*&`bDbHgA@N}y7EOuEceoYIA&k#uEVgi3I3Y=_BkG)yv^|q$IgyV_I#%x
zis#68f%rr`5{z^U5Xvbb15OyZ7n3z;MKelR1ZnQZ?|9dO1LM(y5^1HBHewj8z0X6b
z5ns&>&tj>m&LsvB)`-y9#$4XU=Dd^+CzvoAz%9216#f0cS`;kERxrtjbl^7pmO;_y
zYBGOL7R1ne7%F9<i~hqkED!wXO5LBBco|+$qCFci6|!-WQ>M2~0a7Srciz=MeaMU~
zV%Y#m_KV$XReYHtsraWL<vKnB$+Zz-Psj~gMs%tLbl;djUW;H;u25)lZ~Qm%4FzzV
zfs~u@z?ywI*zMsCG+$x}k+Zt=z;A=9uoFZ0uyjL?unMSF6p`V2w|s^vq37hCdK<*M
zQG4HE?XU*W1jw^vfg9M{L@tofUxN*3g2Z~iPTJR8y3WBJ(gUv}lBzRwS|l?`_FLLt
zDW+p@*L9!&Q{&Zrmi{U_bUOaiNV1ZE_G|QIq57EotA?e^B=gl*)4mnUB{ID2*hS?K
z97*K-A4~i4U^!JB&H{YCj!coICIVY)QNpfeE&d15$&n^iL%ZPcjxr-(h$wToAxn2L
zPRdYf%644lF&Ct8opZ&DwcltfV$?3&sTTr>rdJItLtRiRo98T3J|x~(a>~)#>JHDJ
z|4j!VO^qWQfCm9-$N29SpHUqvz62%#%98;2FNIF<r)HDZh-H_}MwGugFOnYSqd%Sy
zI=YaMecE)Ud_fxgSR<n-(O`=`i9bA1ZwT6qs+cI!LFWB2FCcvPar+8o0PX}9gN%GU
z#oIy=fF~{NHiEcjJAgRPrJ{92E7!?|80I39UP!TZA$bl-0B38>*?c9hZ7GAu$q>=0
zX_igPSK8Et(fmD)V=CvbtA-V(wS?z6WV|RX2`g=w=4D)+H|F_N(^ON!jHf72<2nCJ
z^$hEygTAq7URR{Vq$)BsmFKTZ+i1i(D@SJuTGBN<J^d%g3-SsRr1Zq23^Y<XMk33u
z0YpIow(yh?q_G$W1G9T?O`wbI_&XbT=@+$4lm9L~7k=bD&%`F5G=A^k_|g(QrA7|R
zlKb%Fw^<1ppNM&?|K#tNLnJ^+TYlwL9RC;8+T<k(qy{d2CuhNoF@jMeCRv$p@)2rZ
z>3W8<ub;IgTVJz1Un@p7$E&xFXkfS;|BBLRtyYXByIi)rTxM@Bn`|z3wO{>{JpJ^J
zkF=gBTz|P;Xxo1NIypGzJq8GK^#4tl)S%8$PP6E8c|GkkQ)vZ1OiB%mH#@hO1Z%Hp
zv%2~Mlar^}7TRN-SscvQ*xVv+i1g8CwybQHCi3k;o$K@bmB%^-U8dILX)7b~#iPu@
z&D&W7YY2M3v`s(lNm2#^dCRFd;UYMUw1Rh2mto8laH1m`n0u;>okp5XmbsShOhQwo
z@EYOehg-KNab)Rieib?m&NXls+&31)MB&H-zj_WmJsGjc1sCSOz0!2Cm1vV?y@kkQ
z<1k6O$hvTQnGD*esux*aD3lEm$mUi0td0NiOtz3?7}h;Bt*vIC{tDBr@D)9rjhP^<
zY*uKu^BiuSO%)&FL>C?Ng!HYZHLy`R>`rgq+lJh<d&y2bxU%x2bp&;{EY>dXfo|df
zmkzpQf{6o9%^|7Yb<H9Djj73&=!H<l1fR%V0gHumtd=k;shCSDzmr2~L?7>5v{Tu&
zsP*Y~<#jK$S_}uEisRC;=y{zbq`4Owc@JyvB->nPzb#&vcMKi5n66PVV{Aub>*>q8
z=@u7jYA4Ziw2{fSED#t4QLD7Rt`au^y(Ggp3y(UcwIKtI(OMi@GHxs!bj$v~j(FZK
zbdcP^gExtXQqQ8^Q#rHy1&W8q!@^aL><u!}aGR8PHJwu92JD4JDlbnay+X<Ycn<ki
zD^80O2}kCVUWjex%^O<n@=mW<38)Qu_YK#S=N;)9mm7XNJJECSa=DJ$G|#yLf3~L@
z-HW4z+Cyl}+dB?P4cDZq;7|41V@~U!6UPdEGIJj(3NaGsZl6`hnAr?OX*FX_ttOXb
zsH?UN_o>g1v2R45T(KErWB)1rB@rU`#n&-?g2Ti~xXCrexrLgajgzNy=N9|A6K=RZ
zc3yk>w5sz1zsg~tO~-Ie?%Aplh#)l3`s632mi#CCl^75%i6IY;dzpuxu+2fliEjQn
z&=~U+@fV4>{Fp=kk0oQIvBdqS#yY`Z+>Z|T&K{d;v3}=JqzKx05XU3M&@D<Xziu0j
z$T_QZ!o|grC*e9F1-Dp?WgCQfrKo7wqcyX&!TI}mTs|pg4*U1gOy^7sU?zi1GJ1ue
z?TkG+pTl*xn`gl>5!uPTGydasyeZ5=1~IX-?HlM@AGB9|Mzb{{Dt@bUU8{KUPU@EX
zv0fpQNvG~nD2WiOe{Vn=hE^rQD(5m+!$rs%s{w9;yg9oxRhqi0)rwsd245)igLmv*
zJb@Xlet$+)oS1Ra#qTB@U|lix{Y4lGW-$5*4xOLY{9v9&RK<|K!fTd0wCKYZ)h&2f
zEMcTCd+bj&YVmc#>&|?F!3?br3ChoMPTA{RH@NF(jmGMB2fMyW(<0jUT=8QFYD7-%
zS0ydgp%;?W=>{V9>BOf=p$q5U511~Q0-|C!85)W0ov7eb35%XV;3mdUI@f5|x5C)R
z$t?xLFZOv}A(ZjjSbF+8&%@RChpRvo>)sy>-IO8A@>i1A+8bZd^5J#(lgNH&A=V4V
z*HUa0{zT{u-_FF$978RziwA@@*XkV{<-CE1N=Z!_!7;wq*xt3t((m+^$SZKaPim3K
zO|Gq*w5r&7iqiQ!03SY{@*LKDkzhkHe*TzQaYAkz&jNxf^&A_-40(aGs53&}$dlKz
zsel3=FvHqdeIf!UYwL&Mg3w_H?utbE_(PL9B|VAyaOo8k4qb>EvNYHrVmj^ocJQTf
zL%4vl{qgmJf#@uWL@)WiB>Lm>?ivwB%uO|)i~;#--nFx4Kr6{TruZU0N_t_zqkg`?
zwPFK|WiC4sI%o1H%$!1ANyq6_0OSPQJybh^vFriV=`S;kSsYkExZwB{68$dTODWJQ
z@N57kBhwN(y~OHW_M}rX2W13cl@*i_tjW`TMfa~Y;I}1hzApXgWqag@(*@(|EMOg-
z^qMk(s~dL#ps>>`oWZD=i1XI3(;gs7q#^Uj&L`gVu#4zn$i!BIHMoOZG!YoPO^=Gu
z5`X-(KoSsHL77c<7^Y*IM2bI!dzg5j>;I@2-EeB$LgW|;csQTM&Z|R)q>yEjk@Sw%
z6FQk*&zHWzcXalUJSoa&pgH24n`wKkg=2^ta$b1`(BBpBT2Ah9yQF&<s0t#=CvrrS
zhID}v^bURD{xYt-7G^$r)TW*tHPfwa<MygGIW`SIzn~^mpOlkddrC2QnaKRX^i|}+
ztb9<mhSg<Qxk*l=ZE}+5_uD(mzp&OPh211AXsFW}kd_5%1?CrhNsJe#*Y<ZlnvU3i
z9FSrFY?Dr^Z=A0b%B#l7!s~@FV})h2QE2dq9XU8D;k$CT$b*|~B+ozO*7MGpG-4l_
zHB>Kh+3jTaSE|=vChGz2_R^{$C;D`Ua(_=|OO11uLm;+3k%kO19EA`U065i;fRBoH
z{Hq$cgHKRFPf0#%L?$*KeS@FDD;_TfJ#dwP7zzO5F>xntH(ONK{4)#jYUDQr6N(N<
zp<gr$yEF+Bh<8VMyl!Z~38n3=ExaSY0h2rbMXGGeh?xbO6ZTOM{<7x2ScCLhXP2Ft
z)INnh8dDXY+c;~$2FxS>+fAS9l9)^c4Ss8628Zq5AzMq4zc(In_yJSXAT57Dtl}@=
zvZoD7iq0cx7*#I{{r9m{%~g6@Hdr|*njKBb_5}mobCv=&X^`D9?;x6cHwRcwnlO^h
zl;MiKr#LaoB*PEL<dy!vtQo2cB(_!Lx!l45orL*11H7TM(b>m8+8%btnC)b^E12!^
zMmVA!z>59e7n+^!P{PA?f9M^2FjKVw1%x~<`RY5FcXJE)AE}MTopGFDkyEjGiE|C6
z(ad%<3?v*?p;LJGopSEY18HPu2*}U!Nm|rfewc6(&y(&}B#j85d-5PeQ{}zg>>Rvl
zDQ3H4E%q_P&kjuAQ>!0bqgAj){vzHpnn+h(AjQ6GO9v**l0|aCsCyXVE@uh?DU;Em
zE*+7EU9tDH````D`|rM6WUlzBf1e{ht8$62#ilA6Dcw)qAzSRwu{czZJAcKv8w(Q6
zx)b$aq*=E=b5(UH-5*u)3iFlD;XQyklZrwHy}+=h6=aKtTriguHP@Inf+H@q32_LL
z2tX|+X}4dMYB;*EW9~^5bydv)_!<%q#%Ocyh=1>FwL{rtZ?#2Scp{Q55%Fd-LgLU$
zM2u#|F{%vi%+O2^<ba$kF;<;;Rt95z5<wHL5K(j+Q8k$UbpgxRp3j{Mp^w)B^HfYf
zDA0hRMhNbE2=Vj2YiL~z1)_|?;fh9jerBnuTe?P4hal2R4f7=m$Q(~VOU_C<;|0{Z
z3|u!g6zg=FOiT;#Yow7zlAZMlBeju5?i6<U#@UV0Bb~8OCe{A7Ccmu?Gyqdhjg(s#
z+lg05=w;`87GW>~uK3)?$6<Ii6i|CibK0rXDvO^#;fkTXF9V{wZfQL2cW5uAO1K21
zyr@nFcEG^iu`2#R9oGU;Lq1G%agZl2%SOI7JXztK#Z;$;)Lz*}ur422VHM7@=-v?f
zBlBe`7E*iZpFhhLUcSr4=IECR7@1F_Ml2FfW0MO&eq+fQw8MX@4v0dY1>>9cc7_}F
zWU72eFrzZ~x3ZIBH;~EMtD%51o*bnW;&QuzwWd$<Sv0&$GkytlNUOK6=cE?4aMBme
z1h#{t_Gn%>ds=O>Ev807cu%>Ac^ZK&7bCN;Ftk#eeQL4pG0p!W{Ri@tGw>nhIo`rC
zi!Z6?70nYr<u`@synlh-MYS0<B^dq282OT7OFjP<^MkKg!2Li61nIAG$0&EsmPTPr
zR)}<%a~xy;pP3@S-zf2+&bEh1;6wodY7P24J|Iev;5LQ+!5jDK@1Jw&i1XSXY*mE}
zt$!>Nf92V{Y_i(a4DG=5>RktP=?%GcHEx?aKN$@{w{uj#Cqev$bXefo?yC6KI%Rol
z%~$974WCymg;BBhd9Mv}_MeNro_8IB4!evgo*je4h?B-CAkEW-Wr-Q_V9~ef(znU&
z{f-OHnj>@lZH(EcUb2TpOkc70@1BPiY0B#++1EPY5|UU?&^Vpw|C`k4ZWiB-3oAQM
zgmG%M`2qDw5BMY|tG++34My2fE|^kvMSp(d+~P(Vk*d+RW1833i_bX^RYbg9tDtX`
zox?y^YYfs-#fX|y7i(FN7js)66jN!`p9^r7oildEU#6J1(415H3h>W*p(p9@dI|c7
z&c*Aqzksg}o`D@i+o@WIw&jjvL!(`)JglV5zwMn)praO2M05H&CDeps0Wq8(8AkuE
zPm|8MB6f0kOzg(gw}k>rzhQyo#<#sVdht~Wdk`y`=%0!jbd1&>Kxed8lS{Xq?Zw>*
zU5;dM1tt``JH+A9@>H%-9f=<q<+LVr{M#T<q^Cnc-&?xMZN&ijTkf8?0<(syaVN;&
z(C3Efq5EyyrE~N$#X}_S8c^@i6}!4ZVjtXj?-J{FtLW*bQ{65S1G|KSG!!l69P$zC
z{siN1*3l-kL=tqVq$_mWRT&v!^(EH-d>EnW)UkRJe0+e^iqm0C5Z5?iEn#lbp}Xso
ztleC}hl&*yPFcoCZ@s<vLB4vKL);?UQ8SNsN-4lT7E(h++9yfu0i+RG?zQZ`Vyu!N
z2csF4b4_|Yj8d3fGl192T|jkwza^`sMg!wyzjg4YT*3%R=hCis_KugR){yZ{69#*3
zK<)AFqpKOIQ3(`3fk3V+JNe31%APK*Q^d*1qjD!07S=F+NAlE*3L1Zbd=12fPr9W#
zjsGg@L~A0y+Dv6%JO9(Ta*Ah3uR3g(3z}G`82M)ekyTxF_;RCYSlBdkw<IaMsMQ?e
zbsMfyKpLJ)Okmnzl2(R+c-sy1Ki;aKK-sU-FR6hwy#IRr72%A4)qj-ug11pmglUA^
zU@_5Gw6!(Wdy$iHzby;~7AhGdig(Mkgk1LPjq5QFk0S4Cl+LBU^bzgEux96pNv;KN
zUR+$IJ#$~DWu^%Nz(1&3Se2cJg9EwK1ih4HlD~*P+AU9y9Gh^R$@}B0u-*gkxP!N`
zI`OEtCMx2=OXR>gvvjBA_Ew6msFml$cfLQY_(=h03WS_z+Leeh$M3#-?f9YT^Q($z
z+pgaEv$r<Ugeur|SR*p$+UFDnLL;xoN-%!T43feTdR&aK^iX*=YkAhKCcZGH6=Hc`
zK<f-)!~rlB=sV5y>Ia*9wST`WHASQio=9IaVS7l<87%;83~X*`{BX#@>>p=k`@FYo
ze!K5_h8hOc`m0mK0p}LxsguM}w=9vw6Ku8y@RNrXSRPh&S`t4UQY=e-B8~3YCt1Fc
zU$CtRW%hbcy{6K{>v0F*X<`rXVM3a{!muAeG$zBf`a(^l${EA9w3>J{<NHaZSe3Dx
zY8Dg(e$l6m2U+$Er9e(r#AcIf<kD?-fMtOH$;$Ez#?uh-p(moA2-$e?HZ?d3`gHO^
zLs#=xyRr;&%j-2s;@q4VtWbGT-(B6wwnV|+r>aPwJT?mKVN2ba+v)Mp*~gQ_+Ws6=
zy@D?85!U@VY0z9T=E9LMbe$?7_KIg)-R$tD)9NqIt84fb{B;f7C)n+B8)Cvo*F0t!
zva6LeeC}AK4gL#d#<LpOpPalt`s^?A%fPT!zdEW(FA^EFVBGD5=s#;p_o>N_HvvD&
z0;mdU3@7%d5>h(xX-NBmJAOChtb(pX-qUtR<NGf~8Y({*{Qd2}r;MLZ_vin>LF5f$
z`X<bri1=?cM=8<+71}cIK~u!^Xc=hLQi+++$ZeGh>?Kpu?ENMc88>O&ym_$Jc7LZ>
z#73|xJ|aa@l}PawS4Mpt9n)38w#q^P1w2N|rYKdcG;<tU5_YID!TW~j<gG_D0?bfZ
zAx5SYdUR0;(Qp~TWf)<@H*?|jqIg?jv>nb!_nHMZA_09L!j)pBK~e+j?tb-_A`wF8
zIyh>&%v=|n?+~h}%i1#^9UqZ?E9W!qJ0d0EHmioSt@%v7FzF`eM$X==#oaPESHBm@
zYzTXVo*y|C0~l_)|NF|F(If~YWJVkQAEMf5IbH{}#>PZpbXZU;+b^P8L<V=zh^PmD
zL`7&OcUEqxV0p9pX<02z-THUDhdvEGk97J;t-GBJ<nF(C?^w$|%4@|~DP~oZlYgIl
zuI+NRKR*sNKvHH6R=w{`+FIkv?XA>WmlmDJ%Zu)4CajvRL!g_Faph`g0hpA2)D0|h
zYy0h5+<vXcbvZ!}-Ti2$yE64n^Sfk2I--2XL&qjovG)2_V|^=LBv9V~JglT}?G{~<
z!pmh?-EZ?Hnt@nUC6p23YL!L4k^U?vrZo%<4hyajBFhPn!n$|mWN_#4En32u<1zn!
zu-nPRAo(%8b6>@4T81(s0D=crojdj|dYa{Y=<2zKp@xl&{sHO;#|!uTHtTey25f1U
z#=Nyz{rJy#@SPk3_U|aALcg%vEjwIqSO$LZI59<YMW2T5A_lwnC?F0LTE49h#h(4+
z5@#;o=aOg6Ty^S7NeNEi8BQv>^;Mu~Swb53L+>oxWiN7J{;P*(2b@ao*aU~}-_j10
z@fQiaWnb}fRrHhNKrxKmi{aC#34<Ne?5f?i(t}|X_E14g4c;<RChmG6j68+0n_%a=
z5|bnIjoCZq*qma>BRP(a#0K>-J8D+v_2!~(V-6J%M@L{s?fU5ChwFfqn)2$siOUKw
z?SmIRlbE8ot5P^z0J&G+rQ5}H=JE{FNsg`^jab7g-c}o`s{JS{-#}CRdW@hO`HfEp
z1eR0<hko%0^tlAD{Bs=wlKM5<olTH(jMXi+3-x##vBp{A3eZRJrKN8uvd%5RzMT#n
z68`b?pf9bXk0(J)&vOsl{d9K0)2Cr%Vk3VloUq}n%`ke311Pl4;%DuDh2;4Z>DsN!
zt5xmsYt{Uu;ZM`CgW)VYk=!$}N;w+Ct$Wf!*Z-7}@pA62F^1e$Ojz9O5H;TyT&rV(
zr#<BLuF>IBM8<W03YGL3%?f^4_AqtJpyj#h&p$VI3rl`I`^taW$jxAML<$(BdMwx_
zlLmr$vOaoI0IA<o)>te~-2t2;kv2xm&z%tt3pyt|s#vg2EOx1XkfsB<u=a#QAHFyw
zH^#er(Fasy7e*uyj*LRn;;cw)`8HoCa<6waLzyN|B}26Z?f#|l5{!Lo7xhOuO!}qW
zbC^9ND3VwU&(zUs<yvQCMiiM!;ElHzg2J~V^hj}-Lfwl~SrFWideTJ|+XrQuCDiS<
z)vM6eQf~V@yT)+mzn`+@eTvHTgxq*XAn*5~P%Kpv#89KZUu>*RM;D>ab$W-D6#Jdf
zJ3{yD;P4=pFNk2GL$g~+5x;f9m*U2!ovWMK^U5`mAgBRhGpu)e`?#4vsE1aofu)iT
zDm;aQIK6pNd8MMt@}h|t9c$)FT7PLDvu3e)y`otVe1SU4U=o@d!gn(DB9kC>Ac1wJ
z?`{Hq$Q!rGb9h&VL#z+BKsLciCttdLJe9EmZF)J)c1MdVCrxg~EM80<OYrqK%FS_O
zx}L#|X%K3tWqV@0vzDsnnR3Yz?SjfReMeOp#n1B7DSod$5n^}wbM_)dHEDu_nV)?R
z!c3rf)Of{=$5uKL#I@V1Ws|Z5fZ4NpoMn{Vt{-gR^QY-}n)k?MJLe+(H*DLi@ubuD
zJ>_b3k{ur=jVjrVhDK1GTjd3&t#ORvC0Q_&m|n>&TF1C_>k^8&ylR7oz#rG?mE%V|
zepj0BlD|o?p8~LK_to`GINhGyW{{jZ{xqaO*SPvH)BYy1eH22DL_Kkn28N!0z3fzj
z_+xZ3{ph_Tgkd)D$OjREak$O{F~mODA_D`5VsoobVnpxI<L#y)dT{XZ@6C1AwZkx=
z#&n}Q%H5?TjCQfym&hus3U5BHHIrCx1lCD^^tf!XhezUxy8nw6bXYs))PhzY)EbV~
z3_uarYiYvr3Pwc2$wF1I24aXT5%LN$)?(Q8ezWWgqA6SimfTwJTLp0QrC{lEbrWx)
zJ;3xJ%h9biZ#RRkBdua)Y&WiYHVQr56z{shOIS=w&x(H=87V2*HYE2h0gb!qf{Jvq
z^Y==~Gp_|z$%Yc`0s9OhhH~H)!fwAop3O+L?QQ&)<5x(4oOcNSU`gIBbPz$19h8Vi
z=x{Sq{n8pR)3(2lByb(h#PyQT+r6_RQ~eScAm}hch0nJiuE6tB&ns}cLsxs|ui(=>
zV0F_79%JB!?@jPs=cY73FhGuT!<K$a=G|53e{10$p+byZeKD{oLj89mh@LC}=%NX0
z;*KNX7R-K^!*zxK691T$=ETKR3FMLcQe#X=<6^Ubhq;0af0G`<fK*adOjW173pl<B
z01`*u%;G66RFIDk4yL`Xeck?Ec|CUlA6<`FzY$xfm|b6;?e52Vf1?xaS(4T=peR5I
z`?V%dkA|C!r{l_7!OGwBXtbID_FDLfk@nuPBO#I2YcSR_(&2p~ezLTg$*hJyS9id*
zIVqsN$5(G<j!-p(3x6BVMb~3eT}-TWte&t8Hw$UAjb%!=vt3(V#FxL>?fpVX1W=Wm
zK5}i7(Pfh4o|Z{Ur=Y>bM1BDo2OdXBB(4Y#Z!61A8C6;7`6v-(P{ou1mAETEV?Nt<
zMY&?ucJcJ$NyK0Zf@b;U#3ad?#dp`>zmN<gr`{4O%cMrKxJwRla^p0?!O?&AEgD?v
z+o$qCnnug51;!OM^et<=@e!eMXwUGFJXwg~`R((9W1ml^g2V_H^M~P?j;4e#lHGTQ
z@o$?Z;gOHRYcLSD_PBHaO);T6r9aGw>n=H1&-<Xr>H`Y+)ai-TfyZJX@O&nRB*7j$
zDQF!q#a7VHL3z#Hc?Ca!MRbg<t0CM<jNd$9g{^<cPIWj4e6fx|J;XcBe<*U<nwT?=
z|2dLWm#eObkDu9iqDM9n+dIe!&FvDUWehAEb@;_47iOsYhZJ1`$c&IWG&}fV$2)}H
z$Ag?+n{DXVCqvJ=xR_!Y(QY$HsT4GoXpk@2mNXrU7sE_1ouq{duV;<HzGQ?qpd*wp
z@ZzwS=W7<)0Hr(b4ettbWO2^GYSwO|sWaRtx#Mtwp4TWZlPkdry}8Q423of>L`daF
zW#;L$yiQP|5VvgvRLluk3>-1cS+7MQ1)DC&DpYyS9j;!Rt$HdXK1}tG3G_)ZwXvGH
zG;PB^f@CFrbEK4>3gTVj73~Tny+~k_pEHt|^<lR`mlNFIi9z2bxO*+RL86KeAWH4$
zU4VsFpeQG~WVDSof1UN^o@%PJAewV!QpQH-VHGj;=}0vP`eH{TpWLIqcJqm)jkN53
z<II)B6VMc5@{*J}uF{>eLw{?6NbG&`Ng9diB9XsMr(ztNC!{FhW8Hi!)TI`(Q|F*b
z-z;#*c1T~kN67omP(l7)ZuTlxaC_XI(K8$VPfAzj?R**AMb0*p@$^PsN!LB@RYQ4U
zA^xYY9sX4+;7gY%$i%ddfvneGfzbE4ZTJT5Vk3&1`?ULTy28&D#A&{dr5ZlZH&NTz
zdfZr%Rw*Ukmgu@$C5$}QLOyb|PMA5syQns?iN@F|VFEvFPK321mTW^uv?GGNH6rnM
zR9a2vB`}Y++T3Wumy$6<!67?cC%>`W)_c0PS*L;;0J^(T7<)`s{}lZVp`e)fM^?{$
zLbNw>N&6aw5Hlf_M)h8=)x0$*)V-w-Pw5Kh+EY{^$?#{v)_Y{9p5K{DjLnJ(Z<ay_
zQ|zCgJ7Z<@f^IyT#!w8xRb(NaD!Nm0u%yH}t?$zg)w^&IK4Z`0m)_RSq1QCUJEibT
z7kQvMAXo4U!zLzUk>Ucyk*y(6D8wHB8=>Y)fb_Pw0v)Xybk`Sw@hNEaHP$-n`DtYP
ziJyiauEXtuMpWyQjg$gdJR?e+=8w+=5GO-OT8pRaVFP1k^vI|I&agGjN-O*bJEK!M
z`kt^POhUexh+PA&@And|vk-*MirW?>qB(f<fb}iMf`M1*cE2&^ns<lAgNbe9%8FD$
zwjvM|R2me}U1H(R)#ASROdqw^rZnHr0&f97^OKn&Qj^OAr-J8;B23)_uUb<>%y{ux
z*d44UXxQOs+C`e-x4KSWhPg-!gO~kavIL8X3?!Ac2ih-dkK~Ua2qlcs1b-AIWg*8u
z0QvL~51vS$LnmJSO<hpkIr+#{?3T{F9>nV4JUCUzg&4;bSsR5r_=FD@y|)Y2R_--e
zMWJ;~*r<i!;TA2bZ)HKh8;KT9<ZHJ@A^xz#EfNXNM<Iaxvn=m=sJYOJ@7H!t#H3v1
zI%NsU5_wkr0!QqEEvXG^6jST`^S>=vJssF5_*n?wF0DO_>Mja=g+HvT=Yd^uBU|aw
zRixHUQJX0Pgt-nFV+8&|;-n<aRd<Z#DH?k4n__AwYiBH~b*I+O${aSV!V6<4WmU!Y
zsadZ+r7y_;@eome8lEH+W|l)H7<g)uB&cK=<NbeH>>!jNUj!8Y_YzH*%M!-_uWt6&
z|Ec+lAD``i^do;u_?<(RpzsYZVJ8~}|NjUFgXltofbjhf!v&208g^#0<NyCEi~Rq?
z$PwqiMoc*zc>h-x?`z8cInq!9kfVwJ|HQ;VK>p_-fn@(3q?e51Keq(=U-7C0#as-q
z8Or}Ps07>O2@AAXz_%3bTOh{tKm#uRe}Sqr=w6-Wz$FCdfF3qNabEaj`-OfipxaL-
zPh2R*l&%ZbcV?lv4C3+t2DAVSFaRo20^W_n4|0t(_*`?KmmUHG2sNZ*CRZ<Vl7Sz}
z4RnAGishdzC)X@en*4i_sx;)tVg`me7}2q6vh`wr8N?~M3=EDah6vkFwplEVbilC{
zEBNTu$^DB(nS>lCFIyZbJqLdBCj)~%if)g|4NJr(8!R!E0iBbm$;`m;1n2@(8*E%B
zH!g{hK|WK?1jUfM9zX?hlV#l%!6^p$$P+~rg}OdKg|d^Ed4WTY1$1J@WWHr$Os_(L
z;-Zu1FJqhR4LrCUl<W{I<bh|WpctYa0aa`ugIHt3z@UVpXlgD<(WK=XGQjmCkmV!5
z;MYY_v#}DQ2DB;%lGYKUcMJ>)C~E7gA!^wtA6YIh10In9rX@LGSjnTPtLp+gPGp6u
z3}{?J1!yT~?FwqT;O_-1%37f#4ek&DL){N}MX3RbNfRb-T;U^wXhx#De&QssA$lu~
mWkA_K7-+yz9tH*t6hj_Qg(_m7JaeTomk=)l!_+yTk^le-`GmOu

delta 34176
zcmX7vV`H6d(}mmEwr$(CZQE$vU^m*aZQE(=WXEZ2+l}qF_w)XN>&rEBu9;)4>7EB0
zo(HR^Mh47P)@z^^pH!4#b(O8!;$>N+S+v5K5f8RrQ+Qv0_oH#e!pI2>yt4ij>fI9l
zW&-hsVAQg%dpn3NRy$kb_vbM2sr`>bZ48b35m{D=OqX;p8A${^Dp|W&J5mXvUl#_I
zN!~GCBUzj~C%K?<7<Lh)kN@p@FGCC|S+xWQML0moHteKXeb8wJdQH-gjR&7XH4^`G
z18O**eOiwBMhV|yW}+)H1-qhO2aiyh%|2AVjN^2;YOavpiJ0<eag))8h36*<J}UmM
zh5)@`0psU<7DA@>+UZ_q|L)EGG#_*2Zzko-&Kck)Qd2%CpS3{P1co1?$|Sj1?E;PO
z7alI9$X(MDly9AIEZ-vDLhpAKd1x4U#w$OvBtaA{fW9)iD#|AkMrsSaN<NH{Yj<;r
zJR^3Ei65zvOeKyy368On7xFr|udQdRg!uvBg!o!BMrLO4`R~=WSNU)FX3DN?UiRax
zt1Nc*-cP@`?<QFC2v<*!x!PMc9!`H@mKU%%&E@IsfX5sqlj5iC9s3zUdp-4#$Pj{D
z-ud{50Mow^jMOt&t!;$ig-cEDVcZ_LuIYDHKBg^7I=ypK+jgs5kU>z(69;h1iM1#_
z?u?O_aKa>vk=j;AR&*V-p3SY`CI}Uo%eRO(Dr-Te<99WQhi>y&l%UiS%W2m(d#woD
zW?alFl75!1NiUzVqgqY98fSQNjhX3uZ&orB08Y*DFD;sjIddWoJF;S_@{Lx#SQk+9
zvSQ-620z0D7cy8-u_7u?PqYt?R0m2k%PWj%V(L|MCO(@3%l&pzEy7ijNv(VXU9byn
z@6=4zL|qk*7!@QWd9imT9i%y}1#6+%w=s%WmsHbw@{UVc^?nL*GsnACaLnTbr9A>B
zK)H-$tB`>jt9LSw<e?{;w%G1n2P1|J0yx{P*t9jy^kFBQA#W^mMH}$k)?g@xYa+r6
zlJ|^>aY+4!F1q(YO!E7@?SX3X-Ug4r($QrmJnM8m#;#LN`kE>?<{vbCZbhKOrMpux
zTU=<lXsfLv18QvxbhhA4+*COFL{lUUKwTI^?+b!W)%bL{5ICeYgxi==?r7ml!xm!7
zhdowRK-_IXtccBJOk{G;-<SoBvpq6sZLl$N`1P40zF|?WL@Z|Q9X1BGIgTLA`g8zK
z6>02hy${;n&ikcP8PqufhT9nJU>s;dyl;&~|Cs+o{9pCu{cRF+0{iyuH~6=tIZXVd
zR~pJBC3Hf-g%Y|bhTuGyd~3-sm}kaX5=T?p$V?48h4{h2;_u{<w17YEUL6d7r?`IW
zC*$~_<n<G0=2K)oe-lc+anc79OB&v^xcsx>b}8s~Jar{39PnL7DsXpxcX#3zx@f9K
zkkrw9s2*>)&=fLY{=xeIYVICff2Id5cc*~l7ztSsU@xuXYdV1(lLGZ5)?mXyIDf1-
zA7j3P{C5s?$Y-kg60&XML*y93zrir8CNq*EMx)Kw)XA(N({9t-<qoKDSToyx=0O<F
zcZOoLjIgey#`z<{D=F=|jxIUj7G)oJ<z}l*I|pAYR$!%#pP+(2spDO4`pdL|xx}1{
zoCp>XAdX;rjxk`OF%4-0x?ne@LlBQMJe5+$Ir{Oj`@#qe+_-z!g5qQ2<A}CkiPnG%
z#<9e?dl5B^C&2WW>SxKQy1ex_x^Huj%u+S@Ef<hwN)i9H)8f1HlVw`IOD9pOk3F=2
zUFdA$C*zaFwUQBueYyoochf_SCZNJv(o>EPP-70KeL@7@PBfadCUBt%`huTknOCj{
z;v?wZ2&wsL@-iBa(iFd)7duJTY8z-q5^HR-R9d*ex2m^A-~uCvz9B-1C$2xXL#>ow
z!O<5&jhbM&@m=l_aW3F>vjJyy27gY}!9PSU3kITbrbs#Gm<n97W+KiQNM{Zc)RZRJ
zO9VM|sK^tMcU~i!8>0gD?~Tub8ZFFK$X?pdv-%EeopaGB#$rDQHELW!8bVt`%?&>0
zrZUQ0!yP(uzVK?jWJ8^n915hO$v1SLV_&$-2y(iDIg}GDFRo!JzQF#gJoWu^UW0#?
z*OC-SPMEY!LYY*OO95!sv{#-t!3Z!CfomqgzFJld>~CTFKGcr^sUai5s-y^vI5K={
z)cmQthQuKS07e8nLfaIYQ5f}PJQqcmokx?%yzFH*`%k}RyXCt1C<ET#?;-nOj&O_w
z0RjAX8jLRfx+{_%VvA`D$(8(CLoDsiJS|qdlA=Gf(}R42xBwFy^Y@K2Y2B5F73lIC
z_Y!h7$sAGI9OU(?0{R3(+-fA%SuZuc8k~w~-j=n9^J*)UAglq-zi6`BA?FFqiPk`=
zFg88a>hfv5KAeMWbq^2MNft;@`hMyhWg50(!jdAn;Jyx4Yt)^^DVCSu?xRu^<p^cd
z`AfT9K@W351Yp;%_)?5A+{-Sd(?fRZxF>$*&&=O6#JVShU_N3?D)|$5pyP8A!f)`|
z>t0k&S66T*es5(_cs>0F=twYJUrQMqYa2HQvy)d+XW&rai?m;8nW9tL9Ivp9qi2-`
zOQM<}D*g`<R@=@6xNeyfv+%3f>28wJ54H~1U!+)vQh)(cpuf^&8uteU$G{9BUhOL|
zBX{5E1**;hlc0ZAi(r@)IK{Y*ro_UL8Ztf8n{Xnwn=s=qH;<JNq#i!T6Ol{k1N4b^
z$<%S3ch|aFn`rrM7xp7Akdf|09MH!w#X^*^qWGG{=N4~T_X*vr=<9Sr1u0vsR}sts
z)nFJ(24Ixno*7<(J<m!__?DA*(CbmQp|*(D0(fX(I-?~pJ$dd#K$~K_UvNXKlCI0J
zAi?sKWY{_$3e#h0k$v$pwmR{i3$N!{^!LlUzPj3g^GFVYwXlrd2LlB<R)>fxkK+uL
zY)0pvf6-iHfX+{F8&6LzG;&d%^5g`_&GEEx0GU=cJM*}RecV-AqHSK@{TMi<FO;*^
zVIJ;K`_Wr?eL=2LPxeiG(NZ1XC=-->r1jaFf&R{@?|ieOUnmb?lQxCN!GnAqcii9$
z{a!Y{Vfz)xD!m2VfPH=`bk5m6dG{LfgtA4ITT?Sckn<92rt@pG+sk>3UhTQx9ywF3
z=<e;Zhr+VTogSTRTa`0dZhDEYFlz}iYJ-Ca|IInsl^}*}ws*9OfO%7=435_R)~{jX
z|C))|=(?2={M$D}=%iUpf}~t>$|RgTN<fa5trxoGzi!H8bL1;zwAZzO0dvgcXe@7*
zY^o`jnIo&H5j7~yXg%$-pqf(9s|<SUx!UU?X^UEuJZ$s34K@~hg}#3V7Z`DSr`YnM
zvIU1teWhe~+xESB+c<W5In8tK0k4NOX6yQKGIQC&FBWX~Q<%G1#g|49BQj)83&2%|
zUs<JZ#bIxoeZa-tcILuIpp|3uGrjDI|D_t;j#v#bOj@j6furiEu;aSGahA)d$u{2o
zqNVUdWs5~-2cc><=6-B4+UbYWxfQUOe8cmEDY3QL$;mOw&X2;q9x9qNz3J97)3^jb
zdlzkDYLKm^5?3IV>t3fdWwNpq3qY;hsj<HM2+6N#zwmbwcBhBpw2~<e#bkw}$`!Kn
z1)=dUBB{1-93?8Rgm^nY*tF;B7wJ85X%C|9a*1^ara~8e6Ph?%g(rj#aA~z51%f(0
zrd%qQA0cZ0Z2^@t)yso?$#(rr$H2>=pk9;P!wVmjP|6Dw^ez7_&DH9X33$T=Q{>Nl
zv*a*QMM1-2XQ)O=3n@X+RO~S`N13QM81^ZzljPJIFBh%x<~No?@z_&LAl)ap!AflS
zb{yFXU(Uw(dw%NR_l7%eN2VVX;^Ln{I1G+yPQr1AY+0MapBnJ3k1>Zdrw^3aUig*!
z?xQe8C0LW;EDY(qe_P!Z#Q^jP3u$Z3hQpy^w7?jI;~XTz0ju$DQNc4LUyX}+S5zh>
zGkB%~XU+L?3pw&j!i|x6C+RyP+_XYNm9<?|3Dg4wCcC?VQr<bzeKrSpw8b>`rtH<m
z^q>pqxvoCdV_MXg847oHhYJqO+{t!xxdbsw4Ugn($Cwkm<z&(cEdbmmHs@&T9(Qe{
zY0mG0W~lWDbhWX{<STjlgSTP0kYxL@HoRpRDzEHe(+0b)#tmEv>^+36&goy$vkaFs
zrH6F29eMPXyoBha7X^b+N*a!>VZ<&G<WRC+Em14oermb3Ag6>f3eeE+Bgz7PB-6X7
z_%2M~{sTwC^iQVjH9#fVa3IO6E4b*S%M;#WhHa^L+=DP%arD_`eW5G0<9Tk=Ci?P@
z6tJXhej{ZWF=idj32x7dp{zmQY;;D2*11&-(~wifGXLmD6C-XR=K3c>S^_+x!3OuB
z%D&!EOk;V4Sq6eQcE{UEDsPMtED*;qgcJU^UwLwjE-Ww54d73fQ`<mR8A?eX*vOu(
z;s!AeRF7I0k*#FrPh}Ask{q+pF}CGNj<O)=(?Ka}%Tcfb=@JBbsSO=CT&lP}la&!T
zB*Gtuxukvb<;Db%3gAA$>9Sv%^H>juEKmxN+*aD=0Q+ZFH1_J(*$~9&JyUJ6!>(Nj
zi3Z6zWC%Yz0ZjX>thi~rH+lqv<9nkI3?Ghn7@!u3Ef){G(0Pvwnxc&(YeC=Kg2-7z
zr>a^@b_QClXs?Obplq@Lq-l5>W);Y^JbCYk^n8G`8PzCH^rnY5Zk-AN6|7Pn=oF(H
zxE#8LkI;;}K7I^UK55Z)c=zn7OX_XVgFlEGSO}~H^y|wd7piw*b1$kA!0*X*DQ~O`
z*vFvc5Jy7(fFMRq>XA8Tq`E>EF35{?(_;yAdbO8rrmrlb&LceV%;U3haVV}Koh9C|
zTZnR0a(*yN^Hp9u*h+eAdn)d}vPCo3k?GCz1w>OOeme(Mbo*A7)*nEmmUt?eN_vA;
z=~2}K_}BtDXJM-y5fn^v>QQo+%*FdZQFNz^j&rYhmZHgDA-TH47#Wjn_@iH4?6R{J
z%+C8LYIy>{3~A@|y4kN8YZZp72F8F@dOZWp>N0-DyVb4UQd_t^`P)zsCoygL_>>x|
z2Hyu7;n(4G&?wCB4YVUIVg0K!CALjRsb}&4aLS|}0t`C}orYqhFe7N~h9XQ_bIW*f
zGlDCIE`&wwyFX1U>}g#P0xRRn2q9%FPRfm{-M7;}6cS(V6;kn@6!$y06lO>8AE_!O
z{|W{HEA<ltk<^3&v(zsFX*bwn-7C9ar58A%@T#a2aBXBI3o8y|0%iXyV|l}sg<m!U
zT-k`jQb^8oQ(X_pliK#72^1&??md*<37!Bk(#NKKogWc3``(E}^iGHbqW0g7K=ab9
zUpQLYqhr5^vY&U1qg(xAv~ioY%|o`fES|sX{~Wc{ICx(f+xCyUQrPRZo%C)iUsb?a
zew2`T0vB@=rlln7nHw`MOepMp{ML^Ja1HQ#K5&NkV!sK<&i;~{TAs9+9gJ+;Lz$da
zS};~j46utcwL=M>bI0eD$z9tQvWth7y>qpTKQ0$EDsJkQxAaV2+gE28Al8W%t`Pbh
zP<xNDbl}BXrCZDI-ZIp5KNryWfd5bbbb`{6SD?OqGei3JO+_9Y0^=JD49vHrX%anv
zx});E3Pu1^ut&6#2_NeA4BT3`JGz8npG~rjS&&I~|7dIHW39&8ddY=MbOQ07^K~#4
zAG+`}_`B-xd@Z|;49eO;uCH?5F>l#%_S@a^6Y;lH6BfUfZNRKwS#x_keQ`;Rjg@qj
zZRwQ<VVZO-GvahB#0&T?91+}W8%P`g+CV*WTDcQ*ECFq*EHu?RdUx6LGyt0&7`Ke<
z(79}oUUG8J6UjGrhsg*-n+Rzoc4V@;e92&Fv0kzs^dCx1BLpw}k)lbrZ+!!4b9rh_
z{{2T!5K`M=B=D3khI9L_t!YX2loweH^^dUIKs*I^r|TIqcqitK3=NKDIU!(-Fg-cJ
za`ZI<4s`pPup!z94p%kUdn`lUG3}x)93kQpWvT(t+fqvi%M1$&iX<2wVFk(pY2$hw
z;e()Ntun1;jRBx1Z_weKQ&VAEOVyzxlq3KpHRdO0*!<udc458*N}Tk<yvh(lq)+w`
zFEEJtD{)&$;xqmiHT}}u4L}!;Y0mFCG2c*If`gd*;VV3Vr8aURePSQ2wwxyp-Zg;}
z2y5*0{Ns5&4yo$wW`M$Wj^j~)lpJ%p0cE61bW)~~n2lIIinNG2#<)ly#Dd$&{nJPv
zg4t&sQ>XZd-rWngbYC}r6X)VCJ-=D54A+81%(L*8?+&r7(wOxDSNn!t(U}!;5|sjq
zc5yF5$V!;%C#T+T3*AD+A({T)#p$H_<$nDd#M)KOLbd*KoW~9E19BBd-UwBX1<0h9
z8lNI&7Z_r4bx;`%5&;ky+y7PD9F^;Qk{`J@z!jJKyJ|s@lY^y!r9p^75D)_TJ6S*T
zLA7AA*m}Y|5~)-`cyB+lUE9CS_`iB;MM&0f<l?>X**f;$n($fQ1_Zo=u>|n~r$<Jr
zR^#jf&wU3t7icxNwdO00+#eaU-n3>HvkOUK(gv_L&@DE0b4#ya{HN)8bNQMl9hCva
zi~j0v&plR<c*E(e0zzsewSSCWoYNe#zBz~4gPJgFZQI3UCOBaQQRa$tLad>sp?_zR
zA}uI4n;^_Ko5`N-HCw_1BMLd#OAmmIY#ol4M^UjLL-UAat+xA+zxrFqKc@V5Zqan_
z+L<vzaOW^{oV^!V7EZrt5zgiq1K|N3u8LNf1;g77T|EW9D_#STe{m<8-*ti95##sc
zyGd7O;e|{=b{s4r=uzKM#MLq2_E;Cl(9-pAG6@1SP&CT#ClJkT<QXn*!E+nh?X8yH
zcMM9Cu5gnFv(px!)SJCU0$OR|_#*aP@{anWc1hQYPQ<vIYfp}%E>oVX-Ub2mT7Dk_
z<+_3?XWBEM84@J_F}FDe-hl@}x@v-s1AR{_YD!_fMgagH6s9uyi6pW3gdhauG>+H?
zi<5^{dp*5-9v`|m*ceT&`Hqv77oBQ+Da!=?dDO&9jo;<Pz>=JkzrQKx^o$RqAgzL{
zjK@n)JW~lzxB>(o(21ibI}i|r3e;17zT<i-A5WFI)l0=DfsHm5h*a$|nW5w2Z&g&C
zfIgxfWxL<b7<;2;0#?vaiBe<amMP~Hu(BM=D~XPJ7}ZO*rIjib5G!Hs^`n3(-k2!C
z!UiS)1Z$XWmt$B+Er?b&6mkk#-D8jLY4v(Z+xBe4-ze{3Z8c}rWsNw!vUg{(e_E!O
zGy`+{2}jJyQpV^h@Z#T~xRhsp27NBzs^L@HyvOdwuq!yc4;~zS%a~%ld&pD6w$+^X
z4e>jdEl5c`Cn-KAlR7EPp84M@!8~CywES-`mxKJ@Dsf6B18_!XMIq$Q3rTDeIgJ3X
zB1)voa#V{iY^ju>*Cdg&UCbx?d3UMArPRHZauE}c@<I9zuOvh8{QaF~!8NmT14ZcB
zXDiDmH{)Nqe}et`?!f-+>Fdk;z85OcA&Th>ZN%}=VU%3b9={Q(@M4QaeuGE(BbZ{U
z?WPD<in~-M2H?eVIA^jvfi8U5&YUg%&UM*~ACg=ZhWs!uCP(%s`pq9sl~Rn<t^myp
zyBzUD^1Z%w8~>G+sjJSz1OYFpdImKYHUa@ELn%n&PR9&I7B$<-c3e|{tPH*u@hs<V
z<H3(ufuU6=m@PPl*Z5lGM+(I8E&;iIFkSFjg3169JAkH{U;A7oj2f|AG+4C#qrq+Q
zSEMgDyQI)s?9FfgI&>)Ci>Z@5$M?lP(#d#QIz}~()P7mt`<2PT4oHH}R&#dIx4<lE
zZM@x|FQ}SFXpD?iesWRPGe4;I$q-cmdj*5H_;}S&ml}cX6{lN;Hc9cQTAqNu`75Pu
zm)lpl05-+8mc%^XjQ*+==x*CFMVtN~s|N?yyj?nb@+0b65tp1aoBu<}P|sqT#oxbu
z^9TFiuY0AD1GFwI&Vgx(N@^#!xc>uq943D8gVbaa2&Fygr<d;h^~M>Sk3*whGr~Jn
zR4QnS@83UZ_BUGw<CYZIe2@PKT3-tK{$nVwgnd*Bz&L7Z=B%q|uGZL4XMBC&BC8z`
z)4RakhXH*19!wvlHiX`r;-qnceEtmXoaf9Zp<!_s;6!03b&^hmte9c568Cp_f0FC4
z@(8kb-pvrKkck`L9ixZbpEUWNQ0z@i@*Zn<GA0aPaURQm-ybWQ)C=W4nKD;in<YK)
z$64%N3;kIt{W*W&vFr90Wr=?+S%KEmK=Dy9&+KBnRXYEkzmZq_)xy)7^gtx11&*2l
zFT&6!U^|U`oJ*VvM^5Eh;*~96yk0B!PnHB-7=?Z<!C6~0J+Dn$C3)1UuE9Wd>;?@T
zo5jA#potERcBv+dd8V$xTh)COur`TQ^^Yb&cdBcesjHlA3O8SBeKrVj!-D3+_p6%P
zP@e{|^-G-C(}g+=bAuAy8)wcS{$XB?I=|r=&=TvbqeyXiuG43RR>R72Ry7d6RS;n^
zO5J-QIc@)sz_l6%Lg5zA8cgNK^GK_b-Z+M{RLYk5=O|6c%!1u6YMm3jJg{TfS*L%2
zA<*7$@wgJ(M*gyTzz8+7{iRP_e~(CCbGB}FN-#`&1ntct@`5gB-u6oUp3#QDxyF8v
zOjxr}pS{5RpK1l7+l(bC)0>M;%7L?@<gTpQHS2vT6B!6J&3W7)M@B+Riqg<&33yLj
zDz(l!s5Pz!g$so{@5)~9fIqA36)y?X;K=l3yijdZuqQpxQ-60#B4i){*o9>6t}S&a
zx0gP8^sXi(g2_g8+8-1~hKO;9Nn%_S%9djd*;nCLadHpVx(S0tixw2{Q}vOPCWvZg
zjYc6LQ~nIZ*b0m_uN~l{&2df2*ZmBU8dv`#o+^5p>D5l%9@(Y-g%`|$%nQ|SSRm0c
zLZV)45DS8d#v(z6gj&6|ay@MP23leodS8-GWIMH8_YCScX#Xr)mbuvXqSHo*)cY9g
z#Ea+NvHIA)@`L+)T|f$Etx;-vrE3;Gk^O@IN@1{lpg&XzU5Eh3!w;6l=Q$k|%7nj^
z|HGu}c59-Ilzu^w<93il$cRf@C(4Cr2S!!E&7#)GgUH@py?O;Vl&joXrep=2A|3Vn
zH+e$Ctmdy3B^fh%12D$nQk^j|v=>_3JAdKP<DgTp;^DIt;)F-EZ+0`lzs+uJ77mXF
zKO=n36r1cJ6ZeI&O)*O1QP@8JX7{q1%3ybU`ux1R!~W&-hs|$w8=(7Htli#B52kNC
zQ^VL@u3up6CP>t2YVusbNW&CL?M*?`K1mK*!&-9Ecp~>V1w{EK(429OT>DJAV21fG
z=XP=%m+0vV4LdIi#(~XpaUY$~fQ=xA#5?V%xGRr_|5WWV=uoG_Z&{fae)`2~u{6-p
zG>E>8j({w7njU-5Lai|2HhDPn<YS^8ehQhE5I<iRyh-9mT)mWhU$mn4$2>tQ(X@yB
z9l?NGoKB5N98fWrkdN3g8ox7Vic|gfTF~jIfXkm|9Yuu-p>v3d{5&hC+ZD%mh|_=*
zD5v*u(SuLxzX~owH!mJQi%Z=ALvdjyt9U6baVY<88B>{HApAJ~>`buHVGQd%KUu(d
z5#{NEKk6Vy08_8*E(?hqZe2L?P2$>!0~26N(rVzB9KbF&JQOIaU{SumX!TsYzR%wB
z<5EgJXDJ=1L_SNCNZcBWBNeN+Y`)B%R(wEA?}Wi@mp(jcw9&^1EMSM58?68gwnXF`
zzT0_7>)e<HsEdDR$NlH-Oz4z)4YK4*R4;r~#@Bf-qNf*W7N2rb$7_0t8fk5+&(AR?
zC<bDf1Ag^T@+r>p%6hid-*DZ42eU)tFcFz7@bo=<<wtaeOw^nO{PSb9Z|&*5Akk|K
zT2kaOkz6nI=><d29ZzfLPsac!Z^b$VBXIcmh|xmM@r6)Mz5F3JrGc)HCM;QKXdFn2
zN)F<RDq^r=d;jb2Z_(C<ZvTXP1meFPC<#c8lVpTKloUq~l@!Z@3NZ9Vm&6DNgWy6`
zT}ws|4y{dC<8Z`V4@yo&7N=2Lrz)W}q0uSpoVQq?bXwW`hPgX1VxJc#-*ykw$5f~i
zC|ut1-c`N^gj;icG!hG34qg7q@S4iL%Vod%yqRXM`*vS6e0@J#RM8K8!&}P;Cm)AA
z)coSDZ19_26LgSk3ec~JtbuRjAHdkaY|=S$lB0)roUPH^c%Bj9Hk?JTOI5=(QpBAL
z3sAe_Ulf+sv37C%@|)xs+e!7Qj4K_W!%anrHBA})sm;TbBl+0B6}Z)(%yc<S4D7=h
zfb2Z7*=sa~gIe^IJ52<6s26k2%UEB?h3dcZ_+%c$(i1?60)R)50crnWc*@*MJ7j?m
z+#_q#5p|jLUHhtmm6?Sn8@r$&TZ(yj%-c?;b-Jx|^5Dlk#go9U4yb7#!fULIqQBds
z&2I{W54>~CrLXpNDM}tv*-B(ZF`(9^RiM9W4xC%@ZHv=>w(&~$Wta%)Z;d!{J;e@z
zX1Gkw^XrHOfYHR#<ZxGz&lw$T6G0Nxnpuw>hAU=G`v43E$Iq}*gwqm@-mPac0HOZ0
zVtfu7>CQYS_F@n6n#CGcC5R%4{+P4m7uVlg3axX}B(_kf((>W?EhIO&rQ{iUO$16X
zv{Abj3ZApUrc<F~?Lk!w&f2Xtq>ar7Ck}B1%RvnR%uocMlKsRxV9Qqe^Y_5<iO7aU
zq3dedVPYS67#l$e6weB_b04g?APY5;b;`8Mge$lbj+y6C?EmJGf9^Ws=8R+H6IIt7
zKe|lohcPUhO~ppHQMA6xg5WT0HL*b(&d+ITYX&Vxg_jkc$c~ekjBwTWLMPMT{$RcV
z!!#NM$Q>C$xQW@9QdCcF%W#!zj;!xWc+0#VQ*}u&rJ7)zc+{vpw+nV?{tdd&Xs`NV
zKUp|dV98WbWl*_MoyzM0xv8tTNJChwifP!9WM^GD|Mkc75$F;j$K%Y8K@7?uJjq-w
zz*|>EH5jH&oTKlIzueAN2926Uo1OryC|Cmkyo<gXO1RvR0{t_&+f8HnilyXjJ;i5c
zxvz56DxWcDNyd~<XL{%_niD)o#)a~_BvNhsPHlrS(q>QZABt#FtHz)QmQvSX35o`f
z<^*5XXxexj+Q-a#2h4(?_*|!5Pjph@?Na8Z>K%AAjNr3T!7RN;7c)1SqAJfHY|xAV
z1f;p%lSdE8I}E4~tRH(l*rK?OZ>mB4C{3e%E-bUng2ymerg8?M$rXC!D?3O}_mka?
zm*Y~JMu+_F7O4T;#nFv)?Ru6<Jo9R8v(kHoGs?{2=?i%Iyi}0!42){}rxVvL!pJk>
z92r|old*4ZB$*6M<gaMZQRWjo$?vcL>40B;V&2w->#>4DEu0;#vHSgXdEzm{+VS48
z7U1tVn<u)EUy|Q1O0Ir9Rk;P;jjZ*6(#9^$Kg9d7dC=gOZg$lTVjzn?JP?E=U!^HZ
zZX5_RsBK=U`f|HJ?<gCGcIs3j%>#AnQ3z#gP26$!dmS5&JsXsrR>~rWA}%qd{92+j
zu+wYAqrJYOA%WC9nZ>BKH&;9vMSW_59z5LtzS4Q@o5vcrWjg+<k0<>28#&$*8SMYP
z!l5=|p@x6YnmNq>23sQ(^du5K)TB&K8t{P`@T4J5cEFL@qwtsCmn~p>>*b=37y!kB
zn6x{#KjM{S9O_otGQub*K)iIjtE2NfiV~zD2x{4r)IUD(Y8%r`n;#)ujIrl8Sa+L{
z<QB-&R!kciC=u%_Pu&BK7EGV1yUp_s@Qqpd^*Cf6xOgo*V|4$hGSSKA2WpaB33(Y*
zN`4+3BzbZ%lDtqn<HlZ9zS#|E)QFj}w@z>>ixGoZJ1K@;wTUbRRFgnltN_U*^EOJS
zRo4Y+S`cP}e-zNtdl^S5#%oN#HLjmq$W^(Y6=5tM#RBK-M14RO7X(8Gliy3+&9fO;
zXn{60%0sWh1_g1Z2r0MuGwSGUE;l4TI*M!$5dm&v9pO7@KlW@j_Qboe<WL{+D=0|S
z04rq}Cn#r|Qh`OLI1_QL5U}R{geifFF9P8T)vM{2=Wygi8p}p~9owhqk+?19n*#yM
zj*#{xPp0@cJDT3i?GOww`QWntOHm1f!c}va;b?tOb2%YIGP6RX6g6=_2i^T=N30Lx
zGGxIOD~)lgV;r;otK)h-PN}|RW44>Dd1k9!7S)jIwBza-V#1)(7ht|sjY}a19sO!T
z2VEW7nB0!zP=Sx17-6S$r=A)MZikCjlQHE)%_Ka|OY4+jgGOw=I3CM`3ui^=o0p7u
z?xujpg#dRVZCg|{%!^DvoR*~;QBH8ia6%4pOh<#t+e_u!8gjuk<TWg3Zfj1VT(rT(
z+;cFX>_Aic=|*H24Yq~Wup1dTRQs0nlZOy+30f16;f7EYh*^*i9hTZ`h`015%{i|4
z?$7qC3&kt#(jI#<76B<Zc8_jzF}-jz?c}RJj?}d~o|A$peyx&2tAof6rbF8`JJ<LA
zkx}wt?p2W^anecKr7&{Wp)yE)mY79tNY^xv{LL@QzaTPd04d4;6lK5S1YUv7FN_j~
ztrXYDtR<2@iHMgRaE>iz=bl=k<lj_Eu32rlOy9O^>=&qyaH><ZvCyu=u73u5Amj3Z
zlBLffeJyS(F;wLAij_z7LBu;aGHquG4Ecd?iDly_Tmu`)-}iF7q9@!(siy|rCL-T)
zMJ=;>foM#zA7}N`Ji~<RlOT@^-5)rOA8|yZid=(^iWhCiV9#ueyabSRKG4M!ILEeK
z@}E_xM=5xQ^8{3sm^736?!4juH{#woOSkhU{pHmMs7%U%L{L7L?9}ZSTh126kqS##
z7l>)-f-t&tR4^do)-5t?Hz_Q+X~S2bZx{t+MEjwy3kGfbv(ij^@;<DrdI3T`-v~_9
zcRbkI9fdmuaS>=?H_^FIIu*HP_7mpV)NS{MY-Rr7&rvWo@Wd~{Lt!8|66rq`GdGu%
z@<(<7bYcZKCt%_RmTpAjx=TNvdh+ZiLkMN+hT;=tC?%vQQGc7WrCPIYZwYTW`;x|N
zrlEz1yf95FiloUU^(onr3A3>+96;;6aL?($@!JwiQ2hO|^<dM|7%UlhRzx6gJV9|=
z=NpG%ffNZg)Ud#-8(4E`FwI`_0dIbwuD$x#G#SyFPIa|i#MJAmCx}gJ+(iX-<$2`F
zq$b)!gO0}32UorvmcjGcs0oMXeFUsIgX?OLA?6&a$PuFr{46GnR!g|y(}h#A`6l)i
zpT!HijVb^7e>i)b4pCJ7-y&a~B#J`#FO!3uBp{5GBvM2U@K85&o0q~6#LtppE&cVY
z3Bv{xQ-;i}LN-60B2*1suMd=Fi%Y|7@52axZ|b=Wiwk^5eg{9X4}(q%4D5N5_Gm)`
zg~VyFCwfkIKW(@@ZGAlTra6CO$RA_b*yz#){B82N7AYpQ9)s<e%0{=46^?9=ZEQ-l
zAQWxGXxNdHjc*vyWIT!33B;oq*FC${iQp|GUP9ZdljM~?wy^$O5X<tj{P6elLK%T5
zC#svA*D5wmh9fQFpm0}|k!**l^Nlj<UP85>LQfhOAOMUV7$0|d$=_y&jl>va$3u-H
z_+H*|UXBPLe%N2Uk<CC2<5os`NfNoGP!Ib0m9`%)&9#>wu1*)kt!$Y>(IH3`YbEt;
znb1uB*{UgwG{pQnh>h@vyCE!6B~!k}NxEai#iY{$!_w54s5!6jG9%pr=S~3Km^EEA
z)sCnnau+ZY)(}IK#(3jGGADw8V7#v~<&y5cF=5_Ypkrs3&<giP_=TY>7{}%(4KM7)
zuSHVqo~g#1kzNwXc39%hL8atpa1Wd#V^uL<!G-fTwDKo?kirzAqPxES@VyF*HS5iQ
z6u^SQDo@?kL(sZYU;lwg?P>=W^&E)fvGivt)B!M)?)Y#Ze&zU6O_I?1wj)*M;b*dE
zqlcwgX#eVuZj2GKgBu@QB(#LHMd`qk<08i$hG1@g1;zD*#(9PHjVWl*5!;ER{Q#A9
zyQ%fu<$U?dOW=&_#~{nrq{RRyD8upRi}c-m!n)DZw9P>WGs>o1vefI}ujt_`O@l#Z
z%xnOt4&e}LlM1-0*dd?|EvrAO-$fX8i{aTP^2wsmSDd!Xc9DxJB=x1}6|yM~QQPbl
z0xrJcQNtWHgt*MdGmt<!{59BQ@6R8^J{W0F$k->j%x6SWYd?uGnrx4{m{6A9bYx`m
z$*UAs@9?3s;@Jl19%$!3TxPlCkawEk12FADYJClt0N@O@Pxxhj+Kk(1jK~<na;r+|
zm{2yx7Tja~_uQ<c+6H|8mu<-YUr>laR0*KGAc7%C4nI^v2NShTc4#?!p{0@p<m@p~
zP+-C1vUzlE>0T#HSIRndH;#Ts0YECtlSR}~{Uck+keoJq6iH)(Zc~C!fBe2~4(Wd>
zR<rpD32Yz=|MVv!jF0SQWXAJmWFDV0ka3bIedmZ8+smZ53Ho~&j~&2Ke3DNyKLA+A
zbJ10q_<tT*Npv&sy}xR;{lmk%mN;2WFCXUz0F+vcRuJB#5+NyF41aEUQ~yy+_{tj7
zrTp6j;lWAkEZhiI7QwVMiDXtF6(d<{RD?!c&lT5iMqpaD7bA4G&{!+@%C<d+c70Wi
zU;*do=_MRGv5LZbeY<RwC*Ablvqx17uLc~M%ux><4I1zMeW$<0xww(@09!l?;oDiq
zk8qjS9Lxv$<5m#j(?4VLDgLz;8b$B%XO|9i7^1M;V{aGC#JT)c+L=BgCfO5k>CTlI
zOlf~DzcopV29Dajzt*OcYvaUH{UJPaD$;spv%>{y8goE+bDD$~HQbON>W*~JD`;`-
zZEcCP<ta~{4Akw!C0ePB!7KfHnqyMC?0a{DvplTx4je+~_=&7<z9BH2!>SdlCvANe
z=?|+e{6AW$f(H;BND>uy1MvQ`pri>SafK5bK!YAE>0URAW9RS8#LWUHBOc&BNQ9T+
zJpg~Eky!u!9WBk)!$Z?!^3M~o_VPERYnk1NmzVYaGH;1h+;st==-;jzF~2LTn+x*k
zvywHZg7~=<axHmC^DNM(rrxXXZ+6q8kDUy#Wo11Iv58)OcYVE^Pyh_LpKFMxqfz^m
zX-?%QT4qvLZS`UJtdA|zc7nI&w@Ai(hyYF^v>aiJe=OhS@U>1fYGvT1+jsAaiaM;)
zay2xsMKhO+FIeK?|K{G4SJOEt*eX?!>K8jpsZWW8c!X|JR#v(1+Ey5NM^TB1n|_40
z@Db2gH}PNT+3YEyqXP8U@)`E|Xat<{K5K;eK7O0yV72m|b!o43!e-!P>iW>7-9HN7
zmmc7)JX0^lPz<DsX{e!8YOmOSO*e%?uh^R5cfwUMA1cm{WQM4>F#>$#D~nU^3f!~Q
zQWly&oZEb1847&czU;dg?=dS>z3lJkADL1innNtE(f?~OxM`%A_PBp?Lj;zDDomf$
z;|P=FTmqX|!sHO6uIfCmh4Fbgw@`DOn#`qAPEsYUi<Sw*qR|D%uSTGytX2<>BvUlw
zevH{)YWQu>FPXU$%1!h*2rtk_J}qNkkq+StX8Wc*KgG$yH#p-kcD&)%>)Yctb^JDB
zJe>=!)5nc~?6hrE_3n^_BE<^;2{}&Z>Dr)bX>H{?kK{@R)`R5lnlO6yU&UmWy=d03
z*(jJIwU3l0HRW1PvReOb|MyZT^700rg8eFp#p<3Et%9msiCxR+jefK%x81+iN0=hG
z;<`^RUVU+S)Iv-*5y^MqD@=cp{_cP4`s=z)Ti3!Bf@zCmfpZTwf|>|0t^E8R^s`ad
z5~tA?0x7OM{*D;zb6bvPu|F5XpF11`U<t~+Cx_B1`Z?9!gYQ4&!ts?51b2>5;b*$p
zNAq7E6c=aUnq>}$JAYsO&=L^`M|DdSSp5O4LA{|tO5^8%Hf1lqqo)sj=!aLNKn9(3
zvKk($N`p`f&u+8e^Z-?uc2GZ_6-HDQs@l%+pWh!|S9+y3!jrr3V%cr{FNe&U6(tYs
zLto$0D+2}K_<BSVc4q*O)uySXMPx!L{%pO}$eiT(du2M$spXfHZRz<w6X+6bVU4k9
zN@%hHFXZKrp?pIw&xB@-kL0cNJ>9kuxgFSeQ!EOXjJtZ$Pyl_|$mPQ9#fES=Sw8L%
zO7Jij9cscU)@W+$jeG<B&7|0SBAwFCf%-Zn?fuTSb+p^e@h~60vII8TXxfM|e04Bt
zy@W0cVbw}gVt?ity0Gt&-}Z-&kd+(02DzwKxR8olSYId-ycIO>px&vWP9ZN3fLDTp
zaYM$gJD8ccf&g>n?a56<DwgIK`LkiBKZbuS+^?j{+S7aD;C88gpGwnU|F*rQZag*2
zUg`I<vSR(<ms`C@QZl9<7{O`3#mCATDto?_bb8(LkEVJ4q%*CfZ#+s#!(loq^>X=y
zec%n<x7o9&6f>LN`(dVCpSl9&pJLf2BN;cR5F0Nn{(<Ebul!}s7PIg_pO;G7Fpl=0
z@*Mn6d7fm%|BL90VthiyGnR}>LjGe7RjFe7efp3R_2JmHOY#nWEc2TMhMSj5tBf-L
zlxP3<v`xK)VzhGRzi_HGgaSOoYS>sV`!?@!mRnDTac{35I7<izXnk?f{kA#xa2S3!
z{k7hS;q0Sh7b`M#(tpCk400Lc;D6?CQ^v8;AHXR5eyBE`_v<xTtKe)Mwp#-j^DsjS
zsLKM$h-e&5i>h@WTfRjRiFw*Q*aD8)n)jdkJC@)jD-&mzAdK6Kqdct8P}~dqixq;n
zjnX!pb^;5*Rr?5ycT7>AB9)RED^x+DV<PtA2YVOErZzn~r7$zWHe1`39HIxp#q<lB
zGJt15`R_`Vb@|g>DmIbHKjcDv2lHK;apZOc=O@`4nJ;k|iikKk66v4{zN#lmSn$lh
z_-Y3FC)iV$rFJH!#mNqWHF-DtSNbI)84+VLDWg$ph_tkKn_6+M1RZ!)EKaRhY={el
zG-i@H!fvpH&4~$5Q+zHU(Ub=;Lzcrc3;4Cqqbr$O`c5M#UMtslK<bCBM6b4qP%uu2
zXpMuX2`WDC1lqF`Y$CO^C&>$3r+Cuz>xKl+xW?`t2o=q`1djXC=Q6`3C${*>dm~I{
z(aQH&Qd{{X+&+-4{epSL;q%n$)NOQ7kM}ea9bA++*F+t$2$%F!U!U}(&y7Sd0jQMV
zkOhuJ$+g7^kb<`jqFiq(y1-~JjP13J&uB=hfjH5yAArMZx?VzW1~>tln~d5p<T#Fl
zEVb(Bo{e)Z!MoQ~F^-3jEd3&CO04c*(y4e(v&DYgDaSv=<a!2FuuuIn;dZ$$Ay{KO
z7sdqF?l_u#_)CM+2NYmxY}Ccl0Y%psg1B}Z_hNri;B-leZ>t$uWR~TM!lIg+D)prR
zocU0N2}_WTYpU`@Bsi1z{$le`dO{-pHFQr{M}%iEkX@0fv!AGCTcB90@e|slf#unz
z*w4Cf>(^XI64l|MmWih1g!kwMJiifdt4C<5BHtaS%Ra>~3IFwjdu;_v*7BL|fPu+c
zNp6<j(&v4l8ppxnoKOCUI~><clB|zIt>87`{}e@|%)5g4U*i=0zlSWXzz=YcZ*&Bg
zr$r(SH0V5a%oHh*t&0y%R8&jDI=6VTWS_kJ!^WN!ET@XfEHYG-T1jJsDd`yEgh!^*
z+!P62=v`R2=TBVjt=h}|JIg7N^RevZuyxyS+jsk>=iLA52Ak+7L?2$ZDUaWdi1PgB
z_;*Uae_n&7o27ewV*y(wwK~8~tU<#Np6UUIx}zW6fR&dKiPq|$A{BwG_-wVfkm+EP
zxHU@m`im3cD#fH63>_X`Il-HjZN_hqOVMG;(#7RmI13D-s_>41l|vDH1BglPsNJ+p
zTniY{Hwoief+h%C^|@Syep#722=wmcTR7awIzimAcye?@F~f|n<$%<glynGe@l_#9
z30nmky{?<JKz{){SsGIs*^?U{?(p8<zkVtCHiV|D1BtlXY&|PWhdBFPEJ=ac!<CGF
zDzeno1U+s@ohY`k^InNs;j?P(V=hKzj^=A>=rM+Jkz9<kZJd?(pl-XwbK9uEX7+62
zMb6tu%v|dH9xCO5RX}L!n!qj65W$a-v}tm=>m>PF70$)AK@|h_^(zn?!;={;9Zo7{
zBI7O?6!J2Ixxk;XzS~ScO9{K1U9swGvR_d+SkromF040|Slk%$)M;9O_8h0@WPe4=
z%iWM^ust8w$(NhO)7*8uq+9CycO$3m-l}O70sBi<4=j0CeE_&3iRUWJkDM$FIfrkR
zHG2|hVh3?Nt$fdI$W?<|Qq@#hjDijk@7eUr1&JHYI>(_Q4^3$+Zz&R)Z`WqhBIvjo
zX#EbA8P0Qla-yACvt)%oAVHa#kZi3Y8|(IOp_Z6J-t{)98*OXQ#8^>vTENsV@(M}^
z(>8BXw`{+)BfyZB!&85hT0!$>7$uLgp9hP9M7v=5@H`atsri1^{1VDxDqizj46-2^
z?&eA9udH#BD|QY2B7Zr$l;NJ-$L!u8G{MZoX)~bua5J=0p_JnM`$(D4S!uF}4smWq
zVo%<tG@hoMj@<)H-JgP<Q7M9}m_vBCyCqYX-AdJU@&LEsL`m0haD)<x4J(=(3c|s#
zbn&v-l*)`eo?|iFuk96r?UB%1QXu?v?Njkszif{O!?^mu1lpr2r-OQV&9H@hntG(^
zj|_uj(Vzk+(<<LE1b+=&nd@qy$tcs41*1E26ryDYO9tiLn1xdy13ji(ME+C8#&uuz
zBIDnqWI!p+pkz{ewa6|8Ly~HAiW$WIf_|tUyK#R2a7JuZi2J)_S$l>kQ~C~X?cWCH
zo4s#FqJ)k|D{c_ok+sZ8`m2#-Uk8*o)io`B+WTD0PDA!G`DjtibftJXhPVjLZj~g&
z=MM9nF$7}xvILx}BhM;J-Xnz0=^m1N2`Mhn6@ct+-!ijIcgi6FZ*oIPH(tGYJ2EQ0
z{;cjcc>_GkAlWEZ2zZLA_oa-(vYBp7XLPbHCBcGH$K9AK6nx}}ya%QB2=r$A;11*~
z_wfru1SkIQ0&QUqd)%eAY^FL!G;t@7-prQ|drDn#yDf%Uz8&kGtrPxKv?*TqkC(}g
zUx10<;3Vhn<P(upRheT&3q1!X(bJNsLya$_=t*6hp5+8ZJ+|fGwhh!2S54M5{Z^Ik
zEWCn6ECjbZ;0S?VE83KP;dH@N8NAfvRqx3ALd>x{<Qf_SE}JUOjTetQ0k>gpWXM8H
zKc0kkM~gIAts$E!X-?3DWG&^knj4h(q5(L;V81VWyC@_71oIpXfsb0S(^Js#N_0E}
zJ%|XX&EeVPyu<mLTv8P+%0HPi%$><S@&-Ug3j3&ZjEz64uu4u7(cVJluR3`Mvu>}?
zz~(%slTw+tcY<LfEsDqkG5n$OFpv4hT>3ZMG$+diC8zed=CTN}1fB`RXD_v2;{evY
z@MCG$l9Az+F()8*SqFyrg3jrN7k^x3?;A?L&>y{ZUi$T8!F7Dv8s}}4r9+Wo0h^m=
zAob@CnJ;IR-{|<mV&-EKHX@5=1&om;I{UO+M+*6S+1rH~%#vNH`@gg_)uUaJdy=-_
zt(r+-w@a`jChNk+<Fm9pQ;UiGUjV$D;bb|zan@bWL;-y+;<a~?cC;!wr2>_D;_w)?
zcH@~&V^(}Ag}%A90);X2AhDj(-YB>$>GrW1F4C*1S5`u@N{T|;pYX1;E?gtBbPvS*
zlv3r#rw2KCmLqX0kGT8&%#A6Sc(S>apOHtfn+UdYiN4qPawcL{Sb$>&I)Ie>Xs~ej
z7)a=-92!sv-A{-7sqiG-ysG0k&beq6^<kX#blPuBTLk4nUZLa0Rw?p{JzAbo@#y^A
zDH9Et(b$xVU^HU5S36gthHjgsck-_;Jyj@#E`~oe>nX1L!Fs$JU#fsV*CbsZqBQ|y
z{)}zvtEwO%(&mIG|L?qs2Ou1rqTZHV@H+sm8Nth(+#dp0DW4VXG;;tCh`{BpY)THY
z_10NNWpJuzCG%Q@#Aj>!v7Eq8eI6_JK3g2CsB2jz)2^bWiM{&U8clnV7<2?Qx5*k_
zl9B$P@LV7Sani>Xum{^yJ6uYxM4UHnw4zbPdM|PeppudXe<Dfw0>}+<H|lAF(>OcX
z!nr!xaUA|xYtA~jE|436iL&L={H3e}H`M1;2|pLG)Z~~Ug9X%_#D!DW>w}Es!D{=4
zxRPBf5UWm2{}D>Em;v43miQ~2{>%>O*`wA{7j;yh;*DV=C-bs;3p{AD;>VPcn>E;V
zLgtw|Y{|Beo+_ABz`lofH+cdf33LjIf!RdcW~wWgmsE%2yCQGbst4TS_t%6nS8a+m
zFEr<|9TQzQC@<(yNN9GR4S$H-SA?xiLIK2O2>*w-?cdzNPsG4D3&%$QOK{w)@Dk}W
z|3_Z>U`XBu7j6Vc=es(tz}c7k4al1$cqDW4a~|xgE9zPX(C`IsN(QwNomzsBOHqjd
zi{<R{)|=YTo!0p@cbjBET4CHtzjF)FzZS}wo@ivqa)?dg1(I9m+LTuz^9@^HgJ7x6
zruk6yLp~0QlAd9mMnv(61_Zgfu%Fglg5Jq?%opsVV1y)NRQk$pq7n0k+_>D|jYSv5
zC>6#uB~%#!!*?zXW`!yHWjbjwm!#eo3hm;>nJ!<`ZkJamE6i>>WqkoTpbm(~b%G_v
z`t3Z#ERips;EoA_0c?r@WjEP|ulD+hue5r8946Sd0kuBD$A!=dxigTZn)u3>U;Y8l
zX9j(R*(;;i&HrB&M|Xnitzf@><3#)aKy=bFCf5Hz@_);{nlL?J!U>%fL$Fk~Ocs3&
zB@-Ek%W>h9#$QIYg07&lS_CG3d~LrygXclO!Ws<oAB91#zpSK#Pi1&6uk?}<Ww;*D
zKHhb!yUGj8>-|PxMsn@n{?77wCaq?uj`dd7lllDCGd?ed&%5k{RqUhiN1u&?uz@Fq
zNkv_4xmF<uz?T3Rp6xNF5T%O}(Z;=T72xBIUa=nmY%9x|r@N@*M&qcZo<xtHF_?Oa
zF1a!vjr>cl?vs>;emR1R<$tg;*Ay<V#f!wRQz%qNBZlVHFu*nL9%5U{m0>p@rl=ik
z=x2<DREGik9u=4@Y%Eekt_pE0+QU2oAJ}tFU)uZDF1G-h(D*jZy9JCh@`s8N*i>Hk
zJqsM%++e|*+#camAiem6f;3-khtIgjYmNL0x|Mz|y{r{6<@_&a7^1XDyE>v*uo!qF
zBq^I8PiF#w<-lFvFx9xKoi&0j)4LX~rWsK$%3hr@ebDv^($$T^4m4h#Q-(u*Mbt6F
zE%y0Fvozv=WAaTj6EWZ)cX{|9=AZDvPQuq>2fUkU(!j1GmdgeYLX`B0BbGK(331ME
zu3yZ3jQ@2)WW5!C#~y}=q5Av=_;+hNi!%gmY;}~~e!S&&^{4eJuNQ2kud%Olf8TRI
zW-Dze987<Ep(e1WRKI|@Jy&6ah2?#Q>Il<^!hCO{AR5tLW{F1WLuZ>nhPjke@CSnN
zzoW{m!+PSCb7byUf-1b;`{0GU^zg7b9c!7ueJF`>L;|akVzb&IzoLNNEfxp7b7xMN
zKs9QG6v@t7X)yYN9}3d4>*ROMiK-Ig8(Do$3U<Qx6_~&x4muKM7GIi?xqFM9bm$N9
z#ze4ENG#9H&h^cus4XL3-?GKO9{iJ@&Va8SUG@C6*P0WGjNj5=YpI9rfms4rql;R`
zaDToC?<qV4voyYA2A<Z)IzS$)GMPeQLqyW*S0S%v0iytIX9PpAFOUXkH2lc|+N4iO
z1h5RtQ+&FD@|rHV+H&b20qiLt>I&E}z!vcH2t(VIk-cLyC-Y%`)~>Ce23A=dQsc<(
ziy;8MmHki+5-(CR8$=lRt{(9B9W59Pz|z0^;`C!q<^PyE$KXt!KibFH*xcB9V%xTD
zn;YlZ*tTukwr$(mWMka@|8CW-J8!zCXI{<pR8OBi-_H?FfA)@2XB?(9yoWQ__Z_lr
zeuIIdY}4-^pM-ftYI`S08*}cGCw>P1-&=<B^P5d1)YJk^PW05ogC|Bdkjfg9uR{xP
zHcZUdWCT8bPfNC#O%hKtj9d2Hc0YH&znsX_@_kUDRL2|3x^Fv*tcGwbJzmTYiqoj0
zRfIn+FRhAB9~tuITO69xq_LVntt^TU%&|bRLqEzgavO>wSvZf&%9SZ7m`1&2^nV#D
z6T*)`Mz3wGUC69Fg0Xk!hwY}ykk!TE%mr57TLX*U4ygwvM^!#G`HYKLIN>gT;?mo%
zAxGgzSnm{}vRG}K)8n(XjG#d+I<su=uH~+nz!ctFY7^qIE<|rut@=Lcgc2xFld(*9
zs|yrxP&}#v4{LU8qAk^lu@bX}_!mF={O^YR+|?QD%b%o6xX>yAFnozhk|uwiey(p@
zu>j#n4C|Mhtd=0G?Qn5OGh{{^MWR)V*geNY8d)py)@5a85G&_&OSCx4ASW8g&AEXa
zC}^ET`eORgG*$$Q1L=9_8MCUO4Mr^1IA{^nsB$>#Bi(vN$l8+p(U^0dvN_{Cu-UUm
zQyJc!8>RWp;C3*2dGp49QVW`CRR@no(t+D|@nl138lu@%c1VCy3|v4VoKZ4AwnnjF
z__8f$usTzF)TQ$sQ^|#(M}-#0^3Ag%A0%5vA=KK$37I`RY({kF-z$(P50pf3_<kT*
zu`s$>20YTr%G@w+bxE_V+Tt^YHgrlu$#wjp7igF!=o8e2rqCs|>XM9+M7~TqI&fcx
z=pcX6_MQQ{TIR6a<EerAAlkb)G^0$baC*tO(ycXzU0DmM83ruVs#2~=MFE#!!@jm(
zza|i2_2T@P<~j(R6~06cLW14iRP_SHz{-R%KQd3+A}<-iYz8nW#YK8kur2(c!C1}9
zL6X9`9Wc(<GPrs01Jd(MdV}iM6OieZ64HwmB~*qo(TfICd;&yxM3NTWUkRMO8yxq#
zG_bBGM>0*~xdgFvs<2!yaA1F*4IZgI!)xnzJCwsG&EElg_IpFbrT}nr)UQy}GiK;(
zDlG$cksync34R3J^FqJ=={_y9x_pcd%$B*u&vr7^ItxqWFIAkJgaAQiA)pioK1JQ|
zYB_6IUKc$UM*~f9{Xzw*tY$pUglV*?BDQuhsca*Fx!sm`9y`V&?lVTH%%1eJ74#D_
z7W+@8@7LAu{aq)sPys{MM~;`k>T%-wPA)E2QH7(Z4XEUrQ5YstG`Uf@w{n_Oc!wem
z7=8z;k$N{T74B*zVyJI~4d60M09FYG`33;Wxh=^Ixhs69U_SG_deO~_OUO1s9K-8p
z5{HmcXAaKqHrQ@(t?d@;63;Pnj2Kk<;Hx=kr>*Ko`F*l){%GVDj5nkohSU)B&5Vrc
zo0u%|b%|VITSB)BXTRPQC=Bv=qplloSI#iKV#~z#t#q*jcS`3s&w-z^m--CYDI7n2
z%{LHFZ*(1u4DvhES|Dc*n%JL8%8?h7boNf|qxl8D)np@5t~VORwQn)TuSI07b-T=_
zo8qh+0yf|-6=x;Ra$w&WeVZhUO%3v6Ni*}i&sby3s_(?l5Er{K9%0_dE<`7^>8mLr
zZ|~<y&-g)~txDcjmw~CDXEPUCj(!3kY~@IQaXl0)+%b5&Y?+~Wa*LtayngeKl0gR2
zWSheF+&IbkBG<*mqT`}~I@WLlB@30ju(e^JkaW9W6|<#tM`e^}3);+iAItViV&wB#
zO`W^b1H3h$Hzv(58Ribb-Xh1k%qv7UK2J5l^fgp7_sBjE)_|1fO^WL(vNm6CKEXLc
z?6h^X9|hD1FbuF+;0(pOKIu8jXEKi%ig3C)<$yC6mqD839;oCI6{f?r8h#I)q}7{z
zhdCEvja~GfE&fFAUVvbZM51*`2CP+9d3)CBN9C4Zs6P6Z9~R`mfjXnj{hP08?Qt1g
zLDpcl_8|@m5Xgk|IY;j#AY4Ij2!R9>l#Bi@5}8{<Vy?pt0J|y0{gh3bi6~2-C_tIM
zVh!Pagqv5~mhUyyW>iZ$(d9)!`}@2~#sA~?uH|EbrJQcTw|ssG)MSJJIF96-_gf&*
zy~I&$m6e0nnL<IlXZRPqNxp=jHeJQ42(Z{Y*!;`f3W#rwCyTB1h*-OJ@@e3h&}SQu
zU-t(Z{uSv>z^M2;G|IeUk?s+afSZ){10*P~9W%RtYeSg{Nv5FG<2QaWpj?d`;}<4(
z>V1i|wNTpH`jJtvTD0C3CTws410U9HS_%Ti2HaB~%^h6{+$@5`K9}T=eQL;dMZ?=Y
zX^z?B3ZU_!E^OW%Z*-+t&B-(kLmDw<gr*TZvRf2rfa=KH9`=-+9W9)d*GPjw!lWmR
zNmE-kllByCsai0Tahs#03W>ikb9+F9bj;NFq-XHRB=+L)Rew{w|7p~7ph{#fRT}}K
zWA)F7;kJBCk^aFILnk<BF~6}Ua_B}80{ftECm@?iNgT`lB?3~df1uI+ft9Cw7i;yt
z3<ShU2pmPSJS)Vf*8uEGi-}U9VKstmq^<fVRnV6yeSGxb@aM0~`8;RI!)TH{dMd$T
zS<*v=bgkcnOdnp>V^EMs=B~#qh*RG2&@F|x2$?7QTX_T6qL?i$c6J*-cNQC~E6dro
zR)CGIoz;~V?=>;(NF4dihkz~Koqu}VNPE9^R{L@e6WkL{fK84H?C*uvKkO(!H-&y(
zq|@B~juu*x#J_i3gBrS0*5U*%NDg+Ur9euL*5QaF^?-pxxieMM6k_xAP;S}sfKmIa
zj(T6o{4RfARHz25YWzv=QaJ4P!O$LHE(L~6fB89$`6+olZR!#%y?_v+Cf+g)5#!ZM
zkabT-y%v|ihYuV}Y%-B%pxL264?K%CXlbd_s<<TimgGAnDShiYe)n)%+e)ctIIBiN
zCdyp?(mnu<>GY5BG*`kYQjao$QHiC_qPk5uE~AO+F=eOtTWJ1vm*cU(D5kvs3kity
z$IYG{$L<8|&I>|WwpCWo5K3!On`)9PIx(u<N-i&JsU?~{x!<le*<Cho@L`rVa4ToR
zlqrqoBV>WAq>bSQTvSW`NqgprBIuV^V>C~?+d(w$ZXb39Vs`R=BX;4HISfN^qW!{4
z^amy@Nqw6oqqobiNlxzxU*z2>2Q;9$Cr{K;*&l!;Y??vi^)G|tefJG9utf|~4x<cZ
zX0P0O4txu3=E3GE&U2m@J>h=r3UjmRlADyLC*i`r+m;$7?7*bL!oR4=yU<8<-3XVA
z%sAb<meJ2Y3ySbt6O+x7lG@C4_*@!j6u>`xe&4RV(2vj+1*ktLs<&m~mGJ@RuJ)1c
zLxZyjg~*PfOeAm8R>7e&#FXBsfU<eMU79O%BS@_5qwkw4T7wgygMtxSp&l=ZdEk5B
zBg%Q(1EGMM#TWgrrn6WAtlk?eIn)E68`DMBOB~f=Xt5D?9G8fOPMg)3mJ~jk+$=Dw
zZPEKM1TNUI%fmqSr@^O<v~HmJAfIt9A1nh$j2K$G>_?azU=uxBm=E6z7FSr7J>{XY
z1qUT>dh`X(zHRML_H-7He^P_?148AkDqrb>;~1M-k+xHVy>;D7p!z=XBgxMGQX2{*
z-xMCOwS33&K^~3%#k`eIjKWvNe1f3y#}U4;J+#-{;=Xne^6+eH@eGJK#i|`~dgV5S
zdn%`RHBsC!=9Q=&=wNbV#pDv6rgl?k1wM03*mN`dQBT4K%uRoyoH{e=ZL5E*`~X|T
zbKG9aWI}7NGTQtjc3BYDTY3LbkgBNSHG$5xVx8gc@dEuJqT~QPBD=Scf53#kZzZ6W
zM^$vkvMx+-0$6R^{{hZ2qLju~e85Em>1nDcRN3-Mm7x;87W#@RSIW9G>TT6Q{4e~b
z8DN%n83FvXWdpr|I_8TaMv~MCqq0TA{AXYO-(~l=ug42gpMUvOjG_pWSEdDJ2Bxqz
z!em;9=7y3HW*XUtK+M^)fycd8A6Q@B<4biGAR)r%gQf>lWI%WmMbij;un)qhk$bff
zQxb{&L;`-1uv<!Unl~Y>aCE7Fm*83^0;!QA5-zeSvKY}WjbwE68)jqnOmj^CTBHaD
zvK6}Mc$a39b~Y(AoS|$%ePoHgMjIIux?;*;=Y|3zyfo)^fM=1GBbn7NCuKSxp1J|z
zC>n4!X_w*R8es1ofcPrD>%e=E*@^)7gc?+JC@mJAYsXP;10~gZv0!Egi~){3mjVzs
z^PrgddFewu>Ax_G&tj-!L=TuRl0FAh#X0gtQE#~}(dSyP<a8`o1qYX&B$5>O=@7yd
zNC6l<clAx3O3@a<LB2`9Fw(6kTH2y{(PQ8Xy4XFR0|)dgRB7oTri5>_?zs_u5&x8O
zQ|_JvKf!WHf43F0R%NQwGQi-Dy7~<x)tZ#=V~Be^Zc!Y~@6@<%snVBkQxwTo5x0`E
z#gimVo$wNZs({agM0#vX$3ivZBc#i$E%mb~I-^M+w!gE01e0%}n1qOi9A3Z<ZJe37
z2Z*yG2W+iY2P#c};mhfLc~rFVw)4Je)QnZxDw5wvLup|wd%@P4J*tGP9yF1%Nll-@
zlO1hF2n*2K@2Zu{`CQPt46~lch;D>PGZ@KRKMp?kxlaLAV=X{UkKgaTu2!qzPi8aJ
z-;n$}unR?%uzCkMHwb56T%IUV)h>qS(X<EpfLtJYhILPy8sW%(9OlK128bkhQ-#BL
zVMG_gO7R`(7jS=<1ehw;*`&(cjBT66@$i~b&l@n0xao!&{}w0SC+)|=y8jd%Zy2H@
zWBEqpyS|mllmaeA;dIAUTbBDCP@K?Ji9y)BM*@uV70w6-+JLqNGt$tJxi$dY?2_XL
zx@z%Vb(YkK^=I>i<zZShICE5HaaJv#-(t%csf^j}rnT`qq#k+2M`Xh^Wr?@u%)lO|
z4ZQQR$;A{D>uRLh3fdlr!Cri|{fZf0x9GVYUOlsKgxLA7vHrkpQddcSsg4JfibzpB
zwR!vYiL)7%u8JG7^x@^px(t-c_Xt|9Dm)C@_zGeW_3nMLZBA*9*!fLTV$Uf1a0rDt
zJI@Z6pdB9J(a|&T_&AocM2WLNB;fpLnlOFtC9yE6cb39?*1@wy8UgruTtX?@=<6YW
zF%82|(F7ANWQ`#HPyPqG6~ggFlhJW#R>%p@fzrpL^K)Kbwj(@#7s97r`)iJ{&-ToR
z$7(mQI@~;lwY+8dSKP~0G|#sjL2lS0LQP3Oe=>#NZ|JKKYd6s6qwe#<Anf0<kXN`R
z5lnAdra^vwG(T7cLsTWNRURHI4_OuFP<tc0rV%hLL$|;t?1Z|9Pw@&<N%-9r64fj<
zNinfK&F{Ul6`)k;VjEVt#9IR&P-@C1jy<1Xo=!Z!f||>_6Xz_^L4PJ5TM_|#&~zy=
zabr|kkr3Osj;bPz`B0s;c&kzzQ2C8|tC9tz;es~zr{hom8bT?t$c|t;M0t2F{xI;G
z`0`ADc_nJSdT`#PYCWu4R0Rmbk#PARx(NBfdU>8wxzE(`jA}atMEsaG6zy8^^nCu|
z9_tLj90r-&Xc~+p%1vyt>=q_hQsDYB&-hPj(-OGxFpesWm;A(Lh>UWy4SH9&+mB(A
z2jkTQ2C&o(Q4wC_>|c()M8_kF?qKhNB+PW6__;U+?ZUoDp2GNr<|*j(CC*#v0{L2E
zgVBw6|3c(~V4N*WgJsO(I3o>8)EO5;p7Xg8yU&%rZ3QSRB6Ig6MK7Wn5r+xo2V}fM
z0QpfDB9^xJEi}W*Fv6>=p4%@eP`K5k%kCE0<R2h_PEom0LB7a~l&d1S3a77Hw2%_q
zqH(%vVfZpV_?Y3fF(xKF3+bm0z%8-Lz=1SYxL60R*CBzCSqTVx-`Lb%(u0^@jiL81
z>YF2E<Ezn!7fLCH??-dr?nIFY1<!~lO!ZTqU0)76!oysNs=YTeKF$}l9H5Qod@f10
z!aQmamt|K#Z}Q{gbm7MaqZN;@^eN-4gx^Jw(=2bDOWHR7F{^JWJp+>u5L!D<x34Y+
zc>M1ZY7wh`kgh<M{Gp`d0HdTLKw%XhgHm3=&oCYCnpM*NH+F)MqI##k#3U_iO9`0q
z6eX1$A7~_~dR%;g_==*9=d|P=D;@b~;Q(b^fCex+4qDqp!@y?PN`m^!qd2mod%?QO
zAOHiBwz31qA@k|Dc#@wM_-GEebzK6rovctQS1Yr{ec1A>C^NwxrL}90dRXjQx=H>8
zOWP@<+C!tcw8EL8aCt9{|4aT+x|70i6m*LP<O&^G|2#sCbRkD2k+TMRR0ESMhh$uB
z*bNRR4O)Jlw+XIMt<^OQbKV(NlJC#wAE{$4sZ@z$2JKmkBdnoCpxU|i*#t_vdIxUR
zsrIVZW&8NDF`tgEjviFbbxqyht^v0`uctQnOV7YdieqP92j^|`{@wi!72f2@Wc-yz
zk##%1&ZM-zR~q){3am^@AFF~q)g$JlQcan7O}VDbb9Y1IVj`B__M(Fi^sL;^apGmg
zk5Yf;d|4xJO4lFRfEgmQ^SUc#36*8iZ>*lhp;kGr5f#OwRy`(60LK@rd=to5yk^%N
z6MTSk)7)#!cGDV@pbQ>$N8i2rAD$f{8T{QM+|gaj^sBt%24UJGF4ufrG1_Ag$Rn?c
z<kbZlPrl`GIaLM&F`-vvwlO8^B!`m7qu6<C&$N}X=f&Yaws1}AUo3hgy~3AAtCrm^
z)OL<F1<^A^!C5+1i7c|I+_lBiGw^yRyuztGyCOPS&q|4v2^o4e<-=~2%^f=ub~UF~
zl?&3FNjg@Ye=w{y^o#H(Cg(6t+|Fc3M*pv?vGSIi=o=jbB%1oaQk7aeJ|N#l&E`UP
zgMDC)-A1>zICg9`ICT>9N_2vqvVG#_lf9IEd%G5gJ_!j)1X#d^KUJBkE9?|K03AEe
zo>5Rql|WuUU=LhLRkd&0rH4#!!>sMg@4Wr=z2|}dpOa`4c;_DqN{3Pj`AgSnc;h%#
z{ny1lK%7?@rwZO(ZACq#8mL)|vy8tO0d1^4l;^e?hU+zuH%-8Y^5YqM9}sRzr-XC0
zPzY1l($LC-yyy*1@eoEANoTLQAZ2lVto2r7$|?;PPQX`}rbxPDH-a$8ez@J#v0R5n
z7P*qT3aHj02*cK)WzZmoXkw?e3XNu&DkElGZ0Nk~wBti%yLh+l2DYx&U1lD_NW_Yt
zGN>yOF?u%ksMW?^+~2&p@NoPzk`T)8qifG_owD>@iwI3@u^Y;Mqaa!2DGUKi{?U3d
z|Efe=CBc!_ZDoa~LzZr}%;J|I$dntN24m4|1(#&Tw0R}lP`a`?uT;>szf^0mDJx3u
z6IJvpeOpS$OV!Xw21p>Xu~<j_Of`?i&1Y`>MZ(Nas5Iim-#QSLIYSNhYgx1V!AR>b
zf5b7<W!s$(gS4VH1kyzJoZ^(hV%J?suaCZLpXgV{{xF&BNv#&x4NVE{ARYqj2iU(+
z_h&b$A{cOJBDvz}60OK+U?|+WUp3DacWx;+gK7@=d%%fT3p4_)fGEK?Uq5l2sg}-|
z4>O`ITTvW5z%X8|7>&BeEs8~J1i47l;`7Y#MUMReQ4z!IL1rh8UauKNPG?7rV_;#Y
zG*6Vrt^SsTMOpV7mkui}l_S8UNOBcYi+DzcMF>YKrs3*(q5fwVCr;_zO?gpGx*@%O
zl`KOwYMSUs4e&}<bH2!=YCfBQLA|t^M=$T-j5>eM#FhB3<C>(RIDJ9ZRn6NN{2Nf+
z2jcz%-u6IPq{n7N3wLH{9c+}4G(NyZa`UmDr5c-SPgj0Sy$VN#Vxxr;kF>-P;5k!w
zuAdrP(H+v{Dybn78xM6^*Ym@UGxx?L)m}WY#R>6M2zXnPL_M9#h($ECz^+(4HmKN7
zA>E;`AEqouHJd7pegrq4zkk>kHh`TEb`^(_ea;v{?MW3Sr^FXegkqAQPM-h^)$#Jn
z?bKbnXR@k~%*?q`TPL=sD8C+n^I#08(}d$H(@Y;3*{~nv4RLZLw`v=1M0-%j>CtT(
zTp#U03GAv{RFAtj4vln4#E4eLO<W2JC=!fExpZr3MTUIkw8`fkw=p#&Y_VE{op>vt
zs;=`m&{S@AJbcl1q^39VOtmN^Zm(*x(`(SUgF(=6#&^7oA8T_ojX>V5sJx@*cV|29
z)6_%P6}e}`58Sd;LY2cWv~w}fer&_c1&mlY0`YNNk9q=TRg@Khc5E$N`aYng=!afD
z@ewAv^jl$`U5;q4OxFM4ab%X_Jv>V!98w$8ZN*`D-)0S7Y^6xW$pQ%g3_lEmW9Ef^
zGmFsQw`E!ATjDvy@%mdcqrD-uiKB}!)ZRwpZRmyu+x|RUXS+oQ*_jIZKAD~U=3B|t
zz>9QQr91qJi<sty>hg9j9rWHww{v@+SYBzCfc0kI=4Gr{ZLcC~mft^EkJ`CMl?8fZ
z3G4ix71=2dQ`5QuTOYA0(}f`@`@U<#K?1TI(XO9c*()q!Hf}JUCaUmg#y?ffT9w1g
zc)e=JcF-9J`hK{0##K#A>m^@ZFx!$g09WSBdc8O^IdP&JE@O{i0&G!Ztvt{L4q%x&
zGE2s<zC{NKu8NO}E6}a-)2AXw*VFhsg!|B9v|+S86E+_Sc*Ud^OvwvTfLqQVdOn|@
zN!5IQG|)+M0>!RVi6ZN9)E*(c33HuMf7#X2*VPVThdmrVz-Fyqxcs<k=FMvlffDQ+
z1}^dfltdS*U4kR=<1n-YWaPlaYLEnHy;!@y#i4z>&aI4DvP#bfW={h$9>K0HsBTUf
z2&!G;(<vtQI;LqNW~Xf?xS*27tM?(|+lSBVJBc-TS<Yl{0MOO9mU;e!Mu{ZgP;SH>
z^oOVIYJv~OM=-i`6=r4Z1*hC8Fcf3rI9?;a_rL*nr@zxwKNlxf(-#Kgn@C~4?BdKk
zYvL?QcQeDwwR5_S(`sn&{PL6FYxwb-qSh_rUUo{Yi-GZz5rZotG<e?XQbfL-zzd~}
zQxfAiC<F?(dz{hU)N3muv#7R9aey2eb^k=U<DLpU?#}Y1Ht%&uL~r*Ou+8=~BLl@R
zL8Gi7Ou^b!B4$lJC{-^na|TDZ&C1LADI(lBfr27zJn42_W)bgJ&fLrWWF}nM8obDJ
z22n19%fxa9ike9*iDkC@D6gVRVu4+5RW$uB+DfHJQ`Q|1lS>4R<+!PfsGg`MVtomw
z<EW-Dg15ZwzU<kY&O~_@$Z&${pfnDa5<AY;L26n@f~n{^)0Mp-b7*n=NORAvuWEI`
zSs#}HG0nlMM(&MYTb55ET-gk^92zM(;P^4ZPMYQVg86o?Jv;@`3yG$ydNvTjjVTj_
zU$}ghm{_Gr77AUTR<b;}uu5?lgTo@fi^=YFOhuYvZH&XwqO}eSG!^}5uO8bK+maL}
zB~Ra#jpO(8s!B%@a074GD2+JQ!dWnCQc}1b#KY-lIwrF)5u4ds^|7CU;+r=oEU}z<
z8x1?k;)*8O61_FYU2Z39r7+13>5kzOZJrh(#rMR_87KeP0Q=#^5~r_?y1*kN?3Fq%
zvnzHw$r!w|Soxz8Nbx2d&{!#w$^Hua%fx!xUbc2SI-<{h>e2I;$rJL)4)hnT5cx^*
zIq#+<g_FC1I$r=}e#(WAtb)=04{PCNe37!`vjX&#WcGz#ba}ji2qD!XM{NOIYh}v|
z3H*84VgoU%V3v@1RBj98(_roA0>{3;Leun3Xo=C(XVjt_z)F#PIoAw%SqJ=~DMQeB
zNWQ={d|1qtlDS3xFik}#j*8%DG0<^6fW~|NGL#P_weHnJ(cYEdJtI9#1-Pa8M}(r{
zwnPJB_qB?IqZw5h!hRwW2WIEb?&F<52Ruxpr77O2K>=t*3&Z@=5(c^Uy&JSph}{Q^
z0Tl|}gt=&vK;Rb9Tx{{jUvhtmF>;~k$8T7kp;EV`C!~FKW|r$n^d6=thh`)^uYgBd
zydgnY9&mm$?B@pKK+_QreOm?wnl5l}-wA$RZCZukfC$slx<D0d<J+Cw;}=Cm{CH*G
z3I#Y*VHC++-6WTU13^Tb{+v0A5|5;&p98U>bqv9uKq0o^QeSID96{Rm^084kZ)*`P
zk))V~+<4-_7d6<~)PL%!+%JP`Dn23vUpH47h~xnA=B_a}rLy|7U-f0W+fH`{wnyh2
zD$JYdXuygeP5&OAqpl2)BZ|X){~G;E|7{liYf%AZFmXXyA@32qLA)tuuQz`n^iH1Y
z=)pAzxK$jw0Xq?7`M`=<A}Zu*B(WK%s9cbyOinKSRv#SgfRAEEObC$uiHc$R8I~sX
zE@F(?ZZE*)#ZciBY-TL42=MqJO{IDCL~VDpQIM1-;m<S2{d@ee(h&3E+{D^YQ?(RA
zsaHCU#>kN2<PEl==iW6b{LM*AQAaNkRc7NDXcmslS<B{l8>WeQFhz)p;QhjbKg#SB
zP~_Vqo0SGbc5Q;v4Q7vm6_#iT+p9B>%{s`8H}r|hAL5I8Q|ceJAL*eruzD8~<gkwq
zvx^l#{8v+M0LC~Y2*bE0DEUAXMgh}?JStrO9?u9X(uTZCUYB7X;Xob60c{YKpNb$A
zc;|Fq#0e5sI?RG9K%{SS)-mChed+5|5p)}#T=P?pLne#(u(j=td?xOGQ`h}}XFPh(
zlK+}c-Om4Y60f46T8zD@)L8uQ3`>_m>fg26HvLpik&#{3Zd#|1C_>l&-RW2nBBzSO
zQ3%G{nI*T}jBjr%3fjG*&G#ruH^ioD<PZ?iS!V3_Bib@z*xEykgCY!@q63$4+>M>0
zb0vSM8ML?tPU*y%aoCq;V%x%~!W*HaebuDn9qeT*vk0%X>fq-4zrrQf{Uq5zI1rEy
zjQ@V|Cp~$AoBu=VgnVl@Yiro>ZF{uB=5)~i1rZzmDTIzLBy`8Too!#Z4nE$Z{~uB(
z_=o=gK<S)17$`VnQy;G<3X(el`nw>uhVpy&`}<v<r!A(AB2s5JZ9<#XokF-4(v!Ny
z;aH`__4bm9O+%UZR^53b{n6JWE8A8wcI7wbfOxFQDV1P}HVpO_4(+LolUbk6N;bF_
z(r&2MBvBe-W}0x#>-c&f%**M&(|;2iy+nZy2Su}GOAH_GT9z`!ogwn$+Bi&1ZhtPF
z<FQ)JtUVOSX?C$RHNR}`2=&|1sQ|UQ+>VS&LO5#Bq}cew$kvE7*t8W^{{7&7<g9Jf
z53}%j>WaF{upy0mj*K&xbnXvSP9V$6m6cesHGC!&Us36ld9f*Pn8gbJb3`PPT|<Fb
z|1-Xv{%3qi_m%`Q!Iaxc8q*OBBUcCt*A&~l2e{UH-(u{U=5LEXU9{BLbzpXc&}|;r
z%5*mPUnOBaSvQ#Jb=vE7TC}ohwYt^Tcnc`M3FMOLw3sc}eY~7+-M-Jb_dH}j2*l3T
z`d%ikhFij&rqSo{xLb}U0z|w{l8nrBI&_!^0oMQ=9s!{FiR)}rwdu|bZkl^kR(>ZG
zri2?uIu09i>6Y-0-8sREOU?WaGke0+rHPb^sp;*E{Z5P7kFJ@RiLZTO`cN2mRR#Nz
zxjJ##Nk+Uy-2N-8K_@576L(kJ>$UhP+)|w!SQHkkz+e62*hpzyfmY4eQLZtZUhEdG
zIZluDOoPDlt5#iw+2epC3vEATfok^?SDT`TzBwt<L&)-&a(au{C~U;V4AtmQ>gKjY
z>ZImbO)i~T=IYAfw$3j2mF1Cj*_yqK(qw(U^r-!gcUKvWQrDG@E{lEyWDWOPtA9v{
z5($&mxw{nZWo_Ov??S#Bo1;+YwVfx%M23|o$24Hdf^&4hQeV=Cffa5MMYOu2NZLSC
zQ4UxWvn+8%YVGDg(Y*1iHbUyT^=gP*COcE~QkU|&6_3h<QOP!SXtKnFZ(t6QiNz*>
z-GOS6-@o9+Vd(D7x#N<VZFr-?w0u0<s3ZF(&RZgVV0jd(9Fm@KCZpz*28|E31YxOS
z-V4|fS*}%&$;-03ZgJ||hwgX*MLnYGa5UO=kN(8OrY^6V#T*KLm^4=wz0sdB7=;&t
zhHGp$YQD=Oi@!vD+OIFiqU?nyp>Yt{Bvx2`P&ZuCx#^l0bR89Hr6V<YJ*Pbj)-qkc
zv<0$8-MTLHJoaT@QrzeUztAl!w75-*1p{29x7L$=p8u4M6)2M>m<||c3Waq(KO0eZ
zH(|B;X}{FaZ8_4yyWLdK!G_q9AYZcoOY}Jlf3R;%oR5dwR(rk7NqyF%{r>F4s^>li
z`R~-fh>YIAC1?%!O?mxLx!dq*=%IRCj;vXX628aZ;+^M0CDFUY0Rc<1P5e(OVX8n-
z*1UOrX{J}b2N)6m5&_xw^WSN=L<b&156RUh1DwBDzk$u$#CR}Gk^gq0PISm*L(jv?
zNQiS;LWLg@`(YmKDvhG_H=puK_*;-75WG4Lab`lMg}6)Ro%(e*Z8J5!^pyiCsf(dv
z2on?K8Lxe9Aja=INHwxYl$%EAw={qj+To~1h_M=|`UdS^jCPg&39Y|K3<X{k6`Utq
zu89M{SE(>p$I$T>f8K6|J_bj%ZsIYKNs1$TFt!RuCWF48;98`7D(XPVnk+~~i=U$}
zR#;!ZRo4eVqlDxjDeE^3+8)bzG_o~VRwdxqvD^HNh#@o>1My$0*Y_`wfQ$y}az|Uz
zM47oEaYNTH?J^w9EVNnvfmmbV+GHDe)Kf;$^@6?9DrSHnk@*{PuJ>ra|9KO!qQ-Fp
zNNcZB4ZdAI>jEh@3Mt(E1Fy!^gH-Zx6&lr8%=duIgI^~gC{Q;4yoe;#F7B`w9daIe
z{(I;y)=)anc;C;)#P`8H6~iAG_q-4rPJb(6rn4pjclGi6$_L79sFAj#CTv;t@94S6
zz`Id7?k!#3JItckcwOf?sj=Xr6oKvAyt1=jiWN@XBFoW6dw_+c9O9x2i4or?*~8f&
zm<>yzc6Aw_E-gsGAa`6`cjK~k^TJt(^`E1^_h)5(8)1kzAsBxjd4+!hJ&&T!qklDN
z`?j#za=(^wRCvEI75uE^K#IBe5!5g2XW}|lUqAmdmIQb7xJtP}G9^(=!V`ZS_7#RZ
zjXq#Cekw>fE*YS-?Qea|7~H?)bbLK;G&(~%!B@H`o#LYAuu6;-c~jFfjY7GKZ|9~{
zE!`!d@@rhY_@5fDbuQ8gRI~R_vs4%fR5$?yot4hDPJ28k_Wzmc^0yzwMr#*(OXq@g
zRUgQmJA?E>3GO=5N8iWIfBP{&QM%!Oa*iwTlbd0Fbm*QCX>oRb*2XfG-=Bz1Qz0$v
zn#X!2C!LqE601LEMq;X7`P*5nurdKZAmmsI-zZ|rTH;AFxNDyZ_#hN2m4W(|YB64E
z470#yh$;8QzsdA;6vbNvc95HLvZvyT4{C>F(fwy&izvNDuvfO1<f=DficjH^Ptk=}
zvKKKL1@~P^ao{l`XvpGhd0nnNocBP}t45`-1b1UFhCUXuTeXRN_=Dn&OM_57pS&UM
z<}D_GQ2GngSG{l*c-DGs>Z;`Ss#4a_c6pm*{0t|_i9z{@84^lffQa5zG4<{(+p5-S
z^>lG-^GJR#V>;5f3~y%n=`U_jBp~WgB0cp;Lx5VZYPYCH&(evw#}AYRlGJ>vcoeVr
z3%#-QUBgeH!GB>XLw;rT&<H4u)0+b2gp`B<SS1EU2B<;6FO0V){?53`ii~RP0^+xy
z<G;h8dy{UFKk?BD<-fsiI`+URBzNO}4H3XBa**eIg@56!KOqw&qb?J_tx9{U@N@HC
ztXVt~`#<-JFs+s7Dh@v8f+c_FeOJ(jLRWyj0{dbKP-DdhC!^@mHB<K82)LGN!E9iL
z2t{`qx)ykVE}m6(@)m*bOho;W5Lh5qc_#4D%3<IjyEhf4SO-KM;W}MQ0lG+QaQd;F
z6pPpOTpLpaA)ZX3Y%3n)SqUwMw>oMI9ynP;leDwh4O2uM!oIWo&Qxk{^9#nX&^3GJ
z(U~5{S9aw@yHH^yuQGso=~*JOC9Zdi6(TFP+IddkfK5Eu9q;+F9?PPNAe-O;;P_Aa
zPJ{Dqa1gQb%dZ|0I{#B0(z|r(qq!A4CxlW92-LwXFjYfOzAT1DDK`9rm4AB~l&oVv
zi6_{)M9L1%JP}i52y@`!T9RB~!CRel53wl?amNHqcuElq%hn)|#BPvW5_m51RVb|?
zXQ&B*eAD}}QamG>o{?i~usG5<d^#sT9$FSql@}}40+?obf=&rIT|~3@_jk&b;f8tU
zg^liav>X6IDa3+Xkb8w%7;C8|Cln70biA+ZH}fxkH^Wei$vZPnuqIT!Mmy26;mLfU
z3Bbv4M^vvMlz-I+46=g>0^wWkmA!hlYj*I!%it^x9Kx(d{L|+L{rW?Y#hLHWJfd5X
z>B=Swk8=;mRtIz}Hr3NE_garb5W*!7fnNM{+m2_>!cHZZlNEeof~7M#FBEQ+f&gJ3
z^z<nug~GvKX^YC6t1KJ-As1VD8M(-W&=(T`J@+Nrc5Ym_dy|Eo70Z}P(l@7Y%dQZh
zk7p}j2&d$wI-fgROr|*m;cR+PGJKJk$+9p)oslb16vuOM*TNzmKDAhOa?M~231`L#
zMJ!VZBjBzj7We2@;Ke$w_lpX*ggj5E&yX4*GQ%4_FMjtfv^umnN?Cr7TP=wstL*YY
zQ!TAqEcvdc?V{CRnzORdu|VO6taAYr#G*V9>v*t?XV)jQi%0-Ra|ISiW-fx)DsK->
zI}Fv%uee$#-1PKJwr=lU89eh=M{>Nk7IlJ)U33U)lLW+OOU%A|9-Lf;`@c*+vX{W2
z{{?0QoP!#?8=5%yL=fP%iF+?n$0#iHz`P;1{Ra6iwr=V7v^8<sopg0Y@yZ7NO*6=q
zFFlApm-2#`(9hEp&IVc>;NoLJ5)QxIyIx>ur?lMwV=mBo0BA?28kMow8SX=<Y+)==
z;R=1CQ>Ax5L%S~x4+EQi#Ig`(ht%)D(F#Pa!)SiHy&PvUp32=VtAsR|6|NZR@jkad
zX^aEgojf9(-)rNOZ=NVA&a;6Cljkb=H-bY9m^_I)`p<N16r`XAE_(4fS-+dl!Kd9K
z>BHB16QW)sU27zF13ypefeATJc1Wzy39GrKF{UntHsIU59AdXp?j{eh2R)IbU&omd
zk6(qzvE@hve1yM6dgkbz>5HDR&MD~yi$yymQ}?b;RfL$N-#l7(u?T^Wlu+Q;fo|jd
zBe^jzGMHY(2=5<P2*tw)ntAE!i|kvrfQiOA_7D5amQ`g(2*cXve*N10PW_ErW^V8L
z1MqDEjW6kdkAOC-z}uc?m@V^a5B40*PRN+-f=MjuJ@4}mlCv);PKIt(DEf@zhUnJR
z!oyb^SGMdOXtqePw<6%)O~~F2FTY<jX!>l?bEIh+zgE$1TEQ&!p3fH;AW`P?W<ESK
zH#g7ZdfetwZ2v=9o0mn(AO?csJT~Gn*&Y}OjOpbUo}~Hm@;x|NO+0T%-0Axc&%7lF
zJ1pX`Z^AlfV3?dm5G@PwxK_i|&Of7xpxF?vju^4*EO?%y7Xv=e>5Hkj3eJnT>dqg!
zf~}A*SZU5HHDCbdywQ^l_PqssHRlrySYN=`hAv2sVrtcF!`kyEu%XeeRUTJU7vB%h
zY0*)N$mLo6d=tJfe}IPIeiH~>AKwCpkn&WEfYgl?3anq5#-F$6$v-(G_j0*S9mdsn
zg@ek_ut4(?+JP_9-n`Yqo<vHf2Ir!Nonv)J(3x#DWYX;y3-f=3t|>D(gAz+Ttm1#t
za96D}oQR(o=e8wwes19_(p4g(A1vSGwPAp~Hh3hh!fc>u{1E^+^}AzwilFVf6^vbL
zc&NnRs`u)N-P|Cu4()yTiuE{j_V&=K?iP!IUBf~ei2}<whJD5S_DJ}8lyz{d5e0m^
zXp7wURYpf){TL0trzEJmlx>~_KBvUAlXa;R#Wl`gOBtJ$Y5(L))@`riLB)v*r><aR
zw7qT#lC53m61B>9*8VfmQt<PROW2c<^h*+X1{2yJxbMATtPvxHpc+?jPI+FPnVH_&
zfj7uqK><72?+fdwP{BA@?_qo>mN7yzICUCaeG(+>Rb~8wg~6U(P<nm(X&r_f6obUi
z$dKyG&rI&@a%L*(6>)NlDLuhQgjbC}=)HuZgC}0Z-qLX4lJ7^)8~!!*qP0=~`Y_(A
z{@15*ZevZSI^s|OnpCeCwLXf#tgbq8y~R*GB5anmZ;_N!+-3>!wu@NBFCNJ$#y?{?
zMI!?s*=_xA;V&aX)ROxzVW8*de+&P#2zucA|8mksdgCXBsZ*TM=%{L1Tk5LB<Z!KJ
z;lp910!MJ8J~+1dY_Xn{p8}Y~34%%$3)5agk@iGzX6H!Anv5uUI$ciQvmGcbPG)xv
zdO@rD(K-3Ky;MGnIEtGU{Htp(S893+bn<t9@uj!@5B4gD7du9ZgQn18YO4uo06rZq
z#s2-PcRt)y(275pYB#9Hbw&B>_*^@&S?O=ot{h)1xRVSn27&Tk8>rF|6ruzYb;Nq)
z;qvlmrP^SL$mhe4Ai)xpl6Wx&y;z8o!7-+6$qj;ZLXvfR71I@w(R|6lyuP6v-lP&r
z@KK-TEmGQfMmk1c0^fd7!^si}T%b5a2%>T-Drh|^<Hr=j)=_((p;KuSfKido&LV#J
zFFfl}!<eBhy2#i=6c#ra%kZ1$j(EY7lFC*v8!P_^%qy;W8jQ+Q`Z<xkWskY<0J>Cf
z$}qxIv@zxbm<k^RE-aX~4rCWmq?oKl-EW;PQ_l{3e+jJBhWP}gKtyF&I$%ZeMK`+v
z8e^?6J-`{J<4-qj-Ad~A)|HKBJMM+itDqMD(Et|5n|aQ=z$&Sb7P;n0h5a2h`q=X8
zoL#YBVnHjcM6gYTkYUnp7Y*}nB=Og*ah7+WL}S|s!dTMo_mJp5G)1p4pQo%*M<ul@
zTl*h(Spw1r1ddb%$9LJbAQ>J#qjK6Q_aGDe{ciVT20V1lW52Xs!}x(4_j)sUXYdm4
zwYC9FOa;X*c*LxL;xE5ov?|?^7gWXyALy_D2GvDo-8%0-Y%9TkkO_Tcr2qIUg3(OC
z%3wt?<o?7ws>hyn*+e^z%(~2#!2dvMFa$mzgwk1I1X;naFMjXSbnmZ!zd%7u)=cgi
z*0&@Scrl&BDfU(9Pks8#;!~v~r7<YRA|b+cmZ<O+%qVn;SdwH~C-8G;f`4)Dnc*H4
zz^itXa><D&I>~DN{G6WE&_;7i{{a*?oiCao(l%2ruxX0fAt69e2vLgL%Mf_)!*(Tz
zNKW>sW@YB2vBfP>C&L|-pq)Uq^PsG_THu;8iEcqafO?0k$IQp1KyWyOoTxwmKvlc^
zO9$%Tt8;%qQxwy5;CsJ)V}a7I6}SvQ%0_H53Kcqx=m8<MOsI~Wzc<Q!qbFzwSB`D+
z{D9hC-4#S=>3fIzpLSGgfVe^SPdc*xPdciI5dg}#{Etv$e<)gGD=qm0v=!aN@*?$s
zLhzD%4w{vf-g6FHQjG9XyC+4=bewb?Mz%!u8%oP{G9{UJFTLTcCi3R(=Nm&t&Sl(?
zr>pj?=ECdDVa}-g%`LF^1EY@>7d}%VhYpKFS<Su*wlsyNILeDAmwC&4vcc1^J!Zw#
z1{mO|uomzhkc4n!BQAnn>DPH)D(z<fPLgY#uASJ*Dl<~1S0ksFUXxI*v2|bDYL^Mp
z+uux$8f>B+gPe1m7E}W>TiW=8L0&(D&YG=0<&7G4Bu{;-#Ud;-1%Ta9V}U6fyK1YX
z`Rq|i-X(loPZ)M$H%m@j7bGx>uj~y=0)!t#dc|c}+hT%~Sq>fefez0Ul|jOJHta~u
zx7*mV6~Jpt(FkY(pQN91>aFk7VS%Sa^oLaq$*)W?fy`xuFJgH<2s=!Rz}_(qdmdF~
zlr2f=)q_vpi8X;Jq><kv8yxSR^Y*0XEH>5^$GweJ{iS`Khw2f)fsvKpgh;U~13a+9
zfaw}UuGiBy;q10pI^Avb#X3D=k_r(T{N;-xA)OM}2Py5L##<96NU*Sr7GQqhfrPej
z?;B$Bt_sTxuSAPXfTSC{zr?@$$0iHxC@z*5F52j*PG87hh`0w3At8jPf*rjNE~_Gj
z2)fjeUFJ(#l9uWuw&5#@13|AQ1;pdA?EL4YKq0JDR5T8I?aWGxI=J9}vdyH;gQ@iE
z>+UnC2iwT0f80-VuE^bY!N@(}9?bOXyy%rTqSNDN4rO4Zt#(kZwcGgTp&3((F+nsd
ze~B<vkvAmqZQCN{VT^_3N)dA|5@JD*b^OT9w?DKQKQ;>)%K6oP4WX_w1>|QImC;9q
zy}4p+s%^Too2(gE>yo%+yY#F{)phtmNqsJPVQQ0lGR|H9q>aA&AtU4M+EZ%`xvQLb
zbigBOc`dL}&j3er?EOI`!W)N#>+uwp_!h^5FspaEylq!e(FPY-6T3~WeNmZ<$?Y6y
z-!bM1kD7ZF8xl+Pi6fiv1?)q%`aNxn#pK%)ct||L&Xnf8Gu&3g;Of{B8Pt=u`e+Mn
zA(DmU#3cF#Nr7W;X0V4ksFHMcNDAf4G&D8VjLeZ^|5-f$>_|71>P3xuu)?4NJed*w
z6GR_RB5HQLzT(h+`Y?-3esxeue{-Q%b+!&o>IJ<U{K5n=>!#=}#_&q+h<RCdh)3ad
z3u9U*q-7CzJO1;f{W)bBVeSC|{^P$QIIk-CyR3gi5P7Korq0R)C7=#L)o&^V8kh(x
zNN{4}&7CJN$8L7_)db6<z!w~!{P5^-h7S-wszcjbc^U6D3XVpe@7=4Lshiqe0Y5N7
zsFoi-9bHpq0%4HaycQW`HDSXEoRpZA$r%O8D&^MW(rU(>wJga>fkt(*(WdoN5vSta
z#$mMN6}YzYRpaBZ)j)EL91-oL1(|d(>%UclsTUOyXyWM<i=3tzRhCib5fq2Ef#*;)
z!4K=N!LPQ;#t8R?NIyV<J=&|0SM3GNVDlC9rKZ`^G%|W;P3k6I7uja571~nqmtHor
z`gh1ba^|7r%2g9p-h)}xS-a;H1mn;Lmy(6EFMmKhY12ffmjeU0ZfKOR@8x(I{qJ^q
zWjzyb+f<%IGR(jVuT@@|r|AHvml$9>&(hNqLwqtn`!E<P-d=Tz2P)hWLDtC`SMn-I
zloIV)$+_p$q6pB=3{+T$bt&h5MiRm@f))DR4ajXxL~e~d?aZ7D`BA#RIe#z5AdNuY
z4Mu~W1;T&@$^*+^zTgSBFa_%Z+#!Ex?(l(z&?%r3{UE;C#v+0r-0~JQ95Xz5N?r&y
z*034nI1U7@Q9#B{slBKMiyAtxAI4+f8Y--}xBIB$X;zz`!CSfV2z_$UfxvE>>HJM{
zh>M~xa1@*U^cwx-k5QjePr5=B6u*jpJ)C0{C?f7Yga+I^4$TleyX$x&jm9z@c!?cC
z<2kY7)p^+<iaz~w05^&?q!U1}|D10Ixrw;JZn#OjY5bsrsT0c{MzF*BVSiu=+KAdT
zKQuo-KJJbUw`(m-=2HrjxRrUZ<4T2VI}lY0Ghf>W{AXd@l1C09_yB*TG|yzb96BYk
z8Wpj81vB>zcR+qM4m~A44w1n7$fxB$-?MV}S?Fh}c_|2FXg`cZ?750i;Cdl-_nGK#
zta)h)6!<k-ithudu6LI{`^y6%$8{g&DkiXYPz8(kVsF-P5TW&F<TGk7-`qR&|E4Od
zgJr;N;#RT&P%aaBU_tTM95&<ztJNAH6Be>*AsQ-z8caSh)%5JY>_yCeJs~FpAzdY8
zF@SU_hN#~ip5I;UACFzx1v0yf{j97l&)e-=`d#1Kp6A(Kj&HC!%vK!wEdK3HFJ?|6
za;WwUczZ+&<$g!Td^48@lJtfW@doXL#jY6)dK_RDCQAZ}l&OdD+?Yl5-bqpsHZR^(
zF{u_cR(x>u(c4i5f(^8!h6CV0#ZxRFhLlunWiGDLO6yoRb(wV<(P^8=fOU7Hp{AHE
z;Yg%kg@6&tL3Z*IrbkDeQ$%rbalVP39D@LVrC2xSavnTp%PorXPf1DVzHyqjDsDnS
zL=mv0a2s60bHKGQM)ue>npH0SCp;XtZFUzm?R-x7D*(PxMmuJ4J*K2eY&ebe0yQHe
zVG&*qe{pot{PM^xQv`H_rn2FcYOrEN+I#uX^1`Id%J$;Hi2cNCU!0Hlc0TjxLzkss
zHxmC;hQBu5U4J0XflWM;{uH`_47Sg)QyZ{8D&T0;bdc3{^^<=q7P?C_2E-}PQn>*=
z2T5q^J|Q_2+x%Qt`i3m6=6V$)BxIx{2KAFkMb#q`iMCD|L>+}_dYVA$wBr1Zr}YOF
z^MMGO@PHGGh>g|^yF`PvvtDwN@kxt?ClLcG<+murHMz1Asj!$l=b)4{d}SqOJ}>Y<
zSeAyP@ZEcpx`ayIdp>{--UVLYC_cZZURh_!4u2(*#x@Tk(QJa}4BqqZ$6%LhF-HB~
zAcc?$I6KP}IxANcAteEBX$Ys?T=JB|Fnd3*UAO0mYAXCgWf~?7Z_G7G5`H4;S^QKK
zG*2l75vI@DHQC*es>6&|r^#RHKRQ5rwv_l4`!(!I3%)Z$P1f<pp$a6um{0o<xo1(S
zZ`Q0UjI755S`%%J_bkQdMJX=gQ{yGwHkEGhB^jy#Kdw`Bz|GK-!lL;4BMah}BF+x+
z?HI()zNqsZIGTqA_xWDA=-;C4;b|i|!YxXR_7sk5(v2GtT%3GTmNwkY;US<pe8iMx
z?CMVyA>nZ8N@27zyg}54ElO%<W#-o+m4iU~8Q?$4$|V+p5$&IW7v%jYE2kKCPp*(d
zFu#B%8S=B~N(!;YOU;1OEc3s-B5iV$wBx@k(n04f!GdovshST2rB@sL)o7#C00dbz
zXLs^S+aB?68q$l630l4mcvrwQA6iub28Kfn2K|9b`26o(qj%;Gb~*&bcgMHKOZ}{Y
zpH25NG-g&gW}2EiE*s0bJ7k5r6CL;J<)P?02__GA3^V)q7ZuC)FdRFi4Ui^Hu`+ke
zlP$?ecllVihlR$b$u#yp1B#i7to3FBXsOesoC<RET3TvI{~Xg=|3aNr1q=*+q#7{W
z-Y$TNBqW^r8?8@4K)pJ3Mu3uzqB%>SjQ_4uujX)4ta@Gz2)_>4b~vX|rhRIH-eqdD
zL)xaEpW3K|a>daQRRR*_$W&gtrWOsW-IE4VQl3L$3}=-PFU)s@<aWQn^ePgERyg<~
zi9>XG&9+DFivH-;2&w~$ES_nJZJH!?1mO!CnP)Jb{mW9=f`bDpo^PI6i4|YurK)Q1
z^Ys1oHRdr!$X4RuyR%kgp!a*Lz*_AAoJ$EVAdsNCoPA^VZE1pGO@D3UStACE+%vs6
z<P#Iz;tqZ&(cujrDA6_F?Rn}(1d-gA3k(F0-q!_>$io@E>DmB|3VV~GbOt2oc+K;t
zdn3gaFvYz;vRN-+2+Qk{8|O}e86nVck)fZn3sg$j#dLVham{yGkc$I#!HF7mRS%f*
z!+NdzG49K(qaO^SBlp@K@D?|^rAq;8{*@kRc4sYSNQmoy7@_RS_ksWl2T_38h2A)#
ziU2WXWD03(NqS&Mu*?0-iK8X_Z3w`}c7MPv0qZ7iM|L3xdTnR{y!7{#82$}uJCiGT
z<R=!u#|^6|?wiC#sfCopSzEKCR6U6Bw(Q;@s$H1rn`1g@5SxCRm~1fj@s^zS?<3!C
zifc616*O$TXPDdO5kx`EKMG|B6zm3|2vBezn)24W%c37snNJGF8e>qa=8<9L05hu6
z1N+2n<bYn!L1|(Gqhn$6j9K??r7Po{X_%ib8Rqb7TWs5SRq}=2dXRLIAumPFyfCrC
zDiI||Hbl~nD|ql~>7OzT{NEf?gS@eq7@buCDFe9mAxY%THo^b@BHckKK>jg6{@)>n
z43cPs%$Qi0iwyZ+{C491>FRu5+6baJ{&XXXC@Sp+b!Q<l1VW-1h>E|{7_d?lm5K=B
z)myKEcxjFm74+drF|JCYcxdY%ASig#YoRBRUV7An7f-%<D?52!XFl`Zn^^{ShT;3I
zI<T$g4}e~*gKXa&-QyT9VSr&V{tp%o7Tij&#SziJ(&k5ME%t`kBX71Cwyq<7<3_Q^
zHQr(Xa%dr@sn1-1v9SW^7YS~0`f$$GMn;WvV$Re5WJdJgCv=nq{y&U|*odda3tRIk
zzko?E=~Q~8WW~^B-1Zi0*k}NsJlmR1>rqj%PHECbxh#5476cEq@NQL?dI6gUqvS@w
zq!WmD(<!x6<aoxbqX{?AGp1;={PQ8ebhe#@zB4txI_~4KZH2Rd-MI-}g)&O50No<?
zR1OOz8&~sj1_S9zN|F=cSe`)^cpX(nsSlt>aR0{NxItAZCKDCVw=Zu{9WGDu^i?2g
zLerPiOU*HSaXg^3CdOX^F6c9MiHINP339N%)a96`^Z-c#&EogcxMSYo0Cb4{-}q1(
zRrJine`P|6WRkm8u4Ja1QRYq$AR>b7tugd#EsT-VmXN-t!TYjZy}i!uKi6$u>EJ?w
zvdHZg+hp+5ree?>fdJAX)5#Wtm#2M-{~2jfX2{G`)?D6UD1MevdeeU;;HCi}AtJr(
SGW6ptSs!X7{rG*o_g?|vpSEZK

diff --git a/gradle/wrapper/gradle-wrapper.properties b/gradle/wrapper/gradle-wrapper.properties
index a4413138c9..df97d72b8b 100644
--- a/gradle/wrapper/gradle-wrapper.properties
+++ b/gradle/wrapper/gradle-wrapper.properties
@@ -1,6 +1,6 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-8.8-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.10.2-bin.zip
 networkTimeout=10000
 validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME
diff --git a/gradlew b/gradlew
index 1aa94a4269..b740cf1339 100755
--- a/gradlew
+++ b/gradlew
@@ -55,7 +55,7 @@
 #       Darwin, MinGW, and NonStop.
 #
 #   (3) This script is generated from the Groovy template
-#       https://github.com/gradle/gradle/blob/HEAD/subprojects/plugins/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt
+#       https://github.com/gradle/gradle/blob/HEAD/platforms/jvm/plugins-application/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt
 #       within the Gradle project.
 #
 #       You can find Gradle at https://github.com/gradle/gradle/.

From 9829371548e326e558fa24b78e8eeff83a7247a3 Mon Sep 17 00:00:00 2001
From: John Niang <johnniang@foxmail.com>
Date: Fri, 4 Oct 2024 19:46:43 +0800
Subject: [PATCH 071/185] Add Gradle plugin to discover dependency updates
 (#6761)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/kind improvement
/area core
/milestone 2.20.x

#### What this PR does / why we need it:

This PR adds [a Gradle plugin ](https://github.com/ben-manes/gradle-versions-plugin)to discover dependency updates.

```bash
❯ ./gradlew dependencyUpdates -Drevision=release

> Task :api:dependencyUpdates

------------------------------------------------------------
:api Project Dependency Updates (report to plain text file)
------------------------------------------------------------

The following dependencies are using the latest release version:
 - com.github.ben-manes.caffeine:caffeine:3.1.8
 - com.github.java-json-tools:json-patch:1.13
 - com.j256.two-factor-auth:two-factor-auth:1.3
 - io.asyncer:r2dbc-mysql:1.3.0
 - io.github.java-diff-utils:java-diff-utils:4.12
 - io.github.resilience4j:resilience4j-reactor:2.2.0
 - io.github.resilience4j:resilience4j-spring-boot3:2.2.0
 - io.projectreactor:reactor-test:3.7.0-M6
 - io.r2dbc:r2dbc-h2:1.0.0.RELEASE
 - io.seruco.encoding:base62:0.1.3
 - org.apache.commons:commons-lang3:3.17.0
 - org.imgscalr:imgscalr-lib:4.2
 - org.jacoco:org.jacoco.agent:0.8.12
 - org.jacoco:org.jacoco.ant:0.8.12
 - org.mariadb:r2dbc-mariadb:1.2.2
 - org.openapi4j:openapi-schema-validator:1.0.7
 - org.pf4j:pf4j:3.12.0
 - org.postgresql:postgresql:42.7.4
 - org.postgresql:r2dbc-postgresql:1.0.5.RELEASE
 - org.projectlombok:lombok:1.18.30
 - org.springdoc:springdoc-openapi-starter-webflux-ui:2.6.0
 - org.springframework.boot:spring-boot-starter-actuator:3.4.0-M3
 - org.springframework.boot:spring-boot-starter-cache:3.4.0-M3
 - org.springframework.boot:spring-boot-starter-data-jpa:3.4.0-M3
 - org.springframework.boot:spring-boot-starter-data-r2dbc:3.4.0-M3
 - org.springframework.boot:spring-boot-starter-mail:3.4.0-M3
 - org.springframework.boot:spring-boot-starter-security:3.4.0-M3
 - org.springframework.boot:spring-boot-starter-test:3.4.0-M3
 - org.springframework.boot:spring-boot-starter-thymeleaf:3.4.0-M3
 - org.springframework.boot:spring-boot-starter-validation:3.4.0-M3
 - org.springframework.boot:spring-boot-starter-webflux:3.4.0-M3
 - org.springframework.integration:spring-integration-core:6.4.0-M3
 - org.springframework.security:spring-security-oauth2-client:6.4.0-M4
 - org.springframework.security:spring-security-oauth2-jose:6.4.0-M4
 - org.springframework.security:spring-security-oauth2-resource-server:6.4.0-M4
 - org.springframework.security:spring-security-test:6.4.0-M4
 - org.springframework.session:spring-session-core:3.4.0-M2
 - org.thymeleaf.extras:thymeleaf-extras-springsecurity6:3.1.2.RELEASE

The following dependencies have later release versions:
 - com.google.guava:guava [32.0.1-jre -> 33.3.1-jre]
     https://github.com/google/guava
 - net.bytebuddy:byte-buddy [1.15.1 -> 1.15.3]
     https://bytebuddy.net
 - org.apache.lucene:lucene-analysis-common [9.11.1 -> 9.12.0]
     https://lucene.apache.org/
 - org.apache.lucene:lucene-backward-codecs [9.11.1 -> 9.12.0]
     https://lucene.apache.org/
 - org.apache.lucene:lucene-core [9.11.1 -> 9.12.0]
     https://lucene.apache.org/
 - org.apache.lucene:lucene-highlighter [9.11.1 -> 9.12.0]
     https://lucene.apache.org/
 - org.apache.lucene:lucene-queryparser [9.11.1 -> 9.12.0]
     https://lucene.apache.org/
 - org.apache.tika:tika-core [2.9.2 -> 3.0.0-BETA2]
     https://tika.apache.org/
 - org.jsoup:jsoup [1.15.3 -> 1.18.1]
     https://jsoup.org/

Gradle release-candidate updates:
 - Gradle: [8.10.2: UP-TO-DATE]

Generated report file build/dependencyUpdates/report.txt

> Task :application:dependencyUpdates

------------------------------------------------------------
:application Project Dependency Updates (report to plain text file)
------------------------------------------------------------

The following dependencies are using the latest release version:
 - com.puppycrawl.tools:checkstyle:9.3
 - io.projectreactor:reactor-test:3.7.0-M6
 - org.jacoco:org.jacoco.agent:0.8.12
 - org.jacoco:org.jacoco.ant:0.8.12
 - org.springframework:spring-context-indexer:6.2.0-RC1
 - org.springframework.boot:spring-boot-configuration-processor:3.4.0-M3
 - org.springframework.boot:spring-boot-starter-test:3.4.0-M3
 - org.springframework.security:spring-security-test:6.4.0-M4
 - org.webjars.npm:jsencrypt:3.3.2
 - org.webjars.npm:normalize.css:8.0.1

The following dependencies have later release versions:
 - org.projectlombok:lombok [1.18.30 -> 1.18.34]
     https://projectlombok.org

Gradle release-candidate updates:
 - Gradle: [8.10.2: UP-TO-DATE]

Generated report file build/dependencyUpdates/report.txt

Deprecated Gradle features were used in this build, making it incompatible with Gradle 9.0.

You can use '--warning-mode all' to show the individual deprecation warnings and determine if they come from your own scripts or plugins.

For more on this, please refer to https://docs.gradle.org/8.10.2/userguide/command_line_interface.html#sec:command_line_warnings in the Gradle documentation.

BUILD SUCCESSFUL in 1s
9 actionable tasks: 2 executed, 7 up-to-date
```

#### Does this PR introduce a user-facing change?

<!--
如果当前 Pull Request 的修改不会造成用户侧的任何变更，在 `release-note` 代码块儿中填写 `NONE`。
否则请填写用户侧能够理解的 Release Note。如果当前 Pull Request 包含破坏性更新（Break Change），
Release Note 需要以 `action required` 开头。
If no, just write "NONE" in the release-note block below.
If yes, a release note is required:
Enter your extended release note in the block below. If the PR requires additional action from users switching to the new release, include the string "action required".
-->

```release-note
None
```
---
 api/build.gradle         | 1 +
 application/build.gradle | 1 +
 build.gradle             | 1 +
 3 files changed, 3 insertions(+)

diff --git a/api/build.gradle b/api/build.gradle
index 752acc961a..8185f2a024 100644
--- a/api/build.gradle
+++ b/api/build.gradle
@@ -3,6 +3,7 @@ plugins {
     id 'halo.publish'
     id 'jacoco'
     id "io.freefair.lombok"
+    id "com.github.ben-manes.versions"
 }
 
 group = 'run.halo.app'
diff --git a/application/build.gradle b/application/build.gradle
index cffbdfd6a9..2103485192 100644
--- a/application/build.gradle
+++ b/application/build.gradle
@@ -13,6 +13,7 @@ plugins {
     id "io.freefair.lombok"
     id 'org.gradle.crypto.checksum'
     id 'org.springdoc.openapi-gradle-plugin'
+    id "com.github.ben-manes.versions"
 }
 
 group = 'run.halo.app'
diff --git a/build.gradle b/build.gradle
index e94ecb0b40..272959fcb2 100644
--- a/build.gradle
+++ b/build.gradle
@@ -7,4 +7,5 @@ plugins {
     id 'org.gradle.crypto.checksum' version '1.4.0' apply false
     id "com.github.node-gradle.node" version "7.0.2" apply false
     id "org.springdoc.openapi-gradle-plugin" version "1.9.0" apply false
+    id "com.github.ben-manes.versions" version "0.51.0" apply false
 }

From b3fa0b9568be3c59c8364873485c9838b72779b2 Mon Sep 17 00:00:00 2001
From: John Niang <johnniang@foxmail.com>
Date: Fri, 4 Oct 2024 19:54:43 +0800
Subject: [PATCH 072/185] Upgrade to Guava 33.3.1-jre (#6762)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/kind cleanup
/area core
/milestone 2.20.x

#### What this PR does / why we need it:

This PR upgrades to Guava 33.3.1-jre. See https://github.com/google/guava/releases/tag/v33.3.1 for more.

#### Does this PR introduce a user-facing change?

```release-note
升级依赖 Guava 至 33.3.1-jre
```
---
 platform/application/build.gradle | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/platform/application/build.gradle b/platform/application/build.gradle
index 13bb84bdd1..10d92d30c9 100644
--- a/platform/application/build.gradle
+++ b/platform/application/build.gradle
@@ -15,7 +15,7 @@ ext {
     base62 = "0.1.3"
     pf4j = '3.12.0'
     javaDiffUtils = "4.12"
-    guava = "32.0.1-jre"
+    guava = "33.3.1-jre"
     jsoup = '1.15.3'
     jsonPatch = "1.13"
     springDocOpenAPI = "2.6.0"

From 6ac8c9b2f763016fb3237bb325c6c92fe5d513ef Mon Sep 17 00:00:00 2001
From: John Niang <johnniang@foxmail.com>
Date: Fri, 4 Oct 2024 19:58:42 +0800
Subject: [PATCH 073/185] Upgrade to Lucene 9.12.0 (#6763)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/kind cleanup
/area core
/milestone 2.20.x

#### What this PR does / why we need it:

This PR upgrades to Lucene 9.12.0. See https://lucene.apache.org/core/9_12_0/changes/Changes.html for more.

#### Does this PR introduce a user-facing change?

```release-note
升级依赖 Lucene 至 9.12.0
```
---
 platform/application/build.gradle | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/platform/application/build.gradle b/platform/application/build.gradle
index 10d92d30c9..f474527a90 100644
--- a/platform/application/build.gradle
+++ b/platform/application/build.gradle
@@ -19,7 +19,7 @@ ext {
     jsoup = '1.15.3'
     jsonPatch = "1.13"
     springDocOpenAPI = "2.6.0"
-    lucene = "9.11.1"
+    lucene = "9.12.0"
     resilience4jVersion = "2.2.0"
     twoFactorAuth = "1.3"
     tika = "2.9.2"

From 1852784a4ce81708c54b981f4f7d1a9a49cde005 Mon Sep 17 00:00:00 2001
From: Ryan Wang <i@ryanc.cc>
Date: Fri, 4 Oct 2024 20:22:43 +0800
Subject: [PATCH 074/185] chore: bump vue version to 3.5.11 (#6764)

#### What type of PR is this?

/area ui
/kind improvement
/milestone 2.20.x

#### What this PR does / why we need it:

Bump vue version to [3.5.11](https://github.com/vuejs/core/blob/main/CHANGELOG.md#3511-2024-10-03)

#### Does this PR introduce a user-facing change?

```release-note
None
```
---
 ui/package.json                     |   6 +-
 ui/packages/components/package.json |   2 +-
 ui/packages/editor/package.json     |   2 +-
 ui/packages/shared/package.json     |   2 +-
 ui/pnpm-lock.yaml                   | 516 ++++++++++++++--------------
 5 files changed, 257 insertions(+), 271 deletions(-)

diff --git a/ui/package.json b/ui/package.json
index b50b25b0af..47f4c7fb7d 100644
--- a/ui/package.json
+++ b/ui/package.json
@@ -100,8 +100,8 @@
     "short-unique-id": "^5.0.2",
     "transliteration": "^2.3.5",
     "ua-parser-js": "^1.0.38",
-    "vue": "^3.5.8",
-    "vue-demi": "^0.14.7",
+    "vue": "^3.5.11",
+    "vue-demi": "^0.14.10",
     "vue-draggable-plus": "^0.4.1",
     "vue-grid-layout": "3.0.0-beta1",
     "vue-i18n": "^9.13.1",
@@ -125,7 +125,7 @@
     "@vitejs/plugin-vue": "^5.1.4",
     "@vitejs/plugin-vue-jsx": "^4.0.1",
     "@vitest/ui": "^0.34.1",
-    "@vue/compiler-sfc": "^3.4.27",
+    "@vue/compiler-sfc": "^3.5.11",
     "@vue/eslint-config-prettier": "^7.1.0",
     "@vue/eslint-config-typescript": "^11.0.3",
     "@vue/test-utils": "^2.4.6",
diff --git a/ui/packages/components/package.json b/ui/packages/components/package.json
index b8ab022570..567b27498d 100644
--- a/ui/packages/components/package.json
+++ b/ui/packages/components/package.json
@@ -61,7 +61,7 @@
     "vite-plugin-dts": "^4.2.2"
   },
   "peerDependencies": {
-    "vue": "^3.5.8",
+    "vue": "^3.5.11",
     "vue-router": "^4.3.2"
   },
   "exports": {
diff --git a/ui/packages/editor/package.json b/ui/packages/editor/package.json
index 10bedb02c2..9e58bf6d81 100644
--- a/ui/packages/editor/package.json
+++ b/ui/packages/editor/package.json
@@ -90,6 +90,6 @@
     "vite-plugin-dts": "^4.2.2"
   },
   "peerDependencies": {
-    "vue": "^3.5.8"
+    "vue": "^3.5.11"
   }
 }
diff --git a/ui/packages/shared/package.json b/ui/packages/shared/package.json
index 46b01f01fd..7038339014 100644
--- a/ui/packages/shared/package.json
+++ b/ui/packages/shared/package.json
@@ -41,7 +41,7 @@
     "vite-plugin-dts": "^4.2.2"
   },
   "peerDependencies": {
-    "vue": "^3.5.8",
+    "vue": "^3.5.11",
     "vue-router": "^4.3.2"
   },
   "dependencies": {
diff --git a/ui/pnpm-lock.yaml b/ui/pnpm-lock.yaml
index 2a4278190e..6b0a41fc24 100644
--- a/ui/pnpm-lock.yaml
+++ b/ui/pnpm-lock.yaml
@@ -79,7 +79,7 @@ importers:
         version: link:packages/editor
       '@tanstack/vue-query':
         specifier: ^4.29.1
-        version: 4.29.1(vue@3.5.8(typescript@5.6.2))
+        version: 4.29.1(vue@3.5.11(typescript@5.6.2))
       '@tiptap/extension-character-count':
         specifier: ^2.6.5
         version: 2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))(@tiptap/pm@2.6.5)
@@ -109,25 +109,25 @@ importers:
         version: 3.3.3(@uppy/core@3.11.3)
       '@uppy/vue':
         specifier: ^1.1.2
-        version: 1.1.2(@uppy/core@3.11.3)(@uppy/dashboard@3.8.3(@uppy/core@3.11.3))(@uppy/drag-drop@3.1.0(@uppy/core@3.11.3))(@uppy/file-input@3.1.2(@uppy/core@3.11.3))(@uppy/progress-bar@3.1.1(@uppy/core@3.11.3))(@uppy/status-bar@3.3.3(@uppy/core@3.11.3))(vue@3.5.8(typescript@5.6.2))
+        version: 1.1.2(@uppy/core@3.11.3)(@uppy/dashboard@3.8.3(@uppy/core@3.11.3))(@uppy/drag-drop@3.1.0(@uppy/core@3.11.3))(@uppy/file-input@3.1.2(@uppy/core@3.11.3))(@uppy/progress-bar@3.1.1(@uppy/core@3.11.3))(@uppy/status-bar@3.3.3(@uppy/core@3.11.3))(vue@3.5.11(typescript@5.6.2))
       '@uppy/xhr-upload':
         specifier: 3.6.0
         version: 3.6.0(@uppy/core@3.11.3)
       '@vueuse/components':
         specifier: ^10.9.0
-        version: 10.9.0(vue@3.5.8(typescript@5.6.2))
+        version: 10.9.0(vue@3.5.11(typescript@5.6.2))
       '@vueuse/core':
         specifier: ^10.9.0
-        version: 10.9.0(vue@3.5.8(typescript@5.6.2))
+        version: 10.9.0(vue@3.5.11(typescript@5.6.2))
       '@vueuse/integrations':
         specifier: ^10.9.0
-        version: 10.9.0(axios@1.7.2)(fuse.js@6.6.2)(qrcode@1.5.3)(sortablejs@1.14.0)(vue@3.5.8(typescript@5.6.2))
+        version: 10.9.0(axios@1.7.2)(fuse.js@6.6.2)(qrcode@1.5.3)(sortablejs@1.14.0)(vue@3.5.11(typescript@5.6.2))
       '@vueuse/router':
         specifier: ^10.9.0
-        version: 10.9.0(vue-router@4.3.2(vue@3.5.8(typescript@5.6.2)))(vue@3.5.8(typescript@5.6.2))
+        version: 10.9.0(vue-router@4.3.2(vue@3.5.11(typescript@5.6.2)))(vue@3.5.11(typescript@5.6.2))
       '@vueuse/shared':
         specifier: ^10.9.0
-        version: 10.9.0(vue@3.5.8(typescript@5.6.2))
+        version: 10.9.0(vue@3.5.11(typescript@5.6.2))
       axios:
         specifier: ^1.7.x
         version: 1.7.2(debug@4.3.2)
@@ -148,7 +148,7 @@ importers:
         version: 5.6.0
       floating-vue:
         specifier: ^5.2.2
-        version: 5.2.2(vue@3.5.8(typescript@5.6.2))
+        version: 5.2.2(vue@3.5.11(typescript@5.6.2))
       fuse.js:
         specifier: ^6.6.2
         version: 6.6.2
@@ -163,13 +163,13 @@ importers:
         version: 2.5.0
       overlayscrollbars-vue:
         specifier: ^0.5.7
-        version: 0.5.7(overlayscrollbars@2.5.0)(vue@3.5.8(typescript@5.6.2))
+        version: 0.5.7(overlayscrollbars@2.5.0)(vue@3.5.11(typescript@5.6.2))
       path-browserify:
         specifier: ^1.0.1
         version: 1.0.1
       pinia:
         specifier: ^2.1.6
-        version: 2.1.6(typescript@5.6.2)(vue@3.5.8(typescript@5.6.2))
+        version: 2.1.6(typescript@5.6.2)(vue@3.5.11(typescript@5.6.2))
       pretty-bytes:
         specifier: ^6.0.0
         version: 6.0.0
@@ -189,11 +189,11 @@ importers:
         specifier: ^1.0.38
         version: 1.0.38
       vue:
-        specifier: ^3.5.8
-        version: 3.5.8(typescript@5.6.2)
+        specifier: ^3.5.11
+        version: 3.5.11(typescript@5.6.2)
       vue-demi:
-        specifier: ^0.14.7
-        version: 0.14.7(vue@3.5.8(typescript@5.6.2))
+        specifier: ^0.14.10
+        version: 0.14.10(vue@3.5.11(typescript@5.6.2))
       vue-draggable-plus:
         specifier: ^0.4.1
         version: 0.4.1(@types/sortablejs@1.15.8)
@@ -202,10 +202,10 @@ importers:
         version: 3.0.0-beta1(@interactjs/core@1.10.17(@interactjs/utils@1.10.17))(@interactjs/utils@1.10.17)
       vue-i18n:
         specifier: ^9.13.1
-        version: 9.13.1(vue@3.5.8(typescript@5.6.2))
+        version: 9.13.1(vue@3.5.11(typescript@5.6.2))
       vue-router:
         specifier: ^4.3.2
-        version: 4.3.2(vue@3.5.8(typescript@5.6.2))
+        version: 4.3.2(vue@3.5.11(typescript@5.6.2))
     devDependencies:
       '@changesets/cli':
         specifier: ^2.25.2
@@ -215,7 +215,7 @@ importers:
         version: 2.2.235
       '@intlify/unplugin-vue-i18n':
         specifier: ^4.0.0
-        version: 4.0.0(rollup@4.17.2)(vue-i18n@9.13.1(vue@3.5.8(typescript@5.6.2)))
+        version: 4.0.0(rollup@4.17.2)(vue-i18n@9.13.1(vue@3.5.11(typescript@5.6.2)))
       '@rushstack/eslint-patch':
         specifier: ^1.3.2
         version: 1.3.2
@@ -251,16 +251,16 @@ importers:
         version: 0.7.39
       '@vitejs/plugin-vue':
         specifier: ^5.1.4
-        version: 5.1.4(vite@5.4.1(@types/node@18.13.0)(less@4.2.0)(sass@1.60.0)(terser@5.31.0))(vue@3.5.8(typescript@5.6.2))
+        version: 5.1.4(vite@5.4.1(@types/node@18.13.0)(less@4.2.0)(sass@1.60.0)(terser@5.31.0))(vue@3.5.11(typescript@5.6.2))
       '@vitejs/plugin-vue-jsx':
         specifier: ^4.0.1
-        version: 4.0.1(vite@5.4.1(@types/node@18.13.0)(less@4.2.0)(sass@1.60.0)(terser@5.31.0))(vue@3.5.8(typescript@5.6.2))
+        version: 4.0.1(vite@5.4.1(@types/node@18.13.0)(less@4.2.0)(sass@1.60.0)(terser@5.31.0))(vue@3.5.11(typescript@5.6.2))
       '@vitest/ui':
         specifier: ^0.34.1
         version: 0.34.1(vitest@0.34.1)
       '@vue/compiler-sfc':
-        specifier: ^3.4.27
-        version: 3.4.27
+        specifier: ^3.5.11
+        version: 3.5.11
       '@vue/eslint-config-prettier':
         specifier: ^7.1.0
         version: 7.1.0(eslint@8.43.0)(prettier@2.8.8)
@@ -341,7 +341,7 @@ importers:
         version: 5.6.2
       unplugin-icons:
         specifier: ^0.19.2
-        version: 0.19.2(@vue/compiler-sfc@3.4.27)(vue-template-compiler@2.7.14)
+        version: 0.19.2(@vue/compiler-sfc@3.5.11)(vue-template-compiler@2.7.14)
       vite:
         specifier: ^5.4.1
         version: 5.4.1(@types/node@18.13.0)(less@4.2.0)(sass@1.60.0)(terser@5.31.0)
@@ -359,7 +359,7 @@ importers:
         version: 1.0.6(vite@5.4.1(@types/node@18.13.0)(less@4.2.0)(sass@1.60.0)(terser@5.31.0))
       vite-plugin-vue-devtools:
         specifier: ^7.3.8
-        version: 7.3.8(rollup@4.17.2)(vite@5.4.1(@types/node@18.13.0)(less@4.2.0)(sass@1.60.0)(terser@5.31.0))(vue@3.5.8(typescript@5.6.2))
+        version: 7.3.8(rollup@4.17.2)(vite@5.4.1(@types/node@18.13.0)(less@4.2.0)(sass@1.60.0)(terser@5.31.0))(vue@3.5.11(typescript@5.6.2))
       vitest:
         specifier: ^0.34.1
         version: 0.34.1(@vitest/ui@0.34.1)(jsdom@20.0.3)(less@4.2.0)(sass@1.60.0)(terser@5.31.0)
@@ -402,13 +402,13 @@ importers:
     dependencies:
       floating-vue:
         specifier: ^5.2.2
-        version: 5.2.2(vue@3.5.8(typescript@5.6.2))
+        version: 5.2.2(vue@3.5.11(typescript@5.6.2))
       vue:
-        specifier: ^3.5.8
-        version: 3.5.8(typescript@5.6.2)
+        specifier: ^3.5.11
+        version: 3.5.11(typescript@5.6.2)
       vue-router:
         specifier: ^4.3.2
-        version: 4.3.2(vue@3.5.8(typescript@5.6.2))
+        version: 4.3.2(vue@3.5.11(typescript@5.6.2))
     devDependencies:
       '@iconify-json/ri':
         specifier: ^1.1.15
@@ -433,10 +433,10 @@ importers:
         version: 0.0.14-next.2
       '@storybook/vue3':
         specifier: ^7.6.3
-        version: 7.6.3(@vue/compiler-core@3.5.8)(vue@3.5.8(typescript@5.6.2))
+        version: 7.6.3(@vue/compiler-core@3.5.11)(vue@3.5.11(typescript@5.6.2))
       '@storybook/vue3-vite':
         specifier: ^7.6.3
-        version: 7.6.3(@vue/compiler-core@3.5.8)(typescript@5.6.2)(vite@5.4.1(@types/node@20.14.2)(less@4.2.0)(sass@1.60.0)(terser@5.31.0))(vue@3.5.8(typescript@5.6.2))
+        version: 7.6.3(@vue/compiler-core@3.5.11)(typescript@5.6.2)(vite@5.4.1(@types/node@20.14.2)(less@4.2.0)(sass@1.60.0)(terser@5.31.0))(vue@3.5.11(typescript@5.6.2))
       eslint-plugin-storybook:
         specifier: ^0.6.15
         version: 0.6.15(eslint@8.43.0)(typescript@5.6.2)
@@ -451,7 +451,7 @@ importers:
         version: 7.6.3
       unplugin-icons:
         specifier: ^0.14.15
-        version: 0.14.15(@vue/compiler-sfc@3.5.8)(vue-template-compiler@2.7.14)
+        version: 0.14.15(@vue/compiler-sfc@3.5.11)(vue-template-compiler@2.7.14)
       vite-plugin-dts:
         specifier: ^4.2.2
         version: 4.2.2(@types/node@20.14.2)(rollup@4.17.2)(typescript@5.6.2)(vite@5.4.1(@types/node@20.14.2)(less@4.2.0)(sass@1.60.0)(terser@5.31.0))
@@ -460,7 +460,7 @@ importers:
     dependencies:
       '@ckpack/vue-color':
         specifier: ^1.5.0
-        version: 1.5.0(vue@3.5.8(typescript@5.6.2))
+        version: 1.5.0(vue@3.5.11(typescript@5.6.2))
       '@tiptap/core':
         specifier: ^2.6.5
         version: 2.6.5(@tiptap/pm@2.6.5)
@@ -568,10 +568,10 @@ importers:
         version: 2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))(@tiptap/pm@2.6.5)
       '@tiptap/vue-3':
         specifier: ^2.6.5
-        version: 2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))(@tiptap/pm@2.6.5)(vue@3.5.8(typescript@5.6.2))
+        version: 2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))(@tiptap/pm@2.6.5)(vue@3.5.11(typescript@5.6.2))
       floating-vue:
         specifier: ^5.2.2
-        version: 5.2.2(vue@3.5.8(typescript@5.6.2))
+        version: 5.2.2(vue@3.5.11(typescript@5.6.2))
       github-markdown-css:
         specifier: ^5.2.0
         version: 5.2.0
@@ -585,8 +585,8 @@ importers:
         specifier: ^6.3.7
         version: 6.3.7
       vue:
-        specifier: ^3.5.8
-        version: 3.5.8(typescript@5.6.2)
+        specifier: ^3.5.11
+        version: 3.5.11(typescript@5.6.2)
     devDependencies:
       '@iconify/json':
         specifier: ^2.2.117
@@ -607,11 +607,11 @@ importers:
         specifier: workspace:*
         version: link:../api-client
       vue:
-        specifier: ^3.5.8
-        version: 3.5.8(typescript@5.6.2)
+        specifier: ^3.5.11
+        version: 3.5.11(typescript@5.6.2)
       vue-router:
         specifier: ^4.3.2
-        version: 4.3.2(vue@3.5.8(typescript@5.6.2))
+        version: 4.3.2(vue@3.5.11(typescript@5.6.2))
     devDependencies:
       vite-plugin-dts:
         specifier: ^4.2.2
@@ -4253,26 +4253,26 @@ packages:
   '@vue/compiler-core@3.4.27':
     resolution: {integrity: sha512-E+RyqY24KnyDXsCuQrI+mlcdW3ALND6U7Gqa/+bVwbcpcR3BRRIckFoz7Qyd4TTlnugtwuI7YgjbvsLmxb+yvg==}
 
+  '@vue/compiler-core@3.5.11':
+    resolution: {integrity: sha512-PwAdxs7/9Hc3ieBO12tXzmTD+Ln4qhT/56S+8DvrrZ4kLDn4Z/AMUr8tXJD0axiJBS0RKIoNaR0yMuQB9v9Udg==}
+
   '@vue/compiler-core@3.5.8':
     resolution: {integrity: sha512-Uzlxp91EPjfbpeO5KtC0KnXPkuTfGsNDeaKQJxQN718uz+RqDYarEf7UhQJGK+ZYloD2taUbHTI2J4WrUaZQNA==}
 
   '@vue/compiler-dom@3.4.27':
     resolution: {integrity: sha512-kUTvochG/oVgE1w5ViSr3KUBh9X7CWirebA3bezTbB5ZKBQZwR2Mwj9uoSKRMFcz4gSMzzLXBPD6KpCLb9nvWw==}
 
+  '@vue/compiler-dom@3.5.11':
+    resolution: {integrity: sha512-pyGf8zdbDDRkBrEzf8p7BQlMKNNF5Fk/Cf/fQ6PiUz9at4OaUfyXW0dGJTo2Vl1f5U9jSLCNf0EZJEogLXoeew==}
+
   '@vue/compiler-dom@3.5.8':
     resolution: {integrity: sha512-GUNHWvoDSbSa5ZSHT9SnV5WkStWfzJwwTd6NMGzilOE/HM5j+9EB9zGXdtu/fCNEmctBqMs6C9SvVPpVPuk1Eg==}
 
-  '@vue/compiler-sfc@3.4.27':
-    resolution: {integrity: sha512-nDwntUEADssW8e0rrmE0+OrONwmRlegDA1pD6QhVeXxjIytV03yDqTey9SBDiALsvAd5U4ZrEKbMyVXhX6mCGA==}
-
-  '@vue/compiler-sfc@3.5.8':
-    resolution: {integrity: sha512-taYpngQtSysrvO9GULaOSwcG5q821zCoIQBtQQSx7Uf7DxpR6CIHR90toPr9QfDD2mqHQPCSgoWBvJu0yV9zjg==}
+  '@vue/compiler-sfc@3.5.11':
+    resolution: {integrity: sha512-gsbBtT4N9ANXXepprle+X9YLg2htQk1sqH/qGJ/EApl+dgpUBdTv3yP7YlR535uHZY3n6XaR0/bKo0BgwwDniw==}
 
-  '@vue/compiler-ssr@3.4.27':
-    resolution: {integrity: sha512-CVRzSJIltzMG5FcidsW0jKNQnNRYC8bT21VegyMMtHmhW3UOI7knmUehzswXLrExDLE6lQCZdrhD4ogI7c+vuw==}
-
-  '@vue/compiler-ssr@3.5.8':
-    resolution: {integrity: sha512-W96PtryNsNG9u0ZnN5Q5j27Z/feGrFV6zy9q5tzJVyJaLiwYxvC0ek4IXClZygyhjm+XKM7WD9pdKi/wIRVC/Q==}
+  '@vue/compiler-ssr@3.5.11':
+    resolution: {integrity: sha512-P4+GPjOuC2aFTk1Z4WANvEhyOykcvEd5bIj2KVNGKGfM745LaXGr++5njpdBTzVz5pZifdlR1kpYSJJpIlSePA==}
 
   '@vue/compiler-vue2@2.7.16':
     resolution: {integrity: sha512-qYC3Psj9S/mfu9uVi5WvNZIzq+xnXMhOwbTFKKDD7b1lhpnn71jXSFdTQ+WsIEk0ONCd7VV2IMm7ONl6tbQ86A==}
@@ -4319,23 +4319,26 @@ packages:
       typescript:
         optional: true
 
-  '@vue/reactivity@3.5.8':
-    resolution: {integrity: sha512-mlgUyFHLCUZcAYkqvzYnlBRCh0t5ZQfLYit7nukn1GR96gc48Bp4B7OIcSfVSvlG1k3BPfD+p22gi1t2n9tsXg==}
+  '@vue/reactivity@3.5.11':
+    resolution: {integrity: sha512-Nqo5VZEn8MJWlCce8XoyVqHZbd5P2NH+yuAaFzuNSR96I+y1cnuUiq7xfSG+kyvLSiWmaHTKP1r3OZY4mMD50w==}
 
-  '@vue/runtime-core@3.5.8':
-    resolution: {integrity: sha512-fJuPelh64agZ8vKkZgp5iCkPaEqFJsYzxLk9vSC0X3G8ppknclNDr61gDc45yBGTaN5Xqc1qZWU3/NoaBMHcjQ==}
+  '@vue/runtime-core@3.5.11':
+    resolution: {integrity: sha512-7PsxFGqwfDhfhh0OcDWBG1DaIQIVOLgkwA5q6MtkPiDFjp5gohVnJEahSktwSFLq7R5PtxDKy6WKURVN1UDbzA==}
 
-  '@vue/runtime-dom@3.5.8':
-    resolution: {integrity: sha512-DpAUz+PKjTZPUOB6zJgkxVI3GuYc2iWZiNeeHQUw53kdrparSTG6HeXUrYDjaam8dVsCdvQxDz6ZWxnyjccUjQ==}
+  '@vue/runtime-dom@3.5.11':
+    resolution: {integrity: sha512-GNghjecT6IrGf0UhuYmpgaOlN7kxzQBhxWEn08c/SQDxv1yy4IXI1bn81JgEpQ4IXjRxWtPyI8x0/7TF5rPfYQ==}
 
-  '@vue/server-renderer@3.5.8':
-    resolution: {integrity: sha512-7AmC9/mEeV9mmXNVyUIm1a1AjUhyeeGNbkLh39J00E7iPeGks8OGRB5blJiMmvqSh8SkaS7jkLWSpXtxUCeagA==}
+  '@vue/server-renderer@3.5.11':
+    resolution: {integrity: sha512-cVOwYBxR7Wb1B1FoxYvtjJD8X/9E5nlH4VSkJy2uMA1MzYNdzAAB//l8nrmN9py/4aP+3NjWukf9PZ3TeWULaA==}
     peerDependencies:
-      vue: 3.5.8
+      vue: 3.5.11
 
   '@vue/shared@3.4.27':
     resolution: {integrity: sha512-DL3NmY2OFlqmYYrzp39yi3LDkKxa5vZVwxWdQ3rG0ekuWscHraeIbnI8t+aZK7qhYqEqWKTUdijadunb9pnrgA==}
 
+  '@vue/shared@3.5.11':
+    resolution: {integrity: sha512-W8GgysJVnFo81FthhzurdRAWP/byq3q2qIw70e0JWblzVhjgOMiC2GyovXrZTFQJnFVryYaKGP3Tc9vYzYm6PQ==}
+
   '@vue/shared@3.5.8':
     resolution: {integrity: sha512-mJleSWbAGySd2RJdX1RBtcrUBX6snyOc0qHpgk3lGi4l9/P/3ny3ELqFWqYdkXIwwNN/kdm8nD9ky8o6l/Lx2A==}
 
@@ -7517,9 +7520,6 @@ packages:
     resolution: {integrity: sha512-hX9XH3ziStPoPhJxLq1syWuZMxbDvGNbVchfrdCtanC7D13888bMFow61x8axrx+GfHLtVeAx2kxL7tTGRl+Ow==}
     engines: {node: '>=12'}
 
-  magic-string@0.30.10:
-    resolution: {integrity: sha512-iIRwTIf0QKV3UAnYK4PU8uiEc4SRh5jX0mwpIwETPpHdhVM4f53RSwS/vXvN1JhGX+Cs7B8qIq3d6AH49O5fAQ==}
-
   magic-string@0.30.11:
     resolution: {integrity: sha512-+Wri9p0QHMy+545hKww7YAu5NyzF8iomPL/RQazugQ9+Ez4Ic3mERMd8ZTX5rfK944j+560ZJi8iAwgak1Ac7A==}
 
@@ -7527,10 +7527,6 @@ packages:
     resolution: {integrity: sha512-lNZdu7pewtq/ZvWUp9Wpf/x7WzMTsR26TWV03BRZrXFsv+BI6dy8RAiKgm1uM/kyR0rCfUcqvOlXKG66KhIGug==}
     engines: {node: '>=12'}
 
-  magic-string@0.30.7:
-    resolution: {integrity: sha512-8vBuFF/I/+OSLRmdf2wwFCJCz+nSn0m6DPvGH1fS/KiQoSaR+sETbov0eIk9KhEKy8CYqIkIAnbohxT/4H0kuA==}
-    engines: {node: '>=12'}
-
   make-dir@2.1.0:
     resolution: {integrity: sha512-LS9X+dc8KLxXCb8dni79fLIIUA5VyZoyjSMCwTluaXA0o27cCK0bhXkpgw+sTXVpPy/lSO57ilRixqk0vDmtRA==}
     engines: {node: '>=6'}
@@ -10205,8 +10201,8 @@ packages:
       '@vue/composition-api':
         optional: true
 
-  vue-demi@0.14.7:
-    resolution: {integrity: sha512-EOG8KXDQNwkJILkx/gPcoL/7vH+hORoBaKgGe+6W7VFMvCYJfmF2dGbvgDroVnI8LU7/kTu8mbjRZGBU1z9NTA==}
+  vue-demi@0.14.10:
+    resolution: {integrity: sha512-nMZBOwuzabUO0nLgIcc6rycZEebF6eeUfaiQx9+WSk8e29IbLvPU9feI6tqW4kTo3hvoYAJkMh8n8D0fuISphg==}
     engines: {node: '>=12'}
     hasBin: true
     peerDependencies:
@@ -10275,8 +10271,8 @@ packages:
     peerDependencies:
       typescript: '>=5.0.0'
 
-  vue@3.5.8:
-    resolution: {integrity: sha512-hvuvuCy51nP/1fSRvrrIqTLSvrSyz2Pq+KQ8S8SXCxTWVE0nMaOnSDnSOxV1eYmGfvK7mqiwvd1C59CEEz7dAQ==}
+  vue@3.5.11:
+    resolution: {integrity: sha512-/8Wurrd9J3lb72FTQS7gRMNQD4nztTtKPmuDuPuhqXmmpD6+skVjAeahNpVzsuky6Sy9gy7wn8UadqPtt9SQIg==}
     peerDependencies:
       typescript: '*'
     peerDependenciesMeta:
@@ -10637,12 +10633,12 @@ snapshots:
   '@babel/code-frame@7.24.2':
     dependencies:
       '@babel/highlight': 7.24.5
-      picocolors: 1.0.1
+      picocolors: 1.1.0
 
   '@babel/code-frame@7.24.7':
     dependencies:
       '@babel/highlight': 7.24.7
-      picocolors: 1.0.1
+      picocolors: 1.1.0
 
   '@babel/compat-data@7.24.4': {}
 
@@ -10656,10 +10652,10 @@ snapshots:
       '@babel/helper-compilation-targets': 7.23.6
       '@babel/helper-module-transforms': 7.24.5(@babel/core@7.24.5)
       '@babel/helpers': 7.24.5
-      '@babel/parser': 7.24.5
+      '@babel/parser': 7.25.3
       '@babel/template': 7.24.0
       '@babel/traverse': 7.24.5
-      '@babel/types': 7.24.5
+      '@babel/types': 7.25.2
       convert-source-map: 2.0.0
       debug: 4.3.6(supports-color@8.1.1)
       gensync: 1.0.0-beta.2
@@ -10690,7 +10686,7 @@ snapshots:
 
   '@babel/generator@7.24.5':
     dependencies:
-      '@babel/types': 7.24.5
+      '@babel/types': 7.25.2
       '@jridgewell/gen-mapping': 0.3.5
       '@jridgewell/trace-mapping': 0.3.25
       jsesc: 2.5.2
@@ -10704,7 +10700,7 @@ snapshots:
 
   '@babel/helper-annotate-as-pure@7.22.5':
     dependencies:
-      '@babel/types': 7.24.5
+      '@babel/types': 7.25.2
 
   '@babel/helper-annotate-as-pure@7.24.7':
     dependencies:
@@ -10712,7 +10708,7 @@ snapshots:
 
   '@babel/helper-builder-binary-assignment-operator-visitor@7.22.15':
     dependencies:
-      '@babel/types': 7.24.5
+      '@babel/types': 7.25.2
 
   '@babel/helper-compilation-targets@7.23.6':
     dependencies:
@@ -10797,15 +10793,15 @@ snapshots:
   '@babel/helper-function-name@7.23.0':
     dependencies:
       '@babel/template': 7.24.0
-      '@babel/types': 7.24.5
+      '@babel/types': 7.25.2
 
   '@babel/helper-hoist-variables@7.22.5':
     dependencies:
-      '@babel/types': 7.24.5
+      '@babel/types': 7.25.2
 
   '@babel/helper-member-expression-to-functions@7.24.5':
     dependencies:
-      '@babel/types': 7.24.5
+      '@babel/types': 7.25.2
 
   '@babel/helper-member-expression-to-functions@7.24.8':
     dependencies:
@@ -10816,11 +10812,11 @@ snapshots:
 
   '@babel/helper-module-imports@7.22.15':
     dependencies:
-      '@babel/types': 7.24.5
+      '@babel/types': 7.25.2
 
   '@babel/helper-module-imports@7.24.3':
     dependencies:
-      '@babel/types': 7.24.5
+      '@babel/types': 7.25.2
 
   '@babel/helper-module-imports@7.24.7':
     dependencies:
@@ -10836,7 +10832,7 @@ snapshots:
       '@babel/helper-module-imports': 7.24.3
       '@babel/helper-simple-access': 7.24.5
       '@babel/helper-split-export-declaration': 7.24.5
-      '@babel/helper-validator-identifier': 7.24.5
+      '@babel/helper-validator-identifier': 7.24.7
 
   '@babel/helper-module-transforms@7.25.2(@babel/core@7.25.2)':
     dependencies:
@@ -10850,7 +10846,7 @@ snapshots:
 
   '@babel/helper-optimise-call-expression@7.22.5':
     dependencies:
-      '@babel/types': 7.24.5
+      '@babel/types': 7.25.2
 
   '@babel/helper-optimise-call-expression@7.24.7':
     dependencies:
@@ -10892,7 +10888,7 @@ snapshots:
 
   '@babel/helper-simple-access@7.24.5':
     dependencies:
-      '@babel/types': 7.24.5
+      '@babel/types': 7.25.2
 
   '@babel/helper-simple-access@7.24.7':
     dependencies:
@@ -10903,7 +10899,7 @@ snapshots:
 
   '@babel/helper-skip-transparent-expression-wrappers@7.22.5':
     dependencies:
-      '@babel/types': 7.24.5
+      '@babel/types': 7.25.2
 
   '@babel/helper-skip-transparent-expression-wrappers@7.24.7':
     dependencies:
@@ -10914,7 +10910,7 @@ snapshots:
 
   '@babel/helper-split-export-declaration@7.24.5':
     dependencies:
-      '@babel/types': 7.24.5
+      '@babel/types': 7.25.2
 
   '@babel/helper-string-parser@7.23.4': {}
 
@@ -10936,13 +10932,13 @@ snapshots:
     dependencies:
       '@babel/helper-function-name': 7.23.0
       '@babel/template': 7.24.0
-      '@babel/types': 7.24.5
+      '@babel/types': 7.25.2
 
   '@babel/helpers@7.24.5':
     dependencies:
       '@babel/template': 7.24.0
       '@babel/traverse': 7.24.5
-      '@babel/types': 7.24.5
+      '@babel/types': 7.25.2
     transitivePeerDependencies:
       - supports-color
 
@@ -10953,28 +10949,28 @@ snapshots:
 
   '@babel/highlight@7.23.4':
     dependencies:
-      '@babel/helper-validator-identifier': 7.24.5
+      '@babel/helper-validator-identifier': 7.24.7
       chalk: 2.4.2
       js-tokens: 4.0.0
     optional: true
 
   '@babel/highlight@7.24.5':
     dependencies:
-      '@babel/helper-validator-identifier': 7.24.5
+      '@babel/helper-validator-identifier': 7.24.7
       chalk: 2.4.2
       js-tokens: 4.0.0
-      picocolors: 1.0.1
+      picocolors: 1.1.0
 
   '@babel/highlight@7.24.7':
     dependencies:
       '@babel/helper-validator-identifier': 7.24.7
       chalk: 2.4.2
       js-tokens: 4.0.0
-      picocolors: 1.0.1
+      picocolors: 1.1.0
 
   '@babel/parser@7.24.5':
     dependencies:
-      '@babel/types': 7.24.5
+      '@babel/types': 7.25.2
 
   '@babel/parser@7.25.3':
     dependencies:
@@ -11568,7 +11564,7 @@ snapshots:
       '@babel/helper-hoist-variables': 7.22.5
       '@babel/helper-module-transforms': 7.24.5(@babel/core@7.24.5)
       '@babel/helper-plugin-utils': 7.24.5
-      '@babel/helper-validator-identifier': 7.24.5
+      '@babel/helper-validator-identifier': 7.24.7
 
   '@babel/plugin-transform-modules-systemjs@7.24.1(@babel/core@7.25.2)':
     dependencies:
@@ -12076,14 +12072,14 @@ snapshots:
     dependencies:
       '@babel/core': 7.24.5
       '@babel/helper-plugin-utils': 7.24.5
-      '@babel/types': 7.24.5
+      '@babel/types': 7.25.2
       esutils: 2.0.3
 
   '@babel/preset-modules@0.1.6-no-external-plugins(@babel/core@7.25.2)':
     dependencies:
       '@babel/core': 7.25.2
       '@babel/helper-plugin-utils': 7.24.5
-      '@babel/types': 7.24.5
+      '@babel/types': 7.25.2
       esutils: 2.0.3
 
   '@babel/preset-typescript@7.23.3(@babel/core@7.24.5)':
@@ -12125,8 +12121,8 @@ snapshots:
   '@babel/template@7.24.0':
     dependencies:
       '@babel/code-frame': 7.24.2
-      '@babel/parser': 7.24.5
-      '@babel/types': 7.24.5
+      '@babel/parser': 7.25.3
+      '@babel/types': 7.25.2
 
   '@babel/template@7.25.0':
     dependencies:
@@ -12142,8 +12138,8 @@ snapshots:
       '@babel/helper-function-name': 7.23.0
       '@babel/helper-hoist-variables': 7.22.5
       '@babel/helper-split-export-declaration': 7.24.5
-      '@babel/parser': 7.24.5
-      '@babel/types': 7.24.5
+      '@babel/parser': 7.25.3
+      '@babel/types': 7.25.2
       debug: 4.3.6(supports-color@8.1.1)
       globals: 11.12.0
     transitivePeerDependencies:
@@ -12175,8 +12171,8 @@ snapshots:
 
   '@babel/types@7.24.5':
     dependencies:
-      '@babel/helper-string-parser': 7.24.1
-      '@babel/helper-validator-identifier': 7.24.5
+      '@babel/helper-string-parser': 7.24.8
+      '@babel/helper-validator-identifier': 7.24.7
       to-fast-properties: 2.0.0
 
   '@babel/types@7.25.2':
@@ -12335,11 +12331,11 @@ snapshots:
       human-id: 1.0.2
       prettier: 2.8.8
 
-  '@ckpack/vue-color@1.5.0(vue@3.5.8(typescript@5.6.2))':
+  '@ckpack/vue-color@1.5.0(vue@3.5.11(typescript@5.6.2))':
     dependencies:
       '@ctrl/tinycolor': 3.6.1
       material-colors: 1.2.6
-      vue: 3.5.8(typescript@5.6.2)
+      vue: 3.5.11(typescript@5.6.2)
 
   '@codemirror/autocomplete@6.3.0(@codemirror/language@6.3.1)(@codemirror/state@6.1.4)(@codemirror/view@6.5.1)(@lezer/common@1.0.1)':
     dependencies:
@@ -12773,7 +12769,7 @@ snapshots:
       '@formkit/themes': 1.5.9(tailwindcss@3.3.0(postcss@8.4.21))
       '@formkit/utils': 1.5.9
       '@formkit/validation': 1.5.9
-      vue: 3.5.8(typescript@5.6.2)
+      vue: 3.5.11(typescript@5.6.2)
     transitivePeerDependencies:
       - tailwindcss
       - typescript
@@ -12939,7 +12935,7 @@ snapshots:
 
   '@interactjs/utils@1.10.17': {}
 
-  '@intlify/bundle-utils@8.0.0(vue-i18n@9.13.1(vue@3.5.8(typescript@5.6.2)))':
+  '@intlify/bundle-utils@8.0.0(vue-i18n@9.13.1(vue@3.5.11(typescript@5.6.2)))':
     dependencies:
       '@intlify/message-compiler': 9.13.1
       '@intlify/shared': 9.13.1
@@ -12951,7 +12947,7 @@ snapshots:
       source-map-js: 1.2.0
       yaml-eslint-parser: 1.2.2
     optionalDependencies:
-      vue-i18n: 9.13.1(vue@3.5.8(typescript@5.6.2))
+      vue-i18n: 9.13.1(vue@3.5.11(typescript@5.6.2))
 
   '@intlify/core-base@9.13.1':
     dependencies:
@@ -12961,16 +12957,16 @@ snapshots:
   '@intlify/message-compiler@9.13.1':
     dependencies:
       '@intlify/shared': 9.13.1
-      source-map-js: 1.2.0
+      source-map-js: 1.2.1
 
   '@intlify/shared@9.13.1': {}
 
-  '@intlify/unplugin-vue-i18n@4.0.0(rollup@4.17.2)(vue-i18n@9.13.1(vue@3.5.8(typescript@5.6.2)))':
+  '@intlify/unplugin-vue-i18n@4.0.0(rollup@4.17.2)(vue-i18n@9.13.1(vue@3.5.11(typescript@5.6.2)))':
     dependencies:
-      '@intlify/bundle-utils': 8.0.0(vue-i18n@9.13.1(vue@3.5.8(typescript@5.6.2)))
+      '@intlify/bundle-utils': 8.0.0(vue-i18n@9.13.1(vue@3.5.11(typescript@5.6.2)))
       '@intlify/shared': 9.13.1
       '@rollup/pluginutils': 5.1.0(rollup@4.17.2)
-      '@vue/compiler-sfc': 3.4.27
+      '@vue/compiler-sfc': 3.5.11
       debug: 4.3.4(supports-color@8.1.1)
       fast-glob: 3.3.2
       js-yaml: 4.1.0
@@ -12980,7 +12976,7 @@ snapshots:
       source-map-js: 1.2.0
       unplugin: 1.5.1
     optionalDependencies:
-      vue-i18n: 9.13.1(vue@3.5.8(typescript@5.6.2))
+      vue-i18n: 9.13.1(vue@3.5.11(typescript@5.6.2))
     transitivePeerDependencies:
       - rollup
       - supports-color
@@ -14162,7 +14158,7 @@ snapshots:
     dependencies:
       '@babel/core': 7.24.5
       '@babel/preset-env': 7.23.5(@babel/core@7.24.5)
-      '@babel/types': 7.24.5
+      '@babel/types': 7.25.2
       '@storybook/csf': 0.1.2
       '@storybook/csf-tools': 7.6.3
       '@storybook/node-logger': 7.6.3
@@ -14292,9 +14288,9 @@ snapshots:
   '@storybook/csf-tools@7.6.3':
     dependencies:
       '@babel/generator': 7.24.5
-      '@babel/parser': 7.24.5
+      '@babel/parser': 7.25.3
       '@babel/traverse': 7.24.5
-      '@babel/types': 7.24.5
+      '@babel/types': 7.25.2
       '@storybook/csf': 0.1.2
       '@storybook/types': 7.6.3
       fs-extra: 11.2.0
@@ -14435,15 +14431,15 @@ snapshots:
       '@types/express': 4.17.21
       file-system-cache: 2.3.0
 
-  '@storybook/vue3-vite@7.6.3(@vue/compiler-core@3.5.8)(typescript@5.6.2)(vite@5.4.1(@types/node@20.14.2)(less@4.2.0)(sass@1.60.0)(terser@5.31.0))(vue@3.5.8(typescript@5.6.2))':
+  '@storybook/vue3-vite@7.6.3(@vue/compiler-core@3.5.11)(typescript@5.6.2)(vite@5.4.1(@types/node@20.14.2)(less@4.2.0)(sass@1.60.0)(terser@5.31.0))(vue@3.5.11(typescript@5.6.2))':
     dependencies:
       '@storybook/builder-vite': 7.6.3(typescript@5.6.2)(vite@5.4.1(@types/node@20.14.2)(less@4.2.0)(sass@1.60.0)(terser@5.31.0))
       '@storybook/core-server': 7.6.3
-      '@storybook/vue3': 7.6.3(@vue/compiler-core@3.5.8)(vue@3.5.8(typescript@5.6.2))
-      '@vitejs/plugin-vue': 4.2.3(vite@5.4.1(@types/node@20.14.2)(less@4.2.0)(sass@1.60.0)(terser@5.31.0))(vue@3.5.8(typescript@5.6.2))
+      '@storybook/vue3': 7.6.3(@vue/compiler-core@3.5.11)(vue@3.5.11(typescript@5.6.2))
+      '@vitejs/plugin-vue': 4.2.3(vite@5.4.1(@types/node@20.14.2)(less@4.2.0)(sass@1.60.0)(terser@5.31.0))(vue@3.5.11(typescript@5.6.2))
       magic-string: 0.30.2
       vite: 5.4.1(@types/node@20.14.2)(less@4.2.0)(sass@1.60.0)(terser@5.31.0)
-      vue-docgen-api: 4.75.1(vue@3.5.8(typescript@5.6.2))
+      vue-docgen-api: 4.75.1(vue@3.5.11(typescript@5.6.2))
     transitivePeerDependencies:
       - '@preact/preset-vite'
       - '@vue/compiler-core'
@@ -14455,18 +14451,18 @@ snapshots:
       - vite-plugin-glimmerx
       - vue
 
-  '@storybook/vue3@7.6.3(@vue/compiler-core@3.5.8)(vue@3.5.8(typescript@5.6.2))':
+  '@storybook/vue3@7.6.3(@vue/compiler-core@3.5.11)(vue@3.5.11(typescript@5.6.2))':
     dependencies:
       '@storybook/core-client': 7.6.3
       '@storybook/docs-tools': 7.6.3
       '@storybook/global': 5.0.0
       '@storybook/preview-api': 7.6.3
       '@storybook/types': 7.6.3
-      '@vue/compiler-core': 3.5.8
+      '@vue/compiler-core': 3.5.11
       lodash: 4.17.21
       ts-dedent: 2.2.0
       type-fest: 2.19.0
-      vue: 3.5.8(typescript@5.6.2)
+      vue: 3.5.11(typescript@5.6.2)
       vue-component-type-helpers: 2.1.6
     transitivePeerDependencies:
       - encoding
@@ -14502,13 +14498,13 @@ snapshots:
 
   '@tanstack/query-core@4.29.1': {}
 
-  '@tanstack/vue-query@4.29.1(vue@3.5.8(typescript@5.6.2))':
+  '@tanstack/vue-query@4.29.1(vue@3.5.11(typescript@5.6.2))':
     dependencies:
       '@tanstack/match-sorter-utils': 8.7.6
       '@tanstack/query-core': 4.29.1
       '@vue/devtools-api': 6.5.0
-      vue: 3.5.8(typescript@5.6.2)
-      vue-demi: 0.13.11(vue@3.5.8(typescript@5.6.2))
+      vue: 3.5.11(typescript@5.6.2)
+      vue-demi: 0.13.11(vue@3.5.11(typescript@5.6.2))
 
   '@testing-library/dom@8.20.1':
     dependencies:
@@ -14711,13 +14707,13 @@ snapshots:
       '@tiptap/core': 2.6.5(@tiptap/pm@2.6.5)
       '@tiptap/pm': 2.6.5
 
-  '@tiptap/vue-3@2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))(@tiptap/pm@2.6.5)(vue@3.5.8(typescript@5.6.2))':
+  '@tiptap/vue-3@2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))(@tiptap/pm@2.6.5)(vue@3.5.11(typescript@5.6.2))':
     dependencies:
       '@tiptap/core': 2.6.5(@tiptap/pm@2.6.5)
       '@tiptap/extension-bubble-menu': 2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))(@tiptap/pm@2.6.5)
       '@tiptap/extension-floating-menu': 2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))(@tiptap/pm@2.6.5)
       '@tiptap/pm': 2.6.5
-      vue: 3.5.8(typescript@5.6.2)
+      vue: 3.5.11(typescript@5.6.2)
 
   '@tootallnate/once@2.0.0': {}
 
@@ -14733,24 +14729,24 @@ snapshots:
 
   '@types/babel__core@7.20.5':
     dependencies:
-      '@babel/parser': 7.24.5
-      '@babel/types': 7.24.5
+      '@babel/parser': 7.25.3
+      '@babel/types': 7.25.2
       '@types/babel__generator': 7.6.7
       '@types/babel__template': 7.4.4
       '@types/babel__traverse': 7.20.4
 
   '@types/babel__generator@7.6.7':
     dependencies:
-      '@babel/types': 7.24.5
+      '@babel/types': 7.25.2
 
   '@types/babel__template@7.4.4':
     dependencies:
-      '@babel/parser': 7.24.5
-      '@babel/types': 7.24.5
+      '@babel/parser': 7.25.3
+      '@babel/types': 7.25.2
 
   '@types/babel__traverse@7.20.4':
     dependencies:
-      '@babel/types': 7.24.5
+      '@babel/types': 7.25.2
 
   '@types/body-parser@1.19.5':
     dependencies:
@@ -15143,11 +15139,11 @@ snapshots:
       lodash: 4.17.21
       preact: 10.11.2
 
-  '@uppy/vue@1.1.2(@uppy/core@3.11.3)(@uppy/dashboard@3.8.3(@uppy/core@3.11.3))(@uppy/drag-drop@3.1.0(@uppy/core@3.11.3))(@uppy/file-input@3.1.2(@uppy/core@3.11.3))(@uppy/progress-bar@3.1.1(@uppy/core@3.11.3))(@uppy/status-bar@3.3.3(@uppy/core@3.11.3))(vue@3.5.8(typescript@5.6.2))':
+  '@uppy/vue@1.1.2(@uppy/core@3.11.3)(@uppy/dashboard@3.8.3(@uppy/core@3.11.3))(@uppy/drag-drop@3.1.0(@uppy/core@3.11.3))(@uppy/file-input@3.1.2(@uppy/core@3.11.3))(@uppy/progress-bar@3.1.1(@uppy/core@3.11.3))(@uppy/status-bar@3.3.3(@uppy/core@3.11.3))(vue@3.5.11(typescript@5.6.2))':
     dependencies:
       '@uppy/core': 3.11.3
       shallow-equal: 1.2.1
-      vue: 3.5.8(typescript@5.6.2)
+      vue: 3.5.11(typescript@5.6.2)
     optionalDependencies:
       '@uppy/dashboard': 3.8.3(@uppy/core@3.11.3)
       '@uppy/drag-drop': 3.1.0(@uppy/core@3.11.3)
@@ -15162,25 +15158,25 @@ snapshots:
       '@uppy/utils': 5.9.0
       nanoid: 4.0.0
 
-  '@vitejs/plugin-vue-jsx@4.0.1(vite@5.4.1(@types/node@18.13.0)(less@4.2.0)(sass@1.60.0)(terser@5.31.0))(vue@3.5.8(typescript@5.6.2))':
+  '@vitejs/plugin-vue-jsx@4.0.1(vite@5.4.1(@types/node@18.13.0)(less@4.2.0)(sass@1.60.0)(terser@5.31.0))(vue@3.5.11(typescript@5.6.2))':
     dependencies:
       '@babel/core': 7.25.2
       '@babel/plugin-transform-typescript': 7.25.2(@babel/core@7.25.2)
       '@vue/babel-plugin-jsx': 1.2.2(@babel/core@7.25.2)
       vite: 5.4.1(@types/node@18.13.0)(less@4.2.0)(sass@1.60.0)(terser@5.31.0)
-      vue: 3.5.8(typescript@5.6.2)
+      vue: 3.5.11(typescript@5.6.2)
     transitivePeerDependencies:
       - supports-color
 
-  '@vitejs/plugin-vue@4.2.3(vite@5.4.1(@types/node@20.14.2)(less@4.2.0)(sass@1.60.0)(terser@5.31.0))(vue@3.5.8(typescript@5.6.2))':
+  '@vitejs/plugin-vue@4.2.3(vite@5.4.1(@types/node@20.14.2)(less@4.2.0)(sass@1.60.0)(terser@5.31.0))(vue@3.5.11(typescript@5.6.2))':
     dependencies:
       vite: 5.4.1(@types/node@20.14.2)(less@4.2.0)(sass@1.60.0)(terser@5.31.0)
-      vue: 3.5.8(typescript@5.6.2)
+      vue: 3.5.11(typescript@5.6.2)
 
-  '@vitejs/plugin-vue@5.1.4(vite@5.4.1(@types/node@18.13.0)(less@4.2.0)(sass@1.60.0)(terser@5.31.0))(vue@3.5.8(typescript@5.6.2))':
+  '@vitejs/plugin-vue@5.1.4(vite@5.4.1(@types/node@18.13.0)(less@4.2.0)(sass@1.60.0)(terser@5.31.0))(vue@3.5.11(typescript@5.6.2))':
     dependencies:
       vite: 5.4.1(@types/node@18.13.0)(less@4.2.0)(sass@1.60.0)(terser@5.31.0)
-      vue: 3.5.8(typescript@5.6.2)
+      vue: 3.5.11(typescript@5.6.2)
 
   '@vitest/expect@0.34.1':
     dependencies:
@@ -15196,7 +15192,7 @@ snapshots:
 
   '@vitest/snapshot@0.34.1':
     dependencies:
-      magic-string: 0.30.7
+      magic-string: 0.30.11
       pathe: 1.1.2
       pretty-format: 29.6.2
 
@@ -15250,7 +15246,7 @@ snapshots:
       '@babel/plugin-syntax-jsx': 7.23.3(@babel/core@7.24.5)
       '@babel/template': 7.24.0
       '@babel/traverse': 7.24.5
-      '@babel/types': 7.24.5
+      '@babel/types': 7.25.2
       '@vue/babel-helper-vue-transform-on': 1.1.5
       camelcase: 6.3.0
       html-tags: 3.3.1
@@ -15282,16 +15278,24 @@ snapshots:
       '@babel/core': 7.25.2
       '@babel/helper-module-imports': 7.22.15
       '@babel/helper-plugin-utils': 7.24.5
-      '@babel/parser': 7.24.5
-      '@vue/compiler-sfc': 3.4.27
+      '@babel/parser': 7.25.3
+      '@vue/compiler-sfc': 3.5.11
 
   '@vue/compiler-core@3.4.27':
     dependencies:
-      '@babel/parser': 7.24.5
+      '@babel/parser': 7.25.3
       '@vue/shared': 3.4.27
       entities: 4.5.0
       estree-walker: 2.0.2
-      source-map-js: 1.2.0
+      source-map-js: 1.2.1
+
+  '@vue/compiler-core@3.5.11':
+    dependencies:
+      '@babel/parser': 7.25.3
+      '@vue/shared': 3.5.11
+      entities: 4.5.0
+      estree-walker: 2.0.2
+      source-map-js: 1.2.1
 
   '@vue/compiler-core@3.5.8':
     dependencies:
@@ -15299,51 +15303,39 @@ snapshots:
       '@vue/shared': 3.5.8
       entities: 4.5.0
       estree-walker: 2.0.2
-      source-map-js: 1.2.0
+      source-map-js: 1.2.1
 
   '@vue/compiler-dom@3.4.27':
     dependencies:
       '@vue/compiler-core': 3.4.27
       '@vue/shared': 3.4.27
 
+  '@vue/compiler-dom@3.5.11':
+    dependencies:
+      '@vue/compiler-core': 3.5.11
+      '@vue/shared': 3.5.11
+
   '@vue/compiler-dom@3.5.8':
     dependencies:
       '@vue/compiler-core': 3.5.8
       '@vue/shared': 3.5.8
 
-  '@vue/compiler-sfc@3.4.27':
-    dependencies:
-      '@babel/parser': 7.24.5
-      '@vue/compiler-core': 3.4.27
-      '@vue/compiler-dom': 3.4.27
-      '@vue/compiler-ssr': 3.4.27
-      '@vue/shared': 3.4.27
-      estree-walker: 2.0.2
-      magic-string: 0.30.10
-      postcss: 8.4.38
-      source-map-js: 1.2.0
-
-  '@vue/compiler-sfc@3.5.8':
+  '@vue/compiler-sfc@3.5.11':
     dependencies:
       '@babel/parser': 7.25.3
-      '@vue/compiler-core': 3.5.8
-      '@vue/compiler-dom': 3.5.8
-      '@vue/compiler-ssr': 3.5.8
-      '@vue/shared': 3.5.8
+      '@vue/compiler-core': 3.5.11
+      '@vue/compiler-dom': 3.5.11
+      '@vue/compiler-ssr': 3.5.11
+      '@vue/shared': 3.5.11
       estree-walker: 2.0.2
       magic-string: 0.30.11
       postcss: 8.4.47
-      source-map-js: 1.2.0
-
-  '@vue/compiler-ssr@3.4.27':
-    dependencies:
-      '@vue/compiler-dom': 3.4.27
-      '@vue/shared': 3.4.27
+      source-map-js: 1.2.1
 
-  '@vue/compiler-ssr@3.5.8':
+  '@vue/compiler-ssr@3.5.11':
     dependencies:
-      '@vue/compiler-dom': 3.5.8
-      '@vue/shared': 3.5.8
+      '@vue/compiler-dom': 3.5.11
+      '@vue/shared': 3.5.11
 
   '@vue/compiler-vue2@2.7.16':
     dependencies:
@@ -15354,7 +15346,7 @@ snapshots:
 
   '@vue/devtools-api@6.6.1': {}
 
-  '@vue/devtools-core@7.3.8(vite@5.4.1(@types/node@18.13.0)(less@4.2.0)(sass@1.60.0)(terser@5.31.0))(vue@3.5.8(typescript@5.6.2))':
+  '@vue/devtools-core@7.3.8(vite@5.4.1(@types/node@18.13.0)(less@4.2.0)(sass@1.60.0)(terser@5.31.0))(vue@3.5.11(typescript@5.6.2))':
     dependencies:
       '@vue/devtools-kit': 7.3.8
       '@vue/devtools-shared': 7.3.8
@@ -15362,7 +15354,7 @@ snapshots:
       nanoid: 3.3.7
       pathe: 1.1.2
       vite-hot-client: 0.2.3(vite@5.4.1(@types/node@18.13.0)(less@4.2.0)(sass@1.60.0)(terser@5.31.0))
-      vue: 3.5.8(typescript@5.6.2)
+      vue: 3.5.11(typescript@5.6.2)
     transitivePeerDependencies:
       - vite
 
@@ -15425,30 +15417,32 @@ snapshots:
     optionalDependencies:
       typescript: 5.6.2
 
-  '@vue/reactivity@3.5.8':
+  '@vue/reactivity@3.5.11':
     dependencies:
-      '@vue/shared': 3.5.8
+      '@vue/shared': 3.5.11
 
-  '@vue/runtime-core@3.5.8':
+  '@vue/runtime-core@3.5.11':
     dependencies:
-      '@vue/reactivity': 3.5.8
-      '@vue/shared': 3.5.8
+      '@vue/reactivity': 3.5.11
+      '@vue/shared': 3.5.11
 
-  '@vue/runtime-dom@3.5.8':
+  '@vue/runtime-dom@3.5.11':
     dependencies:
-      '@vue/reactivity': 3.5.8
-      '@vue/runtime-core': 3.5.8
-      '@vue/shared': 3.5.8
+      '@vue/reactivity': 3.5.11
+      '@vue/runtime-core': 3.5.11
+      '@vue/shared': 3.5.11
       csstype: 3.1.3
 
-  '@vue/server-renderer@3.5.8(vue@3.5.8(typescript@5.6.2))':
+  '@vue/server-renderer@3.5.11(vue@3.5.11(typescript@5.6.2))':
     dependencies:
-      '@vue/compiler-ssr': 3.5.8
-      '@vue/shared': 3.5.8
-      vue: 3.5.8(typescript@5.6.2)
+      '@vue/compiler-ssr': 3.5.11
+      '@vue/shared': 3.5.11
+      vue: 3.5.11(typescript@5.6.2)
 
   '@vue/shared@3.4.27': {}
 
+  '@vue/shared@3.5.11': {}
+
   '@vue/shared@3.5.8': {}
 
   '@vue/test-utils@2.4.6':
@@ -15458,30 +15452,30 @@ snapshots:
 
   '@vue/tsconfig@0.5.1': {}
 
-  '@vueuse/components@10.9.0(vue@3.5.8(typescript@5.6.2))':
+  '@vueuse/components@10.9.0(vue@3.5.11(typescript@5.6.2))':
     dependencies:
-      '@vueuse/core': 10.9.0(vue@3.5.8(typescript@5.6.2))
-      '@vueuse/shared': 10.9.0(vue@3.5.8(typescript@5.6.2))
-      vue-demi: 0.14.7(vue@3.5.8(typescript@5.6.2))
+      '@vueuse/core': 10.9.0(vue@3.5.11(typescript@5.6.2))
+      '@vueuse/shared': 10.9.0(vue@3.5.11(typescript@5.6.2))
+      vue-demi: 0.14.10(vue@3.5.11(typescript@5.6.2))
     transitivePeerDependencies:
       - '@vue/composition-api'
       - vue
 
-  '@vueuse/core@10.9.0(vue@3.5.8(typescript@5.6.2))':
+  '@vueuse/core@10.9.0(vue@3.5.11(typescript@5.6.2))':
     dependencies:
       '@types/web-bluetooth': 0.0.20
       '@vueuse/metadata': 10.9.0
-      '@vueuse/shared': 10.9.0(vue@3.5.8(typescript@5.6.2))
-      vue-demi: 0.14.7(vue@3.5.8(typescript@5.6.2))
+      '@vueuse/shared': 10.9.0(vue@3.5.11(typescript@5.6.2))
+      vue-demi: 0.14.10(vue@3.5.11(typescript@5.6.2))
     transitivePeerDependencies:
       - '@vue/composition-api'
       - vue
 
-  '@vueuse/integrations@10.9.0(axios@1.7.2)(fuse.js@6.6.2)(qrcode@1.5.3)(sortablejs@1.14.0)(vue@3.5.8(typescript@5.6.2))':
+  '@vueuse/integrations@10.9.0(axios@1.7.2)(fuse.js@6.6.2)(qrcode@1.5.3)(sortablejs@1.14.0)(vue@3.5.11(typescript@5.6.2))':
     dependencies:
-      '@vueuse/core': 10.9.0(vue@3.5.8(typescript@5.6.2))
-      '@vueuse/shared': 10.9.0(vue@3.5.8(typescript@5.6.2))
-      vue-demi: 0.14.7(vue@3.5.8(typescript@5.6.2))
+      '@vueuse/core': 10.9.0(vue@3.5.11(typescript@5.6.2))
+      '@vueuse/shared': 10.9.0(vue@3.5.11(typescript@5.6.2))
+      vue-demi: 0.14.10(vue@3.5.11(typescript@5.6.2))
     optionalDependencies:
       axios: 1.7.2(debug@4.3.2)
       fuse.js: 6.6.2
@@ -15493,18 +15487,18 @@ snapshots:
 
   '@vueuse/metadata@10.9.0': {}
 
-  '@vueuse/router@10.9.0(vue-router@4.3.2(vue@3.5.8(typescript@5.6.2)))(vue@3.5.8(typescript@5.6.2))':
+  '@vueuse/router@10.9.0(vue-router@4.3.2(vue@3.5.11(typescript@5.6.2)))(vue@3.5.11(typescript@5.6.2))':
     dependencies:
-      '@vueuse/shared': 10.9.0(vue@3.5.8(typescript@5.6.2))
-      vue-demi: 0.14.7(vue@3.5.8(typescript@5.6.2))
-      vue-router: 4.3.2(vue@3.5.8(typescript@5.6.2))
+      '@vueuse/shared': 10.9.0(vue@3.5.11(typescript@5.6.2))
+      vue-demi: 0.14.10(vue@3.5.11(typescript@5.6.2))
+      vue-router: 4.3.2(vue@3.5.11(typescript@5.6.2))
     transitivePeerDependencies:
       - '@vue/composition-api'
       - vue
 
-  '@vueuse/shared@10.9.0(vue@3.5.8(typescript@5.6.2))':
+  '@vueuse/shared@10.9.0(vue@3.5.11(typescript@5.6.2))':
     dependencies:
-      vue-demi: 0.14.7(vue@3.5.8(typescript@5.6.2))
+      vue-demi: 0.14.10(vue@3.5.11(typescript@5.6.2))
     transitivePeerDependencies:
       - '@vue/composition-api'
       - vue
@@ -15942,7 +15936,7 @@ snapshots:
 
   babel-walk@3.0.0-canary-5:
     dependencies:
-      '@babel/types': 7.24.5
+      '@babel/types': 7.25.2
 
   balanced-match@1.0.2: {}
 
@@ -16431,8 +16425,8 @@ snapshots:
 
   constantinople@4.0.1:
     dependencies:
-      '@babel/parser': 7.24.5
-      '@babel/types': 7.24.5
+      '@babel/parser': 7.25.3
+      '@babel/types': 7.25.2
 
   content-disposition@0.5.4:
     dependencies:
@@ -17704,11 +17698,11 @@ snapshots:
 
   flatted@3.2.7: {}
 
-  floating-vue@5.2.2(vue@3.5.8(typescript@5.6.2)):
+  floating-vue@5.2.2(vue@3.5.11(typescript@5.6.2)):
     dependencies:
       '@floating-ui/dom': 1.1.1
-      vue: 3.5.8(typescript@5.6.2)
-      vue-resize: 2.0.0-alpha.1(vue@3.5.8(typescript@5.6.2))
+      vue: 3.5.11(typescript@5.6.2)
+      vue-resize: 2.0.0-alpha.1(vue@3.5.11(typescript@5.6.2))
 
   flow-parser@0.223.2: {}
 
@@ -18559,7 +18553,7 @@ snapshots:
   istanbul-lib-instrument@5.2.1:
     dependencies:
       '@babel/core': 7.24.5
-      '@babel/parser': 7.24.5
+      '@babel/parser': 7.25.3
       '@istanbuljs/schema': 0.1.3
       istanbul-lib-coverage: 3.2.0
       semver: 6.3.1
@@ -18696,7 +18690,7 @@ snapshots:
   jscodeshift@0.15.1(@babel/preset-env@7.23.5(@babel/core@7.24.5)):
     dependencies:
       '@babel/core': 7.24.5
-      '@babel/parser': 7.24.5
+      '@babel/parser': 7.25.3
       '@babel/plugin-transform-class-properties': 7.23.3(@babel/core@7.24.5)
       '@babel/plugin-transform-modules-commonjs': 7.23.3(@babel/core@7.24.5)
       '@babel/plugin-transform-nullish-coalescing-operator': 7.23.4(@babel/core@7.24.5)
@@ -19056,10 +19050,6 @@ snapshots:
     dependencies:
       sourcemap-codec: 1.4.8
 
-  magic-string@0.30.10:
-    dependencies:
-      '@jridgewell/sourcemap-codec': 1.4.15
-
   magic-string@0.30.11:
     dependencies:
       '@jridgewell/sourcemap-codec': 1.5.0
@@ -19068,10 +19058,6 @@ snapshots:
     dependencies:
       '@jridgewell/sourcemap-codec': 1.4.15
 
-  magic-string@0.30.7:
-    dependencies:
-      '@jridgewell/sourcemap-codec': 1.4.15
-
   make-dir@2.1.0:
     dependencies:
       pify: 4.0.1
@@ -19529,10 +19515,10 @@ snapshots:
 
   outdent@0.5.0: {}
 
-  overlayscrollbars-vue@0.5.7(overlayscrollbars@2.5.0)(vue@3.5.8(typescript@5.6.2)):
+  overlayscrollbars-vue@0.5.7(overlayscrollbars@2.5.0)(vue@3.5.11(typescript@5.6.2)):
     dependencies:
       overlayscrollbars: 2.5.0
-      vue: 3.5.8(typescript@5.6.2)
+      vue: 3.5.11(typescript@5.6.2)
 
   overlayscrollbars@2.5.0: {}
 
@@ -19734,11 +19720,11 @@ snapshots:
 
   pify@4.0.1: {}
 
-  pinia@2.1.6(typescript@5.6.2)(vue@3.5.8(typescript@5.6.2)):
+  pinia@2.1.6(typescript@5.6.2)(vue@3.5.11(typescript@5.6.2)):
     dependencies:
       '@vue/devtools-api': 6.5.0
-      vue: 3.5.8(typescript@5.6.2)
-      vue-demi: 0.14.7(vue@3.5.8(typescript@5.6.2))
+      vue: 3.5.11(typescript@5.6.2)
+      vue-demi: 0.14.10(vue@3.5.11(typescript@5.6.2))
     optionalDependencies:
       typescript: 5.6.2
 
@@ -19873,14 +19859,14 @@ snapshots:
   postcss@8.4.38:
     dependencies:
       nanoid: 3.3.7
-      picocolors: 1.0.1
-      source-map-js: 1.2.0
+      picocolors: 1.1.0
+      source-map-js: 1.2.1
 
   postcss@8.4.41:
     dependencies:
       nanoid: 3.3.7
       picocolors: 1.0.1
-      source-map-js: 1.2.0
+      source-map-js: 1.2.1
 
   postcss@8.4.47:
     dependencies:
@@ -21623,7 +21609,7 @@ snapshots:
 
   unpipe@1.0.0: {}
 
-  unplugin-icons@0.14.15(@vue/compiler-sfc@3.5.8)(vue-template-compiler@2.7.14):
+  unplugin-icons@0.14.15(@vue/compiler-sfc@3.5.11)(vue-template-compiler@2.7.14):
     dependencies:
       '@antfu/install-pkg': 0.1.1
       '@antfu/utils': 0.7.6
@@ -21633,12 +21619,12 @@ snapshots:
       local-pkg: 0.4.3
       unplugin: 1.5.1
     optionalDependencies:
-      '@vue/compiler-sfc': 3.5.8
+      '@vue/compiler-sfc': 3.5.11
       vue-template-compiler: 2.7.14
     transitivePeerDependencies:
       - supports-color
 
-  unplugin-icons@0.19.2(@vue/compiler-sfc@3.4.27)(vue-template-compiler@2.7.14):
+  unplugin-icons@0.19.2(@vue/compiler-sfc@3.5.11)(vue-template-compiler@2.7.14):
     dependencies:
       '@antfu/install-pkg': 0.3.3
       '@antfu/utils': 0.7.10
@@ -21648,7 +21634,7 @@ snapshots:
       local-pkg: 0.5.0
       unplugin: 1.12.1
     optionalDependencies:
-      '@vue/compiler-sfc': 3.4.27
+      '@vue/compiler-sfc': 3.5.11
       vue-template-compiler: 2.7.14
     transitivePeerDependencies:
       - supports-color
@@ -21684,19 +21670,19 @@ snapshots:
     dependencies:
       browserslist: 4.21.5
       escalade: 3.1.2
-      picocolors: 1.0.1
+      picocolors: 1.1.0
 
   update-browserslist-db@1.0.16(browserslist@4.23.0):
     dependencies:
       browserslist: 4.23.0
       escalade: 3.1.2
-      picocolors: 1.0.1
+      picocolors: 1.1.0
 
   update-browserslist-db@1.1.0(browserslist@4.23.3):
     dependencies:
       browserslist: 4.23.3
       escalade: 3.1.2
-      picocolors: 1.0.1
+      picocolors: 1.1.0
 
   update-notifier@6.0.2:
     dependencies:
@@ -21792,7 +21778,7 @@ snapshots:
       debug: 4.3.6(supports-color@8.1.1)
       mlly: 1.4.0
       pathe: 1.1.2
-      picocolors: 1.0.1
+      picocolors: 1.1.0
       vite: 4.2.3(@types/node@18.19.34)(less@4.2.0)(sass@1.60.0)(terser@5.31.0)
     transitivePeerDependencies:
       - '@types/node'
@@ -21900,9 +21886,9 @@ snapshots:
       picocolors: 1.0.1
       vite: 5.4.1(@types/node@18.13.0)(less@4.2.0)(sass@1.60.0)(terser@5.31.0)
 
-  vite-plugin-vue-devtools@7.3.8(rollup@4.17.2)(vite@5.4.1(@types/node@18.13.0)(less@4.2.0)(sass@1.60.0)(terser@5.31.0))(vue@3.5.8(typescript@5.6.2)):
+  vite-plugin-vue-devtools@7.3.8(rollup@4.17.2)(vite@5.4.1(@types/node@18.13.0)(less@4.2.0)(sass@1.60.0)(terser@5.31.0))(vue@3.5.11(typescript@5.6.2)):
     dependencies:
-      '@vue/devtools-core': 7.3.8(vite@5.4.1(@types/node@18.13.0)(less@4.2.0)(sass@1.60.0)(terser@5.31.0))(vue@3.5.8(typescript@5.6.2))
+      '@vue/devtools-core': 7.3.8(vite@5.4.1(@types/node@18.13.0)(less@4.2.0)(sass@1.60.0)(terser@5.31.0))(vue@3.5.11(typescript@5.6.2))
       '@vue/devtools-kit': 7.3.8
       '@vue/devtools-shared': 7.3.8
       execa: 8.0.1
@@ -21924,9 +21910,9 @@ snapshots:
       '@babel/plugin-syntax-import-meta': 7.10.4(@babel/core@7.24.5)
       '@babel/plugin-transform-typescript': 7.23.5(@babel/core@7.24.5)
       '@vue/babel-plugin-jsx': 1.1.5(@babel/core@7.24.5)
-      '@vue/compiler-dom': 3.4.27
+      '@vue/compiler-dom': 3.5.8
       kolorist: 1.8.0
-      magic-string: 0.30.10
+      magic-string: 0.30.11
       vite: 5.4.1(@types/node@18.13.0)(less@4.2.0)(sass@1.60.0)(terser@5.31.0)
     transitivePeerDependencies:
       - supports-color
@@ -22026,28 +22012,28 @@ snapshots:
 
   vue-component-type-helpers@2.1.6: {}
 
-  vue-demi@0.13.11(vue@3.5.8(typescript@5.6.2)):
+  vue-demi@0.13.11(vue@3.5.11(typescript@5.6.2)):
     dependencies:
-      vue: 3.5.8(typescript@5.6.2)
+      vue: 3.5.11(typescript@5.6.2)
 
-  vue-demi@0.14.7(vue@3.5.8(typescript@5.6.2)):
+  vue-demi@0.14.10(vue@3.5.11(typescript@5.6.2)):
     dependencies:
-      vue: 3.5.8(typescript@5.6.2)
+      vue: 3.5.11(typescript@5.6.2)
 
-  vue-docgen-api@4.75.1(vue@3.5.8(typescript@5.6.2)):
+  vue-docgen-api@4.75.1(vue@3.5.11(typescript@5.6.2)):
     dependencies:
       '@babel/parser': 7.24.5
       '@babel/types': 7.24.5
       '@vue/compiler-dom': 3.4.27
-      '@vue/compiler-sfc': 3.4.27
+      '@vue/compiler-sfc': 3.5.11
       ast-types: 0.16.1
       hash-sum: 2.0.0
       lru-cache: 8.0.5
       pug: 3.0.2
       recast: 0.23.4
       ts-map: 1.0.3
-      vue: 3.5.8(typescript@5.6.2)
-      vue-inbrowser-compiler-independent-utils: 4.71.1(vue@3.5.8(typescript@5.6.2))
+      vue: 3.5.11(typescript@5.6.2)
+      vue-inbrowser-compiler-independent-utils: 4.71.1(vue@3.5.11(typescript@5.6.2))
 
   vue-draggable-plus@0.4.1(@types/sortablejs@1.15.8):
     dependencies:
@@ -22092,25 +22078,25 @@ snapshots:
       - '@interactjs/core'
       - '@interactjs/utils'
 
-  vue-i18n@9.13.1(vue@3.5.8(typescript@5.6.2)):
+  vue-i18n@9.13.1(vue@3.5.11(typescript@5.6.2)):
     dependencies:
       '@intlify/core-base': 9.13.1
       '@intlify/shared': 9.13.1
       '@vue/devtools-api': 6.5.0
-      vue: 3.5.8(typescript@5.6.2)
+      vue: 3.5.11(typescript@5.6.2)
 
-  vue-inbrowser-compiler-independent-utils@4.71.1(vue@3.5.8(typescript@5.6.2)):
+  vue-inbrowser-compiler-independent-utils@4.71.1(vue@3.5.11(typescript@5.6.2)):
     dependencies:
-      vue: 3.5.8(typescript@5.6.2)
+      vue: 3.5.11(typescript@5.6.2)
 
-  vue-resize@2.0.0-alpha.1(vue@3.5.8(typescript@5.6.2)):
+  vue-resize@2.0.0-alpha.1(vue@3.5.11(typescript@5.6.2)):
     dependencies:
-      vue: 3.5.8(typescript@5.6.2)
+      vue: 3.5.11(typescript@5.6.2)
 
-  vue-router@4.3.2(vue@3.5.8(typescript@5.6.2)):
+  vue-router@4.3.2(vue@3.5.11(typescript@5.6.2)):
     dependencies:
       '@vue/devtools-api': 6.6.1
-      vue: 3.5.8(typescript@5.6.2)
+      vue: 3.5.11(typescript@5.6.2)
 
   vue-template-compiler@2.7.14:
     dependencies:
@@ -22125,13 +22111,13 @@ snapshots:
       semver: 7.5.4
       typescript: 5.6.2
 
-  vue@3.5.8(typescript@5.6.2):
+  vue@3.5.11(typescript@5.6.2):
     dependencies:
-      '@vue/compiler-dom': 3.5.8
-      '@vue/compiler-sfc': 3.5.8
-      '@vue/runtime-dom': 3.5.8
-      '@vue/server-renderer': 3.5.8(vue@3.5.8(typescript@5.6.2))
-      '@vue/shared': 3.5.8
+      '@vue/compiler-dom': 3.5.11
+      '@vue/compiler-sfc': 3.5.11
+      '@vue/runtime-dom': 3.5.11
+      '@vue/server-renderer': 3.5.11(vue@3.5.11(typescript@5.6.2))
+      '@vue/shared': 3.5.11
     optionalDependencies:
       typescript: 5.6.2
 
@@ -22301,8 +22287,8 @@ snapshots:
 
   with@7.0.2:
     dependencies:
-      '@babel/parser': 7.24.5
-      '@babel/types': 7.24.5
+      '@babel/parser': 7.25.3
+      '@babel/types': 7.25.2
       assert-never: 1.2.1
       babel-walk: 3.0.0-canary-5
 

From 38b7898899c79ac7d356f419ea78bcb35f89bb2e Mon Sep 17 00:00:00 2001
From: John Niang <johnniang@foxmail.com>
Date: Fri, 4 Oct 2024 20:34:42 +0800
Subject: [PATCH 075/185] Upgrade to jsoup 1.18.1 (#6765)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/kind cleanup
/area core
/milestone 2.20.x

#### What this PR does / why we need it:

This PR upgrades to jsoup 1.18.1. See https://github.com/jhy/jsoup/releases/tag/jsoup-1.18.1 for more.

#### Does this PR introduce a user-facing change?

```release-note
升级依赖 jsoup 至 1.18.1
```
---
 platform/application/build.gradle | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/platform/application/build.gradle b/platform/application/build.gradle
index f474527a90..90311f35e7 100644
--- a/platform/application/build.gradle
+++ b/platform/application/build.gradle
@@ -16,7 +16,7 @@ ext {
     pf4j = '3.12.0'
     javaDiffUtils = "4.12"
     guava = "33.3.1-jre"
-    jsoup = '1.15.3'
+    jsoup = '1.18.1'
     jsonPatch = "1.13"
     springDocOpenAPI = "2.6.0"
     lucene = "9.12.0"

From c941e37435ac220cdc473dc7fdc46852ec3f9a64 Mon Sep 17 00:00:00 2001
From: Ryan Wang <i@ryanc.cc>
Date: Fri, 4 Oct 2024 20:44:43 +0800
Subject: [PATCH 076/185] refactor: enhance login page styling for improved UX
 (#6757)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/area core
/kind improvement
/milestone 2.20.x

#### What this PR does / why we need it:

微调登录相关页面的样式。

#### Does this PR introduce a user-facing change?

```release-note
None
```
---
 .../src/main/resources/static/styles/main.css | 36 ++++++++++---------
 .../gateway_modules/common_fragments.html     |  4 +--
 .../gateway_modules/login_fragments.html      | 24 ++++++-------
 .../src/main/resources/templates/signup.html  | 10 +++---
 4 files changed, 39 insertions(+), 35 deletions(-)

diff --git a/application/src/main/resources/static/styles/main.css b/application/src/main/resources/static/styles/main.css
index b449f94f93..0f325cd5d0 100644
--- a/application/src/main/resources/static/styles/main.css
+++ b/application/src/main/resources/static/styles/main.css
@@ -1,6 +1,6 @@
 /* Base */
 .gateway-page {
-    width: 100vw;
+    width: 100%;
     height: 100vh;
     background-color: #f5f5f5;
     overflow: auto;
@@ -34,8 +34,10 @@
     --spacing-xl: 1.25em;
     --spacing-lg: 1em;
     --spacing-md: 0.875em;
-    --spacing-sm: 0.5em;
-    --text-md: 0.875em;
+    --spacing-sm: 0.625em;
+    --spacing-xs: 0.5em;
+    --text-base: 1em;
+    --text-sm: 0.875em;
 }
 
 .gateway-wrapper {
@@ -88,7 +90,7 @@
 .halo-form .form-item-group {
     gap: var(--spacing-lg);
     display: flex;
-    align-items: center;
+    align-items: flex-start;
     margin-bottom: 1.3em;
 }
 
@@ -142,7 +144,7 @@
 .halo-form .form-input-stack-select {
     all: unset;
     color: var(--color-text);
-    font-size: var(--text-md);
+    font-size: var(--text-sm);
     padding-right: 1.85em;
     display: inline-flex;
     align-items: center;
@@ -153,16 +155,18 @@
 
 .halo-form .form-input-stack-text {
     color: var(--color-text);
-    font-size: var(--text-md);
+    font-size: var(--text-sm);
 }
 
 .halo-form .form-item label {
     color: var(--color-text);
-    margin-bottom: 0.5em;
+    margin-bottom: 0.625em;
+    font-size: var(--text-base);
+    font-weight: 500;
 }
 
 .halo-form .form-item .form-label-group {
-    margin-bottom: 0.5em;
+    margin-bottom: 0.625em;
     display: flex;
     justify-content: space-between;
     align-items: center;
@@ -174,7 +178,7 @@
 
 .halo-form .form-item-extra-link {
     color: var(--color-link);
-    font-size: var(--text-md);
+    font-size: var(--text-sm);
     text-decoration: none;
 }
 
@@ -187,7 +191,7 @@
 
 .halo-form .form-item-compact label {
     color: var(--color-text);
-    font-size: var(--text-md);
+    font-size: var(--text-sm);
 }
 
 .halo-form button[type="submit"] {
@@ -263,7 +267,7 @@
     border-radius: var(--rounded-base);
     border: 1px solid var(--color-border);
     color: var(--color-text);
-    font-size: var(--text-md);
+    font-size: var(--text-sm);
     grid-column: span 1 / span 1;
     height: 100%;
     cursor: pointer;
@@ -281,7 +285,7 @@
 
 .auth-provider-items {
     all: unset;
-    gap: var(--spacing-md);
+    gap: var(--spacing-sm);
     margin: 0;
     display: flex;
     flex-wrap: wrap;
@@ -300,12 +304,12 @@
 
 .auth-provider-items li a {
     gap: var(--spacing-sm);
+    font-size: var(--text-sm);
     padding: 0.7em 1em;
     display: flex;
     align-items: center;
     color: #1f2937;
     text-decoration: none;
-    font-size: 0.8em;
 }
 
 .auth-provider-items li img {
@@ -328,7 +332,7 @@
 
 .divider-wrapper {
     color: var(--color-text);
-    font-size: var(--text-md);
+    font-size: var(--text-sm);
     gap: var(--spacing-lg);
     display: flex;
     align-items: center;
@@ -347,7 +351,7 @@
     border-radius: var(--rounded-base);
     margin-bottom: var(--spacing-xl);
     padding: var(--spacing-md) var(--spacing-xl);
-    font-size: var(--text-md);
+    font-size: var(--text-sm);
     overflow: hidden;
     position: relative;
     color: var(--color-text);
@@ -411,4 +415,4 @@
 
 ::-ms-reveal {
     display: none;
-}
\ No newline at end of file
+}
diff --git a/application/src/main/resources/templates/gateway_modules/common_fragments.html b/application/src/main/resources/templates/gateway_modules/common_fragments.html
index dc5df4b1bb..78885a91f9 100644
--- a/application/src/main/resources/templates/gateway_modules/common_fragments.html
+++ b/application/src/main/resources/templates/gateway_modules/common_fragments.html
@@ -30,7 +30,7 @@
         .language-switcher select {
             all: unset;
             border: 1px solid var(--color-border);
-            font-size: var(--text-md);
+            font-size: var(--text-sm);
             height: 2em;
             border-radius: var(--rounded-lg);
             outline: none;
@@ -111,4 +111,4 @@
             </li>
         </ul>
     </th:block>
-</div>
+</div>
\ No newline at end of file
diff --git a/application/src/main/resources/templates/gateway_modules/login_fragments.html b/application/src/main/resources/templates/gateway_modules/login_fragments.html
index b9cdf7148b..ed976a4843 100644
--- a/application/src/main/resources/templates/gateway_modules/login_fragments.html
+++ b/application/src/main/resources/templates/gateway_modules/login_fragments.html
@@ -1,11 +1,11 @@
 <!-- Those fragments are only for login template-->
 <form
-        th:fragment="form"
-        class="halo-form"
-        name="login-form"
-        id="login-form"
-        th:action="${authProvider.spec.authenticationUrl}"
-        th:method="${authProvider.spec.method}"
+    th:fragment="form"
+    class="halo-form"
+    name="login-form"
+    id="login-form"
+    th:action="${authProvider.spec.authenticationUrl}"
+    th:method="${authProvider.spec.method}"
 >
     <div class="alert alert-error" role="alert" th:if="${param.error.size() > 0}" th:with="error = ${param.error[0]}">
         <strong th:if="${error == 'invalid-credential'}">
@@ -28,7 +28,7 @@
     <div th:replace="~{__${fragmentTemplateName}__::form}"></div>
 
     <div th:if="${authProvider.spec.rememberMeSupport}" class="form-item-compact">
-        <input type="checkbox" id="remember-me" name="remember-me" value="true"/>
+        <input type="checkbox" id="remember-me" name="remember-me" value="true" />
         <label for="remember-me" th:text="#{form.rememberMe.label}"></label>
     </div>
 
@@ -40,14 +40,14 @@
 <div th:remove="tag" th:fragment="formAuthProviders">
     <th:block th:unless="${#lists.isEmpty(formAuthProviders)}">
         <div class="divider-wrapper">
-            <hr/>
+            <hr />
             <th:block th:text="#{otherLogin.label}"></th:block>
-            <hr/>
+            <hr />
         </div>
         <ul class="auth-provider-items">
             <li th:each="provider : ${formAuthProviders}">
                 <a th:href="'/login?method=' + ${provider.metadata.name}">
-                    <img th:src="${provider.spec.logo}"/>
+                    <img th:src="${provider.spec.logo}" />
                     <span th:text="${provider.spec.displayName}"></span>
                 </a>
             </li>
@@ -59,7 +59,7 @@
     <style>
         .signup-notice,
         .returntosite-notice {
-            font-size: var(--text-md);
+            font-size: var(--text-sm);
             color: var(--color-text);
             text-align: center;
             margin: 1em 0;
@@ -95,4 +95,4 @@
             <span th:text="#{returnToSite}"></span>
         </a>
     </div>
-</div>
+</div>
\ No newline at end of file
diff --git a/application/src/main/resources/templates/signup.html b/application/src/main/resources/templates/signup.html
index 2276f5b701..7ec0d47771 100644
--- a/application/src/main/resources/templates/signup.html
+++ b/application/src/main/resources/templates/signup.html
@@ -143,11 +143,11 @@ <h1 class="form-title" th:text="#{title}"></h1>
                         <th:block
                             th:replace="~{gateway_modules/input_fragments :: password(id = 'confirmPassword', name = 'confirmPassword', required = 'true', minlength = 6, enableToggle = true)}"
                         ></th:block>
-                         <p
-                             class="alert alert-error"
-                             th:if="${#fields.hasErrors('confirmPassword')}"
-                             th:errors="*{confirmPassword}"
-                         ></p>
+                        <p
+                            class="alert alert-error"
+                            th:if="${#fields.hasErrors('confirmPassword')}"
+                            th:errors="*{confirmPassword}"
+                        ></p>
                     </div>
 
                     <div class="form-item">

From cf7746be6db71f6dda658408409ab6aa5b5eba54 Mon Sep 17 00:00:00 2001
From: Ryan Wang <i@ryanc.cc>
Date: Fri, 4 Oct 2024 20:48:43 +0800
Subject: [PATCH 077/185] refactor: exclude indices directory during backup
 (#6753)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/area core
/kind improvement
/milestone 2.20.x

#### What this PR does / why we need it:

备份时排除全文索引目录 indices，防止恢复之后因为索引文件问题无法启动。

#### Which issue(s) this PR fixes:

Fixes https://github.com/halo-dev/halo/issues/6443

#### Does this PR introduce a user-facing change?

```release-note
备份时排除全文索引目录 indices，防止恢复之后因为索引文件问题无法启动。
```
---
 .../java/run/halo/app/migration/impl/MigrationServiceImpl.java   | 1 +
 1 file changed, 1 insertion(+)

diff --git a/application/src/main/java/run/halo/app/migration/impl/MigrationServiceImpl.java b/application/src/main/java/run/halo/app/migration/impl/MigrationServiceImpl.java
index 9616382c5d..1d99e64d80 100644
--- a/application/src/main/java/run/halo/app/migration/impl/MigrationServiceImpl.java
+++ b/application/src/main/java/run/halo/app/migration/impl/MigrationServiceImpl.java
@@ -64,6 +64,7 @@ public class MigrationServiceImpl implements MigrationService, InitializingBean
         "backups/**",
         "db/**",
         "logs/**",
+        "indices/**",
         "docker-compose.yaml",
         "docker-compose.yml",
         "mysql/**",

From 4dd5b7e103c3ff2ed0c96a0c325548f77f36bdcd Mon Sep 17 00:00:00 2001
From: Ryan Wang <i@ryanc.cc>
Date: Fri, 4 Oct 2024 22:02:44 +0800
Subject: [PATCH 078/185] feat: add link prefetch for logo resource on login
 page (#6751)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/area core
/kind improvement
/milestone 2.20.x

#### What this PR does / why we need it:

为登录页面的 Logo 资源添加 link prefetch 标签，以缓解页面抖动的问题。

before:

https://github.com/user-attachments/assets/ec718b62-6593-4deb-a028-bcb3d8504c4e

after:

https://github.com/user-attachments/assets/8d408408-37bd-4cdc-a22a-b39531fa505f

#### Does this PR introduce a user-facing change?

```release-note
None
```
---
 .../src/main/resources/templates/gateway_modules/layout.html    | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/application/src/main/resources/templates/gateway_modules/layout.html b/application/src/main/resources/templates/gateway_modules/layout.html
index 126838d12a..f82bb0db5b 100644
--- a/application/src/main/resources/templates/gateway_modules/layout.html
+++ b/application/src/main/resources/templates/gateway_modules/layout.html
@@ -10,6 +10,8 @@
         />
         <meta content="noindex,nofollow" name="robots" />
         <title th:text="${title}"></title>
+        <link rel="preload" href="/images/wordmark.svg" as="image" type="image/svg+xml" />
+        <link rel="preload" href="/images/logo.png" as="image" type="image/png" />
 
         <th:block th:replace="~{gateway_modules/common_fragments::basicStaticResources}"></th:block>
 

From 8896e16615777a1afff643e8d677e5a0957275d6 Mon Sep 17 00:00:00 2001
From: Ryan Wang <i@ryanc.cc>
Date: Fri, 4 Oct 2024 22:10:44 +0800
Subject: [PATCH 079/185] feat: disallow deletion of system-protected
 attachment policies (#6735)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/area core
/kind improvement
/milestone 2.20.x

#### What this PR does / why we need it:

为系统默认的存储策略添加保护措施，不允许删除。

<img width="893" alt="image" src="https://github.com/user-attachments/assets/990f834f-3d97-4ee8-9c24-01cc188b7be6">


#### Does this PR introduce a user-facing change?

```release-note
为系统默认的存储策略添加保护措施，不允许删除。
```
---
 .../extensions/attachment-local-policy.yaml   |  2 ++
 .../components/AttachmentPoliciesModal.vue    | 25 +++++++++++++++++--
 ui/src/constants/finalizers.ts                |  1 +
 ui/src/locales/en.yaml                        |  1 +
 ui/src/locales/zh-CN.yaml                     |  1 +
 ui/src/locales/zh-TW.yaml                     |  1 +
 6 files changed, 29 insertions(+), 2 deletions(-)
 create mode 100644 ui/src/constants/finalizers.ts

diff --git a/application/src/main/resources/extensions/attachment-local-policy.yaml b/application/src/main/resources/extensions/attachment-local-policy.yaml
index faba8b06f3..645895d28f 100644
--- a/application/src/main/resources/extensions/attachment-local-policy.yaml
+++ b/application/src/main/resources/extensions/attachment-local-policy.yaml
@@ -10,6 +10,8 @@ apiVersion: storage.halo.run/v1alpha1
 kind: Policy
 metadata:
   name: default-policy
+  finalizers:
+    - system-protection
 spec:
   displayName: 本地存储
   templateName: local
diff --git a/ui/console-src/modules/contents/attachments/components/AttachmentPoliciesModal.vue b/ui/console-src/modules/contents/attachments/components/AttachmentPoliciesModal.vue
index 3b4b5ae39f..a7c036a1c9 100644
--- a/ui/console-src/modules/contents/attachments/components/AttachmentPoliciesModal.vue
+++ b/ui/console-src/modules/contents/attachments/components/AttachmentPoliciesModal.vue
@@ -1,4 +1,5 @@
 <script lang="ts" setup>
+import { SYSTEM_PROTECTION } from "@/constants/finalizers";
 import { formatDatetime } from "@/utils/date";
 import type { Policy, PolicyTemplate } from "@halo-dev/api-client";
 import { consoleApiClient, coreApiClient } from "@halo-dev/api-client";
@@ -15,6 +16,7 @@ import {
   VModal,
   VSpace,
   VStatusDot,
+  VTag,
 } from "@halo-dev/components";
 import { ref } from "vue";
 import { useI18n } from "vue-i18n";
@@ -171,6 +173,14 @@ function getPolicyTemplateDisplayName(templateName: string) {
             ></VEntityField>
           </template>
           <template #end>
+            <VEntityField>
+              <template
+                v-if="policy.metadata.finalizers?.includes(SYSTEM_PROTECTION)"
+                #description
+              >
+                <VTag>{{ $t("core.common.text.system_protection") }}</VTag>
+              </template>
+            </VEntityField>
             <VEntityField v-if="policy.metadata.deletionTimestamp">
               <template #description>
                 <VStatusDot
@@ -189,10 +199,21 @@ function getPolicyTemplateDisplayName(templateName: string) {
             </VEntityField>
           </template>
           <template #dropdownItems>
-            <VDropdownItem @click="handleOpenEditingModal(policy)">
+            <VDropdownItem
+              :disabled="
+                policy.metadata.finalizers?.includes(SYSTEM_PROTECTION)
+              "
+              @click="handleOpenEditingModal(policy)"
+            >
               {{ $t("core.common.buttons.edit") }}
             </VDropdownItem>
-            <VDropdownItem type="danger" @click="handleDelete(policy)">
+            <VDropdownItem
+              :disabled="
+                policy.metadata.finalizers?.includes(SYSTEM_PROTECTION)
+              "
+              type="danger"
+              @click="handleDelete(policy)"
+            >
               {{ $t("core.common.buttons.delete") }}
             </VDropdownItem>
           </template>
diff --git a/ui/src/constants/finalizers.ts b/ui/src/constants/finalizers.ts
new file mode 100644
index 0000000000..5e8ad3ca75
--- /dev/null
+++ b/ui/src/constants/finalizers.ts
@@ -0,0 +1 @@
+export const SYSTEM_PROTECTION = "system-protection";
diff --git a/ui/src/locales/en.yaml b/ui/src/locales/en.yaml
index 2ae7613718..8250ab3ac5 100644
--- a/ui/src/locales/en.yaml
+++ b/ui/src/locales/en.yaml
@@ -1779,6 +1779,7 @@ core:
       none: None
       tip: Tip
       warning: Warning
+      system_protection: System protection
     tooltips:
       unpublished_content_tip: There is content that has been saved but not yet published.
       publishing: Publishing
diff --git a/ui/src/locales/zh-CN.yaml b/ui/src/locales/zh-CN.yaml
index 92783f828f..7480986aa7 100644
--- a/ui/src/locales/zh-CN.yaml
+++ b/ui/src/locales/zh-CN.yaml
@@ -1664,6 +1664,7 @@ core:
       none: 无
       tip: 提示
       warning: 警告
+      system_protection: 系统保留
     tooltips:
       unpublished_content_tip: 当前有内容已保存，但还未发布。
       publishing: 发布中
diff --git a/ui/src/locales/zh-TW.yaml b/ui/src/locales/zh-TW.yaml
index 3c82339717..a68bac96b4 100644
--- a/ui/src/locales/zh-TW.yaml
+++ b/ui/src/locales/zh-TW.yaml
@@ -1645,6 +1645,7 @@ core:
       none: 無
       tip: 提示
       warning: 警告
+      system_protection: 系統保留
     tooltips:
       unpublished_content_tip: 當前有內容已保存，但還未發布。
       publishing: 發布中

From b0ad0406b95ab14c407919ff744f0bd18d8f7626 Mon Sep 17 00:00:00 2001
From: Ryan Wang <i@ryanc.cc>
Date: Sat, 5 Oct 2024 14:38:44 +0800
Subject: [PATCH 080/185] fix: resolve issue with logout functionality in
 Console not working (#6766)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/area ui
/kind bug
/milestone 2.20.x

#### What this PR does / why we need it:

修复 Console 中退出登录功能失效的问题。

#### Which issue(s) this PR fixes:

Fixes #6756

#### Does this PR introduce a user-facing change?

```release-note
None
```
---
 ui/console-src/layouts/BasicLayout.vue | 18 ++----------------
 ui/src/locales/en.yaml                 |  1 +
 ui/src/locales/zh-CN.yaml              |  1 +
 ui/src/locales/zh-TW.yaml              |  1 +
 ui/uc-src/layouts/BasicLayout.vue      | 18 ++----------------
 5 files changed, 7 insertions(+), 32 deletions(-)

diff --git a/ui/console-src/layouts/BasicLayout.vue b/ui/console-src/layouts/BasicLayout.vue
index fa0f29e355..0eff4a6604 100644
--- a/ui/console-src/layouts/BasicLayout.vue
+++ b/ui/console-src/layouts/BasicLayout.vue
@@ -17,7 +17,6 @@ import {
   VTag,
 } from "@halo-dev/components";
 import { useEventListener } from "@vueuse/core";
-import axios from "axios";
 import {
   useOverlayScrollbars,
   type UseOverlayScrollbarsParams,
@@ -42,24 +41,11 @@ const { currentRoles, currentUser } = storeToRefs(userStore);
 const handleLogout = () => {
   Dialog.warning({
     title: t("core.sidebar.operations.logout.title"),
+    description: t("core.sidebar.operations.logout.description"),
     confirmText: t("core.common.buttons.confirm"),
     cancelText: t("core.common.buttons.cancel"),
     onConfirm: async () => {
-      try {
-        await axios.post(`/logout`, undefined, {
-          withCredentials: true,
-        });
-
-        await userStore.fetchCurrentUser();
-
-        // Clear csrf token
-        document.cookie =
-          "XSRF-TOKEN=; Path=/; Expires=Thu, 01 Jan 1970 00:00:01 GMT;";
-
-        window.location.href = "/login";
-      } catch (error) {
-        console.error("Failed to logout", error);
-      }
+      window.location.href = "/logout";
     },
   });
 };
diff --git a/ui/src/locales/en.yaml b/ui/src/locales/en.yaml
index 8250ab3ac5..58b49521d8 100644
--- a/ui/src/locales/en.yaml
+++ b/ui/src/locales/en.yaml
@@ -26,6 +26,7 @@ core:
       logout:
         tooltip: Logout
         title: Logout
+        description: Clicking Confirm will redirect to the logout page. Please ensure that the content you are editing is saved.
       profile:
         tooltip: Profile
       visit_homepage:
diff --git a/ui/src/locales/zh-CN.yaml b/ui/src/locales/zh-CN.yaml
index 7480986aa7..0bf25ca638 100644
--- a/ui/src/locales/zh-CN.yaml
+++ b/ui/src/locales/zh-CN.yaml
@@ -26,6 +26,7 @@ core:
       logout:
         tooltip: 退出登录
         title: 退出登录
+        description: 点击确定将跳转至退出登录页面，请确保正在编辑的内容已保存。
       profile:
         tooltip: 个人中心
       visit_homepage:
diff --git a/ui/src/locales/zh-TW.yaml b/ui/src/locales/zh-TW.yaml
index a68bac96b4..62b745fcda 100644
--- a/ui/src/locales/zh-TW.yaml
+++ b/ui/src/locales/zh-TW.yaml
@@ -26,6 +26,7 @@ core:
       logout:
         tooltip: 登出
         title: 登出
+        description: 點擊確定將跳轉至退出登入頁面，請確保正在編輯的內容已保存。
       profile:
         tooltip: 個人中心
       visit_homepage:
diff --git a/ui/uc-src/layouts/BasicLayout.vue b/ui/uc-src/layouts/BasicLayout.vue
index f9ff9528be..87fd8af98d 100644
--- a/ui/uc-src/layouts/BasicLayout.vue
+++ b/ui/uc-src/layouts/BasicLayout.vue
@@ -13,7 +13,6 @@ import {
   VAvatar,
   VTag,
 } from "@halo-dev/components";
-import axios from "axios";
 import {
   useOverlayScrollbars,
   type UseOverlayScrollbarsParams,
@@ -38,24 +37,11 @@ const { currentRoles, currentUser } = storeToRefs(userStore);
 const handleLogout = () => {
   Dialog.warning({
     title: t("core.sidebar.operations.logout.title"),
+    description: t("core.sidebar.operations.logout.description"),
     confirmText: t("core.common.buttons.confirm"),
     cancelText: t("core.common.buttons.cancel"),
     onConfirm: async () => {
-      try {
-        await axios.post(`/logout`, undefined, {
-          withCredentials: true,
-        });
-
-        await userStore.fetchCurrentUser();
-
-        // Clear csrf token
-        document.cookie =
-          "XSRF-TOKEN=; Path=/; Expires=Thu, 01 Jan 1970 00:00:01 GMT;";
-
-        window.location.href = "/login";
-      } catch (error) {
-        console.error("Failed to logout", error);
-      }
+      window.location.href = "/logout";
     },
   });
 };

From d6489283b854adab76e1779fd85c9478f493f79e Mon Sep 17 00:00:00 2001
From: Ryan Wang <i@ryanc.cc>
Date: Mon, 7 Oct 2024 12:26:50 +0800
Subject: [PATCH 081/185] refactor: remove redirect-on-login setting option
 from role editing form (#6776)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/area ui
/kind api-change
/milestone 2.20.x

#### What this PR does / why we need it:

See #6774

#### Which issue(s) this PR fixes:

Fixes #6774

#### Does this PR introduce a user-facing change?

```release-note
移除角色的 **登录之后默认跳转位置** 设置选项。
```
---
 .../modules/system/roles/components/RoleEditingModal.vue | 9 ---------
 ui/src/constants/annotations.ts                          | 1 -
 ui/src/locales/en.yaml                                   | 1 -
 ui/src/locales/zh-CN.yaml                                | 1 -
 ui/src/locales/zh-TW.yaml                                | 1 -
 5 files changed, 13 deletions(-)

diff --git a/ui/console-src/modules/system/roles/components/RoleEditingModal.vue b/ui/console-src/modules/system/roles/components/RoleEditingModal.vue
index 400eba68da..324e9f1b43 100644
--- a/ui/console-src/modules/system/roles/components/RoleEditingModal.vue
+++ b/ui/console-src/modules/system/roles/components/RoleEditingModal.vue
@@ -118,15 +118,6 @@ const handleCreateOrUpdateRole = async () => {
               type="text"
               validation="required|length:0,50"
             ></FormKit>
-            <FormKit
-              v-model="
-                formState.metadata.annotations[
-                  rbacAnnotations.REDIRECT_ON_LOGIN
-                ]
-              "
-              type="text"
-              :label="$t('core.role.editing_modal.fields.redirect_on_login')"
-            ></FormKit>
             <FormKit
               v-model="
                 formState.metadata.annotations[
diff --git a/ui/src/constants/annotations.ts b/ui/src/constants/annotations.ts
index 4a165ebec2..5dd8a1f914 100644
--- a/ui/src/constants/annotations.ts
+++ b/ui/src/constants/annotations.ts
@@ -11,7 +11,6 @@ export enum rbacAnnotations {
   DEPENDENCIES = "rbac.authorization.halo.run/dependencies",
   AVATAR_ATTACHMENT_NAME = "halo.run/avatar-attachment-name",
   LAST_AVATAR_ATTACHMENT_NAME = "halo.run/last-avatar-attachment-name",
-  REDIRECT_ON_LOGIN = "rbac.authorization.halo.run/redirect-on-login",
   DISALLOW_ACCESS_CONSOLE = "rbac.authorization.halo.run/disallow-access-console",
 }
 
diff --git a/ui/src/locales/en.yaml b/ui/src/locales/en.yaml
index 58b49521d8..fd355ec4c8 100644
--- a/ui/src/locales/en.yaml
+++ b/ui/src/locales/en.yaml
@@ -1074,7 +1074,6 @@ core:
         permissions: Permissions
       fields:
         display_name: Display name
-        redirect_on_login: Default redirect location after logging in
         disallow_access_console:
           label: Disable access to Console
           help: Once checked, this role will not be able to access the Console
diff --git a/ui/src/locales/zh-CN.yaml b/ui/src/locales/zh-CN.yaml
index 0bf25ca638..127aa5021e 100644
--- a/ui/src/locales/zh-CN.yaml
+++ b/ui/src/locales/zh-CN.yaml
@@ -1001,7 +1001,6 @@ core:
         permissions: 权限
       fields:
         display_name: 名称
-        redirect_on_login: 登录之后默认跳转位置
         disallow_access_console:
           label: 禁止访问 Console
           help: 勾选之后，该角色将无法访问 Console
diff --git a/ui/src/locales/zh-TW.yaml b/ui/src/locales/zh-TW.yaml
index 62b745fcda..c4315abbd0 100644
--- a/ui/src/locales/zh-TW.yaml
+++ b/ui/src/locales/zh-TW.yaml
@@ -981,7 +981,6 @@ core:
         permissions: 權限
       fields:
         display_name: 名稱
-        redirect_on_login: 登入之後預設跳轉位置
         disallow_access_console:
           label: 禁止訪問 Console
           help: 勾選之後，該角色將無法存取 Console

From ea491f2386b929bd151dcecb6f1e97156f767740 Mon Sep 17 00:00:00 2001
From: Ryan Wang <i@ryanc.cc>
Date: Mon, 7 Oct 2024 12:28:51 +0800
Subject: [PATCH 082/185] chore: bump tiptap version to 2.8.x (#6777)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/area ui
/kind improvement
/milestone 2.20.x

#### What this PR does / why we need it:

Bump tiptap verison to [2.8.x](https://github.com/ueberdosis/tiptap/releases/tag/v2.8.0)

#### Does this PR introduce a user-facing change?

```release-note
升级编辑器依赖 Tiptap 的版本至 [2.8.x](https://github.com/ueberdosis/tiptap/releases/tag/v2.8.0)。
```
---
 ui/package.json                               |   2 +-
 ui/packages/editor/package.json               |  72 +-
 .../editor/src/extensions/audio/AudioView.vue |  14 +-
 .../src/extensions/iframe/IframeView.vue      |  14 +-
 .../editor/src/extensions/image/ImageView.vue |  14 +-
 .../editor/src/extensions/video/VideoView.vue |  14 +-
 ui/pnpm-lock.yaml                             | 702 +++++++++---------
 .../editor/extensions/image/ImageView.vue     |  18 +-
 .../editor/extensions/video/VideoView.vue     |  18 +-
 9 files changed, 404 insertions(+), 464 deletions(-)

diff --git a/ui/package.json b/ui/package.json
index 47f4c7fb7d..1b4c7b731f 100644
--- a/ui/package.json
+++ b/ui/package.json
@@ -64,7 +64,7 @@
     "@halo-dev/console-shared": "workspace:*",
     "@halo-dev/richtext-editor": "workspace:*",
     "@tanstack/vue-query": "^4.29.1",
-    "@tiptap/extension-character-count": "^2.6.5",
+    "@tiptap/extension-character-count": "^2.8.0",
     "@uppy/core": "^3.11.3",
     "@uppy/dashboard": "^3.8.3",
     "@uppy/drag-drop": "^3.1.0",
diff --git a/ui/packages/editor/package.json b/ui/packages/editor/package.json
index 9e58bf6d81..1f38a5a9b6 100644
--- a/ui/packages/editor/package.json
+++ b/ui/packages/editor/package.json
@@ -41,42 +41,42 @@
   },
   "dependencies": {
     "@ckpack/vue-color": "^1.5.0",
-    "@tiptap/core": "^2.6.5",
-    "@tiptap/extension-blockquote": "^2.6.5",
-    "@tiptap/extension-bold": "^2.6.5",
-    "@tiptap/extension-bullet-list": "^2.6.5",
-    "@tiptap/extension-code": "^2.6.5",
-    "@tiptap/extension-code-block": "^2.6.5",
-    "@tiptap/extension-color": "^2.6.5",
-    "@tiptap/extension-document": "^2.6.5",
-    "@tiptap/extension-dropcursor": "^2.6.5",
-    "@tiptap/extension-hard-break": "^2.6.5",
-    "@tiptap/extension-heading": "^2.6.5",
-    "@tiptap/extension-highlight": "^2.6.5",
-    "@tiptap/extension-history": "^2.6.5",
-    "@tiptap/extension-horizontal-rule": "^2.6.5",
-    "@tiptap/extension-image": "^2.6.5",
-    "@tiptap/extension-italic": "^2.6.5",
-    "@tiptap/extension-link": "^2.6.5",
-    "@tiptap/extension-list-item": "^2.6.5",
-    "@tiptap/extension-list-keymap": "^2.6.5",
-    "@tiptap/extension-ordered-list": "^2.6.5",
-    "@tiptap/extension-paragraph": "^2.6.5",
-    "@tiptap/extension-placeholder": "^2.6.5",
-    "@tiptap/extension-strike": "^2.6.5",
-    "@tiptap/extension-subscript": "^2.6.5",
-    "@tiptap/extension-superscript": "^2.6.5",
-    "@tiptap/extension-table": "^2.6.5",
-    "@tiptap/extension-table-row": "^2.6.5",
-    "@tiptap/extension-task-item": "^2.6.5",
-    "@tiptap/extension-task-list": "^2.6.5",
-    "@tiptap/extension-text": "^2.6.5",
-    "@tiptap/extension-text-align": "^2.6.5",
-    "@tiptap/extension-text-style": "^2.6.5",
-    "@tiptap/extension-underline": "^2.6.5",
-    "@tiptap/pm": "^2.6.5",
-    "@tiptap/suggestion": "^2.6.5",
-    "@tiptap/vue-3": "^2.6.5",
+    "@tiptap/core": "^2.8.0",
+    "@tiptap/extension-blockquote": "^2.8.0",
+    "@tiptap/extension-bold": "^2.8.0",
+    "@tiptap/extension-bullet-list": "^2.8.0",
+    "@tiptap/extension-code": "^2.8.0",
+    "@tiptap/extension-code-block": "^2.8.0",
+    "@tiptap/extension-color": "^2.8.0",
+    "@tiptap/extension-document": "^2.8.0",
+    "@tiptap/extension-dropcursor": "^2.8.0",
+    "@tiptap/extension-hard-break": "^2.8.0",
+    "@tiptap/extension-heading": "^2.8.0",
+    "@tiptap/extension-highlight": "^2.8.0",
+    "@tiptap/extension-history": "^2.8.0",
+    "@tiptap/extension-horizontal-rule": "^2.8.0",
+    "@tiptap/extension-image": "^2.8.0",
+    "@tiptap/extension-italic": "^2.8.0",
+    "@tiptap/extension-link": "^2.8.0",
+    "@tiptap/extension-list-item": "^2.8.0",
+    "@tiptap/extension-list-keymap": "^2.8.0",
+    "@tiptap/extension-ordered-list": "^2.8.0",
+    "@tiptap/extension-paragraph": "^2.8.0",
+    "@tiptap/extension-placeholder": "^2.8.0",
+    "@tiptap/extension-strike": "^2.8.0",
+    "@tiptap/extension-subscript": "^2.8.0",
+    "@tiptap/extension-superscript": "^2.8.0",
+    "@tiptap/extension-table": "^2.8.0",
+    "@tiptap/extension-table-row": "^2.8.0",
+    "@tiptap/extension-task-item": "^2.8.0",
+    "@tiptap/extension-task-list": "^2.8.0",
+    "@tiptap/extension-text": "^2.8.0",
+    "@tiptap/extension-text-align": "^2.8.0",
+    "@tiptap/extension-text-style": "^2.8.0",
+    "@tiptap/extension-underline": "^2.8.0",
+    "@tiptap/pm": "^2.8.0",
+    "@tiptap/suggestion": "^2.8.0",
+    "@tiptap/vue-3": "^2.8.0",
     "floating-vue": "^5.2.2",
     "github-markdown-css": "^5.2.0",
     "linkifyjs": "^4.1.3",
diff --git a/ui/packages/editor/src/extensions/audio/AudioView.vue b/ui/packages/editor/src/extensions/audio/AudioView.vue
index 99319ca42a..17bf2d5b33 100644
--- a/ui/packages/editor/src/extensions/audio/AudioView.vue
+++ b/ui/packages/editor/src/extensions/audio/AudioView.vue
@@ -1,20 +1,10 @@
 <script lang="ts" setup>
 import { i18n } from "@/locales";
-import type { Decoration, Node as ProseMirrorNode } from "@/tiptap/pm";
-import type { Editor, Node } from "@/tiptap/vue-3";
+import type { NodeViewProps } from "@/tiptap/vue-3";
 import { NodeViewWrapper } from "@/tiptap/vue-3";
 import { computed, onMounted, ref } from "vue";
 
-const props = defineProps<{
-  editor: Editor;
-  node: ProseMirrorNode;
-  decorations: Decoration[];
-  selected: boolean;
-  extension: Node<any, any>;
-  getPos: () => number;
-  updateAttributes: (attributes: Record<string, any>) => void;
-  deleteNode: () => void;
-}>();
+const props = defineProps<NodeViewProps>();
 
 const src = computed({
   get: () => {
diff --git a/ui/packages/editor/src/extensions/iframe/IframeView.vue b/ui/packages/editor/src/extensions/iframe/IframeView.vue
index b3b3ad6e7c..e0b87dd90a 100644
--- a/ui/packages/editor/src/extensions/iframe/IframeView.vue
+++ b/ui/packages/editor/src/extensions/iframe/IframeView.vue
@@ -1,21 +1,11 @@
 <script lang="ts" setup>
 import { i18n } from "@/locales";
-import type { Decoration, Node as ProseMirrorNode } from "@/tiptap/pm";
-import type { Editor, Node } from "@/tiptap/vue-3";
+import type { NodeViewProps } from "@/tiptap/vue-3";
 import { NodeViewWrapper } from "@/tiptap/vue-3";
 import { isAllowedUri } from "@/utils/is-allowed-uri";
 import { computed, onMounted, ref } from "vue";
 
-const props = defineProps<{
-  editor: Editor;
-  node: ProseMirrorNode;
-  decorations: Decoration[];
-  selected: boolean;
-  extension: Node<any, any>;
-  getPos: () => number;
-  updateAttributes: (attributes: Record<string, any>) => void;
-  deleteNode: () => void;
-}>();
+const props = defineProps<NodeViewProps>();
 
 const src = computed({
   get: () => {
diff --git a/ui/packages/editor/src/extensions/image/ImageView.vue b/ui/packages/editor/src/extensions/image/ImageView.vue
index a63f705ef7..64dfd69c33 100644
--- a/ui/packages/editor/src/extensions/image/ImageView.vue
+++ b/ui/packages/editor/src/extensions/image/ImageView.vue
@@ -1,21 +1,11 @@
 <script lang="ts" setup>
 import { i18n } from "@/locales";
-import type { Decoration, Node as ProseMirrorNode } from "@/tiptap/pm";
-import type { Editor, Node } from "@/tiptap/vue-3";
+import type { NodeViewProps } from "@/tiptap/vue-3";
 import { NodeViewWrapper } from "@/tiptap/vue-3";
 import { computed, onMounted, ref } from "vue";
 import Image from "./index";
 
-const props = defineProps<{
-  editor: Editor;
-  node: ProseMirrorNode;
-  decorations: Decoration[];
-  selected: boolean;
-  extension: Node<any, any>;
-  getPos: () => number;
-  updateAttributes: (attributes: Record<string, any>) => void;
-  deleteNode: () => void;
-}>();
+const props = defineProps<NodeViewProps>();
 
 const src = computed({
   get: () => {
diff --git a/ui/packages/editor/src/extensions/video/VideoView.vue b/ui/packages/editor/src/extensions/video/VideoView.vue
index 443b3d07a7..4ab6e57194 100644
--- a/ui/packages/editor/src/extensions/video/VideoView.vue
+++ b/ui/packages/editor/src/extensions/video/VideoView.vue
@@ -1,20 +1,10 @@
 <script lang="ts" setup>
 import { i18n } from "@/locales";
-import type { Decoration, Node as ProseMirrorNode } from "@/tiptap/pm";
-import type { Editor, Node } from "@/tiptap/vue-3";
+import type { NodeViewProps } from "@/tiptap/vue-3";
 import { NodeViewWrapper } from "@/tiptap/vue-3";
 import { computed, onMounted, ref } from "vue";
 
-const props = defineProps<{
-  editor: Editor;
-  node: ProseMirrorNode;
-  decorations: Decoration[];
-  selected: boolean;
-  extension: Node<any, any>;
-  getPos: () => number;
-  updateAttributes: (attributes: Record<string, any>) => void;
-  deleteNode: () => void;
-}>();
+const props = defineProps<NodeViewProps>();
 
 const src = computed({
   get: () => {
diff --git a/ui/pnpm-lock.yaml b/ui/pnpm-lock.yaml
index 6b0a41fc24..9c92632e31 100644
--- a/ui/pnpm-lock.yaml
+++ b/ui/pnpm-lock.yaml
@@ -81,8 +81,8 @@ importers:
         specifier: ^4.29.1
         version: 4.29.1(vue@3.5.11(typescript@5.6.2))
       '@tiptap/extension-character-count':
-        specifier: ^2.6.5
-        version: 2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))(@tiptap/pm@2.6.5)
+        specifier: ^2.8.0
+        version: 2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))(@tiptap/pm@2.8.0)
       '@uppy/core':
         specifier: ^3.11.3
         version: 3.11.3
@@ -462,113 +462,113 @@ importers:
         specifier: ^1.5.0
         version: 1.5.0(vue@3.5.11(typescript@5.6.2))
       '@tiptap/core':
-        specifier: ^2.6.5
-        version: 2.6.5(@tiptap/pm@2.6.5)
+        specifier: ^2.8.0
+        version: 2.8.0(@tiptap/pm@2.8.0)
       '@tiptap/extension-blockquote':
-        specifier: ^2.6.5
-        version: 2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))
+        specifier: ^2.8.0
+        version: 2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))
       '@tiptap/extension-bold':
-        specifier: ^2.6.5
-        version: 2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))
+        specifier: ^2.8.0
+        version: 2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))
       '@tiptap/extension-bullet-list':
-        specifier: ^2.6.5
-        version: 2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))
+        specifier: ^2.8.0
+        version: 2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))(@tiptap/extension-list-item@2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0)))(@tiptap/extension-text-style@2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0)))
       '@tiptap/extension-code':
-        specifier: ^2.6.5
-        version: 2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))
+        specifier: ^2.8.0
+        version: 2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))
       '@tiptap/extension-code-block':
-        specifier: ^2.6.5
-        version: 2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))(@tiptap/pm@2.6.5)
+        specifier: ^2.8.0
+        version: 2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))(@tiptap/pm@2.8.0)
       '@tiptap/extension-color':
-        specifier: ^2.6.5
-        version: 2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))(@tiptap/extension-text-style@2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5)))
+        specifier: ^2.8.0
+        version: 2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))(@tiptap/extension-text-style@2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0)))
       '@tiptap/extension-document':
-        specifier: ^2.6.5
-        version: 2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))
+        specifier: ^2.8.0
+        version: 2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))
       '@tiptap/extension-dropcursor':
-        specifier: ^2.6.5
-        version: 2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))(@tiptap/pm@2.6.5)
+        specifier: ^2.8.0
+        version: 2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))(@tiptap/pm@2.8.0)
       '@tiptap/extension-hard-break':
-        specifier: ^2.6.5
-        version: 2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))
+        specifier: ^2.8.0
+        version: 2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))
       '@tiptap/extension-heading':
-        specifier: ^2.6.5
-        version: 2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))
+        specifier: ^2.8.0
+        version: 2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))
       '@tiptap/extension-highlight':
-        specifier: ^2.6.5
-        version: 2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))
+        specifier: ^2.8.0
+        version: 2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))
       '@tiptap/extension-history':
-        specifier: ^2.6.5
-        version: 2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))(@tiptap/pm@2.6.5)
+        specifier: ^2.8.0
+        version: 2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))(@tiptap/pm@2.8.0)
       '@tiptap/extension-horizontal-rule':
-        specifier: ^2.6.5
-        version: 2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))(@tiptap/pm@2.6.5)
+        specifier: ^2.8.0
+        version: 2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))(@tiptap/pm@2.8.0)
       '@tiptap/extension-image':
-        specifier: ^2.6.5
-        version: 2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))
+        specifier: ^2.8.0
+        version: 2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))
       '@tiptap/extension-italic':
-        specifier: ^2.6.5
-        version: 2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))
+        specifier: ^2.8.0
+        version: 2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))
       '@tiptap/extension-link':
-        specifier: ^2.6.5
-        version: 2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))(@tiptap/pm@2.6.5)
+        specifier: ^2.8.0
+        version: 2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))(@tiptap/pm@2.8.0)
       '@tiptap/extension-list-item':
-        specifier: ^2.6.5
-        version: 2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))
+        specifier: ^2.8.0
+        version: 2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))
       '@tiptap/extension-list-keymap':
-        specifier: ^2.6.5
-        version: 2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))
+        specifier: ^2.8.0
+        version: 2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))
       '@tiptap/extension-ordered-list':
-        specifier: ^2.6.5
-        version: 2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))
+        specifier: ^2.8.0
+        version: 2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))(@tiptap/extension-list-item@2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0)))(@tiptap/extension-text-style@2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0)))
       '@tiptap/extension-paragraph':
-        specifier: ^2.6.5
-        version: 2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))
+        specifier: ^2.8.0
+        version: 2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))
       '@tiptap/extension-placeholder':
-        specifier: ^2.6.5
-        version: 2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))(@tiptap/pm@2.6.5)
+        specifier: ^2.8.0
+        version: 2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))(@tiptap/pm@2.8.0)
       '@tiptap/extension-strike':
-        specifier: ^2.6.5
-        version: 2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))
+        specifier: ^2.8.0
+        version: 2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))
       '@tiptap/extension-subscript':
-        specifier: ^2.6.5
-        version: 2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))
+        specifier: ^2.8.0
+        version: 2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))
       '@tiptap/extension-superscript':
-        specifier: ^2.6.5
-        version: 2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))
+        specifier: ^2.8.0
+        version: 2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))
       '@tiptap/extension-table':
-        specifier: ^2.6.5
-        version: 2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))(@tiptap/pm@2.6.5)
+        specifier: ^2.8.0
+        version: 2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))(@tiptap/pm@2.8.0)
       '@tiptap/extension-table-row':
-        specifier: ^2.6.5
-        version: 2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))
+        specifier: ^2.8.0
+        version: 2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))
       '@tiptap/extension-task-item':
-        specifier: ^2.6.5
-        version: 2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))(@tiptap/pm@2.6.5)
+        specifier: ^2.8.0
+        version: 2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))(@tiptap/pm@2.8.0)
       '@tiptap/extension-task-list':
-        specifier: ^2.6.5
-        version: 2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))
+        specifier: ^2.8.0
+        version: 2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))
       '@tiptap/extension-text':
-        specifier: ^2.6.5
-        version: 2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))
+        specifier: ^2.8.0
+        version: 2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))
       '@tiptap/extension-text-align':
-        specifier: ^2.6.5
-        version: 2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))
+        specifier: ^2.8.0
+        version: 2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))
       '@tiptap/extension-text-style':
-        specifier: ^2.6.5
-        version: 2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))
+        specifier: ^2.8.0
+        version: 2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))
       '@tiptap/extension-underline':
-        specifier: ^2.6.5
-        version: 2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))
+        specifier: ^2.8.0
+        version: 2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))
       '@tiptap/pm':
-        specifier: ^2.6.5
-        version: 2.6.5
+        specifier: ^2.8.0
+        version: 2.8.0
       '@tiptap/suggestion':
-        specifier: ^2.6.5
-        version: 2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))(@tiptap/pm@2.6.5)
+        specifier: ^2.8.0
+        version: 2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))(@tiptap/pm@2.8.0)
       '@tiptap/vue-3':
-        specifier: ^2.6.5
-        version: 2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))(@tiptap/pm@2.6.5)(vue@3.5.11(typescript@5.6.2))
+        specifier: ^2.8.0
+        version: 2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))(@tiptap/pm@2.8.0)(vue@3.5.11(typescript@5.6.2))
       floating-vue:
         specifier: ^5.2.2
         version: 5.2.2(vue@3.5.11(typescript@5.6.2))
@@ -3127,8 +3127,8 @@ packages:
   '@radix-ui/rect@1.0.1':
     resolution: {integrity: sha512-fyrgCaedtvMg9NK3en0pnOYJdtfwxUcNolezkNPUsoX57X8oQk+NkqcvzHXD2uKNij6GXmWU9NDru2IWjrO4BQ==}
 
-  '@remirror/core-constants@2.0.2':
-    resolution: {integrity: sha512-dyHY+sMF0ihPus3O27ODd4+agdHMEmuRdyiZJ2CCWjPV5UFmn17ZbElvk6WOGVE4rdCJKZQCrPV2BcikOMLUGQ==}
+  '@remirror/core-constants@3.0.0':
+    resolution: {integrity: sha512-42aWfPrimMfDKDi4YegyS7x+/0tlzaqwPQCULLanv3DMIlu96KTJR0fM5isWX2UViOqlGnX6YFgqWepcX+XMNg==}
 
   '@rollup/plugin-alias@3.1.9':
     resolution: {integrity: sha512-QI5fsEvm9bDzt32k39wpOwZhVzRcL5ydcffUHMyLVaVaLeC70I8TJZ17F1z1eMoLu4E/UOcH9BWVkKpIKdrfiw==}
@@ -3577,212 +3577,216 @@ packages:
     peerDependencies:
       '@testing-library/dom': '>=7.21.4'
 
-  '@tiptap/core@2.6.5':
-    resolution: {integrity: sha512-1q5gn4YB0Qm3xFxdQq40FMwjL0gj4flP3UeXHlHXHYvJtMK9ZckRJReYtTEGjRp99BJWivU0YehGdC/96f47GA==}
+  '@tiptap/core@2.8.0':
+    resolution: {integrity: sha512-xsqDI4BNzYRWRtBq7+/38ThhqEr7uG9Njip1x+9/wgR3vWPBFnBkYJTz6jSxS35NRE6BSnERm4/B/vrLuY1Hdw==}
     peerDependencies:
-      '@tiptap/pm': ^2.6.5
+      '@tiptap/pm': ^2.7.0
 
-  '@tiptap/extension-blockquote@2.6.5':
-    resolution: {integrity: sha512-lKg/8UfsToG0GycizXGqFlA4/ptB3KumM8ch3MBKRLqy/yViu4oXpbTCqE9sqx/WNUYiriPrvkQnBW10LfFIJQ==}
+  '@tiptap/extension-blockquote@2.8.0':
+    resolution: {integrity: sha512-m3CKrOIvV7fY1Ak2gYf5LkKiz6AHxHpg6wxfVaJvdBqXgLyVtHo552N+A4oSHOSRbB4AG9EBQ2NeBM8cdEQ4MA==}
     peerDependencies:
-      '@tiptap/core': ^2.6.5
+      '@tiptap/core': ^2.7.0
 
-  '@tiptap/extension-bold@2.6.5':
-    resolution: {integrity: sha512-ey78g9YCOQi+qQ58QBFvWJVIXLQ+9isamshO9lzoc4RdtWDm+WuIUmmyoeneRcQixbVlyvOOMUf7PNKdIZHHtg==}
+  '@tiptap/extension-bold@2.8.0':
+    resolution: {integrity: sha512-U1YkZBxDkSLNvPNiqxB5g42IeJHr27C7zDb/yGQN2xL4UBeg4O9xVhCFfe32f6tLwivSL0dar4ScElpaCJuqow==}
     peerDependencies:
-      '@tiptap/core': ^2.6.5
+      '@tiptap/core': ^2.7.0
 
-  '@tiptap/extension-bubble-menu@2.6.5':
-    resolution: {integrity: sha512-KIqZnbmIcHEg7ynkkDS7PKqHmsF45FZYeyJGXESrvxwfrvPElTtCwDeNaqmDwb000ljwW7BwiVUj5DjZCJlj2A==}
+  '@tiptap/extension-bubble-menu@2.8.0':
+    resolution: {integrity: sha512-swg+myJPN60LduQvLMF4hVBqP5LOIN01INZBzBI8egz8QufqtSyRCgXl7Xcma0RT5xIXnZSG9XOqNFf2rtkjKA==}
     peerDependencies:
-      '@tiptap/core': ^2.6.5
-      '@tiptap/pm': ^2.6.5
+      '@tiptap/core': ^2.7.0
+      '@tiptap/pm': ^2.7.0
 
-  '@tiptap/extension-bullet-list@2.6.5':
-    resolution: {integrity: sha512-6r1sc7voURIVU1bl6D9iBOJCHRQphQXHRzE2tLENCHdT8nlgO6wRwAIUVaps8Xkckr+WkLEeHTun+AD6bS+Q3A==}
+  '@tiptap/extension-bullet-list@2.8.0':
+    resolution: {integrity: sha512-H4O2X0ozbc/ce9/XF1H98sqWVUdtt7jzy7hMBunwmY8ZxI4dHtcRkeg81CZbpKTqOqRrMCLWjE3M2tgiDXrDkA==}
     peerDependencies:
-      '@tiptap/core': ^2.6.5
+      '@tiptap/core': ^2.7.0
+      '@tiptap/extension-list-item': ^2.7.0
+      '@tiptap/extension-text-style': ^2.7.0
 
-  '@tiptap/extension-character-count@2.6.5':
-    resolution: {integrity: sha512-UZlSzfZ6Vq0zOGhNOAzLIEjAhS46dSsHXFnhgw8l61tLknVeIyXbcdi8hBxWzOQ6XkH2PA3QSnahEGwYks73WQ==}
+  '@tiptap/extension-character-count@2.8.0':
+    resolution: {integrity: sha512-wTV5RFNqKh202qPFrvoAaueL9BJVpIHPCc1fGRrLe7ri95oMmEO+50SoFH1xOVjU0Pd8SXKwLKPiYTpbi3SRXQ==}
     peerDependencies:
-      '@tiptap/core': ^2.6.5
-      '@tiptap/pm': ^2.6.5
+      '@tiptap/core': ^2.7.0
+      '@tiptap/pm': ^2.7.0
 
-  '@tiptap/extension-code-block@2.6.5':
-    resolution: {integrity: sha512-kV8VAerd3z23zv6vZSVkq0JJs0emzWb3KyrLsiUuhR1Yj+zgcxer3zw4IJlmDeDhp6qIXK/qTgHzNcxS+fV4Rw==}
+  '@tiptap/extension-code-block@2.8.0':
+    resolution: {integrity: sha512-POuA5Igx+Dto0DTazoBFAQTj/M/FCdkqRVD9Uhsxhv49swPyANTJRr05vgbgtHB+NDDsZfCawVh7pI0IAD/O0w==}
     peerDependencies:
-      '@tiptap/core': ^2.6.5
-      '@tiptap/pm': ^2.6.5
+      '@tiptap/core': ^2.7.0
+      '@tiptap/pm': ^2.7.0
 
-  '@tiptap/extension-code@2.6.5':
-    resolution: {integrity: sha512-zwp1J76CmnPG1kyx8hDSRG6UM7pEIPqSMZMJRYjJMX6n0tGGGzUFFNlcshxnsZeiKOn0KZsi0o1kJN4Pza9xbg==}
+  '@tiptap/extension-code@2.8.0':
+    resolution: {integrity: sha512-VSFn3sFF6qPpOGkXFhik8oYRH5iByVJpFEFd/duIEftmS0MdPzkbSItOpN3mc9xsJ5dCX80LYaResSj5hr5zkA==}
     peerDependencies:
-      '@tiptap/core': ^2.6.5
+      '@tiptap/core': ^2.7.0
 
-  '@tiptap/extension-color@2.6.5':
-    resolution: {integrity: sha512-+dybkeWrcSqhU0KDxWqBu5iJtUDkfyDUlqtPkNULUi9QDkuDlxMJJ4FqZBCmKtS2sxNH9WtmTmzSRfSdLaPjyA==}
+  '@tiptap/extension-color@2.8.0':
+    resolution: {integrity: sha512-b0ZIDaZKTDVdTb0PMgtOiPzgCkYhvDldjzdWyPLsjWup5x9/zPasH5X/2SfMuwtjt+cKj6YBPveJjF7w5ApK7w==}
     peerDependencies:
-      '@tiptap/core': ^2.6.5
-      '@tiptap/extension-text-style': ^2.6.5
+      '@tiptap/core': ^2.7.0
+      '@tiptap/extension-text-style': ^2.7.0
 
-  '@tiptap/extension-document@2.6.5':
-    resolution: {integrity: sha512-3rjyNAW8yAm4jrD8AsD39n/FXZ0PMkqbEN0Uzt4RCfK0Kbi8UcTYgcRCgo+HneqqtUAK/d+5imcbdTP6R2lTCg==}
+  '@tiptap/extension-document@2.8.0':
+    resolution: {integrity: sha512-mp7Isx1sVc/ifeW4uW/PexGQ9exN3NRUOebSpnLfqXeWYk4y1RS1PA/3+IHkOPVetbnapgPjFx/DswlCP3XLjA==}
     peerDependencies:
-      '@tiptap/core': ^2.6.5
+      '@tiptap/core': ^2.7.0
 
-  '@tiptap/extension-dropcursor@2.6.5':
-    resolution: {integrity: sha512-4Kh/TseGVSwt4eoZ6EcFZiCxhK3wSrUUTwltxdeNQVsCYG1jBfflOhIyy41fMC8N73KlnaLjQXsCvesUNx/X2Q==}
+  '@tiptap/extension-dropcursor@2.8.0':
+    resolution: {integrity: sha512-rAFvx44YuT6dtS1c+ALw0ROAGI16l5L1HxquL4hR1gtxDcTieST5xhw5bkshXlmrlfotZXPrhokzqA7qjhZtJw==}
     peerDependencies:
-      '@tiptap/core': ^2.6.5
-      '@tiptap/pm': ^2.6.5
+      '@tiptap/core': ^2.7.0
+      '@tiptap/pm': ^2.7.0
 
-  '@tiptap/extension-floating-menu@2.6.5':
-    resolution: {integrity: sha512-RrGNBvpvklZH5n3iIeTgrKVH07n6ozb7IZ60T5idhxedWBtvbEAou3Y9XlCqOhNgooHiCqWkiV4dPngk51G2Yg==}
+  '@tiptap/extension-floating-menu@2.8.0':
+    resolution: {integrity: sha512-H4QT61CrkLqisnGGC7zgiYmsl2jXPHl89yQCbdlkQN7aw11H7PltcJS2PJguL0OrRVJS/Mv/VTTUiMslmsEV5g==}
     peerDependencies:
-      '@tiptap/core': ^2.6.5
-      '@tiptap/pm': ^2.6.5
+      '@tiptap/core': ^2.7.0
+      '@tiptap/pm': ^2.7.0
 
-  '@tiptap/extension-hard-break@2.6.5':
-    resolution: {integrity: sha512-5DcI6hDm3pw5I1jWwzNo/tx/2Nx+as4Nl6Stk3tJO1WPKCWPWouyR62EHyzhgMqcPFKRUWtWpeHag2rGDoY4Bw==}
+  '@tiptap/extension-hard-break@2.8.0':
+    resolution: {integrity: sha512-vqiIfviNiCmy/pJTHuDSCAGL2O4QDEdDmAvGJu8oRmElUrnlg8DbJUfKvn6DWQHNSQwRb+LDrwWlzAYj1K9u6A==}
     peerDependencies:
-      '@tiptap/core': ^2.6.5
+      '@tiptap/core': ^2.7.0
 
-  '@tiptap/extension-heading@2.6.5':
-    resolution: {integrity: sha512-H7WqddzURXUptUznPWqW988mVK1HwghSwKYNTvcw3BHUI6nbVK2UJQyZUV3+XDDru2W77lXwvmBTw8xglPkHlg==}
+  '@tiptap/extension-heading@2.8.0':
+    resolution: {integrity: sha512-4inWgrTPiqlivPmEHFOM5ck2UsmOsbKKPtqga6bALvWPmCv24S6/EBwFp8Jz4YABabXDnkviihmGu0LpP9D69w==}
     peerDependencies:
-      '@tiptap/core': ^2.6.5
+      '@tiptap/core': ^2.7.0
 
-  '@tiptap/extension-highlight@2.6.5':
-    resolution: {integrity: sha512-4MFOO/iqnkFuwmd8clAXurP8c2kHNhtzwx+ElYVH4z21v9JXDM8rX6LQEQZaUlTGs6CXk2oAqnXxpWXkoguD4w==}
+  '@tiptap/extension-highlight@2.8.0':
+    resolution: {integrity: sha512-vyqX7D449nuARhI0AyRqtIZReFg3sfc/U/q1p3JOjtUoW6z2jmDTzshiKRrSg+Jf7Hhzj1pqwU+6+CpelPPDpA==}
     peerDependencies:
-      '@tiptap/core': ^2.6.5
+      '@tiptap/core': ^2.7.0
 
-  '@tiptap/extension-history@2.6.5':
-    resolution: {integrity: sha512-zDCXiVKfqii0D+Q9lu65skW3+4Jqzicge+sw42YBQp4H7jXLJC55QoLuctwhl4iGXliiWnobRpotTPdaUXYhoA==}
+  '@tiptap/extension-history@2.8.0':
+    resolution: {integrity: sha512-u5YS0J5Egsxt8TUWMMAC3QhPZaak+IzQeyHch4gtqxftx96tprItY7AD/A3pGDF2uCSnN+SZrk6yVexm6EncDw==}
     peerDependencies:
-      '@tiptap/core': ^2.6.5
-      '@tiptap/pm': ^2.6.5
+      '@tiptap/core': ^2.7.0
+      '@tiptap/pm': ^2.7.0
 
-  '@tiptap/extension-horizontal-rule@2.6.5':
-    resolution: {integrity: sha512-NzbbzR9VQ0YY/NbjiRxuk7k1M0GfCx327I/TXc7/0YTQ2Am3QvOtrnpwQsM4P9920yhc6QT65ZP63LXcJFkiBg==}
+  '@tiptap/extension-horizontal-rule@2.8.0':
+    resolution: {integrity: sha512-Sn/MI8WVFBoIYSIHA9NJryJIyCEzZdRysau8pC5TFnfifre0QV1ksPz2bgF+DyCD69ozQiRdBBHDEwKe47ZbfQ==}
     peerDependencies:
-      '@tiptap/core': ^2.6.5
-      '@tiptap/pm': ^2.6.5
+      '@tiptap/core': ^2.7.0
+      '@tiptap/pm': ^2.7.0
 
-  '@tiptap/extension-image@2.6.5':
-    resolution: {integrity: sha512-JDwjtGMzcPd9aq2+3LjNoZpwsDaRrKr+Eam3WfBrmses9avezb5ajSU0aSECkUvIDvgzOm4W3Kemep9zsNdrjA==}
+  '@tiptap/extension-image@2.8.0':
+    resolution: {integrity: sha512-5CReomgHGTUgxaX8P3i6qiC9VRWcWQgVoYtds4ZM52LVx/oGwMxQ4ECyzdVYKaRW+6PrNnAe6ew3Qpd5Wk0cIg==}
     peerDependencies:
-      '@tiptap/core': ^2.6.5
+      '@tiptap/core': ^2.7.0
 
-  '@tiptap/extension-italic@2.6.5':
-    resolution: {integrity: sha512-g+OC1KcgKu3xhaydTRDcw/Ydr+EEAVLelmtwNILv5UfypFDvcYZRQNqF5/m2ZJ6kjtXQQ8whC3ddMGUgxs29Bg==}
+  '@tiptap/extension-italic@2.8.0':
+    resolution: {integrity: sha512-PwwSE2LTYiHI47NJnsfhBmPiLE8IXZYqaSoNPU6flPrk1KxEzqvRI1joKZBmD9wuqzmHJ93VFIeZcC+kfwi8ZA==}
     peerDependencies:
-      '@tiptap/core': ^2.6.5
+      '@tiptap/core': ^2.7.0
 
-  '@tiptap/extension-link@2.6.5':
-    resolution: {integrity: sha512-AZCATebxJJdt4sJCkrbhTZZpyU2uqfLz7qv9FaVSUdYEMCDSFEDVfBhN5rKG+ZsXrrDo6fX7JO1xgkXGPWJNBw==}
+  '@tiptap/extension-link@2.8.0':
+    resolution: {integrity: sha512-p67hCG/pYCiOK/oCTPZnlkw9Ei7KJ7kCKFaluTcAmr5j8IBdYfDqSMDNCT4vGXBvKFh4X6xD7S7QvOqcH0Gn9A==}
     peerDependencies:
-      '@tiptap/core': ^2.6.5
-      '@tiptap/pm': ^2.6.5
+      '@tiptap/core': ^2.7.0
+      '@tiptap/pm': ^2.7.0
 
-  '@tiptap/extension-list-item@2.6.5':
-    resolution: {integrity: sha512-Ks/m2spl3t3pX8W23H1clq0CQ2cGrLKdPxpSn3DAbZxYjT3SF7jpJaG3e+MKKh84PcjY0Xa3FextuLFRSLlgOw==}
+  '@tiptap/extension-list-item@2.8.0':
+    resolution: {integrity: sha512-o7OGymGxB0B9x3x2prp3KBDYFuBYGc5sW69O672jk8G52DqhzzndgPnkk0qUn8nXAUKuDGbJmpmHVA2kagqnRg==}
     peerDependencies:
-      '@tiptap/core': ^2.6.5
+      '@tiptap/core': ^2.7.0
 
-  '@tiptap/extension-list-keymap@2.6.5':
-    resolution: {integrity: sha512-ZuBh3SQrmU6gASLT7355oMlhpWmrZ4DBdSMOtHDmaF2m1bu4MAiBB4xACC1eVKTubFY0Carr8qFXMoZfsLzQcw==}
+  '@tiptap/extension-list-keymap@2.8.0':
+    resolution: {integrity: sha512-+Q4Q76/VIq1EAKnX4okXUct+31+/GYXjIn7+5YrV9sbSERPq8s615ffHNhimGZhpTuhlou10jyNsUtok2g9nRQ==}
     peerDependencies:
-      '@tiptap/core': ^2.6.5
+      '@tiptap/core': ^2.7.0
 
-  '@tiptap/extension-ordered-list@2.6.5':
-    resolution: {integrity: sha512-brTZiwS3Lg3bFXCJABfJ1UOLiX08BNnWw/mOBYuKsnBvIPJQpJ98C1galnX77ihsjFtAUdVdm7xlwcX2q5x8Yg==}
+  '@tiptap/extension-ordered-list@2.8.0':
+    resolution: {integrity: sha512-sCvNbcTS1+5QTTXwUPFa10vf5I1pr8sGcOTIh0G+a5ZkS5+6FxT12k7VLzPt39QyNbOi+77U2o4Xr4XyaEkfSg==}
     peerDependencies:
-      '@tiptap/core': ^2.6.5
+      '@tiptap/core': ^2.7.0
+      '@tiptap/extension-list-item': ^2.7.0
+      '@tiptap/extension-text-style': ^2.7.0
 
-  '@tiptap/extension-paragraph@2.6.5':
-    resolution: {integrity: sha512-RGevQMVpqTxuU9Gz2G4STOVcqoP9i9Fc0QurM/B0mDjs5onzCCJLd6qIqxuT7WfFYILe8q3QIu8KB+XGmvmobQ==}
+  '@tiptap/extension-paragraph@2.8.0':
+    resolution: {integrity: sha512-XgxxNNbuBF48rAGwv7/s6as92/xjm/lTZIGTq9aG13ClUKFtgdel7C33SpUCcxg3cO2WkEyllXVyKUiauFZw/A==}
     peerDependencies:
-      '@tiptap/core': ^2.6.5
+      '@tiptap/core': ^2.7.0
 
-  '@tiptap/extension-placeholder@2.6.5':
-    resolution: {integrity: sha512-ysPt++WIN9j57lQJFk5UmKK1lPMrbREAB206VrOqDmsehThegpgl4rRWQP6G4AUr+ieytYPV49vjJtZQGxo3WA==}
+  '@tiptap/extension-placeholder@2.8.0':
+    resolution: {integrity: sha512-BMqv/C9Tcjd7L1/OphUAJTZhWfpWs0rTQJ0bs3RRGsC8L+K20Fg+li45vw7M0teojpfrw57zwJogJd/m23Zr1Q==}
     peerDependencies:
-      '@tiptap/core': ^2.6.5
-      '@tiptap/pm': ^2.6.5
+      '@tiptap/core': ^2.7.0
+      '@tiptap/pm': ^2.7.0
 
-  '@tiptap/extension-strike@2.6.5':
-    resolution: {integrity: sha512-ehA++vHPMmLNhfjKFDHJR6FAh3wziIfehaZShuvkjlF7mryTa19y7KJem+8d0wv2w5AwoFOMBJmC7EBXyG0boQ==}
+  '@tiptap/extension-strike@2.8.0':
+    resolution: {integrity: sha512-ezkDiXxQ3ME/dDMMM7tAMkKRi6UWw7tIu+Mx7Os0z8HCGpVBk1gFhLlhEd8I5rJaPZr4tK1wtSehMA9bscFGQw==}
     peerDependencies:
-      '@tiptap/core': ^2.6.5
+      '@tiptap/core': ^2.7.0
 
-  '@tiptap/extension-subscript@2.6.5':
-    resolution: {integrity: sha512-6xNJjUqvn1XN6GvB7W+kUrxMj/r7aC/6Tb3JPtqnagxo8cdAiuU2wgRtmuqjhdzRdA7vHGnzhjRpyd0r9W9JPg==}
+  '@tiptap/extension-subscript@2.8.0':
+    resolution: {integrity: sha512-m14K5M7E+SqqrBul+B9t5sjN4zqTddV+Q+vd+RIm+OHG6AQhwewNoFyghZz5dGZ2Xj7HqiEyusBN+iHwfgJpmg==}
     peerDependencies:
-      '@tiptap/core': ^2.6.5
+      '@tiptap/core': ^2.7.0
 
-  '@tiptap/extension-superscript@2.6.5':
-    resolution: {integrity: sha512-IaisTroP4PrZmSpAZvHDuzgBv4DvErS16EcT8hBlMIo3PzgDqSCAHBLq0nf4IxU4rLO0me5Ra9FbieoQtOqw+A==}
+  '@tiptap/extension-superscript@2.8.0':
+    resolution: {integrity: sha512-3rAVyRvzhoM51vaeIAEXmr2PkucIwv7ptgyxg6zx6STxcyzMchafGee0LJL7Kcn9uE/n7Yt7ek6bDqo8jU8CtA==}
     peerDependencies:
-      '@tiptap/core': ^2.6.5
+      '@tiptap/core': ^2.7.0
 
-  '@tiptap/extension-table-row@2.6.5':
-    resolution: {integrity: sha512-gI4cDRpuEUwQAn3M8HShiFQNdza3i7BjnUWbP8jxatPiJWdOsbcLQwlmA282d2RbjUT9odedy1PV4Bgk1BNj+w==}
+  '@tiptap/extension-table-row@2.8.0':
+    resolution: {integrity: sha512-Iezej6l7X+WqKzGLmCgAwmpL+QsfjFv1g8yVH5d0/3Pkcj3G9nDn+GSm4bZnbfYFyqInHG94PZ5PMReiALrJtA==}
     peerDependencies:
-      '@tiptap/core': ^2.6.5
+      '@tiptap/core': ^2.7.0
 
-  '@tiptap/extension-table@2.6.5':
-    resolution: {integrity: sha512-qIYAGtJQPMvcdSAtYaNYmRFESigBReed8Fac4U/g+rC/Ucs5sandzHTbZZOU/Wgiu4N8zphfenZeEB6FRGdarw==}
+  '@tiptap/extension-table@2.8.0':
+    resolution: {integrity: sha512-dm9CitjacXyJuE5SZfV2lUc3uOiP2sxo6fygIzMz7iuxHqQueyONWG+TBkK7HjqzXOiMPsvOf/25NazzIG8HMg==}
     peerDependencies:
-      '@tiptap/core': ^2.6.5
-      '@tiptap/pm': ^2.6.5
+      '@tiptap/core': ^2.7.0
+      '@tiptap/pm': ^2.7.0
 
-  '@tiptap/extension-task-item@2.6.5':
-    resolution: {integrity: sha512-RX6S9OVb4AEZ+hdMlBp1jIRRzdxIPnxSAeyJeRwg7Asx04Qm8M10tV6GfGkOdBvSWdgsgIRo9kNctq2lSZl20Q==}
+  '@tiptap/extension-task-item@2.8.0':
+    resolution: {integrity: sha512-U40uCE39vc6HT52JUTFGXQhxoakTsYapsfJmpy8LwfFAJVJtA7LBurY8qufvTzet55pSLtd3yNaZByhQaDlQrw==}
     peerDependencies:
-      '@tiptap/core': ^2.6.5
-      '@tiptap/pm': ^2.6.5
+      '@tiptap/core': ^2.7.0
+      '@tiptap/pm': ^2.7.0
 
-  '@tiptap/extension-task-list@2.6.5':
-    resolution: {integrity: sha512-fSp65hDG/A+kPnP7uX+kTz0OVmnu+ZhNHqIVLVPu3/sYej+71kF4SY7V0ur6vJ4hrp8sAEnS7p5b8Rp1cXohqg==}
+  '@tiptap/extension-task-list@2.8.0':
+    resolution: {integrity: sha512-2Zkq0UojPh+Y4trJcNSsjkdHsYczxFReUqhzl5T0/OuPzIcDYL2OicUrsp36y16KKnH+WSOUOR8twDfR9LHygg==}
     peerDependencies:
-      '@tiptap/core': ^2.6.5
+      '@tiptap/core': ^2.7.0
 
-  '@tiptap/extension-text-align@2.6.5':
-    resolution: {integrity: sha512-07FVqMyWRY3vyyOj4oRD71kYAekOajbgGbY5B6ZqYQjqEYjUei7OF6/+D+UafPtWXkysyuw0UuR2hV5VqeutHA==}
+  '@tiptap/extension-text-align@2.8.0':
+    resolution: {integrity: sha512-Y6s/DF+P4lxpAnvSrnmt4xGwQT/AJJJm0aA1wu5GuPKpAQ+K4C7K6rE6uGNAXtR39GlewC7KdmcvA+CYhL8xlw==}
     peerDependencies:
-      '@tiptap/core': ^2.6.5
+      '@tiptap/core': ^2.7.0
 
-  '@tiptap/extension-text-style@2.6.5':
-    resolution: {integrity: sha512-7nBnUww/+RcGqX/+9qZFQUM/UQ5cSUpvNJb2kaU/Rae48tYkXKq4ll8roqw3FzkbFSb+mGpCfu5xQ3l19TJmzQ==}
+  '@tiptap/extension-text-style@2.8.0':
+    resolution: {integrity: sha512-jJp0vcZ2Ty7RvIL0VU6dm1y+fTfXq1lN2GwtYzYM0ueFuESa+Qo8ticYOImyWZ3wGJGVrjn7OV9r0ReW0/NYkQ==}
     peerDependencies:
-      '@tiptap/core': ^2.6.5
+      '@tiptap/core': ^2.7.0
 
-  '@tiptap/extension-text@2.6.5':
-    resolution: {integrity: sha512-ItYw4K2EjP4yNBP2BVa77kimdvpsEqDy0Iic+d46F3SM60wLMhp1qmauZhwk5oo89sDuMz3DI0p+R4lI43wprA==}
+  '@tiptap/extension-text@2.8.0':
+    resolution: {integrity: sha512-EDAdFFzWOvQfVy7j3qkKhBpOeE5thkJaBemSWfXI93/gMVc0ZCdLi24mDvNNgUHlT+RjlIoQq908jZaaxLKN2A==}
     peerDependencies:
-      '@tiptap/core': ^2.6.5
+      '@tiptap/core': ^2.7.0
 
-  '@tiptap/extension-underline@2.6.5':
-    resolution: {integrity: sha512-OUkCVviAe1m5j0xZZHDdNhX4kd7TpasWJn9TvEhAoE9zCaCn54T1xSFGWq61Eu4qICn+KPjgWXWOGwniKEIrKg==}
+  '@tiptap/extension-underline@2.8.0':
+    resolution: {integrity: sha512-1ouuHwZJphT8OosAmp6x8e+Wly3cUd1pNWBiOutJX+6QRGBXJnIKFCzn8YOTlWhg1YQigisG7dNF3YdlyuRNHw==}
     peerDependencies:
-      '@tiptap/core': ^2.6.5
+      '@tiptap/core': ^2.7.0
 
-  '@tiptap/pm@2.6.5':
-    resolution: {integrity: sha512-5n7O7MdVATwJTNMs5mW0qngtIfaxzBXnkO6gaQj169HgmDHKA0ST60r/G6r6yQ/QU6UCt6ey9Stgr7ko1eU1NQ==}
+  '@tiptap/pm@2.8.0':
+    resolution: {integrity: sha512-eMGpRooUMvKz/vOpnKKppApMSoNM325HxTdAJvTlVAmuHp5bOY5kyY1kfUlePRiVx1t1UlFcXs3kecFwkkBD3Q==}
 
-  '@tiptap/suggestion@2.6.5':
-    resolution: {integrity: sha512-yjJUwhkHTfGNOt/zzGRVrkNyBkkfU42mmqCntbrggAVbkw2QDD7QqDpYZOqLGADnkfct6DYiDQHXh1pMYi+Caw==}
+  '@tiptap/suggestion@2.8.0':
+    resolution: {integrity: sha512-ENBgO7a92cZa4gESb0Da5e7PKnHiz77tZr226VLqEdMcp7Lve2jb3Q2uL+cWCJxs7P1l6ZhetUmUiJg+Ee7Wjg==}
     peerDependencies:
-      '@tiptap/core': ^2.6.5
-      '@tiptap/pm': ^2.6.5
+      '@tiptap/core': ^2.7.0
+      '@tiptap/pm': ^2.7.0
 
-  '@tiptap/vue-3@2.6.5':
-    resolution: {integrity: sha512-mQnXkGI4UfhcuxWe1kcCrr7LUZ5yoK6ubxYVs6pWWkFDkGxlUPQBQV/Sjq3ujK4ppbly30G/3gG80Ld3GWj45g==}
+  '@tiptap/vue-3@2.8.0':
+    resolution: {integrity: sha512-bJLoNQAkKXcWfRuX1YGu7SQFF+xY40YkpDagBXKXtmAfwIAwjO52grj4dpZoEtM12ZyxsC2RAHYYxBVPPYRSnw==}
     peerDependencies:
-      '@tiptap/core': ^2.6.5
-      '@tiptap/pm': ^2.6.5
+      '@tiptap/core': ^2.7.0
+      '@tiptap/pm': ^2.7.0
       vue: ^3.0.0
 
   '@tootallnate/once@2.0.0':
@@ -8457,8 +8461,8 @@ packages:
   prosemirror-collab@1.3.1:
     resolution: {integrity: sha512-4SnynYR9TTYaQVXd/ieUvsVV4PDMBzrq2xPUWutHivDuOshZXqQ5rGbZM84HEaXKbLdItse7weMGOUdDVcLKEQ==}
 
-  prosemirror-commands@1.5.2:
-    resolution: {integrity: sha512-hgLcPaakxH8tu6YvVAaILV2tXYsW3rAdDR8WNkeKGcgeMVQg3/TMhPdVoh7iAmfgVjZGtcOSjKiQaoeKjzd2mQ==}
+  prosemirror-commands@1.6.0:
+    resolution: {integrity: sha512-xn1U/g36OqXn2tn5nGmvnnimAj/g1pUx2ypJJIe8WkVX83WyJVC5LTARaxZa2AtQRwntu9Jc5zXs9gL9svp/mg==}
 
   prosemirror-dropcursor@1.8.1:
     resolution: {integrity: sha512-M30WJdJZLyXHi3N8vxN6Zh5O8ZBbQCz0gURTfPmTIBNQ5pxrdU7A58QkNqfa98YEjSAL1HUyyU34f6Pm5xBSGw==}
@@ -8481,8 +8485,8 @@ packages:
   prosemirror-menu@1.2.4:
     resolution: {integrity: sha512-S/bXlc0ODQup6aiBbWVsX/eM+xJgCTAfMq/nLqaO5ID/am4wS0tTCIkzwytmao7ypEtjj39i7YbJjAgO20mIqA==}
 
-  prosemirror-model@1.22.2:
-    resolution: {integrity: sha512-I4lS7HHIW47D0Xv/gWmi4iUWcQIDYaJKd8Hk4+lcSps+553FlQrhmxtItpEvTr75iAruhzVShVp6WUwsT6Boww==}
+  prosemirror-model@1.23.0:
+    resolution: {integrity: sha512-Q/fgsgl/dlOAW9ILu4OOhYWQbc7TQd4BwKH/RwmUjyVf8682Be4zj3rOYdLnYEcGzyg8LL9Q5IWYKD8tdToreQ==}
 
   prosemirror-schema-basic@1.2.3:
     resolution: {integrity: sha512-h+H0OQwZVqMon1PNn0AG9cTfx513zgIG2DY00eJ00Yvgb3UD+GQ/VlWW5rcaxacpCGT1Yx8nuhwXk4+QbXUfJA==}
@@ -8496,18 +8500,18 @@ packages:
   prosemirror-tables@1.4.0:
     resolution: {integrity: sha512-fxryZZkQG12fSCNuZDrYx6Xvo2rLYZTbKLRd8rglOPgNJGMKIS8uvTt6gGC38m7UCu/ENnXIP9pEz5uDaPc+cA==}
 
-  prosemirror-trailing-node@2.0.9:
-    resolution: {integrity: sha512-YvyIn3/UaLFlFKrlJB6cObvUhmwFNZVhy1Q8OpW/avoTbD/Y7H5EcjK4AZFKhmuS6/N6WkGgt7gWtBWDnmFvHg==}
+  prosemirror-trailing-node@3.0.0:
+    resolution: {integrity: sha512-xiun5/3q0w5eRnGYfNlW1uU9W6x5MoFKWwq/0TIRgt09lv7Hcser2QYV8t4muXbEr+Fwo0geYn79Xs4GKywrRQ==}
     peerDependencies:
       prosemirror-model: ^1.22.1
       prosemirror-state: ^1.4.2
       prosemirror-view: ^1.33.8
 
-  prosemirror-transform@1.9.0:
-    resolution: {integrity: sha512-5UXkr1LIRx3jmpXXNKDhv8OyAOeLTGuXNwdVfg8x27uASna/wQkr9p6fD3eupGOi4PLJfbezxTyi/7fSJypXHg==}
+  prosemirror-transform@1.10.0:
+    resolution: {integrity: sha512-9UOgFSgN6Gj2ekQH5CTDJ8Rp/fnKR2IkYfGdzzp5zQMFsS4zDllLVx/+jGcX86YlACpG7UR5fwAXiWzxqWtBTg==}
 
-  prosemirror-view@1.33.9:
-    resolution: {integrity: sha512-xV1A0Vz9cIcEnwmMhKKFAOkfIp8XmJRnaZoPqNXrPS7EK5n11Ov8V76KhR0RsfQd/SIzmWY+bg+M44A2Lx/Nnw==}
+  prosemirror-view@1.34.3:
+    resolution: {integrity: sha512-mKZ54PrX19sSaQye+sef+YjBbNu2voNwLS1ivb6aD2IRmxRGW64HU9B644+7OfJStGLyxvOreKqEgfvXa91WIA==}
 
   proto-list@1.2.4:
     resolution: {integrity: sha512-vtK/94akxsTMhe0/cbfpR+syPuszcuwhqVjJq26CuNDgFGj682oRBXOP5MJpv2r7JtE8MsiepGIqvvOTBwn2vA==}
@@ -13660,7 +13664,7 @@ snapshots:
     dependencies:
       '@babel/runtime': 7.19.0
 
-  '@remirror/core-constants@2.0.2': {}
+  '@remirror/core-constants@3.0.0': {}
 
   '@rollup/plugin-alias@3.1.9(rollup@2.79.1)':
     dependencies:
@@ -14522,170 +14526,174 @@ snapshots:
       '@babel/runtime': 7.19.0
       '@testing-library/dom': 8.20.1
 
-  '@tiptap/core@2.6.5(@tiptap/pm@2.6.5)':
+  '@tiptap/core@2.8.0(@tiptap/pm@2.8.0)':
     dependencies:
-      '@tiptap/pm': 2.6.5
+      '@tiptap/pm': 2.8.0
 
-  '@tiptap/extension-blockquote@2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))':
+  '@tiptap/extension-blockquote@2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))':
     dependencies:
-      '@tiptap/core': 2.6.5(@tiptap/pm@2.6.5)
+      '@tiptap/core': 2.8.0(@tiptap/pm@2.8.0)
 
-  '@tiptap/extension-bold@2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))':
+  '@tiptap/extension-bold@2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))':
     dependencies:
-      '@tiptap/core': 2.6.5(@tiptap/pm@2.6.5)
+      '@tiptap/core': 2.8.0(@tiptap/pm@2.8.0)
 
-  '@tiptap/extension-bubble-menu@2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))(@tiptap/pm@2.6.5)':
+  '@tiptap/extension-bubble-menu@2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))(@tiptap/pm@2.8.0)':
     dependencies:
-      '@tiptap/core': 2.6.5(@tiptap/pm@2.6.5)
-      '@tiptap/pm': 2.6.5
+      '@tiptap/core': 2.8.0(@tiptap/pm@2.8.0)
+      '@tiptap/pm': 2.8.0
       tippy.js: 6.3.7
 
-  '@tiptap/extension-bullet-list@2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))':
+  '@tiptap/extension-bullet-list@2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))(@tiptap/extension-list-item@2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0)))(@tiptap/extension-text-style@2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0)))':
     dependencies:
-      '@tiptap/core': 2.6.5(@tiptap/pm@2.6.5)
+      '@tiptap/core': 2.8.0(@tiptap/pm@2.8.0)
+      '@tiptap/extension-list-item': 2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))
+      '@tiptap/extension-text-style': 2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))
 
-  '@tiptap/extension-character-count@2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))(@tiptap/pm@2.6.5)':
+  '@tiptap/extension-character-count@2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))(@tiptap/pm@2.8.0)':
     dependencies:
-      '@tiptap/core': 2.6.5(@tiptap/pm@2.6.5)
-      '@tiptap/pm': 2.6.5
+      '@tiptap/core': 2.8.0(@tiptap/pm@2.8.0)
+      '@tiptap/pm': 2.8.0
 
-  '@tiptap/extension-code-block@2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))(@tiptap/pm@2.6.5)':
+  '@tiptap/extension-code-block@2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))(@tiptap/pm@2.8.0)':
     dependencies:
-      '@tiptap/core': 2.6.5(@tiptap/pm@2.6.5)
-      '@tiptap/pm': 2.6.5
+      '@tiptap/core': 2.8.0(@tiptap/pm@2.8.0)
+      '@tiptap/pm': 2.8.0
 
-  '@tiptap/extension-code@2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))':
+  '@tiptap/extension-code@2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))':
     dependencies:
-      '@tiptap/core': 2.6.5(@tiptap/pm@2.6.5)
+      '@tiptap/core': 2.8.0(@tiptap/pm@2.8.0)
 
-  '@tiptap/extension-color@2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))(@tiptap/extension-text-style@2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5)))':
+  '@tiptap/extension-color@2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))(@tiptap/extension-text-style@2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0)))':
     dependencies:
-      '@tiptap/core': 2.6.5(@tiptap/pm@2.6.5)
-      '@tiptap/extension-text-style': 2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))
+      '@tiptap/core': 2.8.0(@tiptap/pm@2.8.0)
+      '@tiptap/extension-text-style': 2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))
 
-  '@tiptap/extension-document@2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))':
+  '@tiptap/extension-document@2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))':
     dependencies:
-      '@tiptap/core': 2.6.5(@tiptap/pm@2.6.5)
+      '@tiptap/core': 2.8.0(@tiptap/pm@2.8.0)
 
-  '@tiptap/extension-dropcursor@2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))(@tiptap/pm@2.6.5)':
+  '@tiptap/extension-dropcursor@2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))(@tiptap/pm@2.8.0)':
     dependencies:
-      '@tiptap/core': 2.6.5(@tiptap/pm@2.6.5)
-      '@tiptap/pm': 2.6.5
+      '@tiptap/core': 2.8.0(@tiptap/pm@2.8.0)
+      '@tiptap/pm': 2.8.0
 
-  '@tiptap/extension-floating-menu@2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))(@tiptap/pm@2.6.5)':
+  '@tiptap/extension-floating-menu@2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))(@tiptap/pm@2.8.0)':
     dependencies:
-      '@tiptap/core': 2.6.5(@tiptap/pm@2.6.5)
-      '@tiptap/pm': 2.6.5
+      '@tiptap/core': 2.8.0(@tiptap/pm@2.8.0)
+      '@tiptap/pm': 2.8.0
       tippy.js: 6.3.7
 
-  '@tiptap/extension-hard-break@2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))':
+  '@tiptap/extension-hard-break@2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))':
     dependencies:
-      '@tiptap/core': 2.6.5(@tiptap/pm@2.6.5)
+      '@tiptap/core': 2.8.0(@tiptap/pm@2.8.0)
 
-  '@tiptap/extension-heading@2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))':
+  '@tiptap/extension-heading@2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))':
     dependencies:
-      '@tiptap/core': 2.6.5(@tiptap/pm@2.6.5)
+      '@tiptap/core': 2.8.0(@tiptap/pm@2.8.0)
 
-  '@tiptap/extension-highlight@2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))':
+  '@tiptap/extension-highlight@2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))':
     dependencies:
-      '@tiptap/core': 2.6.5(@tiptap/pm@2.6.5)
+      '@tiptap/core': 2.8.0(@tiptap/pm@2.8.0)
 
-  '@tiptap/extension-history@2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))(@tiptap/pm@2.6.5)':
+  '@tiptap/extension-history@2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))(@tiptap/pm@2.8.0)':
     dependencies:
-      '@tiptap/core': 2.6.5(@tiptap/pm@2.6.5)
-      '@tiptap/pm': 2.6.5
+      '@tiptap/core': 2.8.0(@tiptap/pm@2.8.0)
+      '@tiptap/pm': 2.8.0
 
-  '@tiptap/extension-horizontal-rule@2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))(@tiptap/pm@2.6.5)':
+  '@tiptap/extension-horizontal-rule@2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))(@tiptap/pm@2.8.0)':
     dependencies:
-      '@tiptap/core': 2.6.5(@tiptap/pm@2.6.5)
-      '@tiptap/pm': 2.6.5
+      '@tiptap/core': 2.8.0(@tiptap/pm@2.8.0)
+      '@tiptap/pm': 2.8.0
 
-  '@tiptap/extension-image@2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))':
+  '@tiptap/extension-image@2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))':
     dependencies:
-      '@tiptap/core': 2.6.5(@tiptap/pm@2.6.5)
+      '@tiptap/core': 2.8.0(@tiptap/pm@2.8.0)
 
-  '@tiptap/extension-italic@2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))':
+  '@tiptap/extension-italic@2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))':
     dependencies:
-      '@tiptap/core': 2.6.5(@tiptap/pm@2.6.5)
+      '@tiptap/core': 2.8.0(@tiptap/pm@2.8.0)
 
-  '@tiptap/extension-link@2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))(@tiptap/pm@2.6.5)':
+  '@tiptap/extension-link@2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))(@tiptap/pm@2.8.0)':
     dependencies:
-      '@tiptap/core': 2.6.5(@tiptap/pm@2.6.5)
-      '@tiptap/pm': 2.6.5
+      '@tiptap/core': 2.8.0(@tiptap/pm@2.8.0)
+      '@tiptap/pm': 2.8.0
       linkifyjs: 4.1.3
 
-  '@tiptap/extension-list-item@2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))':
+  '@tiptap/extension-list-item@2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))':
     dependencies:
-      '@tiptap/core': 2.6.5(@tiptap/pm@2.6.5)
+      '@tiptap/core': 2.8.0(@tiptap/pm@2.8.0)
 
-  '@tiptap/extension-list-keymap@2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))':
+  '@tiptap/extension-list-keymap@2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))':
     dependencies:
-      '@tiptap/core': 2.6.5(@tiptap/pm@2.6.5)
+      '@tiptap/core': 2.8.0(@tiptap/pm@2.8.0)
 
-  '@tiptap/extension-ordered-list@2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))':
+  '@tiptap/extension-ordered-list@2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))(@tiptap/extension-list-item@2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0)))(@tiptap/extension-text-style@2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0)))':
     dependencies:
-      '@tiptap/core': 2.6.5(@tiptap/pm@2.6.5)
+      '@tiptap/core': 2.8.0(@tiptap/pm@2.8.0)
+      '@tiptap/extension-list-item': 2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))
+      '@tiptap/extension-text-style': 2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))
 
-  '@tiptap/extension-paragraph@2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))':
+  '@tiptap/extension-paragraph@2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))':
     dependencies:
-      '@tiptap/core': 2.6.5(@tiptap/pm@2.6.5)
+      '@tiptap/core': 2.8.0(@tiptap/pm@2.8.0)
 
-  '@tiptap/extension-placeholder@2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))(@tiptap/pm@2.6.5)':
+  '@tiptap/extension-placeholder@2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))(@tiptap/pm@2.8.0)':
     dependencies:
-      '@tiptap/core': 2.6.5(@tiptap/pm@2.6.5)
-      '@tiptap/pm': 2.6.5
+      '@tiptap/core': 2.8.0(@tiptap/pm@2.8.0)
+      '@tiptap/pm': 2.8.0
 
-  '@tiptap/extension-strike@2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))':
+  '@tiptap/extension-strike@2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))':
     dependencies:
-      '@tiptap/core': 2.6.5(@tiptap/pm@2.6.5)
+      '@tiptap/core': 2.8.0(@tiptap/pm@2.8.0)
 
-  '@tiptap/extension-subscript@2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))':
+  '@tiptap/extension-subscript@2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))':
     dependencies:
-      '@tiptap/core': 2.6.5(@tiptap/pm@2.6.5)
+      '@tiptap/core': 2.8.0(@tiptap/pm@2.8.0)
 
-  '@tiptap/extension-superscript@2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))':
+  '@tiptap/extension-superscript@2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))':
     dependencies:
-      '@tiptap/core': 2.6.5(@tiptap/pm@2.6.5)
+      '@tiptap/core': 2.8.0(@tiptap/pm@2.8.0)
 
-  '@tiptap/extension-table-row@2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))':
+  '@tiptap/extension-table-row@2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))':
     dependencies:
-      '@tiptap/core': 2.6.5(@tiptap/pm@2.6.5)
+      '@tiptap/core': 2.8.0(@tiptap/pm@2.8.0)
 
-  '@tiptap/extension-table@2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))(@tiptap/pm@2.6.5)':
+  '@tiptap/extension-table@2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))(@tiptap/pm@2.8.0)':
     dependencies:
-      '@tiptap/core': 2.6.5(@tiptap/pm@2.6.5)
-      '@tiptap/pm': 2.6.5
+      '@tiptap/core': 2.8.0(@tiptap/pm@2.8.0)
+      '@tiptap/pm': 2.8.0
 
-  '@tiptap/extension-task-item@2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))(@tiptap/pm@2.6.5)':
+  '@tiptap/extension-task-item@2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))(@tiptap/pm@2.8.0)':
     dependencies:
-      '@tiptap/core': 2.6.5(@tiptap/pm@2.6.5)
-      '@tiptap/pm': 2.6.5
+      '@tiptap/core': 2.8.0(@tiptap/pm@2.8.0)
+      '@tiptap/pm': 2.8.0
 
-  '@tiptap/extension-task-list@2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))':
+  '@tiptap/extension-task-list@2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))':
     dependencies:
-      '@tiptap/core': 2.6.5(@tiptap/pm@2.6.5)
+      '@tiptap/core': 2.8.0(@tiptap/pm@2.8.0)
 
-  '@tiptap/extension-text-align@2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))':
+  '@tiptap/extension-text-align@2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))':
     dependencies:
-      '@tiptap/core': 2.6.5(@tiptap/pm@2.6.5)
+      '@tiptap/core': 2.8.0(@tiptap/pm@2.8.0)
 
-  '@tiptap/extension-text-style@2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))':
+  '@tiptap/extension-text-style@2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))':
     dependencies:
-      '@tiptap/core': 2.6.5(@tiptap/pm@2.6.5)
+      '@tiptap/core': 2.8.0(@tiptap/pm@2.8.0)
 
-  '@tiptap/extension-text@2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))':
+  '@tiptap/extension-text@2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))':
     dependencies:
-      '@tiptap/core': 2.6.5(@tiptap/pm@2.6.5)
+      '@tiptap/core': 2.8.0(@tiptap/pm@2.8.0)
 
-  '@tiptap/extension-underline@2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))':
+  '@tiptap/extension-underline@2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))':
     dependencies:
-      '@tiptap/core': 2.6.5(@tiptap/pm@2.6.5)
+      '@tiptap/core': 2.8.0(@tiptap/pm@2.8.0)
 
-  '@tiptap/pm@2.6.5':
+  '@tiptap/pm@2.8.0':
     dependencies:
       prosemirror-changeset: 2.2.1
       prosemirror-collab: 1.3.1
-      prosemirror-commands: 1.5.2
+      prosemirror-commands: 1.6.0
       prosemirror-dropcursor: 1.8.1
       prosemirror-gapcursor: 1.3.2
       prosemirror-history: 1.4.1
@@ -14693,26 +14701,26 @@ snapshots:
       prosemirror-keymap: 1.2.2
       prosemirror-markdown: 1.13.0
       prosemirror-menu: 1.2.4
-      prosemirror-model: 1.22.2
+      prosemirror-model: 1.23.0
       prosemirror-schema-basic: 1.2.3
       prosemirror-schema-list: 1.4.1
       prosemirror-state: 1.4.3
       prosemirror-tables: 1.4.0
-      prosemirror-trailing-node: 2.0.9(prosemirror-model@1.22.2)(prosemirror-state@1.4.3)(prosemirror-view@1.33.9)
-      prosemirror-transform: 1.9.0
-      prosemirror-view: 1.33.9
+      prosemirror-trailing-node: 3.0.0(prosemirror-model@1.23.0)(prosemirror-state@1.4.3)(prosemirror-view@1.34.3)
+      prosemirror-transform: 1.10.0
+      prosemirror-view: 1.34.3
 
-  '@tiptap/suggestion@2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))(@tiptap/pm@2.6.5)':
+  '@tiptap/suggestion@2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))(@tiptap/pm@2.8.0)':
     dependencies:
-      '@tiptap/core': 2.6.5(@tiptap/pm@2.6.5)
-      '@tiptap/pm': 2.6.5
+      '@tiptap/core': 2.8.0(@tiptap/pm@2.8.0)
+      '@tiptap/pm': 2.8.0
 
-  '@tiptap/vue-3@2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))(@tiptap/pm@2.6.5)(vue@3.5.11(typescript@5.6.2))':
+  '@tiptap/vue-3@2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))(@tiptap/pm@2.8.0)(vue@3.5.11(typescript@5.6.2))':
     dependencies:
-      '@tiptap/core': 2.6.5(@tiptap/pm@2.6.5)
-      '@tiptap/extension-bubble-menu': 2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))(@tiptap/pm@2.6.5)
-      '@tiptap/extension-floating-menu': 2.6.5(@tiptap/core@2.6.5(@tiptap/pm@2.6.5))(@tiptap/pm@2.6.5)
-      '@tiptap/pm': 2.6.5
+      '@tiptap/core': 2.8.0(@tiptap/pm@2.8.0)
+      '@tiptap/extension-bubble-menu': 2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))(@tiptap/pm@2.8.0)
+      '@tiptap/extension-floating-menu': 2.8.0(@tiptap/core@2.8.0(@tiptap/pm@2.8.0))(@tiptap/pm@2.8.0)
+      '@tiptap/pm': 2.8.0
       vue: 3.5.11(typescript@5.6.2)
 
   '@tootallnate/once@2.0.0': {}
@@ -19943,42 +19951,42 @@ snapshots:
 
   prosemirror-changeset@2.2.1:
     dependencies:
-      prosemirror-transform: 1.9.0
+      prosemirror-transform: 1.10.0
 
   prosemirror-collab@1.3.1:
     dependencies:
       prosemirror-state: 1.4.3
 
-  prosemirror-commands@1.5.2:
+  prosemirror-commands@1.6.0:
     dependencies:
-      prosemirror-model: 1.22.2
+      prosemirror-model: 1.23.0
       prosemirror-state: 1.4.3
-      prosemirror-transform: 1.9.0
+      prosemirror-transform: 1.10.0
 
   prosemirror-dropcursor@1.8.1:
     dependencies:
       prosemirror-state: 1.4.3
-      prosemirror-transform: 1.9.0
-      prosemirror-view: 1.33.9
+      prosemirror-transform: 1.10.0
+      prosemirror-view: 1.34.3
 
   prosemirror-gapcursor@1.3.2:
     dependencies:
       prosemirror-keymap: 1.2.2
-      prosemirror-model: 1.22.2
+      prosemirror-model: 1.23.0
       prosemirror-state: 1.4.3
-      prosemirror-view: 1.33.9
+      prosemirror-view: 1.34.3
 
   prosemirror-history@1.4.1:
     dependencies:
       prosemirror-state: 1.4.3
-      prosemirror-transform: 1.9.0
-      prosemirror-view: 1.33.9
+      prosemirror-transform: 1.10.0
+      prosemirror-view: 1.34.3
       rope-sequence: 1.3.3
 
   prosemirror-inputrules@1.4.0:
     dependencies:
       prosemirror-state: 1.4.3
-      prosemirror-transform: 1.9.0
+      prosemirror-transform: 1.10.0
 
   prosemirror-keymap@1.2.2:
     dependencies:
@@ -19988,60 +19996,60 @@ snapshots:
   prosemirror-markdown@1.13.0:
     dependencies:
       markdown-it: 14.0.0
-      prosemirror-model: 1.22.2
+      prosemirror-model: 1.23.0
 
   prosemirror-menu@1.2.4:
     dependencies:
       crelt: 1.0.5
-      prosemirror-commands: 1.5.2
+      prosemirror-commands: 1.6.0
       prosemirror-history: 1.4.1
       prosemirror-state: 1.4.3
 
-  prosemirror-model@1.22.2:
+  prosemirror-model@1.23.0:
     dependencies:
       orderedmap: 2.1.0
 
   prosemirror-schema-basic@1.2.3:
     dependencies:
-      prosemirror-model: 1.22.2
+      prosemirror-model: 1.23.0
 
   prosemirror-schema-list@1.4.1:
     dependencies:
-      prosemirror-model: 1.22.2
+      prosemirror-model: 1.23.0
       prosemirror-state: 1.4.3
-      prosemirror-transform: 1.9.0
+      prosemirror-transform: 1.10.0
 
   prosemirror-state@1.4.3:
     dependencies:
-      prosemirror-model: 1.22.2
-      prosemirror-transform: 1.9.0
-      prosemirror-view: 1.33.9
+      prosemirror-model: 1.23.0
+      prosemirror-transform: 1.10.0
+      prosemirror-view: 1.34.3
 
   prosemirror-tables@1.4.0:
     dependencies:
       prosemirror-keymap: 1.2.2
-      prosemirror-model: 1.22.2
+      prosemirror-model: 1.23.0
       prosemirror-state: 1.4.3
-      prosemirror-transform: 1.9.0
-      prosemirror-view: 1.33.9
+      prosemirror-transform: 1.10.0
+      prosemirror-view: 1.34.3
 
-  prosemirror-trailing-node@2.0.9(prosemirror-model@1.22.2)(prosemirror-state@1.4.3)(prosemirror-view@1.33.9):
+  prosemirror-trailing-node@3.0.0(prosemirror-model@1.23.0)(prosemirror-state@1.4.3)(prosemirror-view@1.34.3):
     dependencies:
-      '@remirror/core-constants': 2.0.2
+      '@remirror/core-constants': 3.0.0
       escape-string-regexp: 4.0.0
-      prosemirror-model: 1.22.2
+      prosemirror-model: 1.23.0
       prosemirror-state: 1.4.3
-      prosemirror-view: 1.33.9
+      prosemirror-view: 1.34.3
 
-  prosemirror-transform@1.9.0:
+  prosemirror-transform@1.10.0:
     dependencies:
-      prosemirror-model: 1.22.2
+      prosemirror-model: 1.23.0
 
-  prosemirror-view@1.33.9:
+  prosemirror-view@1.34.3:
     dependencies:
-      prosemirror-model: 1.22.2
+      prosemirror-model: 1.23.0
       prosemirror-state: 1.4.3
-      prosemirror-transform: 1.9.0
+      prosemirror-transform: 1.10.0
 
   proto-list@1.2.4: {}
 
diff --git a/ui/src/components/editor/extensions/image/ImageView.vue b/ui/src/components/editor/extensions/image/ImageView.vue
index d69069d758..4654ea409d 100644
--- a/ui/src/components/editor/extensions/image/ImageView.vue
+++ b/ui/src/components/editor/extensions/image/ImageView.vue
@@ -1,11 +1,6 @@
 <script lang="ts" setup>
 import { IconImageAddLine, VButton } from "@halo-dev/components";
-import {
-  Editor,
-  type Decoration,
-  type Node,
-  type PMNode,
-} from "@halo-dev/richtext-editor";
+import { type NodeViewProps } from "@halo-dev/richtext-editor";
 import { computed, onMounted, ref } from "vue";
 import { EditorLinkObtain } from "../../components";
 import InlineBlockBox from "../../components/InlineBlockBox.vue";
@@ -13,16 +8,7 @@ import { type AttachmentAttr } from "../../utils/attachment";
 import { fileToBase64 } from "../../utils/upload";
 import Image from "./index";
 
-const props = defineProps<{
-  editor: Editor;
-  node: PMNode;
-  decorations: Decoration[];
-  selected: boolean;
-  extension: Node;
-  getPos: () => number;
-  updateAttributes: (attributes: Record<string, unknown>) => void;
-  deleteNode: () => void;
-}>();
+const props = defineProps<NodeViewProps>();
 
 const src = computed({
   get: () => {
diff --git a/ui/src/components/editor/extensions/video/VideoView.vue b/ui/src/components/editor/extensions/video/VideoView.vue
index 6480650ae2..cb2214417d 100644
--- a/ui/src/components/editor/extensions/video/VideoView.vue
+++ b/ui/src/components/editor/extensions/video/VideoView.vue
@@ -1,11 +1,6 @@
 <script lang="ts" setup>
 import { VButton } from "@halo-dev/components";
-import type {
-  Decoration,
-  Editor,
-  Node,
-  PMNode,
-} from "@halo-dev/richtext-editor";
+import type { NodeViewProps } from "@halo-dev/richtext-editor";
 import { computed, ref } from "vue";
 import RiVideoAddLine from "~icons/ri/video-add-line";
 import { EditorLinkObtain } from "../../components";
@@ -13,16 +8,7 @@ import InlineBlockBox from "../../components/InlineBlockBox.vue";
 import type { AttachmentAttr } from "../../utils/attachment";
 import Video from "./index";
 
-const props = defineProps<{
-  editor: Editor;
-  node: PMNode;
-  decorations: Decoration[];
-  selected: boolean;
-  extension: Node;
-  getPos: () => number;
-  updateAttributes: (attributes: Record<string, unknown>) => void;
-  deleteNode: () => void;
-}>();
+const props = defineProps<NodeViewProps>();
 
 const src = computed({
   get: () => {

From 04e195f034913b9015be894d8fce4aa46e11675b Mon Sep 17 00:00:00 2001
From: guqing <38999863+guqing@users.noreply.github.com>
Date: Mon, 7 Oct 2024 17:20:50 +0800
Subject: [PATCH 083/185] fix: unique index conflict issue after backup
 restoration preventing startup (#6701)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?
/kind bug
/area core
/milestone 2.20.x
/sig docs

#### What this PR does / why we need it:
修复恢复备份后可能会因为与之前的数据冲突导致无法启动的问题

如果恢复时发生不可预知的错误,需要重启之后重新初始化再进行恢复

#### Which issue(s) this PR fixes:
Fixes #6672

#### Does this PR introduce a user-facing change?
```release-note
修复恢复备份后可能会因为与恢复之前存在的数据冲突导致无法启动的问题
```
---
 .../migration/impl/MigrationServiceImpl.java  | 19 +++++++++++--------
 .../impl/MigrationServiceImplTest.java        |  4 ++--
 .../modules/system/backup/tabs/Restore.vue    |  4 +++-
 .../src/components/dialog/Dialog.vue          |  2 +-
 ui/src/locales/en.yaml                        |  6 ++----
 ui/src/locales/zh-CN.yaml                     |  4 ++--
 ui/src/locales/zh-TW.yaml                     |  4 ++--
 7 files changed, 23 insertions(+), 20 deletions(-)

diff --git a/application/src/main/java/run/halo/app/migration/impl/MigrationServiceImpl.java b/application/src/main/java/run/halo/app/migration/impl/MigrationServiceImpl.java
index 1d99e64d80..a699a39cbd 100644
--- a/application/src/main/java/run/halo/app/migration/impl/MigrationServiceImpl.java
+++ b/application/src/main/java/run/halo/app/migration/impl/MigrationServiceImpl.java
@@ -141,7 +141,14 @@ public Mono<Void> restore(Publisher<DataBuffer> content) {
         return Mono.usingWhen(
             createTempDir("halo-restore-", scheduler),
             tempDir -> unpackBackup(content, tempDir)
-                .then(Mono.defer(() -> restoreExtensions(tempDir)))
+                .then(Mono.defer(() ->
+                    // This step skips index verification such as unique index.
+                    // In order to avoid index conflicts after recovery or
+                    // OptimisticLockingFailureException when updating the same record,
+                    // so we need to truncate all extension stores before saving(create or update).
+                    repository.deleteAll()
+                        .then(restoreExtensions(tempDir)))
+                )
                 .then(Mono.defer(() -> restoreWorkdir(tempDir))),
             tempDir -> deleteRecursivelyAndSilently(tempDir, scheduler)
         );
@@ -241,13 +248,9 @@ private Mono<Void> restoreExtensions(Path backupRoot) {
                             sink.complete();
                         })
                     // reset version
-                    .doOnNext(extensionStore -> extensionStore.setVersion(null)).buffer(100)
-                    // We might encounter OptimisticLockingFailureException when saving extension
-                    // store,
-                    // So we have to delete all extension stores before saving.
-                    .flatMap(extensionStores -> repository.deleteAll(extensionStores)
-                        .thenMany(repository.saveAll(extensionStores))
-                    )
+                    .doOnNext(extensionStore -> extensionStore.setVersion(null))
+                    .buffer(100)
+                    .flatMap(repository::saveAll)
                     .doOnNext(extensionStore -> log.info("Restored extension store: {}",
                         extensionStore.getName()))
                     .then(),
diff --git a/application/src/test/java/run/halo/app/migration/impl/MigrationServiceImplTest.java b/application/src/test/java/run/halo/app/migration/impl/MigrationServiceImplTest.java
index e515e02c65..0d65e0134e 100644
--- a/application/src/test/java/run/halo/app/migration/impl/MigrationServiceImplTest.java
+++ b/application/src/test/java/run/halo/app/migration/impl/MigrationServiceImplTest.java
@@ -120,7 +120,7 @@ void restoreTest() throws IOException, URISyntaxException {
         expectStore.setVersion(null);
 
         when(haloProperties.getWorkDir()).thenReturn(workdir);
-        when(repository.deleteAll(List.of(expectStore))).thenReturn(Mono.empty());
+        when(repository.deleteAll()).thenReturn(Mono.empty());
         when(repository.saveAll(List.of(expectStore))).thenReturn(Flux.empty());
 
         var content = DataBufferUtils.read(backupFile,
@@ -132,7 +132,7 @@ void restoreTest() throws IOException, URISyntaxException {
 
 
         verify(haloProperties).getWorkDir();
-        verify(repository).deleteAll(List.of(expectStore));
+        verify(repository).deleteAll();
         verify(repository).saveAll(List.of(expectStore));
 
         // make sure the workdir is recovered.
diff --git a/ui/console-src/modules/system/backup/tabs/Restore.vue b/ui/console-src/modules/system/backup/tabs/Restore.vue
index 6a0f940c7c..a071a62a12 100644
--- a/ui/console-src/modules/system/backup/tabs/Restore.vue
+++ b/ui/console-src/modules/system/backup/tabs/Restore.vue
@@ -114,7 +114,9 @@ useQuery({
           <ul>
             <li>{{ $t("core.backup.restore.tips.first") }}</li>
             <li>
-              {{ $t("core.backup.restore.tips.second") }}
+              <strong>
+                {{ $t("core.backup.restore.tips.second") }}
+              </strong>
             </li>
             <li>
               {{ $t("core.backup.restore.tips.third") }}
diff --git a/ui/packages/components/src/components/dialog/Dialog.vue b/ui/packages/components/src/components/dialog/Dialog.vue
index 8a5cb7cbbb..26abc23002 100644
--- a/ui/packages/components/src/components/dialog/Dialog.vue
+++ b/ui/packages/components/src/components/dialog/Dialog.vue
@@ -86,7 +86,7 @@ const handleClose = () => {
   <VModal
     :visible="visible"
     :width="450"
-    :layer-closable="true"
+    :layer-closable="false"
     :data-unique-id="uniqueId"
     @close="handleCancel()"
   >
diff --git a/ui/src/locales/en.yaml b/ui/src/locales/en.yaml
index fd355ec4c8..9a2d4c5886 100644
--- a/ui/src/locales/en.yaml
+++ b/ui/src/locales/en.yaml
@@ -1402,14 +1402,12 @@ core:
         first: >-
           1. The restore process may last for a long time, please do not refresh
           the page during this period.
-        second: >-
-          2. During the restore process, although the existing data will not be
-          cleaned up, if there is a conflict, the data will be overwritten.
+        second: 2. Before performing the restore, all existing data will be cleared. Please ensure that there is no data that needs to be retained.
         third: >-
           3. After the restore is completed, you need to restart Halo to load
           the system resources normally.
         complete: Restore completed, waiting for restart...
-      start: Start restore
+      start: I have read the above instructions, start restore
       tabs:
         local:
           label: Upload
diff --git a/ui/src/locales/zh-CN.yaml b/ui/src/locales/zh-CN.yaml
index 127aa5021e..2b7050c93c 100644
--- a/ui/src/locales/zh-CN.yaml
+++ b/ui/src/locales/zh-CN.yaml
@@ -1302,10 +1302,10 @@ core:
     restore:
       tips:
         first: 1. 恢复过程可能会持续较长时间，期间请勿刷新页面。
-        second: 2. 在恢复的过程中，虽然已有的数据不会被清理掉，但如果有冲突的数据将被覆盖。
+        second: 2. 在执行恢复之前，会清空现有的所有数据，请确保当前没有需要保留的数据。
         third: 3. 恢复完成之后需要重启 Halo 才能够正常加载系统资源。
         complete: 恢复完成，等待重启...
-      start: 开始恢复
+      start: 我已阅读上方提示，开始恢复
       tabs:
         local:
           label: 上传
diff --git a/ui/src/locales/zh-TW.yaml b/ui/src/locales/zh-TW.yaml
index c4315abbd0..fbaef66176 100644
--- a/ui/src/locales/zh-TW.yaml
+++ b/ui/src/locales/zh-TW.yaml
@@ -1281,10 +1281,10 @@ core:
     restore:
       tips:
         first: 1. 還原過程可能需要較長時間，期間請勿重新整理頁面。
-        second: 2. 在還原過程中，雖然已有的資料不會被清除，但若有衝突的資料將被覆蓋。
+        second: 2. 在執行恢復之前，會清空現有的所有數據，請確保當前沒有需要保留的數據。
         third: 3. 還原完成後需要重新啟動 Halo 才能正常載入系統資源。
         complete: 還原完成，等待重啟...
-      start: 開始還原
+      start: 我已閱讀上方提示，開始恢復
       tabs:
         local:
           label: 上傳

From 709884212abe2e149b8d1a3e329617f6fe5d949b Mon Sep 17 00:00:00 2001
From: Ryan Wang <i@ryanc.cc>
Date: Mon, 7 Oct 2024 17:28:51 +0800
Subject: [PATCH 084/185] refactor: login-related page templates structure
 (#6769)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/area core
/kind improvement
/milestone 2.20.x

#### What this PR does / why we need it:

Fixes https://github.com/halo-dev/halo/issues/6760

重构登录、注册、找回密码、两步验证等模板的结构，提供更好的复用性，现在主题可以这样复用模板：

login.html

```html
<form th:replace="~{gateway_modules/form_fragments::login}"></form>
```

signup.html

```html
<form th:replace="~{gateway_modules/form_fragments::signup}"></form>
```

challenges/two-factor/totp.html

```html
<form th:replace="~{gateway_modules/form_fragments::totp}"></form>
```

#### Special notes for your reviewer:

需要测试各个页面是否功能正常

#### Does this PR introduce a user-facing change?

```release-note
None
```
---
 .../templates/challenges/two-factor/totp.html |  30 +-
 .../challenges/two-factor/totp.properties     |   3 -
 .../challenges/two-factor/totp_en.properties  |   3 -
 .../challenges/two-factor/totp_es.properties  |   3 -
 .../two-factor/totp_zh_TW.properties          |   3 -
 .../gateway_modules/common_fragments.html     |  13 +-
 .../gateway_modules/form_fragments.html       | 291 ++++++++++++++++++
 .../gateway_modules/form_fragments.properties |  36 +++
 .../form_fragments_en.properties              |  36 +++
 .../form_fragments_es.properties              |  36 +++
 .../form_fragments_zh_TW.properties           |  36 +++
 .../gateway_modules/login_fragments.html      |  40 +--
 .../login_fragments.properties                |  10 -
 .../login_fragments_en.properties             |  10 -
 .../login_fragments_es.properties             |  11 +-
 .../login_fragments_zh_TW.properties          |  10 +-
 .../src/main/resources/templates/login.html   |   4 +-
 .../main/resources/templates/login_email.html |  37 ---
 .../src/main/resources/templates/logout.html  |   8 +-
 .../resources/templates/logout.properties     |   3 +-
 .../resources/templates/logout_en.properties  |   3 +-
 .../resources/templates/logout_es.properties  |   3 +-
 .../templates/logout_zh_TW.properties         |   3 +-
 .../templates/password-reset-link.html        |  27 +-
 .../templates/password-reset-link.properties  |   4 -
 .../password-reset-link_en.properties         |   4 -
 .../password-reset-link_es.properties         |   4 -
 .../password-reset-link_zh_TW.properties      |   4 -
 .../resources/templates/password-reset.html   |  23 +-
 .../templates/password-reset.properties       |   4 -
 .../templates/password-reset_en.properties    |   4 -
 .../templates/password-reset_es.properties    |   6 +-
 .../templates/password-reset_zh_TW.properties |   6 +-
 .../src/main/resources/templates/signup.html  | 190 +-----------
 .../resources/templates/signup.properties     |  15 +-
 .../resources/templates/signup_en.properties  |  15 +-
 .../resources/templates/signup_es.properties  |  15 +-
 .../templates/signup_zh_TW.properties         |  15 +-
 38 files changed, 466 insertions(+), 502 deletions(-)
 create mode 100644 application/src/main/resources/templates/gateway_modules/form_fragments.html
 create mode 100644 application/src/main/resources/templates/gateway_modules/form_fragments.properties
 create mode 100644 application/src/main/resources/templates/gateway_modules/form_fragments_en.properties
 create mode 100644 application/src/main/resources/templates/gateway_modules/form_fragments_es.properties
 create mode 100644 application/src/main/resources/templates/gateway_modules/form_fragments_zh_TW.properties
 delete mode 100644 application/src/main/resources/templates/login_email.html

diff --git a/application/src/main/resources/templates/challenges/two-factor/totp.html b/application/src/main/resources/templates/challenges/two-factor/totp.html
index 96baa8d8c2..7b02af8ab1 100644
--- a/application/src/main/resources/templates/challenges/two-factor/totp.html
+++ b/application/src/main/resources/templates/challenges/two-factor/totp.html
@@ -8,35 +8,7 @@
             <div th:replace="~{gateway_modules/common_fragments::haloLogo}"></div>
             <div class="halo-form-wrapper">
                 <h1 class="form-title" th:text="#{title}"></h1>
-                <form
-                    class="halo-form"
-                    th:action="@{/challenges/two-factor/totp}"
-                    name="two-factor-form"
-                    id="two-factor-form"
-                    method="post"
-                >
-                    <div class="alert alert-error" role="alert" th:if="${param.error.size() > 0}">
-                        <strong th:text="#{messages.invalidError}"></strong>
-                    </div>
-                    <div class="form-item">
-                        <label for="code" th:text="#{form.code.label}"></label>
-                        <div class="form-input">
-                            <input
-                                type="text"
-                                inputmode="numeric"
-                                id="code"
-                                name="code"
-                                autocomplete="one-time-code"
-                                pattern="\d{6}"
-                                autofocus
-                                required
-                            />
-                        </div>
-                    </div>
-                    <div class="form-item">
-                        <button type="submit" th:text="#{form.submit}"></button>
-                    </div>
-                </form>
+                <form th:replace="~{gateway_modules/form_fragments::totp}"></form>
             </div>
         </div>
     </th:block>
diff --git a/application/src/main/resources/templates/challenges/two-factor/totp.properties b/application/src/main/resources/templates/challenges/two-factor/totp.properties
index dfea51a906..1b02e431c6 100644
--- a/application/src/main/resources/templates/challenges/two-factor/totp.properties
+++ b/application/src/main/resources/templates/challenges/two-factor/totp.properties
@@ -1,4 +1 @@
 title=两步验证
-messages.invalidError=错误的验证码
-form.code.label=验证码
-form.submit=验证
\ No newline at end of file
diff --git a/application/src/main/resources/templates/challenges/two-factor/totp_en.properties b/application/src/main/resources/templates/challenges/two-factor/totp_en.properties
index bffc96863a..65a92c2045 100644
--- a/application/src/main/resources/templates/challenges/two-factor/totp_en.properties
+++ b/application/src/main/resources/templates/challenges/two-factor/totp_en.properties
@@ -1,4 +1 @@
 title=Two-Factor Authentication
-messages.invalidError=Invalid TOTP code
-form.code.label=TOTP Code
-form.submit=Verify
diff --git a/application/src/main/resources/templates/challenges/two-factor/totp_es.properties b/application/src/main/resources/templates/challenges/two-factor/totp_es.properties
index 43e5e25e1c..0f0517887c 100644
--- a/application/src/main/resources/templates/challenges/two-factor/totp_es.properties
+++ b/application/src/main/resources/templates/challenges/two-factor/totp_es.properties
@@ -1,4 +1 @@
 title=Autenticación en Dos Pasos
-messages.invalidError=Código de verificación incorrecto
-form.code.label=Código de Verificación
-form.submit=Verificar
\ No newline at end of file
diff --git a/application/src/main/resources/templates/challenges/two-factor/totp_zh_TW.properties b/application/src/main/resources/templates/challenges/two-factor/totp_zh_TW.properties
index a2be3bc9c4..8b8ac41202 100644
--- a/application/src/main/resources/templates/challenges/two-factor/totp_zh_TW.properties
+++ b/application/src/main/resources/templates/challenges/two-factor/totp_zh_TW.properties
@@ -1,4 +1 @@
 title=兩步驗證
-messages.invalidError=錯誤的驗證碼
-form.code.label=驗證碼
-form.submit=驗證
diff --git a/application/src/main/resources/templates/gateway_modules/common_fragments.html b/application/src/main/resources/templates/gateway_modules/common_fragments.html
index 78885a91f9..6ce5f4a414 100644
--- a/application/src/main/resources/templates/gateway_modules/common_fragments.html
+++ b/application/src/main/resources/templates/gateway_modules/common_fragments.html
@@ -1,7 +1,9 @@
 <th:block th:fragment="basicStaticResources">
-    <link rel="stylesheet" href="/webjars/normalize.css/8.0.1/normalize.css" />
-    <link rel="stylesheet" th:href="|/styles/main.css?v=${site.version}|" />
+    <th:block th:replace="~{gateway_modules/common_fragments::basicStyleResources}"></th:block>
+    <th:block th:replace="~{gateway_modules/common_fragments::basicScriptResources}"></th:block>
+</th:block>
 
+<th:block th:fragment="basicScriptResources">
     <script th:inline="javascript">
         const i18nResources = {
             sendVerificationCodeSuccess: `[(#{js.sendVerificationCode.success})]`,
@@ -12,6 +14,11 @@
     <script src="/js/main.js"></script>
 </th:block>
 
+<th:block th:fragment="basicStyleResources">
+    <link rel="stylesheet" href="/webjars/normalize.css/8.0.1/normalize.css" />
+    <link rel="stylesheet" th:href="|/styles/main.css?v=${site.version}|" />
+</th:block>
+
 <div th:remove="tag" th:fragment="languageSwitcher">
     <style>
         .language-switcher {
@@ -111,4 +118,4 @@
             </li>
         </ul>
     </th:block>
-</div>
\ No newline at end of file
+</div>
diff --git a/application/src/main/resources/templates/gateway_modules/form_fragments.html b/application/src/main/resources/templates/gateway_modules/form_fragments.html
new file mode 100644
index 0000000000..1a80002818
--- /dev/null
+++ b/application/src/main/resources/templates/gateway_modules/form_fragments.html
@@ -0,0 +1,291 @@
+<form
+    th:fragment="login"
+    class="halo-form"
+    name="login-form"
+    id="login-form"
+    th:action="${authProvider.spec.authenticationUrl}"
+    th:method="${authProvider.spec.method}"
+>
+    <div class="alert alert-error" role="alert" th:if="${param.error.size() > 0}" th:with="error = ${param.error[0]}">
+        <strong th:if="${error == 'invalid-credential'}">
+            <span th:text="#{form.login.error.invalidCredential}"></span>
+        </strong>
+        <strong th:if="${error == 'rate-limit-exceeded'}">
+            <span th:text="#{form.login.error.rateLimitExceeded}"></span>
+        </strong>
+    </div>
+    <div class="alert" role="alert" th:if="${param.logout.size() > 0}">
+        <strong th:text="#{form.login.messages.logoutSuccess}"></strong>
+    </div>
+    <div class="alert" role="alert" th:if="${param.signup.size() > 0}">
+        <strong th:text="#{form.login.messages.signupSuccess}"></strong>
+    </div>
+    <div class="alert" role="alert" th:if="${param.oauth2_bind.size() > 0}">
+        <strong th:text="#{form.login.messages.oauth2Bind}"></strong>
+    </div>
+
+    <div th:replace="~{__${fragmentTemplateName}__::form}"></div>
+
+    <div th:if="${authProvider.spec.rememberMeSupport}" class="form-item-compact">
+        <input type="checkbox" id="remember-me" name="remember-me" value="true" />
+        <label for="remember-me" th:text="#{form.login.rememberMe.label}"></label>
+    </div>
+
+    <div class="form-item">
+        <button type="submit" th:text="#{form.login.submit}"></button>
+    </div>
+</form>
+
+<form
+    th:fragment="signup"
+    class="halo-form"
+    name="signup-form"
+    id="signup-form"
+    th:action="@{/signup}"
+    th:object="${form}"
+    method="post"
+>
+    <div class="alert alert-error" role="alert" th:if="${error == 'invalid-email-code'}">
+        <strong>
+            <span th:text="#{form.signup.error.invalidEmailCode}"></span>
+        </strong>
+    </div>
+    <div class="alert alert-error" role="alert" th:if="${error == 'rate-limit-exceeded'}">
+        <strong>
+            <span th:text="#{form.signup.error.rateLimitExceeded}"></span>
+        </strong>
+    </div>
+    <div class="alert alert-error" role="alert" th:if="${error == 'duplicate-name'}">
+        <strong>
+            <span th:text="#{form.signup.error.duplicateName}"></span>
+        </strong>
+    </div>
+    <div class="form-item-group">
+        <div class="form-item">
+            <label for="username" th:text="#{form.signup.username.label}"></label>
+            <div class="form-input">
+                <input
+                    type="text"
+                    id="username"
+                    name="username"
+                    autocomplete="off"
+                    spellcheck="false"
+                    autocorrect="off"
+                    autocapitalize="off"
+                    autofocus
+                    required
+                    th:field="*{username}"
+                />
+            </div>
+            <p class="alert alert-error" th:if="${#fields.hasErrors('username')}" th:errors="*{username}"></p>
+        </div>
+
+        <div class="form-item">
+            <label for="displayName" th:text="#{form.signup.displayName.label}"></label>
+            <div class="form-input">
+                <input
+                    type="text"
+                    id="displayName"
+                    name="displayName"
+                    autocomplete="off"
+                    spellcheck="false"
+                    autocorrect="off"
+                    autocapitalize="off"
+                    required
+                    th:field="*{displayName}"
+                />
+            </div>
+            <p class="alert alert-error" th:if="${#fields.hasErrors('displayName')}" th:errors="*{displayName}"></p>
+        </div>
+    </div>
+
+    <div class="form-item-group">
+        <div class="form-item">
+            <label for="email" th:text="#{form.signup.email.label}"></label>
+            <div class="form-input">
+                <input
+                    type="email"
+                    id="email"
+                    name="email"
+                    autocomplete="off"
+                    spellcheck="false"
+                    autocorrect="off"
+                    autocapitalize="off"
+                    required
+                    th:field="*{email}"
+                />
+            </div>
+            <p class="alert alert-error" th:if="${#fields.hasErrors('email')}" th:errors="*{email}"></p>
+        </div>
+
+        <div class="form-item" th:if="${globalInfo.mustVerifyEmailOnRegistration}">
+            <label for="emailCode" th:text="#{form.signup.emailCode.label}"></label>
+            <div class="form-input-group">
+                <div class="form-input">
+                    <input type="text" inputmode="numeric" pattern="\d*" id="emailCode" name="emailCode" required />
+                </div>
+
+                <button id="emailCodeSendButton" type="button" th:text="#{form.signup.emailCode.sendButton}"></button>
+            </div>
+            <p class="alert alert-error" th:if="${#fields.hasErrors('emailCode')}" th:errors="*{emailCode}"></p>
+        </div>
+    </div>
+
+    <div class="form-item">
+        <label for="password" th:text="#{form.signup.password.label}"></label>
+        <th:block
+            th:replace="~{gateway_modules/input_fragments :: password(id = 'password', name = 'password', required = 'true', minlength = 6, enableToggle = true)}"
+        ></th:block>
+        <p class="alert alert-error" th:if="${#fields.hasErrors('password')}" th:errors="*{password}"></p>
+    </div>
+
+    <div class="form-item">
+        <label for="confirmPassword" th:text="#{form.signup.confirmPassword.label}"></label>
+        <th:block
+            th:replace="~{gateway_modules/input_fragments :: password(id = 'confirmPassword', name = 'confirmPassword', required = 'true', minlength = 6, enableToggle = true)}"
+        ></th:block>
+        <p class="alert alert-error" th:if="${#fields.hasErrors('confirmPassword')}" th:errors="*{confirmPassword}"></p>
+    </div>
+
+    <div class="form-item">
+        <button type="submit" th:text="#{form.signup.submit}"></button>
+    </div>
+
+    <script th:inline="javascript">
+        document.addEventListener("DOMContentLoaded", function () {
+            function sendRequest() {
+                return new Promise((resolve, reject) => {
+                    const email = document.getElementById("email").value;
+
+                    if (!email) {
+                        throw new Error(/*[[#{form.signup.emailCode.send.emptyValidation}]]*/);
+                    }
+
+                    fetch("/signup/send-email-code", {
+                        method: "POST",
+                        body: JSON.stringify({ email: email }),
+                        headers: {
+                            "Content-Type": "application/json",
+                            [[${_csrf.headerName}]]: [[${_csrf.token}]],
+                        },
+                    })
+                        .then((response) => {
+                            if (response.ok) {
+                                resolve(response);
+                            }
+                            reject(response);
+                        })
+                        .catch((e) => {
+                            reject(e);
+                        });
+                });
+            }
+
+            const emailCodeSendButton = document.getElementById("emailCodeSendButton");
+            sendVerificationCode(emailCodeSendButton, sendRequest);
+
+            var password = document.getElementById("password"),
+                confirm_password = document.getElementById("confirmPassword");
+
+            function validatePassword() {
+                if (password.value != confirm_password.value) {
+                    confirm_password.setCustomValidity("Passwords Don't Match");
+                } else {
+                    confirm_password.setCustomValidity("");
+                }
+            }
+
+            password.onchange = validatePassword;
+            confirm_password.onkeyup = validatePassword;
+        });
+    </script>
+</form>
+
+<form
+    th:fragment="totp"
+    class="halo-form"
+    th:action="@{/challenges/two-factor/totp}"
+    name="two-factor-form"
+    id="two-factor-form"
+    method="post"
+>
+    <div class="alert alert-error" role="alert" th:if="${param.error.size() > 0}">
+        <strong th:text="#{form.totp.messages.invalidError}"></strong>
+    </div>
+    <div class="form-item">
+        <label for="code" th:text="#{form.totp.code.label}"></label>
+        <div class="form-input">
+            <input
+                type="text"
+                inputmode="numeric"
+                id="code"
+                name="code"
+                autocomplete="one-time-code"
+                pattern="\d{6}"
+                autofocus
+                required
+            />
+        </div>
+    </div>
+    <div class="form-item">
+        <button type="submit" th:text="#{form.totp.submit}"></button>
+    </div>
+</form>
+
+<form th:fragment="logout" class="halo-form" id="logout-form" name="logout-form" th:action="@{/logout}" method="post">
+    <div class="form-item">
+        <button type="submit" th:text="#{form.logout.submit}"></button>
+    </div>
+</form>
+
+<form
+    th:fragment="passwordResetLink"
+    class="halo-form"
+    th:action="@{/password-reset/{resetToken}(resetToken=${resetToken})}"
+    method="post"
+>
+    <p style="color: red" role="alert" th:if="${error}" th:text="${error}"></p>
+    <div class="form-item">
+        <label for="password" th:text="#{form.passwordResetLink.password.label}">Password</label>
+        <th:block
+            th:replace="~{gateway_modules/input_fragments :: password(id = 'password', name = 'password', required = 'true', minlength = 6, enableToggle = true)}"
+        ></th:block>
+    </div>
+    <div class="form-item">
+        <label for="confirmPassword" th:text="#{form.passwordResetLink.confirmPassword.label}">Confirm Password</label>
+        <th:block
+            th:replace="~{gateway_modules/input_fragments :: password(id = 'confirmPassword', name = 'confirmPassword', required = 'true', minlength = 6, enableToggle = true)}"
+        ></th:block>
+    </div>
+    <div class="form-item">
+        <div class="alert" th:text="#{form.passwordResetLink.password.tips}"></div>
+    </div>
+    <div class="form-item">
+        <button type="submit" th:text="#{form.passwordResetLink.submit}"></button>
+    </div>
+</form>
+
+<th:block th:fragment="passwordReset">
+    <form th:if="${sent}" method="get" action="/login" class="halo-form">
+        <div class="form-item">
+            <div class="alert" th:text="#{form.passwordReset.message.success}"></div>
+        </div>
+        <div class="form-item">
+            <button type="submit" th:text="#{form.passwordReset.sent.submit}"></button>
+        </div>
+    </form>
+    <form th:unless="${sent}" class="halo-form" th:action="@{/password-reset}" method="post">
+        <div class="alert alert-error" th:if="${error}">
+            <strong th:text="${error}"></strong>
+        </div>
+        <div class="form-item">
+            <label for="email" th:text="#{form.passwordReset.email.label}"></label>
+            <div class="form-input">
+                <input type="email" id="email" name="email" autofocus required />
+            </div>
+        </div>
+        <div class="form-item">
+            <button type="submit" th:text="#{form.passwordReset.submit}"></button>
+        </div>
+    </form>
+</th:block>
diff --git a/application/src/main/resources/templates/gateway_modules/form_fragments.properties b/application/src/main/resources/templates/gateway_modules/form_fragments.properties
new file mode 100644
index 0000000000..fdd436a16f
--- /dev/null
+++ b/application/src/main/resources/templates/gateway_modules/form_fragments.properties
@@ -0,0 +1,36 @@
+form.login.messages.logoutSuccess=登出成功。
+form.login.messages.signupSuccess=恭喜！注册成功，请立即登录。
+form.login.messages.oauth2Bind=当前登录未绑定账号，请尝试通过其他方式登录，登录成功后会自动绑定账号。
+form.login.error.invalidCredential=无效的凭证。
+form.login.error.rateLimitExceeded=请求过于频繁，请稍后再试。
+form.login.rememberMe.label=保持登录会话
+form.login.submit=登录
+
+form.signup.username.label=用户名
+form.signup.displayName.label=名称
+form.signup.email.label=电子邮箱
+form.signup.emailCode.label=邮箱验证码
+form.signup.emailCode.sendButton=发送
+form.signup.emailCode.send.emptyValidation=请先输入邮箱地址
+form.signup.password.label=密码
+form.signup.confirmPassword.label=确认密码
+form.signup.submit=注册
+form.signup.error.invalidEmailCode=无效的邮箱验证码
+form.signup.error.duplicateName=用户名已经被注册
+form.signup.error.rateLimitExceeded=请求过于频繁，请稍后再试
+
+form.totp.messages.invalidError=错误的验证码
+form.totp.code.label=验证码
+form.totp.submit=验证
+
+form.logout.submit=退出登录
+
+form.passwordResetLink.password.label=密码
+form.passwordResetLink.confirmPassword.label=确认密码
+form.passwordResetLink.password.tips=密码必须至少包含 8 个字符，并且至少包含一个大写字母、一个小写字母、一个数字和一个特殊字符。
+form.passwordResetLink.submit=修改密码
+
+form.passwordReset.email.label=电子邮箱
+form.passwordReset.submit=提交
+form.passwordReset.sent.submit=返回到登录页面
+form.passwordReset.message.success=检查您的电子邮件中是否有重置密码的链接。如果几分钟内没有出现，请检查您的垃圾邮件文件夹。
\ No newline at end of file
diff --git a/application/src/main/resources/templates/gateway_modules/form_fragments_en.properties b/application/src/main/resources/templates/gateway_modules/form_fragments_en.properties
new file mode 100644
index 0000000000..63be73e23a
--- /dev/null
+++ b/application/src/main/resources/templates/gateway_modules/form_fragments_en.properties
@@ -0,0 +1,36 @@
+form.login.messages.logoutSuccess=Logout successfully.
+form.login.messages.signupSuccess=Congratulations! Sign up successfully, please login now.
+form.login.messages.oauth2Bind=The current login is not bound to an account. Please try to log in through other methods. After successful login, the account will be automatically bound.
+form.login.error.invalidCredential=Invalid credentials.
+form.login.error.rateLimitExceeded=Too many requests, please try again later.
+form.login.rememberMe.label=Remember me
+form.login.submit=Login
+
+form.signup.username.label=Username
+form.signup.displayName.label=Display Name
+form.signup.email.label=Email
+form.signup.emailCode.label=Email Verification Code
+form.signup.emailCode.sendButton=Send
+form.signup.emailCode.send.emptyValidation=Please enter your email address first
+form.signup.password.label=Password
+form.signup.confirmPassword.label=Confirm Password
+form.signup.submit=Sign Up
+form.signup.error.invalidEmailCode=Invalid Email Verification Code
+form.signup.error.duplicateName=Username is already taken
+form.signup.error.rateLimitExceeded=Too many requests, please try again later
+
+form.totp.messages.invalidError=Invalid TOTP code
+form.totp.code.label=TOTP Code
+form.totp.submit=Verify
+
+form.logout.submit=Logout
+
+form.passwordResetLink.password.label=Password
+form.passwordResetLink.confirmPassword.label=Confirm Password
+form.passwordResetLink.password.tips=Password must be at least 8 characters long and contain at least one uppercase letter, one lowercase letter, one number, and one special character.
+form.passwordResetLink.submit=Change password
+
+form.passwordReset.email.label=Email
+form.passwordReset.submit=Submit
+form.passwordReset.sent.submit=Return to login
+form.passwordReset.message.success=Check your email for a link to reset your password. If it doesn’t appear within a few minutes, check your spam folder.
\ No newline at end of file
diff --git a/application/src/main/resources/templates/gateway_modules/form_fragments_es.properties b/application/src/main/resources/templates/gateway_modules/form_fragments_es.properties
new file mode 100644
index 0000000000..8175c046d4
--- /dev/null
+++ b/application/src/main/resources/templates/gateway_modules/form_fragments_es.properties
@@ -0,0 +1,36 @@
+form.login.messages.logoutSuccess=Cierre de sesión exitoso.
+form.login.messages.signupSuccess=¡Felicidades! Registro exitoso, por favor inicie sesión de inmediato.
+form.login.messages.oauth2Bind=El inicio de sesión actual no está vinculado a una cuenta. Intente iniciar sesión a través de otros métodos. Después de un inicio de sesión exitoso, la cuenta se vinculará automáticamente.
+form.login.error.invalidCredential=Credenciales inválidas.
+form.login.error.rateLimitExceeded=Demasiadas solicitudes, por favor intente nuevamente más tarde.
+form.login.rememberMe.label=Mantener sesión iniciada
+form.login.submit=Iniciar sesión
+
+form.signup.username.label=Nombre de Usuario
+form.signup.displayName.label=Nombre
+form.signup.email.label=Correo Electrónico
+form.signup.emailCode.label=Código de Verificación
+form.signup.emailCode.sendButton=Enviar
+form.signup.emailCode.send.emptyValidation=Por favor, introduce tu dirección de correo electrónico primero
+form.signup.password.label=Contraseña
+form.signup.confirmPassword.label=Confirmar Contraseña
+form.signup.submit=Registrarse
+form.signup.error.invalidEmailCode=Código de verificación del correo inválido
+form.signup.error.duplicateName=El nombre de usuario ya está registrado
+form.signup.error.rateLimitExceeded=Demasiadas solicitudes, por favor intente nuevamente más tarde
+
+form.totp.messages.invalidError=Código de verificación incorrecto
+form.totp.code.label=Código de Verificación
+form.totp.submit=Verificar
+
+form.logout.submit=Cerrar Sesión
+
+form.passwordResetLink.password.label=Contraseña
+form.passwordResetLink.confirmPassword.label=Confirmar Contraseña
+form.passwordResetLink.password.tips=La contraseña debe tener al menos 8 caracteres e incluir al menos una letra mayúscula, una letra minúscula, un número y un carácter especial.
+form.passwordResetLink.submit=Cambiar Contraseña
+
+form.passwordReset.email.label=Correo Electrónico
+form.passwordReset.submit=Enviar
+form.passwordReset.sent.submit=Volver a la Página de Inicio de Sesión
+form.passwordReset.message.success=Revisa tu correo electrónico para ver el enlace de restablecimiento de contraseña. Si no aparece en unos minutos, revisa tu carpeta de spam.
diff --git a/application/src/main/resources/templates/gateway_modules/form_fragments_zh_TW.properties b/application/src/main/resources/templates/gateway_modules/form_fragments_zh_TW.properties
new file mode 100644
index 0000000000..e4ad256f11
--- /dev/null
+++ b/application/src/main/resources/templates/gateway_modules/form_fragments_zh_TW.properties
@@ -0,0 +1,36 @@
+form.login.messages.logoutSuccess=登出成功。
+form.login.messages.signupSuccess=恭喜！註冊成功，請立即登入。
+form.login.messages.oauth2Bind=當前登入未綁定至帳戶。請嘗試通過其他方法登入。成功登入後，帳戶將自動綁定。
+form.login.error.invalidCredential=無效的憑證。
+form.login.error.rateLimitExceeded=請求過於頻繁，請稍後再試。
+form.login.form.rememberMe.label=保持登入會話
+form.login.form.submit=登入
+
+form.signup.username.label=使用者名稱
+form.signup.displayName.label=名稱
+form.signup.email.label=電子郵件
+form.signup.emailCode.label=郵箱驗證碼
+form.signup.emailCode.sendButton=發送
+form.signup.emailCode.send.emptyValidation=請先輸入電子郵件地址
+form.signup.password.label=密碼
+form.signup.confirmPassword.label=確認密碼
+form.signup.submit=註冊
+form.signup.error.invalidEmailCode=無效的郵箱驗證碼
+form.signup.error.duplicateName=使用者名稱已經被註冊
+form.signup.error.rateLimitExceeded=請求過於頻繁，請稍後再試
+
+form.totp.messages.invalidError=錯誤的驗證碼
+form.totp.code.label=驗證碼
+form.totp.submit=驗證
+
+form.logout.submit=退出登入
+
+form.passwordResetLink.password.label=密碼
+form.passwordResetLink.confirmPassword.label=確認密碼
+form.passwordResetLink.password.tips=密碼必須至少包含 8 個字元，並且至少包含一個大寫字母、一個小寫字母、一個數字和一個特殊字元。
+form.passwordResetLink.submit=修改密碼
+
+form.passwordReset.email.label=電子郵件
+form.passwordReset.submit=提交
+form.passwordReset.sent.submit=返回到登入頁面
+form.passwordReset.message.success=檢查您的電子郵件中是否有重置密碼的連結。如果幾分鐘內沒有出現，請檢查您的垃圾郵件資料夾。
\ No newline at end of file
diff --git a/application/src/main/resources/templates/gateway_modules/login_fragments.html b/application/src/main/resources/templates/gateway_modules/login_fragments.html
index ed976a4843..b9c5299e13 100644
--- a/application/src/main/resources/templates/gateway_modules/login_fragments.html
+++ b/application/src/main/resources/templates/gateway_modules/login_fragments.html
@@ -1,42 +1,4 @@
 <!-- Those fragments are only for login template-->
-<form
-    th:fragment="form"
-    class="halo-form"
-    name="login-form"
-    id="login-form"
-    th:action="${authProvider.spec.authenticationUrl}"
-    th:method="${authProvider.spec.method}"
->
-    <div class="alert alert-error" role="alert" th:if="${param.error.size() > 0}" th:with="error = ${param.error[0]}">
-        <strong th:if="${error == 'invalid-credential'}">
-            <span th:text="#{error.invalid-credential}"></span>
-        </strong>
-        <strong th:if="${error == 'rate-limit-exceeded'}">
-            <span th:text="#{error.rate-limit-exceeded}"></span>
-        </strong>
-    </div>
-    <div class="alert" role="alert" th:if="${param.logout.size() > 0}">
-        <strong th:text="#{messages.logoutSuccess}"></strong>
-    </div>
-    <div class="alert" role="alert" th:if="${param.signup.size() > 0}">
-        <strong th:text="#{messages.signupSuccess}"></strong>
-    </div>
-    <div class="alert" role="alert" th:if="${param.oauth2_bind.size() > 0}">
-        <strong th:text="#{messages.oauth2_bind}"></strong>
-    </div>
-
-    <div th:replace="~{__${fragmentTemplateName}__::form}"></div>
-
-    <div th:if="${authProvider.spec.rememberMeSupport}" class="form-item-compact">
-        <input type="checkbox" id="remember-me" name="remember-me" value="true" />
-        <label for="remember-me" th:text="#{form.rememberMe.label}"></label>
-    </div>
-
-    <div class="form-item">
-        <button type="submit" th:text="#{form.submit}"></button>
-    </div>
-</form>
-
 <div th:remove="tag" th:fragment="formAuthProviders">
     <th:block th:unless="${#lists.isEmpty(formAuthProviders)}">
         <div class="divider-wrapper">
@@ -95,4 +57,4 @@
             <span th:text="#{returnToSite}"></span>
         </a>
     </div>
-</div>
\ No newline at end of file
+</div>
diff --git a/application/src/main/resources/templates/gateway_modules/login_fragments.properties b/application/src/main/resources/templates/gateway_modules/login_fragments.properties
index 99ab4a3175..ce89f98a19 100644
--- a/application/src/main/resources/templates/gateway_modules/login_fragments.properties
+++ b/application/src/main/resources/templates/gateway_modules/login_fragments.properties
@@ -1,13 +1,3 @@
-messages.loginError=无效的凭证。
-messages.logoutSuccess=登出成功。
-messages.signupSuccess=恭喜！注册成功，请立即登录。
-messages.oauth2_bind=当前登录未绑定账号，请尝试通过其他方式登录，登录成功后会自动绑定账号。
-
-error.invalid-credential=无效的凭证。
-error.rate-limit-exceeded=请求过于频繁，请稍后再试。
-
-form.rememberMe.label=保持登录会话
-form.submit=登录
 otherLogin.label=其他登录方式
 signup.description=没有账号？
 signup.link=立即注册
diff --git a/application/src/main/resources/templates/gateway_modules/login_fragments_en.properties b/application/src/main/resources/templates/gateway_modules/login_fragments_en.properties
index dbe74bc626..bb99adf53e 100644
--- a/application/src/main/resources/templates/gateway_modules/login_fragments_en.properties
+++ b/application/src/main/resources/templates/gateway_modules/login_fragments_en.properties
@@ -1,13 +1,3 @@
-messages.loginError=Invalid credentials.
-messages.logoutSuccess=Logout successfully.
-messages.oauth2_bind=The current login is not bound to an account. Please try to log in through other methods. After successful login, the account will be automatically bound.
-messages.signupSuccess=Congratulations! Sign up successfully, please login now.
-
-error.invalid-credential=Invalid credentials.
-error.rate-limit-exceeded=Too many requests, please try again later.
-
-form.rememberMe.label=Remember me
-form.submit=Login
 otherLogin.label=Other Login
 signup.description=Don't have an account?
 signup.link=Sign up
diff --git a/application/src/main/resources/templates/gateway_modules/login_fragments_es.properties b/application/src/main/resources/templates/gateway_modules/login_fragments_es.properties
index ae350b0a6b..33fc61f56b 100644
--- a/application/src/main/resources/templates/gateway_modules/login_fragments_es.properties
+++ b/application/src/main/resources/templates/gateway_modules/login_fragments_es.properties
@@ -1,13 +1,4 @@
-messages.loginError=Credenciales inválidas.
-messages.logoutSuccess=Cierre de sesión exitoso.
-messages.signupSuccess=¡Felicidades! Registro exitoso, por favor inicie sesión de inmediato.
-
-error.invalid-credential=Credenciales inválidas.
-error.rate-limit-exceeded=Demasiadas solicitudes, por favor intente nuevamente más tarde.
-
-form.rememberMe.label=Mantener sesión iniciada
-form.submit=Iniciar sesión
 otherLogin.label=Otras formas de inicio de sesión
 signup.description=¿No tienes una cuenta?
 signup.link=Regístrate ahora
-returnToSite=Volver al sitio
+returnToSite=Volver al sitio
\ No newline at end of file
diff --git a/application/src/main/resources/templates/gateway_modules/login_fragments_zh_TW.properties b/application/src/main/resources/templates/gateway_modules/login_fragments_zh_TW.properties
index 42fb89cc01..7a44090fab 100644
--- a/application/src/main/resources/templates/gateway_modules/login_fragments_zh_TW.properties
+++ b/application/src/main/resources/templates/gateway_modules/login_fragments_zh_TW.properties
@@ -1,13 +1,5 @@
-messages.loginError=無效的憑證。
-messages.logoutSuccess=登出成功。
-messages.signupSuccess=恭喜！註冊成功，請立即登入。
 
-error.invalid-credential=無效的憑證。
-error.rate-limit-exceeded=請求過於頻繁，請稍後再試。
-
-form.rememberMe.label=保持登入會話
-form.submit=登入
 otherLogin.label=其他登入方式
 signup.description=沒有帳號？
 signup.link=立即註冊
-returnToSite=返回網站
+returnToSite=返回網站
\ No newline at end of file
diff --git a/application/src/main/resources/templates/login.html b/application/src/main/resources/templates/login.html
index 47d8084593..4d8513891e 100644
--- a/application/src/main/resources/templates/login.html
+++ b/application/src/main/resources/templates/login.html
@@ -8,7 +8,7 @@
             <div th:replace="~{gateway_modules/common_fragments::haloLogo}"></div>
 
             <div class="halo-form-wrapper">
-                <form th:replace="~{gateway_modules/login_fragments::form}"></form>
+                <form th:replace="~{gateway_modules/form_fragments::login}"></form>
                 <div th:replace="~{gateway_modules/login_fragments::formAuthProviders}"></div>
                 <div th:replace="~{gateway_modules/common_fragments::socialAuthProviders}"></div>
             </div>
@@ -17,4 +17,4 @@
             <div th:replace="~{gateway_modules/common_fragments::languageSwitcher}"></div>
         </div>
     </th:block>
-</html>
\ No newline at end of file
+</html>
diff --git a/application/src/main/resources/templates/login_email.html b/application/src/main/resources/templates/login_email.html
deleted file mode 100644
index cbdda6d645..0000000000
--- a/application/src/main/resources/templates/login_email.html
+++ /dev/null
@@ -1,37 +0,0 @@
-<div th:remove="tag" th:fragment="form">
-    <div class="form-item">
-        <label for="email"> Email </label>
-
-        <div class="form-input">
-            <input
-                type="email"
-                id="email"
-                name="email"
-                autocomplete="off"
-                spellcheck="false"
-                autocorrect="off"
-                autocapitalize="off"
-                required
-                autofocus
-            />
-        </div>
-    </div>
-    <div class="form-item">
-        <label for="code"> Code </label>
-        <div class="form-input-group">
-            <div class="form-input">
-                <input
-                    type="text"
-                    id="code"
-                    name="code"
-                    autocomplete="off"
-                    spellcheck="false"
-                    autocorrect="off"
-                    autocapitalize="off"
-                    required
-                />
-            </div>
-            <button type="button">Send</button>
-        </div>
-    </div>
-</div>
\ No newline at end of file
diff --git a/application/src/main/resources/templates/logout.html b/application/src/main/resources/templates/logout.html
index cafcd1b7f4..88b1f6c8cb 100644
--- a/application/src/main/resources/templates/logout.html
+++ b/application/src/main/resources/templates/logout.html
@@ -7,12 +7,8 @@
         <div class="gateway-wrapper">
             <div class="halo-form-wrapper">
                 <h1 class="form-title" th:text="#{form.title}"></h1>
-                <form class="halo-form" id="logout-form" name="logout-form" th:action="@{/logout}" method="post">
-                    <div class="form-item">
-                        <button type="submit" th:text="#{form.submit}"></button>
-                    </div>
-                </form>
+                <form th:replace="~{gateway_modules/form_fragments::logout}"></form>
             </div>
         </div>
     </th:block>
-</html>
\ No newline at end of file
+</html>
diff --git a/application/src/main/resources/templates/logout.properties b/application/src/main/resources/templates/logout.properties
index 4ff553242b..a0b22a0839 100644
--- a/application/src/main/resources/templates/logout.properties
+++ b/application/src/main/resources/templates/logout.properties
@@ -1,3 +1,2 @@
 title=退出登录
-form.title=确定要退出登录吗？
-form.submit=退出登录
+form.title=确定要退出登录吗？
\ No newline at end of file
diff --git a/application/src/main/resources/templates/logout_en.properties b/application/src/main/resources/templates/logout_en.properties
index 3ad1587f0b..f2355d223a 100644
--- a/application/src/main/resources/templates/logout_en.properties
+++ b/application/src/main/resources/templates/logout_en.properties
@@ -1,3 +1,2 @@
 title=Logout
-form.title=Are you sure want to log out?
-form.submit=Logout
\ No newline at end of file
+form.title=Are you sure want to log out?
\ No newline at end of file
diff --git a/application/src/main/resources/templates/logout_es.properties b/application/src/main/resources/templates/logout_es.properties
index ab74ddb056..5179c8c2c9 100644
--- a/application/src/main/resources/templates/logout_es.properties
+++ b/application/src/main/resources/templates/logout_es.properties
@@ -1,3 +1,2 @@
 title=Cerrar Sesión
-form.title=¿Estás seguro de que deseas cerrar sesión?
-form.submit=Cerrar Sesión
+form.title=¿Estás seguro de que deseas cerrar sesión?
\ No newline at end of file
diff --git a/application/src/main/resources/templates/logout_zh_TW.properties b/application/src/main/resources/templates/logout_zh_TW.properties
index 8d8fddf093..d707b5fba1 100644
--- a/application/src/main/resources/templates/logout_zh_TW.properties
+++ b/application/src/main/resources/templates/logout_zh_TW.properties
@@ -1,3 +1,2 @@
 title=退出登入
-form.title=確定要退出登入嗎？
-form.submit=退出登入
+form.title=確定要退出登入嗎？
\ No newline at end of file
diff --git a/application/src/main/resources/templates/password-reset-link.html b/application/src/main/resources/templates/password-reset-link.html
index 5ce127ab34..84b1f8da4f 100644
--- a/application/src/main/resources/templates/password-reset-link.html
+++ b/application/src/main/resources/templates/password-reset-link.html
@@ -8,33 +8,8 @@
             <div th:replace="~{gateway_modules/common_fragments::haloLogo}"></div>
             <div class="halo-form-wrapper">
                 <h1 class="form-title" th:text="#{title(${username})}"></h1>
-                <p style="color: red" role="alert" th:if="${error}" th:text="${error}"></p>
-                <form
-                    class="halo-form"
-                    th:action="@{/password-reset/{resetToken}(resetToken=${resetToken})}"
-                    method="post"
-                >
-                    <div class="form-item">
-                        <label for="password" th:text="#{form.password.label}">Password</label>
-                        <th:block
-                            th:replace="~{gateway_modules/input_fragments :: password(id = 'password', name = 'password', required = 'true', minlength = 6, enableToggle = true)}"
-                        ></th:block>
-                    </div>
-                    <div class="form-item">
-                        <label for="confirmPassword" th:text="#{form.confirmPassword.label}">Confirm Password</label>
-                        <th:block
-                            th:replace="~{gateway_modules/input_fragments :: password(id = 'confirmPassword', name = 'confirmPassword', required = 'true', minlength = 6, enableToggle = true)}"
-                        ></th:block>
-                    </div>
-                    <div class="form-item">
-                        <p th:text="#{form.password.tips}"></p>
-                    </div>
-                    <div class="form-item">
-                        <button type="submit" th:text="#{form.submit}">Change password</button>
-                    </div>
-                </form>
+                <form th:replace="~{gateway_modules/form_fragments::passwordResetLink}"></form>
             </div>
-
             <div th:replace="~{gateway_modules/common_fragments::languageSwitcher}"></div>
         </div>
     </th:block>
diff --git a/application/src/main/resources/templates/password-reset-link.properties b/application/src/main/resources/templates/password-reset-link.properties
index a401763b38..5a6fc29992 100644
--- a/application/src/main/resources/templates/password-reset-link.properties
+++ b/application/src/main/resources/templates/password-reset-link.properties
@@ -1,5 +1 @@
 title=为 {0} 修改密码
-form.password.label=密码
-form.confirmPassword.label=确认密码
-form.password.tips=密码必须至少包含 8 个字符，并且至少包含一个大写字母、一个小写字母、一个数字和一个特殊字符。
-form.submit=修改密码
diff --git a/application/src/main/resources/templates/password-reset-link_en.properties b/application/src/main/resources/templates/password-reset-link_en.properties
index 3075f3b839..d4123a6b25 100644
--- a/application/src/main/resources/templates/password-reset-link_en.properties
+++ b/application/src/main/resources/templates/password-reset-link_en.properties
@@ -1,5 +1 @@
 title=Change password for @{0}
-form.password.label=Password
-form.confirmPassword.label=Confirm Password
-form.password.tips=Password must be at least 8 characters long and contain at least one uppercase letter, one lowercase letter, one number, and one special character.
-form.submit=Change password
diff --git a/application/src/main/resources/templates/password-reset-link_es.properties b/application/src/main/resources/templates/password-reset-link_es.properties
index 406600dace..681c176738 100644
--- a/application/src/main/resources/templates/password-reset-link_es.properties
+++ b/application/src/main/resources/templates/password-reset-link_es.properties
@@ -1,5 +1 @@
 title=Cambiar Contraseña para {0}
-form.password.label=Contraseña
-form.confirmPassword.label=Confirmar Contraseña
-form.password.tips=La contraseña debe tener al menos 8 caracteres e incluir al menos una letra mayúscula, una letra minúscula, un número y un carácter especial.
-form.submit=Cambiar Contraseña
diff --git a/application/src/main/resources/templates/password-reset-link_zh_TW.properties b/application/src/main/resources/templates/password-reset-link_zh_TW.properties
index 6b6a4c5bcd..cbe818b669 100644
--- a/application/src/main/resources/templates/password-reset-link_zh_TW.properties
+++ b/application/src/main/resources/templates/password-reset-link_zh_TW.properties
@@ -1,5 +1 @@
 title=為 {0} 修改密碼
-form.password.label=密碼
-form.confirmPassword.label=確認密碼
-form.password.tips=密碼必須至少包含 8 個字元，並且至少包含一個大寫字母、一個小寫字母、一個數字和一個特殊字元。
-form.submit=修改密碼
diff --git a/application/src/main/resources/templates/password-reset.html b/application/src/main/resources/templates/password-reset.html
index 782a9a3a34..b27921db39 100644
--- a/application/src/main/resources/templates/password-reset.html
+++ b/application/src/main/resources/templates/password-reset.html
@@ -8,28 +8,7 @@
             <div th:replace="~{gateway_modules/common_fragments::haloLogo}"></div>
             <div class="halo-form-wrapper">
                 <h1 class="form-title" th:text="${sent} ? #{sent.title} : #{title}"></h1>
-                <div class="alert alert-error" th:if="${error}">
-                    <strong th:text="${error}"></strong>
-                </div>
-                <form th:if="${sent}" method="get" action="/login" class="halo-form">
-                    <div class="form-item">
-                        <div class="alert" th:text="#{sent.form.message}"></div>
-                    </div>
-                    <div class="form-item">
-                        <button type="submit" th:text="#{sent.form.submit}"></button>
-                    </div>
-                </form>
-                <form th:unless="${sent}" class="halo-form" th:action="@{/password-reset}" method="post">
-                    <div class="form-item">
-                        <label for="email" th:text="#{form.email.label}"></label>
-                        <div class="form-input">
-                            <input type="email" id="email" name="email" autofocus required />
-                        </div>
-                    </div>
-                    <div class="form-item">
-                        <button type="submit" th:text="#{form.submit}"></button>
-                    </div>
-                </form>
+                <form th:replace="~{gateway_modules/form_fragments::passwordReset}"></form>
             </div>
 
             <div th:replace="~{gateway_modules/common_fragments::languageSwitcher}"></div>
diff --git a/application/src/main/resources/templates/password-reset.properties b/application/src/main/resources/templates/password-reset.properties
index f008656fcf..74f925d2c1 100644
--- a/application/src/main/resources/templates/password-reset.properties
+++ b/application/src/main/resources/templates/password-reset.properties
@@ -1,6 +1,2 @@
 title=重置密码
-form.email.label=电子邮箱
-form.submit=提交
-sent.form.submit=返回到登录页面
-sent.form.message=检查您的电子邮件中是否有重置密码的链接。如果几分钟内没有出现，请检查您的垃圾邮件文件夹。
 sent.title=已发送重置密码的邮件
\ No newline at end of file
diff --git a/application/src/main/resources/templates/password-reset_en.properties b/application/src/main/resources/templates/password-reset_en.properties
index 36555ac691..9aadd2b589 100644
--- a/application/src/main/resources/templates/password-reset_en.properties
+++ b/application/src/main/resources/templates/password-reset_en.properties
@@ -1,6 +1,2 @@
 title=Reset password
-form.email.label=Email
-form.submit=Submit
-sent.form.submit=Return to login
-sent.form.message=Check your email for a link to reset your password. If it doesn’t appear within a few minutes, check your spam folder.
 sent.title=Password reset email has been sent
\ No newline at end of file
diff --git a/application/src/main/resources/templates/password-reset_es.properties b/application/src/main/resources/templates/password-reset_es.properties
index 671e3e29e2..c3a202e78a 100644
--- a/application/src/main/resources/templates/password-reset_es.properties
+++ b/application/src/main/resources/templates/password-reset_es.properties
@@ -1,6 +1,2 @@
 title=Restablecer Contraseña
-form.email.label=Correo Electrónico
-form.submit=Enviar
-sent.form.submit=Volver a la Página de Inicio de Sesión
-sent.form.message=Revisa tu correo electrónico para ver el enlace de restablecimiento de contraseña. Si no aparece en unos minutos, revisa tu carpeta de spam.
-sent.title=Correo de Restablecimiento de Contraseña Enviado
+sent.title=Correo de Restablecimiento de Contraseña Enviado
\ No newline at end of file
diff --git a/application/src/main/resources/templates/password-reset_zh_TW.properties b/application/src/main/resources/templates/password-reset_zh_TW.properties
index 9b773cd893..b879cbfb78 100644
--- a/application/src/main/resources/templates/password-reset_zh_TW.properties
+++ b/application/src/main/resources/templates/password-reset_zh_TW.properties
@@ -1,6 +1,2 @@
 title=重置密碼
-form.email.label=電子郵件
-form.submit=提交
-sent.form.submit=返回到登入頁面
-sent.form.message=檢查您的電子郵件中是否有重置密碼的連結。如果幾分鐘內沒有出現，請檢查您的垃圾郵件資料夾。
-sent.title=已發送重置密碼的郵件
+sent.title=已發送重置密碼的郵件
\ No newline at end of file
diff --git a/application/src/main/resources/templates/signup.html b/application/src/main/resources/templates/signup.html
index 7ec0d47771..1aca0da135 100644
--- a/application/src/main/resources/templates/signup.html
+++ b/application/src/main/resources/templates/signup.html
@@ -15,198 +15,10 @@
             <div th:replace="~{gateway_modules/common_fragments::haloLogo}"></div>
             <div class="halo-form-wrapper">
                 <h1 class="form-title" th:text="#{title}"></h1>
-                <p class="alert alert=erro" role="alert" th:if="${error == 'invalid-email-code'}">
-                    <span th:text="#{error.invalid-email-code}">Invalid email code</span>
-                </p>
-                <p class="alert alert=erro" role="alert" th:if="${error == 'rate-limit-exceeded'}">
-                    <span th:text="#{error.rate-limit-exceeded}">Rate limit exceeded</span>
-                </p>
-                <p class="alert alert=erro" role="alert" th:if="${error == 'duplicate-name'}">
-                    <span th:text="#{error.duplicate-name}">Duplicate name</span>
-                </p>
-                <form
-                    class="halo-form"
-                    name="signup-form"
-                    id="signup-form"
-                    th:action="@{/signup}"
-                    th:object="${form}"
-                    method="post"
-                >
-                    <div class="form-item-group">
-                        <div class="form-item">
-                            <label for="username" th:text="#{form.username.label}"></label>
-                            <div class="form-input">
-                                <input
-                                    type="text"
-                                    id="username"
-                                    name="username"
-                                    autocomplete="off"
-                                    spellcheck="false"
-                                    autocorrect="off"
-                                    autocapitalize="off"
-                                    autofocus
-                                    required
-                                    th:field="*{username}"
-                                />
-                            </div>
-                            <p
-                                class="alert alert-error"
-                                th:if="${#fields.hasErrors('username')}"
-                                th:errors="*{username}"
-                            ></p>
-                        </div>
-
-                        <div class="form-item">
-                            <label for="displayName" th:text="#{form.displayName.label}"></label>
-                            <div class="form-input">
-                                <input
-                                    type="text"
-                                    id="displayName"
-                                    name="displayName"
-                                    autocomplete="off"
-                                    spellcheck="false"
-                                    autocorrect="off"
-                                    autocapitalize="off"
-                                    required
-                                    th:field="*{displayName}"
-                                />
-                            </div>
-                            <p
-                                class="alert alert-error"
-                                th:if="${#fields.hasErrors('displayName')}"
-                                th:errors="*{displayName}"
-                            ></p>
-                        </div>
-                    </div>
-
-                    <div class="form-item-group">
-                        <div class="form-item">
-                            <label for="email" th:text="#{form.email.label}"></label>
-                            <div class="form-input">
-                                <input
-                                    type="email"
-                                    id="email"
-                                    name="email"
-                                    autocomplete="off"
-                                    spellcheck="false"
-                                    autocorrect="off"
-                                    autocapitalize="off"
-                                    required
-                                    th:field="*{email}"
-                                />
-                            </div>
-                            <p class="alert alert-error" th:if="${#fields.hasErrors('email')}" th:errors="*{email}"></p>
-                        </div>
-
-                        <div class="form-item" th:if="${globalInfo.mustVerifyEmailOnRegistration}">
-                            <label for="emailCode" th:text="#{form.emailCode.label}"></label>
-                            <div class="form-input-group">
-                                <div class="form-input">
-                                    <input
-                                        type="text"
-                                        inputmode="numeric"
-                                        pattern="\d*"
-                                        id="emailCode"
-                                        name="emailCode"
-                                        required
-                                    />
-                                </div>
-
-                                <button
-                                    id="emailCodeSendButton"
-                                    type="button"
-                                    th:text="#{form.emailCode.sendButton}"
-                                ></button>
-                            </div>
-                            <p
-                                class="alert alert-error"
-                                th:if="${#fields.hasErrors('emailCode')}"
-                                th:errors="*{emailCode}"
-                            ></p>
-                        </div>
-                    </div>
-
-                    <div class="form-item">
-                        <label for="password" th:text="#{form.password.label}"></label>
-                        <th:block
-                            th:replace="~{gateway_modules/input_fragments :: password(id = 'password', name = 'password', required = 'true', minlength = 6, enableToggle = true)}"
-                        ></th:block>
-                        <p
-                            class="alert alert-error"
-                            th:if="${#fields.hasErrors('password')}"
-                            th:errors="*{password}"
-                        ></p>
-                    </div>
-
-                    <div class="form-item">
-                        <label for="confirmPassword" th:text="#{form.confirmPassword.label}"></label>
-                        <th:block
-                            th:replace="~{gateway_modules/input_fragments :: password(id = 'confirmPassword', name = 'confirmPassword', required = 'true', minlength = 6, enableToggle = true)}"
-                        ></th:block>
-                        <p
-                            class="alert alert-error"
-                            th:if="${#fields.hasErrors('confirmPassword')}"
-                            th:errors="*{confirmPassword}"
-                        ></p>
-                    </div>
-
-                    <div class="form-item">
-                        <button type="submit" th:text="#{form.submit}"></button>
-                    </div>
-                </form>
-
+                <form th:replace="~{gateway_modules/form_fragments::signup}"></form>
                 <div th:replace="~{gateway_modules/common_fragments::socialAuthProviders}"></div>
             </div>
-
             <div th:replace="~{gateway_modules/common_fragments::languageSwitcher}"></div>
         </div>
-        <script th:inline="javascript">
-            document.addEventListener("DOMContentLoaded", function () {
-                function sendRequest() {
-                    return new Promise((resolve, reject) => {
-                        const email = document.getElementById("email").value;
-
-                        if (!email) {
-                            throw new Error(/*[[#{form.emailCode.send.emptyValidation}]]*/);
-                        }
-
-                        fetch("/signup/send-email-code", {
-                            method: "POST",
-                            body: JSON.stringify({ email: email }),
-                            headers: {
-                                "Content-Type": "application/json",
-                                [[${_csrf.headerName}]]: [[${_csrf.token}]],
-                            },
-                        })
-                            .then((response) => {
-                                if (response.ok) {
-                                    resolve(response);
-                                }
-                                reject(response);
-                            })
-                            .catch((e) => {
-                                reject(e);
-                            });
-                    });
-                }
-
-                const emailCodeSendButton = document.getElementById("emailCodeSendButton");
-                sendVerificationCode(emailCodeSendButton, sendRequest);
-
-                var password = document.getElementById("password"),
-                    confirm_password = document.getElementById("confirmPassword");
-
-                function validatePassword() {
-                    if (password.value != confirm_password.value) {
-                        confirm_password.setCustomValidity("Passwords Don't Match");
-                    } else {
-                        confirm_password.setCustomValidity("");
-                    }
-                }
-
-                password.onchange = validatePassword;
-                confirm_password.onkeyup = validatePassword;
-            });
-        </script>
     </th:block>
 </html>
diff --git a/application/src/main/resources/templates/signup.properties b/application/src/main/resources/templates/signup.properties
index 8e307cc798..3eed1c6e97 100644
--- a/application/src/main/resources/templates/signup.properties
+++ b/application/src/main/resources/templates/signup.properties
@@ -1,14 +1 @@
-title=注册
-form.username.label=用户名
-form.displayName.label=名称
-form.email.label=电子邮箱
-form.emailCode.label=邮箱验证码
-form.emailCode.sendButton=发送
-form.emailCode.send.emptyValidation=请先输入邮箱地址
-form.password.label=密码
-form.confirmPassword.label=确认密码
-form.submit=注册
-
-error.invalid-email-code=无效的邮箱验证码
-error.duplicate-name=用户名已经被注册
-error.rate-limit-exceeded=请求过于频繁，请稍后再试
\ No newline at end of file
+title=注册
\ No newline at end of file
diff --git a/application/src/main/resources/templates/signup_en.properties b/application/src/main/resources/templates/signup_en.properties
index fed3c49659..6493ee3d8a 100644
--- a/application/src/main/resources/templates/signup_en.properties
+++ b/application/src/main/resources/templates/signup_en.properties
@@ -1,14 +1 @@
-title=Sign Up
-form.username.label=Username
-form.displayName.label=Display Name
-form.email.label=Email
-form.emailCode.label=Email Verification Code
-form.emailCode.sendButton=Send
-form.emailCode.send.emptyValidation=Please enter your email address first
-form.password.label=Password
-form.confirmPassword.label=Confirm Password
-form.submit=Sign Up
-
-error.invalid-email-code=Invalid Email Verification Code
-error.duplicate-name=Username is already taken
-error.rate-limit-exceeded=Too many requests, please try again later
\ No newline at end of file
+title=Sign Up
\ No newline at end of file
diff --git a/application/src/main/resources/templates/signup_es.properties b/application/src/main/resources/templates/signup_es.properties
index 747860645f..79e8eae797 100644
--- a/application/src/main/resources/templates/signup_es.properties
+++ b/application/src/main/resources/templates/signup_es.properties
@@ -1,14 +1 @@
-title=Registrarse
-form.username.label=Nombre de Usuario
-form.displayName.label=Nombre
-form.email.label=Correo Electrónico
-form.emailCode.label=Código de Verificación
-form.emailCode.sendButton=Enviar
-form.emailCode.send.emptyValidation=Por favor, introduce tu dirección de correo electrónico primero
-form.password.label=Contraseña
-form.confirmPassword.label=Confirmar Contraseña
-form.submit=Registrarse
-
-error.invalid-email-code=Código de verificación del correo inválido
-error.duplicate-name=El nombre de usuario ya está registrado
-error.rate-limit-exceeded=Demasiadas solicitudes, por favor intente nuevamente más tarde
\ No newline at end of file
+title=Registrarse
\ No newline at end of file
diff --git a/application/src/main/resources/templates/signup_zh_TW.properties b/application/src/main/resources/templates/signup_zh_TW.properties
index 597c7052b4..fe86a3ac8c 100644
--- a/application/src/main/resources/templates/signup_zh_TW.properties
+++ b/application/src/main/resources/templates/signup_zh_TW.properties
@@ -1,14 +1 @@
-title=註冊
-form.username.label=使用者名稱
-form.displayName.label=名稱
-form.email.label=電子郵件
-form.emailCode.label=郵箱驗證碼
-form.emailCode.sendButton=發送
-form.emailCode.send.emptyValidation=請先輸入電子郵件地址
-form.password.label=密碼
-form.confirmPassword.label=確認密碼
-form.submit=註冊
-
-error.invalid-email-code=無效的郵箱驗證碼
-error.duplicate-name=使用者名稱已經被註冊
-error.rate-limit-exceeded=請求過於頻繁，請稍後再試
\ No newline at end of file
+title=註冊
\ No newline at end of file

From f78f7dad028ec8c4cd112419b7ea80fa00cf7055 Mon Sep 17 00:00:00 2001
From: Ryan Wang <i@ryanc.cc>
Date: Mon, 7 Oct 2024 17:38:51 +0800
Subject: [PATCH 085/185] feat: add support to check access permissions for
 /console (#6775)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/area ui
/kind improvement
/milestone 2.20.x

#### What this PR does / why we need it:

支持检查是否有权限访问 /console。

#### Which issue(s) this PR fixes:

Fixes #6773

#### Does this PR introduce a user-facing change?

```release-note
None
```
---
 ui/console-src/router/guards/permission.ts | 53 ++++++++++++++++------
 1 file changed, 40 insertions(+), 13 deletions(-)

diff --git a/ui/console-src/router/guards/permission.ts b/ui/console-src/router/guards/permission.ts
index b513e9e0e0..0367d31963 100644
--- a/ui/console-src/router/guards/permission.ts
+++ b/ui/console-src/router/guards/permission.ts
@@ -1,22 +1,49 @@
+import { rbacAnnotations } from "@/constants/annotations";
 import { useRoleStore } from "@/stores/role";
+import { useUserStore } from "@/stores/user";
 import { hasPermission } from "@/utils/permission";
-import type { Router } from "vue-router";
+import type { Role } from "@halo-dev/api-client";
+import type { RouteLocationNormalized, Router } from "vue-router";
 
 export function setupPermissionGuard(router: Router) {
   router.beforeEach((to, _, next) => {
+    const userStore = useUserStore();
     const roleStore = useRoleStore();
-    const { uiPermissions } = roleStore.permissions;
-    const { meta } = to;
-    if (meta && meta.permissions) {
-      const flag = hasPermission(
-        Array.from(uiPermissions),
-        meta.permissions as string[],
-        true
-      );
-      if (!flag) {
-        next({ name: "Forbidden" });
-      }
+
+    if (isConsoleAccessDisallowed(userStore.currentRoles)) {
+      window.location.href = "/uc";
+      return;
+    }
+
+    if (checkRoutePermissions(to, roleStore.permissions.uiPermissions)) {
+      next();
+    } else {
+      next({ name: "Forbidden" });
     }
-    next();
   });
 }
+
+function isConsoleAccessDisallowed(currentRoles?: Role[]): boolean {
+  return (
+    currentRoles?.some(
+      (role) =>
+        role.metadata.annotations?.[rbacAnnotations.DISALLOW_ACCESS_CONSOLE] ===
+        "true"
+    ) || false
+  );
+}
+
+function checkRoutePermissions(
+  to: RouteLocationNormalized,
+  uiPermissions: string[]
+): boolean {
+  const { meta } = to;
+  if (meta?.permissions) {
+    return hasPermission(
+      Array.from(uiPermissions),
+      meta.permissions as string[],
+      true
+    );
+  }
+  return true;
+}

From c3ecd339a1a60cf66054b5c6fa8ec31cfbd8c6cb Mon Sep 17 00:00:00 2001
From: Ryan Wang <i@ryanc.cc>
Date: Mon, 7 Oct 2024 23:22:52 +0800
Subject: [PATCH 086/185] feat: refine i18n for login method selection button
 (#6771)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/area core
/kind improvement
/milestone 2.20.x

#### What this PR does / why we need it:

完善登录方式选择按钮的 i18n。

#### Which issue(s) this PR fixes:

Fixes https://github.com/halo-dev/halo/issues/6759

#### Does this PR introduce a user-facing change?

```release-note
None
```
---
 .../templates/gateway_modules/login_fragments.html          | 4 +++-
 .../templates/gateway_modules/login_fragments.properties    | 5 ++++-
 .../templates/gateway_modules/login_fragments_en.properties | 5 ++++-
 .../templates/gateway_modules/login_fragments_es.properties | 5 ++++-
 .../gateway_modules/login_fragments_zh_TW.properties        | 6 ++++--
 5 files changed, 19 insertions(+), 6 deletions(-)

diff --git a/application/src/main/resources/templates/gateway_modules/login_fragments.html b/application/src/main/resources/templates/gateway_modules/login_fragments.html
index b9c5299e13..2d6d0f95cc 100644
--- a/application/src/main/resources/templates/gateway_modules/login_fragments.html
+++ b/application/src/main/resources/templates/gateway_modules/login_fragments.html
@@ -10,7 +10,9 @@
             <li th:each="provider : ${formAuthProviders}">
                 <a th:href="'/login?method=' + ${provider.metadata.name}">
                     <img th:src="${provider.spec.logo}" />
-                    <span th:text="${provider.spec.displayName}"></span>
+                    <span
+                        th:text="${#messages.msgOrNull('formAuthProviders.' + provider.metadata.name + '.displayName') ?: provider.spec.displayName}"
+                    ></span>
                 </a>
             </li>
         </ul>
diff --git a/application/src/main/resources/templates/gateway_modules/login_fragments.properties b/application/src/main/resources/templates/gateway_modules/login_fragments.properties
index ce89f98a19..a5b4cc3d28 100644
--- a/application/src/main/resources/templates/gateway_modules/login_fragments.properties
+++ b/application/src/main/resources/templates/gateway_modules/login_fragments.properties
@@ -1,4 +1,7 @@
 otherLogin.label=其他登录方式
 signup.description=没有账号？
 signup.link=立即注册
-returnToSite=返回网站
\ No newline at end of file
+returnToSite=返回网站
+
+# Rule: `formAuthProviders.${provider.metadata.name}.displayName`
+formAuthProviders.local.displayName=账号密码登录
\ No newline at end of file
diff --git a/application/src/main/resources/templates/gateway_modules/login_fragments_en.properties b/application/src/main/resources/templates/gateway_modules/login_fragments_en.properties
index bb99adf53e..39a5fc7b5b 100644
--- a/application/src/main/resources/templates/gateway_modules/login_fragments_en.properties
+++ b/application/src/main/resources/templates/gateway_modules/login_fragments_en.properties
@@ -1,4 +1,7 @@
 otherLogin.label=Other Login
 signup.description=Don't have an account?
 signup.link=Sign up
-returnToSite=Return to site
\ No newline at end of file
+returnToSite=Return to site
+
+# Rule: `formAuthProviders.${provider.metadata.name}.displayName`
+formAuthProviders.local.displayName=Login with credentials
\ No newline at end of file
diff --git a/application/src/main/resources/templates/gateway_modules/login_fragments_es.properties b/application/src/main/resources/templates/gateway_modules/login_fragments_es.properties
index 33fc61f56b..a714b589ab 100644
--- a/application/src/main/resources/templates/gateway_modules/login_fragments_es.properties
+++ b/application/src/main/resources/templates/gateway_modules/login_fragments_es.properties
@@ -1,4 +1,7 @@
 otherLogin.label=Otras formas de inicio de sesión
 signup.description=¿No tienes una cuenta?
 signup.link=Regístrate ahora
-returnToSite=Volver al sitio
\ No newline at end of file
+returnToSite=Volver al sitio
+
+# Rule: `formAuthProviders.${provider.metadata.name}.displayName`
+formAuthProviders.local.displayName=Iniciar sesión con credenciales
diff --git a/application/src/main/resources/templates/gateway_modules/login_fragments_zh_TW.properties b/application/src/main/resources/templates/gateway_modules/login_fragments_zh_TW.properties
index 7a44090fab..b0e1012389 100644
--- a/application/src/main/resources/templates/gateway_modules/login_fragments_zh_TW.properties
+++ b/application/src/main/resources/templates/gateway_modules/login_fragments_zh_TW.properties
@@ -1,5 +1,7 @@
-
 otherLogin.label=其他登入方式
 signup.description=沒有帳號？
 signup.link=立即註冊
-returnToSite=返回網站
\ No newline at end of file
+returnToSite=返回網站
+
+# Rule: `formAuthProviders.${provider.metadata.name}.displayName`
+formAuthProviders.local.displayName=帳號密碼登入

From 9d01b627d0fee7671dcc9f07b751a8421bd6ea5a Mon Sep 17 00:00:00 2001
From: John Niang <johnniang@foxmail.com>
Date: Mon, 7 Oct 2024 23:50:53 +0800
Subject: [PATCH 087/185] Customize authorization exchange separately (#6779)

#### What type of PR is this?

/kind cleanup
/area core
/milestone 2.20.x

#### What this PR does / why we need it:

This PR separates authorization exchange customization into security configurers. I also define the annotations `@Order` on every security configurer in order to customize authorization exchange in separated source file instead of modifying existing.

#### Does this PR introduce a user-facing change?

```release-note
None
```
---
 .../infra/config/WebServerSecurityConfig.java |  44 +------
 .../AuthorizationExchangeConfigurers.java     | 107 ++++++++++++++++++
 .../NotAuthenticatedAuthorizationManager.java |  30 -----
 3 files changed, 108 insertions(+), 73 deletions(-)
 create mode 100644 application/src/main/java/run/halo/app/security/authorization/AuthorizationExchangeConfigurers.java
 delete mode 100644 application/src/main/java/run/halo/app/security/authorization/NotAuthenticatedAuthorizationManager.java

diff --git a/application/src/main/java/run/halo/app/infra/config/WebServerSecurityConfig.java b/application/src/main/java/run/halo/app/infra/config/WebServerSecurityConfig.java
index 4385ae9741..6acb689059 100644
--- a/application/src/main/java/run/halo/app/infra/config/WebServerSecurityConfig.java
+++ b/application/src/main/java/run/halo/app/infra/config/WebServerSecurityConfig.java
@@ -3,7 +3,6 @@
 import static org.springframework.security.web.server.authentication.ServerWebExchangeDelegatingReactiveAuthenticationManagerResolver.builder;
 import static org.springframework.security.web.server.util.matcher.ServerWebExchangeMatchers.pathMatchers;
 
-import java.util.Collections;
 import java.util.concurrent.ConcurrentHashMap;
 import lombok.RequiredArgsConstructor;
 import org.springframework.beans.factory.ObjectProvider;
@@ -12,11 +11,8 @@
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.http.HttpMethod;
-import org.springframework.http.MediaType;
-import org.springframework.security.authorization.AuthorizationDecision;
 import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity;
 import org.springframework.security.config.web.server.ServerHttpSecurity;
-import org.springframework.security.core.Authentication;
 import org.springframework.security.crypto.factory.PasswordEncoderFactories;
 import org.springframework.security.crypto.password.PasswordEncoder;
 import org.springframework.security.web.server.SecurityWebFilterChain;
@@ -24,13 +20,9 @@
 import org.springframework.security.web.server.context.WebSessionServerSecurityContextRepository;
 import org.springframework.security.web.server.savedrequest.ServerRequestCache;
 import org.springframework.security.web.server.util.matcher.AndServerWebExchangeMatcher;
-import org.springframework.security.web.server.util.matcher.MediaTypeServerWebExchangeMatcher;
 import org.springframework.security.web.server.util.matcher.NegatedServerWebExchangeMatcher;
-import org.springframework.security.web.server.util.matcher.ServerWebExchangeMatcher;
-import org.springframework.security.web.server.util.matcher.ServerWebExchangeMatchers;
 import org.springframework.session.MapSession;
 import org.springframework.session.config.annotation.web.server.EnableSpringWebSession;
-import reactor.core.publisher.Mono;
 import run.halo.app.core.user.service.RoleService;
 import run.halo.app.core.user.service.UserService;
 import run.halo.app.extension.ReactiveExtensionClient;
@@ -44,8 +36,6 @@
 import run.halo.app.security.authentication.pat.PatAuthenticationManager;
 import run.halo.app.security.authentication.pat.PatServerWebExchangeMatcher;
 import run.halo.app.security.authorization.AuthorityUtils;
-import run.halo.app.security.authorization.NotAuthenticatedAuthorizationManager;
-import run.halo.app.security.authorization.RequestInfoAuthorizationManager;
 import run.halo.app.security.session.InMemoryReactiveIndexedSessionRepository;
 import run.halo.app.security.session.ReactiveIndexedSessionRepository;
 
@@ -86,29 +76,6 @@ SecurityWebFilterChain filterChain(ServerHttpSecurity http,
             new NegatedServerWebExchangeMatcher(staticResourcesMatcher));
 
         http.securityMatcher(securityMatcher)
-            .authorizeExchange(spec -> spec.pathMatchers(
-                    "/api/**",
-                    "/apis/**",
-                    "/actuator/**"
-                ).access(new RequestInfoAuthorizationManager(roleService))
-                .pathMatchers(HttpMethod.GET, "/login", "/signup")
-                .access(new NotAuthenticatedAuthorizationManager())
-                .pathMatchers(
-                    "/login/**",
-                    "/challenges/**",
-                    "/password-reset/**",
-                    "/signup",
-                    "/logout"
-                ).permitAll()
-                .pathMatchers("/console/**", "/uc/**").authenticated()
-                .matchers(createHtmlMatcher()).access((authentication, context) ->
-                    // we only need to check the authentication is authenticated
-                    // because we treat anonymous user as authenticated
-                    authentication.map(Authentication::isAuthenticated)
-                        .map(AuthorizationDecision::new)
-                        .switchIfEmpty(Mono.fromSupplier(() -> new AuthorizationDecision(false)))
-                )
-                .anyExchange().permitAll())
             .anonymous(spec -> {
                 spec.authorities(AuthorityUtils.ROLE_PREFIX + AnonymousUserConst.Role);
                 spec.principal(AnonymousUserConst.PRINCIPAL);
@@ -190,14 +157,5 @@ CryptoService cryptoService(HaloProperties haloProperties) {
         return new RsaKeyService(haloProperties.getWorkDir().resolve("keys"));
     }
 
-    private static ServerWebExchangeMatcher createHtmlMatcher() {
-        ServerWebExchangeMatcher get =
-            ServerWebExchangeMatchers.pathMatchers(HttpMethod.GET, "/**");
-        ServerWebExchangeMatcher notFavicon = new NegatedServerWebExchangeMatcher(
-            ServerWebExchangeMatchers.pathMatchers("/favicon.*"));
-        MediaTypeServerWebExchangeMatcher html =
-            new MediaTypeServerWebExchangeMatcher(MediaType.TEXT_HTML);
-        html.setIgnoredMediaTypes(Collections.singleton(MediaType.ALL));
-        return new AndServerWebExchangeMatcher(get, notFavicon, html);
-    }
+
 }
diff --git a/application/src/main/java/run/halo/app/security/authorization/AuthorizationExchangeConfigurers.java b/application/src/main/java/run/halo/app/security/authorization/AuthorizationExchangeConfigurers.java
new file mode 100644
index 0000000000..e59f8fec41
--- /dev/null
+++ b/application/src/main/java/run/halo/app/security/authorization/AuthorizationExchangeConfigurers.java
@@ -0,0 +1,107 @@
+package run.halo.app.security.authorization;
+
+import java.util.Collections;
+import org.springframework.context.annotation.Bean;
+import org.springframework.core.annotation.Order;
+import org.springframework.http.HttpMethod;
+import org.springframework.http.MediaType;
+import org.springframework.security.authentication.AuthenticationTrustResolver;
+import org.springframework.security.authentication.AuthenticationTrustResolverImpl;
+import org.springframework.security.authorization.AuthorizationDecision;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.web.server.util.matcher.AndServerWebExchangeMatcher;
+import org.springframework.security.web.server.util.matcher.MediaTypeServerWebExchangeMatcher;
+import org.springframework.security.web.server.util.matcher.NegatedServerWebExchangeMatcher;
+import org.springframework.security.web.server.util.matcher.ServerWebExchangeMatcher;
+import org.springframework.security.web.server.util.matcher.ServerWebExchangeMatchers;
+import org.springframework.stereotype.Component;
+import reactor.core.publisher.Mono;
+import run.halo.app.core.user.service.RoleService;
+import run.halo.app.security.authentication.SecurityConfigurer;
+
+/**
+ * Authorization exchange configurers.
+ *
+ * @author johnniang
+ * @since 2.20.0
+ */
+@Component
+class AuthorizationExchangeConfigurers {
+
+    private final AuthenticationTrustResolver authenticationTrustResolver =
+        new AuthenticationTrustResolverImpl();
+
+    @Bean
+    @Order(0)
+    SecurityConfigurer apiAuthorizationConfigurer(RoleService roleService) {
+        return http -> http.authorizeExchange(
+            spec -> spec.pathMatchers("/api/**", "/apis/**", "/actuator/**")
+                .access(new RequestInfoAuthorizationManager(roleService)));
+    }
+
+    @Bean
+    @Order(100)
+    SecurityConfigurer unauthenticatedAuthorizationConfigurer() {
+        return http -> http.authorizeExchange(spec -> {
+            spec.pathMatchers(HttpMethod.GET, "/login", "/signup")
+                .access((authentication, context) -> authentication.map(
+                        a -> !authenticationTrustResolver.isAuthenticated(a)
+                    )
+                    .defaultIfEmpty(true)
+                    .map(AuthorizationDecision::new));
+        });
+    }
+
+    @Bean
+    @Order(200)
+    SecurityConfigurer preAuthenticationAuthorizationConfigurer() {
+        return http -> http.authorizeExchange(spec -> spec.pathMatchers(
+            "/login/**",
+            "/challenges/**",
+            "/password-reset/**",
+            "/signup",
+            "/logout"
+        ).permitAll());
+    }
+
+    @Bean
+    @Order(300)
+    SecurityConfigurer authenticatedAuthorizationConfigurer() {
+        // Anonymous user is not allowed
+        return http -> http.authorizeExchange(
+            spec -> spec.pathMatchers("/console/**", "/uc/**").authenticated()
+        );
+    }
+
+    @Bean
+    @Order(400)
+    SecurityConfigurer anonymousOrAuthenticatedAuthorizationConfigurer() {
+        return http -> http.authorizeExchange(
+            spec -> spec.matchers(createHtmlMatcher()).access((authentication, context) ->
+                // we only need to check the authentication is authenticated
+                // because we treat anonymous user as authenticated
+                authentication.map(Authentication::isAuthenticated)
+                    .map(AuthorizationDecision::new)
+                    .switchIfEmpty(Mono.fromSupplier(() -> new AuthorizationDecision(false)))
+            )
+        );
+    }
+
+    @Bean
+    @Order
+    SecurityConfigurer permitAllAuthorizationConfigurer() {
+        return http -> http.authorizeExchange(spec -> spec.anyExchange().permitAll());
+    }
+
+    private static ServerWebExchangeMatcher createHtmlMatcher() {
+        ServerWebExchangeMatcher get =
+            ServerWebExchangeMatchers.pathMatchers(HttpMethod.GET, "/**");
+        ServerWebExchangeMatcher notFavicon = new NegatedServerWebExchangeMatcher(
+            ServerWebExchangeMatchers.pathMatchers("/favicon.*"));
+        MediaTypeServerWebExchangeMatcher html =
+            new MediaTypeServerWebExchangeMatcher(MediaType.TEXT_HTML);
+        html.setIgnoredMediaTypes(Collections.singleton(MediaType.ALL));
+        return new AndServerWebExchangeMatcher(get, notFavicon, html);
+    }
+
+}
diff --git a/application/src/main/java/run/halo/app/security/authorization/NotAuthenticatedAuthorizationManager.java b/application/src/main/java/run/halo/app/security/authorization/NotAuthenticatedAuthorizationManager.java
deleted file mode 100644
index c0435f5d0e..0000000000
--- a/application/src/main/java/run/halo/app/security/authorization/NotAuthenticatedAuthorizationManager.java
+++ /dev/null
@@ -1,30 +0,0 @@
-package run.halo.app.security.authorization;
-
-import org.springframework.security.authentication.AuthenticationTrustResolver;
-import org.springframework.security.authentication.AuthenticationTrustResolverImpl;
-import org.springframework.security.authorization.AuthorizationDecision;
-import org.springframework.security.authorization.ReactiveAuthorizationManager;
-import org.springframework.security.core.Authentication;
-import org.springframework.security.web.server.authorization.AuthorizationContext;
-import reactor.core.publisher.Mono;
-
-/**
- * Authorization manager that checks if the user is not authenticated.
- *
- * @author johnniang
- * @since 2.20.0
- */
-public class NotAuthenticatedAuthorizationManager
-    implements ReactiveAuthorizationManager<AuthorizationContext> {
-
-    private final AuthenticationTrustResolver trustResolver = new AuthenticationTrustResolverImpl();
-
-    @Override
-    public Mono<AuthorizationDecision> check(Mono<Authentication> authentication,
-        AuthorizationContext object) {
-        return authentication.map(a -> !trustResolver.isAuthenticated(a))
-            .defaultIfEmpty(true)
-            .map(AuthorizationDecision::new);
-    }
-
-}

From f632322dba8f64b2e2b6d7ea03b8f70c3565ee2c Mon Sep 17 00:00:00 2001
From: Takagi <1103069291@qq.com>
Date: Tue, 8 Oct 2024 15:28:54 +0800
Subject: [PATCH 088/185] pref: remove anonymous and ghost users from the
 userSelect (#6781)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/kind improvement
/area ui
/milsetone 2.20.x

#### What this PR does / why we need it:

在 userSelect 查询用户列表时，移除匿名与已删除用户这两个保留用户。

#### How to test it?

在文章设置，用户列表中不存在匿名与已删除用户即可。

#### Which issue(s) this PR fixes:

Fixes #6665

#### Does this PR introduce a user-facing change?
```release-note
在 user select 中不再显示匿名与已删除用户。
```
---
 ui/src/formkit/inputs/user-select.ts | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/ui/src/formkit/inputs/user-select.ts b/ui/src/formkit/inputs/user-select.ts
index 3cc7d2141a..1f233ea112 100644
--- a/ui/src/formkit/inputs/user-select.ts
+++ b/ui/src/formkit/inputs/user-select.ts
@@ -1,15 +1,16 @@
-// TODO: This is a temporary approach.
-// We will provide searchable user selection components in the future.
-
 import type { FormKitNode, FormKitTypeDefinition } from "@formkit/core";
 import { consoleApiClient } from "@halo-dev/api-client";
 import { select } from "./select";
 
+const ANONYMOUSUSER_NAME = "anonymousUser";
+const DELETEDUSER_NAME = "ghost";
+
 const search = async ({ page, size, keyword }) => {
   const { data } = await consoleApiClient.user.listUsers({
     page,
     size,
     keyword,
+    fieldSelector: [`name!=${ANONYMOUSUSER_NAME}`, `name!=${DELETEDUSER_NAME}`],
   });
   return {
     options: data.items?.map((user) => {

From 1d31d323128861f3fd4cf7b6ea1a5ddc52235b2f Mon Sep 17 00:00:00 2001
From: Ryan Wang <i@ryanc.cc>
Date: Tue, 8 Oct 2024 16:06:53 +0800
Subject: [PATCH 089/185] fix: resolve issue with code input can not displaying
 fullscreen in modal component (#6787)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/area ui
/kind bug
/milestone 2.20.x

#### What this PR does / why we need it:

修复 Code 输入框在模态框（VModal）组件中无法正常全屏显示的问题。

#### Which issue(s) this PR fixes:

Fixes https://github.com/halo-dev/halo/issues/6682

#### Does this PR introduce a user-facing change?

```release-note
修复 Code 输入框在模态框（VModal）组件中无法正常全屏显示的问题。
```
---
 ui/packages/components/src/components/modal/Modal.vue | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ui/packages/components/src/components/modal/Modal.vue b/ui/packages/components/src/components/modal/Modal.vue
index 019f1f496d..4c7f603ca1 100644
--- a/ui/packages/components/src/components/modal/Modal.vue
+++ b/ui/packages/components/src/components/modal/Modal.vue
@@ -156,7 +156,7 @@ watch(
         <div
           v-show="internalVisible"
           :style="contentStyles"
-          class="modal-content transform transition-all duration-300"
+          class="modal-content transition-all duration-300"
           :class="{ 'modal-focus': focus }"
         >
           <div v-if="$slots.header || title" class="modal-header group">

From f1d5911bb36a260597c283420930b118ad274aa6 Mon Sep 17 00:00:00 2001
From: John Niang <johnniang@foxmail.com>
Date: Tue, 8 Oct 2024 16:24:54 +0800
Subject: [PATCH 090/185] Fix the problem of not being able to resolve headers
 correctly (#6786)

#### What type of PR is this?

/kind bug
/area core
/milestone 2.20.x

#### What this PR does / why we need it:

This PR changes server.forward-header-strategy to native instead of framework due to a bug of Spring Framework 6.20.0-RC.1.

See https://github.com/spring-projects/spring-framework/pull/32097#discussion_r1791264218 for more.

If Halo server is proxied by OpenResty which is using HTTP 2, all header names proxied into Halo server will be lowercase. This behavior makes Halo get a null header(e.g.:: `content-type: application/json`) while invoking `request.getHeaders().getContentType()`.

And I found that `ServerHttpRequest` is mutated by `org.springframework.web.server.adapter.ForwardedHeaderTransformer`, so I try to use native forward-header-strategy to resolve the problem and it works very well. See [reactor.netty.http.server.DefaultHttpForwardedHeaderHandler](https://github.com/reactor/reactor-netty/blob/446683826b3020782fe3d647ef264ca7eace94f6/reactor-netty-http/src/main/java/reactor/netty/http/server/DefaultHttpForwardedHeaderHandler.java) for more.

#### Does this PR introduce a user-facing change?

```release-note
None
```
---
 application/src/main/resources/application.yaml                | 2 +-
 application/src/test/java/run/halo/app/XForwardHeaderTest.java | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/application/src/main/resources/application.yaml b/application/src/main/resources/application.yaml
index b2869a3e11..810ed858ed 100644
--- a/application/src/main/resources/application.yaml
+++ b/application/src/main/resources/application.yaml
@@ -1,6 +1,6 @@
 server:
   port: 8090
-  forward-headers-strategy: framework
+  forward-headers-strategy: native
   compression:
     enabled: true
   error:
diff --git a/application/src/test/java/run/halo/app/XForwardHeaderTest.java b/application/src/test/java/run/halo/app/XForwardHeaderTest.java
index e0e15e9be4..5237b27904 100644
--- a/application/src/test/java/run/halo/app/XForwardHeaderTest.java
+++ b/application/src/test/java/run/halo/app/XForwardHeaderTest.java
@@ -17,7 +17,7 @@
 import reactor.test.StepVerifier;
 
 @SpringBootTest(webEnvironment = RANDOM_PORT,
-    properties = "server.forward-headers-strategy=framework")
+    properties = "server.forward-headers-strategy=native")
 class XForwardHeaderTest {
 
     @LocalServerPort

From 223eb88b1038538b0b82f63f134a6f1a57e89c2a Mon Sep 17 00:00:00 2001
From: Ryan Wang <i@ryanc.cc>
Date: Tue, 8 Oct 2024 16:58:53 +0800
Subject: [PATCH 091/185] refactor: update local login method icons (#6783)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/area core
/kind improvement
/milestone 2.20.x

#### What this PR does / why we need it:

更新本地登录方式的图标。

<img width="514" alt="image" src="https://github.com/user-attachments/assets/d8624548-c1b1-4f26-bf2f-353f127af7e5">


#### Which issue(s) this PR fixes:

Fixes https://github.com/halo-dev/halo/issues/6759

#### Does this PR introduce a user-facing change?

```release-note
None
```
---
 application/src/main/resources/extensions/authproviders.yaml  | 4 ++--
 .../static/images/login-methods/login-with-credentials.svg    | 1 +
 2 files changed, 3 insertions(+), 2 deletions(-)
 create mode 100644 application/src/main/resources/static/images/login-methods/login-with-credentials.svg

diff --git a/application/src/main/resources/extensions/authproviders.yaml b/application/src/main/resources/extensions/authproviders.yaml
index 87cad00e27..82080199b1 100644
--- a/application/src/main/resources/extensions/authproviders.yaml
+++ b/application/src/main/resources/extensions/authproviders.yaml
@@ -10,9 +10,9 @@ metadata:
 spec:
   displayName: Local
   description: Built-in authentication for Halo.
-  logo: /images/logo.png
+  logo: /images/login-methods/login-with-credentials.svg
   website: https://www.halo.run
   authenticationUrl: /login
   method: post
   rememberMeSupport: true
-  authType: form
+  authType: form
\ No newline at end of file
diff --git a/application/src/main/resources/static/images/login-methods/login-with-credentials.svg b/application/src/main/resources/static/images/login-methods/login-with-credentials.svg
new file mode 100644
index 0000000000..2e323aa68a
--- /dev/null
+++ b/application/src/main/resources/static/images/login-methods/login-with-credentials.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="rgba(75,85,99,1)"><path d="M3 4.99509C3 3.89323 3.89262 3 4.99509 3H19.0049C20.1068 3 21 3.89262 21 4.99509V19.0049C21 20.1068 20.1074 21 19.0049 21H4.99509C3.89323 21 3 20.1074 3 19.0049V4.99509ZM5 5V19H19V5H5ZM7.97216 18.1808C7.35347 17.9129 6.76719 17.5843 6.22083 17.2024C7.46773 15.2753 9.63602 14 12.1022 14C14.5015 14 16.6189 15.2071 17.8801 17.0472C17.3438 17.4436 16.7664 17.7877 16.1555 18.0718C15.2472 16.8166 13.77 16 12.1022 16C10.3865 16 8.87271 16.8641 7.97216 18.1808ZM12 13C10.067 13 8.5 11.433 8.5 9.5C8.5 7.567 10.067 6 12 6C13.933 6 15.5 7.567 15.5 9.5C15.5 11.433 13.933 13 12 13ZM12 11C12.8284 11 13.5 10.3284 13.5 9.5C13.5 8.67157 12.8284 8 12 8C11.1716 8 10.5 8.67157 10.5 9.5C10.5 10.3284 11.1716 11 12 11Z"></path></svg>
\ No newline at end of file

From 479b439ce44cbd199d657f1ddfd2413fa893351b Mon Sep 17 00:00:00 2001
From: Ryan Wang <i@ryanc.cc>
Date: Tue, 8 Oct 2024 17:14:54 +0800
Subject: [PATCH 092/185] chore: bump preset plugins version (#6792)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/area core
/kind improvement
/milestone 2.20.x

#### What this PR does / why we need it:

升级预设插件的版本。

#### Does this PR introduce a user-facing change?

```release-note
None
```
---
 application/build.gradle | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/application/build.gradle b/application/build.gradle
index 2103485192..47c9d9168c 100644
--- a/application/build.gradle
+++ b/application/build.gradle
@@ -128,7 +128,7 @@ ext.presetPluginUrls = [
         // Currently, plugin-app-store is not open source, so we need to download it from the official website.
         // Please see https://github.com/halo-dev/plugin-app-store/issues/55
         // https://www.halo.run/store/apps/app-VYJbF
-        'https://www.halo.run/store/apps/app-VYJbF/releases/download/app-release-BpYuv/assets/app-release-BpYuv-LTHgb': 'appstore.jar',
+        'https://www.halo.run/store/apps/app-VYJbF/releases/download/app-release-CZSAd/assets/app-release-CZSAd-KZEqI': 'appstore.jar',
 ]
 
 tasks.register('downloadPluginPresets', Download) {

From c39f937b5bfb2fd025134d16299a53de71647b35 Mon Sep 17 00:00:00 2001
From: Ryan Wang <i@ryanc.cc>
Date: Tue, 8 Oct 2024 18:25:22 +0800
Subject: [PATCH 093/185] chore: add LIlGG as a approver (#6795)

---
 OWNERS | 1 +
 1 file changed, 1 insertion(+)

diff --git a/OWNERS b/OWNERS
index a707d8b421..5691d610b4 100644
--- a/OWNERS
+++ b/OWNERS
@@ -9,3 +9,4 @@ approvers:
 - ruibaby
 - guqing
 - JohnNiang
+- LIlGG

From 2555cbf6ffd83d347b3e356e5202a88c82a4a12c Mon Sep 17 00:00:00 2001
From: Ryan Wang <i@ryanc.cc>
Date: Tue, 8 Oct 2024 18:28:55 +0800
Subject: [PATCH 094/185] fix: JavaScript error on signup page (#6788)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/area core
/kind bug
/milestone 2.20.x

#### What this PR does / why we need it:

修复注册页面的 JS 错误。

#### Does this PR introduce a user-facing change?

```release-note
None
```
---
 .../gateway_modules/form_fragments.html       | 34 +++++++++++--------
 1 file changed, 19 insertions(+), 15 deletions(-)

diff --git a/application/src/main/resources/templates/gateway_modules/form_fragments.html b/application/src/main/resources/templates/gateway_modules/form_fragments.html
index 1a80002818..e0d50c0443 100644
--- a/application/src/main/resources/templates/gateway_modules/form_fragments.html
+++ b/application/src/main/resources/templates/gateway_modules/form_fragments.html
@@ -152,13 +152,31 @@
     </div>
 
     <script th:inline="javascript">
+        document.addEventListener("DOMContentLoaded", function () {
+            var password = document.getElementById("password"),
+                confirm_password = document.getElementById("confirmPassword");
+
+            function validatePassword() {
+                if (password.value != confirm_password.value) {
+                    confirm_password.setCustomValidity("Passwords Don't Match");
+                } else {
+                    confirm_password.setCustomValidity("");
+                }
+            }
+
+            password.onchange = validatePassword;
+            confirm_password.onkeyup = validatePassword;
+        });
+    </script>
+
+    <script th:if="${globalInfo.mustVerifyEmailOnRegistration}" th:inline="javascript">
         document.addEventListener("DOMContentLoaded", function () {
             function sendRequest() {
                 return new Promise((resolve, reject) => {
                     const email = document.getElementById("email").value;
 
                     if (!email) {
-                        throw new Error(/*[[#{form.signup.emailCode.send.emptyValidation}]]*/);
+                        throw new Error(/*[[#{form.signup.emailCode.send.emptyValidation}]]*/"");
                     }
 
                     fetch("/signup/send-email-code", {
@@ -183,20 +201,6 @@
 
             const emailCodeSendButton = document.getElementById("emailCodeSendButton");
             sendVerificationCode(emailCodeSendButton, sendRequest);
-
-            var password = document.getElementById("password"),
-                confirm_password = document.getElementById("confirmPassword");
-
-            function validatePassword() {
-                if (password.value != confirm_password.value) {
-                    confirm_password.setCustomValidity("Passwords Don't Match");
-                } else {
-                    confirm_password.setCustomValidity("");
-                }
-            }
-
-            password.onchange = validatePassword;
-            confirm_password.onkeyup = validatePassword;
         });
     </script>
 </form>

From 16641e3331e92b080150d9b39dfc4af406e297cc Mon Sep 17 00:00:00 2001
From: Ryan Wang <i@ryanc.cc>
Date: Tue, 8 Oct 2024 18:30:55 +0800
Subject: [PATCH 095/185] refactor: improve error message styling for reset
 password form (#6791)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/area core
/kind improvement
/milestone 2.20.x

#### What this PR does / why we need it:

优化重置密码表单的错误提示样式。

#### Does this PR introduce a user-facing change?

```release-note
None
```
---
 .../resources/templates/gateway_modules/form_fragments.html   | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/application/src/main/resources/templates/gateway_modules/form_fragments.html b/application/src/main/resources/templates/gateway_modules/form_fragments.html
index e0d50c0443..c664d37fb7 100644
--- a/application/src/main/resources/templates/gateway_modules/form_fragments.html
+++ b/application/src/main/resources/templates/gateway_modules/form_fragments.html
@@ -248,7 +248,9 @@
     th:action="@{/password-reset/{resetToken}(resetToken=${resetToken})}"
     method="post"
 >
-    <p style="color: red" role="alert" th:if="${error}" th:text="${error}"></p>
+    <div class="alert alert-error" role="alert" th:if="${error}">
+        <strong th:text="${error}"></strong>
+    </div>
     <div class="form-item">
         <label for="password" th:text="#{form.passwordResetLink.password.label}">Password</label>
         <th:block

From c82b65be990f320ebbec2592af39d0173d0ffe4b Mon Sep 17 00:00:00 2001
From: Ryan Wang <i@ryanc.cc>
Date: Tue, 8 Oct 2024 18:32:54 +0800
Subject: [PATCH 096/185] chore: bump preset theme version (#6794)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/area core
/kind improvement
/milestone 2.20.x

#### What this PR does / why we need it:

更新默认主题的版本。

#### Does this PR introduce a user-facing change?

```release-note
None
```
---
 .../src/main/resources/themes/theme-earth.zip | Bin 371003 -> 371688 bytes
 1 file changed, 0 insertions(+), 0 deletions(-)

diff --git a/application/src/main/resources/themes/theme-earth.zip b/application/src/main/resources/themes/theme-earth.zip
index aa2fcd9634ce4df5eb4ad9b9db8da9f22f282cc8..b636c959438fe2734476f2533716f671182c458a 100644
GIT binary patch
delta 60505
zcmZsCV{~QP)@^LtHY>Jm+qTUe+qP}nso1VKRk4#wQgQO?oO<7T_uTXC-F91TwLZt%
zbN*O;^wH;--HR9}YZ&l~GN52+Kv2KGNl}uC@Pu%t&tMkjzkh#SlM^-Z8`bPV;eTUV
zK>zpSnmiAR{m)^87<kFZU{s)^EcD5|U|0Z_tc3{!qizdv<FaxevhUltDrPWUub=0i
z)t~Y9p!o0jI24P^F|7PhXuVJnucHZBbCSbICM6gz(n!I)14K)dQZ!V9F(J_nU@Ayh
z9U08QYGnv!UB;>`(iHDvNy^HD^ON4<$^#|pqdOU*ALBygr0bNA7r~W=F(~j;VCVqT
zAY|!xYJ36_PSQ-pKxTV|)~9(kR10)bK!^v_<)UV`+m7wJ%elQ7M-%D$XrM9$6*%Z&
zGl%egR$L_iw5(-B6RIG0Yd($+CLzO7O)_<RlVR>O>JuX7UE+%I4OvNUoTP{^na^$d
z=n_o+EZM4(p=BKux^eQy(X#LUcN;){Q{%_g@Q83h%}5lBz`5;K`==UZ|F>5bb-M*_
zou+sL?FWtb-f!hlLIgPL&?$@qH*}NH#~_hejB8n`#pZ{4cRThb?ZyIn@wl_1SmsPa
z$frrMYnr=1Y@}9HsfgBdtZOb&QMnu}{NQhq(E^BXMbDB!h~hi!?tva{TVnyVtbS13
zGTVZC@(y{N9tyZR%`=x{BpMOabPG|IDNhsSU-<zsn&%3j1bO%2*&KYm57BV>pg*zT
zfvx$YDc!~&fo_YKIM+vL;)XjOF>n-iM)4t11q&e!G69wX-`uL*%GD3go57Zu6~QDH
zdH8(0s0fWv4Ly%xAQJdrWnlpI#wjb>{>gNYT318HxiKpX@_d<8HJ|}Z3DM*g9{{%R
z*oC-jX1!t8-4`^0cTH0vRgupMdpuT*&snF62=buGrbaB6M%kylc;IH><qRHj@P7QR
zq-;-K){d5YKKK|N*6D0wEM04yYTwOxBhMFbXGaC^im(+7-YQqU?nwZ+(5b(6yj^^j
zaz8zEdEWD5ya@&55@AFLrmQ@Srzf+bBKyt!q_}hh>Uel8{8P%@y}NSpEE|-<{1$L3
z3M@O_Yb-}1PPeaYh=}jZm9odPnhL3<*)>KrRYE~>91<eT=Pn_=+>H93U0P|c<apQR
zaqL|1HZiC4m>mLm7dZjelwlM#DjG*Qk#}SEZslCP<E<@RR>qoV+!@_tbJ@64v)?;i
zK6DfCv<4h$IQb)(k&C84O=Jb#Sm{fY6$>L?y;)dQh2jX}NfcoRsgY^s@;(-7^Ey@@
z-Q70xvhC>XqtPZB-7CT(ml+5(YTFUCzNHW0&B<=AEJbL9c3c3)fT&SR7*DS^4h%@%
z)|}<7`!q?w(+kSPJ2Yo+CnSR4OBut$OB1E^Xt4wt<$nfhZ|QwMNPBRK4OuuymVx1U
zJkk0Qc<E=+3<Wnk$|_DdBZ1X?Y+lpM!N+1Qh@VuHHp8Lc6?utYf)|J63O^x4o-9Z9
zMs2{nBRd6|Tw(;+3JH=EbjDhD&X?c%9%JN87lGJF93~$Nf_=mq8%yeX_RDT(5AoK0
z<QVdhb=Fg#_BdcNQxRBv--xU;BBcjdO?@L|NlsvwNY-MgVuhctCH*lIeT($MVV$H-
zqxR9(L8gCTjFUZL{!>KOTSAs?h($dl!)6w0)WB0c*3c1fNig{IV#CC?j{}!`(8F(2
z_emMZdnAesR^;L1L@IS%Q!h5Y9gJ;p7@Co@pM>l!p!S+aDh~a8ZB`rf^9!VQA$dUa
zS^XCG1cM$X-7V1JYli{&o$=TQb7f`CokuQ+#6VZwsTnvHb(XE%2TG=+;yfG}_#GD7
z5DTH3`#KT;H;Ik{<DHvO_mh8!uWMJ+hor5*-m+Ly>PF;vN8iOS-RBM^4B46mWVH)1
z#|dF}#1N#{B|%c*$HfY25LheH+90n*te1u^E*_?GOHkVB#MM^Xi?asIIEUZ2utoZ=
zn)W4QYi1DXHn2OWukkU>D($oG7rXv#*0i@jzIOuvA9FvGY8n%dex`+GG<dA(^EEvZ
zuwAR?o&|n;q6)Pdv@ek^;qLJc5}`&-bp<c0z%s8=>2oPRw|}rR{$YqDrN)4|CMiuB
z+xkAb;E<~f5^O_)?mCV#duLF)R9c4&peizcKH~}(I!_6@NLBMWZ2fGuna5K`dQUHy
zg0z_d9EU4w;|Q6MO059fP_Tw2ONY*q%S>Mp8Vr6($c4?SS4{>R(f=kY9L0V@UlKR?
zrs1R$^#wg1h#U)G3i91j^t?cJ@P&P^0p#Ec-O5>`eefejR*U7EvkqK3W{m@=e|4(F
zWTz(%2JqrB`_7Au6Vt`uD1`^x(xgZ1sMWa^phKsCk~6fq2mW#9#&JzEY+}`UXbSN1
z{2cv(c2F-7JzM?0gFFS1ouJ*iBi-A0Ps<`9D&!T=EAhi0bccZyRGh&$iSd<WvuTc_
zu~*8>T)+qGcmPn!A{}tZ>p9nAuw%!&d2hg0+l>ABu?6|+*f`(wI>epZ%;E7)%cQ&v
z_||;9dMfg|kmS~Aw6eof-TiCCs+d{CfZt~G*GSX5;Z*I)OXfB=Cgjy^q0Vb=^|*YI
ztG58m!Yd;5!mNer5`&1MOl2zRqd%>M!R=98Z{yvSQU=rKMkt{5_ztN%!bY!0x#+^s
zlH^%`Zmdzh?1>*GJbEdQo@@c(Hd@ynfILHAprb|2efC;;UA8(=^w}V(yX0e3{(*_M
zxx;xo6ylxDwN{9k&WYIw`Cb1R3MeE72sF&bM<n|T%VKN?Dl&QCH$GCHlWrwjt5^ET
zX2k>eNe(Rm4adhzf_w+#k)Is08D||6hHt6SKfaJKiR1}RYo13i5-!?A9?JRL0@CYV
zt9DeKCdhpdC*xY54|MIG=(vv`1-hj6Pv4Uiobq5(&~i~rO3x7<x<oEf9=k*i&wqA_
z^j<0Q4C;AQ7&ZJ2{Jtf<??GULRN~2RHFP(}P3;^9G+!*2Id2k@ooksFq0jd}W%oz+
z`flM8zz;!tg7887#AI5X0myP+PVg!ULm{HI+yZOKJ<czqv!=EPgA87r?p~htyzW=2
zyq?0KKz#Eh-v7oYRh><5Bp|iRAY#JI2kbJ8gyr0L-LEJE2?ZD40rCq92*~vd5YQi?
z^p^(uPcih@Jq!>%kgJ)UqpgvvnG2(uDm(%Z<X`G3`hQduus=z%BRm-De+KrF00E%_
z(Weuog8vaye?|PQxqgc&z@fHI{8k&f|6_eYtB?hTmbE#DetYKC1%;!^!AKxsP9Iw6
zU?L}}JGl~3Wv8jf&!k_iVg%Y?;{Zwh;QOC8)?eQ-`N+g#>sXp2^OZq=NuqgqGVFHV
z%xlDp5LC#CE0rWYy)2}Dc!kV!N2+isEi6Z;OdgoBYS*gwMX^K20;n@zb?JCB%8DWj
zv}8fJANc!aJTt~r<BXfWcM2y*5_7A{j-bgc@OWUSPo`tT`?9o&T^9il-8||&QDqj5
zJYh#w>@^(Rbx(*23`q{Ch^eT-VK|smKu=|og(PwvM@1P=_YG8-66Ydw==NNm@JC0c
zgh`<<guHy=wSe7?0{p;C)<4A$z#*}MVo|A^k5mmRg*|0?R!XXzailaENLS6VUx3Hq
z9gQ5q+y~Ao7~FF`=j(zv)C>G&&V*>+igO%9hw=>s4Z+9rg=acK%R3q@wmeT2SJ6(i
z^5^}%<oxsU>z+NBt_r!tuRF^@)s#6$;jeb%8kK~SUd=f>zyQLeTUQ=Bf--sO;qq4)
z-@-&A+XK$csj|H|Iga6;hr*!@RTB{Za9RIpRQM>aNb(hRO`K#kCgafo;rFM7tYut+
zxz^C&eI1A(v$HNk9%8x&OxDsMs+T0l;U$AjtK#jRVs`3*2O3cN`4(35@w5^7K#0v{
z72W|Htp-LYMgTgjJ%{8iTtX24aDV?BsP=a+f-$P`&;t;QoKl?ipkpgZk)F5(+dvIu
zPK3!DA4zernz$4qYEIM)G*nHzBcgc!PP}-f5;yKfR40@oqy%PQ5@v|Z+xk(HYQ^%T
z>XRX+DP<tik-LmKWZMi$JjLOeAfRE%h1MY!l1g$beE|K!RO9iuRjLIUy_B(-ITJdk
zxw00_?NB#_-*Cxx7GdAV(L?{o5hsoqCb>t!LKH*dFQ$ecI1*2%s3qjNV?-1a=xeG*
z?ncm$Pe?ZGjXS~4nC3tyBl`^jLVQ0t9WCJuIG#Aes!2%H8bVh&$)aR?d38X>!$B|U
zgPVnzmH_dR(|(ENUrPGN2P=<L*5E5B@lPtM`dE>^h^L^a)bH(mFpxv%!oh^gRgidZ
ztrc$${@S6{z<9+~JOvEk|KRTW$Otx==I|6>iCSzC%$B7v@7kl4s0nI>p@Tadisn9*
z77J-orTqd<Qu5PSbXui>F~Rq^j^{|Er*w!?CIO(@F`%k-MdDtF#=}!gLd-qxun8+0
zv9zgn6fO($gFW9;OdV5q4a1<(w2)d7nRQj?s;%@p`D@INJ11<VmONR1;>L~k*4U0i
ze^O;1yR-h58uhzx{r5N*t7`A0Ef0o%Y7G{oY9MMNF#W7XECk`~SoC1)dyi8Uowz<Q
zCNqF99#^9@$(QM{m}=)2Lm|bTz4jFyA`^a0Ui7t=Ogf@4_$h@(xR{MHVb=zq4^wNq
zez*D8pCHdqU|U(zfZ0KYD&=R>XE<T+`y}#v+lD}ar)L+uFvaJs_F*5l>?%39^lLZA
z$_FpL4GHtH+G=bxrJth)%;V7~=FB@qpZ<V{V~*XA;_zJQx)VIhK6elTW0g&+;}7yA
z*1UZ^y@q0?eW67|kWAViAiikMrEf_30Z6cdkl$}w&>7E&IV~6mbTXDxw~<J0q1Wld
z3rR5Y;Sa<?;!%^4DWIh$f)M1d&%gQ@twPN{sL|zkvzjWRA4uQ2Ds+G(Wwz0oet`h!
zGm_?weRrr~X}SFtgOTd#BoJgu=_M;6o|m|j7mZ7Q-ok?YF07aueNX<0UtC>@!qw~0
zMZ>KL#6_<<6C;ZPZVHZ8?n^GIKB`&KWv)BGRP@v+2&t&ye2tUj&<4!hdXf^r>lL&I
zgdzMgsDQhptLpY;GmMDHqE9c*$SVOLqw%Yhw{!$5$1X<EeB9h;D*2&>Sv-YpfDuum
z&-rR8F2eG_rmDm0M<26N_EKu(42=iy*-XPWbhblSI2-?UH0KDzn!wxLwZq4|nF6O(
z=yoFLdEU+Z_Zc81_{-7L#nG~edj0jR%T%{i@taSgi0`IAlnk71qxUL0+g4A2Jom23
z1+c23Rwv(zz_mhV{R^l0GFHT2k=A~JveswqdBJwj)uUr55wU3Nta{m2%fe_mtzzKH
zY#vqiHhoY?1++H$ZFf9Die;DF4+J_>VR{fOUcG^MW8NIqp0htP!rbCu`+A(`Uefe@
zT;Z+W+NaR6)m*=RO`}^a7<nfKJP2k!{Bqr@DU8B%=wy}ZQxjp+>$z;Nt=jdj<>%qs
zkL36EOR@F|f&an&nFHoNt8+6|r1~N7I0q)LtC+YK5J^-v#!Vw5(zaK&>jW0(9|Yiq
z+e9>}hTH)kiW}i5sn1VJD=<dl)2dW+%IX}pSI&wW+-)mw^Ua=ZoXRi<>>u-zF=dhH
zZNJ0$RUER2pP1;G5f|8BhaNQ6IaN@WaScVbiFCWo0~)IOMUUkd!Qw*I>!RIst7CYy
z<Lv}CTH{-N7rZn$7O=Y4(W=NHiDaaZ0`HQ+vpRNId&aZ!m$k8PRyv#*UbV4T*uyew
zGcRpmFXTHZ`I>F|)FV~_H?)}D86fUK5V~1@@sB)?KTF!Lm0+#aaFgv}Mf`?|Ceu+L
zfEQc2vhjz<x@L6n%*=z5bb5k<qqk;24>Kysmh@JykdE!$rVpXB<QE2Z^5O1NW4lEL
zSqSW>M`B6n^o5YdtdpJQB{1wDHaFtD;H~Oz&#tN_<;g7vqBhn6a&A-_T}&F+`Dz<^
zFP)E1@HI6VeLYLQyetrm*9!iyD2m^8u;4bqx9Z$F%LkRt^9W9|H^7?rzs5)S5}zd9
z>LO&vDi5+fsWh3wE|qgKYq_%Zi{_oFL!ZsgjtRa3)Ay=RH6^gog7NJ=UP74L_>tQ_
zP&Uq*xF9W*29TivmO6!7i*JJwm-h4gwR+FhPZN^YWo3Y>!(U6eyRkO26J~MDADjAb
zj~v&}>hMD+6#`!K`AAeW?@Sgf*9hXj?jtW0Y(<BOU}2U`#S+H+3?{k`H!7AzepQG~
zB{}llT5w)s+pQC225R@3C!l*ot#|C`?vOKYJzux(Z6UNZdHL~crXApYH}kk6qalae
zme&y+v0$88F{LApxXqmFVGt18yKQ8ouv<X#5Lm5kIQC|d`U(7(WQ#%^?ID8(0{Tl|
z{lnY(fBuyP>L2A5_`fJG0>Eb67AscYwMvK8$VHVKb8|zec(#^e<ySc+avJ+Y%3IlK
zZYNV79#r#kjsf}#j)?Mt_6nlBu&6`&r%ODF@XU4l5otS$w$Hmq!kp&rL@2jJCA9Mp
zh3lNmG5ip9Xob}J{ej5V*_3Oqsl&w;r$j~hi7j;J?*mNuuSw=PApllK{W?_S!yKCU
zWZ?sx=RPy<lFTDC@RJYiM%Tepm!^WcNz0RsTzKyQaj4;b$X^j<D=#8wD%1fthZ~PG
z3YySjRaRBiBWE*tWJ)ecq7BTL!YW#|sf-O(nxYn8>B_l|;rl6bsLa%sndB;9r(D_`
zWkj~l<~hPx9EHeY_W-6etX<_TVA&~C%S&WSBTBnNin_{PJwnHpu9%cK`7sjX62%L*
zqn#|^ka>ZS7P=vrqp2=Z7|>84<-ufQ7sJrAi?C$Wh<K&2jt;Vw?$fuLi(Y%aUB3i9
zs!}!VePGM>eZx>m7)cssw-qbzrVQb|sVEj_lpaVc>{`87y8#85KWmKjYuAO?N-I`s
z6u!0ljW+<Zbp#wEs~ALl1u~KED5AhfXEzkd`Gy~{BPYqM&o;EX9YoX8ij3SXS~w`Y
zCz)7|9D5U0ybi)>GC)3gBS8hy|I$#zxqt>>CeUcnJL4*+1tW_bBEEs_?wd(9zXO@8
z&{xi4SJmTA69#lp?<mx<CgRXbhAC*%1wdQ%YCaxQd*W&C7!V3m6NN~p>!R%Gbk~oR
zjB1YUlgo*l3Bz%6h%n<Kka`QEGl5r7^^rkeCdl#7&1yEC&}r65hw*r&Z9KL#poN_4
zSQ&j(NmBj7A4z7aa{3bPy})<o_I8~(YeNWoB!CBFF9P6jSIEs9G_81hed<#(SV|qG
z31rR~N~W--@C>;)6HWpVAc$A8U7Xyl;|pSgy-xZD;;UTWijdAj3G`mLcr;L}_n{vF
zJbj<zuL84CL+#g~Tx!9o^A%_NBuKwSFkw=%tM&2ha;|>o<KunT!9Qrjl@WyIa2EWl
zBqFzP+8lsW<rX$=KD-#@<EGhyGpc}8m&-8Wd$*1zPlNgzqQ{AK5c2~<<NDcFZBdq`
z+m$}E<-o}np~HNC|A*)MOFW-+uGiiv!v_!S`x+nlta&J!3~pBB(p*8Dq?kzl0XGH;
zGwQdBxjk@@Dd8`?+}s3c#6_)eIp|@I341gabHo6v3}(A4OE4u89cN8vmEih?;Y1oV
z!%;@P<UpI0`~<YT;{EEn2oHt_d>RaJgxHMHW?h>^f{MTaW)>ka+UWwM3e5xFm!9b`
zVxm{@5;fsEUP~8g$Fo#*Bbzjf7NnnBSOl&O35s$tOVatiM3u8<FT%bvC(QHA<r?pA
zV%LDJKJ83Sp|(npHsL6h#uPG}C_9wG%!DttYVjyHKv(LF`a&$TFosLiZqS;klu%*I
zP;f)>-kr6^AR>uedaEpk7LW2{f&@pC^#~;-r7JM90jpHqs_vi4<;?q8Q47;xguA-p
z+0F6pDH=8gyCd(Ok5wSUS<{?UW<lB;)0hBBnIvI;&>p7m^WFo!*bL;qU353i%;`-%
zW*X`xz{lI+OTC8A<YWPq51TV0T7({Iw9xarn{0<C2?|R-pIoexQvF4GK_6zCh5J!S
zD_ZLU){!!FB+DQj5TqZlwsSClA7?`9dy}ipMLQ&nDemG2)yj?S-qNNm(3(xmI}!js
zRUGty><hi{ul<Axq_PVLk=!?{sdgT^*l)suA8<?nZakziP_zpmaqzBTmzmG1)vL}@
z>qzujTNS)%!uODGY!K|@ZI5^zhH7Q^M4e)U%p*>SKw%HX0#a9ymiSf`PR<4auPop9
zb!I}!{fKs~<xl#)CTrh<ndd6cpmqRaTc_T>w9WPz+B-y+eH%#@N7yRI0_sz$MDgYz
zrqyK&$}BkmVJy6;uJt1tBOuojUmA}%_vIN6+3@FT&~QNmvsB%gl{g9(^b;9lK}P@8
z96%An2;8NKnF;i0;l#AzN_NB}TOG1I7d8+xR%)k{KRN8yc6dACDbdW5YVHHLZaiVX
zlhuntWN{GV<F_K4IZN~vN4o@j`~pS1ymY=Mp!@j?qR4CU2)^i@+se+!vhKNV-Nh`A
z`y?nc!*9iNVO>6k176e)(H430%@*JRv~pq5`uRH*K|&e6v8l^J00I4#fd2Q?^bIn3
z7LVZXy_Ns81DetBT|hy9y9dcpL^S_Kw}_(upw?tm|3<sWw*H`*RP_Hwuc*5Jpfz-~
z|3*LQE<q9g)3xBHOn&)7{I7w4OB^|e{f^%@LC}J%5hT1BW%6`5k_AQv!#v;g6`uK{
zyi7|e{DV?b)TLY#mEwijE2uZ^{3e07ZQ#3*4%!{#i=;F&`9c#5%K(O$pCsK`@7Uuz
z0imB4+F{`q8rlf6nMORrO1}hDtx8&?;3x}YS`*TsX_I!XFSdj7B$XE6iOawnh+;or
zDJU^vw&&VmiI)Z&9aWs&i&_cEvdAP;QhWg}_Tzo6zyEVe07;zmUg!Qmoh<3)<?tOk
zih2&1f)<-c$S6-LOUm=(gB_}h5?-_j!ZPtV>F1FW8FDVF{&!V{NBG*c7^uPwEc{)c
z__}~c8AJcspEuf4jeDkmOptHW)q8y4Ac9KH!NQ?Dcb@v@zmrf_;WJ9Tu^}P)6P{Rz
z0b~OSRw7z|hCHqAK%9cjfoq%riPRcOKJW(!`yh2}5;NP$ODwS?@RPVodh$~Xu^AIc
zi$1H*Ky?gjJw{Aj;!Chb4w|J@fDj^b9@6x9PE+P%+;nIt+{ssf_dG=`m)>;GoIRyg
zoh!*zFNUZNzBHzcJo}R?x7Y|yevxr-`9~<SddX3Lm?t!nlfQ_U;(pGcw2t50S!$a2
zv~sXbTE2qLIR;3>54X@o-Q=PIE!MldEq?RJgdv5m$5zA~`$3LLFG+Oq3$(1<XSW{9
zyAKt;#6P6kzFHgs^2PnNMb1jadyruUV0E~At(knNVUqOT&%^U~K2OW1BK;d?*ocQ$
zi^)P7z?BU1Dcf)QZ3L!<JnHw}WksH`rB2_sKO1V*Oq0n_bxiULv~NB!nrW|AAXu)i
z8tpKytFED8O6l6LAa=f9*nG+8S<^IYT=HX}OyJIfV+lk9n3Utf)|p~J=dnmWN|(2N
zNi7E=DADf`T1g+(Ymu%R5ieyAWQ&U+W2vXJCu)qB5KmZ;dKig^p7PT-pNYc4cevGI
zZu*Lk2B9z}CN>mKmd6beA~|89KeD)8%Pjn*s_`vFx@ZS$KSo|Or(XZK(i@Ww3U$&@
zFREHpZK<jYFpZ;JR8VN3!D(@kNGBzvhpe3t;h%VV5vT46tcGZH)tC?>lY2g=DyR?l
zq?yE^1DnM*D00Y$F7ZrLyhX`DL?}@Ya<4hcTFQSTT#6M>F))J?<tvI=Vv2$*Xs|`+
zW_F3Z2Hq#ZFAdfLpUs&1fhQR<0a>V8g)-rRl!6okP%BmEwhor(erc$t8J^=MI}mT|
zmL@R-4Gjr3x!KtjTynk==-*@I`&GxCO-qtXPA{qzZf2%$;3mSiihC5>&~fDllLu@4
z@q;U{UV=KXDz2Hg*m9P-bF?}~VhAiPP=;AD4xNU96CQ^5^2%c+>aLgBbbcOMV$ijt
z-T@~I(1+<Nrs@b*isD^Pu28g*x#EG85B=8SY@P@~>&wk`J~6*Jz)q$lD}^WGRn-TA
zJU0pA{c4Be2<^1n+_Y0l$RAsl6uO#}KywM3|4|qs`eoJUxoVIfyZ8NF<GRloOiD&9
zDOr}zIq!#=5_{Zq8dW}^S`=FC-9@E=MC)1`;GEuWM@*boI4!smG3A<<81gKW6^pxt
z${Gac6F*zNv=W&d^NvlDOvB8`p9QC4DqqN6f3;;?c>{?a=T?vbq`o)uf+YmETO(g3
zf%)sJm4k+=D$JI{wL{<2_Hp;6UV8T?-bRW;0nL%a&xnR9f4G;3%|U!DhD<>kwP2Ta
zK)350x87LrMPZ|d;!bJ3LQ!Mwn@b|gcwHIVSxG&rq^5JCi|&C`nS59oXPByhuMSKm
z9s5Huxxx0m&~YXvnQX~N)&7@6sXQZ)61h#Se!$LD)x&Xf0{QocX&YSh+1#Y`<=6xD
zQfc<q9_TdFSt?102Sj|Uz<gR2GM?!@z~s#e?YvZB7vqfpw8S&XaRS(pSBnz`Z){Vt
z=DRyl)wzjPQy2t<w*$>BnqN7ZZZ-bTp#$G)?-iO^DNp>{o&gtiXHNAC<+hiTV!Iqs
z<QdhUTcxIVS|%%%ZnZ2ijcy@=-LuohqUqW-=6FgIk?u+5+a}}u++{W@Jy?T;fT+4T
z_Ow+5af_6#c?F`-vZd4?gE1|KSc2}4^qX^#JVj9#;8Pl&!BW(B#J`B)P$hBCGmmH6
zb(jP)^INA~el5tG|IFg|w<~xLf|%0Jr~(I;V;o^*<X<FQKo}yts?y=(-I{u_f0=kX
z_q?H8xUuJOXz%I*DnlA+tPJq}34o-(H@s9~k>UGVkrznnCXcn@;^0{sU+Ks1S(DYr
zZCzk*7nV}Z?*=L?WHJFSR=H@rgziwha_}Zk%psyhk5>#EDJn}6px12Aw?+wD%lu@H
zpng6Ggx?mqIuC4@y1uj|Vue7N``x{&kT>U<bzDCpSeA2s0ME2%)K{iK1_11pMvl#D
zF)4$1I@%&sv;I;kkP*6Ukv~7nZyj4T2w<sGEtZ^NX@iJ)AaW^KX=>vdkbD*VmD*9b
zCL*_6a`loEj>l2tBimr(KA&?#j<@sri~SMl%A`BEbVEPw74G5J`{~`Ys{~}d5NF4R
z%h<*97L#e6p`LxmXcaCL4Zz$%LV|sWO3*w3JNChM-K(rJn4UuG>&cq=P37S0{FRsJ
zl64FFoi_oYN(I0(@e9OdJij3C_UQ`7O0mfJRcSfIn#l2b%B6LAmQ)Qlt;sN4U72K5
z>3Uq^g}n8HWL@5yBuS{l33uWa@KXNQY&Q?0cN%_v3&#lV@!^?ld_XQ>t((3{!tO%J
zP;M}{OV`9QlP131u&@nJD<0Cve+^TG224vCkAm0qo~YcGYft`>NNi9@Pl<GMCA=eG
zY7eo!VYq;YB9-sGqKpOfEq-a*1d5r)cO@EmJqyI;VG2lSmz<gp+iov-w`WkPWRwe0
zRkM{-*L=2zLS}tuAMj0B4-eev(6(!QE&1d~enMm|^6ba%iJ3#T2Sl<g!14sCyxo<{
zC~b$4lKgyYU`4^sE1zr9dRu&^QdcR<Ym-{XuNNKlHf<@JjB(@%YkQmcd?ej)@wSog
z)LxH5XYH$wH#pKO4)=z7z}igh*~Y*$@raiG`^TP;UBMZOJRsZrOYA)FF>*~dV6%GN
zF1#bGSqONnlfv_YP(6T0{0!!oR{2~t0yxliUqN36h__}`0mwWDy*c<St2S7#DMKT?
zLT>cMhnv%J+c&rN_vyrxR$m@_j>{+8qHIS5x^t0ut`EBI%3*tl+h4L>VL%?b4B3Rl
zZ$Izi``_Ni9sz(?3(Nw)*e&Xt2eq&}3E;T=?v~uTu8%ffgr*n1EY0*b=Jb$WwY7v_
zVm1m<?^ij4`kx-h2D`a~3m+HmEk=Oj31<HB?~hO2hqLN^_I*RZRWG&QR*I)0pG&s@
zf2-FsMo$0f-^L0z<-gS{{9oH(KtSdQKtSlf_q3QYz;XW<ji@mbhbxBk+grIuptXf<
zAKTfc%TBx`LXy-i!rKesY_ae*&$^$h=(eyk;Sm<r-5XCtZSMh6{u)?5LGTk}`Tosw
z)V)a(kA&EH+*U(F4e+pJ&{}?+2y@9@Ow}4RH&-@t3|E-Cw+P0b>s8sB3GEB$)Qz+4
z!bnj;iBFLS@G3T26<Cc*Nm}eg$0{n#R^D=HRc{p$Im*ALX~{3ZJzN1^&p+l2kj44#
zk-NTOnV*i^U4>DVY6r$ma}gFPO39RlK19nQsnV8<7Ku}<PbzQI!AGA2olKT#U*Z_#
zI~mIY7jb;^vTzyT2fu->8#)$4Yov$-YR%L*^$CRmP>Ee2goa*DFVUp`?N5jWrBe?`
zVE2h5FU)}^V9C>swC_8a!LFW`uw%f!VQF<WJ)vBfaDu_&H0q`t*_XTCKwV79%DuZT
zc31-g8??`0H;_v;qq}qoj{rO?rNU4^fcQjNNi&kc4_U5ho4(MSe4(rjrM0TE;=SWv
ze*$P#)iCqa7tha#Cq{`Tv*pE%QR#e#o?P|h^;R9V7JYWZi5DVO^H7CsogtU(TJNqT
z&kac_8f`-Z@LrAUKmd*K#7q=YXo;J#-Z8KfI-1vDGu?HLUv%Xo%YCH^%xD7k4)Q*h
zfSQY+<GUt^WKD+dqZ62Ys#<j|q8K26DFDFpXytnB$;*i!ynU3XJNWx@J!}{0G3NJl
z`=*3AI_Q0ITpSryyM={VSu~5tuX_#NRth_-a;R<+aO!G~j(v>-Yb7H|iy=dHZGT7P
z5E}#vky^TnBIZsEeO#nL@cdpUs2jwL4KIPrBKY;ZT+D4}RXcYz^JM@RzV~T>@ea_8
zvCirZ=d9xXb;nNaO7T`#67+#S;t0kJmbX(>9PA-XC&h=vx<n&_a^?q)-`#h-S=f@M
zcOvr*O}w%giC_m%qgypUOIS~#P`P{_%UAwz9=l4Q*(#>AM?n=y>h55sa4CeBARv(+
zSQHZJu$hwb4{V9Df>I=C$r1k4i7NonEKRGxWIBll!#%0aK{^!_)Ehrdj^g1WTLdeu
zHr>1ZpFvrLihGwMqh+0%l0#2ag-yF`ctv@EPGNOp`-ctt#qZZbghe+_uh+geLt|id
z1J0YVqYc;8WDVCSvm{Wnm1fnzLD7!wc<NKdcu4k$$`5S_kDGj#8y(G@Y=Qv#J|`8F
zPV+%xIA2d`-*numA8h)H-6g8t;BXimRMS-CN10_FvWH~?f}8XkQ~5)&begT9rE=5s
z{&qcPduKLO0Ll!QLLWV#yKpoawHfENaam^yYJZ+5Yc1U_sijO1DlIE4pcRWb&DZp4
zm^zaA`x4^QU!>p!eoBL~9Q1%Q2FvvlGUX}ZZkZo~bB!=AsH!l^Qrc2`Rwu%aMM)<z
zvXG{L=^{un@2F1)`J4V|hy49nKgKYdT$eC<Ek_{X7Krhj(YBahC;I8F1Bck(E<2Zu
z7QOCJQ8%IW`(K_PstI@AKE?`#(^EGi<m0DM5l7!;zg=xclevb!@iA#=n?VC0l$$pR
zhJ73K$e%v@^>zW>!lducU5Pu}b6Mo40@f#xFP$rO^j&rzIWG^_G*4`&>HRdH5Puc#
zySr-AjbMK`?jOZ_a<#xeYx3sr0@omaSL;i{|4YS9C6WsMH##8sr&|AyHUWyi0emUS
zzuEI&fR_}-e*=Fv7W^HxEXDK>&TU4P9{*F?Z^?2014%}f#%~soPXzumNd?aTMhTkP
z6u16a_)ozl6RNWQYan38exLm>N=K3g8WXgf+W9IMW4b95zp3INhS(x0wM9-ISn{^?
zt$au4-Y$w?;gOHK#56L=jB@jVII$wr!MyKzANBCu11i%Mn>I-@E%TVj{A)^-lJ3FA
zUIdl5N&YA>lz5QkJ02MgBWwzlypk$SE^WeLrqN{XcPdPrIe=oHISs}$M0t*K8nNOe
z)t)`LHo0fA^KgPZG&r<Wq7vEC)(!8lD3qv-*w&OER?)IBy^U5Pk@WI0xuK;H+%O_h
z;b9Y-A7Rfc&@8`@BReaB0OT5@mi>Gxdz3|Fp5uEl-SjLt`vQ10MIsv$KiC*jBp(~+
zNPLC=*4{b@Fo1s*eB$PHAPb1}YnCKBD5*e?Zog^-1l4kK5VaK896uotW(gcekd}dV
z^VNx>2{2B&)cZ+Ok=k;qhdlv^K^PQE#QN|8+}B@gj1=^TG^Dz+C}|JS9b%+>IE3?h
zSoZd~K%bA?0WCm?yFf&A1GXRVP@6Euz(}uYkTU?21i(73RGa58_52Ufs7tJwA;;d%
zS_7TfE{qzIIGKt`--n5`pk|j!<9MW{F3Ga5=m%&tO_kF)x=d8YedcynGu5-ww8{Pw
zVqC0R<~LE9@WFA?lE91LeLNV&;joIx!#unW(bd+!%BXt!kaV;4HALsNrRq4B1kLK^
zy`)4?5&&FA^cc3$7lb`ZC4%#p%KH&&CPUo*%TM!`{K$;oW5ZkJvO|H_P=bdFs#niP
z)!))@)(UqntUbD0%5AG-ob{lZULz&li>BI+J}XvJq`;-xury`RM4B2+Q_`EbWzg0;
zjWlA1e_bHYZb{atZY%Z(<arIPq>G*09y%GUoB$k2up$?afly-8D&l6%dkOtzczxet
z%5v|sE4B@C6L%2j*Ei)Pj5~onNaB}9aJhPUrcU3hbJ%;Y^%u4JbpnXOzH4p75jguI
z*fgu4Y@aSY_UmQ4pVGhzD3Vfs@2KTn&M;^^d?Pra>qNjmt?^>WN;KLJhVwF|t119j
zPzJc509`}?C#UMz;xegWS+sG+eW!r@C`p0X?G#$cRmzvP^XwT8D3|4H#7Pf-8t1@P
zsi%9FE>k%onELo7u>P4!qlJ0{>DMo+L1C68M+9bmKVvybE|rm|jFGI2r3)>8&y5|+
z7~cV$-}U1Ie!r=q{|jLjZ2qQ6wXP68NfqEH$QlRNxT{;TOa57o|8e_bOKp0a>&E(h
z8s5{8Lwq;F!B0AWybRpvz)mI}9*!gbhRY$`p0bx`!p9#!&p&-Nb0JzZVqL!DG|_-7
zanhEGr<?ffMi&q)8GO8*Pwn=9zRnRgFw{{&ok``0D93o{&`zS;{<^ndSiiJ{6nNvk
zB`rgnblc4rR8Tp$ua7<tf7u26MVIOly&wp`>2eD0-)ixXSX_llp0mJ8m&*Z1`X{X<
zY7zis;tyDV(@On~IG%Tjd$~ngZm7BiP^_S1SZacLbz-tA$~C8ZL$3c9YX;pXL`lgl
zPUjzlmqwr9W;|E&b22Q-GX83QY7Z-<y}nviL-ssGv34UP(WN>OhE2053DAu*MT<4|
zLK}3q4yaSL0al>ea<Js|eS3kaOVZS^-qrw5Xs)H(OXV*n@=4K{A#}MJn|p2GQ<4i`
z?0^DyKko70Nr+FM8XMb+Z)D~)w0^Sqy~6jZ+Kti8fs>g6%_R}`%@ovpPpdPfH=T$Y
z?o!!^`?}WCBBwqSg(>)MB;9e4#v&v)2xeNYve*Rg@ao>d$z%9Bj!%xk4)tq2w*MP|
z9CK><8iHx?kZpme>Fc*zpd}#9In(08$)tJ*<r1(ODH(g)Gc)s0CWG3hY;?=v)GfI%
zxiEGdOCxh`D)ZY1Q;(Yov@DO+LR`HqU<d4UmRZ^iKTiVwFth}dlNl1sst)%s&qHI6
z2{J|&5+7oBDWq=libB+y04lzp+_A<02_?~lJ+`t#W$01>T~2uN!FKlvU0L&w2V2A0
z30-W)7N1Z4OnxHBB%@PZqnQbubd%cT!P;QLDOUA!W{tx%w7R%vvieHoX%Ig?O7f+(
z==YKIJ1=KMEguB`ZY#BQ6E07~c~bT(QjO~4gz6R2gSb}jNP>*xEUec!?Pzd-(|Jht
zwHhoLsruuW5r$z95@083;pUK~36sk3A>#$HpiOwQUbT|e`y5pe_B#C2tiE+9<z@uN
zZus|{2=Bo2P6yihi7o`wQxIIlJS9VN12NqGMJ}sO(dAAKA%#dQR`*N&7o$4Jdl5kf
zvafyV0}0bcBs=7<Mzq0`jj1Mp9|UZvd@IYu%}VIWJhqhhQN)!V$({;0OT_UCHi0*_
zo-N=(<4f6l2nXZCj){+}G+YB0mw2&J+7&sGnO4g<;lb*{y5O~XC=WL}ktPEMqdakL
z={i!u5Unr(Jzvu-78=c~K1jmPxAT3%Pyd(Keue%|)ZOr`nkNY9B-*b4yHlGYuWe0T
zKS)Q|+CuO&e3YMs9BCSxp37C~<S8w}Nl*yIZo!Ks#q|+qnuC`ZHe0MUsx}wO6!0EW
zMR1{0`YZrXw*2JLhbxk*o=8lg<fxa`1|A7?+rhzY6#x`N{;Y`Mt7~T5Wp=j8d00ak
zr-ufP+#|lzuCjO7_9X{@tGQ16)#Y=w;q7#+Mh&xQ^fSB^)bPfP<=bOY7=Y;$^sjfE
z=BYU=2NVcs^>>HlKP8c%F7H3z>EAt#%_X|RpveEZnV^US1VohlT>(8A&JgvV<9{m@
zfX4r5i!ahZBbrNq$fX)13!hUbpR-yj5bY9j`+LZwp9*&Q-VO^AC$RULXy7mGdT4&p
z2vX}sw(GNP@(J_H(~d{KJ93Jd4(~XiDlJ)2$z(OFDD?BBLP1GRYV})#ZD&QZOL&Q+
zEUbL8pkZ)RU@=Z&(;y*&G9<YGx5A0&Tv;QwRv&vr(TVE$BkLd%zhwpqk`#5ZCw8$_
z1SYZu+(d+8f+Q6RFZ?Yl#UQM5P)X7`>6b_oQCK6qfnj|_v5m6|)o2mXNKfoQE^O41
z8&b&(e3O|gzlC!zcIAEA3753RNRQ?niLiN}1D)Y-Id=Ez9oNOkKi}yA-qF5KUeWfe
z7{SszIV_xMo53Lzs0W}pVo5LBmo#WOB<~U?WKM(=rmBAUX=Obe3VV0oC?+`PEH*5X
zlj%vQLq!&43vDV}5SxY%HKgj)DctZgn+r@#b#&%5sqRGYQA0`J5K^bWuLL~1MG%m<
zvBBvYr=_|O^>jR$)kj4ExKUuBfPUTGnp%OV3SoC=3KW#Pd$aC`mXsef<}U@4R?V#s
zHS`Um$ql+Vkfl&(KQWNzQi&U_Tf7V<n2|QOYSdK8mQrpyP@C?N`q+P#?rs#l>N_m#
z;5rJV!;@_c?0<eivH^Vu*8HX_B>BM?9I``U8i|=BEGtfC(5BcASj%SII9!u1E(uWo
z+6)3io9(|0_hl@HwhPC(Jj$}#%V-0L!G@KHY509-e)rTvCd^f;6UbX*x$eiTR~9o2
z+IpfpO`!KYeVsA8if2HbYTCZP1r%8m+{^2n!RPZ~dlcJ-W99U%Yh)zSJcBAkKUWts
z6kMXQOz7bhjDTPSKw+PO>JpDGeZ^QKqEu<HK<tJ~<W;zXg)NpOx<+SLD2>Ll-g9y}
zNC+2B3W50G$=|>Ywyr1=)1@-cq-hd{Z6U`H8Wf_0g~0v7UV`-gBEn8#<#MD<vHJUW
zCwQKxK*@sa?*(CXQ&8FbOEE1jkmV5bGQ+Zt6oFqe1<T3N0nlbPK3~_)l(nFeNITe2
zB0&YwByAeDtavZk#=cgz^oAd1a=*gYg~D)&O2Et2pnSGH>Z!<7+pJ}81~$oqA2NrF
z`pcoXm%uK+F;<bAMgr|<c~e?KybVJa_efsoQ;kn<rL@Uc_j+`1E>&geICgBhgj^;=
zwli^lyRPb{1|Y|P4Y*3OeyNL*w|M{Z2IJ}Zf-Q-Asv*?f$xqyC6~ICjG7UD%VlUYa
znnvqL>G;LZlf3Mak_lh`>#~)~4fz?NIxNuFFEyy!rdfD|15awjqP^FIF9tKZ-kzu%
zzMv9uLrhECr#>bw=4}C9<M75DI@>k5vlgzd$$kW^Cx9)z`A(bpPDVF&x$OfM3Y>Pw
z?eF_T9V%0f%e(b=#r72{kO$R=>$ao3G0RH!5Rhvg+d{ZtIuNo4);?Ex0Ja2=SvzA#
zJde9zn^ylpGML>>j&N<8Pff`Y3tBjS7&Z16J~}z<2@GmfOmSISm2(97ylt&J%Z-*Q
zQ~3eHdw_pP-6cFc@fUK3cZL`t;$*!^^O6Ykwjg{i#P`+b?83qFt`45LJWO}Wp0W4W
zv`ooKOiUU>XPVu-0I^@c`_HTT>DLw7f0&9X{AfBbMzG%UaoaK@I<9Z<fWQ1zSh)R5
zp>1>c2i0-N=;_1^z{aPmOg>zV)|t;M7e*t|3fTxXaET=G#Mjm%_OSQ)erYb>|MPpj
zfPV;vr<{<YyE!(Q7+12PzHDJdv4iK(#s>`l(=eng_54ExWL)>g_R;r_w@1dmXqt*^
zuZ0KvH%0%Z+keuuk{QQ8Y4<OhZZJaz`Nw&`{p48->VJ((CbWbHkO`7=?XYI!xOdTS
z6!}p{+3kXAmyz37$cWLz;g)<Z?VhB&Nk*YaJ!4SD5!#+J4|mSxWYR?mC%{Cy%3>}J
zYABG9V?*zg7|fF`BZ@Gn#}u5R<yHbb(k<pd(O9ORT@xbroFmMo8e}VpDs;g)EaR$Q
znYMnw!J=%zg$Hi}P(vtOUgnkgAUZI>CvQv|;Q0BORrw(_A}sd7N#lQFW|;9tNHLTK
zpEI&yx;Da?i_$?)Aj^yjI@fZ7I>anS1%N0~euKlJu}7dCF5ib^M7Tul7)Z5z0<p*<
zpD|e0qGkl+J}fHo8WNcVOiDL$8(46wlZ}k9(9pC5Mg+S8W^_Pb@$^Tsw}^MecVm@g
ztd(#MtM@>8KXGfW9Y<s(>!Oqu2PI{2T4C-`j`;=TzYS%`a^dJlNhM%T!K6zjNFc`y
zL`IWf0#jn=qTALD3-T=m-ptG=it(?P6eZQJETp!evnD06f5bc9L1N8mBJUFJRmU8#
zc@`cTu;^?7$kC~>Fm{Ag9LwJBSZ0m|(~)k6&p2`t?R0$zvcT84c@H%TE;{HHTk%=m
zvsFF8kMMrU^5P(Hgtu4-%qJ*SVh=hMuh$a+;c#q(9wA)Y7P-uHDV8l%KAuV~Nuf|-
zYcBJqDCE%}ZX@*y7Y%WBWMFs&V2fDY3RXFl|7b4&#Pw;&$gpIg);2v9)$y$R!ok%;
z_E}Pl`wkwZq{GqHbN$$EODq|VT430+HV>KsTfdYNIH3WFF=57kyGud8%R(kNm4xy{
zR+%nvt<udFRYY9LZ?U#(3M$AzM?a~8ceL`|+FI8C_~zM3U8D#Tcr$v_I$1NTY-loB
zGL6*_fUue9m9CL}Et-D?dX!b-x4P_ifSH9F@ybB+3cBN&SdstAu;*G*DxBhrCzeH3
ztO|4}f_1FKIMZ{|2!m8d<WL^mjXnI_tCDd~tZ%evvCz>2%KtdmO{*nAMCh?nO{?bq
z4pQD5yCA<s#?ut9gPD5tH5Z>_&<r;|3Ju2=uzADJCpHiYMX&((dn-EDS$m0Dp=(gY
zt-TspnSRFKZvKI}Ub8kfFDZMEEB2#Gsx>Oj^cUoyTFyqOkp{0_T!kLf%J^02O5H$H
zkG<0Rp$$qZ#eA0Zoj>@%_|0y=I99hPPOJQ};8>xOIyS~JmsSzu6L5HI0o@xiL9W3#
zVCRK0bk_Tpjaz5%_~OU<&+DwlIgbRtJU&?}na~rT6YhMgB$zmURQW1MX2gZ-kt9{q
zICI)hJX9WPb1}`8=QNXT%Z_(&s^!G@Er3P7Y{|{O`BnUz_A=O1iIw*JcZzVqkcCDf
z5LRzB<Gr<TFh?15Oars<YP@dNDKYpyK)OpXUfMx@SN05~PEmFC#s$i;8Vg7GF8G%o
z2<DCg;#TBggz11B>GQp?ed2HpBS<yk?&aoy;QE0nzOlhNP6L*+Y*jUGW-Z&AnqGZ@
zk?Yu$`%0bxC5=yx8SEJ6MqK>coq$AD*SG@>B+M8{(v=;D1J{jh)ee2Lqw#DUz(v`7
zAre;#En1Tj9Bx9z#SUsd_LUKW0VY9>l!T2@)U@YVuw6<Qr<u?6uK~$%85D<L;?wcO
zI`g_Dn2gq}4b2(E?%aq4reOxv6MT|(Is!jLV)l)GIC5<UPuhfU0((FK-#j6G*qZ~2
z`q&MX3|gU2iX@J|>jyaAa|>GT0OsjiE^Dm8fjiG^zXw%m5;R0M%b%~}CV9Y$=W;<{
zRmq5BtS-(FME=Tmg{#-supgT@fiJq|h$1k;y6g(=+&U3a8@U9+_5=+ewvp{|F?8Dk
zeA{cWb1S$!EIIq21$$nHe{BQq2VI4RUyxCU`MG~xdx1S>_3B`_^^qXqqG^?CC~(ow
zg|b>ldl`Dz*be>*K9z?XYyvq~);nmF9qbRq#V4b8pT_5tZr&|h6PW*QHd6gqg&*)v
z_*Z7APSSku{hb;1asE3q+}Zt?Wf<s)->hzb^2ah1a{Q+g*c|8x_XkOEV)<95Xg+s}
zh5FlS^zr`kH~JsO=KuFE_q_T38Tyw?Dee>S$4Z^>qx<jBKW6ELKS?@KIXEQp?{ioG
zI(GGENUZ-KgZ4lE_J3j-{`;Z-e?AI;|MEruN{;n_i$4p^3;eT`|JSDV*K8jH@BYm8
zGUR`$f0RO-{`j#FkzD^=>0eK_h*bR(+ZQeTZ<H#=`45^KC;D#`I(`h~A8lIqz`xyE
ztYoB6sN|1Cw0{S1C+PwIqZF%e0|p{YCfvtP*DeJ|_*X#kV=^|!wx>AbyxjnS=iXx*
z<d^CwWv6U6SA1^m`Cx%C_@2kZHz~aS@q-zf)RLqwjpptpa%L80(w|Yu5-DN;wRSrP
z2593xspIUzhqIMSSC%Qr;Zx(@&WUC(YlWo?-!5#JF@aXbrG;`^6NklWcqr*h)1U2^
zS<HHmuPQ!mPsR>O$j5LimAw`HD+F^;*?wu$O>f>EGZ${m2Ak)usk!j0Yv*#@&F$+2
zX-{V}&Y9(_IxRyl<?BBj)~g38stuOz#H`=r`_Z5eU+dSJ7f1+uUh1P~ij+nR<dSFH
zQ<Yb;;UAKjQc(eIyjmM7XYqJ`#@z1BB--f{QQSA~Eg8DI(@85{?B&Fjj|S}d$~Nrn
zODnNbP6}>b$tp3c=8dc-G-(>`6P7JF`Y3`gFZJ2B$>sg|TdZM5NpYC86y6=VDqedn
z6wxyjxj8%Fjy&kWm3XqfgR1alABH$vjsiEF=%!ASX3YTP3AyBZ_975_R!s->=;vp-
zUKAVxl707{jFMo5VrcjWTQ1GI#q8Cd4EiJ3vo$B~r-y#u0*lxF^5acjEqMNtJ71=P
z64M^69=&O+Cd%`{SKAcpdyE2VlkUmI)CYs5DIu+uVhW)Z4wBsMI%?|r2aN-NK=+Pv
zbo-RH^$7s5n*nik>fAWnk*sbd@5!*Z6z$qNF)C$G$y$3ftkfj01lGE+xND2iTzDx-
z$XRKhMR*^@p{?xYJ?xjiFh0wHj(L)+m6Aa@<;G1%U@xIl<;OpMG<9j-plLs=5q;?_
zc(QbB9uQ@vP8sWDH60}{!0znB-IQ4GgOXEh5e0at&0Wel1CB0E1Y@L2%8sSi*k#U?
z1v<i*S-xDvAB|3X+KYkk*tv*s?$l#k%6A*RrsUJAPT5$=76Ij$VsA~&qD!|D#u__S
z)bQk%9?hTMypu|gUS?_5a?Z2H37<Bc!`Q#{7Q5`yvgJ4_F>2bTlclK5vh^2QvMhRx
zu>vq_>7Ff4t^CNL(%-$vvKuxMvSZJ8VYG1Byq8Ipkj(Z1=P;p>y{oL<KfU&=mDtTU
zv*PDsTi%RrW;q)zq>o%zvvfsgOIy^)yh?4F)=De?<(|oyBqg+Y^)Z%0yT0trQ>^9U
z$1<@x#oI}6w4UW1=w7s`)Q1Il>Cv-Y90ZUN%2EU)jN!>@1UFygqzwwXG#Y<wJM&c9
z{XTuqtT4Cqd{8D`KyQ<cXnyMJGyLs=Jr3iS+=*1$LG+#Wt#j=nl8F|2ux~YGc^>|9
zn-jO$l@7y|{pt+Jl#L4?nz@l5W;`k*7j4y9{b2&kwCT&abz(Z~xp|LXEwp*(xFi5f
zYa77|ZeW!{Y?O>ortSHNJv$e174tYa+BS&+Vn3wp**n3Oa@{x~w>C+OThgM~m02_9
zBTP&mjvUc2dw8~Kf=r=Px-L%qr0Sc?U_6e>{{dM*roVbhz$p=0)X1~$$F_*ZVpJi5
zY5rti4K4SyFXOt*;8joCKw1N?(ki&sVnYe#ChPiBdRZ&MuNCl`TFMoQ`ulbHzD(xG
ztzNFnmuya}?#qI99IGgk;g}hJVCSo3lBL)ZR*RWkZgEyC_aaMnXKogqJnFV=p5!Gl
zw9ik|iTx#AEsC`Hc1CM>Z0j}HPA#^IHt;GL*YSX#659hKs;6k)WM+otF0Z<IdWKuy
zot>T4GEM60eDvCnE#bMARDt!A<@hJvDh!vlT>AfaF8!|tvLkPAvc{f&PCD76e7h>z
zH(Fte>#;m7b%0f}-qgnBnrBXtFx{r*Jk%+)*U-W$M+d?{Eq9$Rv!r;LtVpaa$TlR<
zF2~6Yy2`{3fn`>k(lVn%a+%Ymz07JhqD(HBSUbJl$||GYT#%U19?8tOl}1d2Hotc2
zl72dgdKa*0lPl2tgVFqdgVFqh(fotaJQ1UD&ax|#y~^dmueVMzA|0C~|0<(MxpfLP
z_NJrQ-a2cNx;|Z3Ir{z9;T2%JtjoHmE29}3UDqW&?~L9Huq#{LaEe%^GXsprTj%4S
zkZwzz?f8`Vr);)dtTxGfgKXGR1Y;rnxj*-#<7)sfY(r>zY`;){!iBEn)?uvfO+hA;
zMDL~@MS^b<%3{E0+N@v1$Dbs>`|kHTMe6(tKH_)D?_a3&7gqJJP{S8nRPTZl{3^lc
zgpYsqKmJ~&-8!^n!K>!fE$6F@mCx;r28NO>L5xE`)Zt_gpe!L}4YUWc1gyh(T{y3R
z^J;K@7tSx>>P-oMyKrFv7aBNHQ#Q6}G+HMP1+~_mT@&?M(Xx$!1(VIBltvgmF0(5e
zszCwI(*Owt_^Q$#9IBW`saCV>t63H`x5(&&tw6m7XxIlEmcXhGEV`hg01O&{eH4g_
zgs9Q9o`#uqYR@*9+w~r9ueRB!YJ01xqpGRxhK;I*H5)R2sv6QJdsLC#Ad@oUc1E#w
zXF08y`heFmyk<sNW(19l691~IN>7!tu2t0qCa28sS{Y%PqnbIU{hQu-#~Ixz#>qX?
ziPJkXhf{l|2{A@kbjEoyBTja+pzZD~r)^kk(5Hn0T^MEH!>B!z3<l|}G+mT=Ri#7O
zKoL9zih%fkK5Pa}3j%G7d3sf*;RV|hmuuwI(lGDAZpu8o)MtDr^VZSrXxbX68uqpL
zH^xNK-pfu)7fsJ5$3?@kXt=9rXZPcRG>3Fa!?p}~F_|=sG%#Kb!mIK<lWjPZ0VpOI
zgQ$YO8i1&>TP<(3*8l}2P!pyG5*3Z9H>Jux+vfRyP1g*BXBrt>1cj|raha(tRgn^y
zl<1~W?bMFTLb52udq>^GL}`q=fe$9BsU0Y`O%*vB&5Tx^DZ-ESVwWIFw?PA6+R7~(
zWm1AN#WyKoF@_>CDNLnK(?njj`$rRUNkR$#)o#coPkXkf*_gdG(;8kI44;9*tGosi
zX%cmRmTqCgG*@KJCbbNyX~vo(&Wb-nLBb56IgRPyWWAm^aXlry=MxcMdxKP^pBkwo
zAQ0m)yzZv-9N0Q>NQopt)D&zYqN{V;X6{ywhcf&1MY4L`E^#vGNxeQfv9xwkmC^5%
z0p+|()|$IX{^wRY>S6umf7UXzGGFBUb32EB%8*EUM=M`gBd=+G^q5LWKYuwbR6Q*e
zfB%E1k=d~sz(OaF-AQ`>ciuGpNbK<DE-TziXlLxVn(4%TtD#8w`)+DU{mlz$hkd@>
z_O->E+^01I_bazYJ0Wf3ooqWR9UW1i1&l(M*sfuK=M3$?)t>owYCEB<3{fS0by0eM
zw<;vI-r3->oz2(SpaE}QwL4ZnY25=k>%tJUNoPy$^#W*>F4JW5S`0|KBU$UUI}m3p
z^hvF#yrZn#Q}~Xu`-*z|i+X#Cs{KXPo}&K#qJF0+%aE(Zr4}Y9*(%k(07|Md?Nv(Z
z=sN8IDzXeP;cEkF5={Q(Dp}r?Pec5Flmc)oPbXleaNM6gN;j7&>7DEzFQWlDVyeg^
zb(dPc)<!b}$SFfDDkHgo8K=Bj>OeZ_)<L*nc6M#5Dc%Z<^{R?I#7XqRQAP!2P__Zv
zXp4rn;aW{SPhhE~U#-yaD-6X*afH!2kt%djJ*9;6!YWnjq$<JF2{jPKDWZIT*R_ax
z-GND}QX)=~<@;50(c2Yur=66t1Sswl($t@JlZa7qXI<IeFEo)huZswYlYec#nr+(v
zo4E|%VZ&TSymtIr_k;DLRq^0vv6GY2x+$$$h~I=|?<sv!Q5_tOYCRD5q`EA0AF8iy
zaX8i2JygR;r#nsFf&RLNzGcjRZC0?mTt&4!7S)d>`T&|I8DfF#>qAH`VCyt@!gn>X
z%d1|x+ckjjGPaxDPMu2jlr5=;V-lLdJsMH^A4M~G6h39CJWDENoXTwiOvyHS|9IGA
zOZqPT6Z^4~@N>rdgx+!RTH7Kxx3MKLK(RFxHe_w_DlN*|=v8JK!)(ic;9LW^Zk8vt
zMAxucZRcYW7dp0T4nr*y(>%|X>uh~`Ii(F#&(Ct3<}^KJ%~swAHCm;~C;O6mab1zY
z+kKS-y%<s8h!5r7Moh$ZUG4}bSDW6NATj+9n_&TxpSSC1Rx#_~DE5y6;;N0J*ba5-
zP2+$Ag5gbuU6x}<Y%TwP<DX1MHlJkY3tJUBvPrIHn^m)ccP5^Yu_Y8@DWdwsYgTe{
z()1N`Ua|gmU_E$+wNW(@$on9mwn$IVKmTw9-hB|bgg{U$M7$pX4bFMHgU)viNjp4x
zUtgW~4@rejJ`mrIuG@icf9oFHq^e^7KK1sp&i;BM*ZugDa&J0+HGL<}WbB1Oz_3~=
zzZVgaAwupYf|=RjwfeqQ{M%RS7(B4vCJvF|RGqJPgc?8@rc!JT1T|mSTED9U>Xc!b
zN812L9UGkX!Zz<`*+yeLZ71A1P#%f^?t=Xq^`T5II3^T`GO<YVs-zN3m1$a$SYB0F
z>VE4Ymb~SFUS2hS2rwm#D$puY(sor5XIFtZZSV@Xiy-KwDX56@S_OIus_0QoaM1-W
zd#6Q;=<S|T30uM;P~_?0rQ)p!UeZAIHnKZiH0v$G7(`XEXcp*)ufSy!ycfCz_L{(9
zFLYRfs|L8}0Tu;lvzhJgYX?p(5nj?P&<|gNM-6b<1FV&Q-{lC_s8*I&WT|$Jp+E1P
zx|Ff$Zy1SlklFyMj}htf1b8=DhO5*v3ueMe@~VDh%(T9K)JaxY{06Moh7<-YZh%F*
zz;Mo|j=BTq)Eju-pwdj<CU{tbU(agrP89Zl*ZZ&433t_gwXWCRQ@M8k0))U<2@V)G
zP8`w(XY%=f+-4)sEAwV438Aw_re9{R(^=N3H$Zl_p>ZA?3OS5Yrx5YU2<H_M47}Fc
zTPIq$4pKWcM}H0Iu-xEGi1JBIiLFH`*OHro$~_qddtVU~u6%+R$Ao8p&^`sc(h*&H
zQsuNM8vh}yGrhu9wRgK5DO}sN>!sS#8|Sfr5*HGG)j>!^NaB>`#rMLqqJ9kThbAH!
zB*K3O;i+2V?Lc#Sr%c_fy<VrfyH4Q;mIypcg#KZ5`UlkMhL#Y@68n0gUT1K3okSk>
zY<ytDca2%CLXr~$s#6?RVRUzeq!K7$`3H96uE~3^8EY!UEIptLrF1PX!hd&Fxc+p|
zm`F>1c=YdpL8-~|d#dXf;oB9OM-sV;THGoTT2^_`uuAr;RL8H9!&-7!B}cX72(dpn
zHejrh<;e$F-#q%~T6GrYh?9ZIl=RQWLo0vRS&6E`ij~)Zy7l&hoz{-{R^HLhd5=ML
zI-}-gtsVO42he#ZMW?`=)9M#Rlm$DQjygeqK45UP_t36s)VaHN8dZM_y+Z;}&#aN%
zS>yV9r-j@zEuObUB%`%jBwY~bquc%d5sxTY0Ll&yAM#eUy9d2l`&aEFhLkruY9Ct7
zD)|`8iKY9Zmnt@4p7iILhP5f&i-f%fm`i`&hp&zBUR~JVZ=KGncckgJn$W1Lt+t4N
z7A-@oS7@x4Iw@*xidF|zyhF-rS6@3(R<85LDYM$kYrTv+9Fdm&$>~{^lO|YoDvqPo
z#-KWgR!c07pw*Jf!)LX$>eyK=Q6D&~D-7mHSv?7d$!hPlw!n;5KRH)6zIC1szpsfK
zpH!jt1wg08^^*0bcMs$B<@R(&_efrUUuJLjv<~L=<rK4^C#$C~n<w;6PXEyj=mrxM
z#+KEa>d{^j2;sXP@`@a^ZM}oKqhZjxV92CWzvg_y(5G}@XdG1BYfy%t4fFsEcFfPy
zuS?Z8P0b;Fw#jB-nP=O%iAvgzvavl%zhvp^wW9{^z>xzI0BS`hTXR#CBm8xLeTH!O
zTVD?#((R}?i&xep`oZc@au<}WLwUQPygHP>3#vg^==TDJ{*0i~WS!EAy}4JH2<nlt
zD6aCkUvchHQ~o}M-KwlPZ=9~`=Scn&EN_YRx;jQ;1&Rc{lbafRb=-sVZu?4wLA0|J
z=k=Bnu2egV>CFCeGTKd~&g?IL=X=5Ka-4a4>m=(X97faPm__kE#Od5JGj3<bW#%P3
z3Z1*gT6S<26id!sRC7`nhl=V>tRF25mk~va<T^cs@|PdGXT<9VsZML>tL`}cT~!)9
zQ$vCV(jzv7xY#;1cjlG!aH5SH0}-=S&TfA^H3cklso3&_189mX#>RPnvR?n|&y=LA
z_<hh#vVJ@{X&%tT{c)XhynLx#6IoFg?7zQ15OHrqQQ^sH)9&9f`v<2@qWfs>kenQq
z%xwN?eX{%N#M6#{ph1hi@9>xe!Rv5x+HpHHd%!vZ-r_d2X4TaVXitY@Go`s<ZKh9$
zVUa(u(&{oc8+Y3cX-Z^&xC`>IwN-K{b1c~0H~`mnXBIDVeS6-UhpxIdsoNz<P9#q)
zr^yaf$+1x7i_1Guy|LEM*skLtySrt7Ic~dFi&-+?fhs$0tM;M#%dy96Z@Z2?Ui*-}
z60eSh%rJu%qV3UmO|~9C38VQX&mKnNa7f5Mk-%Etj+9&6WZc?+xyGcalB&2q>2%QJ
z3FzM{w|Sm!I`}4=WA4XO?HFHo_T=tRwdk0x9!N(c=CV!B>ZBWbE|ynyYP`;@@jAp+
z`}_lmY{^BZoq&k`Nx~@CWgF`A*EGh&hx7sLuF=GwQpFm<@YVnO-~aZCe*PUl{|7(+
z_f>Pmf}XV%>|9!Zdpgis4$ra`t>wiTFXRVKb$!9;O>snNu}tT>ZTk>YO^?N^FElMr
zP~~Nxwx_dr`ehZB6A3DVY%oBrbG7aTiuiwVN3jt4f1M^gPUNhU8oR9v-P^e2(|1?c
z=q};3daFmB>U5N+|JNb@cpVkp)luH_u<MR0dIvY)q?WpW+9CaT-4x!{P3kM`YF+um
z=_>JlhtlWkm2CD<EPK~U*XXd!#<=_bfykQIQ{NLc-&y@Ut^72a98(-<eMF#lCIV&M
z2d#amg-5juY~a?g^$GX;lYz^@HHQJ$m;l07D>0)yv(yUQ*1_Bwv?Um%^9e`A_l0@)
z7SNJ}F4F3McYGY<n9G~%+rt5M<Bvu}TXuQ%zg``$?xuXwtvazD-FrJYu6VMV<<V-s
zYfx#6dJ0r=7m<3Z-l_?_PlTZ~NIp^h%Li{9y{nt5Gb_AvVyXvnbbfMLo)5j!H<z~c
z`3_rbMdu48BR_1)1}3pbi>h*ZPlPs^D*+OC+|OTsNs#BNL=ThQS+FpMltsIv@tA?$
z|0$Q=k93*#*FNdd`wg63tF8GFp5~s~_syweHn+{%_1!hcM9}2#J@xZ<j~+N!b)Oxo
zDK5$8RZu&%!*k|N!R)|w(#KsMX9{ZE5ddpXGrf21Z>FVDWCy!@9)+U)0U{>3SD4}j
z9R)pqYrUJ(l&Q-6c1z)IwKk75#676@Cp&xJ(4=iQ<7t*3b8@s@g$CP0QSAD9R13-3
zV)0O;Yp*f0mU!Q}4N{KQUcT$IQNKQA^~;Zs*T>qntoFzerg5_5<5|bl40M(29#yEx
z%k<`{>O8U9a*Gg$R$#->`pyfL@Qd$(G&lo)WeOo88J@PH1Sms|d_V9`+kW}pB5;uR
zW)%Jh$_z%KjNH?%uYmF<V&YFm4GQt04gI;y(~haS7gfXN+*`Ql=U!q+GwrRmrm+sK
z;*`*7ORwuKS%`$av}h?1<@kL6Y41Yn?U{;;^;WDyNQ<HG7B~5|8Bl)Cqyb=Nf&OlP
zSYN)G4E?3egy_$#O^Th>S97B~4~r(Odgr#uEoaJ^cc#vQT@bat+*ws^-t44TPoMtw
zHl|SR;8kze@O<g7r#7K>j%zWm>Y?v`8EDl2ZOpTsz1)~?ri=ETVGi52M`Nb@<tTQ+
zyEybiy_(JY_<K#P$MfOd9BzergroL<9$56-FO1AOLadt;_H^MLcz-Eec8?Li?(+Y(
z5I$PmJ0P0Rpj<q68yC;m#%*qG@%2n=kq;L9yukDGO{B>Ya2+0?IXS}6Irj`1nXdkP
z3<0-e^?Z_Ay(g(vJw>gB;(dgL**ls$@jZH7_NeQ-G|j;yRj}qgH@g)7r!^RVOzI<4
zHt5-gtstTrwu*-57)o=M$g{W{%?@(hy{g@y0?Cp0rvl9Zx9yaYD#Jc&sDA@vQQ>3a
z{f`;c-yrVML21Vb@M=)>;Gm}`h+=9I_R#R6qs9w0NqT4?&k-YYngl&GWai;9Fb(`q
z9-PwTC69_wc?8C%Rkj-#pCJ@~rh)H~@i5;`ph=@uk8pnOh&E`krpLHf55n-MpoZQs
zhUUb6@G|;CIMN$^bqvk>ktZD*^gQ@D#uL%=^hUzga6F|AuhrAfhN_nIe1^mQ6g;VU
z?M~EBX=vMt{OQe#ccOl_c7HW1V}pw4F*P<(KGcza(3n1_HM1!)JTwM><iK-PEo8^E
z9=3$5r>pv?meiIe_GDE*COYh1;ap9uj|-uCT4QD}rB7|V>__^P*2*Tvzh~=nZ%e+4
z3A&$>=e9#PsCW)zbPvL(4Do8Cdt98?5dyh(%3V)mmfwx;_y+pSK0mi7$?B6mTTF_G
zwR{VpY`mDS?d>WbTJ-Zv`qd=aB*Sc$oTopnFV6pbHOmLzdvEE{qR09A=O3n<&2sqD
zPnVaM&ZXxpR_8xS*L4B>gLRRmm;ZTj_45yigOT{e%Mags|3u}J;jJlu281f?)izIm
z{vo|c=ZneYhoYc-8#pQqEqbzwCn490ABC&`TMO4NQf%S=DniGX9z$AkMg(6dgI+KJ
z5xqxNRJ_|F_`w?I*|J50A@Qek^Ot&po?cZ~L(Y=*r&<VNtKUzo@|!BBheOuuHfCej
z{hsf5I_*pA1nk#GqPW$6iIz>VVz4TB*31@*`B#`Q<$$;5%$`Z$NEuktaa}Kooj4Sh
z{?$_{bYx7E!ii-twmm0yeT#q1vv3{hg&1iCOV79lQRJBy&bM4fAuau@=POsP5hYZ{
z^)S!)k0!zKywH}87eoow5`~uj<&%Ck30g{7#Hc)?PdJ`0oLI$w1Ri=GCHsK~N~3_D
zBchK$VwWbmM6#rcTu%bPvz;JPW1GabK>r9wxIpVl#d!=hc4Qda&`>-lqC(OMJYQF>
z(Tp7>2;Pq+=TjwEHK0yY$_*5{fud+2w~d=Q^9j@vz7zN=37t4lmi{ezO8Npz(Tgw`
zzT$CHJ~}Umk*z|1J9a!tcw>JI>V0W`iAdk}oiOx~r=e=AG@ve}PNGT!wRg3?tW~<+
z{+%q+ip6W58r2!T6@d#UffZCdw|F&2V&w-x8B=1_jvL4%a@;Vs^skwOmiy&H=(w@6
zX!=F(6|n_k?@r`K@A=o_l=sNA814-fSCOTE8HrVu|G;>EEFs>x7joK<Q~>Ra^llMR
z8CsV)&DAJmtf9;W){@1)Ij88{q=VLG82yW83gRwa^qW-FT)RXaFzUddMtf(B)Mf(m
z4rX1SA!$Eq%b;eww20nGbz#ftF5H+6A4EheP<L3pb-CR|uBjT+rW;WzAtP4pM9kAl
z<bRYk%NqNC%1&1J<~4s?>8mbZoH+Zz(pToT7qd=9{CP?;`p-XbTN}xLTV(TgIye01
zAEaLRw7JMBO)dP*X+h8Izz%Zy_u|Kv@5lT@3@(kS#bas)*Lul=i|fYcq*1->ktMM$
zfl8&>J+byF?Z>qQQkm)rv>C~FLH*s9UuHtu>Oy^gh%E1d<_K-~Q$bTC#$Vd*-3#wU
zPm@i0zF1wq^l74|!A0;+(O?r9c%It97fKiP3@`C4uaMJ8g(}~Oakwve5=_&J)nfkg
zxA~dyX$R2Tz{}?TW<+29=01z{VDhN`0Y-GYeA&ZE%9fwMeDQ3OUS#8x{;WT37B729
zKX{gZp9o{J7Et9$zN#l!;zGDpf=y5FRQ=r+UuLvb`%~f0><GfzEWqyzo*(HX`x<=v
z{OPAe%c&AtVND{3c}!l!)jLG^Y2)3N7q)1)T~Lj59WSEI-SHzokq(LePGMP>P8{;j
z`<V2=3vcRu`5*$z&q=&{$-a?dCS89`f7<hZO(b~G3RMq7uSkHerj@D$_-f7&i;<sg
z&!Me`)V*M1$9C|UUP+Xor%hbjfnM(Xn5N0<Ws8Wg7sCYP_@R6cSE`%ap#x`*lF=LA
z@{4T<u36U&k}8S7z*9o`g0~u;0QiDfo=(0c9}Pw>AhsP_p5un9bh8LcIdK%h954L~
z9R5rC=ix!w^wWTojj}F(dLjwP7#Q(Lps~jjO1`Nu)Tn>K^9Nr@c-j1eHiD@TA7VBm
z^WO-6i8Wj}u3+<W@etwR1rPQt$?`vhIN^0I%c^Zzc3YNZzhzl&OB^$*G>5$+w*Lr{
z#Vnm~iw`otRMw!t8Uh%SrTI&&;Uya`X6brO!)1@N)j0nen#D7J+M+y&inQS)<mj!S
z%{+h<83Y~&3Meabq>K>GXZcPjgR$rMG9XpccLnA7h>nsml|kH+@2H3X_@XZ-3=yss
z#1JoJfcOGe#t=oQ<gWxC_%We&Vu`?o&=T>N7d)eI=l<84N7_5=U(|RzqQ62NYxZ8c
zh|~(}nJ(hN-iH8x@f@MvR5?D$n^FA3;d8T^Z1<b2FLx@eNfjASUo=x8!Gh$5&<c&2
zLcmT@zS?-52~uuI|9IKaC+lgldfEF2hFb1(DI@YA*bCs^Rf8Qk&^x_6a022?h;eb)
zy-C0H`jY3*CdpRom+lYyKq5dewfzg9f8K@kPtKGr#BUy7&95LQ;iO^6et84ENzT`Q
z5S25!P>u*?P26z&BK$Nb8B;*e6p2K1D*tF8TIg<Mxw(gUc$<GaFpygm3|**!e`=yj
z46IgAQ()N<)6rkCF~uYi0}cNsB=Sg$e+o2{n6xYbP?N>9B!4DJYgGXhNQt^*Cyv4k
z5*32av?P6HaUm?@Ko`TA9p44F@%ccG#IXX>XmKLP)JhxzcZ+?tby-xSGr5|#^zPwM
zK)~mHFk6T^KKMdtRd``Db}oeqLaq`O1e>y!P)+Gk<$R<E;rS#02}c6G^o(uI@dy@2
z3O>8G<9n)j4}WvgqeB}%pB=?uq(k%H4L#uR`xw1OeW%oC96X|b0WN5Ar0}K+L?sSU
zZLE9_4k=L%4i5M@g%qkz&0{nToH_`kBXBHA#*SJ$UQDf_SNtW?K7*Hg(iC-rFCVxo
zVE|B{xtUBmshttJg2pHe2wg;f^`WX*UEnw%b)Uq$P=7(0<86v!Q&LwwPklyxwt<XL
z2YP_OZ3f3cP)!T~)GD;gOtrDgB40j05kWV7#w?*0#GZ!+e8wd(^pCpHiGvFamB-cj
z*sp9({j8fxfVL@yV_!aIjVts?FCtQB0#tDU-wZBg#=&pYDKt(PWD;{xag6@=BBGaG
z@x~7`8h@{^N+IgCQL#?_tRZ-$b<r0opEZ~zzKgwBeRB>(#D$2^0*gq9GeLeas~bmc
zqsRx(5q<(69sZdt9G!w^ag61!2VE(G4{%1&h3`@N2~HMS{G$uO#7CSUA>J&CG~$IJ
zpJOBp5jb>JKb)1}8=?mWJ|`??xga$3I--nW!IR~-5`Wdka7htg4I5Z2DkV4-2d4P6
zR$;1g;@E>@(rXvMoOdM-fU;#m^FbV3#evRPp`QZ$E9p|SQizAv8Vw&Qj#&{ik$?~J
zui)IS8(~oq0zUI>(0Txu8l3(sxG$B1^oYZ*5`7*L(eTomN3hHQM_t>cs6~Rfdj!@N
z^D>mZq<;|Sm()4Z;kxS7dtKsnW5EoG<CA(FgW+O_^mw0?5;jBX)^3mL4sA|8jx>O*
z-W>vL60}8*9ULPS=z_?LY}&U%#b;4tn?^kds2J5z4TOg#c^{}MiG!^k@8<%7xs81Z
zv(TmKuAiY8#ADayt3sXF4|IxE&!sl;2|A*IEq~N;ptGS>$T6mc2j)hFS<i^<GFL>i
z(1}Ceay1R!K{WV}ph5M}@bX#iVmnH{sbjU^xWrDuS%RsQBys-cguefd(!R{#&<HV3
zz87A^V53tEmls0T3xXKBZGaP<BpXKW+zZHv(UdlRKC2mow$2B;{*89=IGhsCi$nP@
zGk?l)gTUfC-;rn&<$&k<rapWsU-%R#CDF7b5jODDg^xXZD){{Ri}bEErpj3|PDhKy
zr*Cbt#Kcd9CE*JbkV@m|9kEtPssdPCIHiRgstfGV(HI*xaS!&)L^R}ah||oZVCd(u
zqg=rfpig6~z>`%#y9I7ru!;l0*b(^5{(l9Dd$cJRIoPO4z~=}dN&KT^`3N8)P95XM
z0&Fq7m&ag4JSU0Ix-sb|P-V(80m%-5l#m^0b5<<#le`(T<cMR$p)W}yl{ABi?}<2P
zAr_3y_2^kfS}{^nT%DkTi->;xx3qV7V1Jb6Md)D!EQK*Y;c@~shV6y=&h}aSB!2~f
z|69{Pt4JcyF}D9eLRW+jQ;>k<TY4Pec~s$xUkvBjX1X1HYfFI!2UB8<LG<`yfzGIT
zE`&Bk!w)%vrUmZ%5D0u8J0#1HSP)4)>G0PNLz)saoqPyU*m@z`32d{j!nGEjM<NWV
z_X^8}Pv_Sj-zo&Nu~^BzYTWVxUw?G<IOg3Ps-sd`a12TFEgrCSyFOmAU_BO@y`cU~
z5N^l`K3{(jV>jnZO;ij4l~%NHSrH|*ilu1EC6*5IT)uQ82(Y9ece5eGBgsiW`?x}c
zB?~YCwAdiUbt=3vg@>XpEp8u12A`Id;LBD>&=_l>*L49xec(CT`Y<Nd&VM#`ix~Ha
zkk}1Hkcfc;9|9#`6GD~K>asWkdl>5XQH^AELwdDG8aM@(M%>52RAJdu02qW&Yl*`t
z%NRgnVHL$OArwXoJ?Ha^hPbFgJjarlAuc;{BB7-wJV;#%y%+FA0JhjXf+94Wdd!E)
z6VMEUt{lFlZQBnBmRc6GA%6+C5}7B-Gq#`a{1Mnlo_uR;WQM(z*n=NqD{*=Eih}o0
zgK5qtv|ZAF#YW|M0Z-oqSCZkM$$%2&lde}Pj8M)<0e&xVb(ID4Bg<J{_+A^au#%|~
znr1;&04lTSRBh|38?ZzN$aqhz4a%+Wa&Rp)-Y7@{mhJR!5uf1-zJJj}<n#}_GlG9<
z1&W-uSq`lUWtfxfz?xYUcyL)@@AqI!ba_n_ei3MH7NUGqj0=YdgbT77NCkbYYM3Yy
zX)Ms20u+T-P-vW*9+F*1pL_9hKAW#M$@waoePh!e7wRA?TVYd@(AuHVLi?8ijLk9M
zP?ZpC1bZwzT*PR>TYtSMYULme@)!&*p5%aY31b1|O{yA~MY&<Hw)v_VVwSL%x&h3}
zu?p9ii5APRM3G4xQ$BO=5D{Ns^dQdXP_kHvG3`aP8Aq|hCI#h(nl2`yMK`DMW*K3F
zfN_I&5G*3rk7HPce2E<xrVu}15@RNoi2<!^5D2n$^I%DJBY!T#ZD9gK>~=oaXm|Th
z(`NVdAJfL&8;?Pq&15PqGZUG<FL+F7n<DBkVvsUy-gSsH8}vkD+blhjXF#Ub2tcK<
zb(expTNA8DS-@QGn*kR+V;b5${mE$&=R?YeiBHB#lWH^7s1BEnkr3`fLI%r$jYWEF
zE9MA4@E!Np2!9d>y0n;&Ga}03{Z!jy&;acG5rhj8>!IYL0m_XMkHxF%!Zj~qBbwjJ
zaKNX$5X1@yK)7R#_Iiwji>`vK#I=?kgeJKm%XNxREWq?x?_rWz^phV!br&XIlPYLb
zNDa|MgHTgDi3tI^Tj0h*n7u)(Cc8;7rUT5K@mSMJRDWA+mju~bE(w`z%s#Y;olu(8
zkiE+oSC_*lT~GJ8A(fsK_B1!Z)D;1yJ6Jw7NGheP2FYW15Qtt-sW`fis06)hS{VdS
zG7YaNsF6e-L|<dqqX`PqbX8+b8WG91Vh{-t*DAV;rPn5nHZT0LzkSw0Lmqp}OanOY
zC1gRHNq>X`f_jvN%?RP6L~D0$(8`8V3PLdpc<ezk4-QC<m=(e;$jc6d(iG6W6~=2G
zY^i5J(Zj)v_z#gxM2Hw$rM~g6xC{-~>xF!rrkST#m-6@mJ|#a8lk{R%N^v<Fk%yBo
z_%+o~*J2vDQgN=d^slLibCC(>6NKvMO>rNaFn<Y_2;LO8vI(mId-0nuKCqllvTx4f
zN5Z8du@HZJ38RJYs|(Tw{J@xZc}t-+4r@2NIDKvTW)(8>jd_^0L&Yo+&%|`S_`(O%
ze;4Dv$=~9shd`JM?B!w#AIR9S9^U?R&Cu5L6S0ec#XNTFT5$iGM_S*$e-S|C(Qa7C
zw0|UfCQ|Qw#;T4@3fmEWea=&s{?(I_bNSbw30gSpj&Vi&4n5#AxwIL5`5+~G2i$iA
z6pFV_80*OnKQ}KcQkO5FW-0mBWdjc}t<b1gC}QD;J@l@4i(EZ229Tc!K`4IXir&&Y
zSIm$u=Rv}K`8LkaUl#MP98lV`HlTKeq<_>%SB!1r+#yW^vL&&5-nwyak%XLIiR~gD
zzy~8OAJ;Y;CTRUoNddEi%aRYG4_ruST#*QBPrtHLnl=!hRdkO8%`k}GLR*LT8)<?z
zNW^ML1SPD2-eGG81ZIywVX^SI0{D~o6lC?ZW;-cI7?6YqjG7=rPYmI>`1>oC0)G{a
zT@C@klVZy#d|nWrJXdm*1$;o%35la3N0rVnA+c6T%k&{{3AM&127ejafU6o^B(wOU
zV7AbI*6ekPIko~~5g((V)kBrj&KQ)H(~CET*bDiA8ZJ2+L}BBibO8@-?BT{%!ME7*
zK2|;xDLfiVVQhJuU*idGIsIo1vww(UQ;seO;eZ4cq76P<#RfQtR1(F7*CCI#cWCi3
zOk4p(lL(GzpEq6!3Dw0u%bPbYy$xX#^JD11Hr$JBloq(CRtdJe1p)PZEPVFb!be6_
zfGewz6<dGIwrg9<;t*1V0u~8LjIY8)fDeQepJRAHu21}$wtED~u<RlHfPZxeL`?*+
zF>BXiSUiQEER2$n*P$9f8g)Gmbm41*Nif2GAVZpB9viqY*gVM;Iu6Svgr<NQ8^Ne4
zJR|E8sqhbDQIWpmN30G&OG3;L-{6VZ59%Ve;8F2F1{i2anrxwSS>)CRHG$F|Y<r%F
zA;!Z(hy5thPpr*pn;F|oLx0>S0NW+o7}?PkbBmzqMGE_f6ei}WcqGlyRDcfh*wUvk
z%~-Ew0|!f!5>uUJv{>qe7nXl>pXEN9M{#HMK(6**Jm+7nzea%YerrC>m>ABPx8{jN
z0~PRn)QI3v90x$Zzqw<|fkwoYQ#PB!f#%BxsP+Q(RwbYWdTfc-LVqu^n4iS{8_zff
z@LT3a9wW!nlS<10z65U}K_V1uWbj0dd0vx(&vktexT+U)<5Jxq@Y%Ra8X#P(R6qz;
zT7_l``t3I`voTx=e27I?5YjSK#S8wt$V1VMS-8&T$z__27T?@lbg@-o;5{gr9&8l|
zOT>Kz`UYed*TM&^9)G&pZ;7*u0VaYI`aJjwdswKzW)w%{V59J2n8Fldf2a~X2O*SQ
zSHL`gLyQhHeIMo)SH(1!LXYKdFaGi&W@R0rm(XOr2>uMVSJ3_*MIbDa@aco10L%_|
z!XxsB_7+&A6l=CVZi{F8g3op^5khZfV;h5#4lss0mbPB_$A1tp04>$x`1KihIMic_
z?FGJJ>49e=Y{=)k>SNqNk1k<b585o)+=8$t=pH`qq8He{*wnxx4eg5oM>Hww1rOe0
zcB?>Uia^ho8B<9egO+nhrp*^fU?U_x;j@|!l|?{}CzgQiJ7oWzWV-@;f^ai6#GNrV
zGg5XG!p5*`d4CEA1%$^Nau}1`V4Kc>qyk9JVLK0PPP34&?}wa(07wt9Wh`^TLL=BX
zg{_k00~0G5;-U+-2PxjFmCHB!M=(qXA=zH0O%jk?JT^ahW9?55NU}w!l8-%^v=-FK
zgN_(sq3vOiheP&karcmz#J?fB1sgwK#2-ZwZ`g0)7k}i#v;3_B;-)h6G$Zm9c2`K?
z=nq865%QQnnBYc%ei@St<MDOwE~=#7iQpj6FC?`|R$(K_2Obnt<tx)duvy$3N=yzx
z2(&j7mj?H(T|I@M)j%eQujP2%GAuA4xen<hoEK(Oq+q@$h)J~gr!b(=jD;tYdkX?1
z+?;wHvwvtu5?l)f3HAs_BMcGz!bL!$g*57Y!K5;+WsG5<0#?iYFS9b33ST!sR5pKB
z!4LJ<D0FZZWK4FRlAxEs!XB43g={8sBhg6bB#AhRgtQL}|8(<|J|;~pz)M&!;U5#u
z7b~dkB*8Z8G6!RXAHoO_v(=8d0%-#}o!4f9L4W3vuFSw523ArtU;dVqQyt&hc4VS+
zd<<EFXfO^5D=jWQuHpBk_okJlm$WGZy9fX3EIdmtJH^izX6phMfc1iEG`lkS_aXqJ
z@6bRSlZSTp(yf2xmk%0>+qnmDN9At2NR29ap_|8UOFjs;3$l}E*Ye(RT|FJl6!g}r
zdw*Bpnq*QdWIv8NWT$qi`m5KSrYoG99-Oi1I_mZX=X(|Q=J;{0M*myc#MTh&Ikcmf
zb<M!9-*jX5fp(f{>eo|b7kTocXsD}Ox)0b(wCG+4@C5~WzL)c~J(bnIC1%#xAAkdH
z(r?dM&F(_lklwOcNAK0_BMPAD!<*=OVSf(m6vip=;r@Y|R(L$H4Pq0IKeHLhb%i!5
zxdGc@v{)xeFN;NIKUI99i+{(ojmL`hP@iLuT+ih5Z@7l#n+r?duG0M}i-$R+)lmDJ
z*-k-7{TOO0t~~RK&%c!K0U7~;Ly0Pj?K`A6BJ?9*mumPHMjFZ53Wr%JghndM^nV#q
z&A~>f0P;<&qmGIfA%A5N+c){><qsj7%pwvo`J*o|b_FDN%7E5@^6&vsl!g4kCL+m8
z#^*)mS4V6ie<Em<7q;TXrizeHzSo66CBva6h{5p^oFhQgSrpd3VWT*{EeMH`0-V1O
z<$4JmUKalp6}l{6x~%x?04@A#Hh*19LF}_+^PLN_b!dSsT@)C2y$@;^2!0DLfQx7F
z+b&n+`ug|9vxrTar{7{o3+6BUt8X{})XYP^5Tc&I&#e?%25(w0?w1*kyulC-EzjZe
zFOt7t=1R;+Sl1KBFJ*F49O1e1VPX$p2WOkVhchRz=W+}s&u$pOV|L>DE`O9HTE|hL
zPY1+;pxI(^v5`EII+BuBU<}VR2SMWO9LE<RM!@B7#~~~PF%vdNM)L7UC|$%Yp^WKM
zCE9juLPMqCI1zBhu~y7sfAaW4ZPEmV5kJ97g~=Zd3Jx$sT!(;r#pjcr67H5znR882
z#q6g33>ZES#wQK<>PY3|h<~PJd#_+G20Qo_`#Rl-<HXqnpd-on02!2IoycWSyT@l-
zWy~iq!OwBHR4Q!}2m<f3Z<-)kVU6R6xq=#d9PTPOa$NEGL$+c-Rnj4{-XCG*&c{^Z
z^XG4E>Eg^_%q}a^rV~XwtXrtYk;{&NfKNE%6rjXCU}Jscw49QDV1FJWFMtIZlAoe6
zm3)-i7iLlaiqTdkM?WK0N5H2bai9^ZKfGi3lA{+eO2nE32r8m&Ij*RZn*a0Slg5IK
zC5XzE$NnEY;=Hqu&#n3TyaGFSWc`^#j8zcRREMd`i`exZgUT=z+LQ-zg;@oBPY7qi
z{b-Q~2b98bZay**vwuN?mKJ>A5sq1Vj<3&rM7X;ZMrIYEE(Dvywg#)Sg6oHK5NSkN
zI1dOHkz|9IqYxtHp|e8{p<*~sN1-8FHqenyz#MUmx(+PxBE`*s^UveX^4MO7CTY`#
zj^%^%mOI1JoxvZHL@b!k)-f;Up0v3qU;g^cK5f3eGe@`x8k0`RO%#57q7{D;_0N<=
zgcezR-7))q2`Q7W$rc4tU?l}5lgi04e_n)S@@fgV@oaSEKpq5l`RpAX^T||)y_jeQ
zA3acf6$9MT=qK$#hOr&H93pnWFQ788W!d60EG%LO-7gYGQtZwgf({El1_Z*rj?ROC
zVgzgI9X?($Hg_ZNCjw$@vV0+<t;-<=CU|(lHCh+;eYT%FIz*Dg8(`LkXv8Laf9@Q1
z<)c5TS6}`as?BA#*`#0j>vFvtFR66c2VA9tLnO3mfglUkmk`uDc3D`3JAp%F6whtN
z2LteX0SV4~Be1?K{aacfX)E^PB&IFM;vc=Qhd8vy=c=G^#~kxrm|K*-m<?AYarm`W
z1W$ADj~l5s99^zs%nRW=#u*L~e}o_<=qc(UJ|TG1!e#NXS6oXOC7?U9^smtZT&xqw
z`3e<Eu2L2!BO~lh3NZvY^-*0F;F;iPK?*#=t~pq|)Dqd$g+pX-a3ZZb-L6dqzF#}$
z&k-lS)|=xOzdkP0@ih6$*P?fqM}%{>7K>kRam9gows5#m@ud!!-(#L)e|nSSkV%d%
zAa#+TXh><-qW_ASD)}-3+?&s_NIJ@ymI-TEh{k~;g$Dv0b5s+}D2_G2nIig=fZuwh
zdx|63Twmqzs<GxL8pnkQWyn$VG47CXB!B(9To{puaBu#6INt{2D~_JQi6uUH1ZOH=
zE<l1L`-l{OA6>xnW(Twre_;;`8Lwg!OB7*;jP*%lBu5-;1c#Uo?^akDxP_7SHQf1Y
zo<GnQ8u3{?D5QbnuaY3lnPiVxKjD|!;BX+2s6x9<Rv5i$<w5?I%-r~3XW+xs#Hz5a
zkRQLyeC_RfDAxWw4hV~Oqn*LqiU9~Xs5gvx6j?w(l$bz#lD@+uf8y`Q>tikwGC~mP
z6I)2dZOVvsiWS5P<$HXNhTYr}ZoDW``gu(II(u#5+D9BBBytFGo);w0%fsTPc0^(E
zM;dU5oS7`mIH#I#IPx08g%7Ug!1pXTt_5m3_cNcC<Z}xU8{p{|VTk$8kprYOBo1!d
z)SYD@eL|vQ`mbCjf6zF*IC`sN+hLAW`V=>O%>00_T8!D2$fsjG+|oz$8HX!<%qlmE
zev4?)7N=KTcA)FXYMS(H(a@d?4h#x$gNO%n4(%p5y~lszNG7<3fv;jPB<pmqFWp84
zI>Cqk8IgA}hfwfen3N(|sGbgy&UpFf>b~;rfjvqRLU#GAe~Rx-X$?j>1YDRGMEqWd
zoRf|`MF<f-Cr>jKcZx+S=i}?p#OdW7ED||wIyOlL-h1XnzMA6vFs`$d3fcj2-haWB
zb~p*-;?&O+UWfR-w*13__YUy^(Z9U-NpQW`ZnmRuF@#;kV9X*4I*tlNp-O#XgY8s&
z0?J2ltZY53e=$Men1Rb9<mWf7+ANrmHKMn0M)L_<wqgsp=0F~gA+W=#HYt1@ku6bd
zwuwT)=wgnTX*{hBA)JCR5!dgp%(P3pQe#gadDp*dFlyLnVf1EtKE%4YIQIfZtvvZ&
zAO`{WFW=GnWtvU5-`dpmIVjtGi<1wc(4Bl1cS8~Xe+Hjmgd;bwCh$Q-pNCf$lM2@Z
z`856}Tc5gNLy+FVWh8zB>|6GpO4{vpu4^*kbwPL(WEMA!KI@}?d?5ou3pu`TN_tWh
zj&&eCt|U_&Sq|5Uc?t#2KSe6>NeV4oiHNg<)D+{6oDe5zJ$Qg6Jgt0N1>Zc$PeDNC
z1#P<|e{RD(T-2bC9ST?G9NFarP??nvv5PMOWd$JQ-&h|A4msA!<0F&i=u`bEhc7o~
zJ5t0kn>y}*?L`qgJ_9~kP(DMDX6F-Mk-@i?kT^&kA_82T!39IU@&uK}BGjj<A*jdU
zJ1DDy1vCUY#4L;{*t_+a*MK_)MkjWuAmWex612)ZQP;f-bcjAyIY*Py_JnSefzKL$
z-NP}09H=J({-PklOW8UUpjX*FqfeU$A&b;}U0nJ60Vl^G{UV+t3@>o2i^tJ0p@(ke
zU}`wJbBvol0807rd&QVz9*5x4%LVmfFom9wbHHotg}B?m=UXhJDIS9h8$d6TC5^7^
zWVKpc+M9*_)xWFT^Eo>UJmo^Z3%<;M_&zBCZ8Ll?`0gbo)Nj(AN{o*m1-arFfBwxy
z5vncJd%pYv00^h%7zz4)fx|gTR-Zl&m#f8^HktWFy4no0^=nSHempT_%ekY)<a%gT
zgx8929`!|)K24KJHa}nQDp2G%3gwizs{rzvz}fuM&gwa{0X|yfJL^VX19(h-eYi<i
zJF749n;5ovo^E!QG1<*tTJ7wgRRi$zcCkr!R;_cp1*l=G$)093fSMhUEH@d=$ekTv
z@*9Odjdu1hWwk-^ZIa32awm!!NNa2+>F#lvqz&NZYJY(uzf)**zOTsWyis5?y{o4y
zh-SgbodrvXlUrw$o-J1C$6+#)7||LzMXE}&`8wU$?%j0|iyykDD`pw)>1eUpEN1kO
zr)TtD)i*k~M~H;}_>(%I(hjToj<|ks>r5Ba?2~KJ9DjsyHY~GWmpH2uS0{s>)a#QI
zYqi)k%IJ5>Sbs_{t7N=UEjsz1Tj{80Jx=oUf7UYau1nzQpW8W9rfjnwXZw7WT-(ZZ
z>y0*9i)Av-Hq>r$YEpFHt<FcU1?0&9m&W<lPt{~<mh587=9BDv@eq8lbt-Jj(P8+`
zb<0Ex(|>sbOM6xT6D$~f&xi^dn9lcLk@v?!?U5d?$@CA#;@`h1gv6&#BTeTnB%AbV
zqgPa8`XjZ5rm9=3)U{gcpxt`6sU0*sX?N9LXyKS;vuE~IZ+hpz>IKVaQ23*JAvl<R
zS`v|uCfuj?_+aw+@TYfh?W=TRhX+?qgj2U1)PFNH*U}ZfG-9e|ut_>ztP<=2{1K80
zs4QkGBAQIOf)FPxVf02^C)uPx%Uxbs9{qEz`ZRRJ$-rbv`e);zm48~RNH3Cf(yXxJ
zmNlSmz5QUsv#ts<E5=Sjr@c5k!``R!222pPAGfwWFx)->op;jeAv-_c(Mc}RDSS}u
zb$@#TC=?|J$XEC1sb;OayQ@+8H`HCTNq={h^!7{}Ai&TA#+HY7R-?|{UDc@i8|td{
zZ1?h$-R0-{d)JrTv%a3Ud0ar&+tx)@la4u)W!Dp9MeZe$mEDv6Jk!cHxqFe2v^IW?
zPW$sdd~JmH>d*d8?DSl{S8tuO#dy0e=YI%3P&MSF_AD_ac1?*Q`*}v*5WU!Luo2a%
zHc3PDG$}0E#9}#pnZS&3S`^U40O;0%jJ4FW$I>r$SBJQ=-M02{McM;#&%blk;lS35
zzSh48-D!6R+%@_ydGPNV`xid+8c4YQO}(}uUo?4Iuf`<3)PAVx+{e|n_oBR<W`CRX
zaD4byyZQG3d<}i=7@FFhsM2%})%H%Ene^G1^k(%4WX3pi05%-{LWsQ*k3a{-G`Jg=
zl&*!l_xGx#r6u*_aA~_1d<w(MX}U^ZQ`*UJzStD+e;wz^di}3IQ<64){yyj?SwEhf
zoZKvv37iJ7I%>DYB)iBasjU|x%zptj*TpZ4<ge3gGD+vZpZsg{RX5U<-)H9v1#Abz
zOX{s{mP31c=n0>M9$#1in=|f9PV^+?c%)Ye%a0Es=i{H6Mn~DCXou<1`cpPrE>@d_
z1i-Ep5_Ty8gPPiBg{-P5XfY7FYy5)<>A~*e0CZr9CQIqsKznco55(C!AAb+R7(NhV
z-;6s5Ve~+ReRFCTLYh<Od)s%uYby0^M!iiv-#d>=uSe9x-s|8P*NX9`)!#*T@0z$n
zfVybUmf6G;KM+sfj=2NRzG;0oqW)>U57XVl{jf3aAbRi^^-be_h#ovhBt3bSl6N8c
z_$S__H8RnMthMRa*GpYOM1PnT!n5`WQr(r(!0tU9J5GHH`X~2zBksWNKfLLY@!!b%
zAg_efLwf!6PGP()Y_+lUF2cvTM`|bv|HVBp9OT8Qp*Vbs-gjR1py?Gu_KCmvJ{)B2
zz23GCnnR}iedl=(8g<W+QIU2VM|%~O4w?g&(0$iUFP8f?re7ZGM}MQumAf}BZT76t
zw5+;AYv;CAFWHN)cl8{EuW$3}N7w7-FWuq~6L$|2w)-ilTK;eX?jwm-_K0eXcVRxF
zc+y6@uffNYRXWBHZ#UX~EGO11M;x$xc6zj*XkVz~tG0*xxA8ukL>K3t1$3kxql@!_
zV|kD5ql?pjP}kmr$$$5ue8>d456AD~+`|<1h)aFE;BJg;7JWdk_S;AIn)WpEwq16g
zt>XYCV~4F{x1Dw$6;GzT{ij(v$r9`JESqbe?9d97ySzHNan`esL#oMMFO#_~Z_Za4
z*Sww0he)z8YxToz6V~g(dIhZ4f{nYdaRD1^*x8kxY&VOWS%0!Z<TuArBH`2|=txVX
z82D>DDu5A-DdD;??<N`(Nd|aiyEn~D*W_%f91iK!$?Q-a=gDkIeS%Rs%Ms|qcEHm~
zwqEAR^{@y;A1$s<YtQy#m2r4yy4qypBro%-N{6z8#(N4hUI&eO3N%Wi8Rd)dr<<Za
ze$yFed3sf*<9|gbYXZs)IJ|WR0{Cqa+~}#QR#kAmDu?va79W3-2E=#2FH+C8d2Uh>
z{clD&xv~)}a>EatDXXe<?p0pP^@1|D9&_9Am|njGk12P#aSpm|=V042_+r``xBZ|_
z+;)Q^<?p|_n(MBKk=e7w7sG_tLwQ<0X}E$#uZwM9lYh>Z+>8QHAHaDn2egmST6ygb
z#M!DqQx#YHi>o_|`}>RgcN7oy7Y}-igDKI-T;A}*BwM9pJ|I9z8i1sf+1kdHf9dKb
z$+Pph%}GO@q=EjnU2n3pYkR#(R-2pRtqAw$syV9(JxVv1De=KJJnfF-w8%BBOqRBw
z(MgE4mwyZji5{mpp<kvhiCNV=gE}cFlY~=&vebkPSI5S3>xOu*Wt*1Q08GRCWQ#C}
zShko=c5S_!vm$yLyL&+ta(ng+F2uZgHmP&+s4P@Wb+0+qy>hC18txHO9mVfCa*Pop
z=kh4YS}VCfJ=%KCsHi!(hEHu_%i|5!?0ZtjrhoMIws585?#|C)S3nm7RUrf!Y{=wZ
zM&8O)T4fz9P64>+X4ULwRd%z|a8);Z`@7lebTf)Cuc`^F1wuVRPK&h0tm*9<8EGl^
zDt{C;&EogvZ@13Jzkd9WAAgx-7a!qJ{`i`vceYy7s+wl`<m1W5-&qj#0HK2bYS}0C
zVSh0z90v<4K@JbJN^XA~mO|WmyjtY>C|O}M8h^5vSvpR8yl-a_{$JRXR>>sW(tbb~
z`sy-b6|L<;9HYk_Sf|_Bs0ZI<GHIwVdA1xDqY1(DFhX?oCOEc>WHcJl>PqKZ;<nlN
z)3tHiuNKQP^t1NzTE{?l;?LcXw$>(`Gz1~SO}LZ)*)M+%u9mP)HrrJbW}Pmxr1oBG
ziwW~Z*KsPy9a{K(Edp9Fl>$&ebQ)LyYCx60FIsPDncmmrGPkGgWnNz=l$pJ~QRa5K
zrOYXG;hwCXuB-C64^RKm4d{kjXR{cS-bb7Xvd=H&YnMZ{wvJ{Zv+_b#*-_;ofjD}b
zy|z~=HFuqoDt20bBZOnq^|opKs3X;dW!IKRv-AnA;wI6}3U-&<-7SWjp}l5D62v<j
zJDS;omkF-4obv&2Dgm)T%UXtE6`Y5UwjgHW*2&g(LPF|=KJ$Ik<eVmy^-u%SLE()}
zgiqx#m@SBNZwgV$ayH5NleeuHk|FNHz;GKBl~C3vlZiTiA&(2M>}m8<9MtSX^CZJ~
zSDzec6yMn`Phus#o9Kg_Bz;7;4t~G-?iIli`Lwj>d`m=Eim9FOs0Cd#=U?czs<F2D
z4Kt$k<~mP@q&|(?5Q`>6I?iTE-UgbAK|4iuQoK%z>ZJIcl)$WJHuu$oLYi<(>aJ3K
z-3w;nrh=k>Qc<3e`R;6V7Mum00>5Ol4ntuJW7{sOnf*V`bLzuM&0gf)7$M8Q=+5tm
z;K|u28Virq?M;&9ml@@3u9pjvX_nLL8x2$<sV-8%7F?+Hfj^%17Pnd<(zpZV_lE^f
z_fw)TRjF&_((my8pe}0=L`UY~w7m^Tj!Lw?+og4Xy16>otlM*`$@d{Z?4fMESuN)0
z$0Sc*CR3*&xPykoIsz5hoQh?ey@=RR!I!=~7sd_5JZm$3E_{ppfhek-0=1UgMQiH&
zeRJQh*=e#luN}61V(B3B4uby*d_TW==(=tbzFjVf-zWKUnjC~UITm8tQ0|5JjkW%2
zZ9X1<>if3(FUM{3YB5XZ2O-Xm+v39!|K-@@e2+FCdz=qP{Ytz#7V1)R-Gg>}G`>fI
z^fNHMU-Il>1P_Oh&q!UYZ?MXBPkZ;`@}9OkI`8r1^os)K%D27PC!1qRAJx5jEeWJM
zsC%iJt{zBLBWSZt91HQBPh`{#MK#*I&TR94?jW_2Y92^(OI|ecFl&w3CdspL|Kuue
z-77<Et5sl{X3Qpi0K03fE{Zdk{=NEt|NGxw(a*o*=l|g6|GsLDX3(=jgPjZX;O?}R
z#yhh(W9IO{CDJkpESBk9xAbr_sNTm?k(_OKnQ9`&dD-9lmw|Zt#Tk`T4l0;zFkF3q
z_g>4y9P$6+j-n>?|L$ne<3#Z~;c>}!4-w6$^69%WY;>h?T0PmLx^_Cz)Bn4pDaY%?
z=zg8(J<n#*F$vtkZ#b!CHn^i9$LqrIeqE@(!hYM8p`5Ov#lM5@uhnDAY`ob%^wfSc
zN^<{dyvvM)TV#*8#h)d!EWa+gpnsEp=ZkA=hDY<6Eo1!b0+(0TT0dFB{r+U&mj3p;
zfm?2vN^~g9x1RRelp8y{A%zBQZT9JWLhy~8V&?T1(9(e}vUe2tzT6`&A$|YuZVsfo
z;)zJ=I4u6xtEa-$ltAu6lvt1M=YzPRcqTmZXn5{7HE5%G3dHeUXw~!dYfVgleinSC
zLHAj(J@~Geeoj-}_TBO0^g!a0@4{7PU+E(nZL33vVYl3tLdnPvo3emO?9th(oHpMN
zyKJ8T2|VuS{G<$URicOe?<`mtaLS^0jm={w!9F)|(R{5%yRF`E%OD1~F&@o*yt`%_
zDXqP~K5Pe0%tti7z3J%lAWw&XuDSEviEWdN@`ny<bspuEtFcM+TWrk%r&>%k&$T<H
z!2{RV-5l$2#w-(RT-mFd>Af7JcH{p+4E1@GlHzQW83o;dUeS@6L=^P!k8Vy=f-Lj*
zx0~JTn@5@%A2c$P14qVCsI5;rLiu>a?so|r+z&<A9_D17>MOtZp*&lEEFNl#?ltPx
z5+AohK-kgxg2>s6?JPStA2&Iwj#GXw<qnRfw_a7}jMawSA7j#rEE!tgd7%=%=>Htg
zcS49rhTYHZe5XdfA9y{V*y$;vzoyfZQGGe*yI>T`$nE_?&UX_r@h7A9r*OVY{WMG)
z$;F3ndQi1Kann<{`if0|4>A0;nx1MKpQb578oM8$=_y%#Y^H~n;-fO(i8C2{jdJzR
z$Mp0}{Ub3w71zGN)LXpu!6kw@J3H$EFtZ>YCtlK<Zze;3X)_`EGi#G#XZ6+G=+49P
zn@GKLyYUeu(BPe^vtSoQtuJ?0Rhu_E>DAMxzrBqqR6D@m+ci9YU;68*O{ksYTFk3@
zES?WrQWvx_&vy25W4f6xs+ohkvBBYfyQRJg^cQxrTFVDA)n?dzU)22_;zpf{UzUwi
zM~|lH0C#E&{i7v{K7afn1T4O8`xjrk{l{(iei^PndF00SBfWXd5<SAI+!H7A<e{xk
zAHVwO5QC?4*FV^QL;ZX%=Z89epTm>;P=D&vJ4heuraZRaF`GTq<M=3F-{YK)$3Xqd
zQCi+!O8fT=T%5i58f|{0YxM>DEbr%SdX$^%868{qaAiH*3G)Z`jy(7v!c)iIJ~&eN
zsR?^%2yR0+?BDO6Dj50Zq3q}p5yub4X+FsTTkyA`jMqqi`Dz+zlZLOQmTD@#u5R9>
z;rV-Fn_Js_K);K8u;Awfp1;-<ojfg@e3}yh_Z#=g5vG^(D3<@=Lk5pJFECyG`NyZW
z{Y>RE;P9RShkAM(j|n$8R(!z29q?bpcWy{N!dB5s#vS8TV1M)`(bIQ_xy1*M^a(dq
zg`H#aoN*9;lloYe&HG9NT#!@^a7EGc5Bgbl{*??t8uKs5;DGnC0zEng;pjmIeX`>7
z`%(<v=W(dig{jq!Zt336W9VdOd@BZ|=BRIYXDiQqe}O8Rs}r-)UqIjL(T(HS0j;mo
z=mdA{qCRidUHSI=3zSE2djmmsATj4=+wmbg`e)UD04(AF`hkl>o4eyk_LQrRX7&b|
z?C5|p^rszs(htukPIkqk>?~3qCFw@0>>3xuLH9<l^cSdtr+cDWb{9bu^^RDV{zA2|
zuw79wI||+z*LUQPkp74N4^T@72*^Kjle$g-0I#+I08mQ<1QY-W00;n*ibz=i00000
z00002gYlCb<1Gwi`2=TW`2=TV`2=T^!4@2U&An@nBUzRh_I-W@GbWuK(Rs<t?B21o
z!H%S=v$DFX>)DlA-PO%vXGW5jWK;zsSP{W|6iGu8jI|7CEg813(7?b#@M{eNyI5I<
zjNO&>XSSzjKkZ-8Ip@BEWLA}C*D%ms$++*wx#ynuy^M>-Bu=tuILrD~l4t&#VD8O-
zO5P}|BI#FN`w~iQ^JwdUy{3O3M%^BJ&ZFi*Th(bKh0lX|j{h!oB7M#uwvw!$&IY`M
zuf^hFYdR~(@ROB=Zxw!8Vd0cljVi(_1AhH<2ubZ~D}t_ecB;eYd}rrjtDL4upZgU%
zuxevl^R3rVU~3!x@o~KS?Cp%t_~WF1U*uI>zVYKCu&TsZ#msBJJ%sUM|2*1n^DiE@
zQl5>fahvb%1`oTu=La}x-c}jWzE}jYDob3Yuh<Lr4LhyaThXBEDy4;ZOMP)@hqBE`
z`jq`u#9IZAA?cE{Z|EcCamm?>sEQ7Giw}pqU%|ZRWq-^Evy>NM79B#f9a#N;EC@4L
z&Se1IW8L`5wEu{f_C>@^(yTD6?FZ1xvR&|MR%G1*J}^CrUid{IQyaW>c6}yBP%aj}
z{TXHas&T?AMv28NJC^Cxu3fSPD|{UH$9^6i=05C2z?|%OFz}Or$q^;6@0WQpXzas&
zI^_niFcrt5-@re?k|j$<RVrA2fu5P<1DH3f#56O6hl1g(s3@l85o|{L>yxKXS_tde
zC>h@PdBCzx5#?bGcw`4TD*^`DF!l_$U9Avi<7fyDo>X{5-q62~@m~W9Lt6O9l{y7x
zwD-9fZFMu{`4ILc@>HJJ5ev`<fXHT3y#wkSdXP)0QbhAr5QIK}0}MrfCzuYO5m-D~
zGn8#wIF<!s`{D{#=VDgzqgwwf8PQzr=}K0&>TRqBd1eaha>WocYlyGq-mb5*v-9-g
zHNZ-XXOM%KXKk@SL!{r$Skc2RhV@c#w^&pLcV$5Ua9HRXNpzS13^M_YjSWN3dI05S
z)C1c6Waw^RfS9N4?w>?|K0$3)^Qj;B0?6)hI(d(0Rg7&vy(oEc$qWA>pw_#HY7EeQ
z32;8Y$6L85;}7!wYywLIsAP6g6`Y4~IQrux9Xv|P3P1ErO6TioI`}qDXIOqIda=;h
zb2xtUDPUCwT@8}5pJy3jEIAw+bitj|fTiaG=R%z-e#4*heqIa@N*~Xa*mXQvT&~9<
z;DU#f_vR>nmj?<5!k}=DvTN>Z?1<~jDw^OsLh>Vbnq!>iJ9o9tR2p2U+#kWFQ6*D=
z=7~di2Y(=M#9OeU{TNTJ?06|gq7ZPVe-#2W;wd0J`Ac7KIb3h~7kb@txZZG{yqou6
z2Z|A|5ag0kmKVGZT!@LO9N;KeP*1~*r*Z&?^TCsU98QcrDP?q6wlYXM6}9j#CtP2`
z@u5lupX8SxP%Tr{WIZ(u1Fc>l;HiwP`LI}g>0(df31_KD%q2*(zPNUZ);KPqkHw;B
zmAvvxhM1{njqrCMKyscz17XZA=`56(cSp7D#|TGkCNDAFT4J@9IITg2c8TTeHg<MW
zm{~S|OVdu@55krFjz0sKgRCHgAIrpGvYeIJ^K0xZ$2+!I$pf6PlH%wvrh-t?fJg%_
zpe(3p@Hq_rP33G0qyb%KU+44O0L=+chj`msNeKD1=Bpsn&F8J8JQCP~4*-%RPOY`c
zR+Hg&T^U%dU$#23`q)3XyCo7QxF>kj@J}Is{v`Cr9No8cvr6QUbN>g#SSCB+>Uy=Q
zt3h1FCso{k6Ll-rYPEjwv&Di3J!a@AQ^fsj4U@D2)DN^<v4wbUX*&DC8j4%1<9>#c
z@HiRAgZ%1wo;wuC&JJ%RSy{zd-!0UE4qD^9tbz~_c3i-<g6Ei$&1VqWs4eH#pb$TQ
zJuC9-8-JeDrCo-6$wq~^<wiv`&#$tF{HC<?b?rMv5#O|iMLzK*@`HYdX<PxygRA^d
z(gAO<K2SeMEh5y}T~)d<nDNQY<RVX7vkb1UX?&6Lva@vnGb{56_cPtz6t0;Z7Yt$e
z=~V_3nDU~!Y4zhY^)qO5v3SmhDVD{5{xAi)#$)evZ2<u;ca<YG>UAbXsA`YIjDR7+
z?X}x1u+7C{E}B`ga<y?FR_AbOlt|9YM#>MILn&J4U3F754|*(*WL+4QRpTx%`$aOX
z;Cv@gO<jxm7M+Woog8r=oNFrq8VEX+F1jmV3X8?ozMePECJ{4RnwxZjx29}=UX@hf
zQH>KosRgh`z#jToGdlDuAi*MgEwL12!7$m}zVPo`{3k55JPZYFida%O0b2stl9K)c
zceJyE$4w#xAGr(9!^2u5KHsxuu#<sJiRNrBFBZl#pwkKj!!Ta<BuNv)#jtg-Sd=!Q
zDu!Fy!!705;8*MH?DDL9lT0OlEkh(s8YOsndYwEx-<~JS*7iJKp10rI6kx*)uuY%i
z;5!9eqEQKSa#AI6n!H2Ymco4!;sqya0@<+Tmp1x1PC3$_ke>mdrFdg1pvfFg<Q|dv
zl0{XV++21hNKvr_%pDd|t=5oWYhXwk4H6Kv>{bZLUKUs|U~oiUh&p9|KoysIbQSOc
ztPuOK4nzvQP(^K_0?Acp)>5@D@I+=o+fIz|mS(YHQq!og7gyxz#d0PQ!A&F!ESEej
zc|E_-^{fj5X3cFJNCKA1_gbDgOo&LL!>n8Mn7unM^hIWt1JRh^rjaJBBD*~}b%q*0
z2za;Z?)Q38*2ck78zy^yKd8n<e%0Vbk?V2G8pue>y2x<iFvKUcUy^j_ARxqnH^|)z
z3K<M?DrS4P>hfMxnYnz&on@#U;k(s3UQzBS?6+w@_h~f}#Wf^tEY^ih=|$fH`q6ur
zARHTjy+@aRxn%cIwiN^5Ethf-0}hy*E5rfAJm21)XUlUoM}($-hg?8C606u~14R_b
zlbea&6k^k`JAlfnxY0MUPf1JQF_6Ix<|PLdjH_aSODXqUq8{MD)twNRC6Gxz?{wx9
zUY7BQhu)K1Y+ysCG)BoK&syG+&3PJDj9*U+$bp8#42Fq!Ri5(JRa|8L`JHqM^KKmL
zGL2(wD{O27IV2l@T>j!0uoj(9OrfyheX^VFo_oLe#d+v?uuOpJ;Wjx<COn^2QjjBH
zYsvNnnK5w%c3)bT!GyOb#7+z3W3hdZ3=3g_kX#vssWjN$A<#mRK@lZ*`4pzo9b9xn
z4ZW+xw_ql#=wW3>bxqO(NVInIp(Eo0KnFO^;E>X2i>RA_2~ra2$Rt`TTDmBRk_b=e
zFVoB=0E)y<c)#Jy66@$+I9LNHBY~n(I0;}H0@b!;K>o#(GE9)I#YNF#H-MGtG`;bG
z4(t{<K#ojN(7wd6=knZs%bjz3B|C((^(_!3J$1h5L+*{aXrC$C<|*8l<xSRaXz_Lc
zBWV#)RLuH+aPk11@BP?)mAxu^pC-fBr>}hYKiF#lH;I%Nod1cBl+fOf$h<75X7H-4
z7wDXej%XbaLYIwY;0Na+2dYT|9UL{moFb{3`CaeqtOQQOV;-%V*JI~bNi}Zx^cghf
z4N(B_a5+n>Mg;8^&~96$171kVF&{t<%!aoca#5UrYVC8qrRxz&$vk9eJw<n%cg4x;
z(KOECT$U0ilp0O}4U_~e44RoFC5o%z=)w-75Zas(+MXz9xdEM%LfskyMz0DY)|4PM
zsew{%fl_IKQX!`&5fQSvay8UpjUxoGTmo3zy|VQI2-GzT;2#5I&_w&dOme@^h;DD2
zraS(BCE`TYH;Wk&leMt~VcM$3Ji}(@RG}|RF4uN|%>xm9Lts*GYiZxr68WMen~uVS
z@9eBQ)j{o~;RW8#Z4yjw8_?i1QlNRL@sgMZHOi7kSu&*RfxiRxTF@0%mzwmc*0o-V
z)`82$%Gg9DP}|o$@~)enIo}+5NAg(#*w=i2*Ftkgg!-Tor`k6zZa8tS?i&KRip?)L
zT-kt9gdh)+vz}mw^c8bLgbHd)&X3|O%c}<RNR2^KaMHsxUY+Aj`|7+!zc~DATqSAR
zK>ZlZtN|w}#*>*B174t5gJ1Lh3<sqT-BK`MMf9!KY5}l+tMpjKVYJ^VLX+v;J-&B;
z=f$H_FJSvfZCTrYTv&Xw&Dq}Yz}B*v8s9q<T4Zs{l@zyMCPg)i)4OWQr2?IG67<!=
ztqJhiem7<*QbaY$Sh@_5ntoBi-na88r@}GH^@tTsqr<d?6@c7}=||8J4V+&$@#+b;
z=OP_0afzBdOrqaQ?|d1?D3Pg@U=+ZAQ=pW&A=s(Umz9!z33i2!9EnW6sl*gc3t~Y7
zVDyX1e^iK6fZL~tt#Vs@^TL+ySS!i{)t70$iVnBFsYvgFaQl+vy)oC~+3zYTaR7{I
zNCMjCmqd~X8bp_Y@_=+WamN+P66MWDD3heykV$NApj8MaMN7J|l+>cZd4wB(km`%k
zp&GHxiO;e1v)@`IQMU(F4(wy41egr2@uU}#R?)0HWdc9dos0V<9C9Xfcwxb$P9p?j
z1-CP<_#^ng2=54@;|^XeDkuC-Bz}kIfmpSg05b?I>C)4}CW+)_Qbch6E0P!k`;f6N
z@O4Cx!+?dltCbhY2=OrNc3WJ3(?;?p<bR6=cV&dYh#+^C!sL+S6Tf^xD?yi%fGQ;Q
z#9s1_+>GxkDf}&hut1t!ty<YCW|>x}0n7?)2`n(qNuRJxo`(XjLO*K(;w`H3J0Kol
zLcn)rz-JbGn#O&>)&y*&9{U~$Nx;hn?f`PRX0_#QEUHzqTBe9NkzB}s<YXCrRcU5X
z95j^0vX$Cunk1&&+2KTbvU+QR0Q}0;oPI?@!>`t;E8&2N7A(2o4*=(qLK8>t2O&kk
zgZG?|fL-v<f82%}W$AZ+41a9(c7s>1F3zn}c<NHPYt~(J^b@))vC9C6J@vg80$yys
zyVLw(zxn&Gnr9*Ov4{A7P#1XB>i*bz)$8s0ov8aG{P=V`*c$<@2?s2WDwMuu2(5C}
zNHrWLouqrv3yCThgULI&PMPF`WSH;*XeGi%gku#X01wVQWWz1Ct6&Q5!&ol-H*gWF
zONf0Nbv*&_P`BVntfI&m{v-qV2k!fEUce88bWF^W3jPc!4F<!1Q}q|wQTSaIaaJZo
zqyX7F&abc%wE7K)JU~fPz`vfg?T?((Y_3U8XE}(_IHdCp>^*%m`<kt4MZ~wJOs(s<
zX+8=Iuu^VubfnXq;>H~V3tN%6`Dj*F`9ypJ!7<=foTLCG7qbf#9g|u$pG@<T59l{i
zN2%b;_m}pa@>Vl{H~)E3_+V~dL@m<G6+8=Ub@f{k&N{k7G+`jR*cTEow30x{i6td0
zNN`+~m6X{XVbg7)NNopi#Q{cCm+@;=<|MfQL^!fgGPDm=cvU066o>yEd_eh7@Ef8e
zK_br_J@x~X{_<>R=c(_>s^hq9#A(6f!A;|W^Q>WHWrGHPR6$8!V;YZmt8oM*HuTaE
zH3iD_gT@3v8;Zpl6z}r}>=FEr^xd?`VW%c#3n(#8_9IGf-nz&KH;V;~;zfqL*{E`>
z-xi>b8|(;D(>xx?4jY0TZJd9BwGYo5FtGR%;00S~HSPkjf0NG|P-cXeY~F|mgT^@!
zn7n|pnQY~MlM)&bl4EG1ibow7U23WHy;$6}bPzXZ(NIxH7ckOZ4~bTJ4N&|R@B_-A
z0C8kUxUgrHlBUnU=k!ZM6)K#_kf$w__(<+tLm8?0k>J2k<z~UBUdFdGUfjSv%8?Jh
zgIWL}K3cEyB=Z3)1cr>_rppR-n@F|1XKsApt%`kr9v7tLr~3f4?X1e2J0{DFIPC{c
z2o$eK-#)5^TSk(eRTiu-o})l}{sUjVwo1yWvelex!aD%^x+A*AGa+~Os}7DK#K8ta
zF$JevUMfJTC$Mm$8X_6X%#3R!BMb}hZq&vNZDp0Bknopr{|##Oqm|TvZEbOPivw$%
zwas^bq=!#z4hAP6#!m)rYW#{=j@`X^LsjE7%k`R8>n+PP@d6aIwATW>hP*QT&V+Cu
z8gR_eFcD}Wq(lm1Az+yXNn<ru7}9TNCm}epuZm0zBA`Aqp@0V(dVr>Rc0mNedAIA$
z61+(PRP&L?x?cCXDL#6v0l%mDG{59U&+GMnAX8tm>Ian<AF>FtEqI~QAIip`nAx)g
z*CaY1(e*Koi)<Vu{2)NAKbQzmis$sthxrURWDgZa9&5l_HGt7C5#4Rit7T)F&VZOW
z2N2m`s-wn<W2h<zmuIWQW@D|%9gsowV~lv4#M)AKjG_iY47@TnLvu39sqYh3B}Pds
z42M_7(yFp7fsBzHZWordOm~vXkvF(n!7AwV2^J(CYXBY#*UC$zs;ILqlP&fy0Wy<a
z_Ah_i4o!y~+?tVFqpFD_P!}UL{95vmb~4~YLqM4;^^*^)zjY8|6RY)egkF?9YR!$!
ze9qUdE*kLoYgP+b<x(-tu5HdOO_ANCyC*T4xmfMc?v!?8t2MC7h5~wYHm<&KHDb5I
z@M{Uf&x;z6zIL|S$Ys`SiN;bWOCXHhEqZ?u5^6UoN7Z9tv$<Zg>EX&0(c1zQ=u8$w
z(TJ98BXVD^k^!oyQ8of$Ef>KUS$R~*)5}Zik=ZNs+?gDA?Z9Mp%N~NpwyuCWTx+v4
zJVSP`ZwtqyM=^JM#BKHhzY82^5BNytZ67qZKZ6rh<&W|!UL3_Gw{cs(PPq<9Q8s^V
zX-u+?5+sxPL|lyMo+yLRC&HMo&xKK+_zuSh9ZDrbWwEN6!;qqGPzin#;<ML@?a>%F
zN@(X%n6PyK30sA>gut>F;skr0d$><1X%Fw?FEX52TCDzkt&x}^PE9K0l3^66o(&Tv
z12XeyQBG?xL+NppESX0MO#)BvmKuLlz^cH3XTGI4WMg5N#3f%_jB@O8P{M8F5H-v=
zM1_sx5XHqfmffu9+h_ZpyKEO)>$qjvO?ye^0Wx%w;2=_32DrI!tgNZ@V$l`r<MnL&
zYe2-c!qg6yreV6J+iS*9NQ(rC;r$yn1n?SuQ5oSoHA#jFtHa$;{cyFqlplY(lb*)?
zq`FyIjItjimSJ&J)@G+Fu(Y0~>hz<yvmYL?S(J8W$eYO=_WQpI_73(jYZ{3Rl)&70
zY#-A3=WHNTh3p3i$G%wbfQ=&6F>4SY0A8MW>`FB=D`Ih!4}K-vda#o94}K+b#*x>b
zT_pYH1%C$z-QREh9&7Bk_VIt8&sgIi@Y;!T?$~s?=6VoMX{_OZnWA@bQfR$2U6$uo
zy1D?ukzH7h56fS<<>7XKzV1oD4#!J&+xeZ#1q%C24=y~XmG`&jvt@9;sXiVgUHibQ
zE%wca6@l9(U$Z98N&ov<lLsHWCN?g4->f!Nb{1swa#~1-P>qqvIgNiR2NRPLNhCfO
zD+f0X4Hs{mY!GG&w{FY^3cgS(ghbzzrSOkYwaA*x23pyQl}-uNsFetxOVZ>n8ImR+
z*pUqhc1PB3n2z)+%Z^|ruK-!)S1rk&TUMaBaQSGI@;li8NQHhp;7Dnm>cuRLk07sG
zmulAWGAWab1c>>YlL~)saI`R_B*03Yf&+(FR(G;wLQr?FK$*Is&e}rrh_g=+g`<pO
zWs^4{45^%{gILg6TN+wfr{LUxg_JUFvG|}$v<V+s2lhzSSRFEeVHSkBk2cm$&gPOz
z%u5Bv$$(2fIjXl{^U%IDJgm2>DQBU5D<#406oO?!D!QK55@LVPBNBa6Be6eE%6rhG
zNK5&^fS8nv2Vvc+qzLNXoZ5{Kz!D{C?Xu&SYO+UC01g;oC5>FoR#KH%DF_qObR4Df
zS3goCLTlx2T3c0=S^Mc~@6eS{dI#`>Od<U444IpmWSoSN2l{YmHbMFwtaMRNSG}<Q
zvK^y{RM>2!LY9BCm9{pnvNWwsmqIvVc_(H@$!nYMi<77oyY9d`RXEHX!mx(66jm(=
zFC}Qe!*Ye}N{#Ha0P?*cCG;qMz-$|cEO7WaJFD27mDpLq91adEeMd(Uvy}DQcahee
zOP#?yj&OzrAZ{^5^kSnVw8IwwALck)EQ@|Rl!=Hw9^!v>R4Vm1Ruq0bOZ$?$YcrON
zte2x)9>F8=M>w=1St!k10+s-@BbtF;SwYH3;M%Z19}lbJVpFyB02~iSXPpr^+N;UY
z+&<D}*zGarjF-Wj?jEO<I9?^JfY`hcreiUfq)%E?O9|)JWEo?I9EE&Lm}rIhlF1dS
zl!^zIL2ZB267AJ+dDh)T+G)^HfR)jc+2jHi5xD!Kd@=>zd~kxSIUc!HO3Lu#to7+0
zGLlC9S_<{+r$`&eAJ{BXb064dyA<&4-#X-2&3R?Sc3Xj2MFn3dt|Fk@ymp9hbv**a
zr2s`+1heKqi@jszF4{e#4$>9c&TK0tZuGlCwX1*dQr1?MR_L^13hf^B5Py+y0Lc--
zBJJ!X<&*dc-ekHy*+@YN&B@3bf_G9D{Do5A``!KK@Ar0tNx4U~in00b9`u&RttV1!
z*3M4XtMVx-(v#5`<@G5aR)+gx-bG$j`NZaAYjgRm7j(LSNb9LRBW?~0lDgk_#O?PS
zQICJLX@E-$)q3|kmG~KQ@z<>UmzJ!_C%r5bN4pK9qaC<vnkzEX7_3p#ypu?6U^FmU
zbeKu|l=}!;(@X#l>LI1m!MuPUa@-{Izps3WV^^W@P&QvVUTuUDZ*iTI9b;Rj`xk{!
zFy1F?E$qg!{<0z`K=-dL4HGKEm5U{U($0U*lLF=J%CrYi6?H>S8Z{7~S~u^D_M=Mq
zTu7KhU6P^?FwB5l5wz@w!}X|guHUhy&ym!bmsbgbE6p3NG~mE#4}SF>edW)Wil$SE
z=$4-W)D)KFp$}(0^@7e1xI`gp_vZb$<Q@t2yzo1cv<2;pg2!*#lq1BL;n%A<B!7SQ
z!f)5qA=MKfc%djb=KVML^}Uif$->h7GCa$ibW2$JoiQ8d+F!Vc2TAS)+|u_6o5IKm
zIU$m&fJv4KmDi8alm+ELMjEcgjA(a31C36&s*WhC3QZ0=NQfM=#UN{1XKYmPBER+m
zfy3e6egMc}gvNx(7|20|TXnUQF$90!GGp4=+3E^QA)1zjSFFZ_6)f)OiYm(tywWa^
zFa_X`<@5q;Zd+TGJ)wB?MA&wEC&!PDk50Yd8?hPM-G}Q{SHxvoPf%|~2lYtSj(%HM
zksoHTF?Z1A{0L!*my%qpC;Jkz>*<kH<(byMUfVido-2)u)RneHawOF!mMwp-7ME&p
zWnZZ@D=>h{oZCCcwhkQeCX6K!8&p?Yz&84mi~s_53!wL<>ci?pr_F0xiz?WPGMuQR
zi*QHym8lFU0#!id{g2qfw#t($DK2HaB($xB;EB+9WEbd-wqv@KPf66^*qF@G6<=Tk
z@}HBdP)HcG@#qh(a>UVm7&3pV>A$){4T-dC$)Mbe=~R`onj2+~4h%rmav3|Z+?cxu
z%sU|Swi#Nvk#*Y*2ZCzLK6E_jZ0(2Ledg_>kz5St01FS%sxHetcayR3LC8B>TRe3A
z%O{!Du{TIcG$BIkJB29GQt$07Ddf+1kZ0))_B7>WcBjxQ^Ws^R5A%Qi3`xJF;uGPB
z!n_Hf)nrN*dsz<4oWPBVAHe<QS3?+0*)KRXMk&+y2BkleG!zDa6SpFCG$j$VhpNpY
zPqE81Cvs>q6QjWbrLdw!>j;6}abzU`3{B;d7o`|DI@^dsL^);oB*&mg4((*^BpesL
zW?Nk^E|R!OIw#Q@ewu&PqfdT4je*3{-+I+H^iU=1-1^mJDv^hEx9a#toqA4qnXRCO
zEYX)b(8rot{($C#b;E%I+Tuqn_?K==Zlcqkq)FBnGfHxP4Mct)$OrbNU|rEa4wIFt
z4-T3vyk@>SX|AjgYj{eV600~F^7_jh`w23X3Jc-r3}=rpBOHIJZY9sEwV7y(ZTU&c
zqmQI!wnisP;cOz(cqWn7c><$u>rI7oxKfXj2)2!!ccGY}4C6>y%u(*zOI_PG9%}|6
z)}}s)wvdFIP8mrHYHD!Q^^zvkQu${-`jmzo%fhWo9;PV2fq#po+IS4Afo>hPoD9j(
zG=d>XM#xVqGC6-p$jS!qdm%-uMcV>?Z&puBgLWT)E$^sCLj0ToeS_aA3^=b>L8Q%U
zX_+ugG~v1C-=O@#GTE~II3)0JW8Ki9_NFo58^7Kil0BA95up~}C7w|59HO71%j^uf
zv~K$vrC?XCeQT0vV)Y8Q@M|E;zYeI>K03P8PxRO5`uKmf@OHY*JOkxDZj1+C7;0NY
zBYBFu3U+Lnl3{P}S3Z8))&q&LgZ!GNbdot<S!H5dM_9zEIi2Ln5mwqjVoi*I&Ji8~
z+|1BF$#AZQ9n@XL7ILqfmYigPYXR4@LNu(nR#&c5weX0>jT5fXb!Y0M8kRy%m`tO!
z<f>3XyV`%^@T?lX2oEZB5I6oEr8Mo2m*i6LqJlGJ9LE!?Q$~lmaHJv&D(Og7Zg8Y3
zR~@NJ%aN)i8%V&<Od7J5M0N?Oo$ZrC@=;|HvuUovkKovahg8DDaaMD^?<cpp-XCY{
zT<<sSU$(k`2{~1gCr%Yed$qML@;K&M5@7=k6^Vb*!1z}bzNI0fGMe;nM7j*msFPpF
z;_;P9I|Yo21Pm%Vyw6()zt;kiahSpy-^qY&$ftLam_aO~0&kV!S;2sMtL^~#bS$l6
zluot`zpR*~{zTBl6A>8_h3;t~r0ybgm(%2zfZn0AH95~KMD@?b+>`3&81P-j!+yc?
zOy7UK&qcJZaJ#ZoOX7XPXBF$GIj~mMT^(5H2Zo_X?ve=hD9xe4dkhIuJLSuQ#e)I5
zGAOgtFwZdQ0pK5<RAx-aOc3?1I2JlVs`WHSRYjPfrUaJJ%xYXPfM_$)@GD+-Iy22;
zf8m<~*Fml~^m`30@M463b`3BY=FotkZV-R;!Yo1QGcc7j@vzTfddI0+r~6zj2~ID(
z#__>jlHZ(S<h|6Ik_ZD~M5AFz`ym+0@Pe}m&WYd6C*cv(PO9MvKr>*?5y0|A#!$CY
zRq*>dgN`n802UtJWR^1>MMj~{Uo-UDI89)avWfv+HcYNz#GK3D;ZebaMQ>Onu!w)7
zq#vFl@D#AliB#)6KxaPOi-+<DZNs~QVc&zWO4v4v+rqaMyF$Tf_yB*TZ^E~X($j<y
zjw+KS8}ewDSo)~M<ss#%2i5~7LV*cTCe4-gDDzB^u_W4WCtqmXl<e*XS-0pWy&k$%
zs$0L4M2A~jSvPSx#a^h=dqT#k@%DcZmhBx!VHun1#7&Wu*b!HLd(%Y3Il?dYedN#z
zuubTRcL%vTBviZN0!IhYp2x-sW?J-#jIP4^RXu~eL_Ky)&2e-2uh2H^Y|YrKTnK{L
zoeb-rsSyY4X{N^~<E#8b);s{xjYcp|$mbCI^Pa>{&`GJgkL-figx{XGOEiDf12p(%
z2m3ff&PFsTxv$l_ebu3AV2b1gCqg-)V=AEUNfM0`a<*vo$8m9|^7jLmiQnZq6imQQ
zGqn#~I3D_VRdONThYcBuAd27d_zimHPRTdqF?*>TZ;>@FkdF=6KzrkQP_*%e-!ycl
z0o+TQAmPMPC8fa8WFBp?83dQ@1pyHniDO_qYt#7M&0+yWksW^In)(E?pRfY7^9Yw1
z1_3WPql^smOvITZpdn$kRd`qS7>GMEQ5EqJ=9op}dw_F&98Gz5YQ-a4n!rq1D;Y!=
zaLQTMB8kLvmwyHUHv+!Um$(K2J_$#b&TXrLv+}r?{{{gm9%D4=PRL;WF>E;PgZ3kT
zY{BhmLGDQ_N&Z}Vm_KHhMh5{k0ppi^2LT`f_m`aq0XKh33Vcl1N+k_2x}vSa5dbdQ
zgiZaJssJ2bSS$2W6_N2Y`eOB+{ZB?CwCq}wsKH`pz=GgG0S9cV2qy=mt_pIT;LlT0
z90Puvc69{y&YCn>dy2{0j`eQ!1yVguBA{rzvopGM&(0Wz<x9%vd<egi^4l3+Fi&(C
z-}Qk5QK^3dTrJ%}+UHPw3UPz5PVS>p^-dB!M$Gw?{-O}!O%|OdcCZQj(ul!?f%g>R
zCZBFnG^4mSE`dN6Up>bqlf?h}S|Ba*T&d%)MQBDl0x>HiX`d*95PwlpAmT@U!919*
z$8ypPDC@!kS{IEPCKy%!i$y}g5Ied6Eyy)maiM>5wCf@6K*2JJnaN}X{?0P>O9Wy0
zfVm+4ZPzA*fyphu2QxUjt%{{9Du4~3_!^F1r|w0fAQYbAfmVPa?j}$9bJ88-77(I+
z$Bk1LfZGf(M-HDp?^K<KNq9F4tIoS5ya!A*o+@MgP_z~L`yS)|Q%LBYopNXAi2H9c
zW_*`X2>}&<6A|+_3Buz9-3n1mxmcK8$LRk-Ck`)B?$_BW7mKYKRg^Jb!Z<vp=*PVC
zCHZ?zupkC5z~l8Oi5@tx{UD(wUtMjD@?|)#ZqZXShSj_FDG21XUj}UJdqRenBAVsa
zWo5b7Hk8&lVZc(TH4qiho)_jT%y5d}i%f!gc*IGU<p}{A0fm+d0arJ%O+`~7MQSs;
zsnpdJzQngV+-R^e?8h@9&k64&B*cD{Fn7A)lLP|-hi_o@Ma}Rr@S)qX+EbT~3IR1d
zT^W`7ckgq_#>BrJ<3-z<Ai)E-;+d89WhT-_B2o;yLyV<$$n7wD+&XwqRp1Q3cLkk5
zvO5+iNn`bEm;VX@905a@918(G0k)S~3jsBManA|q`iwXmE{3nzb9I3$hi6p3;ef;%
zViZ6!vqJI~AD=*HAVNwUasZ=4UCZ}ZYP2e`?`jcc7mRkcK+!203g1C?UwQ=;Dz-KZ
zEbrVGNE{Z)=L(Rl5`n(W604f#71fz$IU?7phFlSJ9pp+y-D$iw9H3bsG5U-~U(o1(
zE5-d}X06%@jvo0AYxGVDHF}s*r!dJX)G^Rb7W-&W^<C-bMR=MkJe_0sM&q(-^MPvE
zXzY!k0ALDCa72`MN3w4OhbpqVkhT%iVnRGt@`ez+jOteYaf6*ca9xUR>PL+#7uw7+
z$~7>@;wny~3XeIL$6S#_2<Wj3<rbTN)Mqmi|I5>!0x8arJED+o)@4}_$#0W?mYa)n
z)^kNE3^2GMzA}M?m(*JTGlrisp1c@c4$Mi34^Ln@G(X4C+N>WX_`DQ##AZ>3ldRlH
z(rM1ENv54ag}2@u<+o}_rDyFF6$U&UETeu)WNXiYPQ6Gd6XH&H=1;r(Js1Ih{5|Le
zJ>X%cfhxCT-P%lgMy)|7!;Vw<rFCuF3kf@KuqJfYIX9OVe#5<mA$!~Ijki6YARVx@
z?mP_2c<T)(AzK?5aB0SiM+2>D#E{Ktc9<Y>321ec2p5iVX-T7l2gS_&k;oO#3WTSm
zjR>C!jrn#aul4YCMh5>y_&j5O5;Q|N3vfH4ybaFZral=K+5h|L8Jo>+>G{@fMYedr
zL#wyA#8p-UIH)guLZf5^jvt6*mD>S+%Y6ytNFhavMVt}ui?u3l8}a`i2fZH{rkc(?
z6UMUmL*WWmKU~iHB=}BE^aNwS3xHvnNuX6>l~V%P{K6@L_VlbvF7T{>AdN=%dBWZ%
z?0&-TCB5ji!!^ClTvEOQZtGqW-cJDazD>gCiK68N%Mu-~<5)Xe=&`=asCKMmWKTQp
zOBci)C2$)j81ky<V0=1?z)z9fB~cCoR43<4D@g!|<<+ls^M-F1PKAZAS*(;w2Do62
z;h$!T@-Y}l&8mS>ZyG9pGDqVguf`Mw7ADe&vw>C`H>8rcq=#;xKp9VfWG873G=cMn
zo7L-hjks(OOkkjL*0>rc{V_!#15g@>sA4#hq^x+>2S8~x?$EtDNQOg>&RGfI!)(;J
z;MEldKYQ<BFv^)wE@2Ve5gp35UcQkG8`Hcb*Ui?sRO#Q#97V|uyTtjt>*hXma?QrP
zAeR*n0VEep8;Hw<ecLkJQPJoZGJrLeVz;C`zJ`}j4*?l}Ashn0K1<kLIB$-7g=NUu
z5asrP_XMzpwX|I)G9#%L0(oN4bkr>eS_!)#6k$B$3*MN-1GBprV^8vlaHXCD%OTAG
z#d*Y+Ix1%tLa}4yONvTMEE##OvU5##)9MnVMUHi~>OzPvUj5+=i+l!%z>@As3Oxp@
z%2IH-OMPvBhK&!^Sf+#4o@{OT&aMne{T3`weNU;rJrVj4NPI|CF&=?{jt*1#LPshX
z8OXj8dFTu1S`btwpe==Dl`bJN3OBm1#?gbySj?qrsyT)NPa`Btmly*-qX)#WFH*Au
z&zp#WQP52o6g@6QNkyJllyuE?5+9b7BrH4e6NSxx*Eh=H!=zwv^lx#Ol-q~N3as0J
zis-n%YScO&U8ZUxIu&X>m4ed{kK*09PjEc6q5cLR;(*c7Uw{<0yGuVUlYG}a$PR@^
zeI<hupN12^x>av&@VoC5%dQ{Fsr7)L=Fv(~-^xNk@Iw*23Kkawp5o4{ovuXiUHJ-_
zan_-KnBm*=qI2HFc>UrP3bk@C6SA_ZnDq=P%`ihwBJbp?>#P?(%q+JbXb#(jCd;L4
z*Cd>i3DXt#rJ7sK6FpVLFKMnja01`F)JDa|qBt3t1+bUKtZc)iDBYfK1vyfA_|$~}
zc-zC2vX&@2gcZf;uqasy*o(~f?nyiJq4QUN<UPYni7d;fE5ED>z0i05sgKVf9zONY
zzt3lg4L_;qs_SlJoVs2EA6m#~81TI)W$1bl9u)6F4+D{UGMHUs3|DQ~7+2M_4EOd#
zpvl+x4DIEfC{gZ-_gL_K;S=8ucT0%E#5O{UTB(St$GtWYu@md140QTYF4CAXGiYOf
zicaLfq0N>k07EvZS~jA_*%|pbjPrEBi}OHeDP!fmFW*#{JEg)Isw(;sI;atYyx}d)
zE!seuopINp!;Xed<QesdNEO(Zmb`hT-Qz4Wb@Ae0Q#%2WJsU*Q_}EbGs6-?2>nNB{
z;h*KQ_To)x6-cQ7Tsi(g_z7a<DHTtDnD)WMo2tD#V@|XP>#Tj3T%#bgXsP%F7Oq0~
z(Wkz5-Bdjg(MIGHT(|&c6ni#qe4)x8VyIS6y~~nB-(@185ycO!Fm8snoI*9-nuxnj
z6i$3lqaKwr;;bG)4DSp*#HJoQaR~YCWr?X4C8=lNM}WE*P^e?&BH*Msf$VaBlm$|{
z0ti256iT6mmWL?jjz_VuAYtnQE2s7gEq*FuJEQ40?reg54FEIOaoWj8AGfY=xhldA
zPcg7n&`GUO22h~nuwufg87c;$T`8V^NF9=^$SBA7*oUY^8%57~N*`$8GwJCJc2Bvr
z=Jn?(m-Ox|b9VRHOl+uSUQh6UVw!b|vlx8_kTs_4Tt)LE^LGlQZiQzNCRP%%kleYn
z(dT!T7pfTZhLE6K7yy5jSWmrF7!lcdN5eWFT=a<HjT@yh=ahK%T+s>NstB&_Z!;N8
zKdPNv>#&Mo^iEhTd`w41PjO!S47s!D>Rwt?*SV^66X9wyE;yhV6&n42+l(-dK<*xH
z_-4$%6ya#at5C2>)&^Wx=0cWUHh?8k46~f#MKDKX?+aiDyxxbOGa|Dsw>WQ*lV!hO
zMc*V8!8u!X;HB&zR<o!0iWh2}F^oV<eu=2yP9sy;a#c!xt&|dOvs5UF#D`lz0hcVI
zK5K=f4Xb+EH;uAxW+JYCne5#IAl<wqBd4?GRg8h?`_UT?=tJ6vPJo&~8K=_Au4IIt
z{c69RM>iQ9+<vgEt*f%E-7pf9{dYH#YdI2Q<z}O|OSN`+6hk>*BSD#WSKYxR_g>bv
z8Zq(O+N&sfUG<z6eWf}P5Q)S=?iElm;r9->!)_?P!r%(1<8nfO?v=>^SK5IL=Jv%+
zl+?a_>lxZnKkbMoDncZ0<-;LdeBUL5YW&3k*+NpneU1?szBo`%e3U2S{3?^xa89es
zM+jrh@`>KjzEsqt30FC(y}!<c#=BN2%ke2F$XDf))eBUt9+S^X-?F}z3$82TFz&Ay
z9JJ-xZnJL5-_>nM_KoEkyH)p#+S%C>p*I}&%-nWqZ2)zD=K5K7@QH^Hh;^!qbkAOu
zy*=hNHwQqioKD~H8^BQL(h9$3(@k!kUpvmXM7~{Dm!%Z}PJeIkeb8>c2ImDU*zU9N
z;JsMY>C$BW?p>NVPl#*GJES{1-(ye)*mUa=tqdzGNy33PS%3|%iqtYCi^)HE!s$hn
z{sf(c%h{AdmzvGY+%?xWKAFAYiBpJe`H39k;r`A}qDq$0p-(b3>P$QWEPJHOI1*z4
zin4o-f`Nzp=6@U}Vy3HFg~ABQ;)#^SV&f9nGL%d{9I&M<y}P|OkLc*ihpOhdJfZUN
z_E?$5<v8^A;MWvRWr!!6eqF=`eZVY2xqQ6rhaUVBqXRn7cV1i+`Bf86BExg3zQq~E
zz&R>K1ks_8Ix0!V*MVh8a_FGt;X5poIE3wC{Ov4;F@HuLn<Uw+3;{#1830@XyfHBP
zfOyR7VJMU0PM9(2uqOpj<dXoHUdIqxY6DDk_cY>w_p+cX4`bP40PaMy6^x0zdz@F+
zB|mfr&Ir(>aoci<mR=*Bm~u&Sv??tK*ZELu2NLw6UDptx)HO}Tik26ol4fQG`l%~_
z1pGxb3MJUf44C%LfF#O6I9LL)G?1l7?b5%B4oA@y6&nSe5y^%J(82AOl@|e10e+Y1
z7XdW^J(nLC0UHY2L{ZU{iO`N8AeTfK0Y86YiXk@W#0;zeM(ZHodU<RQAz*+nZmxtk
zLJnD+2#O>nV>_`ypkoErYbe=+TrGU5(1y5KmcV^5Q;emSDG23~ibM-EH-Hd{z<40(
z@cJyJaL+Kz7Z$^;oQg~wKii+&daDZ;LcG<r5+uXQ5YBTeB|9o5%oL+R3)J2a#tDCt
z-7`}J`Ym{TIb1t+nf1zuDTI>`Y;)zi-2jfZN~$<dSoDOi6h*5tJB8^_8SA8D#r8^q
zP7xL=NKZEbCbX~#lp;rQRv@2%)$8RpXvKE=D4cNHDp>J>bayHk%TpCD2ruPCUzmxQ
z?_!a(kUUq5d_`}BZd$^>yM9i%=;wc9TC6n{v;~kDy^4Ejbyl{rzS*$*#VQ1>UEwP<
zYu~UcC%m4AFJ2?W$)~UB!A6Trys};j<sEYVyqD%N*%#XopCC)zshmg}`7Pm=lKf+t
z%9pmH@iu>0lhz{EeGTzLG=QChq+K88^+srAS5+oQ@@A+9=;B;e#A_g6rI3F{o_DwB
zm?Z*pEPLl9P!#Vet`{dNhi(!mTJb*=g@&$=Vv7Kc;roP3w2%qS&p>KPuB(sIR9SCd
zqJF9^rKt%SD``>+n>`ZBjVPCqhN-`CHA(*-`b#pn!tb9xeiY?wRRYXjqs)4}bXO1V
zEAD>{yd!W4-&eFv<d;s{Bm{ry<VO772TaV1nu(cJt_k~csq|@;k|P3@949E@y+hVW
zKDxG1XptEO4VDCMs>9hVmH!~HB--~U&#Cf9hIQJMuEICjzMe?(Qx~}m<V`A_Rhpx)
zX^x^sbEHIbSoB53QVLFoM?r1o?-1JW_E>$$6MW?;7vB3E4QUEg)Omk*owTOhNwu`*
z^;M1L4xq?279mLRY=~D>zsf8MC(kX*1=#On-2foR+{GPaB%*PLFd12M&|D1)8tLT5
zny4+F@bbKlH(z>T)z(jHe}|9cX%!|U^b<cpa1eLlcY@9punOF3+s`#<EEc&iydj<y
z*XKJF<Y<odD|{jRK01F{NkB{JG5VlgQUIcz9c*0u4wUu=$#sgOp>pLXFuwA6xVk-r
zj{2(1A~r>ZWz{<EC@_ajq5a1fcBCTJp+-yVifY{N#1;8e*SN~{ZQ<Kxc%_IZaX(O4
zU}45PB8aM(M}9vUa0Q&=E3$)!uX`(tOrJ!6zAVT1d(Hzo6V!j=#VB>?SRc|OL9Djy
z3<c+=Yy4W<wJm>BX>tSzeKdqM(Jj@ZT%oEX3arjT@CoKYiMh2F3TH?uKRVL0(kX@M
zE2Z{H`G)Twm_TaemylOzjWO*2e!-^~*wnmP^+C^S*deh#qylX9l%Yj>IPJuuPc-0Q
zGYW0ui}y2d5L;BUogH)#?~{Lyy`2+2NC@oUDCkB|(KAI$kSR8G5YST$h)L)<=i6><
z*MLGmWQz11%Ly`*76q3?6()YJ;xZEC4mj{j0)$b}jox?|gn<&$JbyEn&l~}F8q-r7
zIE=nQO7Vt`5f2ys8M)hQ7&;5c1m^CSU>yN1QWx4ke7w6Wmik5vs_c$?YFtBiT*D6?
z*Kqx~Zme<L1WO@mgB2V^B=LcNu2hsaGthL+KvNiFd!|(xHzHX5&d$iR9i@uDhArM2
znMsW06JigS-yH!We*qi!Ow@@Xut{Ul;8|o<IY4y^yEI9|=7C6TI}Kj~646EA`wR}5
z?C6YL_N4USN-aYBL3FcpXEs_hvk@+4+`Z``XbY?ZBwj5+AM&SwcPLLCbovspIOXBS
zgj&CYdcWNpHta<MT-37&E5P*Q?y$!$-eXTAuewV#i1~y7EwAB)NUEck5~><7Xx*Rz
z$x?as3E;6IT039L2RkkTb|!ybVk%6sKPynq|6rG`9swbLm-q65;;Z@nt^wy^fUzK*
z^_#9=zo}S1y45u>ck&Pyw7oh)z%wg@qqA@s^~KuH@Xr&o1%ezQxnZu%>DXE$I(7_%
z<|Uj7?muD2=o$HB-9)3~%3LNo459Nx>79z5aq*Bc{O(0(WDg|wT`lqxW%%_PehND;
zc}rZ_w*(n~5+aNsrZQ&x+Es%!lBzM8l_Iqv7%K#x80C$91yodD_x2@*l9bK?1VJRF
zJCu-+lI~I(RHR`*Bm|@e83kzsq(e$VkS^&)x)Es@7~&i74SDtVU*F8SYq8eZ&yHvB
zeeN07ojnO8RCMC$C@ox`ebDht!?A?xZiS}2o}1qd*+GbjZ;1)+OEqqZ)C@gzyVa5<
zI-NSTQ(6Ag*c&}5rM0ak)|;(5i&=#y&AGst<K}B!qK%{PI*Yl`sVrKBi9p-?<!!-x
z29MAoUbyMF*ACQMG8F86NrbT}n4-zl`%m*&nrUM`);|{dBrYY_lNsXeZKp0^XHMHh
zYr+Te$kDLU>1aL%aD-M?gHkjtZGfK|B<l=1WC{N0QrhhTdX8gOmd{aTFpd2K*UBY)
zh9;)$v}mT))7GSoHf5rxd0NG$`u8V;%{=EI6E9md&BT@Xh0uC-#tJhG4$^X{596e<
z(B3sl#ob0jJ_mzx+uhN}Wp{if4lMDxKRmA~n%SsNNUruxVM<DLlqV4=y_eU~A*72B
zySDAMQQx_B!yLhiZ0$)y^o_|5i)(bp`a<@%F|oaCbx&_5=|WO7{FG#LjCEa;qDbq5
zA+5fIuEFhF7Aw1v+|Cbzz;@%_@}9%;iq{&~S0)cgiu(CE5UDr&6eGfKR$1bA@kQPu
zbhamSrqK;5*UnP6Z;~enGVgLKD=ty7&!A?-vmSIN!QV7}j`lvi(>(Mn_Thc+p`5TL
z(_4#)*m~NnwBDd7biL4xC*#lJp_2(a29PQ(U$LGa@|Dn)D6vN|rnM&bZD^Df7xgss
z83!R5ve^`C0#PxKyh)`)N+f6SR?2=7(lYqrez0laP`r69>Qu|_Idh8h^;NTa{<sa~
zTU|;2h;b>&cVA~>D~8$oyMkE)Zlw%>{2EXb^bV6t?wf`WTuiBvW~&i^MYE<SBP8w1
zQWopW$VL)oN?Nb>@#(bpPYXWcc;1&j8a5rCuVhN+Uyp3wkQh!SdLU3WXefB@>th?l
z^s#@|{WO@O1lqrr8hTpg>hivRgT8lK<*Vi367u1z7M<C$lF7DohR2&}dXCNSKTP<c
z^2{YL@7&||tViECGR0o-Vfi#;;?4`{>9;Xi2%z>XBtZKqZ`@eAfKgAF_$rgjzpX40
z<5)`VnsNS+4uM9FLJUa+Z@e@a)u+&Ia6QJmn6<$*-D|2_V+|}nWO{d8<;fqQdwWS4
zU@908dx)W*%?t}btt)kz*rVC_Pk+9X>K`N?&%@4R6)E41;^i53Ph?VFv*2@s@Ur9L
zZQ0-Gd2<tJg;AGU^z5i8K}$S=Z2wryHvB4c<84OL+&AeIIb%fQuBdmaUQSysQ?5Sr
zG*+j7HISirWD|ZI*Qq~G`pCoH+O8!p{xBE2Nb;%9_ONDuWW=6kMd{nAxNEv}Zu^s7
z#6!KXh&$gXf!xTa%9bD}qxvTv5Hg*4qfOWpr{5I4?k(GV?Smj~+ltBkJ1dp1$TYfd
zYB#Ai^+q)ZK3I)r>sFe3nqQ1o==De(@%Vr)?lT3@L6MUGptVzzYwyv=3XchYL~Tfu
zL{9YTPpj)(`vFu%`Q&||H_<DkiFF@IG%1H?p=!lu;(l&lKGC`Eez3Db&OJ#vi{{pC
z<$jZ3Xt&0UR*cnnz<oT!c4w9^8OI|`OY2nak>F>hKr1cq#`wEjH=*u8_G3B>T%A?c
z>JM0REbRb?SaOVw_*4u0II{B9$O2102KY0m#<#LSc{xuuSIMo`T+=R{u$u9MeVvw>
z;MY?FO@U81vaST7Dtaaa!sL+B1~jw}A_Z`@2`czw=c&Ctiq#i%DVh44q%j(gtBLq-
zbc)~bdcgE9uax_G_BimP7nfW_G(axsz|xd~BMg^jZW@~~sm#g$)gj94m^|7nhS0=V
z!%XwsI916t9BJV2weg;kgD`EEm2SRL08hmjuUU)ORz*M~@8}#)<b7$#ZBvIsQxoNb
z=XB!pE_cP}XL+Z@)F!-$j9g8Y#c|WJnlc}5X#{8D=f&K7V;kZxiIVL$(qrdQ&4ybc
z7mXr1rPe!RSh$!nc`e|n<SL^;WR0q;9sC4!t7=2J4{qfZT;?iyS}1{Cn-8w2F7#9g
z<2*2~J(mAkJvWrQfyOl|dfK$^BeT~){C1=Gdb67KM2^Ha(W14o)HE&njg}`?4)WaK
zh9r9@A>T4kDyHos)l^lPDgssKbm|BW^JYe2f|PN2#Zw(_tI&#sy-0Lit|&}J<#FmB
z%7#4`b&GrMwc)4pQ<Z;w<JeS3F^9jR#?dYrJUkyaSPy?-RQ{2fnr6*`h`k8Y*P+$k
z!aJ<j*AL5`<7atLbxF<B%5|l}WW(0hFmre`l)~|?G@(AMZFKV4T^o%`U0egJKA3{x
z7-T$oOb}Xvrq4b+J@e5^*N>~`{;vI$JaCNt?$#=*@G_;Gwoo_X_;htkPW;7uMuh+B
z-NFcNE8Y^?pvf)UTaCf0yVk~wKBpz&Bc4VA3@Eg+A>798HXXQ;?dxA-DZoW7a9;TN
zvq+oL5`Bk7)*8?A;Chc$D=cyL@MOANO-N_zaxv8sR&9oTD4*Vau>R2XppI<fx={^U
zitJm=h7>a*l{41MEF_a(8;UclZ{j@eR!F>aVEvr@gfm%to)B*J8LoQM13%f|XN70J
z*hy{AB<>TN_3>6~zUWMH_*RshqVqJ@JFm`Q%;OI<Hl0Lgw#oU-f^D{M^85YyXx~64
znbJr{t4YWCNd~z};bN0JB8?$7G0Ay&ljc5MIo5EZ^u}JT9_*>@Z5C_AZwKn$4Vty|
zqZ|#hr<U9^@5CxUXc=4Ax`1pAqVci#mogGV#4Fp6b!#=SZAJ6kB`tK)P&MD}SG9jT
zsl)y`uwl^SMNw_4X<1RYN<DHqxIzZ`>BSkCWa_X!6kWGLMsGyf>-><j)x5aCPb$o{
z$_mV{03OYLPPrgN({Gh(P@KcrB`~sqZy0Uh)2iZ8+>0Hmr?v#QHsRo&WM8XReWcjP
zTinx4g3_3d^&|gzQNOzS*WsmOA2TPf(6}{eYe)=QIrFUAF%6?&W}g_PY5i*mie`T<
zVX|JdC{=v-5YWZtLB$Ag=MFiS^U2W4`^~9x@L;q1A4%zT>a%XzD;#F!fnREtK4T7q
ze#kOvvUI*ZMjv1PqoG8d&q9YtB)1r|PiwiO9dwUB0;3z#VP}2Ms*2+r$DOAV_50T%
zTNFz}8};P<kYLGBWzYJS?o52ht|x_!t;~$JKH0Td&1?*t5LB_lHqZO&%IeBa!`g&4
zLR{dObz9Nb1#-vqkqhOUo@Q}(`@VZBRU6Nktz1JG7F<soNOA4>q2M;<qsvw)MNQ(2
z4yL|={fXAZlKhdp6U&5*YJelt>A2v+dMsYk5BZ`hG!9{O&(b}4dz@Hvh#tuPb5mQj
zUqm%)H7pkU<|NDw*M`7<hw!fYN4T0lUF*9*QV%=&Lcus$HYSv#jj@=eyG|G`vC4|O
z5?b~55{Payz6nSRdXlx*Eyx`pz2aS-*p^HI8X>YQlw(li{CVq`;L~^6?;RsSX1dIX
z8g{2R7Z1T^t0hpd0%Da-2*S5t1WRD$3hq&8-BogWyxh1>qn60AIh>lGsvuuAM8|$B
zA-5an_RVq}{=D1wFgrREL-)M1eF!pII-N=xZ_8EbDdJfdx0pwZ?5d0?@4>z@7%rJ<
z6zi_2lAxJtm|6&WiOp?)@`)?YlQ;3UAM$l0&7~jQe{GHV=(bY<mlK2zm%F6>hYU9g
zoW!7-AYdHPxA}5gh9&|eT*f&QnzLi?FGN@HNoaIR>E*1n2?ySk7W|2HfOMF^uv0W$
zr<=J)<kR)pB?Xh|8)vmCD%>xN#-yL^ENE-*z&Xeek2FDP^~vF_%rUxJN+-JP03}nx
zOY>wGC`yM3Mh$^ZZy02mU<F&;U)=1LLE$d?*4vmocCt;IAg6-P9qawq^$!?WO4oNE
zykMgoP2?id>~BoK-rIX`%mFG&`1-Oj^PGWEgj{|F*PE0wU_gn5u(l+^r}X~8GZ*f`
zPB8BtZu;RoKe1b(pO4_kwUi|x)Q$$Xbc(q{u|Oq$?Sed81>g%LaFRvR3i)df55BO9
zu6wP8!4lZ<?s1zq+?nVuW7bJUY22scU3K-+gw)IZ2o>+ebSNShA4P=Y)d{T_ZulIm
z&I~mCWZlE;zG*jCA?bGxOrR8PntO{<rq_f>R2VNO2nk}V&BaH3XU!?oHJJrR%!)RX
zfL?iov=PnT_0Ac9JalR&)fee!-up6Cm_beNU#jur^J`w*BQwhdtJuv)5By!vWQ%WO
zIBZkU<_<l2$hSMhXy);jPe&tx6@HLEUadZ+tZldHdvL2&Fu5Je{YB<-&lt7@X-g8y
zb6fEPg>}hSoKGR~ymh)M96cFUydQg~o8Dszsy-=KlVz9TFnMIokwShGsOd>(IP>$r
zXL0-lidgy(aa&oVuv0Hb@AR9Tb{pzDc0hrDzVFqJl2%5jNrSWP3w-(ymA1nUf(;nj
zD`0D(l!qmg0r$tmY`1Ed7kEjwsvQs{7OV#crP*v<?OXvzyD$%S6y!G>t?JRWP#nHw
zynSrhyp0RXW=CO#^mq@nA<BerGY3SRH^`3k`o&lWSok$8Ltt?@oJlFEaek3}sVEYk
z1`f+^;mN+@q1zQv8&X}}9i~!e6mcAM<HqbDo<F@UNss%3LeE#4j1*o|##Xv#V=!Xo
zzmGT--PqqOk&c-}{;)Z1oz+m{i#WJIh4C<9TdR;cg8zLHMAx~Wh+4<kh4l0s=i5l&
zLqre8e%Wi`sP-gClh|;@a$c2>r^F*Ruy8*Cg#vwh?D~lhfu+F{v8RWWidN0WC>{BA
zz<b47yWkWYBizBn%x66G{Mxab;xok8^_&xP$y0DV4XX_HRvILC1;R-Q3)IRTNj<w{
zk^eC_p^tj83X#GcZr3i};+^SePM58ws5#)A!6r*EE889er<mqMY|ezE<9!^S4`*cC
zR(a%Uc;_)s9Z>+ap=$Y9((N=E_9vkN89tK2x&t1QY%bB)D>Z^$hWg24EAq;<U|%eo
zJA@?TEo&XTvs5Dm@VXsk@RjUmUlnN|EU)+|&DoE}FhV9D1DWr-`vwrIu~nrvDA67(
zsnof1=LO=$EL%%<E7jHAYEIWr@k=jW0~hri9;$oSM+_<;JVFboE#6vFx-K()!>gS>
zIga#2OrIG<Vk7jO2+5t<p%PTHH@o|?v2|3IINq_HjX<`uT(=+IQz`9$@m9l~&QHPT
z-G%4PJ&^Meld}^TB=7bcLFQGjJpEAz;s8pIPCBSdw7bUPYer~9*Vbw+ot?<fMhy<H
zG!ER`>`6Z4TuyRxvYgcfM}V5#SMzH1K%?ObMHx`|knZ<>7q5Z(&l1z(SZ85FnV`D0
z*<sq{=qAoeNa?DT@it2BQW&GNi-V4u*|MxjGDOU$KaG`*sa;7G@SG<Cu}M32N`hN$
z3UWU6wv`8F(k}`VCL32QH+Z%we{t3s{@FqyOb!P$uwz{;XdVZ|eo4`&b7!b8cuW^L
zWC)mlfklG97qV3jzG`q};Sjr9clcwq{bOrQt$TbdTs17nsH>#5Ge9UYVm?4TJa8+B
z9I}|SQs2m(Z8@*Rfo)dUBH2Aa9ZnpAQr+H1j6XEBem#ZSZc#7370t}?%jYyB@6f!Y
zj!?R1!xi4s$9Kjl8Eozc37#oJheds<i{eL^6T`Cy(Mie>*kju%d0E`U0tQvpy;k?O
zw&>A54-A*p2W@(-lv^cu#Z_Zg!#@)i;6S)SYeMX?t#C$)HcwB$XNctU9mw%U@+o5a
z<Vf;#6>_vYeO7(G?{vPF+_>BW*$I|B?L7aPB?)hwJ{$WYBlY#v4^1}#?)`89PJ@w<
zDb<u|*5Zu6Vkg6z%eu0!X5sWHfJ|0&+j6{ozRWZB*fmb)!46C8NoNma`u^z)4TxsN
z3IlTlcOM~{n;I4CR1)uwi_*Q!X-Uq9B%SPYD?>ThuQ(0Q#9f^F>-?mF@IB7KD3KB-
zELZ=6QSsi*bW5e{9D+$pcoC6UcpWV~1*envb_93R+7i!><}>b5YTa-QY4z%*cJ?xU
z{;kh>3g0&5BRoaHKFhQ7*}jyOk`yG;J~E1IfBn^@;K|Jrt>~<;P#?~Ryd~NSJ>}XI
zj=+tnK-mQ)2;S3Xg}9YmORmh~9jvG)Rkrk0_4D_Q5X-G2nxXEX0k7wrighCLbGVOL
zyg?-SO;k53OH5`h$V#>sb9Z;^H3A<RjJN;rskQ2jV#WF15Lzd~Qv7nYdZ7qH8_=Do
zllCm|yGw|jXKz}GLN`hs@-y?-u{d({QtRP&&oRX*8Sa+zyv8Yu<Mo8paed`|P-Y>?
zVV~)D$06aCgsfG1njZ6v%B-@6ySuj$Q7cAoQs^`VhpCgqp$VQVIR(21B5%a!`F>8-
zcf_Z8x34-Jr=<0e&c!KK8(9AkBywe;t%TNGSllZ=kj)D`$th5M-A|+?TP`hMUYHRR
zg5PR-J$;Qiwkaw-)7(<jX;k&ta#4trTgX)TfaKIWehcL+UL&N1xJwo{VnO{5R;``t
z4D;p(2JH^ZJ1QQ;lASk6>R%JoQU<{j&FBqW)UXc^3T8Euf2c!f6(X0mAU#hpi|zTc
zirJ$TzdqP%2v8?deQ1((?BxK<gnv%z<ClA5tx`!*PiOh%G2va@qJ(9qLHeJon`Hsq
z&4PF`Z@4?v+9dN=-N)a(D$f2nU8hA0+3jxec<eK(z+UySr!M6ClqVw2vsMv9YCFVu
zy6(GD5Nna-jWVNaH$umhUW7r^O`sK<tl6)rMtaU$O-{POr^v5!K&=E{=XG_Ek*Zs)
zN5(A4#%$F3u()E?^(<`ivSMJK`lMISwaXUB9S)o$vLsJu3kAdRxLw$loPgmNa@c+F
zC<D8dtMbY1gY|<3+?_Gm_aFOC4tg$TEzUxwxT&;U1~iO}jLPm&dO_&T{b=tzAe&FI
zv$Ik;p06w+TP!@E|1!pntMy4Dyf!r3c{>Z+Tc3aGE?Q;Iq?bX8T){1}W)MBUAA4pN
z`yzlou{$7%2>5aqc0PccF4Jz@N8|jS=;YS4nxQKX;TXUz-4>0-@k&~$j?@{P&&t-m
zGt>t&^}K^~BjP3_sR(3#g?qpxRO<CH^<DC)0=e3LJ!~5T`AIG_W>mcN!a|xU^Vz%W
zdfxBCd#ekEB6-)uoNp`M^)!ljwSmJ74#T1xF;tc|dlpLnQni4QMLPdjYh!WmxFlqC
zE-~&in!=MQA&4|_u9C*fBAo`F#rIA8Ia&9rX}avN&w{(9kdHV+KJ7T2ttOwGte+nX
zo*#aJZ=9d?_#Tfyc1F&7z-LR4lhWyvUC3O0a6v{Ao%l?0Dbw-LnZ)GCP7txi0}ba5
zpJC+#i2&+}Z)t*T^jUuIg+#u5?ZE>3TD;~N3SAM`7zRQD_Go;~nD($5>q;@?NE6<u
z$2F>6KQRJ2rIMK-6L*UO3wO(ZM8D;u$1EjdN7*8xODHS=<rb2w9WI-<KoB}#rjiUO
zmzh3YNBG97_JxkTDB^o(yzqp_+KBXibDwROn^(+WUgbdhoBlViyApo{FeAbt54u{=
zn8C$*qw+^sw{aYpYNfFsE~AeoL3WY#vRVj1d^v@FIchzJz_ZSmxO|Z}$fE%WTnD+i
zN*+&qIkvcy6tb=2-x6h!g5|{ZLEF^qW(}3aLyw03gKH8q@auN^L39#(<0P}-z(nrx
z!*8{)ZkQF1ebSPX`%<6;p-zhfUcu14_5BGvE<#K{CZeKOvRdYQT+?12J154wd#jD}
zEGw!Tba+M($sJVh8frm8o%9Dvq%=q7CR<jjFU4dOZU8Kj0nMr}&&zOe9Xpw<NsWb?
zz4wQAgpxl5R5NbHJIOn}t`X`irS`^0%SFu@yKY!AfG^QjTgI8ruhbPhADn-W#7^D{
zz46<bO?yBLd4VE*5#niKl^}m@e<!i9EUqDK$`1xRNa}(#d#;F@TiXX=&(^83sMf<;
z>1fsF2@s1%iYA9yAGUZ%Sc73i9;yb}*NA++uf}v<mdv+iyiIk=w0i<JT4-Ld=5zbr
zNathi8@+jhPSx)zG)cHmlf-=y(Rhll^VxFM{Y5;=Akh)suyvePKjc|}G-CJ-w3v7@
zO=+n85kz(-Ve&wuVjq(_D^(eeQhTq)_oa5NX}FQ($+=fjr5js#pHmGC?~_B!_NUlg
z;Nw%mq(L@I5yzLGIXRzwS&A!~Vwr`3=fb4|j4cqV1kQX;@tAldgF)n$CR6M@`ZC0h
z+0P>|nPzQpHGRLQSc|G;OnLOViwEFQPw@?*4MIRT6aI%u=IaCNOVaB)uN5&l?NL$s
zC>mdeZJ7_E7houEYzjsN+QdQS@aGkC5|$(<$<YRwn|se1>XgYB7oFFQ(a#q{6VJ~!
zB0wb+5thxNr#kSUA0qFbXEaS=pe74D9c>8&g?FcwF&aEsOJL@gB~V7Uci^HF%{l2B
z%7)NsrGY<@XIZbA(_`Q-Hl)JkB6+&fH;<$=@lne7HzMxpcl+796K%(Cye>ESnfgsc
zrZ|NJBks<VXR_F<YB~>NI<P4Texi9Tfd@$Q@t<pKme#r!n`ybZ4u|@EKQ%WDGn4TB
zIKuj^d7iE-rlWv1X>2W#)(<7$EmbJ7Vhs5cjy}h_9WTHQi;)s+;GkWu9Od|Bf!vz=
zk<G{{Vvup~Qc7T7t>QgemjK@37zm8U9Fna#3V1PUZz6hqtjrJ{Zqp1o(+bI(jfqTX
zO^SKfJur<cW6D)6`>EfG?lE_XrnL$)(XUz*p7AQ9yB7^au<hT83R%et=&dtj5rm3{
ziGdb4(4S{*D>T<^(=7++;V3h>RPQZIai7ddqFjt$1o3NrThao6fNkLF_(j-}5Q+ru
z#jM5OXD(Kl2%{hf&|*RrU`F>*r2brQzK_y~ak(C*hNAYzdN7(g3i3ilUT76)>gcLM
zm$F)~(C_^rThZ_e-F5tOUBnV3_~-gNOOO%e<@%8iNcwX9(Qor1E6jaCZNywiU;i^o
z5{?Q0H~<IWVr}JM#pz+@V6XKM55T;L@^>WUbxgy9MsD1oO`lNK_Y-;Z_n4z@z6E%0
zHW9wB9k#nM&ZIP{QX_tU;yJxTzi0Nt^W=?b*M>ILPY-P0@Z=OVWW3O4Dc3TG$vChn
zq&s~K4fjFkw~a~xUa*@hO9$N54mbU{!=t81996iC`gN2vffV#CpJzPAg4$sWx>^6I
z1yV$66NaWmL<z&@DR+}5F%7>~2>)<0UgyTX8Jpgd((&SPcqC2a`vx%z)(l?$6L!(u
z-GKHuHU}@rDPe=gVO47xbm0c3B;wT9o^&m>GoNpe;|Gdh@9<#ZjL<mWJNJ^|4-!Ul
z=<URB9DAiaGRLYwx_pqexR@N*#D&kR0uXZYO5$@a#zeb5qxTG+Q!FA(F*!eUTF>dX
zQ=ADF^&KpaaF);oY*8j@&r102vwVNS?r2~W!0+oOs?wiedA(kLDVyeC<W(?YtF=Pb
z`#ajKjl)I&EaFqazCIuQ8(p#K9$2n$r0-<~o_4WQJVF70i`=Lwp`enWkzfHA?~5XX
zLqWd=fBri?FrHWtHQq%|af2&S53m5h1*R7ZV!4w23n6k$0QtJmk%L5l$?=eqRu0bg
zW-eCGxc-y%uz%IdrCRWX+E9X)8YXN2sAU8IVu1ca$>l4<-yTNy21I>n=%QdQuK&VJ
zPx!S}FaY2&@&CfkV35DU=r63n6qpY6&;Vc*>Frf(RkX0#Hz2A%%`sfy7)q;&o*;2A
zk)D!V@zRe0fX37R1t)ufqca*#{EEcM;sC()D>zf;-wARtd(3I=@>_dciTKh5r?(Re
zsYq1=NEgVjsEWJ=KtHn5{^|N<uPVbp)M#lO0JMhvFJxY-UgHw-?Lw**VF3WLE2<ZH
z0O&b4&7Z0-*_@u%QY=OXfJgWMKzaqoC<fzx3;GN0(%u~buDL2?`Dr7waFxxw(g3tt
z@-J*EUa(1Q8ZhJq0)Pjk|4V`0z2Dh1dum~A<7)NnpDF!swTiz3QKRZA!iZ8pBt(C$
z)BnmQB4yFa6ags5eez36elO?$ik%?En2D5r_sHt$Q>Ul@&<2-T(vL^FVXt)Q1}rQd
zg#Rbym+dl?UZ~-Yf^0NoB`{r~+y$nd03wB+tNe29N&#JF%lg|_L=zGghipy8D^NT2
zOS{kmRnkArUShT7Yf<r$neM~|fLm9vd0M})f)D?a?Mo~hyfpqj((W*F^Ps(gmC*kc
zugZH6;XfEw<u=V^MS_Kq<$3c8Si|@ixbi)S@*lvg!ZV*lk@ccR2q2;K|JqpqAj2PF
z_RDKrQ{q3dmkF^+L?)#8@h=<ki6D|c<u0SkjnO@=McSCB`rqi7Y=7A}SHXZ0B!O`L
zRB)M5tGooy9uxo=|0AP%u)ZW@M#&uiDWk+k(57KzRB1>!-Ie&Vp8j%tDG5aMr`^i{
z8Iq9!9z460qp`L^j&pkY|I;tw7qD6HU!f5OV*R~ms4uzcOws!J7}@6*$UbMe;-8$)
zg#yk$T>Ebm*`y$Qjmr;!GR%`hw|qdCqJQtV?hDZ<KLAFb38MVFKjcgo$-me`{!;|V
zKYrhPHl%m`U}~xVy5amEhBW*En1A*^8KS=A7J<}*R^|^tO(3j)#Q00ZE)6My{t|!|
z_|yL>a!Fq}I-TKLWL2~yo9=4uYX<+D|9>idT&8tD5hV3Q$kM!Vg?jt2e`B#=e(8VP
zXfBQ0Wb+N^A{EFZ6|i4Xz!dRs1=!HFFtUGe9y|MaX+9Dki`;EEui(+5f8pyR82-dw
z(pQjytTEx(f1AOAo<;wq{Vs1MzmGEqUoiv3UDggv|HI#6yafM#7{9tB@-1F~f93Aq
z=kd$K$0avvjjfKe1OPCJyjZUog^9wznINvqxc<Z~et$^$5qW6ALf$XguHX<#7dR?d
zVJ7HTvtI#UlCqVFB;}UozvQw&*I~k0pkMp-72(UshUMe<4aWhXVC8?=-wi{*>=RgF
z*1u}~3i>iW<@AF2yOaQsi@d8cT=8@C5sWAs^iRBmWbeTXkO#8mX8>^f3J&IXfg^_E
tLoi|S*&vEbg07q~#V?xk_p>R^6$PEKp#SSr1dQw>2#gUIhb&g${{e#lKiB{O

delta 59617
zcmZ^~V|Zli)-@d4b~<)Cwr#tkPRF*BitUPR+fIia8y(xWldsR-&-*^_KIeReA9am;
zUh7_~YRx&un6r+SusUY35S3)XAuvE-{ycSk@!}DQ5w=*zP5;jum`6cSr)CF^_y^Ml
z`Jaa)a2g!<-<J^r(IBY6_tJ=fd=NMQyosZ|n%ebS6juIqGT6(FR9e;P^-qIOgLi;4
ze&Wn#p6wU;38~#cAsXyn!%ZBOTU-kqqo{ci16ZRtXdL4ga%o74)OdT;WJ5SGLTuHL
zo>6Miv}&A%y98lCd|{&6G<!p4JO)!)+HXSOFfn(jG5P6UwhPmKtaASMwA=tdl%PnN
zU{U`M7&CHkTBV`$GQZe*)2+&Yqu48?JiT<QhKCFWE8F$5GYQwiO)e$50F`NF0WUJP
z>Lliw(0EuxWmj*hjt5nz)1Cf7-Cg6+GI}<J1K79F$md~8W_Pq%1<67ZfrO?f*;|WX
zMKhFBY9=<#Ah<edfR$zU^Hmc-a#<JfxNX#{xo9+)ozuj5@$Iu5Xi)i{CSg<O&}>ZD
zV?A$h|7es$3gJ;|My1pZ(%(S+HT#yrvP;)WJw_+Vt;(xoVm;#CnctQR{CnykjAWrK
zhrW|fWDSM7YM!65Q+ZpnqMUJ0);-&Rq!LKT0D74soS*Ja^Ni10!vY7Odisv!h~5R<
zpSR1yXp`T@cA~kNI8v9SxK@lVUwMZr2krHZ*{DhovDJN+*mlGDe(@`dH`4GAHi*(^
z`fPg9Zs;)V=-v@V4F`guww7t{8;%R6QV2Nyr_ndj)81;;s?{c1gB*(7bRkp%>BqaP
z<9zQRdB5!}Ivk;wGgcZvXN0mw?Hi@`McrEPAP;UuL6#?rvKBPRk1yD=O7EYRee5Ef
z)nlHBn{LbMV236tu<Gcy#G7ujwm0mvc?6kIP$PX3D}x-f9$av8kR^<6@`yeH&SdOQ
z9+vjzTdyqi_6v+w5yfsb4&{Ag?r2K|yqVGd2jZ;N-A}5$9?oO{eAuML4NohtxwKC=
zUEZ9ic4C8{q=~;ASF&&_>WhtbY_t^>CWm5AA12eV3(AtRZK*<WD>G`p>VRTmFf7Gj
z2nVHZoOgqvvDjfWg;$cCrso?wQ4XckVr+Q_4zOC;ZcdfM-&W;R=sDPJjku1Q<L~}%
z*SbjXAl!=|Qs!j_uzt_tVL24b6m%`;tvVL3&We@>?^jvMTjTcKSkY=mo;trh445AV
z3qkL_7ETOD(IYzg0ajjML6Q^zC%(3nk(USOcxR8{uX8mOrsT1B7prhTP}bd2zPh+(
z?d0&SP%5TL6jQFy@wruppUe2W0h|*btBtxMnLg%DJu!G8KrXJju*V7r2){Cz$ej1A
z6B}g^7LT@{8NVKpd_yey8WLI*KT@wTE!@U60u9&N(Ko_Awu=XwKSGs~=rTFeFaW;#
zIw^sAlo@Riq>vuVWI8dyHo0*(o{BUUm)L0C>;ROvwiDd856ZQYf}+K>#@kl(NVqly
zBbG}DaX^OyaDa|{H;(k-aR_A%8L9gsFc5;n!wzShI>*KlGhMdY;t?n~kbxOXoH)m|
z>oGA7n#7t17B$o_<%mk-L0Ded2wRfjn=PE$9i&|0;%Uxs$x7EM`FoY+OSLBc<?>{*
zZ+EPNHA>!RXzE=|s%4N_B@FXYCTdjARV7~U)(U?B;QD^a$a07shiAmsXHn-<5zJ#e
zoD@dva&bo@VME&>GL9FT^<fmAnfn(7*`0p*1D|9R+Rf&e4&?rKB#6AhP^)<ZZkGhT
zc1Eoo(9v6m8mNQ8n0FHuRrbkE7dQfeQ<ExdS|P<5W2>u_;h?~PVlwK~U%4pR&!r7x
zA;05{0nBwrOV3-LEvS<-?*}XBb&zB291)2Sf{mBwO^a@AkBr}O@;Jy0du_I&eC!#a
z(2ueL#dy%XYO+ztOM_dH4tT7_J9bvKTI2FD8|4&T4>{&jI#h(ZkNY_iZD&lnvam#f
zs7mz|sghrOjnA??cddWDoF7WqQ0Vh{KTdsW1N0NvIc9Y?W>C-{E><ce7dHwP*UR<z
zQSgb2m>7QFtA(qDYAV`Oo8+o!`_s^d#GfQyW*)bz`edYX;fSdujSa9T%t|}i^myET
zD@pvhg(n3`SReHMwls9CvJ@tWp*+*+Ir)8>r|657$%2l@`TH3jTPTLuC&kfCug>Xn
z9w0GUV*0m~ip$S**y!y-l{}{rw1(GTnoJ1BhXDt43txomusP!6@)14Z%YHC@s;?!J
z$_-Ko!446p331`g@KCGPb|Z3Cg0y*w<E<^&)C!V`E;=`_VfF7rp04_BS{{U@MV5R=
z{o-T2Th)Vs-A`m~ZLi5%<-KH{*_<8R0SWL7P~{q1wckWQc8e~;w`QQ~d@0FE={Zsq
z{_t!x?^(GdoS9z^!kG7@yFZw%87Dx6+y`~d343*MUlrqt(j6c-co1(kA+|H}0*;P*
zJ}^!CKT4FOfQ+?$rdxD%u6j2gcUf>uns%-_A)oaRikx0V4jpGUwVmpP$L9~F^8@TM
z1saJM*cmzSnjRlcs$CpbD#xeYrdFC=>a6*HJ6bmRnzl?1`a5|a&HEnG)&r@t^kYTt
zHdsX(Z*dnI$51e+n;iGnkR2Z|?Jj=f^F9&<<K9;5J!yIoA=gE=ZtWzYnLvx8k34!3
zDeM|YT#`Aoa-A=Wpq-=i4DVyjtO3AyhGk}yrxf`)Z8GUSry>T}*B@O@0KRqSG3a0A
zN?X#L2tDn>olw1yE|QRmg@$3Kzqd9oHNldRt%vcVDx-z1v(^V@;}0e`8|3T4i|gm|
z0q>n4-8L?+pD8uidcOCm{gQ{;wbR82MGePwgftooAnW#)s-Z~ctQs_EzW`Ktst!`5
zobglhE*=1#nzrlAb2dMZD5FarWd#O3CN))@72=YsdFM}&nq=2bk&<f0PLb~0Mb9DJ
z*7HJo{{sGejGn&bnI{lC_s05pHqJrk6#r?wTqeKYEGWfjmKOdc7jVsKhi>)U%E^Zp
zgnk9#dAI-7NSA}<xY2;_RtT1aPicAx+L(P^R8@0YZ59p|qM;bjQhqxbTj6?MLML_f
z<2E?z$0NDTGEC4rxzB3Qi?JuzK?uq8zR@NCR7n;ZhI8~Bcn1Rl;>ZL7@;6QT7X$i3
zg@ELUU;ZLM2miyB{_rF`pprif_W$sx|I3vEzkq<CgD|8_q(J@$Wg-CV>rB{^x1e@k
zswy#%u?D2@lU42IgiF+uaSfXw5_7cS3<b<h9GlLsTgRQ@PRQ)aCRha!fI$rN{$Bbi
zyg?ahy+JBozx>IHw>&w>Y-p9PN543wIaqFKKorcUl#!XQRW!2DAp3rZE8=F6Fp?H=
zs9&kZXa*ed?0Qh|l(qnfjLaUA-uTH4vI^e@K{#Ld_~hKwN|k1k8~4Kpo3i#hSEkBP
zrx!e4I58%Db;5fxwTax2Bn#T!eB3TFjz~V8QkH`ZWiZ&BGJT<{gy2(UQ{6XuHl~)=
zQcgh8NY13A9c6z7sYnQR7G86FR=e$z4oj4f!kkNdsqHk5w^IjP%jPe=Kx~CbVS$+p
zVe%x))Y2yi0CS4kR-&v3!MpQ!j3cXOj$lgQa^xk=LnI1-RgY(IQEsq{-^lq|7ff~G
z(2DFKa0n)^?!0oPv|J-0<PWmd@R@An%5K;^=#LyPd>jQq%gPeaUp>*7F|pw@(H!t^
zTn?aB^lJ_tzk~ve`Br1bh@DD`;^(>`+olI#I2;nrF;(rUiVK(&JCwfbmNSC_e#w1A
zl;B~=CP<Zc)v_>J84XnWhq~@cep4ZKZ=J_NQn1B^Nv^0+IZLb^k2RNoRKCMR9-<O#
zF$Shz<ciAJcTM)fu~lT^)~kD{<o0qrVj$N_U}eIO$_@eoRuNVBpbK+3pT;6<rt!W;
zk_!uykYjTl($5WJbq<T*?Q}pekaot9*ek^te8EM(;!z1OMv>c6ku!AC@)LO3HsTSl
zYd#)F+hG$U`C<YkXAH)(8(XYurDT>c_B0MV#sWe%I2N=)!o`%tl`D}R=J!)-hBp{n
zOl54APp24wtvXdVM>!>}Q8y4lk49_XS6EMwFx&y=1+Lt6xCwYYI2ZifAx|GLOL8`x
z31NtjVZPcSjJbwBl(K4<6Ovb<u5JT!Ifi|_rP(+$@_`=JO9#zO5&T7gu#)!6U-ZXQ
zIoU4~l_cCUe+K7J(fr{xx*JSCZ@$?X7Eb|Mn)g%y`5Lx3l<Z41L6-ZZd%qtKv5@54
zT~eSBQ+{HqR}lpABd+wZwHlPQ4Cc&fxBhxeGqQeD1K*~f%qMgoiABL_3*^9{V<5I#
z70rZ9<A}5AFr)#mDPk16;dibSWwv2WTGGV*6+ap#l4$4xqj-OS|Gw8_KR59W1Ezqs
ze{mmxqIk$PrB1d$>m)NG@rb<V+>VJxfp{qwISpdKMqnw#+P2lwrrX$}kXs7X`Qh7f
zbJ8w_m+19z<0$ot!htVI_=;QOMC*bF`mE>KO3zIt$L)O270*ty{5yZ;y|EX2tr@F2
zoVq9!z+x1O57vey0%Cb9wxUwI#s|b|oy`q!vWPeEFp)M^ZsXv;WoS{uLrKJRQ=REe
zRb>eqX%tMfkhhDUQb*@cyzy~7W%v2f0q}X0Y>ka2sVuuoA$ZHjOH$OQ|5Eg;MoT6q
zmg5T9_ZcmeL`?ws{ceM=_!ymRKN6ItiNA*O_4oX2d%7?xMa?^Apcks%RPndFoSqNB
z_Ik_bZxV&wY8>4o0VFUYN7YT5k`KrPHtn5u#!?SwR*-L&evK!}74qXtH8#nBF6zX9
zl`6y(#Q+FP*wUF?1^J_zbD!LXOX-a2MDBpADdpRMOAG=AcHL^Je16>03PjJwD0|p8
zr-+d?sPXgiq2VZ-%3eg1pDMwIheg4FiO_YXv+pHe*-nyZm9iqsHI9Q+Z?$eE{J=yV
zTxX_WrX9bZFSWTD^W!6Nj~fRdabz9!=kHL+qTw}DFz(-!v#v@aWidAvf|um{wx-Gb
z>TSJjgs4-gJq1k{Ac=MxYqo2<$j}gwG+P*~zj%HS;%j=e0Lx+N(&W;ws#oa)NVWh3
z5gt5*@FLMq#G<6^@4o<ua%kqw$@94kN&Tv?e+rps50l#R6oT8|f$!{E{Ps=P;@#3C
zJyY@)&AJw?rZ8t1jQLi!M2WL<%|tgbxMk;cb0vrz^D@K+-Lpp`ovWvspDWmlb21pE
z{4%W+4$=6Xm&C)|oNrOwD%`#t@IGzF;hJJ}9{MzIkuE}FanBQowUpRTgQy*kgh=<|
zpoW~;=zD!U{npFXu`1Eb2yG}UjUsvlgqc`lgC{bkQ_z_}?qvV2JFGXM*l^7}uk%|k
zT1*d{_%hdaP^V0Xs#^EL2yOtD$Ntz=h8THk&)ckIUdB?M82BAo)TjRoU`#WJz7m>j
z9k)N82%*Yhh&2K$AmLl*0cj#TA<nP31l=i<5Y@~K@C*mK^r@L)1zkzc;nU)3_ul?!
z+<V%-1a@+VN)B#luf1#2Mw=|H#<&9scH4Hn367s&8VkM8k)mz0Ro)%Dwg@tJmy>Ko
z6r<_K4n4`cLtLHdtsiJ?0Kbd*KEt)ITPNRtWha-i+j$tz8huUGK@+6Bffv?{!ggFE
ztb(cT&56g198bOdIc8L<hb4{$f-rM+?hVtJ!vt}J$StFHt1=_G(=B*&bZ%EzwVv{O
zi;pAhSmq~1;&f4cO2W)GQqE$_z(oZdr<<Ic^Y3$kE@oA-$lyf~S3vBe)%}~brCCWJ
zyWD$ikGfmy+5Ikb-i=e-2UYAa!h^Q~+e%j`*|oixGuNe9{|_8&Q^t^-s2fS)Zv2oe
z7V)!7JbdwSi{mlKHQjdG3d`<xF&2=P$6OowM^-y2Ex?I1b`>(ugr|kz@4J$0x6O}_
zb<Rz8!8!8{`@3;=QovBeg1DYf%GET(+~WoI){h!ntcP(#Je@~@3qC8zy29Ql4BCT$
zF3>QRXBxhr+j5ecT-C+&>M(qALVU3Pe9W6Nl(}6yJDx2}g6L|Pq+Wx7{v*$7-q7;I
z*^TMfy7P#&`Z1BSm=N>cZFNhDYrNP6aa-uS!_XGgX*h2WZxdgq+epO{18uwIDehQr
zd~f9<^lYGC8RAFjZQZnsoamq(rkaktvvJTz?d?dkv!D&A*!ZX8mBGKrQM#dBYsnvS
z^e=|<4-e`8avv(xzqt=%>VM-tRa)z|s~i}AxDS&IbBQ_4vc+t*#91Xg+*xtIA7%$`
zh<}24IJ`I<Ip(VDT82#vzH3W~mR;zDi$<<jB%z96Gx@4T1f-NTQNrOPui*HyFg;nr
zIE{?_P|4%u*)RSeEL?0)>)G%WJm9GV%J`wvX5m<rql{^{S~&DCIUWrF+aY;A`sKX~
z<!*o~p?!T~u<&l(4^QLNZ4CM8cdH4pzGF@DyzWVhy^btQ&oC&M{!3A}f$4}3m?Aal
z)~6RwzGee|H0kf9Oqg{#Z9sBcg#;XGRvJWg%qm?F^@h}tfduhhkN(R5^s1}~$|Br*
zf4(2#26#J~q1`Q+{_vy#(h#5so^xq5SVrU2T_io{SV47gd}sbiFI-kZFX$wK01?tO
z4k8q?#zq$n*A)UEjw7y~j^-qWGz$uZ0<?7YdMJ8kxNISHj{6FIZx>C`P{S`(aWnMG
zhEovd5((&i*El917Rh8-d(^(}Q~ctgCeUhHl$Az9av??9reY4zumRbnw1ok0Iq^_l
zW?W_J(^ut6(hoVm111og`XOS9g~Qs%-c;A>2zt6Za4vLbE1Ga$j`^{TrIuF}9kz@a
zL61e5oe&&m5rs_<44YlzC!4s7juB|^OK2t&Cqj@AsiNb2l~n;7rrH=!@+a}xOWt(I
zL^4;QsY02#ZPO)y8FahY{n5oHjD?znTVTTwRBm{vudN4V%fZm&)00>Rltk@$F9Kw9
z#Rp%`GOCGBe`BO<Gz{{v954~wA91lBkp`tk-$RaTqnFXFm03q`fl8oRm0!gtd(NxV
ziXW80Yw;aWE@l2eHdsJX?!Xl2IU|7A_(mMJSRV=b3M~mp=$J-)SFQQMbWHcj+-*0{
z>HNKRG8X~vsSp>QA~wE&GJ^iPVH>50qiV=%1wEJBJtc+krzE@0u6>&m!t^Db4f5LZ
zK5;P4Pq|;mEk(Iw>9f%AdY&N-<m^Wp*v|Qo0nQ2oD;pVZJ?|eEH8~$1uXOXp{W!K3
z07?>x;w4nT4e6d-NsX2SF=Fynph5S50|Mdp5O^T{=6N3n_^Go`r?@75qD5`&gwCNW
zCi}pV(`SS*xWwV^Hr)H`udkPzZ(X8g4Iq5$Lx9L>y$fmwM!Lkzj_D{{8gpyY>v%NA
zug0chkMP1G3cE<OqmA5Aqpas$GQkiDJdzm^V!^Wjm2F*?&_p8ZFF!J5eggS};Stue
z<61NxEZem0;`%E{!2-b6anZkUuREkgPlphorIVjqC#Slv$j=ioy~xxo3=Q#UZzH6`
zf<Q{jiBJD2qwcfPS@O@eq2Z|%XgRk2Cl)=va$dD70gZ6OuVWjZ<%<vX8YXhVtSPKr
zH}mp<OdGv?;b#0m!;f;gV<E?A0ii*da}Xh_J4MeTD`cTlsnf(#J<yBhC^I)p+!DPn
z8)Z?A*vF+Be1R%j<sJzA>2#;K(c1Ag;Z-eksi!2fSe?%E!~PDDpj-G!w0Y3D+FRUM
zDoPl%GK|-{<ytl8;M^C~BTlqNbk+Bb!$tZ4LHf157)o?D>d;4jpRe=ad`Kpp&NWb?
zI62_X%zVGeTLl$U0@Y=W>INHSq~4cxYu6hZZO&DjdM0h%z10S}ASxJ4(`6cnA_>~H
ztwYc1F)q!zQSa|s<1rQqdCAk813HL<P)?3tIR$$@ZyCgH-GQ88L`%}AaH6+xSLfM)
z8o2E|S<@d6F1z9-yv!2ve4v5Dh5Or4cwqcFPkj^A_(WP{%`ZB>HQzFdXHqdJli)(+
zhlSn=uySD{e+E4r2@{r^;&j3asWWgR%3O0nKl6Zu;*?F=&7Gl(%jXTyJtG#}hATsM
zl~Md=(q`nMkBZNyTq?l$HjNXE*37~QKwm8z@pV|Q%uG}i=&TU-czL+m+u6B2?7tjk
zN}i&l<^y@M?T>^PU)ym|1sE%knkHYpl*8;#6tmiS#k22Eq=zGA&MJ0U(1{hk+CrSQ
z0wUj_|5X=+HpR3@AVEO>mHq#FUHA?Cr!D~J3Gx5Ehd|JPP2>a){x5+YO+x$cC{e>U
zN%-HW4F&Z-(1tvUr@xU*8is!$e}p+v!!1qQ-)Id3-G8DGjHlp8|8IYTf)e=7O!Dsw
z2?2QWc6-hD-8}(|w#*!smO~r&Jaq1zpv|D^{ght6_a@`H$Oh*nrAJxOSB3raQy!r2
zG;&)AJgxoTaxn%!A_Wo>LK3JwI<3BlD--geJrg~5Z|)X+Mat((Tn)(ADn7dz34ZYi
zn5HyIgE8iNG@^k=l`A>DUrD*<D2hrb$^qOaK^w9laWUY)9<RM_Q%)2lC^MTFXQZG(
z`s?2*Q6?y}Ndf_%_m{*UH^@OV5bt>W9jM`j-PxVI63qMDKaDAV{GuLbm1c$A6kLN4
zzAy5Zng?OH)m7Q>jv&v6@1x5+Ijz<{MI;lUCZ&{g+W^YuzJrAs)be$z=+bj*7Xd&x
z9%<bb{XvuxbqkcXC;78ew8h9eznj<fo#G5jLi+lX_SJylphihW2xd&s>i&#TwA^#{
zHz1MbM9TsDK;!78iB4c)Kk^)+w}*O?P{E#iD%2h&g;;#4Tm~;@nU!O}UH@_qUBgW?
z9RcD`M9N2!8V_mWbjhy`1CKi$eh<h~$8&1W^vc<ko6{W;Tk~KDYvxL%*T}TK9<dII
zKok%j#F~0z?XQ%Ys0ne0L~-zy_fXo+?34QD{q;0HS!`S>&?;ogtjYl%RO-52&Z1me
zd73`mYsxmeUQBA6YA3QWZnZzaKH(*yGG^L}jr(ZEZF=)Qw~J&)y1B39KoUSESVMBJ
z)V~1%X&B6qrr#Xag#tOk_<8?}SnzH8S7g~o?E*W+?n(hUL<^*bVU8K+)#^e{(e~;R
zli-q)uY`)H+pA!u)&4U1$biD~uTs;u9`W-C&!*nB4j;>k!H%<U0U|V!gdzT%0<TaQ
zl$UH8+6d`WgBT)`=--P`jLrb|KYEkKbpj3%`nnRzCge<L{Gju&?Ue6lQzNmY*?))4
z>l+4=k&dj<MOwj}g`)Ql@3nef|LAkfNzrEg^NsSpVa3ur@CNtJ`6@GPi=rqJB8e34
zIn|IJKS<D!q|R&k%1|h?N^k>zpdOxbdXygoP<$7msqEO{QC@BwWxNHL(kM?)*RW>J
zJxV1PeyN6GkQVD1cXpPv>I|w3WxLms>MM%5FBv77lCY+i)~o`RPv6R`&yL9V&QiVr
zT5ZJ^EP;B`{zz9LHqTQbP$(9ffJ^WeODQx)!xu8pt#LLzXQ)Q^wtJ>VRpPMjQMqyY
zf=Wpoq!KPez8R<*z^VaA(-|p6<T)SipDah{xr>YYCVs&a?uUSZhD8)`{{a_~jQ#P9
zTXG!lw!Ey%FpE1Ym)P`8<K$kQeV(j~WP>U4bfsjgE%)H7K8icP6s)mJ=02`Cyut{k
z{vjXQP#uD9g0Ow1l0&bB(w4Sc&scKK=9nlHWR^X-T<G&laqcnTn{bLaq@)sUo~zC^
zd3m&U7x=5()?pHJB%9VQ@Yo_YbOWlHG@Mjs2WM9G9xl>d17mviGQck~ydyjLp3&#g
zf;@@7DKSXxyTQ|)8wEswXje)N+}Z9($ENT5hgB%BQH-2>WPs(6MjzAU$FOzq&7fOE
zlG485BV01osh%w0qP{sB`3&Oey3*%$->w_Sv?}I|liPUDjs$ei?l!EJRxKu?ze*N5
zB$8@NrYK{LA<b5MGl`iiVu(n~LrOoEw2tr-KAshZobu%Ksn~~tzHOMB@rGPA^a~JL
zq+GC@E?6#k^<{3SrrIudcoZIuQl-ZdC~KTxmilwHxUU>=IOPRe=qrG%jix`*)vU4|
zM&Tj7E@i7s+f)85UrP=z;m-<le<Z}}U9A?6P}++*UQQDyod<_lD+pV%NP378jqTCs
z^3p7Ut6P~(m}$+{EXNU7kvCq5HZ}by^RwyqwmFwi9eP)J1QvN`guDJ0BptWfv}m73
ztia%)G{y`-ZZMpLB*QFFU3qq4l51!Z1<Z!WDHbhDy_RQEl7ebQD%*|j;&qW3G9rJF
z=|jm`Z|IxKDt?x-qdc)ce3wE>BsBW$!4HV#tbDgAN&NhqGm5b#_eg1)TjrZyM06PZ
zjJCs=7G4hGiAkLk?ssD{RtNbUwq_*@A%^eB<MVz1zn7RDO|u;HSaZYeSk8qk0wP-z
zA66f>7apuPYBVB_TUYfGbVE3Of((Sx3|%FLm;-@@?774H6MSkFitFFmkL@X*au>I~
zM(PDK@!&2NtdzR<^N=u*;S@_4MKTfcpslwW=(oJ#Yj?!#PEm{$Xw2atuKn%Ly4W*1
z##g3*Nt6s_Xu_rN<Y^+4q~*D}cTFVmcX#fEN<N}zw&5-muQK~WzhzmE=ogLL6tEq7
zSr+Qa#H0(=Xp3Min>};@8(i6;KyjAKJd`^BMKNnhyKTCu_5JKg_PSJ=iA_Uj!UcHS
z*THD{SWKU}_7f)}$F;Bv^y_KnHtum5u9649y^YSr1$ud4p^icFbJW7ayTobavJhmA
zFjwkITfxLj-;83Fp`K}LZ#f<et&triG)Et~P_Y>{;fY51t(+?FH@W(-89TXH#lXkB
zb;--(d2^eCdwPN5xX&w=?+ByBK7Q^3<_nAE(697fm!9R4ysp{u%Szk}Y=jHixcEi@
z`voRt@(Jkn*uaW~^^*1xl5mV}?WOQN*HquR<){wAW9+(X$UxC~eJop3DB90zmv3W4
zjdfK13s)|qj)8f`<@6f?!E26&J{LC6df(*AP>jVLQm^7>x}xe$`~nYzBLV_j^Fvz3
zVwpix`iQH)hl)U_JMur5=CgvoDFVj<s`f0j-s+L4%a-nrF0hP8ujEC)fDC+3=idm#
z%d>8U{M7?@Ee__b@)K?NV;JTMrBO77ih<ti&NkJGe9lRwv>#PO53UYoY{PdMAxN&C
zqS&gYBkx8!^^+z*msR8I*V%ZDQx;3%{q))KRhQ+HjLg(9w@iI14;rM{>2n4^J!Lmo
z5)sj|{Q6>7nG0F_w;I2}ZvTkp{Vf-VigFGmCn<+yP0e#;T5$Cw`&o=Yiy$oSSi`lq
zGg}fj%pIsnC`f`syu-TBP>^wEm6qtQye|4K)F4L>dS}ZB)BP$Cn10=AOl0=OGxSF!
zP6k%yCu_?Ob`reU1=Ut-DKWW#%4hu6;fD8yYui5VxJqRHgQtd*5TuUI!4B4AD1tSI
zSj&r5z{jzo;OE^dGT_w=JJ;vOiu9Gs(uT+9`O{QP^Nc!YSMr3gT92sesjtdGLap1$
z&_uWDnS(<Qw^{Ad=fragrx{bDU<abj+J;Ac#3Rd-*V#IY8J#|7jlCax`3J+v&B);V
zo9b`CA8H8=!vs9D@`42cp`iT#qnbvDKpwuoTQ&dBNDCoAb0TJy1LcqRV80-~6v@co
z#kouwaE`%%mz(k>^g-=TNH%dGL=a56%H}r`97I>+FCwoKhObIrj`9?N{Cf;Mg}(I5
z8-*<(;$JKF?L*#759T;;_Slr`^e{2@HLjLN2KW_Fbl@1}jc+aDzI{ujM!=37oIaov
z=B7ASI;IB!aAruRV`UCF<8|u7CnaX4#{rXQ86rplM?YD{Xwvg<J2pSNUr#xMX1HGv
zvZ@dpoR2tLQm9LG{A204d&KGzl4ameQ%<SNH8;Y^t5nMqi`w<@lBc<6T;#e|n$3I$
z!<mr=o(DO&(m)?z{c@Zzd+fCf(~ZH_iiOXKxv=d4GQSxj^v>9(%M)ScuM!G8La@1i
z{$X%_X!!<WhRm5-5ya6FF7#rDyOdhv*FTJpXLsnr6t~gn&HH4OgI}{w{6bL-)Gg5t
zb{|TSP`FN&y`Zh7XKjlz8RK6AvC}cA$v~Kd#8?Bk(^LfzyD6OJU_<O@wV#p?(u?P|
zB3-lqd!w`sh@MFAmaQtr>6KURY$AhbvC4IQ1>60!nq=iAkM0OWZS6%omPXY-XKOa(
ze;i{LvNY8tJ>M!%ZNP$1_xdUjvD3iO0xj&DKZ00)OvI(th=11%3@|4R!QE5S&80ee
zy93!i-tH=Sr;9gb>DOH7hc@8M-k7I!k0H$ke6J~QAX*Ej3Cmo6e|uT4SOQLeZGVRw
zd0my1M!2j}gtF!N_R1(=GR>e@^t5kjU&mjnG<Pq*{y??i=Gpu(m6w}LK9G<{9$?G)
z`CWwz@{3$LBOT*RJgqlIx%<`yS7<Ak2^=0Wx~Wi@=9I46MS(^v4-mz<ASngq&ct;V
zfSR!wD{Mn6aTZgxN=T;<XOY{ZU|y}v{A-uaSZv<<NxX?FVbL?%eUXtU_fjyc*C$@h
z6{ScHKXNzodT%FGO3Qm)cLnsKuy(&Kw0W1ib1oTfx)SQgJ&`#ag-Hw30TWHH0g94T
zX5ZeC6$$z>vp)I=L?gK{jr0*Gnzno)KspJFi%w=90V-P^f1HJa*}viO)ztZH<se?e
zhK^m(`s=pq)Oq(s$hz+f*2dD5tGkx>E)~R0a33=QFHV7A@=(2V@Zmfob&`Kz?<`g@
z?!f@x(p_@dECS=SX`t(a*-wcQYC?KF<r8yRFC9=xALz2jgfi5Z5x8<}ReE)Pz%Os~
zv^_Z$Z^0+eV;D}`4pO0*M5yZu;*J&<&cPHR(YR6vI;C|`L}I>hFFHG(`hD_|J#uCE
z!*y(?xMH=zqHs&-GV&^hEA2hit74fwS~)Kfx6&_OV2*OHwlU^8Q+ArWL`&<27M7E>
z6i!G&VT&MXbMqR@ME30`kkuDI0lrh4NVLS`F>-Wv?ym<aEq1=1kH2zWk$l8YNO=Tk
zW4!6l@9Y~2ut$!tf_ar|N6|hADos1MgPw)kWw<^8?Y`daVDY~E3Wbli+70xdnn52R
zIlRv2!#1y%<kr5bKfjjMzKGu=|0_v3kWWt=LV$o6A^vZYg8XaP4yYvjA0n5aAzye7
z>@NxIF7{6;+fXM~2l*FbBJ;QW{kQHj!e3yY4Ao!K^}m8dvXuV~gn|B_zBSN8miga>
zFG0hsY~|nj*<X?8Kha&q1kk@XtjzVF=x^nXf2!+vc%X734scDK;6D}vvNXmV|9Had
zhjdKNrUVlho`V`cqO)A*OxjPX=OD#&6Qp1g!2J@`zg1k!9dA0n@J|5lz=EXW@-a&E
zhf$pE9j4m8t~u5Dh=+|Vh8vXy_3??pGO5ySHPSZaF{{2s>&cTs3~|rBkjSWOYm%!6
z09!TM)xt1?LH8fbbq~@3j8bioNqhS-rU6dWFhsOmD?Z~RltmqKIA3^v5TGWY7ii@L
zqnZe7XQS)W9dxfv9+Ec{FA`;x1hL**L~}S#B22r5O*^jZ`QUeX#!haKam&h+BhQ?c
z<g@L`;8R4XDF%N?YnWb!$-6*avo&kVA<e{-HgtrT-o-ra$1rLDAkJ0w>H@l>&oJF#
z8#ImKt`dlI^aa_m5M@eBFsVlzmA!d#^~7+$JJxnPFSS<%wgfK*$-U2ti&wP9y4e!t
zqx3tnS~d*2OX$2Iv6U&WI^NEpIW{vM`?4|Ls+o<C@QCVt^XYPc#DS{|R>(C05^Fn|
zq+&aSm#N^igEoKz#v>Ee!>W%alxKf3rbqZ+9M=O&rI(X^QPy?MS;K6iVE+^zzia}j
zvSE+H?=(gVYO;>*<PU)t7!@!FmGf*Nl*?7SztAsNfsd7XP(&}hHW(7RvWRJt?>_=F
zPqum{0r+FJAIHAch)ApS+aj9WtDocKnVG?ow}2SWk-|Q}mv8uLvI&N@We|*(%V$Lq
z=XxU?;_K(@+u3wy2c>l9tGoIjw!YdE;9X$n83csL5Vc%hVNBD;@_fAb_ayHM?r-<_
ziLOW3(y!hwQ15)Chq?Vk!I)6%;o$O`U+3=*DvMhT78<L39x1*dR6s(4MOazTd5&LG
zaD3{^+;vO=ra!BnS7-7npW_L*^L9<gw7&a_)*xBsE|q&Z8b`Y7H8J$x^us_JRpQOI
zNwGSK7>3v9=r6ZI#xj?VwpvyEz_<N@;woct6m6yUPIO<lC_(NO@sM~;SmEL!7wf3$
z_cD59$<)P$tcGOvdj!KOrk+6*FpO;FXu=Z5Bo1c?xXU<Ai=&6+-;Jx~;cNs|xaa7~
z*0psY6S&{r&g?`$f<EYYSl&7KU96TG8dOoA|G^&+Z@WQuK}9@w*{_oB@;qClu#};X
z7KrlZxRE`)ukXz{%c();^TVOpj$X8W{U^SUb?|i#f_v~YAX}pb<Xm-^K(C*}WfFtI
zvTVe}!qyHN!8_yQ=Fq_4<70OdAh6rox&t#mS2&QHy0xvffS-A`{8gmSZOQAcfLK6j
zl36b&l<>&cbe&MG&fp2~`PbA;lUna>J2(hPJpBJAyub3@|7{F4!vK+-ae%fuDF2xP
zk~D1W{!p`z4TD~|*Da9z{X(l1T#aUu-_t%9a0t{9ehCU__!09`qhH}WH#f*=Rvb6t
zK%kynAJ^8MzTTYJ6v=d)`ZqSCYuahpk_3!UDhg2!G>_>t6oXsb4)jdWw}8!JHOk0R
zFm!MEt6NkhLT2IV3->yEcVLaDHtd}M5J~8$4meuRf3m1F%i#-ceFc0<3sRD22sAG~
zV0;ih@hE=e8Tghgm7k{V2m1v@ZF$@*5p$~{uFWM?2J&e;{l1e~4Sx#JY@VRgx<xA$
zEDVyh<wl=RloRsJPKdGb;B?*{97J7}yr8bD6|c>?cpDUG(=qYojDTgd3x|paPz_x`
zq+<Q_r2K~HlKtkILPB9Eui@~6^(*Vw=x3L#%_?F1>OEf$TgS#35oo75QSR6pv)2N}
z;`z=Nr1hg4Q1@T0nNIrsZ?C6U%!PggqIN04O8Zr;16J4_vXmYf=-e=MiUGg*g%P_9
zDa4M$m$Wf>!$|`mYM2?8WT@ZU0M0~{2{i@<4XKmqoVW4ZR8BuSr$1I($bCeR$ops8
zdeec3j3qi|1>YnEHMA=i)$_^;Y4ivWrDv4LQXyY_g=vfJQbHpQup;+R>yZfF083?-
zKOL`r=2BVnNmOgpkZ4wz4QE**qVY4;uruEiHYLmMEaGzJs6mrcX&}cL0aCt$#`~ov
zOw(^WKj@z1HEKD>Z`sN&8)6>Qcab;wRar^4=MgstuvPvV^OXfq=4<bG9<PpC)ptW{
zxBV;*G(*!GT$&jII1BSIqPlF$PdgduMC*CQ`KF(uzT?Ef!`2Z~Fp)cDh9Qsmu8fvC
zTJ9&dn#u2fWp^33RvX-l0jz4r8cCh>lM5saS&#3I>3s2~%eL|Va&trJ4#IuSq>B;Q
zBoo5~%}Z5~k6LbMWUJHEyPcba!YOQ(BgX%xv4eA!avk$y9aCdASGcOrfSCAKdc`vq
ztqS%0>5*5y$DEF?Pp}hwRvtw%Ce)h`Q}R-W`@Cfwrdp!}8Vpi~1fYTNy;UnNyPK@s
zjG~2?{>NOsj7=?S8r#~wKTBc_)Wq91A#Gzde~R+HXeUg%8r$Q+GDW#zN;FZ<tLW8>
zH>we@@xa~LbWf%Zry2X;O#7m_=TZ2p?kv2uVb5|Sjvdp%RPS0aevXzn4CXDi6jJ~1
z3BxzHgkS)T;J-8#9t@|Y9<l46+qd~oZ}%VmJ<vd(??3L>hJJk!aMb_TJ=aDC0r>(%
zb;bnJ8KM8jdO()ugzfHM(u+w3q^d6O6RiZlfAV2=_o1;RAI3aBp>>8>iZ<r-sqqoZ
zC&<U2C^BDYvp6!}Zia+LJCR{^nbKcWm9;<3t{XSTG*PfyL~3wODURACE!|6;5fdpa
zx90wYWtcdvl^j<we8<DJZ5T2baTF5%PGSliTv!B9nCTTiJO&mF>%~IMHH==k&`)l#
zld3w(0zryvf+0v@j=F6!jw#AQi9xOs0Wn3|DJ6B~m-r=Z?*&FK0b)i42l~pGORTP$
zr)oX{MwyhT*ieB|jQI_Vd_1Pk^syTki66i0Itc@E>}ah+%Z^O+i14QByY(c8Cmr9-
z48}9y1FB0{;H_I2+bU9+%x)6*a?D0p<d*veG@50?yUG;{Rw4dl8b_K>ge8l^fGUaR
za)I!PuR)q+@>c29+Ob}kyue;6na-Ip=|T9R?TwLPezdUqD?HX+w6)zXF1&hnm~Xy)
zl$~;u?#@iKCUJe>bT74GxQTGR&CyC<Rvim~Y(<G4=jrwQ#mMGeSuCmEfGIv9$P76n
zx}*q06Lt=oT_K|?+RVnEJzHX7mWx_^I=RKqy&6GUtz@D~E;x8kkeML)XRY_Ovgmhf
z!XE~wsiM{^=6-VgTM?C@(l|tjRK8V$rMY-<mY^QCj%!@{SM)zHYRem1;^M%mGa7;b
z!EmuNX`}FbCyF5Q@cV**_lL{FP5h_EZJD&)L3BzHq4iRN4>)I2l+-VS*%-;lbl%`3
z8xv5uYP?zu8R8SeqosyQbZ_x_3}n>^ZOYd1F5yIbX#oO(*nipwcY$FTC?ftfEqC7>
zF{iqMWL<LN)b-1s2XzMNP2vvd_mnpQ7Z2<rk1@XwQ2Z4&BqPUxJ}kUX{!+OeeXYUO
zV=x&4s!1ztS*qaXw91TJz^*^P93J{IDRQq@Z=3d0l{hfrS2+qK5almbz4eQ&tCo|)
zuE*|LS!E5I+d74DqR#Wm6VXq|{lp!X9aZbqH-sixaHA%m;cwZ6){5Ar&j2+5-LML1
zXTzO>GR#{)O+lyJxjy;us4i}^LPpo>3tnCM0Z;0@S4^#s<1Pmj^lN*22U@Qbh+L=`
z_-^@;^P*e7onL5)fq!GXFKXk|A#`C5?-qg#iIab1CjRWgPe;fL2&7`puLE~4Uy6ai
zR300+?ty}JOHe<Y5SQ`{xs+YNk5o~eMDxdYz0ZtoQAK8vjLWTIeJ;~+Zf`q2;x^;&
zO!k4Lp;3`dbI(yRw)Ky@NLdx=Jeq_&OG%SXnw-xO73&PTk5~c@mn|#=vCXGOHTWm<
zpwBuU92u~&MolRh*OT|_uG3Jx*<h4#P28?iJvhU3haAjYlTd?`O)K31LzUo~bC`9@
zb7I*t_tw6x0wwi=&A!>Bc<(f32cyM$ma2=by=B7ohatua86w!HzzzACwyr!9h~hmf
z0LTxefjz(axWw>2joPooWIb+grbkz03>QeQzk=6cFV7za`{l?NAQU0x6c(%?YKOZe
zQYFuqpk7(cxt6Dat@PZ0v_Py!eF8Vk;cL3H=7RMN=f>5UUe}Iq1Phtd-283Nmo`XC
z^V_vL;?-0&qT96f)aa!48pUXYvFGItojE;kH>W9r0`KpKQ`2BmG%%ySsiG>0tgu-7
zU=chYKUH0iYqp?!0I@WX?HBhymxVf3`3W>XKfwPb1S4trsm?L}D8YYa$bV+mZZpn*
zWXc9ma|W<~^dyz>{zaKmnsXullQRLMED-_Lelm`o798wn&fglvUsW(xyP+G!WY?4u
zX;mE7zP#srNc2>Ss$eJFFpTi{)>e%naI>0Cj@viW!%5SUH_+%!N*eHwM(vSD!FLy0
zm=lGFRO1TYa`Vi6+J2qPmY_D(3VWtb=^eyjm^DmNmR4#*s#XrD=%86cLy$$&jr|2E
z$UqM=h3&d5Bm&bN1KWQh(Sjr<!l5M&kR`u4PKbxThaYuB9SEve@4Y|Nk!sh4h9}hw
zvLBeG3DdQh$i*+HBsCP8x3dO?YvPbpuP9kU_!@JL88nb&eHUPwUNT`Y?-h=XmIbG+
zoE;Gtk#nO`y=mh}NH@Fl28)TgLP`!Wbes4_=0&JHxZ0PuA+ag1Ol2wEJfzv{<^I9x
zzBv<-rl!+WSeOv6z;=RwMRCwAApE=DB@KzK69ednT>+OOl>m(^_a$sBU`!}3lMyZ%
z2j|EP3T87ZtE-f1Rc_wv)Y{o?#fD9V*Jg)!`v93*zm~MyOSsap&nir$q{kHS;Hs%+
zx~1g~JwcLsGBuS*^(6)Ex&MVT6R4*Hjj98o36*_9H|@IyskZxT?X4J7KalqqIJV-@
z?s?q98#ES6IXxMdE&VGdhhK5D%XcryI|1f4Q$6#g)cMyZ^SwkEC8*>km<1r!m^*fU
zij+pGXqZJW_&CmJgqMoE7kUo>(rLU)$0J=?A!=kXGQ{o17!IyR;$u-K?ipXUlp1$Y
z*{RuWj%4I##0-%wyH)REz}bN@OnZdiPU^ViC*Og%3M(mTV2}_7^B_X0>fs7Kn7}-s
zzWjCsPpFQXwswJQD?i%7X-@1}6n#HL%pXqps(ry~rgB6@X>PV~6ekA|I5EjjxmfLk
zb+^&apOQ#eiW6n5l5B)04llxt>?C87iuL$?yg)d>-JzuvTr<w$cIG_byYHb=g!VuI
zMgvy#*tcn?$HtsMPtg0;!>nv$>jO}?9OoA#6M_aYohuBdE}1EmU$K+n6JQPXfBtn<
zCFihAA{{AWaVE3y>laKT0ELD$eHTM$6UU66!DFQbp`B4LCXP|!!K$De&V#K1mA}Zm
z*9q@k9cW2dHN1lyP{Gxp>Pej4OlC=3oZj_kP6e8t?j$);p0A<Q+JDi0V724|@Y$SE
zH&VrZ$_B~}N>M#p=lyF0&S&V6tCGTGJND{my{$X~pi&xs_=he7*u5twb1I)~&40gv
zET1mh_&unFb%%OhhZm<|9HFBYwo^%m`F_<XB!$(fe0R|~Gfu_)u6|26)^6VV3`u^M
z(7y(-;!)4Y;UM(db5aIR)>gI6<(SZ)T~mx%SQ8Cj!~pN{WkqgbYkQ*P)lu&^R%5gZ
z>neXLpHS|3vCWPGxaL+|wpd5p{vMy$=Crssm^<q@_ceWd@oM+kW2&0FCayUIs4vyv
z)+_Q?>^~y9`|d$JVcsIjduEicNE8nbjjmKoyg&A`#%Q}tY0ce!HVXtQlRQqb8%-M)
zV#>$8!0iNt8|II_Hl5JDW_Xe=rEy=kLv>K!-3D5g+`rWVT<{;L^BP`%j+8GDIX>|`
zLM2$&JN#6_y%ehzE#v)uHgskf1tTuKqX#a=;oz#tx+KM~;*z|gnvC4h)sVd#;&YqX
z62?P(y$9W(_v8KcfR_%!z_JscvDTq+6*GmB<M(YU`&Qbi>oBXP-b<Tm&h1sMu<cE|
zaJ5fA#&mTx;G_V2SncqRzBFP1USYa&;pGQxQ3pP079$kKiL6BO;`g+56vB<e#&#(7
zHY<_Xg^+GNGS485#v07?{Y4y0q!v(?n^6GWVynAdM?3S|kPKBX67eg;%5UcKbG$`;
zdx&Wm{zDugpEp&~j;{_fE(M?P1n^oHdAc4HT-N%VDnvcep@9$ATXj@#{XZSI5&_m%
z)*1H(9OuX+dun(-%v`zLsY>U28%!)n$T<2w5zEL~pMRBw(t`l_mOt|{%6R`?6-@2_
zi`zDAfBd)G*67IgkDBpk(uDws;&k<w6$kFj`tKlNgMo7t%wOn*H`8C}zgdL;>jJ9!
z@c(-_K|`yL|KG+WpCA2y3;)}GH1H<{_V^+E|1L=I|J(EYw`2dGV8;Iz_`e(L^Zzdv
zBWb|d-<Je6=<oCTe_A~R4HiLne{b6`^uNfLfzbNDtxb<e?th*#s5xQ7YNYDlvCJ_d
z|3v>>?1qdO$G=gOc(H#+2^)OkhyF$-5(WQ(HpC}-fc`@=Ew_Mz5Cf-WFo0i^|3fkn
z0<Ds9I1TzGzD~b`cy0M_t`hyMq?H-8S)6e>G8abvz?t%U-+z-P=o#LdpiL@FXxD7$
zn4@5+35yz!0=6fM0~VTX>=?@iyn&OPqNfWLtH-9v$RTrso=!ls+xhI`<!5JBj2M8W
zL2-fN^3X=1CjOVim61KWRd$p1i^q}&>+8V{a<WO>a#b&7Km~s`D%&f4n#uFMea7;s
zad-35F)c5CWzABCv#DK!FvImi#y*Q;Rm)NEeU4dVk4X&_pvG5z3cKun^HYU9@v=vM
zN+Qzx>Ldp{L%bjcG=nnZoVKW#6F>jZlgpseRJxk=Yl3>Rb^Tx`Q15|Hdqp*05-A<0
z&sHPoltmjA)J`&T<bHx)JIl-oFM;R1{yEXJp)IT0RxZM;{4^uesF5SG2v@bPvt3@I
zVBsnOuCV5hTR+0#@$xz%{{x5e*uBoEFm#oB0b0(g{<rn)$gv)zZHW<6QeYWpYI*NG
zv0Na2F?g)1KURq@2XFiuo3b4^?PxUA>4YV-U{4vRNWZB0S`0SO`O1PVFE5(`dQ9DO
zE*-mJ&|BD<uq4pna}3(E`SY7+_XKcZOO$5{8(c;PFcjIlI+#i6RZrA8B~b=tm&aye
zt*PB!|H0iwkSNb@iKf<wdVJ<8FYOVnAOHG(?kUT^!Dv;M_v!NkueD@skmm<!)okXL
zZea=bu_Z7XxTavPGZ9)~oRtr!Q&7~iOm8Z>8ZTg|vdSiSglX4UcykwGkux(q$%%=5
zl%<^rd`pD`So#PIAB>%w)@s>KYDS(r3T@3@oBD-VXi!BvSd2#?5#qP;2U+h~$pkpv
z$<=i?Ii;)e8al8gYz2!uHZ<&?e4_-yMzo1@y7aL1y3e2yXU=R*W&}~EtlqP{Yn#3K
z&H|fc$_%==+3XvvRlk*uIHplTIAkKZ1eO#SzroG}vK8BP3$xQE5^mLYxs0K_nsMxw
z=uVa<j5<K$Lq=R1n9>?8>z^Uz3&J;8i${zd%B;R>MmqJm`!rZJBZfjYFMCg_O&&Do
z$tFn(Wq3ex{-Bq8EUVc)zVzvWKA);*%gMw$J0D!ejdw7YHFCwoSr>~gx??XcQ(5F5
zyP4krFy4x@(Acla1LWEg<f~d()7h6ef!1B)z|-&9RpD@r=<6{zgHLmZ=SDyz%4b6s
zTxYHW!*;w(lfy;?sPst8+souvX`hbcw0IBC>`5w4bub(4Rc|KQ!&Ur{>K2E)T00TN
zdUAuzrScT3q!663a-6+y{M`3vx!uuoG)|iUM+dhCTP!X8jMF?O_|p#eO!pD(nLlbU
zl+BQG&OkG=Q&)>~_uNw6BsnrlEN<aEZV1HMM#Wfew!t{V&bDFs+0e&9pmmt?*oaBN
zJiP{b#5I8dYI&J9ttil$Lxw7F@W@VUZ&2w5q?!ASK11#%F=Ow*Jg7Q?AN#G8xu}F!
zjf+Ao63b)p{WsQ(Rurum(?rf$Mc#h)gNbemZs&;wzLZsPMPvDzWnEs-jmtYtSLMRi
zQu$T7=O`jjAOoAHRJI^#^^_Y{pfSa4cOo-&c$(DJF$opeu{b!XIYKU5M^TBz+Of7%
zsc|8md^Wj8&*LH1Y@NMF!2*oUzyY{!tFu)1g9=hKLrbVB&UB89BaG?kyWHL(v~=_G
z@>ZCn&o4Y5H4%U7b7Ck1JEa=CR&1BYVYF$x`@GbBF{m1j>FgT8^W-@;j=ecAKiV`8
zrm6mQ(>M>RG2*F;pJJ8GE#Bvxk$kIEGOaHPUqL_!1Kzae(mtNBV^U9A*9;I^%@yh(
zpyIruMdyV{*0zxwi$WSTQNVs=saOtYX)`oBzjOUs5#{OTZzSSH&bq6C$Ber2wo)eh
za!h`r_cLF<8srvP;(uRaQA6Bg)lv_%DbPI|JR@Pw)(LMFQKb8eH1oeRVvM{_E2U3f
zob~pP9>0ZZ`ke#n8BepTqfD)x^-}ISSv|i-=q;aws1DF(rS-XYx(Iy09yiY~$0&va
zMoq^CErH{l!yydfOc=8{uTFwI-Hcno=V*Au-&%vQ7;(kYwy}>zT6|BLcrN7q1$SjG
zivz_2s8u2!oa^mW#uoi@^8T0u#DIjii;m4xjI!H`8&p7#tna5tQ%|kM794{&=+=&&
zeSiVQQ|8rm&Bw3JipFoD$z1NMnZxegqgvYQljdJ&M$iV#??k&Y&uFN}66!S?ON_N^
z^(Rl0ZzCM_t1>qk4zc%7^k6&o`|@?oN8@!w!55Ai6$s!?s`xu7&zg)(@dFVkOQdO{
zIXrbuH8}uk;rV=1NaPrUnn}&uO8spA9{@Q(#=lCnmStbd#l&f&(O0%A>NSdnePzS4
zu&Ngp-J+r>7&Hp@VIV3LqDI$xI%d|jJ=<Vz*D2gyowHHZ_f}U&Rae^`8&w@^c4Sm_
zq>c8dLc4(`WyI}_V(rdyS~2wjuVr}6jIhiI8W|=0Rn?T9Dt~2LtBM3Br_AtL8DW{D
znmMNbo8EcH8Qm$y$vxAF(>pVVQ+uWf@k>~M#(6R$PIj}P?eQ$9ZCh*Hr-i~@7;)h9
zs6CU+25GJ|b(DEkqeIyM5j+KmfVKnJ7@8Ib+DP;Cs!YQRwll8R$f>1a-h<tgd3dSM
z_)g}nqx;dcO@B}`?3?j#j7g)t_nnq5ot{mRtA=IOa97pNZpjsC4(XbPZJFZ5WYT4%
zDdW{jc(r_0<Tu*z>TP(Yh~Z+UNHGbyNYRR@6%bW+i#jcum_k8Ws9B~~Bq};w?{1ZS
zw$1aKu4xI+G<voO3j3+zI#XM!A|)^>(M_Y-sU4S<WPeeM_m{faiqaT#10Kv=Q#(*>
z?<#UMm>I21Q-vSv)h>aQ?t?CTX)Cwvlt~H76yKzT#W;(|q%f8`O(S{PrjJJCk^~q2
zt6iH*UK(tpvoXVK<~qDKHU%yeUgfnikw#Hx=^i%BeMQ!6Qp=DUXRJ%&zW6f~B=Dd#
zr!gL!tbf-WC$6WYOMN2bYj2Re^iw01ga~3Th9BOP-UwSK4k?kOjGEF;NObjh+sxg{
znNeoHzDQQD+ci!GJ*n3xCzjS&syh0eGNABR$=VuVlK-WZj&@il`X99nZ6GLe{-vEm
zbx3Tzqn9tNlh-sqddx4R^S_)Ps-7N-zyCqhz<=!63}B(>$L=IO|2yxRek68ybC+fB
zCG<1)TitYGztvHs{C#(|#Qx@m^us=1Zu|P;P43g1f%}#FqaB;J@p!f!ppK4G&;mxG
zZ*12v>T`zn32SeEJGGrqHik%*zP2d6+Y}O8?`#y=&gN@u&?s+SwTo9jY5fE_>%v&H
zNq=Wcrg~9ml`hj{^I8l@x+7WZwL1`JE6}7?Ro+oo?x}o7-F;QP{Z+j^Rn`8gYEM;v
ze^tLzm1W4);!+EflWdi0{{kgdnf59rm35u=6e_YzVS?8#q){;Wm#buXQ$7vxQwqSX
zJe`1<!m)(*DBWD9q?@wKy^JvAD6ArnRDWXX`C1#+OhHZ=YEc=<MVWERtEFB@C*3*-
zLCnssO*6$?0kPgxk%!oe-g1;tl`<gP1>0bYj<(CSx_X|#noGZ0q2X5;pONASqje%x
z=%ji|S<VZqRH>7y1WzZ_iYQJI<-2Z0)Y}eBQk4>MiY(u+nv349usiLflr?~Hr+<>h
z{<ND!jEaeMWqZHSMB2PAqApJUt@&!UZBy9HW%wf-CN1K%<JX!F){j=jgPYY(PEPCQ
zwq_-M6PCTF_DO|xa5Sv-K-?4SveJF9zP82TSYP*G4MUzLn!E%2bq##W;M;6qcfAU0
zc`U3Si}V3FPcp<8+1H1lT$HWj+<yrP*2pfedhu?z0L069arRhs8rf5~#2(I0Xa@J_
zMCsEM&45(+sipEPsg!Y4w-GQk+u;4<L60rzyYx@&hfc!J8SfK%$H8lDi{RYGmc#{$
zt)Z|pYl~NDb=F3&GSe7uTSn<xf$L^{QcH9To7HwcCUK!-&*sq9GBM5bY=61V)~A<K
z+A#I}EVpS+(^J-L<$a|_t2Fs!UlJA96&k$VS2@s&5m}CyQ>HfJEVk=%M=-hC^wumA
z)Bms;7De*&b{owmW*r#C{!x^;YJ(`YL!EllI5dF(dy`?8_1K47%m4T%lab9Q+4;g&
zg^p~JtJ!AN?Btz^CuD31g@5>rs6O$Ujhvh`{m-0NtiK&l4_;wyP)z{xJ^-jM(i8O0
zKOBH}9{?@^5Y!71?*~AGbKWM<`K}>phg|QY)p`GrRPf{j;q4&Z4tSLQ@vk4hQ*Yn?
z(;N5W?>!Lv!GwV&UC$DMy9)}py@zrSCRf$4f1h@H*>Zoo(LE3*QhzI9`8$c-X!YYy
z%Dw3{^PM=8u@?pbm(^y3dvz@`U6Xr}VD@`>tJJ09-@aDI;M(;*ai9>V>U_P2)e4ls
zI>ly2rRED;YozspI%Qbq(Z<EG*9NA&u+95fw$Ttz+X=T0)SV)Xz1T2}!c!&}JRT}f
znOG!wRZ>|@m1$b_S$|$tQ0m_JBBH+KR$pE<5HK~2^3tkO;&xRbXIJ4!?c!D8E`XpH
zr=UX0YgOn)sKQ4zi;HgIk~%F^L@#+twQ&g-Mv<pOxQe$Tgi9By_mP7HM6=x@I73to
zi)MxX@>Ox!EZ$qXEbKK4hrOl4vbbs#7d?eVQMB33Hu>67Vt-2n%`_|YmoJM)jpDMW
zuvXWXBiPScSzeK)+BpXQym#tS#-_hxB!EKBL{WX1N}sC0yU8+KrIuMR6Hby>^@DS!
z_w@r`vV!6_%6jdR!W4@e#iCusaN4O3x>L@ncksM{rJ20V;$f})dR8m%L}5?yI{jKi
zxU2Q6b-neT#(%ZL8bzr1D#0<!#<@${;7mTBUTx%gW!@|$v3b_W^vle3I?Fok2FT7f
zG|pp#AqSJ{6hb~3;nXHVqStzR>%>ggi`32z(qB__SZ;78Q2V5&cGqIHYst-U?Vbz+
zy|0Q1+CD)*XTq~TXrF~%={Pk#sdCyBjmMJ}uwHSn+JC!Uj+d_O+Vxs(d6V;4K#2>n
z=O7>=Bq7c6;(Nha5go((fr&^4iSXY+aH`&TJHVXYsRcA!ueYi0Zd3RHNyQ`?hyG!0
z`UkY>hL#Y@68or7Z!@^NO+t?-8z0#5U1L^jkmSUG+7yR17~S1qpJcte!CjO0UNhD-
zh*^3734f(@Eib}<cQv^FbkLYcOL+9}fI+Fr@_U-=7vb9tnnx13idNhz5xQG>+_Fmc
zt5nCYlEYeZSS3fb<OtD9I6PtOsO9+&*b6=S=UR0Z=7^Jl$&~cZ#zQNA*NKs;!HSjF
z3U%A<FLqix=v?`8JEvX-)fttVU$}PkrN4mAJAWyN0s~ZwE{ZS<c61$W0)3Rh0p~+W
z(`a)ybs9~73)CS2sAty5?yPbBz0*SOnHJC6Ba+ctJ(4aE^g(vNf5an77AR#0hYxwH
z+1-QQZ2ha!h)c?w9jy<oW|MrF=fu*q=*5bSt|$F@rekdk_X1%*2j<eB_rYreycY@k
z>3`NCR-KTBZZ)A%H(PBHEnJ3Huh3YpbyBq26s-<wc!!kLZoYP|u3YDhvv#$Y*LoRu
zI3g|klhd;-Crz*-Dh}n<#-KWmS4%7o;?<JMBY3s6>hN7HQ6IajD-7mfT|Eg$>T2(`
zzQBxDKR;M@zICb)zpsfKpHv43iUOS;*MDo)yWTyL*q7TwjPAk2zRX_ow2mkC<rK4^
zC##2+&2x$;r~e=W$Y8?Q*s^+4J=#kuLh!DKydno}TkoLm8X2^%Su&|a*PQQJ`jid~
zj)RJO4a$JIfgXUtj`?}|b+P)Uu{nfhn`{P_dA6OKII8U^8{4DwOO~!)J8Iw#9Dg|=
z0iaf8vNiW*Il^DpX9x%E^-%z^c}Im=ys{?IU#wnA?kXkgrMz9Gym~2rSE&YGq2F65
z^k-BmP1Y%`*qeKiL=Z*Fs<_bTe$|<xrv7~@yH#Ct>N;K3Prm#oSl$xrb#?H?3KR)?
zCpWe7)d3aGyX~tL2GP!1oYz}RxPMaZtfn*j>&a+0k~*`$p6>;_>v87ot&^;ma2QRC
zgCWKH5ND3d%($HymzkIFD0FUIYuUkBP%Jrj(acF*94eYSv3|5LTt*ZvlI!>o$X|Z!
zo|La2{W`6k2)pA9eAQ_1OdSatK#$lJ;$rL6+#Fcq!-+QTO+=JcIlKMw)PGd4%++ek
z6At+)E?OJs$$I^7KU0!!;`c!}$@=l+q<QQVx9D|FC-c>MO<+Y^u>b!4K)}5nMS~}&
zO}l@`>>r#qk?zB}gK~0IG_(1q^~vrFBu_j3fd(%6*2iNa1h2!%X~*r*q=0n<xW%1t
z&8Dk+;GPb~W=eCz+DxAg!ha%vV58NQbT)4I8`6}>a3khnYpdi^=CHH5M**(w&MaQ!
z`VPT24_$R_RJTi#oJgKpPLmy=l4F6&7ngT{dSk7hv0ujnc6ZPIa@>Bc7PDl&15|e0
zUhM<*mt&9D-hLf>y!HWmC0-p1m|+GjK-;77nruCO5=Qe&o;?i3;eU{Te<Fdkz8xvI
zxX-z@bB#$;B~@{K(jm~}5$NA4w|Sm!I`Af&WA4XO?HFHo_T=tRweXm(9*9RHO0<p6
z>ZBViFP2wzY`o5_@jA#=`}_luY{^BZoq&k`Nx~r4WgqJE*L23jhx8TL-J*$@rG_<t
z;j91mzy8lF`uV^3`G0r({O?!I5es_OR<Ltv?IEDG9G+z>TFZ+wUdRue>iU}1o8nN_
zVwui$-}V8fmL3aNU+Y?)`N~V0wx_dr`ehZB6A3DVY%oBrbG2?eiuiwVN3jt4f1NHo
zPUNhk8oRA)?c1>A(~~P~kV`l%YW1j79YT5fe;wqHN2us7LVtPB!>&83=pEdElUnL(
z2leBTDZGnJ>MQJOUHQZ5D)D{?)90f~HhU<Pz3ZfFbXaC%d;#Erz?zqI-xD<7-2FVg
z{4|;zQygf0N}+cq0%Y9>t$nD4N3~nnlv~5rC*1E(1}+EJ99Fo-1Q51bi5cZ7t5)E)
z4(8THTY^D4pMP*vd|#M%Zv`z$=qfF`;}aprT;AN?9uBBGe>5c8vdgRg`RaIWH|3LV
z(~0$H>h0jT;>lW;M{D`6L8UF~DL}<tK<cTeRTFrh2tsL)e4_T358gO>S2s0hR(R*c
zR8Ps#`N?T{qV-DO$J*BCJ8ZEPoiCJ({IDq-n8Y3}s(;GqJ;T~$u2hhU$Nl`31bJ>s
z^f1|-6$@iXS+zSFj~VFwAGGQHRGI02?ZYO$Ujo{-+M1stYVN6hU*0-qciXI8-?np1
z08Reh(>{Ow>4Ae)_t~MD;;L|71+`N<JZJ6{%nn>9eca`7rl7{H2C()t(|gzcW?C9W
zcCfqWQGY1fpJ8H@dxa@p&{5E{*1I`PnX1fh_Z03{Yx77$+=Hk;*-3qaleXQAr&)f?
z$<cNd8fXs%vFjUJEg)x$#Y2s*y~fO1;(g~fP&rzE`F7Gq`}&mCFF!tBA8XsP+9OAh
z#>tY8XB|^B&`qv;RG}s>)0?NN^TcY)EkYbxfqxA{>pL%0!Y{sx(%=k~DTIh*c-o2*
zpbRzg{lGhI`{jG9z(L-dQTQJyGZ=+3a!<Ry0?M0+i9Z=NFvRCZ^hZNaJErPhPz{@N
zZ{>o{y~vPe+S_bRV;x$>DWTJrUe{Z*5D9y6(NZAl@%jGK-i6dlnTm_`HmpNPi=ppU
zH-GuH8Bl)IrBT4l0{!*0zI-zo`fHmB(VtnH6g!)*=0<lO7F}5N&TW%h&XhCnOq~V0
zO4Mk%v#Hv=*@>^7KK=b|OrhGrt6tLZeCcneHlcQoYca3tq3?bfXw@j%m}fhw+?Z~L
zM0?LLhi%)VG1L8W6uaPE9QvVN&E{7IdVfu<$MfOd9BzergroKzQ1sg`49q%0teX?|
zknj$;zZ5RJ$B18d`F~pgA1&@35Y1;mE}pxOi)ZZPHn+C;hN!j32Mc~);Q9F`(&PxR
z4iC_r9AW63dxnfmSARZ+fZMTpK1r+IleDUyqSZq2KElH69nGEa9=$Gm)b(AO=6~Rk
zDp>QLn_Y_k(;5sW^${vN^lZacAW;olg~M|UrMXJvSzL~02RZIu)$ULM<jDI|0p@_)
zc1lT=%RXzUe*<FC;A7(bj~Ue8K<?2&X~zigYGCx>pr<E@VrnAx(D0(8#tSu3dT1ce
z5hHV&2t71p=HW3g4fszUoYLeakAI3#c?86#Rkj-tpCJ^c0q>FVFyBs~NuyVfaDMKH
zHfXV?$GBGyg7B!IhTbrS=EQ#RGWtU}(i^lohUWdqlMW4h9()|*iST)PBVlVep3;Wb
zqV%(YswF+2;c!0&PikJf6ZBIW+I9kedb8r4pr5VZU(L$cz~XsKjZKgbb${d^G^WpK
z&1{Mc4~+pi@LW|3*fFh#E#d0vnm(!}wWWzYS<{b+4!c)4R}<>vLa3hBnAwZzQyVY)
zfj*_RvI+6;+4|huldoce?#JZ0?a&P@p2Ha31Mn$ByxQO%7w2_^K(3u~*VCBgcY`~=
zfj+a(&+SRF`ee@*lOkd*-&mqhHeSrv_I8yIE&6%=YLaY{VKz(7)1THC=YPJM<%93N
zxAbVy<9z+|57W(NIsECT%gamW(sLH8^Pi;ax+wgEb&;i)|FpRJ`3J<oNPIZvhwr`r
zO!boyuql652u;|lZJz%8Lwb?U7n8{kMMe2Ga8wvt^kfxJLar4*3RnNP7Oq{S*uwo)
zgpMygE@{abA$*|>c)<un^d4DJ@otOY2Wy;X%N7m>#h=d2U!nv(y{fK;oF(f|wGhM>
z-A}CYn<}S=m#nvK%*L+!J>T(k+LzV|*sqU7ajSn5Et_J+U{&y}nJpIcuP|ZC0dLKj
zJ(IwZGO(oMx?U1HaVRYPtEW=v$e1RD6U$(1drs{77XO-O;X2X_G13Z_o^h>2k!M~w
z-*Op*wDhl@uiUr>lu#Yl!#v|Z8U@GmLR&gs5GB+~6k7V1Px{#;Xenh8qw)wp;ds7q
zVikW=@zC=q*$+Hm8U^$m5q?x8c4?wZBui?@^&|>-wi85ZY?Ig)=pW$-7hqkfIFCz>
z9T~<pG!)N?sFHL7&(}?BFk?pvD(}aV^QjT68epd}<qitnK~Z#&`^Mdz`Bc;rz7zN=
z37t4lmi{d$C4GUV=tUR|U-7spAH)k{WUGJBjvY@D+}IxjdtaJgLejT=Ck%b$=~A^-
z8W2f|NYrSc_O8~KwMy69zmr8;v3Si>qdLR4B5>g(u!4%`7O&<=to$G-V@j;raRZq|
zjvL07{xy@(a=&~C9XD1MO~2^9BDO&6-HF`jJ^xyq@*bHMmwQ9iRb=U324Yq9KQMnB
zONe*wg`D;S6#zRUy<0?7ht_3Ib2SPXYAADowPf*c&M7)K>43GljQ&M81#uTI`b{e8
zu3dr-7<6DjqrWo-YBK_P2eNL@ptK*fWk54rT14-py0GPR7i`Ri4<e!!s0mi@U2b=Q
zYplk!=|+@Fz=%~l5%aVX_#b7>vc`YDvXd3Q(#_vi`l`zpC(eGb^p&~o#jH~if1Z+z
z{__vq*GBT+7TLU=&K>{x2dNi6Z7y<3Qwx7{TF^5)u!Efbz4)=^`!W9zgG*y-@tB&y
zwO;bz;=1uUX;d$JWJzpGpi*gePpo}P`*AISRHk|YZAS84P=B}Omzj{Zx=?=~BFnp=
zIYQh0RL~TO@t3xH_riP8(`1vLFILwteVV9ga1p#yG}wd&o~L&3h0;Ym!%IBNE97)i
zp~^R69PUe=1k?0lwV1#BZGI+v+5z-7@UpqT8PS)&xzA!fm^`X~fDzp;U-od4vgPM5
zUp$+n7uh(aKkHAM#mgSj51xPJC&HMl1yp&Guj&bwxDalYVAIn(Re!g|ml<u<{#3X#
zJA$w_3-J4b=SMopz6ReufBGrWa;k(@Sd++M9+MYw^$rn!+IY9+g)JIx7c?VX$BSrl
zcl^jtq(h>=Q&`re6NmisJ|;cz!kc<uK8V2ba}w`fvTvlAN!MS~pZ0%z6A2!)Le<02
zD-z(VX{9OwzM3<{V&rGrb7-p}buZZ1u^oJ-R}v-YX%p9WpqD#8rfITz*&-tB#V`Rm
zekk9=mFnhp=)jqyWc0?j{9+q|Yu0sxq)MV<;3=Ve!CMVa0DM6#Pbc4!j|L+b5ZjI|
z&v8Rlx><y!oH&YLj+YF64*w<n^YEZ-`e~GtytFQVd?JaGF(BfRipCyKDEX#>P{aNO
z&mVjt;brp=+6bmXe2CeM%zq>NCDw4^xPr~g#Y2RL7d+UrB+LI0;)K_=EUUI<*=<>t
z{g!39Epg1K(H!=Q*#09(7PEA|Ek4NnQdxrnYY1RSmgX<9hL>!(n5FAA4VOL6R^$9@
zXco_ZXp8b7D$<6JkfXPPHuC^dWDs~9D4?v!kupL!pXEED491@0%Yal(-xZYSBRWdP
zR0nZOzM~>4z!!ZvVTf?8AclA$1H>1&GKMHZHGiezfgclSCzc3Y2rUtRdBHOZckX|!
zd8EC={zZ+qBl;`Uv1ae3i%6}op6MbU?0txTBAz4En<~dAc{7TCIDBqalkI+!_2o{5
zHK`)w>5FD6Bv_E#5L%%zQwZ28%2yk&GeOD?=^rmU`eZ##Rxf-1z);J5E@ea>1bYj(
zceP*#4)jhh51fEF6JlH(c5l)zy}so6vq`em`lb8BK9C3yOl|+d=bv{W{gX3g3-Oy^
zNAoMlNjPa3vR~dnZ<6!%A4KJhE|eoeSra!LzX(6gNyZcqG({p2oytGD5G`~!vfSK5
zJiN`noidPH6bxNxfq!bEOAM%1P*Y&p5!2CMu`$IY5d#eWCM5Dmi+>6*lg73z0brB!
zwj_TlNo!RB6iA7-V<(Qn3lbHA&$J|cWpO1e<3Lx#nH}E+xAFNvj>NG7(r9ra$Fxcu
z0(Xmjwsl=JqcgdgxAgAeP(Z-veK1=HJ3jbAU{!cwGjy(n210HU4FsFAl~7ITQRRH3
z2jTf700~C|y!4E1&GD!#jud=$ZO8Xi@g9HXq(_G~em*;ji;)h^e>e1izwcvEjcBLT
zXB<4De*rFNa-{I43P>dmVQs8@4h|_%4h|0ZIE56dPRnC-4V*d%q$6-FO2&>_J6=q^
zp;!DR)INikd(u>OgD)SLlrR9O&)iMMoz%_<q@Xbh0|FP(Uwx=5Ru?!9NaT}v7b<@!
zbG%JaZA$8@=c&(V&o(6^v;hiGahr={AgCoS0MIJ5%S^Sg%PL<!KoJ3%K4X?p4`R<l
z2R`Ex82U$KbmHIwL*;REKK3h{Q$OpjQbF5P!?7<Pv&I$rq!%HnGf`A=1>X!VWyZm8
zL=+k)3^IwiXgCJ_y@>FoSG@7VjK+WKt73?DZ8WS?KkE`a(z@!4l+PN>65qvMtiCx1
zBH}_sXn{o}#F-$!nAMG=wo&AR=LkQ6j}HG#7LHEAvpB}`*MqJUl@D-6(S`3(`Uy@J
zS^T3b!Nf<LAR*o?iZtSdA)jL;2oX4R)jph+;TysS20kY&Ww{_U_&TDDVZoCVxe|ZP
z#&AgyUkw{jEUG0q6$hsHv{qrNa^l#7W72C^z?^p_4uG;{Li0f!T*ZOTSb<If{*`zs
zS}DXsYn_IV6vwQHnMjlm@vq?At{Y)d5dc2(Y`}UbE_HGGui(B^57HwJyGqbJB&6Y`
zHIHDK0gk%1Yf+B`arX$UE#_q?dr^NO&M%2L(&4u1*n3^%b!Wj0iQ|)c9fRRwhxB-#
zloB>WB5RkTnxM_e$B_n*)w@H0O@g+_v4dlz0wjpM$fkWORD2dSwrSLZfT~d&)j)XY
zlJ|j{k~rAv@qR8KnA_NwFbiFp?)n*uK|FSCzADs-{XnN!^<3%`pP(Zg*g}6D2Ra*C
zg&bpAcwlZ+ne~jwE^|dR3!OOhEmz~<9fX7b2pm)o4lkeOF1DlOn>tntj!WzmoF$k_
zNfPI8PU!pZDDBG(4vi4w<a^;o3^qE&aCsqQy&#C8+Xgt%NwQ(|&b@$)7)@#8=d+qY
zXzP5i>)&V>kHabPyf~EqI-`FaHwY|l^BsvcQI7K5-qeRr<qMwzr6ih`B*F%sy6~}Q
zPX(V}f05pm##A{=#_4FW`1Gw!mYDdduq1q80#a!ly(88tNmT%g3#YV@Lv?{YIvQic
zChozWnTUow4sn{96b$`5c9bhv0`zHY6?n1=Xt%&^3s!L;7&`)=*}s1vagR3TA_p5a
z3HTf#B#D2NEFS?x#HnN4Sb!~t_wpEwi035nSvMyA1gcC~Cm`7&kP@;3ZO)2iev&t1
zmK<@6IP@h+q>^SZ@jVgeEX0DbxgI^sNGnEaimMY;a1qh3|CaU+5A2W9ya*IVz)~3V
z6D}uEW7uAZcDB#rCn<jb{NI}XSw#{R9b@|sBy>giFa-%nzNN<jo<|kF_{DIZZKm7N
zx3&~$a4;pt7(|aR7U+zc=R#;xH2jbwXj<UD4}rkvu|u*9i3O3=lMa9VFr+C#)5(Vr
zg{>E|oxnEhDqL&fc_hM+datlt_;h~l@vTBI8;h0ftHv!K@I`-Dk7M4=p*kw11;>yy
z-{JvVx9j5-3)W+i*$e8=RKg88!RPA_V(jL8sfmgqpwfyKE-Rv>R<RUKxx~_ep39eR
z1Ob*5<Zd=(cqBRLXCGIHuw(%yfF2v5xK4#vrtnbJrN!;T$l%km5`5VT2^wQ9^tvvJ
z5Dh#>TOY=x+Sz}`ZV}@i5fZzh2of@I;6tF~YeJ}TT3r@rU=Kt4KAMrNZb+~8NCT(9
z(un&wm?|uL3KRw+)LY_k$}$F!SXf1MObCS$1Lb^P(GV9^i04=mGsI;lP9(I{ga@f>
zfqDT?1VD?;BQQe8iDEufo`7Z;bmj0ZZQFi8WvOQ|8<Kx;E0KAUJY)O$&L4q|<jJ?j
zMrPPci9Pr+wi1_juPAsAHJIjXLfa+%S8P<C7x45=a3vZ3nG7gVKIwX;!U*Mz6yWy)
zS65juKeC+Vh3~Zy3oDr#p=lOW6`(SUPSdt-x>1(!02=R!wL!V{T@J2=#v27mz_OkG
zE#fm=!8d<;h@AdmcSi6ptw52}Hp`(kp$v199auAq0uL?=?EM~Wi7u~+!Y=~N%|euq
zigDo(72%4k22w>Is~RRsL>dcFQvjpT3JQ%=<3q9w>2oiB&S&%WCOKavvu|wL<3b%o
zWh-n-5?VVnT4?_=fU!B|8>$jwjbM+3hl?03c&mRGMXem9K^}v_#giOxE@3Qyyh%;t
zvM4tU);3=?L(CHPQa6BEIac8sGtpxCl`t}iW6Edl9U|fjj2_7O97+}oF{ZtUHsdIE
z*rcHRP~*i&wD9IM-Yg?*5HN1=4uVC*`f&`akT0<V!xZ8NjAG2lGBUt*4FrL<?j9_u
zZp3DFxG#)gh~3WT7VR$mG;Vee{TMeUZ#)KeHlwMu%uHzdzTh#TZHlnNh(XG*dDkJ-
zY~T}(ZL{=9o&lO#BLJ4d)+7a<wnkWwvVghVHv=wu#x%5h=*ejj=R?YeiBHB#qiQqO
zXp;fI8h=Py%*PoaW$}Kh?J?*8cK!&$1&Q@ga?t_hMv2GbRdwN-7qJn|Z)G^(Q(g#U
z1q2}6u||76M#2TDAS-dJC4tZ-H)Od^@rebPKI;@FnMFVO5ma|!@-?c0MupT6jWiH7
zt&^A#fZPH%7Q*ZeTs7KFj4>Tx?u^G8SHjw2yMH9m)^bV6Xk+%FN9=^ssD|ua#<;p1
zKIwXz;s#ZEQrOen08>{4nC@Wt)FG*qZW<_$;XxpLfu-W;KEe|Cu4!dZd6H>(ML~@u
z^dR~gyB<wYpr)G|Yt#rywiN?Oh`3fkE|y-KINH4MOM3gPgN8izmYD`{-b=`WHlqj!
z1b<PKh0O@zql9aBZqUkxQVK*d3wZ2-G7k<=j+hm~Ey&9bh|(0$)C%J@54O}ZprCLt
zBmP4u6A~iER;h3ND=tIB^?D&6r)lQt)ulYXfKSN}#3a3#l~P=eM(E)r41P^BL|RM(
zS1Qhxmi{#jaV|39e1cFNy(#Wv6DGkD!GD|LRyJW3#a{g8iw`WPlkA(b_>pj_NG!x3
zU&3hN`|5(U0Y5P2UEWe?jl<f_E>2%tzFCEgd}AJF?NBjG#4|BnFTU`>^xws}Z}PWz
z>LC#30(-fb!Ur-otcSNh-7>T_{Y2~{U@?!~x)$8O=8@L7?_UH^d9)iAGA+rTiGS2P
zpRuZAlfrg{U!U`orGNEg<XrysXMz?EyJK7tzXJt)Mwd3DFCV02?|}P`3WegW6UKV7
z!_Upjiqz!`s98$Bb=kl}Oe-`h7OGgdVGq<5Z;`7<#uVfy0uYMdxS_Z7&JA-(m-8Uu
zzI+?!=P!%-R}LucSsPHhLQ-m^D}Tneaqf_&0ojt+J#XDOw@5<Huf%o{58#85mXB+j
z4HL9}sHT9~!DYz@(FZOhG;T-)wWnX%DNP%Q&nmh{f@T;*Z=tQj`;9a~8zf>iB!Uvw
z0PnE10|K*0MPae<xB>W+_!MOIv}QXgM;MTV2Z$OWgHH_MxcK`kmI76cU4IS%!INUk
zD12TJpFCG`lm&c1M1;gqk)ujyn2=bjq-FY$w}e__6NA4DeZW<XE|OV%Q7~KRKWp|n
z#T;7!v51dR(CVSaX=e<|#_7cyL+pk8KpmGH4Wh7dQM!PKHui91tKeH~c^@mE2^Ag<
zr7*U<&9CtUx19d7hFL_hDSt;-gm6HD3gHHytzrWlL@J5u!t0<%+dH)Q7$&X&qDcft
zw9gx_goNs1pXJRPm)?f3iTN>fU>oj5HcAUzRI3DA-hzNA9}Azow(yY=7U0S%WX0AW
zv+df}vN(hkp#Vif6633I5#R$M#pf6vpz9OArtKa9GAw%tKVTgKQGXKwY|PrV7#2^V
zCkvw_<aMY9kVajP16}yqU=ob5AIOlVn8yY#3^q?P1;SyugwPZ)V<Q+fg=b`4LKXgD
zEGp7>{D{>7Xi10};u|~>`#~gP3m#PuWPpK&q{$XKmql)EP!p)_!M5j#7-Bpubl8s~
z{lwawwwbZbG{k)Zuzy{$jgcK)G4}|XUZk*(NMT~0ibv8MO#>j1$Cf^YX~udb8#q{+
zl$h!)qs3A$ys-S6`z-g-Jc>K32XeLl;yM3n{WSuF_gnL6#>8;WyfsfG8mNHpqecXW
z;y3{M{mmUy4m2WeoU+**4lrLnK(!aJw<-Z8&|^!q7J8Az{C_0&-+0C`fZsAV@)$Ul
zo>W>6@FjQ)2@;`LBZDVu%=4NQd~WN5z*W7#8<*+^fzQTW(g5LNr3yl@(ke7l&~Lwi
znT_E};6p6BfsmG=DqisCMIMT7%))gxPcGAJwD{)cqKmBx1Mfk}^kAz%SR(E#&^I8v
zxE4NO_0ZLROMjeQ3@{O#(C5Kd*uz2vHlsKq2OEVK!xW|v`$LW3IS8Tbx&r0_9Ab2s
z>H9FZxGJW(6nZRwd-0bKF)Ql`y@V#~Met{^y@K}lC<0=UgijwB1z>i#6CRO2w70+_
zrC77|aa%mw7ksvZi4b}-8{4=j=>TK6V`=M!e+&@=(0@`bj$faFheJJ<*k0fpmL7N}
z!iIdlt3JjZ^dJe_deCRV<`#rKLHF=+7rnst#ij-pX=q;zIHE}r6+C#0*{uSZDFQxU
zW{f2f20iDHOq(x|z(z=X!e=!dDvN*`Pb>l3cgX%b$#w<y1mR|Ch&y9!W~A&WgpFa>
z@)QmV2!D?^<S-_=!8XKzq=J&1!*(9poMs_k-w!zn0gxVI%UI@wg+{P(3R@+~2PRfB
z#6=fu4^q5UE0=Hdk6@S(LbAO~n<OB)cx-<1#@e4AkYtNcB_De-X)S1z2OTlOLfgY2
z4~Oj8V)Brf#J?fPf{mXq;*X+;H|)3Y3-aMv{(n{haZ?$3nh|*lyDKDc&;wC&1U%*s
zCb&_cU&bWEczm6^izbOW5gY{ig`_sgDr_YAz=L9}d}VqFHjA4>iOC@df%azN(%`<e
ztEUjO8ps6kwH&Woh6M&B*CCyR^TKS36wLPoF^Lxc6b3Y!vG8OvwIDFU&8gQhi*_Wz
zwSPd6V2^M#f)K$kTm&RqNF(YCMwM|bV+;couv+eanU%p*___h2viY+LeyG1jp@Xv^
zW3uy<1ib_n_PA^*WHXr?iAFjnNyJekq<vWUr@N>0F==7}Uc!0_|Cn&TSV3(k3AWjm
zIT$1S5JrHQt#-^6NE^`UyfzaIGLLj+27mT2u#&p@^0%a%+W6MCBNLtDW5^OjgK<b$
zX>sv!4ZknFH?1taq)i>zJ@{8=;aPIsDSo~%TNk(hthcBJvn!K-F9I<74i2<2dFW>^
z-uhR5`JhX2Klc>e(YV{LQo~AK=<c!Gk`IFID%r`iYkBXutsVk12EDCn>Iz(wOn+*H
z?1xb=*=b#>{^m8&bc0hv!5N#bqb@Bt->aZE$B%P0_}|JdwuV^Gp&eA#Ed#!O)1BQ{
zw9`$~zMdkx(32NMM_t|1eTBV5i|&O0Utpl;dpS?rQ(5g>VrGr~0XX0${q~&I>@K7Y
z=`EXe^j^(Aq5zscyos(C=CDp-oPPoz?jNXWg~tQiAU5&%Gn<iIS7?)x8?YTli*=Ip
zvRHKXQ^hB`_;*a(c&u0t^*Q#)^-MnhhHF^9xw7=_D&3#5c$h<44Yj|S?GyymkD;dG
z$}_L{{7d;Bpc4={l&G@UzC(&5LO%j_sfKT1q>-$xaF~TcXr!_X%?N7_Hh)3`kZ)og
zbyU0v`74XqzR3rbKZI;Di%7)ekG{az6_DI116l*h!v{oB7xD+2h$Jr=pBI^59kGS{
ziJ(zl*oqgMDndT_UKjq942PN^2FFWqjsQ_-QCRzijpF#WAS6bL;{1Im*Gu5=viPTH
z&}I43WyN0yXyI40=~@b6pMNEr?_8j*Lknc-qQJoGeNekV@LO;JTs(u{cD*9k*S{~G
zMQqYM{T4%7Fn{4+eZv8uW*+i|5cLFpZl%yNc+)E5ewpFO8w}yl@*F<@BKZquuEdOl
zbv<$XQYI(G5uQ6ACiVb!aJKn-ICBDfF2_*v?1m9MW+$%iLP?@^9Df!1bU-W!nk^O=
z8_6T7BPnSG#_&vY5G2mdaeM({1YG`h9Ku2nGhuUNBp;82(nZ`7%9uV?qHV_}G*k+X
z69H!&YsDP)CyzhWCQVQn@e{06nEc_O-~cnkbqKgud_L(Z;cf|)IoBjr%x>z>D8uK$
z_@n_}9jSaA(UffO6@To-U<bcqU#A;!oH&~RbR-!cAcK;u6S)pr_xOyfjQIp6_&E-j
zN~KK#LEwG%O&269tZ^JMS5RY*!(9bOjw?QY$W{!fN;*W=`y;H}`Iu^a{`{>iU7Q(=
z*=0rAbfRd7bqm!va@i3O@Cj#}0+hH1Y^;x*mQ&IX%tPb_uzw&!@>4XXl8;jR!Yt}v
zG1|)H=x4<02>28v4m3jbhj$ELa`XZQiCB{WK}EDJ#}!sm^M77^(pZqO1kt$i*#Cn^
zoOkx|xiw#(S77IktUq&zu?k|E>M&J#5xd@FU>Sx&oAMy8Fsp#?3E@n*A1(6WfKoWl
z%||9;Hb~IYf`1P@!ZB;l@%5RH2zR%_$gCo?g<x~o)?js3aQ$!&B8?~u=K<j&l57xj
z6hfpt5If`$DlX^gC^SUN20GFSkRy&!*MS9Iq_`V!{&`F+kL`8nk~VGVSUxy!nHZKP
z27gErv0y%1$Gn&+X)`5X{`$;5ZN9xTN4N+Y{%*;hJ(GpYNECd0q7{D;_0O0^1QuC*
z-7))q2`H1{%N7MxU?l}6ll;pue_VuQ@@fgV^K5kGKpq5l`RpAX^T||)y_o0*A3acf
z6$9MTpp*6>!`O~p4iP)x7f>14vTX4g78Wstri+A;6uUErpu>WX0fBI@qw^r37{QvT
z!^bPe=57T3L_my9mM>(qbv>lO1P@QR2J6DU&-Qaihe&dG1I*eGjo4(*f5c%|KIlnQ
zefejoHka9ElYZr|%k^%&q|#v@aFq@Yk<g|Ef-G2HLQwD6WnmTW1P+l=Jhv4e48ZRN
zBslMl!1}WEZ)t&~t=Nl`n6@B`fAqc{;?N$StAfHEbIf;PZc+MTHe8j&;n!9XJk7yB
zZlvCDbh(Z(FNE(HXE;O<e*%@Dr>ckegy2mJmc_?jaV=$(0Po1szeWpiu}&c8D>Nv%
zNm-nXjIcK;#1P=rM|D+zXM&>zDewrp=3wzsOJq|Q4w1dViL~l;yEYa0e(jh)N1XUt
zZ;oI5`nXKT)8s2(i{4!x5zg6KEPlPk6$j?o!r?;2mpWj6k9msee@%`<CONu*)I};q
zLrS|A{a4IX$(Iq}-h7Tl(oxQ|OjyH0G!7IgJW#<gM>Wxm;#dQmDWX3K_^nsEr#O<$
z^;Hh98f$){aa@Q%h8#s7;|>W&^4HJHg%NoO_vX)s^KCG`;^-NiSmKjMaHjI*0whSX
zk4W+N(FHtjc0fB3fA+AD;VL$<L=kq#Sf4aTa>TJlaER&fZiSVBTNr6y!=1n8`2%gC
z5ue3_LK-OkDha}zN%n~K6Mm@=4hI5>Dzw{Vh0&W<9^`My%#9Cr20lzptP1M}`SHul
z*WSK|LhaAvfUsyc*crU77=VC-dc&AUkp%=qi3!9f={r0kfBt^FKIS4JBLtB?v4vFJ
zri@spSV62%zQ^Zi*v&2B#)~4QpU1SXv)2}`eZ(O`B8L#?c|iibJS=W%M-&!+qydM>
znaR?ObE^4<Bd;M`_~2>|e9wa8TA-#go%ysRpId;~08hUNL(F%M93Z73ad6wFCYCAb
z6A%^Cf8{cPf5zd((OVtc4s)c^r?}x`<_CP$V$8NgJ{{xXmOh%#I9%ytR=H91TSSYt
zIKAq!16@Z})1+sMhW1==U{Ht~L_C;tXg9&>J^m9%GQl+rd=-O1S*Lq_={7Pz1Rwrq
zMBc?5LcxDwQi@=qdOAQl<K>^L`^vWm_9#gR+2yk;f4(=RH5la(aA95$@p~O|PCD`w
zAw>9`Jk3<xDHf@mkFP@$r<ZrINaVEX*d!Tv@0l0*YKrs2xXw~4Xa~f3{}or-;UtiY
zQ$JI99pd-e@(&B%JH!V>|N7!5!S!Oh*^a)&5Ox)VF^eeZI4Tf@D)osCwo~y5C?CPG
zvh}dWe*}SJ1}=|~pWn1vvtUBjfZoCx%_nTxiY?@t19?0yfgMh@QQ_l=Y>8sCO%w_S
z7jwi+<7sUW;S_|4xPE_QreE5X8hiT4yZ&8+QNu<Hqc`L8A=cf+xfd{M<;nK~IS9Ca
z`Ht2v(`>r^)~2q{LD}wGoO}?4?&Pz$8;bZhfA|C=9Jzrtfe#}3JiNM^RJb0<r|~!0
z`qT{@g7gk9Bk>!`zGd&Jq}^WUx+W7|7lcPaW^u#lvp(v_7cwBUkmLKNq$fq;SO?PM
zN;1Wf<#3&tr%>ShQ=}4~q|m~Zh&Ve)O)>7s32~Cvg9li`)5^D1@XeF_6a-XX(6&qB
ze>Tj+MGN}ap>So+kzGyzm09@^yZ91NRscf&jrD=xkYlYpJ~C;JKGmOc_;O>mBSjpu
zspAgVUKFw8GvJd2<ue3nc0TbH8GLIAiGxHC5#Ztst{C!_CulSlp*~d&K|K!NL0J_n
zpdrv9W?@Xh-mTBP222<jo!F&<h(Gqze=74tq<a_W5Pht2jwYq;31nvr9V~CK%IVVr
zF1vXG*JHaE>jZqhLiqj|<lz`W4%8C?e^C(OrEDDvKvj0n=+ovw$Ragg7gs)iz{xR4
zzli4u!wcN%;&C)g=z**pObthOj&aimKq()7uNZU8;}BeWxgaVAQ|Jjf2fW5!e~7yc
ze7?mpn&L6Iuu<qmvZT?Kovc=iOMA1hzxsD|dp>7pfu~%^cfpq#-zO!YZHDg!-@T-S
z`c1l1iShBHAXgmY&%e1SLbZi@&zE1I0K%y`MuL7{;BZco)u)fc<!Z5}O=f<Pt~SGL
z{hE`lA5YBKa_(p`xgJ^-;<YNAe@C>a(x+)M$>!(lT@{M_Mx~q*cU3@Mvv4;5w6l56
zY!n|Y@||rXuTgkRG~A@Coy`~dO$ggOPd7X3nCvE%Ry*mlY83puU2M{wP3zol1?t#p
zvZou3LQMiB%S}czawh>yexuT-(M}3eR=X&^O)^<r?gUXQ(i)pdx_ewEAZerUa<#ug
zk>9B_I^S1ibl#}2nchX|szkHm<j#s^iIYInB@0!mMzZ-j-PrEkZIf`*6&bZRI=4rN
zg#P%GI-t=GtNM<(esJqd7u4;Op3@wE1aUSjvtO4ms~T4)gPzpulM`#T*fi?scgk3Q
zN-wKqyiqGU`CnS;XlFf6^7MbyGVrcz;OSr5IaH_YvmR&re3e|=%603VHd%{hGR`*C
zZ*gi;H0@UBqt^oRWPnTKeCwxbGBs;<p=I+)cD{HBJlHxFw&mzBc;~ujq6O)HyaA;>
zD*y==48CVX1r12&d!WesL!tgi57%V+2Sf4i-xUJl6VXW1xeLf9z1rv%)tLTBt%0f9
z)+%+a)q2rxyW7+bnnc>&v=>@9X4$07zUB>e4s2eqj0S~2x)*?h@uwvb`RKxZT8|G#
zpAUa}2e-aTCw6#n<AgYo<siy`&|FJb_|k}Jnu|@+@nV%=58#iGRE5fFrXj+~)GH8i
z!cLi}Qzk0Q=*_y`Et3LGczI=c^v|{GQ`HeC1CuG~pN)rB{%Nfty^zvLv%!j^)(Umo
z?Jq`r?W#btV*VtU+KaO@?2kHczzAWBa%)=%m)loB=bf}DWasBQh~yG~p27#lUY8O8
zp(r^(zPbmcnyv08SEKQ7h+MNtKe<YLd!`KlVCYfCmWLCo(dKSaHJbj0NVT5rUVgH>
z{9J$U`jUIr*YkFdE694^x}a(jG-tAWdtxljy(qFmeA1t1df7&IFA$RG#;-xNKktLr
z26!)e_7kx~xjI#EowLP%c)Kp=2tHyp<fQg2F*SBgi6Z-XM&2O3*lw^{)v-27Lr|KO
znrvdREWb=(>NqVbXk<|6)`1+h)U(IZFLqbYxU${0hH*t2264~7bM@lD-iyB8zX<(m
zHv#S%{g*uWca8lEA9`I#xc*JOwIN?dd0KDAB)wER)b#S>YUF!=L0(R?O?o&ye9ztd
zdjPzKPInA#?oLo?I*0mur(R7uZ%n$idIT_Iz&QXK4u~NPUx`P6gYp{O4NFSb!u|Yv
z)z;G5`f<3lT?>AP;pH@4rLQUNWH?`Jiub>c^JKmLx1T9Vn@4{ibd#(fPfkv5mdON;
z1z0AvYh#jKWRui?)(a6PgPMEe7Y6dzX*QXp^WRVYt@)}uY3lE@g@pq41>z<3-Ztx@
zzdiVbPlAsxtbk1(_eCdq5_CM$tAypphoJNEPff$5Y+|&-JZb$Yn=KcsO+o@-*HQ`F
zm4MMr?Xy%?O%%A85}GvrL5TD~cX3EMutbxkbnT=)FoOqw!t9-o2SE%U2(fR*9Rx6X
zAi%ykwF@B4sq?-4JKr^x`ZlB9uAc9mN2O;ZYC`XIf{bg`c+=`9(cQZy?inBw?b$M$
zaN-BT>Dw`Pz}Yvg?*`OAt@lB?d$=Dq#vMQp9;3c#ybsWW2Z^L7&r<R(Kp+3ayR-%-
z`hc}I{rY-;sY{3m<w6M89zm+RQX0^`heOB7P(lCX9*@Nx(EW#ZJu*HXc^}}Fka`H!
zPwy1Q+rm~GO79|koC~D}qVRFt1HwU`jv9!=r|5m>We=EMF=U_ki*Lw5*52!p>wr0A
z%HMaM_kdCN92pg9*K)L1QR#p=U<uuK-Sk4aUuXJ%<*|M++FZGN)6!<o3QWtYJG6Fg
zTlJc~@OoFzLGb!EuYPd7p#Y`p{9)qmVZwGl235}=j=+5+(aIiCjqxtXM-)%mVE1+S
zc(O{z7~<^)yN~6>n&pTCmd{SF_Y>_4b$HeGaQ{BuXOrl{+_Qj=v}1H(K5#7Wv3+!5
z`VS(1?LC-$AIOJHp!;zAF3delVUM`f#|!R;$Y#+8P_^Gay4SR)fw%3l`)nNtC>c9!
z9lPzc`>=R2<?TPs(n*$BuV>j@`(%e!pxouv$&Is~eH>Ct_IjDjZFzIP%DCn2Y(7Mi
zg;}c~ZkuJjZdtD=>$S?p-Li2}Hr8clS9Y?0-7Icq$qLco9BYY$Q<I>hF_B`*U)xbp
z81b4Ct{d}iA~um^3Xg2}rkUxQoK2O(VV^pg9jfCznJtMX7^Slufj(>pJe_3gWu9CQ
zi(vK9;_9^aY%f+Bhk&N5O*T&QGOucMC_7-hrvT%1z^JDHqcoUNz8HVHDca*VopF|b
zr&nb<UUafXpv-{7TW281-xk4*o~mk91@NnKNH1;i@h54D`0n>b>e)8WO)5?Zm{Cry
zY{ZJ(@B?Scswtg&mDh5;pv<ku<#s%#*Dt|i$|N_=LAUK3Y<mV@Okd-+AJmE4ZcwEB
z{dZS$-8C^Xd$#yunDBZiPs=A=u3*uB>tY+&q_ZV=qbR5k>AaQ$+DB-uymklTY*m1%
zs;m9g)g9IS{nh<Dst5b42ffw7lxSowZ}?%7t<o_cBA_H)fTWb!+Qzkj>FOrQv-7#l
zNkg5a3;k`o-ehOj_Ii`7HaEpvaU_77=B#GvQM$QIi4V5R)9yG<i(J#oWN8b38l8k#
zd&!`X=y948`eo{pm{rX)sFQ*+NjOzemYT5P>iAji-4O4!Y}4~v0n_n5*&+-gmMvzJ
zU0W~btO%dR?p`2;+@3vyD>1L0P3oLHDk~LJ-D^&Dubk?hF87G3j_UUuIfjUlb9t0x
zt(QzskG7sOs%j3m;d5Nr@_2)PHT#~_u_?XO7OqrG?))5f1&|n^3L(fqLnc!hc`MUs
zm36Q<g~A1yRg=uBB(u`xDl&Wf$?SE=jOxp)YQk!PP*0H4BCRoNdPyTAE#+S2kHV%|
z{l5I|*7^9?kN@%GFO%%zBOJ;fU(@u?R%=>S(=4BSJo)%L3!)xM=pcZ9TJ}kOSj-B?
z;loOh!vn37+aHIe5Vsz$7I{8OR@jWjpX_Cpj?*6R+gXJF7dE9;GRd~I9}tATwv1Rs
zYr7D~=y3<s>2@~ifj5~<8Y)blEr-QuLhw8c5#78Aj_m>&jYhP(()pISZ8rXNZQS;&
z#j*_jti8O}G0>g(b2p?3t+iQBnh@b;xsxs2FMn39matAX+f}p7I$dT-?Y-6)6Xpxj
zaVpRqTKIh}0$MPY0#KCbbg*8v-qSL@ughg_Pv6VDJ|dKvz0@dkJ7g(y3SGD-tA}(|
z9@FsjA7lU-Zk^3yOnM)2CdfX&l&@V5)!I6miOk9iS!G9)hXms2ZT8w;rPSSZN~+jt
z4Sx}iP1oC|^`nkd7nWUH9?jY(w2GTZHyhYpZ#P*CH$#8TjwFb8Hg+_#1uqj^dpYMr
z;#31-ftIxl!zwrrA8kR*#I2L9?SzEX3w<v9rpY-?DC?mHq=Uj6n*g86VK7?|=iU^e
zl;v!a^C$0HF(gCWnStRpAS$7(PbL#}M1LL^UfI*>r#Q^n2j)qJ@h+MiXcXT`mM5{2
z-i`D@PLe*PTZhA6efNsW5&E>W=X{eySBj~f@Tdh{H0NLFx0<oG`3*Co_2xQHhonA@
z+a(sw66rXbC3(BhR1DfFvXkO<QdB3!@1z7~HM6;|9u(3nw<L0v>g(QO7H%^r8h;h#
z37PNCMrXlU(5diCHtR4HwlKEsqMF(N<2<K6oYbTu@5TsO{zVhNBZ4Pqqi8HVQnxor
zmS1L+v$<X_NTyj%uWxjr5=eE~3bx=vtq=V1w70s|3X#S=DZf7~c)A}Geep_NBbR=M
z_Xl-ZgGzK{9!}faf#j%2>-%3?Cx4);!_T@uml}N^0>mE7)|=I0ett~!^o28Z9D+M=
zNUS4Zk<F=Ew%H4a9Tj{r%yU89K+Ll?)8~S>$R7xz+9}X#xm~oTzTY?Z{hFO7oAcUX
z+b5O|GVeh6uYmXSn}@FJHsagmlK6d+FQ>^tfRkeZrVZs@fZteDol|fnOt`MIV%xTz
z$;7s8+csBh+s?!`CbluLZJTrE->2%-*;jqj7hTmC{dM>EJnu!_^2tFUu*ae9uk$8<
z-9Hk@A9?q(osS>?)*y~==H>LEVf4*$u5PHxB#@C}h0m}};=qSoQUGl6gJPC2?A8(b
zE#}YgJ7ksaOS1<P<BfAyuxGqPnE^WU%D`19{~Er^d-?UYjTG^g&{p)4>yuzLu28n!
zp=QL1uW+$Bb>-f%n|Zbe5UMg&^+7O2=e{U0T+3$ar&M0-2bG2sn*oloP7UZHyUEWp
zy85o+b5<@FmfioK1p2=q&^)}ix@EmfAfc?hja4^WG@Cghk}fGja^HUhkOGoK@VXy8
z=J;AzdWE=gPWt0^FZ|FV(@c4evtqw#@ZR|c@J*ZYIN~ps2ReJ<Uk{0JLaL}0lz5p|
zp9o9-R0V~JdLik(X6m)#PWOn@v%g#OsRt-5okS?VPuA$UDFb<45vW?GAU#|UJ;~v3
zB!r(Zo;PaYk6aNLz6m^m3{ebCcjg~+Dj(C-<6l*GjBKd(S$zALz_h8x&rV{Yzm&7-
zz>Q`2_+u5_k=Hc_U40vyFH@M8kK{m|_l+CIP3J+?A`zpWr{<Mko2zRGG_Lc@=J_*J
zsy&G+Q{CUN+T3$$&vBqT6+S~0B{!#A(}6!|@}NuO2KRwI-n5c(Fo%qS{}>={q9KG~
zw*EwkV3*zsA-ri7khmMrs=V-8c9u6S;BG49mPO$6ZkO>pmz*1!=V<(*3My70RxRs?
zG|{}J4goiO*HJ6Fw7CCj3WTh2{EYfh^PB&w*~kA7Ksos-fPVx~{oj8C5SYByQ*DFS
z6#422Bx7e?i)EV_LL0oXBi_OM=4h8qYvRKC$Hk!g?vStO$wqb@KhnMHZWfSdHh1pl
zI5qIJUj0N#z5^#)w0C$J-?4I7^+C5w1((;+Z)>`N&|-?Ua3uA2W#;yzkhK8>XG9@?
zys~nR9cys`&m0{$YjQ*o;rINsm2`sH_qTtOkKcnN+d;6nx%2KAHhjyIlms;q(%KiJ
z5!go|$i`q!wTd6ZD}Ta29tbERH~(9FOMCx79U7SjmjOEW_uNdQ%L5>#_?+{IL+yIk
z()&WqZAQ~>^^1kFW-O`jDHn@&FZx^I*_Y}c{ImM?W7fm^@FQ^L0Vgky_C1=14`*q`
ztp`rLFlKYR?$nn91r5k*4P-p&`lB$|oT%%IUk0Um!N$p#TE(>WNDLe_Xg;%Qy?e_d
zEot~j%*xAJg0k{<q~YiNAGCX=T;uPMERxwdQPP=J`*Z5A?em&=R;A3QrlvelbIhTG
zAsO$7Y17j>J4#WYxt;Q*ZBG{7mY1eKM}>zy2Y(7Uem9#N<|VCC@zKmL>j!hH9`E<Z
zmo}DAYp7QrslkU*U~lev$U0Z;aChbC{#!kTTlCN4HF;W&U)dx|)A*aQ2#7Bm3{PqW
zz4ggU+WZL>KL@Wrimq>vInFgd8*OvAy?=;9wX5jt5-}(}z8xS58Q!^l^uDft3D}Rm
zOgci0k$JQdolcvioua58<#8rbA=&x8zb;9HWAo;AefJZd15aGI1peH8;OA|IzpLbL
z3%x6H95sB!tz8xpj!L|}6P~#8LY^ALEj&CculHK)?q3eCoIa50RWYqvcnLTx7H{g#
zp00L=(_QSzX9(1L9QH$@<Z(Yg_a_c0#IA~nIO260{q=uQ?H}VnGLwjp;PhvfeUL(2
z4eCWO>kgaH04_>qbNVv0sG8ilxjj%K&MHLO+1ot;z8LTOgYvOFzqM6d@0)G!t>nQs
z9X6>XGW2JPHNS(AaCpzV`&^$+i1OE;*-~dg27Ms0&(Dl_DK~dD?*K?1eL#$z4xu+_
z9Wf?cj~ETW*L=1p(iNghG!o$%nteGe&*&l70Wswhuz|koB^9z=umX1%w)lkTvFY-Y
z4kzfxp+Q_f;KmHX+ZBFbJ{bPpbok_@6uW))K(PW&rHa7xY<tG!*3`n64zlF9+`-d=
zZq^qVN}E-M)--P*v~xZmd$6jcZBRB3bG;hsw{6>XfAyk49l!ew8FUF^JTu*TAmTn}
zu|%y290ELIF(TSs$C0h6)NyC6;h8oDgP5Hv@Vu7v^5%1{VZ=8!NqeP~;8ir*=psXH
z;r(7PD1^<sj<jCWgHZazW32a1w=^)|F4lip?rEXBlPDnkPV_DCpQbg*fK%p69t7k+
zDck?DwEjPRJ?ia0JvQlozP5CSatO@-C3pMJ!UvrGZ52<pmWKWO^#yC*?dmRiLc!ML
zlUEAkPOg@lx}>IOqhVf0?`}@+B_(dg9E5=~RVs;_WEf*6Xfj?O8b}Ba5AI-sozXwW
zYC08DEx`8mK3(<($9=NNCuy#BHjNG0Nr&TMFvIt9`9jNxo6I?0v`2rTA(i)*-oKfh
z+6`1v7h9<7e#S`g>@ThXd(Qgy!*lbwq=?UgvQsNdMCV63=KAjX6Zyym+>mbc=f=B5
z?ZJ$0t2wL2A5>7s>`{C53Jq1!XRm~=f`6TUAR%w5s)6oYU#mbgxX;aPt8vbv^t;x$
z?5m8mn{Lw=39P}ojgLRrvT!i>9m%KsA_dm%-!H^R_f?{rV6fGFJtL1qe?3_CP7C;K
zNPGRP9I@-^!t1`e&m-C`@zOC9{V+xus-$;H?J<mB)3|Ilb`TA&tV+S$M|c`8B$)U~
zcBb--h2nt08&*O$(^C|mGD=|)Urft=$iR<(?+@{im;S{<G^MN`qU8!b?QZzgL=2oV
z<Vpv)#=9NZEPkVDuaBZ|NHq;qw-O1`O}h72X(hVBz4kqldtYJ&%G%v7uT5uS3w3C|
zK3k;RU5vogVN+l>U26VP>2e>(tp0a%Ci?Jl&G@Lt0=P6D^!F)%Qc9%s^%xwD7c?M!
zoTcFP4XENr`$PN%mr0|?QL8Y7@CKSE#T#x{qb^P%6T*fy6%}QqNz~(9F)8E;*pO6P
z6q|ZpoB$@d#ZtoAcM}N?tD&(?2UpoP-CKk+Vv9*QJ=OP6I!b`~`@N9pVa>M+bZ)Ry
zmPF1h>*wwh4<wf|hZVeaWS9j=Ac@nzyrKSZJQAlXmqr{{5kvcdKw(G8GXn|i(KLB=
z*ix{X9qHkQo`*52XNIfyC0f2USc^K={{<D;FKuWd+)tq|A4QRvFC!aF{?;=vvp9Jh
zwh2hZoF#^0nO!#y43q55ZYT=Zfxjr-wQnegzn%yJ*{z>rPda4=V4H(t<KcznJ%LP2
zmqRswjL&WLfUqcRYzajA1_9S=k5vS2Arkm@UGMW|DzP{G{gv+bqp-eB1Z!SUmaq#x
z@OOQ`1KOOGMu-l-*1*#s6~`}&{uSnXj*p{K+@47(82+c3DKje%uD5bIGxeX!kH&=!
z>5iYrDt(pkow(#?0<)|`n$Da*PJ?*L05Y=>GojpSzT*b>{`&CJL<qB~t8Tnny0xPu
zyFsJ>-u|e8`B1P>0|kz8jW*Xdmk}3}v{}14!uMnzStdEhIvy=Es_TGYoLIxf@+2C;
zhar;gP=N%FeFn{W|Clm$_il7DC1}pYURVI`9XfK}XK7s<er?+)+i!a=T?bBu?P;HS
zu;B;|Xy<Y2NjQBd#-SlqL`QV`@-m|l6|R86w_PnDB9(Z43M)6g4i0&4l(uI&S}oJw
zt72)8!hO|Cd0K^aV;*i;pgI%st*ZF4uO@wuYlFpINRul0F=~mHfi91j4SxFEsIgMB
zwEi1~$ke~EfL9)5Vy@YOKxT6dS4`=tuCn!KlMu3>$>|yP3=P^cIm-pYT|>_9csx8b
zQ}o%uQme8Xs6A=_(R{#^kUH`}yqPhx){OM!8@qej0fA2SAz(&B%E=X5MTpu;umpgm
zh^hMH6(16)#kB!yC78ap^2W;{=rXWKvfZkVD(qkLMmy&E;6+Ch58k>97C;`UVq@31
zWZJH$0jYkGUK3Z%|NL@oA2|eb4MWKOsS*JcfcavPctO~zM&&x({0m@78<%hI)VDjg
zM%K8K!gygSwjb86Sw`}2)x0ejg(onJYR|7RN>UGa4|Jz%MV@7lvk=e}ak6pSoK-|6
zq&o0SFzB6f2?t$U+lwWqtKz)q3gw;?vdKwTLk1m)gKJm6#aC&3gBQkYIoiZU-!J>u
zBJA&SG3(OVJek0>R*u}ZSsrox=JuSiljh!2>sLp;zp-3DM%5$gKX=0%ODE{%m`Wtg
zy^DGQ_7wbwR5*7_trRa9Cx26(@xGaTa`!!J1dE1=M+b_zi8bF*VDU<BFKgVXA2}@F
zz=AoDhN*HxT|iz%AowR%bh>YbvDPIJNu|Js_gQ`g6M5HJgG;$s-$FU0@>y~U8k=-e
zziS$FLzn)zD3gLt0}smB4KZCj^03>s#CMh}rO0htjYI6AVDw&cIaEoD{raKNfP4{l
z#shTePfLcwe8=kAILb?ZM=NSUV1dY4Q5Wd1dQID_3$FuPRF<aF4k;>6n~7tfniK@#
z5+@)<8^i|uvM`>#Sfm#emA-KWRYnLCK6&~I?r-5Ra6ou+P_ge<1Vt!XJw*Tm%^8!U
z1P_nrCb{r!V%IG%Z#Db=1Az@B56)_e<;?NDu@NsAca0!3{DGN5(hnA0cpa!{F)Or6
z<MvX%P31TQ|CX7V+L?(-Q(7w^4yn-sb^qkz#o^xDKdWbJ>&e@F_t(rX5Ipk$yLWu3
z9hzO#Sm}b~WZKBZLx%lU^y_3~CQc=^e;T~r=J`>liNx=aPk0c9VLTOp+_57mQp8j`
zedYe)aU+{hR1}5bb$x<$OBlEgn8<=<LO_98o3P|_WnT~=nC!l$Tm=%S>Qo`20U+vw
zZ9uvZESZB-`-4fFpzCJNpmqVOV2as%H3aQog-J)r9t-Q^B$lU7Z-I)kDcacQJieH;
z@&Knd+evJ=yg3p`Zdl=4ca%985<$*A)hQOg*7Z=+GdAT+jElDUV<AM%v<<3kM)3d&
zaHGEUrO!06&Z%iVXnF&LT52Dw!|SGY=CjuV!;#X$!jZ=hdkuM(NkSw558=Fp>@W}_
z2^Nwcw!P8N+m5DXORwu_f^Q-7?bRNon;;1N`gwK2Un5@B9##@N+*wca`xH-5!21R@
z#00D!>2!f9{gPy&)flAvNEy+%58&bw%4wK!va#`C>os#6G4}{efGd|U#=x^Hhye9+
zW}Dv-w#9XaQq;m|d#8M+v4Y`+WNq*7J`4zQQlodIIm(my1BTz;iMHPe&N_aQJL5Yr
z$x3)P=aUwVU^|vFLfx^iHL26cr7#$Emu&^$nsdzPXTGbQP}%N`i=GnbO_w*?jy2Ky
z<rHHV8f!-!ZW;`nH24HvE_z6$LI2qu@7}cKa)Z^&iNuGL2BXNgNm(`?a?&IX>kMwo
zu+~G&Mp@f;?Q+4Iar+#yY8B{9--?uEL{fb~tRZehi_rQ4-K=P;C<>#`A6nsxgtet8
z;y`!DkTFi{t(&Q|1?^>R26s=$!^#Na8gKxQNE6!{(U}P(rbvvFEovz$jSixYybbwg
zoz?{{ko*jJ!JDCPi2Du=W)EORrN#|S2KhyzXeR@CXuwM|2)?GRi_YK<rkN?fs6%wx
zXCDZ5IED^!MThUhID5sh$<?;fD8i|;1ERE`auUsdxSbLG99m?TH|VFeZT=O8=>Wx?
zgoz?HT#W>zLYjNqj^EN)t7?34Vzu@AoCyCL{2S9TS<<WjE&o*#=ISeAYBI<gvTnjV
zaHiulVi`c<x~2)~??~uekVQV%uY@*5lT?|x^E5Lfz59drc)rq$&)q*)^&m_kU&v$|
z83F_;y{Xw+bj}`d)vCt58(M<@066Tk_3R?S8m<5?^RMW15*DURiG(eyxQ=>h<a86t
z9pKNH(KrcL?4i#IO3e)vWJ)O)wd2MyUJ}C=PU93_MLMV9&2iEEsUb0Z>?AgpgHcY#
zr9Q%>PQ|3gaP~$;A<3rG5FuFR6b6~32x!@&(;*5F)N2CyW)XyxYet$PfBA?xeQvet
zJTL%~$gBD_WuUNV;mIKXs<ED8vo)8;cyBy(wu4&bMec6{r+jKnd)8w}WRh+?qn3T0
zndwv^_#=<2zk9Vw*?-syK#(Vc$O^}0inLNJrngF=5UC`5<uR;-&@*zYkjl5#yGXSp
zXt%A7ky8b2@f#<*`E{20FkR?Do{tgWH|_ys_~9X1jzsHJ>36XohIVq^Ly=Im`WZBs
zia;#}eNW7F0pl)dz(OTjUeJ2@Nj=lpZA~2i2b&y%icj`niEF#LZbs)Zda!Q9E$J7+
zpZNYMT*oA1-b^o+U5F_5SA?5cN5%I!1_&^9Q3IPAOpuQi>3B7K@sC{6ADP=<2T(7-
z9)IU^2wS2G2Ahv~xM+t~t_>Z+RqdZD2R`A#(e(BmN&C-LCFSN$-Uf0Vss&B*K|R{-
z>;V3an-O}ksB%ginRI~i;*NU#%N6fLg=35}pRw5DDYKms1o4aUJBq6)*a?SRxA(wR
zhh(^nZV@F?^6AS0k3krVv?(nGHpDFuo!ZPE+Wq{YOM1Kqyh~UjPL$F>%^0=}qM-o5
z{4RDRKqE@qcjYpq-oeoGww!jYNjCwuly21%h1k|pDR~p*_(3r4V^TZZWT2tE4}!gz
z0Ny;kgCa$0iL3`X0k*I=M4&+}lfpq%D4S$2LfOy}s7{iB&TuxOtQ-w_f?^L8tYi`o
zw;uXQ#Xq_{>u-`Mx<#nSRUe;<YRK9?lB_SPE!K3O0`sZr!FZkQIF>oL7YdQg9g7@+
zu{qPeudw@<w3{j-&d0N*Jm*#?@s%MD%6Q2dbc(pXL}nH)n>;C93Z?(8PSP0uQe>pF
zZv{mN5e)OZR$ZT*Y-q54!_EmPhc}*`@RtE|GZh7tEND{;Hd!Q2;qxA%23$`Xv@+oj
z+DDwnp}DV~)Sd%M2*kpr_0oho%VaY*f}y&hjA5XY{CkMmJukW^#=90AvV&6U4(J^S
z8fXt47=P35;*V>%R!T#<r_~ohNl^Wtj!+4c>{Sd7CQ3C)ORQo;k%z)SN~+1zXlb_S
z{enXJw3<Kai{vavGl*0R$xAwD;JaA0$B%HRxc&{|dN5G3&4%L;KoHJ!^ej$q0caXf
z!tQim@XH|J_rcFiYMI^-lUI|fHoR_cHz)ht0hROty{7A|;`}+YNIgiw%Zi)d$hXE1
zSHF*uKBjkoOT2J}@q9zT@Xo#}^_S7*Dt(8Q8__MIz0uK){%vSWIZi_-)xt*x5zEvn
z@yb2sGxDuqeM!|0Y}xH`w+V70^1%=+K{}M5r1(|D08htb5<L3`JqQ&?q7mo4-k@kr
zJ>koX@(Y-N@J@(-=Zo0LEfr3mfa6a51E@c7iHUKV>aB&O6*D$4ud;V6Zs4XeqKTD+
z6k=@K$v-x=V5yGt5Fnie`u$XG2i(swcad}Eo)iihA<3;XygAEWTd`H6BkjR}USDxq
z^hL)sEZy8cl`P{Lj^%;GY$g4dAW>a?ANdLyWYSl~DFu*ZG{>Umrfjk1&pf6ensX?L
zQ|?c{VY=cuiZut?e?OGm_HXt?XqTkZd19`fpL3AsxVeT~4hXt7Fp(QtQUoTU$w+G^
z?6y<W(KPW4{MrysTu0oF0E;PSJm9FDl5z$_IGPrkS`wAtR*L)6ApX^P4Y)7d<q(w$
z63yfCzLcQ;I$E2VaoI^$8+BTXSPU8s-WY*6(Hb0^fJ6Y62PO54{2;tjKY*6BJuM}%
zhD|wxiiHXIi5|^Hy?uhPO7=>0)@7AAC@(jGsc4*YDUq_>?UsmSj|GQ4yn=IWUOZ9b
zuM@y+-#{iQ_uxs)V+-xv?DUPZ%+Kr4*SAj>fMr{_)Q&XtZO3mTn2Dm_=tV{dk9#6$
zcn>;Z-k1uEm$np?j4O<!C3G`%ttef1F?L#65ZcTU6A>fP>yz~1BiBA+7revkL!u4_
z9ZDqG8)&7Ykjn?oo~4J;s&XchDCkh%C2n>EvMN82^#>MCOb03aj&U&WZV&ZIAtUlf
zY5@`SZPq`LItEjRhQ}F}OUF3>nP}}by7}6tgYg06WssaycmY^%Xr*#_$fn^qts~_i
zQ|l-8_^HCR#gOw={p-f$l?eQogwo?}mztttR>j2;;sNsLCgB=uA$)zQL4Yq35sVOG
z3@hK(ts0=LV7MpBF3OsgiL)Xpj*YpyRUV7CK0zx+vNwD1O=101ocbrg&d$jr8q6lA
zW!eK+5<Y8-2uVde@-Nxf`ZG#1ZtHhPN#$MEk+)pcQ<zznCjeG^-3Fj9qL1TmA>59H
zz-exo0o{zOOd8sNTrV43(tt|`f7aHNjEujgAw~&_qL`nl*awEdC%DMlMI5x-z42rY
zvt0sG`8H;vSLd^cPQ<qyu(Rl!WpGz?^5hLns9@513Z95Y(gI(@>{dKOGCNS1y3`7?
zK_y5yea9XZ`-zC^k4(HwBnwVG?DBpx=nIM87!FGo&u&<Q+jp8Caou{d)W{-dAt;*z
z7IDe6q;xREqM8~!*`#LN)UbSrI9Bk^BHk@$Y*)b}t^`H`sgILg$c1zC=LMz;wV0ef
zY>>{xN=++Ga6}TZ4Q^8V7mw7@7@ls8A%^QaI2>v`J4k$}%@KvN+8-~HWP?{G0B>^q
zD-)0jKMRqoot>;rTn$aEfKlA~wdIiH%Cs*$EPz$xoa#mcctJcwseW++{hQkBPZnPG
zTTY#x-jCh8m1@lTiBjV%y^S26EYdD14+Y~NE)DC2TQpZA>NbX{2oR5_wz__M)<f4J
zdn>462AJ%`epj|FiIdf9sIjGrX@b~YI*&k7@;~+}ah0P3<}Sa@7Y9>miZ~!>=Q8Od
ziclEV#1DIPDZo^fifzFMv>Ag~8t=;!%F@%9$(l4yOWC-t*8|7T)A+z+?eqX{?aSsC
zo?(~zJLqvz@y6HB5gV5f{#cwdgtv)P8~m2`Kv1g6iTuNrZq6tf`-4{BTxWuWB3t14
zLWU^;g(T%eWIOgepAuxDLI{gNK3p;X9YGutcZzh_gs~c1IEmO+0qQ6DkVPHZKlhY<
z%G^vbv(W_zYAdWAOrROl5X>_-l4HK&0wMp9fhlKGv*uU0HW`aZPL}Ez#UQmJA0DMN
zr0MZ|QO>eq*unv|7Hd3e7I@w^0XwifKrIk#)>p!5Y-E5rlCGx}`)Ku`Af#)A#5%(%
z0v2zSBr4j8zDsMiZT1<=V~w$S*=e#d`#EU}%=DDJU#O%R-qB@GQ%mJ+xQK3f^kVIK
zB_P5kw1R+MZqQYxZ6&5K0TTvw@T1KZdYApPnsva#Itd;_J-n;%eb3sBMgZta#TWY_
z<<`}RZ6+X2Ke%6BJuR<hXvHV9bSB|sA;4?cM13`tz>&;#`2xhaB)BwL{(*`^9oX@-
z%3t!JuqOBmb`1$R&aYt?fG1XIvP>)p(#?Cf+G1_4KD19w^eNr?WJz)HZ#;}4s}tyw
ze4mE<#zgGw-FfF*UUj%S01D*Sj|lCypdD>CoViXv5$7#x4g%Q3ZVpQ3ysbLvXKP&D
z03l>u_4q_-z3!8PS0H|T2>}Fg>6f(+Jn3-g&zXd}p7L}z4zm`MyS^%Zypo;IfoeLJ
z*+_JtZE`*4ayiN0FHMy3{H}7gy7#qOcIB7!W5-9$35bQbWXUeLKs7{4N{S>&Uq*FA
zdt6+`ZO%2~DRld-3<PxFLRIL<9vYcFqGIbr_DqE4Mhv=K)N&;{6#n#*aXnUYx$P!0
zJk-m$>Mdr1Gqp5=erbKM#)&$eB)+z4L8ra@dFrE=MnD4WmuFw%0{2q17A}#HejDRb
z^?{l)B^C_wLmL$aaC6tvNKz^wl^X&Iv99{sY&@jkS}2g!O(eG^^cck=pBPpGXLy3r
zK^R+^O9iT-psDpobEABJ2LO)7Y~A=yKh+YAzaH^2v9f{N6l9Pd+J(rjIyYyUA~ho&
zHYOR6?(3}T(0^R$XXUBspr$e-{Gl!#v_S(t8KUaSS3@xb%#$F0|0Qk=%u7KkkVs6s
z4+OB#U?B~3s!5^z`OVdWM-)IIy|8XJ%Cuw}Ujl;9JRptRkyTSd+n|h0`Rj~R`l!yo
zL_B19Vyn5elDg@6acR4duJ93Y7b;Wubqj};gKeA>h79R(Z_YO8kw^2aD6iJr=*x^p
z9HpXuO)``oXhCOZr)y@Voyi#LICL*R6_d2`a|eq`iOzj1(5=!jgDb=c!H%X{8(Cj^
zE+G5}b}bcm%?fbHBP4yQ^ck@B6IpBb*2P`Dfs3x8DToUnU;RBUj@+E)qV0yPh9{jn
z*b9FT9!_x6IO=p*T*@+>350*jsZ|s6%as}p#gBIgcu}r;?odtr>6!LS;jv>*kE6vT
z(ZL%eu^;bfDb}c%)d5Zqu$1@#_Pa4CC9$u?2*^*UK05r%`V7EH7&F67=Gd%}T-@PT
zGFiW2GK0eu%(cZQPvg`rtqExGB9R?6W|qot{*{J0Q!~yw0?!5emccv^`#_OQr%Ho?
zL?65kq@)f<<!gPWT#yfr1Feq9o2JC7kLcSXI!dOwJq|`QoxU5ZQC1EkvZ#rFNl5&0
zzM@=iARxZZ=|5|pnB_D3bE7oC;qMH|sPzmTS?dPu6fNzmuoDJg>$pY4x9S3gm=S_{
zoiu|TO8b(4&SU->$1S0D&fQ#x#i@7)qf##vnBLgh*eqOzp<?+`5dIn+0wx&;jcH{;
zMUy`~drP_aG%gM+Z7DCljNF~vxXYCCzI}7e0qkwVlbzrzQj3}PcqwT6Vb7On+~n@w
zsh_H#l$aMYLS3iuR?oVL^}u*vIYIT4N+)}g>UY7vbZ>2iD;y^m&4fQ+g=F@?-3adz
zpd6U4cKNc;YQ@lOLUgbBkwBZN9RHbFA?LasHo;Y&+M;f9=7?cz)^UxfHCS=rc+sHj
zdKs_iT$VYgry>$fF5)r7XTkwx=3kK`8T>BT(9y=Xi92hu6wmOBoJ;Ht)-9k8G{isa
z!191S{RI=9GpOs|^#$faR^1LwQtGQqATOQbOs%XBh?)||VTlshU4`2Nzr8?3%4}!|
z*B=U+caTB&F$|$ee@<Nm+LLzzn|FMvTraO&;`W8^d1)}joabGQoq4Qp-wI3a)Cl`G
z96>oFDZ+QhWfi8=&j1<pB6o-Fc$w=&#aXysN-3SW9%@hDwO{xoBk;Yt(<E<AKrH{J
zUx*cXuYGW0{VX>I`ztTf`{Zyk50kg_E(;7sXDcJNIX1vOQbO_$EJv9gDqC1Gs>2Y;
zN>EBIN>zOUF%`@dFdVCPOtzve2!tQpdzIWp<+MMzPKimJ$1sDdt#TWb`lCNb;J^{X
zeLhf#!%=Y2NKJ^LFzlC><VTP_fs-*-78X@>^r4p8nEDO4XzKOt`E-@^Y`4-~f&=IQ
z0%?nI)g5+rYR@72^K3>NXSw(ST>RWmL3KmsmL5d48hR+{c6>s=F$n&UY4N<v8HxF4
z^p9+cq(6{_Q0PlLH{@N)jMbJ&D5qLz|8=&zaP_MF!KkdUjyayFny=Z~4%F7I>`(P8
zT&V5?p>?sp!QbF^9Li=+6SY;;vjc3LDzJh=uQCK|->4F)Q*qnrFKVmytEcRV66l5S
z3^2)>38IvPlHLG^Fk98~bfuhV4k!xkD8Lm$M##DZ9hwOiOMRt_AV)_`<7!_)$rAqN
z=!Oap6vRpZ9aG8Tjt3KzfO3DA*sUc?^kg89dh+DexT-poj!*kQR2kA6&?aL$eEPb<
zSRJwpQ}MLgww#H}TQ5aMgJ+igSGO#-`EkdG9TDqqk!#KyH(fYz;D|!Hn_7lNR(gGt
zv<Q5HOGME~n|o9uP#K=Kr;>!fW1zg!wv823<jp-`f3q^>sl74Z0A~{(WoY?P;;5&x
zLA2$5nKq;!)lb1}X1oG69sK!1=2O0cR7_G>V;z*<$)rS#KscS~ge6o^g?!4_>F?3I
zWL-$ZDcM+X=@nt=w439QR|zE4LHp)ZYdw{s0*jkssYO#%(iEKGqYmffm*oeX=51P+
zp7u#2vrAl1Yxc^tfPC+V9E;eJ^j|d^b|Oe>jWaa{dcRP;G(D=~9R5_CglMe6YLB7%
zRe<?bXCA#+@@sPZ^L#P*4+R0QTMsF@ucWd}{aA|0PdEe*Ujls%^Wl~;z7CkRD&BVs
z#s_SUtCEi=U>m~9nrRxMl1b`%ryBB!MJno%<7OP6q1gr!f#>S?)!NySt*dGICA{yF
z*5)>@Md&k>q_GyLR=HHn=dIhSoZ)m&)RBf8V_sNMI1|iqDZ}_jwZH$w+8s2QBOBYD
z2V25PwV$OVHW&PYl+a_c5@tvR9v3TEjWy73b{-l<-Q&HsX;#LL7T{JllUWU)Vva9B
zhmqru2-J)n0*OiJ@Vak8(Q7d6;9h@g@i8E*`+>A}7vsX*xj;T5_?I#7cI!hV{;VoB
z8(^LfImrTs-a}2APCg$b^bN+kiG;6bj|4b;dV5GdYyK1q(e_RE6z+G4@Q-3_Vmn;u
zyuwQf((8Jzkt&K@ve_JP2%!H<S)lxJda5iizf*8=0OT0hIAeT(PkCu)A@nsWw?m0N
zq`9VDZ7`D#`|YRs_G+brL_UIekC(L|b?j-D8fiyhgi?0wnnWj|X$2O^&H~CU;R)`@
zCi0hjumjg!(E~$g?6<wPa}q=?gzhZteEq(*UWfeB02wZae7pEcZbiJcCM=f`YwU7T
zl`zDWH86Ux$@-O)w|q`$^VK6|p;<sbNv6LIBZuaIGfy#>m3u0b3`0v%N}|#^m`ttX
zTvAOtPL*O!5Y*p%A)$r5QAYC0HXl7Ho;Eo{&IQ9Ce3X&51eGwZDeJ;dpkwmsn^Wh+
zyVvS(<I<PRSVa=AQ>EZ~RgGKXD9daTG@fO-BrpbYq_^Of0Rbm<z640IVCE^F`>BZ;
zUnjRtW2j1Qs5rmpx6b|g8#5th5PkVoAJSHY|9AWlyfF@jXBGS`EaV>@H>9yL6Dy2j
z*G98fuVL~hsvyR^h_M7}R|Pl{H>|?097+MGN5tHkaW5^BN+8W~o@(1@zzr+mGhEug
zrsr!vnj*JQCR&~r@@=ZkT1|oJz?RDEi#}liW_Uj5e9?LdD?|i-L&=17ntUvJLio8<
zq0HPcuP~{2kiVxTtR~#%LFFFP4RbKcHDz3tv;*Mm6!kIY>IXpp(d@)9gWJx<Oe@R}
zI3_q<sE+Nq8-(V*XcW+Ogg(;@5wM_6A>bTb6L{%tpX$QUAb<E7L78<fp>qp4=kHs{
zQ78{7f1jwt7iAl1Quq***f5H#a6{@rxEV@LDu03e5D8hHiZCjW=>T>KkVz~Yku7<(
z{+n!g?#?lQrl)7N){HAUPAE5Udd}wHN1)sUEu`xjb4MVG3nMUG0s;;5w^3prDKIX{
z-!rODrH`9Rx#j^n_sx-saFVDQ!2vGJ4{3nbXoK1wZb$VJ7ou#B>@!h6%mKT!42BF}
zjZ)_4;XHlAqf+Fg$b<?~HI!@!C|ZGR7Ttx?aVD{eRP&BJ|6)7M+7?2i{k)tvpKFzB
zn?F?~Vq0sY{l0V5Z^hD=kQkMND<BE|hECi7>(8agY*LyAvf9t*Uy%_mAqJO|V}%%o
z*>h+&gwAe~<?h1}afn5H@v&%A&8KKMdZABM-jH6A-j^9!2gmmYg?6iJSq&N;$lwh=
zILiVmWQeN|vhfNd8gJp%ULYlSv4%Mbvn0<ae9`%Z$;uu?YY=rXy?hSomcVie%iC$h
zXQ!~7SW9JRgDSU=N|B{L^l>=(5NF|0Rl%KPa$Jf-+xheOgMIy@8z@G!-bpv=jDTEo
zYoc~X-p9MjL*Z^DJXUle^xmU83hyKNagIZp4}Gp}QX5@jBE0&*=aHuZ%Y&qypRT_E
zn{?U4dqc_;rG4|Jgmw)$;ORur02JJ46GL8`#n-DVV}NKPf&XFHJ9uM$J!ta-c)Bz+
zfQd6X2L3^ID3h#!#HdBhQ{x#uf`?TJ;|}>aL+rpO#KjL+&dbAkm`o?DPgaW#M-<C(
zLTi~ca!4k<0UE#o%D<R?4h`Ukp-P*vs|sqmZ%$`{0niYt{5X>zGyI~l<-7`hCIedc
zUs(xVOVLSv>w0Ghn5BEd0N4SG>9sHbVnBNOEDV4H_=5hLQJ*S}Yv?Mb6HW%A+YFQa
zPND|j?5<Zo^-&WYSv-wi@^}`&iJfb-kt>3X&IG^(K|$cxSCHo5Cv?(|IRyzQh&jQ(
z+O034tn%0_7+%p(+VCuQEn!JMaYhCd-ObFLF7WY~V5c$B7~GS5N>4bLd-n4#8u_k3
zA&Qm)VI5msp{(*n?r4S(2Dm%orI&o99?@A&T;8LFLni6D<t`1;UQ1DeVZd%^hUECS
zN-V{l>~ui`>3h86WGEy5KD7vHA9g5@?nKPRxPu$3i!bmifs=e!mk16id<J<j>%||H
z;3zJKLNqhtvdc18eq%+41d+JA0<;tGn)ii)N0uuhn}I=QsBFpO(4V<x=jqS`_k=D&
zpBuGu&|t|r{z&GIt~wYp8mb_8f_Lorz4BYpqC(WX|C+f$L^kE}?oUd1Mi_`iKjQGp
z7(v=_4CC<m{kAK(<CAawG1YV1q+UTXta;T&-U}`19$zR%zRD8jczBLxW>8+3*vx&?
zgW&)e*lZ{d954e1;9IatvK^WkdZVX*g{Tng6w~YB0O)dDZ$5JM#E^`A2T$aYgk1Gs
z)P)oVdUmn*W}LP5^D1m%OI>#~(1)=GkhT{x!eJVuSx3uiW*sX(Q<gc6`jpGrkum1-
zu#V}b9HVxd(ox|5ZGLz<D?C7hqe4zhg+$Dnt+V3K61so9gG>9oq1kG@9my=r4F&m-
ze-g7t=Ux*y7-)EU{d<x5EBfmkR^z%$dLKN1o!1X1_1)vfWqf3)m*7BbBa^rvtZhFt
z_1TMZL7Y?>zDpve)NSmF*=Lj6b5?B^zRv?9SFn)>lUmB;2``-m0e}yXNS8+d@Btdq
zV-NuBK<8PQvrf4j1gt@g%Z|>z)Iqk&9Y;Z91QuB0Of3?x=y-(!He?bCM6Q7O!rG$`
zI(F^URgad4MmTXEoq|(zgwPw3E~ek0uoyackZB%-u;hr*hb|D3>XCvw=8<Z04^ii`
zP56m6Y9h7Jorun*Mb|&{@et?e6R`cni<vARfvNlctWD}y;1cn^;q2aJA-H_96)G8~
z80XlQRMCDv%HMk)A4qwpG4f_ue2bm5THXZNZGSwAD}pdXP;!z^bdjxb1c_j1=}B%x
zSh0{0(s_wM>x;Y5{cZ1;C+c7v{`piao(gAYj&p>YVd8{QrW87wGig#QNeceB8tNP^
z2Rv`WiTrzHr4Wd2F-D*y$#KzG9e&t0E-*Pg%yrRGgbs<liENN5I3RP*5P&nNfTN%v
z!w7X;G89f#kDrxqVrjP=kLs%*#ckX~Jt(DqO@8*{WSM+%reHwFA?{wMrFfyqJqi|#
z5HU@um!h%7La0oiJO#$7jOU?j>x(c31o%z(7({r>yeOEe(`au;$ydBwkZd$c^SRmC
zdKDUy%b|(JeUXzr3D>)~J&^F*?qy^nPay$OQ`>_O(yaR-EIFYD0lxjm!EkY)I=k`M
z@edx^gm&;|Zs`!X(e~z&`Tk(z<8RT!C<}-Il?CyT4PldS(&QEIS8lT4zoh?C<bg0*
zBsmc61WMbGCk`t4@X?olzaC?z%{?A{E!s$Rcy|kzbaeM=s{r_aPWTIzSV2dTL>nir
zKzfgQz@1AHNQX&hB3_2IF+5^l|HcPzBf+c4S>(Z(XnhtsLR1kkp7^2qmQi|#HS9q2
z)lZSnRn||?0BrsDQUraxmnpD3)qx4(#UHFj4yez}Mo3BekL!C`+op^(27tCFVi+RI
z0Ph|0y-Cse`yjJO#1*INT!u$Y12a_~b=Jl*f|pXb{W#S2STuMqHCJYS0<qmP$?GKQ
za6o19Lq{q($k6@yN~hOg8(i6d@G8B!GzFM${mAVso7fvRe2Mu|UpWT?1~9YODN(~D
z3KR~_YG_T6E*4LDTxUUqL$M%+O0Y5c2UJ$y+u-!MTerCGPiRVJMJ^lN_~h>l(gXlC
zf~YDBzLc^$?*&*vGw#c&J^}e4iNr}Y_^r`TYu(#(+~EA*F3i|RvefDI(AN=&W;#qe
zl3}q{`bih&7rK@IK#sVgLj=2h-)#>UBAyO&lOBq62^0W1P!um>GQ@9#byI2n6pJ;0
zJ=M6agtsTqtqeji$WkCA5Y1Eb@qXwhDQXlU)GlCqhZG;Q&z|a%KZj%V_W<jmZG`hj
zpAV?!p!Rw#T4tguTp%xtCHHw6SWSo?aujpk9fX7Ie&Cv3Oas-MXuI-k;8B8kz&`K3
z3_&UzT;VDU@SZ}flp-yLS7WV%vdhXXa-MXwQ`?P16szvrF-(jfAZjS}LLN#8re;Rd
zzFFGCGB^@$O}{8)qtM#wYoQTV;t!Wr)>EdslLzewP0mkVi5)K}C=p)aTS$fx18-^&
z&HD)9$^cD^HkT&cD4mXs6N<N`ad4_+Mt`i#zJxCV3@k%QDwT-|%%2A{Ud5_d3p|k<
z>Z3lTgpVRjFDfCOrIYU5<Bmj<kw#6+eT^JA&el1)HBx5geCKGFnYbD>g;=%|6m#7)
zV7DfSXH;QF$%SRllkT^QkhrtoqT(dnPy|LJIrW{MG6}+NY?bDxN%hzenuZS)_aq5L
zDhx&f4Yn%Ve!gzKM4GK29sTj{Q+Ti}Eq5?0Bz|px)`y6W1}He4EXiw-zSjCeOmSW)
zPTgL4&2u>zcl+PLhH7`*pf)yEW<0^uOf!qflinOwUQ}c8&(OCKSt4$PQcjlIu8`*>
z!z{ADlxFEnqw%Q?F<I5}ID+o@mc>TJiaD_Ync)nXVzt)7q?9`Oc3_=L?r$sL0Jp8-
zG-eD+?$C5m^F~UI==Bb4J3ho$bKx@vi7%i`6pi%xwV#cYk2O6H3VyzjcefqDZ$Ew!
z+gBwq4LuLMgFjEWuXDoug8?^UG$Jd}w*{V9-q;a;lKU@lP1>yoN7^fYnYFi3fy(s&
zM=UJso<$>_6}m@*Zs77?-P?79(J5O|wEswpsq$U7L`LLlGMN=D#ycmDq+|-=sko9t
zA=<Ty0<asUmKssmXJ*DmjdIGs^mCwuWpL<j{N8>IY|>!ND5}lJ&k4n1A0jwd+0R2R
zT*h=E61e|xC7ms&60Pj(X+E5$yCSpzCRRjaL1nMQ1YE8WCyk7TSxZphMjA-;`@;UE
zPjA6;kggJxhS;6BgBnmkCR3>J9B4+O+*ZBX!f`1Q)3mtiI>d!26q6aIs&~ZbjOTy(
zo&D=PFybd^+3o-YbMb1E(*c{>H?l~J_qkpg`8zinAeP$SGSrE!`3Sx8Y*};@=vL&o
zAB_7{o`YiX1a0hTaZ2*@X*E)0?1oWBwuM@X4@>~`&v1Y+0UZ{AY8u8gy_h~>0YmVW
zrC1S`p_x~d#e+906aq#EOOva`!17K7Wdld9*U19y&;}%<BW_Wi|GnMKZ&D4#-7_k%
zCP>~olr;d9A{+xvep-<Q`bzo^_~>_@perWMH8RRC%CJuDJ)`n22$nCUU{Mb>QNvy*
zpwLm`VUgL?#bj<Q!tmf7gtb_$k~4hD7EsM%c0!v)l-a97>_*2M&D@Zb5PCS18q43?
z+O0U8!4U#}Gyw7%J>-2}IuJ27!-Kp0wp%0t@32Xo%2hVhbP^^1DlX;-v;!uO8@?-D
z9cqWGffsuW81I>IvwBB8>|2cGifOzoWOdG{m1aY0Bs=v3hRf$pcT7W^z@1+l2RTf>
zOQ9v`^h1N>8h`HoV#R8FYy{9J8fP4#GX-&x`WS%l>^|{-=AdNSbqsq2=g@zA(Z16b
zLeH#Kf-#x>t<T~c*63CQ9>f@dYv0R=LU`b24y08n-`kX?IA)g$OOf+$g2J|&qC9EQ
zk=to5E%sQYxUr!*O`F~jf}9;w;Be)#*O|bJ?!+^46(Cs=aRaPD&2prfx{^@*@2kGt
z3AfB09Y6XTTWcp8-3KLQpLez-?GGhmQnO>XYyYetDZwB4#)6vxxBc9pk~e*{Hmrw+
zY;5X^PTiJVv>#K?MFq)Gp*l1KheLLFb`iS@UvY!!3gRYVIy5N3bgiIRGd8d|l$1a2
zYb-1!zM9GM%ApgxQ<1_Q@BFgiEAK3zOyQ(pkhsK6UoQpu?v(Ok9xi0n2f1n(iAZAD
zC#k$8K9rS`DRqy4CC}fiXt+1prSzj^1;hra3hGRX4c@Z+bbh1n+KlbB5rgf$#*TAo
z7G2Yw6hMu(HJM2^_o{2GmZl~OVF%9Z%#N#tb&&J#si&sPT{NT{lnYg?v%KH5K0Z@6
z_J{%6T)F!9I(>?#3$VTBi*ojP2HZ1kqCH!xAUSN0wsKPG+gJbzVEQY+C5J)qLlB1T
zi<IZBeD%4j6)W(CQ7(sSi2aygAvgDig&NGZ^C?0-EH#yUPcWOlFHA$sIx}hbFrRnt
zkyIKOG&68yD_tlvZEk*@WrLSLwS7B8Gt~Mi8h7Uiw4hR=m^_`M%EWb}Bm|`KEtug)
zHh_q&@k#XenfUtv5z$x{)oO%|LQL;OCyX1MU~F-uDTxqQmD9Gj^s^;gU5`Z6Ty*mk
zy*z!YWe=S3y?t(NV9QvClI40C_k;KiF$;D1^`AwMz9Z)W1gAVqj8UJRFjR?q9jZI~
zF~+<2siZ-tijoAW<OdghjpSUebN9CdX;SzD&&=QEn1k3rvUs^9TlKI2l2v$+T99pQ
zY(GKX<0s}6DJQC_4A<3UQ0jXr5ZO8tXoeO5Wv36WQy-7kTxxiOEenW8(HiWC=r-RB
z-9-{nCzJ*F>3q9ghp0?lqP%PeIhS@SX2^wac?%ef_k67lwBmWzFJrMuIAtj|Hn6Wh
zsRE$iq__|imtF7~&ocq!6GEJtpbb9~N+qrqdgBl!=GiguAaYU0!=UE+x6(&(04e~Z
zbUfUDH%x+bC0qa=Y?r9gd`je8+zm;(J1#%~_=GNEI~R$g35Z!1>Up|fB^2%hG1%0F
zaR|Y0<U~Q2k{)q44i+4RtzJ=VgzC_KRW3wuYN8MPF#Lrr!=QpZL4gs8X=x8af*N=y
zxUl!6CB2ttl)*$Frp1Mk$?4xJ(D9^>#TepQWkVqumP(RyqAu;ODxE<i9*kN3n<NGe
zNZw`f3;I##_SL!F{hak86-5P_ifHwC!lMg-Z<ng-lvjTWV?Yz7ZsrcVn9sT_H5zr5
z3Z6?!ubPl&4=QVEghnkEw_h#D52#w1w3~~%dKBW^t5vJt2Rpk~WllSx)kW5yi0olT
zW7!!dwIcDV#eB=!hTdup0eXDpIL^-k!<#j2Xf5H0S-de`7S5|}&HS2-UZT~YHM<5@
zESGzX)Z{(+kPN!TBa#&i7K39kGd=BoqfhW0e!dY;n=~@DlJE<qwX1L?{<!BEV4!#l
zXHDH%iyG<rG?LSf)_h?fLYfD0M@(|}%UCI$o2adnjXRuHM4B7!sEk+<?2{$|#`50S
z&$7sXA8S6(NEJ|TtLQSxt0HcZD>m-~sbLZHh=wr%xPvb+>6RpDS^0r~k~UR|N-7$+
zdqlrfb);3$Sk)Iw(0}@nr{F0uk|C%753G~E`5x0v9YY0p{octZ)+)g>ev4;5d7sr1
zZenfzMfH@}MeV7x%pPOPZIyxsE{w;%<|1WeV6mgIRq3KVA1R+L(o#r(({jlx4*0}Z
zC;GbD70;2f!Q#@xY^sJgY0>@_GL&k*QOHv{LV~|&rqK&^X!PStJS<~$#u>|2<*xc6
zVYG-Z7JDoid0c-Q9aV~+gBTyQKD9&AytCEto<Q|Fpv2hyz=gYjUS9qHyymu&>qxe?
zn!c#QohA@Ww4oPH*j+=eEB8;-LYL3eNrS838SMlJ#&tyVj7f?fAR4hY9v5`rqW}1}
za&{#h-n}C)0*9W*fy$cvKi{}S<BPPilBZPuLA%7)0}c?mbcPu1E3Nr9bDH$dMxG+P
zbhWc9)MNAb7g(>tuOhC%#-xC>Ig>}Bt`ZPY9-h_qR|4uQgro~}36Y}-1w-GX2S+y_
zXo4rTOflOi*vU$_btOZ@Y~hc1rb|h&N|D&KWsD`y)kwPgidv`Ci;aP{$y;d@h5eqg
z`o4jf7g1z2miSL2)?HZ6VGUC#B!d@q%uN1B5I?QByO$g&SITnWaJ16-TmyfJM3AQ4
z8V>A?+{$Z9tBub0uYciK$nTcWHbpv>5*@;766l(_p}S~P!Kf}a4Cpfn%Kok;7Nsh%
ziyG2b$@d650?dJb#+XRz=5S5c0iQt%O!XCBP3OP!mg+@}e=9(&p3{g#KRT{Qisf7O
z^_!!w4`JO{>=L)Cn)C3S5^q!e#rNT%@=ZWq?N^$MEhw^xN+VXWJtr<G!$wY?bD8nj
zTCD|y28^Mf@uZ=dQZm3YM$*cD>JFQcj}bWTrh`Kl7vTNAV}=H!DDm?D2MiGbJa9Ku
z@Hk_7gr)D&Vo{K=zHvG>Y_PfE#=wui)02n*49XVk0>0f{bZPJE@RgTwKGwP-9=d}s
z1S^hT?e;ZJTaYp&*1;I~qU3jhz*@Bw4z@YhX+afi6Q5sdIBlewU;oO;W`feF-Y|x3
z+)SyMBQ)dqbQEF$sXPkai|n6Bl6onV`CTnjH7-Fn*e+J7!Q((lTOI@h0P4Kh?gu<#
z=H+RO-c!lrt~P`4hmvcTtHn=kwk8xt^UdE^B$ja1VC4D?LPYl`>4C%mbbOtkmttVL
zf104_`W_Fi>qi;4jTFf0I_Z8yyhWrp{F{M`vfDtS&0{bQ#lr~dP6^aEqLpnF`1j@c
z*D`&F7(fENAv}Z_)_C~P1DhEHF%jav;Lz*!S84Eft+Fw^J|tnZ^l=LbuuzATu-KzL
zk8a7|%eOFx1LqQU9@NcTY-ka8y~Ku|rsG801dhbbv)!+CMv9N7cF4M73!g+T_+aoH
z?30+iZbi?G5lUWnX&+il++MJMqPy$gr?uBRz_0?zMX`ls&8D7PsvvF1)l69F#H>Y_
z)uDM=COBw*@Oq1b#TYymS+vM?v~o~f>kpbgZg+HO!ald<@^IWudEIbx2<Pz~djL)A
z((1f_$Ak5vt>+6__{5vdZ^ze7#2dUtYXCmCw(%NB*B`p-CN!vi$MYn#!Yw7)CL*1+
zO+f>nvBhyPFN<TO5?4Q|ol%)3Ng0YtKBN?)c*s=(XB{nl0%G#yP~Kjbi)@#NxFdLa
zEMf0eODAemqMrchj&q9$LS<tMAe*Js%ObV(Kfz!Es*~&*HybC%&cQ<vyFuZW?EF3}
z+kUT9a`qI9E(LdPhm!W1#Cdg>UUVQ0J`MrfU}DP#ywj{5A@h!!45ZpF#nd>i8G?}^
zS;GVAH6Wcw2f@^DH{VZ>Tjm*dfUc!DT9ITjokdPD-gE{+LS!UQq_E<J7MttHnO3OY
ziFjQ_fBS=miRPlc--5{`+LK2yc^_jPSJe?wU%eaN<#-#ug{1)LA+_E0m%Jo&0Z733
zFXBtY<h}5@6C%Ui9C(30&2M>+)$u8qVJq_;S2TvDHrmgAaz&~5IC9S8_!(A&D#W|1
z#JimJ@OCxw#j6qVgb2eKJC-J9*{hNqinw#-d(`;b{pXOJ66wR}Uo;g-ua#<8k^RaO
zJZO#8aXhcE#4wHM8wbrNKd3r5j@p3EWuKmTYw?a$^CbTO?SAjxqy^5jl!>O2X3_G$
zlF^DRf9!}UreA4;kj;8W@#bu{NVtVTaHJQ5cv56Bi9f2A&!q+T$QK3!Z0I)_HW-T2
zn(xJ?_`c5TTK6bqUON*9e&RTWf*>xoM^Kqbo~qLY%NR%s=MO9p07jz99z}toz-a{~
zXrgc$X;$v%q?TSWt|MI)jK`#)`<njhGAAi<n`NTt|5MmiM@1EV>pQ>z(g-NsCDI}t
zB3%N~9a7TWFqDF%gbad+bV|3RgwiPpgM@^nfOO6q$M@cnpZeagX3ZaGfBW0<opUd&
zI~!O)krcx#d)LB-$CnqU<2VWrb31lV<9IAsaz9CtoVjhS3I@X@-?YNQdI|;>aL=R5
zIw&j~;^m|UTcWHQNZgVgQL#EBoRU8hwXcGRs=tLYJwHkx4uPx;Ktz@D0}#)Et~HC}
z)YJIj4kb_kQtr&DEhzMpp5&{jk{sSO+9qQ1h4c!DA)z+tdN#vs{1AY`La|7r_z{O_
zhc!k<1-4`#jLJxmaAynTKt=1Ivb0NZ94Z1+&RQ^!FPAPF-+yO~qM)H_Q^j1KwfcEb
zYOqsx(IbJoFm7Z9GEmOV*H#rHs*?&(nmF{wiuDO_sPwKAzCnLTO)Ih#>C+XZS)v_l
zUSK6>1H1Nd2`ex$-8x5O%||Af@j)Wnaz4+xL8)zwPRepc=3BBVTk#U+w#$!3T?VQO
z62haZUk1&64LD7GW<I%Xt7uA@2=xkD10~|UJn<w=9-t4)5E;W5uVxe9cYtrGX>LJ{
z{uI;OamR)Y%V8HHj+|7Ll8B6mOu8uS^id+MRA}e2{v!<IqkiARp-nM%4;~<i=bk}&
zEHvMEb>N}XUM=d8AK|kAO@^^AeT>HI7<Ww#xU#U>7)EXj2WZ^N<1Oi6$u#fq1-1h%
z#Wq)zCVMMQAong9%*tcU*aR9T#+A^`37>A6?ayjiynifC^5aHv(P?JCqq_p)0xLdU
zb4O>}ITc%P9~FnRbX46_iLg^O0i^FO&NAlP6tjCk<3d!{qnd*&?vCw!;cWDBP%law
z`rWrHZ$g&NQ$}&hzxcgl*jZhky$wm^CN*(dWec?{C&Vfg16|R>a5uB|?#|GB)7l!(
zC|K;iO3mzT#@s<q1{>LAKgq*a^1OQ1W{hezpwF3PobI0JF*sX2ZTIzWkO_9S648p<
z&4GxvQQlYKqrb;>uB{4fkLs$qYjKk}1o%$Tys9(pDxA_+uCIgssKpfaKH6u#6%%jB
zH0pyWGZ^v~@vV-~0G_FvKGg$jPp4NF_?@T=wwfbK8@YZ^qmO8qYp{9eN@-wdD<mr3
z?QF{cjlbLYR?}oe^3)*vV-S@StBrH%q^sKZCz1^`9)xLfvvTk5`UirJXFT(4&MTWc
z^xx6Ib!eW<PQ<~!=!oUW-1I9mzF=4|+Fk#27<_Y6Byj0Koc?s4tp8B=nK^5<gBHy<
zG2Me{wGp=Go{ROBwG1h7rmDvFf`K*QObpv)^4WJ)s%I!V7qe$O&{7t}pB<~X{8Gt}
zc2%f^qweqW?7f>*3r?w9u^sPgOc&`pHQx%-`L23*`sP7<X_BU$qtBNK@wu`O9EHKV
z>5cXpO8kQ3FnV3nxbx}QsqW(&nHQLZJNh#YxL%e%%g&QfV~K{?xSL%&s4P4)+@ZA9
zobeS6-=2=<I9HI?_GWR#*H=PnB&wX4EitNfOIq7Cj>-X(*NH1rO>w|J5wFH5*mdwu
zbcu87(ZSi+!dqXo4+>PMW8ubBX1!JxA~+2T2M?d(XRM4g^`4ztl9e4a+TTYJjwCQ^
zN*GHbqfVTBa*IdYG-j7&2cAzoW@TA3-K*|>aETwhH`+(wt4k^&rkxK-mKu6=x1Z2g
zVT$;1WrBEh5fjb}br%1MTw!iC4aIuyHV^0akwI0~`X`}}RJ>G(2UFvPEjLHjIgbOx
z-*(gO^ttb5C?h6C*UdN`==&V|Wz>^>9i6C&8?m8R;o4cCi%FVqG2uN*#>d}R5*kfr
zIR7MWpyc@c6PrOU>SJLxNP~j(?Q*Z%)po1}CRV#X^~)Yl3C9>E^eF1PPE)i-b{J&C
zGmDL{H!Uuz4kx|ZN<0q9_mwO+2<Zs#F>Sl!<E&KNH0-;EHC{_kMPS>nAVTQpoOV#*
zn|poSQ+GG8yHpyS$GhQ{n0^vKG?Ndjdws<1*`D{&(PT`Z^sI1%10uR_h$YrOJyFaM
z0OPpV$opoYz%aJU+z1qWW6QNq-1hlwmHGznM;F1IzWa6NT1F`jr7)^``nuEDv>)b~
zM2LS+-oHE2qHkKSH|~|upY+t)JR|KE%2PSQ&juT&x!GA^ZwC&}-p?Kqb9@RNzGTF(
zS9+hhFC^`#obAKg7DNF-&CAiD6R)E8;^Rvz2Bnzn@<{`x+Qkd@kHdsxfvyaF^Xs}O
zd%=~-HEOd{&%dkcNnqw%eN)6@QBr*u(KD}IDaq$B6>6Dn(_PBouKg%3Yh$n`5j(<`
z5;rw&dTDa4&(+}a?vA-LxbcbECzOx%6ItRLg!mBRm-|66X)06@#BcYb<6&)YtJ!b7
z&sW18B>;PWk3UGrO36x@EqO~j>TE2|IQhww+z2tWh`PsN?%+Lpc-FgvWY6Zdj^Ue!
z4Ten8`I1{nQ}N%M!pk+CgZWwKF~#|1uiJ>UeB|tpoqbUI<Td&i`O_MwkCV43BBtU@
z-7xfBG54+3;yx3zc0nq!KD$4Q_X1IQse5wWB2xBd-6kESMp>qNn)Pru6Gbfc4)*OI
z6Zedr*rPP%QGURxm<GaUaaLJhCanY%1wG?u(3WPykilJiu$JaziXJ+AVlNUe!Gl%G
z@X<Kt{u{#?jeQ!McTtTm%5Xc%6%T#%X4%(%I7asMW8=jij%hhVY}U=V1k{c3GM>kN
zgU${Po=pn95jL1jmokuwk992;(|yRVlSZPgY)@jVs}q5j1Qj7!J5f8MmXCqXS;=Te
zyH+KU51Yqy(R-|<mA+i%dLmWd-;rZpF`U7Q-j>tW?Re<jx%l{u-9ay|<@j^a#dkJs
z$$|}v5xjowS;LGuh&Z{aMdH*GQ<R-swVpKSHAmTV*A|}$QewN>8nuyVEl;7ih#Ee2
zDQ|{ic7(R*lQ$LbEQX+m-f$?HqZdow?)*W$Jkc=_-_jy??kAaMifL9Ay0X;swq$A7
zfc<bF4@){&f-Fvnv7#vXxI!1;mFK_KCBDv#n$(KpO;h@&3}Pal#j=lf7?x|_JV?~`
zNU^d~w<(*frGc|A`;!2Q$dgz7r9&duiY!dM#O0I~@ST{4$CP|)h}#^oi15-b&mvY0
zDKqcvXj$Mq;7Y%@-z$7Lz&tfH(yqn@=^wrmJsUTvJQIp?_{ESbD0LB&6=N>OJYsH-
znDdivLuC;i=p1sxHRC+Va#UaNqGYpVyO7J+v67FV-M^;CUSKlW@CiE3q+NdwY)j<=
zL{VXPC{I(}ZoF@^O~ik^`NpmJsOLjy9LBrsVH&=)l4o<5z$L0ZMq5kN?v_RL5Bk$_
z-*l(1GmQ71+1>ZdE|@S6cmff8x=pM>%(y~FFBgWtTlfH?(afY{vnCH6hHJMbI0m5&
zDpqXp4{|Ss$Hzm}ThfHU(<jzlrKHtekK9YN)6_@$b)v$S%|;Cs9J1zNb++5GmUr~t
zHlOu;pq%q(W|+U0`nuJE<yeyxhQ2=TyBR+Lxo)&{$!G0fanInjLZ8*c%+_Z@_>Ql?
z+Gj@UhUvFhb?V>aQU<(DWTnnQsL#6h7x|9{l&B_Ca*Ux>npLOiF(uEzyn4WM+wN?l
zWoVH+No&Z$I2zSGMVC({Fvk$wl3|Hq=X-?~4H$`)KI8M2N*}FR=e=Nux4P9fx3&t{
z`g^!SPx_$6oFH2Kc*{04Es#TNPKvcf*DeZlniIqdfweqd`ZE3MMS|o9$aa>U%{_(c
zcAmERy;db9@J-cWHKjJW)L~#7w)Sp1>1kFcX`ByL!Fv9_rCkgwA(g<oNDAumv)#)V
zGz93L(d@0XQCR*{`Y-fOtKV*vx1C;GrXQYqP0=cRj}vOZo2yuVAgSb^X24~Kx%7y#
z;)48vE`(ihEh6SNS7YQQ1pIB|e$j<>=;?Gf<wpxH2~+9~nA^mRxEKxZ3w+8oKODyA
z7QHH$r5KfO1*sd(aB?fn%YbF=4A6tz*%~ReC!FZ(55^iupOfG2J)+*Z_Kdy0=M%OX
zSgdr0!*_o^!-t|93sZ;HpbkrHB}+B1hKoSH-5o-UzF|?UdraoM{B<PD2*=ouW(O^5
zpnUpx6JL#6>w}lGY{*m14HsF$7st$Z#5iA8k<LZ5<Ce0(?1%2E(<KYaP>i;uQI@QU
zekX2}zh+n{)o8nh-D{u?E9x_;G`D<3qg*+Aw`J^`T-sAB0lILe+8t@#+h=b3Ele)_
z_6mfM?{|Q){*~3W3zpuQsrcyNs$6ChQPPR`=sj-L87oXCb4g#-In>%lbPw=9=bxRi
zikr&W=3I!%OvdmiSL3{MyZ-IztW)5HT<e7s{OyOZfVTn>*n-IlG%?PJD>ma{#msxj
z$|UfO)?<x#-fUTUddqz;jn3=fmvQiwN%+@q5cmcc<g!m<;zchkVP8y}W3%>Idvud!
zoI<0#XrW)>#~g+`{=Q`&Qe)4`HTz!MV0U0eS<iL#rNw*4_kEWV2a@8;KRargK@Z+0
zsDU2c)%N21GRs$9I^=~P0ynRD99-sG@A1Khu>$-1oW1W09she}Cs~-3Mlcf1&psni
z7RXRW4QnKp!jDm+pjmI}V8!RKA44BpQj6I*_$nPTZ^`@Mb>>fQ`IJ-hj&aSrsCmaD
zI|vpJ(nMkULi%BfcG*PZmPr$V>ExZb54M~@#hjOFhG+>}{rIzXM-~oIsg|R!Cq0E9
znwq^+la5uRo*MO6HW!BqrpGRZibX$h?uml9s=Cjck!n`%<|c=g>nvuhtZ{T->kRs`
zw0bSvcH86Ha7@h)_JPG<?m82r5l(R#ZB<K|IH3)L7P|nlt?1{~j2#A$T!js)R$SeI
zjf4lXnzksB(-#q&-f9yXq;_d<XN*>P>Ak&^Kwlnj=$m#NiMhin2gLfmgc|u9Vd^|V
z%$+cnt_|aTV)ywd@Dd+>F$6i0xHufTyl}ca&$!%gJwI`Re}SLYK@Nr%_P$A+bYxsE
zLypF1&KI2En<jL$3xRE*5*2@OHdlYVP!$bY^D*v6f*AXE>5{aF_k9a01g0gUveLbI
z9bmiqVu}HG`fjtFFeqLw=eKU>1j-gd3Jvz3Uzba<!Hn`_#U*wcBJ*ivq95C)xycr3
zdBbJj_EVVjO-?v<qrhX6Hd;W|_ol5pmELu<clUHQsaKEGE18}pQw;5)e~=49w_GHh
z40H^y38zzEdH_Fv{4guJh)|$&QEU~rUaU;`n~k6o#@$X$e>KKhjppSB-#3*^Zy<8D
za`I892h!h}T4U_BmI`+)GO#~ImynEBy(M`{(H7xlMtCx65^Bhkz;wzs74^786ve`@
zlp+Fs$NS;r<;m_q61{QzzHxd~LfK%vV8_%o6Ohd9if+u(O`YSEC-(j)>*u27nslF%
zJ$e0foXGeXBky~aXO#^qu$!H73fV(Gn7Vy?v1({0K=n11y1Ib<p<9rX-N6gz+GTJ%
zd#Z=k7fDswkIx;Hv+uuMj-Jifj@pUV*!rxBop$SuGR!J+NPVinM*Et#hF~HwHMNOO
zX9cJ_|Eqv3_UE*r3!Ts}V05Kf@eL0XqgGqTBk}LY={s6V5b(~NYlDE|bgugWgh5!S
z(mq`G!H}_CX78+DUDQA++M8IOqIjDPh1ien867++odv$vn0S^73Q4C1DGn3G^@L)v
zaqvhJ#bhKhnEiuV^N6!{(cB0_8GMp(?r(P!dH0+R65O`reVNzvEW?rrYrY$C%OrI^
z$o-r{xFF2WPr$iQ^{}87FGtSp7-HQJs>`1`rkgC!WX5tl-(C>GQdFjK(Oj#f;cqmw
zN}jD)&1{HcieEX$6G4amd0<cJZUn}u-xjU%u1csHQ$H{94^=zi*Pd49>_uk+PMRM~
z0%}}l^=SC7D><%LahccE%{FBkmnDMKM6)IZoDLJ{ur`O}9VXvLm>(w0n?uGYmj(>5
zY_q!$_TalWA$xLg$BtEtDHVp>Rh2R_<DXBnb9~}0{G4VZsY15zoSflAwo5`LS4(|d
z<BLZw_TiUns*vLi+()Q5RDGiqK{ZQVTB8`Am`X3Hh~SYIjegvr{+@)^wtTG@dlJVd
zkmC%2Xjzgk)tZx&lN{>Z)Q|{L)9~oTF2U7leZ9m>!O{|$lMVQ>6F-g=$y@wKW%O)@
z=Z{e`v}2Bjfl{`kS>l3tyGR)qkUTDJ)Y>g2A)x*6e1GV2z6|~q&eu_(R;j~>L1~Q!
z=~asC<3y*Y0GKg_u4gjw*!0w)e9tD4VbW_6KE1B2Dr?p`BAs*J8bV2Bb?Qb~pbmMo
ziZc4CKu7pCox?`N8B>Y$8?*g`7aa!d{x)J!WeJ47lQpL<vgsI(GLPlU`gkggGM63^
z(k-S&-D0(WKp3{uqqW3Xpw(K`{L0wm29HtG*h4Si)*!_<E*o<Xg-C)!Ho?4CiS@Dv
zNjA_>AC7iND_KE`Ujjt?azNrDF#~d80$+h&-fX>?gHNf#PgO5Z;U^t)=W&q3G{~hY
z<?--~@v&@-bB$!_*6F$MGyPfT`@ITSrOm3TJ+my%k6?QHvfw4+=R|VfCXdM$I-E*)
z^7ILt<$B2hm*=lLxT3?T%|3fgv=x|F@%FkND}=OSo06?2T0s0TYj-?mlf|wlqA!_F
zgfIc(?;q`bsxdt{Kv};u>_2vbuTR3<ZZEzH(>9-r`*BNuSDzr6c`Qnl6aDQ5eW9R!
z%!#9FLMn-uaKppK%J_!FfO3nB9o1)3-Z@JQ{McuVG-fiHF*yRP!RxO8*q+nne!j%T
zffKwA@<RZAOap=M&z*M-!B4p$r}*&oe8`C$<V**m+)c#Oa%-5>6^D3XD|Z}=y+2In
zQ8XKu?sQ-~2BnF)O5botxN#c&d3HIG?AdI?k<lLFE0FxEdrGf;GVwcKxEO@m-5v40
z@a(|u1koy>*_*4sAid~2Y7y}{dE;|>zPo#8Ki@O%X(@!p2P8flLlIG|o}Y^q>(BF2
z3C;G~cKo)(KGj+2lm3Ej+(>`6kj;#x;0HB1<ShHHw`Hk>DzW7A(y0s{yZ4J8b}BwB
zK8_f*3DJj~D5K-5C8VnGGriWGVs38CWT9_6KkK-_(<xF}!w3$s)zmwtp0G*Q8f|Ur
zB6Z#9RnUP1)~!DDsMO;+V6UqmR5Ezg>_Xm~MfpbT>j9OKM=!V4$_{+n2L)G~ly_Ee
zjC`q4VQKhb?PiW%Tln2^HVfhC;P=Kl4JK6yCQkJ5zN3nme91B%nfxQ#)VhIC^j_Q!
zY+f(N<khA*w6KOjyw_-WF=o9^<izK>&pH{o$jhuD<z^kQJYW2VdsAHHAsY4pzGI>`
z7e(r8g1##CL*$QAoC%GiQ}0<w6<%DRKO7%$9sOu#sNexR4?i<EZOkE^miP=^%W9%@
z{8DhyYRDrp*9sdny3r9|LaGJF%HT6%xgV26JmCuSdY!!B5N(<&W5*Qn)m}i!HgZ-3
z^YgSZgx6E^<Yn=^NRhOJO^b4SbJsl_%HB|^1<%*!<C1fG!JT9%R`%0W;nk_2mr3-#
zw_p@1@iS8C9$~KxddfJyOsqs+AI&T+V6<H36`k@s?3c*7txvU{Gi&X)W!_QreY50+
zeB)VHeKMB+@x!u_#mGA56edPP5z(qoA|e2)J_Prk8N>F&p*hH<W+Zb)n^71i(RTPA
zSCO)Q6n}A(f)li6tIlTHze+pRw}8SGWR>>xY%?S-m|IelN%^4|q41&6YD;B#!1BAH
zuj5WRsz(bC5_T1tw4XJhav3VX@(s?euiyn-vkP724M!Wt`&<ksCIV4!R%a`UX)>Vn
zuSup9KsT2>UE}kEnx4$8@=+HOu+NV9b1MbQ1v^47DL;mooU{BKdU(<r7GkFb0M~bb
zt3wZ=IU*qOKPDX3VTppy@KFr|$)T9apnHF=J1c`a(2?u>8X&bl*27CRK!`UA;*DBY
zs)42|_|rBy8cq5S(>nWTG|y?It7R*&z@O{V)?gzt<a$mJSn|qx-EI(giHHl~`hRCP
z9-;sM7Qg|x+gLhSa{8D#*lTIx0vPjm`mO%wod~j_f+VP@c5vf7-M%1E7p$A=2D1h8
zwWCGw&^?{stTm<>Vb=Rv`gJa``t1I6&VgECAPuZ+D<s~;CViaEQqwF{0bKLIzPQs0
zr>4-9@<LuKXY)>hdMFy0Acyb~7Ws@-7iKaW4QehQ=){+kHrlA-u{!r8c{Ybo?P#*t
z8J@i@4#Xg#wmz4Qe(@pQ;g%5rm~`>|?Ldy!NgA;}zvcNm1(ox+7X4!722H7Ph(}+N
z2i|P{G&N|U^rAMj)hxoa5WdOnmf&ykEq|jipjZvx$T2rF5HT=6q&CkC96rL_^D(i8
z^I(maUjB7~J7OQ-85rbf%MvOwP%N5e@9`LO;)HNIGhCWT3r}Xf6O_VfQgxSS)DkL*
zrJ>u^UZC!+(eL?z+kefz4D4KW*4N$R&`J}vp*=kxJvXP4kY+(#uD?=1iC6cmZgN3&
zd+*p6ct18hjlo65TI|70{#>!&gxV@<Ia&_#Q+emy$sh|50Q_u>ni2?w7?l{n1i+ZU
zPjTfYgE_8r6dDf&Q{et=s6g*l;yxw-xI)pPV3t3OZbH?dU^KDcTMr;!SOD$M59Di0
zk^~n3+$|lP?akaR-MIc&2rK_B1|%8HPZz1CPWAZ+vQSz8Ao|TkPOvSs4-wHH^b|<g
zy*X*U9xwo~5dJ3&0%cG68w{yq7sL`uEhRKI1x)^@XWE|u(N(=8bU{oZ4Z8*a#8(0e
zpoMP#)in}FZ8VYo9)Xj=LhSV`I3q@=`b#j`Klq$dU`v?@+!%uI<`rBtE41PznEFo~
zGL@5;U<%X>b|A5p<1a-*hQyt?Y3GM<%ft)-H?Fw;$_@2N1ylX$n(k)_To{LkP0;|r
z9MMFQE4V>nAW=f}Uwpj$TwfayV$;U>&(gh?fZj{{TUU^LM5dvi{1DB2K=Pj@=)Mmm
zMo9k|=PwN+>#&aSi&7;IRnGtu6aH0bzZomO0#h&(DEzKXGdDL&_kT$AH)J6KiE6I^
zByuYK8cTac%E)rlYH7SmKy=a_8vrP-l<k88GQ7lBN_c;k9GQi4IwFf9m0xB#syF{M
zLsHlbzCY_kP$VNdLw|*$TlE(<O`YT)*c#3Dy+#B!9ueNHD_9K8U)UKf%70)5Y>j9<
z5!hP9PNlknmC^l$b<`*L2UeBaG>;X56+$SH`3m-q;ZN*ejv-{OQEXx?TL=~E;R6U1
z;&}M)S5EMZ$uG{^=0yMCv^XOmI06B{cLXop6|A%+5(|}k11A0lxL_p&yAB~ob@KmA
zw$Az&xb_YBFWDj+x$_3m$Q6g5c2rQdOz>YCj?9keB(ZY>kx>>RO6n^S@;U#?Zqk+T
z&j67egP919P?uk^z%&06%WuLJ%0d`B`a%iwz?6UA9~4NZnLq8ue1CC!2K;$E{_=_3
zu>aGFpP#=UEL)OI0YIYq^3A^!{T7vPHex$b1p-ilXf(3_*Lwb^bx<IXND%xhuHQG`
ze|SZi3xt~FfN7Am``wNLS$9~r=kO?^=86bqT-`zUA<(WI@U1^<j!YS&zPo4|aklB8
z0|5Dze#Hj^iF9GKf8vm34a!B7bv_JP{=}&8zqAw?77pV^kTAkMAwqWySKK3>C_=Q3
z?N9f}>)_)8zA;?{P7Z-%zk;iP667Hy_&N{#m%{`Z+FTx(0`wdjj4(?SiT}&>329}J
zk4T_99+?0%DgSS~23errhkMgpi6kZwsR<}X!QXZR68!s3^3|@OE&c?v{+T{9xUvF-
zFg682NEtx~L_mKz{E!68Uo^=I5v{|-0|2%w(WxOG%t45d4l1M!!v6<NdLe=)Pz`B#
z8@f^m{uj-JT=HGRX#gl)1pv+~H1f~Te$w#$gCVmB!N6ewMkt&Fie(MH{tr8X;-3iz
zfT5;2U^3`H5Sa8&L-U{4@ZWF#e!n%#38qZ||6lj$9^Tjh2<-p_0BFRB?X9K+MwATz
R?jU|d5!dInM1<0S{{rkhDuw_6


From e667719dd7a4a0f59e81d28edb0509404087e927 Mon Sep 17 00:00:00 2001
From: John Niang <johnniang@foxmail.com>
Date: Tue, 8 Oct 2024 22:10:54 +0800
Subject: [PATCH 097/185] Redirect to user center after authenticating
 successfully (#6797)

#### What type of PR is this?

/kind cleanup
/area core
/milestone 2.20.x

#### What this PR does / why we need it:

This PR changes the redirect URI to `/uc` instead of `/console` after authenticating successfully.

#### Does this PR introduce a user-facing change?

```release-note
None
```
---
 .../security/authentication/login/UsernamePasswordHandler.java  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/application/src/main/java/run/halo/app/security/authentication/login/UsernamePasswordHandler.java b/application/src/main/java/run/halo/app/security/authentication/login/UsernamePasswordHandler.java
index a04a90208a..9fb3443529 100644
--- a/application/src/main/java/run/halo/app/security/authentication/login/UsernamePasswordHandler.java
+++ b/application/src/main/java/run/halo/app/security/authentication/login/UsernamePasswordHandler.java
@@ -46,7 +46,7 @@ public class UsernamePasswordHandler implements ServerAuthenticationSuccessHandl
     private RememberMeRequestCache rememberMeRequestCache = new WebSessionRememberMeRequestCache();
 
     private final ServerAuthenticationSuccessHandler defaultSuccessHandler =
-        new RedirectServerAuthenticationSuccessHandler("/console/");
+        new RedirectServerAuthenticationSuccessHandler("/uc");
 
     public UsernamePasswordHandler(ServerResponse.Context context, MessageSource messageSource,
         LoginHandlerEnhancer loginHandlerEnhancer) {

From 672b2d86c7e1585870580beebb340014446f7ed1 Mon Sep 17 00:00:00 2001
From: Ryan Wang <i@ryanc.cc>
Date: Tue, 8 Oct 2024 22:50:56 +0800
Subject: [PATCH 098/185] fix: style issue of the fullscreen button in Code
 input (#6785)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/area ui
/kind bug
/milestone 2.20.x

#### What this PR does / why we need it:

为 Code Input 设置默认高度，修复全屏按钮被遮挡的问题。

#### Which issue(s) this PR fixes:

Fixes https://github.com/halo-dev/halo/issues/6681

#### Does this PR introduce a user-facing change?

```release-note
为 Code Input 设置默认高度，修复全屏按钮被遮挡的问题。
```
---
 ui/src/formkit/inputs/code/CodeInput.vue | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ui/src/formkit/inputs/code/CodeInput.vue b/ui/src/formkit/inputs/code/CodeInput.vue
index 5a8d27013d..592c4c19cf 100644
--- a/ui/src/formkit/inputs/code/CodeInput.vue
+++ b/ui/src/formkit/inputs/code/CodeInput.vue
@@ -39,7 +39,7 @@ useEventListener(codeInputWrapperRef, "keydown", (e: KeyboardEvent) => {
       ref="codeInputWrapperRef"
       :style="{ height }"
       :class="{ '!fixed inset-0 z-[999] !block bg-white': fullscreen }"
-      class="group relative w-full"
+      class="group relative h-9 w-full"
     >
       <VPageHeader v-if="fullscreen" :title="context.label" class="border-b">
         <template #actions>

From 786cb1b260e2dd5d9dfb3f5330da5718d9339f8a Mon Sep 17 00:00:00 2001
From: Ryan Wang <i@ryanc.cc>
Date: Tue, 8 Oct 2024 22:52:56 +0800
Subject: [PATCH 099/185] fix: can not display error message for duplicate
 username during signup (#6789)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/area core
/kind bug
/milestone 2.20.x

#### What this PR does / why we need it:

修复注册时，不能正常显示用户名重复的错误的问题。

<img width="666" alt="image" src="https://github.com/user-attachments/assets/bef83af1-ab9d-4c84-8c3e-0d4f8a6892f3">

#### Does this PR introduce a user-facing change?

```release-note
None
```
---
 .../resources/templates/gateway_modules/form_fragments.html   | 4 ++--
 .../templates/gateway_modules/form_fragments.properties       | 2 +-
 .../templates/gateway_modules/form_fragments_en.properties    | 2 +-
 .../templates/gateway_modules/form_fragments_es.properties    | 4 ++--
 .../templates/gateway_modules/form_fragments_zh_TW.properties | 2 +-
 5 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/application/src/main/resources/templates/gateway_modules/form_fragments.html b/application/src/main/resources/templates/gateway_modules/form_fragments.html
index c664d37fb7..1533e1cfa1 100644
--- a/application/src/main/resources/templates/gateway_modules/form_fragments.html
+++ b/application/src/main/resources/templates/gateway_modules/form_fragments.html
@@ -55,9 +55,9 @@
             <span th:text="#{form.signup.error.rateLimitExceeded}"></span>
         </strong>
     </div>
-    <div class="alert alert-error" role="alert" th:if="${error == 'duplicate-name'}">
+    <div class="alert alert-error" role="alert" th:if="${error == 'duplicate-username'}">
         <strong>
-            <span th:text="#{form.signup.error.duplicateName}"></span>
+            <span th:text="#{form.signup.error.duplicateUsername}"></span>
         </strong>
     </div>
     <div class="form-item-group">
diff --git a/application/src/main/resources/templates/gateway_modules/form_fragments.properties b/application/src/main/resources/templates/gateway_modules/form_fragments.properties
index fdd436a16f..48d3a835a7 100644
--- a/application/src/main/resources/templates/gateway_modules/form_fragments.properties
+++ b/application/src/main/resources/templates/gateway_modules/form_fragments.properties
@@ -16,7 +16,7 @@ form.signup.password.label=密码
 form.signup.confirmPassword.label=确认密码
 form.signup.submit=注册
 form.signup.error.invalidEmailCode=无效的邮箱验证码
-form.signup.error.duplicateName=用户名已经被注册
+form.signup.error.duplicateUsername=用户名已经被注册
 form.signup.error.rateLimitExceeded=请求过于频繁，请稍后再试
 
 form.totp.messages.invalidError=错误的验证码
diff --git a/application/src/main/resources/templates/gateway_modules/form_fragments_en.properties b/application/src/main/resources/templates/gateway_modules/form_fragments_en.properties
index 63be73e23a..7f63f5e6dd 100644
--- a/application/src/main/resources/templates/gateway_modules/form_fragments_en.properties
+++ b/application/src/main/resources/templates/gateway_modules/form_fragments_en.properties
@@ -16,7 +16,7 @@ form.signup.password.label=Password
 form.signup.confirmPassword.label=Confirm Password
 form.signup.submit=Sign Up
 form.signup.error.invalidEmailCode=Invalid Email Verification Code
-form.signup.error.duplicateName=Username is already taken
+form.signup.error.duplicateUsername=Username is already taken
 form.signup.error.rateLimitExceeded=Too many requests, please try again later
 
 form.totp.messages.invalidError=Invalid TOTP code
diff --git a/application/src/main/resources/templates/gateway_modules/form_fragments_es.properties b/application/src/main/resources/templates/gateway_modules/form_fragments_es.properties
index 8175c046d4..8dab4708d6 100644
--- a/application/src/main/resources/templates/gateway_modules/form_fragments_es.properties
+++ b/application/src/main/resources/templates/gateway_modules/form_fragments_es.properties
@@ -16,7 +16,7 @@ form.signup.password.label=Contraseña
 form.signup.confirmPassword.label=Confirmar Contraseña
 form.signup.submit=Registrarse
 form.signup.error.invalidEmailCode=Código de verificación del correo inválido
-form.signup.error.duplicateName=El nombre de usuario ya está registrado
+form.signup.error.duplicateUsername=El nombre de usuario ya está registrado
 form.signup.error.rateLimitExceeded=Demasiadas solicitudes, por favor intente nuevamente más tarde
 
 form.totp.messages.invalidError=Código de verificación incorrecto
@@ -33,4 +33,4 @@ form.passwordResetLink.submit=Cambiar Contraseña
 form.passwordReset.email.label=Correo Electrónico
 form.passwordReset.submit=Enviar
 form.passwordReset.sent.submit=Volver a la Página de Inicio de Sesión
-form.passwordReset.message.success=Revisa tu correo electrónico para ver el enlace de restablecimiento de contraseña. Si no aparece en unos minutos, revisa tu carpeta de spam.
+form.passwordReset.message.success=Revisa tu correo electrónico para ver el enlace de restablecimiento de contraseña. Si no aparece en unos minutos, revisa tu carpeta de spam.
\ No newline at end of file
diff --git a/application/src/main/resources/templates/gateway_modules/form_fragments_zh_TW.properties b/application/src/main/resources/templates/gateway_modules/form_fragments_zh_TW.properties
index e4ad256f11..7accc38c1f 100644
--- a/application/src/main/resources/templates/gateway_modules/form_fragments_zh_TW.properties
+++ b/application/src/main/resources/templates/gateway_modules/form_fragments_zh_TW.properties
@@ -16,7 +16,7 @@ form.signup.password.label=密碼
 form.signup.confirmPassword.label=確認密碼
 form.signup.submit=註冊
 form.signup.error.invalidEmailCode=無效的郵箱驗證碼
-form.signup.error.duplicateName=使用者名稱已經被註冊
+form.signup.error.duplicateUsername=使用者名稱已經被註冊
 form.signup.error.rateLimitExceeded=請求過於頻繁，請稍後再試
 
 form.totp.messages.invalidError=錯誤的驗證碼

From edb3f1c6170088866bf2f43432c1ccef7ba7b1a5 Mon Sep 17 00:00:00 2001
From: Ryan Wang <i@ryanc.cc>
Date: Tue, 8 Oct 2024 22:54:56 +0800
Subject: [PATCH 100/185] feat: add login link to signup page (#6780)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/area core
/kind improvement
/milestone 2.20.x

#### What this PR does / why we need it:

在注册表单底部添加登录入口。

<img width="693" alt="image" src="https://github.com/user-attachments/assets/dafc48bb-c16e-4d9b-95f7-b44e2f14ed6f">

#### Which issue(s) this PR fixes:

Fixes https://github.com/halo-dev/halo/issues/6770

#### Does this PR introduce a user-facing change?

```release-note
None
```
---
 .../gateway_modules/common_fragments.html     | 70 +++++++++++++++++++
 .../common_fragments.properties               |  8 ++-
 .../common_fragments_en.properties            |  8 ++-
 .../common_fragments_es.properties            |  8 ++-
 .../common_fragments_zh_TW.properties         |  8 ++-
 .../gateway_modules/login_fragments.html      | 42 -----------
 .../login_fragments.properties                |  3 -
 .../login_fragments_en.properties             |  3 -
 .../login_fragments_es.properties             |  5 +-
 .../login_fragments_zh_TW.properties          |  5 +-
 .../src/main/resources/templates/login.html   |  3 +-
 .../src/main/resources/templates/signup.html  |  2 +
 12 files changed, 104 insertions(+), 61 deletions(-)

diff --git a/application/src/main/resources/templates/gateway_modules/common_fragments.html b/application/src/main/resources/templates/gateway_modules/common_fragments.html
index 6ce5f4a414..cb0bd48b5e 100644
--- a/application/src/main/resources/templates/gateway_modules/common_fragments.html
+++ b/application/src/main/resources/templates/gateway_modules/common_fragments.html
@@ -119,3 +119,73 @@
         </ul>
     </th:block>
 </div>
+
+<div th:remove="tag" th:fragment="signupNoticeContent">
+    <style>
+        .signup-notice-content {
+            font-size: var(--text-sm);
+            color: var(--color-text);
+            text-align: center;
+            margin: 1em 0;
+        }
+
+        .signup-notice-content a {
+            color: var(--color-link);
+            text-decoration: none;
+        }
+    </style>
+    <div th:if="${globalInfo.allowRegistration}" class="signup-notice-content">
+        <div>
+            <th:block th:text="#{signupNotice.description}"></th:block>
+            <a th:href="@{/signup}" th:text="#{signupNotice.link}"></a>
+        </div>
+    </div>
+</div>
+
+<div th:remove="tag" th:fragment="loginNoticeContent">
+    <style>
+        .login-notice-content {
+            font-size: var(--text-sm);
+            color: var(--color-text);
+            text-align: center;
+            margin: 1em 0;
+        }
+
+        .login-notice-content a {
+            color: var(--color-link);
+            text-decoration: none;
+        }
+    </style>
+    <div th:if="${globalInfo.allowRegistration}" class="login-notice-content">
+        <div>
+            <th:block th:text="#{loginNotice.description}"></th:block>
+            <a th:href="@{/login}" th:text="#{loginNotice.link}"></a>
+        </div>
+    </div>
+</div>
+
+<div th:remove="tag" th:fragment="returnToSiteContent">
+    <style>
+        .returntosite-content {
+            font-size: var(--text-sm);
+            text-align: center;
+            margin: 1em 0;
+        }
+
+        .returntosite-content a {
+            color: var(--color-text);
+            display: inline-flex;
+            align-items: center;
+            gap: 0.3em;
+            text-decoration: none;
+        }
+    </style>
+    <div class="returntosite-content">
+        <a th:href="@{/}">
+            <svg viewBox="0 0 24 24" width="1.2em" height="1.2em">
+                <path fill="currentColor" d="M21 11H6.83l3.58-3.59L9 6l-6 6l6 6l1.41-1.42L6.83 13H21z"></path>
+            </svg>
+            <span th:text="#{returnToSite}"></span>
+        </a>
+    </div>
+</div>
diff --git a/application/src/main/resources/templates/gateway_modules/common_fragments.properties b/application/src/main/resources/templates/gateway_modules/common_fragments.properties
index f079f83e50..36f5946b88 100644
--- a/application/src/main/resources/templates/gateway_modules/common_fragments.properties
+++ b/application/src/main/resources/templates/gateway_modules/common_fragments.properties
@@ -1,3 +1,9 @@
 socialLogin.label=社交登录
 js.sendVerificationCode.success=发送成功
-js.sendVerificationCode.failed=发送失败，请稍后再试
\ No newline at end of file
+js.sendVerificationCode.failed=发送失败，请稍后再试
+
+signupNotice.description=没有账号？
+signupNotice.link=立即注册
+loginNotice.description=已有账号，
+loginNotice.link=立即登录
+returnToSite=返回网站
\ No newline at end of file
diff --git a/application/src/main/resources/templates/gateway_modules/common_fragments_en.properties b/application/src/main/resources/templates/gateway_modules/common_fragments_en.properties
index cb299c93a5..77019abe17 100644
--- a/application/src/main/resources/templates/gateway_modules/common_fragments_en.properties
+++ b/application/src/main/resources/templates/gateway_modules/common_fragments_en.properties
@@ -1,3 +1,9 @@
 socialLogin.label=Social Login
 js.sendVerificationCode.success=Sent Successfully
-js.sendVerificationCode.failed=Sending Failed, Please Try Again Later
\ No newline at end of file
+js.sendVerificationCode.failed=Sending Failed, Please Try Again Later
+
+signupNotice.description=Don't have an account?
+signupNotice.link=Sign up
+loginNotice.description=Already have an account,
+loginNotice.link=Login now
+returnToSite=Return to site
\ No newline at end of file
diff --git a/application/src/main/resources/templates/gateway_modules/common_fragments_es.properties b/application/src/main/resources/templates/gateway_modules/common_fragments_es.properties
index cbda753fe4..e79af38312 100644
--- a/application/src/main/resources/templates/gateway_modules/common_fragments_es.properties
+++ b/application/src/main/resources/templates/gateway_modules/common_fragments_es.properties
@@ -1,3 +1,9 @@
 socialLogin.label=Inicio de Sesión Social
 js.sendVerificationCode.success=Enviado con éxito
-js.sendVerificationCode.failed=Error al enviar, por favor intente nuevamente más tarde
\ No newline at end of file
+js.sendVerificationCode.failed=Error al enviar, por favor intente nuevamente más tarde
+
+signupNotice.description=¿No tienes una cuenta?
+signupNotice.link=Regístrate ahora
+loginNotice.description=Ya tienes una cuenta,
+loginNotice.link=Inicia sesión ahora
+returnToSite=Volver al sitio
\ No newline at end of file
diff --git a/application/src/main/resources/templates/gateway_modules/common_fragments_zh_TW.properties b/application/src/main/resources/templates/gateway_modules/common_fragments_zh_TW.properties
index d55ad22de9..ddc0d3f899 100644
--- a/application/src/main/resources/templates/gateway_modules/common_fragments_zh_TW.properties
+++ b/application/src/main/resources/templates/gateway_modules/common_fragments_zh_TW.properties
@@ -1,3 +1,9 @@
 socialLogin.label=社交登入
 js.sendVerificationCode.success=發送成功
-js.sendVerificationCode.failed=發送失敗，請稍後再試
\ No newline at end of file
+js.sendVerificationCode.failed=發送失敗，請稍後再試
+
+signupNotice.description=沒有帳號？
+signupNotice.link=立即註冊
+loginNotice.description=已有帳號，
+loginNotice.link=立即登入
+returnToSite=返回網站
\ No newline at end of file
diff --git a/application/src/main/resources/templates/gateway_modules/login_fragments.html b/application/src/main/resources/templates/gateway_modules/login_fragments.html
index 2d6d0f95cc..20cbfd22d0 100644
--- a/application/src/main/resources/templates/gateway_modules/login_fragments.html
+++ b/application/src/main/resources/templates/gateway_modules/login_fragments.html
@@ -18,45 +18,3 @@
         </ul>
     </th:block>
 </div>
-
-<div th:remove="tag" th:fragment="miscellaneous">
-    <style>
-        .signup-notice,
-        .returntosite-notice {
-            font-size: var(--text-sm);
-            color: var(--color-text);
-            text-align: center;
-            margin: 1em 0;
-        }
-
-        .signup-notice a {
-            color: var(--color-link);
-        }
-
-        .returntosite-notice a {
-            color: var(--color-text);
-            display: inline-flex;
-            align-items: center;
-            gap: 0.3em;
-        }
-
-        .returntosite-notice a,
-        .signup-notice a {
-            text-decoration: none;
-        }
-    </style>
-    <div th:if="${globalInfo.allowRegistration}" class="signup-notice">
-        <div>
-            <th:block th:text="#{signup.description}"></th:block>
-            <a th:href="@{/signup}" th:text="#{signup.link}"></a>
-        </div>
-    </div>
-    <div class="returntosite-notice">
-        <a th:href="@{/}">
-            <svg viewBox="0 0 24 24" width="1.2em" height="1.2em">
-                <path fill="currentColor" d="M21 11H6.83l3.58-3.59L9 6l-6 6l6 6l1.41-1.42L6.83 13H21z"></path>
-            </svg>
-            <span th:text="#{returnToSite}"></span>
-        </a>
-    </div>
-</div>
diff --git a/application/src/main/resources/templates/gateway_modules/login_fragments.properties b/application/src/main/resources/templates/gateway_modules/login_fragments.properties
index a5b4cc3d28..5396009aa6 100644
--- a/application/src/main/resources/templates/gateway_modules/login_fragments.properties
+++ b/application/src/main/resources/templates/gateway_modules/login_fragments.properties
@@ -1,7 +1,4 @@
 otherLogin.label=其他登录方式
-signup.description=没有账号？
-signup.link=立即注册
-returnToSite=返回网站
 
 # Rule: `formAuthProviders.${provider.metadata.name}.displayName`
 formAuthProviders.local.displayName=账号密码登录
\ No newline at end of file
diff --git a/application/src/main/resources/templates/gateway_modules/login_fragments_en.properties b/application/src/main/resources/templates/gateway_modules/login_fragments_en.properties
index 39a5fc7b5b..2ac24fcf27 100644
--- a/application/src/main/resources/templates/gateway_modules/login_fragments_en.properties
+++ b/application/src/main/resources/templates/gateway_modules/login_fragments_en.properties
@@ -1,7 +1,4 @@
 otherLogin.label=Other Login
-signup.description=Don't have an account?
-signup.link=Sign up
-returnToSite=Return to site
 
 # Rule: `formAuthProviders.${provider.metadata.name}.displayName`
 formAuthProviders.local.displayName=Login with credentials
\ No newline at end of file
diff --git a/application/src/main/resources/templates/gateway_modules/login_fragments_es.properties b/application/src/main/resources/templates/gateway_modules/login_fragments_es.properties
index a714b589ab..90da22132e 100644
--- a/application/src/main/resources/templates/gateway_modules/login_fragments_es.properties
+++ b/application/src/main/resources/templates/gateway_modules/login_fragments_es.properties
@@ -1,7 +1,4 @@
 otherLogin.label=Otras formas de inicio de sesión
-signup.description=¿No tienes una cuenta?
-signup.link=Regístrate ahora
-returnToSite=Volver al sitio
 
 # Rule: `formAuthProviders.${provider.metadata.name}.displayName`
-formAuthProviders.local.displayName=Iniciar sesión con credenciales
+formAuthProviders.local.displayName=Iniciar sesión con credenciales
\ No newline at end of file
diff --git a/application/src/main/resources/templates/gateway_modules/login_fragments_zh_TW.properties b/application/src/main/resources/templates/gateway_modules/login_fragments_zh_TW.properties
index b0e1012389..8a96457ded 100644
--- a/application/src/main/resources/templates/gateway_modules/login_fragments_zh_TW.properties
+++ b/application/src/main/resources/templates/gateway_modules/login_fragments_zh_TW.properties
@@ -1,7 +1,4 @@
 otherLogin.label=其他登入方式
-signup.description=沒有帳號？
-signup.link=立即註冊
-returnToSite=返回網站
 
 # Rule: `formAuthProviders.${provider.metadata.name}.displayName`
-formAuthProviders.local.displayName=帳號密碼登入
+formAuthProviders.local.displayName=帳號密碼登入
\ No newline at end of file
diff --git a/application/src/main/resources/templates/login.html b/application/src/main/resources/templates/login.html
index 4d8513891e..ac00d57c8c 100644
--- a/application/src/main/resources/templates/login.html
+++ b/application/src/main/resources/templates/login.html
@@ -13,7 +13,8 @@
                 <div th:replace="~{gateway_modules/common_fragments::socialAuthProviders}"></div>
             </div>
 
-            <div th:replace="~{gateway_modules/login_fragments::miscellaneous}"></div>
+            <div th:replace="~{gateway_modules/common_fragments::signupNoticeContent}"></div>
+            <div th:replace="~{gateway_modules/common_fragments::returnToSiteContent}"></div>
             <div th:replace="~{gateway_modules/common_fragments::languageSwitcher}"></div>
         </div>
     </th:block>
diff --git a/application/src/main/resources/templates/signup.html b/application/src/main/resources/templates/signup.html
index 1aca0da135..e602bad92b 100644
--- a/application/src/main/resources/templates/signup.html
+++ b/application/src/main/resources/templates/signup.html
@@ -18,6 +18,8 @@ <h1 class="form-title" th:text="#{title}"></h1>
                 <form th:replace="~{gateway_modules/form_fragments::signup}"></form>
                 <div th:replace="~{gateway_modules/common_fragments::socialAuthProviders}"></div>
             </div>
+            <div th:replace="~{gateway_modules/common_fragments::loginNoticeContent}"></div>
+            <div th:replace="~{gateway_modules/common_fragments::returnToSiteContent}"></div>
             <div th:replace="~{gateway_modules/common_fragments::languageSwitcher}"></div>
         </div>
     </th:block>

From 2585636c487645fd5a81039b06feb7f713ff4c42 Mon Sep 17 00:00:00 2001
From: guqing <38999863+guqing@users.noreply.github.com>
Date: Tue, 8 Oct 2024 22:56:55 +0800
Subject: [PATCH 101/185] feat: allow users to manage their attachments in uc
 (#6731)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?
/kind feature
/milestone 2.20.x
/area core

#### What this PR does / why we need it:
支持用户在个人中心管理自己的附件（需要具有对应权限）

Fixes https://github.com/halo-dev/halo/issues/5278

#### Does this PR introduce a user-facing change?
```release-note
支持用户在个人中心管理自己的附件（需要具有对应权限）
```
---
 api-docs/openapi/v3_0/aggregated.json         | 349 +++++++++----
 .../v3_0/apis_extension.api_v1alpha1.json     |  21 -
 .../openapi/v3_0/apis_uc.api_v1alpha1.json    | 387 +++++++++++---
 .../run/halo/app/infra/SystemSetting.java     |   1 +
 .../app/core/attachment/AttachmentLister.java |  10 +
 .../app/core/attachment/SearchRequest.java    | 110 ++++
 .../endpoint/AttachmentEndpoint.java          | 134 +----
 .../attachment/impl/AttachmentListerImpl.java |  37 ++
 ...ndpoint.java => UcAttachmentEndpoint.java} | 118 ++++-
 .../role-template-uc-attachment.yaml          |  15 +
 .../extensions/role-template-uc-content.yaml  |  14 +-
 .../resources/extensions/system-setting.yaml  |   5 +
 .../endpoint/AttachmentEndpointTest.java      |  25 +-
 .../components/AttachmentDetailModal.vue      |   8 +-
 .../components/AttachmentPermalinkList.vue    |  72 ---
 .../CoreSelectorProvider.vue                  |  21 +-
 .../attachments/composables/use-attachment.ts |  72 +--
 .../api-client/src/.openapi-generator/FILES   |   1 +
 .../src/api/attachment-v1alpha1-uc-api.ts     | 294 ++++++++++-
 ui/packages/api-client/src/models/index.ts    |   1 +
 .../src/models/uc-upload-request-form-data.ts |  38 ++
 .../src/models/user-connection-spec.ts        |  36 --
 .../attachment/AttachmentPermalinkList.vue    | 129 +++++
 ui/src/components/editor/DefaultEditor.vue    |  69 ++-
 .../editor/components/EditorLinkObtain.vue    |   4 +-
 .../inputs/attachment/AttachmentInput.vue     |  35 +-
 ui/src/locales/en.yaml                        |  47 ++
 ui/src/locales/zh-CN.yaml                     |  45 ++
 ui/src/locales/zh-TW.yaml                     |  45 ++
 .../components/AttachmentDetailModal.vue      | 167 ++++++
 .../components/AttachmentSelectorModal.vue    | 171 ++++++
 .../AttachmentUploadModal.vue                 |  35 ++
 .../CoreSelectorProvider.vue                  | 486 ++++++++++++++++++
 .../components/AttachmentSelectorListItem.vue |  83 +++
 .../modules/contents/attachments/module.ts    |   8 +
 .../posts/components/PostSettingForm.vue      |   4 +-
 36 files changed, 2514 insertions(+), 583 deletions(-)
 create mode 100644 application/src/main/java/run/halo/app/core/attachment/AttachmentLister.java
 create mode 100644 application/src/main/java/run/halo/app/core/attachment/SearchRequest.java
 create mode 100644 application/src/main/java/run/halo/app/core/attachment/impl/AttachmentListerImpl.java
 rename application/src/main/java/run/halo/app/core/endpoint/uc/{UcPostAttachmentEndpoint.java => UcAttachmentEndpoint.java} (69%)
 create mode 100644 application/src/main/resources/extensions/role-template-uc-attachment.yaml
 delete mode 100644 ui/console-src/modules/contents/attachments/components/AttachmentPermalinkList.vue
 create mode 100644 ui/packages/api-client/src/models/uc-upload-request-form-data.ts
 create mode 100644 ui/src/components/attachment/AttachmentPermalinkList.vue
 create mode 100644 ui/uc-src/modules/contents/attachments/components/AttachmentDetailModal.vue
 create mode 100644 ui/uc-src/modules/contents/attachments/components/AttachmentSelectorModal.vue
 create mode 100644 ui/uc-src/modules/contents/attachments/components/selector-providers/AttachmentUploadModal.vue
 create mode 100644 ui/uc-src/modules/contents/attachments/components/selector-providers/CoreSelectorProvider.vue
 create mode 100644 ui/uc-src/modules/contents/attachments/components/selector-providers/components/AttachmentSelectorListItem.vue
 create mode 100644 ui/uc-src/modules/contents/attachments/module.ts

diff --git a/api-docs/openapi/v3_0/aggregated.json b/api-docs/openapi/v3_0/aggregated.json
index 7426653032..79fafe85cc 100644
--- a/api-docs/openapi/v3_0/aggregated.json
+++ b/api-docs/openapi/v3_0/aggregated.json
@@ -14722,87 +14722,6 @@
         ]
       }
     },
-    "/apis/uc.api.content.halo.run/v1alpha1/attachments": {
-      "post": {
-        "description": "Create attachment for the given post.",
-        "operationId": "CreateAttachmentForPost",
-        "parameters": [
-          {
-            "description": "Wait for permalink.",
-            "in": "query",
-            "name": "waitForPermalink",
-            "schema": {
-              "type": "boolean"
-            }
-          }
-        ],
-        "requestBody": {
-          "content": {
-            "multipart/form-data": {
-              "schema": {
-                "$ref": "#/components/schemas/PostAttachmentRequest"
-              }
-            }
-          }
-        },
-        "responses": {
-          "default": {
-            "content": {
-              "*/*": {
-                "schema": {
-                  "$ref": "#/components/schemas/Attachment"
-                }
-              }
-            },
-            "description": "default response"
-          }
-        },
-        "tags": [
-          "AttachmentV1alpha1Uc"
-        ]
-      }
-    },
-    "/apis/uc.api.content.halo.run/v1alpha1/attachments/-/upload-from-url": {
-      "post": {
-        "description": "Upload attachment from the given URL.",
-        "operationId": "ExternalTransferAttachment_1",
-        "parameters": [
-          {
-            "description": "Wait for permalink.",
-            "in": "query",
-            "name": "waitForPermalink",
-            "schema": {
-              "type": "boolean"
-            }
-          }
-        ],
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/UploadFromUrlRequest"
-              }
-            }
-          },
-          "required": true
-        },
-        "responses": {
-          "default": {
-            "content": {
-              "*/*": {
-                "schema": {
-                  "$ref": "#/components/schemas/Attachment"
-                }
-              }
-            },
-            "description": "default response"
-          }
-        },
-        "tags": [
-          "AttachmentV1alpha1Uc"
-        ]
-      }
-    },
     "/apis/uc.api.content.halo.run/v1alpha1/posts": {
       "get": {
         "description": "List posts owned by the current user.",
@@ -15570,6 +15489,217 @@
           "PersonalAccessTokenV1alpha1Uc"
         ]
       }
+    },
+    "/apis/uc.api.storage.halo.run/v1alpha1/attachments": {
+      "get": {
+        "description": "List attachments of the current user uploaded.",
+        "operationId": "ListMyAttachments",
+        "parameters": [
+          {
+            "description": "Page number. Default is 0.",
+            "in": "query",
+            "name": "page",
+            "schema": {
+              "type": "integer",
+              "format": "int32"
+            }
+          },
+          {
+            "description": "Size number. Default is 0.",
+            "in": "query",
+            "name": "size",
+            "schema": {
+              "type": "integer",
+              "format": "int32"
+            }
+          },
+          {
+            "description": "Label selector. e.g.: hidden!\u003dtrue",
+            "in": "query",
+            "name": "labelSelector",
+            "schema": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          },
+          {
+            "description": "Field selector. e.g.: metadata.name\u003d\u003dhalo",
+            "in": "query",
+            "name": "fieldSelector",
+            "schema": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          },
+          {
+            "description": "Sorting criteria in the format: property,(asc|desc). Default sort order is ascending. Multiple sort criteria are supported.",
+            "in": "query",
+            "name": "sort",
+            "schema": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          },
+          {
+            "description": "Filter attachments without group. This parameter will ignore group parameter.",
+            "in": "query",
+            "name": "ungrouped",
+            "schema": {
+              "type": "boolean"
+            }
+          },
+          {
+            "description": "Keyword for searching.",
+            "in": "query",
+            "name": "keyword",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "description": "Acceptable media types.",
+            "in": "query",
+            "name": "accepts",
+            "schema": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          }
+        ],
+        "responses": {
+          "default": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/AttachmentList"
+                }
+              }
+            },
+            "description": "default response"
+          }
+        },
+        "tags": [
+          "AttachmentV1alpha1Uc"
+        ]
+      },
+      "post": {
+        "description": "Create attachment for the given post.",
+        "operationId": "CreateAttachmentForPost",
+        "parameters": [
+          {
+            "description": "Wait for permalink.",
+            "in": "query",
+            "name": "waitForPermalink",
+            "schema": {
+              "type": "boolean"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "multipart/form-data": {
+              "schema": {
+                "$ref": "#/components/schemas/PostAttachmentRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "default": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/Attachment"
+                }
+              }
+            },
+            "description": "default response"
+          }
+        },
+        "tags": [
+          "AttachmentV1alpha1Uc"
+        ]
+      }
+    },
+    "/apis/uc.api.storage.halo.run/v1alpha1/attachments/-/upload": {
+      "post": {
+        "description": "Upload attachment to user center storage.",
+        "operationId": "UploadUcAttachment",
+        "requestBody": {
+          "content": {
+            "multipart/form-data": {
+              "schema": {
+                "$ref": "#/components/schemas/UcUploadRequest"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "default": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/Attachment"
+                }
+              }
+            },
+            "description": "default response"
+          }
+        },
+        "tags": [
+          "AttachmentV1alpha1Uc"
+        ]
+      }
+    },
+    "/apis/uc.api.storage.halo.run/v1alpha1/attachments/-/upload-from-url": {
+      "post": {
+        "description": "Upload attachment from the given URL.",
+        "operationId": "ExternalTransferAttachment_1",
+        "parameters": [
+          {
+            "description": "Wait for permalink.",
+            "in": "query",
+            "name": "waitForPermalink",
+            "schema": {
+              "type": "boolean"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/UploadFromUrlRequest"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "default": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/Attachment"
+                }
+              }
+            },
+            "description": "default response"
+          }
+        },
+        "tags": [
+          "AttachmentV1alpha1Uc"
+        ]
+      }
     }
   },
   "components": {
@@ -19740,6 +19870,9 @@
           }
         }
       },
+      "Part": {
+        "type": "object"
+      },
       "PasswordRequest": {
         "required": [
           "password"
@@ -23476,6 +23609,39 @@
           }
         }
       },
+      "UcUploadRequest": {
+        "required": [
+          "file"
+        ],
+        "type": "object",
+        "properties": {
+          "file": {
+            "type": "string",
+            "format": "binary"
+          },
+          "formData": {
+            "type": "object",
+            "properties": {
+              "all": {
+                "type": "object",
+                "additionalProperties": {
+                  "$ref": "#/components/schemas/Part"
+                },
+                "writeOnly": true
+              },
+              "empty": {
+                "type": "boolean"
+              }
+            },
+            "additionalProperties": {
+              "type": "array",
+              "items": {
+                "$ref": "#/components/schemas/Part"
+              }
+            }
+          }
+        }
+      },
       "UpgradeFromUriRequest": {
         "required": [
           "uri"
@@ -23625,36 +23791,15 @@
       },
       "UserConnectionSpec": {
         "required": [
-          "accessToken",
-          "displayName",
           "providerUserId",
           "registrationId",
           "username"
         ],
         "type": "object",
         "properties": {
-          "accessToken": {
-            "type": "string"
-          },
-          "avatarUrl": {
-            "type": "string"
-          },
-          "displayName": {
-            "type": "string"
-          },
-          "expiresAt": {
-            "type": "string",
-            "format": "date-time"
-          },
-          "profileUrl": {
-            "type": "string"
-          },
           "providerUserId": {
             "type": "string"
           },
-          "refreshToken": {
-            "type": "string"
-          },
           "registrationId": {
             "type": "string"
           },
diff --git a/api-docs/openapi/v3_0/apis_extension.api_v1alpha1.json b/api-docs/openapi/v3_0/apis_extension.api_v1alpha1.json
index da95940039..c3607a4242 100644
--- a/api-docs/openapi/v3_0/apis_extension.api_v1alpha1.json
+++ b/api-docs/openapi/v3_0/apis_extension.api_v1alpha1.json
@@ -13261,36 +13261,15 @@
       },
       "UserConnectionSpec": {
         "required": [
-          "accessToken",
-          "displayName",
           "providerUserId",
           "registrationId",
           "username"
         ],
         "type": "object",
         "properties": {
-          "accessToken": {
-            "type": "string"
-          },
-          "avatarUrl": {
-            "type": "string"
-          },
-          "displayName": {
-            "type": "string"
-          },
-          "expiresAt": {
-            "type": "string",
-            "format": "date-time"
-          },
-          "profileUrl": {
-            "type": "string"
-          },
           "providerUserId": {
             "type": "string"
           },
-          "refreshToken": {
-            "type": "string"
-          },
           "registrationId": {
             "type": "string"
           },
diff --git a/api-docs/openapi/v3_0/apis_uc.api_v1alpha1.json b/api-docs/openapi/v3_0/apis_uc.api_v1alpha1.json
index 7c8eb55b5b..88e7c7c5fa 100644
--- a/api-docs/openapi/v3_0/apis_uc.api_v1alpha1.json
+++ b/api-docs/openapi/v3_0/apis_uc.api_v1alpha1.json
@@ -17,87 +17,6 @@
     }
   ],
   "paths": {
-    "/apis/uc.api.content.halo.run/v1alpha1/attachments": {
-      "post": {
-        "description": "Create attachment for the given post.",
-        "operationId": "CreateAttachmentForPost",
-        "parameters": [
-          {
-            "description": "Wait for permalink.",
-            "in": "query",
-            "name": "waitForPermalink",
-            "schema": {
-              "type": "boolean"
-            }
-          }
-        ],
-        "requestBody": {
-          "content": {
-            "multipart/form-data": {
-              "schema": {
-                "$ref": "#/components/schemas/PostAttachmentRequest"
-              }
-            }
-          }
-        },
-        "responses": {
-          "default": {
-            "content": {
-              "*/*": {
-                "schema": {
-                  "$ref": "#/components/schemas/Attachment"
-                }
-              }
-            },
-            "description": "default response"
-          }
-        },
-        "tags": [
-          "AttachmentV1alpha1Uc"
-        ]
-      }
-    },
-    "/apis/uc.api.content.halo.run/v1alpha1/attachments/-/upload-from-url": {
-      "post": {
-        "description": "Upload attachment from the given URL.",
-        "operationId": "ExternalTransferAttachment",
-        "parameters": [
-          {
-            "description": "Wait for permalink.",
-            "in": "query",
-            "name": "waitForPermalink",
-            "schema": {
-              "type": "boolean"
-            }
-          }
-        ],
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/UploadFromUrlRequest"
-              }
-            }
-          },
-          "required": true
-        },
-        "responses": {
-          "default": {
-            "content": {
-              "*/*": {
-                "schema": {
-                  "$ref": "#/components/schemas/Attachment"
-                }
-              }
-            },
-            "description": "default response"
-          }
-        },
-        "tags": [
-          "AttachmentV1alpha1Uc"
-        ]
-      }
-    },
     "/apis/uc.api.content.halo.run/v1alpha1/posts": {
       "get": {
         "description": "List posts owned by the current user.",
@@ -865,6 +784,217 @@
           "PersonalAccessTokenV1alpha1Uc"
         ]
       }
+    },
+    "/apis/uc.api.storage.halo.run/v1alpha1/attachments": {
+      "get": {
+        "description": "List attachments of the current user uploaded.",
+        "operationId": "ListMyAttachments",
+        "parameters": [
+          {
+            "description": "Page number. Default is 0.",
+            "in": "query",
+            "name": "page",
+            "schema": {
+              "type": "integer",
+              "format": "int32"
+            }
+          },
+          {
+            "description": "Size number. Default is 0.",
+            "in": "query",
+            "name": "size",
+            "schema": {
+              "type": "integer",
+              "format": "int32"
+            }
+          },
+          {
+            "description": "Label selector. e.g.: hidden!\u003dtrue",
+            "in": "query",
+            "name": "labelSelector",
+            "schema": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          },
+          {
+            "description": "Field selector. e.g.: metadata.name\u003d\u003dhalo",
+            "in": "query",
+            "name": "fieldSelector",
+            "schema": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          },
+          {
+            "description": "Sorting criteria in the format: property,(asc|desc). Default sort order is ascending. Multiple sort criteria are supported.",
+            "in": "query",
+            "name": "sort",
+            "schema": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          },
+          {
+            "description": "Filter attachments without group. This parameter will ignore group parameter.",
+            "in": "query",
+            "name": "ungrouped",
+            "schema": {
+              "type": "boolean"
+            }
+          },
+          {
+            "description": "Keyword for searching.",
+            "in": "query",
+            "name": "keyword",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "description": "Acceptable media types.",
+            "in": "query",
+            "name": "accepts",
+            "schema": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          }
+        ],
+        "responses": {
+          "default": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/AttachmentList"
+                }
+              }
+            },
+            "description": "default response"
+          }
+        },
+        "tags": [
+          "AttachmentV1alpha1Uc"
+        ]
+      },
+      "post": {
+        "description": "Create attachment for the given post.",
+        "operationId": "CreateAttachmentForPost",
+        "parameters": [
+          {
+            "description": "Wait for permalink.",
+            "in": "query",
+            "name": "waitForPermalink",
+            "schema": {
+              "type": "boolean"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "multipart/form-data": {
+              "schema": {
+                "$ref": "#/components/schemas/PostAttachmentRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "default": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/Attachment"
+                }
+              }
+            },
+            "description": "default response"
+          }
+        },
+        "tags": [
+          "AttachmentV1alpha1Uc"
+        ]
+      }
+    },
+    "/apis/uc.api.storage.halo.run/v1alpha1/attachments/-/upload": {
+      "post": {
+        "description": "Upload attachment to user center storage.",
+        "operationId": "UploadUcAttachment",
+        "requestBody": {
+          "content": {
+            "multipart/form-data": {
+              "schema": {
+                "$ref": "#/components/schemas/UcUploadRequest"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "default": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/Attachment"
+                }
+              }
+            },
+            "description": "default response"
+          }
+        },
+        "tags": [
+          "AttachmentV1alpha1Uc"
+        ]
+      }
+    },
+    "/apis/uc.api.storage.halo.run/v1alpha1/attachments/-/upload-from-url": {
+      "post": {
+        "description": "Upload attachment from the given URL.",
+        "operationId": "ExternalTransferAttachment",
+        "parameters": [
+          {
+            "description": "Wait for permalink.",
+            "in": "query",
+            "name": "waitForPermalink",
+            "schema": {
+              "type": "boolean"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/UploadFromUrlRequest"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "default": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/Attachment"
+                }
+              }
+            },
+            "description": "default response"
+          }
+        },
+        "tags": [
+          "AttachmentV1alpha1Uc"
+        ]
+      }
     }
   },
   "components": {
@@ -920,6 +1050,65 @@
           }
         }
       },
+      "AttachmentList": {
+        "required": [
+          "first",
+          "hasNext",
+          "hasPrevious",
+          "items",
+          "last",
+          "page",
+          "size",
+          "total",
+          "totalPages"
+        ],
+        "type": "object",
+        "properties": {
+          "first": {
+            "type": "boolean",
+            "description": "Indicates whether current page is the first page."
+          },
+          "hasNext": {
+            "type": "boolean",
+            "description": "Indicates whether current page has previous page."
+          },
+          "hasPrevious": {
+            "type": "boolean",
+            "description": "Indicates whether current page has previous page."
+          },
+          "items": {
+            "type": "array",
+            "description": "A chunk of items.",
+            "items": {
+              "$ref": "#/components/schemas/Attachment"
+            }
+          },
+          "last": {
+            "type": "boolean",
+            "description": "Indicates whether current page is the last page."
+          },
+          "page": {
+            "type": "integer",
+            "description": "Page number, starts from 1. If not set or equal to 0, it means no pagination.",
+            "format": "int32"
+          },
+          "size": {
+            "type": "integer",
+            "description": "Size of each page. If not set or equal to 0, it means no pagination.",
+            "format": "int32"
+          },
+          "total": {
+            "type": "integer",
+            "description": "Total elements.",
+            "format": "int64"
+          },
+          "totalPages": {
+            "type": "integer",
+            "description": "Indicates total pages.",
+            "format": "int64"
+          }
+        }
+      },
       "AttachmentSpec": {
         "type": "object",
         "properties": {
@@ -1442,6 +1631,9 @@
           }
         }
       },
+      "Part": {
+        "type": "object"
+      },
       "PasswordRequest": {
         "required": [
           "password"
@@ -2022,6 +2214,39 @@
           }
         }
       },
+      "UcUploadRequest": {
+        "required": [
+          "file"
+        ],
+        "type": "object",
+        "properties": {
+          "file": {
+            "type": "string",
+            "format": "binary"
+          },
+          "formData": {
+            "type": "object",
+            "properties": {
+              "all": {
+                "type": "object",
+                "additionalProperties": {
+                  "$ref": "#/components/schemas/Part"
+                },
+                "writeOnly": true
+              },
+              "empty": {
+                "type": "boolean"
+              }
+            },
+            "additionalProperties": {
+              "type": "array",
+              "items": {
+                "$ref": "#/components/schemas/Part"
+              }
+            }
+          }
+        }
+      },
       "UploadFromUrlRequest": {
         "required": [
           "url"
diff --git a/api/src/main/java/run/halo/app/infra/SystemSetting.java b/api/src/main/java/run/halo/app/infra/SystemSetting.java
index 9beabb6c4f..8475cc76eb 100644
--- a/api/src/main/java/run/halo/app/infra/SystemSetting.java
+++ b/api/src/main/java/run/halo/app/infra/SystemSetting.java
@@ -71,6 +71,7 @@ public static class User {
         boolean mustVerifyEmailOnRegistration;
         String defaultRole;
         String avatarPolicy;
+        String ucAttachmentPolicy;
     }
 
     @Data
diff --git a/application/src/main/java/run/halo/app/core/attachment/AttachmentLister.java b/application/src/main/java/run/halo/app/core/attachment/AttachmentLister.java
new file mode 100644
index 0000000000..ed57380428
--- /dev/null
+++ b/application/src/main/java/run/halo/app/core/attachment/AttachmentLister.java
@@ -0,0 +1,10 @@
+package run.halo.app.core.attachment;
+
+import reactor.core.publisher.Mono;
+import run.halo.app.core.extension.attachment.Attachment;
+import run.halo.app.extension.ListResult;
+
+public interface AttachmentLister {
+
+    Mono<ListResult<Attachment>> listBy(SearchRequest searchRequest);
+}
diff --git a/application/src/main/java/run/halo/app/core/attachment/SearchRequest.java b/application/src/main/java/run/halo/app/core/attachment/SearchRequest.java
new file mode 100644
index 0000000000..05ead06ba5
--- /dev/null
+++ b/application/src/main/java/run/halo/app/core/attachment/SearchRequest.java
@@ -0,0 +1,110 @@
+package run.halo.app.core.attachment;
+
+import static org.springdoc.core.fn.builders.arrayschema.Builder.arraySchemaBuilder;
+import static org.springdoc.core.fn.builders.parameter.Builder.parameterBuilder;
+import static org.springdoc.core.fn.builders.schema.Builder.schemaBuilder;
+import static org.springframework.boot.convert.ApplicationConversionService.getSharedInstance;
+import static run.halo.app.extension.index.query.QueryFactory.contains;
+import static run.halo.app.extension.index.query.QueryFactory.in;
+import static run.halo.app.extension.index.query.QueryFactory.isNull;
+import static run.halo.app.extension.index.query.QueryFactory.not;
+import static run.halo.app.extension.index.query.QueryFactory.startsWith;
+
+import io.swagger.v3.oas.annotations.enums.ParameterIn;
+import java.util.List;
+import java.util.Optional;
+import org.springdoc.core.fn.builders.operation.Builder;
+import org.springframework.util.CollectionUtils;
+import org.springframework.util.StringUtils;
+import org.springframework.web.reactive.function.server.ServerRequest;
+import run.halo.app.extension.ListOptions;
+import run.halo.app.extension.index.query.QueryFactory;
+import run.halo.app.extension.router.IListRequest;
+import run.halo.app.extension.router.QueryParamBuildUtil;
+import run.halo.app.extension.router.SortableRequest;
+
+public class SearchRequest extends SortableRequest {
+
+    public SearchRequest(ServerRequest request) {
+        super(request.exchange());
+    }
+
+    public Optional<String> getKeyword() {
+        return Optional.ofNullable(queryParams.getFirst("keyword"))
+            .filter(StringUtils::hasText);
+    }
+
+    public Optional<Boolean> getUngrouped() {
+        return Optional.ofNullable(queryParams.getFirst("ungrouped"))
+            .map(ungroupedStr -> getSharedInstance().convert(ungroupedStr, Boolean.class));
+    }
+
+    public Optional<List<String>> getAccepts() {
+        return Optional.ofNullable(queryParams.get("accepts"))
+            .filter(accepts -> !accepts.isEmpty()
+                && !accepts.contains("*")
+                && !accepts.contains("*/*")
+            );
+    }
+
+    public ListOptions toListOptions(List<String> hiddenGroups) {
+        var builder = ListOptions.builder(super.toListOptions());
+
+        getKeyword().ifPresent(keyword -> {
+            builder.andQuery(contains("spec.displayName", keyword));
+        });
+
+        getUngrouped()
+            .filter(ungrouped -> ungrouped)
+            .ifPresent(ungrouped -> builder.andQuery(isNull("spec.groupName")));
+
+        if (!CollectionUtils.isEmpty(hiddenGroups)) {
+            builder.andQuery(not(in("spec.groupName", hiddenGroups)));
+        }
+
+        getAccepts().flatMap(accepts -> accepts.stream()
+                .filter(StringUtils::hasText)
+                .map(accept -> accept.replace("/*", "/").toLowerCase())
+                .distinct()
+                .map(accept -> startsWith("spec.mediaType", accept))
+                .reduce(QueryFactory::or)
+            )
+            .ifPresent(builder::andQuery);
+
+        return builder.build();
+    }
+
+    public static void buildParameters(Builder builder) {
+        IListRequest.buildParameters(builder);
+        builder.parameter(QueryParamBuildUtil.sortParameter())
+            .parameter(parameterBuilder()
+                .in(ParameterIn.QUERY)
+                .name("ungrouped")
+                .required(false)
+                .description("""
+                    Filter attachments without group. This parameter will ignore group \
+                    parameter.\
+                    """)
+                .implementation(Boolean.class))
+            .parameter(parameterBuilder()
+                .in(ParameterIn.QUERY)
+                .name("keyword")
+                .required(false)
+                .description("Keyword for searching.")
+                .implementation(String.class))
+            .parameter(parameterBuilder()
+                .in(ParameterIn.QUERY)
+                .name("accepts")
+                .required(false)
+                .description("Acceptable media types.")
+                .array(
+                    arraySchemaBuilder()
+                        .uniqueItems(true)
+                        .schema(schemaBuilder()
+                            .implementation(String.class)
+                            .example("image/*"))
+                )
+                .implementationArray(String.class)
+            );
+    }
+}
diff --git a/application/src/main/java/run/halo/app/core/attachment/endpoint/AttachmentEndpoint.java b/application/src/main/java/run/halo/app/core/attachment/endpoint/AttachmentEndpoint.java
index a79e0f3268..6ecdd19e9a 100644
--- a/application/src/main/java/run/halo/app/core/attachment/endpoint/AttachmentEndpoint.java
+++ b/application/src/main/java/run/halo/app/core/attachment/endpoint/AttachmentEndpoint.java
@@ -2,37 +2,23 @@
 
 import static io.swagger.v3.oas.annotations.media.Schema.RequiredMode.REQUIRED;
 import static org.springdoc.core.fn.builders.apiresponse.Builder.responseBuilder;
-import static org.springdoc.core.fn.builders.arrayschema.Builder.arraySchemaBuilder;
 import static org.springdoc.core.fn.builders.content.Builder.contentBuilder;
-import static org.springdoc.core.fn.builders.parameter.Builder.parameterBuilder;
 import static org.springdoc.core.fn.builders.requestbody.Builder.requestBodyBuilder;
 import static org.springdoc.core.fn.builders.schema.Builder.schemaBuilder;
-import static org.springframework.boot.convert.ApplicationConversionService.getSharedInstance;
 import static org.springframework.web.reactive.function.server.RequestPredicates.contentType;
 import static run.halo.app.extension.ListResult.generateGenericClass;
-import static run.halo.app.extension.index.query.QueryFactory.contains;
-import static run.halo.app.extension.index.query.QueryFactory.in;
-import static run.halo.app.extension.index.query.QueryFactory.isNull;
-import static run.halo.app.extension.index.query.QueryFactory.not;
-import static run.halo.app.extension.index.query.QueryFactory.startsWith;
 
-import io.swagger.v3.oas.annotations.enums.ParameterIn;
 import io.swagger.v3.oas.annotations.media.Schema;
 import java.net.URL;
-import java.util.List;
 import java.util.Objects;
-import java.util.Optional;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
-import org.springdoc.core.fn.builders.operation.Builder;
 import org.springdoc.webflux.core.fn.SpringdocRouteBuilder;
-import org.springframework.data.domain.Sort;
 import org.springframework.http.MediaType;
 import org.springframework.http.codec.multipart.FilePart;
 import org.springframework.http.codec.multipart.FormFieldPart;
 import org.springframework.http.codec.multipart.Part;
 import org.springframework.stereotype.Component;
-import org.springframework.util.CollectionUtils;
 import org.springframework.util.MultiValueMap;
 import org.springframework.util.StringUtils;
 import org.springframework.web.reactive.function.BodyExtractors;
@@ -41,18 +27,11 @@
 import org.springframework.web.reactive.function.server.ServerResponse;
 import org.springframework.web.server.ServerWebInputException;
 import reactor.core.publisher.Mono;
+import run.halo.app.core.attachment.AttachmentLister;
+import run.halo.app.core.attachment.SearchRequest;
 import run.halo.app.core.extension.attachment.Attachment;
-import run.halo.app.core.extension.attachment.Group;
 import run.halo.app.core.extension.endpoint.CustomEndpoint;
 import run.halo.app.core.extension.service.AttachmentService;
-import run.halo.app.extension.ListOptions;
-import run.halo.app.extension.PageRequestImpl;
-import run.halo.app.extension.ReactiveExtensionClient;
-import run.halo.app.extension.index.query.QueryFactory;
-import run.halo.app.extension.router.IListRequest;
-import run.halo.app.extension.router.QueryParamBuildUtil;
-import run.halo.app.extension.router.SortableRequest;
-import run.halo.app.extension.router.selector.LabelSelector;
 
 @Slf4j
 @Component
@@ -61,7 +40,7 @@ public class AttachmentEndpoint implements CustomEndpoint {
 
     private final AttachmentService attachmentService;
 
-    private final ReactiveExtensionClient client;
+    private final AttachmentLister attachmentLister;
 
     @Override
     public RouterFunction<ServerResponse> endpoint() {
@@ -131,112 +110,13 @@ public RouterFunction<ServerResponse> endpoint() {
 
     Mono<ServerResponse> search(ServerRequest request) {
         var searchRequest = new SearchRequest(request);
-        var groupListOptions = new ListOptions();
-        groupListOptions.setLabelSelector(LabelSelector.builder()
-            .exists(Group.HIDDEN_LABEL)
-            .build());
-        return client.listAll(Group.class, groupListOptions, Sort.unsorted())
-            .map(group -> group.getMetadata().getName())
-            .collectList()
-            .defaultIfEmpty(List.of())
-            .flatMap(hiddenGroups -> client.listBy(Attachment.class,
-                        searchRequest.toListOptions(hiddenGroups),
-                        PageRequestImpl.of(searchRequest.getPage(), searchRequest.getSize(),
-                            searchRequest.getSort())
-                    )
-                    .flatMap(listResult -> ServerResponse.ok()
-                        .contentType(MediaType.APPLICATION_JSON)
-                        .bodyValue(listResult)
-                    )
+        return attachmentLister.listBy(searchRequest)
+            .flatMap(listResult -> ServerResponse.ok()
+                .contentType(MediaType.APPLICATION_JSON)
+                .bodyValue(listResult)
             );
     }
 
-    public static class SearchRequest extends SortableRequest {
-
-        public SearchRequest(ServerRequest request) {
-            super(request.exchange());
-        }
-
-        public Optional<String> getKeyword() {
-            return Optional.ofNullable(queryParams.getFirst("keyword"))
-                .filter(StringUtils::hasText);
-        }
-
-        public Optional<Boolean> getUngrouped() {
-            return Optional.ofNullable(queryParams.getFirst("ungrouped"))
-                .map(ungroupedStr -> getSharedInstance().convert(ungroupedStr, Boolean.class));
-        }
-
-        public Optional<List<String>> getAccepts() {
-            return Optional.ofNullable(queryParams.get("accepts"))
-                .filter(accepts -> !accepts.isEmpty()
-                    && !accepts.contains("*")
-                    && !accepts.contains("*/*")
-                );
-        }
-
-        public ListOptions toListOptions(List<String> hiddenGroups) {
-            var builder = ListOptions.builder(super.toListOptions());
-
-            getKeyword().ifPresent(keyword -> {
-                builder.andQuery(contains("spec.displayName", keyword));
-            });
-
-            getUngrouped()
-                .filter(ungrouped -> ungrouped)
-                .ifPresent(ungrouped -> builder.andQuery(isNull("spec.groupName")));
-
-            if (!CollectionUtils.isEmpty(hiddenGroups)) {
-                builder.andQuery(not(in("spec.groupName", hiddenGroups)));
-            }
-
-            getAccepts().flatMap(accepts -> accepts.stream()
-                    .filter(StringUtils::hasText)
-                    .map(accept -> accept.replace("/*", "/").toLowerCase())
-                    .distinct()
-                    .map(accept -> startsWith("spec.mediaType", accept))
-                    .reduce(QueryFactory::or)
-                )
-                .ifPresent(builder::andQuery);
-
-            return builder.build();
-        }
-
-        public static void buildParameters(Builder builder) {
-            IListRequest.buildParameters(builder);
-            builder.parameter(QueryParamBuildUtil.sortParameter())
-                .parameter(parameterBuilder()
-                    .in(ParameterIn.QUERY)
-                    .name("ungrouped")
-                    .required(false)
-                    .description("""
-                        Filter attachments without group. This parameter will ignore group \
-                        parameter.\
-                        """)
-                    .implementation(Boolean.class))
-                .parameter(parameterBuilder()
-                    .in(ParameterIn.QUERY)
-                    .name("keyword")
-                    .required(false)
-                    .description("Keyword for searching.")
-                    .implementation(String.class))
-                .parameter(parameterBuilder()
-                    .in(ParameterIn.QUERY)
-                    .name("accepts")
-                    .required(false)
-                    .description("Acceptable media types.")
-                    .array(
-                        arraySchemaBuilder()
-                            .uniqueItems(true)
-                            .schema(schemaBuilder()
-                                .implementation(String.class)
-                                .example("image/*"))
-                    )
-                    .implementationArray(String.class)
-                );
-        }
-    }
-
     public record UploadFromUrlRequest(@Schema(requiredMode = REQUIRED) URL url,
                                        @Schema(requiredMode = REQUIRED) String policyName,
                                        String groupName,
diff --git a/application/src/main/java/run/halo/app/core/attachment/impl/AttachmentListerImpl.java b/application/src/main/java/run/halo/app/core/attachment/impl/AttachmentListerImpl.java
new file mode 100644
index 0000000000..3f0511d5d6
--- /dev/null
+++ b/application/src/main/java/run/halo/app/core/attachment/impl/AttachmentListerImpl.java
@@ -0,0 +1,37 @@
+package run.halo.app.core.attachment.impl;
+
+import java.util.List;
+import lombok.RequiredArgsConstructor;
+import org.springframework.data.domain.Sort;
+import org.springframework.stereotype.Component;
+import reactor.core.publisher.Mono;
+import run.halo.app.core.attachment.AttachmentLister;
+import run.halo.app.core.attachment.SearchRequest;
+import run.halo.app.core.extension.attachment.Attachment;
+import run.halo.app.core.extension.attachment.Group;
+import run.halo.app.extension.ListOptions;
+import run.halo.app.extension.ListResult;
+import run.halo.app.extension.ReactiveExtensionClient;
+
+@Component
+@RequiredArgsConstructor
+public class AttachmentListerImpl implements AttachmentLister {
+    private final ReactiveExtensionClient client;
+
+    @Override
+    public Mono<ListResult<Attachment>> listBy(SearchRequest searchRequest) {
+        var groupListOptions = ListOptions.builder()
+            .labelSelector()
+            .exists(Group.HIDDEN_LABEL)
+            .end()
+            .build();
+        return client.listAll(Group.class, groupListOptions, Sort.unsorted())
+            .map(group -> group.getMetadata().getName())
+            .collectList()
+            .defaultIfEmpty(List.of())
+            .flatMap(hiddenGroups -> client.listBy(Attachment.class,
+                searchRequest.toListOptions(hiddenGroups),
+                searchRequest.toPageRequest()
+            ));
+    }
+}
diff --git a/application/src/main/java/run/halo/app/core/endpoint/uc/UcPostAttachmentEndpoint.java b/application/src/main/java/run/halo/app/core/endpoint/uc/UcAttachmentEndpoint.java
similarity index 69%
rename from application/src/main/java/run/halo/app/core/endpoint/uc/UcPostAttachmentEndpoint.java
rename to application/src/main/java/run/halo/app/core/endpoint/uc/UcAttachmentEndpoint.java
index 0e04701a77..48f5cbdd0c 100644
--- a/application/src/main/java/run/halo/app/core/endpoint/uc/UcPostAttachmentEndpoint.java
+++ b/application/src/main/java/run/halo/app/core/endpoint/uc/UcAttachmentEndpoint.java
@@ -9,13 +9,17 @@
 import static org.springdoc.core.fn.builders.schema.Builder.schemaBuilder;
 import static org.springdoc.webflux.core.fn.SpringdocRouteBuilder.route;
 import static org.springframework.web.reactive.function.server.RequestPredicates.contentType;
+import static run.halo.app.extension.index.query.QueryFactory.equal;
 
 import io.swagger.v3.oas.annotations.enums.ParameterIn;
 import io.swagger.v3.oas.annotations.media.Schema;
 import java.net.URL;
 import java.util.HashMap;
+import java.util.List;
 import java.util.Objects;
 import java.util.function.Consumer;
+import lombok.Builder;
+import lombok.Getter;
 import org.apache.commons.lang3.StringUtils;
 import org.springframework.http.MediaType;
 import org.springframework.http.codec.multipart.FilePart;
@@ -25,6 +29,7 @@
 import org.springframework.security.core.context.ReactiveSecurityContextHolder;
 import org.springframework.security.core.context.SecurityContext;
 import org.springframework.stereotype.Component;
+import org.springframework.util.Assert;
 import org.springframework.util.MultiValueMap;
 import org.springframework.web.reactive.function.BodyExtractors;
 import org.springframework.web.reactive.function.server.RouterFunction;
@@ -32,31 +37,40 @@
 import org.springframework.web.reactive.function.server.ServerResponse;
 import org.springframework.web.server.ServerWebInputException;
 import reactor.core.publisher.Mono;
+import reactor.core.scheduler.Schedulers;
 import run.halo.app.content.PostService;
+import run.halo.app.core.attachment.AttachmentLister;
+import run.halo.app.core.attachment.SearchRequest;
 import run.halo.app.core.extension.attachment.Attachment;
 import run.halo.app.core.extension.content.Post;
 import run.halo.app.core.extension.endpoint.CustomEndpoint;
 import run.halo.app.core.extension.service.AttachmentService;
 import run.halo.app.extension.GroupVersion;
+import run.halo.app.extension.ListOptions;
+import run.halo.app.extension.ListResult;
 import run.halo.app.infra.SystemConfigurableEnvironmentFetcher;
 import run.halo.app.infra.SystemSetting;
 import run.halo.app.infra.exception.NotFoundException;
 
 @Component
-public class UcPostAttachmentEndpoint implements CustomEndpoint {
+public class UcAttachmentEndpoint implements CustomEndpoint {
 
     public static final String POST_NAME_LABEL = "content.halo.run/post-name";
     public static final String SINGLE_PAGE_NAME_LABEL = "content.halo.run/single-page-name";
 
     private final AttachmentService attachmentService;
 
+    private final AttachmentLister attachmentLister;
+
     private final PostService postService;
 
     private final SystemConfigurableEnvironmentFetcher systemSettingFetcher;
 
-    public UcPostAttachmentEndpoint(AttachmentService attachmentService, PostService postService,
+    public UcAttachmentEndpoint(AttachmentService attachmentService,
+        AttachmentLister attachmentLister, PostService postService,
         SystemConfigurableEnvironmentFetcher systemSettingFetcher) {
         this.attachmentService = attachmentService;
+        this.attachmentLister = attachmentLister;
         this.postService = postService;
         this.systemSettingFetcher = systemSettingFetcher;
     }
@@ -82,6 +96,19 @@ public RouterFunction<ServerResponse> endpoint() {
                     )
                     .response(responseBuilder().implementation(Attachment.class))
             )
+            .POST("/attachments/-/upload", contentType(MediaType.MULTIPART_FORM_DATA),
+                this::uploadAttachment, builder -> builder
+                    .operationId("UploadUcAttachment")
+                    .description("Upload attachment to user center storage.")
+                    .tag(tag)
+                    .requestBody(requestBodyBuilder()
+                        .required(true)
+                        .content(contentBuilder()
+                            .mediaType(MediaType.MULTIPART_FORM_DATA_VALUE)
+                            .schema(schemaBuilder().implementation(UcUploadRequest.class))
+                        ))
+                    .response(responseBuilder().implementation(Attachment.class))
+            )
             .POST("/attachments/-/upload-from-url", contentType(MediaType.APPLICATION_JSON),
                 this::uploadFromUrlForPost,
                 builder -> builder
@@ -103,9 +130,94 @@ public RouterFunction<ServerResponse> endpoint() {
                     .response(responseBuilder().implementation(Attachment.class))
                     .build()
             )
+            .GET("/attachments", this::listMyAttachments, builder -> {
+                builder.operationId("ListMyAttachments")
+                    .description("List attachments of the current user uploaded.")
+                    .tag(tag)
+                    .response(responseBuilder()
+                        .implementation(ListResult.generateGenericClass(Attachment.class))
+                    );
+                SearchRequest.buildParameters(builder);
+            })
             .build();
     }
 
+    private Mono<ServerResponse> uploadAttachment(ServerRequest request) {
+        var builder = UploadContext.builder();
+        var filePartMono = request.body(BodyExtractors.toMultipartData())
+            .map(UcUploadRequest::new)
+            .switchIfEmpty(
+                Mono.error(new ServerWebInputException("Required request body is missing.")))
+            .doOnNext(uploadRequest -> builder.filePart(uploadRequest.getFile()))
+            .subscribeOn(Schedulers.boundedElastic());
+
+        var ownerMono = getCurrentUser()
+            .doOnNext(builder::owner);
+
+        var storagePolicyMono =
+            systemSettingFetcher.fetch(SystemSetting.User.GROUP, SystemSetting.User.class)
+                .mapNotNull(SystemSetting.User::getUcAttachmentPolicy)
+                .filter(StringUtils::isNotBlank)
+                .switchIfEmpty(Mono.error(new ServerWebInputException(
+                    "Please contact the administrator to configure the storage policy."))
+                )
+                .doOnNext(builder::storagePolicy)
+                .subscribeOn(Schedulers.boundedElastic());
+
+        return Mono.when(filePartMono, storagePolicyMono, ownerMono)
+            .then(Mono.fromSupplier(builder::build))
+            .flatMap(context -> attachmentService.upload(context.owner(),
+                context.storagePolicy(), null, context.filePart(), null)
+            )
+            .flatMap(attachment -> ServerResponse.ok().bodyValue(attachment));
+    }
+
+    private Mono<ServerResponse> listMyAttachments(ServerRequest request) {
+        return getCurrentUser()
+            .flatMap(username -> {
+                var searchRequest = new UcSearchRequest(request, username);
+                return attachmentLister.listBy(searchRequest)
+                    .flatMap(listResult -> ServerResponse.ok()
+                        .contentType(MediaType.APPLICATION_JSON)
+                        .bodyValue(listResult)
+                    );
+            });
+    }
+
+    @Builder
+    record UploadContext(String owner, String storagePolicy, FilePart filePart) {
+    }
+
+    public record UcUploadRequest(MultiValueMap<String, Part> formData) {
+
+        @Schema(description = "The file to upload.", requiredMode = REQUIRED)
+        public FilePart getFile() {
+            if (formData.getFirst("file") instanceof FilePart file) {
+                return file;
+            }
+            throw new ServerWebInputException("Invalid part of file");
+        }
+    }
+
+    @Getter
+    public static class UcSearchRequest extends SearchRequest {
+        private final String owner;
+
+        public UcSearchRequest(ServerRequest request, String owner) {
+            super(request);
+            Assert.state(StringUtils.isNotBlank(owner), "Owner must not be blank.");
+            this.owner = owner;
+        }
+
+        @Override
+        public ListOptions toListOptions(List<String> hiddenGroups) {
+            var listOptions = super.toListOptions(hiddenGroups);
+            return ListOptions.builder(listOptions)
+                .andQuery((equal("spec.ownerName", owner)))
+                .build();
+        }
+    }
+
     private Mono<ServerResponse> uploadFromUrlForPost(ServerRequest request) {
         var uploadFromUrlRequestMono = request.bodyToMono(UploadFromUrlRequest.class);
 
@@ -218,7 +330,7 @@ private Mono<String> getCurrentUser() {
 
     @Override
     public GroupVersion groupVersion() {
-        return GroupVersion.parseAPIVersion("uc.api.content.halo.run/v1alpha1");
+        return GroupVersion.parseAPIVersion("uc.api.storage.halo.run/v1alpha1");
     }
 
     public record UploadFromUrlRequest(@Schema(requiredMode = REQUIRED) URL url,
diff --git a/application/src/main/resources/extensions/role-template-uc-attachment.yaml b/application/src/main/resources/extensions/role-template-uc-attachment.yaml
new file mode 100644
index 0000000000..132b358aef
--- /dev/null
+++ b/application/src/main/resources/extensions/role-template-uc-attachment.yaml
@@ -0,0 +1,15 @@
+apiVersion: v1alpha1
+kind: Role
+metadata:
+  name: role-template-uc-attachment-manager
+  labels:
+    halo.run/role-template: "true"
+  annotations:
+    rbac.authorization.halo.run/module: "Attachments Management"
+    rbac.authorization.halo.run/display-name: "UC Attachment Manage"
+    rbac.authorization.halo.run/ui-permissions: |
+      [ "uc:attachments:manage" ]
+rules:
+  - apiGroups: [ "uc.api.storage.halo.run" ]
+    resources: [ "attachments", "attachments/upload", "attachments/upload-from-url" ]
+    verbs: [ "create", "list" ]
diff --git a/application/src/main/resources/extensions/role-template-uc-content.yaml b/application/src/main/resources/extensions/role-template-uc-content.yaml
index 575d68e68e..60c20d7e0c 100644
--- a/application/src/main/resources/extensions/role-template-uc-content.yaml
+++ b/application/src/main/resources/extensions/role-template-uc-content.yaml
@@ -40,7 +40,7 @@ metadata:
     rbac.authorization.halo.run/display-name: "Post Author"
     rbac.authorization.halo.run/dependencies: |
       [ "role-template-post-contributor", "role-template-post-publisher", "role-template-recycle-my-post",
-        "role-template-post-attachment-manager" ]
+        "role-template-uc-attachment-manager" ]
 rules: [ ]
 
 ---
@@ -100,6 +100,7 @@ rules:
     verbs: [ "update" ]
 
 ---
+# TODO remove this in next major version
 apiVersion: v1alpha1
 kind: Role
 metadata:
@@ -121,17 +122,10 @@ apiVersion: v1alpha1
 kind: Role
 metadata:
   name: role-template-post-attachment-manager
+  deletionTimestamp: 2024-09-30T14:00:41.813954138Z
   labels:
     halo.run/role-template: "true"
   annotations:
     rbac.authorization.halo.run/module: "Posts Management"
     rbac.authorization.halo.run/display-name: "Post Attachment Manager"
-    rbac.authorization.halo.run/ui-permissions: |
-      [ "uc:attachments:manage" ]
-rules:
-  - apiGroups: [ "uc.api.content.halo.run" ]
-    resources: [ "attachments" ]
-    verbs: [ "create", "update", "delete" ]
-  - apiGroups: [ "uc.api.content.halo.run" ]
-    resources: [ "attachments/upload-from-url" ]
-    verbs: [ "create" ]
+rules: [ ]
diff --git a/application/src/main/resources/extensions/system-setting.yaml b/application/src/main/resources/extensions/system-setting.yaml
index eaf4414840..60626a1243 100644
--- a/application/src/main/resources/extensions/system-setting.yaml
+++ b/application/src/main/resources/extensions/system-setting.yaml
@@ -118,6 +118,11 @@ spec:
           label: "头像存储位置"
           value: "default-policy"
           help: 指定用户上传头像的存储策略
+        - $formkit: attachmentPolicySelect
+          name: ucAttachmentPolicy
+          label: "个人中心附件存储位置"
+          value: "default-policy"
+          help: 指定用户在个人中心上传的附件的存储位置
     - group: comment
       label: 评论设置
       formSchema:
diff --git a/application/src/test/java/run/halo/app/core/extension/attachment/endpoint/AttachmentEndpointTest.java b/application/src/test/java/run/halo/app/core/extension/attachment/endpoint/AttachmentEndpointTest.java
index fb0a1ba56a..bd0f77d2b0 100644
--- a/application/src/test/java/run/halo/app/core/extension/attachment/endpoint/AttachmentEndpointTest.java
+++ b/application/src/test/java/run/halo/app/core/extension/attachment/endpoint/AttachmentEndpointTest.java
@@ -1,8 +1,6 @@
 package run.halo.app.core.extension.attachment.endpoint;
 
 import static org.mockito.ArgumentMatchers.any;
-import static org.mockito.ArgumentMatchers.eq;
-import static org.mockito.ArgumentMatchers.same;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.never;
 import static org.mockito.Mockito.verify;
@@ -19,7 +17,6 @@
 import org.mockito.Mock;
 import org.mockito.junit.jupiter.MockitoExtension;
 import org.springframework.core.io.buffer.DataBuffer;
-import org.springframework.data.domain.Sort;
 import org.springframework.http.HttpStatusCode;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
@@ -28,16 +25,15 @@
 import org.springframework.web.reactive.function.BodyInserters;
 import reactor.core.publisher.Flux;
 import reactor.core.publisher.Mono;
+import run.halo.app.core.attachment.AttachmentLister;
 import run.halo.app.core.attachment.endpoint.AttachmentEndpoint;
 import run.halo.app.core.extension.attachment.Attachment;
-import run.halo.app.core.extension.attachment.Group;
 import run.halo.app.core.extension.attachment.Policy;
 import run.halo.app.core.extension.attachment.Policy.PolicySpec;
 import run.halo.app.core.user.service.impl.DefaultAttachmentService;
 import run.halo.app.extension.ConfigMap;
 import run.halo.app.extension.ListResult;
 import run.halo.app.extension.Metadata;
-import run.halo.app.extension.PageRequest;
 import run.halo.app.extension.ReactiveExtensionClient;
 import run.halo.app.infra.ReactiveUrlDataBufferFetcher;
 import run.halo.app.plugin.extensionpoint.ExtensionGetter;
@@ -54,6 +50,9 @@ class AttachmentEndpointTest {
     @Mock
     ReactiveUrlDataBufferFetcher dataBufferFetcher;
 
+    @Mock
+    AttachmentLister attachmentLister;
+
     AttachmentEndpoint endpoint;
 
     WebTestClient webClient;
@@ -62,7 +61,7 @@ class AttachmentEndpointTest {
     void setUp() {
         var attachmentService =
             new DefaultAttachmentService(client, extensionGetter, dataBufferFetcher);
-        endpoint = new AttachmentEndpoint(attachmentService, client);
+        endpoint = new AttachmentEndpoint(attachmentService, attachmentLister);
         webClient = WebTestClient.bindToRouterFunction(endpoint.endpoint())
             .apply(springSecurity())
             .build();
@@ -240,11 +239,7 @@ class SearchTest {
 
         @Test
         void shouldListUngroupedAttachments() {
-            when(client.listAll(eq(Group.class), any(), any(Sort.class)))
-                .thenReturn(Flux.empty());
-
-            when(client.listBy(same(Attachment.class), any(), any(PageRequest.class)))
-                .thenReturn(Mono.just(ListResult.emptyResult()));
+            when(attachmentLister.listBy(any())).thenReturn(Mono.just(ListResult.emptyResult()));
 
             webClient
                 .get()
@@ -257,11 +252,7 @@ void shouldListUngroupedAttachments() {
 
         @Test
         void searchAttachmentWhenGroupIsEmpty() {
-            when(client.listAll(eq(Group.class), any(), any(Sort.class)))
-                .thenReturn(Flux.empty());
-
-            when(client.listBy(eq(Attachment.class), any(), any(PageRequest.class)))
-                .thenReturn(Mono.empty());
+            when(attachmentLister.listBy(any())).thenReturn(Mono.just(ListResult.emptyResult()));
 
             webClient
                 .get()
@@ -269,7 +260,7 @@ void searchAttachmentWhenGroupIsEmpty() {
                 .exchange()
                 .expectStatus().isOk();
 
-            verify(client).listBy(eq(Attachment.class), any(), any(PageRequest.class));
+            verify(attachmentLister).listBy(any());
         }
     }
 
diff --git a/ui/console-src/modules/contents/attachments/components/AttachmentDetailModal.vue b/ui/console-src/modules/contents/attachments/components/AttachmentDetailModal.vue
index 2111013cb7..c82fa25783 100644
--- a/ui/console-src/modules/contents/attachments/components/AttachmentDetailModal.vue
+++ b/ui/console-src/modules/contents/attachments/components/AttachmentDetailModal.vue
@@ -1,4 +1,5 @@
 <script lang="ts" setup>
+import AttachmentPermalinkList from "@/components/attachment/AttachmentPermalinkList.vue";
 import LazyImage from "@/components/image/LazyImage.vue";
 import { formatDatetime } from "@/utils/date";
 import { isImage } from "@/utils/image";
@@ -14,8 +15,7 @@ import {
 } from "@halo-dev/components";
 import { useQuery } from "@tanstack/vue-query";
 import prettyBytes from "pretty-bytes";
-import { computed, ref, toRefs } from "vue";
-import AttachmentPermalinkList from "./AttachmentPermalinkList.vue";
+import { computed, ref, toRefs, useTemplateRef } from "vue";
 import DisplayNameEditForm from "./DisplayNameEditForm.vue";
 
 const props = withDefaults(
@@ -35,6 +35,7 @@ const emit = defineEmits<{
 
 const { name } = toRefs(props);
 
+const modal = useTemplateRef<InstanceType<typeof VModal> | null>("modal");
 const onlyPreview = ref(false);
 
 const { data: attachment, isLoading } = useQuery({
@@ -92,6 +93,7 @@ const showDisplayNameForm = ref(false);
 </script>
 <template>
   <VModal
+    ref="modal"
     :title="
       $t('core.attachment.detail_modal.title', {
         display_name: attachment?.spec.displayName || '',
@@ -235,7 +237,7 @@ const showDisplayNameForm = ref(false);
 
     <template #footer>
       <VSpace>
-        <VButton type="default" @click="emit('close')">
+        <VButton type="default" @click="modal?.close()">
           {{ $t("core.common.buttons.close_and_shortcut") }}
         </VButton>
         <slot name="footer" />
diff --git a/ui/console-src/modules/contents/attachments/components/AttachmentPermalinkList.vue b/ui/console-src/modules/contents/attachments/components/AttachmentPermalinkList.vue
deleted file mode 100644
index 1338f1cca2..0000000000
--- a/ui/console-src/modules/contents/attachments/components/AttachmentPermalinkList.vue
+++ /dev/null
@@ -1,72 +0,0 @@
-<script lang="ts" setup>
-import type { Attachment } from "@halo-dev/api-client";
-import { VButton } from "@halo-dev/components";
-import { computed, toRefs } from "vue";
-import { useAttachmentPermalinkCopy } from "../composables/use-attachment";
-
-const props = withDefaults(
-  defineProps<{
-    attachment?: Attachment;
-    mountToBody?: boolean;
-  }>(),
-  {
-    attachment: undefined,
-    mountToBody: false,
-  }
-);
-
-const { attachment } = toRefs(props);
-
-const { handleCopy, htmlText, markdownText } =
-  useAttachmentPermalinkCopy(attachment);
-
-const formats = computed(
-  (): {
-    label: string;
-    key: "url" | "html" | "markdown";
-    value?: string;
-  }[] => {
-    return [
-      {
-        label: "URL",
-        key: "url",
-        value: attachment?.value?.status?.permalink,
-      },
-      {
-        label: "HTML",
-        key: "html",
-        value: htmlText.value,
-      },
-      {
-        label: "Markdown",
-        key: "markdown",
-        value: markdownText.value,
-      },
-    ];
-  }
-);
-</script>
-
-<template>
-  <ul class="flex flex-col space-y-2">
-    <li v-for="format in formats" :key="format.key">
-      <div
-        class="flex w-full cursor-pointer items-center justify-between space-x-3 rounded border p-3 hover:border-primary"
-      >
-        <div class="flex flex-1 flex-col space-y-2 text-xs text-gray-900">
-          <span class="font-semibold">
-            {{ format.label }}
-          </span>
-          <span class="break-all">
-            {{ format.value }}
-          </span>
-        </div>
-        <div>
-          <VButton size="sm" @click="handleCopy(format.key)">
-            {{ $t("core.common.buttons.copy") }}
-          </VButton>
-        </div>
-      </div>
-    </li>
-  </ul>
-</template>
diff --git a/ui/console-src/modules/contents/attachments/components/selector-providers/CoreSelectorProvider.vue b/ui/console-src/modules/contents/attachments/components/selector-providers/CoreSelectorProvider.vue
index aa39d787d3..45f40381af 100644
--- a/ui/console-src/modules/contents/attachments/components/selector-providers/CoreSelectorProvider.vue
+++ b/ui/console-src/modules/contents/attachments/components/selector-providers/CoreSelectorProvider.vue
@@ -259,14 +259,19 @@ const viewType = useLocalStorage("attachment-selector-view-type", "grid");
 
   <AttachmentGroupList readonly @select="onGroupSelect" />
 
-  <div v-if="attachments?.length" class="mb-5">
-    <VButton @click="uploadVisible = true">
-      <template #icon>
-        <IconUpload class="h-full w-full" />
-      </template>
-      {{ $t("core.common.buttons.upload") }}
-    </VButton>
-  </div>
+  <HasPermission
+    v-if="attachments?.length"
+    :permissions="['system:attachments:manage']"
+  >
+    <div class="mb-5">
+      <VButton @click="uploadVisible = true">
+        <template #icon>
+          <IconUpload class="h-full w-full" />
+        </template>
+        {{ $t("core.common.buttons.upload") }}
+      </VButton>
+    </div>
+  </HasPermission>
 
   <VLoading v-if="isLoading" />
 
diff --git a/ui/console-src/modules/contents/attachments/composables/use-attachment.ts b/ui/console-src/modules/contents/attachments/composables/use-attachment.ts
index 1a386fd1fb..cb900fa528 100644
--- a/ui/console-src/modules/contents/attachments/composables/use-attachment.ts
+++ b/ui/console-src/modules/contents/attachments/composables/use-attachment.ts
@@ -1,10 +1,8 @@
-import { matchMediaType } from "@/utils/media-type";
 import type { Attachment } from "@halo-dev/api-client";
 import { consoleApiClient, coreApiClient } from "@halo-dev/api-client";
 import { Dialog, Toast } from "@halo-dev/components";
 import { useQuery } from "@tanstack/vue-query";
-import { useClipboard } from "@vueuse/core";
-import { computed, nextTick, ref, watch, type Ref } from "vue";
+import { nextTick, ref, watch, type Ref } from "vue";
 import { useI18n } from "vue-i18n";
 
 interface useAttachmentControlReturn {
@@ -237,71 +235,3 @@ export function useAttachmentControl(filterOptions: {
     handleReset,
   };
 }
-
-export function useAttachmentPermalinkCopy(
-  attachment: Ref<Attachment | undefined>
-) {
-  const { copy } = useClipboard({ legacy: true });
-  const { t } = useI18n();
-
-  const mediaType = computed(() => {
-    return attachment.value?.spec.mediaType;
-  });
-
-  const isImage = computed(() => {
-    return mediaType.value && matchMediaType(mediaType.value, "image/*");
-  });
-
-  const isVideo = computed(() => {
-    return mediaType.value && matchMediaType(mediaType.value, "video/*");
-  });
-
-  const isAudio = computed(() => {
-    return mediaType.value && matchMediaType(mediaType.value, "audio/*");
-  });
-
-  const htmlText = computed(() => {
-    const { permalink } = attachment.value?.status || {};
-    const { displayName } = attachment.value?.spec || {};
-
-    if (isImage.value) {
-      return `<img src="${permalink}" alt="${displayName}" />`;
-    } else if (isVideo.value) {
-      return `<video src="${permalink}"></video>`;
-    } else if (isAudio.value) {
-      return `<audio src="${permalink}"></audio>`;
-    }
-    return `<a href="${permalink}">${displayName}</a>`;
-  });
-
-  const markdownText = computed(() => {
-    const { permalink } = attachment.value?.status || {};
-    const { displayName } = attachment.value?.spec || {};
-    if (isImage.value) {
-      return `![${displayName}](${permalink})`;
-    }
-    return `[${displayName}](${permalink})`;
-  });
-
-  const handleCopy = (format: "markdown" | "html" | "url") => {
-    const { permalink } = attachment.value?.status || {};
-
-    if (!permalink) return;
-
-    if (format === "url") {
-      copy(permalink);
-    } else if (format === "markdown") {
-      copy(markdownText.value);
-    } else if (format === "html") {
-      copy(htmlText.value);
-    }
-
-    Toast.success(t("core.common.toast.copy_success"));
-  };
-
-  return {
-    htmlText,
-    markdownText,
-    handleCopy,
-  };
-}
diff --git a/ui/packages/api-client/src/.openapi-generator/FILES b/ui/packages/api-client/src/.openapi-generator/FILES
index fe7e5a16eb..4aa1855785 100644
--- a/ui/packages/api-client/src/.openapi-generator/FILES
+++ b/ui/packages/api-client/src/.openapi-generator/FILES
@@ -323,6 +323,7 @@ models/thumbnail.ts
 models/totp-auth-link-response.ts
 models/totp-request.ts
 models/two-factor-auth-settings.ts
+models/uc-upload-request-form-data.ts
 models/upgrade-from-uri-request.ts
 models/upload-from-url-request.ts
 models/user-connection-list.ts
diff --git a/ui/packages/api-client/src/api/attachment-v1alpha1-uc-api.ts b/ui/packages/api-client/src/api/attachment-v1alpha1-uc-api.ts
index 109d280a7f..26cdda13d3 100644
--- a/ui/packages/api-client/src/api/attachment-v1alpha1-uc-api.ts
+++ b/ui/packages/api-client/src/api/attachment-v1alpha1-uc-api.ts
@@ -24,6 +24,10 @@ import { BASE_PATH, COLLECTION_FORMATS, RequestArgs, BaseAPI, RequiredError, ope
 // @ts-ignore
 import { Attachment } from '../models';
 // @ts-ignore
+import { AttachmentList } from '../models';
+// @ts-ignore
+import { UcUploadRequestFormData } from '../models';
+// @ts-ignore
 import { UploadFromUrlRequest } from '../models';
 /**
  * AttachmentV1alpha1UcApi - axios parameter creator
@@ -43,7 +47,7 @@ export const AttachmentV1alpha1UcApiAxiosParamCreator = function (configuration?
         createAttachmentForPost: async (file: File, waitForPermalink?: boolean, postName?: string, singlePageName?: string, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
             // verify required parameter 'file' is not null or undefined
             assertParamExists('createAttachmentForPost', 'file', file)
-            const localVarPath = `/apis/uc.api.content.halo.run/v1alpha1/attachments`;
+            const localVarPath = `/apis/uc.api.storage.halo.run/v1alpha1/attachments`;
             // use dummy base URL string because the URL constructor only accepts absolute URLs.
             const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
             let baseOptions;
@@ -104,7 +108,7 @@ export const AttachmentV1alpha1UcApiAxiosParamCreator = function (configuration?
         externalTransferAttachment1: async (uploadFromUrlRequest: UploadFromUrlRequest, waitForPermalink?: boolean, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
             // verify required parameter 'uploadFromUrlRequest' is not null or undefined
             assertParamExists('externalTransferAttachment1', 'uploadFromUrlRequest', uploadFromUrlRequest)
-            const localVarPath = `/apis/uc.api.content.halo.run/v1alpha1/attachments/-/upload-from-url`;
+            const localVarPath = `/apis/uc.api.storage.halo.run/v1alpha1/attachments/-/upload-from-url`;
             // use dummy base URL string because the URL constructor only accepts absolute URLs.
             const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
             let baseOptions;
@@ -137,6 +141,136 @@ export const AttachmentV1alpha1UcApiAxiosParamCreator = function (configuration?
             localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
             localVarRequestOptions.data = serializeDataIfNeeded(uploadFromUrlRequest, localVarRequestOptions, configuration)
 
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+        /**
+         * List attachments of the current user uploaded.
+         * @param {number} [page] Page number. Default is 0.
+         * @param {number} [size] Size number. Default is 0.
+         * @param {Array<string>} [labelSelector] Label selector. e.g.: hidden!&#x3D;true
+         * @param {Array<string>} [fieldSelector] Field selector. e.g.: metadata.name&#x3D;&#x3D;halo
+         * @param {Array<string>} [sort] Sorting criteria in the format: property,(asc|desc). Default sort order is ascending. Multiple sort criteria are supported.
+         * @param {boolean} [ungrouped] Filter attachments without group. This parameter will ignore group parameter.
+         * @param {string} [keyword] Keyword for searching.
+         * @param {Array<string>} [accepts] Acceptable media types.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        listMyAttachments: async (page?: number, size?: number, labelSelector?: Array<string>, fieldSelector?: Array<string>, sort?: Array<string>, ungrouped?: boolean, keyword?: string, accepts?: Array<string>, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            const localVarPath = `/apis/uc.api.storage.halo.run/v1alpha1/attachments`;
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+
+            const localVarRequestOptions = { method: 'GET', ...baseOptions, ...options};
+            const localVarHeaderParameter = {} as any;
+            const localVarQueryParameter = {} as any;
+
+            // authentication basicAuth required
+            // http basic authentication required
+            setBasicAuthToObject(localVarRequestOptions, configuration)
+
+            // authentication bearerAuth required
+            // http bearer authentication required
+            await setBearerAuthToObject(localVarHeaderParameter, configuration)
+
+            if (page !== undefined) {
+                localVarQueryParameter['page'] = page;
+            }
+
+            if (size !== undefined) {
+                localVarQueryParameter['size'] = size;
+            }
+
+            if (labelSelector) {
+                localVarQueryParameter['labelSelector'] = labelSelector;
+            }
+
+            if (fieldSelector) {
+                localVarQueryParameter['fieldSelector'] = fieldSelector;
+            }
+
+            if (sort) {
+                localVarQueryParameter['sort'] = sort;
+            }
+
+            if (ungrouped !== undefined) {
+                localVarQueryParameter['ungrouped'] = ungrouped;
+            }
+
+            if (keyword !== undefined) {
+                localVarQueryParameter['keyword'] = keyword;
+            }
+
+            if (accepts) {
+                localVarQueryParameter['accepts'] = accepts;
+            }
+
+
+    
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
+
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+        /**
+         * Upload attachment to user center storage.
+         * @param {File} file 
+         * @param {UcUploadRequestFormData} [formData] 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        uploadUcAttachment: async (file: File, formData?: UcUploadRequestFormData, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            // verify required parameter 'file' is not null or undefined
+            assertParamExists('uploadUcAttachment', 'file', file)
+            const localVarPath = `/apis/uc.api.storage.halo.run/v1alpha1/attachments/-/upload`;
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+
+            const localVarRequestOptions = { method: 'POST', ...baseOptions, ...options};
+            const localVarHeaderParameter = {} as any;
+            const localVarQueryParameter = {} as any;
+            const localVarFormParams = new ((configuration && configuration.formDataCtor) || FormData)();
+
+            // authentication basicAuth required
+            // http basic authentication required
+            setBasicAuthToObject(localVarRequestOptions, configuration)
+
+            // authentication bearerAuth required
+            // http bearer authentication required
+            await setBearerAuthToObject(localVarHeaderParameter, configuration)
+
+
+            if (file !== undefined) { 
+                localVarFormParams.append('file', file as any);
+            }
+    
+            if (formData !== undefined) { 
+                localVarFormParams.append('formData', new Blob([JSON.stringify(formData)], { type: "application/json", }));
+            }
+    
+    
+            localVarHeaderParameter['Content-Type'] = 'multipart/form-data';
+    
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
+            localVarRequestOptions.data = localVarFormParams;
+
             return {
                 url: toPathString(localVarUrlObj),
                 options: localVarRequestOptions,
@@ -180,6 +314,38 @@ export const AttachmentV1alpha1UcApiFp = function(configuration?: Configuration)
             const localVarOperationServerBasePath = operationServerMap['AttachmentV1alpha1UcApi.externalTransferAttachment1']?.[localVarOperationServerIndex]?.url;
             return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
         },
+        /**
+         * List attachments of the current user uploaded.
+         * @param {number} [page] Page number. Default is 0.
+         * @param {number} [size] Size number. Default is 0.
+         * @param {Array<string>} [labelSelector] Label selector. e.g.: hidden!&#x3D;true
+         * @param {Array<string>} [fieldSelector] Field selector. e.g.: metadata.name&#x3D;&#x3D;halo
+         * @param {Array<string>} [sort] Sorting criteria in the format: property,(asc|desc). Default sort order is ascending. Multiple sort criteria are supported.
+         * @param {boolean} [ungrouped] Filter attachments without group. This parameter will ignore group parameter.
+         * @param {string} [keyword] Keyword for searching.
+         * @param {Array<string>} [accepts] Acceptable media types.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async listMyAttachments(page?: number, size?: number, labelSelector?: Array<string>, fieldSelector?: Array<string>, sort?: Array<string>, ungrouped?: boolean, keyword?: string, accepts?: Array<string>, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<AttachmentList>> {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.listMyAttachments(page, size, labelSelector, fieldSelector, sort, ungrouped, keyword, accepts, options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['AttachmentV1alpha1UcApi.listMyAttachments']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
+        /**
+         * Upload attachment to user center storage.
+         * @param {File} file 
+         * @param {UcUploadRequestFormData} [formData] 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async uploadUcAttachment(file: File, formData?: UcUploadRequestFormData, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<Attachment>> {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.uploadUcAttachment(file, formData, options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['AttachmentV1alpha1UcApi.uploadUcAttachment']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
     }
 };
 
@@ -208,6 +374,24 @@ export const AttachmentV1alpha1UcApiFactory = function (configuration?: Configur
         externalTransferAttachment1(requestParameters: AttachmentV1alpha1UcApiExternalTransferAttachment1Request, options?: RawAxiosRequestConfig): AxiosPromise<Attachment> {
             return localVarFp.externalTransferAttachment1(requestParameters.uploadFromUrlRequest, requestParameters.waitForPermalink, options).then((request) => request(axios, basePath));
         },
+        /**
+         * List attachments of the current user uploaded.
+         * @param {AttachmentV1alpha1UcApiListMyAttachmentsRequest} requestParameters Request parameters.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        listMyAttachments(requestParameters: AttachmentV1alpha1UcApiListMyAttachmentsRequest = {}, options?: RawAxiosRequestConfig): AxiosPromise<AttachmentList> {
+            return localVarFp.listMyAttachments(requestParameters.page, requestParameters.size, requestParameters.labelSelector, requestParameters.fieldSelector, requestParameters.sort, requestParameters.ungrouped, requestParameters.keyword, requestParameters.accepts, options).then((request) => request(axios, basePath));
+        },
+        /**
+         * Upload attachment to user center storage.
+         * @param {AttachmentV1alpha1UcApiUploadUcAttachmentRequest} requestParameters Request parameters.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        uploadUcAttachment(requestParameters: AttachmentV1alpha1UcApiUploadUcAttachmentRequest, options?: RawAxiosRequestConfig): AxiosPromise<Attachment> {
+            return localVarFp.uploadUcAttachment(requestParameters.file, requestParameters.formData, options).then((request) => request(axios, basePath));
+        },
     };
 };
 
@@ -267,6 +451,90 @@ export interface AttachmentV1alpha1UcApiExternalTransferAttachment1Request {
     readonly waitForPermalink?: boolean
 }
 
+/**
+ * Request parameters for listMyAttachments operation in AttachmentV1alpha1UcApi.
+ * @export
+ * @interface AttachmentV1alpha1UcApiListMyAttachmentsRequest
+ */
+export interface AttachmentV1alpha1UcApiListMyAttachmentsRequest {
+    /**
+     * Page number. Default is 0.
+     * @type {number}
+     * @memberof AttachmentV1alpha1UcApiListMyAttachments
+     */
+    readonly page?: number
+
+    /**
+     * Size number. Default is 0.
+     * @type {number}
+     * @memberof AttachmentV1alpha1UcApiListMyAttachments
+     */
+    readonly size?: number
+
+    /**
+     * Label selector. e.g.: hidden!&#x3D;true
+     * @type {Array<string>}
+     * @memberof AttachmentV1alpha1UcApiListMyAttachments
+     */
+    readonly labelSelector?: Array<string>
+
+    /**
+     * Field selector. e.g.: metadata.name&#x3D;&#x3D;halo
+     * @type {Array<string>}
+     * @memberof AttachmentV1alpha1UcApiListMyAttachments
+     */
+    readonly fieldSelector?: Array<string>
+
+    /**
+     * Sorting criteria in the format: property,(asc|desc). Default sort order is ascending. Multiple sort criteria are supported.
+     * @type {Array<string>}
+     * @memberof AttachmentV1alpha1UcApiListMyAttachments
+     */
+    readonly sort?: Array<string>
+
+    /**
+     * Filter attachments without group. This parameter will ignore group parameter.
+     * @type {boolean}
+     * @memberof AttachmentV1alpha1UcApiListMyAttachments
+     */
+    readonly ungrouped?: boolean
+
+    /**
+     * Keyword for searching.
+     * @type {string}
+     * @memberof AttachmentV1alpha1UcApiListMyAttachments
+     */
+    readonly keyword?: string
+
+    /**
+     * Acceptable media types.
+     * @type {Array<string>}
+     * @memberof AttachmentV1alpha1UcApiListMyAttachments
+     */
+    readonly accepts?: Array<string>
+}
+
+/**
+ * Request parameters for uploadUcAttachment operation in AttachmentV1alpha1UcApi.
+ * @export
+ * @interface AttachmentV1alpha1UcApiUploadUcAttachmentRequest
+ */
+export interface AttachmentV1alpha1UcApiUploadUcAttachmentRequest {
+    /**
+     * 
+     * @type {File}
+     * @memberof AttachmentV1alpha1UcApiUploadUcAttachment
+     */
+    readonly file: File
+
+    /**
+     * 
+     * @type {UcUploadRequestFormData}
+     * @memberof AttachmentV1alpha1UcApiUploadUcAttachment
+     */
+    readonly formData?: UcUploadRequestFormData
+}
+
 /**
  * AttachmentV1alpha1UcApi - object-oriented interface
  * @export
@@ -295,5 +563,27 @@ export class AttachmentV1alpha1UcApi extends BaseAPI {
     public externalTransferAttachment1(requestParameters: AttachmentV1alpha1UcApiExternalTransferAttachment1Request, options?: RawAxiosRequestConfig) {
         return AttachmentV1alpha1UcApiFp(this.configuration).externalTransferAttachment1(requestParameters.uploadFromUrlRequest, requestParameters.waitForPermalink, options).then((request) => request(this.axios, this.basePath));
     }
+
+    /**
+     * List attachments of the current user uploaded.
+     * @param {AttachmentV1alpha1UcApiListMyAttachmentsRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof AttachmentV1alpha1UcApi
+     */
+    public listMyAttachments(requestParameters: AttachmentV1alpha1UcApiListMyAttachmentsRequest = {}, options?: RawAxiosRequestConfig) {
+        return AttachmentV1alpha1UcApiFp(this.configuration).listMyAttachments(requestParameters.page, requestParameters.size, requestParameters.labelSelector, requestParameters.fieldSelector, requestParameters.sort, requestParameters.ungrouped, requestParameters.keyword, requestParameters.accepts, options).then((request) => request(this.axios, this.basePath));
+    }
+
+    /**
+     * Upload attachment to user center storage.
+     * @param {AttachmentV1alpha1UcApiUploadUcAttachmentRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof AttachmentV1alpha1UcApi
+     */
+    public uploadUcAttachment(requestParameters: AttachmentV1alpha1UcApiUploadUcAttachmentRequest, options?: RawAxiosRequestConfig) {
+        return AttachmentV1alpha1UcApiFp(this.configuration).uploadUcAttachment(requestParameters.file, requestParameters.formData, options).then((request) => request(this.axios, this.basePath));
+    }
 }
 
diff --git a/ui/packages/api-client/src/models/index.ts b/ui/packages/api-client/src/models/index.ts
index cd721814af..b8ae0a1a86 100644
--- a/ui/packages/api-client/src/models/index.ts
+++ b/ui/packages/api-client/src/models/index.ts
@@ -237,6 +237,7 @@ export * from './thumbnail-spec';
 export * from './totp-auth-link-response';
 export * from './totp-request';
 export * from './two-factor-auth-settings';
+export * from './uc-upload-request-form-data';
 export * from './upgrade-from-uri-request';
 export * from './upload-from-url-request';
 export * from './user';
diff --git a/ui/packages/api-client/src/models/uc-upload-request-form-data.ts b/ui/packages/api-client/src/models/uc-upload-request-form-data.ts
new file mode 100644
index 0000000000..f04f8734f0
--- /dev/null
+++ b/ui/packages/api-client/src/models/uc-upload-request-form-data.ts
@@ -0,0 +1,38 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * Halo
+ * No description provided (generated by Openapi Generator https://github.com/openapitools/openapi-generator)
+ *
+ * The version of the OpenAPI document: 2.20.0-SNAPSHOT
+ * 
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+
+
+/**
+ * 
+ * @export
+ * @interface UcUploadRequestFormData
+ */
+export interface UcUploadRequestFormData {
+    [key: string]: Array<object> | any;
+
+    /**
+     * 
+     * @type {{ [key: string]: object; }}
+     * @memberof UcUploadRequestFormData
+     */
+    'all'?: { [key: string]: object; };
+    /**
+     * 
+     * @type {boolean}
+     * @memberof UcUploadRequestFormData
+     */
+    'empty'?: boolean;
+}
+
diff --git a/ui/packages/api-client/src/models/user-connection-spec.ts b/ui/packages/api-client/src/models/user-connection-spec.ts
index efb96e7c4d..31994c9196 100644
--- a/ui/packages/api-client/src/models/user-connection-spec.ts
+++ b/ui/packages/api-client/src/models/user-connection-spec.ts
@@ -20,48 +20,12 @@
  * @interface UserConnectionSpec
  */
 export interface UserConnectionSpec {
-    /**
-     * 
-     * @type {string}
-     * @memberof UserConnectionSpec
-     */
-    'accessToken': string;
-    /**
-     * 
-     * @type {string}
-     * @memberof UserConnectionSpec
-     */
-    'avatarUrl'?: string;
-    /**
-     * 
-     * @type {string}
-     * @memberof UserConnectionSpec
-     */
-    'displayName': string;
-    /**
-     * 
-     * @type {string}
-     * @memberof UserConnectionSpec
-     */
-    'expiresAt'?: string;
-    /**
-     * 
-     * @type {string}
-     * @memberof UserConnectionSpec
-     */
-    'profileUrl'?: string;
     /**
      * 
      * @type {string}
      * @memberof UserConnectionSpec
      */
     'providerUserId': string;
-    /**
-     * 
-     * @type {string}
-     * @memberof UserConnectionSpec
-     */
-    'refreshToken'?: string;
     /**
      * 
      * @type {string}
diff --git a/ui/src/components/attachment/AttachmentPermalinkList.vue b/ui/src/components/attachment/AttachmentPermalinkList.vue
new file mode 100644
index 0000000000..f9992d6830
--- /dev/null
+++ b/ui/src/components/attachment/AttachmentPermalinkList.vue
@@ -0,0 +1,129 @@
+<script lang="ts" setup>
+import { matchMediaType } from "@/utils/media-type";
+import type { Attachment } from "@halo-dev/api-client";
+import { Toast, VButton } from "@halo-dev/components";
+import { useClipboard } from "@vueuse/core";
+import { computed, toRefs } from "vue";
+import { useI18n } from "vue-i18n";
+
+const props = withDefaults(
+  defineProps<{
+    attachment?: Attachment;
+    mountToBody?: boolean;
+  }>(),
+  {
+    attachment: undefined,
+    mountToBody: false,
+  }
+);
+
+const { attachment } = toRefs(props);
+
+const { copy } = useClipboard({ legacy: true });
+const { t } = useI18n();
+
+const mediaType = computed(() => {
+  return attachment.value?.spec.mediaType;
+});
+
+const isImage = computed(() => {
+  return mediaType.value && matchMediaType(mediaType.value, "image/*");
+});
+
+const isVideo = computed(() => {
+  return mediaType.value && matchMediaType(mediaType.value, "video/*");
+});
+
+const isAudio = computed(() => {
+  return mediaType.value && matchMediaType(mediaType.value, "audio/*");
+});
+
+const htmlText = computed(() => {
+  const { permalink } = attachment.value?.status || {};
+  const { displayName } = attachment.value?.spec || {};
+
+  if (isImage.value) {
+    return `<img src="${permalink}" alt="${displayName}" />`;
+  } else if (isVideo.value) {
+    return `<video src="${permalink}"></video>`;
+  } else if (isAudio.value) {
+    return `<audio src="${permalink}"></audio>`;
+  }
+  return `<a href="${permalink}">${displayName}</a>`;
+});
+
+const markdownText = computed(() => {
+  const { permalink } = attachment.value?.status || {};
+  const { displayName } = attachment.value?.spec || {};
+  if (isImage.value) {
+    return `![${displayName}](${permalink})`;
+  }
+  return `[${displayName}](${permalink})`;
+});
+
+const handleCopy = (format: "markdown" | "html" | "url") => {
+  const { permalink } = attachment.value?.status || {};
+
+  if (!permalink) return;
+
+  if (format === "url") {
+    copy(permalink);
+  } else if (format === "markdown") {
+    copy(markdownText.value);
+  } else if (format === "html") {
+    copy(htmlText.value);
+  }
+
+  Toast.success(t("core.common.toast.copy_success"));
+};
+
+const formats = computed(
+  (): {
+    label: string;
+    key: "url" | "html" | "markdown";
+    value?: string;
+  }[] => {
+    return [
+      {
+        label: "URL",
+        key: "url",
+        value: attachment?.value?.status?.permalink,
+      },
+      {
+        label: "HTML",
+        key: "html",
+        value: htmlText.value,
+      },
+      {
+        label: "Markdown",
+        key: "markdown",
+        value: markdownText.value,
+      },
+    ];
+  }
+);
+</script>
+
+<template>
+  <ul class="flex flex-col space-y-2">
+    <li v-for="format in formats" :key="format.key">
+      <div
+        class="flex w-full cursor-pointer items-center justify-between space-x-3 rounded border p-3 hover:border-primary"
+      >
+        <div class="flex flex-1 flex-col space-y-2 text-xs text-gray-900">
+          <span class="font-semibold">
+            {{ format.label }}
+          </span>
+          <span class="break-all">
+            {{ format.value }}
+          </span>
+        </div>
+        <div>
+          <VButton size="sm" @click="handleCopy(format.key)">
+            {{ $t("core.common.buttons.copy") }}
+          </VButton>
+        </div>
+      </div>
+    </li>
+  </ul>
+</template>
diff --git a/ui/src/components/editor/DefaultEditor.vue b/ui/src/components/editor/DefaultEditor.vue
index a4ab847815..133893a9d8 100644
--- a/ui/src/components/editor/DefaultEditor.vue
+++ b/ui/src/components/editor/DefaultEditor.vue
@@ -55,7 +55,6 @@ import { i18n } from "@/locales";
 import { usePluginModuleStore } from "@/stores/plugin";
 import { formatDatetime } from "@/utils/date";
 import { usePermission } from "@/utils/permission";
-import AttachmentSelectorModal from "@console/modules/contents/attachments/components/AttachmentSelectorModal.vue";
 import type { Attachment } from "@halo-dev/api-client";
 import {
   IconCalendar,
@@ -72,6 +71,7 @@ import { useDebounceFn, useLocalStorage } from "@vueuse/core";
 import type { AxiosRequestConfig } from "axios";
 import { OverlayScrollbarsComponent } from "overlayscrollbars-vue";
 import {
+  defineAsyncComponent,
   inject,
   markRaw,
   onBeforeUnmount,
@@ -164,9 +164,6 @@ const headingIcons = {
 const headingNodes = ref<HeadingNode[]>();
 const selectedHeadingNode = ref<HeadingNode>();
 const extraActiveId = ref("toc");
-const attachmentSelectorModal = ref(false);
-
-const { onAttachmentSelect, attachmentResult } = useAttachmentSelect();
 
 const editor = shallowRef<Editor>();
 const editorTitleRef = ref();
@@ -175,11 +172,29 @@ const { pluginModules } = usePluginModuleStore();
 
 const showSidebar = useLocalStorage("halo:editor:show-sidebar", true);
 
+// Attachments
+const AttachmentSelectorModal = defineAsyncComponent({
+  loader: () => {
+    if (currentUserHasPermission(["system:attachments:manage"])) {
+      return import(
+        "@console/modules/contents/attachments/components/AttachmentSelectorModal.vue"
+      );
+    }
+    return import(
+      "@uc/modules/contents/attachments/components/AttachmentSelectorModal.vue"
+    );
+  },
+});
+
+const attachmentSelectorModal = ref(false);
+const { onAttachmentSelect, attachmentResult } = useAttachmentSelect();
+
 const initAttachmentOptions = {
   accepts: ["*/*"],
   min: undefined,
   max: undefined,
 };
+
 const attachmentOptions = ref<{
   accepts?: string[];
   min?: number;
@@ -272,7 +287,12 @@ const presetExtensions = [
     name: "custom-attachment-extension",
     addOptions() {
       // If user has no permission to view attachments, return
-      if (!currentUserHasPermission(["system:attachments:view"])) {
+      if (
+        !currentUserHasPermission([
+          "system:attachments:manage",
+          "uc:attachments:manage",
+        ])
+      ) {
         return this;
       }
 
@@ -302,6 +322,29 @@ const presetExtensions = [
             },
           ];
         },
+      };
+    },
+    addCommands() {
+      return {
+        openAttachmentSelector: (callback, options) => () => {
+          if (options) {
+            attachmentOptions.value = options;
+          }
+          attachmentSelectorModal.value = true;
+          attachmentResult.updateAttachment = (
+            attachments: AttachmentLike[]
+          ) => {
+            callback(attachments);
+          };
+          return true;
+        },
+      };
+    },
+  }),
+  Extension.create({
+    name: "custom-sidebar-toggle-extension",
+    addOptions() {
+      return {
         getToolbarItems({ editor }: { editor: Editor }) {
           return {
             priority: 1000,
@@ -321,22 +364,6 @@ const presetExtensions = [
         },
       };
     },
-    addCommands() {
-      return {
-        openAttachmentSelector: (callback, options) => () => {
-          if (options) {
-            attachmentOptions.value = options;
-          }
-          attachmentSelectorModal.value = true;
-          attachmentResult.updateAttachment = (
-            attachments: AttachmentLike[]
-          ) => {
-            callback(attachments);
-          };
-          return true;
-        },
-      };
-    },
   }),
   ExtensionDraggable,
   ExtensionColumns,
diff --git a/ui/src/components/editor/components/EditorLinkObtain.vue b/ui/src/components/editor/components/EditorLinkObtain.vue
index adbb4ca0cd..449355327a 100644
--- a/ui/src/components/editor/components/EditorLinkObtain.vue
+++ b/ui/src/components/editor/components/EditorLinkObtain.vue
@@ -194,7 +194,9 @@ defineExpose({
             </VButton>
           </HasPermission>
 
-          <HasPermission :permissions="['system:attachments:manage']">
+          <HasPermission
+            :permissions="['system:attachments:view', 'uc:attachments:manage']"
+          >
             <VButton @click="openAttachmentSelector">
               {{
                 $t(
diff --git a/ui/src/formkit/inputs/attachment/AttachmentInput.vue b/ui/src/formkit/inputs/attachment/AttachmentInput.vue
index 6c70addb55..56a992cf0f 100644
--- a/ui/src/formkit/inputs/attachment/AttachmentInput.vue
+++ b/ui/src/formkit/inputs/attachment/AttachmentInput.vue
@@ -1,9 +1,11 @@
 <script lang="ts" setup>
-import AttachmentSelectorModal from "@console/modules/contents/attachments/components/AttachmentSelectorModal.vue";
+import { usePermission } from "@/utils/permission";
 import type { FormKitFrameworkContext } from "@formkit/core";
 import { IconFolder } from "@halo-dev/components";
 import type { AttachmentLike } from "@halo-dev/console-shared";
-import { ref, type PropType } from "vue";
+import { defineAsyncComponent, ref, type PropType } from "vue";
+
+const { currentUserHasPermission } = usePermission();
 
 const props = defineProps({
   context: {
@@ -14,6 +16,19 @@ const props = defineProps({
 
 const attachmentSelectorModal = ref(false);
 
+const AttachmentSelectorModal = defineAsyncComponent({
+  loader: () => {
+    if (currentUserHasPermission(["system:attachments:view"])) {
+      return import(
+        "@console/modules/contents/attachments/components/AttachmentSelectorModal.vue"
+      );
+    }
+    return import(
+      "@uc/modules/contents/attachments/components/AttachmentSelectorModal.vue"
+    );
+  },
+});
+
 const onInput = (e: Event) => {
   props.context.handlers.DOMInput(e);
 };
@@ -48,12 +63,18 @@ const onAttachmentSelect = (attachments: AttachmentLike[]) => {
     @blur="context.handlers.blur()"
     @input="onInput"
   />
-  <div
-    class="group flex h-full cursor-pointer items-center border-l px-3 transition-all hover:bg-gray-100"
-    @click="attachmentSelectorModal = true"
+
+  <HasPermission
+    :permissions="['uc:attachments:manage', 'system:attachments:view']"
   >
-    <IconFolder class="h-4 w-4 text-gray-500 group-hover:text-gray-700" />
-  </div>
+    <div
+      class="group flex h-full cursor-pointer items-center border-l px-3 transition-all hover:bg-gray-100"
+      @click="attachmentSelectorModal = true"
+    >
+      <IconFolder class="h-4 w-4 text-gray-500 group-hover:text-gray-700" />
+    </div>
+  </HasPermission>
+
   <AttachmentSelectorModal
     v-model:visible="attachmentSelectorModal"
     :accepts="context.accepts as string[]"
diff --git a/ui/src/locales/en.yaml b/ui/src/locales/en.yaml
index e61cbd6f0a..0b374b33bb 100644
--- a/ui/src/locales/en.yaml
+++ b/ui/src/locales/en.yaml
@@ -662,6 +662,52 @@ core:
       operations:
         select:
           result: ({count} items selected)
+  uc_attachment:
+    empty:
+      title: There are no attachments.
+      message: >-
+        There are no attachments, you can try refreshing or
+        uploading attachments.
+      actions:
+        upload: Upload Attachment
+    filters:
+      sort:
+        items:
+          create_time_desc: Latest uploaded
+          create_time_asc: Earliest uploaded
+          size_desc: Descending order by file size
+          size_asc: Ascending order by file size
+          display_name_asc: Ascending order by display name
+          display_name_desc: Descending order by display name
+      view_type:
+        items:
+          grid: Grid Mode
+          list: List Mode
+    detail_modal:
+      title: "Attachment: {display_name}"
+      fields:
+        preview: Preview
+        display_name: Display name
+        media_type: Media type
+        size: Size
+        owner: Owner
+        creation_time: Creation time
+        permalink: Permalink
+      preview:
+        click_to_exit: Click to exit preview
+        video_not_support: The current browser does not support video playback.
+        audio_not_support: The current browser does not support audio playback.
+        not_support: This file does not support preview.
+    upload_modal:
+      title: Upload attachment
+    select_modal:
+      title: Select attachment
+      providers:
+        default:
+          label: Attachments
+      operations:
+        select:
+          result: ({count} items selected)
   theme:
     title: Themes
     common:
@@ -1517,6 +1563,7 @@ core:
     Post Author: Allows you to manage your own posts
     Post Contributor: Contributions allowed
     Post Publisher: Allow to publish own posts
+    UC Attachment Manage: Allow to manage own attachments
     Recycle My Post: Recycle My Post
   components:
     submit_button:
diff --git a/ui/src/locales/zh-CN.yaml b/ui/src/locales/zh-CN.yaml
index b364374650..6c2341d6c7 100644
--- a/ui/src/locales/zh-CN.yaml
+++ b/ui/src/locales/zh-CN.yaml
@@ -626,6 +626,50 @@ core:
       operations:
         select:
           result: （已选择 {count} 项）
+  uc_attachment:
+    empty:
+      title: 当前没有附件
+      message: 当前没有附件，你可以尝试刷新或者上传附件
+      actions:
+        upload: 上传附件
+    filters:
+      sort:
+        items:
+          create_time_desc: 较近上传
+          create_time_asc: 较晚上传
+          size_desc: 文件大小降序
+          size_asc: 文件大小升序
+          display_name_asc: 文件名升序
+          display_name_desc: 文件名降序
+      view_type:
+        items:
+          grid: 网格模式
+          list: 列表模式
+    detail_modal:
+      title: 附件：{display_name}
+      fields:
+        preview: 预览
+        display_name: 文件名称
+        media_type: 文件类型
+        size: 文件大小
+        owner: 上传者
+        creation_time: 上传时间
+        permalink: 链接
+      preview:
+        click_to_exit: 点击退出预览
+        video_not_support: 当前浏览器不支持该视频播放
+        audio_not_support: 当前浏览器不支持该音频播放
+        not_support: 此文件不支持预览
+    upload_modal:
+      title: 上传附件
+    select_modal:
+      title: 选择附件
+      providers:
+        default:
+          label: 附件库
+      operations:
+        select:
+          result: （已选择 {count} 项）
   theme:
     title: 主题
     common:
@@ -1418,6 +1462,7 @@ core:
     Post Author: 允许管理自己的文章
     Post Attachment Manager: 允许在文章中上传图片
     Post Publisher: 允许发布自己的文章
+    UC Attachment Manage: 允许管理自己的附件
     Recycle My Post: 允许删除自己的文章
   components:
     submit_button:
diff --git a/ui/src/locales/zh-TW.yaml b/ui/src/locales/zh-TW.yaml
index cc068b212a..652fc6725f 100644
--- a/ui/src/locales/zh-TW.yaml
+++ b/ui/src/locales/zh-TW.yaml
@@ -603,6 +603,50 @@ core:
       operations:
         select:
           result: （已選擇 {count} 項）
+  uc_attachment:
+    empty:
+      title: 當前沒有附件
+      message: 當前沒有附件，你可以嘗試重整或者上傳附件
+      actions:
+        upload: 上傳附件
+    filters:
+      sort:
+        items:
+          create_time_desc: 較近上傳
+          create_time_asc: 較晚上傳
+          size_desc: 文件大小降序
+          size_asc: 文件大小升序
+          display_name_asc: 文件名升序
+          display_name_desc: 文件名降序
+      view_type:
+        items:
+          grid: 網格模式
+          list: 列表模式
+    detail_modal:
+      title: 附件：{display_name}
+      fields:
+        preview: 預覽
+        display_name: 文件名稱
+        media_type: 文件類型
+        size: 文件大小
+        owner: 上傳者
+        creation_time: 上傳時間
+        permalink: 連結
+      preview:
+        click_to_exit: 點擊離開預覽
+        video_not_support: 當前瀏覽器不支援該影片播放
+        audio_not_support: 當前瀏覽器不支援該音頻播放
+        not_support: 此文件不支援預覽
+    upload_modal:
+      title: 上傳附件
+    select_modal:
+      title: 選擇附件
+      providers:
+        default:
+          label: 附件庫
+      operations:
+        select:
+          result: （已選擇 {count} 項）
   theme:
     title: 主題
     common:
@@ -1394,6 +1438,7 @@ core:
     Post Author: 允許管理自己的文章
     Post Contributor: 允許投稿
     Post Publisher: 允許發布自己的文章
+    UC Attachment Manage: 允許管理自己的附件
     Recycle My Post: 允許刪除自己的文章
   components:
     submit_button:
diff --git a/ui/uc-src/modules/contents/attachments/components/AttachmentDetailModal.vue b/ui/uc-src/modules/contents/attachments/components/AttachmentDetailModal.vue
new file mode 100644
index 0000000000..bde43766c3
--- /dev/null
+++ b/ui/uc-src/modules/contents/attachments/components/AttachmentDetailModal.vue
@@ -0,0 +1,167 @@
+<script lang="ts" setup>
+import AttachmentPermalinkList from "@/components/attachment/AttachmentPermalinkList.vue";
+import LazyImage from "@/components/image/LazyImage.vue";
+import { formatDatetime } from "@/utils/date";
+import { isImage } from "@/utils/image";
+import { type Attachment } from "@halo-dev/api-client";
+import {
+  VButton,
+  VDescription,
+  VDescriptionItem,
+  VModal,
+  VSpace,
+} from "@halo-dev/components";
+import prettyBytes from "pretty-bytes";
+import { ref, useTemplateRef } from "vue";
+
+withDefaults(
+  defineProps<{
+    attachment: Attachment;
+    mountToBody?: boolean;
+  }>(),
+  {
+    mountToBody: false,
+  }
+);
+
+const emit = defineEmits<{
+  (event: "close"): void;
+}>();
+
+const modal = useTemplateRef<InstanceType<typeof VModal> | null>("modal");
+const onlyPreview = ref(false);
+</script>
+<template>
+  <VModal
+    ref="modal"
+    :title="
+      $t('core.uc_attachment.detail_modal.title', {
+        display_name: attachment?.spec.displayName || '',
+      })
+    "
+    :width="1000"
+    :mount-to-body="mountToBody"
+    :layer-closable="true"
+    height="calc(100vh - 20px)"
+    :body-class="['!p-0']"
+    @close="emit('close')"
+  >
+    <template #actions>
+      <slot name="actions"></slot>
+    </template>
+    <div>
+      <div class="overflow-hidden bg-white">
+        <div
+          v-if="onlyPreview && isImage(attachment?.spec.mediaType)"
+          class="flex justify-center p-4"
+        >
+          <img
+            v-tooltip.bottom="
+              $t('core.uc_attachment.detail_modal.preview.click_to_exit')
+            "
+            :alt="attachment?.spec.displayName"
+            :src="attachment?.status?.permalink"
+            class="w-auto transform-gpu cursor-pointer rounded"
+            @click="onlyPreview = !onlyPreview"
+          />
+        </div>
+        <div v-else>
+          <VDescription>
+            <VDescriptionItem
+              :label="$t('core.uc_attachment.detail_modal.fields.preview')"
+            >
+              <div
+                v-if="isImage(attachment?.spec.mediaType)"
+                @click="onlyPreview = !onlyPreview"
+              >
+                <LazyImage
+                  :alt="attachment?.spec.displayName"
+                  :src="
+                    attachment?.status?.thumbnails?.M ||
+                    attachment?.status?.permalink
+                  "
+                  classes="max-w-full cursor-pointer rounded sm:max-w-[50%]"
+                >
+                  <template #loading>
+                    <span class="text-gray-400">
+                      {{ $t("core.common.status.loading") }}...
+                    </span>
+                  </template>
+                  <template #error>
+                    <span class="text-red-400">
+                      {{ $t("core.common.status.loading_error") }}
+                    </span>
+                  </template>
+                </LazyImage>
+              </div>
+              <div v-else-if="attachment?.spec.mediaType?.startsWith('video/')">
+                <video
+                  :src="attachment.status?.permalink"
+                  controls
+                  class="max-w-full rounded sm:max-w-[50%]"
+                >
+                  {{
+                    $t(
+                      "core.uc_attachment.detail_modal.preview.video_not_support"
+                    )
+                  }}
+                </video>
+              </div>
+              <div v-else-if="attachment?.spec.mediaType?.startsWith('audio/')">
+                <audio :src="attachment.status?.permalink" controls>
+                  {{
+                    $t(
+                      "core.uc_attachment.detail_modal.preview.audio_not_support"
+                    )
+                  }}
+                </audio>
+              </div>
+              <span v-else>
+                {{ $t("core.uc_attachment.detail_modal.preview.not_support") }}
+              </span>
+            </VDescriptionItem>
+            <VDescriptionItem
+              :label="$t('core.uc_attachment.detail_modal.fields.display_name')"
+            >
+              <span>
+                {{ attachment?.spec.displayName }}
+              </span>
+            </VDescriptionItem>
+            <VDescriptionItem
+              :label="$t('core.uc_attachment.detail_modal.fields.media_type')"
+              :content="attachment?.spec.mediaType"
+            />
+            <VDescriptionItem
+              :label="$t('core.uc_attachment.detail_modal.fields.size')"
+              :content="prettyBytes(attachment?.spec.size || 0)"
+            />
+            <VDescriptionItem
+              :label="$t('core.uc_attachment.detail_modal.fields.owner')"
+              :content="attachment?.spec.ownerName"
+            />
+            <VDescriptionItem
+              :label="
+                $t('core.uc_attachment.detail_modal.fields.creation_time')
+              "
+              :content="formatDatetime(attachment?.metadata.creationTimestamp)"
+            />
+            <VDescriptionItem
+              :label="$t('core.uc_attachment.detail_modal.fields.permalink')"
+            >
+              <AttachmentPermalinkList :attachment="attachment" />
+            </VDescriptionItem>
+          </VDescription>
+        </div>
+      </div>
+    </div>
+
+    <template #footer>
+      <VSpace>
+        <VButton type="default" @click="modal?.close()">
+          {{ $t("core.common.buttons.close_and_shortcut") }}
+        </VButton>
+        <slot name="footer" />
+      </VSpace>
+    </template>
+  </VModal>
+</template>
diff --git a/ui/uc-src/modules/contents/attachments/components/AttachmentSelectorModal.vue b/ui/uc-src/modules/contents/attachments/components/AttachmentSelectorModal.vue
new file mode 100644
index 0000000000..901272114a
--- /dev/null
+++ b/ui/uc-src/modules/contents/attachments/components/AttachmentSelectorModal.vue
@@ -0,0 +1,171 @@
+<script lang="ts" setup>
+import { usePluginModuleStore } from "@/stores/plugin";
+import { VButton, VModal, VSpace, VTabbar } from "@halo-dev/components";
+import type {
+  AttachmentLike,
+  AttachmentSelectProvider,
+} from "@halo-dev/console-shared";
+import { computed, markRaw, onMounted, ref } from "vue";
+import { useI18n } from "vue-i18n";
+import CoreSelectorProvider from "./selector-providers/CoreSelectorProvider.vue";
+
+const { t } = useI18n();
+
+const props = withDefaults(
+  defineProps<{
+    visible: boolean;
+    accepts?: string[];
+    min?: number;
+    max?: number;
+  }>(),
+  {
+    visible: false,
+    accepts: () => ["*/*"],
+    min: undefined,
+    max: undefined,
+  }
+);
+
+const emit = defineEmits<{
+  (event: "update:visible", visible: boolean): void;
+  (event: "close"): void;
+  (event: "select", attachments: AttachmentLike[]): void;
+}>();
+
+const selected = ref<AttachmentLike[]>([] as AttachmentLike[]);
+
+const attachmentSelectProviders = ref<AttachmentSelectProvider[]>([
+  {
+    id: "core",
+    label: t("core.uc_attachment.select_modal.providers.default.label"),
+    component: markRaw(CoreSelectorProvider),
+  },
+]);
+
+// resolve plugin extension points
+const { pluginModules } = usePluginModuleStore();
+
+onMounted(async () => {
+  for (const pluginModule of pluginModules) {
+    try {
+      const callbackFunction =
+        pluginModule?.extensionPoints?.["attachment:selector:create"];
+
+      if (typeof callbackFunction !== "function") {
+        continue;
+      }
+
+      const providers = await callbackFunction();
+      attachmentSelectProviders.value.push(...providers);
+    } catch (error) {
+      console.error(`Error processing plugin module:`, pluginModule, error);
+    }
+  }
+});
+
+const activeId = ref(attachmentSelectProviders.value[0].id);
+
+const onVisibleChange = (visible: boolean) => {
+  emit("update:visible", visible);
+  if (!visible) {
+    emit("close");
+  }
+};
+
+const onChangeProvider = (providerId: string) => {
+  const provider = attachmentSelectProviders.value.find(
+    (provider) => provider.id === providerId
+  );
+
+  if (!provider) {
+    return;
+  }
+
+  activeId.value = providerId;
+};
+
+const handleConfirm = () => {
+  emit("select", Array.from(selected.value));
+  onVisibleChange(false);
+};
+
+const confirmDisabled = computed(() => {
+  if (props.min === undefined) {
+    return false;
+  }
+  return selected.value.length < props.min;
+});
+
+const confirmCountMessage = computed(() => {
+  if (!props.min && !props.max) {
+    return selected.value.length;
+  }
+  return `${selected.value.length} / ${props.max || props.min}`;
+});
+</script>
+<template>
+  <VModal
+    :visible="visible"
+    :width="1240"
+    :mount-to-body="true"
+    :layer-closable="true"
+    :title="$t('core.uc_attachment.select_modal.title')"
+    height="calc(100vh - 20px)"
+    @update:visible="onVisibleChange"
+  >
+    <VTabbar
+      v-model:active-id="activeId"
+      :items="
+        attachmentSelectProviders.map((provider) => ({
+          id: provider.id,
+          label: provider.label,
+        }))
+      "
+      class="w-full"
+      type="outline"
+    ></VTabbar>
+
+    <div v-if="visible" class="mt-2">
+      <template
+        v-for="(provider, index) in attachmentSelectProviders"
+        :key="index"
+      >
+        <Suspense>
+          <component
+            :is="provider.component"
+            v-if="activeId === provider.id"
+            v-model:selected="selected"
+            :accepts="accepts"
+            :min="min"
+            :max="max"
+            @change-provider="onChangeProvider"
+          ></component>
+          <template #fallback>
+            {{ $t("core.common.status.loading") }}
+          </template>
+        </Suspense>
+      </template>
+    </div>
+    <template #footer>
+      <VSpace>
+        <VButton
+          type="secondary"
+          :disabled="confirmDisabled"
+          @click="handleConfirm"
+        >
+          {{ $t("core.common.buttons.confirm") }}
+          <span v-if="selected.length || props.min || props.max">
+            {{
+              $t("core.uc_attachment.select_modal.operations.select.result", {
+                count: confirmCountMessage,
+              })
+            }}
+          </span>
+        </VButton>
+        <VButton @click="onVisibleChange(false)">
+          {{ $t("core.common.buttons.cancel") }}
+        </VButton>
+      </VSpace>
+    </template>
+  </VModal>
+</template>
diff --git a/ui/uc-src/modules/contents/attachments/components/selector-providers/AttachmentUploadModal.vue b/ui/uc-src/modules/contents/attachments/components/selector-providers/AttachmentUploadModal.vue
new file mode 100644
index 0000000000..284d6fd1cf
--- /dev/null
+++ b/ui/uc-src/modules/contents/attachments/components/selector-providers/AttachmentUploadModal.vue
@@ -0,0 +1,35 @@
+<script lang="ts" setup>
+import { VButton, VModal } from "@halo-dev/components";
+import { ref } from "vue";
+
+const emit = defineEmits<{
+  (event: "close"): void;
+}>();
+
+const modal = ref<InstanceType<typeof VModal> | null>(null);
+</script>
+<template>
+  <VModal
+    ref="modal"
+    :body-class="['!p-0']"
+    :width="920"
+    height="calc(100vh - 20px)"
+    :title="$t('core.uc_attachment.upload_modal.title')"
+    mount-to-body
+    @close="emit('close')"
+  >
+    <div class="w-full p-4">
+      <UppyUpload
+        endpoint="/apis/uc.api.storage.halo.run/v1alpha1/attachments/-/upload"
+        width="100%"
+        :done-button-handler="() => modal?.close()"
+      />
+    </div>
+
+    <template #footer>
+      <VButton @click="modal?.close()">
+        {{ $t("core.common.buttons.close") }}
+      </VButton>
+    </template>
+  </VModal>
+</template>
diff --git a/ui/uc-src/modules/contents/attachments/components/selector-providers/CoreSelectorProvider.vue b/ui/uc-src/modules/contents/attachments/components/selector-providers/CoreSelectorProvider.vue
new file mode 100644
index 0000000000..f32bf45c57
--- /dev/null
+++ b/ui/uc-src/modules/contents/attachments/components/selector-providers/CoreSelectorProvider.vue
@@ -0,0 +1,486 @@
+<script setup lang="ts">
+import LazyImage from "@/components/image/LazyImage.vue";
+import { isImage } from "@/utils/image";
+import { matchMediaTypes } from "@/utils/media-type";
+import { ucApiClient, type Attachment } from "@halo-dev/api-client";
+import {
+  IconArrowLeft,
+  IconArrowRight,
+  IconCheckboxCircle,
+  IconCheckboxFill,
+  IconEye,
+  IconGrid,
+  IconList,
+  IconRefreshLine,
+  IconUpload,
+  VButton,
+  VCard,
+  VEmpty,
+  VLoading,
+  VPagination,
+  VSpace,
+} from "@halo-dev/components";
+import type { AttachmentLike } from "@halo-dev/console-shared";
+import { useQuery } from "@tanstack/vue-query";
+import { useLocalStorage } from "@vueuse/core";
+import { computed, nextTick, ref, watch } from "vue";
+import { useI18n } from "vue-i18n";
+import AttachmentDetailModal from "../AttachmentDetailModal.vue";
+import AttachmentUploadModal from "./AttachmentUploadModal.vue";
+import AttachmentSelectorListItem from "./components/AttachmentSelectorListItem.vue";
+
+const { t } = useI18n();
+
+const props = withDefaults(
+  defineProps<{
+    selected: AttachmentLike[];
+    accepts?: string[];
+    min?: number;
+    max?: number;
+  }>(),
+  {
+    selected: () => [],
+    accepts: () => ["*/*"],
+    min: undefined,
+    max: undefined,
+  }
+);
+
+const emit = defineEmits<{
+  (event: "update:selected", attachments: AttachmentLike[]): void;
+  (event: "change-provider", providerId: string): void;
+}>();
+
+const page = ref(1);
+const size = ref(60);
+const keyword = ref("");
+const selectedSort = ref();
+
+const hasFilters = computed(() => {
+  return selectedSort.value;
+});
+
+function handleClearFilters() {
+  selectedSort.value = undefined;
+}
+
+const {
+  data,
+  isFetching,
+  isLoading,
+  refetch: handleFetchAttachments,
+} = useQuery({
+  queryKey: [
+    "uc:attachments:my",
+    props.accepts,
+    page,
+    size,
+    keyword,
+    selectedSort,
+  ],
+  queryFn: async () => {
+    const { data } = await ucApiClient.storage.attachment.listMyAttachments({
+      accepts: props.accepts,
+      page: page.value,
+      size: size.value,
+      keyword: keyword.value,
+      sort: [selectedSort.value],
+    });
+    return data;
+  },
+});
+
+// Upload
+const uploadVisible = ref(false);
+
+function onUploadModalClose() {
+  handleFetchAttachments();
+  uploadVisible.value = false;
+}
+
+// Select
+const selectedAttachment = ref<Attachment>();
+const selectedAttachments = ref<Set<Attachment>>(new Set<Attachment>());
+
+watch(
+  () => selectedAttachments.value,
+  (newValue) => {
+    emit("update:selected", Array.from(newValue));
+  },
+  {
+    deep: true,
+  }
+);
+
+const isChecked = (attachment: Attachment) => {
+  return (
+    attachment.metadata.name === selectedAttachment.value?.metadata.name ||
+    Array.from(selectedAttachments.value)
+      .map((item) => item.metadata.name)
+      .includes(attachment.metadata.name)
+  );
+};
+
+const isDisabled = (attachment: Attachment) => {
+  const isMatchMediaType = matchMediaTypes(
+    attachment.spec.mediaType || "*/*",
+    props.accepts
+  );
+
+  if (
+    props.max !== undefined &&
+    props.max <= selectedAttachments.value.size &&
+    !isChecked(attachment)
+  ) {
+    return true;
+  }
+
+  return !isMatchMediaType;
+};
+
+const handleSelect = async (attachment: Attachment | undefined) => {
+  if (!attachment) return;
+  if (selectedAttachments.value.has(attachment)) {
+    selectedAttachments.value.delete(attachment);
+    return;
+  }
+  selectedAttachments.value.add(attachment);
+};
+
+// View type
+const viewTypes = [
+  {
+    name: "list",
+    tooltip: t("core.uc_attachment.filters.view_type.items.list"),
+    icon: IconList,
+  },
+  {
+    name: "grid",
+    tooltip: t("core.uc_attachment.filters.view_type.items.grid"),
+    icon: IconGrid,
+  },
+];
+
+const viewType = useLocalStorage("attachment-selector-view-type", "grid");
+
+// Detail modal
+function handleOpenDetail(attachment: Attachment) {
+  selectedAttachment.value = attachment;
+}
+
+function onDetailModalClose() {
+  selectedAttachment.value = undefined;
+}
+
+const handleSelectPrevious = async () => {
+  if (!data.value) return;
+
+  const index = data.value.items.findIndex(
+    (attachment) =>
+      attachment.metadata.name === selectedAttachment.value?.metadata.name
+  );
+
+  if (index === undefined) return;
+
+  if (index > 0) {
+    selectedAttachment.value = data.value.items[index - 1];
+    return;
+  }
+
+  if (index === 0 && data.value.hasPrevious) {
+    page.value--;
+    await nextTick();
+    await handleFetchAttachments();
+    selectedAttachment.value = data.value.items[data.value.items.length - 1];
+  }
+};
+
+const handleSelectNext = async () => {
+  if (!data.value) return;
+
+  const index = data.value.items.findIndex(
+    (attachment) =>
+      attachment.metadata.name === selectedAttachment.value?.metadata.name
+  );
+
+  if (index === undefined) return;
+
+  if (index < data.value.items.length - 1) {
+    selectedAttachment.value = data.value.items[index + 1];
+    return;
+  }
+
+  if (index === data.value.items.length - 1 && data.value.hasNext) {
+    page.value++;
+    await nextTick();
+    await handleFetchAttachments();
+    selectedAttachment.value = data.value.items[0];
+  }
+};
+</script>
+<template>
+  <div class="mb-3 block w-full rounded bg-gray-50 px-3 py-2">
+    <div class="relative flex flex-col items-start sm:flex-row sm:items-center">
+      <div class="flex w-full flex-1 items-center sm:w-auto">
+        <SearchInput v-model="keyword" />
+      </div>
+      <div class="mt-4 flex sm:mt-0">
+        <VSpace spacing="lg">
+          <FilterCleanButton v-if="hasFilters" @click="handleClearFilters" />
+
+          <FilterDropdown
+            v-model="selectedSort"
+            :label="$t('core.common.filters.labels.sort')"
+            :items="[
+              {
+                label: t('core.common.filters.item_labels.default'),
+              },
+              {
+                label: t(
+                  'core.uc_attachment.filters.sort.items.create_time_desc'
+                ),
+                value: 'metadata.creationTimestamp,desc',
+              },
+              {
+                label: t(
+                  'core.uc_attachment.filters.sort.items.create_time_asc'
+                ),
+                value: 'metadata.creationTimestamp,asc',
+              },
+              {
+                label: t(
+                  'core.uc_attachment.filters.sort.items.display_name_desc'
+                ),
+                value: 'spec.displayName,desc',
+              },
+              {
+                label: t(
+                  'core.uc_attachment.filters.sort.items.display_name_asc'
+                ),
+                value: 'spec.displayName,asc',
+              },
+              {
+                label: t('core.uc_attachment.filters.sort.items.size_desc'),
+                value: 'spec.size,desc',
+              },
+              {
+                label: t('core.uc_attachment.filters.sort.items.size_asc'),
+                value: 'spec.size,asc',
+              },
+            ]"
+          />
+
+          <div class="flex flex-row gap-2">
+            <div
+              v-for="item in viewTypes"
+              :key="item.name"
+              v-tooltip="`${item.tooltip}`"
+              :class="{
+                'bg-gray-200 font-bold text-black': viewType === item.name,
+              }"
+              class="cursor-pointer rounded p-1 hover:bg-gray-200"
+              @click="viewType = item.name"
+            >
+              <component :is="item.icon" class="h-4 w-4" />
+            </div>
+          </div>
+
+          <div class="flex flex-row gap-2">
+            <div
+              class="group cursor-pointer rounded p-1 hover:bg-gray-200"
+              @click="handleFetchAttachments()"
+            >
+              <IconRefreshLine
+                v-tooltip="$t('core.common.buttons.refresh')"
+                :class="{ 'animate-spin text-gray-900': isFetching }"
+                class="h-4 w-4 text-gray-600 group-hover:text-gray-900"
+              />
+            </div>
+          </div>
+        </VSpace>
+      </div>
+    </div>
+  </div>
+
+  <div v-if="data?.total" class="mb-5">
+    <VButton @click="uploadVisible = true">
+      <template #icon>
+        <IconUpload class="h-full w-full" />
+      </template>
+      {{ $t("core.common.buttons.upload") }}
+    </VButton>
+  </div>
+
+  <VLoading v-if="isLoading" />
+
+  <VEmpty
+    v-else-if="!data?.total"
+    :message="$t('core.uc_attachment.empty.message')"
+    :title="$t('core.uc_attachment.empty.title')"
+  >
+    <template #actions>
+      <VSpace>
+        <VButton @click="handleFetchAttachments">
+          {{ $t("core.common.buttons.refresh") }}
+        </VButton>
+        <VButton type="secondary" @click="uploadVisible = true">
+          <template #icon>
+            <IconUpload class="h-full w-full" />
+          </template>
+          {{ $t("core.uc_attachment.empty.actions.upload") }}
+        </VButton>
+      </VSpace>
+    </template>
+  </VEmpty>
+
+  <div v-else>
+    <Transition v-if="viewType === 'grid'" appear name="fade">
+      <div
+        class="mt-2 grid grid-cols-3 gap-x-2 gap-y-3 sm:grid-cols-3 md:grid-cols-6 xl:grid-cols-8 2xl:grid-cols-10"
+        role="list"
+      >
+        <VCard
+          v-for="(attachment, index) in data.items"
+          :key="index"
+          :body-class="['!p-0']"
+          :class="{
+            'ring-1 ring-primary': isChecked(attachment),
+            'pointer-events-none !cursor-not-allowed opacity-50':
+              isDisabled(attachment),
+          }"
+          class="hover:shadow"
+          @click.stop="handleSelect(attachment)"
+        >
+          <div class="group relative bg-white">
+            <div
+              class="aspect-h-8 aspect-w-10 block h-full w-full cursor-pointer overflow-hidden bg-gray-100"
+            >
+              <LazyImage
+                v-if="isImage(attachment.spec.mediaType)"
+                :key="attachment.metadata.name"
+                :alt="attachment.spec.displayName"
+                :src="
+                  attachment.status?.thumbnails?.S ||
+                  attachment.status?.permalink
+                "
+                classes="pointer-events-none object-cover group-hover:opacity-75 transform-gpu"
+              >
+                <template #loading>
+                  <div
+                    class="flex h-full items-center justify-center object-cover"
+                  >
+                    <span class="text-xs text-gray-400">
+                      {{ $t("core.common.status.loading") }}...
+                    </span>
+                  </div>
+                </template>
+                <template #error>
+                  <div
+                    class="flex h-full items-center justify-center object-cover"
+                  >
+                    <span class="text-xs text-red-400">
+                      {{ $t("core.common.status.loading_error") }}
+                    </span>
+                  </div>
+                </template>
+              </LazyImage>
+              <AttachmentFileTypeIcon
+                v-else
+                :file-name="attachment.spec.displayName"
+              />
+            </div>
+            <p
+              class="pointer-events-none block truncate px-2 py-1 text-center text-xs font-medium text-gray-700"
+            >
+              {{ attachment.spec.displayName }}
+            </p>
+
+            <div
+              :class="{ '!flex': selectedAttachments.has(attachment) }"
+              class="absolute left-0 top-0 hidden h-1/3 w-full justify-end bg-gradient-to-b from-gray-300 to-transparent ease-in-out group-hover:flex"
+            >
+              <IconEye
+                class="mr-1 mt-1 hidden h-6 w-6 cursor-pointer text-white transition-all hover:text-primary group-hover:block"
+                @click.stop="handleOpenDetail(attachment)"
+              />
+              <IconCheckboxFill
+                :class="{
+                  '!text-primary': selectedAttachments.has(attachment),
+                }"
+                class="mr-1 mt-1 h-6 w-6 cursor-pointer text-white transition-all hover:text-primary"
+              />
+            </div>
+          </div>
+        </VCard>
+      </div>
+    </Transition>
+    <Transition v-if="viewType === 'list'" appear name="fade">
+      <ul
+        class="box-border h-full w-full divide-y divide-gray-100 overflow-hidden rounded-base border"
+        role="list"
+      >
+        <li v-for="attachment in data.items" :key="attachment.metadata.name">
+          <AttachmentSelectorListItem
+            :attachment="attachment"
+            :is-selected="isChecked(attachment)"
+            @select="handleSelect"
+            @open-detail="handleOpenDetail"
+          >
+            <template #checkbox>
+              <input
+                :checked="isChecked(attachment)"
+                :disabled="isDisabled(attachment)"
+                type="checkbox"
+                @click="handleSelect(attachment)"
+              />
+            </template>
+          </AttachmentSelectorListItem>
+        </li>
+      </ul>
+    </Transition>
+  </div>
+
+  <div class="mt-4">
+    <VPagination
+      v-model:page="page"
+      v-model:size="size"
+      :page-label="$t('core.components.pagination.page_label')"
+      :size-label="$t('core.components.pagination.size_label')"
+      :total-label="
+        $t('core.components.pagination.total_label', {
+          total: data?.total || 0,
+        })
+      "
+      :total="data?.total || 0"
+      :size-options="[60, 120, 200]"
+    />
+  </div>
+
+  <AttachmentUploadModal v-if="uploadVisible" @close="onUploadModalClose" />
+
+  <AttachmentDetailModal
+    v-if="selectedAttachment"
+    :mount-to-body="true"
+    :attachment="selectedAttachment"
+    @close="onDetailModalClose"
+  >
+    <template #actions>
+      <span
+        v-if="selectedAttachment && selectedAttachments.has(selectedAttachment)"
+        @click="handleSelect(selectedAttachment)"
+      >
+        <IconCheckboxFill />
+      </span>
+      <span v-else @click="handleSelect(selectedAttachment)">
+        <IconCheckboxCircle />
+      </span>
+
+      <span @click="handleSelectPrevious">
+        <IconArrowLeft />
+      </span>
+      <span @click="handleSelectNext">
+        <IconArrowRight />
+      </span>
+    </template>
+  </AttachmentDetailModal>
+</template>
diff --git a/ui/uc-src/modules/contents/attachments/components/selector-providers/components/AttachmentSelectorListItem.vue b/ui/uc-src/modules/contents/attachments/components/selector-providers/components/AttachmentSelectorListItem.vue
new file mode 100644
index 0000000000..7c90a5e382
--- /dev/null
+++ b/ui/uc-src/modules/contents/attachments/components/selector-providers/components/AttachmentSelectorListItem.vue
@@ -0,0 +1,83 @@
+<script lang="ts" setup>
+import { formatDatetime } from "@/utils/date";
+import type { Attachment } from "@halo-dev/api-client";
+import {
+  VEntity,
+  VEntityField,
+  VSpace,
+  VStatusDot,
+} from "@halo-dev/components";
+import prettyBytes from "pretty-bytes";
+import { toRefs } from "vue";
+
+const props = withDefaults(
+  defineProps<{
+    attachment: Attachment;
+    isSelected?: boolean;
+  }>(),
+  { isSelected: false }
+);
+
+const { attachment } = toRefs(props);
+
+const emit = defineEmits<{
+  (event: "select", attachment?: Attachment): void;
+  (event: "open-detail", attachment: Attachment): void;
+}>();
+</script>
+
+<template>
+  <VEntity :is-selected="isSelected">
+    <template #checkbox>
+      <slot name="checkbox" />
+    </template>
+    <template #start>
+      <VEntityField>
+        <template #description>
+          <div class="h-10 w-10 rounded border bg-white p-1 hover:shadow-sm">
+            <AttachmentFileTypeIcon
+              :display-ext="false"
+              :file-name="attachment.spec.displayName"
+              :width="8"
+              :height="8"
+            />
+          </div>
+        </template>
+      </VEntityField>
+      <VEntityField
+        :title="attachment.spec.displayName"
+        @click="emit('open-detail', attachment)"
+      >
+        <template #description>
+          <VSpace>
+            <span class="text-xs text-gray-500">
+              {{ attachment.spec.mediaType }}
+            </span>
+            <span class="text-xs text-gray-500">
+              {{ prettyBytes(attachment.spec.size || 0) }}
+            </span>
+          </VSpace>
+        </template>
+      </VEntityField>
+    </template>
+    <template #end>
+      <VEntityField :description="attachment.spec.ownerName" />
+      <VEntityField v-if="attachment.metadata.deletionTimestamp">
+        <template #description>
+          <VStatusDot
+            v-tooltip="$t('core.common.status.deleting')"
+            state="warning"
+            animate
+          />
+        </template>
+      </VEntityField>
+      <VEntityField>
+        <template #description>
+          <span class="truncate text-xs tabular-nums text-gray-500">
+            {{ formatDatetime(attachment.metadata.creationTimestamp) }}
+          </span>
+        </template>
+      </VEntityField>
+    </template>
+  </VEntity>
+</template>
diff --git a/ui/uc-src/modules/contents/attachments/module.ts b/ui/uc-src/modules/contents/attachments/module.ts
new file mode 100644
index 0000000000..35b0315b15
--- /dev/null
+++ b/ui/uc-src/modules/contents/attachments/module.ts
@@ -0,0 +1,8 @@
+import { definePlugin } from "@halo-dev/console-shared";
+import AttachmentSelectorModal from "./components/AttachmentSelectorModal.vue";
+
+export default definePlugin({
+  components: {
+    AttachmentSelectorModal,
+  },
+});
diff --git a/ui/uc-src/modules/contents/posts/components/PostSettingForm.vue b/ui/uc-src/modules/contents/posts/components/PostSettingForm.vue
index 881c0ad50f..32b8a85b4a 100644
--- a/ui/uc-src/modules/contents/posts/components/PostSettingForm.vue
+++ b/ui/uc-src/modules/contents/posts/components/PostSettingForm.vue
@@ -195,7 +195,9 @@ const publishTimeHelp = computed(() => {
             max="9999-12-31T23:59"
             :help="publishTimeHelp"
           ></FormKit>
-          <HasPermission :permissions="['system:attachments:view']">
+          <HasPermission
+            :permissions="['system:attachments:view', 'uc:attachments:manage']"
+          >
             <FormKit
               name="cover"
               :label="$t('core.post.settings.fields.cover.label')"

From bba242332d8fbeb13cd448ee2ee449f0a5768a40 Mon Sep 17 00:00:00 2001
From: guqing <i@guqing.email>
Date: Wed, 9 Oct 2024 12:20:27 +0800
Subject: [PATCH 102/185] refactor: system initialization process to adapt to
 the new login method

Signed-off-by: guqing <i@guqing.email>
---
 .../halo/app/core/extension/content/Post.java |   1 -
 .../core/endpoint/console/PluginEndpoint.java |  29 --
 .../{ => console}/SystemConfigEndpoint.java   |   2 +-
 .../console/SystemInitializationEndpoint.java | 147 ----------
 .../app/infra/DefaultThemeInitializer.java    |  65 -----
 .../java/run/halo/app/infra/SystemState.java  |  35 +++
 .../run/halo/app/infra/ValidationUtils.java   |  10 +-
 .../run/halo/app/infra/utils/FileUtils.java   |   9 +
 .../run/halo/app/infra/utils/HaloUtils.java   |  15 +-
 .../run/halo/app/plugin/PluginService.java    |  10 +-
 .../halo/app/plugin/PluginServiceImpl.java    |  61 ++--
 .../run/halo/app/security/CsrfConfigurer.java |   2 +-
 ...DefaultServerAuthenticationEntryPoint.java |   4 +-
 .../InitializeRedirectionWebFilter.java       |  14 +-
 .../security/preauth/SystemSetupEndpoint.java | 274 ++++++++++++++++++
 .../halo/app/theme/TemplateEngineManager.java |  19 --
 .../halo/app/theme/service/ThemeService.java  |   2 +
 .../app/theme/service/ThemeServiceImpl.java   |  48 +++
 .../resources/config/i18n/messages.properties |   5 +-
 .../config/i18n/messages_zh.properties        |   3 +
 .../extensions/role-template-anonymous.yaml   |   2 -
 .../src/main/resources/initial-data.yaml      | 239 +++++++++++++++
 .../gateway_modules/form_fragments.html       |  10 +-
 .../gateway_modules/input_fragments.html      |   5 +-
 .../main/resources/templates/login_local.html |   4 +-
 .../src/main/resources/templates/setup.html   | 121 ++++++++
 .../main/resources/templates/setup.properties |   7 +
 .../resources/templates/setup_en.properties   |   7 +
 .../resources/templates/setup_es.properties   |   7 +
 .../templates/setup_zh_TW.properties          |   7 +
 .../SystemInitializationEndpointTest.java     |  89 ------
 .../app/plugin/PluginServiceImplTest.java     |  27 --
 .../InitializeRedirectionWebFilterTest.java   |  67 +++--
 .../preauth/SystemSetupEndpointTest.java      |  30 ++
 34 files changed, 918 insertions(+), 459 deletions(-)
 rename application/src/main/java/run/halo/app/core/endpoint/{ => console}/SystemConfigEndpoint.java (99%)
 delete mode 100644 application/src/main/java/run/halo/app/core/endpoint/console/SystemInitializationEndpoint.java
 delete mode 100644 application/src/main/java/run/halo/app/infra/DefaultThemeInitializer.java
 create mode 100644 application/src/main/java/run/halo/app/security/preauth/SystemSetupEndpoint.java
 create mode 100644 application/src/main/resources/initial-data.yaml
 create mode 100644 application/src/main/resources/templates/setup.html
 create mode 100644 application/src/main/resources/templates/setup.properties
 create mode 100644 application/src/main/resources/templates/setup_en.properties
 create mode 100644 application/src/main/resources/templates/setup_es.properties
 create mode 100644 application/src/main/resources/templates/setup_zh_TW.properties
 delete mode 100644 application/src/test/java/run/halo/app/core/endpoint/console/SystemInitializationEndpointTest.java
 create mode 100644 application/src/test/java/run/halo/app/security/preauth/SystemSetupEndpointTest.java

diff --git a/api/src/main/java/run/halo/app/core/extension/content/Post.java b/api/src/main/java/run/halo/app/core/extension/content/Post.java
index 0cc785d71f..8e8096b46b 100644
--- a/api/src/main/java/run/halo/app/core/extension/content/Post.java
+++ b/api/src/main/java/run/halo/app/core/extension/content/Post.java
@@ -157,7 +157,6 @@ public static class PostSpec {
 
     @Data
     public static class PostStatus {
-        @Schema(requiredMode = RequiredMode.REQUIRED)
         private String phase;
 
         @Schema
diff --git a/application/src/main/java/run/halo/app/core/endpoint/console/PluginEndpoint.java b/application/src/main/java/run/halo/app/core/endpoint/console/PluginEndpoint.java
index 728e42a1ba..15dc2c24b0 100644
--- a/application/src/main/java/run/halo/app/core/endpoint/console/PluginEndpoint.java
+++ b/application/src/main/java/run/halo/app/core/endpoint/console/PluginEndpoint.java
@@ -71,7 +71,6 @@
 import run.halo.app.extension.router.SortableRequest;
 import run.halo.app.infra.ReactiveUrlDataBufferFetcher;
 import run.halo.app.infra.utils.SettingUtils;
-import run.halo.app.plugin.PluginNotFoundException;
 import run.halo.app.plugin.PluginService;
 
 @Slf4j
@@ -298,12 +297,6 @@ public RouterFunction<ServerResponse> endpoint() {
                     .response(responseBuilder()
                         .implementation(ObjectNode.class))
             )
-            .GET("plugin-presets", this::listPresets,
-                builder -> builder.operationId("ListPluginPresets")
-                    .description("List all plugin presets in the system.")
-                    .tag(tag)
-                    .response(responseBuilder().implementationArray(Plugin.class))
-            )
             .GET("plugins/-/bundle.js", this::fetchJsBundle,
                 builder -> builder.operationId("fetchJsBundle")
                     .description("Merge all JS bundles of enabled plugins into one.")
@@ -472,10 +465,6 @@ private Mono<ServerResponse> reload(ServerRequest serverRequest) {
         return ServerResponse.ok().body(pluginService.reload(name), Plugin.class);
     }
 
-    private Mono<ServerResponse> listPresets(ServerRequest request) {
-        return ServerResponse.ok().body(pluginService.getPresets(), Plugin.class);
-    }
-
     private Mono<ServerResponse> fetchPluginConfig(ServerRequest request) {
         final var name = request.pathVariable("name");
         return client.fetch(Plugin.class, name)
@@ -564,10 +553,6 @@ private Mono<ServerResponse> install(ServerRequest request) {
                     if (InstallSource.FILE.equals(source)) {
                         return installFromFile(installRequest.getFile(), pluginService::install);
                     }
-                    if (InstallSource.PRESET.equals(source)) {
-                        return installFromPreset(installRequest.getPresetName(),
-                            pluginService::install);
-                    }
                     return Mono.error(
                         new UnsupportedOperationException("Unsupported install source " + source));
                 }))
@@ -586,10 +571,6 @@ private Mono<ServerResponse> upgrade(ServerRequest request) {
                         return installFromFile(installRequest.getFile(),
                             path -> pluginService.upgrade(pluginName, path));
                     }
-                    if (InstallSource.PRESET.equals(source)) {
-                        return installFromPreset(installRequest.getPresetName(),
-                            path -> pluginService.upgrade(pluginName, path));
-                    }
                     return Mono.error(
                         new UnsupportedOperationException("Unsupported install source " + source));
                 }))
@@ -606,16 +587,6 @@ private Mono<Plugin> installFromFile(FilePart filePart,
             this::deleteFileIfExists);
     }
 
-    private Mono<Plugin> installFromPreset(Mono<String> presetNameMono,
-        Function<Path, Mono<Plugin>> resourceClosure) {
-        return presetNameMono.flatMap(pluginService::getPreset)
-            .switchIfEmpty(
-                Mono.error(() -> new PluginNotFoundException("Plugin preset was not found.")))
-            .map(pluginPreset -> pluginPreset.getStatus().getLoadLocation())
-            .map(Path::of)
-            .flatMap(resourceClosure);
-    }
-
     public static class ListRequest extends SortableRequest {
 
         public ListRequest(ServerRequest request) {
diff --git a/application/src/main/java/run/halo/app/core/endpoint/SystemConfigEndpoint.java b/application/src/main/java/run/halo/app/core/endpoint/console/SystemConfigEndpoint.java
similarity index 99%
rename from application/src/main/java/run/halo/app/core/endpoint/SystemConfigEndpoint.java
rename to application/src/main/java/run/halo/app/core/endpoint/console/SystemConfigEndpoint.java
index d6ceb690f1..de6bd4fb07 100644
--- a/application/src/main/java/run/halo/app/core/endpoint/SystemConfigEndpoint.java
+++ b/application/src/main/java/run/halo/app/core/endpoint/console/SystemConfigEndpoint.java
@@ -1,4 +1,4 @@
-package run.halo.app.core.endpoint;
+package run.halo.app.core.endpoint.console;
 
 import static org.springdoc.core.fn.builders.apiresponse.Builder.responseBuilder;
 import static org.springdoc.core.fn.builders.content.Builder.contentBuilder;
diff --git a/application/src/main/java/run/halo/app/core/endpoint/console/SystemInitializationEndpoint.java b/application/src/main/java/run/halo/app/core/endpoint/console/SystemInitializationEndpoint.java
deleted file mode 100644
index 4bb6b21b37..0000000000
--- a/application/src/main/java/run/halo/app/core/endpoint/console/SystemInitializationEndpoint.java
+++ /dev/null
@@ -1,147 +0,0 @@
-package run.halo.app.core.endpoint.console;
-
-import static io.swagger.v3.oas.annotations.media.Schema.RequiredMode.REQUIRED;
-import static org.springdoc.core.fn.builders.apiresponse.Builder.responseBuilder;
-import static org.springdoc.core.fn.builders.header.Builder.headerBuilder;
-import static org.springdoc.core.fn.builders.requestbody.Builder.requestBodyBuilder;
-
-import io.swagger.v3.oas.annotations.media.Schema;
-import java.net.URI;
-import java.time.Duration;
-import java.util.LinkedHashMap;
-import java.util.Map;
-import lombok.Data;
-import lombok.RequiredArgsConstructor;
-import org.apache.commons.lang3.StringUtils;
-import org.springdoc.webflux.core.fn.SpringdocRouteBuilder;
-import org.springframework.dao.OptimisticLockingFailureException;
-import org.springframework.http.HttpHeaders;
-import org.springframework.http.HttpStatus;
-import org.springframework.stereotype.Component;
-import org.springframework.web.reactive.function.server.RouterFunction;
-import org.springframework.web.reactive.function.server.ServerRequest;
-import org.springframework.web.reactive.function.server.ServerResponse;
-import org.springframework.web.server.ResponseStatusException;
-import org.springframework.web.server.ServerWebInputException;
-import reactor.core.publisher.Mono;
-import reactor.util.retry.Retry;
-import run.halo.app.core.extension.endpoint.CustomEndpoint;
-import run.halo.app.extension.ConfigMap;
-import run.halo.app.extension.ReactiveExtensionClient;
-import run.halo.app.infra.InitializationStateGetter;
-import run.halo.app.infra.SystemSetting;
-import run.halo.app.infra.ValidationUtils;
-import run.halo.app.infra.exception.UnsatisfiedAttributeValueException;
-import run.halo.app.infra.utils.JsonUtils;
-import run.halo.app.security.SuperAdminInitializer;
-
-/**
- * System initialization endpoint.
- *
- * @author guqing
- * @since 2.9.0
- */
-@Component
-@RequiredArgsConstructor
-public class SystemInitializationEndpoint implements CustomEndpoint {
-
-    private final ReactiveExtensionClient client;
-    private final SuperAdminInitializer superAdminInitializer;
-    private final InitializationStateGetter initializationStateSupplier;
-
-    @Override
-    public RouterFunction<ServerResponse> endpoint() {
-        var tag = "SystemV1alpha1Console";
-        // define a non-resource api
-        return SpringdocRouteBuilder.route()
-            .POST("/system/initialize", this::initialize,
-                builder -> builder.operationId("initialize")
-                    .description("Initialize system")
-                    .tag(tag)
-                    .requestBody(requestBodyBuilder()
-                        .implementation(SystemInitializationRequest.class))
-                    .response(responseBuilder()
-                        .responseCode(HttpStatus.CREATED.value() + "")
-                        .description("System initialization successfully.")
-                        .header(headerBuilder()
-                            .name(HttpHeaders.LOCATION)
-                            .description("Redirect URL.")
-                        )
-                    )
-            )
-            .build();
-    }
-
-    private Mono<ServerResponse> initialize(ServerRequest request) {
-        return request.bodyToMono(SystemInitializationRequest.class)
-            .switchIfEmpty(
-                Mono.error(new ServerWebInputException("Request body must not be empty"))
-            )
-            .doOnNext(requestBody -> {
-                if (!ValidationUtils.validateName(requestBody.getUsername())) {
-                    throw new UnsatisfiedAttributeValueException(
-                        "The username does not meet the specifications",
-                        "problemDetail.user.username.unsatisfied", null);
-                }
-                if (StringUtils.isBlank(requestBody.getPassword())) {
-                    throw new UnsatisfiedAttributeValueException(
-                        "The password does not meet the specifications",
-                        "problemDetail.user.password.unsatisfied", null);
-                }
-            })
-            .flatMap(requestBody -> initializationStateSupplier.userInitialized()
-                .flatMap(result -> {
-                    if (result) {
-                        return Mono.error(new ResponseStatusException(HttpStatus.CONFLICT,
-                            "System has been initialized"));
-                    }
-                    return initializeSystem(requestBody);
-                })
-            )
-            .then(ServerResponse.created(URI.create("/console")).build());
-    }
-
-    private Mono<Void> initializeSystem(SystemInitializationRequest requestBody) {
-        Mono<Void> initializeAdminUser = superAdminInitializer.initialize(
-            SuperAdminInitializer.InitializationParam.builder()
-                .username(requestBody.getUsername())
-                .password(requestBody.getPassword())
-                .email(requestBody.getEmail())
-                .build());
-
-        Mono<Void> siteSetting =
-            Mono.defer(() -> client.get(ConfigMap.class, SystemSetting.SYSTEM_CONFIG)
-                    .flatMap(config -> {
-                        Map<String, String> data = config.getData();
-                        if (data == null) {
-                            data = new LinkedHashMap<>();
-                            config.setData(data);
-                        }
-                        String basic = data.getOrDefault(SystemSetting.Basic.GROUP, "{}");
-                        SystemSetting.Basic basicSetting =
-                            JsonUtils.jsonToObject(basic, SystemSetting.Basic.class);
-                        basicSetting.setTitle(requestBody.getSiteTitle());
-                        data.put(SystemSetting.Basic.GROUP, JsonUtils.objectToJson(basicSetting));
-                        return client.update(config);
-                    }))
-                .retryWhen(Retry.backoff(5, Duration.ofMillis(100))
-                    .filter(t -> t instanceof OptimisticLockingFailureException)
-                )
-                .then();
-        return Mono.when(initializeAdminUser, siteSetting);
-    }
-
-    @Data
-    public static class SystemInitializationRequest {
-
-        @Schema(requiredMode = REQUIRED, minLength = 1)
-        private String username;
-
-        @Schema(requiredMode = REQUIRED, minLength = 3)
-        private String password;
-
-        private String email;
-
-        private String siteTitle;
-    }
-}
diff --git a/application/src/main/java/run/halo/app/infra/DefaultThemeInitializer.java b/application/src/main/java/run/halo/app/infra/DefaultThemeInitializer.java
deleted file mode 100644
index 31af2d0a05..0000000000
--- a/application/src/main/java/run/halo/app/infra/DefaultThemeInitializer.java
+++ /dev/null
@@ -1,65 +0,0 @@
-package run.halo.app.infra;
-
-import java.io.IOException;
-import lombok.extern.slf4j.Slf4j;
-import org.springframework.boot.context.event.ApplicationStartedEvent;
-import org.springframework.context.ApplicationListener;
-import org.springframework.core.io.UrlResource;
-import org.springframework.core.io.buffer.DataBufferUtils;
-import org.springframework.core.io.buffer.DefaultDataBufferFactory;
-import org.springframework.stereotype.Component;
-import org.springframework.util.ResourceUtils;
-import org.springframework.util.StreamUtils;
-import run.halo.app.infra.properties.HaloProperties;
-import run.halo.app.infra.properties.ThemeProperties;
-import run.halo.app.infra.utils.FileUtils;
-import run.halo.app.theme.service.ThemeService;
-
-@Slf4j
-@Component
-public class DefaultThemeInitializer implements ApplicationListener<ApplicationStartedEvent> {
-
-    private final ThemeService themeService;
-
-    private final ThemeRootGetter themeRoot;
-
-    private final ThemeProperties themeProps;
-
-    public DefaultThemeInitializer(ThemeService themeService, ThemeRootGetter themeRoot,
-        HaloProperties haloProps) {
-        this.themeService = themeService;
-        this.themeRoot = themeRoot;
-        this.themeProps = haloProps.getTheme();
-    }
-
-    @Override
-    public void onApplicationEvent(ApplicationStartedEvent event) {
-        if (themeProps.getInitializer().isDisabled()) {
-            log.debug("Skipped initializing default theme due to disabled");
-            return;
-        }
-        var themeRoot = this.themeRoot.get();
-        var location = themeProps.getInitializer().getLocation();
-        try {
-            // TODO Checking if any themes are installed here in the future might be better?
-            if (!FileUtils.isEmpty(themeRoot)) {
-                log.debug("Skipped initializing default theme because there are themes "
-                    + "inside theme root");
-                return;
-            }
-            log.info("Initializing default theme from {}", location);
-            var themeUrl = ResourceUtils.getURL(location);
-            var content = DataBufferUtils.read(new UrlResource(themeUrl),
-                DefaultDataBufferFactory.sharedInstance,
-                StreamUtils.BUFFER_SIZE);
-            var theme = themeService.install(content).block();
-            log.info("Initialized default theme: {}", theme);
-            // Because default active theme is default, we don't need to enabled it manually.
-        } catch (IOException e) {
-            // we should skip the initialization error at here
-            log.warn("Failed to initialize theme from " + location, e);
-        }
-    }
-
-
-}
diff --git a/application/src/main/java/run/halo/app/infra/SystemState.java b/application/src/main/java/run/halo/app/infra/SystemState.java
index 1403a15ccb..03e8a37e02 100644
--- a/application/src/main/java/run/halo/app/infra/SystemState.java
+++ b/application/src/main/java/run/halo/app/infra/SystemState.java
@@ -3,11 +3,19 @@
 import com.fasterxml.jackson.databind.JsonNode;
 import com.github.fge.jsonpatch.JsonPatchException;
 import com.github.fge.jsonpatch.mergepatch.JsonMergePatch;
+import java.time.Duration;
+import java.util.HashMap;
 import java.util.LinkedHashMap;
 import java.util.Map;
+import java.util.function.Consumer;
 import lombok.Data;
+import org.springframework.dao.OptimisticLockingFailureException;
 import org.springframework.lang.NonNull;
+import reactor.core.publisher.Mono;
+import reactor.util.retry.Retry;
 import run.halo.app.extension.ConfigMap;
+import run.halo.app.extension.Metadata;
+import run.halo.app.extension.ReactiveExtensionClient;
 import run.halo.app.infra.utils.JsonParseException;
 import run.halo.app.infra.utils.JsonUtils;
 
@@ -68,6 +76,33 @@ public static void update(@NonNull SystemState systemState, @NonNull ConfigMap c
         }
     }
 
+    /**
+     * <p>Update system state by the given {@link Consumer}.</p>
+     * <p>if the system state config map does not exist, it will create a new one.</p>
+     */
+    public static Mono<Void> upsetSystemState(ReactiveExtensionClient client,
+        Consumer<SystemState> consumer) {
+        return Mono.defer(() -> client.fetch(ConfigMap.class, SYSTEM_STATES_CONFIGMAP)
+                .switchIfEmpty(Mono.defer(() -> {
+                    ConfigMap configMap = new ConfigMap();
+                    configMap.setMetadata(new Metadata());
+                    configMap.getMetadata().setName(SYSTEM_STATES_CONFIGMAP);
+                    configMap.setData(new HashMap<>());
+                    return client.create(configMap);
+                }))
+                .flatMap(configMap -> {
+                    SystemState systemState = deserialize(configMap);
+                    consumer.accept(systemState);
+                    update(systemState, configMap);
+                    return client.update(configMap);
+                })
+            )
+            .retryWhen(Retry.backoff(5, Duration.ofMillis(100))
+                .filter(OptimisticLockingFailureException.class::isInstance)
+            )
+            .then();
+    }
+
     private static String emptyJsonObject() {
         return "{}";
     }
diff --git a/application/src/main/java/run/halo/app/infra/ValidationUtils.java b/application/src/main/java/run/halo/app/infra/ValidationUtils.java
index bb52132052..9ce908c365 100644
--- a/application/src/main/java/run/halo/app/infra/ValidationUtils.java
+++ b/application/src/main/java/run/halo/app/infra/ValidationUtils.java
@@ -6,8 +6,14 @@
 
 @UtilityClass
 public class ValidationUtils {
-    public static final Pattern NAME_PATTERN =
-        Pattern.compile("^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$");
+    public static final String NAME_REGEX =
+        "^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$";
+    public static final Pattern NAME_PATTERN = Pattern.compile(NAME_REGEX);
+
+    /**
+     * No Chinese, no spaces.
+     */
+    public static final String PASSWORD_REGEX = "^(?!.*[\\u4e00-\\u9fa5])(?=\\S+$).+$";
 
     public static final String EMAIL_REGEX =
         "^[a-zA-Z0-9_+&*-]+(?:\\.[a-zA-Z0-9_+&*-]+)*@(?:[a-zA-Z0-9-]+\\.)+[a-zA-Z]{2,7}$";
diff --git a/application/src/main/java/run/halo/app/infra/utils/FileUtils.java b/application/src/main/java/run/halo/app/infra/utils/FileUtils.java
index ca790bfde1..ffaac5cbe7 100644
--- a/application/src/main/java/run/halo/app/infra/utils/FileUtils.java
+++ b/application/src/main/java/run/halo/app/infra/utils/FileUtils.java
@@ -25,6 +25,7 @@
 import java.util.zip.ZipOutputStream;
 import lombok.extern.slf4j.Slf4j;
 import org.reactivestreams.Publisher;
+import org.springframework.core.io.Resource;
 import org.springframework.core.io.buffer.DataBuffer;
 import org.springframework.lang.NonNull;
 import org.springframework.util.AntPathMatcher;
@@ -296,6 +297,14 @@ public static Mono<Boolean> deleteFileSilently(Path file, Scheduler scheduler) {
             .subscribeOn(scheduler);
     }
 
+    public static void copyResource(Resource resource, Path path) {
+        try (var inputStream = resource.getInputStream()) {
+            Files.copy(inputStream, path, REPLACE_EXISTING);
+        } catch (IOException e) {
+            throw new RuntimeException(e);
+        }
+    }
+
     public static void copy(Path source, Path dest, CopyOption... options) {
         try {
             Files.copy(source, dest, options);
diff --git a/application/src/main/java/run/halo/app/infra/utils/HaloUtils.java b/application/src/main/java/run/halo/app/infra/utils/HaloUtils.java
index 08d9e2cc01..190536bebd 100644
--- a/application/src/main/java/run/halo/app/infra/utils/HaloUtils.java
+++ b/application/src/main/java/run/halo/app/infra/utils/HaloUtils.java
@@ -5,6 +5,7 @@
 import java.nio.charset.StandardCharsets;
 import java.time.Instant;
 import java.time.ZoneId;
+import lombok.experimental.UtilityClass;
 import lombok.extern.slf4j.Slf4j;
 import org.apache.commons.lang3.StringUtils;
 import org.springframework.core.io.ClassPathResource;
@@ -14,12 +15,22 @@
 import org.springframework.web.reactive.function.server.ServerRequest;
 
 /**
+ * Halo utilities.
+ *
  * @author guqing
- * @date 2022-04-12
+ * @since 2.0.0
  */
 @Slf4j
+@UtilityClass
 public class HaloUtils {
 
+    /**
+     * Check if the request is an XMLHttpRequest.
+     */
+    public static boolean isXhr(HttpHeaders headers) {
+        return headers.getOrEmpty("X-Requested-With").contains("XMLHttpRequest");
+    }
+
     /**
      * <p>Read the file under the classpath as a string.</p>
      *
@@ -51,7 +62,7 @@ public static String userAgentFrom(ServerRequest request) {
             // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-CH-UA
             userAgent = httpHeaders.getFirst("Sec-CH-UA");
         }
-        return StringUtils.defaultString(userAgent, "unknown");
+        return StringUtils.defaultIfBlank(userAgent, "unknown");
     }
 
     public static String getDayText(Instant instant) {
diff --git a/application/src/main/java/run/halo/app/plugin/PluginService.java b/application/src/main/java/run/halo/app/plugin/PluginService.java
index 193318cd68..3e8bb6e601 100644
--- a/application/src/main/java/run/halo/app/plugin/PluginService.java
+++ b/application/src/main/java/run/halo/app/plugin/PluginService.java
@@ -10,15 +10,7 @@
 
 public interface PluginService {
 
-    Flux<Plugin> getPresets();
-
-    /**
-     * Gets a plugin information by preset name from plugin presets.
-     *
-     * @param presetName is preset name of plugin.
-     * @return plugin preset information.
-     */
-    Mono<Plugin> getPreset(String presetName);
+    Mono<Void> installPresetPlugins();
 
     /**
      * Installs a plugin from a temporary Jar path.
diff --git a/application/src/main/java/run/halo/app/plugin/PluginServiceImpl.java b/application/src/main/java/run/halo/app/plugin/PluginServiceImpl.java
index 25383e89d4..540dc853b4 100644
--- a/application/src/main/java/run/halo/app/plugin/PluginServiceImpl.java
+++ b/application/src/main/java/run/halo/app/plugin/PluginServiceImpl.java
@@ -23,6 +23,7 @@
 import java.util.concurrent.atomic.AtomicBoolean;
 import java.util.stream.Collectors;
 import lombok.extern.slf4j.Slf4j;
+import org.apache.commons.lang3.StringUtils;
 import org.pf4j.DependencyResolver;
 import org.pf4j.PluginDescriptor;
 import org.pf4j.PluginWrapper;
@@ -36,6 +37,7 @@
 import org.springframework.core.io.buffer.DataBufferUtils;
 import org.springframework.core.io.buffer.DefaultDataBufferFactory;
 import org.springframework.core.io.support.PathMatchingResourcePatternResolver;
+import org.springframework.dao.OptimisticLockingFailureException;
 import org.springframework.stereotype.Component;
 import org.springframework.util.Assert;
 import org.springframework.util.CollectionUtils;
@@ -110,18 +112,36 @@ void setClock(Clock clock) {
     }
 
     @Override
-    public Flux<Plugin> getPresets() {
-        // list presets from classpath
-        return Flux.defer(() -> getPresetJars()
-            .map(this::toPath)
-            .map(path -> new YamlPluginFinder().find(path)));
+    public Mono<Void> installPresetPlugins() {
+        return getPresetJars()
+            .flatMap(path -> this.install(path)
+                .onErrorResume(PluginAlreadyExistsException.class, e -> Mono.empty())
+                .flatMap(plugin -> FileUtils.deleteFileSilently(path)
+                    .thenReturn(plugin)
+                )
+            )
+            .flatMap(this::enablePlugin)
+            .subscribeOn(Schedulers.boundedElastic())
+            .then();
     }
 
-    @Override
-    public Mono<Plugin> getPreset(String presetName) {
-        return getPresets()
-            .filter(plugin -> Objects.equals(plugin.getMetadata().getName(), presetName))
-            .next();
+    private Mono<Plugin> enablePlugin(Plugin plugin) {
+        plugin.getSpec().setEnabled(true);
+        return client.update(plugin)
+            .onErrorResume(OptimisticLockingFailureException.class,
+                e -> enablePlugin(plugin.getMetadata().getName())
+            );
+    }
+
+    private Mono<Plugin> enablePlugin(String name) {
+        return Mono.defer(() -> client.get(Plugin.class, name)
+                .flatMap(plugin -> {
+                    plugin.getSpec().setEnabled(true);
+                    return client.update(plugin);
+                })
+            )
+            .retryWhen(Retry.backoff(8, Duration.ofMillis(100))
+                .filter(OptimisticLockingFailureException.class::isInstance));
     }
 
     @Override
@@ -481,24 +501,25 @@ private void satisfiesRequiresVersion(Plugin newPlugin) {
         }
     }
 
-    private Flux<Resource> getPresetJars() {
+    private Flux<Path> getPresetJars() {
         var resolver = new PathMatchingResourcePatternResolver();
         try {
             var resources = resolver.getResources(PRESETS_LOCATION_PATTERN);
-            return Flux.fromArray(resources);
+            return Flux.fromArray(resources)
+                .mapNotNull(resource -> {
+                    var filename = resource.getFilename();
+                    if (StringUtils.isBlank(filename)) {
+                        return null;
+                    }
+                    var path = tempDir.resolve(filename);
+                    FileUtils.copyResource(resource, path);
+                    return path;
+                });
         } catch (IOException e) {
             return Flux.error(e);
         }
     }
 
-    private Path toPath(Resource resource) {
-        try {
-            return Path.of(resource.getURI());
-        } catch (IOException e) {
-            throw Exceptions.propagate(e);
-        }
-    }
-
     private static void updatePlugin(Plugin oldPlugin, Plugin newPlugin) {
         var oldMetadata = oldPlugin.getMetadata();
         var newMetadata = newPlugin.getMetadata();
diff --git a/application/src/main/java/run/halo/app/security/CsrfConfigurer.java b/application/src/main/java/run/halo/app/security/CsrfConfigurer.java
index 0dc3b25e3b..bac91e04bc 100644
--- a/application/src/main/java/run/halo/app/security/CsrfConfigurer.java
+++ b/application/src/main/java/run/halo/app/security/CsrfConfigurer.java
@@ -18,7 +18,7 @@ public class CsrfConfigurer implements SecurityConfigurer {
     public void configure(ServerHttpSecurity http) {
         var csrfMatcher = new AndServerWebExchangeMatcher(
             CsrfWebFilter.DEFAULT_CSRF_MATCHER,
-            new NegatedServerWebExchangeMatcher(pathMatchers("/api/**", "/apis/**")
+            new NegatedServerWebExchangeMatcher(pathMatchers("/api/**", "/apis/**", "/system/setup")
             ));
         http.csrf(csrfSpec -> csrfSpec
             .csrfTokenRepository(withHttpOnlyFalse())
diff --git a/application/src/main/java/run/halo/app/security/DefaultServerAuthenticationEntryPoint.java b/application/src/main/java/run/halo/app/security/DefaultServerAuthenticationEntryPoint.java
index 24dfbf387a..dfb6b4fa12 100644
--- a/application/src/main/java/run/halo/app/security/DefaultServerAuthenticationEntryPoint.java
+++ b/application/src/main/java/run/halo/app/security/DefaultServerAuthenticationEntryPoint.java
@@ -10,6 +10,7 @@
 import org.springframework.security.web.server.util.matcher.ServerWebExchangeMatcher.MatchResult;
 import org.springframework.web.server.ServerWebExchange;
 import reactor.core.publisher.Mono;
+import run.halo.app.infra.utils.HaloUtils;
 
 /**
  * Default authentication entry point.
@@ -22,8 +23,7 @@
 public class DefaultServerAuthenticationEntryPoint implements ServerAuthenticationEntryPoint {
 
     private final ServerWebExchangeMatcher xhrMatcher = exchange -> {
-        if (exchange.getRequest().getHeaders().getOrEmpty("X-Requested-With")
-            .contains("XMLHttpRequest")) {
+        if (HaloUtils.isXhr(exchange.getRequest().getHeaders())) {
             return MatchResult.match();
         }
         return MatchResult.notMatch();
diff --git a/application/src/main/java/run/halo/app/security/InitializeRedirectionWebFilter.java b/application/src/main/java/run/halo/app/security/InitializeRedirectionWebFilter.java
index 08f2e373c2..d4820d9218 100644
--- a/application/src/main/java/run/halo/app/security/InitializeRedirectionWebFilter.java
+++ b/application/src/main/java/run/halo/app/security/InitializeRedirectionWebFilter.java
@@ -1,13 +1,17 @@
 package run.halo.app.security;
 
+import static org.springframework.security.web.server.util.matcher.ServerWebExchangeMatchers.pathMatchers;
+
 import java.net.URI;
 import lombok.Getter;
 import lombok.RequiredArgsConstructor;
 import org.springframework.http.HttpMethod;
+import org.springframework.http.MediaType;
 import org.springframework.lang.NonNull;
 import org.springframework.security.web.server.DefaultServerRedirectStrategy;
 import org.springframework.security.web.server.ServerRedirectStrategy;
-import org.springframework.security.web.server.util.matcher.PathPatternParserServerWebExchangeMatcher;
+import org.springframework.security.web.server.util.matcher.AndServerWebExchangeMatcher;
+import org.springframework.security.web.server.util.matcher.MediaTypeServerWebExchangeMatcher;
 import org.springframework.security.web.server.util.matcher.ServerWebExchangeMatcher;
 import org.springframework.stereotype.Component;
 import org.springframework.util.Assert;
@@ -26,9 +30,11 @@
 @Component
 @RequiredArgsConstructor
 public class InitializeRedirectionWebFilter implements WebFilter {
-    private final URI location = URI.create("/console");
-    private final ServerWebExchangeMatcher redirectMatcher =
-        new PathPatternParserServerWebExchangeMatcher("/", HttpMethod.GET);
+    private final URI location = URI.create("/system/setup");
+    private final ServerWebExchangeMatcher redirectMatcher = new AndServerWebExchangeMatcher(
+        pathMatchers(HttpMethod.GET, "/", "/console/**", "/uc/**", "/login", "/signup"),
+        new MediaTypeServerWebExchangeMatcher(MediaType.TEXT_HTML)
+    );
 
     private final InitializationStateGetter initializationStateGetter;
 
diff --git a/application/src/main/java/run/halo/app/security/preauth/SystemSetupEndpoint.java b/application/src/main/java/run/halo/app/security/preauth/SystemSetupEndpoint.java
new file mode 100644
index 0000000000..afe07f8ff8
--- /dev/null
+++ b/application/src/main/java/run/halo/app/security/preauth/SystemSetupEndpoint.java
@@ -0,0 +1,274 @@
+package run.halo.app.security.preauth;
+
+import static io.swagger.v3.oas.annotations.media.Schema.RequiredMode.REQUIRED;
+import static org.springdoc.core.fn.builders.apiresponse.Builder.responseBuilder;
+import static org.springdoc.core.fn.builders.requestbody.Builder.requestBodyBuilder;
+import static org.springframework.web.reactive.function.server.RequestPredicates.accept;
+import static org.springframework.web.reactive.function.server.RequestPredicates.contentType;
+import static org.springframework.web.reactive.function.server.RequestPredicates.path;
+
+import io.swagger.v3.oas.annotations.media.Schema;
+import jakarta.validation.constraints.Email;
+import jakarta.validation.constraints.NotBlank;
+import jakarta.validation.constraints.Pattern;
+import jakarta.validation.constraints.Size;
+import java.net.URI;
+import java.nio.charset.StandardCharsets;
+import java.time.Duration;
+import java.time.Instant;
+import java.util.LinkedHashMap;
+import java.util.Map;
+import java.util.Properties;
+import lombok.RequiredArgsConstructor;
+import org.springdoc.core.fn.builders.content.Builder;
+import org.springdoc.webflux.core.fn.SpringdocRouteBuilder;
+import org.springframework.beans.factory.config.PlaceholderConfigurerSupport;
+import org.springframework.context.annotation.Bean;
+import org.springframework.core.io.ClassPathResource;
+import org.springframework.dao.OptimisticLockingFailureException;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.MediaType;
+import org.springframework.security.util.InMemoryResource;
+import org.springframework.stereotype.Component;
+import org.springframework.util.LinkedMultiValueMap;
+import org.springframework.util.MultiValueMap;
+import org.springframework.util.PropertyPlaceholderHelper;
+import org.springframework.util.StreamUtils;
+import org.springframework.validation.BeanPropertyBindingResult;
+import org.springframework.validation.BindingResult;
+import org.springframework.validation.Validator;
+import org.springframework.web.reactive.function.server.RouterFunction;
+import org.springframework.web.reactive.function.server.ServerRequest;
+import org.springframework.web.reactive.function.server.ServerResponse;
+import reactor.core.publisher.Flux;
+import reactor.core.publisher.Mono;
+import reactor.core.scheduler.Schedulers;
+import reactor.util.retry.Retry;
+import run.halo.app.extension.ConfigMap;
+import run.halo.app.extension.ReactiveExtensionClient;
+import run.halo.app.extension.Unstructured;
+import run.halo.app.infra.InitializationStateGetter;
+import run.halo.app.infra.SystemConfigurableEnvironmentFetcher;
+import run.halo.app.infra.SystemSetting;
+import run.halo.app.infra.SystemState;
+import run.halo.app.infra.ValidationUtils;
+import run.halo.app.infra.exception.RequestBodyValidationException;
+import run.halo.app.infra.utils.HaloUtils;
+import run.halo.app.infra.utils.JsonUtils;
+import run.halo.app.infra.utils.YamlUnstructuredLoader;
+import run.halo.app.plugin.PluginService;
+import run.halo.app.security.SuperAdminInitializer;
+import run.halo.app.theme.service.ThemeService;
+
+@Component
+@RequiredArgsConstructor
+public class SystemSetupEndpoint {
+    static final String SETUP_TEMPLATE = "setup";
+    static final PropertyPlaceholderHelper PROPERTY_PLACEHOLDER_HELPER =
+        new PropertyPlaceholderHelper(
+            PlaceholderConfigurerSupport.DEFAULT_PLACEHOLDER_PREFIX,
+            PlaceholderConfigurerSupport.DEFAULT_PLACEHOLDER_SUFFIX
+        );
+
+    private final InitializationStateGetter initializationStateGetter;
+    private final SystemConfigurableEnvironmentFetcher systemConfigFetcher;
+    private final SuperAdminInitializer superAdminInitializer;
+    private final ReactiveExtensionClient client;
+    private final PluginService pluginService;
+    private final ThemeService themeService;
+    private final Validator validator;
+
+    @Bean
+    RouterFunction<ServerResponse> setupPageRouter() {
+        final var tag = "System";
+        return SpringdocRouteBuilder.route()
+            .GET(path("/system/setup").and(accept(MediaType.TEXT_HTML)), this::setupPage,
+                builder -> builder.operationId("JumpToSetupPage")
+                    .description("Jump to setup page")
+                    .tag(tag)
+                    .response(responseBuilder()
+                        .content(Builder.contentBuilder()
+                            .mediaType(MediaType.TEXT_HTML_VALUE))
+                        .implementation(String.class)
+                    )
+            )
+            .POST("/system/setup", contentType(MediaType.APPLICATION_FORM_URLENCODED), this::setup,
+                builder -> builder
+                    .operationId("SetupSystem")
+                    .description("Setup system")
+                    .tag(tag)
+                    .requestBody(requestBodyBuilder()
+                        .implementation(SetupRequest.class)
+                        .content(Builder.contentBuilder()
+                            .mediaType(MediaType.APPLICATION_FORM_URLENCODED_VALUE)
+                        )
+                    )
+                    .response(responseBuilder()
+                        .responseCode(String.valueOf(HttpStatus.NO_CONTENT.value()))
+                        .implementation(Void.class)
+                    )
+            )
+            .build();
+    }
+
+    private Mono<ServerResponse> setup(ServerRequest request) {
+        return request.formData()
+            .map(SetupRequest::new)
+            .filterWhen(body -> initializationStateGetter.userInitialized()
+                .map(initialized -> !initialized)
+            )
+            .flatMap(body -> {
+                var bindingResult = body.toBindingResult();
+                validator.validate(body, bindingResult);
+                if (bindingResult.hasErrors()) {
+                    return handleValidationErrors(bindingResult, request);
+                }
+                return doInitialization(body)
+                    .then(Mono.defer(() -> handleSetupSuccessfully(request)));
+            });
+    }
+
+    private static Mono<ServerResponse> handleSetupSuccessfully(ServerRequest request) {
+        if (isHtmlRequest(request)) {
+            return redirectToConsole();
+        }
+        return ServerResponse.noContent().build();
+    }
+
+    private Mono<ServerResponse> handleValidationErrors(BindingResult bindingResult,
+        ServerRequest request) {
+        if (isHtmlRequest(request)) {
+            return ServerResponse.status(HttpStatus.BAD_REQUEST)
+                .render(SETUP_TEMPLATE, bindingResult.getModel());
+        }
+        return Mono.error(new RequestBodyValidationException(bindingResult));
+    }
+
+    private static boolean isHtmlRequest(ServerRequest request) {
+        return request.headers().accept().contains(MediaType.TEXT_HTML)
+            && !HaloUtils.isXhr(request.headers().asHttpHeaders());
+    }
+
+    private static Mono<ServerResponse> redirectToConsole() {
+        return ServerResponse.temporaryRedirect(URI.create("/console")).build();
+    }
+
+    private Mono<Void> doInitialization(SetupRequest body) {
+        var superUserMono = superAdminInitializer.initialize(
+                SuperAdminInitializer.InitializationParam.builder()
+                    .username(body.getUsername())
+                    .password(body.getPassword())
+                    .email(body.getEmail())
+                    .build()
+            )
+            .subscribeOn(Schedulers.boundedElastic());
+
+        var basicConfigMono = Mono.defer(() -> systemConfigFetcher.getConfigMap()
+                .flatMap(configMap -> {
+                    mergeToBasicConfig(body, configMap);
+                    return client.update(configMap);
+                })
+            )
+            .retryWhen(Retry.backoff(5, Duration.ofMillis(100))
+                .filter(t -> t instanceof OptimisticLockingFailureException)
+            )
+            .subscribeOn(Schedulers.boundedElastic())
+            .then();
+        return Mono.when(superUserMono, basicConfigMono,
+                initializeNecessaryData(body.getUsername()),
+                pluginService.installPresetPlugins(),
+                themeService.installPresetTheme()
+            )
+            .then(SystemState.upsetSystemState(client, state -> state.setIsSetup(true)));
+    }
+
+    private Mono<Void> initializeNecessaryData(String username) {
+        return loadPresetExtensions(username)
+            .concatMap(client::create)
+            .subscribeOn(Schedulers.boundedElastic())
+            .then();
+    }
+
+    private static void mergeToBasicConfig(SetupRequest body, ConfigMap configMap) {
+        Map<String, String> data = configMap.getData();
+        if (data == null) {
+            data = new LinkedHashMap<>();
+            configMap.setData(data);
+        }
+        String basic = data.getOrDefault(SystemSetting.Basic.GROUP, "{}");
+        var basicSetting = JsonUtils.jsonToObject(basic, SystemSetting.Basic.class);
+        basicSetting.setTitle(body.getSiteTitle());
+        data.put(SystemSetting.Basic.GROUP, JsonUtils.objectToJson(basicSetting));
+    }
+
+    private Mono<ServerResponse> setupPage(ServerRequest request) {
+        return initializationStateGetter.userInitialized()
+            .flatMap(initialized -> {
+                if (initialized) {
+                    return redirectToConsole();
+                }
+                var body = new SetupRequest(new LinkedMultiValueMap<>());
+                var bindingResult = body.toBindingResult();
+                return ServerResponse.ok().render(SETUP_TEMPLATE, bindingResult.getModel());
+            });
+    }
+
+    record SetupRequest(MultiValueMap<String, String> formData) {
+
+        @Schema(requiredMode = REQUIRED, minLength = 4, maxLength = 63)
+        @NotBlank
+        @Size(min = 4, max = 63)
+        @Pattern(regexp = ValidationUtils.NAME_REGEX,
+            message = "{validation.error.username.pattern}")
+        public String getUsername() {
+            return formData.getFirst("username");
+        }
+
+        @Schema(requiredMode = REQUIRED, minLength = 5, maxLength = 257)
+        @NotBlank
+        @Pattern(regexp = ValidationUtils.PASSWORD_REGEX,
+            message = "{validation.error.password.pattern}")
+        @Size(min = 5, max = 257)
+        public String getPassword() {
+            return formData.getFirst("password");
+        }
+
+        @Email
+        public String getEmail() {
+            return formData.getFirst("email");
+        }
+
+        @NotBlank
+        @Size(max = 80)
+        public String getSiteTitle() {
+            return formData.getFirst("siteTitle");
+        }
+
+        public BindingResult toBindingResult() {
+            return new BeanPropertyBindingResult(this, "form");
+        }
+    }
+
+    Flux<Unstructured> loadPresetExtensions(String username) {
+        return Mono.fromCallable(
+                () -> {
+                    // read initial-data.yaml to string
+                    var classPathResource = new ClassPathResource("initial-data.yaml");
+                    String rawContent = StreamUtils.copyToString(classPathResource.getInputStream(),
+                        StandardCharsets.UTF_8);
+                    // build properties
+                    var properties = new Properties();
+                    properties.setProperty("username", username);
+                    properties.setProperty("timestamp", Instant.now().toString());
+                    // replace placeholders
+                    var processedContent =
+                        PROPERTY_PLACEHOLDER_HELPER.replacePlaceholders(rawContent, properties);
+                    // load yaml to unstructured
+                    var stringResource = new InMemoryResource(processedContent);
+                    var loader = new YamlUnstructuredLoader(stringResource);
+                    return loader.load();
+                })
+            .flatMapMany(Flux::fromIterable)
+            .subscribeOn(Schedulers.boundedElastic());
+    }
+}
\ No newline at end of file
diff --git a/application/src/main/java/run/halo/app/theme/TemplateEngineManager.java b/application/src/main/java/run/halo/app/theme/TemplateEngineManager.java
index 36ac57da3b..9b9487d726 100644
--- a/application/src/main/java/run/halo/app/theme/TemplateEngineManager.java
+++ b/application/src/main/java/run/halo/app/theme/TemplateEngineManager.java
@@ -1,13 +1,10 @@
 package run.halo.app.theme;
 
-import java.io.FileNotFoundException;
-import java.nio.file.Path;
 import lombok.NonNull;
 import org.springframework.beans.factory.ObjectProvider;
 import org.springframework.boot.autoconfigure.thymeleaf.ThymeleafProperties;
 import org.springframework.stereotype.Component;
 import org.springframework.util.ConcurrentLruCache;
-import org.springframework.util.ResourceUtils;
 import org.thymeleaf.TemplateEngine;
 import org.thymeleaf.dialect.IDialect;
 import org.thymeleaf.spring6.ISpringWebFluxTemplateEngine;
@@ -17,7 +14,6 @@
 import org.thymeleaf.templateresolver.ITemplateResolver;
 import reactor.core.publisher.Mono;
 import run.halo.app.infra.ExternalUrlSupplier;
-import run.halo.app.infra.exception.NotFoundException;
 import run.halo.app.plugin.HaloPluginManager;
 import run.halo.app.theme.dialect.HaloProcessorDialect;
 import run.halo.app.theme.engine.HaloTemplateEngine;
@@ -71,24 +67,9 @@ public TemplateEngineManager(ThymeleafProperties thymeleafProperties,
 
     public ISpringWebFluxTemplateEngine getTemplateEngine(ThemeContext theme) {
         CacheKey cacheKey = buildCacheKey(theme);
-        // cache not exists, will create new engine
-        if (!engineCache.contains(cacheKey)) {
-            // before this, check if theme exists
-            if (!fileExists(theme.getPath())) {
-                throw new NotFoundException("Theme not found.");
-            }
-        }
         return engineCache.get(cacheKey);
     }
 
-    private boolean fileExists(Path path) {
-        try {
-            return ResourceUtils.getFile(path.toUri()).exists();
-        } catch (FileNotFoundException e) {
-            return false;
-        }
-    }
-
     public Mono<Void> clearCache(String themeName) {
         return themeResolver.getThemeContext(themeName)
             .doOnNext(themeContext -> {
diff --git a/application/src/main/java/run/halo/app/theme/service/ThemeService.java b/application/src/main/java/run/halo/app/theme/service/ThemeService.java
index 007b4d3e58..7a6fa547a7 100644
--- a/application/src/main/java/run/halo/app/theme/service/ThemeService.java
+++ b/application/src/main/java/run/halo/app/theme/service/ThemeService.java
@@ -8,6 +8,8 @@
 
 public interface ThemeService {
 
+    Mono<Void> installPresetTheme();
+
     Mono<Theme> install(Publisher<DataBuffer> content);
 
     Mono<Theme> upgrade(String themeName, Publisher<DataBuffer> content);
diff --git a/application/src/main/java/run/halo/app/theme/service/ThemeServiceImpl.java b/application/src/main/java/run/halo/app/theme/service/ThemeServiceImpl.java
index c1abe453de..37a7b142d5 100644
--- a/application/src/main/java/run/halo/app/theme/service/ThemeServiceImpl.java
+++ b/application/src/main/java/run/halo/app/theme/service/ThemeServiceImpl.java
@@ -8,6 +8,8 @@
 import static run.halo.app.theme.service.ThemeUtils.locateThemeManifest;
 import static run.halo.app.theme.service.ThemeUtils.unzipThemeTo;
 
+import java.io.IOException;
+import java.nio.file.Files;
 import java.nio.file.Path;
 import java.time.Duration;
 import java.util.HashMap;
@@ -18,11 +20,17 @@
 import lombok.extern.slf4j.Slf4j;
 import org.apache.commons.lang3.StringUtils;
 import org.reactivestreams.Publisher;
+import org.springframework.core.io.FileSystemResource;
+import org.springframework.core.io.UrlResource;
 import org.springframework.core.io.buffer.DataBuffer;
+import org.springframework.core.io.buffer.DataBufferUtils;
+import org.springframework.core.io.buffer.DefaultDataBufferFactory;
 import org.springframework.dao.OptimisticLockingFailureException;
 import org.springframework.retry.RetryException;
 import org.springframework.stereotype.Service;
 import org.springframework.util.Assert;
+import org.springframework.util.ResourceUtils;
+import org.springframework.util.StreamUtils;
 import org.springframework.web.server.ServerErrorException;
 import org.springframework.web.server.ServerWebInputException;
 import reactor.core.publisher.Flux;
@@ -41,6 +49,8 @@
 import run.halo.app.infra.ThemeRootGetter;
 import run.halo.app.infra.exception.ThemeUpgradeException;
 import run.halo.app.infra.exception.UnsatisfiedAttributeValueException;
+import run.halo.app.infra.properties.HaloProperties;
+import run.halo.app.infra.utils.FileUtils;
 import run.halo.app.infra.utils.SettingUtils;
 import run.halo.app.infra.utils.VersionUtils;
 
@@ -53,10 +63,48 @@ public class ThemeServiceImpl implements ThemeService {
 
     private final ThemeRootGetter themeRoot;
 
+    private final HaloProperties haloProperties;
+
     private final SystemVersionSupplier systemVersionSupplier;
 
     private final Scheduler scheduler = Schedulers.boundedElastic();
 
+    @Override
+    public Mono<Void> installPresetTheme() {
+        var themeProps = haloProperties.getTheme();
+        var location = themeProps.getInitializer().getLocation();
+        return createThemeTempPath()
+            .flatMap(tempPath -> Mono.usingWhen(copyPresetThemeToPath(location, tempPath),
+                path -> {
+                    var content = DataBufferUtils.read(new FileSystemResource(path),
+                        DefaultDataBufferFactory.sharedInstance,
+                        StreamUtils.BUFFER_SIZE);
+                    return install(content);
+                }, path -> deleteRecursivelyAndSilently(tempPath, scheduler)
+            ))
+            .onErrorResume(IOException.class, e -> {
+                log.warn("Failed to initialize theme from {}", location, e);
+                return Mono.empty();
+            })
+            .then();
+    }
+
+    private Mono<Path> copyPresetThemeToPath(String location, Path tempDir) {
+        return Mono.fromCallable(
+            () -> {
+                var themeUrl = ResourceUtils.getURL(location);
+                var resource = new UrlResource(themeUrl);
+                var tempThemePath = tempDir.resolve("theme.zip");
+                FileUtils.copyResource(resource, tempThemePath);
+                return tempThemePath;
+            });
+    }
+
+    private static Mono<Path> createThemeTempPath() {
+        return Mono.fromCallable(() -> Files.createTempDirectory("halo-theme-preset"))
+            .subscribeOn(Schedulers.boundedElastic());
+    }
+
     @Override
     public Mono<Theme> install(Publisher<DataBuffer> content) {
         var themeRoot = this.themeRoot.get();
diff --git a/application/src/main/resources/config/i18n/messages.properties b/application/src/main/resources/config/i18n/messages.properties
index b053fc49c9..1123fcc8fc 100644
--- a/application/src/main/resources/config/i18n/messages.properties
+++ b/application/src/main/resources/config/i18n/messages.properties
@@ -86,4 +86,7 @@ problemDetail.comment.waitingForApproval=Comment is awaiting approval.
 
 title.visibility.identification.private=(Private)
 signup.error.confirm-password-not-match=The confirmation password does not match the password.
-signup.error.email-code.invalid=Invalid email code.
\ No newline at end of file
+signup.error.email-code.invalid=Invalid email code.
+
+validation.error.username.pattern=The username can only be lowercase and can only contain letters, numbers, hyphens, and dots, starting and ending with characters.
+validation.error.password.pattern=The password cannot contain Chinese characters and spaces.
\ No newline at end of file
diff --git a/application/src/main/resources/config/i18n/messages_zh.properties b/application/src/main/resources/config/i18n/messages_zh.properties
index 8655c96a08..3b5883143e 100644
--- a/application/src/main/resources/config/i18n/messages_zh.properties
+++ b/application/src/main/resources/config/i18n/messages_zh.properties
@@ -60,3 +60,6 @@ problemDetail.comment.waitingForApproval=评论审核中。
 title.visibility.identification.private=（私有）
 signup.error.confirm-password-not-match=确认密码与密码不匹配。
 signup.error.email-code.invalid=邮箱验证码无效。
+
+validation.error.username.pattern=用户名只能小写且只能包含字母、数字、中划线和点，以字符开头和结尾
+validation.error.password.pattern=密码不能包含中文和空格
\ No newline at end of file
diff --git a/application/src/main/resources/extensions/role-template-anonymous.yaml b/application/src/main/resources/extensions/role-template-anonymous.yaml
index 8f2ffce10e..0e606e55f4 100644
--- a/application/src/main/resources/extensions/role-template-anonymous.yaml
+++ b/application/src/main/resources/extensions/role-template-anonymous.yaml
@@ -23,8 +23,6 @@ rules:
     verbs: [ "create" ]
   - nonResourceURLs: [ "/actuator/globalinfo", "/actuator/health", "/actuator/health/*", "/login/public-key" ]
     verbs: [ "get" ]
-  - nonResourceURLs: [ "/apis/api.console.halo.run/v1alpha1/system/initialize" ]
-    verbs: [ "create" ]
 ---
 apiVersion: v1alpha1
 kind: "Role"
diff --git a/application/src/main/resources/initial-data.yaml b/application/src/main/resources/initial-data.yaml
new file mode 100644
index 0000000000..66112e3ac5
--- /dev/null
+++ b/application/src/main/resources/initial-data.yaml
@@ -0,0 +1,239 @@
+# 提供了 timestamp、username 变量，用于初始化数据时填充时间戳和用户名
+# 初始化文章关联的分类、标签数据
+apiVersion: content.halo.run/v1alpha1
+kind: Category
+metadata:
+  name: 76514a40-6ef1-4ed9-b58a-e26945bde3ca
+spec:
+  displayName: 默认分类
+  slug: default
+  description: 这是你的默认分类，如不需要，删除即可。
+  cover: ""
+  template: ""
+  priority: 0
+  children: [ ]
+status:
+  permalink: "/categories/default"
+
+---
+apiVersion: content.halo.run/v1alpha1
+kind: Tag
+metadata:
+  name: c33ceabb-d8f1-4711-8991-bb8f5c92ad7c
+spec:
+  displayName: Halo
+  slug: halo
+  color: "#ffffff"
+  cover: ""
+status:
+  permalink: "/tags/halo"
+
+---
+# 文章关联的内容
+apiVersion: content.halo.run/v1alpha1
+kind: Snapshot
+metadata:
+  name: fb5cd6bd-998d-4ccc-984d-5cc23b0a09f9
+  annotations:
+    content.halo.run/keep-raw: "true"
+spec:
+  subjectRef:
+    group: content.halo.run
+    version: v1alpha1
+    kind: Post
+    name: 5152aea5-c2e8-4717-8bba-2263d46e19d5
+  rawType: HTML
+  rawPatch: <h2 id="hello-halo"><strong>Hello
+    Halo</strong></h2><p>如果你看到了这一篇文章，那么证明你已经安装成功了，感谢使用 <a target="_blank"
+    rel="noopener noreferrer nofollow" href="https://www.halo.run/">Halo</a>
+    进行创作，希望能够使用愉快。</p><h2
+    id="%E7%9B%B8%E5%85%B3%E9%93%BE%E6%8E%A5"><strong>相关链接</strong></h2><ul><li><p>官网：<a
+    target="_blank" rel="noopener noreferrer nofollow"
+    href="https://www.halo.run">https://www.halo.run</a></p></li><li><p>文档：<a
+    target="_blank" rel="noopener noreferrer nofollow"
+    href="https://docs.halo.run">https://docs.halo.run</a></p></li><li><p>社区：<a
+    target="_blank" rel="noopener noreferrer nofollow"
+    href="https://bbs.halo.run">https://bbs.halo.run</a></p></li><li><p>应用市场：<a
+    target="_blank" rel="noopener noreferrer nofollow"
+    href="https://www.halo.run/store/apps">https://www.halo.run/store/apps</a></p></li><li><p>开源地址：<a
+    target="_blank" rel="noopener noreferrer nofollow"
+    href="https://github.com/halo-dev/halo">https://github.com/halo-dev/halo</a></p></li></ul><p>在使用过程中，有任何问题都可以通过以上链接找寻答案，或者联系我们。</p><blockquote><p>这是一篇自动生成的文章，请删除这篇文章之后开始你的创作吧！</p></blockquote>
+  contentPatch: <h2 id="hello-halo"><strong>Hello
+    Halo</strong></h2><p>如果你看到了这一篇文章，那么证明你已经安装成功了，感谢使用 <a target="_blank"
+    rel="noopener noreferrer nofollow" href="https://www.halo.run/">Halo</a>
+    进行创作，希望能够使用愉快。</p><h2
+    id="%E7%9B%B8%E5%85%B3%E9%93%BE%E6%8E%A5"><strong>相关链接</strong></h2><ul><li><p>官网：<a
+    target="_blank" rel="noopener noreferrer nofollow"
+    href="https://www.halo.run">https://www.halo.run</a></p></li><li><p>文档：<a
+    target="_blank" rel="noopener noreferrer nofollow"
+    href="https://docs.halo.run">https://docs.halo.run</a></p></li><li><p>社区：<a
+    target="_blank" rel="noopener noreferrer nofollow"
+    href="https://bbs.halo.run">https://bbs.halo.run</a></p></li><li><p>应用市场：<a
+    target="_blank" rel="noopener noreferrer nofollow"
+    href="https://www.halo.run/store/apps">https://www.halo.run/store/apps</a></p></li><li><p>开源地址：<a
+    target="_blank" rel="noopener noreferrer nofollow"
+    href="https://github.com/halo-dev/halo">https://github.com/halo-dev/halo</a></p></li></ul><p>在使用过程中，有任何问题都可以通过以上链接找寻答案，或者联系我们。</p><blockquote><p>这是一篇自动生成的文章，请删除这篇文章之后开始你的创作吧！</p></blockquote>
+  lastModifyTime: "${timestamp}"
+  owner: "${username}"
+  contributors:
+    - "${username}"
+
+---
+# 初始化文章数据
+apiVersion: content.halo.run/v1alpha1
+kind: Post
+metadata:
+  name: 5152aea5-c2e8-4717-8bba-2263d46e19d5
+spec:
+  title: Hello Halo
+  slug: hello-halo
+  releaseSnapshot: fb5cd6bd-998d-4ccc-984d-5cc23b0a09f9
+  headSnapshot: fb5cd6bd-998d-4ccc-984d-5cc23b0a09f9
+  baseSnapshot: fb5cd6bd-998d-4ccc-984d-5cc23b0a09f9
+  owner: "${username}"
+  template: ""
+  cover: ""
+  deleted: false
+  publish: true
+  publishTime: "${timestamp}"
+  pinned: false
+  allowComment: true
+  visible: PUBLIC
+  priority: 0
+  excerpt:
+    autoGenerate: false
+    raw: 如果你看到了这一篇文章，那么证明你已经安装成功了，感谢使用 Halo 进行创作，希望能够使用愉快。
+  categories:
+    - 76514a40-6ef1-4ed9-b58a-e26945bde3ca
+  tags:
+    - c33ceabb-d8f1-4711-8991-bb8f5c92ad7c
+  htmlMetas: [ ]
+status:
+  permalink: /archives/hello-halo
+
+---
+# 自定义页面关联的内容
+apiVersion: content.halo.run/v1alpha1
+kind: Snapshot
+metadata:
+  name: c3f73cc2-194e-4cd8-9092-7386aa50a0e5
+  annotations:
+    content.halo.run/keep-raw: "true"
+spec:
+  subjectRef:
+    group: content.halo.run
+    version: v1alpha1
+    kind: SinglePage
+    name: 373a5f79-f44f-441a-9df1-85a4f553ece8
+  rawType: HTML
+  rawPatch: <h2><strong>关于页面</strong></h2><p>这是一个自定义页面，你可以在后台的 <code>页面</code>
+    -&gt; <code>自定义页面</code>
+    找到它，你可以用于新建关于页面、联系我们页面等等。</p><blockquote><p>这是一篇自动生成的页面，你可以在后台删除它。</p></blockquote>
+  contentPatch: <h2><strong>关于页面</strong></h2><p>这是一个自定义页面，你可以在后台的 <code>页面</code>
+    -&gt; <code>自定义页面</code>
+    找到它，你可以用于新建关于页面、联系我们页面等等。</p><blockquote><p>这是一篇自动生成的页面，你可以在后台删除它。</p></blockquote>
+  lastModifyTime: "${timestamp}"
+  owner: "${username}"
+  contributors:
+    - "${username}"
+
+---
+# 初始化自定义页面数据
+apiVersion: content.halo.run/v1alpha1
+kind: SinglePage
+metadata:
+  name: 373a5f79-f44f-441a-9df1-85a4f553ece8
+spec:
+  title: 关于
+  slug: about
+  template: ""
+  cover: ""
+  owner: "${username}"
+  deleted: false
+  publish: true
+  baseSnapshot: c3f73cc2-194e-4cd8-9092-7386aa50a0e5
+  headSnapshot: c3f73cc2-194e-4cd8-9092-7386aa50a0e5
+  releaseSnapshot: c3f73cc2-194e-4cd8-9092-7386aa50a0e5
+  pinned: false
+  allowComment: true
+  visible: PUBLIC
+  version: 1
+  priority: 0
+  excerpt:
+    autoGenerate: false
+    raw: 这是一个自定义页面，你可以在后台的 页面 -> 自定义页面 找到它，你可以用于新建关于页面、联系我们页面等等。
+  htmlMetas: [ ]
+status:
+  permalink: "/about"
+
+---
+# 首页菜单项
+apiVersion: v1alpha1
+kind: MenuItem
+metadata:
+  name: 88c3f10b-321c-4092-86a8-70db00251b74
+spec:
+  displayName: 首页
+  href: /
+  children: [ ]
+  priority: 0
+---
+# 关联到文章作为菜单
+apiVersion: v1alpha1
+kind: MenuItem
+metadata:
+  name: c4c814d1-0c2c-456b-8c96-4864965fee94
+spec:
+  displayName: "Hello Halo"
+  href: "/archives/hello-halo"
+  children: [ ]
+  priority: 1
+  targetRef:
+    group: content.halo.run
+    version: v1alpha1
+    kind: Post
+    name: 5152aea5-c2e8-4717-8bba-2263d46e19d5
+---
+# 关联到标签作为菜单
+apiVersion: v1alpha1
+kind: MenuItem
+metadata:
+  name: 35869bd3-33b5-448b-91ee-cf6517a59644
+spec:
+  displayName: "Halo"
+  href: "/tags/halo"
+  children: [ ]
+  priority: 2
+  targetRef:
+    group: content.halo.run
+    version: v1alpha1
+    kind: Tag
+    name: c33ceabb-d8f1-4711-8991-bb8f5c92ad7c
+---
+# 关联到自定义页面作为菜单
+apiVersion: v1alpha1
+kind: MenuItem
+metadata:
+  name: b0d041fa-dc99-48f6-a193-8604003379cf
+spec:
+  displayName: "关于"
+  href: "/about"
+  children: [ ]
+  priority: 3
+  targetRef:
+    group: content.halo.run
+    version: v1alpha1
+    kind: SinglePage
+    name: 373a5f79-f44f-441a-9df1-85a4f553ece8
+---
+apiVersion: v1alpha1
+kind: Menu
+metadata:
+  name: primary
+spec:
+  displayName: 主菜单
+  menuItems:
+    - 88c3f10b-321c-4092-86a8-70db00251b74
+    - c4c814d1-0c2c-456b-8c96-4864965fee94
+    - 35869bd3-33b5-448b-91ee-cf6517a59644
+    - b0d041fa-dc99-48f6-a193-8604003379cf
diff --git a/application/src/main/resources/templates/gateway_modules/form_fragments.html b/application/src/main/resources/templates/gateway_modules/form_fragments.html
index 1533e1cfa1..269771c092 100644
--- a/application/src/main/resources/templates/gateway_modules/form_fragments.html
+++ b/application/src/main/resources/templates/gateway_modules/form_fragments.html
@@ -134,7 +134,7 @@
     <div class="form-item">
         <label for="password" th:text="#{form.signup.password.label}"></label>
         <th:block
-            th:replace="~{gateway_modules/input_fragments :: password(id = 'password', name = 'password', required = 'true', minlength = 6, enableToggle = true)}"
+            th:replace="~{gateway_modules/input_fragments :: password(id = 'password', name = 'password', required = 'true', minlength = 5, maxlength = 257, enableToggle = true)}"
         ></th:block>
         <p class="alert alert-error" th:if="${#fields.hasErrors('password')}" th:errors="*{password}"></p>
     </div>
@@ -142,7 +142,7 @@
     <div class="form-item">
         <label for="confirmPassword" th:text="#{form.signup.confirmPassword.label}"></label>
         <th:block
-            th:replace="~{gateway_modules/input_fragments :: password(id = 'confirmPassword', name = 'confirmPassword', required = 'true', minlength = 6, enableToggle = true)}"
+            th:replace="~{gateway_modules/input_fragments :: password(id = 'confirmPassword', name = 'confirmPassword', required = 'true', minlength = 5, maxlength = 257, enableToggle = true)}"
         ></th:block>
         <p class="alert alert-error" th:if="${#fields.hasErrors('confirmPassword')}" th:errors="*{confirmPassword}"></p>
     </div>
@@ -254,13 +254,13 @@
     <div class="form-item">
         <label for="password" th:text="#{form.passwordResetLink.password.label}">Password</label>
         <th:block
-            th:replace="~{gateway_modules/input_fragments :: password(id = 'password', name = 'password', required = 'true', minlength = 6, enableToggle = true)}"
+            th:replace="~{gateway_modules/input_fragments :: password(id = 'password', name = 'password', required = 'true', minlength = 5, maxlength = 257, enableToggle = true)}"
         ></th:block>
     </div>
     <div class="form-item">
         <label for="confirmPassword" th:text="#{form.passwordResetLink.confirmPassword.label}">Confirm Password</label>
         <th:block
-            th:replace="~{gateway_modules/input_fragments :: password(id = 'confirmPassword', name = 'confirmPassword', required = 'true', minlength = 6, enableToggle = true)}"
+            th:replace="~{gateway_modules/input_fragments :: password(id = 'confirmPassword', name = 'confirmPassword', required = 'true', minlength = 5, maxlength = 257, enableToggle = true)}"
         ></th:block>
     </div>
     <div class="form-item">
@@ -294,4 +294,4 @@
             <button type="submit" th:text="#{form.passwordReset.submit}"></button>
         </div>
     </form>
-</th:block>
+</th:block>
\ No newline at end of file
diff --git a/application/src/main/resources/templates/gateway_modules/input_fragments.html b/application/src/main/resources/templates/gateway_modules/input_fragments.html
index ffffb5cd6a..9a21e3cdce 100644
--- a/application/src/main/resources/templates/gateway_modules/input_fragments.html
+++ b/application/src/main/resources/templates/gateway_modules/input_fragments.html
@@ -1,4 +1,4 @@
-<div th:remove="tag" th:fragment="password(id,name,required,minlength,enableToggle)">
+<div th:remove="tag" th:fragment="password(id,name,required,minlength,maxlength,enableToggle)">
     <div class="form-input" th:classappend="${enableToggle ? 'form-input-stack toggle-password-display-flag' : ''}">
         <input
             th:id="${id}"
@@ -10,6 +10,7 @@
             autocapitalize="off"
             th:required="${required}"
             th:minlength="${minlength}"
+            th:maxlength="${maxlength}"
         />
 
         <div th:if="${enableToggle}" class="form-input-stack-icon toggle-password-button">
@@ -28,4 +29,4 @@
             </svg>
         </div>
     </div>
-</div>
+</div>
\ No newline at end of file
diff --git a/application/src/main/resources/templates/login_local.html b/application/src/main/resources/templates/login_local.html
index 3ae24d4001..a6021c6f11 100644
--- a/application/src/main/resources/templates/login_local.html
+++ b/application/src/main/resources/templates/login_local.html
@@ -50,7 +50,7 @@
         </div>
 
         <th:block
-            th:replace="~{gateway_modules/input_fragments :: password(id = 'password', name = 'password', required = 'true', minlength = null, enableToggle = true)}"
+            th:replace="~{gateway_modules/input_fragments :: password(id = 'password', name = 'password', required = 'true', minlength = null, maxlength = 257, enableToggle = true)}"
         ></th:block>
     </div>
-</div>
+</div>
\ No newline at end of file
diff --git a/application/src/main/resources/templates/setup.html b/application/src/main/resources/templates/setup.html
new file mode 100644
index 0000000000..3bc8788b61
--- /dev/null
+++ b/application/src/main/resources/templates/setup.html
@@ -0,0 +1,121 @@
+<!doctype html>
+<html
+    xmlns:th="https://www.thymeleaf.org"
+    th:replace="~{gateway_modules/layout :: layout(title = |#{title} - Halo|, head = ~{::head}, body = ~{::body})}"
+>
+    <th:block th:fragment="head">
+        <style>
+            .setup-page-wrapper {
+                max-width: 35em;
+            }
+        </style>
+    </th:block>
+    <th:block th:fragment="body">
+        <div class="gateway-wrapper setup-page-wrapper">
+            <div th:replace="~{gateway_modules/common_fragments::haloLogo}"></div>
+
+            <div class="halo-form-wrapper">
+                <h1 class="form-title" th:text="#{title}"></h1>
+
+                <form th:object="${form}" th:action="@{/system/setup}" class="halo-form" method="post">
+                    <div class="form-item">
+                        <label for="siteTitle" th:text="#{form.siteTitle.label}"></label>
+                        <div class="form-input">
+                            <input
+                                name="siteTitle"
+                                id="siteTitle"
+                                type="text"
+                                th:field="*{siteTitle}"
+                                autocomplete="off"
+                                spellcheck="false"
+                                autocorrect="off"
+                                autocapitalize="off"
+                                maxlength="80"
+                                required
+                                autofocus
+                            />
+                        </div>
+                        <p class="alert alert-error" th:if="${#fields.hasErrors('siteTitle')}" th:errors="*{siteTitle}"></p>
+                    </div>
+
+                    <div class="form-item">
+                        <label for="username" th:text="#{form.username.label}"></label>
+                        <div class="form-input">
+                            <input
+                                name="username"
+                                id="username"
+                                type="text"
+                                th:field="*{username}"
+                                autocomplete="off"
+                                spellcheck="false"
+                                autocorrect="off"
+                                autocapitalize="off"
+                                maxlength="63"
+                                minlength="4"
+                                required
+                            />
+                        </div>
+                        <p class="alert alert-error" th:if="${#fields.hasErrors('username')}" th:errors="*{username}"></p>
+                    </div>
+
+                    <div class="form-item">
+                        <label for="email" th:text="#{form.email.label}"></label>
+                        <div class="form-input">
+                            <input
+                                name="email"
+                                id="email"
+                                type="email"
+                                th:field="*{email}"
+                                autocomplete="off"
+                                spellcheck="false"
+                                autocorrect="off"
+                                autocapitalize="off"
+                                required
+                            />
+                        </div>
+                        <p class="alert alert-error" th:if="${#fields.hasErrors('email')}" th:errors="*{email}"></p>
+                    </div>
+
+                    <div class="form-item">
+                        <label for="password" th:text="#{form.password.label}"></label>
+                        <th:block
+                            th:replace="~{gateway_modules/input_fragments :: password(id = 'password', name = 'password', required = 'true', minlength = 5, maxlength = 257, enableToggle = true)}"
+                        ></th:block>
+                        <p class="alert alert-error" th:if="${#fields.hasErrors('password')}" th:errors="*{password}"></p>
+                    </div>
+
+                    <div class="form-item">
+                        <label for="confirmPassword" th:text="#{form.confirmPassword.label}"></label>
+                        <th:block
+                            th:replace="~{gateway_modules/input_fragments :: password(id = 'confirmPassword', name = null, required = 'true', minlength = 5, maxlength = 257, enableToggle = true)}"
+                        ></th:block>
+                    </div>
+
+                    <div class="form-item">
+                        <button type="submit" th:text="#{form.submit}">初始化</button>
+                    </div>
+                </form>
+            </div>
+
+            <div th:replace="~{gateway_modules/common_fragments::languageSwitcher}"></div>
+        </div>
+
+        <script th:inline="javascript">
+            document.addEventListener("DOMContentLoaded", function () {
+                var password = document.getElementById("password"),
+                    confirm_password = document.getElementById("confirmPassword");
+
+                function validatePassword() {
+                    if (password.value != confirm_password.value) {
+                        confirm_password.setCustomValidity("Passwords Don't Match");
+                    } else {
+                        confirm_password.setCustomValidity("");
+                    }
+                }
+
+                password.onchange = validatePassword;
+                confirm_password.onkeyup = validatePassword;
+            });
+        </script>
+    </th:block>
+</html>
\ No newline at end of file
diff --git a/application/src/main/resources/templates/setup.properties b/application/src/main/resources/templates/setup.properties
new file mode 100644
index 0000000000..139b4c5d1d
--- /dev/null
+++ b/application/src/main/resources/templates/setup.properties
@@ -0,0 +1,7 @@
+title=系统初始化
+form.siteTitle.label=站点标题
+form.username.label=用户名
+form.email.label=电子邮箱
+form.password.label=密码
+form.confirmPassword.label=确认密码
+form.submit=初始化
\ No newline at end of file
diff --git a/application/src/main/resources/templates/setup_en.properties b/application/src/main/resources/templates/setup_en.properties
new file mode 100644
index 0000000000..f65c17eee1
--- /dev/null
+++ b/application/src/main/resources/templates/setup_en.properties
@@ -0,0 +1,7 @@
+title=Setup
+form.siteTitle.label=Site title
+form.username.label=Username
+form.email.label=Email
+form.password.label=Password
+form.confirmPassword.label=Confirm Password
+form.submit=Setup
diff --git a/application/src/main/resources/templates/setup_es.properties b/application/src/main/resources/templates/setup_es.properties
new file mode 100644
index 0000000000..f4041620a8
--- /dev/null
+++ b/application/src/main/resources/templates/setup_es.properties
@@ -0,0 +1,7 @@
+title=Configuración
+form.siteTitle.label=Título del Sitio
+form.username.label=Nombre de Usuario
+form.email.label=Correo Electrónico
+form.password.label=Contraseña
+form.confirmPassword.label=Confirmar Contraseña
+form.submit=Configurar
\ No newline at end of file
diff --git a/application/src/main/resources/templates/setup_zh_TW.properties b/application/src/main/resources/templates/setup_zh_TW.properties
new file mode 100644
index 0000000000..1f2e3a147b
--- /dev/null
+++ b/application/src/main/resources/templates/setup_zh_TW.properties
@@ -0,0 +1,7 @@
+title=系統初始化
+form.siteTitle.label=站點標題
+form.username.label=使用者名稱
+form.email.label=電子郵件
+form.password.label=密碼
+form.confirmPassword.label=確認密碼
+form.submit=初始化
\ No newline at end of file
diff --git a/application/src/test/java/run/halo/app/core/endpoint/console/SystemInitializationEndpointTest.java b/application/src/test/java/run/halo/app/core/endpoint/console/SystemInitializationEndpointTest.java
deleted file mode 100644
index cd2238e863..0000000000
--- a/application/src/test/java/run/halo/app/core/endpoint/console/SystemInitializationEndpointTest.java
+++ /dev/null
@@ -1,89 +0,0 @@
-package run.halo.app.core.endpoint.console;
-
-import static org.mockito.ArgumentMatchers.any;
-import static org.mockito.Mockito.verify;
-import static org.mockito.Mockito.when;
-import static org.springframework.test.web.reactive.server.WebTestClient.bindToRouterFunction;
-
-import org.junit.jupiter.api.BeforeEach;
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.extension.ExtendWith;
-import org.mockito.InjectMocks;
-import org.mockito.Mock;
-import org.mockito.junit.jupiter.MockitoExtension;
-import org.springframework.test.web.reactive.server.WebTestClient;
-import reactor.core.publisher.Mono;
-import run.halo.app.core.endpoint.console.SystemInitializationEndpoint.SystemInitializationRequest;
-import run.halo.app.extension.ConfigMap;
-import run.halo.app.extension.ReactiveExtensionClient;
-import run.halo.app.infra.InitializationStateGetter;
-import run.halo.app.infra.SystemSetting;
-import run.halo.app.security.SuperAdminInitializer;
-import run.halo.app.security.SuperAdminInitializer.InitializationParam;
-
-/**
- * Tests for {@link SystemInitializationEndpoint}.
- *
- * @author guqing
- * @since 2.9.0
- */
-@ExtendWith(MockitoExtension.class)
-class SystemInitializationEndpointTest {
-
-    @Mock
-    InitializationStateGetter initializationStateGetter;
-
-    @Mock
-    SuperAdminInitializer superAdminInitializer;
-
-    @Mock
-    ReactiveExtensionClient client;
-
-    @InjectMocks
-    SystemInitializationEndpoint initializationEndpoint;
-
-    WebTestClient webTestClient;
-
-    @BeforeEach
-    void setUp() {
-        webTestClient = bindToRouterFunction(initializationEndpoint.endpoint()).build();
-    }
-
-    @Test
-    void initializeWithoutRequestBody() {
-        webTestClient.post()
-            .uri("/system/initialize")
-            .exchange()
-            .expectStatus()
-            .isBadRequest();
-    }
-
-    @Test
-    void initializeWithRequestBody() {
-        var initialization = new SystemInitializationRequest();
-        initialization.setUsername("faker");
-        initialization.setPassword("openfaker");
-        initialization.setEmail("faker@halo.run");
-        initialization.setSiteTitle("Fake Site");
-
-        when(initializationStateGetter.userInitialized()).thenReturn(Mono.just(false));
-        when(superAdminInitializer.initialize(any(InitializationParam.class)))
-            .thenReturn(Mono.empty());
-
-        var configMap = new ConfigMap();
-        when(client.get(ConfigMap.class, SystemSetting.SYSTEM_CONFIG))
-            .thenReturn(Mono.just(configMap));
-        when(client.update(configMap)).thenReturn(Mono.just(configMap));
-
-        webTestClient.post().uri("/system/initialize")
-            .bodyValue(initialization)
-            .exchange()
-            .expectStatus().isCreated()
-            .expectHeader().location("/console");
-
-        verify(initializationStateGetter).userInitialized();
-        verify(superAdminInitializer).initialize(any());
-        verify(client).get(ConfigMap.class, SystemSetting.SYSTEM_CONFIG);
-        verify(client).update(configMap);
-    }
-}
diff --git a/application/src/test/java/run/halo/app/plugin/PluginServiceImplTest.java b/application/src/test/java/run/halo/app/plugin/PluginServiceImplTest.java
index bb38bd0fd9..94734dea6b 100644
--- a/application/src/test/java/run/halo/app/plugin/PluginServiceImplTest.java
+++ b/application/src/test/java/run/halo/app/plugin/PluginServiceImplTest.java
@@ -77,33 +77,6 @@ class PluginServiceImplTest {
     @InjectMocks
     PluginServiceImpl pluginService;
 
-    @Test
-    void getPresetsTest() {
-        var presets = pluginService.getPresets();
-        StepVerifier.create(presets)
-            .assertNext(plugin -> {
-                assertEquals("fake-plugin", plugin.getMetadata().getName());
-                assertEquals("0.0.2", plugin.getSpec().getVersion());
-                assertEquals(Plugin.Phase.PENDING, plugin.getStatus().getPhase());
-            })
-            .verifyComplete();
-    }
-
-    @Test
-    void getPresetIfNotFound() {
-        var plugin = pluginService.getPreset("not-found-plugin");
-        StepVerifier.create(plugin)
-            .verifyComplete();
-    }
-
-    @Test
-    void getPresetIfFound() {
-        var plugin = pluginService.getPreset("fake-plugin");
-        StepVerifier.create(plugin)
-            .expectNextCount(1)
-            .verifyComplete();
-    }
-
     @Nested
     class InstallUpdateReloadTest {
 
diff --git a/application/src/test/java/run/halo/app/security/InitializeRedirectionWebFilterTest.java b/application/src/test/java/run/halo/app/security/InitializeRedirectionWebFilterTest.java
index 9d7a1d81bd..2e9d839918 100644
--- a/application/src/test/java/run/halo/app/security/InitializeRedirectionWebFilterTest.java
+++ b/application/src/test/java/run/halo/app/security/InitializeRedirectionWebFilterTest.java
@@ -2,6 +2,7 @@
 
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.lenient;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.never;
 import static org.mockito.Mockito.verify;
@@ -14,6 +15,7 @@
 import org.mockito.InjectMocks;
 import org.mockito.Mock;
 import org.mockito.junit.jupiter.MockitoExtension;
+import org.springframework.http.MediaType;
 import org.springframework.mock.http.server.reactive.MockServerHttpRequest;
 import org.springframework.mock.web.server.MockServerWebExchange;
 import org.springframework.security.web.server.ServerRedirectStrategy;
@@ -50,49 +52,57 @@ void shouldRedirectWhenSystemNotInitialized() {
         when(initializationStateGetter.userInitialized()).thenReturn(Mono.just(false));
 
         WebFilterChain chain = mock(WebFilterChain.class);
+        var paths = new String[] {"/", "/console/test", "/uc/test", "/login", "/signup"};
+        for (String path : paths) {
+            MockServerHttpRequest request = MockServerHttpRequest.get(path)
+                .accept(MediaType.TEXT_HTML).build();
+            MockServerWebExchange exchange = MockServerWebExchange.from(request);
 
-        MockServerHttpRequest request = MockServerHttpRequest.get("/").build();
-        MockServerWebExchange exchange = MockServerWebExchange.from(request);
+            when(serverRedirectStrategy.sendRedirect(any(), any())).thenReturn(Mono.empty().then());
 
-        when(serverRedirectStrategy.sendRedirect(any(), any())).thenReturn(Mono.empty().then());
+            Mono<Void> result = filter.filter(exchange, chain);
 
-        Mono<Void> result = filter.filter(exchange, chain);
+            StepVerifier.create(result)
+                .expectNextCount(0)
+                .expectComplete()
+                .verify();
 
-        StepVerifier.create(result)
-            .expectNextCount(0)
-            .expectComplete()
-            .verify();
-
-        verify(serverRedirectStrategy).sendRedirect(eq(exchange), eq(URI.create("/console")));
-        verify(chain, never()).filter(eq(exchange));
+            verify(serverRedirectStrategy).sendRedirect(eq(exchange),
+                eq(URI.create("/system/setup")));
+            verify(chain, never()).filter(eq(exchange));
+        }
     }
 
     @Test
     void shouldNotRedirectWhenSystemInitialized() {
-        when(initializationStateGetter.userInitialized()).thenReturn(Mono.just(true));
+        lenient().when(initializationStateGetter.userInitialized()).thenReturn(Mono.just(true));
 
         WebFilterChain chain = mock(WebFilterChain.class);
 
-        MockServerHttpRequest request = MockServerHttpRequest.get("/").build();
-        MockServerWebExchange exchange = MockServerWebExchange.from(request);
-        when(chain.filter(any())).thenReturn(Mono.empty().then());
-        Mono<Void> result = filter.filter(exchange, chain);
-
-        StepVerifier.create(result)
-            .expectNextCount(0)
-            .expectComplete()
-            .verify();
-
-        verify(serverRedirectStrategy, never()).sendRedirect(eq(exchange),
-            eq(URI.create("/console")));
-        verify(chain).filter(eq(exchange));
+        var paths = new String[] {"/test", "/apis/test", "system/setup", "/logout"};
+        for (String path : paths) {
+            MockServerHttpRequest request = MockServerHttpRequest.get(path)
+                .accept(MediaType.TEXT_HTML).build();
+            MockServerWebExchange exchange = MockServerWebExchange.from(request);
+            when(chain.filter(any())).thenReturn(Mono.empty().then());
+            Mono<Void> result = filter.filter(exchange, chain);
+
+            StepVerifier.create(result)
+                .expectNextCount(0)
+                .expectComplete()
+                .verify();
+
+            verify(serverRedirectStrategy, never()).sendRedirect(eq(exchange), any());
+            verify(chain).filter(eq(exchange));
+        }
     }
 
     @Test
-    void shouldNotRedirectWhenNotHomePage() {
+    void shouldNotRedirectTest() {
         WebFilterChain chain = mock(WebFilterChain.class);
 
-        MockServerHttpRequest request = MockServerHttpRequest.get("/test").build();
+        MockServerHttpRequest request = MockServerHttpRequest.get("/test")
+            .accept(MediaType.TEXT_HTML).build();
         MockServerWebExchange exchange = MockServerWebExchange.from(request);
         when(chain.filter(any())).thenReturn(Mono.empty().then());
         Mono<Void> result = filter.filter(exchange, chain);
@@ -102,8 +112,7 @@ void shouldNotRedirectWhenNotHomePage() {
             .expectComplete()
             .verify();
 
-        verify(serverRedirectStrategy, never()).sendRedirect(eq(exchange),
-            eq(URI.create("/console")));
+        verify(serverRedirectStrategy, never()).sendRedirect(eq(exchange), any());
         verify(chain).filter(eq(exchange));
     }
 }
diff --git a/application/src/test/java/run/halo/app/security/preauth/SystemSetupEndpointTest.java b/application/src/test/java/run/halo/app/security/preauth/SystemSetupEndpointTest.java
new file mode 100644
index 0000000000..178d636723
--- /dev/null
+++ b/application/src/test/java/run/halo/app/security/preauth/SystemSetupEndpointTest.java
@@ -0,0 +1,30 @@
+package run.halo.app.security.preauth;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+import java.util.Properties;
+import org.junit.jupiter.api.Test;
+
+/**
+ * Tests for {@link SystemSetupEndpoint}.
+ *
+ * @author guqing
+ * @since 2.20.0
+ */
+class SystemSetupEndpointTest {
+
+    @Test
+    void placeholderTest() {
+        var properties = new Properties();
+        properties.setProperty("username", "guqing");
+        properties.setProperty("timestamp", "2024-09-30");
+        var str = SystemSetupEndpoint.PROPERTY_PLACEHOLDER_HELPER.replacePlaceholders("""
+            ${username}
+            ${timestamp}
+            """, properties);
+        assertThat(str).isEqualTo("""
+            guqing
+            2024-09-30
+            """);
+    }
+}
\ No newline at end of file

From 5df755d4a8c6a5dc3061743525fdf0a68c02629f Mon Sep 17 00:00:00 2001
From: Ryan Wang <i@ryanc.cc>
Date: Wed, 9 Oct 2024 12:20:54 +0800
Subject: [PATCH 103/185] Refine setup page

---
 api-docs/openapi/v3_0/aggregated.json         | 128 ++++-------
 .../v3_0/apis_console.api_v1alpha1.json       |  93 +-------
 .../v3_0/apis_extension.api_v1alpha1.json     |  14 +-
 .../openapi/v3_0/apis_uc.api_v1alpha1.json    |  88 +++++++-
 e2e/testsuite.yaml                            |  18 +-
 ui/console-src/router/guards/check-states.ts  |  37 ----
 ui/console-src/router/index.ts                |   2 -
 ui/console-src/router/routes.config.ts        |  18 --
 ui/console-src/views/system/Setup.vue         | 135 ------------
 .../views/system/SetupInitialData.vue         | 202 ------------------
 .../views/system/setup-data/category.json     |  16 --
 .../views/system/setup-data/menu-items.json   |  62 ------
 .../views/system/setup-data/menu.json         |  14 --
 .../views/system/setup-data/post.json         |  35 ---
 .../views/system/setup-data/singlePage.json   |  31 ---
 .../views/system/setup-data/tag.json          |  13 --
 .../api-client/src/.openapi-generator/FILES   |   2 +-
 ui/packages/api-client/src/api.ts             |   1 +
 .../src/api/plugin-v1alpha1-console-api.ts    |  66 ------
 .../src/api/system-v1alpha1-console-api.ts    |  89 --------
 .../api/user-connection-v1alpha1-uc-api.ts    | 149 +++++++++++++
 ui/packages/api-client/src/models/index.ts    |   1 -
 .../api-client/src/models/post-status.ts      |   2 +-
 .../src/models/single-page-status.ts          |   2 +-
 .../models/system-initialization-request.ts   |  48 -----
 ui/src/locales/en.yaml                        |  19 --
 ui/src/locales/es.yaml                        |  19 --
 ui/src/locales/zh-CN.yaml                     |  19 --
 ui/src/locales/zh-TW.yaml                     |  19 --
 29 files changed, 290 insertions(+), 1052 deletions(-)
 delete mode 100644 ui/console-src/router/guards/check-states.ts
 delete mode 100644 ui/console-src/views/system/Setup.vue
 delete mode 100644 ui/console-src/views/system/SetupInitialData.vue
 delete mode 100644 ui/console-src/views/system/setup-data/category.json
 delete mode 100644 ui/console-src/views/system/setup-data/menu-items.json
 delete mode 100644 ui/console-src/views/system/setup-data/menu.json
 delete mode 100644 ui/console-src/views/system/setup-data/post.json
 delete mode 100644 ui/console-src/views/system/setup-data/singlePage.json
 delete mode 100644 ui/console-src/views/system/setup-data/tag.json
 create mode 100644 ui/packages/api-client/src/api/user-connection-v1alpha1-uc-api.ts
 delete mode 100644 ui/packages/api-client/src/models/system-initialization-request.ts

diff --git a/api-docs/openapi/v3_0/aggregated.json b/api-docs/openapi/v3_0/aggregated.json
index 79fafe85cc..bd88ac814e 100644
--- a/api-docs/openapi/v3_0/aggregated.json
+++ b/api-docs/openapi/v3_0/aggregated.json
@@ -2651,30 +2651,6 @@
         ]
       }
     },
-    "/apis/api.console.halo.run/v1alpha1/plugin-presets": {
-      "get": {
-        "description": "List all plugin presets in the system.",
-        "operationId": "ListPluginPresets",
-        "responses": {
-          "default": {
-            "content": {
-              "*/*": {
-                "schema": {
-                  "type": "array",
-                  "items": {
-                    "$ref": "#/components/schemas/Plugin"
-                  }
-                }
-              }
-            },
-            "description": "default response"
-          }
-        },
-        "tags": [
-          "PluginV1alpha1Console"
-        ]
-      }
-    },
     "/apis/api.console.halo.run/v1alpha1/plugins": {
       "get": {
         "description": "List plugins using query criteria and sort params",
@@ -4309,38 +4285,6 @@
         ]
       }
     },
-    "/apis/api.console.halo.run/v1alpha1/system/initialize": {
-      "post": {
-        "description": "Initialize system",
-        "operationId": "initialize",
-        "requestBody": {
-          "content": {
-            "*/*": {
-              "schema": {
-                "$ref": "#/components/schemas/SystemInitializationRequest"
-              }
-            }
-          }
-        },
-        "responses": {
-          "201": {
-            "description": "System initialization successfully.",
-            "headers": {
-              "Location": {
-                "description": "Redirect URL.",
-                "schema": {
-                  "type": "string"
-                },
-                "style": "simple"
-              }
-            }
-          }
-        },
-        "tags": [
-          "SystemV1alpha1Console"
-        ]
-      }
-    },
     "/apis/api.console.halo.run/v1alpha1/tags": {
       "get": {
         "description": "List Post Tags.",
@@ -14722,6 +14666,41 @@
         ]
       }
     },
+    "/apis/uc.api.auth.halo.run/v1alpha1/user-connections/{registerId}/disconnect": {
+      "put": {
+        "description": "Disconnect my connection from a third-party platform.",
+        "operationId": "DisconnectMyConnection",
+        "parameters": [
+          {
+            "description": "The registration ID of the third-party platform.",
+            "in": "path",
+            "name": "registerId",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "default": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/components/schemas/UserConnection"
+                  }
+                }
+              }
+            },
+            "description": "default response"
+          }
+        },
+        "tags": [
+          "UserConnectionV1alpha1Uc"
+        ]
+      }
+    },
     "/apis/uc.api.content.halo.run/v1alpha1/posts": {
       "get": {
         "description": "List posts owned by the current user.",
@@ -20712,19 +20691,16 @@
           },
           "visible": {
             "type": "string",
-            "default": "PUBLIC",
             "enum": [
               "PUBLIC",
               "INTERNAL",
               "PRIVATE"
-            ]
+            ],
+            "default": "PUBLIC"
           }
         }
       },
       "PostStatus": {
-        "required": [
-          "phase"
-        ],
         "type": "object",
         "properties": {
           "commentsCount": {
@@ -22560,19 +22536,16 @@
           },
           "visible": {
             "type": "string",
-            "default": "PUBLIC",
             "enum": [
               "PUBLIC",
               "INTERNAL",
               "PRIVATE"
-            ]
+            ],
+            "default": "PUBLIC"
           }
         }
       },
       "SinglePageStatus": {
-        "required": [
-          "phase"
-        ],
         "type": "object",
         "properties": {
           "commentsCount": {
@@ -22972,29 +22945,6 @@
         },
         "description": "The subscriber to be notified"
       },
-      "SystemInitializationRequest": {
-        "required": [
-          "password",
-          "username"
-        ],
-        "type": "object",
-        "properties": {
-          "email": {
-            "type": "string"
-          },
-          "password": {
-            "minLength": 3,
-            "type": "string"
-          },
-          "siteTitle": {
-            "type": "string"
-          },
-          "username": {
-            "minLength": 1,
-            "type": "string"
-          }
-        }
-      },
       "Tag": {
         "required": [
           "apiVersion",
diff --git a/api-docs/openapi/v3_0/apis_console.api_v1alpha1.json b/api-docs/openapi/v3_0/apis_console.api_v1alpha1.json
index 8f2e91c2cb..df4144e8b8 100644
--- a/api-docs/openapi/v3_0/apis_console.api_v1alpha1.json
+++ b/api-docs/openapi/v3_0/apis_console.api_v1alpha1.json
@@ -518,30 +518,6 @@
         ]
       }
     },
-    "/apis/api.console.halo.run/v1alpha1/plugin-presets": {
-      "get": {
-        "description": "List all plugin presets in the system.",
-        "operationId": "ListPluginPresets",
-        "responses": {
-          "default": {
-            "content": {
-              "*/*": {
-                "schema": {
-                  "type": "array",
-                  "items": {
-                    "$ref": "#/components/schemas/Plugin"
-                  }
-                }
-              }
-            },
-            "description": "default response"
-          }
-        },
-        "tags": [
-          "PluginV1alpha1Console"
-        ]
-      }
-    },
     "/apis/api.console.halo.run/v1alpha1/plugins": {
       "get": {
         "description": "List plugins using query criteria and sort params",
@@ -2176,38 +2152,6 @@
         ]
       }
     },
-    "/apis/api.console.halo.run/v1alpha1/system/initialize": {
-      "post": {
-        "description": "Initialize system",
-        "operationId": "initialize",
-        "requestBody": {
-          "content": {
-            "*/*": {
-              "schema": {
-                "$ref": "#/components/schemas/SystemInitializationRequest"
-              }
-            }
-          }
-        },
-        "responses": {
-          "201": {
-            "description": "System initialization successfully.",
-            "headers": {
-              "Location": {
-                "description": "Redirect URL.",
-                "schema": {
-                  "type": "string"
-                },
-                "style": "simple"
-              }
-            }
-          }
-        },
-        "tags": [
-          "SystemV1alpha1Console"
-        ]
-      }
-    },
     "/apis/api.console.halo.run/v1alpha1/tags": {
       "get": {
         "description": "List Post Tags.",
@@ -5476,19 +5420,16 @@
           },
           "visible": {
             "type": "string",
-            "default": "PUBLIC",
             "enum": [
               "PUBLIC",
               "INTERNAL",
               "PRIVATE"
-            ]
+            ],
+            "default": "PUBLIC"
           }
         }
       },
       "PostStatus": {
-        "required": [
-          "phase"
-        ],
         "type": "object",
         "properties": {
           "commentsCount": {
@@ -6008,19 +5949,16 @@
           },
           "visible": {
             "type": "string",
-            "default": "PUBLIC",
             "enum": [
               "PUBLIC",
               "INTERNAL",
               "PRIVATE"
-            ]
+            ],
+            "default": "PUBLIC"
           }
         }
       },
       "SinglePageStatus": {
-        "required": [
-          "phase"
-        ],
         "type": "object",
         "properties": {
           "commentsCount": {
@@ -6090,29 +6028,6 @@
           }
         }
       },
-      "SystemInitializationRequest": {
-        "required": [
-          "password",
-          "username"
-        ],
-        "type": "object",
-        "properties": {
-          "email": {
-            "type": "string"
-          },
-          "password": {
-            "minLength": 3,
-            "type": "string"
-          },
-          "siteTitle": {
-            "type": "string"
-          },
-          "username": {
-            "minLength": 1,
-            "type": "string"
-          }
-        }
-      },
       "Tag": {
         "required": [
           "apiVersion",
diff --git a/api-docs/openapi/v3_0/apis_extension.api_v1alpha1.json b/api-docs/openapi/v3_0/apis_extension.api_v1alpha1.json
index c3607a4242..2d9cecbfd2 100644
--- a/api-docs/openapi/v3_0/apis_extension.api_v1alpha1.json
+++ b/api-docs/openapi/v3_0/apis_extension.api_v1alpha1.json
@@ -11300,19 +11300,16 @@
           },
           "visible": {
             "type": "string",
-            "default": "PUBLIC",
             "enum": [
               "PUBLIC",
               "INTERNAL",
               "PRIVATE"
-            ]
+            ],
+            "default": "PUBLIC"
           }
         }
       },
       "PostStatus": {
-        "required": [
-          "phase"
-        ],
         "type": "object",
         "properties": {
           "commentsCount": {
@@ -12487,19 +12484,16 @@
           },
           "visible": {
             "type": "string",
-            "default": "PUBLIC",
             "enum": [
               "PUBLIC",
               "INTERNAL",
               "PRIVATE"
-            ]
+            ],
+            "default": "PUBLIC"
           }
         }
       },
       "SinglePageStatus": {
-        "required": [
-          "phase"
-        ],
         "type": "object",
         "properties": {
           "commentsCount": {
diff --git a/api-docs/openapi/v3_0/apis_uc.api_v1alpha1.json b/api-docs/openapi/v3_0/apis_uc.api_v1alpha1.json
index 88e7c7c5fa..84820d4197 100644
--- a/api-docs/openapi/v3_0/apis_uc.api_v1alpha1.json
+++ b/api-docs/openapi/v3_0/apis_uc.api_v1alpha1.json
@@ -17,6 +17,41 @@
     }
   ],
   "paths": {
+    "/apis/uc.api.auth.halo.run/v1alpha1/user-connections/{registerId}/disconnect": {
+      "put": {
+        "description": "Disconnect my connection from a third-party platform.",
+        "operationId": "DisconnectMyConnection",
+        "parameters": [
+          {
+            "description": "The registration ID of the third-party platform.",
+            "in": "path",
+            "name": "registerId",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "default": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/components/schemas/UserConnection"
+                  }
+                }
+              }
+            },
+            "description": "default response"
+          }
+        },
+        "tags": [
+          "UserConnectionV1alpha1Uc"
+        ]
+      }
+    },
     "/apis/uc.api.content.halo.run/v1alpha1/posts": {
       "get": {
         "description": "List posts owned by the current user.",
@@ -1853,19 +1888,16 @@
           },
           "visible": {
             "type": "string",
-            "default": "PUBLIC",
             "enum": [
               "PUBLIC",
               "INTERNAL",
               "PRIVATE"
-            ]
+            ],
+            "default": "PUBLIC"
           }
         }
       },
       "PostStatus": {
-        "required": [
-          "phase"
-        ],
         "type": "object",
         "properties": {
           "commentsCount": {
@@ -2262,6 +2294,52 @@
           }
         }
       },
+      "UserConnection": {
+        "required": [
+          "apiVersion",
+          "kind",
+          "metadata",
+          "spec"
+        ],
+        "type": "object",
+        "properties": {
+          "apiVersion": {
+            "type": "string"
+          },
+          "kind": {
+            "type": "string"
+          },
+          "metadata": {
+            "$ref": "#/components/schemas/Metadata"
+          },
+          "spec": {
+            "$ref": "#/components/schemas/UserConnectionSpec"
+          }
+        }
+      },
+      "UserConnectionSpec": {
+        "required": [
+          "providerUserId",
+          "registrationId",
+          "username"
+        ],
+        "type": "object",
+        "properties": {
+          "providerUserId": {
+            "type": "string"
+          },
+          "registrationId": {
+            "type": "string"
+          },
+          "updatedAt": {
+            "type": "string",
+            "format": "date-time"
+          },
+          "username": {
+            "type": "string"
+          }
+        }
+      },
       "UserDevice": {
         "required": [
           "active",
diff --git a/e2e/testsuite.yaml b/e2e/testsuite.yaml
index 32f2dc0c10..05c17f9c34 100644
--- a/e2e/testsuite.yaml
+++ b/e2e/testsuite.yaml
@@ -8,22 +8,18 @@ param:
   notificationName: "{{randAlpha 6}}"
   auth: "Basic YWRtaW46MTIzNDU2"
 items:
-- name: init
+- name: setup
   request:
-    api: /api.console.halo.run/v1alpha1/system/initialize
+    api: |
+      {{default "http://halo:8090" (env "SERVER")}}/system/setup
     method: POST
     header:
-      Content-Type: application/json
+      Content-Type: application/x-www-form-urlencoded
+      Accept: application/json
     body: |
-      {
-        "siteTitle": "testing",
-        "username": "admin",
-        "password": "123456",
-        "email": "testing@halo.com",
-        "password_confirm": "123456"
-      }
+      siteTitle=testing&username={{.param.userName}}&password=123456&email=testing@halo.run
   expect:
-    statusCode: 201
+    statusCode: 204
 - name: createPost
   request:
     api: /api.console.halo.run/v1alpha1/posts
diff --git a/ui/console-src/router/guards/check-states.ts b/ui/console-src/router/guards/check-states.ts
deleted file mode 100644
index 4bfad5b019..0000000000
--- a/ui/console-src/router/guards/check-states.ts
+++ /dev/null
@@ -1,37 +0,0 @@
-import { useGlobalInfoStore } from "@/stores/global-info";
-import { useUserStore } from "@/stores/user";
-import type { Router } from "vue-router";
-
-export function setupCheckStatesGuard(router: Router) {
-  router.beforeEach(async (to, _, next) => {
-    const userStore = useUserStore();
-    const { globalInfo } = useGlobalInfoStore();
-    const { userInitialized, dataInitialized } = globalInfo || {};
-
-    if (to.name === "Setup" && userInitialized) {
-      next({ name: "Dashboard" });
-      return;
-    }
-
-    if (to.name === "SetupInitialData" && dataInitialized) {
-      next({ name: "Dashboard" });
-      return;
-    }
-
-    if (userInitialized === false && to.name !== "Setup") {
-      next({ name: "Setup" });
-      return;
-    }
-
-    if (
-      dataInitialized === false &&
-      !userStore.isAnonymous &&
-      to.name !== "SetupInitialData"
-    ) {
-      next({ name: "SetupInitialData" });
-      return;
-    }
-
-    next();
-  });
-}
diff --git a/ui/console-src/router/index.ts b/ui/console-src/router/index.ts
index d8afd9b5c9..b441c31f1f 100644
--- a/ui/console-src/router/index.ts
+++ b/ui/console-src/router/index.ts
@@ -6,7 +6,6 @@ import {
   type RouteLocationNormalizedLoaded,
 } from "vue-router";
 import { setupAuthCheckGuard } from "./guards/auth-check";
-import { setupCheckStatesGuard } from "./guards/check-states";
 import { setupPermissionGuard } from "./guards/permission";
 
 const router = createRouter({
@@ -22,7 +21,6 @@ const router = createRouter({
   },
 });
 
-setupCheckStatesGuard(router);
 setupAuthCheckGuard(router);
 setupPermissionGuard(router);
 
diff --git a/ui/console-src/router/routes.config.ts b/ui/console-src/router/routes.config.ts
index d5fadd287b..e2fd53bf69 100644
--- a/ui/console-src/router/routes.config.ts
+++ b/ui/console-src/router/routes.config.ts
@@ -1,8 +1,6 @@
 import Forbidden from "@/views/exceptions/Forbidden.vue";
 import NotFound from "@/views/exceptions/NotFound.vue";
 import BasicLayout from "@console/layouts/BasicLayout.vue";
-import Setup from "@console/views/system/Setup.vue";
-import SetupInitialData from "@console/views/system/SetupInitialData.vue";
 import type { RouteRecordRaw } from "vue-router";
 
 export const routes: Array<RouteRecordRaw> = [
@@ -22,22 +20,6 @@ export const routes: Array<RouteRecordRaw> = [
       },
     ],
   },
-  {
-    path: "/setup",
-    component: Setup,
-    name: "Setup",
-    meta: {
-      title: "core.setup.title",
-    },
-  },
-  {
-    path: "/setup-initial-data",
-    name: "SetupInitialData",
-    component: SetupInitialData,
-    meta: {
-      title: "core.setup.title",
-    },
-  },
 ];
 
 export default routes;
diff --git a/ui/console-src/views/system/Setup.vue b/ui/console-src/views/system/Setup.vue
deleted file mode 100644
index d1da4df5ae..0000000000
--- a/ui/console-src/views/system/Setup.vue
+++ /dev/null
@@ -1,135 +0,0 @@
-<script lang="ts" setup>
-import LocaleChange from "@/components/common/LocaleChange.vue";
-import { useGlobalInfoStore } from "@/stores/global-info";
-import type { SystemInitializationRequest } from "@halo-dev/api-client";
-import { consoleApiClient } from "@halo-dev/api-client";
-import { Toast, VButton } from "@halo-dev/components";
-import { ref } from "vue";
-import { useI18n } from "vue-i18n";
-import { useRouter } from "vue-router";
-import IconLogo from "~icons/core/logo?width=5rem&height=2rem";
-
-const router = useRouter();
-const { t } = useI18n();
-
-const loading = ref(false);
-
-const formState = ref<SystemInitializationRequest>({
-  siteTitle: "",
-  username: "",
-  password: "",
-  email: "",
-});
-
-const handleSubmit = async () => {
-  loading.value = true;
-
-  await consoleApiClient.system.initialize({
-    systemInitializationRequest: formState.value,
-  });
-
-  const globalInfoStore = useGlobalInfoStore();
-  await globalInfoStore.fetchGlobalInfo();
-
-  loading.value = false;
-
-  router.push({ name: "Login" });
-
-  Toast.success(t("core.setup.operations.submit.toast_success"));
-};
-
-const inputClasses = {
-  outer: "!py-3 first:!pt-0 last:!pb-0",
-};
-</script>
-
-<template>
-  <div
-    class="flex h-screen flex-col items-center overflow-auto bg-white/90 pt-[20vh]"
-  >
-    <IconLogo class="mb-8 flex-none" />
-
-    <div class="flex w-72 flex-col">
-      <!-- @vue-ignore -->
-      <FormKit
-        id="setup-form"
-        v-model="formState"
-        name="setup-form"
-        :actions="false"
-        :classes="{
-          form: '!divide-none',
-        }"
-        :config="{ validationVisibility: 'submit' }"
-        type="form"
-        @submit="handleSubmit"
-        @keyup.enter="$formkit.submit('setup-form')"
-      >
-        <FormKit
-          name="siteTitle"
-          :classes="inputClasses"
-          :autofocus="true"
-          type="text"
-          :validation-label="$t('core.setup.fields.site_title.label')"
-          :placeholder="$t('core.setup.fields.site_title.label')"
-          validation="required:trim|length:0,100"
-        ></FormKit>
-        <FormKit
-          name="email"
-          :classes="inputClasses"
-          type="text"
-          :validation-label="$t('core.setup.fields.email.label')"
-          :placeholder="$t('core.setup.fields.email.label')"
-          validation="required|email|length:0,100"
-        ></FormKit>
-        <FormKit
-          name="username"
-          :classes="inputClasses"
-          type="text"
-          :validation-label="$t('core.setup.fields.username.label')"
-          :placeholder="$t('core.setup.fields.username.label')"
-          :validation="[
-            ['required'],
-            ['length:0,63'],
-            [
-              'matches',
-              /^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$/,
-            ],
-          ]"
-        ></FormKit>
-        <FormKit
-          name="password"
-          :classes="inputClasses"
-          type="password"
-          :validation-label="$t('core.setup.fields.password.label')"
-          :placeholder="$t('core.setup.fields.password.label')"
-          validation="required:trim|length:5,100|matches:/^\S.*\S$/"
-          autocomplete="current-password"
-        ></FormKit>
-        <FormKit
-          name="password_confirm"
-          :classes="inputClasses"
-          type="password"
-          :validation-label="$t('core.setup.fields.confirm_password.label')"
-          :placeholder="$t('core.setup.fields.confirm_password.label')"
-          validation="confirm|required:trim|length:5,100|matches:/^\S.*\S$/"
-          autocomplete="current-password"
-        ></FormKit>
-      </FormKit>
-      <VButton
-        block
-        class="mt-8"
-        type="secondary"
-        :loading="loading"
-        @click="$formkit.submit('setup-form')"
-      >
-        {{ $t("core.setup.operations.submit.button") }}
-      </VButton>
-    </div>
-
-    <div
-      class="bottom-0 mb-10 mt-auto flex items-center justify-center gap-2.5"
-    >
-      <LocaleChange />
-    </div>
-  </div>
-</template>
diff --git a/ui/console-src/views/system/SetupInitialData.vue b/ui/console-src/views/system/SetupInitialData.vue
deleted file mode 100644
index 7af6125e2e..0000000000
--- a/ui/console-src/views/system/SetupInitialData.vue
+++ /dev/null
@@ -1,202 +0,0 @@
-<script lang="ts" setup>
-import H2WarningAlert from "@/components/alerts/H2WarningAlert.vue";
-import { useGlobalInfoStore } from "@/stores/global-info";
-import { useUserStore } from "@/stores/user";
-import type { Info } from "@/types";
-import {
-  consoleApiClient,
-  coreApiClient,
-  type Category,
-  type Plugin,
-  type PostRequest,
-  type SinglePageRequest,
-  type Tag,
-} from "@halo-dev/api-client";
-import { VButton, VLoading } from "@halo-dev/components";
-import { useMutation, useQuery } from "@tanstack/vue-query";
-import axios from "axios";
-import { onMounted, ref, watch } from "vue";
-import { useRouter } from "vue-router";
-import category from "./setup-data/category.json";
-import menuItems from "./setup-data/menu-items.json";
-import menu from "./setup-data/menu.json";
-import post from "./setup-data/post.json";
-import singlePage from "./setup-data/singlePage.json";
-import tag from "./setup-data/tag.json";
-
-const router = useRouter();
-const globalInfoStore = useGlobalInfoStore();
-
-const { mutateAsync: pluginInstallMutate } = useMutation({
-  mutationKey: ["plugin-install"],
-  mutationFn: async (plugin: Plugin) => {
-    const { data } = await consoleApiClient.plugin.plugin.installPlugin(
-      {
-        source: "PRESET",
-        presetName: plugin.metadata.name as string,
-      },
-      {
-        mute: true,
-      }
-    );
-    return data;
-  },
-  retry: 3,
-  retryDelay: 1000,
-  async onSuccess(data) {
-    await pluginStartMutate(data);
-  },
-});
-
-const { mutateAsync: pluginStartMutate } = useMutation({
-  mutationKey: ["plugin-start"],
-  mutationFn: async (plugin: Plugin) => {
-    return await consoleApiClient.plugin.plugin.changePluginRunningState(
-      {
-        name: plugin.metadata.name,
-        pluginRunningStateRequest: {
-          enable: true,
-        },
-      },
-      { mute: true }
-    );
-  },
-  retry: 3,
-  retryDelay: 1000,
-});
-
-const processing = ref(false);
-
-async function setupInitialData() {
-  try {
-    processing.value = true;
-
-    // Create category / tag / post
-    await coreApiClient.content.category.createCategory({
-      category: category as Category,
-    });
-    await coreApiClient.content.tag.createTag({
-      tag: tag as Tag,
-    });
-    const { data: postData } = await consoleApiClient.content.post.draftPost({
-      postRequest: post as PostRequest,
-    });
-    await consoleApiClient.content.post.publishPost({
-      name: postData.metadata.name,
-    });
-
-    // Create singlePage
-    const { data: singlePageData } =
-      await consoleApiClient.content.singlePage.draftSinglePage({
-        singlePageRequest: singlePage as SinglePageRequest,
-      });
-
-    await consoleApiClient.content.singlePage.publishSinglePage({
-      name: singlePageData.metadata.name,
-    });
-
-    // Create menu and menu items
-    const menuItemPromises = menuItems.map((item) => {
-      return coreApiClient.menuItem.createMenuItem({
-        menuItem: item,
-      });
-    });
-    await Promise.all(menuItemPromises);
-    await coreApiClient.menu.createMenu({ menu: menu });
-
-    // Install preset plugins
-    const { data: presetPlugins } =
-      await consoleApiClient.plugin.plugin.listPluginPresets();
-
-    for (let i = 0; i < presetPlugins.length; i++) {
-      const presetPlugin = presetPlugins[i];
-      try {
-        await pluginInstallMutate(presetPlugin);
-      } catch (error) {
-        console.error("Failed to install plugin: ", presetPlugin.metadata.name);
-      }
-    }
-  } catch (error) {
-    console.error(error);
-  } finally {
-    await coreApiClient.configMap.createConfigMap({
-      configMap: {
-        metadata: {
-          name: "system-states",
-        },
-        kind: "ConfigMap",
-        apiVersion: "v1alpha1",
-        data: {
-          states: JSON.stringify({ isSetup: true }),
-        },
-      },
-    });
-
-    // Reload page to fetch plugin's bundle files
-    window.location.reload();
-  }
-}
-
-const userStore = useUserStore();
-
-const { data: info } = useQuery<Info>({
-  queryKey: ["system-info"],
-  queryFn: async () => {
-    const { data } = await axios.get<Info>(`/actuator/info`, {
-      withCredentials: true,
-    });
-    return data;
-  },
-  retry: 0,
-});
-
-watch(
-  () => info.value,
-  (value) => {
-    if (!value) {
-      return;
-    }
-    if (!value.database.name.startsWith("H2")) {
-      setupInitialData();
-    }
-  },
-  {
-    immediate: true,
-  }
-);
-
-onMounted(async () => {
-  await globalInfoStore.fetchGlobalInfo();
-
-  if (userStore.isAnonymous) {
-    window.location.href = "/";
-    return;
-  }
-
-  if (globalInfoStore.globalInfo?.dataInitialized) {
-    router.push({ name: "Dashboard" });
-    return;
-  }
-});
-</script>
-
-<template>
-  <div class="flex h-screen flex-col items-center justify-center">
-    <template v-if="info?.database.name.startsWith('H2') && !processing">
-      <H2WarningAlert class="max-w-md">
-        <template #actions>
-          <VButton type="secondary" size="sm" @click="setupInitialData()">
-            {{ $t("core.common.buttons.continue") }}
-          </VButton>
-        </template>
-      </H2WarningAlert>
-    </template>
-
-    <template v-if="processing">
-      <VLoading />
-      <div class="text-xs text-gray-600">
-        {{ $t("core.setup.operations.setup_initial_data.loading") }}
-      </div>
-    </template>
-  </div>
-</template>
diff --git a/ui/console-src/views/system/setup-data/category.json b/ui/console-src/views/system/setup-data/category.json
deleted file mode 100644
index d65a2fab61..0000000000
--- a/ui/console-src/views/system/setup-data/category.json
+++ /dev/null
@@ -1,16 +0,0 @@
-{
-  "spec": {
-    "displayName": "默认分类",
-    "slug": "default",
-    "description": "这是你的默认分类，如不需要，删除即可。",
-    "cover": "",
-    "template": "",
-    "priority": 0,
-    "children": []
-  },
-  "apiVersion": "content.halo.run/v1alpha1",
-  "kind": "Category",
-  "metadata": {
-    "name": "76514a40-6ef1-4ed9-b58a-e26945bde3ca"
-  }
-}
diff --git a/ui/console-src/views/system/setup-data/menu-items.json b/ui/console-src/views/system/setup-data/menu-items.json
deleted file mode 100644
index 603f19dbd9..0000000000
--- a/ui/console-src/views/system/setup-data/menu-items.json
+++ /dev/null
@@ -1,62 +0,0 @@
-[
-  {
-    "spec": {
-      "displayName": "首页",
-      "href": "/",
-      "children": [],
-      "priority": 0
-    },
-    "apiVersion": "v1alpha1",
-    "kind": "MenuItem",
-    "metadata": { "name": "88c3f10b-321c-4092-86a8-70db00251b74" }
-  },
-  {
-    "spec": {
-      "children": [],
-      "priority": 1,
-      "targetRef": {
-        "group": "content.halo.run",
-        "version": "v1alpha1",
-        "kind": "Post",
-        "name": "5152aea5-c2e8-4717-8bba-2263d46e19d5"
-      }
-    },
-    "apiVersion": "v1alpha1",
-    "kind": "MenuItem",
-    "metadata": { "name": "c4c814d1-0c2c-456b-8c96-4864965fee94" }
-  },
-  {
-    "spec": {
-      "displayName": "",
-      "href": "",
-      "children": [],
-      "priority": 2,
-      "targetRef": {
-        "group": "content.halo.run",
-        "version": "v1alpha1",
-        "kind": "Tag",
-        "name": "c33ceabb-d8f1-4711-8991-bb8f5c92ad7c"
-      }
-    },
-    "apiVersion": "v1alpha1",
-    "kind": "MenuItem",
-    "metadata": { "name": "35869bd3-33b5-448b-91ee-cf6517a59644" }
-  },
-  {
-    "spec": {
-      "displayName": "",
-      "href": "",
-      "children": [],
-      "priority": 3,
-      "targetRef": {
-        "group": "content.halo.run",
-        "version": "v1alpha1",
-        "kind": "SinglePage",
-        "name": "373a5f79-f44f-441a-9df1-85a4f553ece8"
-      }
-    },
-    "apiVersion": "v1alpha1",
-    "kind": "MenuItem",
-    "metadata": { "name": "b0d041fa-dc99-48f6-a193-8604003379cf" }
-  }
-]
diff --git a/ui/console-src/views/system/setup-data/menu.json b/ui/console-src/views/system/setup-data/menu.json
deleted file mode 100644
index c1526b53a3..0000000000
--- a/ui/console-src/views/system/setup-data/menu.json
+++ /dev/null
@@ -1,14 +0,0 @@
-{
-  "spec": {
-    "displayName": "主菜单",
-    "menuItems": [
-      "88c3f10b-321c-4092-86a8-70db00251b74",
-      "c4c814d1-0c2c-456b-8c96-4864965fee94",
-      "35869bd3-33b5-448b-91ee-cf6517a59644",
-      "b0d041fa-dc99-48f6-a193-8604003379cf"
-    ]
-  },
-  "apiVersion": "v1alpha1",
-  "kind": "Menu",
-  "metadata": { "name": "primary" }
-}
diff --git a/ui/console-src/views/system/setup-data/post.json b/ui/console-src/views/system/setup-data/post.json
deleted file mode 100644
index d3f275546a..0000000000
--- a/ui/console-src/views/system/setup-data/post.json
+++ /dev/null
@@ -1,35 +0,0 @@
-{
-  "post": {
-    "spec": {
-      "title": "Hello Halo",
-      "slug": "hello-halo",
-      "template": "",
-      "cover": "",
-      "deleted": false,
-      "publish": false,
-      "publishTime": "",
-      "pinned": false,
-      "allowComment": true,
-      "visible": "PUBLIC",
-      "version": 1,
-      "priority": 0,
-      "excerpt": {
-        "autoGenerate": false,
-        "raw": "如果你看到了这一篇文章，那么证明你已经安装成功了，感谢使用 Halo 进行创作，希望能够使用愉快。"
-      },
-      "categories": ["76514a40-6ef1-4ed9-b58a-e26945bde3ca"],
-      "tags": ["c33ceabb-d8f1-4711-8991-bb8f5c92ad7c"],
-      "htmlMetas": []
-    },
-    "apiVersion": "content.halo.run/v1alpha1",
-    "kind": "Post",
-    "metadata": {
-      "name": "5152aea5-c2e8-4717-8bba-2263d46e19d5"
-    }
-  },
-  "content": {
-    "raw": "<h2 id=\"hello-halo\"><strong>Hello Halo</strong></h2><p>如果你看到了这一篇文章，那么证明你已经安装成功了，感谢使用 <a target=\"_blank\" rel=\"noopener noreferrer nofollow\" href=\"https://www.halo.run/\">Halo</a> 进行创作，希望能够使用愉快。</p><h2 id=\"%E7%9B%B8%E5%85%B3%E9%93%BE%E6%8E%A5\"><strong>相关链接</strong></h2><ul><li><p>官网：<a target=\"_blank\" rel=\"noopener noreferrer nofollow\" href=\"https://www.halo.run\">https://www.halo.run</a></p></li><li><p>文档：<a target=\"_blank\" rel=\"noopener noreferrer nofollow\" href=\"https://docs.halo.run\">https://docs.halo.run</a></p></li><li><p>社区：<a target=\"_blank\" rel=\"noopener noreferrer nofollow\" href=\"https://bbs.halo.run\">https://bbs.halo.run</a></p></li><li><p>应用市场：<a target=\"_blank\" rel=\"noopener noreferrer nofollow\" href=\"https://www.halo.run/store/apps\">https://www.halo.run/store/apps</a></p></li><li><p>开源地址：<a target=\"_blank\" rel=\"noopener noreferrer nofollow\" href=\"https://github.com/halo-dev/halo\">https://github.com/halo-dev/halo</a></p></li></ul><p>在使用过程中，有任何问题都可以通过以上链接找寻答案，或者联系我们。</p><blockquote><p>这是一篇自动生成的文章，请删除这篇文章之后开始你的创作吧！</p></blockquote>",
-    "content": "<h2 id=\"hello-halo\"><strong>Hello Halo</strong></h2><p>如果你看到了这一篇文章，那么证明你已经安装成功了，感谢使用 <a target=\"_blank\" rel=\"noopener noreferrer nofollow\" href=\"https://www.halo.run/\">Halo</a> 进行创作，希望能够使用愉快。</p><h2 id=\"%E7%9B%B8%E5%85%B3%E9%93%BE%E6%8E%A5\"><strong>相关链接</strong></h2><ul><li><p>官网：<a target=\"_blank\" rel=\"noopener noreferrer nofollow\" href=\"https://www.halo.run\">https://www.halo.run</a></p></li><li><p>文档：<a target=\"_blank\" rel=\"noopener noreferrer nofollow\" href=\"https://docs.halo.run\">https://docs.halo.run</a></p></li><li><p>社区：<a target=\"_blank\" rel=\"noopener noreferrer nofollow\" href=\"https://bbs.halo.run\">https://bbs.halo.run</a></p></li><li><p>应用市场：<a target=\"_blank\" rel=\"noopener noreferrer nofollow\" href=\"https://www.halo.run/store/apps\">https://www.halo.run/store/apps</a></p></li><li><p>开源地址：<a target=\"_blank\" rel=\"noopener noreferrer nofollow\" href=\"https://github.com/halo-dev/halo\">https://github.com/halo-dev/halo</a></p></li></ul><p>在使用过程中，有任何问题都可以通过以上链接找寻答案，或者联系我们。</p><blockquote><p>这是一篇自动生成的文章，请删除这篇文章之后开始你的创作吧！</p></blockquote>",
-    "rawType": "HTML"
-  }
-}
diff --git a/ui/console-src/views/system/setup-data/singlePage.json b/ui/console-src/views/system/setup-data/singlePage.json
deleted file mode 100644
index 3c605d8eb5..0000000000
--- a/ui/console-src/views/system/setup-data/singlePage.json
+++ /dev/null
@@ -1,31 +0,0 @@
-{
-  "page": {
-    "spec": {
-      "title": "关于",
-      "slug": "about",
-      "template": "",
-      "cover": "",
-      "deleted": false,
-      "publish": false,
-      "publishTime": "",
-      "pinned": false,
-      "allowComment": true,
-      "visible": "PUBLIC",
-      "version": 1,
-      "priority": 0,
-      "excerpt": {
-        "autoGenerate": false,
-        "raw": "这是一个自定义页面，你可以在后台的 页面 -> 自定义页面 找到它，你可以用于新建关于页面、联系我们页面等等。"
-      },
-      "htmlMetas": []
-    },
-    "apiVersion": "content.halo.run/v1alpha1",
-    "kind": "SinglePage",
-    "metadata": { "name": "373a5f79-f44f-441a-9df1-85a4f553ece8" }
-  },
-  "content": {
-    "raw": "<h2><strong>关于页面</strong></h2><p>这是一个自定义页面，你可以在后台的 <code>页面</code> -&gt; <code>自定义页面</code> 找到它，你可以用于新建关于页面、联系我们页面等等。</p><blockquote><p>这是一篇自动生成的页面，你可以在后台删除它。</p></blockquote>",
-    "content": "<h2><strong>关于页面</strong></h2><p>这是一个自定义页面，你可以在后台的 <code>页面</code> -&gt; <code>自定义页面</code> 找到它，你可以用于新建关于页面、联系我们页面等等。</p><blockquote><p>这是一篇自动生成的页面，你可以在后台删除它。</p></blockquote>",
-    "rawType": "HTML"
-  }
-}
diff --git a/ui/console-src/views/system/setup-data/tag.json b/ui/console-src/views/system/setup-data/tag.json
deleted file mode 100644
index c82a115616..0000000000
--- a/ui/console-src/views/system/setup-data/tag.json
+++ /dev/null
@@ -1,13 +0,0 @@
-{
-  "spec": {
-    "displayName": "Halo",
-    "slug": "halo",
-    "color": "#ffffff",
-    "cover": ""
-  },
-  "apiVersion": "content.halo.run/v1alpha1",
-  "kind": "Tag",
-  "metadata": {
-    "name": "c33ceabb-d8f1-4711-8991-bb8f5c92ad7c"
-  }
-}
diff --git a/ui/packages/api-client/src/.openapi-generator/FILES b/ui/packages/api-client/src/.openapi-generator/FILES
index 4aa1855785..90d1b4d591 100644
--- a/ui/packages/api-client/src/.openapi-generator/FILES
+++ b/ui/packages/api-client/src/.openapi-generator/FILES
@@ -76,6 +76,7 @@ api/thumbnail-v1alpha1-api.ts
 api/thumbnail-v1alpha1-public-api.ts
 api/two-factor-auth-v1alpha1-uc-api.ts
 api/user-connection-v1alpha1-api.ts
+api/user-connection-v1alpha1-uc-api.ts
 api/user-v1alpha1-api.ts
 api/user-v1alpha1-console-api.ts
 base.ts
@@ -303,7 +304,6 @@ models/subscription-list.ts
 models/subscription-spec.ts
 models/subscription-subscriber.ts
 models/subscription.ts
-models/system-initialization-request.ts
 models/tag-list.ts
 models/tag-spec.ts
 models/tag-status.ts
diff --git a/ui/packages/api-client/src/api.ts b/ui/packages/api-client/src/api.ts
index 37b68fa218..3a4af9afb5 100644
--- a/ui/packages/api-client/src/api.ts
+++ b/ui/packages/api-client/src/api.ts
@@ -88,6 +88,7 @@ export * from './api/thumbnail-v1alpha1-api';
 export * from './api/thumbnail-v1alpha1-public-api';
 export * from './api/two-factor-auth-v1alpha1-uc-api';
 export * from './api/user-connection-v1alpha1-api';
+export * from './api/user-connection-v1alpha1-uc-api';
 export * from './api/user-v1alpha1-api';
 export * from './api/user-v1alpha1-console-api';
 
diff --git a/ui/packages/api-client/src/api/plugin-v1alpha1-console-api.ts b/ui/packages/api-client/src/api/plugin-v1alpha1-console-api.ts
index dcf3317b41..eed35161d6 100644
--- a/ui/packages/api-client/src/api/plugin-v1alpha1-console-api.ts
+++ b/ui/packages/api-client/src/api/plugin-v1alpha1-console-api.ts
@@ -384,43 +384,6 @@ export const PluginV1alpha1ConsoleApiAxiosParamCreator = function (configuration
                 options: localVarRequestOptions,
             };
         },
-        /**
-         * List all plugin presets in the system.
-         * @param {*} [options] Override http request option.
-         * @throws {RequiredError}
-         */
-        listPluginPresets: async (options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
-            const localVarPath = `/apis/api.console.halo.run/v1alpha1/plugin-presets`;
-            // use dummy base URL string because the URL constructor only accepts absolute URLs.
-            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
-            let baseOptions;
-            if (configuration) {
-                baseOptions = configuration.baseOptions;
-            }
-
-            const localVarRequestOptions = { method: 'GET', ...baseOptions, ...options};
-            const localVarHeaderParameter = {} as any;
-            const localVarQueryParameter = {} as any;
-
-            // authentication basicAuth required
-            // http basic authentication required
-            setBasicAuthToObject(localVarRequestOptions, configuration)
-
-            // authentication bearerAuth required
-            // http bearer authentication required
-            await setBearerAuthToObject(localVarHeaderParameter, configuration)
-
-
-    
-            setSearchParams(localVarUrlObj, localVarQueryParameter);
-            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
-            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
-
-            return {
-                url: toPathString(localVarUrlObj),
-                options: localVarRequestOptions,
-            };
-        },
         /**
          * List plugins using query criteria and sort params
          * @param {number} [page] Page number. Default is 0.
@@ -884,17 +847,6 @@ export const PluginV1alpha1ConsoleApiFp = function(configuration?: Configuration
             const localVarOperationServerBasePath = operationServerMap['PluginV1alpha1ConsoleApi.installPluginFromUri']?.[localVarOperationServerIndex]?.url;
             return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
         },
-        /**
-         * List all plugin presets in the system.
-         * @param {*} [options] Override http request option.
-         * @throws {RequiredError}
-         */
-        async listPluginPresets(options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<Array<Plugin>>> {
-            const localVarAxiosArgs = await localVarAxiosParamCreator.listPluginPresets(options);
-            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
-            const localVarOperationServerBasePath = operationServerMap['PluginV1alpha1ConsoleApi.listPluginPresets']?.[localVarOperationServerIndex]?.url;
-            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
-        },
         /**
          * List plugins using query criteria and sort params
          * @param {number} [page] Page number. Default is 0.
@@ -1072,14 +1024,6 @@ export const PluginV1alpha1ConsoleApiFactory = function (configuration?: Configu
         installPluginFromUri(requestParameters: PluginV1alpha1ConsoleApiInstallPluginFromUriRequest, options?: RawAxiosRequestConfig): AxiosPromise<Plugin> {
             return localVarFp.installPluginFromUri(requestParameters.installFromUriRequest, options).then((request) => request(axios, basePath));
         },
-        /**
-         * List all plugin presets in the system.
-         * @param {*} [options] Override http request option.
-         * @throws {RequiredError}
-         */
-        listPluginPresets(options?: RawAxiosRequestConfig): AxiosPromise<Array<Plugin>> {
-            return localVarFp.listPluginPresets(options).then((request) => request(axios, basePath));
-        },
         /**
          * List plugins using query criteria and sort params
          * @param {PluginV1alpha1ConsoleApiListPluginsRequest} requestParameters Request parameters.
@@ -1527,16 +1471,6 @@ export class PluginV1alpha1ConsoleApi extends BaseAPI {
         return PluginV1alpha1ConsoleApiFp(this.configuration).installPluginFromUri(requestParameters.installFromUriRequest, options).then((request) => request(this.axios, this.basePath));
     }
 
-    /**
-     * List all plugin presets in the system.
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     * @memberof PluginV1alpha1ConsoleApi
-     */
-    public listPluginPresets(options?: RawAxiosRequestConfig) {
-        return PluginV1alpha1ConsoleApiFp(this.configuration).listPluginPresets(options).then((request) => request(this.axios, this.basePath));
-    }
-
     /**
      * List plugins using query criteria and sort params
      * @param {PluginV1alpha1ConsoleApiListPluginsRequest} requestParameters Request parameters.
diff --git a/ui/packages/api-client/src/api/system-v1alpha1-console-api.ts b/ui/packages/api-client/src/api/system-v1alpha1-console-api.ts
index 098ce7f1af..b923088d23 100644
--- a/ui/packages/api-client/src/api/system-v1alpha1-console-api.ts
+++ b/ui/packages/api-client/src/api/system-v1alpha1-console-api.ts
@@ -23,8 +23,6 @@ import { DUMMY_BASE_URL, assertParamExists, setApiKeyToObject, setBasicAuthToObj
 import { BASE_PATH, COLLECTION_FORMATS, RequestArgs, BaseAPI, RequiredError, operationServerMap } from '../base';
 // @ts-ignore
 import { DashboardStats } from '../models';
-// @ts-ignore
-import { SystemInitializationRequest } from '../models';
 /**
  * SystemV1alpha1ConsoleApi - axios parameter creator
  * @export
@@ -63,47 +61,6 @@ export const SystemV1alpha1ConsoleApiAxiosParamCreator = function (configuration
             let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
             localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
 
-            return {
-                url: toPathString(localVarUrlObj),
-                options: localVarRequestOptions,
-            };
-        },
-        /**
-         * Initialize system
-         * @param {SystemInitializationRequest} [systemInitializationRequest] 
-         * @param {*} [options] Override http request option.
-         * @throws {RequiredError}
-         */
-        initialize: async (systemInitializationRequest?: SystemInitializationRequest, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
-            const localVarPath = `/apis/api.console.halo.run/v1alpha1/system/initialize`;
-            // use dummy base URL string because the URL constructor only accepts absolute URLs.
-            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
-            let baseOptions;
-            if (configuration) {
-                baseOptions = configuration.baseOptions;
-            }
-
-            const localVarRequestOptions = { method: 'POST', ...baseOptions, ...options};
-            const localVarHeaderParameter = {} as any;
-            const localVarQueryParameter = {} as any;
-
-            // authentication basicAuth required
-            // http basic authentication required
-            setBasicAuthToObject(localVarRequestOptions, configuration)
-
-            // authentication bearerAuth required
-            // http bearer authentication required
-            await setBearerAuthToObject(localVarHeaderParameter, configuration)
-
-
-    
-            localVarHeaderParameter['Content-Type'] = 'application/json';
-
-            setSearchParams(localVarUrlObj, localVarQueryParameter);
-            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
-            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
-            localVarRequestOptions.data = serializeDataIfNeeded(systemInitializationRequest, localVarRequestOptions, configuration)
-
             return {
                 url: toPathString(localVarUrlObj),
                 options: localVarRequestOptions,
@@ -130,18 +87,6 @@ export const SystemV1alpha1ConsoleApiFp = function(configuration?: Configuration
             const localVarOperationServerBasePath = operationServerMap['SystemV1alpha1ConsoleApi.getStats']?.[localVarOperationServerIndex]?.url;
             return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
         },
-        /**
-         * Initialize system
-         * @param {SystemInitializationRequest} [systemInitializationRequest] 
-         * @param {*} [options] Override http request option.
-         * @throws {RequiredError}
-         */
-        async initialize(systemInitializationRequest?: SystemInitializationRequest, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<void>> {
-            const localVarAxiosArgs = await localVarAxiosParamCreator.initialize(systemInitializationRequest, options);
-            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
-            const localVarOperationServerBasePath = operationServerMap['SystemV1alpha1ConsoleApi.initialize']?.[localVarOperationServerIndex]?.url;
-            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
-        },
     }
 };
 
@@ -160,32 +105,9 @@ export const SystemV1alpha1ConsoleApiFactory = function (configuration?: Configu
         getStats(options?: RawAxiosRequestConfig): AxiosPromise<DashboardStats> {
             return localVarFp.getStats(options).then((request) => request(axios, basePath));
         },
-        /**
-         * Initialize system
-         * @param {SystemV1alpha1ConsoleApiInitializeRequest} requestParameters Request parameters.
-         * @param {*} [options] Override http request option.
-         * @throws {RequiredError}
-         */
-        initialize(requestParameters: SystemV1alpha1ConsoleApiInitializeRequest = {}, options?: RawAxiosRequestConfig): AxiosPromise<void> {
-            return localVarFp.initialize(requestParameters.systemInitializationRequest, options).then((request) => request(axios, basePath));
-        },
     };
 };
 
-/**
- * Request parameters for initialize operation in SystemV1alpha1ConsoleApi.
- * @export
- * @interface SystemV1alpha1ConsoleApiInitializeRequest
- */
-export interface SystemV1alpha1ConsoleApiInitializeRequest {
-    /**
-     * 
-     * @type {SystemInitializationRequest}
-     * @memberof SystemV1alpha1ConsoleApiInitialize
-     */
-    readonly systemInitializationRequest?: SystemInitializationRequest
-}
-
 /**
  * SystemV1alpha1ConsoleApi - object-oriented interface
  * @export
@@ -202,16 +124,5 @@ export class SystemV1alpha1ConsoleApi extends BaseAPI {
     public getStats(options?: RawAxiosRequestConfig) {
         return SystemV1alpha1ConsoleApiFp(this.configuration).getStats(options).then((request) => request(this.axios, this.basePath));
     }
-
-    /**
-     * Initialize system
-     * @param {SystemV1alpha1ConsoleApiInitializeRequest} requestParameters Request parameters.
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     * @memberof SystemV1alpha1ConsoleApi
-     */
-    public initialize(requestParameters: SystemV1alpha1ConsoleApiInitializeRequest = {}, options?: RawAxiosRequestConfig) {
-        return SystemV1alpha1ConsoleApiFp(this.configuration).initialize(requestParameters.systemInitializationRequest, options).then((request) => request(this.axios, this.basePath));
-    }
 }
 
diff --git a/ui/packages/api-client/src/api/user-connection-v1alpha1-uc-api.ts b/ui/packages/api-client/src/api/user-connection-v1alpha1-uc-api.ts
new file mode 100644
index 0000000000..635be3a93f
--- /dev/null
+++ b/ui/packages/api-client/src/api/user-connection-v1alpha1-uc-api.ts
@@ -0,0 +1,149 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * Halo
+ * No description provided (generated by Openapi Generator https://github.com/openapitools/openapi-generator)
+ *
+ * The version of the OpenAPI document: 2.20.0-SNAPSHOT
+ * 
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+
+import type { Configuration } from '../configuration';
+import type { AxiosPromise, AxiosInstance, RawAxiosRequestConfig } from 'axios';
+import globalAxios from 'axios';
+// Some imports not used depending on template conditions
+// @ts-ignore
+import { DUMMY_BASE_URL, assertParamExists, setApiKeyToObject, setBasicAuthToObject, setBearerAuthToObject, setOAuthToObject, setSearchParams, serializeDataIfNeeded, toPathString, createRequestFunction } from '../common';
+// @ts-ignore
+import { BASE_PATH, COLLECTION_FORMATS, RequestArgs, BaseAPI, RequiredError, operationServerMap } from '../base';
+// @ts-ignore
+import { UserConnection } from '../models';
+/**
+ * UserConnectionV1alpha1UcApi - axios parameter creator
+ * @export
+ */
+export const UserConnectionV1alpha1UcApiAxiosParamCreator = function (configuration?: Configuration) {
+    return {
+        /**
+         * Disconnect my connection from a third-party platform.
+         * @param {string} registerId The registration ID of the third-party platform.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        disconnectMyConnection: async (registerId: string, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            // verify required parameter 'registerId' is not null or undefined
+            assertParamExists('disconnectMyConnection', 'registerId', registerId)
+            const localVarPath = `/apis/uc.api.auth.halo.run/v1alpha1/user-connections/{registerId}/disconnect`
+                .replace(`{${"registerId"}}`, encodeURIComponent(String(registerId)));
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+
+            const localVarRequestOptions = { method: 'PUT', ...baseOptions, ...options};
+            const localVarHeaderParameter = {} as any;
+            const localVarQueryParameter = {} as any;
+
+            // authentication basicAuth required
+            // http basic authentication required
+            setBasicAuthToObject(localVarRequestOptions, configuration)
+
+            // authentication bearerAuth required
+            // http bearer authentication required
+            await setBearerAuthToObject(localVarHeaderParameter, configuration)
+
+
+    
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
+
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+    }
+};
+
+/**
+ * UserConnectionV1alpha1UcApi - functional programming interface
+ * @export
+ */
+export const UserConnectionV1alpha1UcApiFp = function(configuration?: Configuration) {
+    const localVarAxiosParamCreator = UserConnectionV1alpha1UcApiAxiosParamCreator(configuration)
+    return {
+        /**
+         * Disconnect my connection from a third-party platform.
+         * @param {string} registerId The registration ID of the third-party platform.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async disconnectMyConnection(registerId: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<Array<UserConnection>>> {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.disconnectMyConnection(registerId, options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['UserConnectionV1alpha1UcApi.disconnectMyConnection']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
+    }
+};
+
+/**
+ * UserConnectionV1alpha1UcApi - factory interface
+ * @export
+ */
+export const UserConnectionV1alpha1UcApiFactory = function (configuration?: Configuration, basePath?: string, axios?: AxiosInstance) {
+    const localVarFp = UserConnectionV1alpha1UcApiFp(configuration)
+    return {
+        /**
+         * Disconnect my connection from a third-party platform.
+         * @param {UserConnectionV1alpha1UcApiDisconnectMyConnectionRequest} requestParameters Request parameters.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        disconnectMyConnection(requestParameters: UserConnectionV1alpha1UcApiDisconnectMyConnectionRequest, options?: RawAxiosRequestConfig): AxiosPromise<Array<UserConnection>> {
+            return localVarFp.disconnectMyConnection(requestParameters.registerId, options).then((request) => request(axios, basePath));
+        },
+    };
+};
+
+/**
+ * Request parameters for disconnectMyConnection operation in UserConnectionV1alpha1UcApi.
+ * @export
+ * @interface UserConnectionV1alpha1UcApiDisconnectMyConnectionRequest
+ */
+export interface UserConnectionV1alpha1UcApiDisconnectMyConnectionRequest {
+    /**
+     * The registration ID of the third-party platform.
+     * @type {string}
+     * @memberof UserConnectionV1alpha1UcApiDisconnectMyConnection
+     */
+    readonly registerId: string
+}
+
+/**
+ * UserConnectionV1alpha1UcApi - object-oriented interface
+ * @export
+ * @class UserConnectionV1alpha1UcApi
+ * @extends {BaseAPI}
+ */
+export class UserConnectionV1alpha1UcApi extends BaseAPI {
+    /**
+     * Disconnect my connection from a third-party platform.
+     * @param {UserConnectionV1alpha1UcApiDisconnectMyConnectionRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof UserConnectionV1alpha1UcApi
+     */
+    public disconnectMyConnection(requestParameters: UserConnectionV1alpha1UcApiDisconnectMyConnectionRequest, options?: RawAxiosRequestConfig) {
+        return UserConnectionV1alpha1UcApiFp(this.configuration).disconnectMyConnection(requestParameters.registerId, options).then((request) => request(this.axios, this.basePath));
+    }
+}
+
diff --git a/ui/packages/api-client/src/models/index.ts b/ui/packages/api-client/src/models/index.ts
index b8ae0a1a86..901db6c75e 100644
--- a/ui/packages/api-client/src/models/index.ts
+++ b/ui/packages/api-client/src/models/index.ts
@@ -217,7 +217,6 @@ export * from './subscription';
 export * from './subscription-list';
 export * from './subscription-spec';
 export * from './subscription-subscriber';
-export * from './system-initialization-request';
 export * from './tag';
 export * from './tag-list';
 export * from './tag-spec';
diff --git a/ui/packages/api-client/src/models/post-status.ts b/ui/packages/api-client/src/models/post-status.ts
index 41bec331f0..407f82ff14 100644
--- a/ui/packages/api-client/src/models/post-status.ts
+++ b/ui/packages/api-client/src/models/post-status.ts
@@ -82,6 +82,6 @@ export interface PostStatus {
      * @type {string}
      * @memberof PostStatus
      */
-    'phase': string;
+    'phase'?: string;
 }
 
diff --git a/ui/packages/api-client/src/models/single-page-status.ts b/ui/packages/api-client/src/models/single-page-status.ts
index fff6d27d0e..d74e35b6bb 100644
--- a/ui/packages/api-client/src/models/single-page-status.ts
+++ b/ui/packages/api-client/src/models/single-page-status.ts
@@ -82,6 +82,6 @@ export interface SinglePageStatus {
      * @type {string}
      * @memberof SinglePageStatus
      */
-    'phase': string;
+    'phase'?: string;
 }
 
diff --git a/ui/packages/api-client/src/models/system-initialization-request.ts b/ui/packages/api-client/src/models/system-initialization-request.ts
deleted file mode 100644
index f974ee3a5e..0000000000
--- a/ui/packages/api-client/src/models/system-initialization-request.ts
+++ /dev/null
@@ -1,48 +0,0 @@
-/* tslint:disable */
-/* eslint-disable */
-/**
- * Halo
- * No description provided (generated by Openapi Generator https://github.com/openapitools/openapi-generator)
- *
- * The version of the OpenAPI document: 2.20.0-SNAPSHOT
- * 
- *
- * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
- * https://openapi-generator.tech
- * Do not edit the class manually.
- */
-
-
-
-/**
- * 
- * @export
- * @interface SystemInitializationRequest
- */
-export interface SystemInitializationRequest {
-    /**
-     * 
-     * @type {string}
-     * @memberof SystemInitializationRequest
-     */
-    'email'?: string;
-    /**
-     * 
-     * @type {string}
-     * @memberof SystemInitializationRequest
-     */
-    'password': string;
-    /**
-     * 
-     * @type {string}
-     * @memberof SystemInitializationRequest
-     */
-    'siteTitle'?: string;
-    /**
-     * 
-     * @type {string}
-     * @memberof SystemInitializationRequest
-     */
-    'username': string;
-}
-
diff --git a/ui/src/locales/en.yaml b/ui/src/locales/en.yaml
index 0b374b33bb..aa46cc72f8 100644
--- a/ui/src/locales/en.yaml
+++ b/ui/src/locales/en.yaml
@@ -1470,25 +1470,6 @@ core:
       message: Unauthorized access to this page
     actions:
       home: Back to home
-  setup:
-    title: Setup
-    operations:
-      submit:
-        button: Setup
-        toast_success: Setup successfully
-      setup_initial_data:
-        loading: Initializing data, please wait...
-    fields:
-      site_title:
-        label: Site title
-      email:
-        label: Email
-      username:
-        label: Username
-      password:
-        label: Password
-      confirm_password:
-        label: Confirm password
   rbac:
     Attachments Management: Attachments
     Attachment Manage: Attachment Manage
diff --git a/ui/src/locales/es.yaml b/ui/src/locales/es.yaml
index b74a7dce1a..b849af5b2b 100644
--- a/ui/src/locales/es.yaml
+++ b/ui/src/locales/es.yaml
@@ -1104,25 +1104,6 @@ core:
       message: Acceso no autorizado a esta página
     actions:
       home: Ir a la página de inicio
-  setup:
-    title: Configuración
-    operations:
-      submit:
-        button: Configurar
-        toast_success: Configuración exitosa
-      setup_initial_data:
-        loading: Inicializando datos, por favor espera...
-    fields:
-      site_title:
-        label: Título del Sitio
-      email:
-        label: Correo Electrónico
-      username:
-        label: Nombre de Usuario
-      password:
-        label: Contraseña
-      confirm_password:
-        label: Confirmar Contraseña
   rbac:
     Attachments Management: Gestión de archivos adjuntos
     Attachment Manage: Gestor de adjuntos
diff --git a/ui/src/locales/zh-CN.yaml b/ui/src/locales/zh-CN.yaml
index 6c2341d6c7..145875729f 100644
--- a/ui/src/locales/zh-CN.yaml
+++ b/ui/src/locales/zh-CN.yaml
@@ -1369,25 +1369,6 @@ core:
       message: 没有权限访问此页面
     actions:
       home: 返回首页
-  setup:
-    title: 系统初始化
-    operations:
-      submit:
-        button: 初始化
-        toast_success: 初始化成功
-      setup_initial_data:
-        loading: 正在初始化数据，请稍后...
-    fields:
-      site_title:
-        label: 站点名称
-      email:
-        label: 邮箱
-      username:
-        label: 用户名
-      password:
-        label: 密码
-      confirm_password:
-        label: 确认密码
   rbac:
     Attachments Management: 附件
     Attachment Manage: 附件管理
diff --git a/ui/src/locales/zh-TW.yaml b/ui/src/locales/zh-TW.yaml
index 652fc6725f..4f3c2d022a 100644
--- a/ui/src/locales/zh-TW.yaml
+++ b/ui/src/locales/zh-TW.yaml
@@ -1345,25 +1345,6 @@ core:
       message: 沒有權限訪問此頁面
     actions:
       home: 返回首頁
-  setup:
-    title: 系統初始化
-    operations:
-      submit:
-        button: 初始化
-        toast_success: 初始化成功
-      setup_initial_data:
-        loading: 正在初始化資料，請稍後...
-    fields:
-      site_title:
-        label: 站點名稱
-      email:
-        label: 電子郵箱
-      username:
-        label: 用戶名
-      password:
-        label: 密碼
-      confirm_password:
-        label: 確認密碼
   rbac:
     Attachments Management: 附件
     Attachment Manage: 附件管理

From 82fb91fc7b31a9f23e71f9dee955b0643b11b769 Mon Sep 17 00:00:00 2001
From: Ryan Wang <i@ryanc.cc>
Date: Wed, 9 Oct 2024 14:52:56 +0800
Subject: [PATCH 104/185] refactor: improve password input toggle button state
 display (#6800)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/area ui
/kind improvement
/milestone 2.20.x

#### What this PR does / why we need it:

优化密码输入框的明文切换图标的状态显示。

before:

<img width="508" alt="image" src="https://github.com/user-attachments/assets/5ae12beb-ce23-40a2-ad08-8e47c2eb6813">

after:

<img width="519" alt="image" src="https://github.com/user-attachments/assets/712e1735-a7ad-40f4-8900-a8c92eda7e54">


#### Does this PR introduce a user-facing change?

```release-note
优化密码输入框的明文切换图标的状态显示。
```
---
 ui/src/formkit/inputs/password/RevealButton.vue | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ui/src/formkit/inputs/password/RevealButton.vue b/ui/src/formkit/inputs/password/RevealButton.vue
index 67c1cc41fe..39a8f434cf 100644
--- a/ui/src/formkit/inputs/password/RevealButton.vue
+++ b/ui/src/formkit/inputs/password/RevealButton.vue
@@ -24,7 +24,7 @@ function handleChange() {
     @click="handleChange"
   >
     <IconEye
-      v-if="context.node.props.type === 'password'"
+      v-if="context.node.props.type !== 'password'"
       class="h-4 w-4 text-gray-500 group-hover:text-gray-700"
     />
     <IconEyeOff

From 5c507796936a727d2e107e897eee03454769299f Mon Sep 17 00:00:00 2001
From: John Niang <johnniang@foxmail.com>
Date: Wed, 9 Oct 2024 17:00:57 +0800
Subject: [PATCH 105/185] Xor CSRF token (#6798)

#### What type of PR is this?

/kind improvement
/area core
/milestone 2.20.x

#### What this PR does / why we need it:

This PR makes XOR operation for CSRF token and changes the CSRF cookie `HttpOnly` to `true` to forbid JavaScript from accessing the cookie.

See https://docs.spring.io/spring-security/reference/servlet/exploits/csrf.html#csrf-token-request-handler-breach for more details.

#### Special notes for your reviewer:

```bash
http http://localhost:8090/login -ph

HTTP/1.1 200 OK
set-cookie: XSRF-TOKEN=6d5dd83f-f0a7-4d94-a33e-73f213d679ff; Path=/; HTTPOnly
```

```bash
http http://localhost:8090/login -pb | grep _csrf

><input type="hidden" name="_csrf" value="ctubmrEC3dAbxC5H_k_-VnVUtih2BrfjcPfLmVAyaP0a1kAdEb-t_IcwuLM29B11yGLKNRQxm0lFZILOFZX-_GcHWJ974iR5"/>
```

#### Does this PR introduce a user-facing change?

```release-note
None
```
---
 .../run/halo/app/security/CsrfConfigurer.java   | 17 ++++++++---------
 .../exception/handlers/I18nExceptionTest.java   |  6 +++---
 2 files changed, 11 insertions(+), 12 deletions(-)

diff --git a/application/src/main/java/run/halo/app/security/CsrfConfigurer.java b/application/src/main/java/run/halo/app/security/CsrfConfigurer.java
index bac91e04bc..229050cfb6 100644
--- a/application/src/main/java/run/halo/app/security/CsrfConfigurer.java
+++ b/application/src/main/java/run/halo/app/security/CsrfConfigurer.java
@@ -1,30 +1,29 @@
 package run.halo.app.security;
 
-import static org.springframework.security.web.server.csrf.CookieServerCsrfTokenRepository.withHttpOnlyFalse;
 import static org.springframework.security.web.server.util.matcher.ServerWebExchangeMatchers.pathMatchers;
 
 import org.springframework.security.config.web.server.ServerHttpSecurity;
+import org.springframework.security.web.server.csrf.CookieServerCsrfTokenRepository;
 import org.springframework.security.web.server.csrf.CsrfWebFilter;
-import org.springframework.security.web.server.csrf.ServerCsrfTokenRequestAttributeHandler;
+import org.springframework.security.web.server.csrf.XorServerCsrfTokenRequestAttributeHandler;
 import org.springframework.security.web.server.util.matcher.AndServerWebExchangeMatcher;
 import org.springframework.security.web.server.util.matcher.NegatedServerWebExchangeMatcher;
 import org.springframework.stereotype.Component;
 import run.halo.app.security.authentication.SecurityConfigurer;
 
 @Component
-public class CsrfConfigurer implements SecurityConfigurer {
+class CsrfConfigurer implements SecurityConfigurer {
 
     @Override
     public void configure(ServerHttpSecurity http) {
         var csrfMatcher = new AndServerWebExchangeMatcher(
             CsrfWebFilter.DEFAULT_CSRF_MATCHER,
-            new NegatedServerWebExchangeMatcher(pathMatchers("/api/**", "/apis/**", "/system/setup")
-            ));
+            new NegatedServerWebExchangeMatcher(
+                pathMatchers("/api/**", "/apis/**", "/system/setup"))
+        );
         http.csrf(csrfSpec -> csrfSpec
-            .csrfTokenRepository(withHttpOnlyFalse())
-            // TODO Use XorServerCsrfTokenRequestAttributeHandler instead when console implements
-            // the algorithm
-            .csrfTokenRequestHandler(new ServerCsrfTokenRequestAttributeHandler())
+            .csrfTokenRepository(new CookieServerCsrfTokenRepository())
+            .csrfTokenRequestHandler(new XorServerCsrfTokenRequestAttributeHandler())
             .requireCsrfProtectionMatcher(csrfMatcher));
     }
 
diff --git a/application/src/test/java/run/halo/app/infra/exception/handlers/I18nExceptionTest.java b/application/src/test/java/run/halo/app/infra/exception/handlers/I18nExceptionTest.java
index e217f3cfb9..2dbc0ccfa8 100644
--- a/application/src/test/java/run/halo/app/infra/exception/handlers/I18nExceptionTest.java
+++ b/application/src/test/java/run/halo/app/infra/exception/handlers/I18nExceptionTest.java
@@ -1,6 +1,7 @@
 package run.halo.app.infra.exception.handlers;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.springframework.security.test.web.reactive.server.SecurityMockServerConfigurers.csrf;
 
 import java.util.Locale;
 import org.junit.jupiter.api.AfterEach;
@@ -121,9 +122,8 @@ void shouldGetErrorIfThrowingGeneralException() {
 
     @Test
     void shouldGetConflictError() {
-        webClient.put().uri("/response-entity/conflict-error")
-            .header("X-XSRF-TOKEN", "fake-token")
-            .cookie("XSRF-TOKEN", "fake-token")
+        webClient.mutate().apply(csrf()).build()
+            .put().uri("/response-entity/conflict-error")
             .exchange()
             .expectStatus().isEqualTo(HttpStatus.CONFLICT)
             .expectBody(ProblemDetail.class)

From 0e4a19d182139c7ee0506ef5ec4296ae04892e59 Mon Sep 17 00:00:00 2001
From: Ryan Wang <i@ryanc.cc>
Date: Wed, 9 Oct 2024 17:02:58 +0800
Subject: [PATCH 106/185] refactor: prevent password field from displaying
 encrypted text (#6801)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/area core
/kind improvement
/milestone 2.20.x

#### What this PR does / why we need it:

在提交登录表单时，不在密码框中显示加密文本。

#### Which issue(s) this PR fixes:

Fixes #6799

#### Does this PR introduce a user-facing change?

```release-note
None
```
---
 application/src/main/resources/templates/login_local.html | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/application/src/main/resources/templates/login_local.html b/application/src/main/resources/templates/login_local.html
index a6021c6f11..3c6bd0eeef 100644
--- a/application/src/main/resources/templates/login_local.html
+++ b/application/src/main/resources/templates/login_local.html
@@ -13,13 +13,15 @@
         document.addEventListener("DOMContentLoaded", function () {
             const loginForm = document.getElementById("login-form");
             loginForm.addEventListener("submit", function (event) {
+                const plainPasswordInput = document.getElementById("plainPassword");
                 const passwordInput = document.getElementById("password");
-                const password = passwordInput.value;
-                passwordInput.value = encryptPassword(password);
+                passwordInput.value = encryptPassword(plainPasswordInput.value);
             });
         });
     </script>
 
+    <input type="hidden" name="password" id="password" />
+
     <div class="form-item">
         <label for="username" th:text="#{form.username.label}"> </label>
 
@@ -50,7 +52,7 @@
         </div>
 
         <th:block
-            th:replace="~{gateway_modules/input_fragments :: password(id = 'password', name = 'password', required = 'true', minlength = null, maxlength = 257, enableToggle = true)}"
+            th:replace="~{gateway_modules/input_fragments :: password(id = 'plainPassword', name = null, required = 'true', minlength = null, maxlength = 257, enableToggle = true)}"
         ></th:block>
     </div>
 </div>
\ No newline at end of file

From ec75564f378a45e6aacf65bc0f436f00a09532b3 Mon Sep 17 00:00:00 2001
From: John Niang <johnniang@foxmail.com>
Date: Wed, 9 Oct 2024 17:04:57 +0800
Subject: [PATCH 107/185] Refactor password reset for extensibility (#6803)

#### What type of PR is this?

/kind improvement
/area core
/milestone 2.20.x

#### What this PR does / why we need it:

This PR refactors password reset for extensibility. If we want to add another password reset method, first thing we need to do is adding a new password reset method into `halo.security.password-reset-methods[]` and then defining PasswordResetAvailabilityProvider bean.

#### Does this PR introduce a user-facing change?

```release-note
None
```
---
 .../EmailPasswordRecoveryServiceImpl.java     |  2 +-
 .../infra/properties/SecurityProperties.java  | 16 +++++++
 ...ultPasswordResetAvailabilityProviders.java | 42 +++++++++++++++++++
 ...mailPasswordResetAvailabilityProvider.java | 26 ++++++++++++
 .../PasswordResetAvailabilityProvider.java    | 30 +++++++++++++
 .../PasswordResetAvailabilityProviders.java   | 31 ++++++++++++++
 ...=> PreAuthEmailPasswordResetEndpoint.java} | 41 ++++++++++++------
 .../src/main/resources/application.yaml       |  5 +++
 .../images/password-reset-methods/email.svg   |  1 +
 .../src/main/resources/static/styles/main.css | 16 +++----
 .../gateway_modules/common_fragments.html     | 22 +++++++++-
 .../common_fragments.properties               |  5 ++-
 .../common_fragments_en.properties            |  5 ++-
 .../common_fragments_es.properties            |  5 ++-
 .../common_fragments_zh_TW.properties         |  5 ++-
 .../gateway_modules/form_fragments.html       |  4 +-
 .../gateway_modules/login_fragments.html      |  4 +-
 .../main/resources/templates/login_local.html |  2 +-
 .../email/reset.html}                         |  0
 .../email/reset.properties}                   |  0
 .../email/reset_en.properties}                |  0
 .../email/reset_es.properties}                |  0
 .../email/reset_zh_TW.properties}             |  0
 .../email/send.html}                          |  4 +-
 .../email/send.properties}                    |  0
 .../email/send_en.properties}                 |  0
 .../email/send_es.properties}                 |  0
 .../email/send_zh_TW.properties}              |  0
 28 files changed, 233 insertions(+), 33 deletions(-)
 create mode 100644 application/src/main/java/run/halo/app/security/preauth/DefaultPasswordResetAvailabilityProviders.java
 create mode 100644 application/src/main/java/run/halo/app/security/preauth/EmailPasswordResetAvailabilityProvider.java
 create mode 100644 application/src/main/java/run/halo/app/security/preauth/PasswordResetAvailabilityProvider.java
 create mode 100644 application/src/main/java/run/halo/app/security/preauth/PasswordResetAvailabilityProviders.java
 rename application/src/main/java/run/halo/app/security/preauth/{PreAuthPasswordResetEndpoint.java => PreAuthEmailPasswordResetEndpoint.java} (84%)
 create mode 100644 application/src/main/resources/static/images/password-reset-methods/email.svg
 rename application/src/main/resources/templates/{password-reset-link.html => password-reset/email/reset.html} (100%)
 rename application/src/main/resources/templates/{password-reset-link.properties => password-reset/email/reset.properties} (100%)
 rename application/src/main/resources/templates/{password-reset-link_en.properties => password-reset/email/reset_en.properties} (100%)
 rename application/src/main/resources/templates/{password-reset-link_es.properties => password-reset/email/reset_es.properties} (100%)
 rename application/src/main/resources/templates/{password-reset-link_zh_TW.properties => password-reset/email/reset_zh_TW.properties} (100%)
 rename application/src/main/resources/templates/{password-reset.html => password-reset/email/send.html} (86%)
 rename application/src/main/resources/templates/{password-reset.properties => password-reset/email/send.properties} (100%)
 rename application/src/main/resources/templates/{password-reset_en.properties => password-reset/email/send_en.properties} (100%)
 rename application/src/main/resources/templates/{password-reset_es.properties => password-reset/email/send_es.properties} (100%)
 rename application/src/main/resources/templates/{password-reset_zh_TW.properties => password-reset/email/send_zh_TW.properties} (100%)

diff --git a/application/src/main/java/run/halo/app/core/user/service/impl/EmailPasswordRecoveryServiceImpl.java b/application/src/main/java/run/halo/app/core/user/service/impl/EmailPasswordRecoveryServiceImpl.java
index 290acb0850..b75ac59f60 100644
--- a/application/src/main/java/run/halo/app/core/user/service/impl/EmailPasswordRecoveryServiceImpl.java
+++ b/application/src/main/java/run/halo/app/core/user/service/impl/EmailPasswordRecoveryServiceImpl.java
@@ -115,7 +115,7 @@ private Mono<Void> sendResetPasswordNotification(String username, String email)
         var tokenHash = hashToken(token);
         var expiresAt = clock.instant().plus(RESET_TOKEN_LIFE_TIME);
         var uri = UriComponentsBuilder.fromUriString("/")
-            .pathSegment("password-reset", token)
+            .pathSegment("password-reset", "email", token)
             .build(true)
             .toUri();
         var resetToken = new ResetToken(tokenHash, username, expiresAt);
diff --git a/application/src/main/java/run/halo/app/infra/properties/SecurityProperties.java b/application/src/main/java/run/halo/app/infra/properties/SecurityProperties.java
index e10d433853..5911ac2846 100644
--- a/application/src/main/java/run/halo/app/infra/properties/SecurityProperties.java
+++ b/application/src/main/java/run/halo/app/infra/properties/SecurityProperties.java
@@ -2,7 +2,10 @@
 
 import static org.springframework.security.web.server.header.ReferrerPolicyServerHttpHeadersWriter.ReferrerPolicy.STRICT_ORIGIN_WHEN_CROSS_ORIGIN;
 
+import java.net.URI;
 import java.time.Duration;
+import java.util.ArrayList;
+import java.util.List;
 import lombok.Data;
 import org.springframework.security.web.server.header.ReferrerPolicyServerHttpHeadersWriter.ReferrerPolicy;
 import org.springframework.security.web.server.header.XFrameOptionsServerHttpHeadersWriter.Mode;
@@ -20,6 +23,8 @@ public class SecurityProperties {
 
     private final BasicAuthOptions basicAuth = new BasicAuthOptions();
 
+    private final List<PasswordResetMethod> passwordResetMethods = new ArrayList<>();
+
     @Data
     public static class BasicAuthOptions {
         /**
@@ -57,4 +62,15 @@ public static class ReferrerOptions {
     public static class RememberMeOptions {
         private Duration tokenValidity = Duration.ofDays(14);
     }
+
+    @Data
+    public static class PasswordResetMethod {
+
+        private String name;
+
+        private URI href;
+
+        private URI icon;
+
+    }
 }
diff --git a/application/src/main/java/run/halo/app/security/preauth/DefaultPasswordResetAvailabilityProviders.java b/application/src/main/java/run/halo/app/security/preauth/DefaultPasswordResetAvailabilityProviders.java
new file mode 100644
index 0000000000..e311eddbee
--- /dev/null
+++ b/application/src/main/java/run/halo/app/security/preauth/DefaultPasswordResetAvailabilityProviders.java
@@ -0,0 +1,42 @@
+package run.halo.app.security.preauth;
+
+import java.util.List;
+import org.springframework.beans.factory.ObjectProvider;
+import org.springframework.stereotype.Component;
+import reactor.core.publisher.Flux;
+import reactor.core.publisher.Mono;
+import run.halo.app.infra.properties.HaloProperties;
+import run.halo.app.infra.properties.SecurityProperties;
+import run.halo.app.infra.properties.SecurityProperties.PasswordResetMethod;
+
+/**
+ * Default password reset availability providers.
+ *
+ * @author johnniang
+ * @since 2.20.0
+ */
+@Component
+public class DefaultPasswordResetAvailabilityProviders
+    implements PasswordResetAvailabilityProviders {
+
+    private final SecurityProperties securityProperties;
+
+    private final List<PasswordResetAvailabilityProvider> providers;
+
+    public DefaultPasswordResetAvailabilityProviders(HaloProperties haloProperties,
+        ObjectProvider<PasswordResetAvailabilityProvider> providers) {
+        this.securityProperties = haloProperties.getSecurity();
+        this.providers = providers.orderedStream().toList();
+    }
+
+    @Override
+    public Flux<PasswordResetMethod> getAvailableMethods() {
+        return Flux.fromIterable(securityProperties.getPasswordResetMethods())
+            .filterWhen(method -> providers.stream()
+                .filter(provider -> provider.support(method.getName()))
+                .findFirst()
+                .map(provider -> provider.isAvailable(method))
+                .orElseGet(() -> Mono.just(false))
+            );
+    }
+}
diff --git a/application/src/main/java/run/halo/app/security/preauth/EmailPasswordResetAvailabilityProvider.java b/application/src/main/java/run/halo/app/security/preauth/EmailPasswordResetAvailabilityProvider.java
new file mode 100644
index 0000000000..7509ac793d
--- /dev/null
+++ b/application/src/main/java/run/halo/app/security/preauth/EmailPasswordResetAvailabilityProvider.java
@@ -0,0 +1,26 @@
+package run.halo.app.security.preauth;
+
+import org.springframework.stereotype.Component;
+import reactor.core.publisher.Mono;
+import run.halo.app.infra.properties.SecurityProperties;
+
+/**
+ * Email password reset availability provider.
+ *
+ * @author johnniang
+ * @since 2.20.0
+ */
+@Component
+public class EmailPasswordResetAvailabilityProvider implements PasswordResetAvailabilityProvider {
+
+    @Override
+    public Mono<Boolean> isAvailable(SecurityProperties.PasswordResetMethod method) {
+        // TODO Check the email notifier is available in the future
+        return Mono.just(true);
+    }
+
+    @Override
+    public boolean support(String name) {
+        return "email".equals(name);
+    }
+}
diff --git a/application/src/main/java/run/halo/app/security/preauth/PasswordResetAvailabilityProvider.java b/application/src/main/java/run/halo/app/security/preauth/PasswordResetAvailabilityProvider.java
new file mode 100644
index 0000000000..5f097149bb
--- /dev/null
+++ b/application/src/main/java/run/halo/app/security/preauth/PasswordResetAvailabilityProvider.java
@@ -0,0 +1,30 @@
+package run.halo.app.security.preauth;
+
+import reactor.core.publisher.Mono;
+import run.halo.app.infra.properties.SecurityProperties;
+
+/**
+ * Password reset availability provider.
+ *
+ * @author johnniang
+ * @since 2.20.0
+ */
+public interface PasswordResetAvailabilityProvider {
+
+    /**
+     * Check if the password reset method is available.
+     *
+     * @param method password reset method
+     * @return true if available, false otherwise
+     */
+    Mono<Boolean> isAvailable(SecurityProperties.PasswordResetMethod method);
+
+    /**
+     * Check if the provider supports the name.
+     *
+     * @param name password reset method name
+     * @return true if supports, false otherwise
+     */
+    boolean support(String name);
+
+}
diff --git a/application/src/main/java/run/halo/app/security/preauth/PasswordResetAvailabilityProviders.java b/application/src/main/java/run/halo/app/security/preauth/PasswordResetAvailabilityProviders.java
new file mode 100644
index 0000000000..a88f976a42
--- /dev/null
+++ b/application/src/main/java/run/halo/app/security/preauth/PasswordResetAvailabilityProviders.java
@@ -0,0 +1,31 @@
+package run.halo.app.security.preauth;
+
+import reactor.core.publisher.Flux;
+import run.halo.app.infra.properties.SecurityProperties.PasswordResetMethod;
+
+/**
+ * Password reset availability providers.
+ *
+ * @author johnniang
+ * @since 2.20.0
+ */
+public interface PasswordResetAvailabilityProviders {
+
+    /**
+     * Get available password reset methods.
+     *
+     * @return available password reset methods
+     */
+    Flux<PasswordResetMethod> getAvailableMethods();
+
+    /**
+     * Get other available password reset methods.
+     *
+     * @param methodName method name
+     * @return other available password reset methods
+     */
+    default Flux<PasswordResetMethod> getOtherAvailableMethods(String methodName) {
+        return getAvailableMethods().filter(method -> !method.getName().equals(methodName));
+    }
+
+}
diff --git a/application/src/main/java/run/halo/app/security/preauth/PreAuthPasswordResetEndpoint.java b/application/src/main/java/run/halo/app/security/preauth/PreAuthEmailPasswordResetEndpoint.java
similarity index 84%
rename from application/src/main/java/run/halo/app/security/preauth/PreAuthPasswordResetEndpoint.java
rename to application/src/main/java/run/halo/app/security/preauth/PreAuthEmailPasswordResetEndpoint.java
index dc49b05c90..3bdee33b01 100644
--- a/application/src/main/java/run/halo/app/security/preauth/PreAuthPasswordResetEndpoint.java
+++ b/application/src/main/java/run/halo/app/security/preauth/PreAuthEmailPasswordResetEndpoint.java
@@ -33,7 +33,10 @@
  * @since 2.20.0
  */
 @Component
-class PreAuthPasswordResetEndpoint {
+class PreAuthEmailPasswordResetEndpoint {
+
+    private static final String SEND_TEMPLATE = "password-reset/email/send";
+    private static final String RESET_TEMPLATE = "password-reset/email/reset";
 
     private final EmailPasswordRecoveryService emailPasswordRecoveryService;
 
@@ -41,32 +44,44 @@ class PreAuthPasswordResetEndpoint {
 
     private final RateLimiterRegistry rateLimiterRegistry;
 
-    public PreAuthPasswordResetEndpoint(EmailPasswordRecoveryService emailPasswordRecoveryService,
+    private final PasswordResetAvailabilityProviders passwordResetAvailabilityProviders;
+
+    public PreAuthEmailPasswordResetEndpoint(
+        EmailPasswordRecoveryService emailPasswordRecoveryService,
         MessageSource messageSource,
-        RateLimiterRegistry rateLimiterRegistry
+        RateLimiterRegistry rateLimiterRegistry,
+        PasswordResetAvailabilityProviders passwordResetAvailabilityProviders
     ) {
         this.emailPasswordRecoveryService = emailPasswordRecoveryService;
         this.messageSource = messageSource;
         this.rateLimiterRegistry = rateLimiterRegistry;
+        this.passwordResetAvailabilityProviders = passwordResetAvailabilityProviders;
     }
 
     @Bean
     RouterFunction<ServerResponse> preAuthPasswordResetEndpoints() {
-        return RouterFunctions.nest(path("/password-reset"), RouterFunctions.route()
-            .GET("", request -> ServerResponse.ok().render("password-reset"))
+        return RouterFunctions.nest(path("/password-reset/email"), RouterFunctions.route()
+            .GET("", request -> {
+                return ServerResponse.ok().render(SEND_TEMPLATE, Map.of(
+                    "otherMethods",
+                    passwordResetAvailabilityProviders.getOtherAvailableMethods("email")
+                ));
+            })
             .GET("/{resetToken}",
                 request -> {
                     var token = request.pathVariable("resetToken");
                     return emailPasswordRecoveryService.getValidResetToken(token)
                         .flatMap(resetToken -> {
                             // TODO Check the 2FA of the user
-                            return ServerResponse.ok().render("password-reset-link", Map.of(
+                            return ServerResponse.ok().render(RESET_TEMPLATE, Map.of(
                                 "username", resetToken.username()
                             ));
                         })
                         .onErrorResume(InvalidResetTokenException.class,
                             e -> ServerResponse.status(HttpStatus.FOUND)
-                                .location(URI.create("/password-reset"))
+                                .location(
+                                    URI.create("/password-reset/email?error=invalid_reset_token")
+                                )
                                 .build()
                                 .transformDeferred(rateLimiterForPasswordResetVerification(
                                     request.exchange().getRequest()
@@ -94,7 +109,7 @@ RouterFunction<ServerResponse> preAuthPasswordResetEndpoints() {
                                 "Password can't be blank",
                                 locale
                             );
-                            return ServerResponse.ok().render("password-reset-link", Map.of(
+                            return ServerResponse.ok().render(RESET_TEMPLATE, Map.of(
                                 "error", error
                             ));
                         }
@@ -105,13 +120,13 @@ RouterFunction<ServerResponse> preAuthPasswordResetEndpoints() {
                                 "Password and confirm password mismatch",
                                 locale
                             );
-                            return ServerResponse.ok().render("password-reset-link", Map.of(
+                            return ServerResponse.ok().render(RESET_TEMPLATE, Map.of(
                                 "error", error
                             ));
                         }
                         return emailPasswordRecoveryService.changePassword(password, token)
                             .then(ServerResponse.status(HttpStatus.FOUND)
-                                .location(URI.create("/login?passwordReset"))
+                                .location(URI.create("/login?password_reset"))
                                 .build()
                             )
                             .onErrorResume(InvalidResetTokenException.class, e -> {
@@ -121,7 +136,7 @@ RouterFunction<ServerResponse> preAuthPasswordResetEndpoints() {
                                     "Invalid reset token",
                                     locale
                                 );
-                                return ServerResponse.ok().render("password-reset-link", Map.of(
+                                return ServerResponse.ok().render(RESET_TEMPLATE, Map.of(
                                     "error", error
                                 )).transformDeferred(rateLimiterForPasswordResetVerification(
                                     request.exchange().getRequest()
@@ -148,12 +163,12 @@ RouterFunction<ServerResponse> preAuthPasswordResetEndpoints() {
                                     "Email can't be blank",
                                     locale
                                 );
-                                return ServerResponse.ok().render("password-reset", Map.of(
+                                return ServerResponse.ok().render(SEND_TEMPLATE, Map.of(
                                     "error", error
                                 ));
                             }
                             return emailPasswordRecoveryService.sendPasswordResetEmail(email)
-                                .then(ServerResponse.ok().render("password-reset", Map.of(
+                                .then(ServerResponse.ok().render(SEND_TEMPLATE, Map.of(
                                     "sent", true
                                 )))
                                 .transformDeferred(rateLimiterForSendPasswordResetEmail(
diff --git a/application/src/main/resources/application.yaml b/application/src/main/resources/application.yaml
index 810ed858ed..29683cea57 100644
--- a/application/src/main/resources/application.yaml
+++ b/application/src/main/resources/application.yaml
@@ -42,6 +42,11 @@ halo:
       - pathPattern: /upload/**
         locations:
           - migrate-from-1.x
+  security:
+    password-reset-methods:
+      - name: email
+        href: /password-reset/email
+        icon: /images/password-reset-methods/email.svg
 
 springdoc:
   api-docs:
diff --git a/application/src/main/resources/static/images/password-reset-methods/email.svg b/application/src/main/resources/static/images/password-reset-methods/email.svg
new file mode 100644
index 0000000000..d658b36a13
--- /dev/null
+++ b/application/src/main/resources/static/images/password-reset-methods/email.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="rgba(75,85,99,1)"><path d="M3 3H21C21.5523 3 22 3.44772 22 4V20C22 20.5523 21.5523 21 21 21H3C2.44772 21 2 20.5523 2 20V4C2 3.44772 2.44772 3 3 3ZM20 7.23792L12.0718 14.338L4 7.21594V19H20V7.23792ZM4.51146 5L12.0619 11.662L19.501 5H4.51146Z"></path></svg>
\ No newline at end of file
diff --git a/application/src/main/resources/static/styles/main.css b/application/src/main/resources/static/styles/main.css
index 0f325cd5d0..c7ac03b8eb 100644
--- a/application/src/main/resources/static/styles/main.css
+++ b/application/src/main/resources/static/styles/main.css
@@ -283,7 +283,7 @@
     background: #f9fafb;
 }
 
-.auth-provider-items {
+.pill-items {
     all: unset;
     gap: var(--spacing-sm);
     margin: 0;
@@ -292,7 +292,7 @@
     justify-content: center;
 }
 
-.auth-provider-items li {
+.pill-items li {
     all: unset;
     border-radius: var(--rounded-lg);
     overflow: hidden;
@@ -302,7 +302,7 @@
     transition-duration: 0.15s;
 }
 
-.auth-provider-items li a {
+.pill-items li a {
     gap: var(--spacing-sm);
     font-size: var(--text-sm);
     padding: 0.7em 1em;
@@ -312,21 +312,21 @@
     text-decoration: none;
 }
 
-.auth-provider-items li img {
+.pill-items li img {
     width: 1.5em;
     height: 1.5em;
 }
 
-.auth-provider-items li:hover {
+.pill-items li:hover {
     border-color: var(--color-primary);
     background: #f3f4f6;
 }
 
-.auth-provider-items li:hover a {
+.pill-items li:hover a {
     color: #111827;
 }
 
-.auth-provider-items li:focus-within {
+.pill-items li:focus-within {
     border-color: var(--color-primary);
 }
 
@@ -415,4 +415,4 @@
 
 ::-ms-reveal {
     display: none;
-}
+}
\ No newline at end of file
diff --git a/application/src/main/resources/templates/gateway_modules/common_fragments.html b/application/src/main/resources/templates/gateway_modules/common_fragments.html
index cb0bd48b5e..ba19048ce6 100644
--- a/application/src/main/resources/templates/gateway_modules/common_fragments.html
+++ b/application/src/main/resources/templates/gateway_modules/common_fragments.html
@@ -109,7 +109,7 @@
             <th:block th:text="#{socialLogin.label}"></th:block>
             <hr />
         </div>
-        <ul class="auth-provider-items">
+        <ul class="pill-items">
             <li th:each="provider : ${socialAuthProviders}">
                 <a th:href="${provider.spec.authenticationUrl}">
                     <img th:src="${provider.spec.logo}" />
@@ -120,6 +120,26 @@
     </th:block>
 </div>
 
+<div th:remove="tag" th:fragment="passwordResetMethods">
+    <th:block th:unless="${#lists.isEmpty(otherMethods)}">
+        <div class="divider-wrapper">
+            <hr />
+            <th:block th:text="#{passwordResetMethods.label}"></th:block>
+            <hr />
+        </div>
+        <ul class="pill-items">
+            <li th:each="method : ${otherMethods}">
+                <a th:href="${method.href}">
+                    <img th:src="${method.icon}" />
+                    <span
+                        th:text="${#messages.msgOrNull('passwordResetMethods.' + method.name + '.displayName') ?: method.name}"
+                    ></span>
+                </a>
+            </li>
+        </ul>
+    </th:block>
+</div>
+
 <div th:remove="tag" th:fragment="signupNoticeContent">
     <style>
         .signup-notice-content {
diff --git a/application/src/main/resources/templates/gateway_modules/common_fragments.properties b/application/src/main/resources/templates/gateway_modules/common_fragments.properties
index 36f5946b88..20c55fde01 100644
--- a/application/src/main/resources/templates/gateway_modules/common_fragments.properties
+++ b/application/src/main/resources/templates/gateway_modules/common_fragments.properties
@@ -6,4 +6,7 @@ signupNotice.description=没有账号？
 signupNotice.link=立即注册
 loginNotice.description=已有账号，
 loginNotice.link=立即登录
-returnToSite=返回网站
\ No newline at end of file
+returnToSite=返回网站
+
+passwordResetMethods.label=其他重置方式
+passwordResetMethods.email.displayName=通过邮件重置
\ No newline at end of file
diff --git a/application/src/main/resources/templates/gateway_modules/common_fragments_en.properties b/application/src/main/resources/templates/gateway_modules/common_fragments_en.properties
index 77019abe17..8b8a620e24 100644
--- a/application/src/main/resources/templates/gateway_modules/common_fragments_en.properties
+++ b/application/src/main/resources/templates/gateway_modules/common_fragments_en.properties
@@ -6,4 +6,7 @@ signupNotice.description=Don't have an account?
 signupNotice.link=Sign up
 loginNotice.description=Already have an account,
 loginNotice.link=Login now
-returnToSite=Return to site
\ No newline at end of file
+returnToSite=Return to site
+
+passwordResetMethods.label=Other Reset Methods
+passwordResetMethods.email.displayName=Reset via Email
\ No newline at end of file
diff --git a/application/src/main/resources/templates/gateway_modules/common_fragments_es.properties b/application/src/main/resources/templates/gateway_modules/common_fragments_es.properties
index e79af38312..00349a8bff 100644
--- a/application/src/main/resources/templates/gateway_modules/common_fragments_es.properties
+++ b/application/src/main/resources/templates/gateway_modules/common_fragments_es.properties
@@ -6,4 +6,7 @@ signupNotice.description=¿No tienes una cuenta?
 signupNotice.link=Regístrate ahora
 loginNotice.description=Ya tienes una cuenta,
 loginNotice.link=Inicia sesión ahora
-returnToSite=Volver al sitio
\ No newline at end of file
+returnToSite=Volver al sitio
+
+passwordResetMethods.label=Otros Métodos de Restablecimiento
+passwordResetMethods.email.displayName=Restablecer por Correo Electrónico
\ No newline at end of file
diff --git a/application/src/main/resources/templates/gateway_modules/common_fragments_zh_TW.properties b/application/src/main/resources/templates/gateway_modules/common_fragments_zh_TW.properties
index ddc0d3f899..d86fbc733c 100644
--- a/application/src/main/resources/templates/gateway_modules/common_fragments_zh_TW.properties
+++ b/application/src/main/resources/templates/gateway_modules/common_fragments_zh_TW.properties
@@ -6,4 +6,7 @@ signupNotice.description=沒有帳號？
 signupNotice.link=立即註冊
 loginNotice.description=已有帳號，
 loginNotice.link=立即登入
-returnToSite=返回網站
\ No newline at end of file
+returnToSite=返回網站
+
+passwordResetMethods.label=其他重置方式
+passwordResetMethods.email.displayName=通過郵件重置
\ No newline at end of file
diff --git a/application/src/main/resources/templates/gateway_modules/form_fragments.html b/application/src/main/resources/templates/gateway_modules/form_fragments.html
index 269771c092..133d2b52fa 100644
--- a/application/src/main/resources/templates/gateway_modules/form_fragments.html
+++ b/application/src/main/resources/templates/gateway_modules/form_fragments.html
@@ -245,7 +245,7 @@
 <form
     th:fragment="passwordResetLink"
     class="halo-form"
-    th:action="@{/password-reset/{resetToken}(resetToken=${resetToken})}"
+    th:action="@{/password-reset/email/{resetToken}(resetToken=${resetToken})}"
     method="post"
 >
     <div class="alert alert-error" role="alert" th:if="${error}">
@@ -280,7 +280,7 @@
             <button type="submit" th:text="#{form.passwordReset.sent.submit}"></button>
         </div>
     </form>
-    <form th:unless="${sent}" class="halo-form" th:action="@{/password-reset}" method="post">
+    <form th:unless="${sent}" class="halo-form" th:action="@{/password-reset/email}" method="post">
         <div class="alert alert-error" th:if="${error}">
             <strong th:text="${error}"></strong>
         </div>
diff --git a/application/src/main/resources/templates/gateway_modules/login_fragments.html b/application/src/main/resources/templates/gateway_modules/login_fragments.html
index 20cbfd22d0..0b56714491 100644
--- a/application/src/main/resources/templates/gateway_modules/login_fragments.html
+++ b/application/src/main/resources/templates/gateway_modules/login_fragments.html
@@ -6,7 +6,7 @@
             <th:block th:text="#{otherLogin.label}"></th:block>
             <hr />
         </div>
-        <ul class="auth-provider-items">
+        <ul class="pill-items">
             <li th:each="provider : ${formAuthProviders}">
                 <a th:href="'/login?method=' + ${provider.metadata.name}">
                     <img th:src="${provider.spec.logo}" />
@@ -17,4 +17,4 @@
             </li>
         </ul>
     </th:block>
-</div>
+</div>
\ No newline at end of file
diff --git a/application/src/main/resources/templates/login_local.html b/application/src/main/resources/templates/login_local.html
index 3c6bd0eeef..46d997c236 100644
--- a/application/src/main/resources/templates/login_local.html
+++ b/application/src/main/resources/templates/login_local.html
@@ -45,7 +45,7 @@
             <a
                 class="form-item-extra-link"
                 tabindex="-1"
-                th:href="@{/password-reset}"
+                th:href="@{/password-reset/email}"
                 th:text="#{form.password.forgot}"
             >
             </a>
diff --git a/application/src/main/resources/templates/password-reset-link.html b/application/src/main/resources/templates/password-reset/email/reset.html
similarity index 100%
rename from application/src/main/resources/templates/password-reset-link.html
rename to application/src/main/resources/templates/password-reset/email/reset.html
diff --git a/application/src/main/resources/templates/password-reset-link.properties b/application/src/main/resources/templates/password-reset/email/reset.properties
similarity index 100%
rename from application/src/main/resources/templates/password-reset-link.properties
rename to application/src/main/resources/templates/password-reset/email/reset.properties
diff --git a/application/src/main/resources/templates/password-reset-link_en.properties b/application/src/main/resources/templates/password-reset/email/reset_en.properties
similarity index 100%
rename from application/src/main/resources/templates/password-reset-link_en.properties
rename to application/src/main/resources/templates/password-reset/email/reset_en.properties
diff --git a/application/src/main/resources/templates/password-reset-link_es.properties b/application/src/main/resources/templates/password-reset/email/reset_es.properties
similarity index 100%
rename from application/src/main/resources/templates/password-reset-link_es.properties
rename to application/src/main/resources/templates/password-reset/email/reset_es.properties
diff --git a/application/src/main/resources/templates/password-reset-link_zh_TW.properties b/application/src/main/resources/templates/password-reset/email/reset_zh_TW.properties
similarity index 100%
rename from application/src/main/resources/templates/password-reset-link_zh_TW.properties
rename to application/src/main/resources/templates/password-reset/email/reset_zh_TW.properties
diff --git a/application/src/main/resources/templates/password-reset.html b/application/src/main/resources/templates/password-reset/email/send.html
similarity index 86%
rename from application/src/main/resources/templates/password-reset.html
rename to application/src/main/resources/templates/password-reset/email/send.html
index b27921db39..f518e2d9f8 100644
--- a/application/src/main/resources/templates/password-reset.html
+++ b/application/src/main/resources/templates/password-reset/email/send.html
@@ -9,9 +9,11 @@
             <div class="halo-form-wrapper">
                 <h1 class="form-title" th:text="${sent} ? #{sent.title} : #{title}"></h1>
                 <form th:replace="~{gateway_modules/form_fragments::passwordReset}"></form>
+
+                <div th:replace="~{gateway_modules/common_fragments::passwordResetMethods}"></div>
             </div>
 
             <div th:replace="~{gateway_modules/common_fragments::languageSwitcher}"></div>
         </div>
     </th:block>
-</html>
\ No newline at end of file
+</html>
diff --git a/application/src/main/resources/templates/password-reset.properties b/application/src/main/resources/templates/password-reset/email/send.properties
similarity index 100%
rename from application/src/main/resources/templates/password-reset.properties
rename to application/src/main/resources/templates/password-reset/email/send.properties
diff --git a/application/src/main/resources/templates/password-reset_en.properties b/application/src/main/resources/templates/password-reset/email/send_en.properties
similarity index 100%
rename from application/src/main/resources/templates/password-reset_en.properties
rename to application/src/main/resources/templates/password-reset/email/send_en.properties
diff --git a/application/src/main/resources/templates/password-reset_es.properties b/application/src/main/resources/templates/password-reset/email/send_es.properties
similarity index 100%
rename from application/src/main/resources/templates/password-reset_es.properties
rename to application/src/main/resources/templates/password-reset/email/send_es.properties
diff --git a/application/src/main/resources/templates/password-reset_zh_TW.properties b/application/src/main/resources/templates/password-reset/email/send_zh_TW.properties
similarity index 100%
rename from application/src/main/resources/templates/password-reset_zh_TW.properties
rename to application/src/main/resources/templates/password-reset/email/send_zh_TW.properties

From d6df340fe4c6dd06e58560da59b1a37702a89753 Mon Sep 17 00:00:00 2001
From: guqing <i@guqing.email>
Date: Wed, 9 Oct 2024 17:18:19 +0800
Subject: [PATCH 108/185] refactor: unified validation for username and
 password format

---
 .../core/endpoint/console/UserEndpoint.java   | 48 +++++++-------
 .../app/core/user/service/SignUpData.java     | 10 ++-
 .../core/user/service/UserServiceImpl.java    |  6 ++
 .../run/halo/app/infra/ValidationUtils.java   | 34 +---------
 .../UnsatisfiedAttributeValueException.java   |  4 ++
 .../resources/config/i18n/messages.properties |  3 +-
 .../config/i18n/messages_zh.properties        |  3 +-
 .../console/EmailVerificationCodeTest.java    |  4 ++
 .../user/service/UserServiceImplTest.java     | 51 +++++++++------
 .../halo/app/infra/ValidationUtilsTest.java   | 65 ++++++-------------
 10 files changed, 106 insertions(+), 122 deletions(-)

diff --git a/application/src/main/java/run/halo/app/core/endpoint/console/UserEndpoint.java b/application/src/main/java/run/halo/app/core/endpoint/console/UserEndpoint.java
index 861390cb0a..a883b69ca5 100644
--- a/application/src/main/java/run/halo/app/core/endpoint/console/UserEndpoint.java
+++ b/application/src/main/java/run/halo/app/core/endpoint/console/UserEndpoint.java
@@ -24,6 +24,7 @@
 import io.github.resilience4j.reactor.ratelimiter.operator.RateLimiterOperator;
 import io.swagger.v3.oas.annotations.enums.ParameterIn;
 import io.swagger.v3.oas.annotations.media.Schema;
+import jakarta.validation.constraints.Email;
 import java.security.Principal;
 import java.time.Duration;
 import java.util.Collection;
@@ -58,6 +59,8 @@
 import org.springframework.util.CollectionUtils;
 import org.springframework.util.MultiValueMap;
 import org.springframework.util.unit.DataSize;
+import org.springframework.validation.BeanPropertyBindingResult;
+import org.springframework.validation.Validator;
 import org.springframework.web.reactive.function.BodyExtractors;
 import org.springframework.web.reactive.function.server.RouterFunction;
 import org.springframework.web.reactive.function.server.ServerRequest;
@@ -65,7 +68,6 @@
 import org.springframework.web.server.ServerWebInputException;
 import reactor.core.publisher.Flux;
 import reactor.core.publisher.Mono;
-import reactor.util.function.Tuples;
 import reactor.util.retry.Retry;
 import run.halo.app.core.extension.Role;
 import run.halo.app.core.extension.User;
@@ -84,7 +86,6 @@
 import run.halo.app.extension.router.SortableRequest;
 import run.halo.app.infra.SystemConfigurableEnvironmentFetcher;
 import run.halo.app.infra.SystemSetting;
-import run.halo.app.infra.ValidationUtils;
 import run.halo.app.infra.exception.RateLimitExceededException;
 import run.halo.app.infra.exception.UnsatisfiedAttributeValueException;
 import run.halo.app.infra.utils.JsonUtils;
@@ -104,6 +105,7 @@ public class UserEndpoint implements CustomEndpoint {
     private final EmailVerificationService emailVerificationService;
     private final RateLimiterRegistry rateLimiterRegistry;
     private final SystemConfigurableEnvironmentFetcher environmentFetcher;
+    private final Validator validator;
 
     @Override
     public RouterFunction<ServerResponse> endpoint() {
@@ -280,7 +282,9 @@ private Mono<Void> verifyEmailCode(String username, String code) {
             .onErrorMap(RequestNotPermitted.class, RateLimitExceededException::new);
     }
 
-    public record EmailVerifyRequest(@Schema(requiredMode = REQUIRED) String email) {
+    public record EmailVerifyRequest(@Schema(requiredMode = REQUIRED)
+                                     @Email
+                                     String email) {
     }
 
     public record VerifyCodeRequest(
@@ -289,25 +293,23 @@ public record VerifyCodeRequest(
     }
 
     private Mono<ServerResponse> sendEmailVerificationCode(ServerRequest request) {
-        return request.bodyToMono(EmailVerifyRequest.class)
+        var emailMono = request.bodyToMono(EmailVerifyRequest.class)
             .switchIfEmpty(Mono.error(
                 () -> new ServerWebInputException("Request body is required."))
             )
-            .doOnNext(emailRequest -> {
-                if (!ValidationUtils.isValidEmail(emailRequest.email())) {
-                    throw new ServerWebInputException("Invalid email address.");
+            .doOnNext(emailReq -> {
+                var bindingResult = new BeanPropertyBindingResult(emailReq, "form");
+                validator.validate(emailReq, bindingResult);
+                if (bindingResult.hasErrors()) {
+                    // only email field is validated
+                    throw new ServerWebInputException("validation.error.email.pattern");
                 }
             })
-            .flatMap(emailRequest -> {
-                var email = emailRequest.email();
-                return ReactiveSecurityContextHolder.getContext()
-                    .map(SecurityContext::getAuthentication)
-                    .map(Principal::getName)
-                    .map(username -> Tuples.of(username, email));
-            })
+            .map(EmailVerifyRequest::email);
+        return Mono.zip(emailMono, getAuthenticatedUserName())
             .flatMap(tuple -> {
-                var username = tuple.getT1();
-                var email = tuple.getT2();
+                var email = tuple.getT1();
+                var username = tuple.getT2();
                 return Mono.just(username)
                     .transformDeferred(sendEmailVerificationCodeRateLimiter(username, email))
                     .flatMap(u -> emailVerificationService.sendVerificationCode(username, email))
@@ -346,9 +348,7 @@ private Mono<User> getUserOrSelf(String name) {
         if (!SELF_USER.equals(name)) {
             return client.get(User.class, name);
         }
-        return ReactiveSecurityContextHolder.getContext()
-            .map(SecurityContext::getAuthentication)
-            .map(Authentication::getName)
+        return getAuthenticatedUserName()
             .flatMap(currentUserName -> client.get(User.class, currentUserName));
     }
 
@@ -501,9 +501,7 @@ public static User from(CreateUserRequest userRequest) {
     }
 
     private Mono<ServerResponse> updateProfile(ServerRequest request) {
-        return ReactiveSecurityContextHolder.getContext()
-            .map(SecurityContext::getAuthentication)
-            .map(Authentication::getName)
+        return getAuthenticatedUserName()
             .flatMap(currentUserName -> client.get(User.class, currentUserName))
             .flatMap(currentUser -> request.bodyToMono(User.class)
                 .filter(user -> user.getMetadata() != null
@@ -538,6 +536,12 @@ private Mono<ServerResponse> updateProfile(ServerRequest request) {
             .flatMap(updatedUser -> ServerResponse.ok().bodyValue(updatedUser));
     }
 
+    private static Mono<String> getAuthenticatedUserName() {
+        return ReactiveSecurityContextHolder.getContext()
+            .map(SecurityContext::getAuthentication)
+            .map(Authentication::getName);
+    }
+
     Mono<ServerResponse> changeAnyonePasswordForAdmin(ServerRequest request) {
         final var nameInPath = request.pathVariable("name");
         return ReactiveSecurityContextHolder.getContext()
diff --git a/application/src/main/java/run/halo/app/core/user/service/SignUpData.java b/application/src/main/java/run/halo/app/core/user/service/SignUpData.java
index 0b5c3cba88..61e32bed04 100644
--- a/application/src/main/java/run/halo/app/core/user/service/SignUpData.java
+++ b/application/src/main/java/run/halo/app/core/user/service/SignUpData.java
@@ -6,6 +6,7 @@
 import jakarta.validation.Payload;
 import jakarta.validation.constraints.Email;
 import jakarta.validation.constraints.NotBlank;
+import jakarta.validation.constraints.Pattern;
 import java.lang.annotation.ElementType;
 import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
@@ -15,6 +16,7 @@
 import lombok.Data;
 import org.springframework.util.MultiValueMap;
 import org.springframework.util.StringUtils;
+import run.halo.app.infra.ValidationUtils;
 
 /**
  * Sign up data.
@@ -27,6 +29,8 @@
 public class SignUpData {
 
     @NotBlank
+    @Pattern(regexp = ValidationUtils.NAME_REGEX,
+        message = "{validation.error.username.pattern}")
     private String username;
 
     @NotBlank
@@ -38,6 +42,8 @@ public class SignUpData {
     private String emailCode;
 
     @NotBlank
+    @Pattern(regexp = ValidationUtils.PASSWORD_REGEX,
+        message = "{validation.error.password.pattern}")
     private String password;
 
     @NotBlank
@@ -79,9 +85,9 @@ public static SignUpData of(MultiValueMap<String, String> formData) {
 
         String message() default "";
 
-        Class<?>[] groups() default { };
+        Class<?>[] groups() default {};
 
-        Class<? extends Payload>[] payload() default { };
+        Class<? extends Payload>[] payload() default {};
 
     }
 
diff --git a/application/src/main/java/run/halo/app/core/user/service/UserServiceImpl.java b/application/src/main/java/run/halo/app/core/user/service/UserServiceImpl.java
index 982765cfb4..fb1b451244 100644
--- a/application/src/main/java/run/halo/app/core/user/service/UserServiceImpl.java
+++ b/application/src/main/java/run/halo/app/core/user/service/UserServiceImpl.java
@@ -33,8 +33,10 @@
 import run.halo.app.extension.router.selector.FieldSelector;
 import run.halo.app.infra.SystemConfigurableEnvironmentFetcher;
 import run.halo.app.infra.SystemSetting;
+import run.halo.app.infra.ValidationUtils;
 import run.halo.app.infra.exception.DuplicateNameException;
 import run.halo.app.infra.exception.EmailVerificationFailed;
+import run.halo.app.infra.exception.UnsatisfiedAttributeValueException;
 import run.halo.app.infra.exception.UserNotFoundException;
 
 @Service
@@ -86,6 +88,10 @@ public Mono<User> updatePassword(String username, String newPassword) {
 
     @Override
     public Mono<User> updateWithRawPassword(String username, String rawPassword) {
+        if (!ValidationUtils.PASSWORD_PATTERN.matcher(rawPassword).matches()) {
+            return Mono.error(
+                new UnsatisfiedAttributeValueException("validation.error.password.pattern"));
+        }
         return getUser(username)
             .filter(user -> {
                 if (!StringUtils.hasText(user.getSpec().getPassword())) {
diff --git a/application/src/main/java/run/halo/app/infra/ValidationUtils.java b/application/src/main/java/run/halo/app/infra/ValidationUtils.java
index 9ce908c365..01f20e567d 100644
--- a/application/src/main/java/run/halo/app/infra/ValidationUtils.java
+++ b/application/src/main/java/run/halo/app/infra/ValidationUtils.java
@@ -2,7 +2,6 @@
 
 import java.util.regex.Pattern;
 import lombok.experimental.UtilityClass;
-import org.apache.commons.lang3.StringUtils;
 
 @UtilityClass
 public class ValidationUtils {
@@ -11,36 +10,9 @@ public class ValidationUtils {
     public static final Pattern NAME_PATTERN = Pattern.compile(NAME_REGEX);
 
     /**
-     * No Chinese, no spaces.
+     * A-Z, a-z, 0-9, !@#$%^&* are allowed.
      */
-    public static final String PASSWORD_REGEX = "^(?!.*[\\u4e00-\\u9fa5])(?=\\S+$).+$";
+    public static final String PASSWORD_REGEX = "^[A-Za-z0-9!@#$%^&*]+$";
 
-    public static final String EMAIL_REGEX =
-        "^[a-zA-Z0-9_+&*-]+(?:\\.[a-zA-Z0-9_+&*-]+)*@(?:[a-zA-Z0-9-]+\\.)+[a-zA-Z]{2,7}$";
-
-    public static final String NAME_VALIDATION_MESSAGE = """
-        Super administrator username must be a valid subdomain name, the name must:
-        1. contain no more than 63 characters
-        2. contain only lowercase alphanumeric characters, '-' or '.'
-        3. start with an alphanumeric character
-        4. end with an alphanumeric character
-        """;
-
-    /**
-     * Validates the name.
-     *
-     * @param name name for validation
-     * @return true if the name is valid
-     */
-    public static boolean validateName(String name) {
-        if (StringUtils.isBlank(name)) {
-            return false;
-        }
-        boolean matches = NAME_PATTERN.matcher(name).matches();
-        return matches && name.length() <= 63;
-    }
-
-    public static boolean isValidEmail(String email) {
-        return StringUtils.isNotBlank(email) && email.matches(EMAIL_REGEX);
-    }
+    public static final Pattern PASSWORD_PATTERN = Pattern.compile(PASSWORD_REGEX);
 }
diff --git a/application/src/main/java/run/halo/app/infra/exception/UnsatisfiedAttributeValueException.java b/application/src/main/java/run/halo/app/infra/exception/UnsatisfiedAttributeValueException.java
index 4b74dd9985..bc960653d8 100644
--- a/application/src/main/java/run/halo/app/infra/exception/UnsatisfiedAttributeValueException.java
+++ b/application/src/main/java/run/halo/app/infra/exception/UnsatisfiedAttributeValueException.java
@@ -13,6 +13,10 @@
  */
 public class UnsatisfiedAttributeValueException extends ServerWebInputException {
 
+    public UnsatisfiedAttributeValueException(String reason) {
+        super(reason);
+    }
+
     public UnsatisfiedAttributeValueException(String reason, @Nullable String messageDetailCode,
         @Null Object[] messageDetailArguments) {
         super(reason, null, null, messageDetailCode, messageDetailArguments);
diff --git a/application/src/main/resources/config/i18n/messages.properties b/application/src/main/resources/config/i18n/messages.properties
index 1123fcc8fc..17b74dc769 100644
--- a/application/src/main/resources/config/i18n/messages.properties
+++ b/application/src/main/resources/config/i18n/messages.properties
@@ -88,5 +88,6 @@ title.visibility.identification.private=(Private)
 signup.error.confirm-password-not-match=The confirmation password does not match the password.
 signup.error.email-code.invalid=Invalid email code.
 
+validation.error.email.pattern=The email format is incorrect
 validation.error.username.pattern=The username can only be lowercase and can only contain letters, numbers, hyphens, and dots, starting and ending with characters.
-validation.error.password.pattern=The password cannot contain Chinese characters and spaces.
\ No newline at end of file
+validation.error.password.pattern=The password can only use uppercase and lowercase letters (A-Z, a-z), numbers (0-9), and the following special characters: !@#$%^&*
diff --git a/application/src/main/resources/config/i18n/messages_zh.properties b/application/src/main/resources/config/i18n/messages_zh.properties
index 3b5883143e..bf8c70faa5 100644
--- a/application/src/main/resources/config/i18n/messages_zh.properties
+++ b/application/src/main/resources/config/i18n/messages_zh.properties
@@ -61,5 +61,6 @@ title.visibility.identification.private=（私有）
 signup.error.confirm-password-not-match=确认密码与密码不匹配。
 signup.error.email-code.invalid=邮箱验证码无效。
 
+validation.error.email.pattern=邮箱格式不正确
 validation.error.username.pattern=用户名只能小写且只能包含字母、数字、中划线和点，以字符开头和结尾
-validation.error.password.pattern=密码不能包含中文和空格
\ No newline at end of file
+validation.error.password.pattern=密码只能使用大小写字母 (A-Z, a-z)、数字 (0-9)，以及以下特殊字符: !@#$%^&*
\ No newline at end of file
diff --git a/application/src/test/java/run/halo/app/core/endpoint/console/EmailVerificationCodeTest.java b/application/src/test/java/run/halo/app/core/endpoint/console/EmailVerificationCodeTest.java
index e5691d09c3..0421bb37b2 100644
--- a/application/src/test/java/run/halo/app/core/endpoint/console/EmailVerificationCodeTest.java
+++ b/application/src/test/java/run/halo/app/core/endpoint/console/EmailVerificationCodeTest.java
@@ -17,6 +17,7 @@
 import org.springframework.security.test.context.support.WithMockUser;
 import org.springframework.test.context.junit.jupiter.SpringExtension;
 import org.springframework.test.web.reactive.server.WebTestClient;
+import org.springframework.validation.Validator;
 import reactor.core.publisher.Mono;
 import run.halo.app.core.extension.User;
 import run.halo.app.core.user.service.EmailVerificationService;
@@ -50,6 +51,9 @@ class EmailVerificationCodeTest {
     @Mock
     RateLimiterRegistry rateLimiterRegistry;
 
+    @Mock
+    Validator validator;
+
     @InjectMocks
     UserEndpoint endpoint;
 
diff --git a/application/src/test/java/run/halo/app/core/user/service/UserServiceImplTest.java b/application/src/test/java/run/halo/app/core/user/service/UserServiceImplTest.java
index 93a93da7d1..d01bed46d5 100644
--- a/application/src/test/java/run/halo/app/core/user/service/UserServiceImplTest.java
+++ b/application/src/test/java/run/halo/app/core/user/service/UserServiceImplTest.java
@@ -44,6 +44,7 @@
 import run.halo.app.infra.SystemConfigurableEnvironmentFetcher;
 import run.halo.app.infra.SystemSetting;
 import run.halo.app.infra.exception.DuplicateNameException;
+import run.halo.app.infra.exception.UnsatisfiedAttributeValueException;
 import run.halo.app.infra.exception.UserNotFoundException;
 
 @ExtendWith(MockitoExtension.class)
@@ -116,25 +117,25 @@ class UpdateWithRawPasswordTest {
 
         @Test
         void shouldUpdatePasswordWithDifferentPassword() {
-            var oldUser = createUser("fake-password");
-            var newUser = createUser("new-password");
+            var oldUser = createUser("fake@password");
+            var newUser = createUser("new@password");
 
             when(client.get(User.class, "fake-user")).thenReturn(
                 Mono.just(oldUser));
             when(client.update(eq(oldUser))).thenReturn(Mono.just(newUser));
-            when(passwordEncoder.matches("new-password", "fake-password")).thenReturn(false);
-            when(passwordEncoder.encode("new-password")).thenReturn("encoded-new-password");
+            when(passwordEncoder.matches("new@password", "fake@password")).thenReturn(false);
+            when(passwordEncoder.encode("new@password")).thenReturn("encoded@new@password");
 
-            StepVerifier.create(userService.updateWithRawPassword("fake-user", "new-password"))
+            StepVerifier.create(userService.updateWithRawPassword("fake-user", "new@password"))
                 .expectNext(newUser)
                 .verifyComplete();
 
-            verify(passwordEncoder).matches("new-password", "fake-password");
-            verify(passwordEncoder).encode("new-password");
+            verify(passwordEncoder).matches("new@password", "fake@password");
+            verify(passwordEncoder).encode("new@password");
             verify(client).get(User.class, "fake-user");
             verify(client).update(argThat(extension -> {
                 var user = (User) extension;
-                return "encoded-new-password".equals(user.getSpec().getPassword());
+                return "encoded@new@password".equals(user.getSpec().getPassword());
             }));
             verify(eventPublisher).publishEvent(any(PasswordChangedEvent.class));
         }
@@ -142,21 +143,21 @@ void shouldUpdatePasswordWithDifferentPassword() {
         @Test
         void shouldUpdatePasswordIfNoPasswordBefore() {
             var oldUser = createUser(null);
-            var newUser = createUser("new-password");
+            var newUser = createUser("new@password");
 
             when(client.get(User.class, "fake-user")).thenReturn(Mono.just(oldUser));
             when(client.update(oldUser)).thenReturn(Mono.just(newUser));
-            when(passwordEncoder.encode("new-password")).thenReturn("encoded-new-password");
+            when(passwordEncoder.encode("new@password")).thenReturn("encoded@new@password");
 
-            StepVerifier.create(userService.updateWithRawPassword("fake-user", "new-password"))
+            StepVerifier.create(userService.updateWithRawPassword("fake-user", "new@password"))
                 .expectNext(newUser)
                 .verifyComplete();
 
-            verify(passwordEncoder, never()).matches("new-password", null);
-            verify(passwordEncoder).encode("new-password");
+            verify(passwordEncoder, never()).matches("new@password", null);
+            verify(passwordEncoder).encode("new@password");
             verify(client).update(argThat(extension -> {
                 var user = (User) extension;
-                return "encoded-new-password".equals(user.getSpec().getPassword());
+                return "encoded@new@password".equals(user.getSpec().getPassword());
             }));
             verify(client).get(User.class, "fake-user");
             verify(eventPublisher).publishEvent(any(PasswordChangedEvent.class));
@@ -166,16 +167,16 @@ void shouldUpdatePasswordIfNoPasswordBefore() {
         void shouldDoNothingIfPasswordNotChanged() {
             userService = spy(userService);
 
-            var oldUser = createUser("fake-password");
-            var newUser = createUser("new-password");
+            var oldUser = createUser("fake@password");
+            var newUser = createUser("new@password");
             when(client.get(User.class, "fake-user")).thenReturn(Mono.just(oldUser));
-            when(passwordEncoder.matches("fake-password", "fake-password")).thenReturn(true);
+            when(passwordEncoder.matches("fake@password", "fake@password")).thenReturn(true);
 
-            StepVerifier.create(userService.updateWithRawPassword("fake-user", "fake-password"))
+            StepVerifier.create(userService.updateWithRawPassword("fake-user", "fake@password"))
                 .expectNextCount(0)
                 .verifyComplete();
 
-            verify(passwordEncoder, times(1)).matches("fake-password", "fake-password");
+            verify(passwordEncoder, times(1)).matches("fake@password", "fake@password");
             verify(passwordEncoder, never()).encode(any());
             verify(client, never()).update(any());
             verify(client).get(User.class, "fake-user");
@@ -188,7 +189,7 @@ void shouldThrowExceptionIfUserNotFound() {
                 .thenReturn(Mono.error(
                     new ExtensionNotFoundException(fromExtension(User.class), "fake-user")));
 
-            StepVerifier.create(userService.updateWithRawPassword("fake-user", "new-password"))
+            StepVerifier.create(userService.updateWithRawPassword("fake-user", "new@password"))
                 .verifyError(UserNotFoundException.class);
 
             verify(passwordEncoder, never()).matches(anyString(), anyString());
@@ -197,6 +198,16 @@ void shouldThrowExceptionIfUserNotFound() {
             verify(client).get(User.class, "fake-user");
         }
 
+        @Test
+        void shouldThrowWhenPwdContainsInvalidChars() {
+            StepVerifier.create(userService.updateWithRawPassword("fake-user", "new-password"))
+                .expectError(UnsatisfiedAttributeValueException.class)
+                .verify();
+
+            verify(passwordEncoder, never()).encode(anyString());
+            verify(client, never()).update(any());
+        }
+
     }
 
     User createUser(String password) {
diff --git a/application/src/test/java/run/halo/app/infra/ValidationUtilsTest.java b/application/src/test/java/run/halo/app/infra/ValidationUtilsTest.java
index 6fa0991c31..1a3520fdcf 100644
--- a/application/src/test/java/run/halo/app/infra/ValidationUtilsTest.java
+++ b/application/src/test/java/run/halo/app/infra/ValidationUtilsTest.java
@@ -2,7 +2,6 @@
 
 import static org.assertj.core.api.Assertions.assertThat;
 
-import java.util.HashMap;
 import org.apache.commons.lang3.StringUtils;
 import org.junit.jupiter.api.Nested;
 import org.junit.jupiter.api.Test;
@@ -19,74 +18,50 @@ class ValidationUtilsTest {
     class NameValidationTest {
         @Test
         void nullName() {
-            assertThat(ValidationUtils.validateName(null)).isFalse();
+            assertThat(validateName(null)).isFalse();
         }
 
         @Test
         void emptyUsername() {
-            assertThat(ValidationUtils.validateName("")).isFalse();
+            assertThat(validateName("")).isFalse();
         }
 
         @Test
         void startWithIllegalCharacter() {
-            assertThat(ValidationUtils.validateName("-abc")).isFalse();
+            assertThat(validateName("-abc")).isFalse();
         }
 
         @Test
         void endWithIllegalCharacter() {
-            assertThat(ValidationUtils.validateName("abc-")).isFalse();
-            assertThat(ValidationUtils.validateName("abcD")).isFalse();
+            assertThat(validateName("abc-")).isFalse();
+            assertThat(validateName("abcD")).isFalse();
         }
 
         @Test
         void middleWithIllegalCharacter() {
-            assertThat(ValidationUtils.validateName("ab?c")).isFalse();
+            assertThat(validateName("ab?c")).isFalse();
         }
 
         @Test
         void moreThan63Characters() {
-            assertThat(ValidationUtils.validateName(StringUtils.repeat('a', 64))).isFalse();
+            assertThat(validateName(StringUtils.repeat('a', 64))).isFalse();
         }
 
         @Test
         void correctUsername() {
-            assertThat(ValidationUtils.validateName("abc")).isTrue();
-            assertThat(ValidationUtils.validateName("ab-c")).isTrue();
-            assertThat(ValidationUtils.validateName("1st")).isTrue();
-            assertThat(ValidationUtils.validateName("ast1")).isTrue();
-            assertThat(ValidationUtils.validateName("ast-1")).isTrue();
+            assertThat(validateName("abc")).isTrue();
+            assertThat(validateName("ab-c")).isTrue();
+            assertThat(validateName("1st")).isTrue();
+            assertThat(validateName("ast1")).isTrue();
+            assertThat(validateName("ast-1")).isTrue();
         }
-    }
-
-    @Test
-    void validateEmailTest() {
-        var cases = new HashMap<String, Boolean>();
-        // Valid cases
-        cases.put("simple@example.com", true);
-        cases.put("very.common@example.com", true);
-        cases.put("disposable.style.email.with+symbol@example.com", true);
-        cases.put("other.email-with-hyphen@example.com", true);
-        cases.put("fully-qualified-domain@example.com", true);
-        cases.put("user.name+tag+sorting@example.com", true);
-        cases.put("x@example.com", true);
-        cases.put("example-indeed@strange-example.com", true);
-        cases.put("example@s.example", true);
-        cases.put("john.doe@example.com", true);
-        cases.put("a.little.lengthy.but.fine@dept.example.com", true);
-        cases.put("123ada@halo.co", true);
-        cases.put("23ad@halo.top", true);
 
-        // Invalid cases
-        cases.put("Abc.example.com", false);
-        cases.put("admin@mailserver1", false);
-        cases.put("\" \"@example.org", false);
-        cases.put("A@b@c@example.com", false);
-        cases.put("a\"b(c)d,e:f;g<h>i[j\\k]l@example.com", false);
-        cases.put("just\"not\"right@example.com", false);
-        cases.put("this is\"not\\allowed@example.com", false);
-        cases.put("this\\ still\\\"not\\\\allowed@example.com", false);
-        cases.put("123456789012345678901234567890123456789012345", false);
-        cases.forEach((email, expected) -> assertThat(ValidationUtils.isValidEmail(email))
-            .isEqualTo(expected));
+        static boolean validateName(String name) {
+            if (StringUtils.isBlank(name)) {
+                return false;
+            }
+            boolean matches = ValidationUtils.NAME_PATTERN.matcher(name).matches();
+            return matches && name.length() <= 63;
+        }
     }
-}
\ No newline at end of file
+}

From d7aba834859d7cc9572eb48742f023aaff62f87c Mon Sep 17 00:00:00 2001
From: Ryan Wang <i@ryanc.cc>
Date: Thu, 10 Oct 2024 10:43:20 +0800
Subject: [PATCH 109/185] Refine password validation

---
 .../system/users/components/UserCreationModal.vue  |  9 +++++++--
 .../users/components/UserPasswordChangeModal.vue   | 14 ++++++++------
 ui/src/constants/regex.ts                          |  1 +
 ui/src/locales/en.yaml                             |  1 +
 ui/src/locales/zh-CN.yaml                          |  1 +
 ui/src/locales/zh-TW.yaml                          |  1 +
 .../profile/components/PasswordChangeModal.vue     | 14 ++++++++------
 7 files changed, 27 insertions(+), 14 deletions(-)
 create mode 100644 ui/src/constants/regex.ts

diff --git a/ui/console-src/modules/system/users/components/UserCreationModal.vue b/ui/console-src/modules/system/users/components/UserCreationModal.vue
index 5084f5e73b..5401b08594 100644
--- a/ui/console-src/modules/system/users/components/UserCreationModal.vue
+++ b/ui/console-src/modules/system/users/components/UserCreationModal.vue
@@ -12,6 +12,7 @@ import { Toast, VButton, VModal, VSpace } from "@halo-dev/components";
 import { setFocus } from "@/formkit/utils/focus";
 import { useQueryClient } from "@tanstack/vue-query";
 import { useI18n } from "vue-i18n";
+import { PASSWORD_REGEX } from "@/constants/regex";
 
 const { t } = useI18n();
 const queryClient = useQueryClient();
@@ -112,9 +113,13 @@ const handleCreateUser = async () => {
         :label="$t('core.user.change_password_modal.fields.new_password.label')"
         type="password"
         name="password"
-        validation="required:trim|length:5,100|matches:/^\S.*\S$/"
+        :validation="[
+          ['required'],
+          ['length', 5, 257],
+          ['matches', PASSWORD_REGEX],
+        ]"
         :validation-messages="{
-          matches: $t('core.formkit.validation.trim'),
+          matches: $t('core.formkit.validation.password'),
         }"
       ></FormKit>
       <FormKit
diff --git a/ui/console-src/modules/system/users/components/UserPasswordChangeModal.vue b/ui/console-src/modules/system/users/components/UserPasswordChangeModal.vue
index 15ae82248c..10b3ae2cf8 100644
--- a/ui/console-src/modules/system/users/components/UserPasswordChangeModal.vue
+++ b/ui/console-src/modules/system/users/components/UserPasswordChangeModal.vue
@@ -1,5 +1,6 @@
 <script lang="ts" setup>
 import SubmitButton from "@/components/button/SubmitButton.vue";
+import { PASSWORD_REGEX } from "@/constants/regex";
 import { setFocus } from "@/formkit/utils/focus";
 import type { User } from "@halo-dev/api-client";
 import { consoleApiClient } from "@halo-dev/api-client";
@@ -81,9 +82,13 @@ const handleChangePassword = async () => {
         :label="$t('core.user.change_password_modal.fields.new_password.label')"
         name="password"
         type="password"
-        validation="required:trim|length:5,100|matches:/^\S.*\S$/"
+        :validation="[
+          ['required'],
+          ['length', 5, 257],
+          ['matches', PASSWORD_REGEX],
+        ]"
         :validation-messages="{
-          matches: $t('core.formkit.validation.trim'),
+          matches: $t('core.formkit.validation.password'),
         }"
       ></FormKit>
       <FormKit
@@ -92,10 +97,7 @@ const handleChangePassword = async () => {
         "
         name="password_confirm"
         type="password"
-        validation="confirm|required:trim|length:5,100|matches:/^\S.*\S$/"
-        :validation-messages="{
-          matches: $t('core.formkit.validation.trim'),
-        }"
+        validation="confirm|required"
       ></FormKit>
     </FormKit>
     <template #footer>
diff --git a/ui/src/constants/regex.ts b/ui/src/constants/regex.ts
new file mode 100644
index 0000000000..4933d3ec5c
--- /dev/null
+++ b/ui/src/constants/regex.ts
@@ -0,0 +1 @@
+export const PASSWORD_REGEX = /^[A-Za-z0-9!@#$%^&*]+$/;
diff --git a/ui/src/locales/en.yaml b/ui/src/locales/en.yaml
index aa46cc72f8..981e0a6db5 100644
--- a/ui/src/locales/en.yaml
+++ b/ui/src/locales/en.yaml
@@ -1664,6 +1664,7 @@ core:
       creation_label: Create {text} tag
     validation:
       trim: Please remove the leading and trailing spaces
+      password: "The password can only use uppercase and lowercase letters (A-Z, a-z), numbers (0-9), and the following special characters: !{'@'}#$%^&*"
     verification_form:
       no_action_defined: "{label} interface not defined"
       verify_success: "{label} successful"
diff --git a/ui/src/locales/zh-CN.yaml b/ui/src/locales/zh-CN.yaml
index 145875729f..4d9140cd29 100644
--- a/ui/src/locales/zh-CN.yaml
+++ b/ui/src/locales/zh-CN.yaml
@@ -1557,6 +1557,7 @@ core:
       creation_label: 创建 {text} 标签
     validation:
       trim: 不能以空格开头或结尾
+      password: "密码只能使用大小写字母 (A-Z, a-z)、数字 (0-9)，以及以下特殊字符: !{'@'}#$%^&*"
     verification_form:
       no_action_defined: 未定义{label}接口
       verify_success: "{label}成功"
diff --git a/ui/src/locales/zh-TW.yaml b/ui/src/locales/zh-TW.yaml
index 4f3c2d022a..6b591117d6 100644
--- a/ui/src/locales/zh-TW.yaml
+++ b/ui/src/locales/zh-TW.yaml
@@ -1535,6 +1535,7 @@ core:
       creation_label: 創建 {text} 標籤
     validation:
       trim: 不能以空格開頭或結尾
+      password: "密碼只能使用大小寫字母 (A-Z, a-z)、數字 (0-9)，以及以下特殊字符: !{'@'}#$%^&*"
     verification_form:
       no_action_defined: 未定義{label}介面
       verify_success: "{label}成功"
diff --git a/ui/uc-src/modules/profile/components/PasswordChangeModal.vue b/ui/uc-src/modules/profile/components/PasswordChangeModal.vue
index 5f5ed02f9a..3414a0973d 100644
--- a/ui/uc-src/modules/profile/components/PasswordChangeModal.vue
+++ b/ui/uc-src/modules/profile/components/PasswordChangeModal.vue
@@ -1,5 +1,6 @@
 <script lang="ts" setup>
 import SubmitButton from "@/components/button/SubmitButton.vue";
+import { PASSWORD_REGEX } from "@/constants/regex";
 import { setFocus } from "@/formkit/utils/focus";
 import { consoleApiClient } from "@halo-dev/api-client";
 import { VButton, VModal, VSpace } from "@halo-dev/components";
@@ -81,9 +82,13 @@ const handleChangePassword = async () => {
         "
         name="password"
         type="password"
-        validation="required:trim|length:5,100|matches:/^\S.*\S$/"
+        :validation="[
+          ['required'],
+          ['length', 5, 257],
+          ['matches', PASSWORD_REGEX],
+        ]"
         :validation-messages="{
-          matches: $t('core.formkit.validation.trim'),
+          matches: $t('core.formkit.validation.password'),
         }"
       ></FormKit>
       <FormKit
@@ -94,10 +99,7 @@ const handleChangePassword = async () => {
         "
         name="password_confirm"
         type="password"
-        validation="confirm|required:trim|length:5,100|matches:/^\S.*\S$/"
-        :validation-messages="{
-          matches: $t('core.formkit.validation.trim'),
-        }"
+        validation="confirm|required"
       ></FormKit>
     </FormKit>
     <template #footer>

From 9cbd9b23d0dd2a7c6bf60660783130f4b600e5d1 Mon Sep 17 00:00:00 2001
From: Ryan Wang <i@ryanc.cc>
Date: Thu, 10 Oct 2024 11:05:00 +0800
Subject: [PATCH 110/185] fix: username length validation in user creation form
 is not working (#6806)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/area ui
/kind bug
/milestone 2.20.x

#### What this PR does / why we need it:

修复创建用户表单的用户名长度校验不生效的问题。

#### Does this PR introduce a user-facing change?

```release-note
修复创建用户表单的用户名长度校验不生效的问题。
```
---
 .../modules/system/users/components/UserCreationModal.vue       | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ui/console-src/modules/system/users/components/UserCreationModal.vue b/ui/console-src/modules/system/users/components/UserCreationModal.vue
index 5401b08594..37a7e4f050 100644
--- a/ui/console-src/modules/system/users/components/UserCreationModal.vue
+++ b/ui/console-src/modules/system/users/components/UserCreationModal.vue
@@ -84,7 +84,7 @@ const handleCreateUser = async () => {
         name="name"
         :validation="[
           ['required'],
-          ['length:0,63'],
+          ['length', 0, 63],
           [
             'matches',
             /^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$/,

From 9e3f77baf37bea93d476a3a9d813ddf670c30970 Mon Sep 17 00:00:00 2001
From: guqing <38999863+guqing@users.noreply.github.com>
Date: Thu, 10 Oct 2024 13:27:00 +0800
Subject: [PATCH 111/185] fix: avoid NPE by skipping nonexistent notifiers in
 user preferences (#6811)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?
/kind improvement
/area core
/milestone 2.20.x

#### What this PR does / why we need it:
修复当用户通知偏好设置中出现不存在的通知器名称时会导致 NPE 的问题

此问题可能发生在，通知器由插件或者专业版提供并且修改了偏好设置后禁用了插件或切换到开源版导致找不到该通知器的记录

#### Does this PR introduce a user-facing change?
```release-note
None
```
---
 .../endpoint/UserNotificationPreferencesEndpoint.java        | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/application/src/main/java/run/halo/app/notification/endpoint/UserNotificationPreferencesEndpoint.java b/application/src/main/java/run/halo/app/notification/endpoint/UserNotificationPreferencesEndpoint.java
index d3d7be08ab..8c3757be0a 100644
--- a/application/src/main/java/run/halo/app/notification/endpoint/UserNotificationPreferencesEndpoint.java
+++ b/application/src/main/java/run/halo/app/notification/endpoint/UserNotificationPreferencesEndpoint.java
@@ -174,6 +174,11 @@ Mono<ReasonTypeNotifierMatrix> listReasonTypeNotifierMatrix(String username) {
                             var notifierNames =
                                 reasonTypeNotifierMap.getNotifiers(reasonType.name());
                             for (String notifierName : notifierNames) {
+                                // Skip if the notifier enabled in the user preference does not
+                                // exist to avoid null index
+                                if (!notifierIndexMap.containsKey(notifierName)) {
+                                    continue;
+                                }
                                 var notifierIndex = notifierIndexMap.get(notifierName);
                                 stateMatrix[reasonTypeIndex][notifierIndex] = true;
                             }

From cae871f9e6797033f8dd0c56603a7ba0f9fcb0e1 Mon Sep 17 00:00:00 2001
From: John Niang <johnniang@foxmail.com>
Date: Thu, 10 Oct 2024 13:43:00 +0800
Subject: [PATCH 112/185] Fix the problem of accessing logout page without
 authentication (#6812)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/kind bug
/area core
/milestone 2.20.x

#### What this PR does / why we need it:

Currently, logout page is always visible for anyone whether the user is authenticated. This PR restricts the visibility of logout page to authenticated users but anonymous users.

#### Special notes for your reviewer:

```bash
> http http://localhost:8090/logout

HTTP/1.1 302 Found
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Expires: 0
Location: /login?authentication_required
Pragma: no-cache
Referrer-Policy: strict-origin-when-cross-origin
Vary: Origin
Vary: Access-Control-Request-Method
Vary: Access-Control-Request-Headers
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 0
content-length: 0
```

#### Does this PR introduce a user-facing change?

```release-note
修复未登录情况下依然能够访问登出页面的问题
```
---
 .../authorization/AuthorizationExchangeConfigurers.java  | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/application/src/main/java/run/halo/app/security/authorization/AuthorizationExchangeConfigurers.java b/application/src/main/java/run/halo/app/security/authorization/AuthorizationExchangeConfigurers.java
index e59f8fec41..d89391b02f 100644
--- a/application/src/main/java/run/halo/app/security/authorization/AuthorizationExchangeConfigurers.java
+++ b/application/src/main/java/run/halo/app/security/authorization/AuthorizationExchangeConfigurers.java
@@ -59,8 +59,7 @@ SecurityConfigurer preAuthenticationAuthorizationConfigurer() {
             "/login/**",
             "/challenges/**",
             "/password-reset/**",
-            "/signup",
-            "/logout"
+            "/signup"
         ).permitAll());
     }
 
@@ -69,7 +68,11 @@ SecurityConfigurer preAuthenticationAuthorizationConfigurer() {
     SecurityConfigurer authenticatedAuthorizationConfigurer() {
         // Anonymous user is not allowed
         return http -> http.authorizeExchange(
-            spec -> spec.pathMatchers("/console/**", "/uc/**").authenticated()
+            spec -> spec.pathMatchers(
+                "/console/**",
+                "/uc/**",
+                "/logout"
+            ).authenticated()
         );
     }
 

From 01a781c54aaefc74993dcee0d07a3c25ec016b55 Mon Sep 17 00:00:00 2001
From: Ryan Wang <i@ryanc.cc>
Date: Thu, 10 Oct 2024 15:17:00 +0800
Subject: [PATCH 113/185] feat: improve password confirmation validation for
 forms (#6807)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/area core
/kind improvement
/milestone 2.20.x

#### What this PR does / why we need it:

完善部分表单的确定密码校验。

1. 封装单独的校验函数。
2. 完善 i18n。

<img width="676" alt="image" src="https://github.com/user-attachments/assets/af8a4edc-d6ba-419f-b7ba-baa9d488186d">

#### Does this PR introduce a user-facing change?

```release-note
None
```
---
 .../src/main/resources/static/js/main.js      | 16 +++++++++
 .../gateway_modules/common_fragments.html     |  1 +
 .../common_fragments.properties               |  1 +
 .../common_fragments_en.properties            |  1 +
 .../common_fragments_es.properties            |  1 +
 .../common_fragments_zh_TW.properties         |  1 +
 .../gateway_modules/form_fragments.html       | 22 +++++-------
 .../src/main/resources/templates/setup.html   | 34 +++++++++----------
 8 files changed, 46 insertions(+), 31 deletions(-)

diff --git a/application/src/main/resources/static/js/main.js b/application/src/main/resources/static/js/main.js
index 727b25abf4..241caa097b 100644
--- a/application/src/main/resources/static/js/main.js
+++ b/application/src/main/resources/static/js/main.js
@@ -151,3 +151,19 @@ document.addEventListener("DOMContentLoaded", () => {
         }
     });
 });
+
+function setupPasswordConfirmation(passwordId, confirmPasswordId) {
+    const password = document.getElementById(passwordId);
+    const confirmPassword = document.getElementById(confirmPasswordId);
+
+    function validatePasswordMatch() {
+        if (password.value !== confirmPassword.value) {
+            confirmPassword.setCustomValidity(i18nResources.passwordConfirmationFailed);
+        } else {
+            confirmPassword.setCustomValidity("");
+        }
+    }
+
+    password.addEventListener("change", validatePasswordMatch);
+    confirmPassword.addEventListener("input", validatePasswordMatch);
+}
diff --git a/application/src/main/resources/templates/gateway_modules/common_fragments.html b/application/src/main/resources/templates/gateway_modules/common_fragments.html
index ba19048ce6..d434cd39d8 100644
--- a/application/src/main/resources/templates/gateway_modules/common_fragments.html
+++ b/application/src/main/resources/templates/gateway_modules/common_fragments.html
@@ -8,6 +8,7 @@
         const i18nResources = {
             sendVerificationCodeSuccess: `[(#{js.sendVerificationCode.success})]`,
             sendVerificationCodeFailed: `[(#{js.sendVerificationCode.failed})]`,
+            passwordConfirmationFailed: `[(#{js.passwordConfirmation.failed})]`
         };
     </script>
 
diff --git a/application/src/main/resources/templates/gateway_modules/common_fragments.properties b/application/src/main/resources/templates/gateway_modules/common_fragments.properties
index 20c55fde01..22053bc75c 100644
--- a/application/src/main/resources/templates/gateway_modules/common_fragments.properties
+++ b/application/src/main/resources/templates/gateway_modules/common_fragments.properties
@@ -1,6 +1,7 @@
 socialLogin.label=社交登录
 js.sendVerificationCode.success=发送成功
 js.sendVerificationCode.failed=发送失败，请稍后再试
+js.passwordConfirmation.failed=确认密码不匹配
 
 signupNotice.description=没有账号？
 signupNotice.link=立即注册
diff --git a/application/src/main/resources/templates/gateway_modules/common_fragments_en.properties b/application/src/main/resources/templates/gateway_modules/common_fragments_en.properties
index 8b8a620e24..70af7ab8db 100644
--- a/application/src/main/resources/templates/gateway_modules/common_fragments_en.properties
+++ b/application/src/main/resources/templates/gateway_modules/common_fragments_en.properties
@@ -1,6 +1,7 @@
 socialLogin.label=Social Login
 js.sendVerificationCode.success=Sent Successfully
 js.sendVerificationCode.failed=Sending Failed, Please Try Again Later
+js.passwordConfirmation.failed=Password confirmation does not match
 
 signupNotice.description=Don't have an account?
 signupNotice.link=Sign up
diff --git a/application/src/main/resources/templates/gateway_modules/common_fragments_es.properties b/application/src/main/resources/templates/gateway_modules/common_fragments_es.properties
index 00349a8bff..db6c8cef4f 100644
--- a/application/src/main/resources/templates/gateway_modules/common_fragments_es.properties
+++ b/application/src/main/resources/templates/gateway_modules/common_fragments_es.properties
@@ -1,6 +1,7 @@
 socialLogin.label=Inicio de Sesión Social
 js.sendVerificationCode.success=Enviado con éxito
 js.sendVerificationCode.failed=Error al enviar, por favor intente nuevamente más tarde
+js.passwordConfirmation.failed=La confirmación de la contraseña no coincide
 
 signupNotice.description=¿No tienes una cuenta?
 signupNotice.link=Regístrate ahora
diff --git a/application/src/main/resources/templates/gateway_modules/common_fragments_zh_TW.properties b/application/src/main/resources/templates/gateway_modules/common_fragments_zh_TW.properties
index d86fbc733c..63129e1666 100644
--- a/application/src/main/resources/templates/gateway_modules/common_fragments_zh_TW.properties
+++ b/application/src/main/resources/templates/gateway_modules/common_fragments_zh_TW.properties
@@ -1,6 +1,7 @@
 socialLogin.label=社交登入
 js.sendVerificationCode.success=發送成功
 js.sendVerificationCode.failed=發送失敗，請稍後再試
+js.passwordConfirmation.failed=確認密碼不匹配
 
 signupNotice.description=沒有帳號？
 signupNotice.link=立即註冊
diff --git a/application/src/main/resources/templates/gateway_modules/form_fragments.html b/application/src/main/resources/templates/gateway_modules/form_fragments.html
index 133d2b52fa..641943a95f 100644
--- a/application/src/main/resources/templates/gateway_modules/form_fragments.html
+++ b/application/src/main/resources/templates/gateway_modules/form_fragments.html
@@ -153,19 +153,7 @@
 
     <script th:inline="javascript">
         document.addEventListener("DOMContentLoaded", function () {
-            var password = document.getElementById("password"),
-                confirm_password = document.getElementById("confirmPassword");
-
-            function validatePassword() {
-                if (password.value != confirm_password.value) {
-                    confirm_password.setCustomValidity("Passwords Don't Match");
-                } else {
-                    confirm_password.setCustomValidity("");
-                }
-            }
-
-            password.onchange = validatePassword;
-            confirm_password.onkeyup = validatePassword;
+            setupPasswordConfirmation("password", "confirmPassword");
         });
     </script>
 
@@ -269,6 +257,12 @@
     <div class="form-item">
         <button type="submit" th:text="#{form.passwordResetLink.submit}"></button>
     </div>
+
+    <script th:inline="javascript">
+        document.addEventListener("DOMContentLoaded", function () {
+            setupPasswordConfirmation("password", "confirmPassword");
+        });
+    </script>
 </form>
 
 <th:block th:fragment="passwordReset">
@@ -294,4 +288,4 @@
             <button type="submit" th:text="#{form.passwordReset.submit}"></button>
         </div>
     </form>
-</th:block>
\ No newline at end of file
+</th:block>
diff --git a/application/src/main/resources/templates/setup.html b/application/src/main/resources/templates/setup.html
index 3bc8788b61..2cf354f456 100644
--- a/application/src/main/resources/templates/setup.html
+++ b/application/src/main/resources/templates/setup.html
@@ -35,7 +35,11 @@ <h1 class="form-title" th:text="#{title}"></h1>
                                 autofocus
                             />
                         </div>
-                        <p class="alert alert-error" th:if="${#fields.hasErrors('siteTitle')}" th:errors="*{siteTitle}"></p>
+                        <p
+                            class="alert alert-error"
+                            th:if="${#fields.hasErrors('siteTitle')}"
+                            th:errors="*{siteTitle}"
+                        ></p>
                     </div>
 
                     <div class="form-item">
@@ -55,7 +59,11 @@ <h1 class="form-title" th:text="#{title}"></h1>
                                 required
                             />
                         </div>
-                        <p class="alert alert-error" th:if="${#fields.hasErrors('username')}" th:errors="*{username}"></p>
+                        <p
+                            class="alert alert-error"
+                            th:if="${#fields.hasErrors('username')}"
+                            th:errors="*{username}"
+                        ></p>
                     </div>
 
                     <div class="form-item">
@@ -81,7 +89,11 @@ <h1 class="form-title" th:text="#{title}"></h1>
                         <th:block
                             th:replace="~{gateway_modules/input_fragments :: password(id = 'password', name = 'password', required = 'true', minlength = 5, maxlength = 257, enableToggle = true)}"
                         ></th:block>
-                        <p class="alert alert-error" th:if="${#fields.hasErrors('password')}" th:errors="*{password}"></p>
+                        <p
+                            class="alert alert-error"
+                            th:if="${#fields.hasErrors('password')}"
+                            th:errors="*{password}"
+                        ></p>
                     </div>
 
                     <div class="form-item">
@@ -102,20 +114,8 @@ <h1 class="form-title" th:text="#{title}"></h1>
 
         <script th:inline="javascript">
             document.addEventListener("DOMContentLoaded", function () {
-                var password = document.getElementById("password"),
-                    confirm_password = document.getElementById("confirmPassword");
-
-                function validatePassword() {
-                    if (password.value != confirm_password.value) {
-                        confirm_password.setCustomValidity("Passwords Don't Match");
-                    } else {
-                        confirm_password.setCustomValidity("");
-                    }
-                }
-
-                password.onchange = validatePassword;
-                confirm_password.onkeyup = validatePassword;
+                setupPasswordConfirmation("password", "confirmPassword");
             });
         </script>
     </th:block>
-</html>
\ No newline at end of file
+</html>

From 2b3badc8e13a907d3dd5cca37daaf67e4c2ff498 Mon Sep 17 00:00:00 2001
From: Ryan Wang <i@ryanc.cc>
Date: Thu, 10 Oct 2024 15:33:00 +0800
Subject: [PATCH 114/185] refactor: update login-related page templates
 structure (#6813)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/area core
/kind improvement
/milestone 2.20.x

#### What this PR does / why we need it:

重构登录、注册相关的模板结构，主要目的是为了解耦，修改页面时仅修改相关的模板和语言文件。

重构之后主题的引用方式如下：

login.html

```html
<div th:replace="~{gateway_fragments/login::form}"></div>
```

#### Special notes for your reviewer:

需要测试各个页面是否功能正常

#### Does this PR introduce a user-facing change?

```release-note
None
```
---
 .../templates/challenges/two-factor/totp.html |   6 +-
 .../common.html}                              |   4 +-
 .../common.properties}                        |   0
 .../common_en.properties}                     |   0
 .../common_es.properties}                     |   0
 .../common_zh_TW.properties}                  |   0
 .../input.html}                               |   0
 .../layout.html                               |   2 +-
 .../templates/gateway_fragments/login.html    |  57 ++++
 .../gateway_fragments/login.properties        |  12 +
 .../gateway_fragments/login_en.properties     |  12 +
 .../gateway_fragments/login_es.properties     |  12 +
 .../gateway_fragments/login_zh_TW.properties  |  12 +
 .../templates/gateway_fragments/logout.html   |   5 +
 .../gateway_fragments/logout.properties       |   1 +
 .../gateway_fragments/logout_en.properties    |   1 +
 .../gateway_fragments/logout_es.properties    |   1 +
 .../gateway_fragments/logout_zh_TW.properties |   1 +
 .../password_reset_email_reset.html           |  34 ++
 .../password_reset_email_reset.properties     |   4 +
 .../password_reset_email_reset_en.properties  |   4 +
 .../password_reset_email_reset_es.properties  |   4 +
 ...assword_reset_email_reset_zh_TW.properties |   4 +
 .../password_reset_email_send.html            |  24 ++
 .../password_reset_email_send.properties      |   4 +
 .../password_reset_email_send_en.properties   |   4 +
 .../password_reset_email_send_es.properties   |   4 +
 ...password_reset_email_send_zh_TW.properties |   4 +
 .../templates/gateway_fragments/signup.html   | 156 ++++++++++
 .../gateway_fragments/signup.properties       |  12 +
 .../gateway_fragments/signup_en.properties    |  12 +
 .../gateway_fragments/signup_es.properties    |  12 +
 .../gateway_fragments/signup_zh_TW.properties |  12 +
 .../templates/gateway_fragments/totp.html     |  30 ++
 .../gateway_fragments/totp.properties         |   3 +
 .../gateway_fragments/totp_en.properties      |   3 +
 .../gateway_fragments/totp_es.properties      |   3 +
 .../gateway_fragments/totp_zh_TW.properties   |   3 +
 .../gateway_modules/form_fragments.html       | 291 ------------------
 .../gateway_modules/form_fragments.properties |  36 ---
 .../form_fragments_en.properties              |  36 ---
 .../form_fragments_es.properties              |  36 ---
 .../form_fragments_zh_TW.properties           |  36 ---
 .../gateway_modules/login_fragments.html      |  20 --
 .../login_fragments.properties                |   4 -
 .../login_fragments_en.properties             |   4 -
 .../login_fragments_es.properties             |   4 -
 .../login_fragments_zh_TW.properties          |   4 -
 .../src/main/resources/templates/login.html   |  16 +-
 .../main/resources/templates/login_local.html |   2 +-
 .../src/main/resources/templates/logout.html  |   4 +-
 .../templates/password-reset/email/reset.html |   8 +-
 .../templates/password-reset/email/send.html  |  10 +-
 .../src/main/resources/templates/setup.html   |  10 +-
 .../src/main/resources/templates/signup.html  |  14 +-
 55 files changed, 488 insertions(+), 509 deletions(-)
 rename application/src/main/resources/templates/{gateway_modules/common_fragments.html => gateway_fragments/common.html} (97%)
 rename application/src/main/resources/templates/{gateway_modules/common_fragments.properties => gateway_fragments/common.properties} (100%)
 rename application/src/main/resources/templates/{gateway_modules/common_fragments_en.properties => gateway_fragments/common_en.properties} (100%)
 rename application/src/main/resources/templates/{gateway_modules/common_fragments_es.properties => gateway_fragments/common_es.properties} (100%)
 rename application/src/main/resources/templates/{gateway_modules/common_fragments_zh_TW.properties => gateway_fragments/common_zh_TW.properties} (100%)
 rename application/src/main/resources/templates/{gateway_modules/input_fragments.html => gateway_fragments/input.html} (100%)
 rename application/src/main/resources/templates/{gateway_modules => gateway_fragments}/layout.html (90%)
 create mode 100644 application/src/main/resources/templates/gateway_fragments/login.html
 create mode 100644 application/src/main/resources/templates/gateway_fragments/login.properties
 create mode 100644 application/src/main/resources/templates/gateway_fragments/login_en.properties
 create mode 100644 application/src/main/resources/templates/gateway_fragments/login_es.properties
 create mode 100644 application/src/main/resources/templates/gateway_fragments/login_zh_TW.properties
 create mode 100644 application/src/main/resources/templates/gateway_fragments/logout.html
 create mode 100644 application/src/main/resources/templates/gateway_fragments/logout.properties
 create mode 100644 application/src/main/resources/templates/gateway_fragments/logout_en.properties
 create mode 100644 application/src/main/resources/templates/gateway_fragments/logout_es.properties
 create mode 100644 application/src/main/resources/templates/gateway_fragments/logout_zh_TW.properties
 create mode 100644 application/src/main/resources/templates/gateway_fragments/password_reset_email_reset.html
 create mode 100644 application/src/main/resources/templates/gateway_fragments/password_reset_email_reset.properties
 create mode 100644 application/src/main/resources/templates/gateway_fragments/password_reset_email_reset_en.properties
 create mode 100644 application/src/main/resources/templates/gateway_fragments/password_reset_email_reset_es.properties
 create mode 100644 application/src/main/resources/templates/gateway_fragments/password_reset_email_reset_zh_TW.properties
 create mode 100644 application/src/main/resources/templates/gateway_fragments/password_reset_email_send.html
 create mode 100644 application/src/main/resources/templates/gateway_fragments/password_reset_email_send.properties
 create mode 100644 application/src/main/resources/templates/gateway_fragments/password_reset_email_send_en.properties
 create mode 100644 application/src/main/resources/templates/gateway_fragments/password_reset_email_send_es.properties
 create mode 100644 application/src/main/resources/templates/gateway_fragments/password_reset_email_send_zh_TW.properties
 create mode 100644 application/src/main/resources/templates/gateway_fragments/signup.html
 create mode 100644 application/src/main/resources/templates/gateway_fragments/signup.properties
 create mode 100644 application/src/main/resources/templates/gateway_fragments/signup_en.properties
 create mode 100644 application/src/main/resources/templates/gateway_fragments/signup_es.properties
 create mode 100644 application/src/main/resources/templates/gateway_fragments/signup_zh_TW.properties
 create mode 100644 application/src/main/resources/templates/gateway_fragments/totp.html
 create mode 100644 application/src/main/resources/templates/gateway_fragments/totp.properties
 create mode 100644 application/src/main/resources/templates/gateway_fragments/totp_en.properties
 create mode 100644 application/src/main/resources/templates/gateway_fragments/totp_es.properties
 create mode 100644 application/src/main/resources/templates/gateway_fragments/totp_zh_TW.properties
 delete mode 100644 application/src/main/resources/templates/gateway_modules/form_fragments.html
 delete mode 100644 application/src/main/resources/templates/gateway_modules/form_fragments.properties
 delete mode 100644 application/src/main/resources/templates/gateway_modules/form_fragments_en.properties
 delete mode 100644 application/src/main/resources/templates/gateway_modules/form_fragments_es.properties
 delete mode 100644 application/src/main/resources/templates/gateway_modules/form_fragments_zh_TW.properties
 delete mode 100644 application/src/main/resources/templates/gateway_modules/login_fragments.html
 delete mode 100644 application/src/main/resources/templates/gateway_modules/login_fragments.properties
 delete mode 100644 application/src/main/resources/templates/gateway_modules/login_fragments_en.properties
 delete mode 100644 application/src/main/resources/templates/gateway_modules/login_fragments_es.properties
 delete mode 100644 application/src/main/resources/templates/gateway_modules/login_fragments_zh_TW.properties

diff --git a/application/src/main/resources/templates/challenges/two-factor/totp.html b/application/src/main/resources/templates/challenges/two-factor/totp.html
index 7b02af8ab1..062ef511da 100644
--- a/application/src/main/resources/templates/challenges/two-factor/totp.html
+++ b/application/src/main/resources/templates/challenges/two-factor/totp.html
@@ -1,14 +1,14 @@
 <!doctype html>
 <html
     xmlns:th="https://www.thymeleaf.org"
-    th:replace="~{gateway_modules/layout :: layout(title = |#{title} - ${site.title}|, head = null, body = ~{::body})}"
+    th:replace="~{gateway_fragments/layout :: layout(title = |#{title} - ${site.title}|, head = null, body = ~{::body})}"
 >
     <th:block th:fragment="body">
         <div class="gateway-wrapper">
-            <div th:replace="~{gateway_modules/common_fragments::haloLogo}"></div>
+            <div th:replace="~{gateway_fragments/common::haloLogo}"></div>
             <div class="halo-form-wrapper">
                 <h1 class="form-title" th:text="#{title}"></h1>
-                <form th:replace="~{gateway_modules/form_fragments::totp}"></form>
+                <form th:replace="~{gateway_fragments/totp::form}"></form>
             </div>
         </div>
     </th:block>
diff --git a/application/src/main/resources/templates/gateway_modules/common_fragments.html b/application/src/main/resources/templates/gateway_fragments/common.html
similarity index 97%
rename from application/src/main/resources/templates/gateway_modules/common_fragments.html
rename to application/src/main/resources/templates/gateway_fragments/common.html
index d434cd39d8..50e23ebdd0 100644
--- a/application/src/main/resources/templates/gateway_modules/common_fragments.html
+++ b/application/src/main/resources/templates/gateway_fragments/common.html
@@ -1,6 +1,6 @@
 <th:block th:fragment="basicStaticResources">
-    <th:block th:replace="~{gateway_modules/common_fragments::basicStyleResources}"></th:block>
-    <th:block th:replace="~{gateway_modules/common_fragments::basicScriptResources}"></th:block>
+    <th:block th:replace="~{gateway_fragments/common::basicStyleResources}"></th:block>
+    <th:block th:replace="~{gateway_fragments/common::basicScriptResources}"></th:block>
 </th:block>
 
 <th:block th:fragment="basicScriptResources">
diff --git a/application/src/main/resources/templates/gateway_modules/common_fragments.properties b/application/src/main/resources/templates/gateway_fragments/common.properties
similarity index 100%
rename from application/src/main/resources/templates/gateway_modules/common_fragments.properties
rename to application/src/main/resources/templates/gateway_fragments/common.properties
diff --git a/application/src/main/resources/templates/gateway_modules/common_fragments_en.properties b/application/src/main/resources/templates/gateway_fragments/common_en.properties
similarity index 100%
rename from application/src/main/resources/templates/gateway_modules/common_fragments_en.properties
rename to application/src/main/resources/templates/gateway_fragments/common_en.properties
diff --git a/application/src/main/resources/templates/gateway_modules/common_fragments_es.properties b/application/src/main/resources/templates/gateway_fragments/common_es.properties
similarity index 100%
rename from application/src/main/resources/templates/gateway_modules/common_fragments_es.properties
rename to application/src/main/resources/templates/gateway_fragments/common_es.properties
diff --git a/application/src/main/resources/templates/gateway_modules/common_fragments_zh_TW.properties b/application/src/main/resources/templates/gateway_fragments/common_zh_TW.properties
similarity index 100%
rename from application/src/main/resources/templates/gateway_modules/common_fragments_zh_TW.properties
rename to application/src/main/resources/templates/gateway_fragments/common_zh_TW.properties
diff --git a/application/src/main/resources/templates/gateway_modules/input_fragments.html b/application/src/main/resources/templates/gateway_fragments/input.html
similarity index 100%
rename from application/src/main/resources/templates/gateway_modules/input_fragments.html
rename to application/src/main/resources/templates/gateway_fragments/input.html
diff --git a/application/src/main/resources/templates/gateway_modules/layout.html b/application/src/main/resources/templates/gateway_fragments/layout.html
similarity index 90%
rename from application/src/main/resources/templates/gateway_modules/layout.html
rename to application/src/main/resources/templates/gateway_fragments/layout.html
index f82bb0db5b..1bcbfaad3d 100644
--- a/application/src/main/resources/templates/gateway_modules/layout.html
+++ b/application/src/main/resources/templates/gateway_fragments/layout.html
@@ -13,7 +13,7 @@
         <link rel="preload" href="/images/wordmark.svg" as="image" type="image/svg+xml" />
         <link rel="preload" href="/images/logo.png" as="image" type="image/png" />
 
-        <th:block th:replace="~{gateway_modules/common_fragments::basicStaticResources}"></th:block>
+        <th:block th:replace="~{gateway_fragments/common::basicStaticResources}"></th:block>
 
         <th:block th:if="${head != null}">
             <th:block th:replace="${head}" />
diff --git a/application/src/main/resources/templates/gateway_fragments/login.html b/application/src/main/resources/templates/gateway_fragments/login.html
new file mode 100644
index 0000000000..07ada8fbba
--- /dev/null
+++ b/application/src/main/resources/templates/gateway_fragments/login.html
@@ -0,0 +1,57 @@
+<form
+        th:fragment="form"
+        class="halo-form"
+        name="login-form"
+        id="login-form"
+        th:action="${authProvider.spec.authenticationUrl}"
+        th:method="${authProvider.spec.method}"
+>
+    <div class="alert alert-error" role="alert" th:if="${param.error.size() > 0}" th:with="error = ${param.error[0]}">
+        <strong th:if="${error == 'invalid-credential'}">
+            <span th:text="#{form.error.invalidCredential}"></span>
+        </strong>
+        <strong th:if="${error == 'rate-limit-exceeded'}">
+            <span th:text="#{form.error.rateLimitExceeded}"></span>
+        </strong>
+    </div>
+    <div class="alert" role="alert" th:if="${param.logout.size() > 0}">
+        <strong th:text="#{form.messages.logoutSuccess}"></strong>
+    </div>
+    <div class="alert" role="alert" th:if="${param.signup.size() > 0}">
+        <strong th:text="#{form.messages.signupSuccess}"></strong>
+    </div>
+    <div class="alert" role="alert" th:if="${param.oauth2_bind.size() > 0}">
+        <strong th:text="#{form.messages.oauth2Bind}"></strong>
+    </div>
+
+    <div th:replace="~{__${fragmentTemplateName}__::form}"></div>
+
+    <div th:if="${authProvider.spec.rememberMeSupport}" class="form-item-compact">
+        <input type="checkbox" id="remember-me" name="remember-me" value="true" />
+        <label for="remember-me" th:text="#{form.rememberMe.label}"></label>
+    </div>
+
+    <div class="form-item">
+        <button type="submit" th:text="#{form.submit}"></button>
+    </div>
+</form>
+
+<div th:remove="tag" th:fragment="formAuthProviders">
+    <th:block th:unless="${#lists.isEmpty(formAuthProviders)}">
+        <div class="divider-wrapper">
+            <hr />
+            <th:block th:text="#{otherLogin.label}"></th:block>
+            <hr />
+        </div>
+        <ul class="pill-items">
+            <li th:each="provider : ${formAuthProviders}">
+                <a th:href="'/login?method=' + ${provider.metadata.name}">
+                    <img th:src="${provider.spec.logo}" />
+                    <span
+                        th:text="${#messages.msgOrNull('formAuthProviders.' + provider.metadata.name + '.displayName') ?: provider.spec.displayName}"
+                    ></span>
+                </a>
+            </li>
+        </ul>
+    </th:block>
+</div>
\ No newline at end of file
diff --git a/application/src/main/resources/templates/gateway_fragments/login.properties b/application/src/main/resources/templates/gateway_fragments/login.properties
new file mode 100644
index 0000000000..a6fd816a8a
--- /dev/null
+++ b/application/src/main/resources/templates/gateway_fragments/login.properties
@@ -0,0 +1,12 @@
+form.messages.logoutSuccess=登出成功。
+form.messages.signupSuccess=恭喜！注册成功，请立即登录。
+form.messages.oauth2Bind=当前登录未绑定账号，请尝试通过其他方式登录，登录成功后会自动绑定账号。
+form.error.invalidCredential=无效的凭证。
+form.error.rateLimitExceeded=请求过于频繁，请稍后再试。
+form.rememberMe.label=保持登录会话
+form.submit=登录
+
+otherLogin.label=其他登录方式
+
+# Rule: `formAuthProviders.${provider.metadata.name}.displayName`
+formAuthProviders.local.displayName=账号密码登录
\ No newline at end of file
diff --git a/application/src/main/resources/templates/gateway_fragments/login_en.properties b/application/src/main/resources/templates/gateway_fragments/login_en.properties
new file mode 100644
index 0000000000..0b4829362f
--- /dev/null
+++ b/application/src/main/resources/templates/gateway_fragments/login_en.properties
@@ -0,0 +1,12 @@
+form.messages.logoutSuccess=Logout successfully.
+form.messages.signupSuccess=Congratulations! Sign up successfully, please login now.
+form.messages.oauth2Bind=The current login is not bound to an account. Please try to log in through other methods. After successful login, the account will be automatically bound.
+form.error.invalidCredential=Invalid credentials.
+form.error.rateLimitExceeded=Too many requests, please try again later.
+form.rememberMe.label=Remember me
+form.submit=Login
+
+otherLogin.label=Other Login
+
+# Rule: `formAuthProviders.${provider.metadata.name}.displayName`
+formAuthProviders.local.displayName=Login with credentials
\ No newline at end of file
diff --git a/application/src/main/resources/templates/gateway_fragments/login_es.properties b/application/src/main/resources/templates/gateway_fragments/login_es.properties
new file mode 100644
index 0000000000..d81ad60bc4
--- /dev/null
+++ b/application/src/main/resources/templates/gateway_fragments/login_es.properties
@@ -0,0 +1,12 @@
+form.messages.logoutSuccess=Cierre de sesión exitoso.
+form.messages.signupSuccess=¡Felicidades! Registro exitoso, por favor inicie sesión de inmediato.
+form.messages.oauth2Bind=El inicio de sesión actual no está vinculado a una cuenta. Intente iniciar sesión a través de otros métodos. Después de un inicio de sesión exitoso, la cuenta se vinculará automáticamente.
+form.error.invalidCredential=Credenciales inválidas.
+form.error.rateLimitExceeded=Demasiadas solicitudes, por favor intente nuevamente más tarde.
+form.rememberMe.label=Mantener sesión iniciada
+form.submit=Iniciar sesión
+
+otherLogin.label=Otras formas de inicio de sesión
+
+# Rule: `formAuthProviders.${provider.metadata.name}.displayName`
+formAuthProviders.local.displayName=Iniciar sesión con credenciales
\ No newline at end of file
diff --git a/application/src/main/resources/templates/gateway_fragments/login_zh_TW.properties b/application/src/main/resources/templates/gateway_fragments/login_zh_TW.properties
new file mode 100644
index 0000000000..c364adb352
--- /dev/null
+++ b/application/src/main/resources/templates/gateway_fragments/login_zh_TW.properties
@@ -0,0 +1,12 @@
+form.messages.logoutSuccess=登出成功。
+form.messages.signupSuccess=恭喜！註冊成功，請立即登入。
+form.messages.oauth2Bind=當前登入未綁定至帳戶。請嘗試通過其他方法登入。成功登入後，帳戶將自動綁定。
+form.error.invalidCredential=無效的憑證。
+form.error.rateLimitExceeded=請求過於頻繁，請稍後再試。
+form.form.rememberMe.label=保持登入會話
+form.form.submit=登入
+
+otherLogin.label=其他登入方式
+
+# Rule: `formAuthProviders.${provider.metadata.name}.displayName`
+formAuthProviders.local.displayName=帳號密碼登入
\ No newline at end of file
diff --git a/application/src/main/resources/templates/gateway_fragments/logout.html b/application/src/main/resources/templates/gateway_fragments/logout.html
new file mode 100644
index 0000000000..84013bb58c
--- /dev/null
+++ b/application/src/main/resources/templates/gateway_fragments/logout.html
@@ -0,0 +1,5 @@
+<form th:fragment="form" class="halo-form" id="logout-form" name="logout-form" th:action="@{/logout}" method="post">
+    <div class="form-item">
+        <button type="submit" th:text="#{form.submit}"></button>
+    </div>
+</form>
\ No newline at end of file
diff --git a/application/src/main/resources/templates/gateway_fragments/logout.properties b/application/src/main/resources/templates/gateway_fragments/logout.properties
new file mode 100644
index 0000000000..0ad6b90f08
--- /dev/null
+++ b/application/src/main/resources/templates/gateway_fragments/logout.properties
@@ -0,0 +1 @@
+form.submit=退出登录
\ No newline at end of file
diff --git a/application/src/main/resources/templates/gateway_fragments/logout_en.properties b/application/src/main/resources/templates/gateway_fragments/logout_en.properties
new file mode 100644
index 0000000000..6f8a3da34f
--- /dev/null
+++ b/application/src/main/resources/templates/gateway_fragments/logout_en.properties
@@ -0,0 +1 @@
+form.submit=Logout
\ No newline at end of file
diff --git a/application/src/main/resources/templates/gateway_fragments/logout_es.properties b/application/src/main/resources/templates/gateway_fragments/logout_es.properties
new file mode 100644
index 0000000000..3fda0b0f14
--- /dev/null
+++ b/application/src/main/resources/templates/gateway_fragments/logout_es.properties
@@ -0,0 +1 @@
+form.submit=Cerrar Sesión
\ No newline at end of file
diff --git a/application/src/main/resources/templates/gateway_fragments/logout_zh_TW.properties b/application/src/main/resources/templates/gateway_fragments/logout_zh_TW.properties
new file mode 100644
index 0000000000..2cbbd75231
--- /dev/null
+++ b/application/src/main/resources/templates/gateway_fragments/logout_zh_TW.properties
@@ -0,0 +1 @@
+form.submit=退出登入
\ No newline at end of file
diff --git a/application/src/main/resources/templates/gateway_fragments/password_reset_email_reset.html b/application/src/main/resources/templates/gateway_fragments/password_reset_email_reset.html
new file mode 100644
index 0000000000..231a10990b
--- /dev/null
+++ b/application/src/main/resources/templates/gateway_fragments/password_reset_email_reset.html
@@ -0,0 +1,34 @@
+<form
+        th:fragment="form"
+        class="halo-form"
+        th:action="@{/password-reset/email/{resetToken}(resetToken=${resetToken})}"
+        method="post"
+>
+    <div class="alert alert-error" role="alert" th:if="${error}">
+        <strong th:text="${error}"></strong>
+    </div>
+    <div class="form-item">
+        <label for="password" th:text="#{form.password.label}">Password</label>
+        <th:block
+                th:replace="~{gateway_fragments/input :: password(id = 'password', name = 'password', required = 'true', minlength = 5, maxlength = 257, enableToggle = true)}"
+        ></th:block>
+    </div>
+    <div class="form-item">
+        <label for="confirmPassword" th:text="#{form.confirmPassword.label}">Confirm Password</label>
+        <th:block
+                th:replace="~{gateway_fragments/input :: password(id = 'confirmPassword', name = 'confirmPassword', required = 'true', minlength = 5, maxlength = 257, enableToggle = true)}"
+        ></th:block>
+    </div>
+    <div class="form-item">
+        <div class="alert" th:text="#{form.password.tips}"></div>
+    </div>
+    <div class="form-item">
+        <button type="submit" th:text="#{form.submit}"></button>
+    </div>
+
+    <script th:inline="javascript">
+        document.addEventListener("DOMContentLoaded", function () {
+            setupPasswordConfirmation("password", "confirmPassword");
+        });
+    </script>
+</form>
\ No newline at end of file
diff --git a/application/src/main/resources/templates/gateway_fragments/password_reset_email_reset.properties b/application/src/main/resources/templates/gateway_fragments/password_reset_email_reset.properties
new file mode 100644
index 0000000000..c8240e54e7
--- /dev/null
+++ b/application/src/main/resources/templates/gateway_fragments/password_reset_email_reset.properties
@@ -0,0 +1,4 @@
+form.password.label=密码
+form.confirmPassword.label=确认密码
+form.password.tips=密码必须至少包含 8 个字符，并且至少包含一个大写字母、一个小写字母、一个数字和一个特殊字符。
+form.submit=修改密码
\ No newline at end of file
diff --git a/application/src/main/resources/templates/gateway_fragments/password_reset_email_reset_en.properties b/application/src/main/resources/templates/gateway_fragments/password_reset_email_reset_en.properties
new file mode 100644
index 0000000000..a69e1b81df
--- /dev/null
+++ b/application/src/main/resources/templates/gateway_fragments/password_reset_email_reset_en.properties
@@ -0,0 +1,4 @@
+form.password.label=Password
+form.confirmPassword.label=Confirm Password
+form.password.tips=Password must be at least 8 characters long and contain at least one uppercase letter, one lowercase letter, one number, and one special character.
+form.submit=Change password
\ No newline at end of file
diff --git a/application/src/main/resources/templates/gateway_fragments/password_reset_email_reset_es.properties b/application/src/main/resources/templates/gateway_fragments/password_reset_email_reset_es.properties
new file mode 100644
index 0000000000..7c34bdbeec
--- /dev/null
+++ b/application/src/main/resources/templates/gateway_fragments/password_reset_email_reset_es.properties
@@ -0,0 +1,4 @@
+form.password.label=Contraseña
+form.confirmPassword.label=Confirmar Contraseña
+form.password.tips=La contraseña debe tener al menos 8 caracteres e incluir al menos una letra mayúscula, una letra minúscula, un número y un carácter especial.
+form.submit=Cambiar Contraseña
\ No newline at end of file
diff --git a/application/src/main/resources/templates/gateway_fragments/password_reset_email_reset_zh_TW.properties b/application/src/main/resources/templates/gateway_fragments/password_reset_email_reset_zh_TW.properties
new file mode 100644
index 0000000000..84d58c2aa7
--- /dev/null
+++ b/application/src/main/resources/templates/gateway_fragments/password_reset_email_reset_zh_TW.properties
@@ -0,0 +1,4 @@
+form.password.label=密碼
+form.confirmPassword.label=確認密碼
+form.password.tips=密碼必須至少包含 8 個字元，並且至少包含一個大寫字母、一個小寫字母、一個數字和一個特殊字元。
+form.submit=修改密碼
\ No newline at end of file
diff --git a/application/src/main/resources/templates/gateway_fragments/password_reset_email_send.html b/application/src/main/resources/templates/gateway_fragments/password_reset_email_send.html
new file mode 100644
index 0000000000..ed9264ad2f
--- /dev/null
+++ b/application/src/main/resources/templates/gateway_fragments/password_reset_email_send.html
@@ -0,0 +1,24 @@
+<th:block th:fragment="form">
+    <form th:if="${sent}" method="get" action="/login" class="halo-form">
+        <div class="form-item">
+            <div class="alert" th:text="#{form.message.success}"></div>
+        </div>
+        <div class="form-item">
+            <button type="submit" th:text="#{form.sent.submit}"></button>
+        </div>
+    </form>
+    <form th:unless="${sent}" class="halo-form" th:action="@{/password-reset/email}" method="post">
+        <div class="alert alert-error" th:if="${error}">
+            <strong th:text="${error}"></strong>
+        </div>
+        <div class="form-item">
+            <label for="email" th:text="#{form.email.label}"></label>
+            <div class="form-input">
+                <input type="email" id="email" name="email" autofocus required />
+            </div>
+        </div>
+        <div class="form-item">
+            <button type="submit" th:text="#{form.submit}"></button>
+        </div>
+    </form>
+</th:block>
\ No newline at end of file
diff --git a/application/src/main/resources/templates/gateway_fragments/password_reset_email_send.properties b/application/src/main/resources/templates/gateway_fragments/password_reset_email_send.properties
new file mode 100644
index 0000000000..5c4461f2a6
--- /dev/null
+++ b/application/src/main/resources/templates/gateway_fragments/password_reset_email_send.properties
@@ -0,0 +1,4 @@
+form.email.label=电子邮箱
+form.submit=提交
+form.sent.submit=返回到登录页面
+form.message.success=检查您的电子邮件中是否有重置密码的链接。如果几分钟内没有出现，请检查您的垃圾邮件文件夹。
\ No newline at end of file
diff --git a/application/src/main/resources/templates/gateway_fragments/password_reset_email_send_en.properties b/application/src/main/resources/templates/gateway_fragments/password_reset_email_send_en.properties
new file mode 100644
index 0000000000..62151a89b4
--- /dev/null
+++ b/application/src/main/resources/templates/gateway_fragments/password_reset_email_send_en.properties
@@ -0,0 +1,4 @@
+form.email.label=Email
+form.submit=Submit
+form.sent.submit=Return to login
+form.message.success=Check your email for a link to reset your password. If it doesn’t appear within a few minutes, check your spam folder.
\ No newline at end of file
diff --git a/application/src/main/resources/templates/gateway_fragments/password_reset_email_send_es.properties b/application/src/main/resources/templates/gateway_fragments/password_reset_email_send_es.properties
new file mode 100644
index 0000000000..0944f68310
--- /dev/null
+++ b/application/src/main/resources/templates/gateway_fragments/password_reset_email_send_es.properties
@@ -0,0 +1,4 @@
+form.email.label=Correo Electrónico
+form.submit=Enviar
+form.sent.submit=Volver a la Página de Inicio de Sesión
+form.message.success=Revisa tu correo electrónico para ver el enlace de restablecimiento de contraseña. Si no aparece en unos minutos, revisa tu carpeta de spam.
\ No newline at end of file
diff --git a/application/src/main/resources/templates/gateway_fragments/password_reset_email_send_zh_TW.properties b/application/src/main/resources/templates/gateway_fragments/password_reset_email_send_zh_TW.properties
new file mode 100644
index 0000000000..f908f1299c
--- /dev/null
+++ b/application/src/main/resources/templates/gateway_fragments/password_reset_email_send_zh_TW.properties
@@ -0,0 +1,4 @@
+form.email.label=電子郵件
+form.submit=提交
+form.sent.submit=返回到登入頁面
+form.message.success=檢查您的電子郵件中是否有重置密碼的連結。如果幾分鐘內沒有出現，請檢查您的垃圾郵件資料夾。
\ No newline at end of file
diff --git a/application/src/main/resources/templates/gateway_fragments/signup.html b/application/src/main/resources/templates/gateway_fragments/signup.html
new file mode 100644
index 0000000000..d31b722c35
--- /dev/null
+++ b/application/src/main/resources/templates/gateway_fragments/signup.html
@@ -0,0 +1,156 @@
+<form
+        th:fragment="form"
+        class="halo-form"
+        name="signup-form"
+        id="signup-form"
+        th:action="@{/signup}"
+        th:object="${form}"
+        method="post"
+>
+    <div class="alert alert-error" role="alert" th:if="${error == 'invalid-email-code'}">
+        <strong>
+            <span th:text="#{form.error.invalidEmailCode}"></span>
+        </strong>
+    </div>
+    <div class="alert alert-error" role="alert" th:if="${error == 'rate-limit-exceeded'}">
+        <strong>
+            <span th:text="#{form.error.rateLimitExceeded}"></span>
+        </strong>
+    </div>
+    <div class="alert alert-error" role="alert" th:if="${error == 'duplicate-username'}">
+        <strong>
+            <span th:text="#{form.error.duplicateUsername}"></span>
+        </strong>
+    </div>
+    <div class="form-item-group">
+        <div class="form-item">
+            <label for="username" th:text="#{form.username.label}"></label>
+            <div class="form-input">
+                <input
+                        type="text"
+                        id="username"
+                        name="username"
+                        autocomplete="off"
+                        spellcheck="false"
+                        autocorrect="off"
+                        autocapitalize="off"
+                        autofocus
+                        required
+                        th:field="*{username}"
+                />
+            </div>
+            <p class="alert alert-error" th:if="${#fields.hasErrors('username')}" th:errors="*{username}"></p>
+        </div>
+
+        <div class="form-item">
+            <label for="displayName" th:text="#{form.displayName.label}"></label>
+            <div class="form-input">
+                <input
+                        type="text"
+                        id="displayName"
+                        name="displayName"
+                        autocomplete="off"
+                        spellcheck="false"
+                        autocorrect="off"
+                        autocapitalize="off"
+                        required
+                        th:field="*{displayName}"
+                />
+            </div>
+            <p class="alert alert-error" th:if="${#fields.hasErrors('displayName')}" th:errors="*{displayName}"></p>
+        </div>
+    </div>
+
+    <div class="form-item-group">
+        <div class="form-item">
+            <label for="email" th:text="#{form.email.label}"></label>
+            <div class="form-input">
+                <input
+                        type="email"
+                        id="email"
+                        name="email"
+                        autocomplete="off"
+                        spellcheck="false"
+                        autocorrect="off"
+                        autocapitalize="off"
+                        required
+                        th:field="*{email}"
+                />
+            </div>
+            <p class="alert alert-error" th:if="${#fields.hasErrors('email')}" th:errors="*{email}"></p>
+        </div>
+
+        <div class="form-item" th:if="${globalInfo.mustVerifyEmailOnRegistration}">
+            <label for="emailCode" th:text="#{form.emailCode.label}"></label>
+            <div class="form-input-group">
+                <div class="form-input">
+                    <input type="text" inputmode="numeric" pattern="\d*" id="emailCode" name="emailCode" required />
+                </div>
+
+                <button id="emailCodeSendButton" type="button" th:text="#{form.emailCode.sendButton}"></button>
+            </div>
+            <p class="alert alert-error" th:if="${#fields.hasErrors('emailCode')}" th:errors="*{emailCode}"></p>
+        </div>
+    </div>
+
+    <div class="form-item">
+        <label for="password" th:text="#{form.password.label}"></label>
+        <th:block
+                th:replace="~{gateway_fragments/input :: password(id = 'password', name = 'password', required = 'true', minlength = 5, maxlength = 257, enableToggle = true)}"
+        ></th:block>
+        <p class="alert alert-error" th:if="${#fields.hasErrors('password')}" th:errors="*{password}"></p>
+    </div>
+
+    <div class="form-item">
+        <label for="confirmPassword" th:text="#{form.confirmPassword.label}"></label>
+        <th:block
+                th:replace="~{gateway_fragments/input :: password(id = 'confirmPassword', name = 'confirmPassword', required = 'true', minlength = 5, maxlength = 257, enableToggle = true)}"
+        ></th:block>
+        <p class="alert alert-error" th:if="${#fields.hasErrors('confirmPassword')}" th:errors="*{confirmPassword}"></p>
+    </div>
+
+    <div class="form-item">
+        <button type="submit" th:text="#{form.submit}"></button>
+    </div>
+
+    <script th:inline="javascript">
+        document.addEventListener("DOMContentLoaded", function () {
+            setupPasswordConfirmation("password", "confirmPassword");
+        });
+    </script>
+
+    <script th:if="${globalInfo.mustVerifyEmailOnRegistration}" th:inline="javascript">
+        document.addEventListener("DOMContentLoaded", function () {
+            function sendRequest() {
+                return new Promise((resolve, reject) => {
+                    const email = document.getElementById("email").value;
+
+                    if (!email) {
+                        throw new Error(/*[[#{form.signup.emailCode.send.emptyValidation}]]*/"");
+                    }
+
+                    fetch("/signup/send-email-code", {
+                        method: "POST",
+                        body: JSON.stringify({ email: email }),
+                        headers: {
+                            "Content-Type": "application/json",
+                            [[${_csrf.headerName}]]: [[${_csrf.token}]],
+                        },
+                    })
+                        .then((response) => {
+                            if (response.ok) {
+                                resolve(response);
+                            }
+                            reject(response);
+                        })
+                        .catch((e) => {
+                            reject(e);
+                        });
+                });
+            }
+
+            const emailCodeSendButton = document.getElementById("emailCodeSendButton");
+            sendVerificationCode(emailCodeSendButton, sendRequest);
+        });
+    </script>
+</form>
\ No newline at end of file
diff --git a/application/src/main/resources/templates/gateway_fragments/signup.properties b/application/src/main/resources/templates/gateway_fragments/signup.properties
new file mode 100644
index 0000000000..d5275f7614
--- /dev/null
+++ b/application/src/main/resources/templates/gateway_fragments/signup.properties
@@ -0,0 +1,12 @@
+form.username.label=用户名
+form.displayName.label=名称
+form.email.label=电子邮箱
+form.emailCode.label=邮箱验证码
+form.emailCode.sendButton=发送
+form.emailCode.send.emptyValidation=请先输入邮箱地址
+form.password.label=密码
+form.confirmPassword.label=确认密码
+form.submit=注册
+form.error.invalidEmailCode=无效的邮箱验证码
+form.error.duplicateUsername=用户名已经被注册
+form.error.rateLimitExceeded=请求过于频繁，请稍后再试
\ No newline at end of file
diff --git a/application/src/main/resources/templates/gateway_fragments/signup_en.properties b/application/src/main/resources/templates/gateway_fragments/signup_en.properties
new file mode 100644
index 0000000000..3d56c1fca3
--- /dev/null
+++ b/application/src/main/resources/templates/gateway_fragments/signup_en.properties
@@ -0,0 +1,12 @@
+form.username.label=Username
+form.displayName.label=Display Name
+form.email.label=Email
+form.emailCode.label=Email Verification Code
+form.emailCode.sendButton=Send
+form.emailCode.send.emptyValidation=Please enter your email address first
+form.password.label=Password
+form.confirmPassword.label=Confirm Password
+form.submit=Sign Up
+form.error.invalidEmailCode=Invalid Email Verification Code
+form.error.duplicateUsername=Username is already taken
+form.error.rateLimitExceeded=Too many requests, please try again later
\ No newline at end of file
diff --git a/application/src/main/resources/templates/gateway_fragments/signup_es.properties b/application/src/main/resources/templates/gateway_fragments/signup_es.properties
new file mode 100644
index 0000000000..9ebb2bcbc0
--- /dev/null
+++ b/application/src/main/resources/templates/gateway_fragments/signup_es.properties
@@ -0,0 +1,12 @@
+form.username.label=Nombre de Usuario
+form.displayName.label=Nombre
+form.email.label=Correo Electrónico
+form.emailCode.label=Código de Verificación
+form.emailCode.sendButton=Enviar
+form.emailCode.send.emptyValidation=Por favor, introduce tu dirección de correo electrónico primero
+form.password.label=Contraseña
+form.confirmPassword.label=Confirmar Contraseña
+form.submit=Registrarse
+form.error.invalidEmailCode=Código de verificación del correo inválido
+form.error.duplicateUsername=El nombre de usuario ya está registrado
+form.error.rateLimitExceeded=Demasiadas solicitudes, por favor intente nuevamente más tarde
\ No newline at end of file
diff --git a/application/src/main/resources/templates/gateway_fragments/signup_zh_TW.properties b/application/src/main/resources/templates/gateway_fragments/signup_zh_TW.properties
new file mode 100644
index 0000000000..5135787d07
--- /dev/null
+++ b/application/src/main/resources/templates/gateway_fragments/signup_zh_TW.properties
@@ -0,0 +1,12 @@
+form.username.label=使用者名稱
+form.displayName.label=名稱
+form.email.label=電子郵件
+form.emailCode.label=郵箱驗證碼
+form.emailCode.sendButton=發送
+form.emailCode.send.emptyValidation=請先輸入電子郵件地址
+form.password.label=密碼
+form.confirmPassword.label=確認密碼
+form.submit=註冊
+form.error.invalidEmailCode=無效的郵箱驗證碼
+form.error.duplicateUsername=使用者名稱已經被註冊
+form.error.rateLimitExceeded=請求過於頻繁，請稍後再試
\ No newline at end of file
diff --git a/application/src/main/resources/templates/gateway_fragments/totp.html b/application/src/main/resources/templates/gateway_fragments/totp.html
new file mode 100644
index 0000000000..6cb2b78097
--- /dev/null
+++ b/application/src/main/resources/templates/gateway_fragments/totp.html
@@ -0,0 +1,30 @@
+<form
+        th:fragment="form"
+        class="halo-form"
+        th:action="@{/challenges/two-factor/totp}"
+        name="two-factor-form"
+        id="two-factor-form"
+        method="post"
+>
+    <div class="alert alert-error" role="alert" th:if="${param.error.size() > 0}">
+        <strong th:text="#{form.messages.invalidError}"></strong>
+    </div>
+    <div class="form-item">
+        <label for="code" th:text="#{form.code.label}"></label>
+        <div class="form-input">
+            <input
+                    type="text"
+                    inputmode="numeric"
+                    id="code"
+                    name="code"
+                    autocomplete="one-time-code"
+                    pattern="\d{6}"
+                    autofocus
+                    required
+            />
+        </div>
+    </div>
+    <div class="form-item">
+        <button type="submit" th:text="#{form.submit}"></button>
+    </div>
+</form>
\ No newline at end of file
diff --git a/application/src/main/resources/templates/gateway_fragments/totp.properties b/application/src/main/resources/templates/gateway_fragments/totp.properties
new file mode 100644
index 0000000000..d2115d37ea
--- /dev/null
+++ b/application/src/main/resources/templates/gateway_fragments/totp.properties
@@ -0,0 +1,3 @@
+form.messages.invalidError=错误的验证码
+form.code.label=验证码
+form.submit=验证
\ No newline at end of file
diff --git a/application/src/main/resources/templates/gateway_fragments/totp_en.properties b/application/src/main/resources/templates/gateway_fragments/totp_en.properties
new file mode 100644
index 0000000000..f9c456fa7c
--- /dev/null
+++ b/application/src/main/resources/templates/gateway_fragments/totp_en.properties
@@ -0,0 +1,3 @@
+form.messages.invalidError=Invalid TOTP code
+form.code.label=TOTP Code
+form.submit=Verify
\ No newline at end of file
diff --git a/application/src/main/resources/templates/gateway_fragments/totp_es.properties b/application/src/main/resources/templates/gateway_fragments/totp_es.properties
new file mode 100644
index 0000000000..2dbc8b4683
--- /dev/null
+++ b/application/src/main/resources/templates/gateway_fragments/totp_es.properties
@@ -0,0 +1,3 @@
+form.messages.invalidError=Código de verificación incorrecto
+form.code.label=Código de Verificación
+form.submit=Verificar
\ No newline at end of file
diff --git a/application/src/main/resources/templates/gateway_fragments/totp_zh_TW.properties b/application/src/main/resources/templates/gateway_fragments/totp_zh_TW.properties
new file mode 100644
index 0000000000..9c06d0cf48
--- /dev/null
+++ b/application/src/main/resources/templates/gateway_fragments/totp_zh_TW.properties
@@ -0,0 +1,3 @@
+form.messages.invalidError=錯誤的驗證碼
+form.code.label=驗證碼
+form.submit=驗證
\ No newline at end of file
diff --git a/application/src/main/resources/templates/gateway_modules/form_fragments.html b/application/src/main/resources/templates/gateway_modules/form_fragments.html
deleted file mode 100644
index 641943a95f..0000000000
--- a/application/src/main/resources/templates/gateway_modules/form_fragments.html
+++ /dev/null
@@ -1,291 +0,0 @@
-<form
-    th:fragment="login"
-    class="halo-form"
-    name="login-form"
-    id="login-form"
-    th:action="${authProvider.spec.authenticationUrl}"
-    th:method="${authProvider.spec.method}"
->
-    <div class="alert alert-error" role="alert" th:if="${param.error.size() > 0}" th:with="error = ${param.error[0]}">
-        <strong th:if="${error == 'invalid-credential'}">
-            <span th:text="#{form.login.error.invalidCredential}"></span>
-        </strong>
-        <strong th:if="${error == 'rate-limit-exceeded'}">
-            <span th:text="#{form.login.error.rateLimitExceeded}"></span>
-        </strong>
-    </div>
-    <div class="alert" role="alert" th:if="${param.logout.size() > 0}">
-        <strong th:text="#{form.login.messages.logoutSuccess}"></strong>
-    </div>
-    <div class="alert" role="alert" th:if="${param.signup.size() > 0}">
-        <strong th:text="#{form.login.messages.signupSuccess}"></strong>
-    </div>
-    <div class="alert" role="alert" th:if="${param.oauth2_bind.size() > 0}">
-        <strong th:text="#{form.login.messages.oauth2Bind}"></strong>
-    </div>
-
-    <div th:replace="~{__${fragmentTemplateName}__::form}"></div>
-
-    <div th:if="${authProvider.spec.rememberMeSupport}" class="form-item-compact">
-        <input type="checkbox" id="remember-me" name="remember-me" value="true" />
-        <label for="remember-me" th:text="#{form.login.rememberMe.label}"></label>
-    </div>
-
-    <div class="form-item">
-        <button type="submit" th:text="#{form.login.submit}"></button>
-    </div>
-</form>
-
-<form
-    th:fragment="signup"
-    class="halo-form"
-    name="signup-form"
-    id="signup-form"
-    th:action="@{/signup}"
-    th:object="${form}"
-    method="post"
->
-    <div class="alert alert-error" role="alert" th:if="${error == 'invalid-email-code'}">
-        <strong>
-            <span th:text="#{form.signup.error.invalidEmailCode}"></span>
-        </strong>
-    </div>
-    <div class="alert alert-error" role="alert" th:if="${error == 'rate-limit-exceeded'}">
-        <strong>
-            <span th:text="#{form.signup.error.rateLimitExceeded}"></span>
-        </strong>
-    </div>
-    <div class="alert alert-error" role="alert" th:if="${error == 'duplicate-username'}">
-        <strong>
-            <span th:text="#{form.signup.error.duplicateUsername}"></span>
-        </strong>
-    </div>
-    <div class="form-item-group">
-        <div class="form-item">
-            <label for="username" th:text="#{form.signup.username.label}"></label>
-            <div class="form-input">
-                <input
-                    type="text"
-                    id="username"
-                    name="username"
-                    autocomplete="off"
-                    spellcheck="false"
-                    autocorrect="off"
-                    autocapitalize="off"
-                    autofocus
-                    required
-                    th:field="*{username}"
-                />
-            </div>
-            <p class="alert alert-error" th:if="${#fields.hasErrors('username')}" th:errors="*{username}"></p>
-        </div>
-
-        <div class="form-item">
-            <label for="displayName" th:text="#{form.signup.displayName.label}"></label>
-            <div class="form-input">
-                <input
-                    type="text"
-                    id="displayName"
-                    name="displayName"
-                    autocomplete="off"
-                    spellcheck="false"
-                    autocorrect="off"
-                    autocapitalize="off"
-                    required
-                    th:field="*{displayName}"
-                />
-            </div>
-            <p class="alert alert-error" th:if="${#fields.hasErrors('displayName')}" th:errors="*{displayName}"></p>
-        </div>
-    </div>
-
-    <div class="form-item-group">
-        <div class="form-item">
-            <label for="email" th:text="#{form.signup.email.label}"></label>
-            <div class="form-input">
-                <input
-                    type="email"
-                    id="email"
-                    name="email"
-                    autocomplete="off"
-                    spellcheck="false"
-                    autocorrect="off"
-                    autocapitalize="off"
-                    required
-                    th:field="*{email}"
-                />
-            </div>
-            <p class="alert alert-error" th:if="${#fields.hasErrors('email')}" th:errors="*{email}"></p>
-        </div>
-
-        <div class="form-item" th:if="${globalInfo.mustVerifyEmailOnRegistration}">
-            <label for="emailCode" th:text="#{form.signup.emailCode.label}"></label>
-            <div class="form-input-group">
-                <div class="form-input">
-                    <input type="text" inputmode="numeric" pattern="\d*" id="emailCode" name="emailCode" required />
-                </div>
-
-                <button id="emailCodeSendButton" type="button" th:text="#{form.signup.emailCode.sendButton}"></button>
-            </div>
-            <p class="alert alert-error" th:if="${#fields.hasErrors('emailCode')}" th:errors="*{emailCode}"></p>
-        </div>
-    </div>
-
-    <div class="form-item">
-        <label for="password" th:text="#{form.signup.password.label}"></label>
-        <th:block
-            th:replace="~{gateway_modules/input_fragments :: password(id = 'password', name = 'password', required = 'true', minlength = 5, maxlength = 257, enableToggle = true)}"
-        ></th:block>
-        <p class="alert alert-error" th:if="${#fields.hasErrors('password')}" th:errors="*{password}"></p>
-    </div>
-
-    <div class="form-item">
-        <label for="confirmPassword" th:text="#{form.signup.confirmPassword.label}"></label>
-        <th:block
-            th:replace="~{gateway_modules/input_fragments :: password(id = 'confirmPassword', name = 'confirmPassword', required = 'true', minlength = 5, maxlength = 257, enableToggle = true)}"
-        ></th:block>
-        <p class="alert alert-error" th:if="${#fields.hasErrors('confirmPassword')}" th:errors="*{confirmPassword}"></p>
-    </div>
-
-    <div class="form-item">
-        <button type="submit" th:text="#{form.signup.submit}"></button>
-    </div>
-
-    <script th:inline="javascript">
-        document.addEventListener("DOMContentLoaded", function () {
-            setupPasswordConfirmation("password", "confirmPassword");
-        });
-    </script>
-
-    <script th:if="${globalInfo.mustVerifyEmailOnRegistration}" th:inline="javascript">
-        document.addEventListener("DOMContentLoaded", function () {
-            function sendRequest() {
-                return new Promise((resolve, reject) => {
-                    const email = document.getElementById("email").value;
-
-                    if (!email) {
-                        throw new Error(/*[[#{form.signup.emailCode.send.emptyValidation}]]*/"");
-                    }
-
-                    fetch("/signup/send-email-code", {
-                        method: "POST",
-                        body: JSON.stringify({ email: email }),
-                        headers: {
-                            "Content-Type": "application/json",
-                            [[${_csrf.headerName}]]: [[${_csrf.token}]],
-                        },
-                    })
-                        .then((response) => {
-                            if (response.ok) {
-                                resolve(response);
-                            }
-                            reject(response);
-                        })
-                        .catch((e) => {
-                            reject(e);
-                        });
-                });
-            }
-
-            const emailCodeSendButton = document.getElementById("emailCodeSendButton");
-            sendVerificationCode(emailCodeSendButton, sendRequest);
-        });
-    </script>
-</form>
-
-<form
-    th:fragment="totp"
-    class="halo-form"
-    th:action="@{/challenges/two-factor/totp}"
-    name="two-factor-form"
-    id="two-factor-form"
-    method="post"
->
-    <div class="alert alert-error" role="alert" th:if="${param.error.size() > 0}">
-        <strong th:text="#{form.totp.messages.invalidError}"></strong>
-    </div>
-    <div class="form-item">
-        <label for="code" th:text="#{form.totp.code.label}"></label>
-        <div class="form-input">
-            <input
-                type="text"
-                inputmode="numeric"
-                id="code"
-                name="code"
-                autocomplete="one-time-code"
-                pattern="\d{6}"
-                autofocus
-                required
-            />
-        </div>
-    </div>
-    <div class="form-item">
-        <button type="submit" th:text="#{form.totp.submit}"></button>
-    </div>
-</form>
-
-<form th:fragment="logout" class="halo-form" id="logout-form" name="logout-form" th:action="@{/logout}" method="post">
-    <div class="form-item">
-        <button type="submit" th:text="#{form.logout.submit}"></button>
-    </div>
-</form>
-
-<form
-    th:fragment="passwordResetLink"
-    class="halo-form"
-    th:action="@{/password-reset/email/{resetToken}(resetToken=${resetToken})}"
-    method="post"
->
-    <div class="alert alert-error" role="alert" th:if="${error}">
-        <strong th:text="${error}"></strong>
-    </div>
-    <div class="form-item">
-        <label for="password" th:text="#{form.passwordResetLink.password.label}">Password</label>
-        <th:block
-            th:replace="~{gateway_modules/input_fragments :: password(id = 'password', name = 'password', required = 'true', minlength = 5, maxlength = 257, enableToggle = true)}"
-        ></th:block>
-    </div>
-    <div class="form-item">
-        <label for="confirmPassword" th:text="#{form.passwordResetLink.confirmPassword.label}">Confirm Password</label>
-        <th:block
-            th:replace="~{gateway_modules/input_fragments :: password(id = 'confirmPassword', name = 'confirmPassword', required = 'true', minlength = 5, maxlength = 257, enableToggle = true)}"
-        ></th:block>
-    </div>
-    <div class="form-item">
-        <div class="alert" th:text="#{form.passwordResetLink.password.tips}"></div>
-    </div>
-    <div class="form-item">
-        <button type="submit" th:text="#{form.passwordResetLink.submit}"></button>
-    </div>
-
-    <script th:inline="javascript">
-        document.addEventListener("DOMContentLoaded", function () {
-            setupPasswordConfirmation("password", "confirmPassword");
-        });
-    </script>
-</form>
-
-<th:block th:fragment="passwordReset">
-    <form th:if="${sent}" method="get" action="/login" class="halo-form">
-        <div class="form-item">
-            <div class="alert" th:text="#{form.passwordReset.message.success}"></div>
-        </div>
-        <div class="form-item">
-            <button type="submit" th:text="#{form.passwordReset.sent.submit}"></button>
-        </div>
-    </form>
-    <form th:unless="${sent}" class="halo-form" th:action="@{/password-reset/email}" method="post">
-        <div class="alert alert-error" th:if="${error}">
-            <strong th:text="${error}"></strong>
-        </div>
-        <div class="form-item">
-            <label for="email" th:text="#{form.passwordReset.email.label}"></label>
-            <div class="form-input">
-                <input type="email" id="email" name="email" autofocus required />
-            </div>
-        </div>
-        <div class="form-item">
-            <button type="submit" th:text="#{form.passwordReset.submit}"></button>
-        </div>
-    </form>
-</th:block>
diff --git a/application/src/main/resources/templates/gateway_modules/form_fragments.properties b/application/src/main/resources/templates/gateway_modules/form_fragments.properties
deleted file mode 100644
index 48d3a835a7..0000000000
--- a/application/src/main/resources/templates/gateway_modules/form_fragments.properties
+++ /dev/null
@@ -1,36 +0,0 @@
-form.login.messages.logoutSuccess=登出成功。
-form.login.messages.signupSuccess=恭喜！注册成功，请立即登录。
-form.login.messages.oauth2Bind=当前登录未绑定账号，请尝试通过其他方式登录，登录成功后会自动绑定账号。
-form.login.error.invalidCredential=无效的凭证。
-form.login.error.rateLimitExceeded=请求过于频繁，请稍后再试。
-form.login.rememberMe.label=保持登录会话
-form.login.submit=登录
-
-form.signup.username.label=用户名
-form.signup.displayName.label=名称
-form.signup.email.label=电子邮箱
-form.signup.emailCode.label=邮箱验证码
-form.signup.emailCode.sendButton=发送
-form.signup.emailCode.send.emptyValidation=请先输入邮箱地址
-form.signup.password.label=密码
-form.signup.confirmPassword.label=确认密码
-form.signup.submit=注册
-form.signup.error.invalidEmailCode=无效的邮箱验证码
-form.signup.error.duplicateUsername=用户名已经被注册
-form.signup.error.rateLimitExceeded=请求过于频繁，请稍后再试
-
-form.totp.messages.invalidError=错误的验证码
-form.totp.code.label=验证码
-form.totp.submit=验证
-
-form.logout.submit=退出登录
-
-form.passwordResetLink.password.label=密码
-form.passwordResetLink.confirmPassword.label=确认密码
-form.passwordResetLink.password.tips=密码必须至少包含 8 个字符，并且至少包含一个大写字母、一个小写字母、一个数字和一个特殊字符。
-form.passwordResetLink.submit=修改密码
-
-form.passwordReset.email.label=电子邮箱
-form.passwordReset.submit=提交
-form.passwordReset.sent.submit=返回到登录页面
-form.passwordReset.message.success=检查您的电子邮件中是否有重置密码的链接。如果几分钟内没有出现，请检查您的垃圾邮件文件夹。
\ No newline at end of file
diff --git a/application/src/main/resources/templates/gateway_modules/form_fragments_en.properties b/application/src/main/resources/templates/gateway_modules/form_fragments_en.properties
deleted file mode 100644
index 7f63f5e6dd..0000000000
--- a/application/src/main/resources/templates/gateway_modules/form_fragments_en.properties
+++ /dev/null
@@ -1,36 +0,0 @@
-form.login.messages.logoutSuccess=Logout successfully.
-form.login.messages.signupSuccess=Congratulations! Sign up successfully, please login now.
-form.login.messages.oauth2Bind=The current login is not bound to an account. Please try to log in through other methods. After successful login, the account will be automatically bound.
-form.login.error.invalidCredential=Invalid credentials.
-form.login.error.rateLimitExceeded=Too many requests, please try again later.
-form.login.rememberMe.label=Remember me
-form.login.submit=Login
-
-form.signup.username.label=Username
-form.signup.displayName.label=Display Name
-form.signup.email.label=Email
-form.signup.emailCode.label=Email Verification Code
-form.signup.emailCode.sendButton=Send
-form.signup.emailCode.send.emptyValidation=Please enter your email address first
-form.signup.password.label=Password
-form.signup.confirmPassword.label=Confirm Password
-form.signup.submit=Sign Up
-form.signup.error.invalidEmailCode=Invalid Email Verification Code
-form.signup.error.duplicateUsername=Username is already taken
-form.signup.error.rateLimitExceeded=Too many requests, please try again later
-
-form.totp.messages.invalidError=Invalid TOTP code
-form.totp.code.label=TOTP Code
-form.totp.submit=Verify
-
-form.logout.submit=Logout
-
-form.passwordResetLink.password.label=Password
-form.passwordResetLink.confirmPassword.label=Confirm Password
-form.passwordResetLink.password.tips=Password must be at least 8 characters long and contain at least one uppercase letter, one lowercase letter, one number, and one special character.
-form.passwordResetLink.submit=Change password
-
-form.passwordReset.email.label=Email
-form.passwordReset.submit=Submit
-form.passwordReset.sent.submit=Return to login
-form.passwordReset.message.success=Check your email for a link to reset your password. If it doesn’t appear within a few minutes, check your spam folder.
\ No newline at end of file
diff --git a/application/src/main/resources/templates/gateway_modules/form_fragments_es.properties b/application/src/main/resources/templates/gateway_modules/form_fragments_es.properties
deleted file mode 100644
index 8dab4708d6..0000000000
--- a/application/src/main/resources/templates/gateway_modules/form_fragments_es.properties
+++ /dev/null
@@ -1,36 +0,0 @@
-form.login.messages.logoutSuccess=Cierre de sesión exitoso.
-form.login.messages.signupSuccess=¡Felicidades! Registro exitoso, por favor inicie sesión de inmediato.
-form.login.messages.oauth2Bind=El inicio de sesión actual no está vinculado a una cuenta. Intente iniciar sesión a través de otros métodos. Después de un inicio de sesión exitoso, la cuenta se vinculará automáticamente.
-form.login.error.invalidCredential=Credenciales inválidas.
-form.login.error.rateLimitExceeded=Demasiadas solicitudes, por favor intente nuevamente más tarde.
-form.login.rememberMe.label=Mantener sesión iniciada
-form.login.submit=Iniciar sesión
-
-form.signup.username.label=Nombre de Usuario
-form.signup.displayName.label=Nombre
-form.signup.email.label=Correo Electrónico
-form.signup.emailCode.label=Código de Verificación
-form.signup.emailCode.sendButton=Enviar
-form.signup.emailCode.send.emptyValidation=Por favor, introduce tu dirección de correo electrónico primero
-form.signup.password.label=Contraseña
-form.signup.confirmPassword.label=Confirmar Contraseña
-form.signup.submit=Registrarse
-form.signup.error.invalidEmailCode=Código de verificación del correo inválido
-form.signup.error.duplicateUsername=El nombre de usuario ya está registrado
-form.signup.error.rateLimitExceeded=Demasiadas solicitudes, por favor intente nuevamente más tarde
-
-form.totp.messages.invalidError=Código de verificación incorrecto
-form.totp.code.label=Código de Verificación
-form.totp.submit=Verificar
-
-form.logout.submit=Cerrar Sesión
-
-form.passwordResetLink.password.label=Contraseña
-form.passwordResetLink.confirmPassword.label=Confirmar Contraseña
-form.passwordResetLink.password.tips=La contraseña debe tener al menos 8 caracteres e incluir al menos una letra mayúscula, una letra minúscula, un número y un carácter especial.
-form.passwordResetLink.submit=Cambiar Contraseña
-
-form.passwordReset.email.label=Correo Electrónico
-form.passwordReset.submit=Enviar
-form.passwordReset.sent.submit=Volver a la Página de Inicio de Sesión
-form.passwordReset.message.success=Revisa tu correo electrónico para ver el enlace de restablecimiento de contraseña. Si no aparece en unos minutos, revisa tu carpeta de spam.
\ No newline at end of file
diff --git a/application/src/main/resources/templates/gateway_modules/form_fragments_zh_TW.properties b/application/src/main/resources/templates/gateway_modules/form_fragments_zh_TW.properties
deleted file mode 100644
index 7accc38c1f..0000000000
--- a/application/src/main/resources/templates/gateway_modules/form_fragments_zh_TW.properties
+++ /dev/null
@@ -1,36 +0,0 @@
-form.login.messages.logoutSuccess=登出成功。
-form.login.messages.signupSuccess=恭喜！註冊成功，請立即登入。
-form.login.messages.oauth2Bind=當前登入未綁定至帳戶。請嘗試通過其他方法登入。成功登入後，帳戶將自動綁定。
-form.login.error.invalidCredential=無效的憑證。
-form.login.error.rateLimitExceeded=請求過於頻繁，請稍後再試。
-form.login.form.rememberMe.label=保持登入會話
-form.login.form.submit=登入
-
-form.signup.username.label=使用者名稱
-form.signup.displayName.label=名稱
-form.signup.email.label=電子郵件
-form.signup.emailCode.label=郵箱驗證碼
-form.signup.emailCode.sendButton=發送
-form.signup.emailCode.send.emptyValidation=請先輸入電子郵件地址
-form.signup.password.label=密碼
-form.signup.confirmPassword.label=確認密碼
-form.signup.submit=註冊
-form.signup.error.invalidEmailCode=無效的郵箱驗證碼
-form.signup.error.duplicateUsername=使用者名稱已經被註冊
-form.signup.error.rateLimitExceeded=請求過於頻繁，請稍後再試
-
-form.totp.messages.invalidError=錯誤的驗證碼
-form.totp.code.label=驗證碼
-form.totp.submit=驗證
-
-form.logout.submit=退出登入
-
-form.passwordResetLink.password.label=密碼
-form.passwordResetLink.confirmPassword.label=確認密碼
-form.passwordResetLink.password.tips=密碼必須至少包含 8 個字元，並且至少包含一個大寫字母、一個小寫字母、一個數字和一個特殊字元。
-form.passwordResetLink.submit=修改密碼
-
-form.passwordReset.email.label=電子郵件
-form.passwordReset.submit=提交
-form.passwordReset.sent.submit=返回到登入頁面
-form.passwordReset.message.success=檢查您的電子郵件中是否有重置密碼的連結。如果幾分鐘內沒有出現，請檢查您的垃圾郵件資料夾。
\ No newline at end of file
diff --git a/application/src/main/resources/templates/gateway_modules/login_fragments.html b/application/src/main/resources/templates/gateway_modules/login_fragments.html
deleted file mode 100644
index 0b56714491..0000000000
--- a/application/src/main/resources/templates/gateway_modules/login_fragments.html
+++ /dev/null
@@ -1,20 +0,0 @@
-<!-- Those fragments are only for login template-->
-<div th:remove="tag" th:fragment="formAuthProviders">
-    <th:block th:unless="${#lists.isEmpty(formAuthProviders)}">
-        <div class="divider-wrapper">
-            <hr />
-            <th:block th:text="#{otherLogin.label}"></th:block>
-            <hr />
-        </div>
-        <ul class="pill-items">
-            <li th:each="provider : ${formAuthProviders}">
-                <a th:href="'/login?method=' + ${provider.metadata.name}">
-                    <img th:src="${provider.spec.logo}" />
-                    <span
-                        th:text="${#messages.msgOrNull('formAuthProviders.' + provider.metadata.name + '.displayName') ?: provider.spec.displayName}"
-                    ></span>
-                </a>
-            </li>
-        </ul>
-    </th:block>
-</div>
\ No newline at end of file
diff --git a/application/src/main/resources/templates/gateway_modules/login_fragments.properties b/application/src/main/resources/templates/gateway_modules/login_fragments.properties
deleted file mode 100644
index 5396009aa6..0000000000
--- a/application/src/main/resources/templates/gateway_modules/login_fragments.properties
+++ /dev/null
@@ -1,4 +0,0 @@
-otherLogin.label=其他登录方式
-
-# Rule: `formAuthProviders.${provider.metadata.name}.displayName`
-formAuthProviders.local.displayName=账号密码登录
\ No newline at end of file
diff --git a/application/src/main/resources/templates/gateway_modules/login_fragments_en.properties b/application/src/main/resources/templates/gateway_modules/login_fragments_en.properties
deleted file mode 100644
index 2ac24fcf27..0000000000
--- a/application/src/main/resources/templates/gateway_modules/login_fragments_en.properties
+++ /dev/null
@@ -1,4 +0,0 @@
-otherLogin.label=Other Login
-
-# Rule: `formAuthProviders.${provider.metadata.name}.displayName`
-formAuthProviders.local.displayName=Login with credentials
\ No newline at end of file
diff --git a/application/src/main/resources/templates/gateway_modules/login_fragments_es.properties b/application/src/main/resources/templates/gateway_modules/login_fragments_es.properties
deleted file mode 100644
index 90da22132e..0000000000
--- a/application/src/main/resources/templates/gateway_modules/login_fragments_es.properties
+++ /dev/null
@@ -1,4 +0,0 @@
-otherLogin.label=Otras formas de inicio de sesión
-
-# Rule: `formAuthProviders.${provider.metadata.name}.displayName`
-formAuthProviders.local.displayName=Iniciar sesión con credenciales
\ No newline at end of file
diff --git a/application/src/main/resources/templates/gateway_modules/login_fragments_zh_TW.properties b/application/src/main/resources/templates/gateway_modules/login_fragments_zh_TW.properties
deleted file mode 100644
index 8a96457ded..0000000000
--- a/application/src/main/resources/templates/gateway_modules/login_fragments_zh_TW.properties
+++ /dev/null
@@ -1,4 +0,0 @@
-otherLogin.label=其他登入方式
-
-# Rule: `formAuthProviders.${provider.metadata.name}.displayName`
-formAuthProviders.local.displayName=帳號密碼登入
\ No newline at end of file
diff --git a/application/src/main/resources/templates/login.html b/application/src/main/resources/templates/login.html
index ac00d57c8c..fd619e2c11 100644
--- a/application/src/main/resources/templates/login.html
+++ b/application/src/main/resources/templates/login.html
@@ -1,21 +1,21 @@
 <!doctype html>
 <html
     xmlns:th="https://www.thymeleaf.org"
-    th:replace="~{gateway_modules/layout :: layout(title = |#{title} - ${site.title}|, head = null, body = ~{::body})}"
+    th:replace="~{gateway_fragments/layout :: layout(title = |#{title} - ${site.title}|, head = null, body = ~{::body})}"
 >
     <th:block th:fragment="body">
         <div class="gateway-wrapper">
-            <div th:replace="~{gateway_modules/common_fragments::haloLogo}"></div>
+            <div th:replace="~{gateway_fragments/common::haloLogo}"></div>
 
             <div class="halo-form-wrapper">
-                <form th:replace="~{gateway_modules/form_fragments::login}"></form>
-                <div th:replace="~{gateway_modules/login_fragments::formAuthProviders}"></div>
-                <div th:replace="~{gateway_modules/common_fragments::socialAuthProviders}"></div>
+                <div th:replace="~{gateway_fragments/login::form}"></div>
+                <div th:replace="~{gateway_fragments/login::formAuthProviders}"></div>
+                <div th:replace="~{gateway_fragments/common::socialAuthProviders}"></div>
             </div>
 
-            <div th:replace="~{gateway_modules/common_fragments::signupNoticeContent}"></div>
-            <div th:replace="~{gateway_modules/common_fragments::returnToSiteContent}"></div>
-            <div th:replace="~{gateway_modules/common_fragments::languageSwitcher}"></div>
+            <div th:replace="~{gateway_fragments/common::signupNoticeContent}"></div>
+            <div th:replace="~{gateway_fragments/common::returnToSiteContent}"></div>
+            <div th:replace="~{gateway_fragments/common::languageSwitcher}"></div>
         </div>
     </th:block>
 </html>
diff --git a/application/src/main/resources/templates/login_local.html b/application/src/main/resources/templates/login_local.html
index 46d997c236..6e3eeefefe 100644
--- a/application/src/main/resources/templates/login_local.html
+++ b/application/src/main/resources/templates/login_local.html
@@ -52,7 +52,7 @@
         </div>
 
         <th:block
-            th:replace="~{gateway_modules/input_fragments :: password(id = 'plainPassword', name = null, required = 'true', minlength = null, maxlength = 257, enableToggle = true)}"
+            th:replace="~{gateway_fragments/input :: password(id = 'plainPassword', name = null, required = 'true', minlength = null, maxlength = 257, enableToggle = true)}"
         ></th:block>
     </div>
 </div>
\ No newline at end of file
diff --git a/application/src/main/resources/templates/logout.html b/application/src/main/resources/templates/logout.html
index 88b1f6c8cb..a91195c419 100644
--- a/application/src/main/resources/templates/logout.html
+++ b/application/src/main/resources/templates/logout.html
@@ -1,13 +1,13 @@
 <!doctype html>
 <html
     xmlns:th="https://www.thymeleaf.org"
-    th:replace="~{gateway_modules/layout:: layout(title = |#{title} - ${site.title}|, head = null, body = ~{::body})}"
+    th:replace="~{gateway_fragments/layout:: layout(title = |#{title} - ${site.title}|, head = null, body = ~{::body})}"
 >
     <th:block th:fragment="body">
         <div class="gateway-wrapper">
             <div class="halo-form-wrapper">
                 <h1 class="form-title" th:text="#{form.title}"></h1>
-                <form th:replace="~{gateway_modules/form_fragments::logout}"></form>
+                <form th:replace="~{gateway_fragments/logout::form}"></form>
             </div>
         </div>
     </th:block>
diff --git a/application/src/main/resources/templates/password-reset/email/reset.html b/application/src/main/resources/templates/password-reset/email/reset.html
index 84b1f8da4f..6178b967c4 100644
--- a/application/src/main/resources/templates/password-reset/email/reset.html
+++ b/application/src/main/resources/templates/password-reset/email/reset.html
@@ -1,16 +1,16 @@
 <!doctype html>
 <html
     xmlns:th="https://www.thymeleaf.org"
-    th:replace="~{gateway_modules/layout:: layout(title = |#{title(${username})} - ${site.title}|, head = null, body = ~{::body})}"
+    th:replace="~{gateway_fragments/layout:: layout(title = |#{title(${username})} - ${site.title}|, head = null, body = ~{::body})}"
 >
     <th:block th:fragment="body">
         <div class="gateway-wrapper">
-            <div th:replace="~{gateway_modules/common_fragments::haloLogo}"></div>
+            <div th:replace="~{gateway_fragments/common::haloLogo}"></div>
             <div class="halo-form-wrapper">
                 <h1 class="form-title" th:text="#{title(${username})}"></h1>
-                <form th:replace="~{gateway_modules/form_fragments::passwordResetLink}"></form>
+                <form th:replace="~{gateway_fragments/password_reset_email_reset::form}"></form>
             </div>
-            <div th:replace="~{gateway_modules/common_fragments::languageSwitcher}"></div>
+            <div th:replace="~{gateway_fragments/common::languageSwitcher}"></div>
         </div>
     </th:block>
 </html>
diff --git a/application/src/main/resources/templates/password-reset/email/send.html b/application/src/main/resources/templates/password-reset/email/send.html
index f518e2d9f8..e10481df25 100644
--- a/application/src/main/resources/templates/password-reset/email/send.html
+++ b/application/src/main/resources/templates/password-reset/email/send.html
@@ -1,19 +1,19 @@
 <!doctype html>
 <html
     xmlns:th="https://www.thymeleaf.org"
-    th:replace="~{gateway_modules/layout:: layout(title = |#{title} - ${site.title}|, head = null, body = ~{::body})}"
+    th:replace="~{gateway_fragments/layout:: layout(title = |#{title} - ${site.title}|, head = null, body = ~{::body})}"
 >
     <th:block th:fragment="body">
         <div class="gateway-wrapper">
-            <div th:replace="~{gateway_modules/common_fragments::haloLogo}"></div>
+            <div th:replace="~{gateway_fragments/common::haloLogo}"></div>
             <div class="halo-form-wrapper">
                 <h1 class="form-title" th:text="${sent} ? #{sent.title} : #{title}"></h1>
-                <form th:replace="~{gateway_modules/form_fragments::passwordReset}"></form>
+                <form th:replace="~{gateway_fragments/password_reset_email_send::form}"></form>
 
-                <div th:replace="~{gateway_modules/common_fragments::passwordResetMethods}"></div>
+                <div th:replace="~{gateway_fragments/common::passwordResetMethods}"></div>
             </div>
 
-            <div th:replace="~{gateway_modules/common_fragments::languageSwitcher}"></div>
+            <div th:replace="~{gateway_fragments/common::languageSwitcher}"></div>
         </div>
     </th:block>
 </html>
diff --git a/application/src/main/resources/templates/setup.html b/application/src/main/resources/templates/setup.html
index 2cf354f456..5a7350cfcf 100644
--- a/application/src/main/resources/templates/setup.html
+++ b/application/src/main/resources/templates/setup.html
@@ -1,7 +1,7 @@
 <!doctype html>
 <html
     xmlns:th="https://www.thymeleaf.org"
-    th:replace="~{gateway_modules/layout :: layout(title = |#{title} - Halo|, head = ~{::head}, body = ~{::body})}"
+    th:replace="~{gateway_fragments/layout :: layout(title = |#{title} - Halo|, head = ~{::head}, body = ~{::body})}"
 >
     <th:block th:fragment="head">
         <style>
@@ -12,7 +12,7 @@
     </th:block>
     <th:block th:fragment="body">
         <div class="gateway-wrapper setup-page-wrapper">
-            <div th:replace="~{gateway_modules/common_fragments::haloLogo}"></div>
+            <div th:replace="~{gateway_fragments/common::haloLogo}"></div>
 
             <div class="halo-form-wrapper">
                 <h1 class="form-title" th:text="#{title}"></h1>
@@ -87,7 +87,7 @@ <h1 class="form-title" th:text="#{title}"></h1>
                     <div class="form-item">
                         <label for="password" th:text="#{form.password.label}"></label>
                         <th:block
-                            th:replace="~{gateway_modules/input_fragments :: password(id = 'password', name = 'password', required = 'true', minlength = 5, maxlength = 257, enableToggle = true)}"
+                            th:replace="~{gateway_fragments/input :: password(id = 'password', name = 'password', required = 'true', minlength = 5, maxlength = 257, enableToggle = true)}"
                         ></th:block>
                         <p
                             class="alert alert-error"
@@ -99,7 +99,7 @@ <h1 class="form-title" th:text="#{title}"></h1>
                     <div class="form-item">
                         <label for="confirmPassword" th:text="#{form.confirmPassword.label}"></label>
                         <th:block
-                            th:replace="~{gateway_modules/input_fragments :: password(id = 'confirmPassword', name = null, required = 'true', minlength = 5, maxlength = 257, enableToggle = true)}"
+                            th:replace="~{gateway_fragments/input :: password(id = 'confirmPassword', name = null, required = 'true', minlength = 5, maxlength = 257, enableToggle = true)}"
                         ></th:block>
                     </div>
 
@@ -109,7 +109,7 @@ <h1 class="form-title" th:text="#{title}"></h1>
                 </form>
             </div>
 
-            <div th:replace="~{gateway_modules/common_fragments::languageSwitcher}"></div>
+            <div th:replace="~{gateway_fragments/common::languageSwitcher}"></div>
         </div>
 
         <script th:inline="javascript">
diff --git a/application/src/main/resources/templates/signup.html b/application/src/main/resources/templates/signup.html
index e602bad92b..5208fe1f22 100644
--- a/application/src/main/resources/templates/signup.html
+++ b/application/src/main/resources/templates/signup.html
@@ -1,7 +1,7 @@
 <!doctype html>
 <html
     xmlns:th="https://www.thymeleaf.org"
-    th:replace="~{gateway_modules/layout :: layout(title = |#{title} - ${site.title}|, head = ~{::head}, body = ~{::body})}"
+    th:replace="~{gateway_fragments/layout :: layout(title = |#{title} - ${site.title}|, head = ~{::head}, body = ~{::body})}"
 >
     <th:block th:fragment="head">
         <style>
@@ -12,15 +12,15 @@
     </th:block>
     <th:block th:fragment="body">
         <div class="gateway-wrapper signup-page-wrapper">
-            <div th:replace="~{gateway_modules/common_fragments::haloLogo}"></div>
+            <div th:replace="~{gateway_fragments/common::haloLogo}"></div>
             <div class="halo-form-wrapper">
                 <h1 class="form-title" th:text="#{title}"></h1>
-                <form th:replace="~{gateway_modules/form_fragments::signup}"></form>
-                <div th:replace="~{gateway_modules/common_fragments::socialAuthProviders}"></div>
+                <form th:replace="~{gateway_fragments/signup::form}"></form>
+                <div th:replace="~{gateway_fragments/common::socialAuthProviders}"></div>
             </div>
-            <div th:replace="~{gateway_modules/common_fragments::loginNoticeContent}"></div>
-            <div th:replace="~{gateway_modules/common_fragments::returnToSiteContent}"></div>
-            <div th:replace="~{gateway_modules/common_fragments::languageSwitcher}"></div>
+            <div th:replace="~{gateway_fragments/common::loginNoticeContent}"></div>
+            <div th:replace="~{gateway_fragments/common::returnToSiteContent}"></div>
+            <div th:replace="~{gateway_fragments/common::languageSwitcher}"></div>
         </div>
     </th:block>
 </html>

From 605d52a86e114570598989c85d8e2ec87221ec24 Mon Sep 17 00:00:00 2001
From: guqing <38999863+guqing@users.noreply.github.com>
Date: Thu, 10 Oct 2024 15:45:00 +0800
Subject: [PATCH 115/185] refactor: optimize file type detection and support
 decision-making based on file name (#6675)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?
/kind improvement
/area core
/milestone 2.20.x

#### What this PR does / why we need it:
优化文件类型检测并支持根据文件名作为决策依据

#### Does this PR introduce a user-facing change?
```release-note
优化文件类型检测并支持根据文件名作为决策依据
```
---
 .../app/infra/utils/FileTypeDetectUtils.java  |  41 ++++++++++---
 .../LocalAttachmentUploadHandler.java         |   6 +-
 .../infra/utils/FileTypeDetectUtilsTest.java  |  55 ++++++++++++++++++
 .../resources/file-type-detect/index.html     |   0
 .../test/resources/file-type-detect/index.js  |   0
 .../resources/file-type-detect/other.xlsx     | Bin 0 -> 9031 bytes
 .../test/resources/file-type-detect/test.docx | Bin 0 -> 10251 bytes
 .../test/resources/file-type-detect/test.json |   0
 .../test/resources/file-type-detect/test.png  | Bin 0 -> 17156 bytes
 .../test/resources/file-type-detect/test.svg  |   1 +
 10 files changed, 91 insertions(+), 12 deletions(-)
 create mode 100644 application/src/test/resources/file-type-detect/index.html
 create mode 100644 application/src/test/resources/file-type-detect/index.js
 create mode 100644 application/src/test/resources/file-type-detect/other.xlsx
 create mode 100644 application/src/test/resources/file-type-detect/test.docx
 create mode 100644 application/src/test/resources/file-type-detect/test.json
 create mode 100644 application/src/test/resources/file-type-detect/test.png
 create mode 100644 application/src/test/resources/file-type-detect/test.svg

diff --git a/api/src/main/java/run/halo/app/infra/utils/FileTypeDetectUtils.java b/api/src/main/java/run/halo/app/infra/utils/FileTypeDetectUtils.java
index f9326863ee..7166260d4f 100644
--- a/api/src/main/java/run/halo/app/infra/utils/FileTypeDetectUtils.java
+++ b/api/src/main/java/run/halo/app/infra/utils/FileTypeDetectUtils.java
@@ -1,29 +1,52 @@
 package run.halo.app.infra.utils;
 
+import java.io.BufferedInputStream;
 import java.io.IOException;
 import java.io.InputStream;
 import lombok.experimental.UtilityClass;
-import org.apache.tika.Tika;
+import org.apache.tika.detect.DefaultDetector;
+import org.apache.tika.detect.Detector;
+import org.apache.tika.metadata.Metadata;
+import org.apache.tika.metadata.TikaCoreProperties;
 import org.apache.tika.mime.MimeTypeException;
 import org.apache.tika.mime.MimeTypes;
+import org.springframework.util.Assert;
 
 @UtilityClass
 public class FileTypeDetectUtils {
 
-    private static final Tika tika = new Tika();
+    private static final Detector detector = new DefaultDetector();
+
+    /**
+     * <p>Detects the media type of the given document.</p>
+     * <p>The type detection is based on the content of the given document stream and the name of
+     * the document.</p>
+     *
+     * @param inputStream the document stream must not be null
+     * @throws IOException if the stream can not be read
+     */
+    public static String detectMimeType(InputStream inputStream, String name) throws IOException {
+        Assert.notNull(name, "The name of the document must not be null");
+        var metadata = new Metadata();
+        metadata.set(TikaCoreProperties.RESOURCE_NAME_KEY, name);
+        return doDetectMimeType(inputStream, metadata);
+    }
 
     /**
      * Detect mime type.
      *
-     * @param inputStream input stream will be closed after detection.
+     * @param inputStream input stream will be closed after detection, must not be null
      */
     public static String detectMimeType(InputStream inputStream) throws IOException {
-        try {
-            return tika.detect(inputStream);
-        } finally {
-            if (inputStream != null) {
-                inputStream.close();
-            }
+        return doDetectMimeType(inputStream, new Metadata());
+    }
+
+    private static String doDetectMimeType(InputStream inputStream, Metadata metadata)
+        throws IOException {
+        Assert.notNull(inputStream, "The inputStream must not be null");
+        try (var stream = (!inputStream.markSupported()
+            ? new BufferedInputStream(inputStream) : inputStream)) {
+            return detector.detect(stream, metadata).toString();
         }
     }
 
diff --git a/application/src/main/java/run/halo/app/core/attachment/endpoint/LocalAttachmentUploadHandler.java b/application/src/main/java/run/halo/app/core/attachment/endpoint/LocalAttachmentUploadHandler.java
index bb48574d4d..2c4351112f 100644
--- a/application/src/main/java/run/halo/app/core/attachment/endpoint/LocalAttachmentUploadHandler.java
+++ b/application/src/main/java/run/halo/app/core/attachment/endpoint/LocalAttachmentUploadHandler.java
@@ -158,7 +158,7 @@ private Mono<Void> validateFile(FilePart file, PolicySetting setting) {
             var typeValidator = file.content()
                 .next()
                 .handle((dataBuffer, sink) -> {
-                    var mimeType = detectMimeType(dataBuffer.asInputStream());
+                    var mimeType = detectMimeType(dataBuffer.asInputStream(), file.name());
                     var isAllow = setting.getAllowedFileTypes()
                         .stream()
                         .map(FileCategoryMatcher::of)
@@ -178,9 +178,9 @@ private Mono<Void> validateFile(FilePart file, PolicySetting setting) {
     }
 
     @NonNull
-    private String detectMimeType(InputStream inputStream) {
+    private String detectMimeType(InputStream inputStream, String name) {
         try {
-            return FileTypeDetectUtils.detectMimeType(inputStream);
+            return FileTypeDetectUtils.detectMimeType(inputStream, name);
         } catch (IOException e) {
             log.warn("Failed to detect file type", e);
             return "Unknown";
diff --git a/application/src/test/java/run/halo/app/infra/utils/FileTypeDetectUtilsTest.java b/application/src/test/java/run/halo/app/infra/utils/FileTypeDetectUtilsTest.java
index a69ee0c806..1c3e407d08 100644
--- a/application/src/test/java/run/halo/app/infra/utils/FileTypeDetectUtilsTest.java
+++ b/application/src/test/java/run/halo/app/infra/utils/FileTypeDetectUtilsTest.java
@@ -3,6 +3,7 @@
 import static org.assertj.core.api.Assertions.assertThat;
 
 import java.io.IOException;
+import java.io.InputStream;
 import java.nio.file.Files;
 import org.apache.tika.mime.MimeTypeException;
 import org.junit.jupiter.api.Test;
@@ -31,6 +32,60 @@ void detectMimeTypeTest() throws IOException {
         assertThat(mimeType).isEqualTo("application/zip");
     }
 
+    @Test
+    void detectMimeTypeWithNameTest() throws IOException {
+        var stream = getFileInputStream("classpath:file-type-detect/index.js");
+        String mimeType = FileTypeDetectUtils.detectMimeType(stream, "index.js");
+        assertThat(mimeType).isEqualTo("application/javascript");
+
+        stream = getFileInputStream("classpath:file-type-detect/index.html");
+        mimeType =
+            FileTypeDetectUtils.detectMimeType(stream, "index.html");
+        assertThat(mimeType).isEqualTo("text/html");
+
+        stream = getFileInputStream("classpath:file-type-detect/test.json");
+        mimeType = FileTypeDetectUtils.detectMimeType(stream, "test.json");
+        assertThat(mimeType).isEqualTo("application/json");
+
+        stream = getFileInputStream("classpath:file-type-detect/other.xlsx");
+        mimeType = FileTypeDetectUtils.detectMimeType(stream, "other.xlsx");
+        assertThat(mimeType).isEqualTo(
+            "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet");
+
+        // other.xlsx detect without name
+        stream = getFileInputStream("classpath:file-type-detect/other.xlsx");
+        mimeType = FileTypeDetectUtils.detectMimeType(stream);
+        assertThat(mimeType).isEqualTo("application/zip");
+
+        // other.xlsx detect with wrong name
+        stream = getFileInputStream("classpath:file-type-detect/other.xlsx");
+        mimeType = FileTypeDetectUtils.detectMimeType(stream, "other.txt");
+        assertThat(mimeType).isEqualTo("application/zip");
+
+        stream = getFileInputStream("classpath:file-type-detect/test.docx");
+        mimeType = FileTypeDetectUtils.detectMimeType(stream, "test.docx");
+        assertThat(mimeType).isEqualTo(
+            "application/vnd.openxmlformats-officedocument.wordprocessingml.document");
+
+        // docx detect without file name
+        stream = getFileInputStream("classpath:file-type-detect/test.docx");
+        mimeType = FileTypeDetectUtils.detectMimeType(stream);
+        assertThat(mimeType).isEqualTo("application/zip");
+
+        stream = getFileInputStream("classpath:file-type-detect/test.svg");
+        mimeType = FileTypeDetectUtils.detectMimeType(stream, "test.svg");
+        assertThat(mimeType).isEqualTo("image/svg+xml");
+
+        stream = getFileInputStream("classpath:file-type-detect/test.png");
+        mimeType = FileTypeDetectUtils.detectMimeType(stream, "test.png");
+        assertThat(mimeType).isEqualTo("image/png");
+    }
+
+    private static InputStream getFileInputStream(String location) throws IOException {
+        var file = ResourceUtils.getFile(location);
+        return Files.newInputStream(file.toPath());
+    }
+
     @Test
     void detectFileExtensionTest() throws MimeTypeException {
         var ext = FileTypeDetectUtils.detectFileExtension("application/x-x509-key; format=pem");
diff --git a/application/src/test/resources/file-type-detect/index.html b/application/src/test/resources/file-type-detect/index.html
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/application/src/test/resources/file-type-detect/index.js b/application/src/test/resources/file-type-detect/index.js
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/application/src/test/resources/file-type-detect/other.xlsx b/application/src/test/resources/file-type-detect/other.xlsx
new file mode 100644
index 0000000000000000000000000000000000000000..1d2b9647f0751884f7af4eee065d5d3cfd8b6daf
GIT binary patch
literal 9031
zcmaJ{bzD`;7Dl9`OS)S@q)WQHq`Mmq-O?@H-Hmj29J)gUDd~_pNK3tgzIVO)?tAmc
z-siW^TC-->w`T2`^=)~nr%><^k1beso&WLvpY{y=!w6s~Zx66_cr6bW!vsHo`ynQv
z8q>r21OkEu5&{DC?_&D4w)C#nRv9tfl1~{iMK1jwP-_4)SZFU&Fa>%uo|d;nrm$P<
zQ9T=SFuQy5z|U@@1!tqx`VF9Ti^z;IS<+<hqI<N_;qWZ0d_Rn3)xUu%Z(}V4onaVj
zfsWa|frE%Z9$h|FP~{W9C_Cz|^uZBmNfVZc6$+hPdT<whN(L9f0=ga%XqL7c|7i|=
zV>f9uu|UPvXjT~s=CcvYf@zf~12pE-OG5Ft>vi1^L0BsFo@<`fc4%rKp`DlI6#a?o
zWLa@hi)oiTZ^pkL-$EHJzDZhu?Z!`M%bs*cKXbC;&Dm6hF~eY95U(ugPF|`g$eBq%
z*zLO+*;w4a+W}&jPRRi>4k|C|S1>kgNW%{M*huVz4byCMs{L#=wx>6UyEb@j2cm5;
z#yz2Z_Dr%WEeT%V4V&<NdDQ{&yNlCRd~Wo>F17-@813&aHU!ukKl(T!wp|v;fEnmQ
zu|oPSlVgvVQd04mJoQUb1t^2sgGDwnJHNwN=MTM~*nNDF7=b-KizHJW(6ZA(N>vQs
zR~+~<9E>X2-;-}32Owe`kq^|wJV~db+cYHBM!Ye>##KZc7mv3EO%YIhg}(71lF?3u
z<G_%B7Yrmpl3AZFD2bwyETHd?l_jB?o`$bT$`kGt-Yde{h@Zq~f?29MM2-|d6UFT2
zoRp>|TOh$LkKR)fhW1fFMC<KJ=#AW3B`$|V8{tC<laav<w#fV{jo<3TmbX=-IANsr
ztd_2}#zbG}#sxIHde#<V5yX8Q1_{qCs{PWZSQu(!ue@RgSg)X?E1ZwFTPQ|amFHHa
z;rSsmDeHLTd}Cw|cxQ3a;^lq{0_2EdOGxrE2zfY+P%MrapI#ZwiwOX2>ZETb9b1Ho
zHX2%O_E)(ss~xgDUcsL9k9mh2a@irk!GCFeAisk79ggegR46aOaG-+W!1xUgCkID>
z^&=n!G1^jKK!T2;AA|<qrLkznIoA>1L7nvYIy5RyJJQxkm{0GaKD6RGgki7jZmscf
zb02d~eRtaJR*-Ia%M_IPo)k5<tT65dhu4~x+J`?)gUzWjKV(h9tVz}ekUN$y%9tW+
zriZ3D0MZ+65)?o6$FVqEP+Q1Xo{`6YBkPgB(6Es!?@1KE5~3%KmQ}Cd&+N6f8raB{
z+DV4rH{tBw$P=N$9?H8$J&9asX>g@-<)&~o?;?)79U0s{`V5=Y!PbXyNL(k-{2IC2
zRfh_7(7kH*_*;fC;aDlLZe0qx2EE;CaQt&RnzEPLHPMML3Rq}EvzRX0&dAQ%iE_&N
z`2w+2b8ZG;7i&|RhqfyK&IaGt#H!>7zPit!FOlfI|6(+Gt(K%pMf~X6f6h5i!LD_+
z`jKt^SpfN`fD6Fh(!tEw*zwQI^p;VNV+xE@47ewp|C0To!uSYQ#9JxAA_HOv%DgwK
zW2JGU<}_5pds2ZaLKsXBM^lkPYf^Vtbd1IauR0#n7d1jCY&5a=M3@<T+?qgH)ZB}T
zRrOeV7};yd*1}aj?*p47&i6Fhlo2lSAncIa9M1>(<98grSP;0RO==*lYE1+*WdxP}
zUYFHk#Tz}!X+{<@=O;$2UPcj3GBbfyif?#HKL9luJhd&MH7g^r2xLi~gbPm-YcBWU
z9yYsU=sY))(=p}2MsIw(6`u62Y1*_Np7%Q*##VW9zILlt=qzoPiuRK`Q#F+!V0A0$
zYUJo){nQoHLI(7cd*I#;?_O&%&82EzpHEEz#1a9ydusxXTS^o=2uC<YHMNjKiw8j-
z`}S@B3(mwWma`Kw6Pn8}-9CcFW^x?(N8ZPG`ewI+C5{k8_%IwL@>zOM`!PKo#Awev
zD6*sBdQ;YzGCw<S^mD_g2)v4dVPCnOe%=7BOWEkMXJ4KA#na|``(`3L4NKxPSu<Z6
z&TXO_h$l~*WUM+4SZJ~z-djp45jk?JWYWwLgC&CEG*MbO@#b@vDlXn38M8cwSSlT#
zJr-5Zo=*op?gf$gxZ(VC#Z!g+XRLE88=l$Er0bWH31IB+Q-=BecT7FL$G|b=Xl86}
z{KtDN;QI~Y6*L4y2RKw7SM^_FKZJh-%AxvL6h13vC;16q`1Z;X#n^!JtX2K>S3#FW
z<+z5gQxfUn_!F*1Z(7HY>cuE1gax#so9y`c3slw>?^6TGXcQlyGY^M)WeIYz0<tY+
znKQq5coBDA-p0_X5>v2n^l70cvh_^&(IDD#8Ii}z;;kKeUG~`Ez=cku<<j*<*hY%D
zIz8N7R%G+wZa~43WQFm3gfo0m+nzzl7@$u<UxQc#vL1EyqiFj!G#--2Jef9`VUIcM
zj4nLQAg%yuah!S9a~C*{4Bc0PX`v_XCTHGD+ci~}&-=dFOo1q!YynQ-G9=^t<S8x;
z=CfzSc>4L?YvcC`gmp;>3e5taV)wu5(kCH=7aH?WXCa13&?Z<EILq(OLA;!^%WyCH
zRPy{g3j|W|YGHNXRI_GfT`K1%$P}@tqj8(&B_~kgy_6-J%gC62@xdzV;BMuIwf$L>
z*7bGP!PPR$D=7t93l)MpJR?v&t7nmhx$+xi9e)GK={-EIu;F@HRx#{o#=Kx1*Y>wx
ziRv7#(4nnpiVF&HYL(nW6SHr^UDnD36(}U|2Hk=N%;4&*NhM*@p~Q^PrC4DXfP>#{
zf`SaJ#bvNVNU2k-0*FoE;Pp$+XHSoHc)ao2-0wGU*J@9L`7-(39q&P~c_V1t!h5|~
zp4VeV-k#?QpqrUWUEcepC~UU-q+`DO>!OKUewy3@k=Grr-}Y;%Uw7PYHUfw}R$&Q{
ztX#7w)S%cw>bCDGSJRNgEjfumb8))^Aspy5Fv~=<gt%|I@EwHTHBmYHy95h8fSy#2
z9ldF|FyM{rWj;OUu=5!RpQ74WfzVQQP)9qOm=5)}=dHDCMCCdkTNW&dTNtPFuaNM3
zsmbU(%AG@#VCMIh?&*1i4C95XOB5<~#emUZik>0v61e~d8bJKJ(JHF>3rBJE!I33X
zlKh3xv6GDKq2h^sHeRO~dDIa1@MFWT0VjB=67g3`7Yc%hKE$NBH{l0k*OUED0Rhr-
z48{Vc0fC^QrOnmKgtPrg-dl6N!qZ+6dx=8c46zVK{LdycD&euC!G|#{4b{XUFXS<y
zsinWK4vdzgo+G>Q@AW%=A)S}Fyb!g;=PI(EjwSgz67FH|hQu7)+0IEw{-G7o(Wyw6
znqqmOZ4B{v!I_+UwO5lnn0Cw^<H&nHchM{{Q?EGeobs!7u-9A;u(3l3P`c&a@%ptU
zqoa8}F3X~I`?c(?$1!709rX?-@w4_jtg7$fEeyp0X95`5u+?-yV#@v5%iS^@FO8_k
z=2*}K`k@F=fDxr1VY#GiA_ulz)k{_L%ou%nV|xPJTS9qD=#>&jLml#T40B_jNFn&^
zk)w89<e(+)ixSDghOEahF(y^rRb}bU6uAZ=WYNc$*<wCKH5Hgu$J(YY>=l{Y!nk0*
z6x3%BRwpL_`XUm=A+A$=G=ZLare%mo$?o<Jqr*sRkPW?hsHHGgoe-Uj5rswqZ>?e|
zMgmcWRe9y*#=Yzm2UMAv*DDUKj|ZLd?38lLZ3;HNN%SZuuHnJcCWWlIO?o<~DnJwd
zG#zd(1Q^GD0BN?xi<h&Q!D7N)C!KgtGCm?`sVdXDoxctxu%$Xi$GtR&?@j<FMh2Q;
zkqc=j8weR=Q|+;+eex^QQLU@A%(UY!M1^bO4500Kx)qX&dW0edvVY;ttzfO<Q4ebT
zkgj#EI*Pv**ygmY%<bbaUwT})zB0ewb7D+idahV6F0yBDq@zRq{9-mE41%Lb(AX5x
zPa)pNcYhFj+iJu=Eh$~iKU4$W8jovVN5L`(34d<jP;eN(=`vPy$~eJf1`RrPz{)5{
z%6)m*vLadY&Gu;3E*)*jtG(psBWnhX%RSB`r6M8v=Z)n|=}-$@uHm8_mjbM|8&By@
zq=?C8%iDOHEZe3^6X=~Go#Ry@8`4J^Wz^f?@{JelKeAe{k=S-4Ra!1I91ciQSRmBX
z+THA1Kbe=$FP(43Y_~iehu&0CM-bZRyO66Dc_`O=fbN31%o(X$8+H;cU?Al8zj%Q9
zeftM3PvO-K-d2o&w-qSAwiN~dfaTBKgaROq0o5z3?m_Q50|$K<5?(0>s$B7{vU#Gl
zTpTQw8Y^2(MvTRRcNS94@<;RaJ<pxvj@FxT9qlZ97%$Y4;#I~o6MCos?A-iY9H89I
zlDc3v%QmHnUmOlE26ScI<*`aewA`0KSI8irGMrBujc9_U#S;Fr(sco8X_A95mK($5
zisckdO01+U`esKhs>R*$Kwr|>w;aOCQ+`Id9IOHRzQX81_2#;>b;=Ct%JDHk2DC0~
zk0|_^%M^jGs_C>?3&nn0eXXgOIerLV?)tq@CI@`_B~Ia?k!X}@4(ElZlo{?3n%Iu<
zNx3)TyVajW1;4mxr@g=Lx)e%lTY+40IWr3cg|~cKNzL7+Bey{Q)^O$?#8}?-!8N)o
zl?ccEh`SEX{*#O3C005`#M%UlTHz5{`WvsKt;plRinv164h*Afva3~N_B4_QR!Ogh
z@LBw2d=2p&;R4e@vq_Tcv_m(kkER$O<fgg9j99Bg*iv<KUw2!;X^B3R@z;$U&?Fr^
zJRu&-GcqFM;FE@0Spr-xhR(N+-7oHVzI1JusXceRb#K)4UIui8Q%>?hi<s<e+eM^_
zZSYBZJ^cgi+?7)XL<oo|Z3qaYpJ+Qcx>*@JJYv19Wf_I9ihCc~>y5+dhXQ9>(J|`W
zu0PjGt{f&W3@HeS8F6@W6jD8qfm_rnk^pHAhY9@*8cr#Jrd;rfAB!eLw7~p9`ryE8
z{WU0)Imsb%XVkUk#CYigX4Jq=JKqk^W$n8y*HySix{1bR{W3D$#Fu`o2Q54vuJfgy
zmqFka3dP3|%rj#btWsugaGgN=M)z*GfjFJx(>eJFJd_^enPx&B366DW?iZdKm_qN*
zgz7?91;_4BnSCl(a(1J*M-Hw-%vM9fC}#V7%~5DcgUbaP;o^Mv?p(P`otL`@5f35{
z=ewV6E2F_Im(QUDSC~2z$e+*87><LI4S1?rGxuBXR+*~Mm%Y9mX}mz%YS~q9wAv(W
zuc_rBKnWLEMbLKPM$~xz%8fFhvu(vc$zB95!lso+exneCv^LHDT07PTzA|TrSY;2O
z>uq=dQ>hF@(OTDJ4-CV3pL_kX)>A0=;oS+1XLet{S8hR}7oskvqF{zHS**KyYIRhb
zUXyNfEFhn4gs*_^LT8lc+|tN&`<Qb$M8VOe;pQkBN<D^Tcz0~P;UUp>#4$T{kVa5@
z&W?u^qE0COBrS)tss}x8MwiF?0wRfviHG>5gm|&VE@1_k!jLbLkI3sjdC{u}oP>4p
zQ{*@0Vfx~r2?o?zt(a*+C^i8-j9QKOE`oi*8!U6}U}sYdI}^VmtXN8Hq)Zv9yliyn
zO8x9kK{5oGD8|YLt5Y2Fd8ZLaD)I<>6QyG;f))a$(jW_#uY=9+OCi+@MK}Z?XSdb@
zz8O<Y&RZWyA(U@A(6N9zMOs*>y~=8j3Q`07l(`2Oc14HYBWXr5v?IOh7PJ(osB*Wy
zP83<wpaHpwzQV$4YF!nY=ygud7b-0+u7m_QH{>`FsI5%;ycRt3+%SUTNgzGjP)NW4
z+B--RyKjenSY<1~@jd2pMlrXW@4w6AXyjK0G{!8+p84|}s1IN{Chs@NQ7FP=E7QMK
zX)WKUjV-_dHR7qavYvsjhu?jtc-124_(ct!YLG9^j5ioc_i*N<0zAk>;jCB)66o0-
zwE@HDCbcD&rETultkIQaGVK*Uc+)jGsSUc&ClMOu>TymYaY-4FWY@GzwJPd><QLbL
z&zLE_U+MQ}WNyuEe@_KU59vz%c<f*}WUUj=f@g{RL!fZ8l5*4)-R!y^*JNUDf$i<L
zIdl`rdySs9TzUvPmJh6>@wfE>DX|Y>`u+aWIG>!gDq+hM1?#5$uylJ=-z-MXqUaIq
zeGV4eWwsSFQ`&=hLbq{Xb!l}vNtlYv9mXhf8%m?kihxz2k+2GfmAUS=Y8Ks6l+E`M
zBBa=iB98?66KvVrXb8-xb9!+!JkBqo3_d#<YQtS$KW_*acuq$kYX{vnv7kw?PECr7
zSehvcmAyEh+z}ajf4CYLEnR_)L@J^{7l0|yjjD+GzA8o<5xYJnm&Sx#M1E2<Y~9%U
zpxIEZN(PjidcUpCnM7s1qlF$>;9wrMz*QvqZ3_qHL+hHGySOoSNzzhk&&SJaHs-$5
zk0H~qD2^+(IOY^m@4WbiR`Dd)2Hsf+;5Xo9_sQ0oL=x%eGPxtpI9(Z=E;=3n*Shd}
z&`Y<Vov~kaIj@yHuSg}jG@Z9_4Rt5d?Iwsw$9TGFxVOeG@9Vh;e1&@5fxj=HqkX#6
z^%cf-A4-GL%Ut=y;!?C2{?+ZRUIMVh^`TFcLm8;a#U`j+T0{2mjn)$90T2aCIKm9-
zAXZcjS5~E$G~C=Cn@*Mt$>x>_S@lRSW%3-&ucf4*8!n<5u}PFus9C0q&>waHvIKp8
zQ_&Bx&b`Fctl!)e7+Mr-3Fknig_P5u&>O6dC+JS|VGX`TRjEO6IjQ)_A76quFg-f&
z#6E`Rtpw2-iKIZiZkD3b{y0s&ikt!x2S>0g{Pfs&?u1!L!Jr|9VKw~<|L3bv7Z7ag
z?8RNi3NaQNB&ouEw^}ugx81l2JVvGJ{=11v5~areSC6+npL8un%92lzlzT{%=rzs~
z_4$zW%t9%O%C;I(h5qs{Uzuw$ML3w(8)@t-noEeawIQLD8@p)|;U#6;Nid_8Q*tLM
zNxfXR{bq(yM+aCG6481AzFMlUGz9k>yDbuFjC^b0aqJygyqMHTY&^^%N1nisp6#xr
zoQ(}@(f~_+s%f)E36yd=w2l(591Pw+{W#s`nUmnQ*7Sfbb*A<-TEZGxuMvg<4}RCx
zxQxl|``N+C8(SZ~STe`{hNo!<f+<xQWFoc?<EN&V)SXw?*B+e_L#W(v>aHrRD`}`h
zoHv&nLo-?ZP&A4G5X9NZ38(8(S^m*`Uoc3E$EaAYSi0!O0;UgPr=twaiwP;?UHz}=
zjEjjx{54nw{at8_%<dg7Z@YJ9bos)zve|+r19q}Zml&=$H)>~Ij}vEhxE^QJs=LSE
zJ>yw<%Sr3-y|NR00A|MuL1!fO;lz|}8_&Eo{+8xa)Y-}Y?g79^C>epN?JDdfI<p6R
zInH-0B<;InN`qc;GeP7HH7o<*Gb!k1^wQ9ZcpoL74k02$u`YoqNy2V{hL-(;%z%;1
z0f>brFclIK7(5!GDGVh-PKHIihMW9ZFXP?4o;|w&Z0d4;8*(19PMy!@N>L~#78*Re
zylIiQm)&;;QhmlJcXpBSdt!}6-tH{T53NJXZ)Q+<rOec|XqNZ`qvfX71u#RCddg>J
zyjRjz?g4bjqxu9reIGZcYV*0%STX4-sIt<jw$xc@v{=%=+<!hTl0!$wLV(9ch@0T$
zxfvkry4oB9o}zr=yV)9mYOoE6s}9u+eZFTYs61#4G=O%0mQG`F`nl>#q4}z0!W3u#
zzn~t;M&J<ZUQ*TNw^2&~lcFOrzdDZIt>!A%YgI6E2ColXm)%;YpP>yv;#N3U-vTm5
zBv73A;N!q(d78KfR_QaA*)yi?J?{w;sTdZqDO82S$7;sIZYKCZk)mwOh%k5ChNuF5
zR$B!f4y1bQ=DpVZ*`R*hUP1s;lP_|8|5zkJCBJmf1<bOuu&>O90UO4nkb1=X&(f8s
zY;^Xl^!Ci{g7ZG!W_eA6TdvR~SZ>g2Q;1E;V~?XVXz1^=`f2swf>nd%`kS#a(2j>5
z14f;%&+I_&n=jEuiPq&V@TpCq?PXc9UyinG@Ix81iwbz&C{ecv!Oxw2Tz)%su282w
zQV4I#m`whf`DQ*2#BYy&qH?+^Eo&#j_;q8kTJKVLd>Jc64f6U#pHGx}r2yl_Sd032
zBw@5$MMw<mu{hdWj(48EoQFN}TL)_s^aRJNeD*vyulPguHi^;2El79tlEjnci^|O&
zv>CKQCkvGBIIMDLb-Hiollu7Y!cgz0uPAD{rn<VDX=^uA$&yRtBu@pKxf&q90(jx#
z4%DHli*4x{q|~X+Q4)2!*O6!!9Nl9sELaoX(Sy)gU57etYvV>Ju}gKa#IQ>mu}{!T
zStpN?Cj%R=y0n>!kT*&)XW0j2ZON~zl}RV&xDjk9l>tZ2Q|eqey&?sbpBtATYAuup
z9n>@=BxlI-+|CF-k@sR`L50aW09~PMHka`hZO@LWS>JhAt|%?crWRT%AL>11w`eA%
zDoa@G!?Fr7If}f)??>+)d<t8k6?p3Nq+{Y>jC`)T%8`MLz-w*FQ01Du$#4E!$3{mA
z=78a+59_`N+7vA;L}aE3M~j)nb=s!fKAI8a)}Tr5_g#!{w@#W~mT_Z2eAPnX_AsJk
z0!7m&Q7Ksj(H&@Da4n1|Xw?dk=y7pXm@#ESsg$svxz{d#_=IHGSz15q?$o%PSoXcU
z!s=jT%%r?M4SU`(TdxpLgFTlXAwVgAbE(V3t;WpLRO`h~5H3P1?@_+fXhZ|RX<0u?
zik)vAj&cL}8=2O&Othb2<`z(%Bnw^6zz8jJRA{8?Rguf=fm&o%2=FbnLuiL7mtm6{
zcLk&Cf+&TO87SF^anR+Ho$YM!KJMyU91k{%82|R54sSi0*}}TH4;H1$Wnb&t-wnPv
zY`=Ral!RGw$L52vtkmH|XNld4q%|$V(^gF|PB5~Nc-)n-rW5a)2j!m8W~p5KT6N0l
zIfofpF%njvXo#16-1qT^C;z)J2?IV_=-L}w{aM5I;Banx0RQ&|%rzkVB}4xxSsptf
z*~@_1f9!XRy4@k;@*M56<7=`58KZYT$<hy#R2Z@9haK$#3UnV^V53s5x6{6O8nxmt
zljtxOMz;AmDfsaN2Aw+;K%TB@%YNb?+Gn4-DcSZwwSN6(a1-Fa%^kl$PZ6W-sW{0L
z{N_cR`P810Jb%_3R*@o3K0|VUwssqNo8fPw{aHlvGTePDFGD<9VeB{p+pYnC(*5yO
zo|HVH31-?&rI-vStLW$9{+@aBov7y`Ffg1G_D;Mb$1ak=AIeQ$A&F=OCch0^+S2N@
zqe~gkk|hqK%pSYupPAX|>5iGwtQ!&M3ZTs0f1qF*=-o_o<7L$qxBvF4%;kUk^4~??
ze{yF;@Ph3E*p08i?!*J%!A0JmVvi)ke@^f}y&E%P0c1cGxeUDbPkzVa3||mG_&Hv%
zq3;fYG>W)4F~B7Dleg}g-!i{A+h@26m}LhFYZtzaY+20aOIe|qt?WT{-OGwukn%h3
zc0U8g3O0Y2e0{PY?dz+myZml(u3l|owF0aGJgyi}&|pK}l<oG@W)^c#f{1(^O~ig8
zX{n~6Q|$1EH`(0#N;eupOLG(1r7tMH9ol?hX)kaAM3Hkg`|u~4i(|_tguV(5>P)8;
z>l(Ql<2i}V3{?3}V5jrm61k6uu;U%Ktr$hwKusTq92PG3&E_}k-_N&_4?f<?;A%!7
z)X%cFrVzl!(b&dOSIN!R*g^XTnH4_<W*1Qdj>X%AHfbf7?D^qX4}G)9&*X`^=F|F1
zA2yw&ZZ53Su|iAv%e2t@F2>oJYnW23%U`geDtM^Y+OZlybL=HJkEFK0)*1Ft(L<Mg
zwn6yO3U<(BX1{F602=}!)mg2UtpL=;IgIt8YZ%tHZsy8NBzK}|Q(!Pb4YHFk;;8A2
z-dD=_E6cp&H>e1;G$n3;d9w?8Hwi7#jXz<T2^mygf%s-TAe}2W-a}9%?i#UyYZd9U
z-YrGW;x%DamPejNu8RDqh;(I7EK)^Vx)^bET+UZO0tVZ=8M9~k)eTAl(Aq}OrHB;I
z7|pLPZmBiD!zBSx2%ToIG3Jun+SA=I)l5>D*EE5Qhls0sbU|=}`Uue<O5CS_TO7(P
zF&Nq=yIC9Ew{#aMpqYW$;LEb^s=O-g-C_8{@ztH6=$$#xN4^Nh>l#ou>;zxT9vFou
zkeCp^X!JjE00$?;69^LUb(;_Z;vZ1?*}*?EV~^S7XM1Gi_3?k@mfwy3nOz=rei{w@
zOXtUG_<zP8m)p<wXza25?Ms2*?fv<!z@zX_d(?kd`}davf4V6B4;uWJb{IH-|1$a?
zQv6T#KWW=v>bT%a-Y@mPNZkK7=|^(%XM3EqBY5%rpei4y`_GX4?xk{qzvZ4k2l{7{
zdbIP?OCSHP_FpOM&wil)C|&*P2L@cX1dsPuA?yE5_4knvf@AA1YV1#oe{yKQEFS+|
z?H8l=X9s`QR)2MX11`RS?f!kz|8LNb-0;u#h)=>#e12n!e~-*Rx#CCNpFZ#YFWq0v
XvAh)YkEMnR{_>>{91>Q<k9z+C$pw*}

literal 0
HcmV?d00001

diff --git a/application/src/test/resources/file-type-detect/test.docx b/application/src/test/resources/file-type-detect/test.docx
new file mode 100644
index 0000000000000000000000000000000000000000..2b083a6fad6ffabccfb63dae99c8327b0a58464b
GIT binary patch
literal 10251
zcmb7qWmp~AvNmMn?oMDM!5snwcXxMpcbDKEHo;wkySuvt0tv3cU4n;jAv1Gkl5fs^
z?zevI-p}fKm%P<oU8}0(r2r6cV9za7c7y-<`d5Q}`eSToB=2Zv@5CVgB!=<S0rOLg
zoYtjB8ypPG{skBq%0I;n?Ct5@ZLBjudUgSf82zhBhg>KtIgpP`N{mQ5(={n!7gMZT
zB;(mO3zpv&D~ECqUF@#Y7c;*v2w^2PoK0jSCXrm`q1?ZOc_l?3Q`|}OMPS2gKvCh7
zD4h5M4UQj(hYu8;2v@hI&y5X~-k<$a!YLT?c~TL*rQSYGaz9a%;u3YZWCKApE<+Oq
zs~<-WRhu>pZG?Xr@WAWf+wh1;M}BZKrskl6#6b#KSCWHO^A4#HR?0#v;Fx}Xk~Eo?
zq=;xpcmI=da<(tAhYXv^mj@*?Bn*$8o@HlKz9ur6cc~?Jrbrl6`2{lFTD!7*5cA9n
z{KxjS5wD?OJaKgH8t01zE8g6!KIl1hHS9F3P>*<KLvM9aNEP5s6uJ1A-H(5{Z*y@>
z4nalAW0Ww>>wV*i-(Ne+9ahNT!T3^UL?2gX15ECG7>5F9@HQ^n0L3B0_H71h<Lt4E
z(B6-4E7n(lUp2w9h^u1$q=}>_O`!f$6GnE9CeNyfj_Z`|WkeZpBU=HUXL3m7#8XO;
z^Jf$V38RLM*Ho5^YzQ~(WmTi$+kpY_4MT#18wGNG;L}+V1^oNmTTbq8xmJUhHB!~l
zV<XH+1T(*qz(b7VVCTVPAbPq&Ye=GZi^su+O%h=24=ic{#{sDl93TxOMJM@0AS~u2
zx1dq^1(=b@U@Y1ePB7!R!7HU)87eUjif<87VD}Y^161ZcVXvCN7CdBxG2^E2QuIdi
zAs8coZ!v;Y=bX5|7knmGx-88(WR0hqy;vGk?zgGI)nT`~ls?ns$dJvjD2*~W_qxgT
z^VW>9bW-?^35gLJmG}`-`NdQhEdb`rN1Hc0<-K_V$o(A$Cv(RgM=nshTyr+i6<)X-
z(Iw~DU2HV(&m7MhyxV;I+I5!se3q7Ju|JlECiN)NL|l>y?{&;?#savKA5HG4%JK>m
zZXf5bU#waguYzrm#00@IRM1`tF42ze-&6Hx{i+tXE*}=^C$*qFsRjKPwYWGr+u1xT
zrT`>k708bgauWOldj7tJXy7xVWmqczUe4PO%~%?<!jn1<vvoP&I^Bd)6JL5-yzAxS
zz8I6PaX;cZp%k08On9+jv?f9Byj<b~m)T&21Nb;6`B|kfLAqN4uWHEFE^fRCnsY%F
z?;|i?qPu&+ASM<SdR}e7t=dr{Z?L1Lg5X-5U53WExPL~<1hqdI$b?(!#o@i)70k}J
z&`DxNH{oj9$b%@$F2%b}QMqTMRk&7;5LtuZ0J9f?9jhNF^zsyD1IH+J+HgFn)NKuM
z#}tlR<<j=@eh@meoWkIu_-H?afbh<IXZh6dFj;{>amYKsXJgO-gKU>eYEorAi@956
zyJGGkSvC<o3zR-Z35SE+!@Rw2IXqXU?>&y=l?hr6n!Hs{QZprbruN@W6yy`NZg!5w
zznLdmqOGffC-b#p0tSZsmxz<IhqZ~*GxO~_i;j5%SU!9zx6l!Vo85_a)hrcL`KI2S
znGrl&N;U6yu<G(Bz+~{M4sY*jTbsi`*<$SmJHuFLRyJ2AQ)=#y_f`ZR4B94wuaq8d
zPKU1D(T3#7MvEW6JA0j`otSV+31STg$vv=V-gf%k?D3t<CTaY@IvWG{leI<#7I%(Z
zd~;+T4#0e;;Yz8L*_8xeY?#<9R-fJ{?L+q|kbi(`v|n48#4jzKfH318Gb;TqSdyM5
zEKnUn($o=jphUlA2z;UYQ2bH;{xs1{cQiZ9BMyHcd;@ik_`Nmxr!vvVYIFPWQoPN6
zS5yWE<wx6g<ax~!Miu5Y4JfAYyiYgD;rVYlc^APg3EW^}(&Cf&rsVDK&Oo=7CWB|7
z@r{wAyTerGNLL)LTpiIf-7!ohlVl*crfcE63TTVD!<5tN^vl8J`kQg2z<lOb%=)j>
zu-^5Y!`B;Y=NHVNh;dT!iOaK;M{s7A_-;16Dv}YF2L+yzeWT0a@68DknH~pHiI9Ta
z0wXW@X~7PTjpAU5IyCnD-gK_hj`EoX)OWTO$Lz5L(%OOhqUD@Y5Ut2XQC+SkN>~`_
z-<Hzd1Lc5LW+u(xO|)^|`&sEi<vsQ1{g1XX;W7_*T~0M<z(=e8_d8Lc@?Sn9n{i{g
zksvhFU+&Lc?1+))2MDI$ovf%ppO~B`gw_&-v6Wn@#Rs!jg3GxKgB|g)6?RiKz(fOs
z=ZMn)8j&jm;>oUe*fu`-gu=r$8`6=fZf(d@4O;~{Y<<J_Vbkj<X1zdPLL>)Xf(=8C
zKD%Dvii;qEq%|n$dp*UvDA=)VFRFj*dnbss<9I^wCN7ZJQ`gCJm+w=TA`W<RHoqgT
ze0*pKIVBRJlsq0@Vm2cyt$>EPdO+@E6$E*X0W6$gFIv3NJjyw5uMO$&U?(A6{up|S
z6T?m=#3?Pf{d67)$>cagh52{Ew^}PdN=1zd=e44Dk5$dOq|;i_^<&F+TBbLLgBwvs
z1qC`gN+Ef}-cm4d2gKwI_MpH};$nO>SkwP5Wga1V2C2r#+B3Lgu7U)VB11bS7vU}(
zx{RmW>+(RuTPAUql@TC~mMN$v(c9~2$S!I~?$)2bnNN}0o)@-`6<mspT2sweXqOYg
zaG*YA5Oy)9r7&;B(+(IY?dHMf+e4rixcI!5m?AJGV&1Fd(OQ!^vWLl?a5CBhyzqgP
z+q#F#9J$8yZaitkixd*o&Juo!T4z*2QoKVspca^-{t98iZTYnkffCZLs?g~QsgiZE
zddvB@{H~iTzqs|ZYvE4^mf6EC(W288T?`~tEda(Q$hFU>#x0X5@>D`X`~`@J0*!AF
zBDw+J#+?B_Dmp`>scJHBGc}k#T0oc&<mM6t;B<x<#KjTcvu}CPV6bWy5BRotP>vi$
zzBKq0F6>A#rwuJY>H(0=M#Dd49>C~WUC(Zcf!PiTw>5RMqf%p(J#+bf-kzX9Hp^Y7
z6jkil9LHmmgQ{V>;oQ#*iax12u&j={?)r2#MMSC&BN#8j4qY`uc77N=AaFfunf+s@
z^X7ZfnUB-;H~SNxpz8EZx(|Ydc<<O6^k5^jOknAR0$QuyhD`X2>zm7>MUmhK@ZBtG
zGph@;-Ep+O^$S{8s70dOQO01wD#RcZGkQc1d&C<Mr3xuT?9P&g<=L9r^NV`bn8e^A
z*FG7T|ACD?7W1OhgMX5T?L(mM{+i<0pkJumr0qRYR`#&chMovQqJA8$`c0<)n9wC=
zY-?CHvUan$s3KiN7`;@bB~%OL41%*ktO6<pZt;5r@Pc;;;LVYgET6T(yUk@Z;2u>-
z@*}GRDBvpvC?d<Bu4Mv+(bU~{C8`rBw6&Hw=w%JmQ{#-z*BeIyh-FxBG&=AXhtHR@
z-*2@FP>i|-$|jybWzeo7KHbRD_42Ovzv5l@Y3mnAyr)B|ftz$9<(4(TkM%q_T#n90
zVMo<tju`G%^naP4y-TOdyf+WW(nG!*j{WJSZn#{cB;%6k?8ekuej>W@BL!68LKR`8
zsilXLT44!Qtq&5kuC4Duia{IpsLJuUD&SSl#CXSRnvO4i`DYZKSs9qx>@1+QLabBh
zmk}ftI)UXME@~gBV%c1N9K53%L&TXU;|`@8YzG##8J|{P>3zppbtbR6>g_lrnzwuE
zNGs3gq0+n^Tq89(>S-YThSw18b#vZQ_1TuCi$(k;y*1{NJVFzM7ApG<K)7f7$H^wT
zY3_@;n1Dn$Em}zuB~yTg^*W`7bPbYmHKd7_M(EwRh+(MXQF*;k_!ZW2j<8qhiF|Im
zi96-giYIrhIiJBxNkgSz(G}|8mm?<AAt6=}s4Z2)LPD$|NSu-E4XFC?(-rPU8rI+o
zn0B<0bZ>k%qPKd&*b_%J+Ny;oHloQLvFvC;weCjY>HYW;o3B>X(bA|{-!zi1sMDvt
zX4SSi8$g@i%mG?Pvd5V}zKy)=2t717;tXJl@5jp4IUCUZzl|B?Zq#hOFllb7^)&5k
z5A(2vjc77QY`e|2vb_J#<^9*8YOux525RPB)X}V{V`(|x_2G{OquS9X{kb`*P1+T8
z60@iMJP{K&B-2(+hI2OHIA51DHPi64f9vx}l=^25=vRhRf@3zKO{yWy)!M3Q8+N~i
zvnRrnJ~8qqI&tV9?2&=e+>Im{pLngY5Xvk5o3KV;z~EeCmUt!6qOC3@_yNdqu9x$2
z`p)5vXE+*nmM&jdr{`MR?Yh~8xTjC%iU4e<hrucD+bg5B(&c2+yu)p#^Gk+zBf$=*
zGv3kFSUK7Um|c>hTAepsMaX01ZJFR}U03_8?o|G~S`YV?;Oct5TatW2tJ<z?(Xl>O
zNXj%lHFj!umk?X;_UVxWDdyA$-5pQ4r(ag+i85YxmLpYk><T%#f9;wv+t<IUZn1P~
zw!eG@)(V7IMXBXKX%DXT5_Gj(0ZbyL9NkK!6&SsW@Di?DZCN@jKWaQQ9;~qp?a=7a
zG>vTKiJiD88biC;i4dCtuyDQ~#jt+c=$7np!@Se0rg|>y4N6*lNrYRzeD{(WRo7$6
zuY=i24bdALjHB2_`c?tI`Aqjg?`r+=SAW{fYamAf0t}4h$q#%!=KOT}oJ^dZEo{wx
z`gHZGT6P;87`}QIkAM-bV6da8+)oPd1=!t_uNjMcoZ<jYH)!)nxOWHF95LWFT%XNV
z?=g0?JDm8gZX2`G*&4E06LN`yD2}qhNfK}|OMMx$qEqz(LtYCT2T6cG=tIA`aXq`%
z+cC-S#=)3I3_^LcVZo=4|6Z&-QFgW~oEO9iV@zML(YIEqS<j)6Mq>9NZl`ZDh}qJ$
zT(;E*Ylg9g2t!hsP5Aw^vIJeyK#8zpb3WA!QDu(rV8t}SNZlH-v`KY=e-5(ZF57s$
z*jK-Z5MTw*&{ZvQL%K&Zv$fwVjZiJggd;ZJL7viBnv{Sq>ckV;P3iL0p|D;j{#V7k
z-O7#WM~T6LmsL6$NSRhwvX6n5t<*6VxnYhb15h02B(s5n_`{)nu{^pOi4-Oka*7IE
z4$Adai-KPSsLW4UTeM({#e1rFMys&3_3b(&hVf0}10}1M=H`xECu<PaV2#gY@z+SH
zqAJ2*p~6WS<5vs9;R}p`HCn{tLQ!<x@<N3Vpfz#H3t7fe{38J%OTA2pII%sNVin>X
zvZWuhdR#yXu7n|}lU>E^nYD-{?Rs?XJhFVqhoF8=3DBlU?=;JfmZ;0b(6K7@T?h#E
zHTSOW*PxTOkWkn2mse_^2tzX~!bzy0G}DN(VaZbl>n_TwmS4hwQgc&FG%N9((>$Vm
zd&Ns`=eE)rNfg7FFrd`9074r2utydGEVUIu%vvC(SUPQxa~|&0fmCZKwQ09$#3VIQ
zjJ$;2<Cue1zf}vXoW6a6at)bRzbL*Ecq6}>l@kTy*Rp{r#+H}wGiasB4_uWF8}Okh
zVFo80XFQE$jG@45;6$!%4w6<F28XDdO!o<QwpT;QzQBzlCInW`GfAg1GWi5bftHOh
zFx;|7PqVyEQvk%)mLHm0%~}aW`57adE+2`ERK`W4w$US;3Xg?DrqA@E>qmwXMz08C
zHjs0_t%tomlo}ylu?{(u0<?PFI`+PHtBmWQ-CiHvsP@+7p4zit$)JCgvA5yDt})ii
zP<ubSci7B=Ynq1rLp<r-L&rFkCT~q>qopctLny@(dIzAxdk;ypSAa(=@g5br+Y;jC
z{Nk2?PI~M6qcAA9WmaNtg?QFiS3d->-Q$bKF)=f<z-$RQw);djQpP_RnakqfuLpUF
z)|0s#Cyk&aV$!Ce)W2E#g0?S2T~U9}lc>|3ZEIh?J)v1FeoTEd9^9@QEe07wb?vM}
zRy~X69!gMcFDBPG@}dE0kBT%<?wzIKz-ASh0P9XQ9W#mzJzM|iw#_nucjLkwjdcH2
z{|ofE9oza>rBy_XtyF@grl$<ONm7^Z%ige6DxIBvJTD=NThLc%;Z+BB6E429&vxM{
z_sU*xKiu?$UMMcicxi5y8NyJ=tob#cTC^W(7R0A{r^x(DYRHzSny8JmnM^s*okCI7
z*dH-Kr|d-7`gGZp#oPTz=ljnv%fBBw;s3Hf&gLdICchm$m+SG);h@04T5-U@Fn<;N
zDbDnK06o$ee}~SF(W$oo$e7A?NVaLD0TM}jX9C|^MFQS8HO#?c%JX%|)pfW$z^Fh{
z#p1IN$nzk_G7>_O;alZ=Vo3qoqhQw2aGz{?MRt*3Sh^{9=k<49-;-O?B>L5l=Jrv|
z#I$z72^R`DYu<f^aTMjJU-Yk+OmSes&v6tIzp8TdlC-rwoQWk(CQ3Vm0AfG(V_60l
z$G<O+Mq~;wAe*R#omgK?K0}aj-x?Mjn}XdP-xXzxz{AHS@xa-n1k}4B-LGG1o4pIz
z(1v4U%x$Y=-5}TZR#wRBmv*K^jzP5v&gL?u0C?+#fQtzBgsS4~=`~gRSO9D=1(hp6
z^_#Ajm9aDs8+j#}?<sm6KWUchS{=sUvH6dvXjjf#eZwo@MdZ&zZL+X-aJGGImErof
zo_~8PueDL5{P>N#)MGGanp^2nM$!Hn+t6-h`C8hgYvc9?+tAtp%?-Q)h2<>41D^3|
zG^Tf@?!k-~l5U`)<ar*ZGlmL&yXRYappocx+o@?~P3tt>8azf-PJUvl;h5tdxn{^Q
zQwO{rW(0}EIse2f_b5^RMWkHgA&DxvIOP(~Ni5MXZY->5G(wgw{81b!L#pmB0of>6
zntD8sXP++$yY~Xk3Xy#|eQr*_b$=8Ek=BQv_a%DXK4AOt{b0R0*mGkb^4S`M$A7$+
z%X+vvNb)6Cp6p4-*5kYVI{zMf)%(W|@;mNR!kCcP-u%q80S7l^O~cIg(qjGf1jx4s
z5(tXI*5Mi4sFY%sSnqyhN)vv&#LXQFv@&83XykN8AvzuTmT6?qx1}V(jaONa0^rt<
zYQVh~T~AFNg}cyCrT8&?J2S8>ygSG42E8Tg>opDgO=d%BUZUD)8z|B&3_DScFvIQ|
zR6W?*8pPqiLrgjWfj_!N54#ZNF2qbM6e<Is!xJZ<Ysw1%uF6^?*+Sch`sliyRYwMu
z@Xr{12UDVmQkzuH9V>M7XSRg)CK{eGGxi%0dtE_6X8fi*9<m(=e*JxOceftR-fZ^U
zn`vKuvy{lqID%W}W6}X@<0L{C#dsO-Io@F<{QGc@7ZJH@u@Xez{hKj!SAfWrdTGat
z5L|n_t@uj;D;8;W#9?>LTbbIr-DB%^exidg2dV&{<-IxF;g8m<rXh{9O*twZH&@kz
z$8Pl|C-xiVDeVQK?MRJFnOsqWo69E?I;`W!Oc;IpXqP#he&!SFUaRS|pDz~eh9l__
z5H)R}#&xw$+E^Y3yre0QMsfS^1y9-`X}Qnn5vYMaBYj&`)^R;~)JBuXYiKc&DZ&`3
zXsFW3{<Q{8stI@eh4ay8bLn(6<DMAf6q7p&$?|eZyGHxkCjA8Lv-@nXsBx?6SYfWf
zzz+#D4eBj6*UkMYV-muHgN{NUzNhjQC~4n0S7?Sh-EeIr=JqT0SlAY3ZFj?J%NM}}
zcf-hNuH(oWohHi=%L*PTp~$Qu8Id&)AEcd{^aLN0fKtn>s8c=zNzpF+<H|5?QwdV~
zCbgBe+L@0#F`|X4QnzQ*driiFAiF4?&5Yx3VY%;}qr4k*C$lltB#nUIt~Y11hO65v
zJd<F|SMo&%SD{fT$l)MB2RD24gm6}5uvb&5#QfYz?AVpkCS<%IHwAHwKe4MGCaY*%
z1g}(9eE5kh18P*${_{b^l}kTM%pk@K@YxW1zNS0^1@xXR0|W-_h(V#xruAx0ex)PB
zCVu^8n3*)1W(xg6907Fqw$#Vbbo7LJo4G4xGo#AN^rG8aE{X=Li^VYhPSnb-uZVF>
zU~!saye%d)JnSzNQLK`S3MN0~)E+0)o6c3a`fzKBdjOJjKT)<6eX@R&%YW|QZ`zbQ
zTb{c;(p+yefp9TV6Tc7<qtQ$-fj!MKXRE=6%vAQHK_%opKR%9}LKHlaGJu`83$61M
zsJJ|G5ZF3^U#_|5O`$L5L8Tu#OfVhaf5ET$flgFsdK>8l_R?v~hm86M^$2033Rf!I
z#|}C${1N2@uA~~b^3`VlC1xuFbMDn277e?P7>D<MuiKz?KEPj>D^UmUf#KCXAph#+
zB1Osx)ILRw?V<nS<vyigTx?8ioqxuRRkZ9Di7|Y$>K^saGUsH|>8tmZ+e?wts0(~D
zVFq4DAi~(IUmdue(#<cav~xRfc_#q~CK!BG3K|O~S-R0NWC5EBvce<onb|vqt;1*@
z3;LNGiuS45fX};z50|6O(MkgQ5sqKMA!e%+$OM9!n6G?f;4}?*%5f9~Bgdq}i@ZT5
zQSz&B33s)`2&tLM0rKT<Pw*~yz7z$P4wwrnB59|{W4`vJRz6l!KeFTmcMeBftcgnj
z=tG<FM2X9nyD!0}A_OcYHet@NJs`0;p1rVZz4$Q7-@8kr835Jo(!Dt~AU4%yI3=~v
zX=<pK;FF$Uz`B7?+qs2ci_u_@A=ZVu1V1dkD5EmJ-JNlAru-=44ZpSu!($taOBCcY
zwkuK6vsRz)%H9jhsYoxnpf`S0*1Sp)kCr)O_Hw8lt)5_0{ED*<x&yyzY1B8gX3g4I
zrW0QO+Z8)xqH`?irAv8qk!@8sprYQ@vLF*}1vBpbEcS$t`Wst8U6GB@bok&#a`#$;
z&3XIvX6S$~@~sUdJWZ-S&KOc<r$VXOcBQ4}zMROZD7Qu0LHns(-O*Rp+Kjen@t+W8
z3j`Pis$VCiu2WEY@T)NCw;yfCo)AlpIl(M_Wfq8+%VaNHMElm7to>*Y@*RY-k^A8X
z$#XPFX>I)_#PTbL%;;fJgW#dI#4=79g1Bic#to|VSoOu#g|4<ijTP1XoK_|hs2p}L
zo0a^7OvV^{C$OjI8m&UxB!o=x(VA1QL7e$926GG#XuunRC)$7h0*#P9(6k8?ioVaG
zIe&iGQounn$DRQ@C-7qsqivJs_!48K3=4wh8xl#kSWUwhnYr^l{ih3W8^KSjmua@O
zQv!ox;~Z`-^>^RA8$*fZL&i5()UUUAi{~tEW=GI+L>DOgs8aC=_UjWaRYCq}3jhO)
zKm-Fr`^!BtwX=0rHZZjQnXg(-oU)x}#0WV7xrb6-Yo)W=v{)|BxRmmXx9SVEx+*o+
zhkYHA)w+U#u|+xQf<zNv0!O!FiFJpMIm$o!ly3?3B3xKy0sX%3$6eOr=IIS&WEm%F
z+<B8#>-|uJIKeq;G=<Ln{FZ*DjTUqN8H^bBE1mmP@%x+I^}t>cv$3zrnv8sjgjlXe
z7OAfY2SMxcjI`Gtf`(0;+X3qsz7gTQRqnh}SAr90>7Rhn=AK9HF!hJD(R1YRMDHxb
zWj#2I$Yd|Q#bRNY&(&ouNG_}+b!zCEaL5Bfg(c@$BBgmlEZU^M-r<MiAVMa2ryuv4
z64a826$I?je_B;H)}lS+&g|1(Gk`e6s<0z6St}Ev7(fU}ibu7`cprQj&q8nj4ja=<
zMjw^(waAJTc>>Ea`_=jS*KYPzSLF}(5y518j>OFCOs1?Y6M2F=pTDA~hD>ww4hED2
zr*Ou}t_?^dDa?j+LO`~=>ZgS*)-R$ch+&=SD{O;#>}o`t2)~1MdCAj9h%kc_#-C}O
zs9R`6RwuA|Kd9EYx?+jKA^Gtwn)EEOueYa%*Ts*kQ7*R4g98dR(>)RGTcIx%Z1(FK
zBeiV@b)v>mW(qB^G=3v+s=%6ngs-I`kV*&LEia}@3=;}^EViXIbVeoIUwNx>JVx}j
z%(*7XAkPpaD4tHj#=ol^9TI}JFQ+7Gj0(_}ry7su+EStlV}WcnQ%1gwFXlDBkCrB(
z5oprLS4Qa=`I=d#@^Mcer6^ldM&<H*n@4TCC$FDBP^BPmsT49y(|%mG_A+3)PRpcd
zA5QdfDsw&u_}Tm#TEK6TCeATO#QG8!QfhihhtY=@JsxJO9kT|O6@IHjMt@^A4)H4~
z$;Rq*^uo;Qr}2I^d`Bfd$XTD<LrBdG7Xgaf5IDpVSby!VO_E^gbvQ|rKuMnuB?2m{
z$tB<}#;NKjG@|6CaHE6qs&fxfAKsC^!Kf<};31hx&u8r;F46d+9=SX$1X%7%DDyVo
zO0ZR47_({x0qfCA%Wd;7nxL(0>&DvpqhE71SYC^e!4TIGXJmOH#XHX5k7qe#WNO|J
z&N?ibUAtwZBDNBPm<jeTOJPSCL+@0kDkU)$XM;Y@NCh;mR45a3aPZ7Cu9x>4t7=_8
zkfV#Q#E;m2pWPo?XyU$u{O_r?r!x$go}-EN@2P)q5)z_^r+e#9->K)5&>u4N&ywYF
z%aQ;ll;9J{Rp6Kp`yw^TCu=+5-3)Obe_+Zo;_~-c>3ScpK)<G{iuO}SX0r)zry)-#
z=Ro(Ic$-tWL>0t<Hl%?&+3t&D0|$5#7SBMT)BH7I+}Gn<{deI|o6PZE__dVuyfnKh
zUo+x0t~VLgfN=~NugOBSM`nh@Jl_!xtLUr_eVYcPf(qyGAT6va1P*1Zt$!?X)s=sC
zCi>P5+6l*WETf!Aeq#t(3B<MFg)R+1a7;CI;T=Cok`#-A!Yx1w$6`uIM_Y_LWS2Ma
zp#6BO!vtN&O=Rx<U76e2_&j8c8*P9?%=t1)_%4>S$s-ea96OG{XKWkszccxt^WwkJ
zIfMZvzw<<6(G#5nPuHJ;tv>|+`QiVQ-;b8Pj0giKf$f1)J`SIvnM5;m2eM~DJpMbB
ze#u7oQuw2bau5sk@-0&IA#y#d*Fv9MuUR}Uqf-WO5R^q=;Q}L%a6ADg;|I&=l!o}4
z2S)q=7PQ0t#k3=Q&(ZVn5GD{>5<e8w_O~*&W^f8A5ow(K>3(hvtQ4<|vimxoeHjhj
zeeZqn%ap=}MyT@+AF$735^;~$F*@vTyu**Jdb+SloUsAySG{@33rnQ<9Eos1NFUq{
zUm2Lh^>i>=MFu;UXoK2U0AOud@{eu%B5k1}Rgty%Q6@rcfk@uIgWCHNKk#3_7~aDY
zzJ^bkbd0B5?{g+yOX%rq@#GHaDSOzPIO#llMfLHcwmpm}BG(Cb$e>0Q!`<8x>KBo`
ziFELH;1w+3rM|-~@;CRgFATsjBo){}Xp7ebtLiVK5+_XI#mxg4L^^lF5!#Rv&ZZUH
z<aE!yKtL)zDtzvELr6-|-h<L^V@z-s-J@y@mfRa+@_k&6V3Dvjk9?$Is*PFJ1cg00
zHb{@fgJlUq?ze^MsR&F2+ydp>i8VXqe!6L7Rg^V@mwh2BaF}^)ny6_b!IiF*w;}SU
zBd$mj(tY?}P|k^SaBp#|G_D6elPL+jRt?upFhbOT<dFsD8s}`dkARQM&x!)f#t7Bq
z`D?e}O1K@#$e62Kct^efyKhe`@=P!1`#2TtcUatBmn|mi^>hlBq;|~e=q$LrA7HcM
z-~4)HT`l7}a&ufnP||)`bjv6^6Z#-@!bNx(Zk;D5NsLm>t^1wmilAk48m_M9l<0-c
zu>|)SA)v<RiorG~dM~!7eL7@SUJCpL2H4;AKff#GNiSgFV8l<qaU}n$qCW=s_jt;)
zrTL>hmlFLT`pc&LKI!k4=Na?Iq$I?DVSc_R|J!8GMNNOS=gFSiKT4c_-Q@2@PS3)B
z%t!H0*q<d&zpwW9!koX+)lX0Je<uB_Oy_s_?*$}(!^NN6r@!I<DJS{gHvL>C@ke{!
zbly`O{m-I_=MDe6Ql5?0AMF_;4*bP3{l3`Wjo35r52hS`1^z!K?e~#>KLPzck}vL`
zOZev)zr%lbFaL(?KN;7boBqYw{2l*$n&EGJGSZ*;e<mG%hyPx8@;7|oFV6q2Liq#y
xe_<cz$?pAJ`(FXaU!T+8LymvXD)1}t?*OE{6y(ph4&|wOZ}RDRA}4zW{SWXD3>yFd

literal 0
HcmV?d00001

diff --git a/application/src/test/resources/file-type-detect/test.json b/application/src/test/resources/file-type-detect/test.json
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/application/src/test/resources/file-type-detect/test.png b/application/src/test/resources/file-type-detect/test.png
new file mode 100644
index 0000000000000000000000000000000000000000..820549a92cc43233d73e8cdbe4683f3c5be07ee3
GIT binary patch
literal 17156
zcmeIac|6oz{5L!^2BYjGvJGZXvPDw1A=}tP$T~%q5DAraCd$5zJ!=|Evai{vR49s(
zY=w$snW*gRbLP6P-~HTwKd;yQ&-1$d!_4=4&iS0rd7saA-baj?i5|<56GtEr2n$wU
z+Z+Ocfj?mo1OxcBcK72B_yxUfuBQd5dM~g5fgmARZB5I&j?_HH2DDD&LDxK;CRC?D
zI|X?Sc@oA6*M?pyDnsd@=Hua-b=sHGa=Gawv1jxdH2Yu%oa{^n=FFz6F=VHM4!50`
z+1V<$O$#hW9NHGGJ-@uJ(Ali=ISl*~+-c$9u<lf(34yh6WtmX^5PwvJ|432v*>`Ty
zFh5j1wGgv2AA~*Z7i8YnEOdb#UiSMl%Sz~HIxXWt-EsT%uti;bA$Mnf<Kd>?c{p+g
z4`Co{rX(W>58+DX8f(@bcc*7%x+;`l(`?*Ha_o2v3@!&@;)XJ@BeZc=SPA_dqr$sf
zQ7stCCt`jKcR>w!B@VnI{jx*~p^d6>-2bZK{7U`w+O#K^uj_0Wf(?q$7RN)QnX^{e
z-3j>6rRnkqVL@%mwMsDQJBD{ab4eI4-V7B(N4SZ|MR~;CZ2i<nY+5e!X?*~JKSbf7
zyqw79i-i|q1<C%#QTukIQu?h;&Mf|*V`dD5P7b1YlK`Z2eb%|Hk&b6gl?y)0wdyZw
zn+$~_*02z|K?zBj2+TFO7spg<jQa&cqO=wXXfF|gg9scu`jowlX<62z>y^8J*@C=-
zA_7BZf->V%wM4jJX9;}en|mu6YrkGa?>SPUP-+EPGP4*6EL8*##kph1#|hqO!JM*L
zDoQZ3OvwfG%Edv3$f1xkab#&?hQ8&WN@9kQC4U_f0%e9cLtr<VD#ZGDJ{N!Xy83PW
z<WX&YI8rVjq5z49Beq0*V@Q{|GJ~IzMmR^KRS{rrWL`X83bv_lD|hSlrh%>Gt%TkP
z2vBxB6!BbiwStt*WxZFrXjXLPe{aAKvoH+mi<vlQ5HucR<)T$+1FL{aHm#w4#gkRg
z`$I85&ZE>8w5867n4N|)V`_^fZn?p|QuEq!-5p6&6}>U`pp6k&lQT;~r<OcW1LJ=c
zl1TT^9S#(+^$*{P`DNkD+j8D=Fhj$gIb3s7*r*=*%g3PVZGZPARo$@aALZet%bSbU
z>nk6hsC8Lvw5_j%m`kK8G2tK+q&!oncZRlY2iZ?GZAT3+lpbu~j@W%}8I(kd%EM=w
zQdV-^jde=)g%b8m##gMn2Evkb!$5Cw41`Y5en<E6-h+q(!U-0E@P<chrOgIA!G9+&
zv^eWx4=1r74lW3OG)l@i$uQ}(uW~sa`jfjW=e;*$>qRj^%x!~!s(qfD`u<WMStqhP
z?U<Z54(_8=YNC~t2&vCr6LXS6uY8wU{ykYml<^9YILEC6p)<2=VKmr4VB1*y-44%<
ze^bgiXwa~4=;NyK2ngoM^{YQI@%_leERzk3_rw&B;Tx}D!wV=^##bB05W1PRu-XwP
zsfF*gDhn}(SFrQVV+GAsHv@gg5(TXq($3XLFFF`f?n!Ulxk0+}kjJ9%nGIOj+TNX{
z-K4}4Ken<#>WZ*a8Z&E^65WK9!K|+)mA^FfFUi<|{AN8&5Z}@o6yZ|Lx>Nk_6;KSP
zteM^)8Dc|_UZ`DjoHgUy&qG%ap9b!C?(FY)a2?w!LQPiBywF|`IO$oth%B8{;jSqq
zb*n5FRB?d~re7l|XgE<A^nUM2;#r%`rUKPn1|!>Oo1;BiX}R=yPb?ZXcc=nURg<yA
zss&s4e(6OBU9yR^xmlgN)^xi!&$R*WLR86BKI}R15)bY7b;PigvL>19<2UxswsM<o
z?#Gh01*sA#kh*p>4)UkUCv|zsURtiLedi%A{FQ}=9(DqKOrB|>M#rTo>vXYe+&OO!
z32!afboqw%*m)7jCL!F}KsKW?Q9*+j5PyV5Z58#hM(~_$qpOcdP4{@@<=O$~D#Hr1
zj~<l!BpV5fmNt?PN+~RP7z*IcILJl)(-idE;l`iD%m(ipMVy1fBe8#m%;yIZh8SPn
z8o7|+&B-gpWmxk%S{Q3~oM;P-l{??vqA!)^p<7Om%9JLR?h@X@eFMoP`noH4@!dB)
zlC=Zx8(OTj;{~q0YN)JVN&Prm5zl);{P^vWw{ZJUu2F00LSX2ivkO{79z><ZqVMXv
z4SbLsrb1(bnUTcDtLI$SU}NXPbD;W-p-z-HPh&4ytH8JByrXWv?dX?Ym|D!9@n?#g
zwfiv}S5HDsiqyopsvL~J4{yLSk>peqid*+ADEHHUhsS?QHv}-fN!2@Z7}6noZxQ91
zx@NQ}szPy-pr2qgS?-wAqtw^)drcH@9qP(%RS@%kxt~^C`1F2Sxw((UKIb?P({Wt@
zm1AjrXqtO;TB)b1DsRkPrSr8{)aB~r(6g?Le6N1_S(PxUPcgV_Np*Y5L-=?auNpk9
zvdmXbSV!lL%QbV#PG9&I#1vc=sug3#|D!#hRG`>i8u#vAcgfL3ru7)8ei^SIwl<wy
z@T+V^{L4hM$?gW0KL=0UXfkPR>K0lV<LB;HwClS${L0N*ennW^OmlPMbo{^@(o~pu
z-xQ?im;soi``2Jflg6U3FaGPR8yW$-frg&C<ov&hdx|Z?@1F^8d-w^DCKjN_-$J7q
z7b^*Z`a0K`ff3`i41K+4y*_YZWOyzJJE8Pi$n}(Y<v~1gIUy;fpk*;U$I*`I;O@TD
zZu9=0+K9Hm&pMw^1%8FYCO#plbb0#m+7LQ+riv#urUs9`5T=B!qq0JV2qq}48D^{#
zkmV$H#lMg%CIxsCQ9=Os#=}>vkVgWo5h&_Xw3PWfv~M9PRDk4DY9KR@k>C^q?m-*2
zB<Z!-21zXZtWESN)<g!tn!2Yp&5vJEgIzm^VbqB|$w9}ST9q_*Qt*@l`kIuL!m-gU
zOzhj2Oclt!#4pAjx1uc;kHuE7(XsQ@M65b?R<<|W(yi9e<?Bb1Lq<;EqXcj`s{zfF
zYX+|%uSiQ`O;J8lft)jK<$^yCsB|Y!9hHzvAZegNIA`?lWnGpEDZB<bA`A)GX};V8
zmCcts5_sD1xw1ZgI%ZMDYsyiOagXDMwGu$e__}bP`ubnU@(iB}M=}Fc7M@Yf=5BCV
zb{;~q&E^TX3bBpM^R+%H%+!C0%)}-@GETvi>%new%hBBt01lAuY9yw-n(ik5Z(sg$
zHbNGBc@-7RooxGkz3byCN{SFOMsJ2|`4cOBi=w<kl75{t-kSr-0-HkgqZVATf5pW^
zMi#fb1Yx>Txe$iJRjAyhoxq7HAtsUSc+ycWN(47T5nWS4I{Ije`*+Z!@o?Y>NfWOJ
zi6>wYq(7hie6Uew!Uz`(P8Q23k=%2I_{k8%$jK=}X2ys<&^OW@m4N4;^7#8I3&{xU
zW>?msxOT&N|4i+oq?KKmZ+?h}Fd*yiGZ?suV7r*OpLy_3Y6TRRoV%q47hr#GK=ke$
z*7@!edi*2TN~&hcUBZR5bM+*ZMZv8JVy#<%`u11v09_6CpLl#_ZEd5H_gUruJCfi=
z1k~52Ap;$5M@dZC4bh>LDlbc%x&E?Li`+EbX-~0Cp|72hJ%d~MDi4{G8cRILLkS*x
zDz*FY+KS=rK~oet(wK-B<aM#L?+HTHG?KVd`vorbv6CSvi`dx*W9m@PQH^1GGtc0Z
z0<i^m)@>$CD!UNV*ketVk6jib@4wXu9xUH^8+P}@^!I4@D+&yS*Jt?r-6k25cnKxp
z4O?{SFCfSVlJJM}V`8oo>RZBbMTv!1ILQ!~E1y0Q>lO?Z;D6WlMi11Uko1-`bUO|k
zbsp>yZd9uJ&nDyd)uok&RzCKwj7=|1KZ^-(UY0+>0!ski>V(*LhA8-Q%7eW3N^bkk
z;;)<B1jma;ngp7Jce{7A_no8I$K!Qa6ZYO!g|j+m35bFTY2yugT@Yhpu_-;rHl)k3
z_1Up0^G}stFV?1nkFRekyAFL81rUv^StvgX;~x>;+ps^YT~B}6m0_9tEL*}}Pxxx4
zZ8)1VcLEblJ!WteTukm6i3>F@q9y-GaPeBTwHlY$U3}K8Q{X-wvxrt2*!X7Vjep;d
zu%54F3%A4b){kqQR)D&_S$4sX(cWU@J@eW80vL2b44Je?jR=31VNq*r)sG+z_I54r
zl*%y-%_M{H`sz@!DwL3l@*d(yO+|Z;Uz!&CLIgsu+}#@LaD(weK8#%4mEcs?Aa4Y8
zH9av;?(#R*Th?o()*T3znru!1jkR0X*zeb0p57}kK<$q|%f^@5ebPF(KH4?+Rrk($
zupqNGBWL{TbnY&R6Bn-#y*M0m{?T5Jb3*4CG#=X9P?KHS*hSjseD@n~khE~)2~BH0
z&hbNfP!M*|bDyv0b}O6u+hs>-<9fHWNmNHIZ1=X(rlBX~7%3YA_8aNOe9BT2G0|8t
z9mKoGukdeYIvn<P$E~7)QA@L=s`_>4P&i{s{GO4}VxD4$bxXqc?s9aZfDtB^Q#D2d
zP~-R8(sHDYR8@$WKeBBHDG!fbH3Y&*HvUon+o??{k1_1Bq})hRq$wv!u>xUt3Mlt!
z`eyc~8j;7yey4-T6H7{=p@MW(XUrVv#h|kNLwiBG;_YvgLrXyeMMG2qZDqt*q+Vvw
zoW_m0{W-NpQf6*%*b`DFohO<m)m>!{Rv0G({?g2Ye*@w%5D@d(NYUm)?vC*V_>g1R
zW3Mp|{N*QlCnc!9DA}(MXd+6$@YQ{?GOQmW$KK9vV@r|Ei{39I<-q>8Zh0YZ@WQZ_
zl(ibJmcQ5?2VCVpcw&=ysYwgxS1-;~5)Xc9|B5FboU5^-X@L;M^%V)y3Fa+P93$1J
z;Q8!v)Hp#+{sc`NUgy{>dM+Fb=EdtfS*^y;KIA<ArH2~#4~^FatFQ4UOVsrRZT*f<
zUtK)c>^t_p#%8%DzxW}`ne5#@jf1O(-5D~j`%xor_Sv&QriX`qjUm4nam56qWww%U
za20lld7x-2@vz}&vIGldF14btvN^IcYMN8FcN{&wyThhS(L11gAsSTv?@FI;H?0aB
zpH#iHU8+AJTBr2Saz-8hYA6bp^XbIB+17XxKbP_KE7-2+ihqze`&DO)2%Mxrd7yer
zzJy2RE6RB%iklrpn+D_JtGee}xB!eDzpDPVbEE{s6mQ(Zjy98GXsd159e>kL0-(6#
z<@S$e8j7(ic!Q_~kNSU5e7j=Ex&&w;o2Mzc!Hb97$#Q3W*{&;eccqB-eC1mIkee=e
z&UdVS(9)5ryiye&)!Q`*9SqoS8_1t>;KHr8$_Rg3%7c1GwaYxBZn>#+1&n8;X&-#C
zL_XNLlX||x6|7#e4qu$<OOv<t3#&S|qPMKosKPt1x-{of!5G5+pM9Oaf-xSj;rl5X
zmX!RI+ZT)|)?%CT?ssX*iAd!CC6xwt(cnwB+>KAf#H6%oC89|*w~D0=?fK(39Jh`D
z7)TcO(w8WAkpfVmjuhC%AK?Y0+vq%p*X`lGHr`)MXu7JrrK|BCU_bXb`?fQujUA=;
zL)P(4dta05Lb_p(K4(re(jaHSpY#(O4P4gaYe@7d0v~$d%U=cSeV?T@d2G_?VPp8@
zhv_Hf9vaFtm~H3@sEM0`DTc(bBcKS7;j$yZNA~=a93qf^KKFseK{<)SwZJ1h1pX3y
zjC3>5{^wOZ<`0;8UnYV;dxV4#R>8-w*_<5zyov<Ij~Vj^t%U@SKwn7O$Gaukk+fH#
z2-N>yhOHHVN$EebpxCc}XeTbaZTPV_JX)|I3Ox-M%5>2%)o(4ie9WJLU<CHSnUg4w
z23_1uEbz{8&7Y(Mjbq4E;(PEW-7z?FP#7pEJoot#*t4~eRa3@96w_XP55hi!q@}Hi
z6al+5GM13$!XzN>k>oNW;-v_i&S+3@2YRP1lH3KP+;!L})>cSghUv4khcs4|$M=f5
zb`PxvW1O|+$aEUDpoAR`GKPGq<`}b~Y<>lG5+i+Jouct%65KUo?KG}Vw5FA0Sob#C
z1u2JuGLw@bEoz3ajT_@_b^R5~Bv;~^{Wzjm2v$uS@B~s$1Zt<+BxY8J@~tJEt?Q2`
zA>}~9gA5sbj<$oTU@x4ST-NVLEK4u2n*nUmOfQ7+8@{Y|Xh^sOCtOC?nqoML#rsau
ziYMxzB0}~US-Qp#eS&~(=;Ay0FcFv`04bf!f>}>kQ^!gNaqMe#yvS7*2ASRi$aU_V
z(-HthWDr|5<dDQ5m$(UEq`Ef~iq42%K^OryPEN*?w^+iJ$4V<waEyphQbk%H4~z@A
zO*v5miJBtPGlM8I_X8<xYwO@=EI+KBp3EzmPj)4moXpqChA3tF-^hNNdKP|{C0QOq
zh(J^6ABr-Kg+ZERAuKQ*&KV9&%5{kaA()%~4oo{1wd#y@I(_Cg@gY77ietyjh+_>2
zkM&{a3~gI``>`j0!+!&TuQiaad^JN6+)x8nE<aE#|JH|sjxp$P&B(hC&B?0VV*rLl
zBKRtZ&Eb12r$ZoVx#|&Jvx}*195{x;<y+)wa@~@X{|56x(L2*Wy!dZDkZ`&<Vb~lD
zx0-1ed`8$5&xfzmgN4%p6FM}muoWkx(dP__6{Z8dg(1?8;$Jx3r1s_V0dayK%P|}Q
z2$6igMS3p=zL*DJyruc(<_(wkpmc=?Z(;s*H3c8Dfwz(a-b^wR7_`q5spmlf3+f8t
zrK1OU;I<DjcVocIlR>LOdw^CyPtza3WikL|FmoG0=*)b7WAkW(f>s1SV94H9s%0yH
z?r@-$nH&KBi`NnXwC-rF{tpWAWrUf${(iBsovUMy#ot`g<)H+5hV4UIbSI*HQM-x{
zpQJJrl!pSvz-uD)|1*<LAt(;=E#BsU;mubAOGY^F9&2pmt1@^N6p@t4hhH^{K@esD
zSYM=Y4)TGyY~8;Kd8vRFh2ICdf$JGy+-Sz}=tC$148)Ew0ajMvBs32oKT?*L0jX*s
zs)bYr?R-gae_imf6UY01JN>^p{XYsR4#FI2|8vaLl2oPeouZLcXpOw@6RxV>NQ@cS
zzlF+7KO)I5iLAtihg==vTy*T!HuHuPb`-kbt;jQQiWn#$R*Or<>fzL}PN@x7+hvM$
z-axc3?%K{+ph6ueT)*3j7!m%!LJx+rn6Vd-bBTfJ4Hx&Siq?TkdKgF~M;Yv7kme_r
zi22Atb%6cd{)JjKSiQl7Ev1thz*i~3j8SZO!f;@%b~7>6<*-B(sRHC$HZag4PFaPo
zPTu}<&P@wWH)t$!i0pHPoBS*Z4tju51@GMTiutS#-K}Z%*=y5()Up5T$wo9ZI`&Tg
z%$>_`{-_Yc<bI^vL!c61PnsNg(0`J1Yh@>5T77T+L)tM0WWq~Z!Ng2|lM{YsP{Ipf
zsTkaP@;umUj_s>pZBZ=ehb(cBqQ`=gtJjIF&TIt2*ewfD&{GUIj4y$y{W3*_*yIsX
z`hi~#vM@p|4m!k(4W~X7MZ|;hu$+=um3|UgVu|fgXE>F|n1ca%V&XB~<adaj@6PIA
z3Iaml0R!4b8e3~3mc<sx$dnNJ7Z8$z?4)Y15qZJmowgv{5yZqe#k(T7$<2wh!*WMB
z<EI#KD57Zo-1&ysY6xj7@&QH;XaOh5#GOL^L1fKPw0Na%&Xxex@6f7VYO7R&TJNUB
zQ#ip$1{JLZxo%Zm>pqKmeu~Ascz5?F^i6s&B~P6Q3=zx<n?ZkxXjOf9R|b)A3w%~*
ze5teUMeb0advXCJvH09)OXtq1qzrVb4bkLURXLHL-jGRJ**1pG{hOg)?m92+7{25*
z<a1;w%^7IUTY9yxv34%)#i!)qp)?Q}@d`g>->M@$dFE_0O^hvk<qs;`QoVS;Fli4%
zY%}X!jb=?GF93*K8vMk4a{hXZ=f%k011n~XIvR+&;rj0NHc4At2uw%SN?LXx@Z|*S
zy<%=OKQo5AB9A__Q3*OtHG&Er2Us-QWB<ub9w&bKWl1P_FAoX3F`~U-y>#)xqtD%q
z><BGjdf{T4CpfcoiQdFIqwZaUP64`PpY<eSgJI`F%9V1Uf~QvEP7W&>{>7wwe~sl0
zTzT=5HmOWO4@oS<OA*PUU_!Byx6fcF&K*dhI?nUyghk>YdmnF@6}!e;3$3~SiojR^
z#g)8z9%cqxGPrPiFsCIc4|0@`?v9}?DcK%d?+hL%9yQb7+z9!b^I-Obl(8%1T8gpk
zFAL)GrSUF+rlMRhieI_wqn0s7jib2_s|PmG-l`#4R-(D$9#5=--ZrOZdUCDygjk^J
ztAJiwt1wghlWASX`@;+pxHhqgaYVR~s<y<PiJ<`}=cK5|<Fcm~-amfA4uL(P<-w<~
zan#ToOT9kgi1{1=j!E<^>m?3-^PhQB+f|}eST5_Rh<#6dEb6NO)Dcg}KnU1{I)7;@
z?(|#yvAr|d8M+iMU;3(i;ATms8=aRG?qR>5r&!(<^f=E;MFd<7RNlZ+mNShtbvAX#
zR))ixe!eT&HYKhV9QfS6H^;x&?c0y&|8*wfm-ggR{o!I&aM1e%kkd5B2IeGnbcft)
z=Cofwm<-|{6Mk+kXi|{}@nF>K(6H~V5K|NJsH#vvwOG-1(d)bbw~gFCO%)2vnV+dd
zuiept$fFAvC_BW!3>W8UrR%VB`a8VINcQ`nbGXhmAWs)vcNV-V#lM~O_f30U|50@*
z4}PpvT6Wm<mC1OH>MI)waYrTeKx{e2n?asLf3Z{R%J&|_@J)w5CRv~zh_@0&EbNRa
zuEbBwe2VopyM`B#^||_`*TITr5ZuP{sAfHBvp*j+eov&f-w8$&Kjo4o(B7v!@_sb)
z-0G<!c3##lLGe8R@*Mee?S9yYp<n*qJacQnI`wmS--W#!)x{705x?GYPpwT+^|~lG
z5XH>CF9O}q)0JAJc+q8g%jbx0Hl_ofQI$Xz$7SR3)FzL5V?~4_NYULR<KjGF!J{jc
zbS|pU$<k>hjh$l{TVP1O-|W$P&SVq*$lBMAFZfEpeQ0laZY9e3SwoU%ap{^$iw%)F
zaVKEMyx#KpwT`x##Vf9(r=NCNx-nF|Shi4bFLp|RN`}G}--WA9IS4Z@XA%=r{H+v1
z>;+@+#snYPg(oTBf|+(}P{HYxske_cakPU*d5&9}#<+t;w&lwYe5Q9W`!B*_PeidW
zyHVX4I&8V8UK;h4M-rVoJ8vq40cWIbZ^re!Ea;8HqUAHem)EAZs6D$2AuVj~Dxrg}
zbjxlTpHuUU!UBn;yhcm}nHvCr7r770IeHsQ^Dq0W?zPNE9M<;xy;I9;363X!Y>`kg
z2-}dH*@OKRpJM<xX2Bf`dP;rk8u!J(GozlbK*i8dwLV0{ezdk>{8?0a<0&a@9bF`l
zCLL5%2=Zu<l2og0Iu#;~s`V#I)r);2?tT3qE<kl*L%r#UiJ)p(P-sB;vO=huri$0%
zQTjQ<auy)i37FKfpNhXr_kF*n)KAOZ(+7s{lE{9IOf`oYlupq;C2El-juT`I46kPq
z%g6;4`mg6J4py7_Ahw-wF9xzJ%uBa0()Ihe5Pgkw0Mp3LEHQ>cks2+T=FO+xi-*Sa
zv%5<{uN5WMkC`p!b9;Ng8-4b`Pxv&FY6px$2(*QGjSlFaq2@@7|HMvrcsA^hTIa#1
z!%>(Y`Zbnm?9wMCeq5W~k14MTpPXRg>?o*#7xGneRvk2v1QkrzhIS$j<NN=jIt~ya
z;5`5D+MSlkXUp!_Rcc}x2s9_b9O(#iBCd7!r;I6eZbYrVpuOx0pRz8P&H5YoGQ3Kd
ze#}|+#6QMk6p>alQcZPrpWbjR{Kd}ufV@WZvg&0W0Y2igZ&kV=Qq~nHJYzw+#b@2q
zqF`g7fPqkp2x*?cxTV(0`0X8zpBlUMTg#va5=mM(XZ6c&Ur5A*t!qy69wVGJvmuyq
zziFg+z%T82x0_vv!x|{PUn(gRolo^Q45;d;jDBA`&U8!SM;7mS9f_LD0flB&5*m&U
z)r`@sDXbKb3h6g1d7rH3`qkw5tUhD6mfqo9<7bI4b2_+%#Rv*d;*YUq`5uq+;<_gL
zAedk4IXU_)<Lw&VpYzxagX3}geu6F3AJ^mPs3Svn8YaEhrha8KkVxTrD>1A@+7WEs
z>B^Y8ZmmzAmCb<{>U{RjcfB29)d}KDzz@L3;xQ%zpU#Jfl}7d!hl2$>xH1=5ESPjd
z>hSgr8ZQ8Rk3RnoPvHFJh@(5sYDZURXGES4O93Xs=v$WR$&DSSTU&B{+FKTlIL{21
zk4Tgo?1RCh^H1RS48@;ZQ^L~I4Mtk2kKWAvno+pH(>?v?Bu6&NXvUl9cR}OZ>mVMy
zAdE}MU!HUoa?Q+G<%i<BXSlF|ovT>DQT^7gAwhd)!dJxD`|M4Y<DyU7#wDem`Zb6#
z&<(QArv;506OFg$D9iG1&bFW~3RNM%Db`f!hvMIDX@=<CemX$VC^M1?cH5_hCmQ{!
z?T$0~fI3cD#p39&8h=iPa*i}f-W@RV6G>19u5JgPHiSO!?Q=tcPtVno-~6}Xj1*so
zfm=0w!CW)9qz~}hgOM34o*Fjcy9J-_ocR7R+>lbmH>-JMn|-T<<ZwnmDpc`|<h8Do
zpfB{?VXM7~a{WMD=S-J?OR@+-*w9uZqTS1L_4}FL2<|tuf}C^oY@N*lA!y}(>03$u
zD;LD%f;%Kv>E8RBp5A=C(};0=7U0-hJL?R2BbwH8*kwi(JY47q)g{hpMPSMS>EsLj
z(^${KCH$hTig<2@JcwT2ysos^jV9SC=>NrGo!%kY%zF#Sqi8Bsb%1fnyU{5ypYcyA
zV1FbZuGU1Td!^US2Nsjk)g<s6-w^hf@*1|W^H+SbhNKeT8*=EWGay+<EsNeG`&fIk
z6^?1r{j8Z!mcs6gKsNo3!dpda+yhP(=QUrQWC-@wNNtF<{{2%Z2Ut-r-Tdk?ZDQrY
z=I17&KXD#D=y;kSjn4b2x_kW;-OV24@EHKh-kLJClMcT^7C-mDbG?@ty?jQ(x13}w
zIPYFfH{nTWU<Nkq%;_6>6!Q@U{mGBrp1a0s>pneu6y!`gUXb4_3C0uni0riZ8gHsH
zlC*phgcP$Xs)@vg)bDFnss2x$_w}R52v7lX_{JMWZS`pLp_~EvL~li5zy*a*afi#R
z!bu5tlGUtO1}sEzD<4<pxreC4<$!CpuE1twA8RmiJKA$}Ua0Dh$gXF8vB)zmruGi?
zIA`_J?dtSC20fGCJt+y$=<dd)vW@<s_Zu5yO_}}`dSBfil6m1?@?YdlPL4AX0?m=q
zVqjav$6hI|t03{`mITD1?ArAsFjerIRc_B!f4E7+PJFYs6{ii#T_=(71U=sDo-|;x
zT|a!_&fc4j&*O0~WeD<$GMISx#8)v1r1i<8y?6CGwtRS^JjP?g?Y2!LFu&l-36Nj~
zvR!aR7<!f7=jBiwRPrjbm-NEj(wGUy!=`x+7QpJNQGhL1K$5&~W1Ctyr0KwUgNxa#
zeD12$hW75XFv*2?tN~(tun5jA0!qcJ$F9waa%4*T2`D~%?!gPH`$cu5oSq)nxiyy5
z{Y~T^4z{s-BhIn(gtFG1b26d}zkaor&YRK76*_gh%E9^<DuVeEj*TTgXjANr<44XE
z;Hg#3_1%ign<HU99{<*vYxFwRG@6}nt2MeU`5ZPqk7giH5d97xV0Y~rf<eX4K*}m{
z`x@j=*<u??O{ULIEh*VW;kY6q&0xkC+ooc8uzf>hMqs4>i$?B(?k{b4dnnF~Jj68i
z_H(M>%PU5l9}Wb0So>Ze?mD#9H<4~fTtb@BGO|1z+tgF<;TDtCvRibHHqxjaqt7zY
ztkC0dndF9&qs7&64WkLo0VRAbKttyk`d{t0OgQg_=U#tP75@In!_V$;)nBYzc+&P0
z4iR4|FlBf8+aFD=GW{=o6ne?ntRZyNV8?W8P&*Q@0`n=mv$}^@n9F6Eslai)dks;R
zEd+;y-gBoD=uUM6s$XD%vGbae!-O|(Gj#K;PG~tk0<k-!^ubcfelp6`Eq<~&Y<I(_
z9s&qtI92HGMtC(Uhh>$rJmNh0GUo@V{F6Pt-WYEZ8_j!fUNd~KybYF`Ju4ZX$LYQV
zZEwg#8$0E(ZxN5b_?b&PGu(_GE8ThHTUgKSHP_Vv#Q@ruI11+j8{>!OKl0dUV(8<V
zF0++~T>7ocb~89emZKxnS8z<_aN`%PU*0@?-u%^Iy1O3jtUrs*pZt6U*^-_zA|A{d
zsmDFcJ;vNp$yMV3^}d6VrEU^`tc&vG(W;?af*kyYJNXLR8&h&|hq=dCS}HkfUgI~L
zC%&)dbyVAqI>)7Wya!e|_gIBqm3Q~{dA&d0H*Vk33raacs6u@H1(K3PV&bnOJo~I*
z2goV6Rjq_r67$4=6ps&;wgqv-nIQc2XL8;r_8z2=SX5?pM(Mz?%!sP*lO?HZT0JKo
z1%6mO1PM{6C2VSnVJiVOc`W${2s+4DUfgI=N)O8sTL|<jleV1=y{e~k@rE0G%BEoD
zcgA~e#g(iN#2@_^x+01K9Pbn0UZ{lz!ms5YC5GkB;naTE30hs95Qnb(G+m6ff87GX
zrajIE{6PiBr}o~vJ}ViqS?d1Fq6=l}Ro^*jOGwB=kGJy44t#=)*+L!x>j2Svy_gc@
zv5vqU)1y#FN~SMR;w%yV#xwix9kbOa<C(;&r5x=;UOejUpiN}yImq%pF4#1S0g6x*
zTP-AQDzz2YKReG`rmz-qCmzb1>tKB+D41@>20M9&J}yjTCW|ajY`R?psABaOhGP34
zfk{uBt!^-o%ZW07qxfF4|IEd!{iyE=b$rAJQGhA_TeBDu8=mBc#LI^}GrwM7zk62j
zr1PmOSBPpy3eSs>h210`ET$|hu;2lQ;U}AXtVl95As8*49RKL#(b{vVUh>F+f60#P
zy=!Yg$s>!0>w6-)@^GSvuj{%JxwWq>yN<mH9%x?1k<ANnqfea$orR(WXaDOg6eXBN
z>+Gr_PU68!h_aNW^eB+0pmGDDF)eY!@*<K6=83%^%Y@#KnK8T`o=bcldkuZ*VW-aB
zU^@Kmm%B33$F*>luqHM<m2sxH7G0BRfCc@W%0QX=K-y3Dv7UVlSe4xzH5VI7gk-cm
z@6@AxJ<Fn25Oi{?-AZC(^_XDspO3$w7rKQai#T90T+b~iqA{KVDQ=!&UR1ULKmo%?
zh_355bZagrv$IkCu}*)G+zIUZx%kSeY2>X0u|La$vMPIVKmH}c2BGp%9!DjJn`!>f
zxhg>g>@9pF+27_ZEVv=>w1=UDZCqvyboDHJ*>3%Kp1z|41#QwG$^|>gWn)Zvee&q?
zP~gKS<3}X)zxM&^jWfSkU5EK*HZMW!RmhzVH_gbw$Vkj3_>YveU<p1aWS^r0={$%r
ze9cHgG1geyA;PS+K&5RUo-2kux#O}zIvuOEp=}>v8~r&^*e36rN-7p83p1e@vHFX0
zz#I{KS12k1(H$)p*xfxCFQi06ea|t3IZ%%@)zFP}r79Kx`cfqRIE>9OD2cAti*dP7
zUySn}e5TB1<lBi|T;3>QR;B!QzxSvX*d6Q-$<&deiPtY9V^7R+Na&(Z!DU~_LmW??
zb(~iqy52%&&*MR*TiY7mUU7KOic(S4%X6BCZsyt62kUun(-q907UHKsz=UF7)tV8&
z7TiH@&|?*p2V=B9L7wx|9o{mpw?KRUN|d=Tk}N~8KzV0WwU4HC*a|xBF#y?r&UQy?
zB}lBgVh{ac-+K*~ZvLZJAw<YUinS^t-K8hvuz;&l=iMv^zTnS?(|!5X_uK<<L!)X4
z9Wi(=`_?0rihIw+`T&FQKgb6E1YU@S7<u?6Zqj<?wD1z6w1G&nDgn?IQrqADhK<vI
z#6G4~{Lmhn*iGdW&r--l3q7#hNM@)C%b*GU+8|Fk&*`ZpP4|TppfsdQ<|N*{C7Kz5
z&*eUneG_pPC>)DzZWXbsF=NITe3O-0V36>mw%_;6b=MJxtFqf@5~<Z+A4^Lt=(1@U
zjz&XQ6<|Cm{-s<k1<#sJtAC);a>;ar4+c9=86OkXPcO&-U}XScS%gh8e%_$l98^m2
zf5iCMJrd6aqnTu`%0Sj=Z#xr1Kzu^}hOPJ3Q_mIzir#U<P6rkp%VuB2;3Tkm_t;N)
zGzCriN%*}>r*#%Q2^(vIZ49!OY5!W$lsq9a6A4&3)Oqb^-t=B}uwhP6r_*o8aP`%D
zE2$~&mej@lH{>+YMZr_(M1ho0`70~3N%>l<k!%!ny#B56mmwWFI0e1xfNg3LUw?BI
z^VGUbPuOJOQtjedh*080!^m496Pdr4LqBF1kxj-Lnmx^Z0$o}vp@sho=o>uv4wmGg
z`ptA}0|(R&aweL5ndlXs@G+<Ipt%|1&I%li0QXb9A}Sqj7fPDCnYotoQKyIvFt$I7
zd)#6SqV9)JGUET&hMh3MH;LgEsUp}F!~gn=AWkh|s;Lln6(~gj#GJ~K=1H&Km8&&r
zP%(9acFR{Q@6)9LvYaw(!|O}pxN*n65#`j=IPK}Xz|K2~ef7e6swD3fk<Oh5_(j|m
zS(U{OUtkYTBn1fk)D~qRf8nheUGg$CV@vo#R<&eG5JKFYp#Rte*<5WcifYvx?PbRJ
zztU7uwxw)nioH4NnsiDg>3DuGyW~T1DQf&<YgAx7Nl+CaHwn_7K)8qs9f@%tzL)hs
z1}Dwmon~;d-*@D?OFN1yKsq1dLwB36K-j28*rj0hSX~6lWJUt;*X+MXtM2j#RB%<k
zeg}L!C?}{qvO26Jv2DGKvqhk=Gf?b`srfjmXxZmux=90%EEnC3C!$|$VKWgmnFHC-
z1qYbyyz%(Tz2<X}cEw%(^{nHy#Y><oeyFVBqqi~3#i%deXk77RQ34wMCAX;Nl46Ht
z<>jn50K>p4y_5GXAZ_PKPPb05|J0VSO<^K%GkIP1hWKm6zSJG^Pa-|Y1ABsjJjeSS
zLwRJ9HW}5G4FUE>ju*PSdX8)6@vS3eQK#13!M?7)kG-HpxoP4uxz?q|PzdaP1V_z6
zcrf$K<KIULqfT9g<X-mBYRSP~c#UQ7Vp=Ad^%`a1Go|q?g;evMeHW~#7bggoxA?h*
zQ~f){#y3tCc5v#0$mtPBjrHO3F^sIYhu%@14!MMKaENitCvB#w=fL8UXb)5CgC~4(
z%JAqTgck@enT6RGH>tB#cP#DF4~tXt7yOYRHz3pmgbiz;1_oPV58z`(uN!yT(w>1c
zcOlrk;Z8i4=*9~l2K)~|xFBDu4I&*FP@?kmn?sL!DWo1M55*ZFNSGOxb#YsZQe+7m
zOOwrz5Oh!g)CrVNStVJT21n$0H8HNAe{c3hkYH-%GiX2Lu$d6t^g7%z@sv-lebqS}
zB*bb1gWXjo9(ZF_RQ?M+B(W+1(nXqwfw00%uA}^<^vz;kNWuCS3?)eb8*W1h7F^Id
z1#cB!O(t!(@(dLoelV;{z`Or@_2HS`BIC2yns-!EJF`%BZL|=x#0Yl@dq+7!v6Q5t
zJZ#@?&y1fIS<NLK-a>^Z1s%VrM+AYM31V4hVbvr^sA6~*EiE@z`FR8lvf9kGsHI)7
zaoCO*jkHx0U5@6sv*XEWO!g-|(0a)>-@ljHbePLSOpaO$vwxdQtKoQi+gj>@@MfIA
z9DB40P6nH#vx4?we5Sv1Wh`0SGXhkaSl-^+sSzVk-EpP^@8!3uBwn~bz`TPirTgD_
z7s@*MWo-m{{ZK#&vDr*JTvGp=taea4;kub8LZ_Q}efM~Xh@Ws|6y6P{k<rlk1YQ-m
z@%$yn#1;_ZH($^4*C=8qcYOr8mg-M_fZCVwwSTDzh@UGd{-zzbOEN>eUVJ;(9<4JU
z2{MsRy~v)0m$bNtUu98*{Q=(l*Y%u`dp8WRt*=vY4V@s^oe5UFYtM-5$&op|aBTYL
zB{o7Kyo9*Mj|~iI%G`)YspO^omjwj5Ov(f+1^j$E?i@F)#-u9+7v)-QYAgL(qnGTI
z*#BUa10>a=FTGDTRPr|ILGvfB6Rp-!yp`<HMl<HvjSG3DO*)N;ZEn;1Ll;Cqcyq|{
z^_C$1l9LrhcJI3c9fH{y2blP*g2nrg4FpAKVJH{G*viuONnS}y5Tk?N#HRJ60%oL~
zBH=sATfsjqknS@GpQwRYpT}TeEiS6~R0r$kw*$`(-qpUF$wN|bA`-WIckEkNv&7?)
zaE>1RiN}ZUTF&TzUBUf~VxQU*0LhrUNlf(0m$`#M^23~N?Fj9+5|>puAAti5NYCq~
zl$%}gZWoN^Ot67#Cs|;{oHZaYGA^F1?b`VH`+<2}hT#-1UiH+rE;bM~-_AO`9nz>W
zV=B0)dj|dxy?P!y&&p4V*gd~rP4`p26$Dm=6UIi9iNhsa9cNW`{IB~I4IL#w;8ngs
z+8cf*)3yk+x^^va)8J{Tci+9#VgIHy|2hk5??W;YzAU(t%Ft5#JvdCpV>|KeU?^>G
zV~|`-w<}3W5=F%^@lmKyOUiBIo8N2^%IMX^MR<pkK~VL@eHAO8(*jhpb3{FG`KQ;@
z#%pCO^RF2;c<wT59f4d1XH8kV9OZRzN%r9Th(pwCe&aI?$W*OQ9{rbO8FF7-wUr&I
zhul&AnCOC7GsM;IOm<0sUjJm0+7NSY=w}{{6BYL4J0nra|4~NA+vlA$aWNY3Fj0?=
zFd3uOM<d`!p-=|J0(d%d$mfwhb`}(RrX_yEi3t;@gcDM-2O99@^wHb7*Ph!^L`@pS
zg3kch-eYA+vZG6~{KkVdGz>cXfs%arF?`vlvZJ`3G`zQ&?w<^Xc?01-%dmWW-7`_a
zH4fMF`r=L*y#4033b7xyz9afJhXXJ>&YW^JJ=N4$<}JV2sAlm2rn-0*>VL5?imbZc
ze0U|#{JbfVYODY5UxxGs>8}E|z%MsnFr_u`zXFeQo^WUffutbm76#<n9`Q$sRjVYd
zTg@60O+GYhyI4VhH`q)0uIkP6p7r3~&@EQ|0%o9-&WqiF{PnlrxZTeEHoWe*&{USf
z0QG_MR0v%kzj8c3oRO`paAk!>HE0)9jeaJjjy_w?9JN{ry160geCz{LVTTPY6T8#!
zeYv1~YPUHdu0Q(!Eo*f=b7WRd{j11!yEUNv_HwWAeZ04K$2|LHsjt-Zfkl~?HVZF4
z+Lwzd)K@%sdGeQs8~P<TAA1%jApkvIm66XseV}GtZA#_Et81R`?03|x+h3plrOcRm
zpxq%fqd9*Mso?`#c~-FdVL{cnb6-Ukr}0M~vTyb$eBdiFaI@f{Oh$t)!@Xp!PPk0D
zP}_L^_J3Ux0+}&%Hi@#KrX4&p(uucuQ*O2i1UZdmY4Yh`<%TgDOi0k33EBNn7`;yd
zvyL(s8V#|a$lN2HxoLf7GB2KiV2KE^qL^B6C`7V$?z2HZOjhzje2($kuk0>e!JlIj
z63tc-ekx4=xgcINGR=sr^tSft;XMUBx%rSecFgApFFp)Ack4?tnwq6|>buhUy6=~T
z-=l<SHQCOct;GkSZwoMIrw<e)ucdO!L5$tEyFLYq*Pnxx{4RL=oOzl2B>j}d-)5sf
zA}mhuDe;9<*ti{{+LcBiGAVh#gaG}SX{kPXPb16ao55#MkEbDTFN%ZM?z9J1FQ^oi
z?sEuAY}gaLc=3im&o?60&&?mc7t6bK<+G$mOZ*>^^fji>NRRQg>l>BHK8K-C-p*@*
z^WR1<VqeV2!IYg+%ZnF{qgJ{&dRkUdKt4-U|EiHNdS+%aT=%sX@d!g9Q)NiiellqZ
z-Ep=c?alRT64jNtS4>E$JOrsl!IQ)0XLBDpphG>Mvwx<h0C(;@^3uJ@X-BL((%@8V
zN1V40;~<j#5xIr(TusvNM%Itq@^QK2%$SR~Y=<z95<O}@(j%w;hR%gAoXU=rPhSk8
zDZ4%8J$z011S=#!G(l$tdyfgL@!@A9dFn=8+0*4(!85!2XzKAZIMG_xl!iOt=Hk$Q
zH<y<DWU+xRzKPT}qS8BgdA}P8<flX>@5<(l3w3IW%LCbmp4Emy2DBs5##sL+^NaD;
zgOf#-rU4P@j(J?qRln;L2L`^_e!mp4CjxByLwHsnbwglq>PT<n7wfM2fkZ-!m9m#(
zQ+EMXx)w85)2FS1rC9ZqY3kEhN_me>tDJ*f^Z&}X9VRyzHOB7d&-RK*qG3m|J38yO
z_N;ntNpIFKVO_TllR5nx{K2iTL6%MK;JosD`Yrd^Z?GG-I+PEvH)59RaCPa0x)2KA
z+0+40R$({+j|9xPHO?)U#_CQrg%2I$GSL$A`Kax)qBRdtIVV1}<cWFY<#M5#X=UDl
zyXn5`Uq{}~d^xJWR@g6mkK61e?xc{UM*(h#!t9bn_8K{?9!`rYmjRhWYhiw1!SDzu
zJR91%vImr6cdjPu!+#s#E@JtEk4<AXg@}pnzG|5~puld1NnzB##ezM~>MPs~h=~gv
zGldmvH;9p<%oxt=`sUgvlVHTiBuNBZ6j$9j@$HQr-D@!;T_6(QF$Jwt$MtO$wCuG2
zC6>xwqbHzoqf{#BH{fi|R9>Sl=Cy@g|FusIH1q*CTp=(gS==pWh|%0bK$W-K4O4Jx
zQG&*&hsE3ygttogHjx6_G70z7m{#@F<`zj$ycx06SUpw)5MQ2Tf8M74W7k7c6K4Ph
zj!z0>5|Hr736uSC0f8yxf(5n~Py;=BLWYrYz#&5z^t<3C;8d+*aD~O55sGLqAqOg|
z76a2c2!b^HySf1JpcfPH{-JExg@>S~s5hgJZ6h$k_CbuWW*EDqiwH5Hw18W|aH6O$
zNA<G!Wwztj<RCI{({g(|P=dL+r{J34a%flOx!rpe{cC+eG=`97->qpj)VR19NTCZ=
zV24jN_NtdnU~0kO)NIwZ<ySygr6XI7_NKWRgm8_?OLk%GTD`>Y$6&P{zO>#O0C0Lr
z+K!cgLJ$q6Gwj&l=4olQAK)Y>*%00K&iVHQy#1L9(;7438$v+Zqvu<l_}4<93e8(Q
z{9fZb1NiJXH0B$-dlGpQ<vrneXDtmJdts{5y)~-m&<>Id($qV~Ng(xt1n(WUSlo)a
z2KlBS^OR8mYONpSjK!u(!EHr-vq_ij7UORIN5PgZbr+v$&DbTWAZATw9xiS!I=4t*
z!>B+>4e#30rsSZ-mXA~?k-nuQoynik>ThYZ_h(byu5nE6sY;=91~Z!2l@Djn|5?lc
zVXWOj%Vr`IAg|9JPbH@kmG4T4e|_ofOuKU>O-f>Nhn{h8(VGcJ4`ex5q0+d4@aA*9
zR?OnaNea;h4m&iZSaN*h<b-k22pPx;QMoSC?!;nz7;+|!Oh;V4^MHZy6X;`zWB7$O
z{8z@BW*GonDtir=(z*Lb;S;p;{y4?`HO`vhcTMz6aOCO<=x(U8kPy2&I8HA#o>&_(
zoH;sj^1d4$4r3oYLacf~2cMwbg3M9gU+1*Zr6eE;n8)w~qz4+iQ3dMDm4M3FkeJIV
zAu3l&5;okCbU~W26AC_k*maVWbTc=m#R0YVxli}xhu?JYJs>%<5`6S0I&%H{6fXm~
zSV~!xRH>l_ZCw{#91w&&RA?z6yC~cOk6s<MEL61<xJx809PQ6b`-@&ZhqW`fATiC|
z*Ut~|+Z>zzc$9}xNNnNab&_F5HdjrD?DE;JoHHL%*K%p;l$4F8-}EUDVQd>un!?i`
zdNVnIx8@SOJB&>JSFxCWNw`%?Lp2FqNC(w}-%R%}B)t>x(7kaLsPMtD&mOJAAH{L9
zr8_AOJcNsjY=_~Q=}O~4AiP+$s;yg}Nc7mSnQ^}EjNH{`+H24M)g^u@wD&$44q7uK
zlE9@VJRdaCXx*k`PqE89eDyrz78(M9mC*h#z+@WG-A#b{&uK><b8*z<(G4I%IM1;E
zOeUwV`ya}xe8h~h^MVu-hxGcK#txmlG!RerXY$Z8IDj8q311aX2`_ia`WM{NQq`{)
z^<bW9K)68dnWCV#hlz<hrFIB7h)xmrQ;;$2HtHOLy}dc)^?RjyfyDqjY33e({$t&*
z(V!$i<KF|Q&;wX=+xVLUdqDdJ&?V^D|0VLnfYUf~`ohVJkbkKB|6Du=4S+=>fcet%
z<fZ+0J>VZo^FQ4cV!$%O;!NKD+r_`M=70V+``7(RT&Il*z5#6Cf5&H+1ScMa<f7Cw
z|BV0dz4w1*;Rf-p8Ey#6_s{tMT$A~?G5iP$Y`L1BB<6pnK${N3|DDdiy7>RNI)p<u
Ys>AIY5=#vB5b%T5G10El!rlLW0Kv|ciU0rr

literal 0
HcmV?d00001

diff --git a/application/src/test/resources/file-type-detect/test.svg b/application/src/test/resources/file-type-detect/test.svg
new file mode 100644
index 0000000000..e93f41998c
--- /dev/null
+++ b/application/src/test/resources/file-type-detect/test.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="32" height="32" viewBox="0 0 24 24"><path fill="currentColor" d="M12 5q-.425 0-.712-.288Q11 4.425 11 4t.288-.713Q11.575 3 12 3t.713.287Q13 3.575 13 4t-.287.712Q12.425 5 12 5Zm0-3q-.425 0-.712-.288Q11 1.425 11 1t.288-.713Q11.575 0 12 0t.713.287Q13 .575 13 1t-.287.712Q12.425 2 12 2ZM8.4 22q-1.6-.95-2.5-2.538Q5 17.875 5 16q0-2.025 1.075-3.738Q7.15 10.55 9 9.675V7q0-.425.288-.713Q9.575 6 10 6h4q.425 0 .713.287Q15 6.575 15 7v2.675q1.825.875 2.913 2.587Q19 13.975 19 16q0 1.85-.913 3.45q-.912 1.6-2.487 2.55Zm.6-2h6q.95-.725 1.475-1.763Q17 17.2 17 16q0-1.45-.762-2.663q-.763-1.212-2.088-1.837L13 10.95V8h-2v2.95l-1.15.55q-1.325.625-2.087 1.837Q7 14.55 7 16q0 1.2.525 2.237Q8.05 19.275 9 20ZM7 3q-.425 0-.713-.288Q6 2.425 6 2t.287-.713Q6.575 1 7 1t.713.287Q8 1.575 8 2t-.287.712Q7.425 3 7 3Zm10 0q-.425 0-.712-.288Q16 2.425 16 2t.288-.713Q16.575 1 17 1t.712.287Q18 1.575 18 2t-.288.712Q17.425 3 17 3ZM9 5q-.425 0-.712-.288Q8 4.425 8 4t.288-.713Q8.575 3 9 3t.713.287Q10 3.575 10 4t-.287.712Q9.425 5 9 5Zm6 0q-.425 0-.712-.288Q14 4.425 14 4t.288-.713Q14.575 3 15 3t.713.287Q16 3.575 16 4t-.287.712Q15.425 5 15 5Zm-3 9Z"/></svg>
\ No newline at end of file

From fbe40c28fcebd0ebd5a699d951f334791cc7c957 Mon Sep 17 00:00:00 2001
From: guqing <38999863+guqing@users.noreply.github.com>
Date: Thu, 10 Oct 2024 15:57:00 +0800
Subject: [PATCH 116/185] chore: restrict username and password length during
 user registration (#6808)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?
/kind improvement
/area core
/milestone 2.20.x

#### What this PR does / why we need it:
为注册用户增加用户名和密码长度校验

#### Does this PR introduce a user-facing change?
```release-note
None
```
---
 api-docs/openapi/v3_0/aggregated.json               | 12 ++++++------
 .../openapi/v3_0/apis_console.api_v1alpha1.json     | 12 ++++++------
 .../openapi/v3_0/apis_extension.api_v1alpha1.json   |  8 ++++----
 api-docs/openapi/v3_0/apis_uc.api_v1alpha1.json     |  4 ++--
 .../app/core/endpoint/console/UserEndpoint.java     | 13 +++++++++++--
 .../run/halo/app/core/user/service/SignUpData.java  |  3 +++
 .../main/resources/config/i18n/messages.properties  |  1 +
 .../resources/config/i18n/messages_zh.properties    |  3 ++-
 .../templates/gateway_fragments/signup.html         |  2 ++
 9 files changed, 37 insertions(+), 21 deletions(-)

diff --git a/api-docs/openapi/v3_0/aggregated.json b/api-docs/openapi/v3_0/aggregated.json
index bd88ac814e..f2242dbd19 100644
--- a/api-docs/openapi/v3_0/aggregated.json
+++ b/api-docs/openapi/v3_0/aggregated.json
@@ -16495,7 +16495,7 @@
             "description": "Old password."
           },
           "password": {
-            "minLength": 6,
+            "minLength": 5,
             "type": "string",
             "description": "New password."
           }
@@ -16508,7 +16508,7 @@
         "type": "object",
         "properties": {
           "password": {
-            "minLength": 6,
+            "minLength": 5,
             "type": "string",
             "description": "New password."
           }
@@ -20691,12 +20691,12 @@
           },
           "visible": {
             "type": "string",
+            "default": "PUBLIC",
             "enum": [
               "PUBLIC",
               "INTERNAL",
               "PRIVATE"
-            ],
-            "default": "PUBLIC"
+            ]
           }
         }
       },
@@ -22536,12 +22536,12 @@
           },
           "visible": {
             "type": "string",
+            "default": "PUBLIC",
             "enum": [
               "PUBLIC",
               "INTERNAL",
               "PRIVATE"
-            ],
-            "default": "PUBLIC"
+            ]
           }
         }
       },
diff --git a/api-docs/openapi/v3_0/apis_console.api_v1alpha1.json b/api-docs/openapi/v3_0/apis_console.api_v1alpha1.json
index df4144e8b8..ff8db40645 100644
--- a/api-docs/openapi/v3_0/apis_console.api_v1alpha1.json
+++ b/api-docs/openapi/v3_0/apis_console.api_v1alpha1.json
@@ -3758,7 +3758,7 @@
             "description": "Old password."
           },
           "password": {
-            "minLength": 6,
+            "minLength": 5,
             "type": "string",
             "description": "New password."
           }
@@ -3771,7 +3771,7 @@
         "type": "object",
         "properties": {
           "password": {
-            "minLength": 6,
+            "minLength": 5,
             "type": "string",
             "description": "New password."
           }
@@ -5420,12 +5420,12 @@
           },
           "visible": {
             "type": "string",
+            "default": "PUBLIC",
             "enum": [
               "PUBLIC",
               "INTERNAL",
               "PRIVATE"
-            ],
-            "default": "PUBLIC"
+            ]
           }
         }
       },
@@ -5949,12 +5949,12 @@
           },
           "visible": {
             "type": "string",
+            "default": "PUBLIC",
             "enum": [
               "PUBLIC",
               "INTERNAL",
               "PRIVATE"
-            ],
-            "default": "PUBLIC"
+            ]
           }
         }
       },
diff --git a/api-docs/openapi/v3_0/apis_extension.api_v1alpha1.json b/api-docs/openapi/v3_0/apis_extension.api_v1alpha1.json
index 2d9cecbfd2..90a36eaf33 100644
--- a/api-docs/openapi/v3_0/apis_extension.api_v1alpha1.json
+++ b/api-docs/openapi/v3_0/apis_extension.api_v1alpha1.json
@@ -11300,12 +11300,12 @@
           },
           "visible": {
             "type": "string",
+            "default": "PUBLIC",
             "enum": [
               "PUBLIC",
               "INTERNAL",
               "PRIVATE"
-            ],
-            "default": "PUBLIC"
+            ]
           }
         }
       },
@@ -12484,12 +12484,12 @@
           },
           "visible": {
             "type": "string",
+            "default": "PUBLIC",
             "enum": [
               "PUBLIC",
               "INTERNAL",
               "PRIVATE"
-            ],
-            "default": "PUBLIC"
+            ]
           }
         }
       },
diff --git a/api-docs/openapi/v3_0/apis_uc.api_v1alpha1.json b/api-docs/openapi/v3_0/apis_uc.api_v1alpha1.json
index 84820d4197..b804cb96a8 100644
--- a/api-docs/openapi/v3_0/apis_uc.api_v1alpha1.json
+++ b/api-docs/openapi/v3_0/apis_uc.api_v1alpha1.json
@@ -1888,12 +1888,12 @@
           },
           "visible": {
             "type": "string",
+            "default": "PUBLIC",
             "enum": [
               "PUBLIC",
               "INTERNAL",
               "PRIVATE"
-            ],
-            "default": "PUBLIC"
+            ]
           }
         }
       },
diff --git a/application/src/main/java/run/halo/app/core/endpoint/console/UserEndpoint.java b/application/src/main/java/run/halo/app/core/endpoint/console/UserEndpoint.java
index a883b69ca5..a998ad2d15 100644
--- a/application/src/main/java/run/halo/app/core/endpoint/console/UserEndpoint.java
+++ b/application/src/main/java/run/halo/app/core/endpoint/console/UserEndpoint.java
@@ -590,12 +590,21 @@ Mono<ServerResponse> changeOwnPassword(ServerRequest request) {
     record ChangeOwnPasswordRequest(
         @Schema(description = "Old password.", requiredMode = REQUIRED)
         String oldPassword,
-        @Schema(description = "New password.", requiredMode = REQUIRED, minLength = 6)
+        @Schema(description = "New password.", requiredMode = REQUIRED, minLength = 5)
         String password) {
+
+        public ChangeOwnPasswordRequest {
+            if (password == null || password.length() < 5 || password.length() > 257) {
+                throw new UnsatisfiedAttributeValueException(
+                    "password is required.",
+                    "validation.error.password.size",
+                    new Object[] {5, 257});
+            }
+        }
     }
 
     record ChangePasswordRequest(
-        @Schema(description = "New password.", requiredMode = REQUIRED, minLength = 6)
+        @Schema(description = "New password.", requiredMode = REQUIRED, minLength = 5)
         String password) {
     }
 
diff --git a/application/src/main/java/run/halo/app/core/user/service/SignUpData.java b/application/src/main/java/run/halo/app/core/user/service/SignUpData.java
index 61e32bed04..e3d07a99fb 100644
--- a/application/src/main/java/run/halo/app/core/user/service/SignUpData.java
+++ b/application/src/main/java/run/halo/app/core/user/service/SignUpData.java
@@ -7,6 +7,7 @@
 import jakarta.validation.constraints.Email;
 import jakarta.validation.constraints.NotBlank;
 import jakarta.validation.constraints.Pattern;
+import jakarta.validation.constraints.Size;
 import java.lang.annotation.ElementType;
 import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
@@ -29,6 +30,7 @@
 public class SignUpData {
 
     @NotBlank
+    @Size(min = 4, max = 63)
     @Pattern(regexp = ValidationUtils.NAME_REGEX,
         message = "{validation.error.username.pattern}")
     private String username;
@@ -42,6 +44,7 @@ public class SignUpData {
     private String emailCode;
 
     @NotBlank
+    @Size(min = 5, max = 257)
     @Pattern(regexp = ValidationUtils.PASSWORD_REGEX,
         message = "{validation.error.password.pattern}")
     private String password;
diff --git a/application/src/main/resources/config/i18n/messages.properties b/application/src/main/resources/config/i18n/messages.properties
index 17b74dc769..565d813987 100644
--- a/application/src/main/resources/config/i18n/messages.properties
+++ b/application/src/main/resources/config/i18n/messages.properties
@@ -91,3 +91,4 @@ signup.error.email-code.invalid=Invalid email code.
 validation.error.email.pattern=The email format is incorrect
 validation.error.username.pattern=The username can only be lowercase and can only contain letters, numbers, hyphens, and dots, starting and ending with characters.
 validation.error.password.pattern=The password can only use uppercase and lowercase letters (A-Z, a-z), numbers (0-9), and the following special characters: !@#$%^&*
+validation.error.password.size=The password length must be between {0} and {1}
diff --git a/application/src/main/resources/config/i18n/messages_zh.properties b/application/src/main/resources/config/i18n/messages_zh.properties
index bf8c70faa5..767d79b77e 100644
--- a/application/src/main/resources/config/i18n/messages_zh.properties
+++ b/application/src/main/resources/config/i18n/messages_zh.properties
@@ -63,4 +63,5 @@ signup.error.email-code.invalid=邮箱验证码无效。
 
 validation.error.email.pattern=邮箱格式不正确
 validation.error.username.pattern=用户名只能小写且只能包含字母、数字、中划线和点，以字符开头和结尾
-validation.error.password.pattern=密码只能使用大小写字母 (A-Z, a-z)、数字 (0-9)，以及以下特殊字符: !@#$%^&*
\ No newline at end of file
+validation.error.password.pattern=密码只能使用大小写字母 (A-Z, a-z)、数字 (0-9)，以及以下特殊字符: !@#$%^&*
+validation.error.password.size=密码长度必须在 {0} 到 {1} 之间
diff --git a/application/src/main/resources/templates/gateway_fragments/signup.html b/application/src/main/resources/templates/gateway_fragments/signup.html
index d31b722c35..ded50b34e7 100644
--- a/application/src/main/resources/templates/gateway_fragments/signup.html
+++ b/application/src/main/resources/templates/gateway_fragments/signup.html
@@ -36,6 +36,8 @@
                         autocapitalize="off"
                         autofocus
                         required
+                        minlength="4"
+                        maxlength="63"
                         th:field="*{username}"
                 />
             </div>

From d6c914f4c668027db76cf931e2f48c900fba53e9 Mon Sep 17 00:00:00 2001
From: Ryan Wang <i@ryanc.cc>
Date: Thu, 10 Oct 2024 16:23:01 +0800
Subject: [PATCH 117/185] refactor: improve ui of logout page (#6810)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/area core
/kind improvement
/milestone 2.20.x

#### What this PR does / why we need it:

优化退出登录页面的 UI。

<img width="568" alt="image" src="https://github.com/user-attachments/assets/dd3b405b-e200-478a-ba87-b0d474e6ee1f">


#### Does this PR introduce a user-facing change?

```release-note
None
```
---
 .../security/LogoutSecurityConfigurer.java    | 12 ++++-
 .../templates/gateway_fragments/logout.html   | 13 ++++-
 .../gateway_fragments/logout.properties       |  4 +-
 .../gateway_fragments/logout_en.properties    |  4 +-
 .../gateway_fragments/logout_es.properties    |  4 +-
 .../gateway_fragments/logout_zh_TW.properties |  4 +-
 .../src/main/resources/templates/logout.html  | 47 +++++++++++++++++--
 7 files changed, 78 insertions(+), 10 deletions(-)

diff --git a/application/src/main/java/run/halo/app/security/LogoutSecurityConfigurer.java b/application/src/main/java/run/halo/app/security/LogoutSecurityConfigurer.java
index 1cf8effe5b..b6bf4ec120 100644
--- a/application/src/main/java/run/halo/app/security/LogoutSecurityConfigurer.java
+++ b/application/src/main/java/run/halo/app/security/LogoutSecurityConfigurer.java
@@ -11,6 +11,8 @@
 import org.springframework.http.MediaType;
 import org.springframework.security.config.web.server.ServerHttpSecurity;
 import org.springframework.security.core.Authentication;
+import org.springframework.security.core.context.ReactiveSecurityContextHolder;
+import org.springframework.security.core.context.SecurityContext;
 import org.springframework.security.web.server.WebFilterExchange;
 import org.springframework.security.web.server.authentication.logout.DelegatingServerLogoutHandler;
 import org.springframework.security.web.server.authentication.logout.RedirectServerLogoutSuccessHandler;
@@ -21,6 +23,7 @@
 import org.springframework.web.reactive.function.server.RouterFunctions;
 import org.springframework.web.reactive.function.server.ServerResponse;
 import reactor.core.publisher.Mono;
+import run.halo.app.core.user.service.UserService;
 import run.halo.app.security.authentication.SecurityConfigurer;
 import run.halo.app.security.authentication.rememberme.RememberMeServices;
 
@@ -55,13 +58,18 @@ public LogoutSuccessHandler(ServerLogoutHandler... logoutHandler) {
         }
 
         @Bean
-        RouterFunction<ServerResponse> logoutPage() {
+        RouterFunction<ServerResponse> logoutPage(UserService userService) {
             return RouterFunctions.route()
                 .GET("/logout", request -> {
+                    var user = ReactiveSecurityContextHolder.getContext()
+                        .map(SecurityContext::getAuthentication)
+                        .map(Authentication::getName)
+                        .flatMap(userService::getUser);
                     var exchange = request.exchange();
                     var contextPath = exchange.getRequest().getPath().contextPath().value();
                     return ServerResponse.ok().render("logout", Map.of(
-                        "action", contextPath + "/logout"
+                        "action", contextPath + "/logout",
+                        "user", user
                     ));
                 })
                 .build();
diff --git a/application/src/main/resources/templates/gateway_fragments/logout.html b/application/src/main/resources/templates/gateway_fragments/logout.html
index 84013bb58c..2a4c49dbdf 100644
--- a/application/src/main/resources/templates/gateway_fragments/logout.html
+++ b/application/src/main/resources/templates/gateway_fragments/logout.html
@@ -1,5 +1,16 @@
 <form th:fragment="form" class="halo-form" id="logout-form" name="logout-form" th:action="@{/logout}" method="post">
+    <div class="user-info" th:object="${user}">
+        <img th:if="*{spec.avatar}" th:src="*{spec.avatar}" class="user-avatar" />
+        <div class="user-details">
+            <span th:text="#{form.currentUser.label}"></span>
+            <span class="user-name" th:text="|*{spec.displayName}(@*{metadata.name})|"></span>
+        </div>
+    </div>
     <div class="form-item">
         <button type="submit" th:text="#{form.submit}"></button>
     </div>
-</form>
\ No newline at end of file
+
+    <div class="form-item">
+        <a href="javascript:history.back()" class="cancel-link" th:text="#{form.cancel}"> </a>
+    </div>
+</form>
diff --git a/application/src/main/resources/templates/gateway_fragments/logout.properties b/application/src/main/resources/templates/gateway_fragments/logout.properties
index 0ad6b90f08..4d110365ed 100644
--- a/application/src/main/resources/templates/gateway_fragments/logout.properties
+++ b/application/src/main/resources/templates/gateway_fragments/logout.properties
@@ -1 +1,3 @@
-form.submit=退出登录
\ No newline at end of file
+form.submit=退出登录
+form.cancel=取消
+form.currentUser.label=当前登录的用户：
\ No newline at end of file
diff --git a/application/src/main/resources/templates/gateway_fragments/logout_en.properties b/application/src/main/resources/templates/gateway_fragments/logout_en.properties
index 6f8a3da34f..de423bad60 100644
--- a/application/src/main/resources/templates/gateway_fragments/logout_en.properties
+++ b/application/src/main/resources/templates/gateway_fragments/logout_en.properties
@@ -1 +1,3 @@
-form.submit=Logout
\ No newline at end of file
+form.submit=Logout
+form.cancel=Cancel
+form.currentUser.label=Currently logged in user:
\ No newline at end of file
diff --git a/application/src/main/resources/templates/gateway_fragments/logout_es.properties b/application/src/main/resources/templates/gateway_fragments/logout_es.properties
index 3fda0b0f14..f6264e15c5 100644
--- a/application/src/main/resources/templates/gateway_fragments/logout_es.properties
+++ b/application/src/main/resources/templates/gateway_fragments/logout_es.properties
@@ -1 +1,3 @@
-form.submit=Cerrar Sesión
\ No newline at end of file
+form.submit=Cerrar Sesión
+form.cancel=Cancelar
+form.currentUser.label=Usuario actualmente conectado:
diff --git a/application/src/main/resources/templates/gateway_fragments/logout_zh_TW.properties b/application/src/main/resources/templates/gateway_fragments/logout_zh_TW.properties
index 2cbbd75231..86ccd7e150 100644
--- a/application/src/main/resources/templates/gateway_fragments/logout_zh_TW.properties
+++ b/application/src/main/resources/templates/gateway_fragments/logout_zh_TW.properties
@@ -1 +1,3 @@
-form.submit=退出登入
\ No newline at end of file
+form.submit=退出登入
+form.cancel=取消
+form.currentUser.label=當前登入的使用者：
\ No newline at end of file
diff --git a/application/src/main/resources/templates/logout.html b/application/src/main/resources/templates/logout.html
index a91195c419..fd0890184f 100644
--- a/application/src/main/resources/templates/logout.html
+++ b/application/src/main/resources/templates/logout.html
@@ -1,14 +1,55 @@
-<!doctype html>
+<!DOCTYPE html>
 <html
     xmlns:th="https://www.thymeleaf.org"
-    th:replace="~{gateway_fragments/layout:: layout(title = |#{title} - ${site.title}|, head = null, body = ~{::body})}"
+    th:replace="~{gateway_fragments/layout:: layout(title = |#{title} - ${site.title}|, head = ~{::head}, body = ~{::body})}"
 >
     <th:block th:fragment="body">
-        <div class="gateway-wrapper">
+        <div class="gateway-wrapper logout-page-wrapper">
+            <div th:replace="~{gateway_fragments/common::haloLogo}"></div>
             <div class="halo-form-wrapper">
                 <h1 class="form-title" th:text="#{form.title}"></h1>
                 <form th:replace="~{gateway_fragments/logout::form}"></form>
             </div>
+            <div th:replace="~{gateway_fragments/common::languageSwitcher}"></div>
         </div>
     </th:block>
+
+    <th:block th:fragment="head">
+        <style>
+            .logout-page-wrapper .user-info {
+                border-radius: var(--rounded-lg);
+                padding: var(--spacing-xs);
+                gap: var(--spacing-lg);
+                display: flex;
+                margin-bottom: 2em;
+                align-items: center;
+                border: 1px dashed #dfe6ecb3;
+            }
+
+            .logout-page-wrapper .user-avatar {
+                width: 4em;
+                border-radius: 100%;
+            }
+
+            .logout-page-wrapper .user-details {
+                color: var(--color-text);
+                font-size: var(--text-sm);
+                gap: var(--spacing-xs);
+                display: flex;
+                flex-direction: column;
+            }
+
+            .logout-page-wrapper .user-name {
+                font-weight: 600;
+                color: #333;
+            }
+
+            .logout-page-wrapper .cancel-link {
+                color: var(--color-link);
+                font-size: var(--text-sm);
+                text-decoration: none;
+                text-align: center;
+            }
+        </style>
+    </th:block>
 </html>

From d0f39330957d3e14c9e1a2f721ccb1b5c482a9c6 Mon Sep 17 00:00:00 2001
From: Ryan Wang <i@ryanc.cc>
Date: Thu, 10 Oct 2024 16:25:01 +0800
Subject: [PATCH 118/185] feat: improve built-in auth providers' i18n (#6814)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/area ui
/kind improvement
/milestone 2.20.x

#### What this PR does / why we need it:

完善内置的认证提供商的 i18n。

<img width="859" alt="image" src="https://github.com/user-attachments/assets/a145fc98-05f0-4d62-805a-f3b4f4380a04">

#### Does this PR introduce a user-facing change?

```release-note
None
```
---
 .../components/AuthProviderListItem.vue            | 14 ++++++++++++--
 ui/src/locales/en.yaml                             |  6 ++++++
 ui/src/locales/zh-CN.yaml                          |  6 ++++++
 ui/src/locales/zh-TW.yaml                          |  6 ++++++
 4 files changed, 30 insertions(+), 2 deletions(-)

diff --git a/ui/console-src/modules/system/auth-providers/components/AuthProviderListItem.vue b/ui/console-src/modules/system/auth-providers/components/AuthProviderListItem.vue
index 794d97e6c9..d8652d8cc9 100644
--- a/ui/console-src/modules/system/auth-providers/components/AuthProviderListItem.vue
+++ b/ui/console-src/modules/system/auth-providers/components/AuthProviderListItem.vue
@@ -74,8 +74,18 @@ const handleChangeStatus = async () => {
         </template>
       </VEntityField>
       <VEntityField
-        :title="authProvider.displayName"
-        :description="authProvider.description"
+        :title="
+          $t(
+            `core.identity_authentication.list.fields.display_name.${authProvider.name}`,
+            authProvider.displayName
+          )
+        "
+        :description="
+          $t(
+            `core.identity_authentication.list.fields.description.${authProvider.name}`,
+            authProvider.description || ''
+          )
+        "
         :route="{
           name: 'AuthProviderDetail',
           params: { name: authProvider.name },
diff --git a/ui/src/locales/en.yaml b/ui/src/locales/en.yaml
index 981e0a6db5..b32f4686d0 100644
--- a/ui/src/locales/en.yaml
+++ b/ui/src/locales/en.yaml
@@ -1135,6 +1135,12 @@ core:
         title: Disable identity authentication method
       disable_privileged:
         tooltip: The authentication method reserved by the system cannot be disabled
+    list:
+      fields:
+        display_name:
+          local: Login with credentials
+        description:
+          local: Default login method built into Halo
     detail:
       title: Identity authentication detail
       fields:
diff --git a/ui/src/locales/zh-CN.yaml b/ui/src/locales/zh-CN.yaml
index 4d9140cd29..f16d924ee1 100644
--- a/ui/src/locales/zh-CN.yaml
+++ b/ui/src/locales/zh-CN.yaml
@@ -1063,6 +1063,12 @@ core:
         title: 停用认证方式
       disable_privileged:
         tooltip: 系统保留的认证方式，无法禁用
+    list:
+      fields:
+        display_name:
+          local: 账号密码登录
+        description:
+          local: Halo 内置的默认登录方式
     detail:
       title: 身份认证详情
       fields:
diff --git a/ui/src/locales/zh-TW.yaml b/ui/src/locales/zh-TW.yaml
index 6b591117d6..d7d91a6eca 100644
--- a/ui/src/locales/zh-TW.yaml
+++ b/ui/src/locales/zh-TW.yaml
@@ -1040,6 +1040,12 @@ core:
         title: 停用認證方式
       disable_privileged:
         tooltip: 系統保留的認證方式，無法禁用
+    list:
+      fields:
+        display_name:
+          local: 帳號密碼登入
+        description:
+          local: Halo 內建的默認登入方式
     detail:
       title: 身份認證詳情
       fields:

From 53b3124288fe3035c8dd684ff284598b2f87f134 Mon Sep 17 00:00:00 2001
From: Ryan Wang <i@ryanc.cc>
Date: Thu, 10 Oct 2024 17:31:01 +0800
Subject: [PATCH 119/185] feat: improve built-in auth providers' i18n in detail
 page (#6816)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/area ui
/kind improvement
/milestone 2.20.x

#### What this PR does / why we need it:

完善内置的认证提供商详情页面的 i18n，在 https://github.com/halo-dev/halo/pull/6814 中遗漏了详情页面。

<img width="653" alt="image" src="https://github.com/user-attachments/assets/7d4b4789-91d0-45e5-b5e7-98324ddc0899">

#### Does this PR introduce a user-facing change?

```release-note
None
```
---
 .../auth-providers/AuthProviderDetail.vue     | 33 +++++++++++++++----
 .../components/AuthProviderListItem.vue       |  4 +--
 ui/src/locales/en.yaml                        | 11 +++----
 ui/src/locales/zh-CN.yaml                     | 11 +++----
 ui/src/locales/zh-TW.yaml                     | 11 +++----
 5 files changed, 44 insertions(+), 26 deletions(-)

diff --git a/ui/console-src/modules/system/auth-providers/AuthProviderDetail.vue b/ui/console-src/modules/system/auth-providers/AuthProviderDetail.vue
index eab704f8eb..e12214d197 100644
--- a/ui/console-src/modules/system/auth-providers/AuthProviderDetail.vue
+++ b/ui/console-src/modules/system/auth-providers/AuthProviderDetail.vue
@@ -136,15 +136,36 @@ const handleSaveConfigMap = async () => {
   await handleFetchConfigMap();
   saving.value = false;
 };
+
+const displayName = computed(() => {
+  if (!authProvider.value) {
+    return t("core.common.status.loading");
+  }
+
+  return t(
+    `core.identity_authentication.fields.display_name.${authProvider.value?.metadata.name}`,
+    authProvider.value?.spec.displayName || ""
+  );
+});
+
+const description = computed(() => {
+  if (!authProvider.value) {
+    return t("core.common.status.loading");
+  }
+
+  return t(
+    `core.identity_authentication.fields.description.${authProvider.value?.metadata.name}`,
+    authProvider.value?.spec.description || ""
+  );
+});
 </script>
 
 <template>
-  <VPageHeader :title="authProvider?.spec.displayName">
+  <VPageHeader :title="displayName">
     <template #icon>
       <VAvatar
-        v-if="authProvider"
-        :src="authProvider.spec.logo"
-        :alt="authProvider.spec.displayName"
+        :src="authProvider?.spec.logo"
+        :alt="authProvider?.spec.displayName"
         class="mr-2"
         size="sm"
       />
@@ -168,13 +189,13 @@ const handleSaveConfigMap = async () => {
               :label="
                 $t('core.identity_authentication.detail.fields.display_name')
               "
-              :content="authProvider?.spec.displayName"
+              :content="displayName"
             />
             <VDescriptionItem
               :label="
                 $t('core.identity_authentication.detail.fields.description')
               "
-              :content="authProvider?.spec.description"
+              :content="description"
             />
             <VDescriptionItem
               :label="$t('core.identity_authentication.detail.fields.website')"
diff --git a/ui/console-src/modules/system/auth-providers/components/AuthProviderListItem.vue b/ui/console-src/modules/system/auth-providers/components/AuthProviderListItem.vue
index d8652d8cc9..b6b9c79f10 100644
--- a/ui/console-src/modules/system/auth-providers/components/AuthProviderListItem.vue
+++ b/ui/console-src/modules/system/auth-providers/components/AuthProviderListItem.vue
@@ -76,13 +76,13 @@ const handleChangeStatus = async () => {
       <VEntityField
         :title="
           $t(
-            `core.identity_authentication.list.fields.display_name.${authProvider.name}`,
+            `core.identity_authentication.fields.display_name.${authProvider.name}`,
             authProvider.displayName
           )
         "
         :description="
           $t(
-            `core.identity_authentication.list.fields.description.${authProvider.name}`,
+            `core.identity_authentication.fields.description.${authProvider.name}`,
             authProvider.description || ''
           )
         "
diff --git a/ui/src/locales/en.yaml b/ui/src/locales/en.yaml
index b32f4686d0..3758022cf4 100644
--- a/ui/src/locales/en.yaml
+++ b/ui/src/locales/en.yaml
@@ -1135,12 +1135,11 @@ core:
         title: Disable identity authentication method
       disable_privileged:
         tooltip: The authentication method reserved by the system cannot be disabled
-    list:
-      fields:
-        display_name:
-          local: Login with credentials
-        description:
-          local: Default login method built into Halo
+    fields:
+      display_name:
+        local: Login with credentials
+      description:
+        local: Default login method built into Halo
     detail:
       title: Identity authentication detail
       fields:
diff --git a/ui/src/locales/zh-CN.yaml b/ui/src/locales/zh-CN.yaml
index f16d924ee1..9eedf9bc02 100644
--- a/ui/src/locales/zh-CN.yaml
+++ b/ui/src/locales/zh-CN.yaml
@@ -1063,12 +1063,11 @@ core:
         title: 停用认证方式
       disable_privileged:
         tooltip: 系统保留的认证方式，无法禁用
-    list:
-      fields:
-        display_name:
-          local: 账号密码登录
-        description:
-          local: Halo 内置的默认登录方式
+    fields:
+      display_name:
+        local: 账号密码登录
+      description:
+        local: Halo 内置的默认登录方式
     detail:
       title: 身份认证详情
       fields:
diff --git a/ui/src/locales/zh-TW.yaml b/ui/src/locales/zh-TW.yaml
index d7d91a6eca..3fa9e5a16b 100644
--- a/ui/src/locales/zh-TW.yaml
+++ b/ui/src/locales/zh-TW.yaml
@@ -1040,12 +1040,11 @@ core:
         title: 停用認證方式
       disable_privileged:
         tooltip: 系統保留的認證方式，無法禁用
-    list:
-      fields:
-        display_name:
-          local: 帳號密碼登入
-        description:
-          local: Halo 內建的默認登入方式
+    fields:
+      display_name:
+        local: 帳號密碼登入
+      description:
+        local: Halo 內建的默認登入方式
     detail:
       title: 身份認證詳情
       fields:

From 02c54846dca9162c0bcc7bf44dd5566e5bd39f20 Mon Sep 17 00:00:00 2001
From: guqing <38999863+guqing@users.noreply.github.com>
Date: Thu, 10 Oct 2024 17:45:01 +0800
Subject: [PATCH 120/185] refactor: head and footer tag injection to skip error
 pages (#6709)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?
/kind improvement
/area core
/milestone 2.20.x

#### What this PR does / why we need it:
模板 head 和 footer 标签注入功能忽略错误页面避免当扩展发生错误时导致错误页面无法显示

#### Which issue(s) this PR fixes:
Fixes #6500 , #6750

#### Does this PR introduce a user-facing change?
```release-note
代码注入功能忽略对错误页面和登录注册等页面的注入
```
---
 .../dialect/GlobalHeadInjectionProcessor.java |  3 +
 .../theme/dialect/HaloProcessorDialect.java   |  1 +
 .../dialect/InjectionExcluderProcessor.java   | 91 +++++++++++++++++++
 .../TemplateFooterElementTagProcessor.java    |  4 +
 .../InjectionExcluderProcessorTest.java       | 62 +++++++++++++
 5 files changed, 161 insertions(+)
 create mode 100644 application/src/main/java/run/halo/app/theme/dialect/InjectionExcluderProcessor.java
 create mode 100644 application/src/test/java/run/halo/app/theme/dialect/InjectionExcluderProcessorTest.java

diff --git a/application/src/main/java/run/halo/app/theme/dialect/GlobalHeadInjectionProcessor.java b/application/src/main/java/run/halo/app/theme/dialect/GlobalHeadInjectionProcessor.java
index a346d42e0b..ee741a887a 100644
--- a/application/src/main/java/run/halo/app/theme/dialect/GlobalHeadInjectionProcessor.java
+++ b/application/src/main/java/run/halo/app/theme/dialect/GlobalHeadInjectionProcessor.java
@@ -42,6 +42,9 @@ public GlobalHeadInjectionProcessor(final String dialectPrefix) {
     @Override
     protected void doProcess(ITemplateContext context, IModel model,
         IElementModelStructureHandler structureHandler) {
+        if (context.containsVariable(InjectionExcluderProcessor.EXCLUDE_INJECTION_VARIABLE)) {
+            return;
+        }
 
         // note that this is important!!
         Object processedAlready = context.getVariable(PROCESS_FLAG);
diff --git a/application/src/main/java/run/halo/app/theme/dialect/HaloProcessorDialect.java b/application/src/main/java/run/halo/app/theme/dialect/HaloProcessorDialect.java
index a355f5ae88..99105931d7 100644
--- a/application/src/main/java/run/halo/app/theme/dialect/HaloProcessorDialect.java
+++ b/application/src/main/java/run/halo/app/theme/dialect/HaloProcessorDialect.java
@@ -41,6 +41,7 @@ public Set<IProcessor> getProcessors(String dialectPrefix) {
         processors.add(new EvaluationContextEnhancer());
         processors.add(new CommentElementTagProcessor(dialectPrefix));
         processors.add(new CommentEnabledVariableProcessor());
+        processors.add(new InjectionExcluderProcessor());
         return processors;
     }
 
diff --git a/application/src/main/java/run/halo/app/theme/dialect/InjectionExcluderProcessor.java b/application/src/main/java/run/halo/app/theme/dialect/InjectionExcluderProcessor.java
new file mode 100644
index 0000000000..5fb6c1c7a2
--- /dev/null
+++ b/application/src/main/java/run/halo/app/theme/dialect/InjectionExcluderProcessor.java
@@ -0,0 +1,91 @@
+package run.halo.app.theme.dialect;
+
+import java.util.Set;
+import java.util.regex.Pattern;
+import org.springframework.util.Assert;
+import org.thymeleaf.context.ITemplateContext;
+import org.thymeleaf.model.ITemplateEnd;
+import org.thymeleaf.model.ITemplateStart;
+import org.thymeleaf.processor.templateboundaries.AbstractTemplateBoundariesProcessor;
+import org.thymeleaf.processor.templateboundaries.ITemplateBoundariesProcessor;
+import org.thymeleaf.processor.templateboundaries.ITemplateBoundariesStructureHandler;
+import org.thymeleaf.standard.StandardDialect;
+import org.thymeleaf.templatemode.TemplateMode;
+
+/**
+ * <p>Determine whether the current template being rendered needs to exclude the processor of
+ * code injection. If it needs to be excluded, set a local variable.</p>
+ * <p>Why do you need to set a local variable here instead of directly judging in the processor?</p>
+ * <p>Because the processor will process the fragment, and if you need to exclude the <code>login
+ * .html</code> template and the login.html is only a fragment, then the exclusion logic will
+ * fail, so here use {@link ITemplateBoundariesProcessor} events are only fired for the
+ * first-level template to solve this problem.</p>
+ *
+ * @author guqing
+ * @since 2.20.0
+ */
+public class InjectionExcluderProcessor extends AbstractTemplateBoundariesProcessor {
+
+    public static final String EXCLUDE_INJECTION_VARIABLE =
+        InjectionExcluderProcessor.class.getName() + ".EXCLUDE_INJECTION";
+
+    private final PageInjectionExcluder injectionExcluder = new PageInjectionExcluder();
+
+    public InjectionExcluderProcessor() {
+        super(TemplateMode.HTML, StandardDialect.PROCESSOR_PRECEDENCE);
+    }
+
+    @Override
+    public void doProcessTemplateStart(ITemplateContext context, ITemplateStart templateStart,
+        ITemplateBoundariesStructureHandler structureHandler) {
+        if (isExcluded(context)) {
+            structureHandler.setLocalVariable(EXCLUDE_INJECTION_VARIABLE, true);
+        }
+    }
+
+    @Override
+    public void doProcessTemplateEnd(ITemplateContext context, ITemplateEnd templateEnd,
+        ITemplateBoundariesStructureHandler structureHandler) {
+        structureHandler.removeLocalVariable(EXCLUDE_INJECTION_VARIABLE);
+    }
+
+    /**
+     * Check if the template will be rendered is excluded injection.
+     *
+     * @param context template context
+     * @return true if the template is excluded, otherwise false
+     */
+    boolean isExcluded(ITemplateContext context) {
+        return injectionExcluder.isExcluded(context.getTemplateData().getTemplate());
+    }
+
+    static class PageInjectionExcluder {
+
+        private final Set<String> exactMatches = Set.of(
+            "login",
+            "signup",
+            "logout"
+        );
+
+        private final Set<Pattern> regexPatterns = Set.of(
+            Pattern.compile("error/.*"),
+            Pattern.compile("challenges/.*"),
+            Pattern.compile("password-reset/.*")
+        );
+
+        public boolean isExcluded(String templateName) {
+            Assert.notNull(templateName, "Template name must not be null");
+            if (exactMatches.contains(templateName)) {
+                return true;
+            }
+
+            for (Pattern pattern : regexPatterns) {
+                if (pattern.matcher(templateName).matches()) {
+                    return true;
+                }
+            }
+
+            return false;
+        }
+    }
+}
diff --git a/application/src/main/java/run/halo/app/theme/dialect/TemplateFooterElementTagProcessor.java b/application/src/main/java/run/halo/app/theme/dialect/TemplateFooterElementTagProcessor.java
index 26a286b26a..7177d2f789 100644
--- a/application/src/main/java/run/halo/app/theme/dialect/TemplateFooterElementTagProcessor.java
+++ b/application/src/main/java/run/halo/app/theme/dialect/TemplateFooterElementTagProcessor.java
@@ -48,6 +48,10 @@ public TemplateFooterElementTagProcessor(final String dialectPrefix) {
     protected void doProcess(ITemplateContext context, IProcessableElementTag tag,
         IElementTagStructureHandler structureHandler) {
 
+        if (context.containsVariable(InjectionExcluderProcessor.EXCLUDE_INJECTION_VARIABLE)) {
+            return;
+        }
+
         IModel modelToInsert = context.getModelFactory().createModel();
         /*
          * Obtain the Spring application context.
diff --git a/application/src/test/java/run/halo/app/theme/dialect/InjectionExcluderProcessorTest.java b/application/src/test/java/run/halo/app/theme/dialect/InjectionExcluderProcessorTest.java
new file mode 100644
index 0000000000..89a767fb16
--- /dev/null
+++ b/application/src/test/java/run/halo/app/theme/dialect/InjectionExcluderProcessorTest.java
@@ -0,0 +1,62 @@
+package run.halo.app.theme.dialect;
+
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+import org.junit.jupiter.api.Nested;
+import org.junit.jupiter.api.Test;
+
+/**
+ * Tests for {@link InjectionExcluderProcessor}.
+ *
+ * @author guqing
+ * @since 2.20.0
+ */
+class InjectionExcluderProcessorTest {
+
+    @Nested
+    class PageInjectionExcluderTest {
+        final InjectionExcluderProcessor.PageInjectionExcluder pageInjectionExcluder =
+            new InjectionExcluderProcessor.PageInjectionExcluder();
+
+        @Test
+        void excludeTest() {
+            var cases = new String[] {
+                "login",
+                "signup",
+                "logout",
+                "password-reset/email/reset",
+                "error/404",
+                "error/500",
+                "challenges/totp"
+            };
+
+            for (String templateName : cases) {
+                assertThat(pageInjectionExcluder.isExcluded(templateName)).isTrue();
+            }
+        }
+
+        @Test
+        void shouldNotExcludeTest() {
+            var cases = new String[] {
+                "index",
+                "post",
+                "page",
+                "category",
+                "tag",
+                "archive",
+                "search",
+                "feed",
+                "sitemap",
+                "robots",
+                "custom",
+                "error",
+                "login.html",
+            };
+
+            for (String templateName : cases) {
+                assertThat(pageInjectionExcluder.isExcluded(templateName)).isFalse();
+            }
+        }
+    }
+}
\ No newline at end of file

From 25c54d792e46030fe57c6044f3338e799b37771b Mon Sep 17 00:00:00 2001
From: guqing <38999863+guqing@users.noreply.github.com>
Date: Thu, 10 Oct 2024 17:49:01 +0800
Subject: [PATCH 121/185] perf: replace concatMap to flatMapSequential to
 improve parallelism and efficiency (#6706)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?
/kind improvement
/area core
/milestone 2.20.x

#### What this PR does / why we need it:
将 concatMap 替换为 flatMapSequential 以提高并行度和执行效率

可以看一下这个场景示例来模拟像文章列表 API 的数据组装
假如每个步骤的执行时间是 1s 有 4 个步骤 同时 Flux 发出 4 条数据:

```java
@Test
void test() {
    var startMs = System.currentTimeMillis();

    var monoA = Mono.fromSupplier(
            () -> {
                sleep();
                return "A";
            })        .subscribeOn(Schedulers.boundedElastic());

    var monoB = Mono.fromSupplier(
            () -> {
                sleep();
                return "B";
            })        .subscribeOn(Schedulers.boundedElastic());

    var monoC = Mono.fromSupplier(
            () -> {
                sleep();
                return "C";
            })        .subscribeOn(Schedulers.boundedElastic());

    var monoD = Mono.fromSupplier(
            () -> {
                sleep();
                return "D";
            })        .subscribeOn(Schedulers.boundedElastic());

    var convert = Mono.when(monoA, monoB, monoC, monoD);

    Flux.just("1", "2", "3", "4")
        // concatMap(convert::thenReturn)
        .flatMapSequential(convert::thenReturn)
        .collectList()
        .block();

    System.out.println("Time: " + (System.currentTimeMillis() - startMs));
}

private static void sleep() {
    try {
        Thread.sleep(1000);
    } catch (InterruptedException e) {
        throw new RuntimeException(e);
    }
}
```
**结果:**
1. 如果每个步骤没有加  subscribeOn 且使用 concatMap 耗时: 16362 ms
2. 每个步骤使用 subscribeOn 且使用 concatMap 耗时: 4174 ms
3. 每个步骤使用 subscribeOn 且使用 flatMapSequential 耗时: 1185 ms

#### Does this PR introduce a user-facing change?
```release-note
提升页面访问速度
```
---
 .../run/halo/app/content/comment/CommentServiceImpl.java    | 2 +-
 .../java/run/halo/app/content/comment/ReplyServiceImpl.java | 2 +-
 .../java/run/halo/app/content/impl/PostServiceImpl.java     | 4 ++--
 .../run/halo/app/content/impl/SinglePageServiceImpl.java    | 2 +-
 .../main/java/run/halo/app/plugin/PluginServiceImpl.java    | 4 ++--
 .../app/plugin/extensionpoint/DefaultExtensionGetter.java   | 4 ++--
 .../theme/finders/impl/CommentPublicQueryServiceImpl.java   | 6 +++---
 .../halo/app/theme/finders/impl/ContributorFinderImpl.java  | 2 +-
 .../run/halo/app/theme/finders/impl/PostFinderImpl.java     | 2 +-
 .../app/theme/finders/impl/PostPublicQueryServiceImpl.java  | 2 +-
 .../theme/finders/impl/SinglePageConversionServiceImpl.java | 2 +-
 .../java/run/halo/app/theme/finders/impl/TagFinderImpl.java | 2 +-
 12 files changed, 17 insertions(+), 17 deletions(-)

diff --git a/application/src/main/java/run/halo/app/content/comment/CommentServiceImpl.java b/application/src/main/java/run/halo/app/content/comment/CommentServiceImpl.java
index 202298d1cf..d6059ec644 100644
--- a/application/src/main/java/run/halo/app/content/comment/CommentServiceImpl.java
+++ b/application/src/main/java/run/halo/app/content/comment/CommentServiceImpl.java
@@ -58,7 +58,7 @@ public Mono<ListResult<ListedComment>> listComment(CommentQuery commentQuery) {
                 commentQuery.toPageRequest())
             .flatMap(comments -> Flux.fromStream(comments.get()
                     .map(this::toListedComment))
-                .concatMap(Function.identity())
+                .flatMapSequential(Function.identity())
                 .collectList()
                 .map(list -> new ListResult<>(comments.getPage(), comments.getSize(),
                     comments.getTotal(), list)
diff --git a/application/src/main/java/run/halo/app/content/comment/ReplyServiceImpl.java b/application/src/main/java/run/halo/app/content/comment/ReplyServiceImpl.java
index fc72507a2c..26567274a1 100644
--- a/application/src/main/java/run/halo/app/content/comment/ReplyServiceImpl.java
+++ b/application/src/main/java/run/halo/app/content/comment/ReplyServiceImpl.java
@@ -166,7 +166,7 @@ public Mono<ListResult<ListedReply>> list(ReplyQuery query) {
         return client.listBy(Reply.class, query.toListOptions(), query.toPageRequest())
             .flatMap(list -> Flux.fromStream(list.get()
                     .map(this::toListedReply))
-                .concatMap(Function.identity())
+                .flatMapSequential(Function.identity())
                 .collectList()
                 .map(listedReplies -> new ListResult<>(list.getPage(), list.getSize(),
                     list.getTotal(), listedReplies))
diff --git a/application/src/main/java/run/halo/app/content/impl/PostServiceImpl.java b/application/src/main/java/run/halo/app/content/impl/PostServiceImpl.java
index 7cdae00cc1..6ce70871ec 100644
--- a/application/src/main/java/run/halo/app/content/impl/PostServiceImpl.java
+++ b/application/src/main/java/run/halo/app/content/impl/PostServiceImpl.java
@@ -77,7 +77,7 @@ public Mono<ListResult<ListedPost>> listPost(PostQuery query) {
             )
             .flatMap(listResult -> Flux.fromStream(listResult.get())
                 .map(this::getListedPost)
-                .concatMap(Function.identity())
+                .flatMapSequential(Function.identity())
                 .collectList()
                 .map(listedPosts -> new ListResult<>(listResult.getPage(), listResult.getSize(),
                     listResult.getTotal(), listedPosts)
@@ -175,7 +175,7 @@ private Flux<Contributor> listContributors(List<String> usernames) {
             return Flux.empty();
         }
         return Flux.fromIterable(usernames)
-            .concatMap(userService::getUserOrGhost)
+            .flatMapSequential(userService::getUserOrGhost)
             .map(user -> {
                 Contributor contributor = new Contributor();
                 contributor.setName(user.getMetadata().getName());
diff --git a/application/src/main/java/run/halo/app/content/impl/SinglePageServiceImpl.java b/application/src/main/java/run/halo/app/content/impl/SinglePageServiceImpl.java
index 5fafa17562..f279e7fdf1 100644
--- a/application/src/main/java/run/halo/app/content/impl/SinglePageServiceImpl.java
+++ b/application/src/main/java/run/halo/app/content/impl/SinglePageServiceImpl.java
@@ -88,7 +88,7 @@ public Flux<ListedSnapshotDto> listSnapshots(String pageName) {
     public Mono<ListResult<ListedSinglePage>> list(SinglePageQuery query) {
         return client.listBy(SinglePage.class, query.toListOptions(), query.toPageRequest())
             .flatMap(listResult -> Flux.fromStream(listResult.get().map(this::getListedSinglePage))
-                .concatMap(Function.identity())
+                .flatMapSequential(Function.identity())
                 .collectList()
                 .map(listedSinglePages -> new ListResult<>(
                     listResult.getPage(),
diff --git a/application/src/main/java/run/halo/app/plugin/PluginServiceImpl.java b/application/src/main/java/run/halo/app/plugin/PluginServiceImpl.java
index 540dc853b4..6e31584182 100644
--- a/application/src/main/java/run/halo/app/plugin/PluginServiceImpl.java
+++ b/application/src/main/java/run/halo/app/plugin/PluginServiceImpl.java
@@ -267,7 +267,7 @@ public Flux<DataBuffer> uglifyJsBundle() {
             });
         var body = Flux.fromIterable(startedPlugins)
             .sort(Comparator.comparing(PluginWrapper::getPluginId))
-            .concatMap(pluginWrapper -> {
+            .flatMapSequential(pluginWrapper -> {
                 var pluginId = pluginWrapper.getPluginId();
                 return Mono.<Resource>fromSupplier(
                         () -> BundleResourceUtils.getJsBundleResource(
@@ -294,7 +294,7 @@ public Flux<DataBuffer> uglifyJsBundle() {
     public Flux<DataBuffer> uglifyCssBundle() {
         return Flux.fromIterable(pluginManager.getStartedPlugins())
             .sort(Comparator.comparing(PluginWrapper::getPluginId))
-            .concatMap(pluginWrapper -> {
+            .flatMapSequential(pluginWrapper -> {
                 var pluginId = pluginWrapper.getPluginId();
                 var dataBufferFactory = DefaultDataBufferFactory.sharedInstance;
                 return Mono.<Resource>fromSupplier(() -> BundleResourceUtils.getJsBundleResource(
diff --git a/application/src/main/java/run/halo/app/plugin/extensionpoint/DefaultExtensionGetter.java b/application/src/main/java/run/halo/app/plugin/extensionpoint/DefaultExtensionGetter.java
index e6c162879d..42b833e16d 100644
--- a/application/src/main/java/run/halo/app/plugin/extensionpoint/DefaultExtensionGetter.java
+++ b/application/src/main/java/run/halo/app/plugin/extensionpoint/DefaultExtensionGetter.java
@@ -86,10 +86,10 @@ private <T extends ExtensionPoint> Flux<T> getEnabledExtensions(String epdName,
                 }
                 var extensions = getExtensions(extensionPoint).cache();
                 return Flux.fromIterable(extensionDefNames)
-                    .concatMap(extensionDefName ->
+                    .flatMapSequential(extensionDefName ->
                         client.fetch(ExtensionDefinition.class, extensionDefName)
                     )
-                    .concatMap(extensionDef -> {
+                    .flatMapSequential(extensionDef -> {
                         var className = extensionDef.getSpec().getClassName();
                         return extensions.filter(
                             extension -> Objects.equals(extension.getClass().getName(),
diff --git a/application/src/main/java/run/halo/app/theme/finders/impl/CommentPublicQueryServiceImpl.java b/application/src/main/java/run/halo/app/theme/finders/impl/CommentPublicQueryServiceImpl.java
index c32cdcbc73..8655f8be97 100644
--- a/application/src/main/java/run/halo/app/theme/finders/impl/CommentPublicQueryServiceImpl.java
+++ b/application/src/main/java/run/halo/app/theme/finders/impl/CommentPublicQueryServiceImpl.java
@@ -86,7 +86,7 @@ public Mono<ListResult<CommentVo>> list(Ref ref, PageRequest pageParam) {
                 return client.listBy(Comment.class, listOptions, pageRequest)
                     .flatMap(listResult -> Flux.fromStream(listResult.get())
                         .map(this::toCommentVo)
-                        .concatMap(Function.identity())
+                        .flatMapSequential(Function.identity())
                         .collectList()
                         .map(commentVos -> new ListResult<>(listResult.getPage(),
                             listResult.getSize(),
@@ -102,7 +102,7 @@ public Mono<ListResult<CommentVo>> list(Ref ref, PageRequest pageParam) {
     public Mono<ListResult<CommentWithReplyVo>> convertToWithReplyVo(ListResult<CommentVo> comments,
         int replySize) {
         return Flux.fromIterable(comments.getItems())
-            .concatMap(commentVo -> {
+            .flatMapSequential(commentVo -> {
                 var commentName = commentVo.getMetadata().getName();
                 return listReply(commentName, 1, replySize)
                     .map(replyList -> CommentWithReplyVo.from(commentVo)
@@ -135,7 +135,7 @@ public Mono<ListResult<ReplyVo>> listReply(String commentName, PageRequest pageP
                     .orElse(PageRequestImpl.ofSize(0));
                 return client.listBy(Reply.class, listOptions, pageRequest)
                     .flatMap(list -> Flux.fromStream(list.get().map(this::toReplyVo))
-                        .concatMap(Function.identity())
+                        .flatMapSequential(Function.identity())
                         .collectList()
                         .map(replyVos -> new ListResult<>(list.getPage(), list.getSize(),
                             list.getTotal(),
diff --git a/application/src/main/java/run/halo/app/theme/finders/impl/ContributorFinderImpl.java b/application/src/main/java/run/halo/app/theme/finders/impl/ContributorFinderImpl.java
index 0f0649a04c..d01abc4b36 100644
--- a/application/src/main/java/run/halo/app/theme/finders/impl/ContributorFinderImpl.java
+++ b/application/src/main/java/run/halo/app/theme/finders/impl/ContributorFinderImpl.java
@@ -33,6 +33,6 @@ public Flux<ContributorVo> getContributors(List<String> names) {
             return Flux.empty();
         }
         return Flux.fromIterable(names)
-            .concatMap(this::getContributor);
+            .flatMapSequential(this::getContributor);
     }
 }
diff --git a/application/src/main/java/run/halo/app/theme/finders/impl/PostFinderImpl.java b/application/src/main/java/run/halo/app/theme/finders/impl/PostFinderImpl.java
index 2e2b5950c4..95be322a6d 100644
--- a/application/src/main/java/run/halo/app/theme/finders/impl/PostFinderImpl.java
+++ b/application/src/main/java/run/halo/app/theme/finders/impl/PostFinderImpl.java
@@ -291,7 +291,7 @@ public Mono<ListResult<PostArchiveVo>> archives(Integer page, Integer size, Stri
     public Flux<ListedPostVo> listAll() {
         return postPredicateResolver.getListOptions()
             .flatMapMany(listOptions -> client.listAll(Post.class, listOptions, defaultSort()))
-            .concatMap(postPublicQueryService::convertToListedVo);
+            .flatMapSequential(postPublicQueryService::convertToListedVo);
     }
 
     static int pageNullSafe(Integer page) {
diff --git a/application/src/main/java/run/halo/app/theme/finders/impl/PostPublicQueryServiceImpl.java b/application/src/main/java/run/halo/app/theme/finders/impl/PostPublicQueryServiceImpl.java
index babe512a2f..d25320cb8f 100644
--- a/application/src/main/java/run/halo/app/theme/finders/impl/PostPublicQueryServiceImpl.java
+++ b/application/src/main/java/run/halo/app/theme/finders/impl/PostPublicQueryServiceImpl.java
@@ -67,7 +67,7 @@ public Mono<ListResult<ListedPostVo>> list(ListOptions queryOptions, PageRequest
             })
             .flatMap(listOptions -> client.listBy(Post.class, listOptions, page))
             .flatMap(list -> Flux.fromStream(list.get())
-                .concatMap(post -> convertToListedVo(post)
+                .flatMapSequential(post -> convertToListedVo(post)
                     .flatMap(postVo -> populateStats(postVo)
                         .doOnNext(postVo::setStats).thenReturn(postVo)
                     )
diff --git a/application/src/main/java/run/halo/app/theme/finders/impl/SinglePageConversionServiceImpl.java b/application/src/main/java/run/halo/app/theme/finders/impl/SinglePageConversionServiceImpl.java
index 23d485d432..3f3ba23613 100644
--- a/application/src/main/java/run/halo/app/theme/finders/impl/SinglePageConversionServiceImpl.java
+++ b/application/src/main/java/run/halo/app/theme/finders/impl/SinglePageConversionServiceImpl.java
@@ -140,7 +140,7 @@ public Mono<ListResult<ListedSinglePageVo>> listBy(ListOptions listOptions,
 
         return client.listBy(SinglePage.class, rewroteListOptions, rewrotePageRequest)
             .flatMap(list -> Flux.fromStream(list.get())
-                .concatMap(this::convertToListedVo)
+                .flatMapSequential(this::convertToListedVo)
                 .collectList()
                 .map(pageVos ->
                     new ListResult<>(list.getPage(), list.getSize(), list.getTotal(), pageVos)
diff --git a/application/src/main/java/run/halo/app/theme/finders/impl/TagFinderImpl.java b/application/src/main/java/run/halo/app/theme/finders/impl/TagFinderImpl.java
index 0f6a135a2b..6fd0583865 100644
--- a/application/src/main/java/run/halo/app/theme/finders/impl/TagFinderImpl.java
+++ b/application/src/main/java/run/halo/app/theme/finders/impl/TagFinderImpl.java
@@ -48,7 +48,7 @@ public Mono<TagVo> getByName(String name) {
     @Override
     public Flux<TagVo> getByNames(List<String> names) {
         return Flux.fromIterable(names)
-            .concatMap(this::getByName);
+            .flatMapSequential(this::getByName);
     }
 
     @Override

From 99db7a610157663249e8a8494ed304a2009f1e71 Mon Sep 17 00:00:00 2001
From: John Niang <johnniang@foxmail.com>
Date: Fri, 11 Oct 2024 10:45:05 +0800
Subject: [PATCH 122/185] Support redirecting to URI with fragment (#6817)

#### What type of PR is this?

/kind bug
/area core
/milestone 2.20.x

#### What this PR does / why we need it:

This PR supports redirecting to URI with fragment. e.g.: <http://localhost:8090/login?redirect_uri=%2F%23afragment>(redirect_uri is `/#afragment`).

#### Which issue(s) this PR fixes:

Fixes #6767

#### Special notes for your reviewer:

1. Request <http://localhost:8090/login?redirect_uri=%2F%23afragment>
2. Log in
3. See the redirection

#### Does this PR introduce a user-facing change?

```release-note
None
```
---
 .../app/security/HaloServerRequestCache.java    |  8 ++++++--
 .../security/HaloServerRequestCacheTest.java    | 17 +++++++++++------
 2 files changed, 17 insertions(+), 8 deletions(-)

diff --git a/application/src/main/java/run/halo/app/security/HaloServerRequestCache.java b/application/src/main/java/run/halo/app/security/HaloServerRequestCache.java
index 0909d40201..02f1460509 100644
--- a/application/src/main/java/run/halo/app/security/HaloServerRequestCache.java
+++ b/application/src/main/java/run/halo/app/security/HaloServerRequestCache.java
@@ -44,6 +44,7 @@ public HaloServerRequestCache() {
     public Mono<Void> saveRequest(ServerWebExchange exchange) {
         var redirectUriQuery = exchange.getRequest().getQueryParams().getFirst(REDIRECT_URI_QUERY);
         if (StringUtils.isNotBlank(redirectUriQuery)) {
+            // the query value is decoded, so we don't need to decode it again
             var redirectUri = URI.create(redirectUriQuery);
             return saveRedirectUri(exchange, redirectUri);
         }
@@ -64,8 +65,11 @@ private Mono<Void> saveRedirectUri(ServerWebExchange exchange, URI redirectUri)
         var requestPath = exchange.getRequest().getPath();
         var redirectPath = RequestPath.parse(redirectUri, requestPath.contextPath().value());
         var query = redirectUri.getRawQuery();
-        var finalRedirect =
-            redirectPath.pathWithinApplication() + (query == null ? "" : "?" + query);
+        var fragment = redirectUri.getRawFragment();
+        var finalRedirect = redirectPath.pathWithinApplication()
+            + (query == null ? "" : "?" + query)
+            + (fragment == null ? "" : "#" + fragment);
+
         return exchange.getSession()
             .map(WebSession::getAttributes)
             .doOnNext(attributes -> attributes.put(this.sessionAttrName, finalRedirect))
diff --git a/application/src/test/java/run/halo/app/security/HaloServerRequestCacheTest.java b/application/src/test/java/run/halo/app/security/HaloServerRequestCacheTest.java
index 02e130c7ef..aa5c09bf9b 100644
--- a/application/src/test/java/run/halo/app/security/HaloServerRequestCacheTest.java
+++ b/application/src/test/java/run/halo/app/security/HaloServerRequestCacheTest.java
@@ -33,23 +33,28 @@ void shouldNotSaveIfPageNotCacheable() {
     @Test
     void shouldSaveIfPageCacheable() {
         var mockExchange = MockServerWebExchange.from(
-            MockServerHttpRequest.get("/archives").accept(MediaType.TEXT_HTML)
+            MockServerHttpRequest.get("/archives")
+                .queryParam("q", "v")
+                .accept(MediaType.TEXT_HTML)
         );
         requestCache.saveRequest(mockExchange)
             .then(requestCache.getRedirectUri(mockExchange))
             .as(StepVerifier::create)
-            .expectNext(URI.create("/archives"))
+            .expectNext(URI.create("/archives?q=v"))
             .verifyComplete();
     }
 
     @Test
-    void shouldSaveIfQueryPresent() {
-        var mockExchange =
-            MockServerWebExchange.from(MockServerHttpRequest.get("/login?redirect_uri=/halo?q=v"));
+    void shouldSaveIfRedirectUriPresent() {
+        var mockExchange = MockServerWebExchange.from(
+            MockServerHttpRequest.get("/login")
+                .queryParam("redirect_uri", "/halo?q=v#fragment")
+        );
         requestCache.saveRequest(mockExchange)
             .then(requestCache.getRedirectUri(mockExchange))
             .as(StepVerifier::create)
-            .expectNext(URI.create("/halo?q=v"));
+            .expectNext(URI.create("/halo?q=v#fragment"))
+            .verifyComplete();
     }
 
     @Test

From aab8806f0d64b4c4cd009ff0a7d9687c9207ab2a Mon Sep 17 00:00:00 2001
From: guqing <38999863+guqing@users.noreply.github.com>
Date: Fri, 11 Oct 2024 15:11:05 +0800
Subject: [PATCH 123/185] refactor: support locale-based validation messages
 based on users language (#6819)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?
/kind improvement
/area core
/milestone 2.20.x

#### What this PR does / why we need it:
优化校验提示信息根据用户选择的语言代替 `Locale#getDefault()#getLanguage()`

#### Does this PR introduce a user-facing change?
```release-note
None
```
---
 .../core/endpoint/console/UserEndpoint.java   |  6 ++---
 .../run/halo/app/infra/ValidationUtils.java   | 25 +++++++++++++++++++
 .../twofactor/TwoFactorAuthEndpoint.java      | 22 ++++++++--------
 .../preauth/PreAuthSignUpEndpoint.java        |  7 +++---
 .../security/preauth/SystemSetupEndpoint.java |  9 ++-----
 5 files changed, 45 insertions(+), 24 deletions(-)

diff --git a/application/src/main/java/run/halo/app/core/endpoint/console/UserEndpoint.java b/application/src/main/java/run/halo/app/core/endpoint/console/UserEndpoint.java
index a998ad2d15..662e6f20e8 100644
--- a/application/src/main/java/run/halo/app/core/endpoint/console/UserEndpoint.java
+++ b/application/src/main/java/run/halo/app/core/endpoint/console/UserEndpoint.java
@@ -59,7 +59,6 @@
 import org.springframework.util.CollectionUtils;
 import org.springframework.util.MultiValueMap;
 import org.springframework.util.unit.DataSize;
-import org.springframework.validation.BeanPropertyBindingResult;
 import org.springframework.validation.Validator;
 import org.springframework.web.reactive.function.BodyExtractors;
 import org.springframework.web.reactive.function.server.RouterFunction;
@@ -86,6 +85,7 @@
 import run.halo.app.extension.router.SortableRequest;
 import run.halo.app.infra.SystemConfigurableEnvironmentFetcher;
 import run.halo.app.infra.SystemSetting;
+import run.halo.app.infra.ValidationUtils;
 import run.halo.app.infra.exception.RateLimitExceededException;
 import run.halo.app.infra.exception.UnsatisfiedAttributeValueException;
 import run.halo.app.infra.utils.JsonUtils;
@@ -298,8 +298,8 @@ private Mono<ServerResponse> sendEmailVerificationCode(ServerRequest request) {
                 () -> new ServerWebInputException("Request body is required."))
             )
             .doOnNext(emailReq -> {
-                var bindingResult = new BeanPropertyBindingResult(emailReq, "form");
-                validator.validate(emailReq, bindingResult);
+                var bindingResult =
+                    ValidationUtils.validate(emailReq, validator, request.exchange());
                 if (bindingResult.hasErrors()) {
                     // only email field is validated
                     throw new ServerWebInputException("validation.error.email.pattern");
diff --git a/application/src/main/java/run/halo/app/infra/ValidationUtils.java b/application/src/main/java/run/halo/app/infra/ValidationUtils.java
index 01f20e567d..9252e2298f 100644
--- a/application/src/main/java/run/halo/app/infra/ValidationUtils.java
+++ b/application/src/main/java/run/halo/app/infra/ValidationUtils.java
@@ -2,6 +2,11 @@
 
 import java.util.regex.Pattern;
 import lombok.experimental.UtilityClass;
+import org.springframework.context.i18n.LocaleContextHolder;
+import org.springframework.validation.BeanPropertyBindingResult;
+import org.springframework.validation.BindingResult;
+import org.springframework.validation.Validator;
+import org.springframework.web.server.ServerWebExchange;
 
 @UtilityClass
 public class ValidationUtils {
@@ -15,4 +20,24 @@ public class ValidationUtils {
     public static final String PASSWORD_REGEX = "^[A-Za-z0-9!@#$%^&*]+$";
 
     public static final Pattern PASSWORD_PATTERN = Pattern.compile(PASSWORD_REGEX);
+
+    /**
+     * Validate the target object with given locale context.
+     */
+    public static BindingResult validate(Object target, String objectName,
+        Validator validator, ServerWebExchange exchange) {
+        BindingResult bindingResult = new BeanPropertyBindingResult(target, objectName);
+        try {
+            LocaleContextHolder.setLocaleContext(exchange.getLocaleContext());
+            validator.validate(target, bindingResult);
+            return bindingResult;
+        } finally {
+            LocaleContextHolder.resetLocaleContext();
+        }
+    }
+
+    public static BindingResult validate(Object target, Validator validator,
+        ServerWebExchange exchange) {
+        return validate(target, "form", validator, exchange);
+    }
 }
diff --git a/application/src/main/java/run/halo/app/security/authentication/twofactor/TwoFactorAuthEndpoint.java b/application/src/main/java/run/halo/app/security/authentication/twofactor/TwoFactorAuthEndpoint.java
index f874f5eb75..31e9198781 100644
--- a/application/src/main/java/run/halo/app/security/authentication/twofactor/TwoFactorAuthEndpoint.java
+++ b/application/src/main/java/run/halo/app/security/authentication/twofactor/TwoFactorAuthEndpoint.java
@@ -15,7 +15,6 @@
 import org.springframework.security.core.context.SecurityContext;
 import org.springframework.security.crypto.password.PasswordEncoder;
 import org.springframework.stereotype.Component;
-import org.springframework.validation.BeanPropertyBindingResult;
 import org.springframework.validation.Validator;
 import org.springframework.web.reactive.function.server.RouterFunction;
 import org.springframework.web.reactive.function.server.ServerRequest;
@@ -29,6 +28,7 @@
 import run.halo.app.extension.GroupVersion;
 import run.halo.app.extension.ReactiveExtensionClient;
 import run.halo.app.infra.ExternalUrlSupplier;
+import run.halo.app.infra.ValidationUtils;
 import run.halo.app.infra.exception.AccessDeniedException;
 import run.halo.app.infra.exception.RequestBodyValidationException;
 import run.halo.app.security.authentication.twofactor.totp.TotpAuthService;
@@ -108,8 +108,9 @@ public RouterFunction<ServerResponse> endpoint() {
     private Mono<ServerResponse> deleteTotp(ServerRequest request) {
         var totpDeleteRequestMono = request.bodyToMono(PasswordRequest.class)
             .switchIfEmpty(Mono.error(() -> new ServerWebInputException("Request body required")))
-            .doOnNext(
-                passwordRequest -> this.validateRequest(passwordRequest, "passwordRequest"));
+            .doOnNext(passwordRequest -> this.validateRequest(passwordRequest, "passwordRequest",
+                request)
+            );
 
         var twoFactorAuthSettings =
             totpDeleteRequestMono.flatMap(passwordRequest -> getCurrentUser()
@@ -148,7 +149,8 @@ private Mono<ServerResponse> enableTwoFactor(ServerRequest request) {
     private Mono<ServerResponse> toggleTwoFactor(ServerRequest request, boolean enabled) {
         return request.bodyToMono(PasswordRequest.class)
             .switchIfEmpty(Mono.error(() -> new ServerWebInputException("Request body required")))
-            .doOnNext(passwordRequest -> this.validateRequest(passwordRequest, "passwordRequest"))
+            .doOnNext(passwordRequest -> this.validateRequest(passwordRequest,
+                "passwordRequest", request))
             .flatMap(passwordRequest -> getCurrentUser()
                 .filter(user -> {
                     var encodedPassword = user.getSpec().getPassword();
@@ -199,7 +201,7 @@ public static class TotpAuthLinkResponse {
     private Mono<ServerResponse> configureTotp(ServerRequest request) {
         var totpRequestMono = request.bodyToMono(TotpRequest.class)
             .switchIfEmpty(Mono.error(() -> new ServerWebInputException("Request body required.")))
-            .doOnNext(totpRequest -> this.validateRequest(totpRequest, "totp"));
+            .doOnNext(totpRequest -> this.validateRequest(totpRequest, "totp", request));
 
         var configuredUser = totpRequestMono.flatMap(totpRequest -> {
             // validate password
@@ -235,11 +237,11 @@ private Mono<ServerResponse> configureTotp(ServerRequest request) {
         return ServerResponse.ok().body(twoFactorAuthSettings, TwoFactorAuthSettings.class);
     }
 
-    private void validateRequest(Object target, String name) {
-        var errors = new BeanPropertyBindingResult(target, name);
-        validator.validate(target, errors);
-        if (errors.hasErrors()) {
-            throw new RequestBodyValidationException(errors);
+    private void validateRequest(Object target, String name, ServerRequest request) {
+        var bindingResult =
+            ValidationUtils.validate(target, name, validator, request.exchange());
+        if (bindingResult.hasErrors()) {
+            throw new RequestBodyValidationException(bindingResult);
         }
     }
 
diff --git a/application/src/main/java/run/halo/app/security/preauth/PreAuthSignUpEndpoint.java b/application/src/main/java/run/halo/app/security/preauth/PreAuthSignUpEndpoint.java
index 4566b03a84..a430723974 100644
--- a/application/src/main/java/run/halo/app/security/preauth/PreAuthSignUpEndpoint.java
+++ b/application/src/main/java/run/halo/app/security/preauth/PreAuthSignUpEndpoint.java
@@ -4,6 +4,7 @@
 import static org.springframework.http.MediaType.APPLICATION_JSON;
 import static org.springframework.web.reactive.function.server.RequestPredicates.contentType;
 import static org.springframework.web.reactive.function.server.RequestPredicates.path;
+import static run.halo.app.infra.ValidationUtils.validate;
 
 import io.github.resilience4j.ratelimiter.RateLimiterRegistry;
 import io.github.resilience4j.ratelimiter.RequestNotPermitted;
@@ -81,10 +82,9 @@ RouterFunction<ServerResponse> preAuthSignUpEndpoints() {
                     .map(SignUpData::of)
                     .flatMap(signUpData -> {
                         // sign up
-                        var bindingResult = new BeanPropertyBindingResult(signUpData, "form");
+                        var bindingResult = validate(signUpData, validator, request.exchange());
                         var model = bindingResult.getModel();
                         model.put("globalInfo", globalInfoService.getGlobalInfo());
-                        validator.validate(signUpData, bindingResult);
                         if (bindingResult.hasErrors()) {
                             return ServerResponse.ok().render("signup", model);
                         }
@@ -120,8 +120,7 @@ RouterFunction<ServerResponse> preAuthSignUpEndpoints() {
             .POST("/send-email-code", contentType(APPLICATION_JSON),
                 request -> request.bodyToMono(SendEmailCodeBody.class)
                     .flatMap(body -> {
-                        var bindingResult = new BeanPropertyBindingResult(body, "body");
-                        validator.validate(body, bindingResult);
+                        var bindingResult = validate(body, "body", validator, request.exchange());
                         if (bindingResult.hasErrors()) {
                             return Mono.error(new RequestBodyValidationException(bindingResult));
                         }
diff --git a/application/src/main/java/run/halo/app/security/preauth/SystemSetupEndpoint.java b/application/src/main/java/run/halo/app/security/preauth/SystemSetupEndpoint.java
index afe07f8ff8..a3bd6572bc 100644
--- a/application/src/main/java/run/halo/app/security/preauth/SystemSetupEndpoint.java
+++ b/application/src/main/java/run/halo/app/security/preauth/SystemSetupEndpoint.java
@@ -118,8 +118,7 @@ private Mono<ServerResponse> setup(ServerRequest request) {
                 .map(initialized -> !initialized)
             )
             .flatMap(body -> {
-                var bindingResult = body.toBindingResult();
-                validator.validate(body, bindingResult);
+                var bindingResult = ValidationUtils.validate(body, validator, request.exchange());
                 if (bindingResult.hasErrors()) {
                     return handleValidationErrors(bindingResult, request);
                 }
@@ -208,7 +207,7 @@ private Mono<ServerResponse> setupPage(ServerRequest request) {
                     return redirectToConsole();
                 }
                 var body = new SetupRequest(new LinkedMultiValueMap<>());
-                var bindingResult = body.toBindingResult();
+                var bindingResult = new BeanPropertyBindingResult(body, "form");
                 return ServerResponse.ok().render(SETUP_TEMPLATE, bindingResult.getModel());
             });
     }
@@ -243,10 +242,6 @@ public String getEmail() {
         public String getSiteTitle() {
             return formData.getFirst("siteTitle");
         }
-
-        public BindingResult toBindingResult() {
-            return new BeanPropertyBindingResult(this, "form");
-        }
     }
 
     Flux<Unstructured> loadPresetExtensions(String username) {

From 2de02c9ad405b99287d3f29239e4431cd475b6b8 Mon Sep 17 00:00:00 2001
From: Ryan Wang <i@ryanc.cc>
Date: Fri, 11 Oct 2024 16:03:05 +0800
Subject: [PATCH 124/185] refactor: improve ui of login page (#6809)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/area core
/kind improvement
/milestone 2.20.x

#### What this PR does / why we need it:

优化登录页面的 UI。

<img width="1910" alt="image" src="https://github.com/user-attachments/assets/736b1f72-e7c1-4c19-a0d9-dc935c738931">


#### Does this PR introduce a user-facing change?

```release-note
None
```
---
 .../src/main/resources/static/styles/main.css     | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/application/src/main/resources/static/styles/main.css b/application/src/main/resources/static/styles/main.css
index c7ac03b8eb..757a531159 100644
--- a/application/src/main/resources/static/styles/main.css
+++ b/application/src/main/resources/static/styles/main.css
@@ -2,7 +2,6 @@
 .gateway-page {
     width: 100%;
     height: 100vh;
-    background-color: #f5f5f5;
     overflow: auto;
 }
 
@@ -44,6 +43,7 @@
     margin: 0 auto;
     max-width: 28em;
     padding: 5% 1em;
+    line-height: 1.5;
     font-family:
         ui-sans-serif,
         system-ui,
@@ -64,6 +64,7 @@
 /* Form */
 .halo-form-wrapper {
     border-radius: var(--rounded-lg);
+    border: 1px solid #dfe6ecb3;
     background: #fff;
     padding: 1.5em;
 }
@@ -79,11 +80,11 @@
 .halo-form .form-item {
     display: flex;
     flex-direction: column;
-    margin-bottom: 1.3em;
+    margin-bottom: 1.5em;
     width: 100%;
 }
 
-.halo-form .form-item:last-child {
+.halo-form .form-item:last-of-type {
     margin-bottom: 0;
 }
 
@@ -91,7 +92,7 @@
     gap: var(--spacing-lg);
     display: flex;
     align-items: flex-start;
-    margin-bottom: 1.3em;
+    margin-bottom: 1.5em;
 }
 
 .halo-form .form-item-group .form-item {
@@ -160,13 +161,13 @@
 
 .halo-form .form-item label {
     color: var(--color-text);
-    margin-bottom: 0.625em;
+    margin-bottom: 0.75rem;
     font-size: var(--text-base);
     font-weight: 500;
 }
 
 .halo-form .form-item .form-label-group {
-    margin-bottom: 0.625em;
+    margin-bottom: 0.75em;
     display: flex;
     justify-content: space-between;
     align-items: center;
@@ -305,7 +306,7 @@
 .pill-items li a {
     gap: var(--spacing-sm);
     font-size: var(--text-sm);
-    padding: 0.7em 1em;
+    padding: 0.6em 0.9em;
     display: flex;
     align-items: center;
     color: #1f2937;

From 687c76028862582916ae1a90fbfc2bf1a709ab7c Mon Sep 17 00:00:00 2001
From: Ryan Wang <i@ryanc.cc>
Date: Fri, 11 Oct 2024 16:21:07 +0800
Subject: [PATCH 125/185] feat: add password reset success message in login
 page (#6818)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/area core
/kind improvement
/milestone 2.20.x

#### What this PR does / why we need it:

重置密码跳转到登录页面之后，在顶部添加重置成功的提示。

#### Does this PR introduce a user-facing change?

```release-note
None
```
---
 .../templates/gateway_fragments/login.html      | 17 ++++++++++-------
 .../gateway_fragments/login.properties          |  1 +
 .../gateway_fragments/login_en.properties       |  1 +
 .../gateway_fragments/login_es.properties       |  1 +
 .../gateway_fragments/login_zh_TW.properties    |  1 +
 5 files changed, 14 insertions(+), 7 deletions(-)

diff --git a/application/src/main/resources/templates/gateway_fragments/login.html b/application/src/main/resources/templates/gateway_fragments/login.html
index 07ada8fbba..bb164b117d 100644
--- a/application/src/main/resources/templates/gateway_fragments/login.html
+++ b/application/src/main/resources/templates/gateway_fragments/login.html
@@ -1,10 +1,10 @@
 <form
-        th:fragment="form"
-        class="halo-form"
-        name="login-form"
-        id="login-form"
-        th:action="${authProvider.spec.authenticationUrl}"
-        th:method="${authProvider.spec.method}"
+    th:fragment="form"
+    class="halo-form"
+    name="login-form"
+    id="login-form"
+    th:action="${authProvider.spec.authenticationUrl}"
+    th:method="${authProvider.spec.method}"
 >
     <div class="alert alert-error" role="alert" th:if="${param.error.size() > 0}" th:with="error = ${param.error[0]}">
         <strong th:if="${error == 'invalid-credential'}">
@@ -23,6 +23,9 @@
     <div class="alert" role="alert" th:if="${param.oauth2_bind.size() > 0}">
         <strong th:text="#{form.messages.oauth2Bind}"></strong>
     </div>
+    <div class="alert" role="alert" th:if="${param.password_reset.size() > 0}">
+        <strong th:text="#{form.messages.passwordReset}"></strong>
+    </div>
 
     <div th:replace="~{__${fragmentTemplateName}__::form}"></div>
 
@@ -54,4 +57,4 @@
             </li>
         </ul>
     </th:block>
-</div>
\ No newline at end of file
+</div>
diff --git a/application/src/main/resources/templates/gateway_fragments/login.properties b/application/src/main/resources/templates/gateway_fragments/login.properties
index a6fd816a8a..bbd2288b45 100644
--- a/application/src/main/resources/templates/gateway_fragments/login.properties
+++ b/application/src/main/resources/templates/gateway_fragments/login.properties
@@ -1,6 +1,7 @@
 form.messages.logoutSuccess=登出成功。
 form.messages.signupSuccess=恭喜！注册成功，请立即登录。
 form.messages.oauth2Bind=当前登录未绑定账号，请尝试通过其他方式登录，登录成功后会自动绑定账号。
+form.messages.passwordReset=密码重置成功，请立即登录。
 form.error.invalidCredential=无效的凭证。
 form.error.rateLimitExceeded=请求过于频繁，请稍后再试。
 form.rememberMe.label=保持登录会话
diff --git a/application/src/main/resources/templates/gateway_fragments/login_en.properties b/application/src/main/resources/templates/gateway_fragments/login_en.properties
index 0b4829362f..a086d11a9b 100644
--- a/application/src/main/resources/templates/gateway_fragments/login_en.properties
+++ b/application/src/main/resources/templates/gateway_fragments/login_en.properties
@@ -1,6 +1,7 @@
 form.messages.logoutSuccess=Logout successfully.
 form.messages.signupSuccess=Congratulations! Sign up successfully, please login now.
 form.messages.oauth2Bind=The current login is not bound to an account. Please try to log in through other methods. After successful login, the account will be automatically bound.
+form.messages.passwordReset=Password reset successfully, please login now.
 form.error.invalidCredential=Invalid credentials.
 form.error.rateLimitExceeded=Too many requests, please try again later.
 form.rememberMe.label=Remember me
diff --git a/application/src/main/resources/templates/gateway_fragments/login_es.properties b/application/src/main/resources/templates/gateway_fragments/login_es.properties
index d81ad60bc4..461229b3c8 100644
--- a/application/src/main/resources/templates/gateway_fragments/login_es.properties
+++ b/application/src/main/resources/templates/gateway_fragments/login_es.properties
@@ -1,6 +1,7 @@
 form.messages.logoutSuccess=Cierre de sesión exitoso.
 form.messages.signupSuccess=¡Felicidades! Registro exitoso, por favor inicie sesión de inmediato.
 form.messages.oauth2Bind=El inicio de sesión actual no está vinculado a una cuenta. Intente iniciar sesión a través de otros métodos. Después de un inicio de sesión exitoso, la cuenta se vinculará automáticamente.
+form.messages.passwordReset=¡Felicidades! La contraseña se ha restablecido con éxito.
 form.error.invalidCredential=Credenciales inválidas.
 form.error.rateLimitExceeded=Demasiadas solicitudes, por favor intente nuevamente más tarde.
 form.rememberMe.label=Mantener sesión iniciada
diff --git a/application/src/main/resources/templates/gateway_fragments/login_zh_TW.properties b/application/src/main/resources/templates/gateway_fragments/login_zh_TW.properties
index c364adb352..b485ddd937 100644
--- a/application/src/main/resources/templates/gateway_fragments/login_zh_TW.properties
+++ b/application/src/main/resources/templates/gateway_fragments/login_zh_TW.properties
@@ -1,6 +1,7 @@
 form.messages.logoutSuccess=登出成功。
 form.messages.signupSuccess=恭喜！註冊成功，請立即登入。
 form.messages.oauth2Bind=當前登入未綁定至帳戶。請嘗試通過其他方法登入。成功登入後，帳戶將自動綁定。
+form.messages.passwordReset=密碼重置成功。請立即登入。
 form.error.invalidCredential=無效的憑證。
 form.error.rateLimitExceeded=請求過於頻繁，請稍後再試。
 form.form.rememberMe.label=保持登入會話

From 59a59715a1c26635dff7f3635bcf0d8d8b1f6a2d Mon Sep 17 00:00:00 2001
From: Ryan Wang <i@ryanc.cc>
Date: Fri, 11 Oct 2024 16:23:07 +0800
Subject: [PATCH 126/185] refactor: improve password hint text on reset
 password page (#6820)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/area core
/kind improvement
/milestone 2.20.x

#### What this PR does / why we need it:

优化重置密码页面的密码提示文本，以 https://github.com/halo-dev/halo/blob/aab8806f0d64b4c4cd009ff0a7d9687c9207ab2a/application/src/main/resources/config/i18n/messages_zh.properties#L66 为准。

#### Does this PR introduce a user-facing change?

```release-note
None
```
---
 .../gateway_fragments/password_reset_email_reset.properties     | 2 +-
 .../gateway_fragments/password_reset_email_reset_en.properties  | 2 +-
 .../gateway_fragments/password_reset_email_reset_es.properties  | 2 +-
 .../password_reset_email_reset_zh_TW.properties                 | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/application/src/main/resources/templates/gateway_fragments/password_reset_email_reset.properties b/application/src/main/resources/templates/gateway_fragments/password_reset_email_reset.properties
index c8240e54e7..978712db88 100644
--- a/application/src/main/resources/templates/gateway_fragments/password_reset_email_reset.properties
+++ b/application/src/main/resources/templates/gateway_fragments/password_reset_email_reset.properties
@@ -1,4 +1,4 @@
 form.password.label=密码
 form.confirmPassword.label=确认密码
-form.password.tips=密码必须至少包含 8 个字符，并且至少包含一个大写字母、一个小写字母、一个数字和一个特殊字符。
+form.password.tips=密码只能使用大小写字母 (A-Z, a-z)、数字 (0-9)，以及以下特殊字符: !@#$%^&*。
 form.submit=修改密码
\ No newline at end of file
diff --git a/application/src/main/resources/templates/gateway_fragments/password_reset_email_reset_en.properties b/application/src/main/resources/templates/gateway_fragments/password_reset_email_reset_en.properties
index a69e1b81df..cbeb3eb213 100644
--- a/application/src/main/resources/templates/gateway_fragments/password_reset_email_reset_en.properties
+++ b/application/src/main/resources/templates/gateway_fragments/password_reset_email_reset_en.properties
@@ -1,4 +1,4 @@
 form.password.label=Password
 form.confirmPassword.label=Confirm Password
-form.password.tips=Password must be at least 8 characters long and contain at least one uppercase letter, one lowercase letter, one number, and one special character.
+form.password.tips=The password can only use uppercase and lowercase letters (A-Z, a-z), numbers (0-9), and the following special characters: !@#$%^&*
 form.submit=Change password
\ No newline at end of file
diff --git a/application/src/main/resources/templates/gateway_fragments/password_reset_email_reset_es.properties b/application/src/main/resources/templates/gateway_fragments/password_reset_email_reset_es.properties
index 7c34bdbeec..7bc35afcb2 100644
--- a/application/src/main/resources/templates/gateway_fragments/password_reset_email_reset_es.properties
+++ b/application/src/main/resources/templates/gateway_fragments/password_reset_email_reset_es.properties
@@ -1,4 +1,4 @@
 form.password.label=Contraseña
 form.confirmPassword.label=Confirmar Contraseña
-form.password.tips=La contraseña debe tener al menos 8 caracteres e incluir al menos una letra mayúscula, una letra minúscula, un número y un carácter especial.
+form.password.tips=La contraseña solo puede usar letras mayúsculas y minúsculas (A-Z, a-z), números (0-9) y los siguientes caracteres especiales: !@#$%^&*.
 form.submit=Cambiar Contraseña
\ No newline at end of file
diff --git a/application/src/main/resources/templates/gateway_fragments/password_reset_email_reset_zh_TW.properties b/application/src/main/resources/templates/gateway_fragments/password_reset_email_reset_zh_TW.properties
index 84d58c2aa7..b39dcdd7b5 100644
--- a/application/src/main/resources/templates/gateway_fragments/password_reset_email_reset_zh_TW.properties
+++ b/application/src/main/resources/templates/gateway_fragments/password_reset_email_reset_zh_TW.properties
@@ -1,4 +1,4 @@
 form.password.label=密碼
 form.confirmPassword.label=確認密碼
-form.password.tips=密碼必須至少包含 8 個字元，並且至少包含一個大寫字母、一個小寫字母、一個數字和一個特殊字元。
+form.password.tips=密碼只能使用大小寫字母 (A-Z, a-z)、數字 (0-9)，以及以下特殊字符: !@#$%^&*。
 form.submit=修改密碼
\ No newline at end of file

From d63eaed10ff601738caae4d2663f9fca5828125c Mon Sep 17 00:00:00 2001
From: Ryan Wang <i@ryanc.cc>
Date: Fri, 11 Oct 2024 17:27:05 +0800
Subject: [PATCH 127/185] fix: correct display of email verification message
 toast (#6822)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/area core
/kind bug
/milestone 2.20.x

#### What this PR does / why we need it:

修复不能正常显示邮箱验证提示的问题。

#### Does this PR introduce a user-facing change?

```release-note
None
```
---
 .../templates/gateway_fragments/signup.html   | 82 +++++++++----------
 1 file changed, 41 insertions(+), 41 deletions(-)

diff --git a/application/src/main/resources/templates/gateway_fragments/signup.html b/application/src/main/resources/templates/gateway_fragments/signup.html
index ded50b34e7..bc3315e06c 100644
--- a/application/src/main/resources/templates/gateway_fragments/signup.html
+++ b/application/src/main/resources/templates/gateway_fragments/signup.html
@@ -1,11 +1,11 @@
 <form
-        th:fragment="form"
-        class="halo-form"
-        name="signup-form"
-        id="signup-form"
-        th:action="@{/signup}"
-        th:object="${form}"
-        method="post"
+    th:fragment="form"
+    class="halo-form"
+    name="signup-form"
+    id="signup-form"
+    th:action="@{/signup}"
+    th:object="${form}"
+    method="post"
 >
     <div class="alert alert-error" role="alert" th:if="${error == 'invalid-email-code'}">
         <strong>
@@ -27,18 +27,18 @@
             <label for="username" th:text="#{form.username.label}"></label>
             <div class="form-input">
                 <input
-                        type="text"
-                        id="username"
-                        name="username"
-                        autocomplete="off"
-                        spellcheck="false"
-                        autocorrect="off"
-                        autocapitalize="off"
-                        autofocus
-                        required
-                        minlength="4"
-                        maxlength="63"
-                        th:field="*{username}"
+                    type="text"
+                    id="username"
+                    name="username"
+                    autocomplete="off"
+                    spellcheck="false"
+                    autocorrect="off"
+                    autocapitalize="off"
+                    autofocus
+                    required
+                    minlength="4"
+                    maxlength="63"
+                    th:field="*{username}"
                 />
             </div>
             <p class="alert alert-error" th:if="${#fields.hasErrors('username')}" th:errors="*{username}"></p>
@@ -48,15 +48,15 @@
             <label for="displayName" th:text="#{form.displayName.label}"></label>
             <div class="form-input">
                 <input
-                        type="text"
-                        id="displayName"
-                        name="displayName"
-                        autocomplete="off"
-                        spellcheck="false"
-                        autocorrect="off"
-                        autocapitalize="off"
-                        required
-                        th:field="*{displayName}"
+                    type="text"
+                    id="displayName"
+                    name="displayName"
+                    autocomplete="off"
+                    spellcheck="false"
+                    autocorrect="off"
+                    autocapitalize="off"
+                    required
+                    th:field="*{displayName}"
                 />
             </div>
             <p class="alert alert-error" th:if="${#fields.hasErrors('displayName')}" th:errors="*{displayName}"></p>
@@ -68,15 +68,15 @@
             <label for="email" th:text="#{form.email.label}"></label>
             <div class="form-input">
                 <input
-                        type="email"
-                        id="email"
-                        name="email"
-                        autocomplete="off"
-                        spellcheck="false"
-                        autocorrect="off"
-                        autocapitalize="off"
-                        required
-                        th:field="*{email}"
+                    type="email"
+                    id="email"
+                    name="email"
+                    autocomplete="off"
+                    spellcheck="false"
+                    autocorrect="off"
+                    autocapitalize="off"
+                    required
+                    th:field="*{email}"
                 />
             </div>
             <p class="alert alert-error" th:if="${#fields.hasErrors('email')}" th:errors="*{email}"></p>
@@ -98,7 +98,7 @@
     <div class="form-item">
         <label for="password" th:text="#{form.password.label}"></label>
         <th:block
-                th:replace="~{gateway_fragments/input :: password(id = 'password', name = 'password', required = 'true', minlength = 5, maxlength = 257, enableToggle = true)}"
+            th:replace="~{gateway_fragments/input :: password(id = 'password', name = 'password', required = 'true', minlength = 5, maxlength = 257, enableToggle = true)}"
         ></th:block>
         <p class="alert alert-error" th:if="${#fields.hasErrors('password')}" th:errors="*{password}"></p>
     </div>
@@ -106,7 +106,7 @@
     <div class="form-item">
         <label for="confirmPassword" th:text="#{form.confirmPassword.label}"></label>
         <th:block
-                th:replace="~{gateway_fragments/input :: password(id = 'confirmPassword', name = 'confirmPassword', required = 'true', minlength = 5, maxlength = 257, enableToggle = true)}"
+            th:replace="~{gateway_fragments/input :: password(id = 'confirmPassword', name = 'confirmPassword', required = 'true', minlength = 5, maxlength = 257, enableToggle = true)}"
         ></th:block>
         <p class="alert alert-error" th:if="${#fields.hasErrors('confirmPassword')}" th:errors="*{confirmPassword}"></p>
     </div>
@@ -128,7 +128,7 @@
                     const email = document.getElementById("email").value;
 
                     if (!email) {
-                        throw new Error(/*[[#{form.signup.emailCode.send.emptyValidation}]]*/"");
+                        throw new Error(/*[[#{form.emailCode.send.emptyValidation}]]*/"");
                     }
 
                     fetch("/signup/send-email-code", {
@@ -155,4 +155,4 @@
             sendVerificationCode(emailCodeSendButton, sendRequest);
         });
     </script>
-</form>
\ No newline at end of file
+</form>

From 98a131309cecc98980c9ef23101a99c1b0ad50db Mon Sep 17 00:00:00 2001
From: John Niang <johnniang@foxmail.com>
Date: Fri, 11 Oct 2024 17:51:06 +0800
Subject: [PATCH 128/185] Add globalInfo into templates model (#6823)

#### What type of PR is this?

/kind improvement
/area core
/milestone 2.20.x

#### What this PR does / why we need it:

This PR adds globalInfo into template models and refactors password reset to adapt data binding.

Fixes https://github.com/halo-dev/halo/issues/6821

#### Does this PR introduce a user-facing change?

```release-note
None
```
---
 .../PreAuthEmailPasswordResetEndpoint.java    | 258 +++++++++---------
 .../preauth/PreAuthTwoFactorEndpoint.java     |   8 +-
 .../password_reset_email_reset.html           |   5 +-
 .../password_reset_email_reset.properties     |   3 +-
 .../password_reset_email_reset_en.properties  |   3 +-
 .../password_reset_email_reset_es.properties  |   3 +-
 ...assword_reset_email_reset_zh_TW.properties |   3 +-
 .../password_reset_email_send.html            |  12 +-
 .../password_reset_email_send.properties      |   4 +-
 .../password_reset_email_send_en.properties   |   4 +-
 .../password_reset_email_send_es.properties   |   4 +-
 ...password_reset_email_send_zh_TW.properties |   4 +-
 12 files changed, 174 insertions(+), 137 deletions(-)

diff --git a/application/src/main/java/run/halo/app/security/preauth/PreAuthEmailPasswordResetEndpoint.java b/application/src/main/java/run/halo/app/security/preauth/PreAuthEmailPasswordResetEndpoint.java
index 3bdee33b01..1054fc2367 100644
--- a/application/src/main/java/run/halo/app/security/preauth/PreAuthEmailPasswordResetEndpoint.java
+++ b/application/src/main/java/run/halo/app/security/preauth/PreAuthEmailPasswordResetEndpoint.java
@@ -2,28 +2,35 @@
 
 import static org.springframework.web.reactive.function.server.RequestPredicates.contentType;
 import static org.springframework.web.reactive.function.server.RequestPredicates.path;
+import static run.halo.app.infra.ValidationUtils.validate;
 
 import io.github.resilience4j.ratelimiter.RateLimiterRegistry;
 import io.github.resilience4j.ratelimiter.RequestNotPermitted;
 import io.github.resilience4j.reactor.ratelimiter.operator.RateLimiterOperator;
+import jakarta.validation.constraints.Email;
+import jakarta.validation.constraints.NotBlank;
+import jakarta.validation.constraints.Pattern;
+import jakarta.validation.constraints.Size;
 import java.net.URI;
-import java.util.Locale;
+import java.util.HashMap;
 import java.util.Map;
 import java.util.Objects;
-import java.util.Optional;
-import org.apache.commons.lang3.StringUtils;
+import lombok.Data;
 import org.springframework.context.MessageSource;
 import org.springframework.context.annotation.Bean;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.MediaType;
 import org.springframework.http.server.reactive.ServerHttpRequest;
 import org.springframework.stereotype.Component;
+import org.springframework.validation.Validator;
 import org.springframework.web.reactive.function.server.RouterFunction;
 import org.springframework.web.reactive.function.server.RouterFunctions;
 import org.springframework.web.reactive.function.server.ServerResponse;
+import reactor.core.publisher.Mono;
 import run.halo.app.core.user.service.EmailPasswordRecoveryService;
 import run.halo.app.core.user.service.InvalidResetTokenException;
-import run.halo.app.infra.exception.RateLimitExceededException;
+import run.halo.app.infra.ValidationUtils;
+import run.halo.app.infra.actuator.GlobalInfoService;
 import run.halo.app.infra.utils.IpAddressUtils;
 
 /**
@@ -38,151 +45,133 @@ class PreAuthEmailPasswordResetEndpoint {
     private static final String SEND_TEMPLATE = "password-reset/email/send";
     private static final String RESET_TEMPLATE = "password-reset/email/reset";
 
-    private final EmailPasswordRecoveryService emailPasswordRecoveryService;
-
-    private final MessageSource messageSource;
-
     private final RateLimiterRegistry rateLimiterRegistry;
 
-    private final PasswordResetAvailabilityProviders passwordResetAvailabilityProviders;
-
     public PreAuthEmailPasswordResetEndpoint(
-        EmailPasswordRecoveryService emailPasswordRecoveryService,
-        MessageSource messageSource,
-        RateLimiterRegistry rateLimiterRegistry,
-        PasswordResetAvailabilityProviders passwordResetAvailabilityProviders
+        RateLimiterRegistry rateLimiterRegistry
     ) {
-        this.emailPasswordRecoveryService = emailPasswordRecoveryService;
-        this.messageSource = messageSource;
         this.rateLimiterRegistry = rateLimiterRegistry;
-        this.passwordResetAvailabilityProviders = passwordResetAvailabilityProviders;
     }
 
     @Bean
-    RouterFunction<ServerResponse> preAuthPasswordResetEndpoints() {
+    RouterFunction<ServerResponse> preAuthPasswordResetEndpoints(
+        GlobalInfoService globalInfoService,
+        PasswordResetAvailabilityProviders availabilityProviders,
+        MessageSource messageSource,
+        EmailPasswordRecoveryService emailService,
+        Validator validator
+    ) {
         return RouterFunctions.nest(path("/password-reset/email"), RouterFunctions.route()
-            .GET("", request -> {
-                return ServerResponse.ok().render(SEND_TEMPLATE, Map.of(
-                    "otherMethods",
-                    passwordResetAvailabilityProviders.getOtherAvailableMethods("email")
-                ));
-            })
+            .GET("", request -> request.bind(SendForm.class)
+                .flatMap(sendForm -> ServerResponse.ok().render(SEND_TEMPLATE, Map.of(
+                    "otherMethods", availabilityProviders.getOtherAvailableMethods("email"),
+                    "globalInfo", globalInfoService.getGlobalInfo(),
+                    "form", sendForm
+                )))
+            )
             .GET("/{resetToken}",
                 request -> {
                     var token = request.pathVariable("resetToken");
-                    return emailPasswordRecoveryService.getValidResetToken(token)
-                        .flatMap(resetToken -> {
-                            // TODO Check the 2FA of the user
-                            return ServerResponse.ok().render(RESET_TEMPLATE, Map.of(
-                                "username", resetToken.username()
-                            ));
-                        })
-                        .onErrorResume(InvalidResetTokenException.class,
-                            e -> ServerResponse.status(HttpStatus.FOUND)
-                                .location(
-                                    URI.create("/password-reset/email?error=invalid_reset_token")
-                                )
-                                .build()
+                    return request.bind(ResetForm.class)
+                        .flatMap(resetForm -> {
+                            var model = new HashMap<String, Object>();
+                            model.put("form", resetForm);
+                            model.put("globalInfo", globalInfoService.getGlobalInfo());
+                            return emailService.getValidResetToken(token)
+                                .flatMap(resetToken -> {
+                                    // TODO Check the 2FA of the user
+                                    model.put("username", resetToken.username());
+                                    return ServerResponse.ok().render(RESET_TEMPLATE, model);
+                                })
                                 .transformDeferred(rateLimiterForPasswordResetVerification(
                                     request.exchange().getRequest()
                                 ))
-                                .onErrorMap(
-                                    RequestNotPermitted.class, RateLimitExceededException::new
+                                .onErrorResume(InvalidResetTokenException.class, e ->
+                                    ServerResponse.status(HttpStatus.FOUND)
+                                        .location(URI.create(
+                                            "/password-reset/email?error=invalid_reset_token")
+                                        )
+                                        .build()
                                 )
-                        );
+                                .onErrorResume(RequestNotPermitted.class, e -> {
+                                    model.put("error", "rate_limit_exceeded");
+                                    return ServerResponse.status(HttpStatus.TOO_MANY_REQUESTS)
+                                        .render(RESET_TEMPLATE, model);
+                                });
+                        });
                 }
             )
             .POST("/{resetToken}", request -> {
                 var token = request.pathVariable("resetToken");
-                return request.formData()
-                    .flatMap(formData -> {
-                        var locale = Optional.ofNullable(
-                                request.exchange().getLocaleContext().getLocale()
-                            )
-                            .orElseGet(Locale::getDefault);
-                        var password = formData.getFirst("password");
-                        var confirmPassword = formData.getFirst("confirmPassword");
-                        if (StringUtils.isBlank(password)) {
-                            var error = messageSource.getMessage(
-                                "passwordReset.password.blank",
-                                null,
-                                "Password can't be blank",
-                                locale
-                            );
-                            return ServerResponse.ok().render(RESET_TEMPLATE, Map.of(
-                                "error", error
-                            ));
-                        }
-                        if (!Objects.equals(password, confirmPassword)) {
-                            var error = messageSource.getMessage(
-                                "passwordReset.confirmPassword.mismatch",
-                                null,
-                                "Password and confirm password mismatch",
-                                locale
-                            );
-                            return ServerResponse.ok().render(RESET_TEMPLATE, Map.of(
-                                "error", error
-                            ));
-                        }
-                        return emailPasswordRecoveryService.changePassword(password, token)
-                            .then(ServerResponse.status(HttpStatus.FOUND)
-                                .location(URI.create("/login?password_reset"))
-                                .build()
-                            )
-                            .onErrorResume(InvalidResetTokenException.class, e -> {
-                                var error = messageSource.getMessage(
-                                    "passwordReset.resetToken.invalid",
-                                    null,
-                                    "Invalid reset token",
-                                    locale
-                                );
-                                return ServerResponse.ok().render(RESET_TEMPLATE, Map.of(
-                                    "error", error
-                                )).transformDeferred(rateLimiterForPasswordResetVerification(
-                                    request.exchange().getRequest()
-                                )).onErrorMap(
-                                    RequestNotPermitted.class, RateLimitExceededException::new
-                                );
-                            });
-                    });
-            })
-            .POST("", contentType(MediaType.APPLICATION_FORM_URLENCODED),
-                request -> {
-                    // get username and email
-                    return request.formData()
-                        .flatMap(formData -> {
-                            var locale = Optional.ofNullable(
-                                    request.exchange().getLocaleContext().getLocale()
-                                )
-                                .orElseGet(Locale::getDefault);
-                            var email = formData.getFirst("email");
-                            if (StringUtils.isBlank(email)) {
-                                var error = messageSource.getMessage(
-                                    "passwordReset.email.blank",
-                                    null,
-                                    "Email can't be blank",
-                                    locale
+                return request.bind(ResetForm.class)
+                    .flatMap(resetForm -> emailService.getValidResetToken(token)
+                        .flatMap(resetToken -> {
+                            var bindingResult = validate(resetForm, validator, request.exchange());
+                            var model = bindingResult.getModel();
+                            model.put("globalInfo", globalInfoService.getGlobalInfo());
+                            model.put("username", resetToken.username());
+                            if (!Objects.equals(
+                                resetForm.getPassword(), resetForm.getConfirmPassword()
+                            )) {
+                                bindingResult.rejectValue(
+                                    "confirmPassword",
+                                    "validation.error.password.confirmPassword.mismatch",
+                                    "Password and confirm password mismatch"
                                 );
-                                return ServerResponse.ok().render(SEND_TEMPLATE, Map.of(
-                                    "error", error
-                                ));
                             }
-                            return emailPasswordRecoveryService.sendPasswordResetEmail(email)
-                                .then(ServerResponse.ok().render(SEND_TEMPLATE, Map.of(
-                                    "sent", true
-                                )))
-                                .transformDeferred(rateLimiterForSendPasswordResetEmail(
+                            if (bindingResult.hasErrors()) {
+                                return ServerResponse.badRequest().render(RESET_TEMPLATE, model);
+                            }
+                            return emailService.changePassword(resetForm.getPassword(), token)
+                                .then(ServerResponse.status(HttpStatus.FOUND)
+                                    .location(URI.create("/login?password_reset"))
+                                    .build()
+                                )
+                                .transformDeferred(rateLimiterForPasswordResetVerification(
                                     request.exchange().getRequest()
                                 ))
-                                .onErrorMap(
-                                    RequestNotPermitted.class, RateLimitExceededException::new
-                                );
-                        });
-                })
+                                .onErrorResume(RequestNotPermitted.class, e -> {
+                                    model.put("error", "rate_limit_exceeded");
+                                    return ServerResponse.status(HttpStatus.TOO_MANY_REQUESTS)
+                                        .render(RESET_TEMPLATE, model);
+                                });
+                        })
+                        .onErrorResume(InvalidResetTokenException.class,
+                            e -> ServerResponse.status(HttpStatus.FOUND)
+                                .location(URI.create(
+                                    "/password-reset/email?error=invalid_reset_token"
+                                ))
+                                .build()
+                        )
+                    );
+            })
+            .POST("", contentType(MediaType.APPLICATION_FORM_URLENCODED),
+                request -> request.bind(SendForm.class)
+                    .flatMap(sendForm -> {
+                        // validate the send form
+                        var bindingResult = validate(sendForm, validator, request.exchange());
+                        var model = bindingResult.getModel();
+                        model.put("globalInfo", globalInfoService.getGlobalInfo());
+                        if (bindingResult.hasErrors()) {
+                            return ServerResponse.badRequest().render(SEND_TEMPLATE, model);
+                        }
+                        return emailService.sendPasswordResetEmail(sendForm.getEmail())
+                            .then(Mono.defer(() -> {
+                                model.put("sent", true);
+                                return ServerResponse.ok().render(SEND_TEMPLATE, model);
+                            }))
+                            .transformDeferred(rateLimiterForSendPasswordResetEmail(
+                                request.exchange().getRequest()
+                            ))
+                            .onErrorResume(RequestNotPermitted.class, e -> {
+                                model.put("error", "rate_limit_exceeded");
+                                return ServerResponse.status(HttpStatus.TOO_MANY_REQUESTS)
+                                    .render(SEND_TEMPLATE, model);
+                            });
+                    }))
             .build());
     }
 
-
     <T> RateLimiterOperator<T> rateLimiterForSendPasswordResetEmail(ServerHttpRequest request) {
         var clientIp = IpAddressUtils.getClientIp(request);
         var rateLimiterKey = "send-password-reset-email-from-" + clientIp;
@@ -198,4 +187,29 @@ <T> RateLimiterOperator<T> rateLimiterForPasswordResetVerification(ServerHttpReq
             rateLimiterRegistry.rateLimiter(rateLimiterKey, "password-reset-verification");
         return RateLimiterOperator.of(rateLimiter);
     }
+
+    @Data
+    static class ResetForm {
+
+        @NotBlank
+        @Pattern(
+            regexp = ValidationUtils.PASSWORD_REGEX,
+            message = "{validation.error.password.pattern}"
+        )
+        @Size(min = 5, max = 257)
+        private String password;
+
+        @NotBlank
+        private String confirmPassword;
+
+    }
+
+    @Data
+    static class SendForm {
+
+        @NotBlank
+        @Email
+        private String email;
+
+    }
 }
diff --git a/application/src/main/java/run/halo/app/security/preauth/PreAuthTwoFactorEndpoint.java b/application/src/main/java/run/halo/app/security/preauth/PreAuthTwoFactorEndpoint.java
index 8fea7bdd14..08ac8052b9 100644
--- a/application/src/main/java/run/halo/app/security/preauth/PreAuthTwoFactorEndpoint.java
+++ b/application/src/main/java/run/halo/app/security/preauth/PreAuthTwoFactorEndpoint.java
@@ -1,10 +1,12 @@
 package run.halo.app.security.preauth;
 
+import java.util.Map;
 import org.springframework.context.annotation.Bean;
 import org.springframework.stereotype.Component;
 import org.springframework.web.reactive.function.server.RouterFunction;
 import org.springframework.web.reactive.function.server.RouterFunctions;
 import org.springframework.web.reactive.function.server.ServerResponse;
+import run.halo.app.infra.actuator.GlobalInfoService;
 
 /**
  * Pre-auth two-factor endpoints.
@@ -16,10 +18,12 @@
 class PreAuthTwoFactorEndpoint {
 
     @Bean
-    RouterFunction<ServerResponse> preAuthTwoFactorEndpoints() {
+    RouterFunction<ServerResponse> preAuthTwoFactorEndpoints(GlobalInfoService globalInfoService) {
         return RouterFunctions.route()
             .GET("/challenges/two-factor/totp",
-                request -> ServerResponse.ok().render("challenges/two-factor/totp")
+                request -> ServerResponse.ok().render("challenges/two-factor/totp", Map.of(
+                    "globalInfo", globalInfoService.getGlobalInfo()
+                ))
             )
             .build();
     }
diff --git a/application/src/main/resources/templates/gateway_fragments/password_reset_email_reset.html b/application/src/main/resources/templates/gateway_fragments/password_reset_email_reset.html
index 231a10990b..b3ce4824b1 100644
--- a/application/src/main/resources/templates/gateway_fragments/password_reset_email_reset.html
+++ b/application/src/main/resources/templates/gateway_fragments/password_reset_email_reset.html
@@ -3,21 +3,24 @@
         class="halo-form"
         th:action="@{/password-reset/email/{resetToken}(resetToken=${resetToken})}"
         method="post"
+        th:object="${form}"
 >
     <div class="alert alert-error" role="alert" th:if="${error}">
-        <strong th:text="${error}"></strong>
+        <strong th:if="${error == 'rate_limit_exceeded'}" th:text="#{error.rate_limit_exceeded}"></strong>
     </div>
     <div class="form-item">
         <label for="password" th:text="#{form.password.label}">Password</label>
         <th:block
                 th:replace="~{gateway_fragments/input :: password(id = 'password', name = 'password', required = 'true', minlength = 5, maxlength = 257, enableToggle = true)}"
         ></th:block>
+        <p class="alert alert-error" th:if="${#fields.hasErrors('password')}" th:errors="*{password}"></p>
     </div>
     <div class="form-item">
         <label for="confirmPassword" th:text="#{form.confirmPassword.label}">Confirm Password</label>
         <th:block
                 th:replace="~{gateway_fragments/input :: password(id = 'confirmPassword', name = 'confirmPassword', required = 'true', minlength = 5, maxlength = 257, enableToggle = true)}"
         ></th:block>
+        <p class="alert alert-error" th:if="${#fields.hasErrors('confirmPassword')}" th:errors="*{confirmPassword}"></p>
     </div>
     <div class="form-item">
         <div class="alert" th:text="#{form.password.tips}"></div>
diff --git a/application/src/main/resources/templates/gateway_fragments/password_reset_email_reset.properties b/application/src/main/resources/templates/gateway_fragments/password_reset_email_reset.properties
index 978712db88..b3bfbf83db 100644
--- a/application/src/main/resources/templates/gateway_fragments/password_reset_email_reset.properties
+++ b/application/src/main/resources/templates/gateway_fragments/password_reset_email_reset.properties
@@ -1,4 +1,5 @@
 form.password.label=密码
 form.confirmPassword.label=确认密码
 form.password.tips=密码只能使用大小写字母 (A-Z, a-z)、数字 (0-9)，以及以下特殊字符: !@#$%^&*。
-form.submit=修改密码
\ No newline at end of file
+form.submit=修改密码
+error.rate_limit_exceeded=您的请求过于频繁，请稍后再试。
diff --git a/application/src/main/resources/templates/gateway_fragments/password_reset_email_reset_en.properties b/application/src/main/resources/templates/gateway_fragments/password_reset_email_reset_en.properties
index cbeb3eb213..89efb84ce0 100644
--- a/application/src/main/resources/templates/gateway_fragments/password_reset_email_reset_en.properties
+++ b/application/src/main/resources/templates/gateway_fragments/password_reset_email_reset_en.properties
@@ -1,4 +1,5 @@
 form.password.label=Password
 form.confirmPassword.label=Confirm Password
 form.password.tips=The password can only use uppercase and lowercase letters (A-Z, a-z), numbers (0-9), and the following special characters: !@#$%^&*
-form.submit=Change password
\ No newline at end of file
+form.submit=Change password
+error.rate_limit_exceeded=Your request is too frequent, please try again later.
diff --git a/application/src/main/resources/templates/gateway_fragments/password_reset_email_reset_es.properties b/application/src/main/resources/templates/gateway_fragments/password_reset_email_reset_es.properties
index 7bc35afcb2..3d3f065905 100644
--- a/application/src/main/resources/templates/gateway_fragments/password_reset_email_reset_es.properties
+++ b/application/src/main/resources/templates/gateway_fragments/password_reset_email_reset_es.properties
@@ -1,4 +1,5 @@
 form.password.label=Contraseña
 form.confirmPassword.label=Confirmar Contraseña
 form.password.tips=La contraseña solo puede usar letras mayúsculas y minúsculas (A-Z, a-z), números (0-9) y los siguientes caracteres especiales: !@#$%^&*.
-form.submit=Cambiar Contraseña
\ No newline at end of file
+form.submit=Cambiar Contraseña
+error.rate_limit_exceeded=Su solicitud es demasiado frecuente, por favor intente nuevamente más tarde.
\ No newline at end of file
diff --git a/application/src/main/resources/templates/gateway_fragments/password_reset_email_reset_zh_TW.properties b/application/src/main/resources/templates/gateway_fragments/password_reset_email_reset_zh_TW.properties
index b39dcdd7b5..3667f441a6 100644
--- a/application/src/main/resources/templates/gateway_fragments/password_reset_email_reset_zh_TW.properties
+++ b/application/src/main/resources/templates/gateway_fragments/password_reset_email_reset_zh_TW.properties
@@ -1,4 +1,5 @@
 form.password.label=密碼
 form.confirmPassword.label=確認密碼
 form.password.tips=密碼只能使用大小寫字母 (A-Z, a-z)、數字 (0-9)，以及以下特殊字符: !@#$%^&*。
-form.submit=修改密碼
\ No newline at end of file
+form.submit=修改密碼
+error.rate_limit_exceeded=您的請求過於頻繁，請稍後再試。
diff --git a/application/src/main/resources/templates/gateway_fragments/password_reset_email_send.html b/application/src/main/resources/templates/gateway_fragments/password_reset_email_send.html
index ed9264ad2f..ef20ffc11c 100644
--- a/application/src/main/resources/templates/gateway_fragments/password_reset_email_send.html
+++ b/application/src/main/resources/templates/gateway_fragments/password_reset_email_send.html
@@ -7,18 +7,22 @@
             <button type="submit" th:text="#{form.sent.submit}"></button>
         </div>
     </form>
-    <form th:unless="${sent}" class="halo-form" th:action="@{/password-reset/email}" method="post">
+    <form th:unless="${sent}" class="halo-form" th:action="@{/password-reset/email}" method="post" th:object="${form}">
+        <div class="alert alert-error" th:if="${param.error.size() > 0}">
+            <strong th:if="${param.error[0] == 'invalid_reset_token'}" th:text="#{error.invalid_reset_token}"></strong>
+        </div>
         <div class="alert alert-error" th:if="${error}">
-            <strong th:text="${error}"></strong>
+            <strong th:if="${error == 'rate_limit_exceeded'}" th:text="#{error.rate_limit_exceeded}"></strong>
         </div>
         <div class="form-item">
             <label for="email" th:text="#{form.email.label}"></label>
             <div class="form-input">
-                <input type="email" id="email" name="email" autofocus required />
+                <input type="email" id="email" name="email" autofocus required th:field="*{email}"/>
             </div>
+            <p class="alert alert-error" role="alert" th:if="${#fields.hasErrors('email')}" th:errors="*{email}"></p>
         </div>
         <div class="form-item">
             <button type="submit" th:text="#{form.submit}"></button>
         </div>
     </form>
-</th:block>
\ No newline at end of file
+</th:block>
diff --git a/application/src/main/resources/templates/gateway_fragments/password_reset_email_send.properties b/application/src/main/resources/templates/gateway_fragments/password_reset_email_send.properties
index 5c4461f2a6..3541f91c6d 100644
--- a/application/src/main/resources/templates/gateway_fragments/password_reset_email_send.properties
+++ b/application/src/main/resources/templates/gateway_fragments/password_reset_email_send.properties
@@ -1,4 +1,6 @@
 form.email.label=电子邮箱
 form.submit=提交
 form.sent.submit=返回到登录页面
-form.message.success=检查您的电子邮件中是否有重置密码的链接。如果几分钟内没有出现，请检查您的垃圾邮件文件夹。
\ No newline at end of file
+form.message.success=检查您的电子邮件中是否有重置密码的链接。如果几分钟内没有出现，请检查您的垃圾邮件文件夹。
+error.rate_limit_exceeded=您的请求速度太快。请稍后再试。
+error.invalid_reset_token=重置密码令牌无效。请重试。
diff --git a/application/src/main/resources/templates/gateway_fragments/password_reset_email_send_en.properties b/application/src/main/resources/templates/gateway_fragments/password_reset_email_send_en.properties
index 62151a89b4..61f10e07fc 100644
--- a/application/src/main/resources/templates/gateway_fragments/password_reset_email_send_en.properties
+++ b/application/src/main/resources/templates/gateway_fragments/password_reset_email_send_en.properties
@@ -1,4 +1,6 @@
 form.email.label=Email
 form.submit=Submit
 form.sent.submit=Return to login
-form.message.success=Check your email for a link to reset your password. If it doesn’t appear within a few minutes, check your spam folder.
\ No newline at end of file
+form.message.success=Check your email for a link to reset your password. If it doesn’t appear within a few minutes, check your spam folder.
+error.rate_limit_exceeded=You are making requests too quickly. Please try again later.
+error.invalid_reset_token=The reset password token is invalid. Please try again.
diff --git a/application/src/main/resources/templates/gateway_fragments/password_reset_email_send_es.properties b/application/src/main/resources/templates/gateway_fragments/password_reset_email_send_es.properties
index 0944f68310..56606e3f39 100644
--- a/application/src/main/resources/templates/gateway_fragments/password_reset_email_send_es.properties
+++ b/application/src/main/resources/templates/gateway_fragments/password_reset_email_send_es.properties
@@ -1,4 +1,6 @@
 form.email.label=Correo Electrónico
 form.submit=Enviar
 form.sent.submit=Volver a la Página de Inicio de Sesión
-form.message.success=Revisa tu correo electrónico para ver el enlace de restablecimiento de contraseña. Si no aparece en unos minutos, revisa tu carpeta de spam.
\ No newline at end of file
+form.message.success=Revisa tu correo electrónico para ver el enlace de restablecimiento de contraseña. Si no aparece en unos minutos, revisa tu carpeta de spam.
+error.rate_limit_exceeded=Se ha superado el límite de intentos de restablecimiento de contraseña. Por favor, inténtalo de nuevo más tarde.
+error.invalid_reset_token=El enlace de restablecimiento de contraseña no es válido o ha expirado. Por favor, solicita un nuevo enlace.
diff --git a/application/src/main/resources/templates/gateway_fragments/password_reset_email_send_zh_TW.properties b/application/src/main/resources/templates/gateway_fragments/password_reset_email_send_zh_TW.properties
index f908f1299c..ccd1bcf335 100644
--- a/application/src/main/resources/templates/gateway_fragments/password_reset_email_send_zh_TW.properties
+++ b/application/src/main/resources/templates/gateway_fragments/password_reset_email_send_zh_TW.properties
@@ -1,4 +1,6 @@
 form.email.label=電子郵件
 form.submit=提交
 form.sent.submit=返回到登入頁面
-form.message.success=檢查您的電子郵件中是否有重置密碼的連結。如果幾分鐘內沒有出現，請檢查您的垃圾郵件資料夾。
\ No newline at end of file
+form.message.success=檢查您的電子郵件中是否有重置密碼的連結。如果幾分鐘內沒有出現，請檢查您的垃圾郵件資料夾。
+error.rate_limit_exceeded=您的請求過於頻繁。請稍後再試。
+error.invalid_reset_token=重置密碼連結無效。請重試。

From 0ad565f35c7caf9ca18e712b1bf612a6959e203e Mon Sep 17 00:00:00 2001
From: John Niang <johnniang@foxmail.com>
Date: Sat, 12 Oct 2024 12:11:09 +0800
Subject: [PATCH 129/185] Do not cache template result for pre-auth pages
 (#6829)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/kind bug
/area core
/milestone 2.20.x

#### What this PR does / why we need it:

This PR prevents caching from cache plugin for pre-auth pages and logout page.

#### Which issue(s) this PR fixes:

Fixes #6826

#### Special notes for your reviewer:

1. Install `Page Cache Plugin` from <https://www.halo.run/store/apps/app-BaamQ>.
2. Open a private browser window
3. Access login page twice
4. Try to login
5. See the result

#### Does this PR introduce a user-facing change?

```release-note
解决因缓存插件缓存登录页面导致无法登录的问题
```
---
 .../run/halo/app/theme/router/ModelConst.java |  6 +++
 .../run/halo/app/infra/utils/HaloUtils.java   | 14 +++++
 .../security/LogoutSecurityConfigurer.java    |  5 ++
 .../PreAuthEmailPasswordResetEndpoint.java    |  5 +-
 .../preauth/PreAuthLoginEndpoint.java         |  3 +-
 .../preauth/PreAuthSignUpEndpoint.java        |  5 +-
 .../preauth/PreAuthTwoFactorEndpoint.java     |  2 +
 .../security/preauth/SystemSetupEndpoint.java |  2 +
 .../run/halo/app/theme/HaloViewResolver.java  |  5 +-
 .../halo/app/infra/utils/HaloUtilsTest.java   | 25 +++++++++
 .../halo/app/theme/ThemeIntegrationTest.java  | 53 ++++++++++++++++++-
 11 files changed, 120 insertions(+), 5 deletions(-)
 create mode 100644 application/src/test/java/run/halo/app/infra/utils/HaloUtilsTest.java

diff --git a/api/src/main/java/run/halo/app/theme/router/ModelConst.java b/api/src/main/java/run/halo/app/theme/router/ModelConst.java
index 86af7e07ee..e6ac84bba4 100644
--- a/api/src/main/java/run/halo/app/theme/router/ModelConst.java
+++ b/api/src/main/java/run/halo/app/theme/router/ModelConst.java
@@ -10,5 +10,11 @@ public enum ModelConst {
     ;
     public static final String TEMPLATE_ID = "_templateId";
     public static final String POWERED_BY_HALO_TEMPLATE_ENGINE = "poweredByHaloTemplateEngine";
+
+    /**
+     * This key is used to prevent caching from cache plugins.
+     */
+    public static final String NO_CACHE = "HALO_TEMPLATE_ENGINE.NO_CACHE";
+
     public static final Integer DEFAULT_PAGE_SIZE = 10;
 }
diff --git a/application/src/main/java/run/halo/app/infra/utils/HaloUtils.java b/application/src/main/java/run/halo/app/infra/utils/HaloUtils.java
index 190536bebd..170b1cdbe7 100644
--- a/application/src/main/java/run/halo/app/infra/utils/HaloUtils.java
+++ b/application/src/main/java/run/halo/app/infra/utils/HaloUtils.java
@@ -5,6 +5,7 @@
 import java.nio.charset.StandardCharsets;
 import java.time.Instant;
 import java.time.ZoneId;
+import java.util.function.UnaryOperator;
 import lombok.experimental.UtilityClass;
 import lombok.extern.slf4j.Slf4j;
 import org.apache.commons.lang3.StringUtils;
@@ -13,6 +14,7 @@
 import org.springframework.util.Assert;
 import org.springframework.util.StreamUtils;
 import org.springframework.web.reactive.function.server.ServerRequest;
+import run.halo.app.theme.router.ModelConst;
 
 /**
  * Halo utilities.
@@ -81,4 +83,16 @@ public static String getYearText(Instant instant) {
         Assert.notNull(instant, "Instant must not be null");
         return String.valueOf(instant.atZone(ZoneId.systemDefault()).getYear());
     }
+
+    /**
+     * Mark the response as no cache.
+     *
+     * @return the server request operator
+     */
+    public static UnaryOperator<ServerRequest> noCache() {
+        return request -> {
+            request.exchange().getAttributes().put(ModelConst.NO_CACHE, true);
+            return request;
+        };
+    }
 }
diff --git a/application/src/main/java/run/halo/app/security/LogoutSecurityConfigurer.java b/application/src/main/java/run/halo/app/security/LogoutSecurityConfigurer.java
index b6bf4ec120..7406322b33 100644
--- a/application/src/main/java/run/halo/app/security/LogoutSecurityConfigurer.java
+++ b/application/src/main/java/run/halo/app/security/LogoutSecurityConfigurer.java
@@ -26,6 +26,7 @@
 import run.halo.app.core.user.service.UserService;
 import run.halo.app.security.authentication.SecurityConfigurer;
 import run.halo.app.security.authentication.rememberme.RememberMeServices;
+import run.halo.app.theme.router.ModelConst;
 
 @Component
 @RequiredArgsConstructor
@@ -72,6 +73,10 @@ RouterFunction<ServerResponse> logoutPage(UserService userService) {
                         "user", user
                     ));
                 })
+                .before(request -> {
+                    request.exchange().getAttributes().put(ModelConst.NO_CACHE, true);
+                    return request;
+                })
                 .build();
         }
 
diff --git a/application/src/main/java/run/halo/app/security/preauth/PreAuthEmailPasswordResetEndpoint.java b/application/src/main/java/run/halo/app/security/preauth/PreAuthEmailPasswordResetEndpoint.java
index 1054fc2367..55c40d5d10 100644
--- a/application/src/main/java/run/halo/app/security/preauth/PreAuthEmailPasswordResetEndpoint.java
+++ b/application/src/main/java/run/halo/app/security/preauth/PreAuthEmailPasswordResetEndpoint.java
@@ -31,6 +31,7 @@
 import run.halo.app.core.user.service.InvalidResetTokenException;
 import run.halo.app.infra.ValidationUtils;
 import run.halo.app.infra.actuator.GlobalInfoService;
+import run.halo.app.infra.utils.HaloUtils;
 import run.halo.app.infra.utils.IpAddressUtils;
 
 /**
@@ -168,7 +169,9 @@ RouterFunction<ServerResponse> preAuthPasswordResetEndpoints(
                                 return ServerResponse.status(HttpStatus.TOO_MANY_REQUESTS)
                                     .render(SEND_TEMPLATE, model);
                             });
-                    }))
+                    })
+            )
+            .before(HaloUtils.noCache())
             .build());
     }
 
diff --git a/application/src/main/java/run/halo/app/security/preauth/PreAuthLoginEndpoint.java b/application/src/main/java/run/halo/app/security/preauth/PreAuthLoginEndpoint.java
index b6c18b81a8..f506ca0d8a 100644
--- a/application/src/main/java/run/halo/app/security/preauth/PreAuthLoginEndpoint.java
+++ b/application/src/main/java/run/halo/app/security/preauth/PreAuthLoginEndpoint.java
@@ -17,6 +17,7 @@
 import reactor.core.publisher.Mono;
 import run.halo.app.core.extension.AuthProvider;
 import run.halo.app.infra.actuator.GlobalInfoService;
+import run.halo.app.infra.utils.HaloUtils;
 import run.halo.app.plugin.PluginConst;
 import run.halo.app.security.AuthProviderService;
 import run.halo.app.security.HaloServerRequestCache;
@@ -50,7 +51,6 @@ class PreAuthLoginEndpoint {
     RouterFunction<ServerResponse> preAuthLoginEndpoints() {
         return RouterFunctions.nest(path("/login"), RouterFunctions.route()
             .GET("", request -> {
-                // TODO get redirect URI and cache it
                 var exchange = request.exchange();
                 var contextPath = exchange.getRequest().getPath().contextPath().value();
                 var publicKey = cryptoService.readPublicKey()
@@ -96,6 +96,7 @@ RouterFunction<ServerResponse> preAuthLoginEndpoints() {
                     ))
                 ));
             })
+            .before(HaloUtils.noCache())
             .build());
     }
 }
diff --git a/application/src/main/java/run/halo/app/security/preauth/PreAuthSignUpEndpoint.java b/application/src/main/java/run/halo/app/security/preauth/PreAuthSignUpEndpoint.java
index a430723974..b653250b29 100644
--- a/application/src/main/java/run/halo/app/security/preauth/PreAuthSignUpEndpoint.java
+++ b/application/src/main/java/run/halo/app/security/preauth/PreAuthSignUpEndpoint.java
@@ -32,6 +32,7 @@
 import run.halo.app.infra.exception.EmailVerificationFailed;
 import run.halo.app.infra.exception.RateLimitExceededException;
 import run.halo.app.infra.exception.RequestBodyValidationException;
+import run.halo.app.infra.utils.HaloUtils;
 import run.halo.app.infra.utils.IpAddressUtils;
 
 /**
@@ -131,7 +132,9 @@ RouterFunction<ServerResponse> preAuthSignUpEndpoints() {
                             )
                             .onErrorMap(RequestNotPermitted.class, RateLimitExceededException::new);
                     })
-                    .then(ServerResponse.accepted().build()))
+                    .then(ServerResponse.accepted().build())
+            )
+            .before(HaloUtils.noCache())
             .build());
     }
 
diff --git a/application/src/main/java/run/halo/app/security/preauth/PreAuthTwoFactorEndpoint.java b/application/src/main/java/run/halo/app/security/preauth/PreAuthTwoFactorEndpoint.java
index 08ac8052b9..6f5c75e04a 100644
--- a/application/src/main/java/run/halo/app/security/preauth/PreAuthTwoFactorEndpoint.java
+++ b/application/src/main/java/run/halo/app/security/preauth/PreAuthTwoFactorEndpoint.java
@@ -7,6 +7,7 @@
 import org.springframework.web.reactive.function.server.RouterFunctions;
 import org.springframework.web.reactive.function.server.ServerResponse;
 import run.halo.app.infra.actuator.GlobalInfoService;
+import run.halo.app.infra.utils.HaloUtils;
 
 /**
  * Pre-auth two-factor endpoints.
@@ -25,6 +26,7 @@ RouterFunction<ServerResponse> preAuthTwoFactorEndpoints(GlobalInfoService globa
                     "globalInfo", globalInfoService.getGlobalInfo()
                 ))
             )
+            .before(HaloUtils.noCache())
             .build();
     }
 
diff --git a/application/src/main/java/run/halo/app/security/preauth/SystemSetupEndpoint.java b/application/src/main/java/run/halo/app/security/preauth/SystemSetupEndpoint.java
index a3bd6572bc..5fa81998e2 100644
--- a/application/src/main/java/run/halo/app/security/preauth/SystemSetupEndpoint.java
+++ b/application/src/main/java/run/halo/app/security/preauth/SystemSetupEndpoint.java
@@ -108,6 +108,8 @@ RouterFunction<ServerResponse> setupPageRouter() {
                         .implementation(Void.class)
                     )
             )
+            .before(HaloUtils.noCache(), builder -> {
+            })
             .build();
     }
 
diff --git a/application/src/main/java/run/halo/app/theme/HaloViewResolver.java b/application/src/main/java/run/halo/app/theme/HaloViewResolver.java
index 3446240d03..1719cc920d 100644
--- a/application/src/main/java/run/halo/app/theme/HaloViewResolver.java
+++ b/application/src/main/java/run/halo/app/theme/HaloViewResolver.java
@@ -97,7 +97,10 @@ public Mono<Void> render(Map<String, ?> model, MediaType contentType,
             return themeResolver.getTheme(exchange).flatMap(theme -> {
                 // calculate the engine before rendering
                 setTemplateEngine(engineManager.getTemplateEngine(theme));
-                exchange.getAttributes().put(ModelConst.POWERED_BY_HALO_TEMPLATE_ENGINE, true);
+                var noCache = (Boolean) exchange.getAttributes()
+                    .getOrDefault(ModelConst.NO_CACHE, false);
+                exchange.getAttributes()
+                    .put(ModelConst.POWERED_BY_HALO_TEMPLATE_ENGINE, !noCache);
                 return super.render(model, contentType, exchange)
                     .onErrorMap(TemplateProcessingException.class::isInstance, tee -> {
                         if (tee instanceof TemplateInputException) {
diff --git a/application/src/test/java/run/halo/app/infra/utils/HaloUtilsTest.java b/application/src/test/java/run/halo/app/infra/utils/HaloUtilsTest.java
new file mode 100644
index 0000000000..59a13c37a6
--- /dev/null
+++ b/application/src/test/java/run/halo/app/infra/utils/HaloUtilsTest.java
@@ -0,0 +1,25 @@
+package run.halo.app.infra.utils;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+import org.junit.jupiter.api.Test;
+import org.springframework.mock.http.server.reactive.MockServerHttpRequest;
+import org.springframework.mock.web.reactive.function.server.MockServerRequest;
+import org.springframework.mock.web.server.MockServerWebExchange;
+import run.halo.app.theme.router.ModelConst;
+
+class HaloUtilsTest {
+
+    @Test
+    void checkNoCache() {
+        var exchange = MockServerWebExchange.from(MockServerHttpRequest.get("/").build());
+        var request = MockServerRequest.builder()
+            .exchange(exchange)
+            .build();
+        var applied = HaloUtils.noCache().apply(request);
+        assertEquals(applied, request);
+        assertTrue(() -> exchange.getRequiredAttribute(ModelConst.NO_CACHE));
+    }
+
+}
\ No newline at end of file
diff --git a/application/src/test/java/run/halo/app/theme/ThemeIntegrationTest.java b/application/src/test/java/run/halo/app/theme/ThemeIntegrationTest.java
index 32f90d23c6..95a246fcbe 100644
--- a/application/src/test/java/run/halo/app/theme/ThemeIntegrationTest.java
+++ b/application/src/test/java/run/halo/app/theme/ThemeIntegrationTest.java
@@ -1,6 +1,10 @@
 package run.halo.app.theme;
 
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.mockito.Mockito.when;
+import static org.springframework.security.web.server.util.matcher.ServerWebExchangeMatchers.pathMatchers;
 
 import java.util.LinkedHashSet;
 import java.util.List;
@@ -13,7 +17,9 @@
 import org.springframework.boot.test.context.TestConfiguration;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Import;
+import org.springframework.http.HttpMethod;
 import org.springframework.http.MediaType;
+import org.springframework.security.web.server.util.matcher.ServerWebExchangeMatcher.MatchResult;
 import org.springframework.test.annotation.DirtiesContext;
 import org.springframework.test.context.bean.override.mockito.MockitoBean;
 import org.springframework.test.web.reactive.server.WebTestClient;
@@ -26,6 +32,9 @@
 import run.halo.app.extension.ExtensionClient;
 import run.halo.app.extension.Metadata;
 import run.halo.app.infra.InitializationStateGetter;
+import run.halo.app.infra.utils.HaloUtils;
+import run.halo.app.security.AfterSecurityWebFilter;
+import run.halo.app.theme.router.ModelConst;
 
 @SpringBootTest
 @Import(ThemeIntegrationTest.TestConfig.class)
@@ -78,11 +87,53 @@ RouterFunction<ServerResponse> noTemplateExistsRoute() {
                 .build();
         }
 
+        @Bean
+        RouterFunction<ServerResponse> noCacheRoute() {
+            return RouterFunctions.route()
+                .GET(
+                    "/should-not-cache",
+                    request -> ServerResponse.ok().render("no-template-exists")
+                )
+                .before(HaloUtils.noCache())
+                .build();
+        }
+
+        @Bean
+        AfterSecurityWebFilter poweredByHaloTemplateEngineCheckFilter() {
+            var matcher = pathMatchers(HttpMethod.GET, "/should-not-cache");
+            return (exchange, chain) -> chain.filter(exchange)
+                .flatMap(v -> matcher.matches(exchange)
+                    .filter(MatchResult::isMatch)
+                    .switchIfEmpty(Mono.fromRunnable(() -> {
+                        assertNull(exchange.getAttribute(ModelConst.NO_CACHE));
+                        assertTrue(exchange.getRequiredAttribute(
+                            ModelConst.POWERED_BY_HALO_TEMPLATE_ENGINE)
+                        );
+                    }).then(Mono.empty()))
+                    .doOnNext(m -> {
+                        assertTrue(exchange.getRequiredAttribute(ModelConst.NO_CACHE));
+                        assertFalse(exchange.getRequiredAttribute(
+                            ModelConst.POWERED_BY_HALO_TEMPLATE_ENGINE)
+                        );
+                    })
+                )
+                .then();
+        }
+
     }
 
     @Test
     void shouldRespondNotFoundIfNoTemplateFound() {
-        webClient.get().uri("/no-template-exists")
+        webClient.get()
+            .uri("/no-template-exists")
+            .accept(MediaType.TEXT_HTML)
+            .exchange()
+            .expectStatus().isNotFound()
+            .expectBody(String.class)
+            .value(Matchers.containsString("Template no-template-exists was not found"));
+
+        webClient.get()
+            .uri("/should-not-cache")
             .accept(MediaType.TEXT_HTML)
             .exchange()
             .expectStatus().isNotFound()

From cecbfcfa4abae73aa635453d92b2c41c077950bb Mon Sep 17 00:00:00 2001
From: John Niang <johnniang@foxmail.com>
Date: Sat, 12 Oct 2024 12:15:09 +0800
Subject: [PATCH 130/185] Disable CSRF protection for actuator endpoints
 (#6830)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/kind bug
/area core
/milestone 2.20.x

#### What this PR does / why we need it:

This PR disables CSRF protection for actuator endpoints because they are not state-changing operations.

#### Which issue(s) this PR fixes:

Fixes #6827

#### Special notes for your reviewer:

Try to restore Halo.

#### Does this PR introduce a user-facing change?

```release-note
修复恢复备份后无法自动重启的问题
```
---
 .../main/java/run/halo/app/security/CsrfConfigurer.java   | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/application/src/main/java/run/halo/app/security/CsrfConfigurer.java b/application/src/main/java/run/halo/app/security/CsrfConfigurer.java
index 229050cfb6..75d37cb20e 100644
--- a/application/src/main/java/run/halo/app/security/CsrfConfigurer.java
+++ b/application/src/main/java/run/halo/app/security/CsrfConfigurer.java
@@ -18,8 +18,12 @@ class CsrfConfigurer implements SecurityConfigurer {
     public void configure(ServerHttpSecurity http) {
         var csrfMatcher = new AndServerWebExchangeMatcher(
             CsrfWebFilter.DEFAULT_CSRF_MATCHER,
-            new NegatedServerWebExchangeMatcher(
-                pathMatchers("/api/**", "/apis/**", "/system/setup"))
+            new NegatedServerWebExchangeMatcher(pathMatchers(
+                "/api/**",
+                "/apis/**",
+                "/actuator/**",
+                "/system/setup"
+            ))
         );
         http.csrf(csrfSpec -> csrfSpec
             .csrfTokenRepository(new CookieServerCsrfTokenRepository())

From 9468e8741f3ed2d4c225adc8cef6c6145a8b48a9 Mon Sep 17 00:00:00 2001
From: John Niang <johnniang@foxmail.com>
Date: Sat, 12 Oct 2024 12:21:09 +0800
Subject: [PATCH 131/185] Add globalInfo into logout page (#6831)

#### What type of PR is this?

/kind improvement
/area core
/milestone 2.20.x

#### What this PR does / why we need it:

This PR adds globalInfo data into logout template model.

#### Which issue(s) this PR fixes:

Fixes https://github.com/halo-dev/halo/issues/6821

#### Does this PR introduce a user-facing change?

```release-note
None
```
---
 .../run/halo/app/security/LogoutSecurityConfigurer.java    | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/application/src/main/java/run/halo/app/security/LogoutSecurityConfigurer.java b/application/src/main/java/run/halo/app/security/LogoutSecurityConfigurer.java
index 7406322b33..f7b1160873 100644
--- a/application/src/main/java/run/halo/app/security/LogoutSecurityConfigurer.java
+++ b/application/src/main/java/run/halo/app/security/LogoutSecurityConfigurer.java
@@ -24,6 +24,7 @@
 import org.springframework.web.reactive.function.server.ServerResponse;
 import reactor.core.publisher.Mono;
 import run.halo.app.core.user.service.UserService;
+import run.halo.app.infra.actuator.GlobalInfoService;
 import run.halo.app.security.authentication.SecurityConfigurer;
 import run.halo.app.security.authentication.rememberme.RememberMeServices;
 import run.halo.app.theme.router.ModelConst;
@@ -59,7 +60,10 @@ public LogoutSuccessHandler(ServerLogoutHandler... logoutHandler) {
         }
 
         @Bean
-        RouterFunction<ServerResponse> logoutPage(UserService userService) {
+        RouterFunction<ServerResponse> logoutPage(
+            UserService userService,
+            GlobalInfoService globalInfoService
+        ) {
             return RouterFunctions.route()
                 .GET("/logout", request -> {
                     var user = ReactiveSecurityContextHolder.getContext()
@@ -69,6 +73,7 @@ RouterFunction<ServerResponse> logoutPage(UserService userService) {
                     var exchange = request.exchange();
                     var contextPath = exchange.getRequest().getPath().contextPath().value();
                     return ServerResponse.ok().render("logout", Map.of(
+                        "globalInfo", globalInfoService.getGlobalInfo(),
                         "action", contextPath + "/logout",
                         "user", user
                     ));

From f40770ad640bf222725bbebfc448ad88276a6f1c Mon Sep 17 00:00:00 2001
From: Ryan Wang <i@ryanc.cc>
Date: Sat, 12 Oct 2024 15:05:09 +0800
Subject: [PATCH 132/185] chore: add prettier-plugin-organize-imports plugin to
 organize imports (#6836)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/area ui
/kind improvement
/milestone 2.20.x

#### What this PR does / why we need it:

使用 https://github.com/simonhaenisch/prettier-plugin-organize-imports 优化 UI 项目的模块导入，之前我们是通过[配置 VSCode](https://github.com/halo-dev/halo/blob/9468e8741f3ed2d4c225adc8cef6c6145a8b48a9/ui/.vscode/settings.json#L34-L36) 来实现导入优化，但这种方式局限于 VSCode 编辑器，在其他编辑器无法得到统一的支持。

并且我们为 UI 添加了 git pre commit hook，在提交代码前会对已修改的文件执行 prettier，这样能够更好的保证一致性。

<img width="1475" alt="image" src="https://github.com/user-attachments/assets/755e2aba-be07-4fba-8007-6210ef44a8ef">

#### Does this PR introduce a user-facing change?

```release-note
None
```
---
 ui/.vscode/settings.json                      |  4 ----
 .../contents/attachments/AttachmentList.vue   |  6 +++---
 .../comments/components/CommentListItem.vue   |  6 +++---
 .../comments/components/ReplyListItem.vue     |  6 +++---
 .../posts/tags/components/TagEditingModal.vue |  2 +-
 .../components/entity-fields/ReloadField.vue  |  2 +-
 .../users/components/UserCreationModal.vue    |  2 +-
 ui/package.json                               |  1 +
 ui/pnpm-lock.yaml                             | 20 +++++++++++++++++++
 ui/prettier.config.cjs                        |  5 ++++-
 ui/src/components/editor/DefaultEditor.vue    |  2 +-
 .../formkit/inputs/select/MultipleSelect.vue  |  8 ++++----
 .../inputs/select/SelectDropdownContainer.vue |  6 +++---
 ui/uc-src/modules/profile/tabs/Devices.vue    |  2 +-
 14 files changed, 46 insertions(+), 26 deletions(-)

diff --git a/ui/.vscode/settings.json b/ui/.vscode/settings.json
index 347d413bd8..f728502ec1 100644
--- a/ui/.vscode/settings.json
+++ b/ui/.vscode/settings.json
@@ -30,9 +30,5 @@
   },
   "[yaml]": {
     "editor.defaultFormatter": "esbenp.prettier-vscode"
-  },
-  "editor.codeActionsOnSave": {
-    "source.organizeImports": "explicit",
-    "source.fixAll": "never"
   }
 }
diff --git a/ui/console-src/modules/contents/attachments/AttachmentList.vue b/ui/console-src/modules/contents/attachments/AttachmentList.vue
index bb601a7f55..fd35e78ba9 100644
--- a/ui/console-src/modules/contents/attachments/AttachmentList.vue
+++ b/ui/console-src/modules/contents/attachments/AttachmentList.vue
@@ -1,6 +1,7 @@
 <script lang="ts" setup>
 import UserFilterDropdown from "@/components/filter/UserFilterDropdown.vue";
 import LazyImage from "@/components/image/LazyImage.vue";
+import LazyVideo from "@/components/video/LazyVideo.vue";
 import { isImage } from "@/utils/image";
 import type { Attachment, Group } from "@halo-dev/api-client";
 import { coreApiClient } from "@halo-dev/api-client";
@@ -31,16 +32,15 @@ import type { Ref } from "vue";
 import { computed, onMounted, provide, ref, watch } from "vue";
 import { useI18n } from "vue-i18n";
 import AttachmentDetailModal from "./components/AttachmentDetailModal.vue";
+import AttachmentError from "./components/AttachmentError.vue";
 import AttachmentGroupList from "./components/AttachmentGroupList.vue";
 import AttachmentListItem from "./components/AttachmentListItem.vue";
+import AttachmentLoading from "./components/AttachmentLoading.vue";
 import AttachmentPoliciesModal from "./components/AttachmentPoliciesModal.vue";
 import AttachmentUploadModal from "./components/AttachmentUploadModal.vue";
-import AttachmentLoading from "./components/AttachmentLoading.vue";
-import AttachmentError from "./components/AttachmentError.vue";
 import { useAttachmentControl } from "./composables/use-attachment";
 import { useFetchAttachmentGroup } from "./composables/use-attachment-group";
 import { useFetchAttachmentPolicy } from "./composables/use-attachment-policy";
-import LazyVideo from "@/components/video/LazyVideo.vue";
 
 const { t } = useI18n();
 
diff --git a/ui/console-src/modules/contents/comments/components/CommentListItem.vue b/ui/console-src/modules/contents/comments/components/CommentListItem.vue
index 6927cacb1c..48d00ebbc8 100644
--- a/ui/console-src/modules/contents/comments/components/CommentListItem.vue
+++ b/ui/console-src/modules/contents/comments/components/CommentListItem.vue
@@ -1,7 +1,9 @@
 <script lang="ts" setup>
+import EntityDropdownItems from "@/components/entity/EntityDropdownItems.vue";
 import { usePluginModuleStore } from "@/stores/plugin";
 import { formatDatetime } from "@/utils/date";
 import { usePermission } from "@/utils/permission";
+import { useOperationItemExtensionPoint } from "@console/composables/use-operation-extension-points";
 import type {
   Extension,
   ListedComment,
@@ -34,18 +36,16 @@ import type {
 import { useMutation, useQuery, useQueryClient } from "@tanstack/vue-query";
 import {
   computed,
+  markRaw,
   onMounted,
   provide,
   ref,
   type Ref,
   toRefs,
-  markRaw,
 } from "vue";
 import { useI18n } from "vue-i18n";
 import ReplyCreationModal from "./ReplyCreationModal.vue";
 import ReplyListItem from "./ReplyListItem.vue";
-import { useOperationItemExtensionPoint } from "@console/composables/use-operation-extension-points";
-import EntityDropdownItems from "@/components/entity/EntityDropdownItems.vue";
 
 const { currentUserHasPermission } = usePermission();
 const { t } = useI18n();
diff --git a/ui/console-src/modules/contents/comments/components/ReplyListItem.vue b/ui/console-src/modules/contents/comments/components/ReplyListItem.vue
index 9ea0a7eca3..6e496c7068 100644
--- a/ui/console-src/modules/contents/comments/components/ReplyListItem.vue
+++ b/ui/console-src/modules/contents/comments/components/ReplyListItem.vue
@@ -1,5 +1,7 @@
 <script lang="ts" setup>
+import EntityDropdownItems from "@/components/entity/EntityDropdownItems.vue";
 import { formatDatetime } from "@/utils/date";
+import { useOperationItemExtensionPoint } from "@console/composables/use-operation-extension-points";
 import type { ListedComment, ListedReply } from "@halo-dev/api-client";
 import { coreApiClient } from "@halo-dev/api-client";
 import {
@@ -15,11 +17,9 @@ import {
 } from "@halo-dev/components";
 import type { OperationItem } from "@halo-dev/console-shared";
 import { useQueryClient } from "@tanstack/vue-query";
-import { computed, inject, ref, type Ref, toRefs, markRaw } from "vue";
+import { computed, inject, markRaw, ref, type Ref, toRefs } from "vue";
 import { useI18n } from "vue-i18n";
 import ReplyCreationModal from "./ReplyCreationModal.vue";
-import { useOperationItemExtensionPoint } from "@console/composables/use-operation-extension-points";
-import EntityDropdownItems from "@/components/entity/EntityDropdownItems.vue";
 
 const { t } = useI18n();
 const queryClient = useQueryClient();
diff --git a/ui/console-src/modules/contents/posts/tags/components/TagEditingModal.vue b/ui/console-src/modules/contents/posts/tags/components/TagEditingModal.vue
index a7b6378a31..398a8cb825 100644
--- a/ui/console-src/modules/contents/posts/tags/components/TagEditingModal.vue
+++ b/ui/console-src/modules/contents/posts/tags/components/TagEditingModal.vue
@@ -23,10 +23,10 @@ import AnnotationsForm from "@/components/form/AnnotationsForm.vue";
 import { setFocus } from "@/formkit/utils/focus";
 import { FormType } from "@/types/slug";
 import useSlugify from "@console/composables/use-slugify";
+import { reset, submitForm } from "@formkit/core";
 import { cloneDeep } from "lodash-es";
 import { onMounted } from "vue";
 import { useI18n } from "vue-i18n";
-import { submitForm, reset } from "@formkit/core";
 
 const props = withDefaults(
   defineProps<{
diff --git a/ui/console-src/modules/system/plugins/components/entity-fields/ReloadField.vue b/ui/console-src/modules/system/plugins/components/entity-fields/ReloadField.vue
index 920287d66a..f6ea8c0314 100644
--- a/ui/console-src/modules/system/plugins/components/entity-fields/ReloadField.vue
+++ b/ui/console-src/modules/system/plugins/components/entity-fields/ReloadField.vue
@@ -1,6 +1,6 @@
 <script setup lang="ts">
-import { IconInformation, VButton } from "@halo-dev/components";
 import { PluginStatusPhaseEnum, type Plugin } from "@halo-dev/api-client";
+import { IconInformation, VButton } from "@halo-dev/components";
 import { computed } from "vue";
 
 const props = withDefaults(
diff --git a/ui/console-src/modules/system/users/components/UserCreationModal.vue b/ui/console-src/modules/system/users/components/UserCreationModal.vue
index 37a7e4f050..5c79a3363d 100644
--- a/ui/console-src/modules/system/users/components/UserCreationModal.vue
+++ b/ui/console-src/modules/system/users/components/UserCreationModal.vue
@@ -9,10 +9,10 @@ import SubmitButton from "@/components/button/SubmitButton.vue";
 import { Toast, VButton, VModal, VSpace } from "@halo-dev/components";
 
 // hooks
+import { PASSWORD_REGEX } from "@/constants/regex";
 import { setFocus } from "@/formkit/utils/focus";
 import { useQueryClient } from "@tanstack/vue-query";
 import { useI18n } from "vue-i18n";
-import { PASSWORD_REGEX } from "@/constants/regex";
 
 const { t } = useI18n();
 const queryClient = useQueryClient();
diff --git a/ui/package.json b/ui/package.json
index 1b4c7b731f..5472762ca0 100644
--- a/ui/package.json
+++ b/ui/package.json
@@ -143,6 +143,7 @@
     "postcss": "^8.4.21",
     "postcss-viewport-height-correction": "^1.1.1",
     "prettier": "^2.8.8",
+    "prettier-plugin-organize-imports": "^4.1.0",
     "prettier-plugin-tailwindcss": "^0.1.13",
     "randomstring": "^1.2.3",
     "rollup-plugin-gzip": "^3.1.0",
diff --git a/ui/pnpm-lock.yaml b/ui/pnpm-lock.yaml
index 9c92632e31..6411cbe3d6 100644
--- a/ui/pnpm-lock.yaml
+++ b/ui/pnpm-lock.yaml
@@ -312,6 +312,9 @@ importers:
       prettier:
         specifier: ^2.8.8
         version: 2.8.8
+      prettier-plugin-organize-imports:
+        specifier: ^4.1.0
+        version: 4.1.0(prettier@2.8.8)(typescript@5.6.2)(vue-tsc@2.1.6(typescript@5.6.2))
       prettier-plugin-tailwindcss:
         specifier: ^0.1.13
         version: 0.1.13(prettier@2.8.8)
@@ -8398,6 +8401,16 @@ packages:
     resolution: {integrity: sha512-GbK2cP9nraSSUF9N2XwUwqfzlAFlMNYYl+ShE/V+H8a9uNl/oUqB1w2EL54Jh0OlyRSd8RfWYJ3coVS4TROP2w==}
     engines: {node: '>=6.0.0'}
 
+  prettier-plugin-organize-imports@4.1.0:
+    resolution: {integrity: sha512-5aWRdCgv645xaa58X8lOxzZoiHAldAPChljr/MT0crXVOWTZ+Svl4hIWlz+niYSlO6ikE5UXkN1JrRvIP2ut0A==}
+    peerDependencies:
+      prettier: '>=2.0'
+      typescript: '>=2.9'
+      vue-tsc: ^2.1.0
+    peerDependenciesMeta:
+      vue-tsc:
+        optional: true
+
   prettier-plugin-tailwindcss@0.1.13:
     resolution: {integrity: sha512-/EKQURUrxLu66CMUg4+1LwGdxnz8of7IDvrSLqEtDqhLH61SAlNNUSr90UTvZaemujgl3OH/VHg+fyGltrNixw==}
     engines: {node: '>=12.17.0'}
@@ -19899,6 +19912,13 @@ snapshots:
     dependencies:
       fast-diff: 1.2.0
 
+  prettier-plugin-organize-imports@4.1.0(prettier@2.8.8)(typescript@5.6.2)(vue-tsc@2.1.6(typescript@5.6.2)):
+    dependencies:
+      prettier: 2.8.8
+      typescript: 5.6.2
+    optionalDependencies:
+      vue-tsc: 2.1.6(typescript@5.6.2)
+
   prettier-plugin-tailwindcss@0.1.13(prettier@2.8.8):
     dependencies:
       prettier: 2.8.8
diff --git a/ui/prettier.config.cjs b/ui/prettier.config.cjs
index f01cc7a68a..6a241df3eb 100644
--- a/ui/prettier.config.cjs
+++ b/ui/prettier.config.cjs
@@ -1,3 +1,6 @@
 module.exports = {
-  plugins: [require("prettier-plugin-tailwindcss")],
+  plugins: [
+    require("prettier-plugin-tailwindcss"),
+    require("prettier-plugin-organize-imports"),
+  ],
 };
diff --git a/ui/src/components/editor/DefaultEditor.vue b/ui/src/components/editor/DefaultEditor.vue
index 133893a9d8..9ee0c6d8d0 100644
--- a/ui/src/components/editor/DefaultEditor.vue
+++ b/ui/src/components/editor/DefaultEditor.vue
@@ -90,6 +90,7 @@ import MdiFormatHeader5 from "~icons/mdi/format-header-5";
 import MdiFormatHeader6 from "~icons/mdi/format-header-6";
 import RiLayoutRightLine from "~icons/ri/layout-right-line";
 import { useAttachmentSelect } from "./composables/use-attachment";
+import { useExtension } from "./composables/use-extension";
 import {
   UiExtensionAudio,
   UiExtensionImage,
@@ -97,7 +98,6 @@ import {
   UiExtensionVideo,
 } from "./extensions";
 import { getContents } from "./utils/attachment";
-import { useExtension } from "./composables/use-extension";
 
 const { t } = useI18n();
 const { currentUserHasPermission } = usePermission();
diff --git a/ui/src/formkit/inputs/select/MultipleSelect.vue b/ui/src/formkit/inputs/select/MultipleSelect.vue
index 9fa8ec28c1..12ccd96967 100644
--- a/ui/src/formkit/inputs/select/MultipleSelect.vue
+++ b/ui/src/formkit/inputs/select/MultipleSelect.vue
@@ -1,12 +1,12 @@
 <script lang="ts" setup>
-import MultipleSelectItem from "./MultipleSelectItem.vue";
-import MultipleOverflowItem from "./MultipleOverflowItem.vue";
-import { useDragAndDrop } from "@formkit/drag-and-drop/vue";
-import { watch } from "vue";
 import type {
   NodeDragEventData,
   NodeTouchEventData,
 } from "@formkit/drag-and-drop";
+import { useDragAndDrop } from "@formkit/drag-and-drop/vue";
+import { watch } from "vue";
+import MultipleOverflowItem from "./MultipleOverflowItem.vue";
+import MultipleSelectItem from "./MultipleSelectItem.vue";
 
 const props = defineProps<{
   selectedOptions: Array<{
diff --git a/ui/src/formkit/inputs/select/SelectDropdownContainer.vue b/ui/src/formkit/inputs/select/SelectDropdownContainer.vue
index 2ef8a6b3bd..b8747936e2 100644
--- a/ui/src/formkit/inputs/select/SelectDropdownContainer.vue
+++ b/ui/src/formkit/inputs/select/SelectDropdownContainer.vue
@@ -1,9 +1,9 @@
 <script lang="ts" setup>
-import { computed, watch } from "vue";
-import SelectOption from "./SelectOption.vue";
+import { i18n } from "@/locales";
 import { VEmpty, VLoading } from "@halo-dev/components";
 import { useTimeout } from "@vueuse/shared";
-import { i18n } from "@/locales";
+import { computed, watch } from "vue";
+import SelectOption from "./SelectOption.vue";
 
 const props = defineProps<{
   options?: Array<Record<string, unknown> & { label: string; value: string }>;
diff --git a/ui/uc-src/modules/profile/tabs/Devices.vue b/ui/uc-src/modules/profile/tabs/Devices.vue
index 78a557540b..8251aecfc8 100644
--- a/ui/uc-src/modules/profile/tabs/Devices.vue
+++ b/ui/uc-src/modules/profile/tabs/Devices.vue
@@ -1,8 +1,8 @@
 <script lang="ts" setup>
+import { ucApiClient } from "@halo-dev/api-client";
 import { VLoading } from "@halo-dev/components";
 import { useQuery } from "@tanstack/vue-query";
 import DeviceListItem from "./components/DeviceListItem.vue";
-import { ucApiClient } from "@halo-dev/api-client";
 
 const { data, isLoading } = useQuery({
   queryKey: ["uc:devices"],

From 91a69de8492ecadd3328965e13a8ff2076d73c39 Mon Sep 17 00:00:00 2001
From: Ryan Wang <i@ryanc.cc>
Date: Sat, 12 Oct 2024 15:19:09 +0800
Subject: [PATCH 133/185] refactor: improve accessibility for login page
 (#6839)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/area core
/kind improvement
/milestone 2.20.x

#### What this PR does / why we need it:

提升登录页面的可访问性。

#### Does this PR introduce a user-facing change?

```release-note
None
```
---
 .../resources/templates/gateway_fragments/common.html  | 10 +++++-----
 .../resources/templates/gateway_fragments/login.html   |  4 ++--
 .../src/main/resources/templates/login_local.html      |  4 ++--
 3 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/application/src/main/resources/templates/gateway_fragments/common.html b/application/src/main/resources/templates/gateway_fragments/common.html
index 50e23ebdd0..127692d41c 100644
--- a/application/src/main/resources/templates/gateway_fragments/common.html
+++ b/application/src/main/resources/templates/gateway_fragments/common.html
@@ -8,7 +8,7 @@
         const i18nResources = {
             sendVerificationCodeSuccess: `[(#{js.sendVerificationCode.success})]`,
             sendVerificationCodeFailed: `[(#{js.sendVerificationCode.failed})]`,
-            passwordConfirmationFailed: `[(#{js.passwordConfirmation.failed})]`
+            passwordConfirmationFailed: `[(#{js.passwordConfirmation.failed})]`,
         };
     </script>
 
@@ -57,7 +57,7 @@
         }
     </style>
     <div class="language-switcher">
-        <label>
+        <label for="language-select">
             <svg viewBox="0 0 24 24" width="1.2em" height="1.2em">
                 <path
                     fill="currentColor"
@@ -99,7 +99,7 @@
         }
     </style>
     <div class="halo-logo">
-        <img src="/images/wordmark.svg" />
+        <img src="/images/wordmark.svg" alt="Halo" />
     </div>
 </div>
 
@@ -113,7 +113,7 @@
         <ul class="pill-items">
             <li th:each="provider : ${socialAuthProviders}">
                 <a th:href="${provider.spec.authenticationUrl}">
-                    <img th:src="${provider.spec.logo}" />
+                    <img th:src="${provider.spec.logo}" th:alt="|${provider.spec.displayName}'s icon|" />
                     <span th:text="${provider.spec.displayName}"></span>
                 </a>
             </li>
@@ -131,7 +131,7 @@
         <ul class="pill-items">
             <li th:each="method : ${otherMethods}">
                 <a th:href="${method.href}">
-                    <img th:src="${method.icon}" />
+                    <img th:src="${method.icon}" th:alt="|${method.name}'s icon|" />
                     <span
                         th:text="${#messages.msgOrNull('passwordResetMethods.' + method.name + '.displayName') ?: method.name}"
                     ></span>
diff --git a/application/src/main/resources/templates/gateway_fragments/login.html b/application/src/main/resources/templates/gateway_fragments/login.html
index bb164b117d..78005cfa43 100644
--- a/application/src/main/resources/templates/gateway_fragments/login.html
+++ b/application/src/main/resources/templates/gateway_fragments/login.html
@@ -49,7 +49,7 @@
         <ul class="pill-items">
             <li th:each="provider : ${formAuthProviders}">
                 <a th:href="'/login?method=' + ${provider.metadata.name}">
-                    <img th:src="${provider.spec.logo}" />
+                    <img th:src="${provider.spec.logo}" th:alt="|${provider.spec.displayName}'s icon|" />
                     <span
                         th:text="${#messages.msgOrNull('formAuthProviders.' + provider.metadata.name + '.displayName') ?: provider.spec.displayName}"
                     ></span>
@@ -57,4 +57,4 @@
             </li>
         </ul>
     </th:block>
-</div>
+</div>
\ No newline at end of file
diff --git a/application/src/main/resources/templates/login_local.html b/application/src/main/resources/templates/login_local.html
index 6e3eeefefe..cc693a311a 100644
--- a/application/src/main/resources/templates/login_local.html
+++ b/application/src/main/resources/templates/login_local.html
@@ -41,7 +41,7 @@
     </div>
     <div class="form-item">
         <div class="form-label-group">
-            <label for="password" th:text="#{form.password.label}"> </label>
+            <label for="plainPassword" th:text="#{form.password.label}"> </label>
             <a
                 class="form-item-extra-link"
                 tabindex="-1"
@@ -55,4 +55,4 @@
             th:replace="~{gateway_fragments/input :: password(id = 'plainPassword', name = null, required = 'true', minlength = null, maxlength = 257, enableToggle = true)}"
         ></th:block>
     </div>
-</div>
\ No newline at end of file
+</div>

From 6d149ae3bbfe7e3252f76d6ac6599951d32b8fbf Mon Sep 17 00:00:00 2001
From: John Niang <johnniang@foxmail.com>
Date: Sat, 12 Oct 2024 16:21:10 +0800
Subject: [PATCH 134/185] Fix the problem of being able to configure invalid
 external URL (#6840)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/kind bug
/area core
/milestone 2.20.x

#### What this PR does / why we need it:

This PR makes users not be able to configure a invalid external URL like `https:www/halo.run` even if it is an valid URL format.

#### Which issue(s) this PR fixes:

Fixes #6837

#### Does this PR introduce a user-facing change?

```release-note
修复可配置无效的外部访问地址的问题
```
---
 .../app/infra/properties/HaloProperties.java  | 20 ++++++++-
 .../run/halo/app/PathPrefixPredicateTest.java |  7 +++
 .../infra/properties/HaloPropertiesTest.java  | 45 +++++++++++++++++++
 3 files changed, 71 insertions(+), 1 deletion(-)
 create mode 100644 application/src/test/java/run/halo/app/infra/properties/HaloPropertiesTest.java

diff --git a/application/src/main/java/run/halo/app/infra/properties/HaloProperties.java b/application/src/main/java/run/halo/app/infra/properties/HaloProperties.java
index 2a296dffb8..e89bc2b0c1 100644
--- a/application/src/main/java/run/halo/app/infra/properties/HaloProperties.java
+++ b/application/src/main/java/run/halo/app/infra/properties/HaloProperties.java
@@ -2,6 +2,7 @@
 
 import jakarta.validation.Valid;
 import jakarta.validation.constraints.NotNull;
+import java.net.URISyntaxException;
 import java.net.URL;
 import java.nio.file.Path;
 import java.util.HashSet;
@@ -69,9 +70,26 @@ public boolean supports(Class<?> clazz) {
     @Override
     public void validate(Object target, Errors errors) {
         var props = (HaloProperties) target;
-        if (props.isUseAbsolutePermalink() && props.getExternalUrl() == null) {
+        var externalUrl = props.getExternalUrl();
+        if (props.isUseAbsolutePermalink() && externalUrl == null) {
             errors.rejectValue("externalUrl", "external-url.required.when-using-absolute-permalink",
                 "External URL is required when property `use-absolute-permalink` is set to true.");
         }
+        // check if the external URL is a http or https URL and is not an opaque URL.
+        if (externalUrl != null && !isValidExternalUrl(externalUrl)) {
+            errors.rejectValue("externalUrl", "external-url.invalid-format",
+                "External URL must be a http or https URL.");
+        }
+    }
+
+    private boolean isValidExternalUrl(URL externalUrl) {
+        try {
+            var uri = externalUrl.toURI();
+            return !uri.isOpaque()
+                && uri.getAuthority() != null
+                && Set.of("http", "https").contains(uri.getScheme());
+        } catch (URISyntaxException e) {
+            return false;
+        }
     }
 }
diff --git a/application/src/test/java/run/halo/app/PathPrefixPredicateTest.java b/application/src/test/java/run/halo/app/PathPrefixPredicateTest.java
index 1447b4dc59..6ca99b356f 100644
--- a/application/src/test/java/run/halo/app/PathPrefixPredicateTest.java
+++ b/application/src/test/java/run/halo/app/PathPrefixPredicateTest.java
@@ -2,6 +2,7 @@
 
 import static org.assertj.core.api.Assertions.assertThat;
 
+import java.net.URI;
 import org.junit.jupiter.api.Test;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RestController;
@@ -34,4 +35,10 @@ class TestController {
 
     }
 
+
+    @Test
+    void urlTest() {
+        URI uri = URI.create("https:///path");
+        System.out.println(uri);
+    }
 }
diff --git a/application/src/test/java/run/halo/app/infra/properties/HaloPropertiesTest.java b/application/src/test/java/run/halo/app/infra/properties/HaloPropertiesTest.java
new file mode 100644
index 0000000000..1501c50c45
--- /dev/null
+++ b/application/src/test/java/run/halo/app/infra/properties/HaloPropertiesTest.java
@@ -0,0 +1,45 @@
+package run.halo.app.infra.properties;
+
+import java.net.MalformedURLException;
+import java.net.URL;
+import java.util.stream.Stream;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.Arguments;
+import org.junit.jupiter.params.provider.MethodSource;
+import org.springframework.validation.SimpleErrors;
+
+class HaloPropertiesTest {
+
+    static Stream<Arguments> validateTest() throws MalformedURLException {
+        return Stream.of(
+            Arguments.of(true, new URL("http://localhost:8080"), true),
+            Arguments.of(false, new URL("http://localhost:8080"), true),
+            Arguments.of(true, new URL("https://localhost:8080"), true),
+            Arguments.of(false, new URL("https://localhost:8080"), true),
+            Arguments.of(true, new URL("ftp://localhost:8080"), false),
+            Arguments.of(false, new URL("ftp://localhost:8080"), false),
+            Arguments.of(true, new URL("http:www/halo/run"), false),
+            Arguments.of(false, new URL("http:www/halo.run"), false),
+            Arguments.of(true, new URL("https:www/halo/run"), false),
+            Arguments.of(false, new URL("https:www/halo/run"), false),
+            Arguments.of(true, new URL("https:///path"), false),
+            Arguments.of(false, new URL("https:///path"), false),
+            Arguments.of(true, new URL("http:///path"), false),
+            Arguments.of(false, new URL("http:///path"), false),
+            Arguments.of(true, null, false),
+            Arguments.of(false, null, true)
+        );
+    }
+
+    @ParameterizedTest
+    @MethodSource
+    void validateTest(boolean useAbsolutePermalink, URL externalUrl, boolean valid) {
+        var properties = new HaloProperties();
+        properties.setUseAbsolutePermalink(useAbsolutePermalink);
+        properties.setExternalUrl(externalUrl);
+        var errors = new SimpleErrors(properties);
+        properties.validate(properties, errors);
+        Assertions.assertEquals(valid, !errors.hasErrors());
+    }
+}
\ No newline at end of file

From b9da9d05eaaed85f4cae5d8dd92b6b30b84cd51a Mon Sep 17 00:00:00 2001
From: Ryan Wang <i@ryanc.cc>
Date: Sat, 12 Oct 2024 17:21:10 +0800
Subject: [PATCH 135/185] refactor: improve login page ui (#6832)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/area core
/kind improvement
/milestone 2.20.x

#### What this PR does / why we need it:

优化登录等页面的 UI，主要优化低分屏下的 UI 表现，防止元素过大。

#### Does this PR introduce a user-facing change?

```release-note
优化登录等页面的 UI，优化低分屏下的 UI 表现，防止元素过大。
```
---
 .../src/main/resources/static/styles/main.css | 198 ++++++++----------
 .../src/main/resources/templates/signup.html  |   2 +-
 2 files changed, 93 insertions(+), 107 deletions(-)

diff --git a/application/src/main/resources/static/styles/main.css b/application/src/main/resources/static/styles/main.css
index 757a531159..e2d8dc5fc5 100644
--- a/application/src/main/resources/static/styles/main.css
+++ b/application/src/main/resources/static/styles/main.css
@@ -1,4 +1,3 @@
-/* Base */
 .gateway-page {
     width: 100%;
     height: 100vh;
@@ -7,18 +6,13 @@
 
 .gateway-wrapper,
 .gateway-wrapper:before,
-.gateway-wrapper:after {
-    box-sizing: border-box;
-    border-width: 0;
-    border-style: solid;
-}
-
+.gateway-wrapper:after,
 .gateway-wrapper *,
-.gateway-wrapper *:before,
-.gateway-wrapper *:after {
+.gateway-wrapper :before,
+.gateway-wrapper :after {
     box-sizing: border-box;
-    border-width: 0;
     border-style: solid;
+    border-width: 0;
 }
 
 .gateway-wrapper {
@@ -30,58 +24,48 @@
     --rounded-sm: 0.125em;
     --rounded-base: 0.25em;
     --rounded-lg: 0.5em;
+    --spacing-2xl: 1.5em;
     --spacing-xl: 1.25em;
     --spacing-lg: 1em;
     --spacing-md: 0.875em;
     --spacing-sm: 0.625em;
     --spacing-xs: 0.5em;
+    --text-xl: 1.25em;
+    --text-2xl: 1.5em;
+    --text-lg: 1.125em;
     --text-base: 1em;
     --text-sm: 0.875em;
-}
-
-.gateway-wrapper {
-    margin: 0 auto;
+    --font-size-base: 16px;
+    --font-size-md: 14px;
+    padding: 5% var(--spacing-lg);
+    font-size: var(--font-size-base);
     max-width: 28em;
-    padding: 5% 1em;
+    margin: 0 auto;
+    font-family: ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, Segoe UI, Roboto, Helvetica Neue, Arial,
+        Noto Sans, sans-serif, Apple Color Emoji, Segoe UI Emoji, Segoe UI Symbol, Noto Color Emoji;
     line-height: 1.5;
-    font-family:
-        ui-sans-serif,
-        system-ui,
-        -apple-system,
-        BlinkMacSystemFont,
-        Segoe UI,
-        Roboto,
-        Helvetica Neue,
-        Arial,
-        Noto Sans,
-        sans-serif,
-        "Apple Color Emoji",
-        "Segoe UI Emoji",
-        Segoe UI Symbol,
-        "Noto Color Emoji";
-}
-
-/* Form */
+}
+
 .halo-form-wrapper {
     border-radius: var(--rounded-lg);
-    border: 1px solid #dfe6ecb3;
+    padding: var(--spacing-2xl);
     background: #fff;
-    padding: 1.5em;
+    border: 1px solid #dfe6ecb3;
 }
 
 .form-title {
     all: unset;
-    margin-bottom: 1em;
-    display: block;
+    font-size: var(--text-2xl);
+    margin-bottom: var(--spacing-lg);
     font-weight: 500;
-    font-size: 1.75em;
+    display: block;
 }
 
 .halo-form .form-item {
-    display: flex;
+    margin-bottom: var(--spacing-2xl);
     flex-direction: column;
-    margin-bottom: 1.5em;
     width: 100%;
+    display: flex;
 }
 
 .halo-form .form-item:last-of-type {
@@ -90,9 +74,9 @@
 
 .halo-form .form-item-group {
     gap: var(--spacing-lg);
-    display: flex;
+    margin-bottom: var(--spacing-2xl);
     align-items: flex-start;
-    margin-bottom: 1.5em;
+    display: flex;
 }
 
 .halo-form .form-item-group .form-item {
@@ -102,27 +86,25 @@
 .halo-form .form-input {
     border-radius: var(--rounded-base);
     border: 1px solid var(--color-border);
-    height: 2.5em;
     background: #fff;
+    height: 2.5em;
     padding: 0 0.75rem;
 }
 
 .halo-form .form-input:focus-within {
     border-color: var(--color-primary);
-    outline: 2px solid transparent;
     outline-offset: "2px";
+    outline: 2px solid #0000;
 }
 
 .halo-form .form-item input {
     appearance: none;
-    -webkit-appearance: none;
-    -moz-appearance: none;
-    display: block;
-    font-size: 1em;
+    font-size: var(--text-base);
     box-shadow: none;
+    background: none;
     width: 100%;
     height: 100%;
-    background: transparent;
+    display: block;
 }
 
 .halo-form .form-item input:focus {
@@ -130,28 +112,27 @@
 }
 
 .halo-form .form-input-stack {
-    display: flex;
     align-items: center;
     gap: 0.5em;
+    display: flex;
 }
 
 .halo-form .form-input-stack-icon {
-    display: inline-flex;
-    align-items: center;
     color: var(--color-text);
     cursor: pointer;
+    align-items: center;
+    display: inline-flex;
 }
 
 .halo-form .form-input-stack-select {
     all: unset;
     color: var(--color-text);
     font-size: var(--text-sm);
+    background: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='1em' height='1em' viewBox='0 0 24 24'%3E%3Cpath fill='%23000' d='m12 13.171l4.95-4.95l1.414 1.415L12 16L5.636 9.636L7.05 8.222z'/%3E%3C/svg%3E")
+        right 0.3em center no-repeat;
+    align-items: center;
     padding-right: 1.85em;
     display: inline-flex;
-    align-items: center;
-    background: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='1em' height='1em' viewBox='0 0 24 24'%3E%3Cpath fill='%23000' d='m12 13.171l4.95-4.95l1.414 1.415L12 16L5.636 9.636L7.05 8.222z'/%3E%3C/svg%3E");
-    background-repeat: no-repeat;
-    background-position: right 0.3em center;
 }
 
 .halo-form .form-input-stack-text {
@@ -161,16 +142,16 @@
 
 .halo-form .form-item label {
     color: var(--color-text);
-    margin-bottom: 0.75rem;
     font-size: var(--text-base);
+    margin-bottom: 0.75rem;
     font-weight: 500;
 }
 
 .halo-form .form-item .form-label-group {
-    margin-bottom: 0.75em;
-    display: flex;
     justify-content: space-between;
     align-items: center;
+    margin-bottom: 0.75em;
+    display: flex;
 }
 
 .halo-form .form-item .form-label-group label {
@@ -185,9 +166,9 @@
 
 .halo-form .form-item-compact {
     gap: var(--spacing-sm);
-    margin-bottom: 1.5em;
-    display: flex;
+    margin-bottom: var(--spacing-2xl);
     align-items: center;
+    display: flex;
 }
 
 .halo-form .form-item-compact label {
@@ -198,10 +179,10 @@
 .halo-form button[type="submit"] {
     background: var(--color-secondary);
     border-radius: var(--rounded-base);
-    height: 2.5em;
     color: #fff;
-    border: none;
     cursor: pointer;
+    border: none;
+    height: 2.5em;
 }
 
 .halo-form button[type="submit"]:hover {
@@ -220,44 +201,39 @@
     border: 1px solid var(--color-border);
     border-radius: var(--rounded-sm);
     appearance: none;
-    -webkit-appearance: none;
-    -moz-appearance: none;
-    padding: 0;
     print-color-adjust: exact;
-    display: inline-block;
     vertical-align: middle;
-    background-origin: border-box;
     user-select: none;
-    flex-shrink: 0;
-    height: 1em;
-    width: 1em;
     color: #2563eb;
     background-color: #fff;
+    background-origin: border-box;
+    flex-shrink: 0;
+    width: 1em;
+    height: 1em;
+    padding: 0;
+    display: inline-block;
 }
 
 .halo-form input[type="checkbox"]:focus {
-    outline: 2px solid transparent;
     outline-offset: 2px;
-    box-shadow:
-        rgb(255, 255, 255) 0px 0px 0px 2px,
-        rgb(37, 99, 235) 0px 0px 0px 4px,
-        rgba(0, 0, 0, 0) 0px 0px 0px 0px;
+    outline: 2px solid #0000;
+    box-shadow: 0 0 0 2px #fff, 0 0 0 4px #2563eb, 0 0 #0000;
 }
 
 .halo-form input[type="checkbox"]:checked {
-    border-color: transparent;
     background-color: currentColor;
-    background-size: 100% 100%;
+    background-image: url("data:image/svg+xml,%3csvg viewBox='0 0 16 16' fill='white' xmlns='http://www.w3.org/2000/svg'%3e%3cpath d='M12.207 4.793a1 1 0 010 1.414l-5 5a1 1 0 01-1.414 0l-2-2a1 1 0 011.414-1.414L6.5 9.086l4.293-4.293a1 1 0 011.414 0z'/%3e%3c/svg%3e");
     background-position: center;
     background-repeat: no-repeat;
-    background-image: url("data:image/svg+xml,%3csvg viewBox='0 0 16 16' fill='white' xmlns='http://www.w3.org/2000/svg'%3e%3cpath d='M12.207 4.793a1 1 0 010 1.414l-5 5a1 1 0 01-1.414 0l-2-2a1 1 0 011.414-1.414L6.5 9.086l4.293-4.293a1 1 0 011.414 0z'/%3e%3c/svg%3e");
+    background-size: 100% 100%;
+    border-color: #0000;
 }
 
 .halo-form .form-input-group {
     gap: var(--spacing-sm);
-    display: grid;
     grid-template-columns: repeat(3, minmax(0, 1fr));
     align-items: center;
+    display: grid;
 }
 
 .halo-form .form-input {
@@ -269,10 +245,10 @@
     border: 1px solid var(--color-border);
     color: var(--color-text);
     font-size: var(--text-sm);
-    grid-column: span 1 / span 1;
-    height: 100%;
     cursor: pointer;
     background: #fff;
+    grid-column: span 1 / span 1;
+    height: 100%;
 }
 
 .halo-form .form-input-group button:hover {
@@ -287,30 +263,30 @@
 .pill-items {
     all: unset;
     gap: var(--spacing-sm);
-    margin: 0;
-    display: flex;
     flex-wrap: wrap;
     justify-content: center;
+    margin: 0;
+    display: flex;
 }
 
 .pill-items li {
     all: unset;
     border-radius: var(--rounded-lg);
-    overflow: hidden;
     border: 1px solid #e5e7eb;
     transition-property: all;
-    transition-timing-function: cubic-bezier(0.4, 0, 0.2, 1);
     transition-duration: 0.15s;
+    transition-timing-function: cubic-bezier(0.4, 0, 0.2, 1);
+    overflow: hidden;
 }
 
 .pill-items li a {
     gap: var(--spacing-sm);
     font-size: var(--text-sm);
-    padding: 0.6em 0.9em;
-    display: flex;
-    align-items: center;
     color: #1f2937;
+    align-items: center;
+    padding: 0.6em 0.9em;
     text-decoration: none;
+    display: flex;
 }
 
 .pill-items li img {
@@ -335,44 +311,44 @@
     color: var(--color-text);
     font-size: var(--text-sm);
     gap: var(--spacing-lg);
-    display: flex;
     align-items: center;
     margin: 1.5em 0;
+    display: flex;
 }
 
 .divider-wrapper hr {
-    flex-grow: 1;
-    overflow: hidden;
     border: 0;
     border-top: 1px solid #f3f4f6;
+    flex-grow: 1;
+    overflow: hidden;
 }
 
 .alert {
-    border: 1px solid #e5e7eb;
     border-radius: var(--rounded-base);
     margin-bottom: var(--spacing-xl);
     padding: var(--spacing-md) var(--spacing-xl);
     font-size: var(--text-sm);
-    overflow: hidden;
-    position: relative;
     color: var(--color-text);
+    border: 1px solid #e5e7eb;
+    position: relative;
+    overflow: hidden;
 }
 
-.alert::before {
+.alert:before {
     content: "";
-    position: absolute;
-    height: 100%;
-    left: 0;
     background: #d1d5db;
     width: 0.25em;
+    height: 100%;
+    position: absolute;
     top: 0;
+    left: 0;
 }
 
 .alert-warning {
     border-color: #fde047;
 }
 
-.alert-warning::before {
+.alert-warning:before {
     background: #ea580c;
 }
 
@@ -380,7 +356,7 @@
     border-color: #fca5a5;
 }
 
-.alert-error::before {
+.alert-error:before {
     background: #dc2626;
 }
 
@@ -388,7 +364,7 @@
     border-color: #86efac;
 }
 
-.alert-success::before {
+.alert-success:before {
     background: #16a34a;
 }
 
@@ -396,14 +372,12 @@
     border-color: #7dd3fc;
 }
 
-.alert-info::before {
+.alert-info:before {
     background: #0284c7;
 }
 
 @media (forced-colors: active) {
     .halo-form input[type="checkbox"]:checked {
-        -webkit-appearance: auto;
-        -moz-appearance: auto;
         appearance: auto;
     }
 }
@@ -414,6 +388,18 @@
     }
 }
 
+@media screen and (min-width: 1201px) and (max-width: 1600px) {
+    .gateway-wrapper {
+        font-size: var(--font-size-md);
+    }
+}
+
+@media screen and (min-width: 1601px) {
+    .gateway-wrapper {
+        font-size: var(--font-size-base);
+    }
+}
+
 ::-ms-reveal {
     display: none;
-}
\ No newline at end of file
+}
diff --git a/application/src/main/resources/templates/signup.html b/application/src/main/resources/templates/signup.html
index 5208fe1f22..b5295ddde4 100644
--- a/application/src/main/resources/templates/signup.html
+++ b/application/src/main/resources/templates/signup.html
@@ -6,7 +6,7 @@
     <th:block th:fragment="head">
         <style>
             .signup-page-wrapper {
-                max-width: 35em;
+                max-width: 38em;
             }
         </style>
     </th:block>

From b761fe2b7933281ec86c5ba2cbe4d2c0fee4c644 Mon Sep 17 00:00:00 2001
From: John Niang <johnniang@foxmail.com>
Date: Sat, 12 Oct 2024 18:59:10 +0800
Subject: [PATCH 136/185] Preserve remember-me option after authentication
 failure (#6844)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/kind bug
/area core
/milestone 2.20.x

#### What this PR does / why we need it:

This PR preserves `remember-me` option after authentication failure.

#### Which issue(s) this PR fixes:

Fixes https://github.com/halo-dev/halo/issues/6835

#### Special notes for your reviewer:

1. Go to login page
2. Input invalid username or password and select `remember-me` option
3. Click `Login` button
4. See the result

#### Does this PR introduce a user-facing change?

```release-note
修复登录失败后记住我选项被重置的问题
```
---
 .../TokenBasedRememberMeServices.java         |  2 +-
 .../WebSessionRememberMeRequestCache.java     | 22 ++++++-------------
 .../preauth/PreAuthLoginEndpoint.java         |  8 ++++++-
 .../templates/gateway_fragments/login.html    |  2 +-
 4 files changed, 16 insertions(+), 18 deletions(-)

diff --git a/application/src/main/java/run/halo/app/security/authentication/rememberme/TokenBasedRememberMeServices.java b/application/src/main/java/run/halo/app/security/authentication/rememberme/TokenBasedRememberMeServices.java
index 4f1e9c0dac..6de95ecf44 100644
--- a/application/src/main/java/run/halo/app/security/authentication/rememberme/TokenBasedRememberMeServices.java
+++ b/application/src/main/java/run/halo/app/security/authentication/rememberme/TokenBasedRememberMeServices.java
@@ -203,7 +203,7 @@ private boolean isValidCookieTokensLength(String[] cookieTokens) {
     public Mono<Void> loginFail(ServerWebExchange exchange) {
         log.debug("Interactive login attempt was unsuccessful.");
         cancelCookie(exchange);
-        return Mono.empty();
+        return rememberMeRequestCache.saveRememberMe(exchange);
     }
 
     @Override
diff --git a/application/src/main/java/run/halo/app/security/authentication/rememberme/WebSessionRememberMeRequestCache.java b/application/src/main/java/run/halo/app/security/authentication/rememberme/WebSessionRememberMeRequestCache.java
index 5c6f629a02..0152ad6901 100644
--- a/application/src/main/java/run/halo/app/security/authentication/rememberme/WebSessionRememberMeRequestCache.java
+++ b/application/src/main/java/run/halo/app/security/authentication/rememberme/WebSessionRememberMeRequestCache.java
@@ -1,7 +1,5 @@
 package run.halo.app.security.authentication.rememberme;
 
-import static java.lang.Boolean.parseBoolean;
-
 import org.springframework.web.server.ServerWebExchange;
 import org.springframework.web.server.WebSession;
 import reactor.core.publisher.Mono;
@@ -23,9 +21,7 @@ public class WebSessionRememberMeRequestCache implements RememberMeRequestCache
     @Override
     public Mono<Void> saveRememberMe(ServerWebExchange exchange) {
         return resolveFromQuery(exchange)
-            .filter(Boolean::booleanValue)
             .switchIfEmpty(resolveFromForm(exchange))
-            .filter(Boolean::booleanValue)
             .flatMap(rememberMe -> exchange.getSession().doOnNext(
                 session -> session.getAttributes().put(SESSION_ATTRIBUTE_NAME, rememberMe))
             )
@@ -35,9 +31,7 @@ public Mono<Void> saveRememberMe(ServerWebExchange exchange) {
     @Override
     public Mono<Boolean> isRememberMe(ServerWebExchange exchange) {
         return resolveFromQuery(exchange)
-            .filter(Boolean::booleanValue)
             .switchIfEmpty(resolveFromForm(exchange))
-            .filter(Boolean::booleanValue)
             .switchIfEmpty(resolveFromSession(exchange))
             .defaultIfEmpty(false);
     }
@@ -50,22 +44,20 @@ public Mono<Void> removeRememberMe(ServerWebExchange exchange) {
     }
 
     private Mono<Boolean> resolveFromQuery(ServerWebExchange exchange) {
-        return Mono.just(
-            parseBoolean(exchange.getRequest().getQueryParams().getFirst(DEFAULT_PARAMETER))
-        );
+        return Mono.justOrEmpty(exchange.getRequest().getQueryParams().getFirst(DEFAULT_PARAMETER))
+            .map(Boolean::parseBoolean);
     }
 
     private Mono<Boolean> resolveFromForm(ServerWebExchange exchange) {
         return exchange.getFormData()
-            .map(form -> parseBoolean(form.getFirst(DEFAULT_PARAMETER)))
-            .filter(Boolean::booleanValue);
+            .mapNotNull(form -> form.getFirst(DEFAULT_PARAMETER))
+            .map(Boolean::parseBoolean);
     }
 
     private Mono<Boolean> resolveFromSession(ServerWebExchange exchange) {
         return exchange.getSession()
-            .map(session -> {
-                var rememberMeObject = session.getAttribute(SESSION_ATTRIBUTE_NAME);
-                return rememberMeObject instanceof Boolean rememberMe ? rememberMe : false;
-            });
+            .mapNotNull(session -> session.getAttribute(SESSION_ATTRIBUTE_NAME))
+            .filter(Boolean.class::isInstance)
+            .cast(Boolean.class);
     }
 }
diff --git a/application/src/main/java/run/halo/app/security/preauth/PreAuthLoginEndpoint.java b/application/src/main/java/run/halo/app/security/preauth/PreAuthLoginEndpoint.java
index f506ca0d8a..641267d495 100644
--- a/application/src/main/java/run/halo/app/security/preauth/PreAuthLoginEndpoint.java
+++ b/application/src/main/java/run/halo/app/security/preauth/PreAuthLoginEndpoint.java
@@ -22,6 +22,8 @@
 import run.halo.app.security.AuthProviderService;
 import run.halo.app.security.HaloServerRequestCache;
 import run.halo.app.security.authentication.CryptoService;
+import run.halo.app.security.authentication.rememberme.RememberMeRequestCache;
+import run.halo.app.security.authentication.rememberme.WebSessionRememberMeRequestCache;
 
 /**
  * Pre-auth login endpoints.
@@ -40,6 +42,9 @@ class PreAuthLoginEndpoint {
 
     private final ServerRequestCache serverRequestCache = new HaloServerRequestCache();
 
+    private final RememberMeRequestCache rememberMeRequestCache =
+        new WebSessionRememberMeRequestCache();
+
     PreAuthLoginEndpoint(CryptoService cryptoService, GlobalInfoService globalInfoService,
         AuthProviderService authProviderService) {
         this.cryptoService = cryptoService;
@@ -91,7 +96,8 @@ RouterFunction<ServerResponse> preAuthLoginEndpoints() {
                         "authProvider", authProvider,
                         "fragmentTemplateName", fragmentTemplateName,
                         "socialAuthProviders", socialAuthProviders,
-                        "formAuthProviders", formAuthProviders
+                        "formAuthProviders", formAuthProviders,
+                        "rememberMe", rememberMeRequestCache.isRememberMe(exchange)
                         // TODO Add more models here
                     ))
                 ));
diff --git a/application/src/main/resources/templates/gateway_fragments/login.html b/application/src/main/resources/templates/gateway_fragments/login.html
index 78005cfa43..bf7eda62ae 100644
--- a/application/src/main/resources/templates/gateway_fragments/login.html
+++ b/application/src/main/resources/templates/gateway_fragments/login.html
@@ -30,7 +30,7 @@
     <div th:replace="~{__${fragmentTemplateName}__::form}"></div>
 
     <div th:if="${authProvider.spec.rememberMeSupport}" class="form-item-compact">
-        <input type="checkbox" id="remember-me" name="remember-me" value="true" />
+        <input type="checkbox" id="remember-me" name="remember-me" value="true" th:checked="${rememberMe}"/>
         <label for="remember-me" th:text="#{form.rememberMe.label}"></label>
     </div>
 

From 3bdec9eacf15ff7e7291f9736c6da878f2a4a995 Mon Sep 17 00:00:00 2001
From: guqing <38999863+guqing@users.noreply.github.com>
Date: Sat, 12 Oct 2024 21:47:10 +0800
Subject: [PATCH 137/185] fix: vertical images are rotated to horizontal when
 generating thumbnails (#6842)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?
/kind improvement
/area core
/milestone 2.20.x

#### What this PR does / why we need it:
修复竖向图片生成缩略图后会丢失方向信息展示为横向图片的问题

#### Which issue(s) this PR fixes:
Fixes #6802

#### Does this PR introduce a user-facing change?
```release-note
修复竖向图片生成缩略图后会丢失方向信息展示为横向图片的问题
```
---
 api/build.gradle                              |  1 +
 .../core/attachment/ThumbnailGenerator.java   | 33 +++++++++++++++++++
 platform/application/build.gradle             |  2 ++
 3 files changed, 36 insertions(+)

diff --git a/api/build.gradle b/api/build.gradle
index 8185f2a024..046529c443 100644
--- a/api/build.gradle
+++ b/api/build.gradle
@@ -68,6 +68,7 @@ dependencies {
     api "org.thymeleaf.extras:thymeleaf-extras-springsecurity6"
     api 'org.apache.tika:tika-core'
     api "org.imgscalr:imgscalr-lib"
+    api 'com.drewnoakes:metadata-extractor'
 
     api "io.github.resilience4j:resilience4j-spring-boot3"
     api "io.github.resilience4j:resilience4j-reactor"
diff --git a/application/src/main/java/run/halo/app/core/attachment/ThumbnailGenerator.java b/application/src/main/java/run/halo/app/core/attachment/ThumbnailGenerator.java
index ad822f05cb..30b2d7455e 100644
--- a/application/src/main/java/run/halo/app/core/attachment/ThumbnailGenerator.java
+++ b/application/src/main/java/run/halo/app/core/attachment/ThumbnailGenerator.java
@@ -2,6 +2,10 @@
 
 import static java.nio.file.StandardCopyOption.REPLACE_EXISTING;
 
+import com.drew.imaging.ImageMetadataReader;
+import com.drew.metadata.Directory;
+import com.drew.metadata.Metadata;
+import com.drew.metadata.exif.ExifIFD0Directory;
 import java.io.File;
 import java.io.FileOutputStream;
 import java.io.IOException;
@@ -92,9 +96,38 @@ private void generateThumbnail(Path tempImagePath) throws IOException {
         }
         var thumbnail = Scalr.resize(img, Scalr.Method.AUTOMATIC, Scalr.Mode.FIT_TO_WIDTH,
             size.getWidth());
+        // Rotate image if needed
+        var orientation = readExifOrientation(file);
+        if (orientation != null) {
+            thumbnail = Scalr.rotate(thumbnail, orientation);
+        }
         ImageIO.write(thumbnail, formatName, thumbnailFile);
     }
 
+    private static Scalr.Rotation readExifOrientation(File inputFile) {
+        try {
+            Metadata metadata = ImageMetadataReader.readMetadata(inputFile);
+            Directory directory = metadata.getFirstDirectoryOfType(ExifIFD0Directory.class);
+            if (directory != null && directory.containsTag(ExifIFD0Directory.TAG_ORIENTATION)) {
+                return getScalrRotationFromExifOrientation(
+                    directory.getInt(ExifIFD0Directory.TAG_ORIENTATION));
+            }
+        } catch (Exception e) {
+            log.debug("Failed to read EXIF orientation from file: {}", inputFile, e);
+        }
+        return null;
+    }
+
+    private static Scalr.Rotation getScalrRotationFromExifOrientation(int orientation) {
+        // https://www.media.mit.edu/pia/Research/deepview/exif.html#:~:text=0x0112-,Orientation,-unsigned%20short
+        return switch (orientation) {
+            case 3 -> Scalr.Rotation.CW_180;
+            case 6 -> Scalr.Rotation.CW_90;
+            case 8 -> Scalr.Rotation.CW_270;
+            default -> null;
+        };
+    }
+
     private static boolean isUnsupportedFormat(@NonNull String formatName) {
         return UNSUPPORTED_FORMATS.contains(formatName.toLowerCase());
     }
diff --git a/platform/application/build.gradle b/platform/application/build.gradle
index 90311f35e7..396df394c7 100644
--- a/platform/application/build.gradle
+++ b/platform/application/build.gradle
@@ -24,6 +24,7 @@ ext {
     twoFactorAuth = "1.3"
     tika = "2.9.2"
     imgscalr = '4.2'
+    exifExtractor = '2.19.0'
 }
 
 javaPlatform {
@@ -58,6 +59,7 @@ dependencies {
         api "com.j256.two-factor-auth:two-factor-auth:$twoFactorAuth"
         api "org.apache.tika:tika-core:$tika"
         api "org.imgscalr:imgscalr-lib:$imgscalr"
+        api "com.drewnoakes:metadata-extractor:$exifExtractor"
     }
 
 }

From 58488686a7bac72b37143729b24a15c668f16e0d Mon Sep 17 00:00:00 2001
From: guqing <38999863+guqing@users.noreply.github.com>
Date: Sun, 13 Oct 2024 21:57:13 +0800
Subject: [PATCH 138/185] chore: ignore preset plugin installation errors to
 avoid initialization failure (#6855)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?
/milestone 2.20.x
/area core
/milestone 2.20.x

#### What this PR does / why we need it:
忽略预设插件安装时的错误避免无法初始化

可能因为没有预先 download 预设插件到项目目录而发生 IO 异常影响初始化流程

#### Does this PR introduce a user-facing change?

```release-note
None
```
---
 .../src/main/java/run/halo/app/plugin/PluginServiceImpl.java   | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/application/src/main/java/run/halo/app/plugin/PluginServiceImpl.java b/application/src/main/java/run/halo/app/plugin/PluginServiceImpl.java
index 6e31584182..2bc3812c0a 100644
--- a/application/src/main/java/run/halo/app/plugin/PluginServiceImpl.java
+++ b/application/src/main/java/run/halo/app/plugin/PluginServiceImpl.java
@@ -516,7 +516,8 @@ private Flux<Path> getPresetJars() {
                     return path;
                 });
         } catch (IOException e) {
-            return Flux.error(e);
+            log.debug("Failed to load preset plugins: {}", e.getMessage());
+            return Flux.empty();
         }
     }
 

From 7c6a8e9ce77fae2dc4e2ef622849110dd423a80f Mon Sep 17 00:00:00 2001
From: John Niang <johnniang@foxmail.com>
Date: Sun, 13 Oct 2024 22:21:14 +0800
Subject: [PATCH 139/185] Fill operation ID while building setup route (#6857)

#### What type of PR is this?

/kind bug
/area core
/milestone 2.20.x

#### What this PR does / why we need it:

This PR fills operation ID while building setup route to prevent errors when generating OpenAPI docs.

```java
2024-10-13T22:09:46.997+08:00 ERROR 68966 --- [     parallel-4] a.w.r.e.AbstractErrorWebExceptionHandler : [88654f05-3]  500 Server Error for HTTP GET "/v3/api-docs/apis_aggregated.api_v1alpha1"

java.lang.IllegalStateException: You should either fill, the Operation or at least the bean class and the bean method
	at org.springdoc.core.fn.builders.operation.Builder.build(Builder.java:467) ~[springdoc-openapi-starter-common-2.6.0.jar:2.6.0]
	Suppressed: reactor.core.publisher.FluxOnAssembly$OnAssemblyException:
```

#### Does this PR introduce a user-facing change?

```release-note
None
```
---
 .../run/halo/app/security/preauth/SystemSetupEndpoint.java     | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/application/src/main/java/run/halo/app/security/preauth/SystemSetupEndpoint.java b/application/src/main/java/run/halo/app/security/preauth/SystemSetupEndpoint.java
index 5fa81998e2..4e1d3c3963 100644
--- a/application/src/main/java/run/halo/app/security/preauth/SystemSetupEndpoint.java
+++ b/application/src/main/java/run/halo/app/security/preauth/SystemSetupEndpoint.java
@@ -108,8 +108,7 @@ RouterFunction<ServerResponse> setupPageRouter() {
                         .implementation(Void.class)
                     )
             )
-            .before(HaloUtils.noCache(), builder -> {
-            })
+            .before(HaloUtils.noCache(), builder -> builder.operationId("SetNoCacheForSetUpPage"))
             .build();
     }
 

From 149cb5d136e1a01069f0dad8b669bef2e8c038c1 Mon Sep 17 00:00:00 2001
From: Ryan Wang <i@ryanc.cc>
Date: Sun, 13 Oct 2024 22:49:14 +0800
Subject: [PATCH 140/185] refactor: remove underline in h2 warning alert
 (#6849)

#### What type of PR is this?

/area ui
/kind improvement
/milestone 2.20.x

#### What this PR does / why we need it:

before:

<img width="804" alt="image" src="https://github.com/user-attachments/assets/3d55d7d2-1dfa-4988-afbd-dd502e54fdb2">

after:

<img width="806" alt="image" src="https://github.com/user-attachments/assets/6194d995-b6f1-404a-820d-b667ccfab9f1">

#### Does this PR introduce a user-facing change?

```release-note
None
```
---
 ui/src/components/alerts/H2WarningAlert.vue | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/ui/src/components/alerts/H2WarningAlert.vue b/ui/src/components/alerts/H2WarningAlert.vue
index 9c41bffb2d..e8c8dedaf3 100644
--- a/ui/src/components/alerts/H2WarningAlert.vue
+++ b/ui/src/components/alerts/H2WarningAlert.vue
@@ -26,8 +26,5 @@ const { data: info } = useQuery<Info>({
     <template #description>
       {{ $t("core.components.h2_warning_alert.description") }}
     </template>
-    <template #actions>
-      <slot name="actions" />
-    </template>
   </VAlert>
 </template>

From a21413e08001829b0112797301c36651111d4b71 Mon Sep 17 00:00:00 2001
From: Ryan Wang <i@ryanc.cc>
Date: Sun, 13 Oct 2024 22:55:14 +0800
Subject: [PATCH 141/185] fix: not redirect to /console after setup (#6852)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/area core
/kind bug
/milestone 2.20.x

#### What this PR does / why we need it:

修复初始化登录之后，没有正确重定向到 /console 的问题。

#### Which issue(s) this PR fixes:

Fixes #6850

#### Does this PR introduce a user-facing change?

```release-note
None
```
---
 .../java/run/halo/app/security/preauth/SystemSetupEndpoint.java | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/application/src/main/java/run/halo/app/security/preauth/SystemSetupEndpoint.java b/application/src/main/java/run/halo/app/security/preauth/SystemSetupEndpoint.java
index 4e1d3c3963..74154d96a8 100644
--- a/application/src/main/java/run/halo/app/security/preauth/SystemSetupEndpoint.java
+++ b/application/src/main/java/run/halo/app/security/preauth/SystemSetupEndpoint.java
@@ -150,7 +150,7 @@ private static boolean isHtmlRequest(ServerRequest request) {
     }
 
     private static Mono<ServerResponse> redirectToConsole() {
-        return ServerResponse.temporaryRedirect(URI.create("/console")).build();
+        return ServerResponse.status(HttpStatus.FOUND).location(URI.create("/console")).build();
     }
 
     private Mono<Void> doInitialization(SetupRequest body) {

From 0d8c4bb12614e7a856c08f3615d90ac6fac0001d Mon Sep 17 00:00:00 2001
From: Ryan Wang <i@ryanc.cc>
Date: Sun, 13 Oct 2024 23:11:14 +0800
Subject: [PATCH 142/185] fix: set default value for attachment storage policy
 in user center (#6853)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/area core
/kind bug
/milestone 2.20.x

#### What this PR does / why we need it:

修复首次初始化之后，个人中心使用的附件存储策略没有默认值的问题。

#### Which issue(s) this PR fixes:

Fixes #6834

#### Does this PR introduce a user-facing change?

```release-note
None
```
---
 .../resources/extensions/system-configurable-configmap.yaml    | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/application/src/main/resources/extensions/system-configurable-configmap.yaml b/application/src/main/resources/extensions/system-configurable-configmap.yaml
index 5d22168340..ca914d254d 100644
--- a/application/src/main/resources/extensions/system-configurable-configmap.yaml
+++ b/application/src/main/resources/extensions/system-configurable-configmap.yaml
@@ -8,7 +8,8 @@ data:
       "allowRegistration": false,
       "mustVerifyEmailOnRegistration": false,
       "defaultRole": "guest",
-      "avatarPolicy": "default-policy"
+      "avatarPolicy": "default-policy",
+      "ucAttachmentPolicy": "default-policy"
     }
   theme: |
     {

From b0d36b784e80212b2c416fca5010a7fcab2b2c2d Mon Sep 17 00:00:00 2001
From: Ryan Wang <i@ryanc.cc>
Date: Sun, 13 Oct 2024 23:33:14 +0800
Subject: [PATCH 143/185] feat: support toast a message for backend exceptions
 when sending emails (#6856)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/area core
/kind improvement
/milestone 2.20.x

#### What this PR does / why we need it:

注册表单发送邮箱验证码时，支持显示来自后端的异常。

<img width="693" alt="image" src="https://github.com/user-attachments/assets/78d1d793-7673-4442-9b0b-1eb7c4d91ebd">


#### Does this PR introduce a user-facing change?

```release-note
None
```
---
 .../templates/gateway_fragments/signup.html   | 46 +++++++++----------
 1 file changed, 23 insertions(+), 23 deletions(-)

diff --git a/application/src/main/resources/templates/gateway_fragments/signup.html b/application/src/main/resources/templates/gateway_fragments/signup.html
index bc3315e06c..fc6fa7c71d 100644
--- a/application/src/main/resources/templates/gateway_fragments/signup.html
+++ b/application/src/main/resources/templates/gateway_fragments/signup.html
@@ -123,32 +123,32 @@
 
     <script th:if="${globalInfo.mustVerifyEmailOnRegistration}" th:inline="javascript">
         document.addEventListener("DOMContentLoaded", function () {
-            function sendRequest() {
-                return new Promise((resolve, reject) => {
-                    const email = document.getElementById("email").value;
+            const headerName = /*[[${_csrf.headerName}]]*/ "";
+            const token = /*[[${_csrf.token}]]*/ "";
+            async function sendRequest() {
+                const email = document.getElementById("email").value;
 
-                    if (!email) {
-                        throw new Error(/*[[#{form.emailCode.send.emptyValidation}]]*/"");
-                    }
+                if (!email) {
+                    throw new Error(/*[[#{form.emailCode.send.emptyValidation}]]*/ "");
+                }
 
-                    fetch("/signup/send-email-code", {
-                        method: "POST",
-                        body: JSON.stringify({ email: email }),
-                        headers: {
-                            "Content-Type": "application/json",
-                            [[${_csrf.headerName}]]: [[${_csrf.token}]],
-                        },
-                    })
-                        .then((response) => {
-                            if (response.ok) {
-                                resolve(response);
-                            }
-                            reject(response);
-                        })
-                        .catch((e) => {
-                            reject(e);
-                        });
+                const response = await fetch("/signup/send-email-code", {
+                    method: "POST",
+                    body: JSON.stringify({ email: email }),
+                    headers: {
+                        "Content-Type": "application/json",
+                        [headerName]: token,
+                    },
                 });
+
+                if (!response.ok) {
+                    const json = await response.json();
+                    if (json.errors && json.errors.length) {
+                        throw new Error(json.errors[0]);
+                    }
+                }
+
+                return response;
             }
 
             const emailCodeSendButton = document.getElementById("emailCodeSendButton");

From 55f133396c07a67e20c630963162f08272e7a299 Mon Sep 17 00:00:00 2001
From: johnniang <johnniang@foxmail.com>
Date: Mon, 14 Oct 2024 10:18:03 +0800
Subject: [PATCH 144/185] Set usingH2database variable into setup template
 model

---
 .../security/preauth/SystemSetupEndpoint.java | 26 +++++++++++++++++--
 1 file changed, 24 insertions(+), 2 deletions(-)

diff --git a/application/src/main/java/run/halo/app/security/preauth/SystemSetupEndpoint.java b/application/src/main/java/run/halo/app/security/preauth/SystemSetupEndpoint.java
index 74154d96a8..d622b4479f 100644
--- a/application/src/main/java/run/halo/app/security/preauth/SystemSetupEndpoint.java
+++ b/application/src/main/java/run/halo/app/security/preauth/SystemSetupEndpoint.java
@@ -1,5 +1,6 @@
 package run.halo.app.security.preauth;
 
+import static io.r2dbc.spi.ConnectionFactoryOptions.DRIVER;
 import static io.swagger.v3.oas.annotations.media.Schema.RequiredMode.REQUIRED;
 import static org.springdoc.core.fn.builders.apiresponse.Builder.responseBuilder;
 import static org.springdoc.core.fn.builders.requestbody.Builder.requestBodyBuilder;
@@ -18,11 +19,14 @@
 import java.time.Instant;
 import java.util.LinkedHashMap;
 import java.util.Map;
+import java.util.Optional;
 import java.util.Properties;
 import lombok.RequiredArgsConstructor;
 import org.springdoc.core.fn.builders.content.Builder;
 import org.springdoc.webflux.core.fn.SpringdocRouteBuilder;
+import org.springframework.beans.factory.ObjectProvider;
 import org.springframework.beans.factory.config.PlaceholderConfigurerSupport;
+import org.springframework.boot.autoconfigure.r2dbc.R2dbcConnectionDetails;
 import org.springframework.context.annotation.Bean;
 import org.springframework.core.io.ClassPathResource;
 import org.springframework.dao.OptimisticLockingFailureException;
@@ -77,6 +81,7 @@ public class SystemSetupEndpoint {
     private final PluginService pluginService;
     private final ThemeService themeService;
     private final Validator validator;
+    private final ObjectProvider<R2dbcConnectionDetails> connectionDetails;
 
     @Bean
     RouterFunction<ServerResponse> setupPageRouter() {
@@ -138,8 +143,10 @@ private static Mono<ServerResponse> handleSetupSuccessfully(ServerRequest reques
     private Mono<ServerResponse> handleValidationErrors(BindingResult bindingResult,
         ServerRequest request) {
         if (isHtmlRequest(request)) {
+            var model = bindingResult.getModel();
+            model.put("usingH2database", usingH2database());
             return ServerResponse.status(HttpStatus.BAD_REQUEST)
-                .render(SETUP_TEMPLATE, bindingResult.getModel());
+                .render(SETUP_TEMPLATE, model);
         }
         return Mono.error(new RequestBodyValidationException(bindingResult));
     }
@@ -209,10 +216,25 @@ private Mono<ServerResponse> setupPage(ServerRequest request) {
                 }
                 var body = new SetupRequest(new LinkedMultiValueMap<>());
                 var bindingResult = new BeanPropertyBindingResult(body, "form");
-                return ServerResponse.ok().render(SETUP_TEMPLATE, bindingResult.getModel());
+                var model = bindingResult.getModel();
+                model.put("usingH2database", usingH2database());
+                return ServerResponse.ok().render(SETUP_TEMPLATE, model);
             });
     }
 
+    private boolean usingH2database() {
+        var rcd = connectionDetails.getIfUnique();
+        if (rcd == null) {
+            // If no R2dbcConnectionDetails is available, we assume H2(mem) is used.
+            return true;
+        }
+        var options = rcd.getConnectionFactoryOptions();
+        return Optional.ofNullable(options.getValue(DRIVER))
+            .map(Object::toString)
+            .map("h2"::equalsIgnoreCase)
+            .orElse(false);
+    }
+
     record SetupRequest(MultiValueMap<String, String> formData) {
 
         @Schema(requiredMode = REQUIRED, minLength = 4, maxLength = 63)

From eff73dca12f96ca46d49a3bc14f9cd67c1f77103 Mon Sep 17 00:00:00 2001
From: Ryan Wang <i@ryanc.cc>
Date: Mon, 14 Oct 2024 10:18:24 +0800
Subject: [PATCH 145/185] feat: add H2 database usage warning for setup page

---
 application/src/main/resources/templates/setup.html         | 6 +++++-
 application/src/main/resources/templates/setup.properties   | 4 +++-
 .../src/main/resources/templates/setup_en.properties        | 2 ++
 .../src/main/resources/templates/setup_es.properties        | 4 +++-
 .../src/main/resources/templates/setup_zh_TW.properties     | 4 +++-
 5 files changed, 16 insertions(+), 4 deletions(-)

diff --git a/application/src/main/resources/templates/setup.html b/application/src/main/resources/templates/setup.html
index 5a7350cfcf..aa3c2275b0 100644
--- a/application/src/main/resources/templates/setup.html
+++ b/application/src/main/resources/templates/setup.html
@@ -16,7 +16,11 @@
 
             <div class="halo-form-wrapper">
                 <h1 class="form-title" th:text="#{title}"></h1>
-
+                <div class="alert alert-error" role="alert" th:if="${usingH2database}">
+                    <strong th:text="#{form.messages.h2.title}"></strong>
+                    <br />
+                    <span th:text="#{form.messages.h2.content}"> </span>
+                </div>
                 <form th:object="${form}" th:action="@{/system/setup}" class="halo-form" method="post">
                     <div class="form-item">
                         <label for="siteTitle" th:text="#{form.siteTitle.label}"></label>
diff --git a/application/src/main/resources/templates/setup.properties b/application/src/main/resources/templates/setup.properties
index 139b4c5d1d..e974e8f799 100644
--- a/application/src/main/resources/templates/setup.properties
+++ b/application/src/main/resources/templates/setup.properties
@@ -4,4 +4,6 @@ form.username.label=用户名
 form.email.label=电子邮箱
 form.password.label=密码
 form.confirmPassword.label=确认密码
-form.submit=初始化
\ No newline at end of file
+form.submit=初始化
+form.messages.h2.title=警告：正在使用 H2 数据库
+form.messages.h2.content=H2 数据库仅适用于开发环境和测试环境，不推荐在生产环境中使用，H2 非常容易因为操作不当导致数据文件损坏。如果必须要使用，请按时进行数据备份。
\ No newline at end of file
diff --git a/application/src/main/resources/templates/setup_en.properties b/application/src/main/resources/templates/setup_en.properties
index f65c17eee1..af468d633d 100644
--- a/application/src/main/resources/templates/setup_en.properties
+++ b/application/src/main/resources/templates/setup_en.properties
@@ -5,3 +5,5 @@ form.email.label=Email
 form.password.label=Password
 form.confirmPassword.label=Confirm Password
 form.submit=Setup
+form.messages.h2.title=Warning: Using H2 Database
+form.messages.h2.content=The H2 database is only suitable for development and testing environments. It is not recommended for production environments, as H2 is very prone to data file corruption due to improper operations. If you must use it, please back up your data regularly.
\ No newline at end of file
diff --git a/application/src/main/resources/templates/setup_es.properties b/application/src/main/resources/templates/setup_es.properties
index f4041620a8..1b0c20f2df 100644
--- a/application/src/main/resources/templates/setup_es.properties
+++ b/application/src/main/resources/templates/setup_es.properties
@@ -4,4 +4,6 @@ form.username.label=Nombre de Usuario
 form.email.label=Correo Electrónico
 form.password.label=Contraseña
 form.confirmPassword.label=Confirmar Contraseña
-form.submit=Configurar
\ No newline at end of file
+form.submit=Configurar
+form.messages.h2.title=Advertencia: Usando la base de datos H2
+form.messages.h2.content=La base de datos H2 solo es adecuada para entornos de desarrollo y prueba. No se recomienda su uso en entornos de producción, ya que H2 es muy susceptible a la corrupción de archivos de datos debido a un manejo inadecuado. Si debe usarla, realice copias de seguridad de los datos regularmente.
\ No newline at end of file
diff --git a/application/src/main/resources/templates/setup_zh_TW.properties b/application/src/main/resources/templates/setup_zh_TW.properties
index 1f2e3a147b..2a9b066a59 100644
--- a/application/src/main/resources/templates/setup_zh_TW.properties
+++ b/application/src/main/resources/templates/setup_zh_TW.properties
@@ -4,4 +4,6 @@ form.username.label=使用者名稱
 form.email.label=電子郵件
 form.password.label=密碼
 form.confirmPassword.label=確認密碼
-form.submit=初始化
\ No newline at end of file
+form.submit=初始化
+form.messages.h2.title=警告：正在使用 H2 資料庫
+form.messages.h2.content=H2 資料庫僅適用於開發環境和測試環境，不建議在生產環境中使用，H2 非常容易因為操作不當導致資料檔案損壞。如果必須要使用，請按時進行資料備份。
\ No newline at end of file

From 82498dcedf6d761c2b0c089533be09c733fb006c Mon Sep 17 00:00:00 2001
From: guqing <38999863+guqing@users.noreply.github.com>
Date: Mon, 14 Oct 2024 10:53:24 +0800
Subject: [PATCH 146/185] refactor: auth provider sorting logic for better
 maintainability and clarity (#6846)

* refactor: auth provider sorting logic for better maintainability and clarity

* Refine UI

* chore: remove other auth type

* Remove other auth providers

---------

Co-authored-by: Ryan Wang <i@ryanc.cc>
---
 api-docs/openapi/v3_0/aggregated.json         |  16 +-
 .../v3_0/apis_console.api_v1alpha1.json       |  16 +-
 .../v3_0/apis_extension.api_v1alpha1.json     |   5 +-
 .../halo/app/core/extension/AuthProvider.java |  15 +-
 .../run/halo/app/extension/Unstructured.java  |   2 +-
 .../run/halo/app/infra/SystemSetting.java     |  13 +-
 .../app/security/AuthProviderService.java     |   3 +
 .../app/security/AuthProviderServiceImpl.java | 189 +++++++++++-------
 .../halo/app/security/ListedAuthProvider.java |   7 +-
 .../preauth/PreAuthLoginEndpoint.java         |  30 ++-
 .../security/AuthProviderServiceImplTest.java | 123 +++++++-----
 .../system/auth-providers/AuthProviders.vue   | 143 +++++--------
 .../components/AuthProvidersSection.vue       |  48 +++++
 .../modules/system/auth-providers/module.ts   |   2 +
 .../modules/system/users/UserList.vue         |  14 +-
 .../src/models/auth-provider-spec.ts          |   8 +-
 .../src/models/listed-auth-provider.ts        |  20 ++
 ui/src/locales/en.yaml                        |   4 +
 ui/src/locales/zh-CN.yaml                     |   4 +
 ui/src/locales/zh-TW.yaml                     |   4 +
 20 files changed, 411 insertions(+), 255 deletions(-)
 create mode 100644 ui/console-src/modules/system/auth-providers/components/AuthProvidersSection.vue

diff --git a/api-docs/openapi/v3_0/aggregated.json b/api-docs/openapi/v3_0/aggregated.json
index f2242dbd19..d07c4b85c6 100644
--- a/api-docs/openapi/v3_0/aggregated.json
+++ b/api-docs/openapi/v3_0/aggregated.json
@@ -16034,6 +16034,7 @@
       },
       "AuthProviderSpec": {
         "required": [
+          "authType",
           "authenticationUrl",
           "displayName"
         ],
@@ -16072,10 +16073,6 @@
           "method": {
             "type": "string"
           },
-          "priority": {
-            "type": "integer",
-            "format": "int32"
-          },
           "rememberMeSupport": {
             "type": "boolean"
           },
@@ -18297,6 +18294,13 @@
         ],
         "type": "object",
         "properties": {
+          "authType": {
+            "type": "string",
+            "enum": [
+              "FORM",
+              "OAUTH2"
+            ]
+          },
           "authenticationUrl": {
             "type": "string"
           },
@@ -18324,6 +18328,10 @@
           "name": {
             "type": "string"
           },
+          "priority": {
+            "type": "integer",
+            "format": "int32"
+          },
           "privileged": {
             "type": "boolean"
           },
diff --git a/api-docs/openapi/v3_0/apis_console.api_v1alpha1.json b/api-docs/openapi/v3_0/apis_console.api_v1alpha1.json
index ff8db40645..e492fe3dc4 100644
--- a/api-docs/openapi/v3_0/apis_console.api_v1alpha1.json
+++ b/api-docs/openapi/v3_0/apis_console.api_v1alpha1.json
@@ -3568,6 +3568,7 @@
       },
       "AuthProviderSpec": {
         "required": [
+          "authType",
           "authenticationUrl",
           "displayName"
         ],
@@ -3606,10 +3607,6 @@
           "method": {
             "type": "string"
           },
-          "priority": {
-            "type": "integer",
-            "format": "int32"
-          },
           "rememberMeSupport": {
             "type": "boolean"
           },
@@ -4435,6 +4432,13 @@
         ],
         "type": "object",
         "properties": {
+          "authType": {
+            "type": "string",
+            "enum": [
+              "FORM",
+              "OAUTH2"
+            ]
+          },
           "authenticationUrl": {
             "type": "string"
           },
@@ -4462,6 +4466,10 @@
           "name": {
             "type": "string"
           },
+          "priority": {
+            "type": "integer",
+            "format": "int32"
+          },
           "privileged": {
             "type": "boolean"
           },
diff --git a/api-docs/openapi/v3_0/apis_extension.api_v1alpha1.json b/api-docs/openapi/v3_0/apis_extension.api_v1alpha1.json
index 90a36eaf33..84340604dc 100644
--- a/api-docs/openapi/v3_0/apis_extension.api_v1alpha1.json
+++ b/api-docs/openapi/v3_0/apis_extension.api_v1alpha1.json
@@ -8666,6 +8666,7 @@
       },
       "AuthProviderSpec": {
         "required": [
+          "authType",
           "authenticationUrl",
           "displayName"
         ],
@@ -8704,10 +8705,6 @@
           "method": {
             "type": "string"
           },
-          "priority": {
-            "type": "integer",
-            "format": "int32"
-          },
           "rememberMeSupport": {
             "type": "boolean"
           },
diff --git a/api/src/main/java/run/halo/app/core/extension/AuthProvider.java b/api/src/main/java/run/halo/app/core/extension/AuthProvider.java
index 256072b78a..8cf0aeadb0 100644
--- a/api/src/main/java/run/halo/app/core/extension/AuthProvider.java
+++ b/api/src/main/java/run/halo/app/core/extension/AuthProvider.java
@@ -6,7 +6,9 @@
 import io.swagger.v3.oas.annotations.media.Schema;
 import lombok.Data;
 import lombok.EqualsAndHashCode;
+import lombok.Getter;
 import lombok.ToString;
+import org.springframework.lang.NonNull;
 import run.halo.app.extension.AbstractExtension;
 import run.halo.app.extension.GVK;
 
@@ -55,19 +57,23 @@ public static class AuthProviderSpec {
         /**
          * Auth type: form or oauth2.
          */
-        private AuthType authType;
+        @Getter(onMethod_ = @NonNull)
+        @Schema(requiredMode = REQUIRED)
+        private AuthType authType = AuthType.OAUTH2;
 
         private String bindingUrl;
 
         private String unbindUrl;
 
-        private int priority;
-
         @Schema(requiredMode = NOT_REQUIRED)
         private SettingRef settingRef;
 
         @Schema(requiredMode = NOT_REQUIRED)
         private ConfigMapRef configMapRef;
+
+        public void setAuthType(AuthType authType) {
+            this.authType = (authType == null ? AuthType.OAUTH2 : authType);
+        }
     }
 
     @Data
@@ -89,7 +95,6 @@ public static class ConfigMapRef {
 
     public enum AuthType {
         FORM,
-        OAUTH2,
-        ;
+        OAUTH2
     }
 }
diff --git a/api/src/main/java/run/halo/app/extension/Unstructured.java b/api/src/main/java/run/halo/app/extension/Unstructured.java
index 6335fd198c..cf2902ed75 100644
--- a/api/src/main/java/run/halo/app/extension/Unstructured.java
+++ b/api/src/main/java/run/halo/app/extension/Unstructured.java
@@ -72,7 +72,7 @@ public MetadataOperator getMetadata() {
         return new UnstructuredMetadata();
     }
 
-    @EqualsAndHashCode(exclude = "version")
+    @EqualsAndHashCode(exclude = "tatersion")
     class UnstructuredMetadata implements MetadataOperator {
 
         @Override
diff --git a/api/src/main/java/run/halo/app/infra/SystemSetting.java b/api/src/main/java/run/halo/app/infra/SystemSetting.java
index 8475cc76eb..6339b54512 100644
--- a/api/src/main/java/run/halo/app/infra/SystemSetting.java
+++ b/api/src/main/java/run/halo/app/infra/SystemSetting.java
@@ -2,8 +2,9 @@
 
 import java.util.LinkedHashMap;
 import java.util.LinkedHashSet;
-import java.util.Set;
+import java.util.List;
 import lombok.Data;
+import lombok.experimental.Accessors;
 import org.springframework.boot.convert.ApplicationConversionService;
 import run.halo.app.extension.ConfigMap;
 import run.halo.app.infra.utils.JsonUtils;
@@ -113,7 +114,15 @@ public static class Menu {
     @Data
     public static class AuthProvider {
         public static final String GROUP = "authProvider";
-        private Set<String> enabled;
+        private List<AuthProviderState> states;
+    }
+
+    @Data
+    @Accessors(chain = true)
+    public static class AuthProviderState {
+        private String name;
+        private boolean enabled;
+        private int priority;
     }
 
     /**
diff --git a/application/src/main/java/run/halo/app/security/AuthProviderService.java b/application/src/main/java/run/halo/app/security/AuthProviderService.java
index 6bd8093dd9..8b99fd0403 100644
--- a/application/src/main/java/run/halo/app/security/AuthProviderService.java
+++ b/application/src/main/java/run/halo/app/security/AuthProviderService.java
@@ -19,6 +19,9 @@ public interface AuthProviderService {
 
     Mono<List<ListedAuthProvider>> listAll();
 
+    /**
+     * Return a list of enabled AuthProviders sorted by priority.
+     */
     Flux<AuthProvider> getEnabledProviders();
 
 }
diff --git a/application/src/main/java/run/halo/app/security/AuthProviderServiceImpl.java b/application/src/main/java/run/halo/app/security/AuthProviderServiceImpl.java
index d6838bd575..b971b7b255 100644
--- a/application/src/main/java/run/halo/app/security/AuthProviderServiceImpl.java
+++ b/application/src/main/java/run/halo/app/security/AuthProviderServiceImpl.java
@@ -1,27 +1,31 @@
 package run.halo.app.security;
 
+import java.time.Duration;
+import java.util.ArrayList;
 import java.util.Comparator;
 import java.util.HashMap;
-import java.util.HashSet;
 import java.util.List;
 import java.util.Map;
-import java.util.Set;
-import java.util.function.Consumer;
+import java.util.function.Function;
 import java.util.stream.Collectors;
+import lombok.Data;
 import lombok.RequiredArgsConstructor;
+import lombok.experimental.Accessors;
 import org.apache.commons.lang3.BooleanUtils;
 import org.apache.commons.lang3.StringUtils;
+import org.springframework.dao.OptimisticLockingFailureException;
 import org.springframework.lang.NonNull;
 import org.springframework.security.core.context.ReactiveSecurityContextHolder;
 import org.springframework.stereotype.Component;
 import reactor.core.publisher.Flux;
 import reactor.core.publisher.Mono;
+import reactor.core.scheduler.Schedulers;
+import reactor.util.retry.Retry;
 import run.halo.app.core.extension.AuthProvider;
 import run.halo.app.core.extension.UserConnection;
 import run.halo.app.extension.ConfigMap;
 import run.halo.app.extension.ExtensionUtil;
 import run.halo.app.extension.ListOptions;
-import run.halo.app.extension.Metadata;
 import run.halo.app.extension.MetadataUtil;
 import run.halo.app.extension.ReactiveExtensionClient;
 import run.halo.app.extension.index.query.QueryFactory;
@@ -42,17 +46,17 @@ public class AuthProviderServiceImpl implements AuthProviderService {
     @Override
     public Mono<AuthProvider> enable(String name) {
         return client.get(AuthProvider.class, name)
-            .flatMap(authProvider -> updateAuthProviderEnabled(enabled -> enabled.add(name))
+            .flatMap(authProvider -> updateAuthProviderEnabled(name, true)
                 .thenReturn(authProvider)
             );
     }
 
     @Override
     public Mono<AuthProvider> disable(String name) {
-        // privileged auth provider cannot be disabled
         return client.get(AuthProvider.class, name)
+            // privileged auth provider cannot be disabled
             .filter(authProvider -> !privileged(authProvider))
-            .flatMap(authProvider -> updateAuthProviderEnabled(enabled -> enabled.remove(name))
+            .flatMap(authProvider -> updateAuthProviderEnabled(name, false)
                 .thenReturn(authProvider)
             );
     }
@@ -62,50 +66,91 @@ public Mono<List<ListedAuthProvider>> listAll() {
         var listOptions = ListOptions.builder()
             .andQuery(ExtensionUtil.notDeleting())
             .build();
-        return client.listAll(AuthProvider.class, listOptions, ExtensionUtil.defaultSort())
-            .map(this::convertTo)
-            .collectList()
-            .flatMap(providers -> listMyConnections()
-                .map(connection -> connection.getSpec().getRegistrationId())
+        var allProvidersMono =
+            client.listAll(AuthProvider.class, listOptions, ExtensionUtil.defaultSort())
+                .map(this::convertTo)
                 .collectList()
-                .map(connectedNames -> providers.stream()
-                    .peek(provider -> {
-                        boolean isBound = connectedNames.contains(provider.getName());
-                        provider.setIsBound(isBound);
+                .subscribeOn(Schedulers.boundedElastic());
+
+        var boundProvidersMono = listMyConnections()
+            .map(connection -> connection.getSpec().getRegistrationId())
+            .collect(Collectors.toSet())
+            .subscribeOn(Schedulers.boundedElastic());
+
+        return Mono.zip(allProvidersMono, boundProvidersMono, fetchProviderStates())
+            .map(tuple3 -> {
+                var allProviders = tuple3.getT1();
+                var boundProviderNames = tuple3.getT2();
+                var stateMap = tuple3.getT3().stream()
+                    .collect(Collectors.toMap(SystemSetting.AuthProviderState::getName,
+                        Function.identity()));
+                return allProviders.stream()
+                    .peek(authProvider -> {
+                        authProvider.setIsBound(
+                            boundProviderNames.contains(authProvider.getName()));
+                        authProvider.setEnabled(false);
+                        // set enabled state and priority
+                        var state = stateMap.get(authProvider.getName());
+                        if (state != null) {
+                            authProvider.setEnabled(state.isEnabled());
+                            authProvider.setPriority(state.getPriority());
+                        }
                     })
-                    .collect(Collectors.toList())
-                )
-                .defaultIfEmpty(providers)
-            )
-            .flatMap(providers -> fetchEnabledAuthProviders()
-                .map(names -> providers.stream()
-                    .peek(provider -> {
-                        boolean enabled = names.contains(provider.getName());
-                        provider.setEnabled(enabled);
-                    })
-                    .collect(Collectors.toList())
-                )
-                .defaultIfEmpty(providers)
-            );
+                    .sorted(Comparator.comparingInt(ListedAuthProvider::getPriority)
+                        .thenComparing(ListedAuthProvider::getName))
+                    .toList();
+            });
     }
 
     @Override
     public Flux<AuthProvider> getEnabledProviders() {
-        return fetchEnabledAuthProviders().flatMapMany(enabledNames -> {
+        return fetchProviderStates().flatMapMany(states -> {
+            var namePriorityMap = states.stream()
+                // filter enabled providers
+                .filter(SystemSetting.AuthProviderState::isEnabled)
+                .collect(Collectors.toMap(SystemSetting.AuthProviderState::getName,
+                    SystemSetting.AuthProviderState::getPriority));
+
             var listOptions = ListOptions.builder()
-                .andQuery(QueryFactory.in("metadata.name", enabledNames))
+                .andQuery(QueryFactory.in("metadata.name", namePriorityMap.keySet()))
                 .andQuery(ExtensionUtil.notDeleting())
                 .build();
-            return client.listAll(AuthProvider.class, listOptions, ExtensionUtil.defaultSort());
+            return client.listAll(AuthProvider.class, listOptions, ExtensionUtil.defaultSort())
+                .map(provider -> new AuthProviderWithPriority()
+                    .setAuthProvider(provider)
+                    .setPriority(namePriorityMap.getOrDefault(
+                        provider.getMetadata().getName(), 0)
+                    )
+                )
+                .sort(AuthProviderWithPriority::compareTo)
+                .map(AuthProviderWithPriority::getAuthProvider);
         });
     }
 
-    private Mono<Set<String>> fetchEnabledAuthProviders() {
-        return client.fetch(ConfigMap.class, SystemSetting.SYSTEM_CONFIG)
-            .map(configMap -> {
-                SystemSetting.AuthProvider authProvider = getAuthProvider(configMap);
-                return authProvider.getEnabled();
-            });
+    @Data
+    @Accessors(chain = true)
+    static class AuthProviderWithPriority implements Comparable<AuthProviderWithPriority> {
+        private AuthProvider authProvider;
+        private int priority;
+
+        public String getName() {
+            return authProvider.getMetadata().getName();
+        }
+
+        @Override
+        public int compareTo(@NonNull AuthProviderWithPriority o) {
+            return Comparator.comparingInt(AuthProviderWithPriority::getPriority)
+                .thenComparing(AuthProviderWithPriority::getName)
+                .compare(this, o);
+        }
+    }
+
+    private Mono<List<SystemSetting.AuthProviderState>> fetchProviderStates() {
+        return fetchSystemConfigMap()
+            .map(AuthProviderServiceImpl::getAuthProviderConfig)
+            .map(SystemSetting.AuthProvider::getStates)
+            .defaultIfEmpty(List.of())
+            .subscribeOn(Schedulers.boundedElastic());
     }
 
     Flux<UserConnection> listMyConnections() {
@@ -121,32 +166,6 @@ Flux<UserConnection> listMyConnections() {
             });
     }
 
-    private static Comparator<AuthProvider> defaultComparator() {
-        return Comparator.comparing((AuthProvider item) -> item.getSpec().getPriority())
-            .thenComparing(item -> item.getMetadata().getName())
-            .thenComparing(item -> item.getMetadata().getCreationTimestamp());
-    }
-
-    private Mono<ConfigMap> updateAuthProviderEnabled(Consumer<Set<String>> consumer) {
-        return client.fetch(ConfigMap.class, SystemSetting.SYSTEM_CONFIG)
-            .switchIfEmpty(Mono.defer(() -> {
-                ConfigMap configMap = new ConfigMap();
-                configMap.setMetadata(new Metadata());
-                configMap.getMetadata().setName(SystemSetting.SYSTEM_CONFIG);
-                configMap.setData(new HashMap<>());
-                return client.create(configMap);
-            }))
-            .flatMap(configMap -> {
-                SystemSetting.AuthProvider authProvider = getAuthProvider(configMap);
-                consumer.accept(authProvider.getEnabled());
-
-                final Map<String, String> data = configMap.getData();
-                data.put(SystemSetting.AuthProvider.GROUP,
-                    JsonUtils.objectToJson(authProvider));
-                return client.update(configMap);
-            });
-    }
-
     private ListedAuthProvider convertTo(AuthProvider authProvider) {
         return ListedAuthProvider.builder()
             .name(authProvider.getMetadata().getName())
@@ -159,6 +178,7 @@ private ListedAuthProvider convertTo(AuthProvider authProvider) {
             .bindingUrl(authProvider.getSpec().getBindingUrl())
             .unbindingUrl(authProvider.getSpec().getUnbindUrl())
             .supportsBinding(supportsBinding(authProvider))
+            .authType(authProvider.getSpec().getAuthType())
             .isBound(false)
             .enabled(false)
             .privileged(privileged(authProvider))
@@ -176,7 +196,7 @@ private boolean privileged(AuthProvider authProvider) {
     }
 
     @NonNull
-    private static SystemSetting.AuthProvider getAuthProvider(ConfigMap configMap) {
+    private static SystemSetting.AuthProvider getAuthProviderConfig(ConfigMap configMap) {
         if (configMap.getData() == null) {
             configMap.setData(new HashMap<>());
         }
@@ -190,10 +210,41 @@ private static SystemSetting.AuthProvider getAuthProvider(ConfigMap configMap) {
             authProvider =
                 JsonUtils.jsonToObject(providerGroup, SystemSetting.AuthProvider.class);
         }
-
-        if (authProvider.getEnabled() == null) {
-            authProvider.setEnabled(new HashSet<>());
+        if (authProvider.getStates() == null) {
+            authProvider.setStates(new ArrayList<>());
         }
+
         return authProvider;
     }
+
+    private Mono<ConfigMap> updateAuthProviderEnabled(String name, boolean enabled) {
+        return Mono.defer(() -> fetchSystemConfigMap()
+                .flatMap(configMap -> {
+                    var providerConfig = getAuthProviderConfig(configMap);
+                    var stateToFoundOpt = providerConfig.getStates()
+                        .stream()
+                        .filter(state -> state.getName().equals(name))
+                        .findFirst();
+                    if (stateToFoundOpt.isEmpty()) {
+                        var state = new SystemSetting.AuthProviderState()
+                            .setName(name)
+                            .setEnabled(enabled);
+                        providerConfig.getStates().add(state);
+                    } else {
+                        stateToFoundOpt.get().setEnabled(enabled);
+                    }
+
+                    configMap.getData().put(SystemSetting.AuthProvider.GROUP,
+                        JsonUtils.objectToJson(providerConfig));
+
+                    return client.update(configMap);
+                })
+            )
+            .retryWhen(Retry.backoff(5, Duration.ofMillis(100))
+                .filter(OptimisticLockingFailureException.class::isInstance));
+    }
+
+    Mono<ConfigMap> fetchSystemConfigMap() {
+        return client.fetch(ConfigMap.class, SystemSetting.SYSTEM_CONFIG);
+    }
 }
diff --git a/application/src/main/java/run/halo/app/security/ListedAuthProvider.java b/application/src/main/java/run/halo/app/security/ListedAuthProvider.java
index e0484ff576..7fdd1258f7 100644
--- a/application/src/main/java/run/halo/app/security/ListedAuthProvider.java
+++ b/application/src/main/java/run/halo/app/security/ListedAuthProvider.java
@@ -5,6 +5,7 @@
 import io.swagger.v3.oas.annotations.media.Schema;
 import lombok.Builder;
 import lombok.Data;
+import run.halo.app.core.extension.AuthProvider;
 
 /**
  * A listed value object for {@link run.halo.app.core.extension.AuthProvider}.
@@ -35,11 +36,15 @@ public class ListedAuthProvider {
 
     String unbindingUrl;
 
+    AuthProvider.AuthType authType;
+
     Boolean isBound;
 
     Boolean enabled;
 
+    int priority;
+
     Boolean supportsBinding;
-    
+
     Boolean privileged;
 }
diff --git a/application/src/main/java/run/halo/app/security/preauth/PreAuthLoginEndpoint.java b/application/src/main/java/run/halo/app/security/preauth/PreAuthLoginEndpoint.java
index 641267d495..4905ae2c2b 100644
--- a/application/src/main/java/run/halo/app/security/preauth/PreAuthLoginEndpoint.java
+++ b/application/src/main/java/run/halo/app/security/preauth/PreAuthLoginEndpoint.java
@@ -61,14 +61,21 @@ RouterFunction<ServerResponse> preAuthLoginEndpoints() {
                 var publicKey = cryptoService.readPublicKey()
                     .map(key -> Base64.getEncoder().encodeToString(key));
                 var globalInfo = globalInfoService.getGlobalInfo().cache();
-                var loginMethod = request.queryParam("method").orElse("local");
                 var authProviders = authProviderService.getEnabledProviders().cache();
-                var authProvider = authProviders
-                    .filter(ap -> Objects.equals(loginMethod, ap.getMetadata().getName()))
-                    .next()
-                    .switchIfEmpty(Mono.error(() -> new ServerWebInputException(
-                        "Invalid login method " + loginMethod)
-                    ))
+
+                var allFormProviders = authProviders
+                    .filter(ap -> AuthProvider.AuthType.FORM.equals(ap.getSpec().getAuthType()))
+                    .cache();
+
+                var authProvider = Mono.justOrEmpty(request.queryParam("method"))
+                    .flatMap(method -> allFormProviders
+                        .filter(ap -> Objects.equals(method, ap.getMetadata().getName()))
+                        .next()
+                        .switchIfEmpty(Mono.error(
+                            () -> new ServerWebInputException("Invalid login method " + method))
+                        )
+                    )
+                    .switchIfEmpty(allFormProviders.next())
                     .cache();
 
                 var fragmentTemplateName = authProvider.map(ap -> {
@@ -83,9 +90,12 @@ RouterFunction<ServerResponse> preAuthLoginEndpoints() {
                 var socialAuthProviders = authProviders
                     .filter(ap -> !AuthProvider.AuthType.FORM.equals(ap.getSpec().getAuthType()))
                     .cache();
-                var formAuthProviders = authProviders
-                    .filter(ap -> AuthProvider.AuthType.FORM.equals(ap.getSpec().getAuthType()))
-                    .filter(ap -> !Objects.equals(loginMethod, ap.getMetadata().getName()))
+                var formAuthProviders = allFormProviders
+                    .filterWhen(ap -> authProvider
+                        .map(provider -> !Objects.equals(provider.getMetadata().getName(),
+                            ap.getMetadata().getName())
+                        )
+                    )
                     .cache();
 
                 return serverRequestCache.saveRequest(exchange).then(Mono.defer(() ->
diff --git a/application/src/test/java/run/halo/app/security/AuthProviderServiceImplTest.java b/application/src/test/java/run/halo/app/security/AuthProviderServiceImplTest.java
index 3c25919ed7..a0bbd463ad 100644
--- a/application/src/test/java/run/halo/app/security/AuthProviderServiceImplTest.java
+++ b/application/src/test/java/run/halo/app/security/AuthProviderServiceImplTest.java
@@ -9,7 +9,6 @@
 import static org.mockito.Mockito.when;
 
 import java.util.HashMap;
-import java.util.Set;
 import org.json.JSONException;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.ExtendWith;
@@ -48,7 +47,7 @@ class AuthProviderServiceImplTest {
     AuthProviderServiceImpl authProviderService;
 
     @Test
-    void testEnable() {
+    void testEnable() throws JSONException {
         // Create a test auth provider
         AuthProvider authProvider = createAuthProvider("github");
         when(client.get(eq(AuthProvider.class), eq("github"))).thenReturn(Mono.just(authProvider));
@@ -56,10 +55,7 @@ void testEnable() {
         ArgumentCaptor<ConfigMap> captor = ArgumentCaptor.forClass(ConfigMap.class);
         when(client.update(captor.capture())).thenReturn(Mono.empty());
 
-        ConfigMap configMap = new ConfigMap();
-        configMap.setData(new HashMap<>());
-        when(client.fetch(eq(ConfigMap.class), eq(SystemSetting.SYSTEM_CONFIG)))
-            .thenReturn(Mono.just(configMap));
+        pileSystemConfigMap();
 
         // Call the method being tested
         authProviderService.enable("github")
@@ -68,51 +64,59 @@ void testEnable() {
             .verifyComplete();
 
         ConfigMap value = captor.getValue();
-        String providerSettingStr = value.getData().get(SystemSetting.AuthProvider.GROUP);
-        Set<String> enabled =
-            JsonUtils.jsonToObject(providerSettingStr, SystemSetting.AuthProvider.class)
-                .getEnabled();
-        assertThat(enabled).containsExactly("github");
+        JSONAssert.assertEquals("""
+                {
+                    "states": [
+                        {
+                            "name": "github",
+                            "enabled": true,
+                            "priority": 0
+                        }
+                    ]
+                }
+                """,
+            value.getData().get(SystemSetting.AuthProvider.GROUP),
+            true);
         // Verify the result
         verify(client).get(AuthProvider.class, "github");
-        verify(client).fetch(eq(ConfigMap.class), eq(SystemSetting.SYSTEM_CONFIG));
     }
 
     @Test
-    void testDisable() {
+    void testDisable() throws JSONException {
         // Create a test auth provider
         AuthProvider authProvider = createAuthProvider("github");
         when(client.get(eq(AuthProvider.class), eq("github"))).thenReturn(Mono.just(authProvider));
 
         AuthProvider local = createAuthProvider("local");
         local.getMetadata().getLabels().put(AuthProvider.PRIVILEGED_LABEL, "true");
-        // when(client.list(eq(AuthProvider.class), any(), any())).thenReturn(Flux.just(local));
 
         ArgumentCaptor<ConfigMap> captor = ArgumentCaptor.forClass(ConfigMap.class);
         when(client.update(captor.capture())).thenReturn(Mono.empty());
 
-        ConfigMap configMap = new ConfigMap();
-        configMap.setData(new HashMap<>());
-        configMap.getData().put(SystemSetting.AuthProvider.GROUP, "{\"enabled\":[\"github\"]}");
-        when(client.fetch(eq(ConfigMap.class), eq(SystemSetting.SYSTEM_CONFIG)))
-            .thenReturn(Mono.just(configMap));
+        pileSystemConfigMap();
 
         // Call the method being tested
         Mono<AuthProvider> result = authProviderService.disable("github");
 
         assertEquals(authProvider, result.block());
         ConfigMap value = captor.getValue();
-        String providerSettingStr = value.getData().get(SystemSetting.AuthProvider.GROUP);
-        Set<String> enabled =
-            JsonUtils.jsonToObject(providerSettingStr, SystemSetting.AuthProvider.class)
-                .getEnabled();
-        assertThat(enabled).isEmpty();
+        JSONAssert.assertEquals("""
+                {
+                    "states": [
+                        {
+                            "name": "github",
+                            "enabled": false,
+                            "priority": 0
+                        }
+                    ]
+                }
+                """,
+            value.getData().get(SystemSetting.AuthProvider.GROUP),
+            true);
         // Verify the result
         verify(client).get(AuthProvider.class, "github");
-        verify(client).fetch(eq(ConfigMap.class), eq(SystemSetting.SYSTEM_CONFIG));
     }
 
-
     @Test
     @WithMockUser(username = "admin")
     void listAll() {
@@ -129,11 +133,7 @@ void listAll() {
         when(client.listAll(same(UserConnection.class), any(ListOptions.class), any(Sort.class)))
             .thenReturn(Flux.empty());
 
-        ConfigMap configMap = new ConfigMap();
-        configMap.setData(new HashMap<>());
-        configMap.getData().put(SystemSetting.AuthProvider.GROUP, "{\"enabled\":[\"github\"]}");
-        when(client.fetch(eq(ConfigMap.class), eq(SystemSetting.SYSTEM_CONFIG)))
-            .thenReturn(Mono.just(configMap));
+        pileSystemConfigMap();
 
         authProviderService.listAll()
             .as(StepVerifier::create)
@@ -142,29 +142,36 @@ void listAll() {
                 try {
                     JSONAssert.assertEquals("""
                             [{
-                                "name": "github",
-                                "displayName": "github",
-                                "bindingUrl": "fake-binding-url",
-                                "enabled": true,
-                                "isBound": false,
-                                "supportsBinding": false,
-                                "privileged": false
-                            }, {
-                                "name": "gitlab",
-                                "displayName": "gitlab",
-                                "bindingUrl": "fake-binding-url",
-                                "enabled": false,
-                                "isBound": false,
-                                "supportsBinding": false,
-                                "privileged": false
-                            },{
-                            
-                                "name": "gitee",
-                                "displayName": "gitee",
-                                "enabled": false,
-                                "isBound": false,
-                                "supportsBinding": false,
-                                "privileged": false
+                                 "name": "gitee",
+                                 "displayName": "gitee",
+                                 "authType": "OAUTH2",
+                                 "isBound": false,
+                                 "enabled": false,
+                                 "priority": 0,
+                                 "supportsBinding": false,
+                                 "privileged": false
+                             },
+                             {
+                                 "name": "github",
+                                 "displayName": "github",
+                                 "bindingUrl": "fake-binding-url",
+                                 "authType": "OAUTH2",
+                                 "isBound": false,
+                                 "enabled": false,
+                                 "priority": 0,
+                                 "supportsBinding": false,
+                                 "privileged": false
+                             },
+                             {
+                                 "name": "gitlab",
+                                 "displayName": "gitlab",
+                                 "bindingUrl": "fake-binding-url",
+                                 "authType": "OAUTH2",
+                                 "isBound": false,
+                                 "enabled": false,
+                                 "priority": 0,
+                                 "supportsBinding": false,
+                                 "privileged": false
                             }]
                             """,
                         JsonUtils.objectToJson(result),
@@ -183,6 +190,14 @@ AuthProvider createAuthProvider(String name) {
         authProvider.getMetadata().setLabels(new HashMap<>());
         authProvider.setSpec(new AuthProvider.AuthProviderSpec());
         authProvider.getSpec().setDisplayName(name);
+        authProvider.getSpec().setAuthType(AuthProvider.AuthType.OAUTH2);
         return authProvider;
     }
+
+    void pileSystemConfigMap() {
+        ConfigMap configMap = new ConfigMap();
+        configMap.setData(new HashMap<>());
+        when(client.fetch(eq(ConfigMap.class), eq(SystemSetting.SYSTEM_CONFIG)))
+            .thenReturn(Mono.just(configMap));
+    }
 }
\ No newline at end of file
diff --git a/ui/console-src/modules/system/auth-providers/AuthProviders.vue b/ui/console-src/modules/system/auth-providers/AuthProviders.vue
index 416ba857e5..050f805157 100644
--- a/ui/console-src/modules/system/auth-providers/AuthProviders.vue
+++ b/ui/console-src/modules/system/auth-providers/AuthProviders.vue
@@ -1,19 +1,22 @@
 <script lang="ts" setup>
-import type { AuthProvider, ListedAuthProvider } from "@halo-dev/api-client";
-import { consoleApiClient, coreApiClient } from "@halo-dev/api-client";
+import type { ListedAuthProvider } from "@halo-dev/api-client";
+import {
+  AuthProviderSpecAuthTypeEnum,
+  consoleApiClient,
+} from "@halo-dev/api-client";
 import {
   IconLockPasswordLine,
-  VCard,
   VLoading,
   VPageHeader,
 } from "@halo-dev/components";
 import { useQuery } from "@tanstack/vue-query";
-import Fuse from "fuse.js";
-import { computed, ref } from "vue";
-import { VueDraggable } from "vue-draggable-plus";
-import AuthProviderListItem from "./components/AuthProviderListItem.vue";
+import { ref } from "vue";
+import AuthProvidersSection from "./components/AuthProvidersSection.vue";
+
+const SYSTEM_CONFIGMAP_AUTH_PROVIDER = "authProvider";
 
-const authProviders = ref<ListedAuthProvider[]>([]);
+const formAuthProviders = ref<ListedAuthProvider[]>([]);
+const oauth2AuthProviders = ref<ListedAuthProvider[]>([]);
 
 const { isLoading, refetch } = useQuery<ListedAuthProvider[]>({
   queryKey: ["auth-providers"],
@@ -23,26 +26,17 @@ const { isLoading, refetch } = useQuery<ListedAuthProvider[]>({
     return data;
   },
   onSuccess(data) {
-    authProviders.value = data;
-    fuse = new Fuse(data, {
-      keys: ["name", "displayName"],
-      useExtendedSearch: true,
-      threshold: 0.2,
-    });
+    formAuthProviders.value = data.filter(
+      (authProvider) =>
+        authProvider.authType === AuthProviderSpecAuthTypeEnum.Form
+    );
+    oauth2AuthProviders.value = data.filter(
+      (authProvider) =>
+        authProvider.authType === AuthProviderSpecAuthTypeEnum.Oauth2
+    );
   },
 });
 
-const keyword = ref("");
-let fuse: Fuse<ListedAuthProvider> | undefined = undefined;
-
-const searchResults = computed(() => {
-  if (!fuse || !keyword.value) {
-    return authProviders.value;
-  }
-
-  return fuse?.search(keyword.value).map((item) => item.item);
-});
-
 // Drag and drop
 const updating = ref(false);
 
@@ -50,29 +44,23 @@ async function onSortUpdate() {
   try {
     updating.value = true;
 
-    const { data: rawAuthProviders } =
-      await coreApiClient.auth.authProvider.listAuthProvider();
-
-    const authProviderNames = authProviders.value.map((item) => item.name);
+    const allAuthProviders = [
+      ...formAuthProviders.value,
+      ...oauth2AuthProviders.value,
+    ].filter(Boolean);
 
-    const sortedAuthProviders = authProviderNames
-      .map((name) => {
-        const authProvider = rawAuthProviders.items.find(
-          (item) => item.metadata.name === name
-        );
-        if (authProvider) {
-          authProvider.spec.priority = authProviderNames.indexOf(name);
-        }
-        return authProvider;
-      })
-      .filter(Boolean) as AuthProvider[];
-
-    for (const authProvider of sortedAuthProviders) {
-      await coreApiClient.auth.authProvider.updateAuthProvider({
-        name: authProvider.metadata.name,
-        authProvider: authProvider,
-      });
-    }
+    await consoleApiClient.configMap.system.updateSystemConfigByGroup({
+      group: SYSTEM_CONFIGMAP_AUTH_PROVIDER,
+      body: {
+        states: allAuthProviders.map((authProvider, index) => {
+          return {
+            name: authProvider.name,
+            enabled: authProvider.enabled,
+            priority: index,
+          };
+        }),
+      },
+    });
   } finally {
     await refetch();
     updating.value = false;
@@ -87,46 +75,25 @@ async function onSortUpdate() {
     </template>
   </VPageHeader>
 
-  <div class="m-0 md:m-4">
-    <VCard :body-class="['!p-0']">
-      <template #header>
-        <div class="block w-full bg-gray-50 px-4 py-3">
-          <div
-            class="relative flex flex-col items-start sm:flex-row sm:items-center"
-          >
-            <div class="flex w-full flex-1 sm:w-auto">
-              <FormKit
-                v-model="keyword"
-                :placeholder="$t('core.common.placeholder.search')"
-                type="text"
-              ></FormKit>
-            </div>
-          </div>
-        </div>
-      </template>
-      <VLoading v-if="isLoading" />
-      <Transition v-else appear name="fade">
-        <VueDraggable
-          v-model="authProviders"
-          ghost-class="opacity-50"
-          handle=".drag-element"
-          class="box-border h-full w-full divide-y divide-gray-100"
-          :class="{
-            'cursor-progress opacity-60': updating,
-          }"
-          role="list"
-          tag="ul"
-          :disabled="updating"
-          @update="onSortUpdate"
-        >
-          <li v-for="(authProvider, index) in searchResults" :key="index">
-            <AuthProviderListItem
-              :auth-provider="authProvider"
-              @reload="refetch"
-            />
-          </li>
-        </VueDraggable>
-      </Transition>
-    </VCard>
+  <div class="m-0 space-y-5 md:m-4">
+    <VLoading v-if="isLoading" />
+    <TransitionGroup v-else appear name="fade">
+      <AuthProvidersSection
+        :key="AuthProviderSpecAuthTypeEnum.Form"
+        v-model="formAuthProviders"
+        :title="$t('core.identity_authentication.list.types.form')"
+        :loading="updating"
+        @update="onSortUpdate"
+      />
+
+      <AuthProvidersSection
+        v-if="oauth2AuthProviders.length"
+        :key="AuthProviderSpecAuthTypeEnum.Oauth2"
+        v-model="oauth2AuthProviders"
+        :title="$t('core.identity_authentication.list.types.oauth2')"
+        :loading="updating"
+        @update="onSortUpdate"
+      />
+    </TransitionGroup>
   </div>
 </template>
diff --git a/ui/console-src/modules/system/auth-providers/components/AuthProvidersSection.vue b/ui/console-src/modules/system/auth-providers/components/AuthProvidersSection.vue
new file mode 100644
index 0000000000..4e9ff02e04
--- /dev/null
+++ b/ui/console-src/modules/system/auth-providers/components/AuthProvidersSection.vue
@@ -0,0 +1,48 @@
+<script setup lang="ts">
+import type { ListedAuthProvider } from "@halo-dev/api-client";
+import { VCard } from "@halo-dev/components";
+import { useQueryClient } from "@tanstack/vue-query";
+import { VueDraggable } from "vue-draggable-plus";
+import AuthProviderListItem from "./AuthProviderListItem.vue";
+
+const queryClient = useQueryClient();
+
+const modelValue = defineModel<ListedAuthProvider[]>({ default: [] });
+
+const { loading = false } = defineProps<{
+  loading?: boolean;
+  title: string;
+}>();
+
+const emit = defineEmits<{
+  (e: "update"): void;
+}>();
+
+function onReload() {
+  queryClient.invalidateQueries({ queryKey: ["auth-providers"] });
+}
+</script>
+<template>
+  <VCard :title="title" :body-class="['!p-0']">
+    <VueDraggable
+      v-model="modelValue"
+      ghost-class="opacity-50"
+      handle=".drag-element"
+      class="box-border h-full w-full divide-y divide-gray-100"
+      :class="{
+        'cursor-progress opacity-60': loading,
+      }"
+      role="list"
+      tag="ul"
+      :disabled="loading"
+      @update="emit('update')"
+    >
+      <li v-for="authProvider in modelValue" :key="authProvider.name">
+        <AuthProviderListItem
+          :auth-provider="authProvider"
+          @reload="onReload"
+        />
+      </li>
+    </VueDraggable>
+  </VCard>
+</template>
diff --git a/ui/console-src/modules/system/auth-providers/module.ts b/ui/console-src/modules/system/auth-providers/module.ts
index a2cb8d910c..80205ac469 100644
--- a/ui/console-src/modules/system/auth-providers/module.ts
+++ b/ui/console-src/modules/system/auth-providers/module.ts
@@ -16,6 +16,7 @@ export default definePlugin({
           meta: {
             title: "core.identity_authentication.title",
             searchable: true,
+            permissions: ["*"],
           },
         },
         {
@@ -24,6 +25,7 @@ export default definePlugin({
           component: AuthProviderDetail,
           meta: {
             title: "core.identity_authentication.detail.title",
+            permissions: ["*"],
           },
         },
       ],
diff --git a/ui/console-src/modules/system/users/UserList.vue b/ui/console-src/modules/system/users/UserList.vue
index e438fc298d..788234a3b6 100644
--- a/ui/console-src/modules/system/users/UserList.vue
+++ b/ui/console-src/modules/system/users/UserList.vue
@@ -292,12 +292,14 @@ function onGrantPermissionModalClose() {
           </template>
           {{ $t("core.user.actions.roles") }}
         </VButton>
-        <VButton :route="{ name: 'AuthProviders' }" size="sm" type="default">
-          <template #icon>
-            <IconLockPasswordLine class="h-full w-full" />
-          </template>
-          {{ $t("core.user.actions.identity_authentication") }}
-        </VButton>
+        <HasPermission :permissions="['*']">
+          <VButton :route="{ name: 'AuthProviders' }" size="sm" type="default">
+            <template #icon>
+              <IconLockPasswordLine class="h-full w-full" />
+            </template>
+            {{ $t("core.user.actions.identity_authentication") }}
+          </VButton>
+        </HasPermission>
         <VButton
           v-permission="['system:users:manage']"
           type="secondary"
diff --git a/ui/packages/api-client/src/models/auth-provider-spec.ts b/ui/packages/api-client/src/models/auth-provider-spec.ts
index 7933629f01..6a83cb797b 100644
--- a/ui/packages/api-client/src/models/auth-provider-spec.ts
+++ b/ui/packages/api-client/src/models/auth-provider-spec.ts
@@ -31,7 +31,7 @@ export interface AuthProviderSpec {
      * @type {string}
      * @memberof AuthProviderSpec
      */
-    'authType'?: AuthProviderSpecAuthTypeEnum;
+    'authType': AuthProviderSpecAuthTypeEnum;
     /**
      * Authentication url of the auth provider
      * @type {string}
@@ -80,12 +80,6 @@ export interface AuthProviderSpec {
      * @memberof AuthProviderSpec
      */
     'method'?: string;
-    /**
-     * 
-     * @type {number}
-     * @memberof AuthProviderSpec
-     */
-    'priority'?: number;
     /**
      * 
      * @type {boolean}
diff --git a/ui/packages/api-client/src/models/listed-auth-provider.ts b/ui/packages/api-client/src/models/listed-auth-provider.ts
index b684d9b3c5..4cc81669ed 100644
--- a/ui/packages/api-client/src/models/listed-auth-provider.ts
+++ b/ui/packages/api-client/src/models/listed-auth-provider.ts
@@ -20,6 +20,12 @@
  * @interface ListedAuthProvider
  */
 export interface ListedAuthProvider {
+    /**
+     * 
+     * @type {string}
+     * @memberof ListedAuthProvider
+     */
+    'authType'?: ListedAuthProviderAuthTypeEnum;
     /**
      * 
      * @type {string}
@@ -74,6 +80,12 @@ export interface ListedAuthProvider {
      * @memberof ListedAuthProvider
      */
     'name': string;
+    /**
+     * 
+     * @type {number}
+     * @memberof ListedAuthProvider
+     */
+    'priority'?: number;
     /**
      * 
      * @type {boolean}
@@ -100,3 +112,11 @@ export interface ListedAuthProvider {
     'website'?: string;
 }
 
+export const ListedAuthProviderAuthTypeEnum = {
+    Form: 'FORM',
+    Oauth2: 'OAUTH2'
+} as const;
+
+export type ListedAuthProviderAuthTypeEnum = typeof ListedAuthProviderAuthTypeEnum[keyof typeof ListedAuthProviderAuthTypeEnum];
+
+
diff --git a/ui/src/locales/en.yaml b/ui/src/locales/en.yaml
index 3758022cf4..1936b5beb5 100644
--- a/ui/src/locales/en.yaml
+++ b/ui/src/locales/en.yaml
@@ -1140,6 +1140,10 @@ core:
         local: Login with credentials
       description:
         local: Default login method built into Halo
+    list:
+      types:
+        form: Basic Authentication Method
+        oauth2: Third-party Authentication Method
     detail:
       title: Identity authentication detail
       fields:
diff --git a/ui/src/locales/zh-CN.yaml b/ui/src/locales/zh-CN.yaml
index 9eedf9bc02..b59738465b 100644
--- a/ui/src/locales/zh-CN.yaml
+++ b/ui/src/locales/zh-CN.yaml
@@ -1068,6 +1068,10 @@ core:
         local: 账号密码登录
       description:
         local: Halo 内置的默认登录方式
+    list:
+      types:
+        form: 基础认证方式
+        oauth2: 三方认证方式
     detail:
       title: 身份认证详情
       fields:
diff --git a/ui/src/locales/zh-TW.yaml b/ui/src/locales/zh-TW.yaml
index 3fa9e5a16b..fed0c13f2a 100644
--- a/ui/src/locales/zh-TW.yaml
+++ b/ui/src/locales/zh-TW.yaml
@@ -1045,6 +1045,10 @@ core:
         local: 帳號密碼登入
       description:
         local: Halo 內建的默認登入方式
+    list:
+      types:
+        form: 基礎認證方式
+        oauth2: 三方認證方式
     detail:
       title: 身份認證詳情
       fields:

From f7b2dcf9fcd55d5bdfbf9652f51afeffc27b9274 Mon Sep 17 00:00:00 2001
From: Ryan Wang <i@ryanc.cc>
Date: Mon, 14 Oct 2024 12:25:35 +0800
Subject: [PATCH 147/185] chore: bump preset theme version (#6860)

Signed-off-by: Ryan Wang <i@ryanc.cc>
---
 .../src/main/resources/themes/theme-earth.zip | Bin 371688 -> 372494 bytes
 1 file changed, 0 insertions(+), 0 deletions(-)

diff --git a/application/src/main/resources/themes/theme-earth.zip b/application/src/main/resources/themes/theme-earth.zip
index b636c959438fe2734476f2533716f671182c458a..e5aa61ee31883e1b38f7c463a2b4418691954fb4 100644
GIT binary patch
delta 56010
zcmZs?1C-=R+P+=3*=5_dZQHiZ?6Pg!c9+#<yUVt#%lu|%_Iv-kGn+am^NuGn;$%D#
zSKRT-lNF5EEev=?8Bj1ZAgDj?5JvI|@C2}Q8E_W=ekKXI;x(u`fFk@MX#xHF7RQ}5
z2m0-A#qa?-S}HhWcz|OS*<Up^2SS$p4wZKcrR=NJ8i{)4HO0zQYBJWv2t`<4=BAVU
z4eVv`!<~<TF%9tF)}IB3&kf}x7+BJB-_hs!!dMqZBm?CRLn@fTH$T4IzT!R!HtiIJ
zwngM5DiafG;X&G!L4y2DB&ke`jV!-OQaz>=0K)+KfHL@{lm)TONsGWH7{LR~la;+0
zrR(~5v6w2Y&2rv}rKl>(E0(0i6Z?a;*}B-FzY>C+#TyaqwXZ3H*o9fMN6HCNn~~0D
zq<(*6W==#fOXtwm+vTRNv^O;q^%u1WpEPEe;dWTAX-D@k;bA9vsReG2REor=Hf0c7
zTZ#k(92Qs*%b9Wk7pr`Y=?lELGF#xwcHqDs_49^)xiS;r&_O5&ubqXn{*-9M05lLd
z+?={r<6()vN-GX?pE}4-ueTYzBtMRiC{Vx#)MIdDzi3&wje9Tl^=fvqnETD~c9>lD
zGU712`OGOm2ZAg%?w2bD&*`foJ%Qu08PEbaI36=`2(mcZE-&HFZ(*u9@vs<e2uX(Z
z8t*Pr+<KDH)B->fTcmuvFsnwrIL>9l;|M`Pjb%vLsetanb)*p;<F48qLn`A0Eh4a>
zCQqkCj)x1n`PVmm37Nsg4I{Kgi+;)TkG#J4$?5>U-P{y!>-AiW)ff~%<BrB5W99?U
z8iz%}@8|@1E#c%{nIcUXucpA?c6pW!6|vBK>Qi3Umuu|WmL1R7dUz)UD?qgB$+|ZO
z%cAN?DnUT?1%g0|8G7Oiiztmk1{wBuKNCA=H7U&87F86eBgcWhL5!x2E52+?52y%p
zl*;J9Z@Zr=f$W!rL5mIkQZVGPVt59eol3&VgW^dT@m(67pMv0mtF215SjfTqak)~l
zJ)2oOTJCJ4YaT@M)s0s!cmIrlTK^1ADO$-k6ND|qSI~d2brkT<h3}NMu_$S8Kbrm;
zmoEEiQo7y`qslfq7;!#xGjH%xW2)~q^ONUN5wPUck?2Vy_xA3}xUht)fq4V$aVaXP
zyU-aRzlNV)UbztN?mZ-O=Pv!uq@GySU1C%f8|}NLezaWPut(CsJjxPS>Co=Bmu(Id
zm%)2m9-Dtb;Z#`gy!@HUm9_UAptEi*&)}?9qi_O2>v1`?`B65tM0Pyb;PS4DglE-f
zN&5>xU?3V?3)IX6ytLIEFD(ujN}OBCDlGtUHU%VqSB7hiQ1o2BkF&q*tI5%Bk+ZR1
z*55#bPAs~TL_w9&pRTe4q>05)b?jwWRk?p-sT!qzga3Zuq?>;4QFA9iv_G?yz3A%>
zX`vffjEz-d9jm~PB1`GV#!DL`tGZYSL0tmPulS>b#dg#BFf;PQ@@^S0l#$c<MCvs1
z$ls(7f^A{ESDf@}0^4+CK3T-U#}J)m<2@Ie!4=Mli!u5QH*j1_b@o(|_~M}*)iu>=
zM-)9nzn%27(mZ}@#5H*MJfffb-H`5***O2g26qon7881<q8FZ)(AKe802|yZT}5qe
zSGQZ5<Gl}qbsy<awXz0~ukIpPfQ@dLZ?j1;u3luG3sb2;UkALo{X*JII&e9PD!D%U
zya!|1dn8pOMiXx(_;%UmOD%p-bDQ}4ti1h>02oVx$&O1qs*0Gau>+Q5{SE7Qi$%zG
zuY#i*vs?27r#7E5c3tQxwgiX<dvd?BWyg+r`bZXk@lFuhWKSPp`K9sXx~%{5D?8i4
z9=9>p5^a>*2Wl^upEVBug?0HVx~0{wuDg{$z(c((+e^2g*G(UvgTUU8Tg!3#Qm51H
z{60oY!0pOmJx+dV-{SGEpqptVB@TiHi6KkAd>udbsJbal#?i_6Yd9gj&*TlI!J`$#
zDH!D;<7t&0(H<F)o91y@(rLbr%tadc%-5@W6p_a)*eF_SLWp<&_#_SSc}1=lI3?4O
zj(5i9{Fv8^?;e!keuY4c7o9Yj7Oy*-FYJ<qbU%7rmBGDuil#9-;x_)7EESvKYkZ7b
zREFmoeBY5Sy;Dx|Q`c>n5e$JRuz$%1F34#E*?OFnlDh{08kfi-jwZ6heFw#5W5eWJ
zD-sv)BFikExATjH68X(8&8r;9h0s+SID6Iel-*H(%dTd`$*(8o4HAksuDLUKLh1Lj
z3B?F9ZFix1CG)IuvFzN7NVo-EC3aw-KPXxe-|<>!^M0)3aJ^X1G|q~^xZ6|d#bKB+
zygI8J+88vz{bXaqs@B#8v8ISo*lM_Mpeh;b_@m*QETIQNVmJT!1uIH6*c{SIAFqj7
zbyNz(NU&*3xw-c|&l77S9}Vz96@R73DGb)~y8YY|FNkw194u75&hV;rx`fX1dEV43
zAN%^taj$>Vk7Nxig$4edVd{&`=Id)M9*-;zYxzq+x8@7wp_-0%W%T)36C`Kyyb@NL
z3)Mhq?it$k#%ZXIPue$5N>Na1FI#M>-C$E0pE{lpFc=L9m=h$j?6R4uK^{GlPetL9
zvsDv>kYy?`t*0xUC;b<JPKYTYtONjbV^_<D@2ils42h*JDHTutQt)tev1)<K_`u1>
zI~E)Oe3h%<MSQM7<-#mOQgRNYJ206^^Eq^>1WM%*N-^+GVmJZ$$r3M^>f1I5ZmLj^
zkI>o199_KtF<+gvYX@B@4b*TO&{u)FL?stHTolll4EWYFdnd$&&<M8&s~glB8}_ka
za%d-rcVH6NppN4<JfcTT$*C(nMHdHI9zic)R6*#yqw}O|;}Wl-at@ek^5Kf@f@h|J
ze-efoXwb)Cp{~D5t+@XevinNHw;34&KbEBZ#Yu1HEWN<50U;Vt@6&!Ar1K&8x3SDG
z;-9>kx7YZ7jJls34!kUg$JH%%U+lmZY|9r7UY_e6J|nzZ4+;>~Ng_Tbp}0_s95qP*
zvh(E*ow_HLCbwyXjSoco4?2y+9L-bLC;WmZ2BZCwnexh3KSj#L7(NebxHXHe`+NqT
zu6?Y^DS@fo?Z{^v!z;!C9vb0fyl7Waf~8l^qkhtDaZS$DM@ymz_wc+!=O#;g2)xh|
z&nkzqo{UV$s81<WcDZXel!jiy^~W_p13EeB#^P}7hI&(#A^yUBM=X%w52XBlOXs?Z
zeQ)uOpV-J4D2BC`C*s@D=>;`Dz6v4@Z$1WQAG*Vv9z5@E6uhV?lZ>PMh_j;)6!iAV
z)I;cPgZt6zs8`P=hzIG$R#V#VWb?3h0mpJdFw$YyI16ARakbE@@NU0MqWGu)(-TOR
z8&w2*(*^eLOY2UmIZ~+)Y=O*2<$1g@xP4ZlVi2f+{*95%LW*if%jach!Q0^v@jC+J
zLj}=zvfg=#kqrce&yCz!2cJZb*fQ?L!tU)lx2l1!Bxd^Yr(YgQJqF3wn1?(BcZI&!
zFjs}Xae;dO`ru9M1-~pV`5Mp+LZ4gGoLAxqE_!!#EeI^ek|g;Nf5RMNAmUgFslPev
zHsn66L5W=dNRw=j`uO{1h9>Vv$^utpY13G7$h1%DLVNiRmUNa|gMm3Kwj-HyQ4Q!1
zT+y0j*5-s7E!)wCuYiS9v{;{xpt}^>CFCPhgO91apW18J@Nox9(4GJgg>U6;rr*%{
zlH`4O5tEUbAtKLO0=g2fb|)*#sm1c4zBQF@Yqxkkjl9W!l(9H|GyI)l+TgR-S{OFz
zpE}Ie$)128)@}sV>|1f&t0)5rRr}=_*A4>&6vqt&^cN)m3xNNVg#Yy(28a&G)y&Q@
zi3=X~PbOyn3!nc$XPhL(04U6VllA}M^DZ$E5GoK|+Ef}i*54o+4{)fh6Sv=r?!Rr&
zzXa9-i8Y=(Hr?tp!UEk&b=TO>Z~LZ<2C7|1=T53bNM*ph-&O2qmk@>l{z{OzLfrkH
zN#FQ^$ww-trLmrLq0-S;OBTt?n|7`1`9niN1ixHPT&Xzm`E@Mi(<^Y6J3@s^X>Ktp
zdHleXRl7#LCz2gHCP@kbiL>X2f@k`OYOHbNZo6<&1QEBY>=2sVoX-<h+ISikye~_u
z*mV)`z|E82Gi65M&@)zK`A+>o)LT*l0tKKaJR&(%3Vkm4m66v1b~|zpGs*q|K@dKH
zH8_Jx<3yCYe?H_s<DGPD(fmge(~b<aeA@{GeD0p;ZqzN1+^nHv$3w1e&|R&dPg6Ri
zhjxsM5C*g@FiaR9?+2dwPugygz+n}IO89d2LRBwsZ_*RrGe1`WklKnwk~gnrLu$ad
z1t-xS{Xx|tVsV$2{B;20m}dtb2BHc@$?k$5c+c!8BfE3<rJ0K3NNJYQ)~lkCY$X$L
zuL!xoVFbib_RmCX8rqn#%5O|2h6VobmU3tCamQ-|{kL?W{mgE9^*KnXudtcQLTG+d
zLA$3jm(6qbTS{4II~`Mku&i`3Sd9R)29^AN_6Ib?dU1>k*a4ZLz)pB&UeMzFnOg^X
zK$N;??g$f%Gf{gVmPLhl>y8)pJW`zrtIm!ZSZomUJ8&X0a1{xeB+N7z`4AXJ7}sc#
z0sV*xnpKYcg=ls#C0McS_wZ;T^Y^CPU(|~g2h<&olZ|M7lDE92Hefj9D3E|f$0ou)
zMrGHUn`lXEsZ0%-d*=%-XYE5QDVapg1T9(c*bLQF;jWunp>0O1wxiBozmFpWfIDtX
zVN@c|tfg3*<l8q*rx=p=cdYruX%nQRgGif7#?Ja+AKz%UEX`}7c32jm`#mSkzI=Qy
zTu#=|IviizK{ezA>R-Y(xF`UzQvF;y;Df<{$JGAS{Pa@^(xaYHm2dL~2Rn-{<L3~I
zO$e^4Y6jR)-$<k*Dl{B#9P<)`<sm`_$yJg0uFmH!4c~TBXreyg%kKqt5S;MzdMElB
zj&OL3ti`Of^X14<S@dpFNYwi^!7)Oecg1pCONfQFD$&zHkd?idh>rkNzc3|xJht(E
z6KyH)CXq=}>l#+ldLVZyM&{%wB_QD)v|WOe|2(~<{w+cd?36XrOk4$9YZFzc**J?<
z426A8=dnJ2ljtXZ`|=~2Qd@z%H(v8{eNBABxfi*joBhE+TfNHb!oVBe{k-xMf6cqO
zhx%7j0(C$oQHViiJysk*1Sc9J(Do+GY;hxoFRZ~loyWr@W$bYxB&yQQ-DqHLL!U!+
zqu`(?y(?9{Ih~F;1Yvx(J|^lH*&w3B=lxPvFW@E5;S1{J8Ehj{8Zg~YU#a|J`T{5H
zeV<8oZ(AQA@O&tP8>;xi+dSywmQ^VSmqy^~Sn=S+w<cjeQd0%MLQ}dMHeeo&Ix%P7
zD*XC<Ky>JRkwD~0(VgR(^}Ph+{aM<oH2on%YQ;O!*<mPAG#pgi55}zV6a1O-K>CHL
z3y28gJHo)O6^;I)h~u<=KpSHPO(&7)9%`cwf`}L`Kh9_j7(N9#i7ZNDA~;?)|6;_`
zKs9pqd6g#TgXJh7pL#T9?=;sDoRq~*Yt#^~OJAHfZqPu}!g9X>i;nts&j@Tx{w_T>
znwO-T50gWC*~)_XH6ouH^VH_kMqERM%=vZJRn4^?$XUBQ6DxxhW)y}}{zW>zI=Vs8
zZR*E&6VY3f0EGP7gDp1FZCg-N>p3c5uRE}QVA|mOpgayhS9|%HVJp0l;IwZi?%*9^
zTJ435mvj^|=lZvT$@r<qREl#evuH}2?|JyKzK0vfc*t|3E2>TlKmE)K*~@59v(&CY
z7PE{xQQ5cQ5N&+7Fr6axYJ1;~4Yoets&XCYVLC}5m-%)J2D5+*vDac2N@C=Y4K~*@
zFPA%{NuB|4Xg?j9zoTMibDO-<Bz2%-1IHyTp|XSIYA3;?vC>_+Zd4aU;ySdmO7*CT
zu<3POw$)T_d)M&ubnis)d;29?`vk-9v43TQxli*X*`pBvz5{p>*5gd7Ah*B=Vuv`2
z>j)B4^No@Cv?|n`GTR63l`|vzw;yf4f^{&)?G!#<=<zJm)TXu=yd;fT#X3OVkzchY
z>Y`^yIu?Wl?Y3dpO*W4ew`E;|QSHLqeG0yA)Bq9FImOVpcs071=Ref>Jen!ids=On
zY+ed~*TxnBnB1G3RAmSSQxgdTfrKzD_g+_Sh;4dQZ9Muk_RrccY&=wT@XTAyTkG8F
zd7$&|Cu?7{iL?jnbbU==enDe9T0M&MU-XSNZEZ=?-Kg2gcF@7GAqB}Q$}fh=uE5y2
zqvxHeJ34J-KucfUz#woqb08+0lqSl07<UflcfK$IFljBh#Xx;Vm}ghGuX4d>Jby5y
z@kG{pf(PJN$qfq;Xf<Qm+VC8)6}KN%cg|3EX5<6YSX+!N73iKG>2;5&Tg99mZ;^1<
zHyXbND*V13_}0~B@<Jvl7~){WXp8C9`FNB|E?G0^o!@4iG#iU5Kzx^yFEi}IWy`Jt
zzOthL7)zv+W!N7zom(PA^{QN_D(49z0KJrG{?N9Y5?-!Gy8pi2mX%%ekW#;t_mewr
zSx7VuBvDcJ7-lJUCXU}R&d1yOVOqB&O5U7>4!9csD(&pT*w#UY`#gJd;`1nb(5wp7
z1C3e$^a^kvE^9RPBvz#7!;2CpAsXb&fQ?`T&`p=;^k*GM4D2EZjbRqM5YSSOO#kg9
zp(DTI+lev;v~eWl^Sq(ZHL!c-%#pEF>sa+L?_Ym9vDvo${&~5wt<GT1X7|f`4}nHJ
z%B+yyftb&A#C6LLoc+-qGLo-5Byth5)+GS%H-Yvi<iDVYU6J#P1{w(HUzG9(^uYW-
zYcL5Glj`rh(xi)N0Rj345+x1e{ZqumcLDuVj3J`_TO@wd4pHP^q8%CKKg1rg^}oby
zD!PA&cT}yQqW=rUaQ}^BwnnaIE({ibym}aU8JIg8S=gD`ySgx_slo$6{<pjNC!#_A
z8_|;L=xF}&ZJ_iQe>LTfiS{3&1oI*EpFL#Y{bytl?>HFhf8ru16c7;FALJ*L1&;l<
zs_+0c>N580j7XcuXw^uBblBRh`}ZW8t6-ZL-9kc9&7$dO;E9o!*ki~Yr&!)G_+^3)
zb3{~QiABXwiVUPPX%6OFv-&-S)J<=Z1q0GfF0HP0EWz%|$>a@U*yzjZ<PrOq?mP`c
z`po^K-i5CC0a<h?Q`ADtsp5!`6_#}A5#WH;s<lGWTPXt_dvFn|j_2R|E7#Wo$l{nM
zbld{p>{ox{Tr(*3H-qFgV(g)qRW?^Q6AIua7AJI}7UV2wQ%$&1V9T#Yo{*O&Ty^TU
z1%BHX)a`1Io3;mfL+Psv9%rwOY$0z4Yh$&3CpiX@Pu?z=94bvvcay>z;t5da+QI+;
z5vX|vP|jt6v5F&2+=QJrM}(XhFGEbA_Xww6(&mc1V<Yq@D(O!kUC|Nsv;7Q{r`tDP
zE;$3%f^8MK3Sc2qlm`;^IFQndHf0>d&DWp|$bEA->N&nroaRXeV#r5(=@sm_mroLx
zTZ^dBWG~nNB6`e=Fm;4WW+cd7q9FmSWD`F*ntkJiO(7&nDsqk`#S16Cj?l2A@ZK|4
z#K0Agr9<l4z~y0dB5v+qg`HZig(!m|Th!)6o#P5R>!}5!;-IJyA)}yPWC{^VddB-L
zBHV{+<p@y>(vb<13VsdbEke<(oEb>e<ybq0Zy;C37kPQZR{2=V0$yMp6(b4==`i6w
z4WlI_wG7f29N$4Ue?-s?)%Dx9hIrxDaaG>7g2it_$r2X9xxH8F?BYoCI=6e~2(|d#
z3hN0kb1`D%%AOsn*bb9KJb)kvT3g@=W&j727e?n5(dLQ$XvH4u!y3`1T67i*rM_YY
zu?fcm9&~=4yz;W^XL~%mUcU<1|7^?K+T)vxniJF<J`+fB3ijs%@w-(%nKaGRNUgdH
zna#_*PWKjVj~?4`#`dP&e<Z)8-|ZP}oUO&ZVu%Zba;qwSgMLv>Off`*T4lCH9K>Cf
zXfu+S_m=0+stcRU*!7rOPw1VSFGq2ko`_(PGt@_3yGbma!>mJiGpS*dFGBg2m`f1&
zc6xSCebMvy2K3bam3M>ruSv-ntBe!{6bR^F3G`pb6-l0=|C}GDMU%n*OiDB9zh;*I
z-jTumsSQX|{F#FPOT(8T{~sFE|4kEKGE9F@-==w)YEbz9O!lTEM@OurVg<~<7X_54
zO#Ca;yPjw;WPw@)DPLyM$_=r*?`K7NiGC^5L@`mp9E`_tU$vzv<7v6mgFBO?vhWP9
z9wuhpr9F6qp4PK$P$GA;Tjt@aK?wDKB;YtF+iWkJ=d5h8g!m$GM=U{pH#2J$N$P1q
zD?)i1;jtke+4y-~yFWO>b+{n)9ni|TgF7*!sIxZcLa@3BSy3T}g2b~(`g8{?szJVJ
zoGc~mG7-$J#V(65Zu(GDlMrwW3WuhGcmyH61^M<fELM<eRGR>I?Sk}ZhkO>@*WKrF
zrrDw$!81NC3Y^tnrl4!Fr&K${NM)MdUGB`iWFVAIj+u@-(^Vbyifu;;6VMsEW?h)h
znj=#@_fGyosXjrhREh+X9ZR+L2q0!cSaD5)VumDpY!nuMaK0ZKi35II(6F4qwkr-x
z&=6*ypz{IxV~ZXWH!08HaJT3e&ObVx<pjHhb<MLE<gkX_t+e+VaVq0@a!S6L)dIJ;
z+T1Pu&c$u;a4LajLhfv1$x5*~OL2;xwhD*JRp)WLX8Er6C3-aU=a!#lz3C<y7zn88
zkHPl0fu_Xy_aCz9m(tc>OGCSwz&}JnbxN>5N1BW_%Rj_Y?bg2{4fJ{cAr9&b|0O~h
zv;RXhH&**=aQ9en{6oaEL<ae<qq;DHBm~!QX|4I-NPjDg573%$US~(!Jf>0PVrgX|
zqN1tTw<hKAlkXgJoxkEkf=&n*iU${*s2uso`xNi3#snfDd?2)wxFXlrL>u#Q%7f(8
zXfjKsB950Xb>$-H?oxr4iXbrel``4pzc0~d2|RLfwXLn4j=h$kG}Rn`p;X&i{YGc(
zkfJE2*z-uQ2nZf}K(m($MZcvV-k&>!4K_#at|+nR(=CT9d0y7>y0*s}cj#`DEL|WY
zX?sOYE}4ggURmycQV3CXZGXfNt%2GNA5uZ$;>Z-@5RV|-5uE+j3KSx)BcoPQHV4NL
zyNO;rAe`bY#3HwUhr*_`mmw^n3_Wggs`8?eS@kg13Ycx6otD2=BA-Pdf?iH>h}m!}
zhVm#8>5b{hDb!v}sLsaR!twmX6zwfRXDMmHmJ&lJX|Yt~p>>(;d?huSpf)9+yHS?p
z&8-2OP9Sa@&k{sQ!_vqlrP4E{Z8S5?T@`-z-e?pPSUoIksCjI#v$C_yr=$B#uyY53
z#-NFz59lplq2eT23rq6|VkWoDF0V?y0l5qH3WgZhg0?ZWGw#=o(@-Ug$MHm-5~}HW
z&bWgLHYw~e0Q6CvGD(FMJ2<t$VQjTu0)Nb~jIFK1lUH@1+N~+SVZnBVUc_)Pb7RGM
zxFbmyS(RLOW${447jct<g_%kEgLlq0!$lcv0ur8z#KoW5e-Hg!Z2frSp(zsss;#Fk
zuFKotVRG6l1UpjHV%^6#ha+2sM_w3Sa_FP;sheFjN=7~J_+5A!sI-z<S=!kus(J*M
z1=mK~Q4PDI&Qv7lhFM*CSy{?p&}^eyM+rrVFy?#zq?aiMp6qRCGmxYu$pl)=Uc(0q
z1n{2{BR;#+6!D^E2IkiunW@B0<FHHJPSK)g!imQOW1#Lvs9bjq%7jV5qdW!bZRrL5
zBCj{2LZIp6aI9N{&Wt69oP!l+dfJa3NjI>n!TDHE&Z=n=t<aSZ>XR-_rbg<$6~VW?
z*Dw2ydol>J=EvWm%{W=76K{!mDp;r&1qgjXKWXo|9+?#v6tH(}0+zz$A_C+wInSh?
zaEp1h7+>oX?03=2k-+HqbT9Sv!V1DFG3Qgo7DP!OSC?_cWs$_KYHY{GugY$&h)>b4
z1yt57B~4U%#s&(&5-;~h()v?q21i68`#m&w7QR|nHg~J2`-L2uZYDS<*kT;00SZ#`
zRgC*t&?L+Td%skNe^_d@yP*YS2XCqrYvwpM3g_LxKf;P-e39^Sb1muI5umXjEUcV(
z!UIOip5*=8a5+1nomX7qn8=m+UlG`I<GfAMPDm0&H{wSndd+BvC4(`}uejANNz=`G
zD4%o9)|VV#U?tPZIDEb`T$mSz0SYq1$gU0Lw5eL{fPQlhA2_ZI+{o-cuVFzrU-vPn
z4d$JBxAqdXyrJrGGvIbeEEoIvyd!(;m`7C&mt+^B+92~we1D9}JG936QksYfHSb?A
z)<kwu4Y;vQyb&$mf^D^D3TX8p@pHMLorZiTUV5$7_DL2D_gybv9zj100kP&9mj!0<
zpKa4v2oxr&mHy^#L%S!m9P(HV`N;EMU5qC4S?PSA!g=ahS?1M-YcBI#+&_4N$cVks
zMT8&McN0+-_Cd#TF!(PSGff*~3ew#jO6ut6*cDa{>T!yHrg1?(%_W%5H`W^3ZNpJi
z;kjCAw;g$Bn9#ua1=lx)1Msh04>(4RPCo{r3X=i{<A2g|VF{y6T<pkC;tp8$Y821;
zS9R7+5$A+GzS7LV>VL$SaH+crVX4`WvZz~b8x)~~Ut@wnCk9#|7wX0l&NeEB5Y~ar
ztjm$&|JpeGF|@PAI5tQUsDCIzK+TJdM1A>*Y5E)pm&NrWkYKbk3b4FuPEdLX<<nY$
zv}dUe*0=kh-HEV$2+xDaUdmJ|U)GDO(!Pg4%dCs0%`pJhEoIFHQtMzxIA`PGLlf}h
z5A_C$UBe}=s^f97RNSCL!VGWw9mxEvJGxa3D$YdRXV~<L))zEC6cGon_Yp4qF(w?J
z$&)q&pV^lc!6S5&9)M$=L%?s5e14-?TeJtCg>pq7@mLqUp5!&#zE^LI#i_&VdV7({
z$ZtRVLrb{Eu9|DM!(_ML@{)KYRcPr*b3tEVcO>0>@qyr9ghqB?$G{H(1QbT_w}tcn
zZ11%{mQ>RJ*q|i=9Etw6CgC-WI-Uamxo9>!v;JL7LUOtJFTz?(f_MG<rjrt|3`|P0
z8(aJ=qHk%2DGm!}8I&(RFQUY`fprB(GCdi1VCi831?B7nvncnSP*CUKK&FllO$?jj
zOK#a-{sr@uGn>KLT)i_9_W%ixlum$P`>p%QKW?KaJn?&^4OD|6FC&4YY?3XI96yC}
zETl5imuZA5_n^-SNmp-JX*NATG5E=$NGkjoSp{t>^_h;81f|%8)}$Crid2PGj&T<k
zTr@k{(3Wx(h2ZM)bP1D_Fftl4PKmn+8oPjMH?fdqv#f9~yTX!pwlJT``=jCWn1dGh
zHk3&18U_QkVWS(kD9-3zsZU<UX&;<CLt2KY4C_LG17O_P=i+P8KNkkT%C_$KiCTGt
z=AK7)BlmL<`MsNOmS)X{eI;;V80C#sNi{!yvJyJ>8wdfKN~QldAw|*?SKb?lL%~$X
zRK<-pF%xE43#amwLBo(00*VUZl@b(M=)?FigAtaN4e*);B85RT*P<}#-SY;uCMz=C
z7|7m`xRh@xrOkH`qfM=V6qZC*{vz$rmNy+0);?DXby+9tCv;}Y4#o5^%S>_@#c%a+
z@x|-T8ylPJEP~@%q!jhbJ^hJf=~uO}*$(DX&b|ky`>eKm3FF`KHS1sFZ(p;ykPL8&
zz>-}<B~kK)zp|y&^7IjL&I}xEP_0pu&&-5?IBf!sk;XiW?Y6-H&=&AsLSWMG1DN-X
zJJjO2-X!PWhhhT*Lw`|;`IDPc-_V-9)QbBw)R<1_WksdvV~4v!^yIL<U5!|gTluHn
z3i8}u#kg~n9VEv>@+*+pJ?cCYcUz9q0dQyuO3GBfEhu=3|7OR8Z;LD){^k3rgGb3^
z@A=iBRI<FMNL|Pb;9BIfu;{LL4uh1P=G5vDF<xVefP&I^Y{q&BEB)BIN$%6q^+b{3
zz`B0y!oNTCc}Ct3$d5P=I@Y}4&B78KrOXMU8FXkX3!N+fRb(%eEE%~VTR@0P8m2wr
zwN7KG*r+(fy`cIto;G}D5k)!S9=h!Ls>Wp{Uuw1m#MYo1(4ZeLjB}-=shoE(%}sRo
z@&UOj9o^G(Z&f5K4g{y$!AOjnaR-;kUZ$dUbgwDYlewR@BYcqzj>a$naK;2#nU`lf
zjNgvZB%g=7b5e8xO8Sg}#c+u+Q15{ek(<DKD<4Unb$?$FP=lKc_~79{(oXjvjH|}w
zzaHHsKmSe*sGPOjlNi&uC|AbYZMCT}u`r;hWD`xeAh8BhB9`$jd`TiF6f8uTrGfJa
zp+29rsBqDHr!h}us&~-`5Yk#`^v`DW@)I9*xD^)4FJ)^v%};o;l&y5TDUfux{nDd2
zo=3}{{O&)layuJmDN6vt6$1E~?-9b=w%zRFZT8^_Fy*xbvI#PI!+man9uaf{MqWJf
zg_puoHywbD)Heo)T6j#KYdHE<$Wtq=L;JHBuLPa(e!+BHxc)tHfk>`dG44H_l<0l#
zkFzBgu^c;Tvgv)=?)QT;PN?!i8dvv*vee-mXA2cj&9|6wc$;i^tdmu#S#a&oZ>Xto
zWNL_KfZa}L+U;js-&47mavTTi6k%7@>vQ%#t>a$;T*QYLUcAqS51W`(0s<eO=f?uP
zZ|iZ}pP;xun39s94=n`z-_p|Z-aQ@;Ud|RM7;^dFKF=NQ0<PH2Zy*u&wIByq7{wEm
zS-9@HkRk_cK~AE&!*9@JFr*!Zo8rkdm5JY>05e)ZPGCm1Z~7qyEFF|&V^l`EK^`8*
zn_VA9J);D7Z0_IrYK$t#BmJRdBn|2_u-T3gI!DzCrZDpW4|m%$udw+wA3p>V+(QtG
z%1}mY2o0A+&P@hroK7n58E#&4gLhvcfOLVSr=V5K3VWbD6*;c-!^YVHu_kAvRv80C
z0j8)sH1HT7mD3AvHBk^|X<~w7y{Qr#)Dh|JHYd_uLwJHBMc6O#PIKMJ9rncBw2~<s
zo41;>!qna0<)wzv*+IkZST~%iB8(s2>HGEl@X&8Ic(;~IRPJmQ+iaEFtE=>C3%%Pj
zUk@Xx(<fFKHPnZ6#qd;wdMfq6V2ko30Jrn~?>gXc!ildWc=^h}^02#_pOvxdtd=GZ
zWmP(BcOJ|10#RorvYq&*pg<s(*h;Bbapc*g6qm@C3&i((bzi!EuX#%rU)DAQbi8XN
z5?hZ^V+Ji_4<*i}>`ljr1b{B@yQzs@0Rz9M!zwnbL~@xNZ-1ua$0JiI4L~LufGsvM
zy*&o#v(0398<o{C@byfI{Ff(WcYx(y8L;2=lY@ZdzE<XUV~=A&#D$mmGH~QY8CT6R
zSdKKIXg|<7WA<ZRsl_i#a<5a5u-DZ6OtV)i9l>Q2==g44ufR*}YiE4ZS#$9`q%YAX
zA3L9dTP<>7sG83R56#syDDlWeK;?qBI`~ndv(>zMTT6wykc4gI5|E-mOJ(_BW&zi_
zC2qBgWq(3z;!k5S96Q4aWjJ1U`_fmt(oNOgpZM78Lb&rS49$xdRh5vQzdZ9oyx61K
zb!4DZ3Tn$S_JOy0<9BKG@NCW4RA7!!=!C?v;xgfVI{Hh3alU<fpl!^!1n@|Gio5sD
z_8^eb=Oeq&u!6Bj64oy18Gjb)6IMs_UUip!hJYiP2oZV9SX)pY=X7}$K#R3WXVnc{
zi4B4XwmHm?1@c%8$q~s{Do$W!4_p|wXb851ZnxDb;*8K|PgE}=@pISL>TVp*x|s2O
zZd(}C<obIZh(T^Tj6hfP0-*D;4Uic<#>Eh0-3BgcwVY|u3zznAQ};B{$9Ew#poj2&
zK`@NTE4x^UUdOb(rNH=s_T;I+a6H(5yn6SSEyfPW_P#s3r?0=3erIZWLsD9AT1m`d
z$FcoLUGG<H^Tl4zO>AZFX0|>Re$3CJ*MILnYgABA^J_lyZe5G!WY+emjoBhW+>_>T
z3RX-8_?$nleF6Uqk=lF(qT~KBuolVwe?<DXhn;lg%lIek{I?hN|NJHuKfb@iP}2{;
z0FXaPiTC?ow)B4o|7CI+1P~|neuw)XmH(+H2K;5q|L;)x{}J~8+B6XGPd|h>@Zv9e
zLk|9{L;rCVag$Z>{a+0>4Ev|$@iVOPFU!L#it8U;U5irvE0QTz_#a|ctn*(YQiAB;
zMEoYdgyFwL@#KFRG&RY3z{vmU*d4Y30}&+6N~0w)q@w=4t|XgOL;#I*`q+Wm0NjQ>
zZxQARyCEX)jn6u0x|&$Uk16gB1U$Nveu6=WtvBaS(pUr2JM$FjlEe;;rp^U2W)^0W
zyU1voB!OIn(9;*+j9i4o-)<dUc++*4YL8@DdT^n?4>|SLlAX=*>l$ypnH{56mR`vf
zAgjD`W1@=Zc=H$_w*e*o*rkJ=>YJ_IJ;dRw+&MLn%T*d4Ne`?7c(O-T4|cgz%07wa
zm`M+UoSzwfDF^~)Ha<D}bwY~P6#Kn)>dB`a+j*-CFPJ_#a9kGo(-&SJHIJV1zb<~8
zW*%|`$(h$Bu8!-MOkBLXx;1H+srV%2ETb57Yth~<dPk{iegRl>zUX}1Ue8wUjdQiX
z_8G*4Up~*LTsdbH3_ey~ytgP#W=qGsn`A4_9x`8D*wUxc7D!hz(#Du&mREh3$LMu(
zX)mB3Bx3oQ@H+KTYNAY~@H{!P;~ebE#_ou-=HeIM7_#Kb+0Hx1?v{&xSafuaQHk5|
z8Kg6zN1b<?asqS_YM}`IK33dXrx&&r>~RJe<t2WTq4NEjEa!F9-hc7ViJiFu{gD;E
z5W$<{S%&JyeXBsxPxk~Gry_(=rptztu)!|nKtjC}T2}So%-{K=MniZ|#B?L(X#f6x
z!BJL(PcNH3_0-NrU-r0(>*1V|@8hA@H{ar|w+u6jR|}BqFKO}eo}8FC_kMrrE1txs
zmD4j5S|RQLoXN~SL93_z#n#PDSLMA(TK+0tywHhGcG&V6xp951j$?gmt|SBh@yAtL
zeSA8T8dx6l%u~=aX5Q`@^ed~BW0%3DOSX)%>Qs^W?AovA55C;>c&DHgOLD)1^l!yw
zs1+RAuUP=ttE(M*Al)ocD8Ee`q#=g}HyuS<X5^bzjhpy$7?v?7Ud)}OPZs80(a;yF
z<+1nY)6sMMZ4Vw@O-T%%NI4~D(9U&uEV!0HF(gQ!^)*R3aCB;W#F+6xC+RXP)=PMz
zG3jpmso<}wSCJ2$JGF`h&ZD;#yc<)gTB<n0AnXB|H8wPCTD0@QjIr|pwKulu(fkE%
z7W?#=6&B_T2gFOP2<iQ~GZI-#iEC~=+tqVYL8eW)S+d$}s~3M5{hHTUNv6EL^Cf?@
z6I`jQW0QRyA}DapmVIA;+Pw8NjXEx#{WpyLuxk2|ijG9m_M3KGkHE~ludjJ|+wt-7
zVhjLO2c@ZM_JrD+wxo`Elg2FLH?6|u6mcHKeqih6M;w(#W5trWbkot1dv*<mmov*~
z6Z!+lrKrcCFaPVk7mGnz+5WpLFaM?E<ign9J#S~enPX+UCezo|kDSHU^<1osGR#w3
zUmdd9)Rr-YvQt}^iC+)wu^5kXCr+sczoP)!x6U>5NG4k7LB3@aWx05ZtxDWRS32}p
z_RE*J6E=P<NajX<m~ki!Tnv?Gb!K@mlculd&beu@=kCo~wNU0vGm>ChTkw`}eapjQ
z!<>8y>@TnMS^C+v^bGP0O-|ebcx0?o8f9bV*;5Klzs;EC6c$by@$#m_0E5H~p@{&<
z`YEHbRnP1)T`~;`5?8&8_8o~BDn6o}WGFi81Fa_$9Z?geN~C^PKw}+bs?TzolZyFG
zWtkme4X}n4`i65)Y4Dxf166lr%FYUmrx@KKjM&FVsjmSk%Yixr$Ds^+k=m1)JWs4z
za>?BI<x(^l!P-RAoVU2FsUb2?`!pbYY}2wn%8Yqh*%o@@Ws$y(vns_WgKV8;<+nV(
zn-06oUE;U3V~W#XpNaIxVr#Z6C2YKn57@S47&>A&o*B_+o_z`tmjTF2Dy$C7EQ8LN
zE1SH0gEiOFGcz_B<ZfO}zLz7ZH@Y&FeXnEA?@9LPp)xx3A74CapBkX6iERKDEfa;2
zoC~8KEsRSXdZwWV&D<33K4z^Nn|<d&mNLn7+j(dFGqg1uOQVz`P^0|RPH9Xn<*w*7
z(q#-&92Cp6{R0R+Gvly6<|;X>j5(tA$<uj#b2c0$a!lFkoGp8^6eS0GNm<J{Q}YdJ
z5^~`z10FXafgI6pSk2}!bW6Zzzvcfua>M61k5}2o^bhZLR(L3|5@Y2O0Vztw8(bmS
zKI=-h*V*V&dU^JhxF7z<H!$^j%VwKRC3Dd+wdaYs9`e`VzglYSxx{D}Du9RgbAI0{
zNVb(syZcJNtFY@$rk$I%inH5N1vbQgZsfhq-LiehY$aj^@U<FH?h0!-A2X^ywGt*t
z6?!bh68CdJn=$RM*ex^c?JFd1`#t&O5WD$<6Wn$lJTa)g!dAVml<!8-ReJP8`={)<
z42<-?5&-JvuW+>+chp$UQlrd<$B)gWK}Doe35N>^&Kw&d6;tCIA=W^(K$dsA=(9EY
zyx2H<VUIBZjt`~5dOzyF!@}cMP}%6PV%MNT25Q?VID~uGSgsED1&*03OOr(7r=7OI
zFXewfw)!3n;;Utah@d80q*|r*xI`P3sbhNIub!_D%6bt5FJq_%iJ_;c1Ox%!#}6Ya
zCcJ2=tuQ#r-BM;VdFhSVrm^m-+0wnVXtcEGJ{YP77|evnQir!n;;SCDkC(!7;wjSX
zT*y|J_3N|2(q|!|WeF4)j{s=>aRMN%wbFP7lB8npSrZL1(c$6mB<?}&<UG^7dp`}g
zyO?__2#1uKrIafhVX`@GrNc90)wz^;r&U0SIgI&CZ9PM3BLqVuhi0a)b}GoO2&ND~
zO!$caSQlJS7Q`{k)lakX>}UUZh|Sf)I_XfK!i>o9kg++|<>Jbd$qrr_>PP)q!z9-H
zRNXX>zR;B6G*?fHZBMhddiaBIib!w1o&r=~mK>f0K3XH_rqXxD6i40^C=z;@urj|6
zg0S*JeM0AwO;8AWF}NZ?RLtZ|uA*^<!^?ji!1lD0AwG;DWVE2FYi=x~Rt!c?)?ug0
z)3DzdPb+<kuf##7gk5C66Le~23>j&sC>ATuQle%Nd1KQ33q5?^ZnjUO)p<fZBROC8
zR!&+ox*%K@Mx|nbH9_O@b1qmn;iezZ(&^N{kb7y)ZtgG@9J&HwVv&EtUDq#~DVkFP
z(D}vKkFK@gL?>dM*>Dsdv^OIdKMP_hZ^F%~RYxJOD<|3eBKmV>i;(ZMOq?1T<R>Rw
zT_+tMSgSm)BC!+<n^<P}$=PyiMrTS;!KA-m2CYGxOm_BT@m6-Wrgl{M_=(5(cNBdx
z8~9DqFBclThx*(*0UIoBD+cG!_8bv2faHBwSqejS0tc&rw=8jSSZ_8)WiCc!@0ZZx
z=*2HM!vdd?E6(m`9*0bSQg=_Eyp~I{W|l{tDOcm(CB@=*KaQ5-&&QDF!5&T9*R{PE
zg8599Cz>`19vr*<5L+HHJUp&^@Mz(*U)6?|$8eWrOZd<3);tB(aC0PnZc5&50BX|K
zt=0O5jA`{>`M?hPE$eCmR-2$)RRcRs@@24B4<MEq^z)`4+S!S&5{=6?Ppa7ra}+Iw
zce#zu61zU*SJY>h^k<ipmF}2oJdv-RQLj0Lv?BD!8rtc&789!L?^G4z&1qB>MODp^
z<)h4f!FBM(Qj9Me6Q)i&{O~s_0GPfS-kk3l1Gj#UjCuwo#U70~UD2=mqvgbLi+a{C
z(l{e<gk^Be<<SQq=E--~6`-fZJdj2Kt1mGXrJgj5%T?5ONQiT=5?JWTLaPwAMReF}
zp*Cy}!~tTd{w>0Tb&OCXL&)OiqLs5!56LLguvMxRNtIv<6pMmrW#M;vfED61H%Rgd
z=?G4-)a#WgF$ays95>~0l>8qmk}7~@Ib!jl95*|k-dR!YUV368`OlUY>sC8Z+aqS*
zVE7>P+qF5HO~mCm^`W4wA$j@fGx8>LB7fA>?xK4su@-LZrM+F&C=p78ScwJ~L4mXo
zeBp-}y2rBD(lG0E^asWXfY0pq;%wXG<P=P6T2*=KNa1UP=(W&qPLbq9zb3>naNC?C
zdBX;Bcc)Dmk4^|Aees+ok!qE(*haDk#|+^#FF_LNnR3g}mVtG;6bq@6=*~{L?^LVe
z*93?@wo=<A0Amh!l$B{Oiv=H2eVZ)oV|I2W2uk**fwLMr*AjSLK-THFtckRJ#;6St
z$JAZ1<SF*@#FVWli2O*$G;pJtapv)=aZ1f}EqU|M`HL0|Ms{ggH8THee&_`2i>ZMU
zLoGG4reKA0{ul{AUP9Hzdie6M>T$lw18Wl_RMOHfqc?iNyC`?ODe6)@+@V+vLESbb
zG@Kvu-FCR$g6TbDfcgpN3*y>Cz<bizsQLbdv3-?r701|;ZIiY7+w@OV=GI{0WC_(g
z&nann`AmJ=X`1D2jB1~{diF|kkQXGdMT}GE*W>HBJ|8HMG$bhNkZ=!@{Qh=JkJ+JC
zA}dJy>$9q;Poj#OG0<DP(+;|4_qMAYay9ff#EP~wx5pJ6K>O85Ub4@6#VL;yy$J&x
zNa&JzFeEZE7V&{RaeBt3LDjX+P_JG~Y#->k-QEtK{L+iJL^*IWFze8=pkh;d4ck0-
zzC2d4S2MgLZ*#xZjNNbl+#0swCij6HP`5HDI)-0$N}l5ffhNL-RH#v;b<))Rsu`t!
z96`B-lw2t>017vBYHx?!f`C*8C>d&q$?R6po!rrh7a{7tcR~f~X9h-6)~V&E<wxQ#
zfnn<HG<s+khi_d`Ee(U~eiO?@sG{DAtfz)obs&KR3ODZ-`yNtGjWGrCafANDHt<O}
ztxq47^CAR6#&HP<ldrE3$d0{f)9*6A797MN6Z~~o25?gjOz-o(rK9KDfdBINT_o+&
zG}HZYw@MoG@&`PL6M{01-~%v)-#qX&`GjMNwt2rSr<DE*VpGQQ3Zl^%Ow{)Ghqd^D
z??dqQmN?(!373>ScCx)e8L(9|$JW6RZEmWp;I|?M@Nc}oTDW(6*6K7K)_kZ}5Ny69
zJu~;ujR1zVB-eIi`SU344!q2^SjmW7*GBIrCe^s7xE~-!r<Yl$NkoVsJ<rgH`LXs$
z$p(@&ynW7pGOY+%AHST`0plg(WJBljS5P&yJfCVivjlfg3>se37=u(OAo*q7Tp+F;
zC#7*O%PLf6vy1KDn!1&0{HT1iPcuok>2&W_)d6_#^I|CO2^X%xMnFkrH+DS>d8RJL
z?GDb0k_L%BJ23F7*>uraPG6-|WVNiEt3Itzz4xI6SVYWj*U1CoxHo4}gtd${7#7dr
zuIiFTi*jS0Y@b`1s?;Q%jRoBzKd7Ux>f%*F$Y=pG_8aV81gs`<A?YPPt_8`phhopy
zJpdSuyhm(QE9kh-OD0M-Eq@8O4`Sa=;op+P8cI<*WWp2Faf0e&{wZhAYR;N62vrB=
zsklVi(2&^CYK^=}z~@;KU%FM(1GrAk*34udO}De-+wPG?mG#DlZ29)xABGk!gCi*d
zZ7wK>&D<QyzhPHmi|#>Bx{?Z245zIgq5#C>fpl^bIfMj^oUUCCE39W5TRbt9y&+pf
zz~vUpqgT~VA2|!cSLqlt>%@t3+H{HZQ1^3}{$Jq|$+SRbkZ*`yRcn_)Th$*`kH{k9
z>vS!M)#fR_eMdj%{pMuQvlta#f6ET8p<Rg%=z~s{2wV@Wh(G7kUtG7zTP*R+-ve~y
zEEkv5bws051D0r5mt}I$TG+*^x~aE_&04DJa@=TEy!PL9E)QGuhw)-1Cq54@cqgP#
ztGUr353NlU|Cn;fFv9k&r4Ac@XluI>)~1%n4J@HUxcsWg4K}fFdD7M~6tBuVrNP<$
z<4Uycm7g&Rm4m?Gf@MPwi4Ub7anOLr!$()~r+PyJbBCwqSh&YSw5EKDsxpQw3rL0O
z&pG%L2-M->)TQ;aIejFk-A=5VNM5^jZ-w*N(1qnC3G$Rzw&Tt?{*toL;e|+_oK#?!
zGH)RHw#k{MI+-O7xha0X*6C8ijN`0~h@v&PrUX9OUenXNmLmC06^YzLAVmNT^Hw@f
zHSTWR8A~we<EuANgO|jRR#zkW9HM$y;(ER*-uODi;Zni7og#dPa4#n1eHmB^c~!Fd
z#br>3sA62QnA6zoV5Cc2<{cu{g}T|4)QPK>z{_2pp_fec%2Gcj%^!zhIUCD6RiM<_
z9xEEuaD_D`oONx<jwNf_vKD~Hw4^zAVmEUD*EVcx+WurG4}})p4r3-7q)6lw@HBi{
zh7%79Jxkq=(#b~Pa$`_azNYh4VP;YXr>d%l@rR|+zy4D|x^haC-248EuUlW>)lHoT
z*?p${zH)vi0~>`k9>0O==a70u`&3<V7^>ZdS$KMhv-?|71eIaN`7{870#{H)*Pnen
zY3a-WP)e#dbX~SddOnhrbd;dHVY|X*G`X_LmVoZo|M~V75blE$38OHb>HZbFD!^%j
zvMJ#bc5qN`YTl$!m2{cLo$K}v3a@=H7d=7>r5~2m6uVxq3c8GZgYneNR#kgt?!%3H
z4m|~L!{@~f_xrt1x(Z;kXS>nCkx!Mdn>zlntUgvUDP-<~38K56qs2S((CzPlpyy_%
z%mJI2Et#t=n@CrlXi_kKtnrlZZBmolpf@7o4w(3K-f*WoUNCJ1S99M`zZ8B*Gl^T7
zcE|JSawqa3)5n9&FoK{H%__Rhv}N-~5&tcdizmKkC^#yR&<D`oj!o9tXxLb57cZ_z
zto*@!>N>j*eX>o>;gws<^E`ZRay5c_`OU!X@!(3a<s_XJvA77?WtH5*YaX5tGwPh1
zP2XbK6K}85?^BRi$9YbRg0K*f$T+UH8v6Rq7Q=K)<Oj5F!+Kk$+91y8`SA7m)Z1N{
z2N;?8>Yw@YTLR!V<XhN*>!dBmA~a(J{kD~|@$#RBed(*Ht>f>eLr|N-Je6&;!!)iu
zZSZ_ht2)f6>$+HYbj48UtuAyX7BY*6hbVWeU5*h${$jYI#1Q_fTL>PB$aYgUX>(ih
z#Yyvhy@J8nB+FKJcqmuNiM_l3;{HicS5)}MJ??|=z6nqgyWWM!UR2iLDJH1P8hGoF
z@(a<cp#gB}k!@WozWR12${`Lly5zXVAVk>)>%1U}E_ZRh1(d(AUmjZ>mhC>L?+Kp&
zhUjKNrab4jycD71t<*CFZ40bX__3Xr-GQsyMBo?$O=#PK!ZOYxQ`2XMH(4X36DY)u
z<D%+okPh&00H%{VA+GTsvEYeq?`rSC!&T(?v=nVNOVju|U%EZBAE(%?L_MGDZVTCu
zq^Q!uuQ_^yNNFuE6GZnwt|&XJ$?SU*{U#lBfV$Mn>A8QRx2c+=wVQ*g!WTanmDF_S
zd(zUQ(o!?y@ynQo+kg`5#YlynF@jH9HD$qvxEU~}3mxCL@Bb+s$g4r-oqn+#7{XLc
zyM`At0(XBEH+k>RKiS;-*pRSQ_uE#-ZfXXU?P;;6&Iqrm-EO(oVV#RSkQ{Jbk=Hxw
zx?{NH=U!g=qbEy4=yDNZCc_83iEl-Uz{4w>s@zEesG4u;eygQ7H(5M^?&8V|E%LD}
zAsuj_Zxo5?igsW9U@xyyO8tACE~IlwTVNi^L-9JU?XjmoYTaHuiB{m~z_JqtzEwoY
z_N`V8cI?I1zkIG`C0$F#_hbWtO2UR=TYjzFAg}TDaAf4%#7;-u=KyMfQtRfn+Qb^7
zV_Yqcdhx)_`?soFuBKhPShxsHy^*2caR@;Ac_>X9J3D|m1StV-Mq3FaxgfNMz|+F6
z*Vh4=bJT|g<_pveVo*{1N^3<!(94ABabyr8<QXjdGyYg>M0GQ&(#YkCPWRr0fvGs-
zQC(+26H@&T!?3z!<sp^!k3~nj87<t|x96+cgXrN=c4)|(W|^pXXx1Yt>wOK5QUK6A
z55(9c2$-v8*p?0boHrM~w^$}0T0X04pUVjo`vc@%)(=uy4mWr-j{Diewf{e^-m$q7
zt_!q{ZQHhOr(@f;jUC%N?l|e#wr#UJwr!l}y;b*C-SZFDw>4|6F~&4<tf}O3YF(@<
zQv&$mtCf4+R<_xB_dc$v{Z`f+Ysu7ln)m8MXtoXFI^I|{bd={_lH{LbiFDX1W?lMn
z#pv1%Ab3}<vwVOD>!Dgbcyk6gy|jr54yt^BFuY%3OIZ?<uFk;vb>0$n_hB$~jYS!~
zyaDuJh#9Z1P-m=^XY;$_AFS*TsM@$*Ys)z2lukYc#vUFNO72jduZRnHg$Cz&kr8mS
z7=HW_K-<io{8My$s4FxCC2PX>1H!^L__Ouy1bq#j%P+P#W|pKYjb{LUj;*xcN_H$b
zYtrTR^G%3)q7t0;n22+%smFB5RxZ5Rgoo{Z8eO80DdaawklBKcTeOrK5do{pKTxAZ
zgJZ)V#O&pLqJN7+7ZXr-R|-yd3(BaYOl{FTt-Tji4#Kl32=T_<hR1WLL?a`n35dX#
z`hN}wXcY|a%VE-_jr{?-7G1%2xMC)FuSB@W4_6S`9J)_1CnxFFp;&glaef}m2#IjE
zr-)|OikG1o3&exT+ox4#*4v2!XY&Ooy9YQ*5_3!VuzEvxsa)NfO2YV+x{D9ENM35U
zCC4p(D#CvX9q8}NxaqfJ-#0eDR;uF=>GH;w*Cl+)$pLk&0gB{ymTKla98l(SZW@f{
zW6eaZVO3>S@8#*s=~U0=8p2e3m!d$kI(|Uwq=AxI`cA_2E7bdRZ+rdN#63_jH!(J<
z<v$|Ho+H2Ja)ymq`|;s@g-3@v)IM9kM7V~D`P*M`Myc;*d$CwDv1w&aSbp_lWVbB8
zwzf8helCldIWVR60_+v~f=#aO`{DEbgct>y{4P3!xcB8ddeTU{9e8y@EcKgGY#6XZ
zMmJ~9nDR7?_wzXfP0EN$F{yeirnHvO`+2K|2&1t+rI7diDejv!dwg(*EGhcN<*bgQ
z`)H1-Bvy+d45#(ehE{7(vOf5w5thI#7}0!~3e&3&)ng1s=9^eu?%gJN8_GG^BpC}O
zzORIR%=`o)*i%^>kwaCb)Pgds*$2qiKH}DxeU7YNbC@2j{Se%_b6?F^g<Y>plyIp+
zXZ&qCVytmnoi%&XRL5d63F<VHMF{LqW~(nb=rly*ccEeUswz`G9nYi+N1rk__fx!l
z$NI^(+T&Y<XI+F#&r?Ax8fRzDaq5T@(|y;P)2h`c|5YA$VUl-8tPpbGQwU%rWR60s
zq=aMqnxg))M{7=Pj8gHD$afYn;%SJ16?hc*^$d=jDg`PiEkPVS%%tERZ7z%1kp~fE
z#V=YS#TD%k{EeF69K4zq^MGS}IL^{qSm>=N5nh7s-CL_$jLZ8ArJGo8w(M8Etw?TZ
zDn5-nxa5L}BR;p=IeIyzKQ-W11C7t6fZ<E;G4&BLy$IWc#ed|W)Zg6@g<LP(^U^!z
zcJv!&`D5`DExGrK-{h2BNqj}qM#SJ(u0$G??TKxGPL+Gh8^2BoX6%{(XC=EoJs7qk
z7=5|7<DG57@P9HC8`W?nA$OAOVY`X_nGriI<I7a!yo;H|!ei_<y(s{GcsqAIe*2+r
zg!U%chV?H#T`ig14;xw)-B0kHwph0t^HB+L1;{4t**~%(wq_=`>?)OUZSgGlYRXuE
zo8m%;EOgBb%RBZA#;`&6DR)JAhi5dO@p7<e{Ieo%#SFwD;dG~v_@d)-y6B9z4QdbY
zd@&v9(9Vi46cwdea1E&Uy>RV{)mP&zQs6F97n7>qjLs}e8~>rPOXqz4lgn_I=J?&Z
zsAbU0<MJH(r*7JT*)lig^&!>#F(0to%9ZlNHD`I{?)W+<EYovq<Cct`t^4|WDI{+*
znDFrNW+ahuC-E&3M;}iuc5E4;_9+D#do6xWrr39bT+UPvEDi9h$<Oo(eKXMxwuEg3
z-I_h+Cgi<~u}?m{dF9VLiq1CW4C>}Jbx5g9Twn9Qu8i&2JgSRF)81~Mvn2_Ikg46=
zq5&$lTY-j9=2WJ0T*G}GL((!JoJKF|fwR#)MP^CH)Z68e(}UXH5>i21aK_BnOjPgZ
zOaR`+z@f?)cpTu=@~$xwn93*&c-!CL>6w<I{n820oiln)3cO_yMjbV0ESLoPYbezZ
z|8cH@_?@?1@!#=!<!!2-sRwg6QNvnnf_AV4gcn_&IbWYgmXxB?)hL?>vn7xoGP~od
zyrOP_qg{;54hzm*1$bwCh7!NK4x|Ig2+_WB2OF7kc>ss`FRW+58Qa4j_o5K#`9SZN
zlmPM(`OdfO@8*-=GPebol|&JS$sk4w^ct|YD><ZC<icBd;(CY`egm5cSG(*zDKw%=
z7wxU!J%8U=Wr0UiSg0n<5wPQT;%`K?>fCMO(6a=T#oWC|*jp(2O||$G8fd}6WnuS_
zPMiXuw*bfn0YZSB5MG?Vh&_L+z!;*&nI&qv>po2gui-oIXU5~)P-x>>87Q{zEh1eS
zzv{xeuPEc1TenC<=zP5E7Aor3$x>+5t`|xs`D7XHZn%p9j*EckqXb$KE6aYeh*=_a
zs=t~^xynz-336}JZQ~oX0|Yv$(6GJKaUbe88o;jIU4P*CXrFX&2%hNDCglhK<1%=m
zo363dc-hJ@6*$%SH=U<c-3G}|(*6gPBG!g)3xn7^u%cQtm=l79Lhd0$dq|E;Uw&yN
zCSr=nVoK$klOxuuS<(ju(`HC|d_hn2w+{#{8;k%FhO*|N3@&NT+<mSx6#3kpg-B)T
z4FGQP0hN%_j4rgDaz_Of^j6YH5r<5lK8n<E9OMqNHjXq#dBO-*;MPp+Y8WjTzL0XC
znb})vZ}zK>GqKrgy|4Pt^FJYqZ}qar9kl{;mEB-Cv<De<pI5A>!qq>8yZANo>%@|C
zgNRGV=vrMnnT{>H+qzUN1abng5EG9*91xUS<ll0~hgtGB>HDs+SV<FT{?_<{jL`D;
zNLA`kv>v^`rw)qWxxmZUXBT2P3*}(H-VYdf_Cz_C?~%f&#r%)>Iangd*z_Yq=%*Y0
zEI)@%FKS01+elP#P<ANk>mJHCSHJq3gwD#nf&g_gyM6Cf^3_I>tu&~B7A^Wz9q_#%
z(melf+|>>F?w0Gv)0m`<2B%XQ{AXDr14p~2ptQe{ytKH_)GS7p3<~dCLFO<S>j%Rc
zj2dmg4?<V|YFrh)%Mrz=WAgfG%2J%;e!wp~dI9>92?hvArn=MMGB~U#G|oK2{SL5`
zazR~0d$3-C?B#YLGYUwbCnMYk1(Z~W`4dp9|0txaR)Wzap?Qoc5`<?^&_U$e$i7eR
zi)oJrGexlT_rg0KJOmR&n?aT=>`Nq6r13ypV}00PG?q(QxpF$4{TnI_3Yz;cZbk9%
zzYU+Syj`@s)Q7_i)2F0^S+!s+%$_fve3L;Qe2@h}OMvh_!`;e0KxIh40Qh@4jJ>Ge
z5gnIEM{)%U@y86vL>~9q`S$O;u=>WoD^|?$cuV|%>CYd^>?vSG{URvZ)P5r%P%R=L
zAh>mbqgBt%mbS*@@j#K0-qlWxBW!W)&eRpJdzC8*fMR|rp*@E(5^~lW1St@5W6$zb
z<tKNCj90-y>5Te57uRU$1Pr@~oC`&J6^5{l>0yshmDKv?y~n-VgX0z=J%R*pAtVGB
zWaEI8YglJw**auM_WB2rg*d*)>4-5#2_hrD#>p9<5_=S*LucU7C00E&7;WUd>u{%m
zIH)0v_4-faX`KQMB}!%?%J;!~arGzTLU+p5taDh#DUOTwalURO0TRqT|NSnMau^z=
zi7nd|o94djh~LUw6fvs`*|Es^WBc`f9uq`G!J`&JVkM(kg?yT7awlv`B_rpNe?kcH
zeX{HD@IlV)!%P_=cd9}V@5U9u?-W0x=P)$BN@IsaC-R7jb?ac*48w~HjmhAUIiFSr
z^3V@)OCTfoD{4==0z|D(JtT04LJokt$WGCb-oujyl1<A%|AeH<_`MXeUOcXPZS`Ny
zbV%}dHZ_ClN5c)!V<l@$LA*D=2tX{R!j40E+GD_T8^nYmU$qwhSpPvmuHnQJQYC02
zvm^s0-ZvWPFyJ06B7^Wh-Y9qiVdCWZ(sDMUgFZuzG@yJJ08kX|{ozbB&H_#7Y?V`q
zg>ZR+sb)O3pz)I>on@|YD;e@wsd(uez8DR`MH{1j;)5C*K{~q=qNTKtSg!d;v_iO<
z<4<4%qSM0<u})zfOTfz`MK=$bjJ?t96dp5IG|Cn4i=xb0S&RpRtZ*-+tbqotC%8Qa
z3E_tSfo54K2Us!?7H5r;uAR{e=W8H7#i+`YbJ$0BmjKr*KM=7JuSz19hew`{hil41
z-LR;QDlJ5h>^-u@>+Z3>B^C`mFWft7`uk>?>900sJKz$X8`1=UPAj|rIRhK;L-;2k
zYp@X2G{>L0J8nRV8i$EFtQs4F)qM+unopK1Zo4BR34mG*>+tEX$qwU?i|qM@f3@$z
zLz;&jd2dvjdH@wX;?YaKKs5<E_oU$es@{7`tNg3TMwZNew?dBC?^)vZ?FswLz(zjp
z!8{e|<Uwg?(>yvlA5Lx%n~EfDbb;TrCPf{xzTH_2o>x6%y|@^a%YL8eGAr78`~ama
zOLky>4nQv55ke`FKdKo_T@~aB|F_i`6FQ`U{5I=L4(-KSjmfoM1sF7kDwgspJ#mjJ
zB9X&48V|W{>dl-u5aq3imhWM<s8leSY5|r)2u4fFKYv`UeN64cZaINE7A0<!B0*;Z
zg}#ICGAqV_^ZR0<DX!VHgsPoS6fy(#>)pxb25{T|O*0caKLn!<XBIek1YrxY1^<+L
z)$}S02lCTa1kg;DC?L202@b1;Auc5WooIXH>3=96#O}jkYJ4(h|6EN6LqsYah6z2r
z8v)BzdC-S(h>0L}g;0S1`$CHHD&Q)UPTD|{;=8z4M;yUHY0dYBQdIvW){4GvX%KG5
z2oOk=z)`)yOoz{(trP6kfUz`dNC{YJKLYPPJ$D)I;#HUa)4Yq5a;zs{eBl|;Z93q~
zz~(3Vl|}M53EjW<n`G2+HY2+n2aK-9dase}mo28;LaH1C;bDjWnG}k#tmw6+c!YEc
zF!0$W97Yby7|gmsH0DCx+X4<*(m?mG5Fidgh>?CEqb8|<by2MD0xayk->vz{M4~d+
z;S!7W8kMvGKZXPq99jtCS1(l<UD=9-3)C~q@=Y<`#CgP{Z6b#=97BA2Vra!+V;Kkw
zOyMe8q*^*_(C{E#jF}is9FFho2_~Y8O1O6dC9Al;=e~rPoPu{!Cx$QcZZwE}1HcDD
z(wgTf6FH5#02j)D*I#a{l^BJgg~3uB&5@E#DaFcOc;}70K3U*xb$uMekG26?cvN%$
z{`x<or4VW<N5Q(Q<R>P6@&PQb7q*sSNEir8IZ16$r;byYlMME0xO+|qe=MEe)P38-
zWokmH_8+toQVF7NxlpmWs=;j>4M0k|%hSeB)!RAR)wS+cNrGV5I@=)=8p8B1jvPND
z_OycdS%kyjb!Z~cMW1A$-U#MwqPg8|?BBi_NI$*LruihB|H~lpR*r*>gbIUg&Y1-F
zuD!ydLbj+~zzs<QS5q+0!zoD7l_d1Cf8x)jR|EWyN%<Nr6=Yf#Rc{?E1yB^Wh!=-H
zGlS#&HtQ{<BVC1g*7k0XS_o<LRau@C#XDrh(HEEiJwY1<8~?4&$rS54WNh)E!9L7j
z!t4Q_nP!Gr%Yx3BZWK)h<SFt$-X<mM?LQUGnJYAJKq23ZwPsH+jZ}b}MCLS*mxy&#
zJeXk{gaSQ)x*^e)s3sn(2f)3d@w3R22KG~o$}^yY>uQmpm|q+Zq?}9XM{Es3M66%=
z*DhQ?=a<f0p9z=7cX1O1^ZlMs*R`Z#3oyFPoad5UHW?<dSns|-vEe$6mTJ}UrI-tn
zuR#s^Wpcp;ncGUGo!A)E@s}H%$#;~a+3y{=L^d0lij1BgmqxW>38+*dWWpyW{TmsE
zkPeO?`?#(-jT*Sie_e-4f#hz(N?az9I`UD`I#vL>{zeXiO|dFIAqk#}Pe~N3wGwV;
zI4s4{m$nzA<U<;Ti4x>IhIjRZ1B-0{sS|C-$Pc67DxQ9Uk*^(e*0eoD(R4~J9CFSi
z-%F)2U!H_l6b)5a3h+cj2Xk-hj}K?@3)NKc1e(f2XYwB;m!_4st~0?lw&<g=ZDa;m
zqw*JWRFL{*u+}m~Ds|>vyNJ^X(q7s)23635$$QoN+a{_1(n3s;z9m8FDNuEBCsu*=
z)oNyg$uq|@R8c067KrK{t(8W{C^@T?%H|+TaTp;%BdgVL2Vl$9Dd0I6zFGi2szW0L
zp3}3SoVVr1L%4u2&=5~F@V`+9rK4A`{}!Yn{=o<{#kyS&H76oSB4DKt(@V-Ag!w~T
z;71>)C9tkK7gQ7(N_$64mKBA<+WITtz{mv`uXYXojYol9sgCLB4$}WuAPLpkNOkJI
zD+d`ewaKkrC7`f&gv0sIzP`<wks9g=8Tu?W%*w*=eIYIrGzQdeT1N|XP0;6kZX<tV
zUP7y#oRP#ZIZ0E}?^iS__#Lf`62#YF)|>nE|9VQRj-D>>oA)zx=7;zXEOwDGI%Ij#
zXTEoTkV}7<MgxF-Bk0J%EE(%lBM?GK$tHr`UuW5cHGnf}Q*6*!pUc&j-S7V<>fV4K
zwxG%4fAvW=vd{7*+i!6igugLb$v@w7%Km$5pe8@LuM@^>c3vkuh<PRS?YDBZVSm3D
z{q>C0egi{;;grj=3M344G}J6%G7_6ny|0;qA~Mx2RB2Ei9z^szHMqm-@HIyu5k?JB
z{v5^Z`2+B(%_KFL4GsIacgV@_o3=9IEoioK5V?Yrtw^rL*%<8*&xSIWGkxjyIQUBj
z%iD*xB`FYuETt<{YtJP=|6Z5^W(l1^Ni0F!o;2T1hPs>=Xi>)DKq6FiN(7s2g3=S-
zigd%h2;q<vwUPw$OB=LjXcY-&nkabCbk7CymKtzJJAQ66;;EXzLIR77!zmh(hcoDM
z_oBrBNr%@(02V?$lCJXFO(Nt|dq@NS8dQ#sCM}sjmun*S-`$#iCccek8?J!x&DIR6
z#n~xic_%qwU-(nKeu3d;4>?RGBqdrENmrK3N<&|U?F7+)eGks5@5&K1I4XGtMzpy;
z6c4BgacVdUsP?B)_2x(&T)*e)8$|!>`aTC|i8@kBV1P0R3QH$}@824O=!{Z95d&W*
zPULVizi*b=4i-g)O0Xd0)QyH#85@w!?WFIEKS*^vHXrQJj=e#{=&VwMX72+JcK)XQ
zdf5`57*`IWrAbQP`W@x4)|x&-S^@*ffCfmxF$#|bA%>w98oLeB&wu4~c!5bW*${sP
zy+Db|hA}o<tsSZNh7;7mp(L#n=M3UF_a!(TT!R7{hkc1eaEu6WIh)k`q|mw(q|3o5
zfU<LisHk~Mtx~G)5swy;1&k$X69%P+Ws>#|pf?aNOWF?<?*}8W%qMYdh@CW!*8mW0
z!Tt!YKMSCW$3=!CeW;Y=YyV#2VsFigXjcMhm1|{fET%uk5?zYLct)j_pH{n*$u6z{
zAv|pOqhylZU^oGVlukui$~R@*unf=4@N+CQ6~K|WKYJdmf7Rzb+ovB853=`f)jyk+
zHHY1420a>zZug@cb)b+3DJT%&CJjghkB_1+v*(HgpUFU0zJk20`6UATxQ<p6ZfMRb
z9R0<e=Yp`?HXSb@mGFl;Egjq+c3Uh&f<|+EHyZDun+h`j;+@1<gZXsyPp9Z^lS>AN
zNV|4L5K473+ziI!mXon1c{|!GN^C7jiA8w~_NPyBWD$OobJ|Qw6$k!oUk9M$)U;}_
z-%puMaGee%J?aDQ5pkTUHXK=7(7j~`%?cY_9)kMO=N9w1UO9M%CSiO)YHx%koObwI
znbI3cjHatL$Oj}6htTp}XqvG$#)c`JXllps^GJMpl244eaKab$6W6}3;7c$@M4Mu7
z30e{~lkhrB`Vjewv0jFD)gBP=7i;brGXKh$ENpvvlnaWI&=|st!J+3ik<=7Kw{qm}
zLhaVMd<<<1-hXHjd`@CLY0hh9tUZ*-V6c^_S*N}O(nM)q(EqO_bA3QVMX)5^CN_A2
zwdyiFQTNEDX7Dsda2~T-X$l_{<4KbIZ|0<aDH;DkD^5bX*dRP522jA3*Z4R8geT-P
z#Ga*X6hFDWWyvK?SiH&FJq8jSOd|Io3suJeS1zb5WKzzMC(&k3DXGy8GA}G>5|QbY
z_HkIaRJ{wF9_0iyl_uM;B(^=WYPSY`hSOuBaVCmbV~_lA3X%?Q`@nmt&3vLH^H^m{
zVm~$;#&RGuA?u*n))0UMIr4I2|C*FF8X)ct&lT7kB^*PxUB5HPJRWKFrUyB!U~y_A
zbx3<zo7BHR9F;<T$O>Q?hzI*(Bf}j%xcF<JF581XAX;D~V+*VvluAJspedcyDh)So
zYUfSOBnUyVcA{cJyw>aTg%hm`mPav~y6d#iHWqOuT$JTuo(7c44EQUd0IlzoOhk%t
z;gzUfupp$`d7t<!7ZNDivEa}yQ4^$a$X>%^gCyW>mOnydEp(@FhD0E%(?5(#Em$yn
z9fQj4zpF!t&+Al9cNxYrF9j$?nS;Xxne5;;<d3C_l4oVnTrgm5h_SxUj%fqrv$caV
z>J0~lsdAV#l>u9_Ar7k+NTV>qVW=dQRfKMki%{--bu$p5)8qzO!GZ|YC6>LPjI?EZ
zy)9Sc5+|=XjSvgQ1ZbMN`u_SuH*z-$^m5ELYEYiY-zz%a>H3}_`OMR+kW3&KkSo@$
z7WX$6AW}Pp!CX|xSC@bEekPfTIWXGXpm)<J|9K|kX#nn3xfB1T`=i+7n^Vu#9`zh_
z`toJcp4Mo*)b?{ulxU6z5_pU&Ua3B5)$uE6@vsW=SS)!gU%}75&|S{l9q7k@w>3uB
zkgmE}%Q0VM2OIUBjb4LYaV#y@m5p=VA6hIZYqhy!*JoHS^q}m*!#(;lpV;`(RT;=l
zS2qZQKm+v4cJi9C|AjY`_E<C}Y*%eaV~8w8axXj$60Fk3sqGGZfpgZ}dK=>pQxO3y
z*;6jy98_JwTZgP06jKbbVrK&@UnQ`A60GqPF)s>*#)vxdCQf#oA*Z;p(|Zm6e4t|?
zyUA1)K65wah9teSF01SN9AoAKXm`Llz`!EWGyqszUNSBcr_%jQE4Pes94RfBNKMKx
z@#^Vk>_yq3@yeiwzqO?aF`31_C&^l!?iZ$r#kjI0DNOIBjf^khWUf;|Ye0|oz>8?$
z-$E56QZnM^VyEj8*2TUh=4qJiM`9H)N%Q^d-~qoP#1&9N4=8!0gUXv|sso0kT>SM=
z&;aC+JOJX!Cp4aJhHqLrcb#5$ox3$q-PaZS&h(IVtBGTNZ1anGFr7{smRn!qWhRtQ
zEPW8{x!pE{+VQ8Sn^-H<3l62ektD2XqgSmRXOQx&NPkiZ!Qgy7+Gd39X5+uiY6L!^
zqy)NoLnlTQfPv|>%;fr7>I9?7!xElBH^9lzFi}6!EEfRTO3`@k2<KPcKbDZO%i$*j
z8rkNAVzGRrC`i$!k$qEg9|{i&%9?(hJR78t;SJsdW|6p{shtFIZ5UH3`-Hf|gJk8-
zC_ORUrLtemSL<OBzXn{$cH_uvGKano?;<x#VByFEL(<@Y!UPxu#u4pEpf53V)Br)s
zzl?=!C)p)28wy{zEdE4sN_e*`$&+KK3KP$U1BM8mxAe~*ov35cO|T-;DR-c3G!uNu
zQw5%hbM2FvO2#4i2hJ7hn-nMz+g3XqqK$)iW2kPBocBC`HJlII_a7qdM}jI##Latz
z2Pbpm%ZE?qb~YDBvIa5@G)okyV*sAoZOZZF8HAvq`Oc%XBGG>RQt#t7yp&)40uqKG
z@N5*ql4f*oG%d{2Mc<gkHS!68Qq>7TN}~HB<mv$Lv0F-MX5-W-PFNImi7i)s6-v&Z
zlM(88NL)FTH2TCZVeerdE8={;hbJFM&+GAb_DGy6lF|w!wKVL83qhzf697#!E%H8G
z6WnVa%52!j0vR$AP58lIe{(X+PzXlG*M4$>re^}9{I@7)FZ#G?Ixzznu1E(&O)JPX
z<P(y`s77ZZ6eh9>C{}4wiAiy*NCL4D=ez_l@n-u1^4uWaeH;%$?On;3-=HV?W4T8S
zJxB_RrHF)6&?k&u5r6nYg#i@N+AR4sW`@&(Hf~D2pHEo<x&S|`1ZPx^&wnX`e#W=j
zsFxw(HA!l_n4_6uNudRp4;6&)ZA~Pz2wj;$LE}OK41$D}s0USv1gB#Ic1Z<fEIv_l
zXc0@vT$Sf$FG;&uc0(ilrk}48^xtIX`LwYxjE%3IX3t+}sz@M*b%4Hm-zRPI-B=^C
zXRd=!aAuQ%lKx+Czv?qzqojvx&A#nvTTxJlpyP)AFziEpzNsc?2BidVOqpyk^o`yc
zn*DBhjR8$$&LHWAnK)cQb3WKOoeUO$xxU}v=i3KXAo;N_APD&uywX9n|5;Gl3`H>G
z_vDqh3^Ee2FrI20u>xpo52JJ%QN)$3=kh`jV)-M$g!vKXLW7RLtS<BWcbl4DOYJH_
z46mENiAm{Yh{MU>-iFyVGhKez3wyaoQABe0S0gS&DLnt>y_}Q=sMhs<va4TI+4m^+
z-LD<_avQ3i)g!n6f{v82UIG)vs%9oF_d0B>hw}o99H+_KiUA-)?Y^L)<-AB42k5-F
zHH$22UXIAh>m`i{`x+s;SSQYDi0&ou9(S>{(FCyK*Z$hSwX1^3JKiPcR(0a()E~>l
z9`uT1Cm@3n{WY()EbcFMTN*yKZ&ufy&h|^h%lyo!7_wcPI_UwEE>-^zgQAqw`fm(V
z80YiiPP%^ffdxPahIg2OTfKJ$Wn%?=<oNckgsw-Y!EZSKKF{fVaz+0d?lI=T0R2D3
zviE6qk~d6=FemnmSbf|3G2jpOd(MUXa)c~>(gGuoRAZz-0t1nAGSP*k#ahW9Om>ZX
z3y5~^e6wWtRCY%6)q0e8a7j312%i0Ns%#YkyC8PSM`{3Q-_x%b4C%&>-pM@;vl%6h
z1bEcRq~cSvzodII-|s#hEM&-g+n;aFy@;b)1cIUHa{l))v+BM2K@hV4O{CvKok1rv
zNY>PYL|ANwBUI@$gGjg+z)_h5o>dqmR>JL?dNyZx@+-Uchcy8}0VBtLlee-A_=pju
zXeRpvQ3HG6Aal#Wo(PFbxaaR`7T=}G&`-v!j=O=`{>X}G4HE-W;lQl-%`GpQ)o%eL
znAq0h+(964mJd_{I6LbIx(*bavq!Z?l;VZZ&%~DaG>psvCJ2ZEJLgClcRyKbn^NI6
zL0z^118JT-u!sB0a}b7+uRX1wLm@9ncc2S>-LJCF>^s%mLqM2$LIM`i-OS)A^1~DE
znoWkxB+jBXXQ>BRy;f8Bj(wo$JRT+jX-)_W>e@}+bhBKSs+kh8&srZn(0QH^JVk*E
zm^7~iCFZM&k>C!zn%@P50nRSafw}<S7Ko%NpG;YT^OD^9?JmRHxB5@?7>Z$uLgny9
zm{TYb>#oc@a*Q@EI=)u=s<s|@`QZhQRD0oj<==#8K^@rrnP0CdDVLoVb7g>ri$nm$
z^n4*Ctf{vcuB;7<PJQIY6+6Y&Kmk^>sg9wyS4(4!u(cRxq9@5TAz7dcSC_T}z49S9
z+)-+K4aj|V|HkFg>N#%{s8G&{-i4GQxVJ<=yJCi374!XX9IpS+u(ov8jTu8-$E$n`
z@Y@H=Ud1-e8n-UUa+9gM1WS&fY(hX1!z%8~cnzWPJ$|?lV%sx|MT_X2L(1K!Eqx50
zjGg`H*|Q678RG7Ut5+~tpPIFIL)G|gk&3ZkM_n0xl;yx(52Rcakl!jZZ!Y6(Oq5N3
z=3$19@H9+spU_VC7*mZEmf9-zjc!OJO|tS=;|86<*7cVMN-S}^m7FE+^#;JX*Kn@v
zF{$k2(Qt*kyFM~1?E4kCS-gl;^`6ik=zJo7ynLAm?$;x4StU?-=3^EMT4rmgK82&r
zBhf?=F&Z7_!bj6&l)+PlwnkkhSiwzAz3STQn7VM2+VGxgs4?MPtm}R++_tDPXPbI>
z_ET-KYmm{u^dIV4F27+ZI16|lVe4o}yI93{XgrQJPpzr=w?AES+N)=XU<5x71Z9eU
zsL8LKSZ3H5NuL?r82Lo;ulJy{pIQifWpbaAfM1dXm-EvEL1)16pNoRS%VhF2PDUOR
zyGkaiop^j1-52hr4I3^~Bv&{QqPTeUt<h39dna#+D6Q11T5i$3C{X_A%Uwap!EfWY
zVradWY0+fmso~^nHFpj<Wv%>L3{ATJJ5U!bIgv`B<k{Ql{_VD`&FgB)-9FM!OEFBX
z?Q(^kV{MVLm&3HuvfhO+n;9KAzDxkn*CYCJt9j>eAD*a~NPV0e6{r8H)=V~}IBVB2
z8DX>&`RDsF5M^b6ZLS%Y8>Z+N7?{wbbdt*^x*qs<^SR%-3&ed}wkq=S(^QVSL!#_f
zv|;TEwm><RfW%0!pe(z^@upVlXh+#gVeIRl#^M&cLlB5KGLGK$j!ryZo0kTl_}r<y
zN^|LIO35=L|Kdj9$aU=9cl+1{RL4mVTSI~GSU%lADGswELqgN@f9Nm$*5S2;*y83X
zC*Rdv*KG@`P`U62f5Vd7lVOkB>`C!VWe)kP$Vw1!vuQYWor^N&@&wmM{L#N@R7$;U
zlLB#msifZAEcWP85{!LRM+G2)4qm_y&9*8wM<my`Za}!d>AAHz#A$;(Eci345h<w0
z{I2^$=3aJ1=)7~<cR0}JbZPWDZ%4BC-uAQ!<-c&K(}M?mRQ)I{btBf=+K#@rO{rP>
zy4%ycI^F?&#e3gm<@gU9`g4X*dDX+me%8c#Hgk?T9_M0-Y|rx<jsozbBnn1~v2hk=
zqBVf`y17x8m6JOk8yNIte8qs$0=j4QmNo+i?0cEEfB61iq}Ad5^Q-x{`Ion=t816c
zs54&wdHFxAgG)C2vR1<=7U*St>^_#1KE=j6p4_j%`??vee==%;8M*Wr^@J$Q6>Y6L
zNLN>d)c$C`{s0q5`&n-q-UVRNL9!twgYb4_P9ne-kI({G#8@hQp|s)7YE+Ak2GXS|
zv;GGH!PYhdv$3+MU_|7!_U?tO1iC90d_I^mo8gZg_|*U|K~$5M&~-Sg0E*d8+!nlv
zJIP=#Zwn&nOhs(&Ro6OK+B;YAcB$cIj`W{3a$D0I4}f!=?TGi%`AyM>m%?9C5rby4
zDf|6s<l&_@Gsl4@JKdeca)9p5p!<(AG1n-e#D5u}9ggkr(_K-rvx%nEZsdhA;X9_9
z<Y*!D8il@I!*evU!Df`a7V)I>+Eggd8|O=&C)(5ezkBiR&|LuUCGvy5WMol8*ou$G
z_l=%G@BefyTeCBRutc}SWo3--SZL$*saO^9h98W8)9y>rCHja<G{9W|&-f;Pj{_mc
zhx}XQ>;n<Uc`$h~*%eoUCmkIjhaW>>WbJQ524p+=K7rLlso(T%PP&_yI)yem9?+|+
z4poMY*hV+!8}LRu$191oYcocjBgp7pFX*iww19HmKps%!WC?md3C__i7Gf0vo8o^f
zy9X0=gl17~gjY=I=yvJk&)PzIf}2Xs%*%HgTSG%zuSp6;v2J5ve2WPSBR;#@LdGAb
z`;W-yo6sz8LaCAR1(D95OtXaYCXwySWAN8w<CY8HzAZaKolDJS$!%ASUG{{2G`M>9
zgn+H9=B{#YwxcUyg(a7C?YgoJ`44kw&4RxpPZKpw*?|Pg3eUF5)Al}o4b$z%Gwxg>
zDd9R*#MjyNhS;n0#ywc}f5YS9*R_Wf|GUka@^%z~lw^Ip323lZRHD+lWF!4M>nfme
z+VZe#@jl!OnKEqs;#)lqmYq~q21m{^WdKFX$a5N{QuuT9xJ91?5#m<xy!fUSG9^bS
zNs@QxzyM9Z)|08YA^xQ!K72}_EG-SbBtnjDwSqf7>t(e96}%ai{6wLDSWkDqXL;t9
zF4zc}`E<~gE&KOs*irhOVs|x_G+L@d9yEAMv|3+ZfgB{g9|6g}y%TQ0m{S1zBw(T?
zUOQPYa9936BhszzLAMq=wc{ysD`D*Mn9^ImV=CTl-hm%_D{laMX|??d+GD>JAA=U~
zGqa-aB^fuJH`|9p)r~jabT2!E$>6JD4}Rg^xoe3L^bRs>=kx0WrY3Fex`M|D%er#k
z*2~31$pzr$@{_keaJ?_;<ibLU2gs_@3&gRSavz3<ppgYnN@X+HXuoGR*rxLFWNqTL
zDFAZJ?{HOlcm|r)txmWG=yhZ6ed}{taTZ3Nz0*+&tw)sob4kVOC{3Ff#NyzCZFo)*
zC0#h+pnjZMhGebEwo;~sv`BHLQ%=vW-#cH|cKio&(_+7Lj~8U)oo|l{1wfs`TDohk
z!R8h00>d_T6d+vl@fdC<Ys;KAbYt^7GJodyOHRceBkXLCLq0ls<dRhCmRwC*cV$ex
zW(wLZZ_{P)r@4b;ggBvXN!;p7J66pei=UUbN={`)?0u%uE0rst-|T9k)mt&1EAspn
zm&Jap`|Y=&&Ut&*b{2_#1;Cr`5WC*T_;o=xJjn7LHtVm*A)~?{jn(ZUqM%sVqHJ`D
zG;|4@cH0o|F6yYYEE1aD_F639wdKDdE6Hrf2p!8F19Ec4V55`7qEemD!tR&Zx7W4A
zpSuI*gUfqz%fqp?W|pR-7|l<LsWD<Dq3>C-Mratq0_7>83gp;5App;#Hf)x6!BfD?
zK>-GfR`HR*T;v2A{?RG0XM9m*^8i;M@%CqMyG4F<BjTBEa9%3|^)2cKqliq<ae!|_
zK2q>?^uR^DXR>Le07n64<O8*+iaWT=fMRGbNmGk&YhE!aUg%$DQpl0NO2nU4L&J;L
zOGW!`{KeLtFd&tG2LKiug_&p0)pS|o@SJ6b!H%>;Jg=h3y`_>eWR4NI(wPnck0*!K
z(mX-Mc$h_}lD|+zS)KA^xe=!GCzhe2XKm9|ENQ_b2hJ55E6^x52uuD?4hBjt)N1Ui
zo^I(2XUFuFjbGN<8mxt-lT&I(t|P4*oM6v?KFUR<!1YiQ0N@VZxi_mbCtU(WvkK9F
zmV4VgQm&~f&Kj@oPAYCy@Ay#+TxtS_qHKpfwRV`v^;S4cFc$sBv}bPX(L>-C_nS$e
zi1Om{<Y<CqM$>QOJs3Ju2Qv*$2S*&D<3T3w5)~NB1=d`KL7d735Ph{y@G4|p^^Vr`
zh%x_$$)C((1>~Zi7-EYR9908jsh#v#DZu}(1n+Ut&=poIQK5T?5n;b?ES;9|NNh$P
z%SPPw3T-SI_qFKd4Tty%FZl5~zehO|{sKJxqYoj!x3QUfg^I1kP~#6!g@>`3?VESf
zFmt%qvy`ZMQpiJ+xx;TEJywWvPgMYRBXXdYU14m<0`B-|D}no7s$fmo8yGss+BSoX
z<z2s4e5o_T^)O<7N&5JnbUp0(I1{<UeWobzBZSxFJN&M(eE#9Ft3+1h^h@?K3sd_k
z;_o95p*|V1rVvPc9;KM7W1H03VK}B(VxZz~!z-6iHMkF9Y-f>y__kiu`)eESbP$-n
zgA9Lp4JeZ^dR1K;|Fg6AC2Fur5|uDLWW$f2M3813a3g<l=;3jy+jjB`cq1OPF1lgc
zlQYMZAe+~FTB<1SjEorV0YTS@i#fH*kJ^A9&RpWd6lWLZv+8@V|9bouOjDT)){?#@
zX?Ok+;I>n@Vbh3PN7y=LdPed<6!HV-FWkrL4lrng-C@8Qz5)8P%07$b5WurK&>)L_
zj_L-qa1kRviR*o39JKoI=2JEGpjeGL+<iy=xL&#hiu_I#oc$;c{GW{CLECXH(#4Cn
zLoWJ`oB7{b1y7uTP|!nmRqPA=YS({F+db{w;@5ezegeE-ML``2j?~Y0@0p9z9w$a}
z0I)NpbHz%kDewwgh}70-Gt#_==(y~{a;e{ISq|HRC7P-;!4z$WlH|xutC=-G0sJSW
z+I^{hw$C<Q$Woh8`$g#bp3!qOemBy+s-Ks>pDWC-PyWDf<iPKns$**?L3)n$PLY>u
zMLUyj_6IjhBxt7ObXntG8LQ4eA3)J3fKYnOq5sU3Iy&p*)c1A|!tfIFY<Z5W@_>2h
z-nk#B9@TNw54INuXW@^RQYaC1%o=Q>Tx(aNwNSFsPMS$EefZM(1kp;%Qgq(;j-Uds
zA+;3pg~ZK&MW_VXU82AtS;nRTK}23d><Huwu_w&uty+X5cSOc-L3cn6k)C-m;OTfC
zA2J&?r%US~z>?yxv)?e|w?LNVo5BL**KYx%N<DUgY^5OF11s$IZpF3t3AF1M>N3YO
zr#|BLqlgNL$U*-Ln>vM#h9-Pf>-km7{Mk{6opD-ALjWiv;VBuvbnwl+;6B=-7r4`j
zNGE+>R7t|nKA^{!PF?}_P)H&g@N^ou9g81hHAtQqabltt%9ULvLa-C5DX7%9I(%p~
zpoQn254kn)vi|6neNJ_sKwJimhMk06%l4s5Ol+e^$cNB%)Qa&-DsVj&Qr<LiR`aO&
zEpXl9143rkMfil;BB%;Y@DgA*Fc_qU)#GGO#18A(5gdDL$GGY66rl$NU~P}Tv%Ws~
z$GIhAbM^IPvgKwfRCITxAf2z_!{<JedtzvRVV+6MSG}T>#a=r~wcymt8d+z1w=J-C
zod)%yZ}j3;J%-yPU+!X2XIuK>nzXqF^K4o^SDcD*Qaep^3iTM1FilZZ5D9R1%SJQL
z>g)P<X=o(8IPE<@9``~3z!fiS6*_}CIza8(qO^A=j;R-%o}gP<OTH2F5y~gFjk)GL
zUqvHs6BAiqcn=xhh`ti&Vj(u<txQl0oH`;(C~Y&;IEh<{_(yEE7{h?8z2j4e)_eM+
zKJO(KB@^*a2`r%OfBK1F{?8e0QQzYdP$gjHq{|p*a{TJccg_p&|M(}*R=&M*UmWuI
z6C=_-zRE2^eM@TX?}LiSte=#*dA9iZGqhrOUBqK&v^oJWWs&Loq1-#sZn%E&u1`u^
zkB{<S;9P>3YrRM-dfiW~{{ghZ!Z)BSO(aB=hKs+QsKfy_?4<APc0g0Rr<K2_vqSfO
z3O#OJcfnNiyMWxP2V;DR8s;`ljo;jQXDdr(eLeBC>RtK;|CffMEkN8_!enih=Wum2
z>dtPU&JOKm7CQ9LQ!YT^jQP^M1q+&O#d1BsX!%QUUn)1o2rFJqI<eFm*~=FGtC%uI
z2=FNcG2Q3*-<p`NuQ7*LN8DNwpF_atGkH(IG@9UG<zH0l`@_N-CE~vKQ<Ts$w>9F+
z!a$*nhr)!NliNe0bEN=Z=(9q{NwW{arn5q#G3mE=q7!!ksB@!)#rtQ~%^s^=)tk39
z>j!d!D&}>oHx{R*;=lTHr|Z5!^cT+5)5PoiuD7CLWeGikJgTo1u>2elZG`~*=Nm62
z%s78P8h&4i;kyBznG-Q%_;0S%J3Lw=1#*YQ+m>Zjg^{(Dnco}&03~}@J7E6ejev0O
z!vn#bkzGtee!7CtOmt9W{KqTI(v%Ozl<;fPK=CZRd^+I!uEIeW{SASq+p51Xk7&$n
z5HSIh*ts42yXtioaYA~X&KEGzZq*HUnYc~i`|c>*_IgGhFo>vOa*-)uMKIhhly33R
zy9k0!p#iS1^7t7Vm}lTmDV{X?ImODe8(J-rm>|mIn<ScF{rcI95&GgoK<8m%+wn)Q
zv+V(gZv%HH2DF0r9DjRbl6}XhAm;dd*!~fFzRlPDfTvaD;(~*3;J^95eD1f0R`1t0
z*b(aAZIL8Kndy!VPyg}sZyhd>Se~H3-TnFFXPy+oqsro}9#JYiz5;|V8|eJUp@(Ro
z!yS!YY^t<uXENQ^D5T4L&jS4yWaaKzUU~YJB#LAY<?5e4Wkv>jJ&ft}keAUX!Z+}W
zpS>UO|E1ngMQ0b+6iGoq{+AT{|8?a5zZ`DJEeHtN|6*eqPUVnT|5t5{5HQnY<3zrZ
zPV)Tq1xJ@x9YbTFs@fBncV-;Uqw~wcLbEn)vO0buMeL9gx55~LovfTv7Voy-Ixg5I
z5pfIWb)dh$9<j~D7*CMMEbhAD%j%u+!R9+;j@Ju0A~oxw6A@g4cJyC{+nnG>Ph9LO
zgJPp~_jrUxiq-d$@fqW<Z2(;r8Lp<`3)(OH2kVQV|B#Ly=`T>fvEpY@trZ)}@VQWn
zgr8auvH+$XuN3=CCaLbQx|Q<)t6rM2TVPta6K0^H$zG~f4c#CedEl2ng6uzA`jA>r
z&&nY$f2)&#vYfJsqz_E~dRsHSshT!rV>|rsJD2W{%YPxvuS@3IhX4(I!&etnZ4J|E
z)8m#M!XfVl0MV7#TgDAP?Htug^OToY=u3dmEqD&cO=X<55krV}8fWd|+9m5pdQauL
z+(N-Q-Jfu8*#H;o$i^9&h}18SVSdO&(zBE%r!(>+mx+yo@)#ta$iy*!?Sbx$Bj-u!
z*i>v2EJCp+LG3RF7y!HWtOv+HvwyFX%|Bu3&o09Xi$yF|SJ3m5oqD&nD&}8cLM(#O
zL?4nQYI@ynz5#Sn%C(xkU$_>Zl^%oiQqd!1{OM=QwFZsg^!^0MWr0M5$3mBq{W+K3
z9QVMW2~^7Zn+zW|+pD2Kz9Xr67R<4tok8J&Y)U&R4La@MU_jO(dnR|)Fb8{BWXN81
zIZf#is=d_9Z{W!sAI!xD1@6wPPk*B!>X8Yew>dN~Js8vm%QHfoK@E!Kfi(;gk%qTK
z-eMp2YaM7fE90l+AH`tYD{&?%y?@g_LJ<Mc0%<2t!(a%YB#k5bH$m?aM2D)C7z_TG
z5QWIQAmR(KrGO!92&_cBh(-nYu|^SlBmIH%9A>&e^$P$wxo)N4zwvXeP`xVAyeu)b
zS{zeL#JifmTgP<#{Bv_VVAby4P`pt-c(IUpWM6@!F`$mD)fpjOE0t{R^zdLoLt<+(
zMMDtAnXtz8|JWYwL6jY(1dIMDjb1-PM)`DJf6E@CF9SR|^FM-_gDyeKfG_SUBkRu(
z4=LCg-M7TxwmpgEqagpZKu)HhyMeK6-!#Nbmh~J#zpzd;27F*5&3F_R7l0+zx8idp
z?!9?s#W(xz!AEOF*zoZ^p$Ba_;F=cmD>Sr`KIx>RDMN*#*nfEuwS8%wnU*W|;lERm
zA57KXy#ckuwFeXXu7XIQ*a8u5Xb=X$U2thj4t%xs^PM1<wv<?%EHxhBuQX*7?L`(X
zp64=-%c}uIGz2iAgS?Zq9d!-lwaiu4AvdrSN`Gw>U9xZft?+5sKqFXk1S=H(Dg~KA
zkGv)N7TFH-GM0>F&C}hu(~XlL-If2LgRmZU69IVNXY_8nwr}4vKXo2C_v{Jy2ov`s
zVW1n5j#B~|n7s+xQP9<R`&H@-@*;4RjzEx3imiBaZ~{~(PwOwulOBI94|e4^2f&U+
z(qa0i8wE<V$ZG(fmRS&*eS?F_*cy+AOz-~03dUOH{2^n_Aeo8S-=yVRY7Z0AtSVBw
zp9C=DnwA!^59|bkOjtl6hOu^)G%1^I3$C;hlM^(AcMrSUMX%`YH$!1|Ql>X;t#8Ph
zSZ<Ih_=yX{aNqlVgBc?=hM)viqlZqoYMRbDH8c_2tecV}JNN#IDIUs%6O#oeV{8v<
zEGQZ{VR<b}Yhp}-a?c9LWp)GSpcWuJZ~)j*k{+&Q*M-P)=X<5x%NWB8fyt!sw5(EX
z$wzE?m>IVOZXA!FoBf<#ugc`?=IyEs35UM|=ZW3ijTUF<lEr7g@=?sPF2kxWR!VE7
zTrl(1?{3M?wW^oSJ`b&`Fp;6A=T%ChJ~nWvZ6M2ut=mlD@BVJOKLa^2+BE0B5CD{W
zE^P7AZ!1#*UNlL$gxkLw8)KRZ^~#|M-AjFRAW2Cs+k@;N=U6F!&yh5%=*`xMk_P&!
z9IkPHvz5tpA-rWPz`0B*#8_t;StPzG*qmH!zQmCAp2fxbAIlv=e<dungQY@iy%m;#
zGt~<z3(GK)EpHfTbh2jNP0U;hC;|9m5o+sv{PXS`+dM$n=^t=k*#B)4)MgQ2BbdCt
zX+WW8J`{DHAslc#v0J;f_)d(`rjLBHKz5Fr-MBk|f--rfk#n9uSxT1MDh<a4kq%z9
zY%$c&tk}|K>omDGxsYgPINPMk%uY#7CgzCK>YfC6s5K))F(jHB;G}6B2=OsTO0w1M
z`co?_7{tC|<;Ldb61WiO*wKUH!T6>!b<!KdRjsV{=5fzbp|b1!{_P&oR%&mUroOA9
z093ieg<R~tCDsKxT~Y#s>n-bn!3xpG_O#4cqwEDsa1cW*hR77M=tCp*9`(9uT!nNI
z|E;27JX+t?I(dA&Z|;^kPDv+4ql!oC7U(e~%5z`_dRX~o)y;Jh+r!nHK&@MjyWIAG
zF)frs@bOlp@F;APJId_|!QO?Sa|YY5-^<|#5R?&|DUHv8%&P*rSuy9$k*M#3#{DOX
z=oB4k`O!<twZV>&;43ukWa>FtDB_`DVfZ}h!_1lC8E{y5$m%3>*$QIp1UungK{TTR
ztih7SnAKJE%0*mPvRc%0-2{?#=3CIoyZ`7^XD)NlU5;S-_%`IoN;soWfL(AZ$r;Wu
zy9-`~1nIcpL#F_O{@nK@SRtX4rJS-{V1rxU%-RJcXB~-fP_^5Xz*dbrA}i(=jv|9?
z*S&v)il%zF)GtR&Y$I3NBpbDOs~rBfLIjE}rICp(hX>&f_9}ydkPimNWf#%4FGLI~
zv>UCd$LQ&eq;gun_hgoBIpOxJGFmH@AMV3pb1pzPUcv={D2pBYWTFPO;1v}3xJ?N&
z24ze<|Hr6yLp;@C1jPHIg<v=e{P-BorJrT4wJl@gJ&qBz@Qf5&IdPbdYf}Uj^8V1W
zh&z0p;}WT$k<Rf^;Zki8&l|zqIn-hT6!M@_dslT*Fryrr$Jv8=*aFr(WzMhXC@#Z7
zV6X6n0UIB%o<dtA>pIbt&}J!@7lC=O_5kKuu*VW=vTu-9*6oIgodxh@&K>I38|#$6
zz}bS++Y&*VfLiN&g{+pmVOOKE_sPGq?6TTs4s^ltC1OA?@NHKxq-4)yrlTE4t#7gX
z2$|080PCu&o-!WoVmB>=yl+?+l8FefPYBh=4X*%jtZ$RgizSPqQhL8(lr9SDyNe_C
z)D5>8Q&pY1SV(y=9#*6=j{9AXw}Z@sCb09AaBPyDTZN=b@UcbXNy?o-s-W$`epzI9
zK!_y2!rpM_=$I0Ixk1~3SWqZ)z)^$Bix+IJB8>NWYexJBHn-F0UP9Hg<(F{_%?E#h
zL5~BHY2i9Ec%Jq1wr<+p9P7*@om+dsi_8mVu>;0?Sh26*CAS13KN`CyA{ZIBk&Gz_
z$zozgP!x#@9(wXWoEo{0b|1|DzJ10c|3Lc@?ouV+hdc;BB%^J9;AUlDt{`luKK<7N
zT|lh?7d!22LHgWfI27TOEeI{9%2cD!VDAIm<mRRK+jvhGYdk<*UeZ;RGUf|~t~OG_
zfe<la+pNSC`~%y(s&wy%m*qVo9}nKRb(CX@QLFJQZEMCYOq~{wSXFZ$(=p2F230sf
zn6;pF5v$n4m=}?qA1uhyQ7vl6OJKSrfh(NBExd|$O~;?-rCqKeHGZrlF;#$71>yl{
zj<9IbuxKz{ebG=!f75G;6Rz@zflN^bdHkc-BMuTVXaf0W6@gN4hnc2$iHtjauC?hr
zF(Ok`4`|9nW!1r#Ln+O*on*JSl*No_JnU=$w<n6)#RmiW>e+qNrjKJ&Zn$Gu`dgKq
zsYAB_Be1=>+hkcf97IBwWP*<iN96#fc*`_$c>f1QK)SzW$&jiC{tnn{L04E^YSO1_
zYP}Mz1DB1Jv588cwr_akUAH}RzB%-c<g)^>Z}_f-=8g#UK_yPLZ(Q7P;#}P~1acKy
zo^!ae0i_5*9wcW2!4Byw=7b0p)Rvqb#aWhDE##3}qom-ZhiSbz!<+WaS%-dc_|>{f
zf6}yt`Z1VU3r<puCo?Zbyg;!AzvjaQ4oV-owP3)C=zFcz0$~4M>9LB#Xuns4Ceyor
z{NUc}C$GGK?IX2iZU1p$@y#}8d&2`;%Vui)=ul{p#VuD-+<uu9)gn&st0|WXbebgS
zn}s_w;IsXH%u=L?YLc;Z9UwLRx`Ms$f96q6g=3WK5i6QThiL~Z0J#^_kDw<SIJ<7+
z)e~+nMLJyK5;b|4M8DVG**c6-B2y{BD1fIxDN94JQ=dOnO7<n#6*_VxGWoU=Q+QPn
z3mO2UUsV2+LZkxRK1Xbo+v1zowsgl@Q68wiO!HNAxb<yCdKZM-A4uLCb1k0zf4-6u
z2f&zyB%p2nfk+ZTgXl6)9*_<v?zlo(qP+PCWs-CoGKtL%v<ktbXh}Dgl3Fx4k8lH0
zeK9&zBX&9QIktZGJBuXh4}i*neXNuKlfgBf3?kAhnw6(a;HUaaai4@^&V&vxESS`3
zgg~s|cE%Nd0{<7`JwbHb!>dK*e}u0^;%ht)#H!T<m_cAkm!20kNhB|mB7*Z@k;E9-
zhm7@suOosS1}xNFoxDgUh=*afyW*NQk~bm$TdlY&BLqeSxw8}|ha8{y<qKK~x|9S|
zA*m<!1MkVr_`Z_D-y#SLq}kP~m7QXdX>}UFtiYDQ0^^+Y3CrYpDDW!uf3prC-l8hM
z2jT%H1bkNpd}hJtX*?8cO~5wlu^)ku1iWnE4j`9nR$Jc2qFN=ZWr~Os$%RZ#*3s9M
zW){UkLs=}_sI8_+V#=KzPNXNRw<ZX{uU*aQ*CaIjx<OqD2TZhJ$pwD`IF}TfIC?(`
zDFPn6mwW>3f`9h&Hryy{f4~28_;Y8l8@zdQerBD*S1yIyu<n|ppV4KBT?RnxsqeiI
z@M8P@z4lN0?LU3fJ`JIdJ;aB)z?)A0=gynKVAt<O{h#5-=i9;F1ZYh-U~yET^esbZ
zm8(Xo;V|hX{ewYBRJj;T-ph5$EFUG~gcm?75jG+ms~`b*aONQ!e{Qi|1ygVz#&Y4m
zg^O5SLhSpf?+Jj1x&=pK6-CDICmF#%aNke!0)8N*V`7$6@MlbEFc_YyzsQcl@2ZHi
zG9e-b$lhswg_WSyZ#m=vN}2=y^{j1w;+$r4O>#QRL4?L3y>DUf>6_WtY*i~Fz7+`C
z*Kyl?6c%8m+~Vj+f2TRejXMSwwjy!!(W0#KnfL~RW5laCNdZXC7w0HCCbeolo987T
z(Ql-VQo)z+ukAbKrDksa!=&)R(!Pi~q?apr7TD_Qmn58ZbcbldKy<M$Bw%PIfszwT
zN?4HKxF{<rvpd43yF!uL4PJ@^jHoW-*Q(4(at?@aVxeSce;=susz!b(4*z@jfbyZ>
zH$+K-M4mZ%>}M$b<=M{8bKjFyr*YYe(}KsNo7Oq!S<A@EMlGm<lD^hFp72iV2uN(`
zr6p<#l<5bp8Gtqvi!&%b<Sp1E_#f%Jd6C0T&B_i?Vw~(pl-|5^o{w%;D;UM=40p3t
z<yOBPKpi*Oe-Wgnc|4LGwgfraI{Ol9AD*>fVDTlu3%1Z{-3Ma-CSSCm%mgplycLf|
ztur7nc>!fJ*~(`nG$16$&_oqadN8`wQt5lKxNGSk-kwE6MIl|lNP9gdTIDT3@k_uD
zD1!pTks;y2UQ|k&zWkBXFAY_wa3VvVu2AA5xpNI=f28I|f&)X9n+2bG8Q(2<aRc`#
zM?U->Y5{=w=)BF7%m=Ix7&3~RE-Tb+BGvMNx$%*=DfYQ2NXt+60czV>l{t4zmKkx{
zPn-}aUXi|iR13F^Bt5GvXfB?kKzsQU-@LX;%Bix=oNK~60Q$Nky2djhclN6ujv>Us
z20}3flJ^>aU1gP`knmUW@B+2^(MD>(wzjyt#ep@>+U7gb!$&p;gA)+rCj&P%enl+D
z?%q75s&T_|y`|N9$udp600k}WwE(XnuMEF4A>4-s95Xab1X>6wk-}IASf)YJSdA5i
z^xN4<2#)NlA`^oMsLxC&;DLr7p=q975J7O+?|X}X1aDFR)qLWyzSqBQi;n?o!S8uK
z&o6l~@CF0O)R(OKLFL7VEP`wcUa0hkvhgQo4lKbni4I6~eT?HG8wUwL2oTK&69G!`
zoc`H3UjT>fp~A>xEm*4-F#08;yX|GQZq3sL5EEwrBKvD~)HrbrRpsFFY?Ih*HJaQ3
z8B{-i#)!8`tSxoNC~6?Yz$;@jv?QaP`aWS*VwA*icx5cDD$5ec7|G#wVOh&`C#f8H
zgR2#+g5Ho|LE^C%;IXh#ULsXRy=_6^gpJZ!(HEL|h*s_MoY|BS+M_8|3-qZlCqOTp
z)nOW!CEDpAx&j&{BTETY=BqqMh6As0XvMdGi=({_T*q*3BrjyLgwc-3HH1Czr>LIX
z?^TiKg|K&?2Yh7aS{`mYG#zqq4I{TkRTD*^E=Fqjwd5h~Wx$7qfHF7gCm&aT>mbA?
zHtXjIy(oFqnj4$>TsE#Q8u0iHs|BobshDQhHs_9}$ZpczlNilhtafO3O1rVm8d&9j
zmI8WoHm*K*HDY(d@LLJP?}{3bzIC?R$YmO~L}MwGB@o8$7lQ~1wVRZq>anodT(8~s
zaAk_<Wq}HGCJUlyL`$|2xvw|L09Di|8-cKvi(rhbJSybr<)!t=>=k<FOpd#DV6wVp
z4?$yVDxeNmV|IpT$nN!J;h6L&=5CLFxXnS}_krUa03XS`?SuCA7jUAg{7HVri=(*Y
zHg3zCl<R;LWz&|%B<m?bGMP`r#f0vOG6;PljCpe|jQYfPI6ml5Dj6z^Rm~iR6m^42
z@RJaq-6Xb0W85gAokwB9)&V4J71|O4%btr9?DZbtKB1&Ne2BluaAs|>`VX~#Mq+_D
zHK~wGhEbq;HcXTZ$jqZdIi1l0rN>dSW*#N92|T?!YES{I0tcS?j^dDwg<%qxys;SN
z*yEstyT&1Em~n^-w~j*;7vos>vw?4)?Fa6%oolV*mSs2XC7B1v&`E-WNNE}1=EAYE
zrqZibU#yQeu<fq_5!VV+J6M{3hUu2>HjJT=76}r=`!{S1;5GiTGQxLik_;6#hkHx)
z!_Deae&|km9uJf1W@9nRVT@RY#Zg(CovOgndX}m)jN;yYc)%7>+FKxRCUe-I{yNw@
z*vG7SBr;F}bK|jnNaw#|Bbh2>KR`GR#exTH5~+?^ivR)e^2}pbs+mQ95sRaI@N3!D
zvyH5O@N1DXjlALFJQ=pn`Fl9%{(k3ASZlwtkN<qZS_gsGO_X!TZKrFg2l1T78jhGL
zdLJi+)=Tqsd1j@n3m}}>h2{9L{FPfCZU^Y=fduSux@LEs-=$ojaLDxF!ZTWVe|x!D
z2WPj{$AhG6A6T`;zWK0!B5>Q}4Qt|@^uM1qdG@JmV&jqz&FYrQ&Vt;&oEFj{RAXdv
zPNT}f#H2(Li7&;<!A(QM#TzFZg_**ww`KzcUnmtqqHoGl_{XSPWKCuRt!%|grvz%$
zN`%ifX>!*LNt2K4$c6;FBWpKIM|zcIN3fDtfUNSXj%3d*D^Og2xO_56`Mqoeq{1*B
zaip|f>BTIKk07sGmulAWGAWbu1c>>YlL~Hdv@oP3z)HP>1BX{u_p)S0Q1_rfnYy9Q
zx<d1avriC(ql{u>lW#*9QaMuxv7pyj8d_;maNdH2lrn9#`lw2@37=R8_DI#(95R4m
z7KFKvHr7tg?Io3en3oDnlM$DEa#U}@=AnIQcvx>$Q_e#BR!V}~DFn-eRCGP9BgCFZ
zB>JXCVt<*G51>bpmhzDSF)0@h!n##S5!AgowHqIRB}&q|WzR3wWRIi(95BL08o8Qn
zq$;se5GJPSI7;QOVWdWc*2?{~wyG$z_S4PYp(~;E4&VoWnL_ye1u{1a$v6ok5A@;C
zY=ZPV*yy63u6kj^bvH&4sj%5dg)C<)?cBP`(zG&N3*m_6otPOVuWi0BPNG)qx&!M~
z;W%>$!y4LBShXO$l%N3*%N4RKHL}wJ$Pa>)(4+VPvuz-<z~SfYtm5{p#LfzqaBx`Z
zJ35k>rEJ)Ly^pl+QtAwrafCB00C9^cq8A$_p&h;e_%O%WVp;Ulp-e>d@ffe8QmMbO
zqVVHc+n3yZo3UhMy&UE82p)+)!l4z(LTTm_umqqT(G2v;3Q|S_*M|N1cvu}5o2sJ+
z;CL`P>x{tB-As;__K_~b{(w1WybP9f_c*1*@hV||1;plsFdd7*Bz;mtEhU_5$TG$Z
zISTohFwqM0HIpk;DHRVagW9Gw+N<I6G~GnnY0y!CmC>`s>>L&mxcj4gHV58(bb_oo
z9=T0Q%JAc?^Z6b!l1BYn3ia#fNE^o=*(_3XAK7NN6!7ieIpkQ)d1J(OTY*_c1z#wx
zBA~lNeeDq6>Uso-YXOS32&Umci@jszF4{e#4$>9cE^I3%ZuGlCwX5(_)>W2P=(J)A
z?H&vef01wi$q~UK?d&Awv-la4&;AvE{r&cz4t9fCxkt2$vH9*F4A#c2CsJ(I&Q9N}
z@;NHflgSk2^(h}$hWldPd0tid%;sckbNONr^!k8E>!|}HZVn5Qx<7Qp?GGGLkF;rk
zOAFO{4||pP8FKO0to&D&tjQ<6EEGq(4WpwSxoVm#GSe6}sA=9yq&6}dm@GPf%%pwF
zLj<jPCV&U^kkaX3S-=lDZj$*wRKCQqt5A3>o39+NHbRMaxX#Iru`Sd6>q00PACk2e
zc4Jw8S&<W<`?r>c36<f>#S%ejXXjCYa&~3f1E`9+At#L*h|jH?_i^`0rF<?V%%Ltx
z(FYi2K&}W{_QT<NQaRV}RMY2wNa`%hs|3N7=8aYwaNx8Dzxs~8_Lpl#)2T#s%g+F6
z3QO`ZgtMM{LGLGAq7b!v%VAt{kA!+&_&rJ5g6?_2<BKlk2r*{(&1MeCpS|$AhB~Br
z;v+8<1*d#?fnPr=iIXfW%`d~#%t^O|rQaK~ajyM^i+GgeUcfDVpRg%^jGT}YBB=_P
zWSLNT{S-}EP!43I;abdyb{90z=!C24h@z^{<e-Cu$RS${vZi&$Mg`CFYcCKu9PaH$
zfE*@hOo)tu98|bfS34O);4L$zot>?|uoR+cS$M^2OjyC<er~9;%)l${0tr(9{#Z^g
zu;#Y4RoN4YC(nd!r+0FH{N(uPl^1*~HbcAnaJ}k^xa{f)>aFOZ9?9C#?+PpO!vZ$u
z9=e<#AuRDyl8g0ZUqW_0J(8+C)A~1!t<&YX(YQ$6Xj>#lQhj3C;%afJ23PjAO0xn3
zsLZ9kb8PFt5pTj+60t#bwFPXWKg$RpV7CBze^7l`o#?b>O>0qq1zS;u6LoYE?g+m&
zl>tSd3W&V_5nI?+d2%JirHq$^wv`Y(5gL!|0=?07OqcRGi5eUmlO?+13yeVib8;05
z34=Bs{mE61IGPVbMz#GnSEwP8b}bo{dp)14a#nMb%+Y}Xs9G*#Czcy?|A2W1WZt$w
zD>t%kyWv1kZP|x^jt9N1{jk5!ynQs1i{Tt#;W1j(Wx3~WG8R4vd2efrhpvD5EVDZH
zMoEb#L}-1d5G7jby;~%O{27n(EWN>==A6v#6nbS|yr}YVK3pK_msETv98s7z1GJjV
z$zm_dVVM)SG4TVq-~4I}qbY|4r^YB{9^at!N0NrZ0C47iR)mh`B!c!(wOQmTcA4fx
z4$T%~G+3Y%R<vjxA+S4+tOS6esa*1+6az<R8&QZTr!1f47!=8&ovfXN<D%DWtMA1{
z61Pd`BwE8yvwHN&ujet4So&M9+ATd)Nt0W@x=bbVu<lkJ->6s52`{q^w2&qGQV052
zGs_>*e9$z194MeIe#C-*<+kJ|I_*iCq`8<;lJjdI@`pe^u&)H`ivDq!tW<q)&}89;
z`Rb&lvO=ukDQ!xu;$+C{FLUfC$WSUQgrhT@J;ID|r23UStJY?sEw<$+DUUvqnpuNR
zl)~9Wr14B5t@8v%-PW55=WwMSB@t{FIqyO-Lm9>sk+PVh+_jgwwrxBb1|im_K8UWD
zZvz1$f3@0p464COJCat6ZjmgFU`Ub?^3#e;4id7m!TVlF(Q47QfZtox)6$?j1Ypa1
zs*w;s7eL?OcM1c}>s1hGvszjv3=>UwuI0BVf3QrpY(EYOJlt3}^r*dg4EV;ccZXz;
zWm80`#dnD(6g-FMr|2>}V=k@RzC$V4m22Oce<Ye%y}~X04#@KF0xGqSjxO~R{T;eK
zekZ)0?lR9nd5;_8!54<w7STwa;;w=nTc%{#+lQ5ppSJZtV(cKlqbZ$aj#pNh*wzsi
zacWK{xpIV+HjrqD5zsrrBY>M3`X?FA)v$xQtJp&Bb<>iQEO0I023ClM4cF?*b*dH~
zf6=&c!Zo_?Onp?tQpgFDX|$GH6)I>~R~(*A!x!N}g%0AzzoV3<{qdSy3SL)mri|lw
zLUqdMFc*$gWI-hzsmfa%sme`9s?u_#D#->C@H3N!tR<0MLTYFGq>y}6nZ(>SSK&u+
z?7~AT;o&%|x!w<xyIk*&vnJR3+x9Qpf84)>oGQr^rwXLKTBD0Rj(L$p*g#7~Vl*)R
zHHB|!$*7Db{acYP!!zpS$Fg{QWzt>&MnwV!6&>EMItPE!0g`c?!W!SpfNjX<_mP-E
zETaN%mEmc@fO@O$0r_++tzwi;whX_jn56zh(8UuG84`u=X(6QUB6OG2<X3>+f1$I6
zoOczX`j=wvNp*7!_%7q&uwZ$n@7|XpT35JT*{LP*KH-as4bvQ0tLnZEEc6q@&?EOr
z1bdX`(BK1x1gV|!Rl(xX2wfSJ*=d+(nDhwnk4`Exreh|EdRH6^ogmfvDo0gCn4qQv
zmeI^=S}=fUGt%&DUUxb(&0>Gyf71fjL9RFSdkrn{VuFBn4KNwz(14(B5cI+<LFqFv
zl{E2i$YFZNsamIpTrCMsFTBR_!CjKyyu!$PsWl}L2EvF&!;<zxFqGjrXEU4=zn{;-
zBc`2H!xMmJz?u_)<@1c8Zl|i?_jLvxo#y~7JiN&)XF7_ELY=>5=(X`Ge}PTPDh71f
zIJt%qb1r{}M+FlWy<w5SB2JQF_zHoifOSr!TIU%$^Wk1RmOp44-WLq}9)(rHwo%*`
zzO2|43Qogk_#?dtUouKh6Gk|yOxA47qeWurqY{^gl&2n8510rACP0}qSJtD<GeO3Z
zXuq3$sc}=XyBlQvqMr-~f9O`JZv9>o9d2!9{lw)I2cb$I2pOlw+hbU^_Z)>~Y_1b;
zi=@PkxboYZCnC-fez9*NhgN`XLQlMV$kidC+7}l%I*1NDHcc?oqEBRW6*jEu8RRAE
zv14kEo6CQLwqd6YW3O@{2x9j#tbeLT9I)q^9-oY_@()@207y3)f59{%pF`}=dlo-K
zC#C*AvI|}tetX_7(NK@j;F}%n;|w{Q(4^$PR!#e=L)E|($qP<|aze*cK;N?@nk3|G
z(HTzT;$G$N2QCx8%XKK2fW6ApK5*f9=;Kw%g?Jw}WGsRxe$V3z^va!+Z^#AvQ90fs
zYg`~78?ce~#`U0RTI+(}v~;Ec+)JAv;lxrUrNGf-9&NE11me*s0ggf}B)MF`y%BU3
z*k6fbU_5Kn`2Edl1w@e@e&m|^1hSv70<`l4H;ieKN+-|oj={mWDI~!Xwb18;ApRVe
zVF&>ef9Fp8)a8?m4D(FHnIoVfVYO9wS9Sr!9hs<#cnC|(qVYY$xn4wb-k)3X$krw>
zQ`SjF(K(!QmUT!X@sbZ00Cp&pbP^!nYz1&KnVvcRhGmbi$cR%^UHB!J%8m3wD=SuG
ziA8}`iiDC}nQ$x>9?D=HvoE!qK?ZmT0a>|Ue`A1a9Z*`3O%;u0?s~tTAhkVLVSHg*
zEAFTzj+*i<FvA6u+s7j;hs)Zn5L0L|1hB^zY5T;|xouT&RxaxNhqU$_%OG_CpR3ha
zL~i3I1gRo?MF>r_>QSLJGZ~%qgjX076Jy$4ph<T^2J08F;j|ChkNm=d+gAm-Cv7D8
ze@p3Me!)cWPvB+AZMI@?RM7?5R<oOE8W<i-EKg}o2&Z1E*^2B~2U$&{1)wnCOBb3x
zonrvuIiQ$})oSj59h~c!rZp#v3#Dl!S%4Q9%l*{o1TrijKm+jTH^_CGa{hwNDO~Z~
zDg~V$Mi`bZ^%tbO$Cjk}C$qw7r+z6ne<RQe92lDyVkbS4N|-{bab&<$+K&|Yn6Q;f
z8ew!rTZbb6T(k+B`YBZbIJ~e{=tosV#?u&z)pzzknM}~Kt07T?#lnCE!Gi)0*i;ct
z4oF=U<T$~fuS9VS_-)$N5!ibTX|VPbleHV`-5Ls{dYnW+(Rin)bm^X+G7QU?f0Qrz
z7=9(?cMH5=9_cW?&4B|^sRCRr-9g&tP<#q;gRo8>qEhu<5?vtXd`^E+i10LvUL|(0
z3H;KC!GwYL6yheIZc;R(xHc|<Ko(yE$0d`*|N2@WE%H*S<F7?%MmqvAD<f&2D1s1w
zSyCY4Cw{>^n6Afi(hMl;!U9?sm+%S!1~#izLctJwx&ST6HCl0@a<uOu?m)pZiJ8e{
z1pY2E^-Ba{`G~n7{_WN#gn`K|zXvlox~+<}mn;hbE`L?M$4PiU3#;DyBzyo&HJ&PC
z{ZMoj`uhgs{!>Wkot<)L=ZO1HGiH1M?O>Xif#EU~YP9pjjFkLsh!Tw6BN6jA3Buz9
z-3n1mxmuZB$LRk-FAgtJ?$_HYSF5cBRg^Jb!Z<vp=*PVG75RJ3upkC5z~l8KiJm#I
z{Vbs+-+x?fjq+tUu6{94Gltc>_9+PDwO<Bo>l;Fbmm-?w)@5b6*S3__IAOq2s5KB3
z(4IHwNi&=x_%f5A9v*Sh?8EJ0M><slGE{E_{pUyx#=TdWkD(}ccJ4ztLXJ!Xrwl0p
zF*g%#tf}p4Tcg>Iggz4aB>-HwdR6}dQQI;wbAQTqb~5aiGlkCKzEttHFhrs8&aL%k
z2dcGN^tbQ{3ykzCL7~F1`bcVc@I}5*7MXQnQ_)mNk=l%IDs?r5KjNDjZZudK_Tz<+
z=Y;nX5@J6|m^<C@QGx-1!>6$NqGosjeCW2U_MECY;wd+R!3pBCIT!Xq7;pd?0&jb%
zb${w>uQiU76u9b^xOvd;U#a9eXBg%N=rq=_3C$hemr<$z_&(QcO8na~UbMX#5<GA#
zo?2;NWg=}NBE_(K#8_H~+zzwHt%LVm1<n9`SI`M0yJLZpG*-Vx_9RDaDqeZX(Ip6>
zA(7|+putU0sAh><R<5Ia^a@BE6}?FnW`DiYDx6k$kW0b3QoIYfim|W4AO%i|e4_*g
zH%B%xK~70jF(CQMxaKQRr;AL^jp5}$KBw1KC?wh1R)upZB&g#iI0-NlB*v4TI2o|=
z>IblT5^q}M`9_QYYl&scw7}-fSf_;OTfimBd+s?QU0)Dq!^Q9wd#)~U<?xK^H-8+E
zSVN2gNM=?@-s0mE=nO<ii9-%xbf|0j{z{EjCH7q{qU?gv&K4*-MML3x$nHz8fI`LA
zhJoe1hXRSiBKceal2szmw^?FU)4ZZO(=12iTGfy%g06#Hsi-@Rw}t~W3nWIL(dY{r
zeWkdc%&b*6!O<h%VU6A?p+*l=>VFj`S%o?V+R0)c4XVB`{k#ZIbA_jK4Bu#6R&72|
z4I7QU5flJSfeDU?^6p9Yjo?s4Ru|GXVp>dy$4cH1f|pU<%0F(f(`T+ru}%G`QRPCL
zSw^`A=2%?CX;k4c=kk~<k_Z7kcA?y2lZI?T;(vMCQy|3|az_->&AKe>A%FR8^3QT}
zan5?KD1{LQH^f&aknoav3t-0ZQ^u1QqsxIgDe>V6EQjXj7+RYRqXeIqqK?=i%5ajE
zJ4rgtxi!hOH>&W~TcZ3{?Wpvuouk5lhof~g?1*gbS<tH&31vdu>o5Fye}4cYfWHTW
zU;sSKJW%D<tY4eSz^FCoWPjLk3cs?hZF?bM=MC0`&U$C&^1^Spw=iUH*S+z!mouaT
z*4CYeK^gD7;Ur{h0|PG2c=2eURgD<3In53eBrXB1juPR*F)l4>bnu{<xjzxP;#q<4
z6=@^F7eZscoyluGe4CNMe-XaRm;}ub&H~(yC~t%FcUzwfi|qgX^nZ-aW_R>_XSX6-
zJm8_#TU_EQs{tI;S3aRpG6KgBM6$~50KetF1ahR1BE=%ki1)=>6?cvJ|Br*-4-8XH
zXPyaTS^S}J1*;z}=Y0}<rzU!YvEK#2u*@XTs<6r_0c?KZlt6oW)+ZNuR**)c|1M!K
z6ZSA+50XLj*5R67W`8azUjeuEAPFBPfO=mh;k!i9@`7cF4x2dE-WGbSZ!)SqD;e3-
zp8L`TaYqT<#tDYJDtZ{7jw0|=BzH-a!vNLE`N~QX0AhLdYu&uz+l5nMA#4^arIG<I
zSY!C-nWB6Q22!(XVbq(Jip<eE&#Ng#frW{*;%uaq#x1GjEr02u8z@l5Ga%VXngdPX
z{NZNxdR{9oTLcprsGPN~rpa(h5y$|PMk1;hjwC57o(%y|I<0$jua1)On4@!60{AeS
zw9a{Tg~880I2ep_CX`E91b0M-vaOeICF9mSFUfVYb0$^#4>Ctl@;-4s@4LB=om{gq
zuZgWwX6aJ?D1T&K(%_raVqPeZ=z)+5;*yE%6Rrx%wyiJ9lNG<v2I4Yd-?j{QR5bd9
z3}8*A*exlKuVLM30gxct4`JX09u~bkvyF&^qQ?PvfcN(ZhXAlI5_TWXo8w+#8FIEn
zxqaY00jyyyZP$s+NUDWEo)|P8b<2TP!Y&9!7|-~ew|{2w$m}l0*pqxBT&ZWka!4~k
zaUSudj>?&ZQ0y4_lA_WQOGcin>|B%Gw7SG-kz-x0x)7p^SARIeB3}R^u%vsELXUx}
zvJ_nIQeT^4<3lx;>7cbITU)-fD`Qf>1?yM7r&Qmb2z>}7J|wCbk3c|2hpBv_BNdDc
zWM7Fq^nV3(EeI+T(3V27N|z8Bg&W;h<LFssEap-*)f_{CrxB8+Ym9-P(F0=G7pd8S
z=S{@GDCj1#-xRhDlZrgADCwH(Bt9-FNmzE`CkmUdZ<ND_Nx|Ug-{CGPw-1vQShoQc
z(Q$v(sC7KLOw~kmD%5x?1*ah%#k+Bz;CO69{eKNU!~vtDzW^z0cb9%zCi$*;kR1w-
z`btJ6J`E>+^{YW+@Vg%q%dQ{Fsr7)L=Fv(~-^xNk@M96Y3Kkawp5o4{ovuXiUHJ-_
zan_-j;oHlich<&u{o)l0wQ@fsWMx$`>lsp-VTPPU-pf_j*&uwJS#Cej9JUKhmTTFr
zNq;ya6Q(QfOEtHeCwi)gU(#H6<OII?K^qkti{fNt7QkK_v$8FdqI7${734_e;Zqj^
z;B606%37oB5LOhU!=hv<V6QXZdm!!5$If4o_W~~^vMir({IVwWTHpDve0&D+@VS5X
zW4=Ia_*q3)U4I+n)D2qr&_cezfbT^qLx0zc@Su1XdKie*lfmp-Q@Cow*0ieTWw^H|
z0!_ZfXJ{|?M2T`wyvKs?3!nIQxLZOLCbkh;)JjEEJ?^!Mh@Dt3WuViKa*@WAg+Uv0
zbRq{1ZLvlH7_v##x)rrfPszt&nx`XPoCQKl87uF7`KH3sDHSeIRWXdvL5&#XTYuit
z+@cMn*%@~oI_zlZM4nMkh*W`n>ByT`+C45JQx`7|Hn$T1*|Sk3jgJl0j!HBVzfOYX
z9R69aYcJlER)LfXz?I{Vgr6Wro>K9IX&+3ysoJ|U=0uCI&f0g$H3~wDmWt0{;VN_=
zeeQeLZPf!2ZA4DNg$rOtv1jAfmw&4KA%<%8)VnN6^nE4*8d3bv3gc#I%PCaTHALKX
zqHyAa8uh505oh%XVt8lhA-46{i9^WmE=x?cC`mm7KLXUnh(aAJ7Xc^D31pX}ERfO_
zK=?7EPzoKiJVY^fJc)$`32O?hoZ2t6_^F8PjHchXvkCGw0L)y+X(u0j+<&^E<*Eof
zJjcLRK`*sJ89;%O!-@%~W~dm1cBOd!F?C3;BBLDRV;`axZ4^D{DSe=U&!nd_*aPL(
zn%AGFT+_R=%-P)+3$dY=c|F04Y1S#uV)Pk6)|j$$70r*#-zku~6`n<ySV_o2a_7=U
zpWj<vsA9~wgaqZn0Ql>~dVlJr!idPuI~vyc;G#ziZ`>-CIj6+4XNpevPDOC-ewWE$
z`cduVT8C8xqj$n$;bS^7dW!SnXULsJSNBpwUFWLOO@y1txZr?dRA}_?GQv0lxqG<b
zw`2ab2uCYkg@R48HsHE47qaxS0W6VXnB^2Nf+Zq*UjRGc^&$LR5Pz9%xy5;-oGknO
zD*85|2+rB2121L&w3$7}SG-W;j9~;i@=HVocN&?)ma9_oYonBKo25cYBtF~%3b<qu
z^;s(<ZCKUQzG;;8GZS&mWbYmT>E<OFIi0nyVhlt-jGl5pAJRT_2Gj(~IF(*@BP0Cc
z*ZbW(y2;?+4uf@VU4NBj?JXlQ*?)H<xt1d_R&F+WyHsnJM=_N1H4>D0_thOta_@C*
zs}U17*4{+XP1SQ+^o{C7KqL|exmQ5Ngx@>h4!fcF3WF=4j>`$TS0*D|X$LZx+ZQ)c
zQit-bXJ|+Lv?HFV2$8&#kH>KFeV>e~>6Zs&3rPtNIYwmo@_#@*@ll>k^Q%l&!#Qm(
zA0do}<rBT5eW|EP6RvVndw-J&jd!h5mg7@Ukgv)on-{29Jtm)(zGHnY7hG4wVccIa
zIB3VS-DcgAf2`Z=Q_C}UtL_)Iv$G{aZ#eFmx$V;00_y(M^|S2Z6AvE|>r@x%pS~#v
zd(3O!9ssp+I)A<3H-Mqgr4@cH=C`?de&aab68Uyr0dOwRvo$4o0&oC81408PxVhzb
zZ##A7j*FBXw7IX)Co^c0=|j)N>1E;+GL4X#Cm)ofL&fwtVj8hqv&w_btD}Z&^QaNk
zb~E*SRnDH``=I^20p|r9*zSw);DcDz>C$BW@m-oYPcDdS%sZqzJ3nGj2H14#5v>d>
zD@nqEHd%lTuZq+%C5y>FdB*8Ql;I4Wh0Dd9mu?sVFMofAf`P~U<_socrmI?o!U)OY
ziImmq)+MlID4BdXU`ttg_Xk}b(b1I;RV{IOLgnG@u`-RzY3S|2uQ{B`5KlJ!I*$wb
zfLVlc`FJ@DJ@_X^2XvtCytpXxt2UfOhUZd!i!+LWb5x25qC+8dRFaIZ1Iv=+&_Tz;
zcUWd|2!Gqd_`5|6V~jjDOR_~70)}7<0Js8pV_@_F@tD`cP$tElFk{kTPYR&OCjl_M
zjv=(x2AJsXX~Y2^WI;C`#<Il#+=*r@7!!H-IIpZre&`;Y5uiuouH_Ofy+(R5<&xxR
zQ(6!<`A};I67-^NY6wtjLsPM$<prsvnVFG(>VL|g0Dlop0`@}&OnYxc66GKqt$|n?
z$<mW<>0d>Mljw?yO@iKpWWyuq;BKMD2%R+>RsipOHxSIu&XI}>K8;I@C#F|1QMO#;
zmBnkBnc}ZdxX~yvptDKLj)zf-b!ZnRJGO5abr9{1MmG=ONuXk!O}G~VuA46^k5+UZ
zJ%8+p`G>?bEEvjAfd25$1rIR-sx2TMko*!%s{o&Z0q83m4fIj>?9rt3;%P%rnw=f@
zHrE9|FnwHf6;cAa)`MIsYwWccExT2qWCYloc}7fmmnbTlGZEVHBZOAi9EPwESJEiL
zC8h+7K|w}B{Q;XG<yM&{XCgL`E7-birhl|Cg2hJC$yAD58CR-gT%!Q?c7#GOC43o*
z;lG|^hz&Y1BP)PW6XaVjkL@7@jPS+HjqpauA&V11k)&j7CpHRntiXB=C3}#og)bG_
z5Vyz@xDOVJvD7jJp<GgtXo2Pi5F!y64<sF4pQRM;8HV}XVwjavk%{AH`;%L5b${VP
zh_|{nf@D}3!g+3^WKX4pnPN0(fx5SZae`#`%oKrs3m#t%*G^q#y)t47;p79`T={M{
zfTOLFD$WxYJ>eTg(W=Z&Vfs_XI_X)ly^^3;goO&y(@%g2Eo=g%$WfdX$R}X+dbtf+
zv7J5%C)~9PR(v4coeIYCT!jn5OMf}h7iJ>nyILh3B+u0%U(p+(w=Ln{T|XyW^z$h#
z)|v{s0!WNr#l5t88(Uf5Y}ox`69O7n_zKP1Z&{TSUeCi9uMy(p)7SK1qeUiOSuch1
z9yxzLNb{KNi*1NckR|R_P9%-|j&Ms!{;5pm54NK5E`L~))*;rtf%qXBz<<s`(ryUz
zx*!!+gUaMc-VF5sU7V|mcnt)s6w=7E{`L~HL|~5f;EV){;yuM?aiVhQCV`?A|3gt|
z==vzO2+$b5Pq;=4nb7<Uq?Y8m`Xo)2_4Xy|r@B&_nvk)QCZ(|1Bca@gav5ou`kPj>
z^zWg+B!esb;j5=lqMU6?fPdLrlvy`RclF@D=KeRpI|7&RV@2CUe(AJLLXb{w#2<XX
z#Js4Pm|5kTurJq2pH?Y3B2dY3f)d_)WR2vbYa4|YSy0emN#LeBoXuMK4+2Y~eSh+t
zDt}^Fr`yt1_$J%e6G?vRBA0=@Nu{$%a}+ksQPgOTlxPl%zNlDA!GG!SD5%Z+BSQP#
z9jgy{g0CIr!UvzDAx(jbI`6KN)|5M`me#z!s?pK`6uHJC1PPuE@rvr#nML8`xn;Qk
z`+ck%0OXjvxPy#DH0}^4BMk@5)u5n}PHwD;y5b2h&+B>1wHH=h{iOEy_(+~sVM4+%
z@e>3GaTmT8bgqC^;D27bey%}dwaSIz4e_kFKHsAtM{}%S;|t*r(aA~zT0)P}2i=ka
z5bf+><KlOqv^PkuQydMID?fqpmCwV~?ICp3S7jD)TU1z9HEBnIIcy8<KfbUd6{!w2
zT3T0B>tQdh$fvr-RW`SUZ<pbfBA&$kNMV768SjZ8s$w4b!+&JN6>y5L$POOf^i~#`
zK8XN*S&s4doCkDfsKtv>>d>=3q(_2SZP^(L&P~_&)!4Nye^Y641PFaJgofyr>QSyx
z)e!|YXCe3m^Pt4iS__3Uq?8{W=~?NN!t{+&`=ors_YX`UHS$ZyE40R#_W-}((+g~F
z-mLnlXEp4QSbrZ=0k(S1&>}sY_hQi}8gQ@$g*NfU`x!Wht;Nm`I*1R+KgZtA86PDC
zc5oDQBdF+^qb0~3n>q;SDF(zO^qliuH@0g)As{kE`i|uUnMsF&OQH%BKR0n1335jq
z_$2|tDCkCSJPg7>32B~REas>H6~{l$$&Ly&9)aRMrGK1Gm{<E&wZM5U-YCc&f<SfY
zB#Qbj&q-Z7O4?G>U!_e{)~M8yEIxpIDJk>`d6briGGe>MDyY&z;25weT$H;Q#-z04
z6XVh-Y-tS@-AkO=3~>n;XuF55!O(0_)`O6hDhSz>-3-(Qj-zjpQoLbP#KVPuO78X=
zhE4-Afq%KbK%qQ968UkU2D?qb!qHux>;X>=0kfnn4yX89#+Yo5M3J!$R-jzOr_p|Q
z`la>{pYHC8rM?k^D*Mxc8rRqz*Z5<{HEtf)jWw>DU@b&#u!5tABtG!Zm5TCa2AVbu
zG=(vC7h08ZBZAfM>`YACQL6ZB*y62;nZ#5+A%FJFvN)=BxoGHefy*+6R!yh4>0=Ql
zKUE5pDcfgoOU}hW`p?*OV4_ZpflZo<22Ufa$^oiV*riDtw+}>O*J=0?kcch<-=}cM
zWJjm$av-G#S85Tu&!U^PJF`i{%qF;)asOt3pe?Wtka)EOeaN2!-l05o(CJIW;*^IQ
z6Mt&`j_UpPZ`gPcjc`#<Bdh?^kNe{RJO6+^jlAkE(IDnC0=$+NBB_pEN~mhUpmn1b
zBunMhXMo4XXzhF{AM7{}*s1(^iK#Hj;i5n}|D*9Su&}CJJttu2>b-_jY@%LIHCoTX
zdTO!OvcrOp0Xa{9c#szqU(Fx(4LFYjjDH2`tlzwO{pMo*=vLRj+{;5;(C+340ncm<
zj?ThmG!$#Uz(0@776@{L<c7I2r(=yqbnF-i%}Y2F+<(N5(KGT<(?p}=%3LNo459Nx
z>Ai}ba`BKd{2oN7WDg|wT`lq>W%%_LehND;c}twzw*(myB8(uWGG_bQRfDyXs(&?G
zlp?hy7%K#x80DK38Xi5P0mjb<(WBa?T-lov_pe|x1|Qs9ECu`9&7GTg;k<X98zIjg
z^ZP%uH|sZp!RLYB3+>OKx4p-*Xz%AY<>znw)tdnRZtqQ45$*Z?H|3j?!RI|l+l6XL
zw#vu!TV@1%45JJS_EE;9NNj!-IWh?tB#{<T(*I&0#T}BVz-KtLJwQg!rigreYf(09
zVjaXiUo-`Is#0ZF%EkHs3OE?(mp&o^A%Ay1e>2$L>r@=yQKITWUGGAX-!aEL-qQEn
zhhYZd+l0nbVLeMVI0Mh}*{`Hu4x*|b57t2l16jgA)*A!4<KY1-cy4`k%i8GHA3wU%
zjI6|wC4JF2M!l7<prDbEdJzSq&@*mrh|DwzgUF3tG5ln~;!o&Bz5dCOBizYj3zyy^
z0U#q1c8AIMQ|R+gFmO)BpK98CPkPozN(;m5=-l=cu+lXx`>~fHBLN&vkH%umFSW6<
zO>CsMP#Vyv;V2y5!RiJ$N0-GE{VA!E_^MSGiNRXRI}@_3j(hkDAPKS*+vBw7G$*+?
z<+pOD{CJt!k8mf^A$iOsL9>^OBLN(L;tl9VcZi-4K!(z^;0`5|1<3xUwYm~eIEnNy
zV1s45WxHk6l2*Qmxu;+K)i%6j312r-*d_z65Wry`7xAnN3EgUCaOn$4=mjj@5n!x%
zPESM(8-9vH_&7{alF_l3H2xOllygm0&`S!+w+6GG#w8i8S$`~U_d<t8IJwP#rRKW*
z_v=$LCP|eJ$Ll}Fke!rP4^`|hwWH$<ZU=$>ZW1P=Hiy^nGrkJ1mE}erjXC=vTI5#D
zS-K4<5F@@>B2NUP2TahO50*gQcR~yPrMK`bo%VS?x}o>_FyMaVwLD9101VNoX!;U}
zT-#}22n4m@)jC7<Af<{VN#QtuqXlH4L95vO5p0ktsZOnqweSd^9el*j1ubuPbnZmJ
zw+FO!fV4G{$7A3R?rbxO#;aAr5~)(t@16-HO+BH_n!t*pV>=Hy6Jw3nOTwf+MsqjA
z!q5OuZ{@kt1mO7c*6i4`eACjTtR4YsAmstFL#~)tyhz1r<tT<~c7(Qnoq$X(;WycN
zMmm+AR}@I%RZ^w=RgC(U%Ua_VW_fIEYsRda533olKXO;`)>G1tp7c|<vzXqNb66gC
z_1t?C)zFuYGR_$QtB-O@WCib>!*O{LSJPeZm)<Ub-YD28YOPjwK`XUe?s^$?+(rwj
zb{i|=Ct_&G;zFnNM3v@$C2_gd*n!tQwVwSmdk;%pi~wbf&{n7C<*65Xi`2V)+kyK%
zkHkKzk?HPb5-;_G8nCVB(K(fo=oOv5sT5Ng*5Q*-am#uD?|x}L?B+|?%5qph{Uc$p
zj$tZqbFHbD48$UgyW{AitH^{``CQ0btg7mVGP}_wDJ-k{=+@4ET)o42E@aUUFkrY!
zN7*e!5I;#qXyN&sOzZJB#@BzuP27;5NE>|U7V!FEQ<>grhgO&Fdc~&JMj>`ZO4)p?
z!fu57*HAXJ3PpAgicM**hn$Pq;E{n+9ans;Z4LZWIB$A-jC4VdP*bh<3Q4Kc-3XeI
z<zA3ICz4FoS(pfaRBZruY=#S+okAmHdor+)mPG~*@$Uo(PrG-(#D{?J^pk<`7C774
z!QjQ>+8VQS3PAw(jb8LiZ8;q*Wmv6CgE6<+3t`4Q^0$M-Q`q7uk4Zr*U~TtcUrcs8
zk6v)Pp<eLt1#cgy?LCh!``h^dgXk%-DHXibp{WC_q)DZJ8e-s&0P5ZK^E%$H3d5~Y
zWWbJZDQIx6*Kttpxk0&~^%0v#-e<cte0~o2+;*mD{j$5mI=i3$C!dAh*3aAhHv^<a
zS9@>X{3GFA@#f9;ffww4<_$h0`rr}F_E?ExD70-=ALl(-_1aL;Dv);LxU#k*SWaM1
zwr@FpwFRMn2WsUS-n+9;`vO<}-uv`^t!8B3?09GAxDg%IH&5ZB<2o*?7Zli*N7S<Q
z?Di=K8in84mpx65`}l1gI*UT_G4s3EP=T1&a5d^>eUUrMy4^V7jr&uLcDp{<jgo53
zEw9_!=g0N9B{eX<Q<vS=k_`^^wg?v3GrzWDwlThcMQA@m1l)+bt>JDguN-c3>E_Ax
ze7q>epE!x}Ei(v0>k^rodu}XE3RkOfr!0mNi7Q+CQ~PF8c0j9D^9`Q5hXwfZoHWno
zeFUJNkeQM$kV~FnWQAAxP`^JN-l#`#oYW~WedyH@rffmB!;l+Zt!4P|c^)mRe5hZR
z@j7pR%QhsSqX-ek8#!&6;W2q#m=e<i)|!3+|NqKk+N`WrTR94E-v1$RUV0fq4-4a`
z$LiE_=y|M$IYKWf+agU?(uY>HgrPF(gfF&K2L@_N2^U7V4lX#_`3VKLaB!^Yu8qQ3
zGg7CFJzCubzt88@Gz5N`F8-5Qp2O#s`>kGoD-ZwV3pYbt+Pd~J8cn3>IX*n3krLeZ
zYv$ha;emcBN7{0Pzusq!<OW%-vQ0XWrlXSEM6?2Xw?Vsxg8F3^pNCssXBaU}@{_fJ
zTda>+6%9XPbQrqoCBZvB{sc|Q**=NSd8!u#yCpb$n2bg|lLxo7$_uTRu0U-o(gC4=
z#+<Yhu?IKV5UW=zL2ZW>?`P^tRA4HLAvf8XKQzI8`a|n^4`UZ>itG+GedD^H8r{M}
z&!x~4tZltIGPK<Sq$>j&j>_d&t(po5v}l)G4^e~kk&RlHL5{;AT^70(tLnmRvuStW
zirgAHZpy2bPEgE(GRH^zYJuSv(a?Q=GE*9!iG6OT2pAqkVDB`+N>4=zYs~eB!rt~3
zTB--3{YehkmV`s;bBNrSN6Tb{0XIfWNv}eDW<~C3Xf{^^Fu&w!hycK>R>Q^G2z49*
zia)o+B(MbL17$6ZP~N*G-Ji2z5YElcl@v~vo^}zF!L4MYXx_00%O=r+T}9}Btj3;2
zSG_AI7ZBAn8nvHw$*<Fw<+l7Q;KkqybPL0(1(0#2MSa#I9{waU=>eOz+d9naVWg=E
zfm>-=EQC*?8l)i#@Z1yYB}FksF}+1sL8Rfld`PaV?KHZY=z~0w+rI0CSq?>a>n-hi
zfrp_l>~pzEh|YuBDYGNpc@JTKso(-_QNR&=Y>Xt(c6^atm>s>HYzsXNx{>tj(2%cl
zHWIU+z~+v$<Phl1(x0$7P>N+0u=yGz?*cmRqwHQ%CYbP0-Z7*-1j<7UMWy0H1$rE(
z7FOh)k-Xkm7O9W~<hN%_nh(7N&`~le&4*M06KzJUh*S=W8m7I{H{Za23<ja|*>xg+
zVia6Qki8j&K)JZ5=s(bP7j-Ld48yQV_IX*}F6r`ai_6Rl4w3fLRd8tPVJ|mPUJhT7
zj^~%&&d$fzIiNaQ-kn2hphzdV)gCM<TdK_pD<-xIHLM#%2g=Kxiu8P_eGjC@%kOqY
zR*Z79lp4@tjnyi3=9@NuO!Sw+AzbERQn6a;PZR@SQea~@dpzRtw0)L#tVdsbY}I~u
z6{{fB4UK3AW-D*5uWlZVFtW+wTrdIn6kB%)gWCJq?}hP79F7$^wXWcbs`6}wI3BLF
zIN07xgyF$ZEe+mP_;F5yL5nsv?2sPIcVc-@a_iydNMGL*{-dCOO)!M8*+Fyi<W^Sl
z_^np^W>W>Cz@LoAC6ZWGNBmf=02w5=3B^9^CnJ=<jQ9|)pw}-S(Gz+Cd%{w7-sTD5
zF(p}9tv=8Uzr8NYqs=!0dxf0LuFrc3s$^hyzCuh%4{s*W(@T1_6u@o{6As({$B5`$
z9HBGtRb&iKFP%Vt^vXK+%_iB;(ZNtJf6UM`jNXseOx%M4_T5}BfSTh7C<ot-Vu;_%
z6fV_Rxw5Ju0sIznpZt_%(potEvg|eYG!!p4SsI97x!Gj4n`=w1LIZ~DHD=Q7_U8VG
zP1qHCrVrX^FM7831si>N(7W3E;`7nxquoj9kJ@e4#&3Ur1pfiH17P39_;xZzc@h1}
zdYy0P+$2DWYeM!`QLV-L3jc5n-zlajNX$b-jtC#(Q=O)IORmt;kuIVCt$rol012Fx
zV%Ke)VaN|7BQK+TH**Sf^Dm2CF=&g&=vl3{qoSQ}775G4q`i^aM!~ml)!vQDcCuM}
z_lwUtzWGdlM!+*PJ%7he@ToBN0;p5#u}50}S#+NJ^PKV33T=629h*so{$}PpxOs}R
zg(_kZYWWgt0lhE-;C&a3@dpefn$nM(+&3?ETw#)WUCvU?>UTD>LKetm0YIu5k4}_d
zsv=eV3Wie?bO0&ERkLop2{y1n|3Je5rIO_yOv>heQG<6KA)ldu-(B0M7(=mlUqn@5
zPJS6I-*vPY2ODP4U=uUCvooVLP=SVleJbT8Y<|i0g<;5}az~Z{6I2Cs{gPsykrl@a
zxRkjFC{uQ%wa+UR{fU-owTkf;u8&=9uqCX3ac?G~wf-7P*CZ7Id*Pc#KCI2zC>iwp
zk1pDOKm$sm4UPc@pZ{Z8D!6!phFStX(u4;1*iJvxrZf~K#(2u>Kvh4b?>Y^lM0DJ!
z?_ds;C&v3%en1%5F|z!EEGqC_XH#bB)3!EYf#&`GqxSlb*&s>oPdT{`-?8dWK}&p_
zTQ6$}<YOGM{TfbKtvKn3jVmv@ivE8E=S?Ah)&7G)y|FO|GTFONm`8Ja&YIh&=ToNg
zi6i}pfdrCFxz0cIK(-afBX^&nR95U2pxo+9z^T-`b_lA_#X#L@Iu`>{V@3Ji13n><
z1=qQH0ji+KmHWkj9{e+J!&m{~3T5k7p~qbG#jp1T0x6gd#9*Cl6$?KDu3S7?w2Q%i
zYwrV|V6hoi7oYtB3a0A$4$er>kg6GH6j6z9GSlOdIg9a)7~J4`vd#8f5fx&IQ?w!N
zhsnX3&f`v@i<H2XI;5+XzM#Biv#q-PB`Y?@`N<^fUE_Q8{OGo!*-gk{i7h-4*2?}8
zy>CgJ4O>!#`wYM|vpITt|A{hpb|hne;B2YM7Y~MYutD-19j1B7o10QRss#!-8ms;R
z`_=wFiVxV48tE`k(RE`A6D`C3lEk^8_q*Tx^FRFO|H@;+zSbMX1suy{h(@?cdopRm
zRg-yZri%aVU;j(Hcq*c%S>?-xUHlLK=3o4~-~6-R|L=eE`@i`Yx>9*llD@}(s)gOQ
zF_@9J9xzE4i6?cRDl+NF44>ZXv8LlbEY-0m+QG2G;@Nlc@@6Dn<g)va4*+E(EVdg}
z*rmBu5-MP<#_EoyySELj@AKV*;6K`ITHvbzZryPnN$i6Ax0qk%6(7-Sz9<4m*LDRJ
zc3$+&$@6C&ilRc2yz~U1H=a;`pc3S^{IhAC=Bi2ujchw;3R0c{@#*yk9;}DV^b2=o
z?QV>bbAb;al|V_irg1h(`D-fWix&dydgk$1%>^L#`{C)6hgAiaIx*PYq=RS3_g*|d
zdF3&0eO(DSRBhNkgM(z>WsRon<SW@yh_Vw(qCr{86e3Gx$d(Mn;3TqS2rYz6DXo%{
zEn8VjiVs6%%`*R)<FDT|zJFZj8gsq({VezUyzhH1*O`Y();9D?Yp#n>Ja%GA%3`Q>
z-kIz8X2%~ld-%kIgqc&Zp+)G;W9_*4TgxNNUzuE=pE)}nW$<9Gl4-csAvo>(<biA5
z-uFBuv!!p}Dsz3FIis|v;we7B=zv4=WWuu+;!I+{l6}J{!NSP)6yxQtW&Bu>RfmnR
zSH|5Qr(reepr8~~@5xaI=T~#P{kzK=cGvetI)ys19*!0=JhrbgN-f&!<6Ia8hg&}U
zjFLfF;leF=hs_<P%#$dsnB^}RN)u(Jf5m2gX&JM$;7zHg43KcML%8{RiXdvk93!Xm
z>4AFVq_2L$*enK~j2MwunmHvKa_`*C=`={FZsBy`C)bn*cP4g@SdTn5Jf`_J+j>d`
zH*?Ek1WLJHWymGxdoeDi^kM7=+}_FA%%odKrPY>Kd~<KwyYuWXIb?od`pcALP6%NZ
zWM^<D2Ij`JC8707H~POGj|h`QA0>D`n$hw04c+HyTbbxfh63zEgn13er<=02qTdxd
z_?qhUMfQbv*B1xI#QY4fGBA71V(6;fel)v?MP8fX{E3jLib9O#;ISVWb+|)@PkFP(
zOmnX%J<va2`QW7wqwu7%qBQ20*Hs0hG9wH+WP3vD{&0M~-NqI`!g8c*kM`3nn;L~{
zeHs5)Pc?|}dT3~WQONN`cU*s-y38zDel?+_Kl28dCQt18VBsz~q7)gk&w7~i&~$@H
z9NMfO9ZMGO?F&Y09sXz@`>+7Vq9h;RCibP<!2q2}4$>>VBv@^T+i{gg?S$yhLMyLF
zIdem?(mG!qwP#yjy0gi)-b)|wvsIVBZpY9k*0?1)_D!dNFBTvd%_p=l%%+)A8axA|
zUnG+(S>UgXcz1P2Hid+#gtoR|P)np^6XwZh<eZi-StKfUZ%%71?{p}{mCdz~UCTvL
zg~#!ywsf7BRyM5S{UZC`)%ICbvea2yJN(!X$3~OvJDIg0Gb{dWf$Oy<KHZlXKepDO
zi;ph7PTFT;lp9Fi&@;H~%$lZ_-eA*L+f>E@`usHTj&KPR5`Hgu!}eu$wb#Rs9wBWQ
zt`B+WrSd*KGf}0JieAK&QXF6CwDZB5f7&}0mU}<u%k{PWQ}w2h_lAfN<HyJ`E_PSE
zUck>KeU1V6FCk)4a$((4wj0XXqnBFKEr+V3h2uw7dbQgpN&S6V6IfQ!IJEbupX>lB
zu&+ArSV=OE)$W^}ffKXI+u6vL#^*X;6uQnPe|Bx_9PABY!{*h_EK+bYC6wMhlui=f
zBCY!L3AaN5g_kyU`y^L15wH`zA@>b_T#(0Q>u=W>libuRVA<%mv#NikpE5<ltz;an
zWwzH!%lAfgz}?2)a@$KQx&@dmDa?+Jzratu4$drUS^844GB!t<p#;@?+O~A3jf{*G
z%e?!@$iq066j3J3;siha;iZ;YoBBW&w@6vyBC#6?+~qo6B5mThbdnKX2y@M>_vGjL
z1PW8V;thRK2RNkS|J5|r1YZ1Fn$2GN)W0%AagVXi^)K<fqS45@k|M;P;l#dA9l&#+
zMe{`yjPhT9#}+-0>iW8EQ2w2N%)MO~^Lb7QMz-D&v^`n%ZS<if&c__ojm*qRFcut^
zYRAN>UI}PEm0M=*9qO)ssFRPx7o+o9_4Tlv;<ieMg=T+2%vQeXhEevf`171Smq$*Y
zu}h3g;6w}I3&jFW@t9slejKYL)=)RfVdie9P7(Hkd5vSN&kgooR8E8SUc$D^RaX2v
zby<oHyxwWXnc7>%;XcdQcknJ<$%wf8ahn{ufBEaP`DO2w^8RH>$`}`=e$N6KHz$N!
z#H}n$tYkb}>fN(!DPH#>mH(UXa~wFgR5I6+Z`GHeZ)7rZzgnehp-)ILplmpLW1X?o
zwuHueKmK_+XL`iT<biY!+Hao0K0)=Mj+cwrxp|RSmU!bz**u(LZ1xs)9hR6#U1PON
z02ju?>66U;puJ{-;`R)m^>r$H95)`qsC?#Vtie;3pDj1cet4&Gyr^$3FEmm8xnNZO
z+a;YV@zz7d2jmmgJ)U+Gh|%EAy@}WEopAg2gyfx1LQ98hign5hlfaxpp=MWU$7HuV
z*bH;YpQkh~kokYM<9@zs4NXcMkGDVZRJ?h|)PQ2snIF-tci4tJOjQ#twC9ax4%rxa
zBwgcrv-5~AIU!H2>|p3ty_88McgMJ9_4Ko2PkX#38q7<kg$*q9rqx+wL+Z5Z@B|m5
zoSZ?4;02>SrIK28v%mTZ>xQH=DaI1Rwx(fc^}TCcLkTjs!})PsrN<Q#5{YlJKEA$_
zI_2!Oo#k^?Va3zwB=&<jTMS5_N`q{YcUSzI%C%eES2awhXTmq%BsEM(R(QWa+=NR)
zz!CJTcv1Y3PFsr@PM`RDcH2m!FC@MRLW^yJ+5K7^ZZ9~8WCoPa4{}&Y)!q?bq3~Hs
zHL@ABi4Hk29wEhP;I!TaWbF`P)jlPlCa$jc<#Bya$&qinG6pGA$FY+qn>h+5rdReY
z7F=l7*K`ZA_})(DjRY%Duhl>G62kL#S}dH4zt~Wb<nzsNl+2)x4Q)L%p&}&f#oXbS
zc(<vfo8<<EBri@X;n?Nu#m1)$|MPiK*7LFtp7raGR68{~XyS1SMQ6GwJ{Wd0h~Hq5
zWl_y31$uQ?w1x6U)O~z0u)Dq9RU?^0W*qaCuh?9=`+)I<yQ-*08}%pgJT~Qp)~<3E
zL63<A!xy5%cg`l?&wJP87(HN({-x)4l5MLpv+HLo2{E>bpZs}Zzp}XaTZEhKyT>(%
z?d)|?0!e0{s@tb=Z+EvHv8-!PebVzGzxSB6zE+z+DiM1u#$d57YvGo^;cbH(ZHr^-
z%JA1r8ZGje+Im%LAMg*fLREU+ihY&NX;x*vLGHH$0|4fVu85bmeQumSlm#0(whPIO
zf|7AVS$pt`O}EV)ZdKlXV(y)Pj!g2dS_)9on6cU=#`s>H3pe*kGn+v!ve4w(^YhZS
z<k;p5ZZ3=O0<*sq^&fcF6{~GryFb+)J;nLNN9J_DLGh5>d+}eq9ULvKV!T)1-#<)Y
z;6q7_RpgoM#>+5t{VROO@)OdN4i&snv;B6^P5q}qmOoph!7$b;r$tjK&ag=e1GVXC
zedUy)fgJ$wP+ObQG(Clg+9=(>Tbz>EbWn?2jLa?;5UUw#FWs<@8R``?GOTWcvRXSF
zn`DE6F9!HxBqiA}VKu0*G(6M3wJ3s~zc>ktXA0;-jC^wkchL>+^8lShkYQptsQ1^f
z1c@^Oe8Yzf!wsON{u&m?B_x|$zEWk6nOGLE)*u~ubC>r3pINvtpDSzQnb8M4r<2j+
z@+-TIAFB|}9k^0Q=I$?dDGM(|cNpJQGul~st*v>uCcp%1<7vima$3eN{eDx9krHpp
z-m8XqIZt0mK*qlK0(;5_roqui;i>_z+}++fdf+PuKRO(p9n&sN-;To?b`2yJ$KmUv
zG%5o1_?__^OXeT^>I-F8gdY@Y%6XUUftS>f(2O)xwKDP8H1EWDXefjr-rkkCQoH$L
z{+IGMJ;qZ>)!9!cxbEuj_K!}DiHY7lu&FAhRzPfj##TN{^{Nj;^_QfAZ+0kcDpcO_
zxB`g(PCSDy8lNIIlS?1r9@gBQ$MO8@7&|_~zI{r!Wpk2k`$Mg;i#6KOA%)GSly2`*
z^(c)Ld`@0bF(vE}7d+wHYAkwZa`Ev=wHsRqfO^^9Z$3{fo;>EloyXLWWVo{$)pdi&
z2ZHnbS}xkUPEM&}?tRz!g*4RNIxZ^Zh5~?j25M=c82B0a0Txz(6`+<+ej2E>c5<Le
z2o&RlM~>X1_*{9!1^`#IAQlMRN&|Y42a4%XLBN_98zA-P6Iri|69D|(PWxb8{N4Oi
z>})vz7NvA{4|Vv0-w`)bR14}>8We>M0PsZ`0QlBeAV#QgLGK}O6OChPbVyNgUjs!M
z>VzSsYyXAtr6M9Fp~UqNi0jSek9m9<0U!!?&rjppL<X9G>2$6UnuJrwjh8UZ5Eh4*
zh9<uavQ7s@)~9)2>mJO7X|1p~AsX5d1?YY{C_zJ`Ds1t$!eVP^WIe3PT7^AeodaEh
zG45wwJWjiv@n54kRrlYTBjPQjgQASBDgfb`5`B&c!tpvRp5P8B_&O*~6W5;!cn%{N
zZFB*`9vylch)!okZf)U(6V_n;TV8(yXm7?k@@}Rk%;y~09s&Y@g}~oB%@_fMOZ#Z!
zq3VQ0JOUeJ7%+pZvq64tx^nviGsy%+(R<9-D(B+o=eAa^-zEBoQv`DuGt2>kvgvBG
z>E8&d7)Yv8b~c&GaH{?r0YG%kBoQNK&5?)*nWmg{IwDks?(!cgC;%vj>04;1E7q%2
zqNULKRL{nji#0GUjRS6nO+)3eU8QDN3#?B)w7;5xlL-Lo*#SU~hI-I`mD*z`Mn^@2
zewzggJ?OZKI^)1iheFb_RCO+pg=5o%t9>htgL!8vm44GfXtJ80E41Osx8eq1(*Nxz
z#E9Gzs~#0x`RF`KQtRf#A~*LO3IN7oubXM8hoRgYPypJW1M<^R5wGaM(<-{m01zt)
z0OB;%cUZ(LRG9<PCyL1NBL|iv+>Z(qhvaj?|CnaJ1wu^+yglB8Bb1<V(Rgk(vCgwR
z>qkcl-GjdZuc0>d-_eN&u0}`6{VTdZrK@=pj&4gh#8Uu@(XWa>i#eAHiwj>3B;W$=
zo=Y``tjs^VJN%2_njFY_XCncE^*14U4}StVpGVztA_0gS&m{8y;677v>QMlJJ7P78
z-)oJ=5<_Yfgdu{Gh+w}Fe^z66UO@8)SZ5Qs5@^@Od=&JW2+GmvjHJi%u(r4hJ|hpq
zm9S||dc=tRu>fIn6wOTxa)2QP5S|Zfmv$MEm=GUJKZ!_nvTqp;*Mg1nz{M>?W4r{4
zD1b{xso=j#=ValIR(qJbAEqkOP(6|muTWM2NWVoO!Sxrw!5O8j2B)1we>5SeqqksG
zD70!U<<>gO1QBSpGyiI1eo2}@4APPLhgb^NNdn>izQILW_tS7whN)axx;a52D=CD_
z!B!WAlnvCNjiTSr5cA)9ZAFUUd1Hm|I^=20KeRx|n;}gz6xaGrZWO^zzS|)<1?YPb
z_#aL>_NVQ1>;iy$!vLU6<D@i^i5lUK_3h^t!}e28f^ba>Kx`f$@A@$A+tgemLCBd1
zia-tFpfDY719hWA?&qK@w?Tn@mmm=E_jEh$rX1{Y8vEze``-iK<6O{20L3(e0stm{
Zc+Fawg0MsYumk=nfKS(h>2O5>{{yX{5<LI_

delta 55272
zcmZsh19T-@*RErAY^P(}R>!t&+t{&fCmq{1I<{@w?j-l%|L^_2bMD@|MvXn5HEUFj
zT63*;y>rEEp`R?H!^um5f}sLI{qaqR5RZo=_-6bHW@h@w@y9vQKpC%2*$x!`52OL~
zKObj?#92_xe>MYLYDy{Lh~f9#Q<_RpHF+VzycARA);Fyxzt%!8EEOwil`oaXb48gB
zG1D?|BCU5?<I8^6Z&(pcTj79bqKWj7{A6Ozm>tzK=r9vCEH3dP+1<oZGJ$D-|2qGw
z_=>d!#rwd+CYxJ`V&Q{A?Sg`MABxME79T(~Dnx&iL<|J*^nRZwm!P8PiwcUY1ye%A
zY)xYdR4IlxX*X16mL&TSNl;Ymn;G*IRqQQP9okC!@i`($O1w(`d=XftAB7Az4u)nN
zfF$`riH9%DL7Xn{&txmt^fJSWVutnu5ab4RIj5fKvSq#MbZ%?HUQhfn<gZ9Z0S<cD
zz%I0(5fcvJn~*jSt49&wYRbjd!XThKs!XJ8sn^e*KzTvHxQ|~nydf#fju993Ch@vW
z9h!&9og!IM&^ND!LNiSKJX-MH-?hrEulu|j7!=B@9E@P*Keyg!`BEY8S$StxwVCD8
zs*lyvd{q1BS}B1N#K&HRPNMI<p&5%j1_{rgU(Ns|7nmOE+;7<$wHWg2#Ntf-z%*s-
zM><W2URK}Uvyxa;rue>^Wm$QNg2HKM<^y+&gz86l`{OJT<a=zZ%>&T0byGAoiw_i+
z)TY3WtX&R=n;ec-!{p^Kky;of&1{5u(#vScFFrt&`nen^e$GQ^COdD}V<c=Y=p7~;
zuq7WLlH6tF8R#~jkz;j`DrTVd868`0YX}b_S>Pw6UOK>>f5oN3r9}1cya8;1NghmW
zj+@uJor1ssMc@4x1|p8{T^gpwFlkZKH<9L9<Eq~<J8E%OmN%WE64Z||E|RqL6TrHQ
z^%G~=q$}jQ<ATcnzJ5HYJp5H|huebwHRBW@4=)RvXl%fIX^?r!g9~l~UP9+41Lwo%
zOw9V?VQFu^<AsObYMII^!rZ>hp|Wej6MjC6Gc_b|pN}P{_q%M#<ADeVI{9hK)5&W-
z`^!z6`y)5XlYn0)9!3~{+``RpVk{#fyvM{xf>VpXnw#6qH>udwvppNvyjCH^XBHb!
znrGhTT4_EQcDi|G^_}qER3URDqy8tQB%9ihx>7JmmR($!>GUO}hl@e?t5Xy8l?>0S
zEVhjk?mEV}4wIc9&m4y(c?emhlG;&L`2Dc0O9^M!NK+%Hg`xTxS6avLbSBRD)NY&8
zr*<5!Mz1{;2VWQyQvNuok+gsd3vD4lQT}JxyC*Y?vS18;ERp=TK1w92>738ms+`uv
zXIGc?oJ<=U+ep;WI@i*W@C7;owW=0)jg{1X+-d3c#rZI`;MR*_AWD=%`qS&R13jYO
z%Z{>^-ReZ(sd>est?E;^qhbMYMf4$|Me!0k)R+SFvUmQP8#=oODUS}(L9+*dL@5~V
z=M#-R|4SdU1}NC6Ar?{cNiocZW7En8c3x&v0lb9#lu35o_V7!*LfjZcXSh*8(nJ}O
z-;{bxThil@iG>CmK>;!Xj+m>Cxw0F(Q3j4QVF-1EA+pgRSVt_;(ZtSYPc~aS2)C|-
z$B>6CQ|`Ld$9`k!^1!0|1|)5Ou%u3471gz%c^Urg@6u-drHg#Ljj7M+XdA>AcB@3y
zYE{qHc2YgP!yIg3Ghf2eo?_Ch{miOCX;xEELwfG2(fan6_<b*LR*bCs*s$3LoqSf+
zU*!HgM?a9j^4+`~h$XHoYeYsi1F_5wgVVD16OcUlRo-)mMWJ7>O{xL_cMOo4KS})>
z&T2NeM(K1gXl{WH-&^&-?+u4Pnaav4@7=ON#CqGSPffrvDKo5PK9SSy<!4~Q!0$0p
z`<V$`Tvris5@^WKKe!0Azxeuj+qc!dh??_k%?rdOZiJ7wbe()sz3!1ikSv)&mf8`r
z9N?!0^+CFv;>6|lE*4P$0bost%Y8g%(H?5rIJg*!jR7gAqgNX#Z;om(BkVpaA#=3t
zl`ZpzmP{a$&0zOXzha{rlv<`-FSdP~Evaw!b~^x{({~A#b@4}cDIsaKZp*s7_0RaM
z*Q(iP{wpsO!4`eCg_4C_ot^>0lqkv0;KikwrsYcAP9^8Ik2Z#YJ$*z86*`n<aY^#%
zrjManyKF^}Kr13N=Mm(od%ddpqG}`nMZV$d8E2^Ac~ZbdvWnMX(^rGl46Y*LM{3?U
zq}AkcsG=sepb@deBCr)1OGu(*@D!=k#1(;FA46RBw~QL)M6f~Kl^;S8Y$vpZF@3+)
z9JC@B&|-l|F#*N^kX`d1=Xuh7Z)`iYAO}}y7LIByeV<X%8q6z>TCk}Ym3E-M70F^_
zZSL6Uz;nlJTW?Yhj2C@FWNxhUV{Xwy7UvqRT6yFg!3~{o&yzRy%jzMcOOE~HfVbDz
z$WPRR8nMW!ijOU%afr+~&898MuDS<mX0acF9)4Y7d%mE6EjnUQQ98o}`gfxB`f2vM
zE(sG;elN`9UO*AEq~9Tr`*fq;mJQGPgC1*D1J>8)2IRYa-Aw0uKUa1GyW0mfqvFC!
z!|~Fo@cV3nOP#^u7I#I*)1XBGldvA2)%w$5{fGW|)#6+FCKm?e)$LEM_w0%h*?ebD
zewf*J1n617l$r88ov^%ASu*jnFSVK8?NLlu-Tjq98spbmFrex99<d|LN~cpX|3crK
z=v8-mxK6hCg%3G2az2NaWETE5Qri}3k~U9EgOcm)z3jSpX*B<<R$P1D%b?^F19g3i
z<F-G@Gm~@qCq^m<Mjhm??kf~fP!teoh?SRcCId5IF1i&3iPV3EmzevcL&4hOop!82
z{s3-_U4viE{`nF=*UoV8j$JzKtaViXcXH$&0}-Qej=+Tac^EyxoK^Ut%pcQY^?Ui2
zvco8;7s6Of)9Zn@%?l0J@iTwB#Qy0=f}BInw<OeTl)|EO_{VnPOXTNv;luO0cHyoo
zdG0=dj$5fg?O)`N|HKcS@T`yu+__EquBJH2Z6kn&i-lsxbpn!e4byzInVy%-p71X3
z4IF&9erR_PUWhvk#-&MVuFFv#c_AnS)W%z24VmYe1vHlAMj?>Ci_`7Pv(ESZa;5iE
z7-WbQZ^Hc*UWtlKS_6KGZ8~8iCSG7trvXGv$GYntc_~OJ*w9vxCnz8wX9ggkzxCCh
z+UXAwm3R#Q{V(Md`F{l#P9iM=EZlzztgb{+gui9jpHl39WEkL3Q!93(8O`^(Ca+1*
z3|+(0lwG$a{py0uUg==apCGFnHMlRHgV>c+;d@z|vD;n3Q<Dh3CfEo-TsQFH&dT!F
z2L>;RNOU!GLwK$t=#x0AhdbSN+s%wxtT2A5jHp6k!pqxi@~2183|F`kr^4()WYXAy
zF^guEYIg)1baWytA|eN0kCc1buyTxH{cf93VmKj}vh*OT%q+JXR_a(P7MwS8v&eNm
zaR1G-&I?6){@@E%MCnfL!F@-fG9o#EFETtSL;`I#=#7EL?Avz49!8?>DV`rTkp&d9
zQuR!@azN3yQ|4ENgtAF{a--f<<t*D-IBcGw@P3Sa;EcS!9p`i2c8EhA|0h#M1luO;
z;{Y1u6%bT-FZVa@i7*Y%NU-RV9AzANn;&I&4-euquM6)xwqV*yq+(C^=6%Y5q-lGh
zUp6CZWd!0L4Ov^j1PQm!+%)*bvXTQO?=ap!;|;72IM&CDcVcAN2Ra{r_NOTuf%t|>
z`%a+1MR10bE~=_yC#o<S4)qFsyv$}S;NVX;1qbeHK?Inbwd->e(mZ0Y6a`ScB|r|$
z>#bW9Y<3o~QT9Gkfzr-2vY3tlQU+!HA=Vd^czUrlYU!cq(Z1QTi{HY=1@H~@^!x_Z
z-1Wd8rWgr605Qud!d?wHwh$NYjG49eS3}}}AG`4q7X_<~N%~I7fs%%bqK<p?J=V7k
zH&&t0g{uz50XZKrjtQ8E2_pTrX2_^Qz9gaIq@QtI5r}y3KCK$bI!zoGAU`k}05l*z
z+tklYR7Pr{OFKJWcRXT|Y(_#WVJKqCh{j>6r~z}^-vQw>P`H^v(EWMz*z<YBfh~eT
z>XtVfK^OnTSi6TU_Hv3+NSZzToop0sS=qqV0Q&g_(Tc5ZE6@?c6zF7dzt&HX_m0Ef
z99ED0g(IYbh)AV2c!`4q5Fy>gqXjY&3VKN!*dWL_A1glL6JNqm*fY{scAT^fS4xg|
zQd-{4g2*76gsfDvv-3$u3Y`rL6Dm_m<hik2u-^ByMXiSZjw62x=*8RPYX3|N)SF;;
z7hQ~)YZS<oCNpi{p%$wQsDq(_J?xL<I+YX&s#m6F04FNEGyE|DP^zVm^FFTTJ`(OM
z>L-_qQ*P~5*0>^a{fWxWT|h+0HDb5^O*(9TUF9fL8f1?x*IYyuLwgxrug>@<r8pAH
zlGaso(JtwG)ZV=VmO^8Wv@c=ZT1!)O>!B~PqL<BCPh+L({YuXR_QjIQ2XW)0zK=?+
z8L<k8iZDzMivcq}Ae0T07HoCrdAzg@#|y@2lELk2h$`_i^&5uD`9*(FL0gw?X{+$4
z52FWdl{ur<4;Z|pp9VM>by6YMdS8#@%iBJ;xz}GHuP<O58IpjhKDu(nSL0V$A<u^d
z(g*8WfBu(OC)^PE*Nv6|FPF@68Q9co7yGhD58gE~)8VQL02Zpk-H;yBNaTqr(^meM
z@8dE1_Gdw8wq*4Qu6egB2)?1xI>qrPX#z{mzK%|9fx^DvoIXf8^&W^fs$<b_L|s3`
zZvv3JH;riYXM`MP^u1bX3(1>^M7PkZw4pzV&~xDqL_uOv5|PNDB}N0_Wv|bFc^NE0
zO+Bj6WO=d}1LV;TByXMNT0s)hn`w+0Aav=8bB1^ADw!K^SEA69-5vM?jLAKu#YA)B
zw{jwJXwMs&u|9<4lOrEUzwinw%8)s`?Aocg)PXo@l_#U5k-?3@QA@l@#Z`yYOWRGg
zdl~az>I5L=)f}&}6YQFSnVL?L{CGS9c7V`@-umQl09)G1E)44--@lu6>%<s%#7U_=
z74Z}eLS@-R$(xRtdW|POHZqAOvG&p<h;=(&&Buh9A6S*QTI_W*DP+zkhfh+u0iR9Q
zZbE0;g@m&5T}N^Z(k=7<zQ4Bn{4kN@un69a2R+ZZnc1BLQh>W0I-MIT4y(~!&A3c<
zNfy2Ng8d%0YYaqA$Kf*cpp@u?h7F96n1;p%g0Gc0gT_Mp<h)V&GXmGHjYXncMVM8m
z^RlI?eA}~%kDGTtoX^uI$<iwbZjbFN3(R#&E0GbM01yD+fn7&1s({=A?~fT|FRaN;
zNXauq<kcusamZ*JuvN^6=-X~CY4*;XsvA!;-9P3bVay=X+5CX@DLrHsJu%WTA<VPA
z4nC->b|@t;=Ijq|7VdDF0o0cF{5Y1K1B(e(t&Viju888+jJ4rkYl?01p7l^;pT+E0
zMJ*?V1bmm0K=i*)1kY&QV(A>o$X(FHx>;;>pnKQET4W1JuS&nP`gS4PM$X${)vX$~
zbVH5Nkp|)#0HK}X6Z_0<e^=OYt?<oK1t-z=o3PKo_pwxzN8q_8&P=?4;r2-_TocoP
z1g*}1z{rhB(8IJcl6jq_E5u`4mx)8@4B6S<EkG{pLvnP7a33?i?ZjX-5sj`O;;?0+
z!;BcZ4aE9dj0c=W_3hbJ`Is!Jd2htps*DSTT05iKb*{=<&Rg5_3tVMoT6gEXHxDxe
z{k5F$H)Q!;Elk*T@QrGhwvs-D^Bnw>%r&rv{a>+R-h?L!x7zTT(TaVnFG}^s-{wm=
zm;f5itUW(+&Qzh#rly7k-hpYmRLAS%SgFBycb+dHOs#xKtslwjri`2rXN&wuQ0Lo(
znhI_M5$5-Ed^NhxRZrs*SEZ$ZDnj3jxH>S`GvlVPO`q#~ZjbC&&#Li)$K?Fpb9srB
z)bEXE&6n|Gf9)g9=50iV2xDRtk4F<k-2no>UxykLNF%+=MJE#-d2h@*&a-Y;|6l@Y
z@tDD<c}A(RZ|!K6F>N|uwd`snuzuTnnrs1h-cLR+N~y`<H0QJihRqtLmyT<RB5X2c
zyXpBwcWoLN$Zh8lJ^EK@>JR@mOa21>Q_Vym40Vz~0|9jr{jZw&(=7u1Q_d`6QvM}p
z{zIrVkYSlY`~~9({tb5toIwAAYQ$9kiYz0J{2Q{9Q~V2tl5hMCO{r=B1v{u)Kq3Ff
z!%Eztr~X$1W`@hZqlsB){srAwj-da#DSf_wM>g<{gZ-EPr3#rCCH!xFR;40kyUu{P
zd5o&`Q$UlY(R%n)thV8_TaCgzJOL^(UqG>LqnA^NomaSKb|3YGmI;+q!!ZdR_$;_E
z-GkZtzF@fq8Esv7^m~iqhHmBNIY?egK12K@yP&O&MLxsE^)quO0SQV}F>_G^kO5mP
z3pIH3Dw%t0DpeU6^Upj;fQm*~KG_M*c$I#w|2RLt@5kpS3Y2y~x4VyBt4YI<duKqF
zMQ~a^@*a$#in^+L62VnLX)-pVjHi5gl1V!ToZL#v*-}Yzj8Els0QSDPb~i5sM$3p#
z^g)ZzAa|-rxdj<gGqk4n&UYxu7rb9nZYbs|XwXvPwECIxJ~0nJ0VLGorCTDUi~*XW
zd{f6&^q$9&QyR9Ttm>*-^*_E)5eO4VI}^6L>Ry1@Pp+w(;O|8UECoo=Dj}Y~*CEF#
zkjxTzq+k><J~0TNk^WG>KN`n{v>$d{ZTR7tQ#A4^G8gQYAu|(_ot`k*5QKvpHh@8e
zg&#;sBW4CSH^L&<3*gnp4x#ZT(>Hcjq!T0~Rxk#=#kOQbR4Zt_Veq8#-x<78_D@Ht
zgPqE;N@>T<8Y_{v*p*f`gKc<kM{8Wk4t`3{D$C174H4OMtF%Dg$r2Yf#HGSjQ`)PK
z!!B#t2h%D-VR^wAW#NrGfAwZCWNq`m+o4LF|8W@}A6LO$3@G?H4x`h#RIpa|0JYul
z423m)7AngevAiD8@Ow(?#+fR7lr<%OA~&f*&?();e4vN1UfosYJ0+dNJbb~v1AEX|
z(lsiYt2Oo{b`Z*MA(9ujwFC@fxg+0P^!ZNmK$a9o#Z82OMHM6?)(=^O{SfZOlZ+#u
zvp0s7+QIoZH?5w&Jzk|q2{G-VJN_bvd|zfkpGU>BiC-D1DHVIc3%TdlNuEM&@TVt^
z*u+Z)Zi!E+H_$Txcm?-$*0227Kl7Z4jef5U1PDkK@;~$Z&ol=S`*+Hzi6w*ol{DAV
ze<$mIE@^mWVE<y$GUR_{+y9T1%8>nw{jn7KD-Kka@gG@A(4Z?@4vO@j>!buwARv-N
zBw4gXIz^0sG{*-d%KVv*!Oxt7eiV5!<{q<PrTW;Lrt!>}N|wfqWFr2!uO-c1Px1kZ
zTCV88^$7yq?6LQ7Z4{H}t#qy-R;2mM5SL>L77PIa1Y*^rv(oRyOy?Shyh>?06;mLM
zgP6(oGyowJ3j{kIV<o)8VzN=f=2D5PL*^f9B#YWK1OOm(%7@rT&-oIRvrK0S#g_w)
z<Gz$A4)46@bjk2C>m~4xJz=RlRO4s_cpF!A3@N-5rFp>Q3jBP|A=i!|-{i6UJ8ke@
z{S$RnGA7&L;!ri4w3>wV%AAgJV9ZeEVX00OGiE}aO&R62HCgmdKUYQ%N$xMlc=Gcw
z(&1b3TYznM%m|0}d=MfNB<WNA4^bDcH|LyG-G?)&Mv-8)x&0lg@9#lIPf+HszINt3
z+_|<K=X5^^jL#?SHM)a8)&+K3nnmrB(%7<fK|*85I_+%j^OlOOs(<wq+?$wD9)S|K
zu{I`F*Cfo{#cDh<W9tfjDj2^qpaUTP>`IFT7&VISz<;cH|9D6LRbfcPSLXQ7chz8^
z{QmdItf$WZpWu($13|-xIvLns9pYA-`5zFkL0YHz??`Y1o_|3L1EIfRwK3a2Abta!
ziSpll*VvN%9}ur$z!C}MzxvreHV_cr|MWA61RI!tMgY3h*KPON5PhcA5M}*I1V}lz
zSTeC)+iBPGeJCSrwm~(ENo`A|M5tnL3cu#JPf}gPBakIt(aB>7tk0PS+NQJ8X(EK;
zV8WfHG3NW!<cLVIp!bRNW=Iwggy~eH@=j5+%K&bvX49ak%oDH9ap60TVWtwb(q-RE
zwZYlVV*nNJj2nBf-;g(8Lj%`Qg2<fSW)yiLTG7GBZj5SS`S_TW`5@H7%=W>FWA8B1
zOnAa1=!yc*=~*$H>tIZO&_ItONeu}&R&jvZMa@O{fhdr#z+zI_!cz~F?8DN-U!t`3
zCY!&2m}QVo>Mdwc(t~jw=I49#3y%TDB<r~J%m7@fB!h#@R8)=rVS&z*TA=T^x`UY;
zgxjLq(F#(Q3fPAgJD@yYIF;A-gVN&F5sLDC;!@a6F!#vEeEhO2{b|yi*t!uCaTwz;
zsp4^BNKw7vkwh54<XG8g*3|<7yz~AylQZ!me5-}|2~~@;$&F|%2?=bUvG(_nnA7S=
z+W>-{il_rt_n(J)%vu|yXq1@fTY^gV#lP>FCyxbE5pM_1*t6now7u{%z?Zpr4%PB5
zT508*@R&a`mEFOQaG#`ku;JN58_oD<;uOlT`Wy;YYrX?vv#$jo!CzbFJ59FB7tfYG
zpGwS2AX8weFYqME<<K5(B6bPo_j9(Up#wbpu!Jpc1<D;t_FD2{y49qlm@`nS>L2r~
zxmUemVQV0}&B;c*`;L-QVX134_coj33kM=*={77)117;%FD3X-s6e8OnDBnzC!yVE
zAmN{iL%Aa<P2@S3YiItDM_9~lw6v)Y$V)>*J1K{=xA5NBSkV1kac`r{mxuAc83Noi
zja5!5>Kly}PGI&xSdDf`R!YC;&%6UYODphMT=v+(OhFBLq@j8Q+;fjE%KoC;aV{(p
zO7g}P$)G4u209eRJXWBe>^!N1L9G66R}$EPHSpS{l=eWVYcOXv+u8}r_dMM}ts(ZE
zz-_UDTE+DPq@*i)R(6AgyFOM6BN=e?D;tl!&jcqn0u|eO{f3WMq&FA}e-@TJjw{+x
zbDl}Ay-(Psr2<%ycGA~o=8>sJy(&5<A#;Z_`m<c3DI&%A39?TmYc1G7jmIXYREKeK
z<SKZvy0^a5R$=wf3OSi<CPVVx7rb}mX1hlev*QPLlkBm;@J|I*Ec9bejeG$83vg&t
z9?fqg{A|6EtvB-EDbHJ0F0H=fi@nvm>x{Z-w>Y01UTF%c;1jPCu3U=*m>513*>XrG
zgxTxC1ZCqGQ|d2V6mCjW5%tB_6r)Y^)(>!sh4_yRfLX3|;myA3RqSug1+ei#3(c8b
zvQUAb*}Cr_ES@TcJIkS9_EG>e3_X+33fvBsaS^!gRHs1Pl!Kb~%t=VC{EE!A3*=)J
zX7<o+aE49@rq(>dCZqxQ3BN4K^PP}=!ca8>NEO14g$BRCn%;5V;l64PJ?67aWfd+a
z4eQFvE?xe?>*%D1GVWdlwJ-KbtSHAi9K72tzj$Tmm;*ILj3`Lr#Vvr{f%Dp?a;vV%
z(MTrtMe)o}M9w5?)OrP2oVe19EtFiWD+72v4E#z7F)M?J3HRYZo1}IQ6R(M<Uhxqr
zWV=AZ(~<aU)9M76w5E(T^+|+|?66tJ0XpRqJfapFd>;ftwzVEuQcXH{>bMpD9U#9I
zcStX`2EY7nHhl%XCTPG(zS!}uuAlt_mw@@!3~l3Or6o9U+nM!lK)E`8ZFqz1`4Uco
z+c(i{P6*6$DN*#Lxk>!+r(9>)8eKKp;Ta>i{A>0Id;`qO_TaXS6JeFXOCT(FP(MN|
z=}sqomkq$mPNR)W-sNH8*(WvF>nhxPGjI>+5;WYblq$^K{vXws3#?&_cRT%!&p0tB
zi)4NNiyltorE2QS;KRBW@OSX>9GpNS$m!y)K7-6aUnovqDV>KDUawTs4(Uq&+z*q%
zisy1XzYl^xXRe9_^^Y!aAfP`7{r{f0qMf+@Ir2ALJDmdmH9xJpu>2Dyvb)~=*E|wR
z`u9A7ktpW||IgN3mztAyxGiWs?=|{Ez%-z{F@-O}y5?vYg5SWzBY;HLg%vn9u&!W<
zrzQdp%-xKjpgbL57G(U11QZi{+%N(48)O15ajvhgFI(4L&t8QwMv_8Q)r7zL!_B&P
zf{NQ9Wq`>QWqHcf?c0T@GWUHRkoZ=_m}OHbh9KQ$So$N=C?k%jf0HFJLN|b?Kr03m
zCQzmnrP;>_5y=iSupt`<$38tjo=M>%i;!&*Crw&J44I3z7M^H7m$`T9Q{@2MHBngv
zYxw5~eESp;?NAjSyY-=wD!MWm-oS<kLN6+j*)<FkDk_m3QwBc2-IEhab@sZY;`*cw
zl$lcV6j=%yJij7u3-MqNY;))6&gwRFp=YthbL5rfgNPXG%Gv)ye5uV+d>()bFcdUH
znSL(!r#Yl4ayO4$GESRH5T^!&_QBNfOEL#nOOdK$k0K@V%N<!ZL28x|=ZIjPh$18t
z%^01V&P%ptxL@}#Yes1*X?oz_RoNV76;@rB#vAN^E}_CPY=)yLWv%%X!A8)b9U*0y
zl!2gz&_I%$HiNJ~KRv_6MUag`SGwre8bcR%oD*YYY9wUgzQ1wMX1)Ll+42z3D|-$)
zIn987E&s7IfHa#pA*6JH-%OFUWO+dJZJB#5XbmjcQv(xZife~chzZMTy+yEJLrNFX
zKOye{yo;taBEDpGgiF7zATN*5Ra7DFTRJq)w0d2|tga#Ts^jvLVRC8+QD&fB$z}Ju
zM2eJVmdTz4`Bum3<xvtKYc?F?MtaV*CzzfoETsR=t@qBsRWz9KBk8!&+-cUn!`d>M
z_NZqy5P3i3nE*@0k~XH0h$@wM)5(_)irUS6<RB|?kzPW`iwp^PcPxjkq;I6Lhn0)i
z9vvg+*PP7MJFgv(&mg|wggb@#+1m~{ddG+<1R~QE`p($R`lSUxpM~z(ToaKrVUI?Q
zVgj5pZ^>cn3I;QYM!9W@1_her8!|&vfHDbaKV`Sudq1l=_EQzmda9K*df`Hd7itO{
zd0U4>nBnJ*pewS`361btX#x@us2W|=h_We9XyN3kv<fG$LR<~{3wkRew-MoB#hLJ~
z(2nL>nJMm_7uGo7M~W~XJPy4693cB5T5hWe!NoA#OpNP8Nvs2;|GJHETBrro*4X4+
zM6Q|b6&zj%QV@lb%G7W;_6^ESyCaL^o$I!OG{TrbfjA7=0~>KNiDeO}-8oFxz>ivG
z6^v6VJCjI<vmwH@>pnzSm$d`lYwGu8UCm4t%9pd^(L@9w%y(*iwd2&rQ!~7CVBd2!
zS@ub#`WsVDIHaI7${Ub5g*W2X4vYwTkBQm!+S};LO9Z4<;5SIzv_|Mo0ZU+{1yeU#
z2`p9PF)1cp1Mt$>tF&2#!(T*f)so!a10<M5Xbdp*&O=1Cza!?6WSZm=0@DhSe$RS(
zQhXE1wv)mJ&>4~kN*|o9K$Pawi$C2K#tdcmn`(iozeiWV;bcW)o~%j?l4|;9BBsQU
zsMxU&JS(bqKW@Iv;b1GUZ_iK#pOpGmtpk~L83B&Nly45gpZng{dn&(f4mxUbe7+v;
z3A$gYIqa>-$d$&X0WU|f^uAv;kNalla`^m!yN3=yO*b7x`+8a*0mp_Z3as7$=Ah){
z;mR{H#n&BW9{sIRKQoO6$p_~&af+ctIFw<hKH)E<pt?&hR^Q2!dUF!9AP2auE}UzO
zON0m!U!_V1Q1>|qKFj=*(Apqau*?bvudC8n(d0Gn&trPM-}|TbWep7k2;_6!GX@XJ
zz-=f1u*xwrCuw(5cpZ#aQe6P4L2LD6A6i~%mJl9QM#9%+vBNdjLMh{fzMx=_C?yF|
z=9#WVEvBkV{Fa>_8$|~VNW^<I&z`GD+eDR+-X3kmM~W!x9pQd{%g{-C_(|<|702t4
zX=G%D(@<wo$Ld-vjs&w=xE5OqHF{gPi$!*T0`T_aAGSHy;3PWQ7#r(YG1Vc}SyDxr
za&@Vy$E)Sx*jaK#sk-IJvPy)$!te62BuCrHdv*+Z-iaQi-tQz93`@XNC_9aaF^AI`
z<{|@hs$X6%Qfi-DYlmVAUCI{Aq1HeGc|OGDO#8b@i4Tq3`CghqIbWxC=W?HIpAXjn
z9huf(v6cslHD5zAyZV;y<Vls59>a{@Ghx~7OT0zUtf`_}m-;VK*SCw$k70ru0>H;!
zq}jP0|2boq52<#O?$Vn@O0{#!TTg@D)T)mkl~fD!MV>^<jp;kpPhkbRRxNWrbIF%E
zIq*rBLDq2w=H{S>K}CHV5p=N0=A1czw|Ma70uO0lS@G!_lTbm)m^mVGpwd_A5+71j
z5~t$vac4{|n%mq(g~hpJae~^4cA3eRL5#AKADr;FwHYq;>zRa$3zBdVyXLjtlp<XB
zJ#9v~b!qN+Umjkj=0J*{k?Q6a=E^b`9t)m|!5(aQZOh`&q&alaDJTd8+GF;Blxldl
z`i!zum~hqa1=2&8AwHWsjvchHQ4r{>Q%_yiKGYq0mU@uLsWV{`?Zga$U=W&mFzB&6
zr2XY1`?~sPdg?#}XsCu2g|46WInC?riSoP^mDvrOIDw>oSG{2Gq;3J-I6K(_)v8V$
z!K;0iHU5@xJ$Bo{%`rM$sTySfQg3hb&FohCG>kFNyKA`~ZT{Dbl~{!LTrZ_Lo~??d
zitaXCIxqYDc>}vk1^qJADx~95<Y6k-nC4a#3i^g-_unoF8JP!=HPxG60W)f=kRttV
zO4m~e#i`yO7iG09%<FF-P4}&K6BpeSEKj(N#x;|j*|~aNFZ(fe+8rpeLsP|SqQA9A
z@ShUf#(Q|WF4pJAyZIiw_-({+tH$S5uj>#TigG!GD5ySn&koiAe~24MsGR&H4W~cq
z)PE|I|E^Or`Z4^aQ2x`n`CoG;#gF$N>IJ{yx1S%#UqT2F__x3MpMn4D2JHmW{p+It
z%Y=je_JjZbaYU(UCE&3C3jW_a0uTN#PvOsPiw!2h7k^7L<<P$$<^Orq_zhK|_aOge
z>W;!DA{t<(#ub4>rEZskBmLt6@fsi_>;Lu>I%7Eh1@U5)|9*Psc%lD<4Sn&ke*>kY
zAO8vdy2GBN;lE*c>OY+iyoQ@p9pL{`k2TG}Km>^jL8z$|72qiUyjWsYIwC;pfFW_T
zA_%K>(_NH)#-<nFedoCulA$6((IL~t8IMbICXhb_uJifuw*+p_$iXC4a$!QdT0_S?
zDHAgj@m)j|bs|4}NWp`3oh0PIfpucFt!N~*SGLdS(ec2nA*+NMTTxcV@VIq-I{fCI
zOIO>}{H|xbSt5}|=Lkl{t{b2%H{|rBS*69sjt<(eTjDtL=i}Mpr8Dz5<iM$6SKDZV
zho#*7g?Bp^%rJiw{rqf+wUOOi1ss&*rSV<MWd@VZ^ShE)^NXQf0@5+;Vp&&d&m#Ub
zRHjeLME!5i*2xPOCcX7@=j3d-rR8%Ou7;M?yp)%-Nyqe(C9TH(w-UhWp51CiUxnWM
zy@=&UY!52*;d{+;!z>X&=UYwWWWK^so=oDTYqH{ECfwt(Cx>38sYEq1eS%7gb^Tyx
zqE0i9#+uSuEUu3smumx&X6k4J*Ntmqn)dcY!lDOT31Qi@9$T)W6<f>vVzh*VoQp@I
zQq+=Z9g7iFidxI4c_RQ@7g^x#ttQhtv7{$=gC)cuAqIn*%(FFH$z!LHEOL@8J8KKv
zo*ON&3|G3VPZ_TGQy+W7p8tje&DdegqycGECh>tSAH<eL-A*;~^;M<|85^Hy-?cNX
zFi@@l8t&1WQ@wgFbEz|p_UPN$vIE!4V~=;9*?UjP@j8zN93P<Y-kUM6(6|$`Q)j}W
zp8UM;-8#wg0X>h>sAFs{`B86vTu@`NfJ|_aohW;=nv$~SQSHDN(6OZ$*)pzac>>r@
zgSa|%tea|0RJD+Gr<<FPbZ#0QlCULbsX7`^sFzg$Ynq+gwnlIGc_~i7QD&P#@DRbS
zsp#Q3;FCK$G6i5q!#K&-NJ=9gcj2PJw-wVW_u(5k8oxBHRkxi|i@bCcIGMjS^^34j
zC69Knn23<&XLI!8s*kVnLe45Mi+HTcp3gc1jx2}=qo+y8jHXrFW=fX^IzpdZxSYcq
zicERgiGpz3x(IV@)1jZwbs4%Q=hdi4T3gH%24x>-YXT%^(4<-jVGf_ltGRPY4&~0Q
z-%F%ME-*J}IObSlhfe5EqwimOid?p9ShJrL8q{ynNRw4%So;djo991ASukm6pUsUg
z?qyNvZeL{B3>XO7u;n_@n>npNNF|GjXL^9M8&OH$msRbbUi(yuZReU;@Nu#(tVcF5
zpAG$_4F{~Mm^-7frp&3OUnSR1Xrz=pxu(-6NC>W9eGVs4uP%6U7ic*7Fpn;c^R(d~
zt!8-oyXLPebYlYEI(4k)`bY?*$pYbrai!G)8!oa^`UITn3_mv=xyx++*gwf6H$DG)
zP%N28Yn6#$dg|>pu=2<jgZ?CQB9U?sd9QivSOu6vG}1r|^sXQ;$-!G_cHlC((xSVv
zU77?Lw{qe|H8t?Th()32q%J?JIgEpuFn&9?j8FY`ZrZ6+1#Q|kA`Ygp32y=0yF?~3
zM8Yf8{CdQenT@c7aU2+Foj?b%A5{G68D~wtY8aPYm7u{TZdTyTq#pGdBBBdRilCo4
zFa@X|C6Q~Btd0>qDPM8wi^W#*l<cKM(p(s6xEgK_8!}WT46yh#)`O#cZlvFDpV(26
zTNls-t)8Q5T{IMiK0JR@^3<U2t3kWT&>TaHczbtw?Up_osnV?;Pqmh<xEc>|#jT)_
zDo9>G=Y-~KOf}n|%t{-XA#!z0MoR2h(gz$@7$+31Age~E>)1M|Qa=+(xtiIcXY-sj
zTjv~*GB!@j&4+)G>d;0szPgH9xm%yJuE^3hN3h*cVJ+YK<sz?x5|@{lZyB409MaXa
zdw7OuZD(g^FEYuToq0d3#nSG!r6~J9CLX?!Z&JagHfz6qxzT;pK-3f4+0_r_$O5=l
z3%on1*4Q--BF^i0XkGkN>bDk#4l~ST;~6%K4|x_S8<%JLsl*`r1!&!}=^6^%(<{X*
zX-C*dX6S}T;o8T3!TX!2X3jAc2s@_F7j;covgJ$DrKxjwZH`eDY-z`(&ESttv?hy6
z2eI|Io+bElg?nPunkQ1v{0^M`9SHd2`18kuRNydGPo2;;cGy?bBFjXCmr3$PRUqEx
z0>k=LT(GjmWtGs*r=!OC_OY~!rr%LH-d;jofQ6&8Ov-y5we_u*T5HojLcNF?G-_Du
zct1DJRx11QCF!Nax>>uDZPYu^dPNb;i14G0|G8k_3W(lX*xb{)N4_5rTz#-)P<bUI
zNS65Hx)@I+zz%uLu-9y@Qt#JrE=kY()iamK*>4!WJ-5+oz0wB^)yEq70SqnW>j0GB
zRDH)mv4BVZPu-$Tu14d&ilYVE<BF){>B}gHkOUgRC}IAEU1Nki8bTAeM#y@w$^j1@
zjvBvvOM738Df*o=8R!mxy#X)=Hix1TTeCTfCOJHK(^8HO%A@9NeY8J#;$&fxC?+pm
z12s;$An^1&5H$Ep`5ZoOd75aMYQsf^20ClY$Vp(8Ko^Ah3M5WSZ#g_odtN>eEViEy
zYFI>2>1<<8NV<#VG+WyGBff1-^J=N3S4CMtdD&%1ba@CX4pTV*dydRYIezndBGaC$
zXq~GWXI0vp-!fCDsi?XsSacNfS9!UlTylN2$|5*f$;6E&mO*+!250d{=9b4W)+Xi9
zDDQmuJU4Twl2<V_qo}&`kOvd7tZPHw<rPhdjk?uLNic{GrpeAgDQ_Yy#AzjqPLhX8
zk?^Vj5)XKU-wPkW8ban9h)tA-r%LfI_&Q3e)xp9X!*!qS7*FSdnK$|U((I-A8g?o6
zQ_~Ck(2v=zaak!0nQ5|Nk%4;i)(Ug8=luYdP-lsOW>|N|be1R<23@%RiaXv!8;&Gk
z3Np;V(tvJkztVawTDzuYAaGK7lwt^EwCFPSqA|YpqgNTgGHj3;HkKAxaFvondKs-s
zJaSsnNwLD^Ld>{OJ;k7x*ygVv7E$f~2xMhtcofYtXq?!SQL5RL{jraRsoy1A1VQ!I
z#%OU&6a$zB*(nVeLx`9trHf?ef9N*9i=jA52tj`>+K!OQc{P`;rggE-W9#C;=KA+n
zbV8t5AiJahYz+oj)Ql&|nqbQ;hBAn!BKU;``(g7qqfd8?yK*=jcuBjCQIPb!0+ow$
zvCBxlBknVFUKKy!u5dYshm!~{pjs2<S2(SkUa7`}GQB^F)O&8yIWV0_bn$W4HM%M!
z&t4}1A9hMEWpqe<9;<Sl8GIZ9mY5ou^bUSIafglp;>110sP)u|Yb<;p(j>+C0e|dN
z;-y6ed<B-quhwDp3X#WdN_c*{ZLxfaU)&tgQEy0@n_aYIoc{8y_$mJSZfhy=G5O6R
z)Tevnsp*djN(n3IGj)p?H=)gbwlz039-cxTc$84;O0|LCG3;f}V$Q3pCHK!tSOroa
z7X{B202N8|*6L1O_T=(P9<ZHm6SpeA#U?1{c|T&KgqhUUBZzr2-MsO=CaicnvBr55
zH=-H!gG5znXF=tL(o0PJdxYnEq^DOz`G?42PX6a-zHbS|cwEI`5jq+9D%D~)kYqX2
zrHbU)3D+esRXr@jt`(>Svh?R6mBv<*obc}?0Ej)c9Jzk6{YEaYBzr35Y4!y^eE~41
zVfhHLOR8q~k|;Ci2&FJB6>*y%R!OJknE==6l3=U8tE){p<rYlTV|fJ6FNueK1yOJl
z`DWmC^T?3qT}>HYIsLLCy{efTYS=+>hoD)mcq(T_-lCxUekzr-LaM%bXja5Q%6#u-
zKvS6KroTkFB9UzT;k$~{>^hoDNp?~_7{wLp+(NEvVwi%1na=7KJxe@WO(ax!BEY6Q
z!)6^Qvki9JU_e`>)AhIJbKqlv%I%J6U1H*VJ7twd*mjV~HKmWD0v>L(B`@N0VLOd8
zL3xdh1IOYrukwI+3AfCa|7Uwhx5<PJK()3*Tcn8xeKD5w4Jd;g%h3PgTv(h=|D46G
z-;K3yyh68qoz?G#sX22~He2#3iMA}%2sxvV7hB<tK!n*HmCvM%M~ccMYs>~jdX&xc
z%YDU2>W%IL<-IQP#%bt1Xv^V7bDfBzrH+(QppF%l&DiFaigs-6M8y<)z<PWKpbgq;
zn?m07W4Ttt=GX`sgR9vRUYHhTo@YAc+}g*Jvj|RUdfGAbh=tc=QgsWGRkLW6{5`?b
zK_|X%-6t8e3sYey4B>D~RQi{z&J`4yTIN>9cg7EdOatJA+?I25RmSrjil<nRz4GY%
z6?m63nSDRdfL)moofIQ6Yuc}UK(4eXTdwi(H!U=-dWmY&OqB+IH?o|#I#N_a%KW!q
zR;rGUa}Q`vx^<tf`n>MJO$w|?Bk$kyn#JX2_`mGIwtNs<g9PNMe{>Q6!%cZ~1WviZ
zNpSOc>gi=aBS-|x@gZ)<RImHn0nYI^3d;?@_#U6?r#?N2mp@(-9qqVS0Y2nY#uveY
zy|tQ@Js3#wghE%O0qLu|O>f;Qzt`2yF?njY$l&95m9uNyg0Ka!iWRNlz*zNGG<zyQ
z&yoz%#nyqu@Nlx8`q{3{Rz;0?Y{)mb<nbebt^z)=AAd^Iagd>gG1ZCRl@}sQCtGO7
ztLv($pZT5>rF0(p>FTmV0T@W5sAi}X=Ui2g%+&ljY;Is$Bfp;%QI>|?X@Yw~m!Bxe
z*w2E~d6kGnoLuH8LTmLC${(EW6zx?(>COo}vek3zu$<HOWByR7Ge<uOt?4yE>BMLU
zd&=lFpm$aesDNla0Y(QmZ%DtqvVxSQMbe$4nL*GC5QDQ{1+7fp1{^{ym8zzw8JD@n
z{N%sRZcnN^wZjZ|idzFJk3~AY2XklF2&q_L`excMaaZnZJki+gyC9*e{u`olIRq7g
z#@0`yqt||_B&Hqocmc<KD{oGEi_Bd;P;c7uMi%wSZ~47u5!!9hx2bx0OR3HE3nZvl
z4H_PkO%`_!!tCyK17J!#O?_`l3H`G{v{=uydR}9xj9tLB`KJRu4h(0MVhQ5yDAX|;
z5^U$vx)!-+E4(5%s~7<8q;_LRI_yqDCcH|7aycQ>e~cFk!b=YcrP@0Hb2!KhFvADl
zIfta<sd(5(iTy=b!Q9oa(&W~GOR2rybY8SJhjU!#hm3)|2oMziA-<P%IQZP(knan7
z9ZE)oMbZy|+%41GzZ7utERo*)qoP*Q-XXgSnF7Tl74&J~@&>tZ8j^xIhWzgNQ`gMi
zE&B)lqqVpGfLpXil~4i-Xt@%us)4gxa3L~<!7HTee)XtV4VD$vFB;ywZ$-|u^!)%g
zmDW$^nKW@JcfiB7pJ3VOomcre#_l>=h8S{NgysenlBTN1Os(Woh4OGs!hoiuI;mLG
z0aP772b+Fn!r>^S`Zmwov8D_9QCOn?Xwt*<kT5l1StGo>KO%YAul?~UFncNHMRjX-
z$|F|Lg{$Dmqzdot1aiiMT%@EoYyJ#FBng~5BZf<m51?<~_&if>vC!7xhOGkl)+G!g
zKV2EWsj>g&RT8|xOq<gpLQ>GANuq;zQn3E<i4;qr0W<~=PjIK&)B)M0@ve4B9FoM&
zZAqXxN%e|39$xgGpGw7Mkn?by9@0d)5gF74ktPM$3ayF0(bZYmw#%L>cPl(?$(Sjv
zsA>*F2ha*vsF_!$a#32^M5sclbPA7Is_Ahns8-((Q8uiNTXjWo<Ho0ajGk(wB$BDS
zP{kB14&`x$sY=nr<SizQ4VX1Go~>xmDiCl~P{SUHYw$vcj#^$fHTOoT@^h-Ob-U!i
z_tb>r<SPGs0v9M5d`x&Oc0<^IJbZE%eHPc%1DM)9H^Lu19-=nnkyn(^XOch2%6`ql
zoj{<V4y7z+p3UkaL+y6p-$mdy+H?iB7Z}X6>yH#F_8fT+%#=9mo8u~PSjmUv!aV@N
zx=u{b*GMh0%S;mbG>@9<r<<*}g-fo*)YtJ!_86a@H5EWy^~QrD16hiYX*nq+5&w4a
z0fgAUXz3w*pSvvOh*Vo5dFwlqcf?4l6!z%I>*Px6`BpBdcJd4o{27%uXPiA3(bcAw
z3UwA=Pf>l>rsr^_p!CTXyjfn!X_r-fb}ashLSq;H*v=(t2p$2}m6(a`?XnSgZ~HD8
zEZEq9di<DzT&>I<c{=gw$h0O?ICVjP4Djl^a?JAZIwv_N#TA|3OB1=}`*pg(#B6Ie
zWO78x1C!k`r0Hspjw&^!qwJ)J5gKtOTS-6*n~Ee7dBDXRbeBrdVfO1BvP{<MxZ;ZA
zLq`RhM@cvUVvd+CxOIh#)$J(x!9G742NbD6dCC^R!wOF0RJL*#1Zo~ZJv8J|577NO
zpH3>Qc=4H$srTjKw7{SF_2H21)ahNOjiRA|anaMmkLX}0tgt(3F@Lqq_zqbjlmBjh
z6_<sZJYoH5;Zy&9_G>-{kS7?~eSMP#)^~32xaPpk;?>IqvbD$7Xu7xvXD%0N#9Y*7
zU{fp?Y7oy~J9oy!hU2ylXCZ0a3ix(c+oa-1=|r=#!2z`FYKBhl=;O7O8Cu=WR<=$m
zAxk1hTQUl-JX$Az7&*=@-&MCXy;8kT*wJAE;I!>fjnrV;_NU^ut$6zRHeNSuW!DkI
ztNR|;g<KO8Ji!o%o_{&(F4K(94_)v|I*l*7XD>d&AK$CF9h0QBVZ5={1{f+VODJ#U
zJ9VDfhd$Y+YVpXi<$58@G`bpAy2R9Tdpfw1Z#qe<#upbOKB||QIxEESq)SnAvFx0x
zyyg0(^8On%+<H``B-=0SQ=*?@*#zh8ewk(HSLg%qMfL2jT*X1`zMI9b_wBEz2;WaU
z{x3-WuV)pfUjaEyXcyX=UI4BcP59}0w5r2FEcydTSr?za6B&me7Io6c?Kba-N;0v7
z74$5$a`J~Jxy>aF?r$b&$tciNfz}KHRZdM;;1MqX2eCTDH$XNSkL*EZB6dgBx6Sp|
zgLyZ#l@q$%M$Zbd>@(-2lCNdLPj@`D%|(T+``YsuDo;rEox+s%H2~p<`zGqvqRbif
zg{98xz$w+OZ|L0dd9wABJdM|~#PUh)#8B(|r~gRCveGsR>$b)RPt|Xh3|u8#bDtl1
zZe$=Pn~+sLrNLrN->i3*Y9FDW-xK}E`&dJPm(zgyRjC;Zcp4U9HkSG}up3D+3-6)D
z2A_jHp3!F#g6QVX+yLIV`)T8u=j#K&F8i^fKeSvu9(#20YOadC=c>5s@Hf4<IjY_3
zGY)4hyRGCcB0XW09WdfO%eTs*JLQ6YvWW93e2hcd;dWJImNQd#IvJKjIy(D0YUUtx
z&9SF8Kfc0iS&JNhBPHgy9)lpO6N@Z&^pp!?OQ!}#cHfxRlK{jWm;XRW+|;OL2uTv@
zD7a1Y-}<6V-HLTie_G}{oqdPP(y6F=MantKS$m!=Gh%C*TzlMP9sV(MaLxO8?-q;C
zq3)84S58ScdZZ%H-8A5IB-?k<>oPa2gKq|7xq$>^CCA+5c4=2!q+kr$;e{WZ{{c)y
z)~1%W2aX5MYX#`aoKGqn`|T>VYuoh44&h(CrO)KtUfVN;HthQrDFjZAjXJ>)e{3YU
zc=J^LHo9tfD_>w$!`P7GzTF0=7_+3?ecqtZ!)Nk19viznyw+U#G=fy@P=BzmF}wil
zoP3V2QaU>Ra8!22Q@7?Ai5RM?KQQw)^)2}(^4gz;1JncnLr8>`)0_`RAsp?^e<Qo@
z`?^JBANOpE`UyD(EBZ5PW4^k^?~crHPfipL=JqGtN87}FOj$dI%D~ZvR_n>JuAw;d
zWmR)=9emYZ(u{>v%{i?`SWs7^IVIxZi}#nswb0pRdPL--YNfDv<j-q#_SYsXdEco*
zV0}~nPg`|>UUxd|N6}=^$#kVmME0VZQvo+ZBw3~Baq}px*;u+;@l=2gVpI2qhKkMB
zMWLEp?&lL*vHazZirw;!_i0TD+fUaRE5@3$pVz)v=8Hf!6Ajs28)>%1kxw}W@axTD
zM#b-k6s~<891p@>8I$iXUNV)#_q$uTw!xl31yA?@^@nx(s0l8i%1o3e=UqH^0HwBT
zEK<+a-B&XrpXLVl_l)U0Z5}rqjOmpj8(W*(M`^2g1oYpXz4!Mrg`-IJc=&mooc%ML
z&#+kO)t}z5z%53P-U*sr<Yg+nB2~eAK0(2&+!@@ryq-EwrRN<ilYPW0wMV?{9jIR=
zteDb(Gh$`7lhu%_@A=rx5h2Hzl1|AZ4XwD7@Qxc@<(qjRqw&urAd|o?mq`g!1AJDc
z08k@^U8B8^SgeKZ?^m;e7Q;|Cmhulfc_rjwhL*@rGdKAKL*G~>Jk7sPBN01gfbp^z
zAMG+S!2OoP&zd_Rjg64^02?Y%X~x0KB}6R-_+Q80GHlD{NffBW+WTIGv6<Hu54Wlz
z^xu@`g={f|9R2dWVR{qhn8WdLft`GhC&$Bn;CbN~LYcjP5ba;G=P81#S)88^DNlLu
z4jK4B<tg*HlwFXsFkcV<eL5N8mhao_3Sgx+3XC{rWMxy}TZjkDr16!oHc&G0us|H(
z^g5}~8V@((HwRUeRJ@g@EToV<8LRM<ab4&pR@ZX_T*q|ej8e9vuU;VDCiwVU$Vbl-
zd9|b?!kWCl<ym*8)m&au5okW#zb%rik_=d<WR>t&(NBGOvyMY<d)b}N<`2KV9TOC1
zPCCBK%cZ8KP8A)~s2=l6EV}^z4s?kxO8xS1c)Ujl3ygpHHIA_D_4VU$ns#IK=^kPK
z5{7UOV26}!R-ZCzYANIUxf>Xl0)=cs>GZS2N=(o9r3@m7>SB>i4)96XC4L+^dJvkQ
z=Z(Wb1xxE$A3;vI96=CV@ul@`nNHDq_mfI!I2B)5(@_*mk0MZ)0T`)EOjWsao#>?x
z`*^ipB#`j7#OXfOGayG-MNN1r;ju&$%CKS^AXj;pNmUXmy!3wnia>S0>o#U%*ZrRF
zcslJ%>jdoAN20jZiIz>VVz4TB*31@*`B#`Q<$$;5%$`Z$NEuktaa}Kooj4Sh{?$_{
zbYx7E!ii-twmm0yeT#q1vv3{hg&1iCOV79lQRJBy&bM4fAuau@=POsP5hYZ{^)S!)
zk0!zKywHD^ju%7;)e?o4{^gT?HVIlvS;VM3qE9%UFPvD#1Ri=GCHsK~N~3_DBchK$
zVwWbmM6#rcTu%bPvz;JPW1GabK>r9wxIpVl#d!=hc4Qda&`>-lqC(OMJYQF>(Tp7>
z2;Pq+=TjwEHK0yY$_*5{fud+2w~d=Q^9j@vz7v1=DhZu9P?r8JdP@2NOVNuk7{20h
zQ$9K`h>@*AJ9a!tcw>JI>V0W`iAdk}oiOx~r=e=AG@ve}PNGT!wRg3?tW~<+{+%q+
zip6W58r2!T6@d#UffZCdw|F&2V&w-x8B=1_jvL4%a@;Vs^skwOmiy&H=(w@6X!=F(
z6|sK>V((7mM(_F8;*|Huv>5IU6<3j^e;J8YmH)taEFs>x7joK<Q~>Ra^llMR8CsV)
z&DAJmtf9;W){@1)Ij88{q=VLG82yW83gRwa^qW-FT)RXaFzUddMtf(B)Mf(m4rX1S
zA!$Eq%b;eww20nGbz#ftF5H+6A4EheP<MY=y>+?WMXsqD)216yDj_3Q?L^GeO5}f(
zHOm_N%1&1J<~4s?>8mbZoH+Zz(pToT7qd=9{CP?;`p-XbTN}xLTV(TgIye01AEaLR
zw7JMBO)dP*X+h8Izz%Zy_u|Kv@5lT@3@(kS#bas)*Lul=i|fYcq*1->ktMM$fl7a+
z**&rLDecF#1X7vm3A7o>cR~H#mS1K<+Ui1mh%E1d<_K-~Q$bTC#$Vd*-3#wUPm@i0
zzF1wq^l74|!A0;+(O?r9c%It97fKiP3@`C4uaMJ8g(}~Oakwve5=_&J)nfkgxA~dy
zX$R2Tz{}?TW<+29=01z{VDhN`0Y-mxyL{QhNy?U=zkKm*l3rxvl>V$gZ5A(kNI!U%
zp9o{J7Et9$zN#l!;zGDpf=y5FRQ=r+UuLvb`%~f0><GfzEWqyzo*(HX`x<=v{OPAe
z%c&AtVND{3c}!l!)jLG^Y2)3N7q)1)T~Lj59WSEI-SHzokq(LePGMP>P8@&o&-<A4
zzzc8cefb~)%g;%?d&$0$VkTXGO@G?+O(b~G3RMq7uSkHerj@D$_-f7&i;<sg&!Me`
z)V*M1$9C|UUP+Xor%hbjfnM(Xn5N0<Ws8Wg7sCYP_@R6cSE`%ap#x`*lF=LA@{4T<
zu36U&k}8S7z*9o`g0~u;0Qi4`Se{P4B_9n&E+DoYTb|>Fs&ummOF3~A!5lCB9R5rC
z=ix!w^wWR~J@^Kd${nd_Y`vhC>p5Pa*g@z<x$TIE{`2X<Rq#6q%n{|&4DiCZE{r&y
zAbKJR$QT&$NT9LD6H30RFx04j!Se@SNO;-&gEoSx5FcVTBlF(~e~EuJTsW>^^K$VJ
z;o$`j_AJTrKZH2pbuG)PZCQ3(mSw+XS#C=lGpaO)y&|^%2$IDtoo|Z|GQU*Tpuide
z7?P#=ORV7~8!l$)dQHP+kF(V{{~DUbGuom&h>En~Bjo6<pv^ph6d42_2MQ=Fa-@t9
z&S&{fD1))*_%a|>(|3Ob<@tz?k};J*+>-C8hyeJaFDDEUt`)=(FJyrD0$0WmMX2Pj
z1RnS?p>|@4z=hBf@s}4oqj2Z`*P2J#JM3T7csruMLLF=NUb=|X3hS9J;=$gB0P!55
z-c&h0$(vF9!{KwYnr!!*tS@&etVtCaPhT`sA;E&=hR_O)nL>ZSPEo$vc%2DSZb<)l
z+0iHKX|j6R`v-<v?sF+4@*vm?;NDe(9XQZCy*zLN;!KEfaoD{{zx4W&=g%g|R_mAU
z5BoqOKrpra3!i`9h4fF(lr6+>9?h>HC*h=F$bNYPy-Cj3e-M>3x=@Y?Wlh|0{384`
zCmB;f&=iS8bSi)UXdqhXZe+Q+hj@6Ke>*UcTNDgksDXcKqDu^{R!~!5*%8yxU$HU8
zBoPA*|0X2zNQ-|8G=UR|;5`B@W_Dz$sa-dSyj*4X>SePb8u{Qo&BW*fb{B-nzetn#
zI-4!?)KD<W@(lmJHKVu)X^DBX>H^=JI+3qFOK6b}@c@5PRzg0G6RQ6vNo!RB6iA7>
zV<(Qn3lbHA&$J|cWpN=a<3Ja~nH}E+xAFNvj>NG7(r9ra$J9z30(Xmjwsl!lqcgdh
zxAgAeP(Z-veK1>yIzIS9XjOP&Gj=Y83PP?D6$G2ImQYRUQRRH32jTf700~C|z4VN2
z&G85pM+$#FySC$ds(24`(xXEgKc5}NV5CFy-wi$B@B0|NMt!H$XB<4De*rFNa-{I4
z3PdFiQEjYz4h|_%4h|0ZIE56dPR(O94V*d%q$6-FO2&>_J6=q!p;!DR(msQid(sqj
zgD)SrD`5aopShV#JE@%!x`M_i3<zCBfAyiNSY3bMI3RVO#Jf;Ind5DWVpCFAJx_f`
zeYSy&PzQQ|z-<P{Ku}E#0Msh9%S^Sg%OYPsKoLPVea0-I7Q~*127JaPF!YbQ(TRf#
z43)>#`Pi>)PW`N#N`SU0hGSnoW{oTKNiQN&X984l0pAQRWyZm8)G0Jh7-SN2QE`m^
z_ac9ymtOJ44>KCCuSy~6wNbH7{j4E)q;=63DW5f%CBBQjSbcL2M8t)N&;pA{h%-Tc
zF{>L#ZKKEs&k=qCA07UgEF7JJXK{?>uLoTzf)8*;(S`3(`Uy@JS^T35!Nf<LAR*o?
ziZtSdA)jL;3=ueVRX?1S;Txg{20kY&Wx0PKH1s;6jA6m?N$`ia#6vt{<*uSx>PbFF
zNY%!0NfBQS8(1tVB{&raruej0VXAWC*n?xzYZt(rcO?#hvSmW^K^$DgfzDW=p91_V
z=~A>(h=<l14Ie3vSrIdlfDiGn;M}eoVNnqRKJ#qQdH|Oioc=4gFO`Gzh{LWDeI9=j
z(eTomN3hHQM_t>cs6~Rfdj!@N^D>mZq!8zq)H%}Oy6V(>UE+0P!3>GxlX@M4;bMpM
zc%PIKHbd&xZjb5?ZB9OpG=Qw$9Rh3;v_*~`93vIzg2;<(+P6Z*XHjFDMm-3q7}Ze?
zgoh@1AE+vcgRLI#=K_McjeQBT(4~LruAiY8#ADayt3sXF4|IxE&!sl;2|A*IE!1(K
zv!PYUF{XtF=0=5C&xq_YS46YWi9_FVH4WZDH29C8LG{q^@>%X;J4(K(W3}M8#7@Ck
zf~k}wasK9nzW<KWzRcjz2r*8+7hc3*qf-o*7edwxf*87OfD@f08%FQk3&?+n(UdlR
zKC2mow$2B;{*89=IGhsCi$nP@Gs<y;z~VaJk!Ta;fam(AK71-)_!KB5(X=EHHt^Ji
zk3D-T`26~d^sY3f%2_f_M~lU$Z*8)~#7~7K;R_RxO5^Aqu~tc{0$5x)rG*@-3+&O+
z7#lWm5BAJNG~{uJ)6Aq`=;wd2qg=rfpig6~z>`%#y9I7ru!;l0*b(^5{soD9v?&)k
z*r-Xs=LjK5{G(*~2p}R(9plCVY%#o-$6!P}CyCFxG3h5zWy&%E$qs>(kR51qRxI<A
zycx6Ph-1W|FG(VmG=quni8yB=7L3jH=vhWuF;Y`pouGn?h<^RIw0D1aV1Jb6Md)D!
zEQK*Y;c@~shV6y=&h}aSBn5!~Thl+QNFvZNw*NpvSA-8!kbvY{dK}<+RN;$X4CmQq
zx*dIMOMwOlQ(}xk^!Q?d&Zv1Vgf>OP4>^LS1@8M02z(wpB+HOk5J^4h@YfGRni4df
zd<aq4dLi2hY_qPywHAM#M<NWV_X^8}Pv_Sj-zo&Nu~^BzYTWVxUv%|2=G`2sqf%OM
z3`z4X9<X)0K3=h4Jr<e0p#Dq{ZpaBfUw;r|H|I-DR15)?R<v+g5hb;XrD)0}mJae<
zzH}o9u%sY&vmwJH$w@!^xI%;_3orq+*dWDqD!ej<hoUYmZXbU}2A`Id;LBD>&=_l>
z*L49xec(CT`Y<Nd&Ng<7825;f*bPOHh=Bti0wrG)LY33%vN!{K80z;?jbwF0dbLLy
zI0cqQ+{eLGVcAmv7=%!3iNh(&7(ilS6~!?j6h;g^=ktn&xTr!r$C8*KE<14|p`|7~
zNL>oO7w|*?w%C6>f+94Wdd!E)6VMEUt{lFlZQBnBmRc6GAqlq<nJ39Jwx93(5!gtc
zd~0lEhP{;7gCAonae4QOg7;8^Y0f6JUDAKWM&)?{Pu~PrlHs4pfD+}Cu2(9IP|ipJ
zelKu!l?C%7%UNFdUK_EnlBp7!W<gZ|DzoTRZR@HVuta|c$aqhz4a%+Wa&Rp)-Y7@{
zmhJR!5uf1-zR^SE^bfl;f`4fRik!At4y_4gn3L?lnpqTha9LpQ_h3tOc}*045om4}
zqI^`03x^1V3$hwW1%0e)m?#lxEYO<*6opn$Xq=iJl3hrjd+~EVo3A&?`6`)xW78fN
z>L4mxVN-vS(AuHVLi?8ijLk9MP?ZpC1bZwzT*PR>TfHc1<sc367z{3+<bZPtV*%t%
zsv4I?xnZ!j`KlRWmavz)0nEy=3fGv47R#?hkx3j=K6CF75no{RAkODdvRH^Q?M1X1
zN3p{u1?7jDE+(QyH>dGt8DWEfaf5ddEF#vAV_1KMe2E<xrVu}15@RNoi2<!^5D2n$
z^I%DJBQC>jVFE+!c0Si=cl%G%X7}_T)5hH!k3pTyWGXE)6Pdm*cuZ)UBI+<=kTPuE
zb%-<@^h9IZEIpEEK&I9RK&7yCmx4}P6RbyBz+CQ|0T(@E8rnVm$!QViL&}GVPsU1<
zYBPV;s1BEnkr3`fLI%r$jYWEFE9MA4@E!Np2oeXnw3v@GBFf_ZRNG_F0POq`gbNbu
zq2!_g%8e3_#jEPVH7{Z#n%~NBz^A+r#0m&NxMPj>dW?jNu7a$@wU!-(Cb=QYb&5|c
z!1P(~VUk(&lOI8K7bahmDri(l4ben{P*Z<9i3tI^Tj0h*n7u)(Cc8;7rUT5K@mSMJ
zR9kG91ld|H37KrnKD3CPP@2?`y~`L^m%}GrPxrVXm7Wy#G&jK16#=F@SUxpKDy6Fi
z$zymBh+a^sIJ%Fh1ifoo83a!<4X-GukwhLuUt`y!2@2A5Rbx#W5y`e<5D5|2D!PA*
zrPn5nHZT0LzkSw0Lmqp}OanOYC1gRHNrVG}dX$CD2;rkdYj<wY%7#)3LNN<?>_IXQ
z4oHre6~ZmZ%MOIn6wtjD#%msIsb@gZ!@-RB50Oknh!|U?zVWZP3=P-og?yZ*nWtBm
z^7sNiB|i|8^kP;@aXA{1hm$b)HPwGm*J2vDQgN=d^slLibCC(>6NKvMO>rNaFbS3j
z-W0d839A5m@tZF`u$)e^Z_eUJ!lfdy5Py6LqlNFQ3(^Msz?gS=OQAImYd5<%eQo(>
z6*BUTd6>0B#Vire#B{y*!UxlT7vsLk-{Pr<K$r{c<zfmS$k?zR-u`sW(AIzS6S0ec
z#XNTFT5$iGM_S*$e-S|C(Qa7Cv?O~bQty1ms*X(x+Yx?!&Qq5D)svBP`PZKbS~%>E
zaYg(NJ>WCBv>AQ*ASHVT+;;>NinmS}>&Xs3H!mwvmoK1ZDf!lA0}nB+(5P4_V&R58
z^sab|Ts<-dke>)aD1PIL-qL?NSIm$u=Rv}K`8LkaUl#MP98lV`HlTKeq|``PjBVrG
zAx#6aC9!+nx^Zrigq&ZA?IIq)2O}*X*ESm_X#G%00keb4k`JN}Tu5kKkqBx}zp_)B
zHV~gxbdLnhFo@nlTZi`>X@WLL#A-+cC9HwoVQU8jW{*H&vGBM8_>+J56lC?ZW;-cI
z7?6YqjG7=rPYmI>`1>oC0u_y24gtZFV#_FeUJ#!=S8|jEd_dF*iK8M%mCi6Bu~tdT
z^dWBvwZ<j}e;L|<s~TM-v-qN5w$Ojp>~)GcwgO@iAEThvLzUCc7?hRMi#LYY3;BT>
zE;$-RVdJ870S|5L;l_Vf!ME7*K2|;xDLfiVVQhJuU*idGIsIo1vxs6-jxGq{fCLqy
z4L)1N1~`aR62*nrA&<6qXz?*jTmeLr2##o<H(m(|)x|!`n>Q}K4Pg`WW9Yy(+>30K
z7PzQZ3AVfi0rh+=eD>PHM@CeDE31$dTYt>9Yg^0W5K@E!772ezjIY8)fDeQepJRAH
zu21}$wtED~u<RlHfOQB&O$4wpYu92}JcXVtjFOPop&CFMbv+Jr;cJ6QFv5NyLz-e9
z8@MpoJjoO~4$CEkrhpk6!Kf)bBkK~W@DF2Ak-p<ctPVg+Ld+1~;EC7|>LRw_QSm?q
z7-&eEY@u^m<ko)%HG$F|Y<r%FA;!Z(hy5thPpr*pn;F|oL)<3-+a=o=+0hkqi=gR6
z3j2r@Cg!PlB+b!OfDZE5(x))ZSg&LQ2TPL@Q=MhBSn7ormVa}f<vyB6acA{FuJ&I%
z=U=VAMu6~sYd+1G7|xlu=7~fD74Uu3h~Q8h2SC5SxnqCIfkwoYQ#PB!f#%BxsP+Q(
zRwbYWdTfc-LNBtIpTzzf&o~C~TjoX{BgfK{O3MMh1aBchA{1+6@I;MyUXy~)b$t-H
zsuy(QQr#f%*|<v@AY80eKnPY^g=Px+?Kd#9F<c3Jh(%Wr(lS)V3;w*wL(z>{xX$Lu
zWtxo^-`sy(bg@-o;5{gr9&8l|OT>Kz`UYed*TM&^9=h6ZiL;9VCV~_CJopNGSg62e
z6i4J>qwr#w!W3eEs1iH}A(UNLz&wCMj1Dt>ALbTU#Wa^fkL7PK{_-JaWgVfH&}6*`
z{tUKP(Ec7pAS{yb>4TyG%no<LBl3s#7FeVdYqozrZi{F8g3op^5khZfV;h5#4lss0
zmbPB_#}F|9E!E=q^%;0L)MJV51-@bFfoCFY$mhH2W86WHE@4{_+AP@Ig0Ls(9zO1(
z7udeo)W9MQ?TZ0NG%4x@58h&St3YOoK+l&MQ%N0zmUBp^%@;^uBP2fIvziW-ML>-w
zmVkflJ7oWzWV-@;f^ai6#GNrVGg5XG!p5*`c?t&wgvT3l7?a#!o6dlw0!YqbI}dG6
zvyiXvhn$1}NDr}PEOWv_BiJ~Ft&-#e6Dt|wq6@YMDc-7;%QyN*FiZ#`*<Pki5|CUx
zHa~e|?N1L#vPGzpk3E^R7Szduju>H~?O}hAheP&karcmz#J?fB1sgwK#2-ZwZ`g0)
z7v#gU{H+4wrZV(2Bk~k>S4iOK4@Aik@|ZuE;6{Od8Iug-@pbMls-)hD;2_X1B(+Ia
zVI#>09u!mME7L--S=<~-Ob$T^v^Nu%2KTL9J%ymvKqiQ<<#^pPEHEIs4(TME7iND`
zq+q@$h)J~gr!b(=jD;tYdkX?1+?;wHvuH;WTnhyW_6SEK3=#aoML?p3H0pi9q%y5#
zjA5VxR?Gb_voe?pUpGKhHh)&Z5B1k5bZ{1AOm?1<pqIeH9+x$RY$kIf(Mabci8zXc
zv=0mabn}!xCQU5BOIR=A9}~_OE2w|%B*8Z8G6!RXAHoO_v(=8d0%-#}o!4f9LFSRJ
z%)lN7R#G!x{+5(e9pBn^WTJC?3|WF`Fb)YTEiOK;;rFHYrj@0av?&9-2mk6UJWDP+
z#m^UJ>jD>m^@3_NyE6IrA^@ZB&_ElLhj#YTt$*d04;qTwxd(7Z<!-x3jVgb6p_|8U
zOFjs;3$l}E*Ye(RT|FJl6!g}rdspC^WKt_+KaM(Nr*^6OtJj^TE1a4hoU!RT>h=Za
zdlmNP_;IdA|6AF_))4DCw4;}G&A_kUbYu5{cA9DG*HdH{dGexYsH<DL57<kz=w1l$
z1qFJ(m-DnemDRo_X4cprfCGPS(r?dM&F(_lklwOcNAK0_BMPAD!<*=OVGipQ#wqaO
z{(+iScs#HTViS))vl+>Cg*GX<0o!4;SSLv@i$!NYReYk0f5)_q$BOk(pJR_)&*bxO
zxQ6AM3rpXw()}rmhdHFxQ2U$NPC-ch7-}l6JoAdrzm)F*8UcYri7J1K?K`A6BJ?9*
zmumPHMjFZ53Wr%JghndM^chjj!A7V6@=dIxj*1r{e`OKdH~Hx04<Vb(A`&tAqc1Ra
z1tfRMfYyNW@BvYjh5W%LBFRg}=SAjMM{FT~B50Hsw&KO6ijYsf*M&bN!=WaK!SNED
zBS6$y6xP0Bqd2}T2#J4@0-V1O<$4JmUKalp6}l{6x~%x?04@A#HeE|W?6YL^oeQ#c
zXn`zU6c~8D4{8?(ehV&ui)ZlLE?4CG`uD}Nh)tTO-(pA$<}duKZ#V$d%tO8qqMpFd
ztrS`YZ(1<!ml=+{!4M8D&*AeglD}Z)O3X-D*AvGtWpYv+;kkeFVPX$p2WOkVhchRz
z=W+}s&u$pOV|L>DE|er%$5EkA2gHJ)*<x|Akvx(*l9E<n49_$NLE`Kj#}^<*z~yhp
zAuI$j6E;Ui^6^M0UBoS+jOkM)+IDP0L#5z25pc$_R?K04^7un-(gcMOKfy|c$sZ01
z4lqMphk$#<=aYY)67H5znR882#q6g33>ZES#wQK<>PY3|h^AzFuV60*JNOm*I^Brl
z#MuO(Bgyyx8I)w5$YoHw$7ft+%qK9x&vCd^Ds2)70`IeLnjl$WjpK;9f*N}q?kYHP
zT=Drswqih4(jl_mA7SOr$5i6;=WlK4;>=*oE-TWe6GeYJtXrtYk;{&NfKNE%6rjXC
zU}Jscw49QDU>+hbfCU+npQ169e3aT3W>No&(N-o$KO<I0z^5Q_pb@G+ykq#1qZcqr
z#F_*MDxz&UuBeil|MTLL#)6C`h{~16{vSNzyt9wbt@--A0y}qP{h33IRS?ruhpEbo
z*!3QR$}oQv+LQ-zg;@oBPY7qi{b-Q~2b98bZay**vq6HE7JT3lj#+z-ug`o$xVsfb
zW)-0>1e?RQ2CK7z>xXj?X+&8#4+s~LWP_Na5F+KFvqKJ{VmMDnp&?o}(2-8S9C3`g
z4lM8@#m#{8&*RSW*j|SwY14*|<%9E<JHyhQ!5@E;L@b!k)-f;Up0v3qU;g^cK5f3e
zGe@`x8vbs{o;@&ltO$0&!dA#B@Csv0A;>|{iuu%zh1*#WXNFx&KtN<49+sXC)rj%c
zM-KGk;5A545tuy0X9>gUSQ}OKv3p4H%(da-9W#D>q7{D;_0N<=gcezR-7))q2`L8v
z^4EV~dA)k95%9$?5qq0){(+aUU{YWu1tnNae8eMS*D-&#6kCXh;RD9uQWkLo{(LD%
zD?rJ>?B%d+mS1Cdud&Tqe8qsrmrD>{gk<t+3ApiWbmc%E1b6xD9Ub$@RENEoXa*lW
zP<#~w+|uYL?LmgI9lIPNcEB&7GO%UY;xm6NEMf@VFA_#l?9Lp54hud81j4<J&Vztr
z1Z(OYK3*|4cO&p80%B~kd?BN)%OM3OczD7!S{L?xwx2sXM3TcBVAh6c#3p<09CqcS
zKdDz={u!#xWwzO*U-|2Dy&Es7bl3-6rGrBxv}u7L3)Ytq)H`-rScN-*Lu3@sZN+~F
z1MqtR3C?>Xu)Zw)TUsD#EB4|frY*?gAHA=KIJC#-s-SSk9P?e6Ta><-4Ob;`__b98
zPjm2(8>u%OU9Mxy3*kG)84eMIASLK2>LETMc+<jV@v&E2OBp4gJF@hz(E?no6Ug}r
z6-usB7AGSk>`e+W1UU6kT@~P&;AnqA3OvHDIas{Z64}&+Lu7AoBCR^zu1y8LUpwZ{
z5huRZo8uS1J}%SoH2KQcqIZ`^gmbnQi(hYX#esRYaJW$Mr4E?iW1eDqljD#{jxHc|
zk)UWuY1g9vikT|;G6LM2&#_24%9)l4YgmZJfg*(m0vvNx6U``&HNcr7`jdZv-+HBc
ziX+)vU*+(svF0Zl$At)G$Win$?vQXKfBn2%7?Fo?Z~lBZ-v;9=j-J7ZB|dosXDVMV
zK!POuh!lSxUBL5Z2ecDm4+|NuViQXgVTX+MNn<2O9BTxJm=5n&SQ)s5k@hv*`D>m(
z&=wl;Sv)ADf#R={Ak3L$k61H5;g{Ora3GMVLc2{?7`<ubLH?G^-1uN;;KS6!s<5t*
zAHU3e?d^Lg*8V&W2#a>3oxzjd(K-Q4lNr)(0ojv?(rgiF4MsTxT$mR`{9cEgla4$^
zlLgZuOXB=6uCtU1+5vIif5DY@I0@w9)Xx-Nhxom={KJCx4)Foezr6TKaJ|@Wwxe$`
zgk8m8%pwXpjtWGfN_}F3?NodM%13alY(1<olX24;0p^p8(;5{GA)JCR5!dgp%(P3p
zQe#gadDp*dle^O$1DZ{@liSl*21<HT6pnS1IMm<)7?T;*DrRu2i^tJ0p@(keU}`wJ
zbBvol0807rd&QVz9*5x4%LVmfFom9wbHHotg}B?m=UXhJDIS9h8$d6TC5^7^WVKpc
z+M9*_)xWFT^Eo>UJmo^Z3%<<wJ}CihGkh=j?j<GEZ_=Ggld07ne@RxKJ`R_w#hNym
z`9-?g472rXPPTqLF=NZQqs8QUXjO#Qif|tFMU_5HlSwu|U+*eV<TncCl(?$^@|wWe
z{L{|rIkN#iTI4(HMqUGWOntaXS39dO@|zg8d7f@|mND7QURv$!pH&0!^LDXGcUG-)
zy9KCWtI3{bG=Q2Ne~>IU8O_L@9bobsg+7gT_Aq6&LGf*p$>MS+iW*33Y$oaMahaqI
z;N@z6fg-<CXmq}>$mqOLU^Bg|rz?nN!O5KkONf(OXOx~TR_VuKGFmV4?Is=Sgd5@=
z8(QWSQ!xoAr_04U!$6fqs!Fo?I^Edr-E|O)AG)V2W*P43e`vAUEN1kOr)TtD)i*k~
zM~H;}_>(%I(hjToj<|ks>r5Ba?2kixvr6XcJfZ1%ZHpnNYF<>!7+N?)vm%DZiG*=B
zEVEyiII9v@Cxf2U>yr~}wb(Su=y%Fke@ZW_WV}%=I{BYl>8NKtPV)4B)-v#}OW^6B
z+c{LGY_lF`fBSruT-(ZZ>y0*9i)Av-Hq>r$YEpFHt<FcU1?0&9m&W<lPt{~<mh587
z=9BDv@eq8lbt-Jj(P8+`b<0Ex(|H3+dsYAwEEs&xhzc5*&i7!E_s2r*kshwe^bf}3
z-@hq@#HUUpP3JBooAhd<S5#yABejO6s#~knwOZ?-f8BbwsU0*sX?N9LXyKS;vuE~I
zZ+hpz>IKVaQ23*JAvl<RS`v|uCfuj?_+aw+@TYfh?W=TRhX+?qgj2U1)H5{K(iOfm
zVyb4aNjhGv66^u|5t0h1EM_VqnoPNZ5GO2Q^hR7K*`z?rU0zup{d2AQG<3wtz+_7L
zXXBxje}7u5NH3Cf(yXxJmNlSmz5QUsv#ts<E5=Sjr@c5k!``R!222pPAGfwWFx)->
zop;jeAv-_c(Mc}RDSS}ub$bFR6eS19SNG_tX05xst5Nwk)LpYle|MGi_DmZfz|aH6
zmWOv%qt4x3)u{R#>Z<i@_wtk7<>&f)*O%P0f4-i#d0ar&+tx)@la4u)W!Dp9MeZe$
zmEDv6Jk!cHxqFe2v^IW?PW$sdd~JmH>d*d8?DSl{S8tuO#dy0e=LkMfHRPoBEHNc^
zO^G7=c}Ct4z1VKB5!I<SNkjBBDJ<E<VmW=8z>INP6wt%~=+=RZwbZl6(l2&bhq$uc
zf425;McM;#&%blk;lS35zSh48-D!6R+%@_ydGPNV`xid+8c4YQO}(}uUo?4Iuf`<3
z)PAVx+{e|n_oBR<W}EbIeE3$o`S$>P4Snqxn%bSH(sT~h_D-Fd^x2s7X7vbU#yE2T
zHXQy!h`kbzKnKM%xEq(0u7$hz_o}3&e<k(faA~_1d<w(MX}U^ZQ`*UJzStD+e;wz^
zdi}3IQ<64){yyj?SwEhfoZKvv37iJ7I%>DYB)iBasjU|x%mFpm#V?HHuhVQYN$0<x
z{A=@7H`0{fXXgq9YzM?k>aA^-LwkGZ37>=>UswT~Gww@H^d#hXq*n>cj}IZ|f8(E;
zMn~DCXou<1`cpPrE>@d_1i-Ep5_Ty8gPPiBg{-P5XfY7FYy5)<>A~*e0CZr9CQIqs
zKznco55(C!9}mJ9J`iKyj5`Qn^gx7tb7~htnp5X{+jqWeD)ntfy-hveJC91QN7TgL
z>);sIit(n^-$i%tnz%!Nx@gaqf7!$nKM+sfj=2NRzG;0oqW)>U57XVl{jf3aAbRi^
z^-be_h#ovhBt3bSl6N8c_$S__H8RnMthMRa*GpYOM3@%Bv-Sv5-Idb7?mZkkPJIgc
zC--<G?!fLpyy=ng-^lwQuY}Y?dj0fHVZ1GDwXyUr!pFHsYA6c-#XT?_f8@oep*Vbs
z-gjR1py?Gu_KCmvJ{)B2z23GCnnR}iedl=(8g<W+QIU2VM|%~O4w?g&(0$iUFP8f?
zre7ZGN2AS^yEiRu_N>sfthz&M=eAWZ*^94t^&Et+Z}aL$*X!ml-Qo`ucMlV``zfee
z{%`{BBZ*e_h-!>?VLqaGf6_*~uffNYRXWBHZ#UX~EGO11M;x$xc6zj*XkVz~tG0*x
zxA8ukL>K3t1$3kxql@!_V|kD5ql?pjP}kmr$@igr$OO6%$M53Y!xZ+2OMSfHZj5Xe
zeL%1F+ei1B_B8UgU3Q<X;{YXNhpl6`opv7;Po}*6r&&7566^IWf17Kc?9d97ySzHN
zan`esL#oMMFO#_~Z_Za4*Sww0he)z8YxToz6V~g(dIhZ4f{nYdaRD1^*x8kxY&VOW
zS+YXpH^)&T;nXDPNK2#`_-i{VfDwx+;kq&JCK?k-26$w<H_c4f<ZP-O4(Zg%>`)!&
z$!tk|f>Aol5$MBqf56j8wqEAR^{@y;A1$s<YtQy#m2r4yy4qypBro%-N{6z8#(N4h
zUI&eO3N%Wi8Rd)dr<<Zae$yFed3sf*<3%TH0?G_HymbZw_-zr~=&7n!RdBv4hxF1G
zAAgbt#CN|hQqQ(|Zc-8bZ$>$}vJoqC!w;M(tEzPFRbI>We}Xc%9&_9Am|njGk12P#
zaSpm|=V042_+r``xBZ|_+;)Q^<?p|_n(MBKk=e7w7sG_tLwQ<0X}E$#uZwM9lg^gh
zi~>*}z<DhPw2#nQdF>9w*{VQO6<7O<t2>JO`-}T`6c6?n4|<D(DbdJW-tfaDTcu+@
zAV5hPfTWb!f7-^Cf9dKb$+Pph%}GO@q=EjnU2n3pYkR#(R-2pRtqAw$syV9(JxVv1
zDe=KJJnfF-w8%BBOqRBw(MgE4mkbJt9;Z2>U#2dJS=Bs)Iw>fVgj0dC)PxOJ$HsE&
zhIp@Ko0iuAOvC$Ri!g{-wwO(JZM~ecB6=FTdqEU(e|z=}F2uZgHmP&+s4P@Wb+0+q
zy>hC18txHO9mVfCa*Pop=kh4YS}VCfJ=%KCsHi!(hEHu_%i|5!?0Ztjru6o<aHZnz
z&d*_2Ko<j5Ap{w0$mCu|-pW*3WgRR|0l4U9)$C?fcC*rORX2P4yV>h>Gm0;-stKzF
zLOnrFe~Yxntm*9<8EGl^Dt{C;&EogvZ@13Jzkd9WAAgx-7a!qJ{`i`vceYy7s+wl`
z<m1W5-&qj#0HK2bYS}0CVKFNl2Ma4f4iB_SZhst>Lfm@1TIBgCSz$98f3lZZI!=4M
zZ)XwyU)YpZ$t2s-en1%d>M~*#t?fb_qsJXsf2Z5os0ZI<GHIwVdA1xDqY1(DFhX?o
zCOEc>WHcJl>PqKZ;<nlN)3tHiuNKQP^t1NzTE{?l;?LcXw$>(`G$F!GxZvdE^eoGX
z8CKDuqkOxng}sh=rq0v#x|RrTu}apPS`w^OynENurrWfT8LC8m4z8B4PBz<B6K0(*
zf3u|aUTcd9^F`NjD##sL_<bz`S}>IYP(XAVST9;{X_?;F<TAIX?PXqHCzP4Jy;0_N
zx~0r1bm5+?p02C%xDQYN(GBQ^TW7Nvlio+139`>G<!hHiwYH9CBD3;BR@qVIA%Qr0
zo4vMIDK&SUk}7suBZOnq^|opKs3X;de`VK}N3-+^t>Pxp%?fsx+ubdOo1wjCM-s$4
z8#|iWf|m)dw4Cz+a4G?@K+9T&VHKQ*kG3FY;?~L5c0xkxg+B9r)8w2cl=V;p(m~;k
zO@vS7Fqkcfb8iY!%5pZz`IEP;7?L6G!@zJG6qQicCzFXfA&(2M>}m8<9MtSXfAb{6
zcvqhsXcXVsEl*-4y_@KRoFsijw+?>4`tB9M5&5*V=X^^<SBj~f@Tdh{H0NLFx2mzW
z`3*Co_2xQHhonA@+YpN;L^{r9N!|vUia|R?c2c}fit42Jos__=W;XZLgF>2cOX{vt
zeccOY;iiJ3Qc<3e`R;6V7Mum0e*(W`vkpUH3uD_Zs+s*i&U5O+NzGp5-54Ruzv#~I
zh~UZDC>jfo)a^}@<(C=dY_69Jl4+LH>l+PJBB?G?!4_Po^?^U0_7=BVA=0=5<@bjL
zPxn)zFIA~)<kIi({-7>v5JX4j;k3OCNRCRhzT2gBy16>otlM*`$@d{Zf9#=by;&{h
z=f@;ZUnWzhA-IEv#5w{M*_?`Ho4ttGQNfqKJQv0d#5`*=eJ*^9{DCN{odUI%+eK^Y
z`+alYui0s`Ij<eIePZb#^A3Xl3Vc7mdFZ-s6TV$8iQgyra+(~3I5`$#+EDI=_>Hyx
zYHdCq>if3(FUM{3YB5XZe+MDXj@#nH5&z}b<9v@cAA6h+NBv5?Iu`0ua@~V=do;dB
zg7h;my<hU|VFV9{kk3e6tZ%T&bx(Wu;_{xhJ38<2<n)UI=E}Fd*e9D~N*~p|dMyd0
zJE(i9nywy5RU>G#O&kmHoKIxb3`I5Cyv}U%?jW_2Y92^(OI|ece=uu}*(S-easT8h
zZrv+GY^zmZnr6%<eE_>_tS*W(m;Sx_fB*a6UeV9L<LCe2=l{NHj%LuaLW7+P^x*Ea
zmc~1?IAiAUz$MZ$2`rZBT(|UaGN|6iQjwf(c$sP<#(CM_`<H=u`o$TQQw}PaY%pAX
z_g>4y9P$6+j-n>?fB)`i(Bnk$I^l82b`KHFr}F8$GHi6Ea9Tatqq=rF(bNCCqbbMh
z#OQvV=snM7(J=|!!EZRJWj45@A;;^&@P1vWzQTUnm7$!jp~b(0?yuEj%WS;aKJ?Un
zGfHy*YP`#ggj-~fxW%6(vn;<Zx}blP=ZkA=hDY<6Eo1!be*%|R)>=PV!u|ea;FkXO
zyMbG7m`Zdg%(tHQ+LRkRyCH=JZEg1Hd_wSzoMPtn7tqpyF0ywN_`cjDE+KvY?rsjG
zyW)vR>NqU^*Q=+()RaK(LX=pK?&pKJp?D@d@@RPOH#KOZc?!hwU1-(w^lME_einSC
zLHAj(J@~Gee|}C=-S*w_<Mcq{lJCM*W?$(e8f~jXhhewemO{zM51X=pN$k<ts+>08
z54&ui00}(q=lrA$a8;s*{qHPT7;ws>ca6<sCc!>8aM66NMZ2xuaLXVDw=o{geZ0G7
z8!4^5zdmdSPRvI%zP;(_^B_-$uDSEviEWdN@`ny<e{~+^l&i5x^jmDr0jF9_HP5v>
zrNIN&*WDcJamFkYYFyc?n(4h9q;})~K@9bIl#=3XlNklwfL_s&nM4%y@Q-dzQ-Un>
z_qUtf>zhZK86Pw<lLJS_P^hg>Izst)#O`+q8{7{?*dFF&o$4#U_n|ynEFNl#?ltPx
z5+Aohe?ZvL`hv*Wi|s5sHy<}Ss*Y2BFXax7rng>I=Zw{c-5+DpiYysg-+7@DzUcoP
z&v!zINQT|d?tG_4z8`o!pV;XsqQ9oolTm#+=euAO%E;~gLe6&+G4Us(_NQ>ZOZ_xV
z8_C6oZ+cL*K5^4ixcZ7s4>A0;nx1MKpQb57e;T_Vpy?@DeQc(Omg1u_--$CBdyR7S
z&&TxiO#LG<Jr&o!z|>p3^}!{AIXgS+0Wh;59w%PXn{OsVe`zxz`ZH^jVrTW$-0053
z@|#G#bGz{oB+%fUsk2}gM6EA(R#lrfJL%Qar@y_8DO5Ya-`h1jU;68*O{ksYTFk3@
ze=MF4TT&OaG0%4Pa$~xgE~=S>yRpIHe!Hc<3iKCtvRcarGSz0-eP7i59pXlvieHwE
zQ%8@c=m2+W3;m-diavk*Ap|VGZu=KsyZy&)_<k9#KzZcG_9MM{%o07qs@xMN^5mhd
zPanVf=n#XabJsuEL;ZX%=Z89epTm>;e^7tw(>q8X>ZUxl-!Yp#)Z_RlU*F@Lj>ka#
z%TZe1UP}A-3|ySO_!@0~q-*sB`z-J0ZF-cO>lqze_i$xB+zIms_KrOGAi`6}-aa@|
z_^AndXb5gYH|*c<o+=pm=ArE95fR4^#%Vsu0bB65p^Vo^`Dz+zlZLOQmTD@#f39xc
zq~ZB{Vw+prd_cd8e6Zl>1)jgw6rDURn|zuR0rwmC$q}ZP^C*`8;6nzFIxjF?{rShI
zw*5@yGvM%^0f%~e9FGY%I97bX!yWKn#dmH<KEhVfOU51JRbYSgCehP(hq=WEkMs#Q
zRE3>m@|<xHlloYe&HG9NT#!@^e{e<7^AGx2cK($NK^pTf$KZhXvI0Fi2I1&I27R*P
z^ZQZ^-sf?s)P<?lj&AAR&SU6gXM8ILq~@q^cxNlme1Cx|nyVAD(O*E{>d}qk*a5At
z)93_u?4mwz)?NAb`wNsuaC-wmb|5k5X4~;0JNjqU04(AF`hkl>o4eykfA*BCj%M}-
zne6C*GW4e%e9{lkCr)<7qwFkF9wq5Us_YsU#6kB)uk;tFf~R|;T6Pyf6!nf+m;OSv
zu&`ZGFgps~8P|8@kC6U{{|``02MEYNa+A7F006JH0RT`-0|XQR2mlBGl8Q)K00000
z00000gYf_WA^<G_bY*RDlNyB$mzApp77Jwg1ZQRW1ZQOV1e0M@9e>TeYmXyYmKgSZ
zeg!ioogLA6$;|BDv9!UCq^h&Bx~l8hm08`@&0=Rpl9yyu1tVAy!F&`+LlTU&3}`JG
zwy@B^z(VkA4FkJaS%!?=mGx(~r)NLyU(h+{zJp{|m1fs4&|S&6@5j04p7*_si^e2Q
zvS>KV`c;x={+nR#&3{VXD61mrS6=%PN^J9J>wvwce;-EO9(&HC=0RK4X(WZugL#hs
zE_EV(&L6gtte?&Xyo9gC;$dq#E64DYm4$B=ep+GSlvj-^!YTuP{d5RP?P@E6u6A~+
z!{>Zw=V7ayrb(as6+5tMV_WmB*HB<<8~*Wey!-6!jL-Pvq<>%JRb0OD<07!C#8}15
zYrj2&@nZix+HdnO9=1}RjjC~*@9qW<yS(QIIBDKi8PUF21hFbhT&1tr3-%2=t=L=9
zpz126g?LMSacGCK%}Dx`{Z+(U1&<-=lCy8<Bjs_)*^8)(4ta|YhrD0Gyys<q%m=fS
z7hx71LbDxM{eLV7Gg!`L0NrEV_{y~Zh?e$6#7)wyFstnc(8{u1@M>0M-2y%^J&9iU
zMIcifymfYcCPq*$7QX!%W&Emf!Yf9J#Vk9P>C~=WvIQ%A9QVh59v$XB>_xzw?07Kn
zlYq$)C9v<8c`|71!+tvD2Cy&{$D-fBKf#hEOGZ^HSbu?@ndAeQH><=nGlYkN;jE}A
zrsWZAM*HiNr%zf4>)9w7-uQXIvQ81@VGVd>2RSPO2H7z747Xja5N6|O2o9c9ctqaN
zzmM@>0}4Z0_{Wtx1!lDOxfpGAGv)aZ_9gOEp4Slz&<B9XW>dWb>Kl5HOQ}*s^HmUp
zK7a!ZMSmxl4xbTNJXtf8ZCW^%1!DW+3RdT0R`H`+|0@~MT<z&fR=4VHtOj{z3hQ#k
z5Ho9tujSsZud=iA^x`$ZN{eTZgP3P+u|Pwl-_2Oj!!3sOQgF9eR0eltK>%=A=o(3M
zm;ekj0gR0eL(h5u<!00a+WlncZeM_yr|s^aM1MX(ZCCTDANT^u?r}PKk7rekZ9lyz
zd2z`L{~@5(yNGHG(0vJTKEKCXxhUfg^8RcBO9QB6c2O0ahj2Lh<0KtCO3Dg9^h`?U
z>uEapHcn?)ekppf(AaZ0e)B0{RR&!RlCqy?8DcCs92#`NozsA&=K|+Kohp9ApYwiR
z41Y==&z0D9JXu_>$06W?hj31Upe=A$p>o>mjw>v*E&#h)iG?mqYwZ9&%5gHRXj!eD
zI+7c;b(aSU2g0Cmj<Rd+YwU>Y%PN}SJ3{g!cba3I<~w(_&Quy)sN5gHrcotRfaZxq
zcn5zVZ^T=$qWu_8t?YOyMxqdKrhgRzG=JhLAUyd?UvD{FZ}}H`-Ez3zaGt!I_h1K#
z5w8&Bl2MiyybfH5iK!gmC|FQW!;GhL0EhFzlN?TrJ}G5%Shg}qIu*6>E+<@H!ttR>
z1)t=XA5bk*)nq+23<IrRAmFKttog85eCc9O;t6M|NX#Wjv%a`?iq<$Tp^wF)Xn&Qw
z@=J!8sc4PxcOXD=o<Rd)%r5CHl$du%we80UM{Fi9G2L2XwU#)oL4|gS<?J?gc2byG
zHcQh^-w(o-{Ej~Zn1ie!gdfYqV6vQ**z;@bEXO;xSjhvNuae^EFs6b~(tt<<E}$%^
zXz)1<{!Qg<3#0*EW?$#?+yKo9Pk)Da+geEo`L*V&Ak)p~t)x5>*n$rLk|a*8waHeK
z;dWgaSgl{SI<orMKe)Rk5+}GPc+~JuA^s%v#~j_abhAq2kaPbB#8@Uf;p%#|sjER;
z#V1wVe-m{p)@rqW@Uz8&2R&x!C{x7!Yz>pN0@M$*Td{?BZfQFE!5WHNtAFEuhLZ3&
z8OMYC>Uo|!6v)mFZzNe+#aZ7i)PW9K<Gieb5D<1;z_o(sn3BzB5Zb6M=hmPQKRqk*
z>l=Tb)1_U8e91<IxaCGgG|#WHhy13r^L6bzMG@b$hDAQ{CGvxQhiO~^%7d%?P|^W!
zus%>fNG&4N*<Dq-F_`hm&41(~Pg}DLuCHl)k@B*$bpSIf^9lDe-QE<gnH(1kVfg7)
z1{0X_qPl7I<23a%Xmhc6&W9<M#r`k_y2fMgbZr3vE_an9HR^RHMW||z#EgI;!tJ%&
zEU?YRVlJ9lvU0U?AXevaX_QFL%SOr%oI@#E=UsJEG!J?#k7QjKl|5DCE-(8<GOgfz
zCs0jYi}@Cvi=CYuaUYy(D*+k^I+QNDD_{zX#n!%_H_j#zGh3RQbb`00Y+jXA;8Bf}
zuJ0KI+`jPdTa(Q1C4b+uX0VfiO^N1gE-x0wGoaH71j8_1_9RIY!^N<5uvnBfp(=)3
z+QTj7*x*;|?CkQae3MKiEkh(s8YOsndYwEx-<~JS*7iJKp10rI6kx*)uuY%i;5!9e
zqEQKSa#AI6n!H2Ymco4!;sqya0@<+Tmp1x1PC3$_ke>mdrGI#1Dxk?6PUIeu`I1Fd
zoZMV?CP-1S1k4>4QmxjIU~6DV8VwQ<wCq+0$zB#%Fko;*UWhtnKoysIbQSOctPuOK
z4nzvQP(^K_0?Acp)>5@D@I+=o+fIz|mS(YHQq!og7gyxz#d0PQ!A&F!ESEejc|E_-
z^{fj5X3cFJNPhyB%J*8HIZTL1qQk6P^q9RnFZ4xbmIKk4;HHr#tRlNTICX{^KL~iY
z>hAY?QP#%6QX3|FKd8n<e%0Vbk?V2G8pue>y2x<iFvKUcUy^j_ARxqnH^|)z3K<M?
zDrS4P>hfMxnYnz&on@#U;k(s3UQzBS?6+w@_h~f}#eX#<Z7kM>P3cA70{YQ=mmnM)
zfW1eTez|1#QMMHW;4PPO5CaaFn=8Zt!#v;Ko@dK*Hb;b}hg?8C606u~14R_blbea&
z6k^k`JAlfnxY0MUPf1JQF_6Ix<|PLdjH_aSODXqUq8{MD)twNRC6Gxz?{wx9UY7BQ
zhu)K1Y=2-wrZh&$CC^&klFfM<R*YXy3&??n!wiOrcU7M9)>T|&{`sAB3iECp>oSdF
zY%6SR134rcT>j!0uoj(9OrfyheX^VFo_oLe#d+v?uuOpJ;Wjx<COn^2QjjBHYsvNn
znK5w%c3)bT!GyOb#7+z3W3hdZ3=3g_kX#vssed%s-XYLJkwFn9c=;5j(j8oMLk+#F
z#J6B3tLR~6Ms-cn14y)X^PwZ-0zd~i&ft*JXp5+u2~ra2$Rt`TTDmBRk_b=eFVoB=
z0E)y<c)#Jy66@$+I9LNHBY~n(I0;}H0@b!;K>o#(GE9)I#YNF#H-MGtG`;bG4(t{<
zK!1)*QP94`vFGyKe#@P6dnG%Bv-K?yB|UY%=tJ&}xoDp$+U6<Tm*q{?Z)ov$03&G;
zQB=(OaPk11@BP?)mAxu^pC-fBr>}hYKiF#lH;I%Nod1cBl+fOf$h<75X7H-47wDXe
zj%XbaLYIwY;0Na+2dYT|9UL{moFb{3`F~yS?5qS%!($$;n%86JS4lN)`1Bbx<_%E*
z@NhXxt40Lv7SL{6r2}3_$}t~64$OwP8*)*cYVC8qrRxz&$vk9eJw<n%cg4x;(KOEC
zT$U0ilp0O}4U_~e44RoFC5o%z=)w-75Zas(+MXz9xdEM%LfskyMz0DY)|4PMsege|
zZh=y1fl?u-ClL{{xpFnsVT~gMuv`LI+r6^&0SMGJ3*a9EWY9$Wz)W(#&xmeso2EPd
zCE`TYH;Wk&leMt~VcM$3Ji}(@RG}|RF4uN|%>xm9Lts*GYiZxr68WMen~uVS@9eBQ
z)j{o~;RW8#Z4yjw8_?i1QlNRL@qdz-1~tl(Mp-hX>Vdxl_FB*tR+pOesn)e#iPnM3
z#>&`4B~aVfJo2uao;lwfdPnkE0od1k*Ftkgg!-Tor`k6zZa8tS?i&KRip?)LT-kt9
zgdh)+vz}mw^c8bLgbHd)&X3|O%c}<RNR2^KaMHsxUY+Aj`|7+!zc~DATz@5L+Ccpn
z%&Y+?DaMnT7Xx0PSc6~l{tO4D58YBQU`6z;)@lK;f2;IZ#bLDHDMFL!-95f{=f$H_
zFJSvfZCTrYTv&Xw&Dq}Yz}B*v8s9q<T4Zs{l@zyMCPg)i)4OWQr2?IG67<!=tqJhi
zem7<*QbaY$Sh@_5ntoBi-ha3AD5t_P%Jqm9O{2rKg%yC@i|I$u5e=MQH}UETx91`q
zE^&#PJWQhBOYeLc#wd}glwcIVQ=pW&A=s(Umz9!z33i2!9EnW6sl*gc3t~Y7VDyX1
ze^iK6fZL~tt#Vs@^TL+ySS!i{)t70$iVnBFsYvgFaQl+vy)oC~*?;dUDRBUdX-ERv
z=9fg02pU9}f%1TKIB~}n$`a+xM<|n|+mK0YZlF~NCPhoSv6R%J!Fhxmkm`%kp&GHx
ziO;e1v)@`IQMU(F4(wy41egr2@uU}#R?)0HWdc9dos0V<9C9Xfcwxb$P9p?j1-CP<
z_#^ng2=54@;|^XeDt{;ZP9%PZ=Yd$YngBBhEa}qI!X}C2Wl}_N{wtCg1N)G%F7S0k
zki&q5x~r8J$q4Z<>~>pR(?;?p<bR6=cV&dYh#+^C!sL+S6Tf^xD?yi%fGQ;Q#9s1_
z+>GxkDf}&hut1t!ty<YCW|>x}0n7?)2`n(qNuRJxo`(XjLVrJN0pcyH@;e|NU_!um
zWx!_^e4566!PW$9r5^hp2uZ-p2JQfIxn{NHZ7ix)vRbByIFVe)<YXCrRcU5X95j^0
zvX$Cunk1&&+2KTbvU+QR0Q}0;oPI?@!>`t;E8ze^K)%0#i54um;12-jl0p+l?*}18
zz=QXkkAPk9&wt#88)bj#cYh3jZ1r}7SFbM4ty6gFQn+i@U32skx-7BF0Ej*Hy%z#r
zY`(kG{9(WO`>&d3A@s3__)r&k)$0D(de!Ug`kkozBmDSuJJ=fmtqBJ#jw+PCWeBZu
z)krlQCY_{v&<lww7lX+=xlWnngJhWS0%#?|MucM(BmfW2JY;{vEw-y*3hu*LF8nue
z5vxmxeH(Q>0q{__;7F{Z$Qb@41NaB-`*B{t4}^3~%#sTJ3@Hr;!&CJa*-`ji6>(N3
zM5F-OJI=4L614gahde+@Q^3ETwe63b(`>FuPG>oY&^V;?4eULAGy9sYYDL7ircABt
zxM@BL3$RjdaddyA)12bQ9Rmwnk+}J2R#y2$d;`HT;8mQY03;W)3ltrbS~Z_c^O6tf
zH&REb;LG=y_MP%pGdKTvQuttQUqmg^%N0BeY<2Zp63#lhLo{I^y4V*IFtn0D$%!Q;
zEJ$!%l$Dg(9bwaLp-629Z^Z#dRG0B<RpunQ07N*lP%?kC4^((nBfk`f{~dfl`B3m1
zq9j2g&m2AW1C;*qY-i`G@5!p;xNO8}!Q;VA<AU?7VPs{422?>wUt=1Nc&l*)BsTQY
z5H$tL^n=C(KpTq185HmH2J8|1kM!NN$YG}@WeX@VPWB^8Z{E7d2RDlajN(OxyV<C6
ztKSx&jvIgM2vXBL9>@+Gf*fs}e}T0R&l@nX_!8g+TWB@z0<nLS&l*r>gqLjIhzEnl
zIS`n<fU=ov<&zQ`5RzkPqKZcy7+q?q^u1WzwR8|SXVFkmNEa~DUJr>@c@0qf7Vrbg
zpa5}XNVu?Pm6E2<zvuKzLlr8V$dIQkl=w*QTtj~usrixMz)<C8!KYrvw=-Vcz&*;5
z55I$203beEuk$4H0V@QCjN+!t3U!-EwY+C;eBiB$eI6I2<)`}qwe76RoI57Vj5zHF
zP6!mQNZ&rHg<D3Fo>dmCFP@`7d;SAoy|zlqsj}6aYr;DK`nn^!#xo&z_Nxw#A;iH3
zLNSwD`Wt_3WtF0k@RxD_4QlnHmDGT3ZE<&t18bbM&3B}SPizhbCm_a825xHnidc@_
zy?H}b<2B3mnpW#A%QW!<6tuM00=$O2GW^bja330Q%+N3qXd$FT3S%K)nFdK?HC7nX
zZ)YbVII^#bObjBRJ~N?!2O4^Srg?Tj1i^W?>&<@>yh#C6^O488UiZ2wK6<PHzo+>$
zzvM;F>-8X0U$W{4l@}kf2(m4Bq0%49#-Etkvjo>9Iv~;YF^-FD93=c8K&(HQ2vCaW
z^v{R+3^-&D6-FLwz*;qc(Jv9*ZO^M^W17x@m^cRz*<Y%o#))I7DhHQmtHfqwt;rpb
zLG^!QjCh;G+ERCnq6R_?yfQXJb27@Q?-N!fMoA2ZSH{w+vMhm&ksNLpmbFZGlFE@c
zxLUy~==2E|Bpz!39t+pXOQfo(vn?o`aIJJ!^o3>~qE-7mXEtSo_Gn7g0(~mX3D65?
zwV%diiFP`Ou7F0#$WlU;`7+Ou;lOJgTJeAF;%ILJ*D;(M$qSh*VYDN14Pg)bDXJ&;
zJ5}U)A?%&!0Uw#UmWSI8O@|!Znvq+hs)-^{7b7+NTJn%~GT=i)K$$D`lMk!Ebr50`
ztMzk)UX(m)&5g}`&eyIk8u0jQRts3=QZdc0ZO$!Ck=>-bCo!72Snbg6ly+mQHL!om
zh5~wYHm<&KHDb5I@M{Uf&x;z6zIL|S$Ys`SiN;bWOCXHhEqW0WYBwoI)nj3^xn8sB
z;mQ=z+X5BnOcq4Zh?Z<4a$l~J0jj7`HUeQS7r_`=c~r>L%S-E#*(>zinH+cRz+`pH
z9)iZUu7EmRYqK*vLw2uk3&*5KF?WA^#BKHhzY82^5BNytZ67qZKZ6rh<&W|!UL3_G
zw{cs(PPq<9Q8sO9OtOv=B$N3>T#V?RD1*=^!kDkmg;AgQ4#x)_N+m;Ov8tKFkfLr-
z34Rjdv)763(HJ*MXy;Lwuyp_lTZOiSz_J(O1bdx(xKAi)5AWkIGMrgjtp0y}t&x}^
zPE9K0l3^66o(&Tv12XeyQBG?xL+NppESX0MO#)BvmKs#Rs=$F~zNI*1V_}%YC0|>N
za_n(X!foRaHOx3fg^lA7#l<+5-K^)^XZxPJY!_PVxMkT*dr9U2GIWyQAW~WexVdnw
ztf};3(G~0C^=$iVK*Y7e)DC}^reV6J+iS*9NQ(rC;r$yn1n?SuQ5oSoHA#jFtHa$;
z{cyFqlpng2p2q#8x>;F_vL7RsVR2N}W~VB!w4SBv^rN`5A0Dt-ly+vwo5>vZ`@ahI
z4)!r?8i@>)z}$FjAJX~fY#>vG><0+PzF6>pjUv@CYY-p+UY>aDN;Q8oD`Ih!4}K-v
zda#o94}K+b#*x>bT_pYH1%C$z-QREh9&7Bk_VJ(3SmPk@+KF=R*mSz)dJs=(tl@x}
zqIYppXuULDmgiQwx&XqFU099}%U`+W;dX$&?n%H7$4hqG`JKxJ3j0hCE<C4|_qXS>
zWpKW!J{}}p`@pI#_RW8X6@l9(U$Z98N&ov<lLsHWCN?g4->f!Nb{1swa#~1-P>qqv
zIgKg@6O$52Bt91_2R9837jK+w5M~OuZp;P>zECQJMBkL9@Q+co$ePRsTG@(~P6^bg
zl?b0p(&R1~k|rP6kqrrUN7inbj`S+aj$kFP09oZ%Ey<o+R-k{laQSGI@;li8NQHhp
z;7Dnm>cuRLk07sGmulAWGAWab1c>>YlL~Hdv@oP3z)GEh1BX{ucd}$cP<O9DnYy9Q
z+CuY)vriC(ql{u@lQ$s@shp{USkPHp8d_PW;M{<Plrn9x_@GL(2_IPp_DI!O9WsDn
z7KFKvHr7tg=8}I(%u5Bv$$(2fIjXl{^U%IDJgm2>DQBU5D<#406oO?!D!QK55@OFI
z5`9x6u|H4Bd(fjuOZmWnn3RhLVcn{v2<qOP+Kmsu5+!Nvvg4O(vPV(?4j5r2ja<!E
zQk7UK2ouwE9HsJCKT;z?YvpcQTUC@<`{`=$(3Mbn2k?J`Od<U444IpmWSoSN2l{Ym
zHbMFwtaMRNSG}<QvK^y{RM>2!LYA|Ywl=P^G_6dRLO5c1CuT;;Yn$(jlc*KD?!Y=#
zILsWvu!go2RxJoGC1}9Ia)s<ljqJ1l^1UD>^eBG7Y#WFyaQHbptJs{C*jd3G4h}1Q
zM@JH~l=XkxcaheeOP#?yj&OzrAZ{^5^kSnVw8IwwALck)EQ@|Rl!=Hw9^!RWD)l#3
z6n;EQ`;xnBGnS03m!n)B!6WfUIJ6>JD9u~~mH@OPnt@(fLCQ$r+OR(#53A#1Q?>K}
z91likoe?<NtI5&aKGJ2_?J?(!m%*Iw9;cKzUL}95fY`hcreiUfq)%E?O9|)JWEo?I
z9EE&Lm}rIhlF1dSl!^zIL2c6#?bUF3*4;$fY0y!CmC=*g<N_8Excj4gG6mjzaDuEk
z9=TOY%JAc?_30iml1BYn3ia!!NE^o=*ep_WAJ}HQ6!7ieI^<Z*d1b_QTY*_c1z#wx
zBA|cUymp9hbv**ar2s`+1heKqi@jszF4{e#4$>9c&TK0tZuGlCwX5(_)>f8Q=(J)A
z?H=?Hf01wi$q~UK?d&AwllTeVWV$}tNI?nB$;cXlcTyJog;L-9-Tmh8_jZFxxkt2$
zvH9*E^p?i0CsJ(I&Q8~>@+m6PlhGLE^(lWJR)+gx-bG$j`NZaAYjgRm7j(LSNb9LR
zBW?~0lDgk_#O?PSQIE7~fJ+P2diOh(_!)BX*R1@PmaNGqy(|<*yA7kG9k^<mD>Bm<
ztWndvlSpk~G%#6om`VGT`v_XoOaKq+A*Iv7ynr8a+$8hAuY8GPSE2AwHeWejZG?Xk
zZ*iTI9b;Rj`xk{!Fy1F?E$qg!{<0z`K=-dL4HGKEm5U{U($3D40_E(=v<FZXbwf@X
zH4vX#H}8w~qe}T)NSH%ilA;eV%z#`GwCsn&^{8^L-?668k<^)&R|$eE%^R&W;J|4Q
ze)S!F<<FOjrc;UNmY)IC6qe+n4`+Wp^@7e1xI`gp_vZb$<Q@t2yzo1cv<2;pg2!*#
zlq1BL;n%A<B!Bk8Z`afz)e|3hp(r@!{Wtjay^=V|!qWUQJj<MPOIZ4yF&pRFU$}?|
zN$v&Q()S6Q!pI3ZA(E<qNtOwf*N@SZ1?50S8m`5RXm>#ajZV0#jwq@MO%8uLNQfM=
z#UN{1XKYmPBER+mfy3e6egMc}gvNx(7|20|TXnUQF$CT+W7^r->IzFCnwEuEtj2^D
zEbixuD$5MK(k_rN1>le6^a5*cTU(Vqp?LH}*mim+$B&MWPQBn8u^HOkhwD{W#ARDg
zP;W&C^+?u^ep^_PA7-#IchG<3{0L!*my%qpC;Jkz>*<kH<(byMUfVido-2)u)RneH
zawOF!mMyLpmuhfjU#T=JFo4RO+dId$4jl0&j3p5pR99QTHu{r{00MRkp!cQf!|Ft*
z&1+hVD%grLoT#IVa7Xx+sSGFrRY2tZkJ!St%9AT8E@iwVw5^2TiO_#|WEbd-wqv@K
zPf66^*qF@G6<=Tk@}HBdP)HcG@#qh(a>UVm7&5Bqzq&#ViL`6Upxle;RF$)u8)c3T
z3_#U#89TAun7aqeJ0SD68CtoKb=wUGf@;e?bUf&6?T6ic=Ix`ATny&`3lGt%F3UZ4
zld<qY$U9qGJaqlbCz*fMu{TIcG$BIkJB29GQt$07Ddf+1kZ0))_B7>WcBjxQ^Ws^R
z5A*&ENx!7x6XA%$ya}MyWJ(r$Sq{sbz>SF?!2RY|Ll{ljFE}+uDbx4{r9YB16b673
zw<2^jB@wiTs?8!#vCA|ka%eIWqrn2Du%bol2!Y*kWF-I$P33=*7o`|DI@^dsL^);o
zB*&mg4((*^BpesLW?Nk^E|R!OIw#Q@ewx*zPkud(fyC0^det`cP$lc!`qgDBk%x7+
z>i9;TdQNzmt)PW0(U&^V$C_FGfaZgB!+`?Y;zum_mu^dLqSKzFN!AxLN^*V;M1CL0
z2ll04UC}=dla+s}4-T3vyk@>SX|AjgYj{eV600~F^7_jh`w23X3Jc-r3}=rpBOIx2
zCC{q0nP`h``AN#7kECX{Mkh+)Y$DQlCXv>80;6v0O@(u~Qjd}dwvC*3p_riz<49S|
zQSRDHUE4MuYX%|Krap+akc68~8A%IjYH-x`k|xwr`Dd5g1_2O%rP_E5s)24Dwww&f
z&@_S}Nk+&|D>6Aq$jS!qdm%-uMcV>?Z&puBgLWT)E$^sCLj0ToeS_aA3^=b>L8Q%U
zX_+ugG~v1C-=O@#GTE~II3)0JW8Ki9_NFo58^7Kil0BA95up~}C7w|59HO71%j^uf
zv~K$vrC?XCeQT0`XkzsWxA1Eq%fAk&)IK`8)KB!+==%7z@OHY*JOkxDZj1+C7;0NY
zBYBFu3U+Lnl3{P}S3Z8))&q&LgZ!GNbdot<S!H5dM_9zEIi2Ln5mwqjVoi*I&Ji8~
z+|1BF$#AZQ9n@XL7ILqfmYigPYXR4@LNu(nR#&c5weX04#*GuM(RF9)qZ*b%PMA!i
zwdAT$LA%=G@T?lX2oEZB5I6oEr8Mo2m*i6LqJlGJ9LE!?Q$~lmaHJv&D(Og7Zg8Y3
zR~@NJ%aN)i8%V&<Od7J5M0N?Oo$ZrC@=;|HvuUovkKovahg8DDaaMD^?<cpp-XCY{
zT<<sSU$(kte+fBNk|$0TNPD%lF7i0$SrTCb4Hb#e!1z}bzNI0fGMe;nM7j*msFPpF
z;_;P9I|Yo21Pm%Vyw6()zt;kiahSpy-^qY&$ftLam_aO~0&kV!S;2sMtL^~#bS$l6
zluot`zpR(f2muv;mw?`(vo$%-D@66r#oUwX<{0o@#>0NW@=V{o&qcJZaJ#ZoOX7XP
zXBF$GIj~mMT^(5H2Zo_X?ve=hD9xe4dkhIuJLSuQ#e)I5GAOgtFwZdQ0pK5<RAx-a
zOc3?1I2JlVs`WHSRYjPfrUaJJ%xYXPfM_$)@GD+-Iy23GVt?VA0@p#VH}rcAE%0K5
zfOZWq8RpP{pl%TK!Yo1QGcc7j@vzTfddI0+r~6zj2~ID(#__>jlHZ(S<h|6Ik_ZD~
zM5AFz`ym+0@Pe}m&WYd6C*cv(PO9MvKr>*?5y0|A#!$CYRq*>dgN`n802UtJWR^1>
zMMj~{Uo-T7+Bi*Mld_5dT{cXvVZ@xv-{Dcgghg*yB(R91q#vFl@D#AliB#)6KxaPO
zi-+<DZNs~QVc&zWO4v4v+rqaMyF$Tf_yB*TZ^E~X($j<yjw+KS8}ewDSo)~M<ss#%
z2i5~7LV*cTCe4-gDDzB^u_W4WCtqmXl<e*XS-0qaCcPfIRjOORlSGGGTUj@8ImKS6
z(tAS2sqyv@mhBx!VHun1#7&Wu*b!HLd(%Y3Il?dYedN#zuubTRcL%vTBviZN0!IhY
zp2x-sW?J-#jIP4^RXu~eL_Ky)&2e-2uh2H^Y|YrKTnK{Loeb-rsSyY4X{N^~<E#8b
z);s`z(v3ziPRQpF`}3Z}PtZxJyN~RG*M#4mw@WnC12p(%2m3ff&PFsTxv$l_ebu3A
zV2b1gCqg-)V=AEUNfM0`a<*vo$8m9|^7jLmiQnZq6imQQGqn#~I3D_VRdONThYcBu
zAd27d_zimHPRTdqF?*>TZ;>@FkdF=6KzrkVdQi0ShTk-FrUBebn;_xDQYEFp(PSQN
zu^9y7(I5eiLM$Y?T)@2%v=!K2iDO_qYt#7M&0+yWksW^In)(E?pRfY7^9VPLX^~1R
z&+v}H!MG_T!4kF5=Y$~s0?&^T>etSp#etw^C6l%7NST;E<xc$6`J;>s^Gw8<BcLIF
zVYO9wSN0f)J2Fuf@et;iMdN#bbA235d3S2XBU_rlOj#=#L>F+%S=J(n#B<)C0ob8X
z(n)}PvlYO}WP0ZK8<su7A_GoQb>Wv>DmT&#t*ls$ITi(0DH2L@Wx_F6cqoH)%)ZcW
z1{vTX1Z3rYjRCH8KxsiXRWz2V>-~Cvg4Fg@h4F=Lt+=C>I9iu)ff+8K+&&&*Ib7Cu
zg_uH%A%H!$NZUu2&TXrLv+}ske@JW3p$t+7@VQtFMdUVaLXaxLSA@_+s~#0vGn3It
zPk4nfF)^myV>Ibb$YA|3Y&h+M_9K66!R={5?nx_2{#<&PKV~BMC-Ac5Hd`@cII8G^
zY^&K#Gz|<7CYGnPCWKQj)oev}tb?qk(F{-+@TD_NpH4A=@DxzY<Hcg?fE}Fcn5H!)
ziwmV`Bw2tL7|Z?C=mat>AV34~==aEVnsWY(O(|UQ)G7s?9!40JF7;=ZJ`DjEe;txa
zm_n*?WWZF~OA35U*h(c0FuJ0x!w~>3+JsI0n5qCAURW#iQWcT$H2Pxoo&8TnBed*V
zlc>RBX262rK>-JBst6|sq^=5boZ!z>Q5*w)n|5^s_Rg9#SbK`e+K%;Z^#xKrP9mUa
zyt6a9bkEKhhUH7j=X?milJeUbEM72AbQs_Dfdf&g0$eTKLE7g~d<t=cuukryQuR&}
zJx0v=l>VX+;Y}8uCYBBX8Gk*;C6mPe`dT0@@?5FouSIA^I|4B)BWa%~f)IaEQXt|-
ze!)DLuE%oH3@Gcu0$LZ18YUQ3|BFRJ!4NyT04>NhT5+LrwCf@6K*2JJnaN}X{?0P>
zO9Wy0fVm+4ZPzA*fyphu2QxUjt%{{9Du4~3_!^F1r|w0fAQYbAftQ#L0UUo+org(y
zHw&xIyCl2^Of{Y=WBpLH75e)g<Ni}f=$)N%XXl9fZ!%_l0PSF!n1SIk6l%2d#Eg{u
zt&b9n&Jz*yHwnVy1l<ZzOu1N?UB~GEK_?C`QSR5-Di@2b8C8@qU&1&%rs&7K^CkIv
zO|T#aF2LjUD2X08u>ByRC0~DCZH@9}IIeEdQ!|FuyY?vv<h5T0Z0mbMhL<9m<<@0o
zxz{$7);M9nQm8c$70{j+<}1u_ir|Y(f_iwwNwW{PhaKru4aiWv5%ixUH5hkJGao}y
z?(E!!a)cb22u>MN0%C3^+*niF)wV{n9SMCT@=E}?aP_MG1){cPVCH|6?d)XOEoTay
z!+ojZZDEK)<DFaU%??y+wdil*6BZchRf0l=VfB&J@ZgJlp)4}%u}wu&Aw_C4x~bIF
z6u!i_IoxQlGVI4QA<qf#BqYRslrVR?;gbXd0*7y4^+nC_G4P?=vf5Ls=7^`<2nHvJ
z&!$}13t_+kWC*<Nxz>NFFTKVvPEz2i8{+0czkj8YYn@}58=%wJnoU^W;awS(`giYh
z$;QOL9pgpYnIORfx8j+V_GKp0Mj}!SyF-knb;#{7d)zvBPgURyz;^|mK(ad)C`n`W
zYh+Jy#HQkvmmFP!5E>GR4geb51chqmxMk%sx<jvk#8J^1RbhYDIjh2Pg$KD5tSiO4
zkgFK`DhyKKl*m^~U~qF}6BFc=L=^*)r^Yp3fjV7ea&8PS2l6?+wn8Dv*0w5~OCdoW
zH^E7OnIJKqbi~Pkl~+H2)suMBBF|T11XxQfTc!mzXT~}uMBf4~N#1eK3F-QbI2$g8
zuh?^Sfh&h+RKI`WfW#VN6hJbwLh=?LpFn3ILP{KR0HZ@)%lB7mv?{UhY7u1@jCQs_
z(J2}V-$8a?dIc0Jwl)kb@7xzi92Uvv3XrT4fxgWWtD5E&)tP2FBG;;hToH5~<Vr=|
zX}mTZpjjX>`iw?j(C910{bXjX+6j&x`3`IJP6;)7m{NbIFv%*^G0;vH`)E-0UFqjV
zc$zCbon!b$<Fab=foj-j?2VuRU<yodM3i?&vTp>3Dzdtewh_}}LOfRTh7i1r>Q?@7
zgPlHbU5ah$M~x~M+RQS_H898GDo&#ck2#meT#-Zw=&=js7Ms*(GZO#H)1Cq;&X7Bz
zkZ#sxSr327Z<BwPn~QVSb44i(Ft{PUGJ%Ab)LQ^EhMzK?yck^$%t?t4PhdGTKgZD8
ztRE%#ycBiBW>JQdtlUY`Y0j-lrkz2Bx85A(w`xbFXYCXf20R=rqkc<dYtMpCy+|k%
z;!bzwPrLg)7y<k}=mkCCVWxp9w`ASgOnOGGK_`F1j#K!hb#2=V2|I7FCUn+0H<uTF
z!@Y$ed)w}fw>_UA9k8_SJPgWs>kTI%TN@Z~X~v631FdSrkj-g!m>_WpXmykb7mjgh
zNuz@Y#mxPY$Q92Dgr}s92%ia!`F19+_3(8@2LDC)JYy0xLpTd?JEFV|&flg!85Y_9
z`{{ofo6T<N`POblws^optGBqsRaOHys4sm&qhth*ABbd?+W~&deF@}9Aw`NsoDuJf
zwJL5K@&6wOy&o8+n$A2E#<KWB;R;qiT+aI>_)bmq1Y^GofMJ<QpjBa&Qv%rh!YP6F
z^sGxR@T?$>M)!Hb-X`pR!tN!#=(WQ&z0H4IQoaIi>s}JxPXP74O~U7iqU8n45*@DN
zSUX$jvA)WvcC2J%Pdn~Q7sMSUa2qEW@~Y@yd^(E2Pm$auQ4RxCC+ABmNdSoD)vtB)
zhHn>6g@v$LtdvRyxL}RppJs~kF&IeAs)12&8Y(hJ<07xd6a^M0(ulKxRvI^?lDB`P
zhi;%i8Bc&@Cut5ef%Au()$4eTxNHziV4!l=xEd$@F-0H)P#TD+VmOkdta#Q3KxsAZ
z(7ifHhC`0dSqb37Y}B~m)fEOmd+%T{%9&6uVG-OB9m=*|zL5+Y)4U|t&DOb8>EFv7
zMajFw`Mm4qK6G-;#=Ic5PMM`k`J;c3bxDJ7Qj2+^Jfa6eDu_!avQM}wDBHHaC{I@W
zOdE*HgnipG+)>f!7czh~m14J~Jidl?rv*TQXg`F36L?tk^29bG5{e!N-~ry>Ashn0
zK1<kLIB$-7g=NUu5asrP_XMzpwX|I)G9#%L0(oN4bkr>eS_!)#6k$B$3*LX2!~?Ut
z7-LWJiEyQ!1Ir=J0L6L4mpUqE7DBOO<V%W5ODq|AuCjAYcGKz-qeYH&wdz8ME?)iN
z42ygQh`^HWNeVp%s>)Juxl4U*hK&!^Sf+#4o@{OT&aMne{T3`weNU;rJrVj4NPI|C
zF&=?{jt*1#LPshX8OXj8dFX!&=voj|CZH{aWR)%<G72}kug1}X%2>>$YN|Pg0#73(
zOP3e}Kcff4urE@x1J9d?fl<&+7!*A&MM*`TSCn+kbrK(zlq4)W@e_s3*Eh=H!=zwv
z^lx#Ol-q~N3as0Jis-n%YScO&U8ZUxIu&X>m4ed{kK*09PjEc6q5e1qAL4+~(O-ZR
zw!2F|Et7oLJjf1(M|~xO5}$?>zq(a#ZScGA6U(k2%Bl5$pXSj@QQyi!LGVMDT^0ct
zfAgYq-o$wQ;uQ+DaxW9IvZ|Q%3@ObpLrx;^<f`ke7e34^w;yN@+l3~}rEJ$EoRbOD
z75Al@Tg?+aRm3l8t~+o7-@MdD#m1sI8JGpIm&UAY!=xzPo^J&?QhE5)g#dWl!<4d?
zC_97|#ptjoSqj*T%=hj|JM^LRSL8jze@lrh%cm>9tO>o)cmAo5&mbN?_0PZ0XNV0y
zspzWfZeyIfUIQOm$Y&Vvy(neqdJ!HJ??Mj)k$N(iU1JPaZP*xB)wB%v_C%n`*Z2(W
z<(?=}?uqwU@O|ME-wt<6h{D7+LW^3dh^oiEHW9HC>!l2I`cW>@m@+eHV~S4Xf54&5
zmM8#2HmO=RqQ==7`8bU8bij-AKxipr<-IT8RG2%Z!WpV6`Vl&)5re$pEzK?3K$@L#
z*P+9XhEC)e^@vCn*q4^Pd8OUsEHZWR;$Txd0gyc#MAG=!Q0=HhBk}7fm`~xK<+AqT
zO=%TKsQ_F#{y_K%V&o|mPnh<>f5e-ry*p!0v<U00eV1ILAhc+y_yiWNLif?9zIWYJ
zJrL1G<P==E0A>_>Hg0^O${%8=R!_all0@HSBA^k)53Mk6hPIqSHQkzsyG|5Nd{Cnv
zl{4b39zhK63_ZlA9y@Ue`R!$isTL)vXW&PGx)@NXW91^?q&b1?a+C#9f4Tw)KV}q4
zp@o)*DCUkwv9KUv>jEpM_6se3Dq=gM={N3df_x1CGuLt2$wwczu5Y<2!VXU{uvO4W
ztxyI~pyaS(!l@Z52BBRko_<IjlB>ul$N1QXs6`t^&v{B8Xy7yH=?r#HxwYo?=P8%;
z?ksb5_t{KrsAXPH@M4;Ee~PmheFl&<rtDlr^CR<j3Z!m@XAve=60(roxwO&eca|5b
z81sgZpj;RLf0bBIy;K+x*?C99Iv-s0h~bSJr84J~c=lY;3E!#+uI+C#8B9N_om}g%
zieU6kSS)-@M@CO^Ui=KXv*_wxT2t4#s&o_KYBDZ3pcoYz{o9N%e~v)z9&Y$%%)b=j
zXvM2guu0YiTvz5omR>f1B~lEtoZ>|=M`Z5{U<bV3ho3Vdvn{tcZ;+E^zh6b)Box6p
zTXo>2>>pOMr}&B&YMe2QKudm!sNhZ`Q`mA<N`9@B5^l3pD2c>}TR;JqETTSZg`^Fu
zdfGRQvTkM~u9@uJe*+-hyd)#1v*uNdf$00u8xH70+J{bnnm`$+(#x)7grEItznw=n
z864bxu&k}CvaH=O5|jORH<D{P5@Y3Nqqj@7c6k&-IbS0|nRi#+!6f%y*0vfk@!Hy}
zD0*G>oECkhIuQ_w#6j*AP%+{64!FZ^D89nr3aI09LhhBxe*jn7fehyM#Z8pdzI^K$
z+EG94h$kvSByZ)zAzXalC4*}G#R1tuQo?<X5gEQXP)~f6C*%AolhtretIJ0SW6ko3
z-qF5P)T9YlIjOzB&V<IhRw>KzDJaNS<&)J5RIDD8&r092zLpEFE8;NjuNWM(<=Jkt
zZpq)(ZT5}je;K<~_lw%u*%F~Q9QVxJc4=(@b${miS$6P=hYyH#s*7~bUX{H)<~275
zK&_lk-|!p2Q0USMzh=`-Zk}H|&bLIqT~`2{GxTgtNuB^40MLNYfC+AH`Q6)2ow?&8
zWe08UD)h+=nq>OWGjV#EIE73jWah~S<>*i`eU6w$UF_DZ@?iDqs3F@tT8nDinR>n|
zXK(O*&~Cm4=LIX+?z8aVy;#-h(q#VbU79#gh-=I{q&qv`V^9Xzbn6kV3@a;1!htqf
zfDNyT)G{TD$v=6*=|z<O1f7M;*_4;a8v!qWdyayEhy3OoCSs<mT7|+0$>NEW#bV<U
z*fNw%J{+*6EWNwEHjn7&%7?1vxICfq@b*}l#^pHl_TbkPPGyKEn|@uy1%1FQLb-gr
z?1vuw6Qct<(05*36!}#XP9no|slLS-#lSf#MFi2IkUA<!#@B&mNpk3*<>5OllQ@Kb
z?P2`wEQT>g9-AcDtPBA|uo(bc0lYCV`ha-M>tQI9;!c<`>98jSP~?*Um|n*aT51DK
zboVskfcLVXD-UDYVgT+$vlWbqynCEi)+Il52hIr4qjB4EiI!d?otSb-a<nQf2-o>g
zYX=haqFvVzpwu-@#fp{}q>^T42KuRgD}Mz1MKlW7%M6(I&VVG!K{!|fu{4mSNA1$T
ziVjE76%`u=oe{}~2hhRoLX81BYpz)Vyz|{aFgrU(DlYgqE-jvzUd2S&a*bCOuVrS6
zze3^0T8ROjO=5ODj8d#ayD-_YeZ#1OXm2#Sc>qrW72|Bgy%2ESbXIw^qSNSqen-qd
zB&K1;P=*5Zhkqe>hyhS-0r7z3mta~2_!JC4SJ`NwkGf}%CZ!io*94{6*>P`kUGP2A
z$3<5mC7^3P$hoq{UW(DOjRGYjz+TNWV#?b@QPGr%(2gG<w8G{vgoU`01`#eXC14B+
zG7{?c*a#`N$}~9<v4LE{)~1<%(#8lD8%ZZqDRO08sgiLG0@&LD3c-}{r7wp6Vu~R)
z=)?@H07mN|-+Fm$4<TTHFK(`cH$o0soCt~}C1X3WL7-y=)@vx)gIq0qsnCYFS(d<k
zFjI`BmMIA3l8QtNG&g_{iNJUu>G1k2rEt$M%oi5JtelEW96#Hi+<L2j3l~DX)wL2N
z!^#lOb1Nk~DkaPmqd^PQ-VnwKlHD^?1o|y_d^ub@b(!_bh$)1V4{USgyWIeewo0lv
zPgwMXuM|bAGCPIoPZ{f^W5xDLf=&?@Do9T^0VcGt36vs7aaJIofYs~eHfY6m`Y4=m
z+bUS`fpm8&7|T-?E(kAw<wReYiJ0$Vk+hIJSBrc_Z-j1I!oRzIPPpjjV_K{=6|@DA
z7`=*nX?0e%vcB1{`^72*tX<(NG;80mDkr?2hc8|u#L1_x>A^;eOuVvQ3gsPg{=Apw
zG1(W}5T77R+^L*M8u=~ZmXiEqnaY>8qVYC=Sd-Qw)_o1}Lo|SYor9!ZALjK&Xk}Mb
zCP(sSs0ZlcTvfztAYi4CMxJ-K=a?k|b1Zx3Bv2IZDXteMDu-?oC|dD96orPak7A1e
zjp6%*OSF&)&Cft;Nv^Ap(o|V*U!s1hEv2am87pa03Y$F=%8e+Ok%p<iaWzT*9{Ni%
zxWezBK7JJCY*hk(%wD6+dcAa45AG}Oe+|4Na0%a6v`yrfPTM2|>EuTI-Um#~i<*g<
zRjvv9a;fxbm69U@l^iE1;k`rFNItr@QD~7F1r3%2ZmPrCES3Ktuq4{|C(o(!M}~FU
zl&-=z*}k4g@>3VN4CGBJomHBnuxXB>MsuV@b6E66#Zn4?PKQT9ZRYO~+VA#QeaI7h
z<tP{4`y35v3RKj2cb&AR+)1^x=Ji#L<_@69H5MUA@N9@zRKLnB3MbDk%LUl)W8DBC
z$K1soWF(?-hcFpgbI@E33L5F;#+s-tp78R#jyGR=Vb#`8YJZ21<Y^TqB=i$ML2wXv
z;dg@06|f3_+-uv<HE1jrxiGvTo)y>UI~3$-j`b^iA^bi%SxG=k=rQ`BT~Yv|ogHjk
z{0@}%2FZ1bqoH!;CosP9dAPbggpT^E%px{Lg=N(`?I<vZO`-kA7j~o~)uBd9>xydJ
z@5B}PRM)u5^=;wXWq75CCviVeSYTnsJ0ggxm`8qpKN)ZZoZ>68gNLtsD~n8@M1a05
z$M}2B13DAb;>9R+=vW`pBSEaT><k6xrfd9K+qEr!Q)zMp2z@k!HPJ2Aqg<h?BMPj}
zLhuRZL5aDw77AxbDL*>Wv(hPr=_{r7N%@BFADBRD<d=|FXpJ%L0Di%z7ueLiS@l8B
zYS<xvu|A{%Z1t3(MS3{x#G+3$;9xTfZQ_gfGjI@Fvz;Au5bu+Jj=h}|K1c}c;3()u
zP|-6*OOPoxbr8@~42VhSIp^DMY}bH7KxB&a9m@$alNJS+L=`4}uHrHh<PJFSO9F&Z
z(2d@B7=(cm(ma1No1y|#9RD~cJ1W$81d98AlyW*@UhP}e0_VASqab$(0@bCHDC)aB
zCw1*8X-iFil{QgXqf$$<_yF>yq|hhiQCc3#i0u}uph^pYW5C96QSM?GlhTe)j7y`i
zr8QJ^FL7qm$0eMh?H;-YL$g6y4?<R|AY@~9(^DHbjJ`oi@rI2N4;TI!x!Y?PIt$2u
z1m^Axh4KJN<i~*;>?Q#VM|XL$2Rt(b%$&A39OG*lL$Wy%MTR<9fpQTaNBiyZ7ur93
zyt^xw`bG?@?2dbCTtjzU!w((TaQ(P$ta050OCf556&yq)@qvG?RFpR}&~(i}Qy61=
zrd1g?B3S*-&d9VKrHa3XE#4ZLNsQ%x6Jif6i=$eXvo&4La9M`Xs_7IreJH}@r%Hh`
zX8R0o$*CAf_W>LCOw@@Xut{Ul;8|o<IY4y^yEI9|=7C6TI}Kj~646EA`wR}5?C6YL
z_N4USN-aYBL3FcpXEs_hvk@+4+`Z``XbY?ZBwj5+AM&SwcPLLCbovspIOXAg#)MkG
zgL=Q+8#e4k16<Uz2rIz!<L<D>F5Y8LBd@wkG>G|x0I%VNNUEck5~><7Xx*Rz$x?as
z3E;6IT039L2RkkTb|!ybVk%6sKPynq|6q6wEUYS5&k5LtdavOOo2b`Qjn;Fpo?5J>
z?6BZNK+fZr_ws_`tNHz|0q0?VfUzK*^_#9=zo}S1y45u>ck&Pyw7oh)z%wg@qqA@s
z^~KuH@Xr&o1%ezQxnZu%>DXE$I(7_%<|Uj7?muD2=o$HB-9)3~%3LNo459Nx>79z5
zaq*Bc{O(0(WDg|wT`lqxW%%_PehND;c}rZ_w*(myB8(uWGG_bQRf9EulBzM8l_Iqv
z7%K#x80DK38Xi5P0md(S(UaPyT-lovcduYGdhgv_ECu`9&Yhch=Dc^E8zIjg^SeK?
zSIbwu-lu`z3GL6Iv%SZ%Xz#~Y<)^Rw#j61RZtsm)5$*ZiSLLgd-lrW%+l6XLw#bL{
zTV@1%45JJS_EE;9NNj!#6gdePB#{<T(*3L_mu@8i7ZDv_GzEF8Qe{`l#rgmWIOyq@
zmL&lpf3`k-)!W`{RUF?@qUu3i??RE^F~>aK()HYjVS3`*gvL{0Jxet>1JCl=ucTY{
zqN*GBmO%&unZrPqD+9UZ;Q=dnZhds~+US-aKDyG3ti+KeUC}s3y_K(^pplSz5e1{r
zGj45&%rptT$c<gm|7gMD59md`{K1hU+{$AMmo_E=AR`cVhsp3`=<|;-a88CFYubEA
zde%ou3&ZQ^-1Zc((lssnp_h3k0UUo1hGNWbwXw2IY@{0~4QSMG6b|oTbpxEE%VLWD
zlvGK4)vAlcU@7ID30YRh9ef3l1X+shaoTg5liZu~Te($!JkRV$xRdCRJZ6$$y<bUb
z97{^&SyEae)PJN!s2J)tkdkJ66+wuyKj01MweAodA%F~}X~8W@CJT`LRcn8BC7^H;
z>0!V%mhG19mQhPu`6A|?e)U(|@RB8b-AG}Z47fr7hiP2IlQJZ9tChi}FC?LlVd;(l
zW5rW?BBH<MrznJv!xSYM9ec^z-=dsyuBi%oNkRG6VAkWfB%?L!kHzgi)}awjHo4SX
zH~)TpYKA1K(&2dhhZwSx(&~Sqiv78EbezELAkg1U!erFu@EU%`SK+m?+{mLLXYZm}
zZpECX+kgTw;+rM%L@;{51nv1?3FLhzwBTQOGtbg#U*v-udan-y?nhq3v*ZTA5S@vp
zFM-Ilod)_qPzzqI)mINvsz{O)jx(A;78<mQ%^$!9nUd<%>R1a;@Y#RCC+tGd@^(iT
zP6T{=KwAe$TN8Oa1peUGHj`+$SR^cwDmDG?nLyIi6WXi^tSCCR^N=$!)_9#HOzLAa
zcQY&u4e)Fu&y^+s$Cn$kW6$zUOOvvC0H}eK2gnY&VqWng6|0q_7^>M3+I9jmxrE<j
z=Nai#dR|c=iPNM?`DuTQ`j*RD;}vFkY-nr7teW?$39vtMSMk<U(vObxQ@692-j)kk
z9(VQJdlS{rmyR;d833z~a!h0eZ(YD~c@|gWUGJCPE`Z)3SSf0)R`!NgYPa0=GU&L8
z7E;Y7R>V)l(2&K2PU(><%}e5Pt+4~IduBcRXZ9YJx)=b;7@&WxPRGkrFZ5=qw|U!v
z`@M+7KB|%F?qw1$^@AF)tryV+m67NboxZ6QQyJFblTfi?J%D$=v>tZzrE6u`FQERB
zFj&Vhm782^>LmlQ2*dU;`rs-u;WVELd5cw5{ZM8%x+H~VRUhrznX7j=&4n!b9tI3o
z=_tFU2;wKn04;w!pOR@k-p2U)kGP4~<R{VwAG!s+ez>ko=d4AmOLx6uQ){CTyCS7*
zzExp2!u?xQHna*wb`Oe8Szix17qh_w1Eo5y_)yy#_-An5^z<0%f*zozTJIH-QfIpn
zG$YGBBYRFHnXI!g5~$h$?9dDsIy-|#hW2D&AuWpx9O8f92@syOZ-I&T0pZz41K|cZ
z+u6b3#p2o;vI`190QZev^h<3y9n57|txJP3x7jmc#ys%1gTph};xUg&K`UTw_h4U4
z_H`aT<8(tk<KZ*jJW$(v5nXm)=RFLfr^KdI@KT4S4y=+Um1>BAKLMzB*UxKtyDAK~
zMv(zK-cWzg;9Rfepxg_CazE)JHjlhdc5C?j0`R%*Owssddxy1lKmD&h3B9c!x4W-;
zNQ*A^UcLH9!n@+ttL+0X*!{%oeM0oX6PWF>62(wx+p0d!JFx1tp`ukF?Z$CsZAUO4
z!JceyIDWMSp$BT^8s53JPx}H_{oeWbeywI?-|T;QXXkh=I;wA;!bQh*TvRV8uq}_M
zW$W4PGY&KgzqK!Wni}`<O&vOmf}L*Xx38fBF>lS)sF!s+cb0W~?SNPAPc_=@`e0W|
zsx`N~Zfl<(*5j7c!1zvGwy7l>9O`WmEU*WDZO3e5e2dV2fCzXk?zV=zvb=J*>r1bn
zT*rUMi(>eZlNfH8K@eJ($k^O-LupdDSPWZb(U(YE+1j7kH<PjhS}fMz;Hi69fG^KU
z^K9Nn0Qw1;Dd_?^=NU#;IL-U|{ps*VJ%Zz;j)CbzuZ}QfGqN3q-0*5C!-r4vXkO)g
z{j!YLdR;al0Ubq%FkZ=N$_$Um>%x>6AFzMM_%rzbbB}4WvRZBBD7<?AhroI1We7bi
zjGrE>Q_G>}u^Q$Gy`*f4G+9X>TGbMU%BT~**is!Bs3|2}7~nd%;ArP36x_nWv8KBw
z3TMqooig@lbr<|DpH|}#_+`5IPbPT|pIh#?daXSCz0ceXacS$?$7nQ>rWg3|kVbz>
zaNjSPd&`Fh`lTFc%Mt!+pRFY~$ZD0X(t$J`mE0tv71+BK+BFo^FSGbO-10iZh-s3a
ztPR{^eaxz8_z|PS&{fX~-tqA#XiCoZQGCHuy&%{v!QuU6FyNUyxTRHIXuWg=YFm*G
z2sP%UorpcS$@*BmQVD81tav|TSE7FcQ<?R-$<F+~3GUPFThDtKyI@mfx3B3N*ZtJ!
z7Vdj4g`Qw->(!CI?G_+i8PIT4F2`cAu7E&`cDZFAHAo-WsC60SI2_Vtp<A)4F3dL9
z?G9X#TYbk(d9lz5idj(R_-J1(Fx)KayH93H!!xnZ%@hH{qX_J+b+FP=QNn-L=K6hM
zZ+nWC>Op9Kk^{CS;ZXV<A~&YdJQ-lXjR8~As}P@Akvkfi&D8+RFL@dw05Gf7aJDo;
z9Y=uTPc1PCEP?qzS<6}|?`%l-r>q}@Q?qj=g_EVHUBqN?E7>5Lw(P;OQ8Z&$5jv}}
z2hmmM%E<*pHI4?&2W|4}^ksj!E&mF5F}MQV!mw%qWL#-cpY@1`KZ;Cxz{bs{4)b~#
zX=*~?R$3Md;ZvvvX@~+m_sDulQA|-xZ`M{2X*e$*lIv<ajjl%eAdlp>?|NaDL($!O
zOS@j+Vdx9{T&@zL)1Y?B>_~UseOM~EKpPZr1RonC3A7zwWEW;fZzq4-LQjKkB>mbq
z<m;3T#Oz0~xdSaZ1bVadM{Ej|Vp#=jy2Qx4fR4K;yO)#+Cft{I3~3L6@(@E&srXQV
z9><x56?tnQuQ!%ODkK5<?b(v%LvIFjluSzVK2^X(n-MD_m4l*&ai{dnH!y=i=zO-F
z$e$Pm*AZl|Mj=ox?kRuz547Dy-OAU7VOS;myew~)ba^+$W#$EkNc-t3I5hRJmzyXr
zhtEjI^Gk1M=fmq9P@OIB)}gJTNJqKV9xN%FtIY~4CbkMStSdwZ%FCUK^n9p&52VJ+
zZ?hsRM!8u^4QR2(Vv#!YP1j8Hm%<@j=3!E?Sm;j_17K2MV>f?$JmT@ReU`SYM_+tw
z)qZyst02_%jc5mED{rnZZypRVvdQd1Fah`!Te}Z~+WXP(gz-Wgjs-cjF5rr)@@#=P
z9<H=F*xpNo;Xz+54c=AwaY2JYi#FD8ksix;VtJ2p>*3}|U*9ACy`W7ngs|B`bMoX?
zR`U2Q7W-yX1)_hzpNz*Pl2}zs{8%gi86=y8VxM%A0m@$nybo8<i{}sM2|a;5VJTa$
z^91milB_Hi?`ei_uFLXh^^L$zAt$rz^G<>)8Q7gK5mVB`n+f#voL(&ju$#h!!>0cs
zB03jG=nQ-n8H3YHClI}|j(xL9_H%SF)XN_;^bDi-<28R1cdvkbH`fcG<~Rb%!FQt=
z;`cm-OEp%mtZGOAzlGc<KV_M;7EZq?JL`Mui<g@$4MZ?sZ8F=<wIx@f0mJngGwF7F
zQ-8ol?20|m2W_wyJ=pt<4Zb+&T<v}K>EP4B?kMyJ%_eK&w?BaY0NVku?_zvA8Kb<2
zKDS=yn>c?r2~gsikliS%wOC)_ACBQW#S{gJd5Fjn;X{0?(^PNC6<RvdCG@}5ucR9w
zfwNNVx{Wgo`C(+_Wt8t`PJwp*MX@UeZSfc#tJP*yH1pLWVR@J|S5liO`1Y;ZyHVLp
zR%`Em_9@3VpUDV#f~M!s*$F-s#-0InYCZNy>py>qE^>dGGrm}$EzhK7GpW$u#GD5=
zPjR+TMJz%sUt%qw7bXC_&!Zv!fPq9~`f-!{=B17+Oj57QS*lt6&PG<q0+}oTNHycp
ziSkQTq>5j`aB6}MAf>o!)@?Vz23F`FXgHu$vfP77**t3Syd~r_6!5!k`xIj+_V%-=
zD$IY$FN68>mKNh+!wec+$BgdmOlS>MpkZL2N_h#JUvhn681ksxl4ZaIRRL|kq?l)9
z#qkU-WiA5Blr3rPbE=|0(K0O-G2X)Uv8xTXgcUIE)kL(`Uqb1cq#|I?eACGLwK*##
zgO2~fMc2@Pl4yftfWhZ~mzD}Ho}i(YfRBGPp#eU$)AzM04MmAD9`ia-)lcd3)*4YF
zI&Rc=FbB#L<NYf?APnpnS$;tl75KchDzo%yTi0QM_51xh?e*`nL6Y1bb8;QNW!0U6
zmiRWeUe*xE$2em9HJq?maMBSQS6*}#{r?Ki*M(I3&j$6ijX99Xo`1wV*0<-ZxqW|n
zK4vN(InoapNFd3S>->EWWLt4Oa`zcZWyM|r%B{WtoJzfGhoA~w4Ah;bb1@(_R+R5O
z;1d#AaGk3cpbC0ixm)z;!9Vjhj1>^BP_}Lrddx+i{c2wzkb>zz4A#k3vG6nC%EhBa
zyBNIoF5n3kn_;!_*&m=_s*dmAj0ArTsn+9+A}aAsW_nyQXEDAJgBx5=w%ML5qCzZj
ziZ-NuKRH;_dE6>=krKF4hji7_7nHZGwpEwEWW~xjKbmB{ZG5Lsk2Vd>ZbA-AY~hKp
zR`%!UeM{nO*pedLX8@*|&C%2QPn5Z{BN+o{OHICbFsy|QlILhY%}c(%DaC)ITA+ZV
zvFabN&-eFHe87&>Nc(w;t{Y>RXc>0rB+d=J-~9TIe*544TaO9*T5k{+a4eHP8sR3*
z(WnVmP3A3`D*o4h@uzn2R76d)%9k^{_;3IHAOFp-|HaS$*I)kpmw&7)l{Y2nd#qa6
zZ4-kTdCMM?bdh*c_l+Wxj?91X>AfCnI_|?#EqkIZ3@a?2eHSlpM&d;-yASyQP)5RH
zyHSN**0)MR1&q~L-O_Y>)4;ku-#rNai`AwDzUtxD9p{n6F1UZQ>1AH=0lnsnB5-tV
zS5RT+MPHvhebS;RDkRBEPXK!35d|tiZp%L($7!yrw9v@5g{C0oIS_xJUbpALddN(_
za97su#uzyl_yAG~lyqYpXM>c#pi;hgA;7L@9*@;r0AjzFk00HyD!9~%!EPrlJVU<s
z?CHs=$Gp9Gnw0oYi-ujyvc1cLIGv8;gFTFe@P-%Vp6I~CFsNkXODzduuf{*k(;JKv
zhylCF(Gw2U-s=*e8*6{%S(?WKVQ#;=qFsE7te(n>9&^^WeBb&q+8H5fNrpH6N|V+*
zejBiw*Cm~dsMG`$wfhO#@t~}yFxEC(xx3J1MDXw+1G>}JwZMk&d+4@hn|qeK2fO&X
z5UvU@ioA$y31te`u<!l+AO8EF|MGwO?VtVo-~9PM{po-C^WT5|yZ`lX|LUK^=g)ug
zhd=$x|L&(h_`~1+*}p<S!u@~)Sey8KROI*^2Aifp#HL}!a1Q8eLMW>!==D%zZ?uCJ
zMLY3i+P34hdX)NhmRC;lCzSll&wt-Z{en_cx9A}yjxf;>7I#n@DBhkk@^ni?rr$p<
zR20iB;^@_?35kC$T>d?DZ_>ViK>&>OF4T}ZvLpz0fv(s+(C?#UOA;+Np5_gXj|dIQ
z#xbt_+zx9GL!!u?{`upiL>W~hZivTw&>L`jUUkmVaNZ7Th^hFXNNlHi%X9TWWlKPh
zY>$u@_3Me;H~c2DRgtH{lYK5!GqP4l&$d<=ZU7_Rg++hlOMeY=#YmRut7I>xvGNFz
zak*+B8o=X8UHj+9*Hemk1=D+VE=s;SN8$`;Cwv7It;8B5xUyg2V-~XU<*W1az*2=&
zTiVI&eZ6JSkSGe>!HT{*C$WU-yX3GPgUy{+qH~4abckzu(4w+P%>llx)mOsVmKOxG
zXx5o^2R(loAw#w?jS97vGkSl%FTyiUwPQamY^H!RZJQ}RMP;L+Sta02;Y?C^czj(E
z#|F@zir*M5U~fM6Uk!E_7%X}Ftk->Y^{Tnu`?TYC!dET*6~KSX<=!Z1m(tab=;X+<
z9b!2>d#!~kdmr2`HoFplI>x9*qOC_cA_spC$6$XFqv|D;#E_$=Vq`mS*iZUo<v1=d
zeO!4wRO=r;W9HbdHCwW4L}e`^$&#f)kwPglmQskK5E&U4*)uq|?BtSNkrqP|5|J!r
zi6kV+nr$q<GsnHIY4kIn^O-;1=lMSG_xnEY_q>0YSH;?JhI`59?l@}su1RnWSA#A~
z#Ft~c7)g#spCraI#LQmX?K<McrBT0)`*}D!i9c{I5hr@u-I!^1Ccn=l`TH@v(4ok|
z@un*bMNW#DMbfwRUmP8;Bpl;3I&n60!P^=7d+upcvyxt{1OCY4&CiAHD$a9gvlPY;
zxwMM@7#=Gj$X6?~9*C8%H-4p&H|*JY=T=eHkKS@qA^g;v8n5#=J{*#Ma=)oO_+!s?
za@=*2KE38duvKsQM}t7ALXE8@mVayw=`ipQJ$9B@IwqABzU6(>O6}RjHzG^$kG6>R
z%Hg>UuX%Zn*^Wd;;|F!4M@cs%uQ8T4eHq&=MbEHwBmLRuI^BG|*_IV@rp8iVfpQqD
zyt}l43(y|T2OSpqASP{p&2Vw&%*ae7%VdXc!u{sOnI_6ztbO<%`7NgIEhd(hmL)p;
z-l8^sLc5Og_NO>H+8<fyfBb-VpkSrHqC=j=v{*fi6q4mSfzM>}u~6#KMnBH(_CB4W
zm%p928WdIXlm0tXdH}$5O|@u{2^GtsD=jSP2kNYv1zi(37q|BspSh;M(E-S7y}HdP
zb4$yhoX1rpPijZqWLq<2eSH`6)`)H5JgWU)<y+2%XofEcX!Awo>yh4_V!CkpV7DAj
zf{r!4pg^$4rVp<@a?0mU*xP6MZIQdbsk!dd*S>BUach)WLL`)t|NR+5Eu343Xn;|^
zxTIFzg6ZhM^umMS;m?V2Ptk`i_o(2txN;0k0t(G56$TPsDrINtJQHkiWLge-qY3}U
zp?K0|c{q7-ab#sdd1ba@Zgge2$#>yBe)9cFlgRQQe(_;1esK!_`FT+Oy(HoNpOPP9
z7uuH9yWdX+a+w@8aUH$UZaAY(5a?=5Q{Ew(>6f6QTJfTZQN-6aT%j%G>wc4VAeb;M
z=!?TnGgg&9q}St#k3AMwWwdG05~$Zq#&&5J{#h{f==<%z6h#>x@=Bw|Ifdg3^1++}
zKI7RTn;JaX9AD9sbeew%TfB+v8)MWQ^4`Bt@s8D(%L)#bJcp~BFE)61N4MraZmElX
z7aQJ?_?;j@4#OX9s6k7J6rK8TaGr4|von^Y#dKl_^C1a81^Z>V08g%1B38`TuFPew
z49fY!@5lKT{G2)5TQwHCDi&;aB?V6$xmgoso5JXVm&-7-#%(LxVtc}?^4-iI>YwH|
zIa&k?t50`w_lf+ODBn5TNP^x#_6kl(gD#$ff2wns*EqB0x9N=h>|&MUVDQ6o7T(e|
zwV9Ud_4b-vw3?b8uIiWkYBVa$YN;_v=Tj!2%we8>)PP5D-sbGMy-|SLfkRsXNex1^
zQNT(G3!ddtJ=TH8N~PN8XZxf|at7g<`1oCygD&A^D)kQqeAv)AblDx7&OB&gQ-4J&
zkxf@JXb9>L%G2R?JZO)pYFxfhM~LRj*B31$UnzK^tVDWO&$U;V<&03ucQMD*FIv($
zs>U9#GWK4t?J0?>oh51AHmdFdCB0IP%ix-s_6OrbE6+sa(wXqSh{#iXVI}NsC$asL
zkF|M;SrcKjM$lg>Pu_QHx}sF`hizMhjr^_<llC?r=k^>RS1qxbKeZe7^uLR0<(wC8
zcZf56hj$}rk=tX5MO@u!25oicbU(#+&zO|{WDv+qHJn3{bjo}K%t+Q@mKuvI-bs%=
zc7!$KUCJQVV&~|I;+QGm{uPd-)*W`Lmja&3%DPny#ufHR_CX?_!!!w2wqzrAS4Ee*
z46NL(fqZsnd!!XC4scz{x*EZN?YqEo-1lRO!@eW;dc2xF_Y+tJdKBBxtsryP&DkWI
zk(QA`tr7EZeFj-4I#l!Ks({dOn^sIdz5eJJUODQ|3vom}wtoHW_(6?sK6Hyj_1opj
zaznm>0oM^L%*sGW;>z-91o&Wcgk5#WlKEWVchx&r@4f7yr%T@JGC#g2FziiQiTLTu
z-{K{dblD9tPR?@t`?41s+OmXA(?p8-G9A9zh|;qSRHn}9MJhC;kIicyXG4`JjYeo&
zyutf9d2&v~jD|lt`y;hc^*~VyH+|f$%Wk?%!^Y+(qF*!dv;RPQ4~n$#<gr~f8GA^&
zR)jP4xYi!x_i@SQOejv>_x^jS#_E3IhUnM%LP;Ip5{3Lwc^;`MiKQLd-8U9azV;WX
z9EeokArd$xmu+}=XirYr;mB(E&Om&p&qICy|I@fM0o|~Nb+!W(K}!T@>3;yc#m&aZ
zZ*SP+$ge$m#j<-3C684lV$m=4b2oW0SUrw@WMubF;IDnt5)J#(YWHGAhiwa%cN=0n
z3tJ*~{M;24{56yCwj3v^Obk^6zsO*&W=<TcE}IY@BAjA26mx$zJ)|kW_*nx*xt$f<
ztaQ9_&=deDm#|V@&kEtxQR=_m!dhCZjv}+8qeBis)kjg9G{Z7Rs49A7c*+!I{OfR#
zqZtZ*=->xk>S%^BQbC}k2#n6J(9-RZm}{M!u+Z8yu{k;bAVxeEzy~elftzRusEeQ_
zKN1f|0JV_ebN^i*Tl$&+zT!fLV<AxV*I|5kbmh@1d6vMj8zE8&UAg@_5>ea!0u;8r
z<VYa3J8td78gw5i+kd$0s;Kk3>scpOl1F>5RlYJRK6)`$A-k~hp1+0UBU2mbfb)(+
z=`Qy}!fs%cE=HvQ{?ayvS_EygFzfr13dZ_eQ3XSEFFx?Z^MG!73Z2om0?r-8vFGP%
z@P#}VLeZw2{1B7EBM&WZ>##ox<}wyL%RQvWV$z#ZUi+U9ixiAZs8ri5b#J%QqV&F;
zDMDS`4rg!t5=W)U?33CO;+L%q8ssHkC!TMq^?8b|GT%|kZ`)f7KB;sn-tm0Uo}q53
zhpFR=z4TVo>+g;y;7LXNx47u+Yl&Z;4)4M9@jd2RkrPjJY_?1gyWS(IijB_xZeF`0
zI+5baK49T&H_tqX*>e%qEwubV@v!7af9Xr7FA$V`J@y@W7jL)exy4|X;LQ75LFDn;
zQeB^q=)MciqXa0TIRB@GqG;?%wcaKuXK$o0;<=>;>CNX*05C^Ku^fty8_mrKP(Bn}
z;qHJk>sJSAjt2$VC_Z2bdQ3ON2mtQ#P}Lo98x?3G2^3UYZx#UlV+KSiU&!C679T52
zg>M*k!nxbK$(f#D1sLpLe}t}j1d$P=L<nK8DZ?@W07)DGxYk9uchiX#AR4msBf=Ca
z{2(;MRSkDR0m)_F^%}0Y^Y*e1?#@nYVl*t7cu)ZSL<k_Ji2NpQ1dO2b6N7T#?~Rqm
zDF|x`h&2KHO$_4%7!kQ0a!vq+H;y5a2+t!;1|W{h(W;12%JNN4#kT=2i>f35@KTj!
zKmkfl1chh<Bh~EfHPtV|0Khpm0N|mbiK_ubS9Mx7gtlvs+~+5-J<J#YfSZb@tpyNo
zYj2@ZLlz+?2~N~e2YQwCOQIBiAPA0R7;#b`;>-ZKIo8(YUlXjsTq&>;eJDH`+>A)k
zAevwVmeXMUdfQ*Q;&NqUXCc}$DR59H1Bx~;WSs)C&?JFWx-GrH#1jPo(P#j`QswS$
zgv^^LYr?lN)uHhP`6Wz?gS{?JMRh!eP@%o4AkW5Jvx6i$Hh87#SpZ-=6*t#(m3u!G
z6r|xInT@5wnW<Z>!bH<Rj*Vd!X)w&hYBh;MHzp|Nx6nokl#E-AxRM5PZ5&Z89flR1
zUxhiRgWNPQq@+2~CznVd0Q7GG03oW}uoqWnBWpq*?aaI}+den`dJ_r&I%yW<l<U8_
z{ANM8=7}%c;Rcij(}k&oGq0>tm#=beteTV-bIJ{FcR>=r&Uwa-Ld8<i)|`7b1FlG)
z4-y=T$^cmr*uVCrG*hG^^(m%5&chqb7T#czR1?#?u{yCQe$<<6O+oE%xL3&e0mP!O
zeE(+)rBGl|egJe?9mT&fPVd)_y?(2YYEAjA-(5I2H+y$Cxr-b0?zO2QnkF}4O#;Xd
zC1-*lP4<Xi8#Cb|mE43zGQsUsWu(*xL8xcJ2uuKUItvt|K_C?j!w8@G3wA^uykE9a
zRq%MwTJ;&B-Yk%Iff0!<_hAXA(EqT+p$Ik_Ed&}$fnp=pL6dL)#&JwpS0CoV3mXHs
z09mSOp>MC_`^Nm{U2!uT6hQ5T#Iivl=xO!_8w%;q>o4^ep;7_j5Mw|xIUsE^2p3#;
z;-qd;iUSm`6jFnKuKxe;y=+`nd#R5d0J`Bvib@jNhoYEFmWGGa&L9`A9oYc-lnaVO
zA-Nzs4GdXMX3OFz_<w?cO+IKql`8!9;}q`diE{m{R-@;^E}sg;Kz+I3PHtJ(OXt^K
zD(kU`gkgGqzcxPrAO~40i4W(XFL~f^5)aOrp3CO~fFU;k*hxi${6LD+6_AYnIqV_@
zv!QIP^~bFBN1=N+>tjH`-ND}3Ue*h@?sW1`g!5ND{{T>!pC|ypaKpXJ*Z`!boS}BZ
OA2lBM<q`*XQs95P{_d3k


From 17eea823a583e47ba51ee9ed68549471961674e4 Mon Sep 17 00:00:00 2001
From: guqing <38999863+guqing@users.noreply.github.com>
Date: Mon, 14 Oct 2024 14:17:16 +0800
Subject: [PATCH 148/185] fix: retain legacy enabled field for auth provider
 setting (#6861)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?
/kind bug
/area core
/milestone 2.20.x

#### What this PR does / why we need it:
恢复 https://github.com/halo-dev/halo/pull/6846 中删除的 SystemSetting.AuthProvider#enabled 字段避免插件应用到了它可能会发生错误，将其标记为过时

#### Does this PR introduce a user-facing change?
```release-note
None
```
---
 .../run/halo/app/infra/SystemSetting.java     | 29 +++++++++++++++++++
 .../security/AuthProviderServiceImplTest.java |  2 ++
 2 files changed, 31 insertions(+)

diff --git a/api/src/main/java/run/halo/app/infra/SystemSetting.java b/api/src/main/java/run/halo/app/infra/SystemSetting.java
index 6339b54512..163b709ea6 100644
--- a/api/src/main/java/run/halo/app/infra/SystemSetting.java
+++ b/api/src/main/java/run/halo/app/infra/SystemSetting.java
@@ -3,6 +3,8 @@
 import java.util.LinkedHashMap;
 import java.util.LinkedHashSet;
 import java.util.List;
+import java.util.Set;
+import java.util.stream.Collectors;
 import lombok.Data;
 import lombok.experimental.Accessors;
 import org.springframework.boot.convert.ApplicationConversionService;
@@ -114,7 +116,34 @@ public static class Menu {
     @Data
     public static class AuthProvider {
         public static final String GROUP = "authProvider";
+        /**
+         * Currently keep it to be compatible with the reference of the plugin.
+         *
+         * @deprecated Use {@link #getStates()} instead.
+         */
+        @Deprecated(since = "2.20.0", forRemoval = true)
+        private Set<String> enabled;
+
         private List<AuthProviderState> states;
+
+        /**
+         * <p>To be compatible with the old version of the enabled field and retained,
+         * since 2.20.0 version, we uses the states field, so the data needs to be synchronized
+         * to the enabled field, and this method needs to be deleted when the enabled field is
+         * removed.</p>
+         *
+         * @deprecated Use {@link #getStates()} instead.
+         */
+        @Deprecated(since = "2.20.0", forRemoval = true)
+        public Set<String> getEnabled() {
+            if (states == null) {
+                return enabled;
+            }
+            return this.states.stream()
+                .filter(AuthProviderState::isEnabled)
+                .map(AuthProviderState::getName)
+                .collect(Collectors.toSet());
+        }
     }
 
     @Data
diff --git a/application/src/test/java/run/halo/app/security/AuthProviderServiceImplTest.java b/application/src/test/java/run/halo/app/security/AuthProviderServiceImplTest.java
index a0bbd463ad..6583e13c23 100644
--- a/application/src/test/java/run/halo/app/security/AuthProviderServiceImplTest.java
+++ b/application/src/test/java/run/halo/app/security/AuthProviderServiceImplTest.java
@@ -66,6 +66,7 @@ void testEnable() throws JSONException {
         ConfigMap value = captor.getValue();
         JSONAssert.assertEquals("""
                 {
+                    "enabled":["github"],
                     "states": [
                         {
                             "name": "github",
@@ -102,6 +103,7 @@ void testDisable() throws JSONException {
         ConfigMap value = captor.getValue();
         JSONAssert.assertEquals("""
                 {
+                    "enabled":[],
                     "states": [
                         {
                             "name": "github",

From dd5f02e505db5db1e76b062bb9fe93b3a3b6ac73 Mon Sep 17 00:00:00 2001
From: John Niang <johnniang@foxmail.com>
Date: Mon, 14 Oct 2024 15:09:16 +0800
Subject: [PATCH 149/185] Fix the problem of redirecting to previous URI with
 fragment after authenticated (#6862)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/kind bug
/area core
/milestone 2.20.x

#### What this PR does / why we need it:

This PR ignores URI fragment while removing redirect URI. Before that, users may be redirected to previous redirect URI that contains fragment.

#### Does this PR introduce a user-facing change?

```release-note
修复二次登录后重定向跳转至旧地址的问题
```
---
 .../app/security/HaloServerRequestCache.java  | 46 +++++++++++++++----
 .../security/HaloServerRequestCacheTest.java  | 24 +++++++++-
 2 files changed, 59 insertions(+), 11 deletions(-)

diff --git a/application/src/main/java/run/halo/app/security/HaloServerRequestCache.java b/application/src/main/java/run/halo/app/security/HaloServerRequestCache.java
index 02f1460509..9b786d68c2 100644
--- a/application/src/main/java/run/halo/app/security/HaloServerRequestCache.java
+++ b/application/src/main/java/run/halo/app/security/HaloServerRequestCache.java
@@ -4,6 +4,7 @@
 
 import java.net.URI;
 import java.util.Collections;
+import java.util.Objects;
 import org.apache.commons.lang3.StringUtils;
 import org.springframework.http.HttpMethod;
 import org.springframework.http.MediaType;
@@ -58,24 +59,49 @@ public Mono<URI> getRedirectUri(ServerWebExchange exchange) {
 
     @Override
     public Mono<ServerHttpRequest> removeMatchingRequest(ServerWebExchange exchange) {
-        return super.removeMatchingRequest(exchange);
+        return getRedirectUri(exchange)
+            .flatMap(redirectUri -> {
+                if (redirectUri.getFragment() != null) {
+                    var redirectUriInApplication =
+                        uriInApplication(exchange.getRequest(), redirectUri, false);
+                    var uriInApplication =
+                        uriInApplication(exchange.getRequest(), exchange.getRequest().getURI());
+                    // compare the path and query only
+                    if (!Objects.equals(redirectUriInApplication, uriInApplication)) {
+                        return Mono.empty();
+                    }
+                    // remove the exchange
+                    return exchange.getSession().map(WebSession::getAttributes)
+                        .doOnNext(attributes -> attributes.remove(this.sessionAttrName))
+                        .thenReturn(exchange.getRequest());
+                }
+                return super.removeMatchingRequest(exchange);
+            });
     }
 
     private Mono<Void> saveRedirectUri(ServerWebExchange exchange, URI redirectUri) {
-        var requestPath = exchange.getRequest().getPath();
-        var redirectPath = RequestPath.parse(redirectUri, requestPath.contextPath().value());
-        var query = redirectUri.getRawQuery();
-        var fragment = redirectUri.getRawFragment();
-        var finalRedirect = redirectPath.pathWithinApplication()
-            + (query == null ? "" : "?" + query)
-            + (fragment == null ? "" : "#" + fragment);
-
+        var redirectUriInApplication = uriInApplication(exchange.getRequest(), redirectUri);
         return exchange.getSession()
             .map(WebSession::getAttributes)
-            .doOnNext(attributes -> attributes.put(this.sessionAttrName, finalRedirect))
+            .doOnNext(attributes -> attributes.put(this.sessionAttrName, redirectUriInApplication))
             .then();
     }
 
+    private static String uriInApplication(ServerHttpRequest request, URI uri) {
+        return uriInApplication(request, uri, true);
+    }
+
+    private static String uriInApplication(
+        ServerHttpRequest request, URI uri, boolean appendFragment
+    ) {
+        var path = RequestPath.parse(uri, request.getPath().contextPath().value());
+        var query = uri.getRawQuery();
+        var fragment = uri.getRawFragment();
+        return path.pathWithinApplication().value()
+            + (query == null ? "" : "?" + query)
+            + (fragment == null || !appendFragment ? "" : "#" + fragment);
+    }
+
     private static ServerWebExchangeMatcher createDefaultRequestMatcher() {
         var get = pathMatchers(HttpMethod.GET, "/**");
         var notFavicon = new NegatedServerWebExchangeMatcher(
diff --git a/application/src/test/java/run/halo/app/security/HaloServerRequestCacheTest.java b/application/src/test/java/run/halo/app/security/HaloServerRequestCacheTest.java
index aa5c09bf9b..eabd2f0ea1 100644
--- a/application/src/test/java/run/halo/app/security/HaloServerRequestCacheTest.java
+++ b/application/src/test/java/run/halo/app/security/HaloServerRequestCacheTest.java
@@ -59,9 +59,31 @@ void shouldSaveIfRedirectUriPresent() {
 
     @Test
     void shouldRemoveIfRedirectUriFound() {
+        var sessionManager = new DefaultWebSessionManager();
+        var mockExchange = MockServerWebExchange.builder(MockServerHttpRequest.get("/login")
+                .queryParam("redirect_uri", "/halo")
+            )
+            .sessionManager(sessionManager)
+            .build();
+        var removeExchange = mockExchange.mutate()
+            .request(builder -> builder.uri(URI.create("/halo")))
+            .build();
+        requestCache.saveRequest(mockExchange)
+            .then(Mono.defer(() -> requestCache.removeMatchingRequest(removeExchange)))
+            .as(StepVerifier::create)
+            .assertNext(request -> {
+                Assertions.assertEquals(URI.create("/halo"), request.getURI());
+            })
+            .verifyComplete();
+    }
+
+    @Test
+    void shouldRemoveIfRedirectUriFoundAndContainsFragment() {
         var sessionManager = new DefaultWebSessionManager();
         var mockExchange =
-            MockServerWebExchange.builder(MockServerHttpRequest.get("/login?redirect_uri=/halo"))
+            MockServerWebExchange.builder(MockServerHttpRequest.get("/login")
+                    .queryParam("redirect_uri", "/halo#fragment")
+                )
                 .sessionManager(sessionManager)
                 .build();
         var removeExchange = mockExchange.mutate()

From 45aae9c1a89ec7e1044934b086aa3cb299338d00 Mon Sep 17 00:00:00 2001
From: guqing <38999863+guqing@users.noreply.github.com>
Date: Mon, 14 Oct 2024 20:43:18 +0800
Subject: [PATCH 150/185] fix: preventing access to login page after Halo setup
 (#6865)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?
/kind bug
/area core
/milestone 2.20.x

#### What this PR does / why we need it:
修复初始化 Halo 之后无法进入登录页面的问题

此问题原因是更改了 AuthProvider 的逻辑，当系统启动之后缺少默认的登录方式导致登录页面无法正确渲染
此 PR 将确保默认的登录方式始终存在来解决此问题

how to test it?
重新初始化 Halo 之后能正确渲染登录页面并登录即为符合预期

#### Does this PR introduce a user-facing change?
```release-note
修复初始化 Halo 之后无法进入登录页面的问题
```
---
 .../app/security/AuthProviderServiceImpl.java    | 16 ++++++++++++----
 .../system-configurable-configmap.yaml           |  8 ++++++++
 .../security/AuthProviderServiceImplTest.java    | 16 +++++++++++++++-
 3 files changed, 35 insertions(+), 5 deletions(-)

diff --git a/application/src/main/java/run/halo/app/security/AuthProviderServiceImpl.java b/application/src/main/java/run/halo/app/security/AuthProviderServiceImpl.java
index b971b7b255..8cdd9124d4 100644
--- a/application/src/main/java/run/halo/app/security/AuthProviderServiceImpl.java
+++ b/application/src/main/java/run/halo/app/security/AuthProviderServiceImpl.java
@@ -13,6 +13,7 @@
 import lombok.experimental.Accessors;
 import org.apache.commons.lang3.BooleanUtils;
 import org.apache.commons.lang3.StringUtils;
+import org.springframework.beans.factory.ObjectProvider;
 import org.springframework.dao.OptimisticLockingFailureException;
 import org.springframework.lang.NonNull;
 import org.springframework.security.core.context.ReactiveSecurityContextHolder;
@@ -29,6 +30,7 @@
 import run.halo.app.extension.MetadataUtil;
 import run.halo.app.extension.ReactiveExtensionClient;
 import run.halo.app.extension.index.query.QueryFactory;
+import run.halo.app.infra.SystemConfigurableEnvironmentFetcher;
 import run.halo.app.infra.SystemSetting;
 import run.halo.app.infra.utils.JsonUtils;
 
@@ -42,6 +44,7 @@
 @RequiredArgsConstructor
 public class AuthProviderServiceImpl implements AuthProviderService {
     private final ReactiveExtensionClient client;
+    private final ObjectProvider<SystemConfigurableEnvironmentFetcher> environmentFetcherProvider;
 
     @Override
     public Mono<AuthProvider> enable(String name) {
@@ -146,7 +149,7 @@ public int compareTo(@NonNull AuthProviderWithPriority o) {
     }
 
     private Mono<List<SystemSetting.AuthProviderState>> fetchProviderStates() {
-        return fetchSystemConfigMap()
+        return getSystemConfigMap()
             .map(AuthProviderServiceImpl::getAuthProviderConfig)
             .map(SystemSetting.AuthProvider::getStates)
             .defaultIfEmpty(List.of())
@@ -218,7 +221,7 @@ private static SystemSetting.AuthProvider getAuthProviderConfig(ConfigMap config
     }
 
     private Mono<ConfigMap> updateAuthProviderEnabled(String name, boolean enabled) {
-        return Mono.defer(() -> fetchSystemConfigMap()
+        return Mono.defer(() -> getSystemConfigMap()
                 .flatMap(configMap -> {
                     var providerConfig = getAuthProviderConfig(configMap);
                     var stateToFoundOpt = providerConfig.getStates()
@@ -244,7 +247,12 @@ private Mono<ConfigMap> updateAuthProviderEnabled(String name, boolean enabled)
                 .filter(OptimisticLockingFailureException.class::isInstance));
     }
 
-    Mono<ConfigMap> fetchSystemConfigMap() {
-        return client.fetch(ConfigMap.class, SystemSetting.SYSTEM_CONFIG);
+    private Mono<ConfigMap> getSystemConfigMap() {
+        var systemFetcher = environmentFetcherProvider.getIfUnique();
+        if (systemFetcher == null) {
+            return Mono.error(
+                new IllegalStateException("No SystemConfigurableEnvironmentFetcher found"));
+        }
+        return systemFetcher.getConfigMap();
     }
 }
diff --git a/application/src/main/resources/extensions/system-configurable-configmap.yaml b/application/src/main/resources/extensions/system-configurable-configmap.yaml
index ca914d254d..64c98e0965 100644
--- a/application/src/main/resources/extensions/system-configurable-configmap.yaml
+++ b/application/src/main/resources/extensions/system-configurable-configmap.yaml
@@ -51,3 +51,11 @@ data:
     {
       "search-engine": ["search-engine-lucene"]
     }
+  authProvider: |
+    {
+      "states": [{
+          "name": "local",
+          "enabled": true,
+          "priority": 0
+      }]
+    }
diff --git a/application/src/test/java/run/halo/app/security/AuthProviderServiceImplTest.java b/application/src/test/java/run/halo/app/security/AuthProviderServiceImplTest.java
index 6583e13c23..6260cc6860 100644
--- a/application/src/test/java/run/halo/app/security/AuthProviderServiceImplTest.java
+++ b/application/src/test/java/run/halo/app/security/AuthProviderServiceImplTest.java
@@ -10,12 +10,14 @@
 
 import java.util.HashMap;
 import org.json.JSONException;
+import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.ExtendWith;
 import org.mockito.ArgumentCaptor;
 import org.mockito.InjectMocks;
 import org.mockito.Mock;
 import org.skyscreamer.jsonassert.JSONAssert;
+import org.springframework.beans.factory.ObjectProvider;
 import org.springframework.data.domain.Sort;
 import org.springframework.security.test.context.support.WithMockUser;
 import org.springframework.test.context.junit.jupiter.SpringExtension;
@@ -28,6 +30,7 @@
 import run.halo.app.extension.ListOptions;
 import run.halo.app.extension.Metadata;
 import run.halo.app.extension.ReactiveExtensionClient;
+import run.halo.app.infra.SystemConfigurableEnvironmentFetcher;
 import run.halo.app.infra.SystemSetting;
 import run.halo.app.infra.utils.JsonUtils;
 
@@ -43,9 +46,20 @@ class AuthProviderServiceImplTest {
     @Mock
     ReactiveExtensionClient client;
 
+    @Mock
+    ObjectProvider<SystemConfigurableEnvironmentFetcher> systemFetchProvider;
+
+    @Mock
+    SystemConfigurableEnvironmentFetcher systemConfigFetcher;
+
     @InjectMocks
     AuthProviderServiceImpl authProviderService;
 
+    @BeforeEach
+    void setUp() {
+        when(systemFetchProvider.getIfUnique()).thenReturn(systemConfigFetcher);
+    }
+
     @Test
     void testEnable() throws JSONException {
         // Create a test auth provider
@@ -199,7 +213,7 @@ AuthProvider createAuthProvider(String name) {
     void pileSystemConfigMap() {
         ConfigMap configMap = new ConfigMap();
         configMap.setData(new HashMap<>());
-        when(client.fetch(eq(ConfigMap.class), eq(SystemSetting.SYSTEM_CONFIG)))
+        when(systemConfigFetcher.getConfigMap())
             .thenReturn(Mono.just(configMap));
     }
 }
\ No newline at end of file

From c3020d6a85846e188f8f313389da7f52abe537ef Mon Sep 17 00:00:00 2001
From: John Niang <johnniang@foxmail.com>
Date: Tue, 15 Oct 2024 15:57:21 +0800
Subject: [PATCH 151/185] Fix the problem of not being able to disconnect
 OAuth2 user (#6869)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/kind bug
/area core
/milestone 2.20.x

#### What this PR does / why we need it:

This PR corrects typo of `apisGroups` to `apiGroups` to fix the problem of not being able to disconnect OAuth2 user.

#### Special notes for your reviewer:

0. Install OAuth2 plugin
1. Log in as a normal user
2. Bind a OAuth2 user
3. Try to unbind it

#### Does this PR introduce a user-facing change?

```release-note
修复无法正常解绑 OAuth2 用户
```
---
 .../main/resources/extensions/role-template-authenticated.yaml  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/application/src/main/resources/extensions/role-template-authenticated.yaml b/application/src/main/resources/extensions/role-template-authenticated.yaml
index 6e0ae46071..f062e9e127 100644
--- a/application/src/main/resources/extensions/role-template-authenticated.yaml
+++ b/application/src/main/resources/extensions/role-template-authenticated.yaml
@@ -29,7 +29,7 @@ rules:
     resources: [ "plugins/bundle.js", "plugins/bundle.css" ]
     resourceNames: [ "-" ]
     verbs: [ "get" ]
-  - apisGroups: [ "uc.api.auth.halo.run" ]
+  - apiGroups: [ "uc.api.auth.halo.run" ]
     resources: [ "user-connections/disconnect" ]
     verbs: [ "update" ]
 ---

From b95a83a242323faaf7b6af21fa81bc48fb171fb7 Mon Sep 17 00:00:00 2001
From: John Niang <johnniang@foxmail.com>
Date: Tue, 15 Oct 2024 16:51:22 +0800
Subject: [PATCH 152/185] Fix the problem of not being able to create PAT for
 OAuth2 user (#6870)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/kind bug
/area core
/milestone 2.20.x

#### What this PR does / why we need it:

This PR refactors check of whether the current user is a real user to fix the problem of not being able to create PAT for OAuth2 user.

#### Does this PR introduce a user-facing change?

```release-note
修复通过 OAuth2 登录之后无法正常创建和恢复个人令牌的问题
```
---
 .../pat/impl/UserScopedPatHandlerImpl.java          | 13 +++++++++----
 .../app/security/authorization/AuthorityUtils.java  | 13 -------------
 .../security/authorization/AuthorityUtilsTest.java  |  9 ---------
 3 files changed, 9 insertions(+), 26 deletions(-)

diff --git a/application/src/main/java/run/halo/app/security/authentication/pat/impl/UserScopedPatHandlerImpl.java b/application/src/main/java/run/halo/app/security/authentication/pat/impl/UserScopedPatHandlerImpl.java
index 108479968d..9a40919d49 100644
--- a/application/src/main/java/run/halo/app/security/authentication/pat/impl/UserScopedPatHandlerImpl.java
+++ b/application/src/main/java/run/halo/app/security/authentication/pat/impl/UserScopedPatHandlerImpl.java
@@ -11,6 +11,8 @@
 import java.util.List;
 import java.util.Objects;
 import java.util.function.Predicate;
+import org.springframework.security.authentication.AuthenticationTrustResolver;
+import org.springframework.security.authentication.AuthenticationTrustResolverImpl;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.GrantedAuthority;
 import org.springframework.security.core.context.ReactiveSecurityContextHolder;
@@ -64,6 +66,9 @@ public class UserScopedPatHandlerImpl implements UserScopedPatHandler {
 
     private Clock clock;
 
+    private final AuthenticationTrustResolver authTrustResolver =
+        new AuthenticationTrustResolverImpl();
+
     public UserScopedPatHandlerImpl(ReactiveExtensionClient client,
         CryptoService cryptoService,
         ExternalUrlSupplier externalUrl,
@@ -84,8 +89,8 @@ public void setClock(Clock clock) {
         this.clock = clock;
     }
 
-    private static Mono<Authentication> mustBeRealUser(Mono<Authentication> authentication) {
-        return authentication.filter(AuthorityUtils::isRealUser)
+    private Mono<Authentication> mustBeAuthenticated(Mono<Authentication> authentication) {
+        return authentication.filter(authTrustResolver::isAuthenticated)
             // Non-username-password authentication could not access the API at any time.
             .switchIfEmpty(Mono.error(AccessDeniedException::new));
     }
@@ -94,7 +99,7 @@ private static Mono<Authentication> mustBeRealUser(Mono<Authentication> authenti
     public Mono<ServerResponse> create(ServerRequest request) {
         return ReactiveSecurityContextHolder.getContext()
             .map(SecurityContext::getAuthentication)
-            .transform(UserScopedPatHandlerImpl::mustBeRealUser)
+            .transform(this::mustBeAuthenticated)
             .flatMap(auth -> request.bodyToMono(PersonalAccessToken.class)
                 .switchIfEmpty(
                     Mono.error(() -> new ServerWebInputException("Missing request body.")))
@@ -222,7 +227,7 @@ public Mono<ServerResponse> delete(ServerRequest request) {
     public Mono<ServerResponse> restore(ServerRequest request) {
         var restoredPat = ReactiveSecurityContextHolder.getContext()
             .map(SecurityContext::getAuthentication)
-            .transform(UserScopedPatHandlerImpl::mustBeRealUser)
+            .transform(this::mustBeAuthenticated)
             .flatMap(auth -> {
                 var name = request.pathVariable("name");
                 return getPat(name, auth.getName());
diff --git a/application/src/main/java/run/halo/app/security/authorization/AuthorityUtils.java b/application/src/main/java/run/halo/app/security/authorization/AuthorityUtils.java
index 75605e35f2..846830aa0d 100644
--- a/application/src/main/java/run/halo/app/security/authorization/AuthorityUtils.java
+++ b/application/src/main/java/run/halo/app/security/authorization/AuthorityUtils.java
@@ -4,9 +4,6 @@
 import java.util.Set;
 import java.util.stream.Collectors;
 import org.apache.commons.lang3.StringUtils;
-import org.springframework.security.authentication.RememberMeAuthenticationToken;
-import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
-import org.springframework.security.core.Authentication;
 import org.springframework.security.core.GrantedAuthority;
 
 /**
@@ -51,14 +48,4 @@ public static boolean containsSuperRole(Collection<String> roles) {
         return roles.contains(SUPER_ROLE_NAME);
     }
 
-    /**
-     * Check if the authentication is a real user.
-     *
-     * @param authentication current authentication
-     * @return true if the authentication is a real user; false otherwise
-     */
-    public static boolean isRealUser(Authentication authentication) {
-        return authentication instanceof UsernamePasswordAuthenticationToken
-            || authentication instanceof RememberMeAuthenticationToken;
-    }
 }
diff --git a/application/src/test/java/run/halo/app/security/authorization/AuthorityUtilsTest.java b/application/src/test/java/run/halo/app/security/authorization/AuthorityUtilsTest.java
index 4ac5082d3d..1d9052a340 100644
--- a/application/src/test/java/run/halo/app/security/authorization/AuthorityUtilsTest.java
+++ b/application/src/test/java/run/halo/app/security/authorization/AuthorityUtilsTest.java
@@ -3,16 +3,12 @@
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertTrue;
-import static org.mockito.Mockito.mock;
 import static run.halo.app.security.authorization.AuthorityUtils.authoritiesToRoles;
 import static run.halo.app.security.authorization.AuthorityUtils.containsSuperRole;
-import static run.halo.app.security.authorization.AuthorityUtils.isRealUser;
 
 import java.util.List;
 import java.util.Set;
 import org.junit.jupiter.api.Test;
-import org.springframework.security.authentication.RememberMeAuthenticationToken;
-import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
 import org.springframework.security.core.authority.SimpleGrantedAuthority;
 
 class AuthorityUtilsTest {
@@ -39,9 +35,4 @@ void containsSuperRoleTest() {
         assertFalse(containsSuperRole(Set.of("admin")));
     }
 
-    @Test
-    void shouldReturnTrueWhenAuthenticationIsRealUser() {
-        assertTrue(isRealUser(mock(UsernamePasswordAuthenticationToken.class)));
-        assertTrue(isRealUser(mock(RememberMeAuthenticationToken.class)));
-    }
 }
\ No newline at end of file

From c9869b7d208ea5f1522bf05981b961756b0a8112 Mon Sep 17 00:00:00 2001
From: Ryan Wang <i@ryanc.cc>
Date: Wed, 16 Oct 2024 11:13:27 +0800
Subject: [PATCH 153/185] docs: update readme for 2.20 (#6874)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/kind documentation

#### What this PR does / why we need it:

更新快速开始的版本号。

#### Does this PR introduce a user-facing change?

```release-note
None
```
---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 82c1ab2988..0dfeedbab3 100755
--- a/README.md
+++ b/README.md
@@ -28,7 +28,7 @@
 ## 快速开始
 
 ```bash
-docker run -d --name halo -p 8090:8090 -v ~/.halo2:/root/.halo2 halohub/halo:2.19
+docker run -d --name halo -p 8090:8090 -v ~/.halo2:/root/.halo2 halohub/halo:2.20
 ```
 
 以上仅作为体验使用，详细部署文档请查阅：<https://docs.halo.run/getting-started/install/docker-compose>

From ecc7c07d0856d719d82d900775628c23a042b3e5 Mon Sep 17 00:00:00 2001
From: Ryan Wang <i@ryanc.cc>
Date: Wed, 16 Oct 2024 14:07:27 +0800
Subject: [PATCH 154/185] docs: add gitpod link for readme (#6876)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/kind documentation

#### What this PR does / why we need it:

添加 Gitpod 的演示环境链接。

#### Does this PR introduce a user-facing change?

```release-note
None
```
---
 README.md | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/README.md b/README.md
index 0dfeedbab3..90d8919eaf 100755
--- a/README.md
+++ b/README.md
@@ -27,10 +27,16 @@
 
 ## 快速开始
 
+如果你的设备有 Docker 环境，可以使用以下命令快速启动一个 Halo 的体验环境：
+
 ```bash
 docker run -d --name halo -p 8090:8090 -v ~/.halo2:/root/.halo2 halohub/halo:2.20
 ```
 
+或者点击下方按钮使用 [Gitpod](https://gitpod.io/) 启动一个体验环境：
+
+[![Open in Gitpod](https://gitpod.io/button/open-in-gitpod.svg)](https://gitpod.io/#https://github.com/halo-sigs/gitpod-demo)
+
 以上仅作为体验使用，详细部署文档请查阅：<https://docs.halo.run/getting-started/install/docker-compose>
 
 ## 在线体验

From c577deb6ee72d30361ed20bea12cf9e32b317920 Mon Sep 17 00:00:00 2001
From: guqing <38999863+guqing@users.noreply.github.com>
Date: Wed, 16 Oct 2024 16:21:28 +0800
Subject: [PATCH 155/185] fix: missing ServerWebExchange in plugin template
 processor extension (#6877)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?
/kind bug
/area core
/milestone 2.20.x

#### What this PR does / why we need it:
修复由 #6680 导致的插件模板处理扩展中无法获取到请求上下文的问题

#6680 修复了插件可以在模板处理扩展中通过请求上下文获取到 Halo 的 ApplicationContext 的问题
但这也引入了新的问题就是导致模板处理扩展无法获取到请求上下文，此 PR 通过判断传递给插件的 ITemplateContext 是否为 IWebContext，如果是则包装为 SecureTemplateWebContext 传递给插件，以解决此问题

#### Which issue(s) this PR fixes:
Fixes #6875

#### Does this PR introduce a user-facing change?
```release-note
修复插件模板处理扩展中无法获取到请求上下文的问题
```
---
 .../dialect/CommentElementTagProcessor.java   |  2 +-
 .../dialect/GlobalHeadInjectionProcessor.java |  2 +-
 .../dialect/HaloPostTemplateHandler.java      |  3 +-
 .../dialect/SecureTemplateContextWrapper.java | 24 +++++++++++++
 .../dialect/SecureTemplateWebContext.java     | 36 +++++++++++++++++++
 .../TemplateFooterElementTagProcessor.java    |  2 +-
 .../dialect/HaloPostTemplateHandlerTest.java  | 14 +++++---
 7 files changed, 74 insertions(+), 9 deletions(-)
 create mode 100644 application/src/main/java/run/halo/app/theme/dialect/SecureTemplateContextWrapper.java
 create mode 100644 application/src/main/java/run/halo/app/theme/dialect/SecureTemplateWebContext.java

diff --git a/application/src/main/java/run/halo/app/theme/dialect/CommentElementTagProcessor.java b/application/src/main/java/run/halo/app/theme/dialect/CommentElementTagProcessor.java
index f449f2e696..9e847194d7 100644
--- a/application/src/main/java/run/halo/app/theme/dialect/CommentElementTagProcessor.java
+++ b/application/src/main/java/run/halo/app/theme/dialect/CommentElementTagProcessor.java
@@ -45,6 +45,6 @@ protected void doProcess(ITemplateContext context, IProcessableElementTag tag,
             structureHandler.replaceWith("", false);
             return;
         }
-        commentWidget.render(new SecureTemplateContext(context), tag, structureHandler);
+        commentWidget.render(SecureTemplateContextWrapper.wrap(context), tag, structureHandler);
     }
 }
diff --git a/application/src/main/java/run/halo/app/theme/dialect/GlobalHeadInjectionProcessor.java b/application/src/main/java/run/halo/app/theme/dialect/GlobalHeadInjectionProcessor.java
index ee741a887a..0604dc5910 100644
--- a/application/src/main/java/run/halo/app/theme/dialect/GlobalHeadInjectionProcessor.java
+++ b/application/src/main/java/run/halo/app/theme/dialect/GlobalHeadInjectionProcessor.java
@@ -75,7 +75,7 @@ protected void doProcess(ITemplateContext context, IModel model,
         // apply processors to modelToInsert
         getTemplateHeadProcessors(context)
             .concatMap(processor -> processor.process(
-                new SecureTemplateContext(context), modelToInsert, structureHandler)
+                SecureTemplateContextWrapper.wrap(context), modelToInsert, structureHandler)
             )
             .then()
             .block();
diff --git a/application/src/main/java/run/halo/app/theme/dialect/HaloPostTemplateHandler.java b/application/src/main/java/run/halo/app/theme/dialect/HaloPostTemplateHandler.java
index 25755a457a..f4f20ba897 100644
--- a/application/src/main/java/run/halo/app/theme/dialect/HaloPostTemplateHandler.java
+++ b/application/src/main/java/run/halo/app/theme/dialect/HaloPostTemplateHandler.java
@@ -57,7 +57,8 @@ private IProcessableElementTag handleElementTag(
             var context = getContext();
             for (ElementTagPostProcessor elementTagPostProcessor : postProcessors) {
                 tagProcessorChain = tagProcessorChain.flatMap(
-                    tag -> elementTagPostProcessor.process(new SecureTemplateContext(context), tag)
+                    tag -> elementTagPostProcessor.process(
+                            SecureTemplateContextWrapper.wrap(context), tag)
                         .defaultIfEmpty(tag)
                 );
             }
diff --git a/application/src/main/java/run/halo/app/theme/dialect/SecureTemplateContextWrapper.java b/application/src/main/java/run/halo/app/theme/dialect/SecureTemplateContextWrapper.java
new file mode 100644
index 0000000000..afafc81079
--- /dev/null
+++ b/application/src/main/java/run/halo/app/theme/dialect/SecureTemplateContextWrapper.java
@@ -0,0 +1,24 @@
+package run.halo.app.theme.dialect;
+
+import org.thymeleaf.context.Contexts;
+import org.thymeleaf.context.ITemplateContext;
+
+/**
+ * Wrap the delegate template context to a secure template context according to whether it is a
+ * WebContext.
+ *
+ * @author guqing
+ * @since 2.20.4
+ */
+public class SecureTemplateContextWrapper {
+
+    /**
+     * Wrap the delegate template context to a secure template context.
+     */
+    static SecureTemplateContext wrap(ITemplateContext delegate) {
+        if (Contexts.isWebContext(delegate)) {
+            return new SecureTemplateWebContext(delegate);
+        }
+        return new SecureTemplateContext(delegate);
+    }
+}
diff --git a/application/src/main/java/run/halo/app/theme/dialect/SecureTemplateWebContext.java b/application/src/main/java/run/halo/app/theme/dialect/SecureTemplateWebContext.java
new file mode 100644
index 0000000000..79de141f00
--- /dev/null
+++ b/application/src/main/java/run/halo/app/theme/dialect/SecureTemplateWebContext.java
@@ -0,0 +1,36 @@
+package run.halo.app.theme.dialect;
+
+import org.springframework.context.ApplicationContext;
+import org.thymeleaf.context.ITemplateContext;
+import org.thymeleaf.context.IWebContext;
+import org.thymeleaf.web.IWebExchange;
+
+/**
+ * Secure template web context.
+ * <p>It's used to prevent some dangerous variables such as {@link ApplicationContext} from being
+ * accessed.
+ *
+ * @author guqing
+ * @see SecureTemplateContext
+ * @since 2.20.4
+ */
+class SecureTemplateWebContext extends SecureTemplateContext implements IWebContext {
+    private final IWebContext delegate;
+
+    /**
+     * The delegate must be an instance of IWebContext to create a SecureTemplateWebContext.
+     */
+    public SecureTemplateWebContext(ITemplateContext delegate) {
+        super(delegate);
+        if (delegate instanceof IWebContext webContext) {
+            this.delegate = webContext;
+        } else {
+            throw new IllegalArgumentException("The delegate must be an instance of IWebContext");
+        }
+    }
+
+    @Override
+    public IWebExchange getExchange() {
+        return delegate.getExchange();
+    }
+}
diff --git a/application/src/main/java/run/halo/app/theme/dialect/TemplateFooterElementTagProcessor.java b/application/src/main/java/run/halo/app/theme/dialect/TemplateFooterElementTagProcessor.java
index 7177d2f789..c41dd14549 100644
--- a/application/src/main/java/run/halo/app/theme/dialect/TemplateFooterElementTagProcessor.java
+++ b/application/src/main/java/run/halo/app/theme/dialect/TemplateFooterElementTagProcessor.java
@@ -63,7 +63,7 @@ protected void doProcess(ITemplateContext context, IProcessableElementTag tag,
 
         getTemplateFooterProcessors(context)
             .concatMap(processor -> processor.process(
-                new SecureTemplateContext(context), tag, structureHandler, modelToInsert)
+                SecureTemplateContextWrapper.wrap(context), tag, structureHandler, modelToInsert)
             )
             .then()
             .block();
diff --git a/application/src/test/java/run/halo/app/theme/dialect/HaloPostTemplateHandlerTest.java b/application/src/test/java/run/halo/app/theme/dialect/HaloPostTemplateHandlerTest.java
index 9d6266f2d7..4881d032fa 100644
--- a/application/src/test/java/run/halo/app/theme/dialect/HaloPostTemplateHandlerTest.java
+++ b/application/src/test/java/run/halo/app/theme/dialect/HaloPostTemplateHandlerTest.java
@@ -82,7 +82,8 @@ void shouldHandleStandaloneElementIfNoElementTagProcessors(
     void shouldHandleStandaloneElementIfOneElementTagProcessorProvided() {
         var processor = mock(ElementTagPostProcessor.class);
         var newTag = mock(IStandaloneElementTag.class);
-        when(processor.process(new SecureTemplateContext(templateContext), standaloneElementTag))
+        when(processor.process(SecureTemplateContextWrapper.wrap(templateContext),
+            standaloneElementTag))
             .thenReturn(Mono.just(newTag));
         when(extensionGetter.getExtensionList(ElementTagPostProcessor.class))
             .thenReturn(List.of(processor));
@@ -97,7 +98,8 @@ void shouldHandleStandaloneElementIfOneElementTagProcessorProvided() {
     void shouldHandleStandaloneElementIfTagTypeChanged() {
         var processor = mock(ElementTagPostProcessor.class);
         var newTag = mock(IStandaloneElementTag.class);
-        when(processor.process(new SecureTemplateContext(templateContext), standaloneElementTag))
+        when(processor.process(SecureTemplateContextWrapper.wrap(templateContext),
+            standaloneElementTag))
             .thenReturn(Mono.just(newTag));
         when(extensionGetter.getExtensionList(ElementTagPostProcessor.class))
             .thenReturn(List.of(processor));
@@ -114,9 +116,10 @@ void shouldHandleStandaloneElementIfMoreElementTagProcessorsProvided() {
         var processor2 = mock(ElementTagPostProcessor.class);
         var newTag1 = mock(IStandaloneElementTag.class);
         var newTag2 = mock(IStandaloneElementTag.class);
-        when(processor1.process(new SecureTemplateContext(templateContext), standaloneElementTag))
+        when(processor1.process(SecureTemplateContextWrapper.wrap(templateContext),
+            standaloneElementTag))
             .thenReturn(Mono.just(newTag1));
-        when(processor2.process(new SecureTemplateContext(templateContext), newTag1))
+        when(processor2.process(SecureTemplateContextWrapper.wrap(templateContext), newTag1))
             .thenReturn(Mono.just(newTag2));
         when(extensionGetter.getExtensionList(ElementTagPostProcessor.class))
             .thenReturn(List.of(processor1, processor2));
@@ -131,7 +134,8 @@ void shouldHandleStandaloneElementIfMoreElementTagProcessorsProvided() {
     void shouldNotHandleIfProcessedTagTypeChanged() {
         var processor = mock(ElementTagPostProcessor.class);
         var newTag = mock(IOpenElementTag.class);
-        when(processor.process(new SecureTemplateContext(templateContext), standaloneElementTag))
+        when(processor.process(SecureTemplateContextWrapper.wrap(templateContext),
+            standaloneElementTag))
             .thenReturn(Mono.just(newTag));
         when(extensionGetter.getExtensionList(ElementTagPostProcessor.class))
             .thenReturn(List.of(processor));

From db4e68b732e09a085820e8a562bd40de3bbf605d Mon Sep 17 00:00:00 2001
From: John Niang <johnniang@foxmail.com>
Date: Wed, 16 Oct 2024 17:29:27 +0800
Subject: [PATCH 156/185] Expose user and role services into plugins (#6880)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/kind feature
/area plugin
/milestone 2.20.x

#### What this PR does / why we need it:

This PR exposes user and role services into plugins. Some authentication plugins may interact with users and users' roles.

#### Does this PR introduce a user-facing change?

```release-note
允许在插件中使用 UserService 和 RoleService
```
---
 .../java/run/halo/app/core/user/service/RoleService.java    | 0
 .../java/run/halo/app/core/user/service/SignUpData.java     | 0
 .../java/run/halo/app/core/user/service/UserService.java    | 0
 .../src/main/java/run/halo/app/infra/ValidationUtils.java   | 2 +-
 .../halo/app/plugin/SharedApplicationContextFactory.java    | 6 ++++++
 5 files changed, 7 insertions(+), 1 deletion(-)
 rename {application => api}/src/main/java/run/halo/app/core/user/service/RoleService.java (100%)
 rename {application => api}/src/main/java/run/halo/app/core/user/service/SignUpData.java (100%)
 rename {application => api}/src/main/java/run/halo/app/core/user/service/UserService.java (100%)
 rename {application => api}/src/main/java/run/halo/app/infra/ValidationUtils.java (96%)

diff --git a/application/src/main/java/run/halo/app/core/user/service/RoleService.java b/api/src/main/java/run/halo/app/core/user/service/RoleService.java
similarity index 100%
rename from application/src/main/java/run/halo/app/core/user/service/RoleService.java
rename to api/src/main/java/run/halo/app/core/user/service/RoleService.java
diff --git a/application/src/main/java/run/halo/app/core/user/service/SignUpData.java b/api/src/main/java/run/halo/app/core/user/service/SignUpData.java
similarity index 100%
rename from application/src/main/java/run/halo/app/core/user/service/SignUpData.java
rename to api/src/main/java/run/halo/app/core/user/service/SignUpData.java
diff --git a/application/src/main/java/run/halo/app/core/user/service/UserService.java b/api/src/main/java/run/halo/app/core/user/service/UserService.java
similarity index 100%
rename from application/src/main/java/run/halo/app/core/user/service/UserService.java
rename to api/src/main/java/run/halo/app/core/user/service/UserService.java
diff --git a/application/src/main/java/run/halo/app/infra/ValidationUtils.java b/api/src/main/java/run/halo/app/infra/ValidationUtils.java
similarity index 96%
rename from application/src/main/java/run/halo/app/infra/ValidationUtils.java
rename to api/src/main/java/run/halo/app/infra/ValidationUtils.java
index 9252e2298f..e0b5b16c5d 100644
--- a/application/src/main/java/run/halo/app/infra/ValidationUtils.java
+++ b/api/src/main/java/run/halo/app/infra/ValidationUtils.java
@@ -15,7 +15,7 @@ public class ValidationUtils {
     public static final Pattern NAME_PATTERN = Pattern.compile(NAME_REGEX);
 
     /**
-     * A-Z, a-z, 0-9, !@#$%^&* are allowed.
+     * {@code A-Z, a-z, 0-9, !@#$%^&*} are allowed.
      */
     public static final String PASSWORD_REGEX = "^[A-Za-z0-9!@#$%^&*]+$";
 
diff --git a/application/src/main/java/run/halo/app/plugin/SharedApplicationContextFactory.java b/application/src/main/java/run/halo/app/plugin/SharedApplicationContextFactory.java
index fb264197d5..16da32adbe 100644
--- a/application/src/main/java/run/halo/app/plugin/SharedApplicationContextFactory.java
+++ b/application/src/main/java/run/halo/app/plugin/SharedApplicationContextFactory.java
@@ -8,6 +8,8 @@
 import org.springframework.security.web.server.savedrequest.ServerRequestCache;
 import run.halo.app.content.PostContentService;
 import run.halo.app.core.extension.service.AttachmentService;
+import run.halo.app.core.user.service.RoleService;
+import run.halo.app.core.user.service.UserService;
 import run.halo.app.extension.DefaultSchemeManager;
 import run.halo.app.extension.ExtensionClient;
 import run.halo.app.extension.ReactiveExtensionClient;
@@ -86,6 +88,10 @@ public static ApplicationContext create(ApplicationContext rootContext) {
             .ifUnique(serverRequestCache ->
                 beanFactory.registerSingleton("serverRequestCache", serverRequestCache)
             );
+        rootContext.getBeanProvider(UserService.class)
+            .ifUnique(userService -> beanFactory.registerSingleton("userService", userService));
+        rootContext.getBeanProvider(RoleService.class)
+            .ifUnique(roleService -> beanFactory.registerSingleton("roleService", roleService));
         // TODO add more shared instance here
 
         sharedContext.refresh();

From 514a05552f9d29ece92666fbf508dc813435af7f Mon Sep 17 00:00:00 2001
From: John Niang <johnniang@foxmail.com>
Date: Wed, 16 Oct 2024 18:07:27 +0800
Subject: [PATCH 157/185] Refactor PAT authentication by making it standalone
 (#6878)

#### What type of PR is this?

/kind improvement
/area core
/milestone 2.20.x

#### What this PR does / why we need it:

This PR makes PAT configuration standalone and removes unused configuration related with `JWT`.

After this, we can define additional authentications in plugins with correct configuration order.

#### Does this PR introduce a user-facing change?

```release-note
None
```
---
 .../infra/config/WebServerSecurityConfig.java | 12 ----
 .../SecurityWebFiltersConfigurer.java         |  3 +
 .../jwt/JwtAuthenticationConfigurer.java      | 70 -------------------
 .../jwt/LoginAuthenticationConverter.java     | 37 ----------
 .../LoginAuthenticationFailureHandler.java    | 31 --------
 .../jwt/LoginAuthenticationManager.java       | 19 -----
 .../LoginAuthenticationSuccessHandler.java    | 62 ----------------
 .../pat/PatAuthenticationConverter.java       | 29 ++++++++
 .../pat/PatAuthenticationManager.java         | 28 +++-----
 .../authentication/pat/PatEndpoint.java       |  2 +-
 .../pat/PatSecurityConfigurer.java            | 45 ++++++++++++
 .../pat/PatServerWebExchangeMatcher.java      | 30 --------
 .../{impl => }/UserScopedPatHandlerImpl.java  |  7 +-
 13 files changed, 91 insertions(+), 284 deletions(-)
 delete mode 100644 application/src/main/java/run/halo/app/security/authentication/jwt/JwtAuthenticationConfigurer.java
 delete mode 100644 application/src/main/java/run/halo/app/security/authentication/jwt/LoginAuthenticationConverter.java
 delete mode 100644 application/src/main/java/run/halo/app/security/authentication/jwt/LoginAuthenticationFailureHandler.java
 delete mode 100644 application/src/main/java/run/halo/app/security/authentication/jwt/LoginAuthenticationManager.java
 delete mode 100644 application/src/main/java/run/halo/app/security/authentication/jwt/LoginAuthenticationSuccessHandler.java
 create mode 100644 application/src/main/java/run/halo/app/security/authentication/pat/PatAuthenticationConverter.java
 create mode 100644 application/src/main/java/run/halo/app/security/authentication/pat/PatSecurityConfigurer.java
 delete mode 100644 application/src/main/java/run/halo/app/security/authentication/pat/PatServerWebExchangeMatcher.java
 rename application/src/main/java/run/halo/app/security/authentication/pat/{impl => }/UserScopedPatHandlerImpl.java (97%)

diff --git a/application/src/main/java/run/halo/app/infra/config/WebServerSecurityConfig.java b/application/src/main/java/run/halo/app/infra/config/WebServerSecurityConfig.java
index 6acb689059..b542b6b785 100644
--- a/application/src/main/java/run/halo/app/infra/config/WebServerSecurityConfig.java
+++ b/application/src/main/java/run/halo/app/infra/config/WebServerSecurityConfig.java
@@ -1,6 +1,5 @@
 package run.halo.app.infra.config;
 
-import static org.springframework.security.web.server.authentication.ServerWebExchangeDelegatingReactiveAuthenticationManagerResolver.builder;
 import static org.springframework.security.web.server.util.matcher.ServerWebExchangeMatchers.pathMatchers;
 
 import java.util.concurrent.ConcurrentHashMap;
@@ -33,8 +32,6 @@
 import run.halo.app.security.authentication.CryptoService;
 import run.halo.app.security.authentication.SecurityConfigurer;
 import run.halo.app.security.authentication.impl.RsaKeyService;
-import run.halo.app.security.authentication.pat.PatAuthenticationManager;
-import run.halo.app.security.authentication.pat.PatServerWebExchangeMatcher;
 import run.halo.app.security.authorization.AuthorityUtils;
 import run.halo.app.security.session.InMemoryReactiveIndexedSessionRepository;
 import run.halo.app.security.session.ReactiveIndexedSessionRepository;
@@ -86,15 +83,6 @@ SecurityWebFilterChain filterChain(ServerHttpSecurity http,
                     basic.disable();
                 }
             })
-            .oauth2ResourceServer(oauth2 -> {
-                var authManagerResolver = builder().add(
-                        new PatServerWebExchangeMatcher(),
-                        new PatAuthenticationManager(client, cryptoService)
-                    )
-                    // TODO Add other authentication mangers here. e.g.: JwtAuthenticationManager.
-                    .build();
-                oauth2.authenticationManagerResolver(authManagerResolver);
-            })
             .headers(headerSpec -> headerSpec
                 .frameOptions(frameSpec -> {
                     var frameOptions = haloProperties.getSecurity().getFrameOptions();
diff --git a/application/src/main/java/run/halo/app/security/SecurityWebFiltersConfigurer.java b/application/src/main/java/run/halo/app/security/SecurityWebFiltersConfigurer.java
index 9559b5b037..52a5e1e8d6 100644
--- a/application/src/main/java/run/halo/app/security/SecurityWebFiltersConfigurer.java
+++ b/application/src/main/java/run/halo/app/security/SecurityWebFiltersConfigurer.java
@@ -11,6 +11,7 @@
 import lombok.Setter;
 import org.pf4j.ExtensionPoint;
 import org.springframework.core.annotation.AnnotationAwareOrderComparator;
+import org.springframework.core.annotation.Order;
 import org.springframework.security.config.web.server.ServerHttpSecurity;
 import org.springframework.security.web.server.WebFilterChainProxy;
 import org.springframework.stereotype.Component;
@@ -22,6 +23,8 @@
 import run.halo.app.security.authentication.SecurityConfigurer;
 
 @Component
+// Specific an order here to control the order or security configurer initialization
+@Order(-100)
 public class SecurityWebFiltersConfigurer implements SecurityConfigurer {
 
     private final ExtensionGetter extensionGetter;
diff --git a/application/src/main/java/run/halo/app/security/authentication/jwt/JwtAuthenticationConfigurer.java b/application/src/main/java/run/halo/app/security/authentication/jwt/JwtAuthenticationConfigurer.java
deleted file mode 100644
index 26c18b53d4..0000000000
--- a/application/src/main/java/run/halo/app/security/authentication/jwt/JwtAuthenticationConfigurer.java
+++ /dev/null
@@ -1,70 +0,0 @@
-package run.halo.app.security.authentication.jwt;
-
-import static org.springframework.security.web.server.util.matcher.ServerWebExchangeMatchers.pathMatchers;
-
-import org.springframework.http.HttpMethod;
-import org.springframework.http.MediaType;
-import org.springframework.http.codec.ServerCodecConfigurer;
-import org.springframework.security.config.web.server.SecurityWebFiltersOrder;
-import org.springframework.security.config.web.server.ServerHttpSecurity;
-import org.springframework.security.core.userdetails.ReactiveUserDetailsService;
-import org.springframework.security.crypto.password.PasswordEncoder;
-import org.springframework.security.oauth2.jwt.JwtEncoder;
-import org.springframework.security.web.server.authentication.AuthenticationWebFilter;
-import org.springframework.security.web.server.util.matcher.AndServerWebExchangeMatcher;
-import org.springframework.security.web.server.util.matcher.MediaTypeServerWebExchangeMatcher;
-import org.springframework.web.reactive.function.server.ServerResponse;
-import run.halo.app.infra.properties.JwtProperties;
-import run.halo.app.security.authentication.SecurityConfigurer;
-
-/**
- * TODO: Use It after 2.0.0.
- */
-public class JwtAuthenticationConfigurer implements SecurityConfigurer {
-
-    private final ReactiveUserDetailsService userDetailsService;
-
-    private final PasswordEncoder passwordEncoder;
-
-    private final ServerCodecConfigurer codec;
-
-    private final JwtEncoder jwtEncoder;
-
-    private final ServerResponse.Context context;
-
-    private final JwtProperties jwtProp;
-
-    public JwtAuthenticationConfigurer(ReactiveUserDetailsService userDetailsService,
-        PasswordEncoder passwordEncoder,
-        ServerCodecConfigurer codec,
-        JwtEncoder jwtEncoder,
-        ServerResponse.Context context,
-        JwtProperties jwtProp) {
-        this.userDetailsService = userDetailsService;
-        this.passwordEncoder = passwordEncoder;
-        this.codec = codec;
-        this.jwtEncoder = jwtEncoder;
-        this.context = context;
-        this.jwtProp = jwtProp;
-    }
-
-    @Override
-    public void configure(ServerHttpSecurity http) {
-        var loginManager = new LoginAuthenticationManager(userDetailsService, passwordEncoder);
-
-        var filter = new AuthenticationWebFilter(loginManager);
-        var loginMatcher = new AndServerWebExchangeMatcher(
-            pathMatchers(HttpMethod.POST, "/api/auth/token"),
-            new MediaTypeServerWebExchangeMatcher(MediaType.APPLICATION_JSON)
-        );
-
-        filter.setRequiresAuthenticationMatcher(loginMatcher);
-        filter.setServerAuthenticationConverter(
-            new LoginAuthenticationConverter(codec.getReaders()));
-        filter.setAuthenticationSuccessHandler(
-            new LoginAuthenticationSuccessHandler(jwtEncoder, jwtProp, context));
-        filter.setAuthenticationFailureHandler(new LoginAuthenticationFailureHandler(context));
-
-        http.addFilterAt(filter, SecurityWebFiltersOrder.FORM_LOGIN);
-    }
-}
diff --git a/application/src/main/java/run/halo/app/security/authentication/jwt/LoginAuthenticationConverter.java b/application/src/main/java/run/halo/app/security/authentication/jwt/LoginAuthenticationConverter.java
deleted file mode 100644
index 05d1d00314..0000000000
--- a/application/src/main/java/run/halo/app/security/authentication/jwt/LoginAuthenticationConverter.java
+++ /dev/null
@@ -1,37 +0,0 @@
-package run.halo.app.security.authentication.jwt;
-
-import static org.springframework.security.authentication.UsernamePasswordAuthenticationToken.unauthenticated;
-
-import java.util.List;
-import lombok.Data;
-import org.springframework.http.codec.HttpMessageReader;
-import org.springframework.security.core.Authentication;
-import org.springframework.security.web.server.authentication.ServerAuthenticationConverter;
-import org.springframework.web.reactive.function.server.ServerRequest;
-import org.springframework.web.server.ServerWebExchange;
-import reactor.core.publisher.Mono;
-
-public class LoginAuthenticationConverter implements ServerAuthenticationConverter {
-
-    private final List<HttpMessageReader<?>> reader;
-
-    public LoginAuthenticationConverter(List<HttpMessageReader<?>> reader) {
-        this.reader = reader;
-    }
-
-    @Override
-    public Mono<Authentication> convert(ServerWebExchange exchange) {
-        return ServerRequest.create(exchange, this.reader)
-            .bodyToMono(UsernamePasswordRequest.class)
-            .map(request -> unauthenticated(request.getUsername(), request.getPassword()));
-    }
-
-    @Data
-    public static class UsernamePasswordRequest {
-
-        private String username;
-
-        private String password;
-
-    }
-}
diff --git a/application/src/main/java/run/halo/app/security/authentication/jwt/LoginAuthenticationFailureHandler.java b/application/src/main/java/run/halo/app/security/authentication/jwt/LoginAuthenticationFailureHandler.java
deleted file mode 100644
index 8078a2ea5d..0000000000
--- a/application/src/main/java/run/halo/app/security/authentication/jwt/LoginAuthenticationFailureHandler.java
+++ /dev/null
@@ -1,31 +0,0 @@
-package run.halo.app.security.authentication.jwt;
-
-import java.util.Map;
-import org.springframework.http.MediaType;
-import org.springframework.security.core.AuthenticationException;
-import org.springframework.security.web.server.WebFilterExchange;
-import org.springframework.security.web.server.authentication.ServerAuthenticationFailureHandler;
-import org.springframework.web.reactive.function.server.ServerResponse;
-import reactor.core.publisher.Mono;
-
-public class LoginAuthenticationFailureHandler implements ServerAuthenticationFailureHandler {
-
-    private final ServerResponse.Context context;
-
-    public LoginAuthenticationFailureHandler(ServerResponse.Context context) {
-        this.context = context;
-    }
-
-    @Override
-    public Mono<Void> onAuthenticationFailure(WebFilterExchange webFilterExchange,
-        AuthenticationException exception) {
-        return ServerResponse.badRequest()
-            .contentType(MediaType.APPLICATION_JSON)
-            .bodyValue(
-                Map.of("error", exception.getLocalizedMessage())
-            )
-            .flatMap(serverResponse ->
-                serverResponse.writeTo(webFilterExchange.getExchange(), context));
-    }
-
-}
diff --git a/application/src/main/java/run/halo/app/security/authentication/jwt/LoginAuthenticationManager.java b/application/src/main/java/run/halo/app/security/authentication/jwt/LoginAuthenticationManager.java
deleted file mode 100644
index a5b3ce3156..0000000000
--- a/application/src/main/java/run/halo/app/security/authentication/jwt/LoginAuthenticationManager.java
+++ /dev/null
@@ -1,19 +0,0 @@
-package run.halo.app.security.authentication.jwt;
-
-import org.springframework.security.authentication.UserDetailsRepositoryReactiveAuthenticationManager;
-import org.springframework.security.core.userdetails.ReactiveUserDetailsPasswordService;
-import org.springframework.security.core.userdetails.ReactiveUserDetailsService;
-import org.springframework.security.crypto.password.PasswordEncoder;
-
-public final class LoginAuthenticationManager
-    extends UserDetailsRepositoryReactiveAuthenticationManager {
-
-    public LoginAuthenticationManager(ReactiveUserDetailsService userDetailsService,
-        PasswordEncoder passwordEncoder) {
-        super(userDetailsService);
-        super.setPasswordEncoder(passwordEncoder);
-        if (userDetailsService instanceof ReactiveUserDetailsPasswordService passwordService) {
-            super.setUserDetailsPasswordService(passwordService);
-        }
-    }
-}
diff --git a/application/src/main/java/run/halo/app/security/authentication/jwt/LoginAuthenticationSuccessHandler.java b/application/src/main/java/run/halo/app/security/authentication/jwt/LoginAuthenticationSuccessHandler.java
deleted file mode 100644
index 6ec9161a1b..0000000000
--- a/application/src/main/java/run/halo/app/security/authentication/jwt/LoginAuthenticationSuccessHandler.java
+++ /dev/null
@@ -1,62 +0,0 @@
-package run.halo.app.security.authentication.jwt;
-
-import java.time.Instant;
-import java.time.temporal.ChronoUnit;
-import java.util.Map;
-import java.util.stream.Collectors;
-import org.springframework.http.MediaType;
-import org.springframework.security.core.Authentication;
-import org.springframework.security.core.GrantedAuthority;
-import org.springframework.security.oauth2.jwt.JwsHeader;
-import org.springframework.security.oauth2.jwt.JwtClaimsSet;
-import org.springframework.security.oauth2.jwt.JwtEncoder;
-import org.springframework.security.oauth2.jwt.JwtEncoderParameters;
-import org.springframework.security.web.server.WebFilterExchange;
-import org.springframework.security.web.server.authentication.ServerAuthenticationSuccessHandler;
-import org.springframework.web.reactive.function.server.ServerResponse;
-import reactor.core.publisher.Mono;
-import run.halo.app.infra.properties.JwtProperties;
-
-public class LoginAuthenticationSuccessHandler implements ServerAuthenticationSuccessHandler {
-
-    private final JwtEncoder jwtEncoder;
-
-    private final JwtProperties jwtProp;
-
-    private final ServerResponse.Context context;
-
-    public LoginAuthenticationSuccessHandler(JwtEncoder jwtEncoder, JwtProperties jwtProp,
-        ServerResponse.Context context) {
-        this.jwtEncoder = jwtEncoder;
-        this.jwtProp = jwtProp;
-        this.context = context;
-    }
-
-    @Override
-    public Mono<Void> onAuthenticationSuccess(WebFilterExchange webFilterExchange,
-        Authentication authentication) {
-        var issuedAt = Instant.now();
-        // TODO Make the expiresAt configurable
-        var expiresAt = issuedAt.plus(24, ChronoUnit.HOURS);
-        var headers = JwsHeader.with(jwtProp.getJwsAlgorithm()).build();
-        var claims = JwtClaimsSet.builder()
-            .issuer("Halo Owner")
-            .issuedAt(issuedAt)
-            .expiresAt(expiresAt)
-            // the principal is the username
-            .subject(authentication.getName())
-            .claim("scope", authentication.getAuthorities().stream()
-                .map(GrantedAuthority::getAuthority)
-                .collect(Collectors.toList()))
-            .build();
-
-        var jwt = jwtEncoder.encode(JwtEncoderParameters.from(headers, claims));
-
-        return ServerResponse.ok()
-            .contentType(MediaType.APPLICATION_JSON)
-            .bodyValue(Map.of("token", jwt.getTokenValue()))
-            .flatMap(serverResponse -> serverResponse.writeTo(webFilterExchange.getExchange(),
-                this.context));
-    }
-
-}
diff --git a/application/src/main/java/run/halo/app/security/authentication/pat/PatAuthenticationConverter.java b/application/src/main/java/run/halo/app/security/authentication/pat/PatAuthenticationConverter.java
new file mode 100644
index 0000000000..ab5ec828ac
--- /dev/null
+++ b/application/src/main/java/run/halo/app/security/authentication/pat/PatAuthenticationConverter.java
@@ -0,0 +1,29 @@
+package run.halo.app.security.authentication.pat;
+
+import org.apache.commons.lang3.StringUtils;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.oauth2.server.resource.authentication.BearerTokenAuthenticationToken;
+import org.springframework.security.oauth2.server.resource.web.server.authentication.ServerBearerTokenAuthenticationConverter;
+import org.springframework.web.server.ServerWebExchange;
+import reactor.core.publisher.Mono;
+
+/**
+ * PAT authentication converter.
+ *
+ * @author johnniang
+ * @since 2.20.4
+ */
+class PatAuthenticationConverter extends ServerBearerTokenAuthenticationConverter {
+
+    public static final String PAT_TOKEN_PREFIX = "pat_";
+
+    @Override
+    public Mono<Authentication> convert(ServerWebExchange exchange) {
+        return super.convert(exchange)
+            .cast(BearerTokenAuthenticationToken.class)
+            .map(BearerTokenAuthenticationToken::getToken)
+            .filter(token -> StringUtils.startsWith(token, PAT_TOKEN_PREFIX))
+            .map(token -> StringUtils.removeStart(token, PAT_TOKEN_PREFIX))
+            .map(BearerTokenAuthenticationToken::new);
+    }
+}
diff --git a/application/src/main/java/run/halo/app/security/authentication/pat/PatAuthenticationManager.java b/application/src/main/java/run/halo/app/security/authentication/pat/PatAuthenticationManager.java
index 9cd8860038..5f4c9c66ce 100644
--- a/application/src/main/java/run/halo/app/security/authentication/pat/PatAuthenticationManager.java
+++ b/application/src/main/java/run/halo/app/security/authentication/pat/PatAuthenticationManager.java
@@ -1,8 +1,6 @@
 package run.halo.app.security.authentication.pat;
 
-import static org.apache.commons.lang3.StringUtils.removeStart;
 import static org.springframework.security.oauth2.jwt.NimbusReactiveJwtDecoder.withJwkSource;
-import static run.halo.app.security.authentication.pat.PatServerWebExchangeMatcher.PAT_TOKEN_PREFIX;
 import static run.halo.app.security.authorization.AuthorityUtils.ANONYMOUS_ROLE_NAME;
 import static run.halo.app.security.authorization.AuthorityUtils.AUTHENTICATED_ROLE_NAME;
 import static run.halo.app.security.authorization.AuthorityUtils.ROLE_PREFIX;
@@ -18,7 +16,6 @@
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.authority.SimpleGrantedAuthority;
 import org.springframework.security.oauth2.server.resource.InvalidBearerTokenException;
-import org.springframework.security.oauth2.server.resource.authentication.BearerTokenAuthenticationToken;
 import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationToken;
 import org.springframework.security.oauth2.server.resource.authentication.JwtReactiveAuthenticationManager;
 import reactor.core.publisher.Flux;
@@ -30,14 +27,14 @@
 import run.halo.app.security.authentication.CryptoService;
 import run.halo.app.security.authorization.AuthorityUtils;
 
-public class PatAuthenticationManager implements ReactiveAuthenticationManager {
+class PatAuthenticationManager implements ReactiveAuthenticationManager {
 
     /**
      * Minimal duration gap of personal access token update.
      */
     private static final Duration MIN_UPDATE_GAP = Duration.ofMinutes(1);
 
-    private final ReactiveAuthenticationManager delegate;
+    private final JwtReactiveAuthenticationManager delegate;
 
     private final ReactiveExtensionClient client;
 
@@ -52,33 +49,28 @@ public PatAuthenticationManager(ReactiveExtensionClient client, CryptoService cr
         this.clock = Clock.systemDefaultZone();
     }
 
-    private ReactiveAuthenticationManager getDelegate() {
+    private JwtReactiveAuthenticationManager getDelegate() {
         var jwtDecoder = withJwkSource(signedJWT -> Flux.just(cryptoService.getJwk()))
             .build();
         return new JwtReactiveAuthenticationManager(jwtDecoder);
     }
 
-    public void setClock(Clock clock) {
+    /**
+     * Set new clock. Only for testing.
+     *
+     * @param clock new clock
+     */
+    void setClock(Clock clock) {
         this.clock = clock;
     }
 
     @Override
     public Mono<Authentication> authenticate(Authentication authentication) {
-        return Mono.just(authentication)
-            .map(this::clearPrefix)
-            .flatMap(delegate::authenticate)
+        return delegate.authenticate(authentication)
             .cast(JwtAuthenticationToken.class)
             .flatMap(this::checkAndRebuild);
     }
 
-    private Authentication clearPrefix(Authentication authentication) {
-        if (authentication instanceof BearerTokenAuthenticationToken bearerToken) {
-            var newToken = removeStart(bearerToken.getToken(), PAT_TOKEN_PREFIX);
-            return new BearerTokenAuthenticationToken(newToken);
-        }
-        return authentication;
-    }
-
     private Mono<JwtAuthenticationToken> checkAndRebuild(JwtAuthenticationToken jat) {
         var jwt = jat.getToken();
         var patName = jwt.getClaimAsString("pat_name");
diff --git a/application/src/main/java/run/halo/app/security/authentication/pat/PatEndpoint.java b/application/src/main/java/run/halo/app/security/authentication/pat/PatEndpoint.java
index 62d1c0a27c..0a1578b3aa 100644
--- a/application/src/main/java/run/halo/app/security/authentication/pat/PatEndpoint.java
+++ b/application/src/main/java/run/halo/app/security/authentication/pat/PatEndpoint.java
@@ -15,7 +15,7 @@
 import run.halo.app.security.PersonalAccessToken;
 
 @Component
-public class PatEndpoint implements CustomEndpoint {
+class PatEndpoint implements CustomEndpoint {
 
     private final UserScopedPatHandler patHandler;
 
diff --git a/application/src/main/java/run/halo/app/security/authentication/pat/PatSecurityConfigurer.java b/application/src/main/java/run/halo/app/security/authentication/pat/PatSecurityConfigurer.java
new file mode 100644
index 0000000000..275f2ae92f
--- /dev/null
+++ b/application/src/main/java/run/halo/app/security/authentication/pat/PatSecurityConfigurer.java
@@ -0,0 +1,45 @@
+package run.halo.app.security.authentication.pat;
+
+import org.springframework.core.annotation.Order;
+import org.springframework.security.config.web.server.SecurityWebFiltersOrder;
+import org.springframework.security.config.web.server.ServerHttpSecurity;
+import org.springframework.security.oauth2.server.resource.web.server.BearerTokenServerAuthenticationEntryPoint;
+import org.springframework.security.web.server.authentication.AuthenticationWebFilter;
+import org.springframework.security.web.server.authentication.ServerAuthenticationEntryPointFailureHandler;
+import org.springframework.stereotype.Component;
+import run.halo.app.extension.ReactiveExtensionClient;
+import run.halo.app.security.authentication.CryptoService;
+import run.halo.app.security.authentication.SecurityConfigurer;
+
+/**
+ * PAT security configurer.
+ *
+ * @author johnniang
+ * @since 2.20.4
+ */
+@Component
+// Specific an order here to control the order or security configurer initialization
+@Order(0)
+class PatSecurityConfigurer implements SecurityConfigurer {
+
+    private final ReactiveExtensionClient client;
+
+    private final CryptoService cryptoService;
+
+    public PatSecurityConfigurer(ReactiveExtensionClient client, CryptoService cryptoService) {
+        this.client = client;
+        this.cryptoService = cryptoService;
+    }
+
+    @Override
+    public void configure(ServerHttpSecurity http) {
+        var filter =
+            new AuthenticationWebFilter(new PatAuthenticationManager(client, cryptoService));
+        filter.setServerAuthenticationConverter(new PatAuthenticationConverter());
+        var entryPoint = new BearerTokenServerAuthenticationEntryPoint();
+        var failureHandler = new ServerAuthenticationEntryPointFailureHandler(entryPoint);
+        filter.setAuthenticationFailureHandler(failureHandler);
+        http.addFilterAt(filter, SecurityWebFiltersOrder.AUTHENTICATION);
+    }
+
+}
diff --git a/application/src/main/java/run/halo/app/security/authentication/pat/PatServerWebExchangeMatcher.java b/application/src/main/java/run/halo/app/security/authentication/pat/PatServerWebExchangeMatcher.java
deleted file mode 100644
index 4d8a7e1772..0000000000
--- a/application/src/main/java/run/halo/app/security/authentication/pat/PatServerWebExchangeMatcher.java
+++ /dev/null
@@ -1,30 +0,0 @@
-package run.halo.app.security.authentication.pat;
-
-import org.apache.commons.lang3.StringUtils;
-import org.springframework.security.core.AuthenticationException;
-import org.springframework.security.oauth2.server.resource.authentication.BearerTokenAuthenticationToken;
-import org.springframework.security.oauth2.server.resource.web.server.authentication.ServerBearerTokenAuthenticationConverter;
-import org.springframework.security.web.server.authentication.ServerAuthenticationConverter;
-import org.springframework.security.web.server.util.matcher.ServerWebExchangeMatcher;
-import org.springframework.web.server.ServerWebExchange;
-import reactor.core.publisher.Mono;
-
-public class PatServerWebExchangeMatcher implements ServerWebExchangeMatcher {
-
-    public static final String PAT_TOKEN_PREFIX = "pat_";
-
-    private final ServerAuthenticationConverter authConverter =
-        new ServerBearerTokenAuthenticationConverter();
-
-    @Override
-    public Mono<MatchResult> matches(ServerWebExchange exchange) {
-        return authConverter.convert(exchange)
-            .filter(a -> a instanceof BearerTokenAuthenticationToken)
-            .cast(BearerTokenAuthenticationToken.class)
-            .map(BearerTokenAuthenticationToken::getToken)
-            .filter(tokenString -> StringUtils.startsWith(tokenString, PAT_TOKEN_PREFIX))
-            .flatMap(t -> MatchResult.match())
-            .onErrorResume(AuthenticationException.class, t -> MatchResult.notMatch())
-            .switchIfEmpty(Mono.defer(MatchResult::notMatch));
-    }
-}
diff --git a/application/src/main/java/run/halo/app/security/authentication/pat/impl/UserScopedPatHandlerImpl.java b/application/src/main/java/run/halo/app/security/authentication/pat/UserScopedPatHandlerImpl.java
similarity index 97%
rename from application/src/main/java/run/halo/app/security/authentication/pat/impl/UserScopedPatHandlerImpl.java
rename to application/src/main/java/run/halo/app/security/authentication/pat/UserScopedPatHandlerImpl.java
index 9a40919d49..ce71890ab0 100644
--- a/application/src/main/java/run/halo/app/security/authentication/pat/impl/UserScopedPatHandlerImpl.java
+++ b/application/src/main/java/run/halo/app/security/authentication/pat/UserScopedPatHandlerImpl.java
@@ -1,7 +1,7 @@
-package run.halo.app.security.authentication.pat.impl;
+package run.halo.app.security.authentication.pat;
 
 import static run.halo.app.extension.Comparators.compareCreationTimestamp;
-import static run.halo.app.security.authentication.pat.PatServerWebExchangeMatcher.PAT_TOKEN_PREFIX;
+import static run.halo.app.security.authentication.pat.PatAuthenticationConverter.PAT_TOKEN_PREFIX;
 
 import com.nimbusds.jose.jwk.JWKSet;
 import com.nimbusds.jose.jwk.source.ImmutableJWKSet;
@@ -41,11 +41,10 @@
 import run.halo.app.infra.exception.NotFoundException;
 import run.halo.app.security.PersonalAccessToken;
 import run.halo.app.security.authentication.CryptoService;
-import run.halo.app.security.authentication.pat.UserScopedPatHandler;
 import run.halo.app.security.authorization.AuthorityUtils;
 
 @Service
-public class UserScopedPatHandlerImpl implements UserScopedPatHandler {
+class UserScopedPatHandlerImpl implements UserScopedPatHandler {
 
     private static final String ACCESS_TOKEN_ANNO_NAME = "security.halo.run/access-token";
 

From 8df91e80b3e44dda773a899670375033b7a9d729 Mon Sep 17 00:00:00 2001
From: Ryan Wang <i@ryanc.cc>
Date: Wed, 16 Oct 2024 21:59:27 +0800
Subject: [PATCH 158/185] chore: bump app store plugin version (#6881)

#### What type of PR is this?

/area core
/kind improvement
/milestone 2.20.x

#### What this PR does / why we need it:

Bump app store plugin to 1.6.0

#### Does this PR introduce a user-facing change?

```release-note
None
```
---
 application/build.gradle | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/application/build.gradle b/application/build.gradle
index 47c9d9168c..05ffad7454 100644
--- a/application/build.gradle
+++ b/application/build.gradle
@@ -128,7 +128,7 @@ ext.presetPluginUrls = [
         // Currently, plugin-app-store is not open source, so we need to download it from the official website.
         // Please see https://github.com/halo-dev/plugin-app-store/issues/55
         // https://www.halo.run/store/apps/app-VYJbF
-        'https://www.halo.run/store/apps/app-VYJbF/releases/download/app-release-CZSAd/assets/app-release-CZSAd-KZEqI': 'appstore.jar',
+        'https://www.halo.run/store/apps/app-VYJbF/releases/download/app-release-dEEUO/assets/app-release-dEEUO-ZRgkG': 'appstore.jar',
 ]
 
 tasks.register('downloadPluginPresets', Download) {

From 02def4e20afbef7c5e2901f4cd8507816cb4441d Mon Sep 17 00:00:00 2001
From: John Niang <johnniang@foxmail.com>
Date: Thu, 17 Oct 2024 10:43:30 +0800
Subject: [PATCH 159/185] Expose ReactiveUserDetailsService to authentication
 plugins (#6885)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/kind improvement
/area core
/milestone 2.20.x

#### What this PR does / why we need it:

This PR exposes ReactiveUserDetailsService to authentication plugins.

#### Does this PR introduce a user-facing change?

```release-note
支持在插件中使用 ReactiveUserDetailsService
```
---
 .../run/halo/app/plugin/SharedApplicationContextFactory.java | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/application/src/main/java/run/halo/app/plugin/SharedApplicationContextFactory.java b/application/src/main/java/run/halo/app/plugin/SharedApplicationContextFactory.java
index 16da32adbe..e8e23316c7 100644
--- a/application/src/main/java/run/halo/app/plugin/SharedApplicationContextFactory.java
+++ b/application/src/main/java/run/halo/app/plugin/SharedApplicationContextFactory.java
@@ -4,6 +4,7 @@
 import org.springframework.cache.CacheManager;
 import org.springframework.context.ApplicationContext;
 import org.springframework.context.support.GenericApplicationContext;
+import org.springframework.security.core.userdetails.ReactiveUserDetailsService;
 import org.springframework.security.web.server.context.ServerSecurityContextRepository;
 import org.springframework.security.web.server.savedrequest.ServerRequestCache;
 import run.halo.app.content.PostContentService;
@@ -92,6 +93,10 @@ public static ApplicationContext create(ApplicationContext rootContext) {
             .ifUnique(userService -> beanFactory.registerSingleton("userService", userService));
         rootContext.getBeanProvider(RoleService.class)
             .ifUnique(roleService -> beanFactory.registerSingleton("roleService", roleService));
+        rootContext.getBeanProvider(ReactiveUserDetailsService.class)
+            .ifUnique(userDetailsService ->
+                beanFactory.registerSingleton("userDetailsService", userDetailsService)
+            );
         // TODO add more shared instance here
 
         sharedContext.refresh();

From c465bf8c75266af5e77e368c4ddb87e2e231516d Mon Sep 17 00:00:00 2001
From: guqing <38999863+guqing@users.noreply.github.com>
Date: Thu, 17 Oct 2024 16:45:30 +0800
Subject: [PATCH 160/185] fix: prevent initialization failure when theme
 directory already exists (#6889)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?
/kind bug
/area core
/milestone 2.20.x

#### What this PR does / why we need it:
修复从旧版本升级到 2.20 会因为默认主题目录已经存在而无法初始化的问题

#### Which issue(s) this PR fixes:
Fixes #6887

#### Does this PR introduce a user-facing change?
```release-note
修复从旧版本升级到 2.20 会因为默认主题目录已经存在而无法初始化的问题
```
---
 .../java/run/halo/app/theme/service/ThemeServiceImpl.java    | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/application/src/main/java/run/halo/app/theme/service/ThemeServiceImpl.java b/application/src/main/java/run/halo/app/theme/service/ThemeServiceImpl.java
index 37a7b142d5..1b6494b708 100644
--- a/application/src/main/java/run/halo/app/theme/service/ThemeServiceImpl.java
+++ b/application/src/main/java/run/halo/app/theme/service/ThemeServiceImpl.java
@@ -47,6 +47,7 @@
 import run.halo.app.extension.Unstructured;
 import run.halo.app.infra.SystemVersionSupplier;
 import run.halo.app.infra.ThemeRootGetter;
+import run.halo.app.infra.exception.ThemeAlreadyExistsException;
 import run.halo.app.infra.exception.ThemeUpgradeException;
 import run.halo.app.infra.exception.UnsatisfiedAttributeValueException;
 import run.halo.app.infra.properties.HaloProperties;
@@ -86,6 +87,10 @@ public Mono<Void> installPresetTheme() {
                 log.warn("Failed to initialize theme from {}", location, e);
                 return Mono.empty();
             })
+            .onErrorResume(ThemeAlreadyExistsException.class, e -> {
+                log.warn("Failed to initialize theme from {}, because it already exists", location);
+                return Mono.empty();
+            })
             .then();
     }
 

From 697a5e5a4c768415e5613758c76606652ae49afb Mon Sep 17 00:00:00 2001
From: John Niang <johnniang@foxmail.com>
Date: Fri, 18 Oct 2024 15:29:37 +0800
Subject: [PATCH 161/185] Fix the problem of not redirecting to corresponding
 login page after authentication failure (#6896)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/kind bug
/area core
/milestone 2.20.x

#### What this PR does / why we need it:

This PR appends query `method=local` after redirection location in authentication failure handler to redirect to login page with local method.

#### Which issue(s) this PR fixes:

Fixes https://github.com/halo-dev/halo/issues/6894

#### Does this PR introduce a user-facing change?

```release-note
修复非默认登录方式登录失败之后跳转至默认登录方式的问题
```
---
 .../authentication/login/UsernamePasswordHandler.java       | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/application/src/main/java/run/halo/app/security/authentication/login/UsernamePasswordHandler.java b/application/src/main/java/run/halo/app/security/authentication/login/UsernamePasswordHandler.java
index 9fb3443529..dd20aa7017 100644
--- a/application/src/main/java/run/halo/app/security/authentication/login/UsernamePasswordHandler.java
+++ b/application/src/main/java/run/halo/app/security/authentication/login/UsernamePasswordHandler.java
@@ -65,12 +65,12 @@ public Mono<Void> onAuthenticationFailure(WebFilterExchange webFilterExchange,
                 .filter(ServerWebExchangeMatcher.MatchResult::isMatch)
                 .switchIfEmpty(Mono.defer(
                     () -> {
-                        URI location = URI.create("/login?error");
+                        URI location = URI.create("/login?error&method=local");
                         if (exception instanceof BadCredentialsException) {
-                            location = URI.create("/login?error=invalid-credential");
+                            location = URI.create("/login?error=invalid-credential&method=local");
                         }
                         if (exception instanceof TooManyRequestsException) {
-                            location = URI.create("/login?error=rate-limit-exceeded");
+                            location = URI.create("/login?error=rate-limit-exceeded&method=local");
                         }
                         return redirectStrategy.sendRedirect(exchange, location);
                     }).then(Mono.empty())

From 3570353ce2da95dd073cb2be2f2680c569daa154 Mon Sep 17 00:00:00 2001
From: John Niang <johnniang@foxmail.com>
Date: Fri, 18 Oct 2024 15:55:39 +0800
Subject: [PATCH 162/185] Bind sign up data instead of building by hand (#6895)

#### What type of PR is this?

/kind improvement
/area core
/milestone 2.20.x

#### What this PR does / why we need it:

This PR refactors sign up data binding using internal `bind` method in `ServerRequest` instead of binding my hand. It's more convenient and simpler.

#### Does this PR introduce a user-facing change?

```release-note
None
```
---
 .../app/core/user/service/SignUpData.java     | 32 -------------------
 .../preauth/PreAuthSignUpEndpoint.java        |  3 +-
 2 files changed, 1 insertion(+), 34 deletions(-)

diff --git a/api/src/main/java/run/halo/app/core/user/service/SignUpData.java b/api/src/main/java/run/halo/app/core/user/service/SignUpData.java
index e3d07a99fb..7fab3d4ccc 100644
--- a/api/src/main/java/run/halo/app/core/user/service/SignUpData.java
+++ b/api/src/main/java/run/halo/app/core/user/service/SignUpData.java
@@ -13,10 +13,7 @@
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;
 import java.util.Objects;
-import java.util.Optional;
 import lombok.Data;
-import org.springframework.util.MultiValueMap;
-import org.springframework.util.StringUtils;
 import run.halo.app.infra.ValidationUtils;
 
 /**
@@ -52,35 +49,6 @@ public class SignUpData {
     @NotBlank
     private String confirmPassword;
 
-    public static SignUpData of(MultiValueMap<String, String> formData) {
-        var form = new SignUpData();
-        Optional.ofNullable(formData.getFirst("username"))
-            .filter(StringUtils::hasText)
-            .ifPresent(form::setUsername);
-
-        Optional.ofNullable(formData.getFirst("displayName"))
-            .filter(StringUtils::hasText)
-            .ifPresent(form::setDisplayName);
-
-        Optional.ofNullable(formData.getFirst("email"))
-            .filter(StringUtils::hasText)
-            .ifPresent(form::setEmail);
-
-        Optional.ofNullable(formData.getFirst("password"))
-            .filter(StringUtils::hasText)
-            .ifPresent(form::setPassword);
-
-        Optional.ofNullable(formData.getFirst("emailCode"))
-            .filter(StringUtils::hasText)
-            .ifPresent(form::setEmailCode);
-
-        Optional.ofNullable(formData.getFirst("confirmPassword"))
-            .filter(StringUtils::hasText)
-            .ifPresent(form::setConfirmPassword);
-
-        return form;
-    }
-
     @Target({ElementType.TYPE})
     @Retention(RetentionPolicy.RUNTIME)
     @Constraint(validatedBy = {SignUpDataConstraintValidator.class})
diff --git a/application/src/main/java/run/halo/app/security/preauth/PreAuthSignUpEndpoint.java b/application/src/main/java/run/halo/app/security/preauth/PreAuthSignUpEndpoint.java
index b653250b29..57595adc84 100644
--- a/application/src/main/java/run/halo/app/security/preauth/PreAuthSignUpEndpoint.java
+++ b/application/src/main/java/run/halo/app/security/preauth/PreAuthSignUpEndpoint.java
@@ -79,8 +79,7 @@ RouterFunction<ServerResponse> preAuthSignUpEndpoints() {
             .POST(
                 "",
                 contentType(APPLICATION_FORM_URLENCODED),
-                request -> request.formData()
-                    .map(SignUpData::of)
+                request -> request.bind(SignUpData.class)
                     .flatMap(signUpData -> {
                         // sign up
                         var bindingResult = validate(signUpData, validator, request.exchange());

From 13644d21eb73f32cb87fbadbfd3a0aec882639f2 Mon Sep 17 00:00:00 2001
From: guqing <38999863+guqing@users.noreply.github.com>
Date: Fri, 18 Oct 2024 17:47:37 +0800
Subject: [PATCH 163/185] fix: language preference is not remembered under
 non-HTTPS connections (#6891)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?
/kind bug
/area core
/milestone 2.20.x

#### What this PR does / why we need it:
修复非 HTTPS 连接下无法记住用户语言偏好的问题

#### Which issue(s) this PR fixes:
Fixes #6888

#### Does this PR introduce a user-facing change?
```release-note
修复非 HTTPS 连接下无法记住用户语言偏好的问题
```
---
 .../infra/webfilter/LocaleChangeWebFilter.java   | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/application/src/main/java/run/halo/app/infra/webfilter/LocaleChangeWebFilter.java b/application/src/main/java/run/halo/app/infra/webfilter/LocaleChangeWebFilter.java
index 1da379c13e..d4bd8e661f 100644
--- a/application/src/main/java/run/halo/app/infra/webfilter/LocaleChangeWebFilter.java
+++ b/application/src/main/java/run/halo/app/infra/webfilter/LocaleChangeWebFilter.java
@@ -45,15 +45,19 @@ public Mono<Void> filter(ServerWebExchange exchange, WebFilterChain chain) {
                     .getFirst(LANGUAGE_PARAMETER_NAME);
                 if (StringUtils.hasText(language)) {
                     var locale = Locale.forLanguageTag(language);
-                    exchange.getResponse()
-                        .addCookie(ResponseCookie.from(LANGUAGE_COOKIE_NAME, locale.toLanguageTag())
-                            .path("/")
-                            .secure(true)
-                            .build()
-                        );
+                    setLanguageCookie(exchange, locale);
                 }
             })
             .then(Mono.defer(() -> chain.filter(exchange)));
     }
 
+    void setLanguageCookie(ServerWebExchange exchange, Locale locale) {
+        var cookie = ResponseCookie.from(LANGUAGE_COOKIE_NAME, locale.toLanguageTag())
+            .path("/")
+            .httpOnly(true)
+            .secure("https".equalsIgnoreCase(exchange.getRequest().getURI().getScheme()))
+            .sameSite("Lax")
+            .build();
+        exchange.getResponse().getCookies().set(LANGUAGE_COOKIE_NAME, cookie);
+    }
 }

From 833b884bdb409f31ed5845ae2668ffd194312263 Mon Sep 17 00:00:00 2001
From: guqing <38999863+guqing@users.noreply.github.com>
Date: Fri, 18 Oct 2024 17:49:38 +0800
Subject: [PATCH 164/185] fix: modify name column charset to make it
 case-sensitive for MySQL (#6897)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?
/kind improvement
/area core
/milestone 2.20.x

#### What this PR does / why we need it:
将 MySQL 的表创建脚本 name 列字符集改为 utf8mb4_bin 以使其对大小写敏感

Fixes https://github.com/halo-dev/halo/issues/4372

**how to test it?**
使用 docker 运行 MySQL
```shell
# mariadb 同样将镜像改为 mariadb 后执行相同步骤
docker run --name mysql-test -e MYSQL_ROOT_PASSWORD=root -e MYSQL_DATABASE=halo -p 3306:3306 --rm -d mysql:latest
```
然后执行表创建脚本并手动执行以下两条 SQL 能成功插入
```sql
insert into extensions(name,data,version) values('a', 'a', 0)
insert into extensions(name,data,version) values('A', 'A', 0)
```

#### Does this PR introduce a user-facing change?
```release-note
修改 MySQL 表创建脚本 name 列的字符集使其大小写敏感以解决可能会遇到切换数据库时因为数据冲突而无法导入备份的问题（这只对此版本及之后的新用户有效）
```
---
 application/src/main/resources/schema-mariadb.sql | 2 +-
 application/src/main/resources/schema-mysql.sql   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/application/src/main/resources/schema-mariadb.sql b/application/src/main/resources/schema-mariadb.sql
index 370cb7ca09..9df635750a 100644
--- a/application/src/main/resources/schema-mariadb.sql
+++ b/application/src/main/resources/schema-mariadb.sql
@@ -1,6 +1,6 @@
 create table if not exists extensions
 (
-    name    varchar(255) not null,
+    name    varchar(255) not null COLLATE utf8mb4_bin,
     data    longblob,
     version bigint,
     primary key (name)
diff --git a/application/src/main/resources/schema-mysql.sql b/application/src/main/resources/schema-mysql.sql
index 370cb7ca09..9df635750a 100644
--- a/application/src/main/resources/schema-mysql.sql
+++ b/application/src/main/resources/schema-mysql.sql
@@ -1,6 +1,6 @@
 create table if not exists extensions
 (
-    name    varchar(255) not null,
+    name    varchar(255) not null COLLATE utf8mb4_bin,
     data    longblob,
     version bigint,
     primary key (name)

From 500f702e02274c4ebba7b423ecb436d7930e987b Mon Sep 17 00:00:00 2001
From: Ryan Wang <i@ryanc.cc>
Date: Sat, 19 Oct 2024 23:58:44 +0800
Subject: [PATCH 165/185] fix: can not return to post list after publishing
 when re-logged in (#6902)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/area ui
/kind bug
/milestone 2.20.x

#### What this PR does / why we need it:

修复通过登录跳转到文章编辑页面时，发布文章会跳转到个人中心的问题。

#### Which issue(s) this PR fixes:

Fixes #6901

#### Special notes for your reviewer:

测试步骤：

1. 新建文章，编写内容，但是不发布
2. 在新的浏览器选项卡中退出登录
3. 回到文章编辑页面，跳转到登录页面重新登录之后，发布文章
4. 观察是否会返回到 Console 的文章管理页面。

#### Does this PR introduce a user-facing change?

```release-note
修复通过登录跳转到文章编辑页面时，发布文章会跳转到个人中心的问题。
```
---
 ui/console-src/modules/contents/pages/SinglePageEditor.vue | 2 +-
 ui/console-src/modules/contents/posts/PostEditor.vue       | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/ui/console-src/modules/contents/pages/SinglePageEditor.vue b/ui/console-src/modules/contents/pages/SinglePageEditor.vue
index 6287f2e5ce..5615d6102f 100644
--- a/ui/console-src/modules/contents/pages/SinglePageEditor.vue
+++ b/ui/console-src/modules/contents/pages/SinglePageEditor.vue
@@ -223,7 +223,7 @@ const handlePublish = async () => {
       if (returnToView.value && permalink) {
         window.location.href = permalink;
       } else {
-        router.back();
+        router.push({ name: "SinglePages" });
       }
     } else {
       formState.value.page.spec.publish = true;
diff --git a/ui/console-src/modules/contents/posts/PostEditor.vue b/ui/console-src/modules/contents/posts/PostEditor.vue
index f55527c48c..cd783c4973 100644
--- a/ui/console-src/modules/contents/posts/PostEditor.vue
+++ b/ui/console-src/modules/contents/posts/PostEditor.vue
@@ -236,7 +236,7 @@ const handlePublish = async () => {
       if (returnToView.value === "true" && permalink) {
         window.location.href = permalink;
       } else {
-        router.back();
+        router.push({ name: "Posts" });
       }
     } else {
       const { data } = await consoleApiClient.content.post.draftPost({

From 53b291b54eab4e7efd5ef074a25e71d358b43dab Mon Sep 17 00:00:00 2001
From: Ryan Wang <i@ryanc.cc>
Date: Mon, 21 Oct 2024 17:24:21 +0800
Subject: [PATCH 166/185] fix: resolve button height overflow in signup form on
 older Safari (#6912)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/area core
/kind bug
/milestone 2.20.x

#### What this PR does / why we need it:

修复在低版本 Safari 浏览器中，注册表单中的按钮高度溢出的问题。

#### Which issue(s) this PR fixes:

Fixes #6910

#### Does this PR introduce a user-facing change?

```release-note
修复在低版本 Safari 浏览器中，注册表单中的按钮高度溢出的问题。
```

<!-- Fuck Safari -->
---
 application/src/main/resources/static/styles/main.css | 1 +
 1 file changed, 1 insertion(+)

diff --git a/application/src/main/resources/static/styles/main.css b/application/src/main/resources/static/styles/main.css
index e2d8dc5fc5..742e171ffc 100644
--- a/application/src/main/resources/static/styles/main.css
+++ b/application/src/main/resources/static/styles/main.css
@@ -234,6 +234,7 @@
     grid-template-columns: repeat(3, minmax(0, 1fr));
     align-items: center;
     display: grid;
+    height: 2.5em;
 }
 
 .halo-form .form-input {

From 329bcc5748179b8760a31910e4ac34ede201640c Mon Sep 17 00:00:00 2001
From: John Niang <johnniang@foxmail.com>
Date: Tue, 22 Oct 2024 11:40:27 +0800
Subject: [PATCH 167/185] Exclude console and uc assets in security
 configuration (#6915)

#### What type of PR is this?

/kind improvement
/area core
/milestone 2.20.x

#### What this PR does / why we need it:

This PR excludes console and uc assets in security configuration to make them access by anonymous users.

#### Which issue(s) this PR fixes:

Fixes https://github.com/halo-dev/halo/issues/6908

#### Special notes for your reviewer:

```bash
http http://localhost:8090/uc/assets/index-E-uvwInx.css -ph

HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: no-cache
Content-Encoding: gzip
Content-Length: 26213
Content-Type: text/css
Vary: Accept-Encoding
```

#### Does this PR introduce a user-facing change?

```release-note
None
```
---
 .../java/run/halo/app/infra/config/WebServerSecurityConfig.java | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/application/src/main/java/run/halo/app/infra/config/WebServerSecurityConfig.java b/application/src/main/java/run/halo/app/infra/config/WebServerSecurityConfig.java
index b542b6b785..9ff7a74b2f 100644
--- a/application/src/main/java/run/halo/app/infra/config/WebServerSecurityConfig.java
+++ b/application/src/main/java/run/halo/app/infra/config/WebServerSecurityConfig.java
@@ -59,6 +59,8 @@ SecurityWebFilterChain filterChain(ServerHttpSecurity http,
 
         var pathMatcher = pathMatchers("/**");
         var staticResourcesMatcher = pathMatchers(HttpMethod.GET,
+            "/console/assets/**",
+            "/uc/assets/**",
             "/themes/{themeName}/assets/{*resourcePaths}",
             "/plugins/{pluginName}/assets/**",
             "/upload/**",

From 9ecc8f1d954010263f6fa02b93cb18417c61cf8b Mon Sep 17 00:00:00 2001
From: Ryan Wang <i@ryanc.cc>
Date: Tue, 22 Oct 2024 14:52:28 +0800
Subject: [PATCH 168/185] fix: post slug generation not following selected
 strategy (#6914)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/area ui
/kind bug
/milestone 2.20.x

#### What this PR does / why we need it:

修复文章自动生成别名不按照别名生成策略生成的问题。

#### Which issue(s) this PR fixes:

Fixes #6913

#### Special notes for your reviewer:

需要测试：

1. 分类、标签创建和更新时的别名生成
2. 文章新建时，别名是否按照生成策略生成。

#### Does this PR introduce a user-facing change?

```release-note
修复文章自动生成别名不按照别名生成策略生成的问题。
```
---
 ui/console-src/composables/use-slugify.ts     | 76 +++++++++----------
 .../components/SinglePageSettingModal.vue     |  2 +-
 .../components/CategoryEditingModal.vue       |  2 +-
 .../posts/components/PostSettingModal.vue     |  2 +-
 .../posts/tags/components/TagEditingModal.vue |  2 +-
 .../posts/components/PostSettingForm.vue      |  2 +-
 6 files changed, 43 insertions(+), 43 deletions(-)

diff --git a/ui/console-src/composables/use-slugify.ts b/ui/console-src/composables/use-slugify.ts
index b94c1b4004..4768f153f9 100644
--- a/ui/console-src/composables/use-slugify.ts
+++ b/ui/console-src/composables/use-slugify.ts
@@ -3,28 +3,20 @@ import { FormType } from "@/types/slug";
 import { randomUUID } from "@/utils/id";
 import ShortUniqueId from "short-unique-id";
 import { slugify } from "transliteration";
-import { watch, type Ref } from "vue";
+import { computed, watch, type Ref } from "vue";
+
 const uid = new ShortUniqueId();
-const Strategy = {
-  generateByTitle: (value: string) => {
-    if (!value) return "";
-    return slugify(value, { trim: true });
-  },
-  shortUUID: (value: string) => {
-    if (!value) return "";
-    return uid.randomUUID(8);
-  },
-  UUID: (value: string) => {
-    if (!value) return "";
-    return randomUUID();
-  },
-  timestamp: (value: string) => {
-    if (!value) return "";
-    return new Date().getTime().toString();
-  },
+
+type SlugStrategy = (value?: string) => string;
+
+const strategies: Record<string, SlugStrategy> = {
+  generateByTitle: (value?: string) => slugify(value || "", { trim: true }),
+  shortUUID: () => uid.randomUUID(8),
+  UUID: () => randomUUID(),
+  timestamp: () => new Date().getTime().toString(),
 };
 
-const onceList = ["shortUUID", "UUID", "timestamp"];
+const onceStrategies = new Set(["shortUUID", "UUID", "timestamp"]);
 
 export default function useSlugify(
   source: Ref<string>,
@@ -32,35 +24,43 @@ export default function useSlugify(
   auto: Ref<boolean>,
   formType: FormType
 ) {
-  const handleGenerateSlug = (forceUpdate = false, formType: FormType) => {
-    const globalInfoStore = useGlobalInfoStore();
-    const mode = globalInfoStore.globalInfo?.postSlugGenerationStrategy;
+  const globalInfoStore = useGlobalInfoStore();
 
-    if (!mode) {
-      return;
-    }
-    if (formType != FormType.POST) {
-      target.value = Strategy["generateByTitle"](source.value);
-      return;
-    }
-    if (forceUpdate) {
-      target.value = Strategy[mode](source.value);
+  const currentStrategy = computed(
+    () =>
+      globalInfoStore.globalInfo?.postSlugGenerationStrategy ||
+      "generateByTitle"
+  );
+
+  const generateSlug = (value: string): string => {
+    const strategy =
+      formType === FormType.POST
+        ? strategies[currentStrategy.value]
+        : strategies.generateByTitle;
+
+    return strategy(value);
+  };
+
+  const handleGenerateSlug = (forceUpdate = false) => {
+    if (
+      !forceUpdate &&
+      onceStrategies.has(currentStrategy.value) &&
+      target.value
+    ) {
       return;
     }
-    if (onceList.includes(mode) && target.value) return;
-    target.value = Strategy[mode](source.value);
+
+    target.value = generateSlug(source.value);
   };
 
   watch(
-    () => source.value,
+    source,
     () => {
       if (auto.value) {
-        handleGenerateSlug(false, formType);
+        handleGenerateSlug(true);
       }
     },
-    {
-      immediate: true,
-    }
+    { immediate: true }
   );
 
   return {
diff --git a/ui/console-src/modules/contents/pages/components/SinglePageSettingModal.vue b/ui/console-src/modules/contents/pages/components/SinglePageSettingModal.vue
index d47d54036b..f30ff8654a 100644
--- a/ui/console-src/modules/contents/pages/components/SinglePageSettingModal.vue
+++ b/ui/console-src/modules/contents/pages/components/SinglePageSettingModal.vue
@@ -318,7 +318,7 @@ const { handleGenerateSlug } = useSlugify(
                     $t('core.page.settings.fields.slug.refresh_message')
                   "
                   class="group flex h-full cursor-pointer items-center border-l px-3 transition-all hover:bg-gray-100"
-                  @click="handleGenerateSlug(true, FormType.SINGLE_PAGE)"
+                  @click="handleGenerateSlug(true)"
                 >
                   <IconRefreshLine
                     class="h-4 w-4 text-gray-500 group-hover:text-gray-700"
diff --git a/ui/console-src/modules/contents/posts/categories/components/CategoryEditingModal.vue b/ui/console-src/modules/contents/posts/categories/components/CategoryEditingModal.vue
index 03bf861d06..d823824193 100644
--- a/ui/console-src/modules/contents/posts/categories/components/CategoryEditingModal.vue
+++ b/ui/console-src/modules/contents/posts/categories/components/CategoryEditingModal.vue
@@ -238,7 +238,7 @@ const { handleGenerateSlug } = useSlugify(
                     )
                   "
                   class="group flex h-full cursor-pointer items-center border-l px-3 transition-all hover:bg-gray-100"
-                  @click="handleGenerateSlug(true, FormType.CATEGORY)"
+                  @click="handleGenerateSlug(true)"
                 >
                   <IconRefreshLine
                     class="h-4 w-4 text-gray-500 group-hover:text-gray-700"
diff --git a/ui/console-src/modules/contents/posts/components/PostSettingModal.vue b/ui/console-src/modules/contents/posts/components/PostSettingModal.vue
index b5645dcb8f..9606ee4f26 100644
--- a/ui/console-src/modules/contents/posts/components/PostSettingModal.vue
+++ b/ui/console-src/modules/contents/posts/components/PostSettingModal.vue
@@ -331,7 +331,7 @@ const showCancelPublishButton = computed(() => {
                     $t('core.post.settings.fields.slug.refresh_message')
                   "
                   class="group flex h-full cursor-pointer items-center border-l px-3 transition-all hover:bg-gray-100"
-                  @click="handleGenerateSlug(true, FormType.POST)"
+                  @click="handleGenerateSlug(true)"
                 >
                   <IconRefreshLine
                     class="h-4 w-4 text-gray-500 group-hover:text-gray-700"
diff --git a/ui/console-src/modules/contents/posts/tags/components/TagEditingModal.vue b/ui/console-src/modules/contents/posts/tags/components/TagEditingModal.vue
index 398a8cb825..761cf87642 100644
--- a/ui/console-src/modules/contents/posts/tags/components/TagEditingModal.vue
+++ b/ui/console-src/modules/contents/posts/tags/components/TagEditingModal.vue
@@ -208,7 +208,7 @@ const { handleGenerateSlug } = useSlugify(
                     )
                   "
                   class="group flex h-full cursor-pointer items-center border-l px-3 transition-all hover:bg-gray-100"
-                  @click="handleGenerateSlug(true, FormType.TAG)"
+                  @click="handleGenerateSlug(true)"
                 >
                   <IconRefreshLine
                     class="h-4 w-4 text-gray-500 group-hover:text-gray-700"
diff --git a/ui/uc-src/modules/contents/posts/components/PostSettingForm.vue b/ui/uc-src/modules/contents/posts/components/PostSettingForm.vue
index 32b8a85b4a..75897f62af 100644
--- a/ui/uc-src/modules/contents/posts/components/PostSettingForm.vue
+++ b/ui/uc-src/modules/contents/posts/components/PostSettingForm.vue
@@ -114,7 +114,7 @@ const publishTimeHelp = computed(() => {
               <div
                 v-tooltip="$t('core.post.settings.fields.slug.refresh_message')"
                 class="group flex h-full cursor-pointer items-center border-l px-3 transition-all hover:bg-gray-100"
-                @click="handleGenerateSlug(true, FormType.POST)"
+                @click="handleGenerateSlug(true)"
               >
                 <IconRefreshLine
                   class="h-4 w-4 text-gray-500 group-hover:text-gray-700"

From ddaf7b0dce0768e8f44f3ebc47a5c28dc11b7d26 Mon Sep 17 00:00:00 2001
From: Ryan Wang <i@ryanc.cc>
Date: Tue, 22 Oct 2024 14:54:29 +0800
Subject: [PATCH 169/185] chore: remove unused dependencies and configuration
 files (#6917)

#### What type of PR is this?

/area core
/kind cleanup

#### What this PR does / why we need it:

Remove unused dependencies and configuration files

#### Does this PR introduce a user-facing change?

```release-note
None
```
---
 .gitattributes                            |    4 -
 ui/.changeset/README.md                   |    8 -
 ui/.changeset/config.json                 |   11 -
 ui/.changeset/pre.json                    |    9 -
 ui/.eslintrc.cjs                          |    6 -
 ui/OWNERS                                 |   15 -
 ui/cypress.json                           |    3 -
 ui/cypress/fixtures/example.json          |    5 -
 ui/cypress/integration/example.spec.ts    |    8 -
 ui/cypress/plugins/index.ts               |   19 -
 ui/cypress/plugins/tsconfig.json          |   14 -
 ui/cypress/support/commands.ts            |   25 -
 ui/cypress/support/index.ts               |   20 -
 ui/cypress/tsconfig.json                  |   18 -
 ui/package.json                           |    9 +-
 ui/packages/components/tsconfig.node.json |    2 +-
 ui/packages/shared/tsconfig.node.json     |    2 +-
 ui/pnpm-lock.yaml                         | 1185 +--------------------
 ui/tailwind.config.cjs                    |   15 -
 ui/tsconfig.node.json                     |    1 -
 20 files changed, 51 insertions(+), 1328 deletions(-)
 delete mode 100644 .gitattributes
 delete mode 100644 ui/.changeset/README.md
 delete mode 100644 ui/.changeset/config.json
 delete mode 100644 ui/.changeset/pre.json
 delete mode 100644 ui/OWNERS
 delete mode 100644 ui/cypress.json
 delete mode 100644 ui/cypress/fixtures/example.json
 delete mode 100644 ui/cypress/integration/example.spec.ts
 delete mode 100644 ui/cypress/plugins/index.ts
 delete mode 100644 ui/cypress/plugins/tsconfig.json
 delete mode 100644 ui/cypress/support/commands.ts
 delete mode 100644 ui/cypress/support/index.ts
 delete mode 100644 ui/cypress/tsconfig.json

diff --git a/.gitattributes b/.gitattributes
deleted file mode 100644
index c161ab51fc..0000000000
--- a/.gitattributes
+++ /dev/null
@@ -1,4 +0,0 @@
-*.js linguist-language=Java
-*.css linguist-language=Java
-*.ftl linguist-language=FreeMarker
-*.html linguist-language=Vue
diff --git a/ui/.changeset/README.md b/ui/.changeset/README.md
deleted file mode 100644
index e5b6d8d6a6..0000000000
--- a/ui/.changeset/README.md
+++ /dev/null
@@ -1,8 +0,0 @@
-# Changesets
-
-Hello and welcome! This folder has been automatically generated by `@changesets/cli`, a build tool that works
-with multi-package repos, or single-package repos to help you version and publish your code. You can
-find the full documentation for it [in our repository](https://github.com/changesets/changesets)
-
-We have a quick list of common questions to get you started engaging with this project in
-[our documentation](https://github.com/changesets/changesets/blob/main/docs/common-questions.md)
diff --git a/ui/.changeset/config.json b/ui/.changeset/config.json
deleted file mode 100644
index ff9fe79d7c..0000000000
--- a/ui/.changeset/config.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "$schema": "https://unpkg.com/@changesets/config@2.0.1/schema.json",
-  "changelog": "@changesets/cli/changelog",
-  "commit": false,
-  "fixed": [],
-  "linked": [["@halo-dev/*"]],
-  "access": "public",
-  "baseBranch": "next",
-  "updateInternalDependencies": "patch",
-  "ignore": []
-}
diff --git a/ui/.changeset/pre.json b/ui/.changeset/pre.json
deleted file mode 100644
index 694d1d353c..0000000000
--- a/ui/.changeset/pre.json
+++ /dev/null
@@ -1,9 +0,0 @@
-{
-  "mode": "pre",
-  "tag": "alpha",
-  "initialVersions": {
-    "@halo-dev/components": "0.0.0-alpha.0",
-    "@halo-dev/console-shared": "0.0.0-alpha.0"
-  },
-  "changesets": []
-}
diff --git a/ui/.eslintrc.cjs b/ui/.eslintrc.cjs
index 63132e5164..a5fe9af584 100644
--- a/ui/.eslintrc.cjs
+++ b/ui/.eslintrc.cjs
@@ -18,12 +18,6 @@ module.exports = {
     "@typescript-eslint/ban-ts-comment": 0,
     "vue/no-v-html": 0,
   },
-  overrides: [
-    {
-      files: ["cypress/integration/**.spec.{js,ts,jsx,tsx}"],
-      extends: ["plugin:cypress/recommended"],
-    },
-  ],
   ignorePatterns: ["!.storybook", "packages/api-client"],
   parserOptions: {
     ecmaVersion: "latest",
diff --git a/ui/OWNERS b/ui/OWNERS
deleted file mode 100644
index 66b425df70..0000000000
--- a/ui/OWNERS
+++ /dev/null
@@ -1,15 +0,0 @@
-reviewers:
-- ruibaby
-- guqing
-- JohnNiang
-- lan-yonghui
-- wan92hen
-- QuentinHsu
-- Aanko
-- wzrove
-- LIlGG
-
-approvers:
-- ruibaby
-- guqing
-- JohnNiang
diff --git a/ui/cypress.json b/ui/cypress.json
deleted file mode 100644
index 6ba19871b9..0000000000
--- a/ui/cypress.json
+++ /dev/null
@@ -1,3 +0,0 @@
-{
-  "baseUrl": "http://localhost:5050"
-}
diff --git a/ui/cypress/fixtures/example.json b/ui/cypress/fixtures/example.json
deleted file mode 100644
index 02e4254378..0000000000
--- a/ui/cypress/fixtures/example.json
+++ /dev/null
@@ -1,5 +0,0 @@
-{
-  "name": "Using fixtures to represent data",
-  "email": "hello@cypress.io",
-  "body": "Fixtures are a great way to mock data for responses to routes"
-}
diff --git a/ui/cypress/integration/example.spec.ts b/ui/cypress/integration/example.spec.ts
deleted file mode 100644
index 3130c0011a..0000000000
--- a/ui/cypress/integration/example.spec.ts
+++ /dev/null
@@ -1,8 +0,0 @@
-// https://docs.cypress.io/api/introduction/api.html
-
-describe("My First Test", () => {
-  it("visits the app root url", () => {
-    cy.visit("/");
-    cy.contains("h1", "You did it!");
-  });
-});
diff --git a/ui/cypress/plugins/index.ts b/ui/cypress/plugins/index.ts
deleted file mode 100644
index 49dc983852..0000000000
--- a/ui/cypress/plugins/index.ts
+++ /dev/null
@@ -1,19 +0,0 @@
-/* eslint-env node */
-// ***********************************************************
-// This example plugins/index.ts can be used to load plugins
-//
-// You can change the location of this file or turn off loading
-// the plugins file with the 'pluginsFile' configuration option.
-//
-// You can read more here:
-// https://on.cypress.io/plugins-guide
-// ***********************************************************
-
-// This function is called when a project is opened or re-opened (e.g. due to
-// the project's config changing)
-
-export default ((on, config) => {
-  // `on` is used to hook into various events Cypress emits
-  // `config` is the resolved Cypress config
-  return config;
-}) as Cypress.PluginConfig;
diff --git a/ui/cypress/plugins/tsconfig.json b/ui/cypress/plugins/tsconfig.json
deleted file mode 100644
index d815dc399e..0000000000
--- a/ui/cypress/plugins/tsconfig.json
+++ /dev/null
@@ -1,14 +0,0 @@
-{
-  "extends": "@vue/tsconfig/tsconfig.node.json",
-  "include": [
-    "./**/*"
-  ],
-  "compilerOptions": {
-    "module": "CommonJS",
-    "preserveValueImports": false,
-    "types": [
-      "node",
-      "cypress/types/cypress"
-    ]
-  }
-}
diff --git a/ui/cypress/support/commands.ts b/ui/cypress/support/commands.ts
deleted file mode 100644
index 119ab03f7c..0000000000
--- a/ui/cypress/support/commands.ts
+++ /dev/null
@@ -1,25 +0,0 @@
-// ***********************************************
-// This example commands.js shows you how to
-// create various custom commands and overwrite
-// existing commands.
-//
-// For more comprehensive examples of custom
-// commands please read more here:
-// https://on.cypress.io/custom-commands
-// ***********************************************
-//
-//
-// -- This is a parent command --
-// Cypress.Commands.add('login', (email, password) => { ... })
-//
-//
-// -- This is a child command --
-// Cypress.Commands.add('drag', { prevSubject: 'element'}, (subject, options) => { ... })
-//
-//
-// -- This is a dual command --
-// Cypress.Commands.add('dismiss', { prevSubject: 'optional'}, (subject, options) => { ... })
-//
-//
-// -- This will overwrite an existing command --
-// Cypress.Commands.overwrite('visit', (originalFn, url, options) => { ... })
diff --git a/ui/cypress/support/index.ts b/ui/cypress/support/index.ts
deleted file mode 100644
index d076cec9fd..0000000000
--- a/ui/cypress/support/index.ts
+++ /dev/null
@@ -1,20 +0,0 @@
-// ***********************************************************
-// This example support/index.js is processed and
-// loaded automatically before your test files.
-//
-// This is a great place to put global configuration and
-// behavior that modifies Cypress.
-//
-// You can change the location of this file or turn off
-// automatically serving support files with the
-// 'supportFile' configuration option.
-//
-// You can read more here:
-// https://on.cypress.io/configuration
-// ***********************************************************
-
-// Import commands.js using ES2015 syntax:
-import "./commands";
-
-// Alternatively you can use CommonJS syntax:
-// require('./commands')
diff --git a/ui/cypress/tsconfig.json b/ui/cypress/tsconfig.json
deleted file mode 100644
index 8e5ea04ba1..0000000000
--- a/ui/cypress/tsconfig.json
+++ /dev/null
@@ -1,18 +0,0 @@
-{
-  "extends": "@vue/tsconfig/tsconfig.web.json",
-  "include": [
-    "./integration/**/*",
-    "./support/**/*"
-  ],
-  "compilerOptions": {
-    "isolatedModules": false,
-    "target": "es5",
-    "lib": [
-      "es5",
-      "dom"
-    ],
-    "types": [
-      "cypress"
-    ]
-  }
-}
diff --git a/ui/package.json b/ui/package.json
index 5472762ca0..dba96c1efb 100644
--- a/ui/package.json
+++ b/ui/package.json
@@ -12,22 +12,18 @@
     "build:uc": "vue-tsc --noEmit -p tsconfig.app.json --composite false && vite build --config ./vite.uc.config.ts",
     "build:console": "vue-tsc --noEmit -p tsconfig.app.json --composite false && vite build --config ./vite.config.ts",
     "build:packages": "pnpm --filter \"./packages/**\" build",
-    "preview": "vite preview --port 5050",
     "api-client:gen": "pnpm --filter \"./packages/api-client\" gen",
     "test:unit": "vitest --environment jsdom --run && pnpm run test:unit:packages",
     "test:unit:watch": "vitest --environment jsdom --watch",
     "test:unit:ui": "vitest --environment jsdom --watch --ui",
     "test:unit:coverage": "vitest run --environment jsdom --coverage",
-    "test:e2e": "start-server-and-test preview http://127.0.0.1:5050/ \"cypress open\"",
-    "test:e2e:ci": "start-server-and-test preview http://127.0.0.1:5050/ \"cypress run\"",
     "typecheck": "vue-tsc --noEmit -p tsconfig.app.json --composite false && pnpm run typecheck:packages",
     "lint": "eslint \"./src\" \"./console-src\" \"./uc-src\" --ext .vue,.js,.jsx,.cjs,.mjs,.ts,.tsx,.cts,.mts --ignore-path .gitignore --max-warnings=0 -f html -o build/lint-result/index.html && pnpm run lint:packages",
     "prettier": "prettier --write \"./{src,uc-src,console-src}/**/*.{vue,js,jsx,ts,tsx,css,scss,json,yml,yaml,html}\" && pnpm run prettier:packages",
     "typecheck:packages": "pnpm --parallel --filter \"./packages/**\" run typecheck",
     "lint:packages": "pnpm --parallel --filter \"./packages/**\" lint",
     "prettier:packages": "pnpm --parallel --filter \"./packages/**\" prettier",
-    "test:unit:packages": "pnpm --parallel --filter \"./packages/**\" run test:unit",
-    "link:editor": "pnpm link --global @halo-dev/richtext-editor"
+    "test:unit:packages": "pnpm --parallel --filter \"./packages/**\" run test:unit"
   },
   "lint-staged": {
     "*.{vue,js,jsx,ts,tsx,css,scss,json,yml,yaml,html}": [
@@ -108,7 +104,6 @@
     "vue-router": "^4.3.2"
   },
   "devDependencies": {
-    "@changesets/cli": "^2.25.2",
     "@iconify/json": "^2.2.235",
     "@intlify/unplugin-vue-i18n": "^4.0.0",
     "@rushstack/eslint-patch": "^1.3.2",
@@ -132,9 +127,7 @@
     "@vue/tsconfig": "^0.5.1",
     "autoprefixer": "^10.4.14",
     "c8": "^7.12.0",
-    "cypress": "^10.11.0",
     "eslint": "^8.43.0",
-    "eslint-plugin-cypress": "^2.13.3",
     "eslint-plugin-vue": "^9.17.0",
     "husky": "^8.0.3",
     "jsdom": "^20.0.3",
diff --git a/ui/packages/components/tsconfig.node.json b/ui/packages/components/tsconfig.node.json
index d3c1dffa32..ccd4b148cc 100644
--- a/ui/packages/components/tsconfig.node.json
+++ b/ui/packages/components/tsconfig.node.json
@@ -1,6 +1,6 @@
 {
   "extends": "@tsconfig/node18/tsconfig.json",
-  "include": ["vite.config.*", "vitest.config.*", "cypress.config.*"],
+  "include": ["vite.config.*", "vitest.config.*"],
   "compilerOptions": {
     "composite": true,
     "module": "ESNext",
diff --git a/ui/packages/shared/tsconfig.node.json b/ui/packages/shared/tsconfig.node.json
index d3c1dffa32..ccd4b148cc 100644
--- a/ui/packages/shared/tsconfig.node.json
+++ b/ui/packages/shared/tsconfig.node.json
@@ -1,6 +1,6 @@
 {
   "extends": "@tsconfig/node18/tsconfig.json",
-  "include": ["vite.config.*", "vitest.config.*", "cypress.config.*"],
+  "include": ["vite.config.*", "vitest.config.*"],
   "compilerOptions": {
     "composite": true,
     "module": "ESNext",
diff --git a/ui/pnpm-lock.yaml b/ui/pnpm-lock.yaml
index 6411cbe3d6..16b9a603b0 100644
--- a/ui/pnpm-lock.yaml
+++ b/ui/pnpm-lock.yaml
@@ -207,9 +207,6 @@ importers:
         specifier: ^4.3.2
         version: 4.3.2(vue@3.5.11(typescript@5.6.2))
     devDependencies:
-      '@changesets/cli':
-        specifier: ^2.25.2
-        version: 2.25.2
       '@iconify/json':
         specifier: ^2.2.235
         version: 2.2.235
@@ -279,15 +276,9 @@ importers:
       c8:
         specifier: ^7.12.0
         version: 7.12.0
-      cypress:
-        specifier: ^10.11.0
-        version: 10.11.0
       eslint:
         specifier: ^8.43.0
         version: 8.43.0
-      eslint-plugin-cypress:
-        specifier: ^2.13.3
-        version: 2.13.3(eslint@8.43.0)
       eslint-plugin-vue:
         specifier: ^9.17.0
         version: 9.17.0(eslint@8.43.0)
@@ -1784,58 +1775,6 @@ packages:
   '@bcoe/v8-coverage@0.2.3':
     resolution: {integrity: sha512-0hYQ8SB4Db5zvZB4axdMHGwEaQjkZzFjQiN9LVYvIFB2nSUHW9tYpxWriPrWDASIxiaXax83REcLxuSdnGPZtw==}
 
-  '@changesets/apply-release-plan@6.1.2':
-    resolution: {integrity: sha512-H8TV9E/WtJsDfoDVbrDGPXmkZFSv7W2KLqp4xX4MKZXshb0hsQZUNowUa8pnus9qb/5OZrFFRVsUsDCVHNW/AQ==}
-
-  '@changesets/assemble-release-plan@5.2.2':
-    resolution: {integrity: sha512-B1qxErQd85AeZgZFZw2bDKyOfdXHhG+X5S+W3Da2yCem8l/pRy4G/S7iOpEcMwg6lH8q2ZhgbZZwZ817D+aLuQ==}
-
-  '@changesets/changelog-git@0.1.13':
-    resolution: {integrity: sha512-zvJ50Q+EUALzeawAxax6nF2WIcSsC5PwbuLeWkckS8ulWnuPYx8Fn/Sjd3rF46OzeKA8t30loYYV6TIzp4DIdg==}
-
-  '@changesets/cli@2.25.2':
-    resolution: {integrity: sha512-ACScBJXI3kRyMd2R8n8SzfttDHi4tmKSwVwXBazJOylQItSRSF4cGmej2E4FVf/eNfGy6THkL9GzAahU9ErZrA==}
-    hasBin: true
-
-  '@changesets/config@2.2.0':
-    resolution: {integrity: sha512-GGaokp3nm5FEDk/Fv2PCRcQCOxGKKPRZ7prcMqxEr7VSsG75MnChQE8plaW1k6V8L2bJE+jZWiRm19LbnproOw==}
-
-  '@changesets/errors@0.1.4':
-    resolution: {integrity: sha512-HAcqPF7snsUJ/QzkWoKfRfXushHTu+K5KZLJWPb34s4eCZShIf8BFO3fwq6KU8+G7L5KdtN2BzQAXOSXEyiY9Q==}
-
-  '@changesets/get-dependents-graph@1.3.4':
-    resolution: {integrity: sha512-+C4AOrrFY146ydrgKOo5vTZfj7vetNu1tWshOID+UjPUU9afYGDXI8yLnAeib1ffeBXV3TuGVcyphKpJ3cKe+A==}
-
-  '@changesets/get-release-plan@3.0.15':
-    resolution: {integrity: sha512-W1tFwxE178/en+zSj/Nqbc3mvz88mcdqUMJhRzN1jDYqN3QI4ifVaRF9mcWUU+KI0gyYEtYR65tour690PqTcA==}
-
-  '@changesets/get-version-range-type@0.3.2':
-    resolution: {integrity: sha512-SVqwYs5pULYjYT4op21F2pVbcrca4qA/bAA3FmFXKMN7Y+HcO8sbZUTx3TAy2VXulP2FACd1aC7f2nTuqSPbqg==}
-
-  '@changesets/git@1.5.0':
-    resolution: {integrity: sha512-Xo8AT2G7rQJSwV87c8PwMm6BAc98BnufRMsML7m7Iw8Or18WFvFmxqG5aOL5PBvhgq9KrKvaeIBNIymracSuHg==}
-
-  '@changesets/logger@0.0.5':
-    resolution: {integrity: sha512-gJyZHomu8nASHpaANzc6bkQMO9gU/ib20lqew1rVx753FOxffnCrJlGIeQVxNWCqM+o6OOleCo/ivL8UAO5iFw==}
-
-  '@changesets/parse@0.3.15':
-    resolution: {integrity: sha512-3eDVqVuBtp63i+BxEWHPFj2P1s3syk0PTrk2d94W9JD30iG+OER0Y6n65TeLlY8T2yB9Fvj6Ev5Gg0+cKe/ZUA==}
-
-  '@changesets/pre@1.0.13':
-    resolution: {integrity: sha512-jrZc766+kGZHDukjKhpBXhBJjVQMied4Fu076y9guY1D3H622NOw8AQaLV3oQsDtKBTrT2AUFjt9Z2Y9Qx+GfA==}
-
-  '@changesets/read@0.5.8':
-    resolution: {integrity: sha512-eYaNfxemgX7f7ELC58e7yqQICW5FB7V+bd1lKt7g57mxUrTveYME+JPaBPpYx02nP53XI6CQp6YxnR9NfmFPKw==}
-
-  '@changesets/types@4.1.0':
-    resolution: {integrity: sha512-LDQvVDv5Kb50ny2s25Fhm3d9QSZimsoUGBsUioj6MC3qbMUCuC8GPIvk/M6IvXx3lYhAs0lwWUQLb+VIEUCECw==}
-
-  '@changesets/types@5.2.0':
-    resolution: {integrity: sha512-km/66KOqJC+eicZXsm2oq8A8bVTSpkZJ60iPV/Nl5Z5c7p9kk8xxh6XGRTlnludHldxOOfudhnDN2qPxtHmXzA==}
-
-  '@changesets/write@0.2.2':
-    resolution: {integrity: sha512-kCYNHyF3xaId1Q/QE+DF3UTrHTyg3Cj/f++T8S8/EkC+jh1uK2LFnM9h+EzV+fsmnZDrs7r0J4LLpeI/VWC5Hg==}
-
   '@ckpack/vue-color@1.5.0':
     resolution: {integrity: sha512-dj1zXVyay2m4LdlLJCQSdIS2FYwUl77BZqyKmUXiehyqjCP0bGYnPcL38lrShzYUc2FdkYQX8ANZZjRahd4PQw==}
     engines: {node: '>=12'}
@@ -1891,13 +1830,6 @@ packages:
     resolution: {integrity: sha512-SITSV6aIXsuVNV3f3O0f2n/cgyEDWoSqtZMYiAmcsYHydcKrOz3gUxB/iXd/Qf08+IZX4KpgNbvUdMBmWz+kcA==}
     engines: {node: '>=10'}
 
-  '@cypress/request@2.88.10':
-    resolution: {integrity: sha512-Zp7F+R93N0yZyG34GutyTNr+okam7s/Fzc1+i3kcqOP8vk6OuajuE9qZJ6Rs+10/1JFtXFYMdyarnU1rZuJesg==}
-    engines: {node: '>= 6'}
-
-  '@cypress/xvfb@1.2.4':
-    resolution: {integrity: sha512-skbBzPggOVYCbnGgV+0dmBdW/s77ZkAOXIC1knS8NagwDjBrNC1LuXtQJeiN6l+m7lzmHtaoUw/ctJKdqkG57Q==}
-
   '@discoveryjs/json-ext@0.5.7':
     resolution: {integrity: sha512-dBVuXR082gk3jsFp7Rd/JI4kytwGHecnCoTtXFb7DB6CNHp4rg5k1bhg0nWdLGLnOV71lmDzGQaLMy8iPLY0pw==}
     engines: {node: '>=10.0.0'}
@@ -2651,12 +2583,6 @@ packages:
     resolution: {integrity: sha512-Z7C/xXCiGWsg0KuKsHTKJxbWhpI3Vs5GwLfOean7MGyVFGqdRgBbAjOCh6u4bbjPc/8MJ2pZmK/0DLdCbivLDA==}
     engines: {node: '>=8'}
 
-  '@manypkg/find-root@1.1.0':
-    resolution: {integrity: sha512-mki5uBvhHzO8kYYix/WRy2WX8S3B5wdVSc9D6KcU5lQNglP2yt58/VfLuAK49glRXChosY8ap2oJ1qgma3GUVA==}
-
-  '@manypkg/get-packages@1.1.3':
-    resolution: {integrity: sha512-fo+QhuU3qE/2TQMQmbVMqaQ6EWbMhi4ABWP+O4AM1NqPBuy0OrApV5LO6BrrgnhtAHS2NH6RrVk9OL181tTi8A==}
-
   '@mdx-js/react@2.3.0':
     resolution: {integrity: sha512-zQH//gdOmuu7nt2oJR29vFhDv88oGPmVw6BggmrHeMI+xgEkp1B2dX9/bMBSYtK0dyLX/aOmesKS09g222K1/g==}
     peerDependencies:
@@ -3883,9 +3809,6 @@ packages:
   '@types/http-errors@2.0.4':
     resolution: {integrity: sha512-D0CFMMtydbJAegzOyHjtiKPLlvnm3iTZyZRSZoLq2mRhDdmLfIWOCYPfQJ4cu2erKghU++QvjcUjp/5h7hESpA==}
 
-  '@types/is-ci@3.0.0':
-    resolution: {integrity: sha512-Q0Op0hdWbYd1iahB+IFNQcWXFq4O0Q5MwQP7uN0souuQ4rPg1vEYcnIOfr1gY+M+6rc8FGoRaBO1mOOvL29sEQ==}
-
   '@types/istanbul-lib-coverage@2.0.4':
     resolution: {integrity: sha512-z/QT1XN4K4KYuslS23k62yDIDLwLFkzxOuMplDtObz0+y7VqJCaO2o+SPwHCvLFZh7xazvvoor2tA/hPz9ee7g==}
 
@@ -3928,18 +3851,9 @@ packages:
   '@types/mime@3.0.4':
     resolution: {integrity: sha512-iJt33IQnVRkqeqC7PzBHPTC6fDlRNRW8vjrgqtScAhrmMwe8c4Eo7+fUGTa+XdWrpEgpyKWMYmi2dIwMAYRzPw==}
 
-  '@types/minimist@1.2.2':
-    resolution: {integrity: sha512-jhuKLIRrhvCPLqwPcx6INqmKeiA5EWrsCOPhrlFSrbrmU4ZMPjj5Ul/oLCMDO98XRUIwVm78xICz4EPCektzeQ==}
-
   '@types/node-fetch@2.6.9':
     resolution: {integrity: sha512-bQVlnMLFJ2d35DkPNjEPmd9ueO/rh5EiaZt2bhqiSarPjZIuIV6bPQVqcrEyvNo+AfTrRGVazle1tl597w3gfA==}
 
-  '@types/node@12.20.55':
-    resolution: {integrity: sha512-J8xLz7q2OFulZ2cyGTLE1TbbZcjpno7FaN6zdJNrgAdrJ+DZzh/uFR6YrTb4C+nXakvud8Q4+rbhoIWlYQbUFQ==}
-
-  '@types/node@14.18.31':
-    resolution: {integrity: sha512-vQAnaReSQkEDa8uwAyQby8bYGKu84R/deEc6mg5T8fX6gzCn8QW6rziSgsti1fNvsrswKUKPnVTi7uoB+u62Mw==}
-
   '@types/node@18.13.0':
     resolution: {integrity: sha512-gC3TazRzGoOnoKAhUx+Q0t8S9Tzs74z7m0ipwGpSqQrleP14hKxP4/JUeEQcD3W1/aIpnWl8pHowI7WokuZpXg==}
 
@@ -3982,9 +3896,6 @@ packages:
   '@types/scheduler@0.16.8':
     resolution: {integrity: sha512-WZLiwShhwLRmeV6zH+GkbOFT6Z6VklCItrDioxUnv+u4Ll+8vKeFySoFyK/0ctcRpOmwAicELfmys1sDc/Rw+A==}
 
-  '@types/semver@6.2.3':
-    resolution: {integrity: sha512-KQf+QAMWKMrtBMsB8/24w53tEsxllMj6TuA80TT/5igJalLI/zm0L3oXRbIAl4Ohfc85gyHX/jhMwsVkmhLU4A==}
-
   '@types/semver@7.3.13':
     resolution: {integrity: sha512-21cFJr9z3g5dW8B0CVI9g2O9beqaThGQ6ZFBqHfwhzLDKUxaqTIy3vnfah/UPkfOiF2pLq+tGz+W8RyCskuslw==}
 
@@ -3994,12 +3905,6 @@ packages:
   '@types/serve-static@1.15.5':
     resolution: {integrity: sha512-PDRk21MnK70hja/YF8AHfC7yIsiQHn1rcXx7ijCFBX/k+XQJhQT/gw3xekXKJvx+5SXaMMS8oqQy09Mzvz2TuQ==}
 
-  '@types/sinonjs__fake-timers@8.1.1':
-    resolution: {integrity: sha512-0kSuKjAS0TrGLJ0M/+8MaFkGsQhZpB6pxOmvS3K8FYI72K//YmdfoW9X2qPsAKh1mkwxGD5zib9s1FIFed6E8g==}
-
-  '@types/sizzle@2.3.3':
-    resolution: {integrity: sha512-JYM8x9EGF163bEyhdJBpR2QX1R5naCJHC8ucJylJ3w9/CVBaskdQ8WqBf8MmQrd1kRvp/a4TS8HJ+bxzR7ZJYQ==}
-
   '@types/sortablejs@1.15.8':
     resolution: {integrity: sha512-b79830lW+RZfwaztgs1aVPgbasJ8e7AXtZYHTELNXZPsERt4ymJdjV4OccDbHQAvHrCcFpbF78jkm0R6h/pZVg==}
 
@@ -4030,9 +3935,6 @@ packages:
   '@types/yargs@17.0.32':
     resolution: {integrity: sha512-xQ67Yc/laOG5uMfX/093MRlGGCIBzZMarVa+gfNKJxWAIgykYpVGkBdbqEzGDDfCrVUj6Hiff4mTZ5BA6TmAog==}
 
-  '@types/yauzl@2.10.0':
-    resolution: {integrity: sha512-Cn6WYCm0tXv8p6k+A8PvbDG763EDpBoTzHdA+Q/MF6H3sapGjCm9NzoaJncJS9tUKSuCoDs9XHxYYsQDgxR6kw==}
-
   '@typescript-eslint/eslint-plugin@5.59.6':
     resolution: {integrity: sha512-sXtOgJNEuRU5RLwPUb1jxtToZbgvq3M6FPpY4QENxoOggK+UpTxUBpj6tD8+Qh2g46Pi9We87E+eHnUw8YcGsw==}
     engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0}
@@ -4635,9 +4537,6 @@ packages:
   app-root-dir@1.0.2:
     resolution: {integrity: sha512-jlpIfsOoNoafl92Sz//64uQHGSyMrD2vYG5d8o2a4qGvyNCvXur7bzIsWtAC/6flI2RYAp3kv8rsfBtaLm7w0g==}
 
-  arch@2.2.0:
-    resolution: {integrity: sha512-Of/R0wqp83cgHozfIYLbBMnej79U/SVGOOyuB3VVFv1NRM/PSFMK12x9KVtiYzJqmnU5WR2qp0Z5rHb7sWGnFQ==}
-
   arg@5.0.2:
     resolution: {integrity: sha512-PYjyFOLKQ9y57JvQ6QLo8dAgNqswh8M1RMJYdQduT6xbWSgK36P/Z/v+p888pM69jMMfS8Xd8F6I1kQ/I9HUGg==}
 
@@ -4672,10 +4571,6 @@ packages:
     resolution: {integrity: sha512-GVYjmpL05al4dNlKJm53mKE4w9OOLiuVHWorsIA3YVz+Hu0hcn6PtE3Ydl0EqU7v+7ABC4mjjWsnLUxbpno+CA==}
     engines: {node: '>=0.10.0'}
 
-  array.prototype.flat@1.3.0:
-    resolution: {integrity: sha512-12IUEkHsAhA4DY5s0FPgNXIdc8VRSqD9Zp78a5au9abH/SOBrsp082JOWFNTjkMozh8mqcdiKuaLGhPeYztxSw==}
-    engines: {node: '>= 0.4'}
-
   array.prototype.map@1.0.6:
     resolution: {integrity: sha512-nK1psgF2cXqP3wSyCSq0Hc7zwNq3sfljQqaG27r/7a7ooNUnn5nGq6yYWyks9jMO5EoFQ0ax80hSg6oXSRNXaw==}
     engines: {node: '>= 0.4'}
@@ -4688,23 +4583,12 @@ packages:
     resolution: {integrity: sha512-bMxMKAjg13EBSVscxTaYA4mRc5t1UAXa2kXiGTNfZ079HIWXEkKmkgFrh/nJqamaLSrXO5H4WFFkPEaLJWbs3A==}
     engines: {node: '>= 0.4'}
 
-  arrify@1.0.1:
-    resolution: {integrity: sha512-3CYzex9M9FGQjCGMGyi6/31c8GJbgb0qGyrx5HWxPd0aCwh4cB2YjMb2Xf9UuoogrMrlO9cTqnB5rI5GHZTcUA==}
-    engines: {node: '>=0.10.0'}
-
   asap@2.0.6:
     resolution: {integrity: sha512-BSHWgDSAiKs50o2Re8ppvp3seVHXSRM44cdSsT9FfNEUUZLOGWVCsiWaRPWM1Znn+mqZ1OfVZ3z3DWEzSp7hRA==}
 
-  asn1@0.2.6:
-    resolution: {integrity: sha512-ix/FxPn0MDjeyJ7i/yoHGFt/EX6LyNbxSEhPPXODPL+KB0VPk86UYfL0lMdy+KCnv+fmvIzySwaK5COwqVbWTQ==}
-
   assert-never@1.2.1:
     resolution: {integrity: sha512-TaTivMB6pYI1kXwrFlEhLeGfOqoDNdTxjCdwRfFFkEA30Eu+k48W34nlok2EYWJfFFzqaEmichdNM7th6M5HNw==}
 
-  assert-plus@1.0.0:
-    resolution: {integrity: sha512-NfJ4UzBCcQGLDlQq7nHxH+tv3kyZ0hHQqF5BO6J7tNJeP5do1llPr8dZ8zHonfhAu0PHAdMkSo+8o0wxg9lZWw==}
-    engines: {node: '>=0.8'}
-
   assert@2.1.0:
     resolution: {integrity: sha512-eLHpSK/Y4nhMJ07gDaAzoX/XAKS8PSaojml3M0DM4JpV1LAi5JOJ/p6H/XWrl8L+DzVEvVCW1z3vWAaB9oTsQw==}
 
@@ -4757,12 +4641,6 @@ packages:
     resolution: {integrity: sha512-wvUjBtSGN7+7SjNpq/9M2Tg350UZD3q62IFZLbRAR1bSMlCo1ZaeW+BJ+D090e4hIIZLBcTDWe4Mh4jvUDajzQ==}
     engines: {node: '>= 0.4'}
 
-  aws-sign2@0.7.0:
-    resolution: {integrity: sha512-08kcGqnYf/YmjoRhfxyu+CLxBjUtHLXLXX/vUfx9l2LYzG3c1m61nrpyFUZI6zeS+Li/wWMMidD9KgrqtGq3mA==}
-
-  aws4@1.11.0:
-    resolution: {integrity: sha512-xh1Rl34h6Fi1DC2WWKfxUTVqRsNnr6LsKz2+hfwDxQJWmrx8+c7ylaqBMcHfl1U1r2dsifOvKX3LQuLNZ+XSvA==}
-
   axios@1.7.2:
     resolution: {integrity: sha512-2A8QhOMrbomlDuiLeK9XibIBzuHeRcqqNOHp0Cyp5EoJ1IFDh+XZH3A6BkXtv0K4gFGCI0Y4BM7B1wOEi0Rmgw==}
 
@@ -4822,9 +4700,6 @@ packages:
   batch-processor@1.0.0:
     resolution: {integrity: sha512-xoLQD8gmmR32MeuBHgH0Tzd5PuSZx71ZsbhVxOCRbgktZEPe4SQy7s9Z50uPp0F/f7iw2XmkHN2xkgbMfckMDA==}
 
-  bcrypt-pbkdf@1.0.2:
-    resolution: {integrity: sha512-qeFIXtP4MSoi6NLqO12WfqARWWuCKi2Rn/9hJLEmtB5yTNr9DqFWkJRCf2qShWzPeAMRnOgCrq0sg/KLv5ES9w==}
-
   before-after-hook@2.2.3:
     resolution: {integrity: sha512-NzUnlZexiaH/46WDhANlyR2bXRopNg4F/zuSA3OpZnllCUgRaOF2znDioDWrmbNVsuZk6l9pMquQB38cfBZwkQ==}
 
@@ -4832,10 +4707,6 @@ packages:
     resolution: {integrity: sha512-aVNobHnJqLiUelTaHat9DZ1qM2w0C0Eym4LPI/3JxOnSokGVdsl1T1kN7TFvsEAD8G47A6VKQ0TVHqbBnYMJlQ==}
     engines: {node: '>=12.0.0'}
 
-  better-path-resolve@1.0.0:
-    resolution: {integrity: sha512-pbnl5XzGBdrFU/wT4jqmJVPn2B6UHPBOhzMQkY/SPUPB6QtUXtmBHBIwCbXJol93mOpGMnQyP/+BB19q04xj7g==}
-    engines: {node: '>=4'}
-
   big-integer@1.6.52:
     resolution: {integrity: sha512-QxD8cf2eVqJOOz63z6JIN9BzvVs/dlySa5HGSBH5xtR8dPteIRQnBxxKqkNTiT6jbDTF6jAfrd4oMcND9RGbQg==}
     engines: {node: '>=0.6'}
@@ -4856,9 +4727,6 @@ packages:
   bl@5.1.0:
     resolution: {integrity: sha512-tv1ZJHLfTDnXE6tMHv73YgSJaWR2AFuPwMntBe7XL/GBFHnT0CLnsHMogfk5+GzCDC5ZWarSCYaIGATZt9dNsQ==}
 
-  blob-util@2.0.2:
-    resolution: {integrity: sha512-T7JQa+zsXXEa6/8ZhHcQEW1UFfVM49Ts65uBkFL6fz2QmrElqmbajIDJvuA0tEhRe5eIjpV9ZF+0RfZR9voJFQ==}
-
   bluebird@3.7.2:
     resolution: {integrity: sha512-XpNj6GDQzdfW+r2Wnn7xiSAd7TM3jzkxGXBGTtWKuSXv1xUV+azxAm8jdWZN06QTQk+2N2XB9jRDkvbmQmcRtg==}
 
@@ -4887,9 +4755,6 @@ packages:
     resolution: {integrity: sha512-b8um+L1RzM3WDSzvhm6gIz1yfTbBt6YTlcEKAvsmqCZZFw46z626lVj9j1yEPW33H5H+lBQpZMP1k8l+78Ha0A==}
     engines: {node: '>=8'}
 
-  breakword@1.0.5:
-    resolution: {integrity: sha512-ex5W9DoOQ/LUEU3PMdLs9ua/CYZl1678NUkKOdUSi8Aw5F1idieaiRURCBFJCwVcrD1J8Iy3vfWSloaMwO2qFg==}
-
   browser-assert@1.2.1:
     resolution: {integrity: sha512-nfulgvOR6S4gt9UKCeGJOuSGBPGiFT6oQ/2UBnvTY/5aQ1PnksW72fhZkM30DzoRRv2WpwZf1vHHEr3mtuXIWQ==}
 
@@ -4963,10 +4828,6 @@ packages:
     resolution: {integrity: sha512-zkDT5WAF4hSSoUgyfg5tFIxz8XQK+25W/TLVojJTMKBaxevLBBtLxgqguAuVQB8PVW79FVjHcU+GJ9tVbDZ9mQ==}
     engines: {node: '>=14.16'}
 
-  cachedir@2.3.0:
-    resolution: {integrity: sha512-A+Fezp4zxnit6FanDmv9EqXNAi3vt9DWp51/71UEhXukb7QUuvtv9344h91dyAxuTLoSYJFU299qzR3tzwPAhw==}
-    engines: {node: '>=6'}
-
   call-bind@1.0.2:
     resolution: {integrity: sha512-7O+FbCihrB5WGbFYesctwmTKae6rOiIzmz1icreWJ+0aA7LJfuqhEso2T9ncpcFtzMQtzXf2QGGueWJGTYsqrA==}
 
@@ -4988,10 +4849,6 @@ packages:
     resolution: {integrity: sha512-QOSvevhslijgYwRx6Rv7zKdMF8lbRmx+uQGx2+vDc+KI/eBnsy9kit5aj23AgGu3pa4t9AgwbnXWqS+iOY+2aA==}
     engines: {node: '>= 6'}
 
-  camelcase-keys@6.2.2:
-    resolution: {integrity: sha512-YrwaA0vEKazPBkn0ipTiMpSajYDSe+KjQfrjhcBMxJt/znbvlHd8Pw/Vamaz5EB4Wfhs3SUR3Z9mwRu/P3s3Yg==}
-    engines: {node: '>=8'}
-
   camelcase@5.3.1:
     resolution: {integrity: sha512-L28STB170nwWS63UjtlEOE3dldQApaJXZkOI1uMFfzf3rRuPegHaHesyee+YxQ+W6SvRDQV6UrdOdRiR153wJg==}
     engines: {node: '>=6'}
@@ -5013,9 +4870,6 @@ packages:
   caniuse-lite@1.0.30001651:
     resolution: {integrity: sha512-9Cf+Xv1jJNe1xPZLGuUXLNkE1BoDkqRqYyFJ9TDYSqhduqA4hu4oR9HluGoWYQC/aj8WHjsGVV+bwkh0+tegRg==}
 
-  caseless@0.12.0:
-    resolution: {integrity: sha512-4tYFyifaFfGacoiObjJegolkwSU4xQNGbVgUiNYVUxbQ2x2lUsFvY4hVgVzGiIe6WLOPqycWXA40l+PWsxthUw==}
-
   chai@4.3.7:
     resolution: {integrity: sha512-HLnAzZ2iupm25PlN0xFreAlBA5zaBSv3og0DdeGA4Ar6h6rJ3A0rolRUKJhSF2V10GZKDgWF/VmAEsNWjCRB+A==}
     engines: {node: '>=4'}
@@ -5179,10 +5033,6 @@ packages:
     resolution: {integrity: sha512-NOKm8xhkzAjzFx8B2v5OAHT+u5pRQc2UCa2Vq9jYL/31o2wi9mxBA7LIFs3sV5VSC49z6pEhfbMULvShKj26WA==}
     engines: {node: '>= 6'}
 
-  commander@5.1.0:
-    resolution: {integrity: sha512-P0CysNDQ7rtVw4QIQtm+MRxV66vKFSvlsQvGYXZWR3qFU0jlMKHZZZgw8e+8DSah4UDKMqnknRDQz+xuQXQ/Zg==}
-    engines: {node: '>= 6'}
-
   commander@6.2.1:
     resolution: {integrity: sha512-U7VdrJFnJgo4xjrHpTzu0yrHPGImdsmD95ZlgYSEajAn2JKzDhDTPG9kBTefmObL2w/ngeZnilk+OV9CG3d7UA==}
     engines: {node: '>= 6'}
@@ -5288,9 +5138,6 @@ packages:
   core-js-compat@3.37.1:
     resolution: {integrity: sha512-9TNiImhKvQqSUkOvk/mMRZzOANTiEVC7WaBNhHcKM7x+/5E1l5NvsysR19zuDQScE8k+kfQXWRN3AtS/eOSHpg==}
 
-  core-util-is@1.0.2:
-    resolution: {integrity: sha512-3lqz5YjWTYnW6dlDa5TLaTCcShfar1e40rmcJVwCBJC6mWlFuj0eCHIElmG1g5kyuJ/GD+8Wn4FFCcz4gJPfaQ==}
-
   core-util-is@1.0.3:
     resolution: {integrity: sha512-ZQBvi1DcpJ4GDqanjucZ2Hj3wEO5pZDS89BWbkcrvdxksJorwUDDZamX9ldFkp9aw2lmBDLgkObEA4DWNJ9FYQ==}
 
@@ -5312,9 +5159,6 @@ packages:
   cropperjs@1.5.7:
     resolution: {integrity: sha512-sGj+G/ofKh+f6A4BtXLJwtcKJgMUsXYVUubfTo9grERiDGXncttefmue/fyQFvn8wfdyoD1KhDRYLfjkJFl0yw==}
 
-  cross-spawn@5.1.0:
-    resolution: {integrity: sha512-pTgQJ5KC0d2hcY8eyL1IzlBPYjTkyH72XRZPnLyKus2mBfNjQs3klqbJU2VILqZryAZUt9JOb3h/mWMy23/f5A==}
-
   cross-spawn@6.0.5:
     resolution: {integrity: sha512-eTVLrBSt7fjbDygz805pMnstIs2VTBNkRm0qxZd+M7A5XDdxVRWO5MxGBXZhjY4cqLYLdtrGqRf8mBPmzwSpWQ==}
     engines: {node: '>=4.8'}
@@ -5362,28 +5206,6 @@ packages:
   csstype@3.1.3:
     resolution: {integrity: sha512-M1uQkMl8rQK/szD0LNhtqxIPLpimGm8sOBwU7lLnCpSbTyY3yeU1Vc7l4KT5zT4s/yOxHH5O7tIuuLOCnLADRw==}
 
-  csv-generate@3.4.3:
-    resolution: {integrity: sha512-w/T+rqR0vwvHqWs/1ZyMDWtHHSJaN06klRqJXBEpDJaM/+dZkso0OKh1VcuuYvK3XM53KysVNq8Ko/epCK8wOw==}
-
-  csv-parse@4.16.3:
-    resolution: {integrity: sha512-cO1I/zmz4w2dcKHVvpCr7JVRu8/FymG5OEpmvsZYlccYolPBLoVGKUHgNoc4ZGkFeFlWGEDmMyBM+TTqRdW/wg==}
-
-  csv-stringify@5.6.5:
-    resolution: {integrity: sha512-PjiQ659aQ+fUTQqSrd1XEDnOr52jh30RBurfzkscaE2tPaFsDH5wOAHJiw8XAHphRknCwMUE9KRayc4K/NbO8A==}
-
-  csv@5.5.3:
-    resolution: {integrity: sha512-QTaY0XjjhTQOdguARF0lGKm5/mEq9PD9/VhZZegHDIBq2tQwgNpHc3dneD4mGo2iJs+fTKv5Bp0fZ+BRuY3Z0g==}
-    engines: {node: '>= 0.1.90'}
-
-  cypress@10.11.0:
-    resolution: {integrity: sha512-lsaE7dprw5DoXM00skni6W5ElVVLGAdRUUdZjX2dYsGjbY/QnpzWZ95Zom1mkGg0hAaO/QVTZoFVS7Jgr/GUPA==}
-    engines: {node: '>=12.0.0'}
-    hasBin: true
-
-  dashdash@1.14.1:
-    resolution: {integrity: sha512-jRFi8UDGo6j+odZiEpjazZaWqEal3w/basFjQHQEwVtZJGDpxbH1MeYluwCS8Xq5wmLJooDlMgvVarmWfGM44g==}
-    engines: {node: '>=0.10'}
-
   data-uri-to-buffer@4.0.1:
     resolution: {integrity: sha512-0R9ikRb668HB7QDxT1vkpuUBtqc53YyAwMwGeUFKRojY/NWKvdZ+9UYtRfGmhqNbRkTSVpMbmyhXipFFv2cb/A==}
     engines: {node: '>= 12'}
@@ -5426,14 +5248,6 @@ packages:
       supports-color:
         optional: true
 
-  debug@3.2.7:
-    resolution: {integrity: sha512-CFjzYYAi4ThfiQvizrFQevTTXHtnCqWfe7x1AhgEscTz6ZbLbfoLRLPugTQyBth6f8ZERVUSyWHFD/7Wu4t1XQ==}
-    peerDependencies:
-      supports-color: '*'
-    peerDependenciesMeta:
-      supports-color:
-        optional: true
-
   debug@4.3.2:
     resolution: {integrity: sha512-mOp8wKcvj7XxC78zLgw/ZA+6TSgkoE2C/ienthhRD298T7UNwAg9diBpLRxC0mOezLl4B0xV7M0cCO6P/O0Xhw==}
     engines: {node: '>=6.0'}
@@ -5461,10 +5275,6 @@ packages:
       supports-color:
         optional: true
 
-  decamelize-keys@1.1.0:
-    resolution: {integrity: sha512-ocLWuYzRPoS9bfiSdDd3cxvrzovVMZnRDVEzAs+hWIVXGDbHxWMECij2OBuyB/An0FFW/nLuq6Kv1i/YC5Qfzg==}
-    engines: {node: '>=0.10.0'}
-
   decamelize@1.2.0:
     resolution: {integrity: sha512-z2S+W9X73hAUUki+N+9Za2lBlun89zigOyGrsax+KUQ6wKW4ZoWpEYBkGhQjwAjjDCkWxhY0VKEhk8wzY7F5cA==}
     engines: {node: '>=0.10.0'}
@@ -5666,9 +5476,6 @@ packages:
   easy-table@1.1.0:
     resolution: {integrity: sha512-oq33hWOSSnl2Hoh00tZWaIPi1ievrD9aFG82/IgjlycAnW9hHx5PkJiXpxPsgEE+H7BsbVQXFVFST8TEXS6/pA==}
 
-  ecc-jsbn@0.1.2:
-    resolution: {integrity: sha512-eh9O+hwRHNbG4BLTjEl3nw044CkGm5X6LoaCf7LPp7UU8Qrt47JYNi6nPX8xjW97TKGKm1ouctg0QSpZe9qrnw==}
-
   editorconfig@1.0.4:
     resolution: {integrity: sha512-L9Qe08KWTlqYMVvMcTIvMAdl1cDUubzRNYL+WfA4bLDMHe4nemKkpmYzkznE1FwLKu0EEmy6obgQKzMJrg4x9Q==}
     engines: {node: '>=14'}
@@ -5802,9 +5609,6 @@ packages:
     resolution: {integrity: sha512-3T8uNMC3OQTHkFUsFq8r/BwAXLHvU/9O9mE0fBc/MY5iq/8H7ncvO947LmYA6ldWw9Uh8Yhf25zu6n7nML5QWQ==}
     engines: {node: '>= 0.4'}
 
-  es-shim-unscopables@1.0.0:
-    resolution: {integrity: sha512-Jm6GPcCdC30eMLbZ2x8z2WuRwAws3zTBBKuusffYVUrNj/GVSUAZ+xKMaUpfNDR5IbyNA5LJbaecoUVbmUcB1w==}
-
   es-to-primitive@1.2.1:
     resolution: {integrity: sha512-QCOllgZJtaUo9miYBcLChTUaHNjJF3PYs1VidD7AwiEj1kYxKeQTctLAezAOH5ZKRH0g2IgPn6KwB4IT8iRpvA==}
     engines: {node: '>= 0.4'}
@@ -6000,11 +5804,6 @@ packages:
     peerDependencies:
       eslint: '>=7.0.0'
 
-  eslint-plugin-cypress@2.13.3:
-    resolution: {integrity: sha512-nAPjZE5WopCsgJwl3vHm5iafpV+ZRO76Z9hMyRygWhmg5ODXDPd+9MaPl7kdJ2azj+sO87H3P1PRnggIrz848g==}
-    peerDependencies:
-      eslint: '>= 3.2.1'
-
   eslint-plugin-prettier@4.2.1:
     resolution: {integrity: sha512-f/0rXLXUt0oFYs8ra4w49wYZBG5GKZpAYsJSm6rnYL5uVDjd+zowwMwVZHnAjf4edNrKpCDYfXDgmRE/Ak7QyQ==}
     engines: {node: '>=12.0.0'}
@@ -6087,9 +5886,6 @@ packages:
   event-stream@3.3.4:
     resolution: {integrity: sha512-QHpkERcGsR0T7Qm3HNJSyXKEEj8AHNxkY3PK8TS2KJvQ7NiSHe3DDpwVKKtoYprL/AreyzFBeIkBIWChAqn60g==}
 
-  eventemitter2@6.4.7:
-    resolution: {integrity: sha512-tYUSVOGeQPKt/eC1ABfhHy5Xd96N3oIijJvN3O9+TsC28T5V9yX9oEfEK5faP0EFSNVOG97qtAS68GBrQB2hDg==}
-
   eventemitter3@4.0.7:
     resolution: {integrity: sha512-8guHBZCwKnFhYdHr2ysuRWErTwhoN2X8XELRlrRwpmfeY2jjuUN4taQMsULKUVo1K4DvZl+0pgfyoysHxvmvEw==}
 
@@ -6097,10 +5893,6 @@ packages:
     resolution: {integrity: sha512-mQw+2fkQbALzQ7V0MY0IqdnXNOeTtP4r0lN9z7AAawCXgqea7bDii20AYrIBrFd/Hx0M2Ocz6S111CaFkUcb0Q==}
     engines: {node: '>=0.8.x'}
 
-  execa@4.1.0:
-    resolution: {integrity: sha512-j5W0//W7f8UxAn8hXVnwG8tLwdiUy4FJLcSupCg6maBYZDpyBvTApK7KyuI4bKj8KOh1r2YH+6ucuYtJv1bTZA==}
-    engines: {node: '>=10'}
-
   execa@5.1.1:
     resolution: {integrity: sha512-8uSpZZocAZRBAPIEINJj3Lo9HyGitllczc27Eh5YYojjMFMn8yHMDMaUHE2Jqfq05D/wucwI4JGURyXt1vchyg==}
     engines: {node: '>=10'}
@@ -6117,10 +5909,6 @@ packages:
     resolution: {integrity: sha512-VyhnebXciFV2DESc+p6B+y0LjSm0krU4OgJN44qFAhBY0TJ+1V61tYD2+wHusZ6F9n5K+vl8k0sTy7PEfV4qpg==}
     engines: {node: '>=16.17'}
 
-  executable@4.1.1:
-    resolution: {integrity: sha512-8iA79xD3uAch729dUG8xaaBBFGaEa0wdD2VkYLFHwlqosEj/jT66AzcreRDSgV7ehnNLBW2WR5jIXwGKjVdTLg==}
-    engines: {node: '>=4'}
-
   exifr@7.1.3:
     resolution: {integrity: sha512-g/aje2noHivrRSLbAUtBPWFbxKdKhgj/xr1vATDdUXPOFYJlQ62Ft0oy+72V6XLIpDJfHs6gXLbBLAolqOXYRw==}
 
@@ -6131,9 +5919,6 @@ packages:
   extend@3.0.2:
     resolution: {integrity: sha512-fjquC59cD7CyW6urNXK0FBufkZcoiGG80wTuPujX590cB5Ttln20E2UB4S/WARVqhXffZl2LNgS+gQdPIIim/g==}
 
-  extendable-error@0.1.7:
-    resolution: {integrity: sha512-UOiS2in6/Q0FK0R0q6UY9vYpQ21mr/Qn1KOnte7vsACuNJf514WvCCUHSRCPcgjPT2bAhNIJdlE6bVap1GKmeg==}
-
   external-editor@3.1.0:
     resolution: {integrity: sha512-hMQ4CX1p1izmuLYyZqLMO/qGNw10wSv9QDCPfzXfyFrOaCSSoRfqE1Kf1s5an66J5JZC62NewG+mK49jOCtQew==}
     engines: {node: '>=4'}
@@ -6142,15 +5927,6 @@ packages:
     resolution: {integrity: sha512-xoh5G1W/PB0/27lXgMQyIhP5DSY/LhoCsOyZgb+6iMmRtCwVBo55uKaMoEYrDCKQhWvqEip5ZPKAc6eFNyf/MA==}
     hasBin: true
 
-  extract-zip@2.0.1:
-    resolution: {integrity: sha512-GDhU9ntwuKyGXdZBUgTIe+vXnWj0fppUEtMDL0+idd5Sta8TGpHssn/eusA9mrPr9qNDym6SxAYZjNvCn/9RBg==}
-    engines: {node: '>= 10.17.0'}
-    hasBin: true
-
-  extsprintf@1.3.0:
-    resolution: {integrity: sha512-11Ndz7Nv+mvAC1j0ktTa7fAb0vLyGGX+rMHNBYQviQDGU0Hw7lhctJANqbPhu9nV9/izT/IntTgZ7Im/9LJs9g==}
-    engines: {'0': node >=0.6.0}
-
   fast-deep-equal@3.1.3:
     resolution: {integrity: sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==}
 
@@ -6243,9 +6019,6 @@ packages:
     resolution: {integrity: sha512-78/PXT1wlLLDgTzDs7sjq9hzz0vXD+zn+7wypEe4fXQxCmdmqfGsEPQxmiCSQI3ajFV91bVSsvNtrJRiW6nGng==}
     engines: {node: '>=10'}
 
-  find-yarn-workspace-root2@1.2.16:
-    resolution: {integrity: sha512-hr6hb1w8ePMpPVUK39S4RlwJzi+xPLuVuG8XlwXU3KD5Yn3qgBWVfy3AzNlDhWvE1EORCE65/Qm26rFQt3VLVA==}
-
   flat-cache@3.0.4:
     resolution: {integrity: sha512-dm9s5Pw7Jc0GvMYbshN6zchCA9RgQlzzEZX3vylR9IqFfS8XciblUXOKfW6SiuJ0e13eDYZoZV5wdrev7P3Nwg==}
     engines: {node: ^10.12.0 || >=12.0.0}
@@ -6286,17 +6059,10 @@ packages:
     resolution: {integrity: sha512-TMKDUnIte6bfb5nWv7V/caI169OHgvwjb7V4WkeUvbQQdjr5rWKqHFiKWb/fcOwB+CzBT+qbWjvj+DVwRskpIg==}
     engines: {node: '>=14'}
 
-  forever-agent@0.6.1:
-    resolution: {integrity: sha512-j0KLYPhm6zeac4lz3oJ3o65qvgQCcPubiyotZrXqEaG4hNagNYO8qdlUrX5vwqv9ohqeT/Z3j6+yW067yWWdUw==}
-
   form-data-encoder@2.1.4:
     resolution: {integrity: sha512-yDYSgNMraqvnxiEXO4hi88+YZxaHC6QKzb5N84iRCTDeRO7ZALpir/lVmf/uXUhnwUr2O4HU8s/n6x+yNjQkHw==}
     engines: {node: '>= 14.17'}
 
-  form-data@2.3.3:
-    resolution: {integrity: sha512-1lLKB2Mu3aGP1Q/2eCOx0fNbRMe7XdwktwOruhfqqd0rIJWwN4Dh+E3hrPSlDCXnSR7UtZ1N38rVXm+6+MEhJQ==}
-    engines: {node: '>= 0.12'}
-
   form-data@4.0.0:
     resolution: {integrity: sha512-ETEklSGi5t0QMZuiXoA/Q6vcnxcLQP5vdugSpuAyi6SVGi2clPPp+xgEhuMaHC+zGgn31Kd235W35f7Hykkaww==}
     engines: {node: '>= 6'}
@@ -6417,10 +6183,6 @@ packages:
     resolution: {integrity: sha512-g/Q1aTSDOxFpchXC4i8ZWvxA1lnPqx/JHqcpIw0/LX9T8x/GBbi6YnlN5nhaKIFkT8oFsscUKgDJYxfwfS6QsQ==}
     engines: {node: '>=8'}
 
-  get-stream@5.2.0:
-    resolution: {integrity: sha512-nBF+F1rAZVCu/p7rjzgA+Yb4lfYXrpl7a6VmJrU8wF9I1CKvP/QwPNZHnOlwbTkY6dvtFIzFMSyQXbLoTQPRpA==}
-    engines: {node: '>=8'}
-
   get-stream@6.0.1:
     resolution: {integrity: sha512-ts6Wi+2j3jQjqi70w5AlN8DFnkSwC+MqmxEzdEALB2qXZYV3X/b1CTfgPLGJNMeAWxdPfU8FO1ms3NUfaHCPYg==}
     engines: {node: '>=10'}
@@ -6441,12 +6203,6 @@ packages:
     resolution: {integrity: sha512-5KLucCJobh8vBY1K07EFV4+cPZH3mrV9YeAruUseCQKHB58SGjjT2l9/eA9LD082IiuMjSlFJEcdJ27TXvbZNw==}
     engines: {node: '>= 14'}
 
-  getos@3.2.1:
-    resolution: {integrity: sha512-U56CfOK17OKgTVqozZjUKNdkfEv6jk5WISBJ8SHoagjE6L69zOwl3Z+O8myjY9MEW3i2HPWQBt/LTbCgcC973Q==}
-
-  getpass@0.1.7:
-    resolution: {integrity: sha512-0fzj9JxOLfJ+XGLhR8ze3unN0KZCgZwiSSDz168VERjK8Wl8kVSdcu2kspd4s4wtAa1y/qrVRiAA0WclVsu0ng==}
-
   giget@1.1.3:
     resolution: {integrity: sha512-zHuCeqtfgqgDwvXlR84UNgnJDuUHQcNI5OqWqFxxuk2BshuKbYhJWdxBsEo4PvKqoGh23lUAIvBNpChMLv7/9Q==}
     hasBin: true
@@ -6552,10 +6308,6 @@ packages:
     engines: {node: '>=0.4.7'}
     hasBin: true
 
-  hard-rejection@2.1.0:
-    resolution: {integrity: sha512-VIZB+ibDhx7ObhAe7OVtoEbuP4h/MuOTHJ+J8h/eBXotJYl0fBgR72xDFCKgIh22OJZIOVNxBMWuhAr10r8HdA==}
-    engines: {node: '>=6'}
-
   has-bigints@1.0.2:
     resolution: {integrity: sha512-tSvCKtBr9lkF0Ex0aQiP9N+OpV4zi2r/Nee5VkRDbaqv35RLYMzbwQfFSZZH0kR+Rd6302UJZ2p/bJCEoR3VoQ==}
 
@@ -6656,10 +6408,6 @@ packages:
     resolution: {integrity: sha512-+ZT+iBxVUQ1asugqnD6oWoRiS25AkjNfG085dKJGtGxkdwLQrMKU5wJr2bOOFAXzKcTuqq+7fZlTMgG3SRfIYQ==}
     engines: {node: '>= 14'}
 
-  http-signature@1.3.6:
-    resolution: {integrity: sha512-3adrsD6zqo4GsTqtO7FyrejHNv+NgiIfAfv68+jVlFmSr9OGy7zrxONceFRLKvnnZA5jbxQBX1u9PpB6Wi32Gw==}
-    engines: {node: '>=0.10'}
-
   http2-wrapper@2.2.1:
     resolution: {integrity: sha512-V5nVw1PAOgfI3Lmeaj2Exmeg7fenjhRUgz1lPSezy1CuhPYbgQtbQj4jZfEAEMlaL+vupsvhjqCyjzob0yxsmQ==}
     engines: {node: '>=10.19.0'}
@@ -6680,13 +6428,6 @@ packages:
     resolution: {integrity: sha512-wlwpilI7YdjSkWaQ/7omYBMTliDcmCN8OLihO6I9B86g06lMyAoqgoDpV0XqoaPOKj+0DIdAvnsWfyAAhmimcg==}
     engines: {node: '>= 14'}
 
-  human-id@1.0.2:
-    resolution: {integrity: sha512-UNopramDEhHJD+VR+ehk8rOslwSfByxPIZyJRfV739NDhN5LF1fa1MqnzKm2lGTQRjNrjK19Q5fhkgIfjlVUKw==}
-
-  human-signals@1.1.1:
-    resolution: {integrity: sha512-SEQu7vl8KjNL2eoGBLF3+wAjpsNfA9XMlXAYj/3EdaNfAlxKthD1xjEQfGOUhllCGGJVNY34bRr6lPINhNjyZw==}
-    engines: {node: '>=8.12.0'}
-
   human-signals@2.1.0:
     resolution: {integrity: sha512-B4FFZ6q/T2jhhksgkbEW3HBvWIfDW85snkQgawt07S7J5QXTk6BkNV+0yAeZrM5QpMAdYlocGoljn0sJ/WQkFw==}
     engines: {node: '>=10.17.0'}
@@ -6968,10 +6709,6 @@ packages:
     resolution: {integrity: sha512-Fd4gABb+ycGAmKou8eMftCupSir5lRxqf4aD/vd0cD2qc4HL07OjCeuHMr8Ro4CoMaeCKDB0/ECBOVWjTwUvPQ==}
     engines: {node: '>=8'}
 
-  is-plain-obj@1.1.0:
-    resolution: {integrity: sha512-yvkRyxmFKEOQ4pNXCmJG5AEQNlXJS5LaONXo5/cLdTZdWvsZ1ioJEonLGAosKlMWE8lwUy/bJzMjcw8az73+Fg==}
-    engines: {node: '>=0.10.0'}
-
   is-plain-object@2.0.4:
     resolution: {integrity: sha512-h5PpgXkWitc38BBMYawTYMWJHFZJVnBquFE57xFpjB8pJFiF6gZ+bU+WyI/yqXiFR5mdLsgYNaPe8uao6Uv9Og==}
     engines: {node: '>=0.10.0'}
@@ -7025,10 +6762,6 @@ packages:
     resolution: {integrity: sha512-tE2UXzivje6ofPW7l23cjDOMa09gb7xlAqG6jG5ej6uPV32TlWP3NKPigtaGeHNu9fohccRYvIiZMfOOnOYUtg==}
     engines: {node: '>= 0.4'}
 
-  is-subdir@1.2.0:
-    resolution: {integrity: sha512-2AT6j+gXe/1ueqbW6fLZJiIw3F8iXGJtt0yDrZaBhAZEG1raiTxKWU+IPqMCzQAXOUCKdA4UDMgacKH25XG2Cw==}
-    engines: {node: '>=4'}
-
   is-symbol@1.0.4:
     resolution: {integrity: sha512-C/CPBqKWnvdcxqIARxyOh4v1UUEOCHpgDa0WYgpKDFMszcrPcffg5uhwSgPCLD2WWxmq6isisz87tzT01tuGhg==}
     engines: {node: '>= 0.4'}
@@ -7068,10 +6801,6 @@ packages:
     resolution: {integrity: sha512-ZhMwEosbFJkA0YhFnNDgTM4ZxDRsS6HqTo7qsZM08fehyRYIYa0yHu5R6mgo1n/8MgaPBXiPimPD77baVFYg+A==}
     engines: {node: '>=12.13'}
 
-  is-windows@1.0.2:
-    resolution: {integrity: sha512-eXK1UInq2bPmjyX6e3VHIzMLobc4J94i4AWn+Hpq3OU5KkrRC96OAcR3PRJ/pGu6m8TRnBHP9dkXQVsT/COVIA==}
-    engines: {node: '>=0.10.0'}
-
   is-wsl@2.2.0:
     resolution: {integrity: sha512-fKzAra0rGJUUBwGBgNkHZuToZcn+TtXHpeCgmkMJMMYx1sQDYaCSyjJBSCa2nH1DGm7s3n1oBnohoVTBaN7Lww==}
     engines: {node: '>=8'}
@@ -7097,9 +6826,6 @@ packages:
     resolution: {integrity: sha512-WhB9zCku7EGTj/HQQRz5aUQEUeoQZH2bWcltRErOpymJ4boYE6wL9Tbr23krRPSZ+C5zqNSrSw+Cc7sZZ4b7vg==}
     engines: {node: '>=0.10.0'}
 
-  isstream@0.1.2:
-    resolution: {integrity: sha512-Yljz7ffyPbrLpLngrMtZ7NduUgVvi6wG9RJ9IUcyCd59YQ911PBJphODUcbOVbqYfxe1wuYf/LJ8PauMRwsM/g==}
-
   issue-parser@6.0.0:
     resolution: {integrity: sha512-zKa/Dxq2lGsBIXQ7CUZWTHfvxPC2ej0KfO7fIPqLlHB9J2hJ7rGhZ5rilhuufylr4RXYPzJUeFjKxz305OsNlA==}
     engines: {node: '>=10.13'}
@@ -7205,9 +6931,6 @@ packages:
     resolution: {integrity: sha512-wpxZs9NoxZaJESJGIZTyDEaYpl0FKSA+FB9aJiyemKhMwkxQg63h4T1KJgUGHpTqPDNRcmmYLugrRjJlBtWvRA==}
     hasBin: true
 
-  jsbn@0.1.1:
-    resolution: {integrity: sha512-UVU9dibq2JcFWxQPA6KCqj5O42VOmAY3zQUfEKxU0KpTGXwNoCjkX1e13eHNvw/xPynt6pU0rZ1htjWTNTSXsg==}
-
   jscodeshift@0.15.1:
     resolution: {integrity: sha512-hIJfxUy8Rt4HkJn/zZPU9ChKfKZM1342waJ1QC2e2YsPcWhM+3BJ4dcfQCzArTrk1jJeNLB341H+qOcEHRxJZg==}
     hasBin: true
@@ -7259,9 +6982,6 @@ packages:
   json-stable-stringify-without-jsonify@1.0.1:
     resolution: {integrity: sha512-Bdboy+l7tA3OGW6FjyFHWkP5LuByj1Tk33Ljyq0axyzdk9//JSi2u3fP1QSmd1KNwq6VOKYGlAu87CisVir6Pw==}
 
-  json-stringify-safe@5.0.1:
-    resolution: {integrity: sha512-ZClg6AaYvamvYEE82d3Iyd3vSSIjQ+odgjaTzRuO3s7toCdFKczob2i0zCh7JE8kWn17yvAWhUVxvqGwUalsRA==}
-
   json5@2.2.3:
     resolution: {integrity: sha512-XmOWe7eyHYH14cLdVPoyg+GOH3rYX++KpzrylJwSW98t3Nk+U8XOl8FWKOgwtzdb8lXGf6zYwDUzeHMWfxasyg==}
     engines: {node: '>=6'}
@@ -7284,10 +7004,6 @@ packages:
     resolution: {integrity: sha512-p/nXbhSEcu3pZRdkW1OfJhpsVtW1gd4Wa1fnQc9YLiTfAjn0312eMKimbdIQzuZl9aa9xUGaRlP9T/CJE/ditQ==}
     engines: {node: '>=0.10.0'}
 
-  jsprim@2.0.2:
-    resolution: {integrity: sha512-gqXddjPqQ6G40VdnI6T6yObEC+pDNvyP95wdQhkWkg7crHH3km5qP1FsOXEkzEQwnz6gz5qGTn1c2Y52wP3OyQ==}
-    engines: {'0': node >=0.6.0}
-
   jstransformer@1.0.0:
     resolution: {integrity: sha512-C9YK3Rf8q6VAPDCCU9fnqo3mAfOH6vUGnMcP4AQAYIEpWtfGLpwOTmZ+igtdK5y+VvI2n3CyYSzy4Qh34eq24A==}
 
@@ -7305,10 +7021,6 @@ packages:
     resolution: {integrity: sha512-eTIzlVOSUR+JxdDFepEYcBMtZ9Qqdef+rnzWdRZuMbOywu5tO2w2N7rqjoANZ5k9vywhL6Br1VRjUIgTQx4E8w==}
     engines: {node: '>=6'}
 
-  kleur@4.1.5:
-    resolution: {integrity: sha512-o+NO+8WrRiQEE4/7nwRJhN1HWpVmJm511pBHUxPLtp0BUISzlBplORYSmTclCnJvQq2tKu/sgl3xVpkc7ZWuQQ==}
-    engines: {node: '>=6'}
-
   kolorist@1.8.0:
     resolution: {integrity: sha512-Y+60/zizpJ3HRH8DCss+q95yr6145JXZo46OTpFvDZWLfRCE4qChOyk1b26nMaNpfHHgxagk9dXT5OP0Tfe+dQ==}
 
@@ -7366,15 +7078,6 @@ packages:
     engines: {node: ^14.13.1 || >=16.0.0}
     hasBin: true
 
-  listr2@3.14.0:
-    resolution: {integrity: sha512-TyWI8G99GX9GjE54cJ+RrNMcIFBfwMPxc3XTFiAYGN4s10hWROGtOg7+O6u6LE3mNkyld7RSLE6nrKBvTfcs3g==}
-    engines: {node: '>=10.0.0'}
-    peerDependencies:
-      enquirer: '>= 2.3.0 < 3'
-    peerDependenciesMeta:
-      enquirer:
-        optional: true
-
   listr2@5.0.8:
     resolution: {integrity: sha512-mC73LitKHj9w6v30nLNGPetZIlfpUniNSsxxrbaPcWOjDb92SHPzJPi/t+v1YC/lxKz/AJ9egOjww0qUuFxBpA==}
     engines: {node: ^14.13.1 || >=16.0.0}
@@ -7388,10 +7091,6 @@ packages:
     resolution: {integrity: sha512-Kx8hMakjX03tiGTLAIdJ+lL0htKnXjEZN6hk/tozf/WOuYGdZBJrZ+rCJRbVCugsjB3jMLn9746NsQIf5VjBMw==}
     engines: {node: '>=4'}
 
-  load-yaml-file@0.2.0:
-    resolution: {integrity: sha512-OfCBkGEw4nN6JLtgRidPX6QxjBQGQf72q3si2uvqyFEMbycSFFHwAZeXx6cJgFM9wmLrf9zBwCP3Ivqa+LLZPw==}
-    engines: {node: '>=6'}
-
   loader-runner@4.3.0:
     resolution: {integrity: sha512-3R/1M+yS3j5ou80Me59j7F9IMs4PXs3VqRrm0TU3AbKPxlmpoY1TNscJV/oGJXo8qCatFGTfDbY6W6ipGOYXfg==}
     engines: {node: '>=6.11.5'}
@@ -7444,15 +7143,9 @@ packages:
   lodash.mergewith@4.6.2:
     resolution: {integrity: sha512-GK3g5RPZWTRSeLSpgP8Xhra+pnjBC56q9FZYe1d5RN3TJ35dbkGy3YqBSMbyCrlbi+CM9Z3Jk5yTL7RCsqboyQ==}
 
-  lodash.once@4.1.1:
-    resolution: {integrity: sha512-Sb487aTOCr9drQVL8pIxOzVhafOjZN9UU54hiN8PU3uAiSV7lx1yYNpbNmex2PK6dSJoNTSJUUswT651yww3Mg==}
-
   lodash.sortby@4.7.0:
     resolution: {integrity: sha512-HDWXG8isMntAyRF5vZ7xKuEvOhT4AhlRt/3czTSjvGUxjYCBVRQY48ViDHyfYz9VIoBkW4TMGQNapx+l3RUwdA==}
 
-  lodash.startcase@4.4.0:
-    resolution: {integrity: sha512-+WKqsK294HMSc2jEbNgpHpd0JfIBhp7rEV4aqXWqFr6AlXov+SlcgB1Fv01y2kGe3Gc8nMW7VA0SrGuSkRfIEg==}
-
   lodash.uniqby@4.7.0:
     resolution: {integrity: sha512-e/zcLx6CSbmaEgFHCA7BnoQKyCtKMxnuWrJygbwPs/AIn+IMKl66L8/s+wBUn5LRw2pZx3bUHibiV1b6aTWIww==}
 
@@ -7494,9 +7187,6 @@ packages:
     resolution: {integrity: sha512-/1clY/ui8CzjKFyjdvwPWJUYKiFVXG2I2cY0ssG7h4+hwk+XOIX7ZSG9Q7TW8TW3Kp3BUSqgFWBLgL4PJ+Blag==}
     engines: {node: 14 || >=16.14}
 
-  lru-cache@4.1.5:
-    resolution: {integrity: sha512-sWZlbEP2OsHNkXrMl5GYk/jKk70MBng6UU4YI/qGDYbgf6YbP4EvmqISbXCoJiRKs+1bSpFHVgQxvJ17F2li5g==}
-
   lru-cache@5.1.1:
     resolution: {integrity: sha512-KpNARQA3Iwv+jTA0utUVVbrh+Jlrr1Fv0e56GGzAFOXN7dk/FviaDW8LHmK52DlcH4WP2n6gI8vN1aesBFgo9w==}
 
@@ -7545,14 +7235,6 @@ packages:
   makeerror@1.0.12:
     resolution: {integrity: sha512-JmqCvUhmt43madlpFzG4BQzG2Z3m6tvQDNKdClZnO3VbIudJYmxsT0FNJMeiB2+JTSlTQTSbU8QdesVmwJcmLg==}
 
-  map-obj@1.0.1:
-    resolution: {integrity: sha512-7N/q3lyZ+LVCp7PzuxrJr4KMbBE2hW7BT7YNia330OFxIf4d3r5zVpicP2650l7CPN6RM9zOJRl3NGpqSiw3Eg==}
-    engines: {node: '>=0.10.0'}
-
-  map-obj@4.3.0:
-    resolution: {integrity: sha512-hdN1wVrZbb29eBGiGjJbeP8JbKjq1urkHJ/LIP/NY48MZ1QVXUsQBV1G1zvYFHn1XE06cwjBsOI2K3Ulnj1YXQ==}
-    engines: {node: '>=8'}
-
   map-or-similar@1.5.0:
     resolution: {integrity: sha512-0aF7ZmVon1igznGI4VS30yugpduQW3y3GkcgGJOp7d8x8QrizhigUxjI/m2UojsXXto+jLAH3KSz+xOJTiORjg==}
 
@@ -7595,10 +7277,6 @@ packages:
     resolution: {integrity: sha512-S3UwM3yj5mtUSEfP41UZmt/0SCoVYUcU1rkXv+BQ5Ig8ndL4sPoJNBUJERafdPb5jjHJGuMgytgKvKIf58XNBw==}
     engines: {node: '>= 0.10.0'}
 
-  meow@6.1.1:
-    resolution: {integrity: sha512-3YffViIt2QWgTy6Pale5QpopX/IvU3LPL03jOTqp6pGj3VjesdO/U8CuHMKpnQr4shCNCM5fd5XFFvIIl6JBHg==}
-    engines: {node: '>=8'}
-
   merge-descriptors@1.0.1:
     resolution: {integrity: sha512-cCi6g3/Zr1iqQi6ySbseM1Xvooa98N0w31jzUYrXPX2xqObmFGHJ0tQ5u74H3mVh7wLouTseZyYIq39g8cNp1w==}
 
@@ -7654,10 +7332,6 @@ packages:
     resolution: {integrity: sha512-e5ISH9xMYU0DzrT+jl8q2ze9D6eWBto+I8CNpe+VI+K2J/F/k3PdkdTdz4wvGVH4NTpo+NRYTVIuMQEMMcsLqg==}
     engines: {node: ^12.20.0 || ^14.13.1 || >=16.0.0}
 
-  min-indent@1.0.1:
-    resolution: {integrity: sha512-I9jwMn07Sy/IwOj3zVkVik2JTvgpaykDZEigL6Rx6N9LbMywwUSMtxET+7lVoDLLd3O3IXwJwvuuns8UB/HeAg==}
-    engines: {node: '>=4'}
-
   mini-svg-data-uri@1.4.4:
     resolution: {integrity: sha512-r9deDe9p5FJUPZAk3A59wGH7Ii9YrjjWw0jmw/liSbHl2CHiyXj6FcDXDu2K3TjVAXqiJdaw3xxwlZZr9E6nHg==}
     hasBin: true
@@ -7680,10 +7354,6 @@ packages:
     resolution: {integrity: sha512-RHiac9mvaRw0x3AYRgDC1CxAP7HTcNrrECeA8YYJeWnpo+2Q5CegtZjaotWTWxDG3UeGA1coE05iH1mPjT/2mg==}
     engines: {node: '>=16 || 14 >=14.17'}
 
-  minimist-options@4.1.0:
-    resolution: {integrity: sha512-Q4r8ghd80yhO/0j1O3B2BjweX3fiHg9cdOwjJd2J76Q135c+NDxGCqdYKQ1SKBuFfgWbAUzBfvYjPUEeNgqN1A==}
-    engines: {node: '>= 6'}
-
   minimist@1.2.6:
     resolution: {integrity: sha512-Jsjnk4bw3YJqYzbdyBiNsPWHPfO++UGG749Cxs6peCu5Xg4nrena6OVxOYxrQTqww0Jmwt+Ref8rggumkTLz9Q==}
 
@@ -7709,10 +7379,6 @@ packages:
   mitt@3.0.1:
     resolution: {integrity: sha512-vKivATfr97l2/QBCYAkXYDbrIWPM2IIKEl7YPhjCvKlG3kE2gm+uBo6nEXK3M5/Ffh/FLpKExzOQ3JJoJGFKBw==}
 
-  mixme@0.5.4:
-    resolution: {integrity: sha512-3KYa4m4Vlqx98GPdOHghxSdNtTvcP8E0kkaJ5Dlh+h2DRzF7zpuVVcA8B0QpKd11YJeP9QQ7ASkKzOeu195Wzw==}
-    engines: {node: '>= 8.0.0'}
-
   mkdirp-classic@0.5.3:
     resolution: {integrity: sha512-gKLcREMhtuZRwRAfqP3RFW+TK4JqApVBtOIftVgjuABpAtpxhPGaDcfvbhNvD0B8iD1oUr/txX35NjcaY6Ns/A==}
 
@@ -7996,12 +7662,6 @@ packages:
     resolution: {integrity: sha512-D2FR03Vir7FIu45XBY20mTb+/ZSWB00sjU9jdQXt83gDrI4Ztz5Fs7/yy74g2N5SVQY4xY1qDr4rNddwYRVX0g==}
     engines: {node: '>=0.10.0'}
 
-  ospath@1.2.2:
-    resolution: {integrity: sha512-o6E5qJV5zkAbIDNhGSIlyOhScKXgQrSRMilfph0clDfM0nEnBOlKlH4sWDmG95BW/CvwNz0vmm7dJVtU2KlMiA==}
-
-  outdent@0.5.0:
-    resolution: {integrity: sha512-/jHxFIzoMXdqPzTaCpFzAAWhpkSjZPF4Vsn6jAfNpmbH/ymsmd7Qc6VE9BGn0L6YMj6uwpQLxCECpus4ukKS9Q==}
-
   overlayscrollbars-vue@0.5.7:
     resolution: {integrity: sha512-i+jjyFXcCWlDhN3nOo0kt81NgwaixEvY60H/G2iixF2pAm4BnXi/i6muSWb5+rATd4I5TYnA+k5QYHmdI/Wvew==}
     peerDependencies:
@@ -8015,10 +7675,6 @@ packages:
     resolution: {integrity: sha512-mlVgR3PGuzlo0MmTdk4cXqXWlwQDLnONTAg6sm62XkMJEiRxN3GL3SffkYvqwonbkJBcrI7Uvv5Zh9yjvn2iUw==}
     engines: {node: '>=12.20'}
 
-  p-filter@2.1.0:
-    resolution: {integrity: sha512-ZBxxZ5sL2HghephhpGAQdoskxplTwr7ICaehZwLIlfL6acuVgZPm8yBNuRAFBGEqtD/hmUeq9eqLg2ys9Xr/yw==}
-    engines: {node: '>=8'}
-
   p-limit@2.3.0:
     resolution: {integrity: sha512-//88mFWSJx8lxCzwdAABTJL2MyWB12+eIY7MDL2SqLmAkeKU9qxRvWuSyTjm3FUmpBEMuFfckAIqEaVGUDxb6w==}
     engines: {node: '>=6'}
@@ -8043,10 +7699,6 @@ packages:
     resolution: {integrity: sha512-LaNjtRWUBY++zB5nE/NwcaoMylSPk+S+ZHNB1TzdbMJMny6dynpAGt7X/tl/QYq3TIeE6nxHppbo2LGymrG5Pw==}
     engines: {node: '>=10'}
 
-  p-map@2.1.0:
-    resolution: {integrity: sha512-y3b8Kpd8OAN444hxfBbFfj1FY/RjtTd8tzYwhUqNYXx0fXx2iX4maP4Qr6qhIKbQXI02wTLAda4fYUbDagTUFw==}
-    engines: {node: '>=6'}
-
   p-map@4.0.0:
     resolution: {integrity: sha512-/bjOqmgETBYB5BoEeGVea8dmvHb2m9GLy1E9W43yeyfP6QQCZGFNa+XRceJEuDB6zqr+gKpIAmlLebMpykw/MQ==}
     engines: {node: '>=10'}
@@ -8192,9 +7844,6 @@ packages:
   perfect-debounce@1.0.0:
     resolution: {integrity: sha512-xCy9V055GLEqoFaHoC1SoLIaLmWctgCUaBaWxDZ7/Zx4CTyX7cJQLJOok/orfjZAh9kEYpjJa4d0KcJmCbctZA==}
 
-  performance-now@2.1.0:
-    resolution: {integrity: sha512-7EAHlyLHI56VEIdK57uwHdHKIaAGbnXPiw0yWbarQZOKaKpvUIgW0jWRVLiatnM+XXlSwsanIBH/hzGMJulMow==}
-
   picocolors@0.2.1:
     resolution: {integrity: sha512-cMlDqaLEqfSaW8Z7N5Jw+lyIW869EzT73/F5lhtY9cLGoVxSXznfgfXMO0Z5K0o0Q2TkTXq+0KFsdnSe3jDViA==}
 
@@ -8385,10 +8034,6 @@ packages:
   preact@10.11.2:
     resolution: {integrity: sha512-skAwGDFmgxhq1DCBHke/9e12ewkhc7WYwjuhHB8HHS8zkdtITXLRmUMTeol2ldxvLwYtwbFeifZ9uDDWuyL4Iw==}
 
-  preferred-pm@3.0.3:
-    resolution: {integrity: sha512-+wZgbxNES/KlJs9q40F/1sfOd/j7f1O9JaHcW5Dsn3aUUOZg3L2bjpVUcKV2jvtElYfoTuQiNeMfQJ4kwUAhCQ==}
-    engines: {node: '>=10'}
-
   prelude-ls@1.1.2:
     resolution: {integrity: sha512-ESF23V4SKG6lVSGZgYNpbsiaAkdab6ZgOxe52p7+Kid3W3u3bxR4Vfd/o21dmN7jSt0IwgZ4v5MUd26FEtXE9w==}
     engines: {node: '>= 0.8.0'}
@@ -8540,9 +8185,6 @@ packages:
     resolution: {integrity: sha512-Rb5RVBy1iyqOtNl15Cw/llpeLH8bsb37gM1FUfKQ+Wck6xHlbAhWGUFiTRHtkjqGTA5pSHz6+0hrPW/oECihPQ==}
     engines: {node: '>= 14'}
 
-  proxy-from-env@1.0.0:
-    resolution: {integrity: sha512-F2JHgJQ1iqwnHDcQjVBsq3n/uoaFL+iPW/eAeL7kVxy/2RrWaN4WroKjjvbsoRtv0ftelNyC01bjRhn/bhcf4A==}
-
   proxy-from-env@1.1.0:
     resolution: {integrity: sha512-D+zkORCbA9f1tdWRK0RaCR3GPv50cMxcrz4X8k5LTSUD1Dkw47mKJEZQNunItRTkWwgtaUSo1RVFRIG9ZXiFYg==}
 
@@ -8554,9 +8196,6 @@ packages:
     engines: {node: '>= 0.10'}
     hasBin: true
 
-  pseudomap@1.0.2:
-    resolution: {integrity: sha512-b/YwNhb8lk1Zz2+bXXpS/LK9OisiZZ1SNsSLxN1x2OXVEhW2Ckr/7mWE5vrC1ZTiJlD9g19jWszTmJsB+oEpFQ==}
-
   psl@1.9.0:
     resolution: {integrity: sha512-E/ZsdU4HLs/68gYzgGTkMicWTLPdAftJLfJFlLUAAKZGkStNU72sZjT66SnMDVOfOWY/YAoiD7Jxa9iHvngcag==}
 
@@ -8642,20 +8281,12 @@ packages:
     resolution: {integrity: sha512-+38qI9SOr8tfZ4QmJNplMUxqjbe7LKvvZgWdExBOmd+egZTtjLB67Gu0HRX3u/XOq7UU2Nx6nsjvS16Z9uwfpg==}
     engines: {node: '>=0.6'}
 
-  qs@6.5.3:
-    resolution: {integrity: sha512-qxXIEh4pCGfHICj1mAJQ2/2XVZkjCDTcEgfoSQxc/fYivUZxTkk7L3bDBJSoNrEzXI17oUO5Dp07ktqE5KzczA==}
-    engines: {node: '>=0.6'}
-
   querystringify@2.2.0:
     resolution: {integrity: sha512-FIqgj2EUvTa7R50u0rGsyTftzjYmv/a3hO345bZNrqabNqjtgiDMgmo4mkUjd+nzU5oF3dClKqFIPUKybUyqoQ==}
 
   queue-microtask@1.2.3:
     resolution: {integrity: sha512-NuaNSa6flKT5JaSYQzJok04JzTL1CA6aGhv5rfLW3PgqA+M2ChpZQnAC8h8i4ZFkBS8X5RqkDBHA7r4hej3K9A==}
 
-  quick-lru@4.0.1:
-    resolution: {integrity: sha512-ARhCpm70fzdcvNQfPoy49IaanKkTlRWF2JMzqhcJbhSFRZv7nPTvZJdcY7301IPmvW+/p0RgIWnQDLJxifsQ7g==}
-    engines: {node: '>=8'}
-
   quick-lru@5.1.1:
     resolution: {integrity: sha512-WuyALRjWPDGtt/wzJiadO5AXY+8hZ80hVpe6MyivgraREW751X3SbhRvG3eLKOYN+8VEvqLcf3wdnt44Z4S4SA==}
     engines: {node: '>=10'}
@@ -8751,10 +8382,6 @@ packages:
     resolution: {integrity: sha512-Ug69mNOpfvKDAc2Q8DRpMjjzdtrnv9HcSMX+4VsZxD1aZ6ZzrIE7rlzXBtWTyhULSMKg076AW6WR5iZpD0JiOg==}
     engines: {node: '>=8'}
 
-  read-yaml-file@1.1.0:
-    resolution: {integrity: sha512-VIMnQi/Z4HT2Fxuwg5KrY174U1VdUIASQVWXXyqtNRtxSr9IYkn1rsI6Tb6HsrHCmB7gVpNwX6JxPTHcH6IoTA==}
-    engines: {node: '>=6'}
-
   readable-stream@2.3.7:
     resolution: {integrity: sha512-Ebho8K4jIbHAxnuxi7o42OrZgF/ZTNcsZj6nRKyUmkhLFq8CHItp/fy6hQZuZmP/n3yZ9VBUbp4zz/mX8hmYPw==}
 
@@ -8774,10 +8401,6 @@ packages:
     resolution: {integrity: sha512-HFM8rkZ+i3zrV+4LQjwQ0W+ez98pApMGM3HUrN04j3CqzPOzl9nmP15Y8YXNm8QHGv/eacOVEjqhmWpkRV0NAw==}
     engines: {node: '>= 0.10'}
 
-  redent@3.0.0:
-    resolution: {integrity: sha512-6tDA8g98We0zd0GvVeMT9arEOnTw9qM03L9cJXaCjrip1OO764RDBLBfrB4cwzNGDj5OA5ioymC9GkizgWJDUg==}
-    engines: {node: '>=8'}
-
   reflect-metadata@0.1.13:
     resolution: {integrity: sha512-Ts1Y/anZELhSsjMcU605fU9RE4Oi3p5ORujwbIKXfWa+0Zxs510Qrmrce5/Jowq3cHSZSJqBjypxmHarc+vEWg==}
 
@@ -8842,9 +8465,6 @@ packages:
   remove-accents@0.4.2:
     resolution: {integrity: sha512-7pXIJqJOq5tFgG1A2Zxti3Ht8jJF337m4sowbuHsW30ZnkQFnDzy9qBNhgzX8ZLW4+UBcXiiR7SwR6pokHsxiA==}
 
-  request-progress@3.0.0:
-    resolution: {integrity: sha512-MnWzEHHaxHO2iWiQuHrUPBi/1WeBf5PkxQqNyNvLl9VAYSdXkP8tQ3pBSeCPD+yw0v0Aq1zosWLz0BdeXpWwZg==}
-
   require-directory@2.1.1:
     resolution: {integrity: sha512-fGxEI7+wsG9xrvdjsrlmL22OMTTiHRwAMroiEeMgq8gzoLC/PQr7RsRDSTLUg/bZAZtF+TVIkHc6/4RIKrui+Q==}
     engines: {node: '>=0.10.0'}
@@ -9085,11 +8705,6 @@ packages:
     resolution: {integrity: sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==}
     hasBin: true
 
-  semver@7.5.2:
-    resolution: {integrity: sha512-SoftuTROv/cRjCze/scjGyiDtcUyxw1rgYQSZY7XTmtR5hX+dm76iDbTH8TkLPHCQmlbQVSSbNZCPM2hb0knnQ==}
-    engines: {node: '>=10'}
-    hasBin: true
-
   semver@7.5.4:
     resolution: {integrity: sha512-1bCSESV6Pv+i21Hvpxp3Dx+pSD8lIPt8uVjRrxAUt/nbswYc+tK6Y2btiULjd4+fnq15PX+nqQDC7Oft7WkwcA==}
     engines: {node: '>=10'}
@@ -9221,11 +8836,6 @@ packages:
     resolution: {integrity: sha512-94hK0Hh8rPqQl2xXc3HsaBoOXKV20MToPkcXvwbISWLEs+64sBq5kFgn2kJDHb1Pry9yrP0dxrCI9RRci7RXKg==}
     engines: {node: '>= 6.0.0', npm: '>= 3.0.0'}
 
-  smartwrap@2.0.2:
-    resolution: {integrity: sha512-vCsKNQxb7PnCNd2wY1WClWifAc2lwqsG8OaswpJkVJsvMGcnEntdTCDajZCkk93Ay1U3t/9puJmb525Rg5MZBA==}
-    engines: {node: '>=6'}
-    hasBin: true
-
   socks-proxy-agent@8.0.2:
     resolution: {integrity: sha512-8zuqoLv1aP/66PHF5TqwJ7Czm3Yv32urJQHrVyhD7mmA6d61Zv8cIXQYPTWwmg6qlupnPvs/QKDmfa4P/qct2g==}
     engines: {node: '>= 14'}
@@ -9270,9 +8880,6 @@ packages:
   spawn-command@0.0.2-1:
     resolution: {integrity: sha512-n98l9E2RMSJ9ON1AKisHzz7V42VDiBQGY6PB1BwRglz99wpVsSuGzQ+jOi6lFXBGVTCrRpltvjm+/XA+tpeJrg==}
 
-  spawndamnit@2.0.0:
-    resolution: {integrity: sha512-j4JKEcncSjFlqIwU5L/rp2N5SIPsdxaRsIv678+TZxZ0SRDJTm8JrxJMjE/XuiEZNEir3S8l0Fa3Ke339WI4qA==}
-
   spdx-correct@3.1.1:
     resolution: {integrity: sha512-cOYcUWwhCuHCXi49RhFRCyJEK3iPj1Ziz9DpViV3tbZOwXD49QzIN3MpOLJNxh2qwq2lJJZaKMVw9qNi4jTC0w==}
 
@@ -9295,11 +8902,6 @@ packages:
   sprintf-js@1.0.3:
     resolution: {integrity: sha512-D9cPgkvLlV3t3IzL0D0YLvGA9Ahk4PcvVwUbN0dSGr1aP0Nrt4AEnTUbuGvquEC0mA64Gqt1fzirlRs5ibXx8g==}
 
-  sshpk@1.17.0:
-    resolution: {integrity: sha512-/9HIEs1ZXGhSPE8X6Ccm7Nam1z8KcoCqPdI7ecm1N33EzAetWahvQWVqLZtaZQ+IDKX4IyA2o0gBzqIMkAagHQ==}
-    engines: {node: '>=0.10.0'}
-    hasBin: true
-
   stackback@0.0.2:
     resolution: {integrity: sha512-1XMJE5fQo1jGH6Y/7ebnwPOBEkIEnT4QF32d5R1+VXdXveM0IBMJt8zfaxX1P3QhVwrYe+576+jkANtSS2mBbw==}
 
@@ -9336,9 +8938,6 @@ packages:
   stream-shift@1.0.1:
     resolution: {integrity: sha512-AiisoFqQ0vbGcZgQPY1cdP2I76glaVA/RauYR4G4thNFgkTqr90yXTo4LYX60Jl+sIlPNHHdGSwo01AvbKUSVQ==}
 
-  stream-transform@2.1.3:
-    resolution: {integrity: sha512-9GHUiM5hMiCi6Y03jD2ARC1ettBXkQBoQAe7nJsPknnI0ow10aXjTnew8QtYQmLjzn974BnmWEAJgCY6ZP1DeQ==}
-
   string-argv@0.3.1:
     resolution: {integrity: sha512-a1uQGz7IyVy9YwhqjZIZu1c8JO8dNIe20xBmSS6qu9kv++k3JGzCVmprbNN5Kn+BgzD5E7YYwg1CcjuJMRNsvg==}
     engines: {node: '>=0.6.19'}
@@ -9419,10 +9018,6 @@ packages:
     resolution: {integrity: sha512-dOESqjYr96iWYylGObzd39EuNTa5VJxyvVAEm5Jnh7KGo75V43Hk1odPQkNDyXNmUR6k+gEiDVXnjB8HJ3crXw==}
     engines: {node: '>=12'}
 
-  strip-indent@3.0.0:
-    resolution: {integrity: sha512-laJTa3Jb+VQpaC6DseHhF7dXVqHTfJPCRDaEbid/drOhgitgYku/letMUqOXFoWV0zIIUbjpdH2t+tYj4bQMRQ==}
-    engines: {node: '>=8'}
-
   strip-json-comments@2.0.1:
     resolution: {integrity: sha512-4gB8na07fecVVkOI6Rs4e7T6NOTki5EmL7TUduTs6bu3EdnSycntVJ4re8kgZA+wx9IueI2Y11bfbgwtzuE0KQ==}
     engines: {node: '>=0.10.0'}
@@ -9526,10 +9121,6 @@ packages:
     resolution: {integrity: sha512-biM9brNqxSc04Ee71hzFbryD11nX7VPhQQY32AdDmjFvodsRFz/3ufeoTZ6uYkRFfGo188tENcASNs3vTdsM0w==}
     engines: {node: '>=10'}
 
-  term-size@2.2.1:
-    resolution: {integrity: sha512-wK0Ri4fOGjv/XPy8SBHZChl8CM7uMc5VML7SqiQ0zG7+J5Vr+RMQDoHa2CNT6KHUnTGIXH34UDMkPzAUyapBZg==}
-    engines: {node: '>=8'}
-
   terser-webpack-plugin@5.3.10:
     resolution: {integrity: sha512-BKFPWlPDndPs+NGGCr1U59t0XScL5317Y0UReNrHaw9/FwhPENlq6bfgs+4yPfyP51vqC1bQ4rp1EfXW5ZSH9w==}
     engines: {node: '>= 10.13.0'}
@@ -9570,9 +9161,6 @@ packages:
   thenify@3.3.1:
     resolution: {integrity: sha512-RVZSIV5IG10Hk3enotrhvz0T9em6cyHBLkH/YAZuKqd8hRkKhSfCGIcP2KUY0EPxndzANBmNllzWPwak+bheSw==}
 
-  throttleit@1.0.0:
-    resolution: {integrity: sha512-rkTVqu6IjfQ/6+uNuuc3sZek4CEYxTJom3IktzgdSxcZqdARuebbA/f4QmAxMQIxqq9ZLEUkSYqvuk1I6VKq4g==}
-
   through2@2.0.5:
     resolution: {integrity: sha512-/mrRod8xqpA+IHSLyGCQ2s8SPHiCDEeQJSep1jqLYeEUClOFG2Qsh+4FU6G9VeqpZnGW/Su8LQGc4YKni5rYSQ==}
 
@@ -9604,10 +9192,6 @@ packages:
     resolution: {integrity: sha512-jRCJlojKnZ3addtTOjdIqoRuPEKBvNXcGYqzO6zWZX8KfKEpnGY5jfggJQ3EjKuu8D4bJRr0y+cYJFmYbImXGw==}
     engines: {node: '>=0.6.0'}
 
-  tmp@0.2.1:
-    resolution: {integrity: sha512-76SUhtfqR2Ijn+xllcI5P1oyannHNHByD80W1q447gU3mp9G9PSpGdWmjUOHRDPiHYacIk66W7ubDTuPF3BEtQ==}
-    engines: {node: '>=8.17.0'}
-
   tmpl@1.0.5:
     resolution: {integrity: sha512-3f0uOEAQwIqGuWW2MVzYg8fV/QNnc/IpuJNG837rLuczAaLVHslWHZQj4IGiEl5Hs3kkbhwL9Ab7Hrsmuj+Smw==}
 
@@ -9633,10 +9217,6 @@ packages:
     resolution: {integrity: sha512-eM+pCBxXO/njtF7vdFsHuqb+ElbxqtI4r5EAvk6grfAFyJ6IvWlSkfZ5T9ozC6xWw3Fj1fGoSmrl0gUs46JVIw==}
     engines: {node: '>=6'}
 
-  tough-cookie@2.5.0:
-    resolution: {integrity: sha512-nlLsUzgm1kfLXSXfRZMc1KLAugd4hqJHDTvc2hDIwS3mZAfMEuMbc03SujMF+GEcpaX/qboeycw6iO8JwVv2+g==}
-    engines: {node: '>=0.8'}
-
   tough-cookie@4.1.2:
     resolution: {integrity: sha512-G9fqXWoYFZgTc2z8Q5zaHy/vJMjm+WV0AkAeHxVCQiEB1b+dGvWzFW6QV07cY5jQ5gRkeid2qIkzkxUnmoQZUQ==}
     engines: {node: '>=6'}
@@ -9660,10 +9240,6 @@ packages:
     resolution: {integrity: sha512-L0Orpi8qGpRG//Nd+H90vFB+3iHnue1zSSGmNOOCh1GLJ7rUKVwV2HvijphGQS2UmhUZewS9VgvxYIdgr+fG1A==}
     hasBin: true
 
-  trim-newlines@3.0.1:
-    resolution: {integrity: sha512-c1PTsA3tYrIsLGkJkzHF+w9F2EyxfXGo4UyJc4pFL++FMjnq0HJS69T3M7d//gKrFKwy429bouPescbjecU+Zw==}
-    engines: {node: '>=8'}
-
   ts-dedent@2.2.0:
     resolution: {integrity: sha512-q5W7tVM71e2xjHZTlgfTDoPF/SmqKG5hddq9SzR49CH2hayqRKJtQ4mtRlSxKaJlR/+9rEM+mnBHf7I2/BQcpQ==}
     engines: {node: '>=6.10'}
@@ -9686,17 +9262,6 @@ packages:
     peerDependencies:
       typescript: '>=2.8.0 || >= 3.2.0-dev || >= 3.3.0-dev || >= 3.4.0-dev || >= 3.5.0-dev || >= 3.6.0-dev || >= 3.6.0-beta || >= 3.7.0-dev || >= 3.7.0-beta'
 
-  tty-table@4.1.6:
-    resolution: {integrity: sha512-kRj5CBzOrakV4VRRY5kUWbNYvo/FpOsz65DzI5op9P+cHov3+IqPbo1JE1ZnQGkHdZgNFDsrEjrfqqy/Ply9fw==}
-    engines: {node: '>=8.0.0'}
-    hasBin: true
-
-  tunnel-agent@0.6.0:
-    resolution: {integrity: sha512-McnNiV1l8RYeY8tBgEpuodCC1mLUdbSN+CYBL7kJsJNInOP8UjDDEwdk6Mw60vdLLrr5NHKZhMAOSrR2NZuQ+w==}
-
-  tweetnacl@0.14.5:
-    resolution: {integrity: sha512-KXXFFdAbFXY4geFIwoyNK+f5Z1b7swfXABfL7HXCmoIWMKU3dmS26672A4EeQtDzLKy7SXmfBu51JolvEKwtGA==}
-
   type-check@0.3.2:
     resolution: {integrity: sha512-ZCmOJdvOWDBYJlzAoFkC+Q0+bUyEOS1ltgp1MGU03fqHG+dbi9tBFU2Rd9QKiDZFAYrhPh2JUf7rZRIuHRKtOg==}
     engines: {node: '>= 0.8.0'}
@@ -9709,10 +9274,6 @@ packages:
     resolution: {integrity: sha512-0fr/mIH1dlO+x7TlcMy+bIDqKPsw/70tVyeHW787goQjhmqaZe10uwLujubK9q9Lg6Fiho1KUKDYz0Z7k7g5/g==}
     engines: {node: '>=4'}
 
-  type-fest@0.13.1:
-    resolution: {integrity: sha512-34R7HTnG0XIJcBSn5XhDd7nNFPRcXYRZrBB2O2jdKqYODldSzBAqzsWoZYYvduky73toYS/ESqxPvkDf/F0XMg==}
-    engines: {node: '>=10'}
-
   type-fest@0.16.0:
     resolution: {integrity: sha512-eaBzG6MxNzEn9kiwvtre90cXaNLkmadMWa1zQMs3XORCXNbsH/OewwbxC5ia9dCxIxnTAsSxXJaa/p5y8DlvJg==}
     engines: {node: '>=10'}
@@ -10014,10 +9575,6 @@ packages:
     resolution: {integrity: sha512-pMZTvIkT1d+TFGvDOqodOclx0QWkkgi6Tdoa8gC8ffGAAqz9pzPTZWAybbsHHoED/ztMtkv/VoYTYyShUn81hA==}
     engines: {node: '>= 0.4.0'}
 
-  uuid@8.3.2:
-    resolution: {integrity: sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg==}
-    hasBin: true
-
   uuid@9.0.1:
     resolution: {integrity: sha512-b+1eJOlsR9K8HJpow9Ok3fiWOWSIcIzXodvv0rQjVoOVNpWMpxf1wZNpt4y9h10odCNrqnYp1OBzRktckBe3sA==}
     hasBin: true
@@ -10033,10 +9590,6 @@ packages:
     resolution: {integrity: sha512-BNGbWLfd0eUPabhkXUVm0j8uuvREyTh5ovRa/dyow/BqAbZJyC+5fU+IzQOzmAKzYqYRAISoRhdQr3eIZ/PXqg==}
     engines: {node: '>= 0.8'}
 
-  verror@1.10.0:
-    resolution: {integrity: sha512-ZZKSmDAEFOijERBLkmYfJ+vmk3w+7hOLYDNkRCuRuMJGEmqYNCNLyBBFwWKVMhfwaEF3WOd0Zlw86U/WC/+nYw==}
-    engines: {'0': node >=0.6.0}
-
   vite-hot-client@0.2.3:
     resolution: {integrity: sha512-rOGAV7rUlUHX89fP2p2v0A2WWvV3QMX2UYq0fRqsWSvFvev4atHWqjwGoKaZT1VTKyLGk533ecu3eyd0o59CAg==}
     peerDependencies:
@@ -10383,10 +9936,6 @@ packages:
   which-module@2.0.0:
     resolution: {integrity: sha512-B+enWhmw6cjfVC7kS8Pj9pCrKSc5txArRyaYGe088shv/FGWH+0Rjx/xPgtsWfsUtS27FkP697E4DDhgrgoc0Q==}
 
-  which-pm@2.0.0:
-    resolution: {integrity: sha512-Lhs9Pmyph0p5n5Z3mVnN0yWcbQYUAD7rbQUiMsQxOJ3T57k7RFe35SUwWMf7dsbDZks1uOmw4AecB/JMDj3v/w==}
-    engines: {node: '>=8.15'}
-
   which-typed-array@1.1.13:
     resolution: {integrity: sha512-P5Nra0qjSncduVPEAr7xhoF5guty49ArDTwzJ/yNuPIbZppyRxFQsRCWrocxIY+CnMVG+qfbU2FmDKyvSGClow==}
     engines: {node: '>= 0.4'}
@@ -10554,9 +10103,6 @@ packages:
     resolution: {integrity: sha512-0pfFzegeDWJHJIAmTLRP2DwHjdF5s7jo9tuztdQxAhINCdvS+3nGINqPd00AphqJR/0LhANUS6/+7SCb98YOfA==}
     engines: {node: '>=10'}
 
-  yallist@2.1.2:
-    resolution: {integrity: sha512-ncTzHV7NvsQZkYe1DW7cbDLm0YpzHmZF5r/iyP3ZnQtMiJ+pjzisCiMNI+Sj+xQF5pXhSHxSB3uDbsBTzY/c2A==}
-
   yallist@3.1.1:
     resolution: {integrity: sha512-a4UGQaWPH59mOXUYnAG2ewncQS4i4F43Tv3JoAM+s2VDAmS9NsK8GpDMLrCHPksFT7h3K6TOoUNn2pb7RoXx4g==}
 
@@ -10674,7 +10220,7 @@ snapshots:
       '@babel/traverse': 7.24.5
       '@babel/types': 7.25.2
       convert-source-map: 2.0.0
-      debug: 4.3.6(supports-color@8.1.1)
+      debug: 4.3.6
       gensync: 1.0.0-beta.2
       json5: 2.2.3
       semver: 6.3.1
@@ -10694,7 +10240,7 @@ snapshots:
       '@babel/traverse': 7.25.3
       '@babel/types': 7.25.2
       convert-source-map: 2.0.0
-      debug: 4.3.6(supports-color@8.1.1)
+      debug: 4.3.6
       gensync: 1.0.0-beta.2
       json5: 2.2.3
       semver: 6.3.1
@@ -10788,7 +10334,7 @@ snapshots:
       '@babel/core': 7.24.5
       '@babel/helper-compilation-targets': 7.23.6
       '@babel/helper-plugin-utils': 7.24.5
-      debug: 4.3.6(supports-color@8.1.1)
+      debug: 4.3.6
       lodash.debounce: 4.0.8
       resolve: 1.22.8
     transitivePeerDependencies:
@@ -10799,7 +10345,7 @@ snapshots:
       '@babel/core': 7.25.2
       '@babel/helper-compilation-targets': 7.25.2
       '@babel/helper-plugin-utils': 7.24.8
-      debug: 4.3.6(supports-color@8.1.1)
+      debug: 4.3.6
       lodash.debounce: 4.0.8
       resolve: 1.22.8
     transitivePeerDependencies:
@@ -12157,7 +11703,7 @@ snapshots:
       '@babel/helper-split-export-declaration': 7.24.5
       '@babel/parser': 7.25.3
       '@babel/types': 7.25.2
-      debug: 4.3.6(supports-color@8.1.1)
+      debug: 4.3.6
       globals: 11.12.0
     transitivePeerDependencies:
       - supports-color
@@ -12169,7 +11715,7 @@ snapshots:
       '@babel/parser': 7.25.3
       '@babel/template': 7.25.0
       '@babel/types': 7.25.2
-      debug: 4.3.6(supports-color@8.1.1)
+      debug: 4.3.6
       globals: 11.12.0
     transitivePeerDependencies:
       - supports-color
@@ -12200,154 +11746,6 @@ snapshots:
 
   '@bcoe/v8-coverage@0.2.3': {}
 
-  '@changesets/apply-release-plan@6.1.2':
-    dependencies:
-      '@babel/runtime': 7.19.0
-      '@changesets/config': 2.2.0
-      '@changesets/get-version-range-type': 0.3.2
-      '@changesets/git': 1.5.0
-      '@changesets/types': 5.2.0
-      '@manypkg/get-packages': 1.1.3
-      detect-indent: 6.1.0
-      fs-extra: 7.0.1
-      lodash.startcase: 4.4.0
-      outdent: 0.5.0
-      prettier: 2.8.8
-      resolve-from: 5.0.0
-      semver: 5.7.1
-
-  '@changesets/assemble-release-plan@5.2.2':
-    dependencies:
-      '@babel/runtime': 7.19.0
-      '@changesets/errors': 0.1.4
-      '@changesets/get-dependents-graph': 1.3.4
-      '@changesets/types': 5.2.0
-      '@manypkg/get-packages': 1.1.3
-      semver: 5.7.1
-
-  '@changesets/changelog-git@0.1.13':
-    dependencies:
-      '@changesets/types': 5.2.0
-
-  '@changesets/cli@2.25.2':
-    dependencies:
-      '@babel/runtime': 7.19.0
-      '@changesets/apply-release-plan': 6.1.2
-      '@changesets/assemble-release-plan': 5.2.2
-      '@changesets/changelog-git': 0.1.13
-      '@changesets/config': 2.2.0
-      '@changesets/errors': 0.1.4
-      '@changesets/get-dependents-graph': 1.3.4
-      '@changesets/get-release-plan': 3.0.15
-      '@changesets/git': 1.5.0
-      '@changesets/logger': 0.0.5
-      '@changesets/pre': 1.0.13
-      '@changesets/read': 0.5.8
-      '@changesets/types': 5.2.0
-      '@changesets/write': 0.2.2
-      '@manypkg/get-packages': 1.1.3
-      '@types/is-ci': 3.0.0
-      '@types/semver': 6.2.3
-      ansi-colors: 4.1.3
-      chalk: 2.4.2
-      enquirer: 2.3.6
-      external-editor: 3.1.0
-      fs-extra: 7.0.1
-      human-id: 1.0.2
-      is-ci: 3.0.1
-      meow: 6.1.1
-      outdent: 0.5.0
-      p-limit: 2.3.0
-      preferred-pm: 3.0.3
-      resolve-from: 5.0.0
-      semver: 5.7.1
-      spawndamnit: 2.0.0
-      term-size: 2.2.1
-      tty-table: 4.1.6
-
-  '@changesets/config@2.2.0':
-    dependencies:
-      '@changesets/errors': 0.1.4
-      '@changesets/get-dependents-graph': 1.3.4
-      '@changesets/logger': 0.0.5
-      '@changesets/types': 5.2.0
-      '@manypkg/get-packages': 1.1.3
-      fs-extra: 7.0.1
-      micromatch: 4.0.5
-
-  '@changesets/errors@0.1.4':
-    dependencies:
-      extendable-error: 0.1.7
-
-  '@changesets/get-dependents-graph@1.3.4':
-    dependencies:
-      '@changesets/types': 5.2.0
-      '@manypkg/get-packages': 1.1.3
-      chalk: 2.4.2
-      fs-extra: 7.0.1
-      semver: 5.7.1
-
-  '@changesets/get-release-plan@3.0.15':
-    dependencies:
-      '@babel/runtime': 7.19.0
-      '@changesets/assemble-release-plan': 5.2.2
-      '@changesets/config': 2.2.0
-      '@changesets/pre': 1.0.13
-      '@changesets/read': 0.5.8
-      '@changesets/types': 5.2.0
-      '@manypkg/get-packages': 1.1.3
-
-  '@changesets/get-version-range-type@0.3.2': {}
-
-  '@changesets/git@1.5.0':
-    dependencies:
-      '@babel/runtime': 7.19.0
-      '@changesets/errors': 0.1.4
-      '@changesets/types': 5.2.0
-      '@manypkg/get-packages': 1.1.3
-      is-subdir: 1.2.0
-      spawndamnit: 2.0.0
-
-  '@changesets/logger@0.0.5':
-    dependencies:
-      chalk: 2.4.2
-
-  '@changesets/parse@0.3.15':
-    dependencies:
-      '@changesets/types': 5.2.0
-      js-yaml: 3.14.1
-
-  '@changesets/pre@1.0.13':
-    dependencies:
-      '@babel/runtime': 7.19.0
-      '@changesets/errors': 0.1.4
-      '@changesets/types': 5.2.0
-      '@manypkg/get-packages': 1.1.3
-      fs-extra: 7.0.1
-
-  '@changesets/read@0.5.8':
-    dependencies:
-      '@babel/runtime': 7.19.0
-      '@changesets/git': 1.5.0
-      '@changesets/logger': 0.0.5
-      '@changesets/parse': 0.3.15
-      '@changesets/types': 5.2.0
-      chalk: 2.4.2
-      fs-extra: 7.0.1
-      p-filter: 2.1.0
-
-  '@changesets/types@4.1.0': {}
-
-  '@changesets/types@5.2.0': {}
-
-  '@changesets/write@0.2.2':
-    dependencies:
-      '@babel/runtime': 7.19.0
-      '@changesets/types': 5.2.0
-      fs-extra: 7.0.1
-      human-id: 1.0.2
-      prettier: 2.8.8
-
   '@ckpack/vue-color@1.5.0(vue@3.5.11(typescript@5.6.2))':
     dependencies:
       '@ctrl/tinycolor': 3.6.1
@@ -12442,34 +11840,6 @@ snapshots:
 
   '@ctrl/tinycolor@3.6.1': {}
 
-  '@cypress/request@2.88.10':
-    dependencies:
-      aws-sign2: 0.7.0
-      aws4: 1.11.0
-      caseless: 0.12.0
-      combined-stream: 1.0.8
-      extend: 3.0.2
-      forever-agent: 0.6.1
-      form-data: 2.3.3
-      http-signature: 1.3.6
-      is-typedarray: 1.0.0
-      isstream: 0.1.2
-      json-stringify-safe: 5.0.1
-      mime-types: 2.1.35
-      performance-now: 2.1.0
-      qs: 6.5.3
-      safe-buffer: 5.2.1
-      tough-cookie: 2.5.0
-      tunnel-agent: 0.6.0
-      uuid: 8.3.2
-
-  '@cypress/xvfb@1.2.4(supports-color@8.1.1)':
-    dependencies:
-      debug: 3.2.7(supports-color@8.1.1)
-      lodash.once: 4.1.1
-    transitivePeerDependencies:
-      - supports-color
-
   '@discoveryjs/json-ext@0.5.7': {}
 
   '@emoji-mart/data@1.2.1': {}
@@ -12692,7 +12062,7 @@ snapshots:
   '@eslint/eslintrc@2.0.3':
     dependencies:
       ajv: 6.12.6
-      debug: 4.3.6(supports-color@8.1.1)
+      debug: 4.3.6
       espree: 9.5.2
       globals: 13.20.0
       ignore: 5.2.0
@@ -12802,7 +12172,7 @@ snapshots:
   '@humanwhocodes/config-array@0.11.10':
     dependencies:
       '@humanwhocodes/object-schema': 1.2.1
-      debug: 4.3.6(supports-color@8.1.1)
+      debug: 4.3.6
       minimatch: 3.1.2
     transitivePeerDependencies:
       - supports-color
@@ -12834,7 +12204,7 @@ snapshots:
       '@antfu/install-pkg': 0.1.1
       '@antfu/utils': 0.7.6
       '@iconify/types': 2.0.0
-      debug: 4.3.6(supports-color@8.1.1)
+      debug: 4.3.6
       kolorist: 1.8.0
       local-pkg: 0.4.3
     transitivePeerDependencies:
@@ -12845,7 +12215,7 @@ snapshots:
       '@antfu/install-pkg': 0.1.1
       '@antfu/utils': 0.7.10
       '@iconify/types': 2.0.0
-      debug: 4.3.6(supports-color@8.1.1)
+      debug: 4.3.6
       kolorist: 1.8.0
       local-pkg: 0.5.0
       mlly: 1.7.1
@@ -12984,7 +12354,7 @@ snapshots:
       '@intlify/shared': 9.13.1
       '@rollup/pluginutils': 5.1.0(rollup@4.17.2)
       '@vue/compiler-sfc': 3.5.11
-      debug: 4.3.4(supports-color@8.1.1)
+      debug: 4.3.4
       fast-glob: 3.3.2
       js-yaml: 4.1.0
       json5: 2.2.3
@@ -13137,22 +12507,6 @@ snapshots:
 
   '@lukeed/csprng@1.1.0': {}
 
-  '@manypkg/find-root@1.1.0':
-    dependencies:
-      '@babel/runtime': 7.19.0
-      '@types/node': 12.20.55
-      find-up: 4.1.0
-      fs-extra: 8.1.0
-
-  '@manypkg/get-packages@1.1.3':
-    dependencies:
-      '@babel/runtime': 7.19.0
-      '@changesets/types': 4.1.0
-      '@manypkg/find-root': 1.1.0
-      fs-extra: 8.1.0
-      globby: 11.1.0
-      read-yaml-file: 1.1.0
-
   '@mdx-js/react@2.3.0(react@18.2.0)':
     dependencies:
       '@types/mdx': 2.0.10
@@ -14836,10 +14190,6 @@ snapshots:
 
   '@types/http-errors@2.0.4': {}
 
-  '@types/is-ci@3.0.0':
-    dependencies:
-      ci-info: 3.4.0
-
   '@types/istanbul-lib-coverage@2.0.4': {}
 
   '@types/istanbul-lib-report@3.0.3':
@@ -14880,17 +14230,11 @@ snapshots:
 
   '@types/mime@3.0.4': {}
 
-  '@types/minimist@1.2.2': {}
-
   '@types/node-fetch@2.6.9':
     dependencies:
       '@types/node': 18.19.34
       form-data: 4.0.0
 
-  '@types/node@12.20.55': {}
-
-  '@types/node@14.18.31': {}
-
   '@types/node@18.13.0': {}
 
   '@types/node@18.19.34':
@@ -14929,8 +14273,6 @@ snapshots:
 
   '@types/scheduler@0.16.8': {}
 
-  '@types/semver@6.2.3': {}
-
   '@types/semver@7.3.13': {}
 
   '@types/send@0.17.4':
@@ -14944,10 +14286,6 @@ snapshots:
       '@types/mime': 3.0.4
       '@types/node': 18.19.34
 
-  '@types/sinonjs__fake-timers@8.1.1': {}
-
-  '@types/sizzle@2.3.3': {}
-
   '@types/sortablejs@1.15.8': {}
 
   '@types/tough-cookie@4.0.2': {}
@@ -14972,11 +14310,6 @@ snapshots:
     dependencies:
       '@types/yargs-parser': 21.0.3
 
-  '@types/yauzl@2.10.0':
-    dependencies:
-      '@types/node': 18.19.34
-    optional: true
-
   '@typescript-eslint/eslint-plugin@5.59.6(@typescript-eslint/parser@5.59.6(eslint@8.43.0)(typescript@5.6.2))(eslint@8.43.0)(typescript@5.6.2)':
     dependencies:
       '@eslint-community/regexpp': 4.5.1
@@ -14984,7 +14317,7 @@ snapshots:
       '@typescript-eslint/scope-manager': 5.59.6
       '@typescript-eslint/type-utils': 5.59.6(eslint@8.43.0)(typescript@5.6.2)
       '@typescript-eslint/utils': 5.59.6(eslint@8.43.0)(typescript@5.6.2)
-      debug: 4.3.6(supports-color@8.1.1)
+      debug: 4.3.6
       eslint: 8.43.0
       grapheme-splitter: 1.0.4
       ignore: 5.2.0
@@ -15001,7 +14334,7 @@ snapshots:
       '@typescript-eslint/scope-manager': 5.59.6
       '@typescript-eslint/types': 5.59.6
       '@typescript-eslint/typescript-estree': 5.59.6(typescript@5.6.2)
-      debug: 4.3.6(supports-color@8.1.1)
+      debug: 4.3.6
       eslint: 8.43.0
     optionalDependencies:
       typescript: 5.6.2
@@ -15017,7 +14350,7 @@ snapshots:
     dependencies:
       '@typescript-eslint/typescript-estree': 5.59.6(typescript@5.6.2)
       '@typescript-eslint/utils': 5.59.6(eslint@8.43.0)(typescript@5.6.2)
-      debug: 4.3.6(supports-color@8.1.1)
+      debug: 4.3.6
       eslint: 8.43.0
       tsutils: 3.21.0(typescript@5.6.2)
     optionalDependencies:
@@ -15031,7 +14364,7 @@ snapshots:
     dependencies:
       '@typescript-eslint/types': 5.59.6
       '@typescript-eslint/visitor-keys': 5.59.6
-      debug: 4.3.6(supports-color@8.1.1)
+      debug: 4.3.6
       globby: 11.1.0
       is-glob: 4.0.3
       semver: 7.5.4
@@ -15666,13 +14999,13 @@ snapshots:
 
   agent-base@6.0.2:
     dependencies:
-      debug: 4.3.6(supports-color@8.1.1)
+      debug: 4.3.6
     transitivePeerDependencies:
       - supports-color
 
   agent-base@7.1.0:
     dependencies:
-      debug: 4.3.6(supports-color@8.1.1)
+      debug: 4.3.6
     transitivePeerDependencies:
       - supports-color
 
@@ -15718,7 +15051,8 @@ snapshots:
     dependencies:
       string-width: 4.2.3
 
-  ansi-colors@4.1.3: {}
+  ansi-colors@4.1.3:
+    optional: true
 
   ansi-escapes@4.3.2:
     dependencies:
@@ -15749,8 +15083,6 @@ snapshots:
 
   app-root-dir@1.0.2: {}
 
-  arch@2.2.0: {}
-
   arg@5.0.2: {}
 
   argparse@1.0.10:
@@ -15783,13 +15115,6 @@ snapshots:
 
   array-uniq@1.0.2: {}
 
-  array.prototype.flat@1.3.0:
-    dependencies:
-      call-bind: 1.0.7
-      define-properties: 1.2.1
-      es-abstract: 1.22.3
-      es-shim-unscopables: 1.0.0
-
   array.prototype.map@1.0.6:
     dependencies:
       call-bind: 1.0.7
@@ -15819,18 +15144,10 @@ snapshots:
       is-array-buffer: 3.0.4
       is-shared-array-buffer: 1.0.3
 
-  arrify@1.0.1: {}
-
   asap@2.0.6: {}
 
-  asn1@0.2.6:
-    dependencies:
-      safer-buffer: 2.1.2
-
   assert-never@1.2.1: {}
 
-  assert-plus@1.0.0: {}
-
   assert@2.1.0:
     dependencies:
       call-bind: 1.0.7
@@ -15881,10 +15198,6 @@ snapshots:
     dependencies:
       possible-typed-array-names: 1.0.0
 
-  aws-sign2@0.7.0: {}
-
-  aws4@1.11.0: {}
-
   axios@1.7.2(debug@4.3.2):
     dependencies:
       follow-redirects: 1.15.6(debug@4.3.2)
@@ -15967,20 +15280,12 @@ snapshots:
 
   batch-processor@1.0.0: {}
 
-  bcrypt-pbkdf@1.0.2:
-    dependencies:
-      tweetnacl: 0.14.5
-
   before-after-hook@2.2.3: {}
 
   better-opn@3.0.2:
     dependencies:
       open: 8.4.2
 
-  better-path-resolve@1.0.0:
-    dependencies:
-      is-windows: 1.0.2
-
   big-integer@1.6.52: {}
 
   big.js@5.2.2: {}
@@ -16001,8 +15306,6 @@ snapshots:
       inherits: 2.0.4
       readable-stream: 3.6.0
 
-  blob-util@2.0.2: {}
-
   bluebird@3.7.2: {}
 
   body-parser@1.20.1:
@@ -16052,10 +15355,6 @@ snapshots:
     dependencies:
       fill-range: 7.0.1
 
-  breakword@1.0.5:
-    dependencies:
-      wcwidth: 1.0.1
-
   browser-assert@1.2.1: {}
 
   browserify-zlib@0.1.4:
@@ -16144,8 +15443,6 @@ snapshots:
       normalize-url: 8.0.0
       responselike: 3.0.0
 
-  cachedir@2.3.0: {}
-
   call-bind@1.0.2:
     dependencies:
       function-bind: 1.1.1
@@ -16170,12 +15467,6 @@ snapshots:
 
   camelcase-css@2.0.1: {}
 
-  camelcase-keys@6.2.2:
-    dependencies:
-      camelcase: 5.3.1
-      map-obj: 4.3.0
-      quick-lru: 4.0.1
-
   camelcase@5.3.1: {}
 
   camelcase@6.3.0: {}
@@ -16188,8 +15479,6 @@ snapshots:
 
   caniuse-lite@1.0.30001651: {}
 
-  caseless@0.12.0: {}
-
   chai@4.3.7:
     dependencies:
       assertion-error: 1.1.0
@@ -16367,8 +15656,6 @@ snapshots:
 
   commander@4.1.1: {}
 
-  commander@5.1.0: {}
-
   commander@6.2.1: {}
 
   commander@8.3.0: {}
@@ -16481,8 +15768,6 @@ snapshots:
     dependencies:
       browserslist: 4.23.3
 
-  core-util-is@1.0.2: {}
-
   core-util-is@1.0.3: {}
 
   cosmiconfig@8.3.6(typescript@5.6.2):
@@ -16500,12 +15785,6 @@ snapshots:
 
   cropperjs@1.5.7: {}
 
-  cross-spawn@5.1.0:
-    dependencies:
-      lru-cache: 4.1.5
-      shebang-command: 1.2.0
-      which: 1.3.1
-
   cross-spawn@6.0.5:
     dependencies:
       nice-try: 1.0.5
@@ -16560,68 +15839,6 @@ snapshots:
 
   csstype@3.1.3: {}
 
-  csv-generate@3.4.3: {}
-
-  csv-parse@4.16.3: {}
-
-  csv-stringify@5.6.5: {}
-
-  csv@5.5.3:
-    dependencies:
-      csv-generate: 3.4.3
-      csv-parse: 4.16.3
-      csv-stringify: 5.6.5
-      stream-transform: 2.1.3
-
-  cypress@10.11.0:
-    dependencies:
-      '@cypress/request': 2.88.10
-      '@cypress/xvfb': 1.2.4(supports-color@8.1.1)
-      '@types/node': 14.18.31
-      '@types/sinonjs__fake-timers': 8.1.1
-      '@types/sizzle': 2.3.3
-      arch: 2.2.0
-      blob-util: 2.0.2
-      bluebird: 3.7.2
-      buffer: 5.7.1
-      cachedir: 2.3.0
-      chalk: 4.1.2
-      check-more-types: 2.24.0
-      cli-cursor: 3.1.0
-      cli-table3: 0.6.3
-      commander: 5.1.0
-      common-tags: 1.8.2
-      dayjs: 1.11.7
-      debug: 4.3.4(supports-color@8.1.1)
-      enquirer: 2.3.6
-      eventemitter2: 6.4.7
-      execa: 4.1.0
-      executable: 4.1.1
-      extract-zip: 2.0.1(supports-color@8.1.1)
-      figures: 3.2.0
-      fs-extra: 9.1.0
-      getos: 3.2.1
-      is-ci: 3.0.1
-      is-installed-globally: 0.4.0
-      lazy-ass: 1.6.0
-      listr2: 3.14.0(enquirer@2.3.6)
-      lodash: 4.17.21
-      log-symbols: 4.1.0
-      minimist: 1.2.6
-      ospath: 1.2.2
-      pretty-bytes: 5.6.0
-      proxy-from-env: 1.0.0
-      request-progress: 3.0.0
-      semver: 7.5.2
-      supports-color: 8.1.1
-      tmp: 0.2.1
-      untildify: 4.0.0
-      yauzl: 2.10.0
-
-  dashdash@1.14.1:
-    dependencies:
-      assert-plus: 1.0.0
-
   data-uri-to-buffer@4.0.1: {}
 
   data-uri-to-buffer@6.0.1: {}
@@ -16660,32 +15877,17 @@ snapshots:
     dependencies:
       ms: 2.0.0
 
-  debug@3.2.7(supports-color@8.1.1):
-    dependencies:
-      ms: 2.1.3
-    optionalDependencies:
-      supports-color: 8.1.1
-
   debug@4.3.2:
     dependencies:
       ms: 2.1.2
 
-  debug@4.3.4(supports-color@8.1.1):
+  debug@4.3.4:
     dependencies:
       ms: 2.1.2
-    optionalDependencies:
-      supports-color: 8.1.1
 
-  debug@4.3.6(supports-color@8.1.1):
+  debug@4.3.6:
     dependencies:
       ms: 2.1.2
-    optionalDependencies:
-      supports-color: 8.1.1
-
-  decamelize-keys@1.1.0:
-    dependencies:
-      decamelize: 1.2.0
-      map-obj: 1.0.1
 
   decamelize@1.2.0: {}
 
@@ -16817,7 +16019,7 @@ snapshots:
   detect-port@1.5.1:
     dependencies:
       address: 1.2.2
-      debug: 4.3.6(supports-color@8.1.1)
+      debug: 4.3.6
     transitivePeerDependencies:
       - supports-color
 
@@ -16893,11 +16095,6 @@ snapshots:
     optionalDependencies:
       wcwidth: 1.0.1
 
-  ecc-jsbn@0.1.2:
-    dependencies:
-      jsbn: 0.1.1
-      safer-buffer: 2.1.2
-
   editorconfig@1.0.4:
     dependencies:
       '@one-ini/wasm': 0.1.1
@@ -16951,6 +16148,7 @@ snapshots:
   enquirer@2.3.6:
     dependencies:
       ansi-colors: 4.1.3
+    optional: true
 
   entities@2.2.0: {}
 
@@ -17104,10 +16302,6 @@ snapshots:
       has-tostringtag: 1.0.2
       hasown: 2.0.2
 
-  es-shim-unscopables@1.0.0:
-    dependencies:
-      has: 1.0.3
-
   es-to-primitive@1.2.1:
     dependencies:
       is-callable: 1.2.7
@@ -17166,7 +16360,7 @@ snapshots:
 
   esbuild-register@3.5.0(esbuild@0.18.20):
     dependencies:
-      debug: 4.3.6(supports-color@8.1.1)
+      debug: 4.3.6
       esbuild: 0.18.20
     transitivePeerDependencies:
       - supports-color
@@ -17318,11 +16512,6 @@ snapshots:
     dependencies:
       eslint: 8.43.0
 
-  eslint-plugin-cypress@2.13.3(eslint@8.43.0):
-    dependencies:
-      eslint: 8.43.0
-      globals: 11.12.0
-
   eslint-plugin-prettier@4.2.1(eslint-config-prettier@8.10.0(eslint@8.43.0))(eslint@8.43.0)(prettier@2.8.8):
     dependencies:
       eslint: 8.43.0
@@ -17379,7 +16568,7 @@ snapshots:
       ajv: 6.12.6
       chalk: 4.1.2
       cross-spawn: 7.0.3
-      debug: 4.3.4(supports-color@8.1.1)
+      debug: 4.3.4
       doctrine: 3.0.0
       escape-string-regexp: 4.0.0
       eslint-scope: 7.2.0
@@ -17449,24 +16638,10 @@ snapshots:
       stream-combiner: 0.0.4
       through: 2.3.8
 
-  eventemitter2@6.4.7: {}
-
   eventemitter3@4.0.7: {}
 
   events@3.3.0: {}
 
-  execa@4.1.0:
-    dependencies:
-      cross-spawn: 7.0.3
-      get-stream: 5.2.0
-      human-signals: 1.1.1
-      is-stream: 2.0.1
-      merge-stream: 2.0.0
-      npm-run-path: 4.0.1
-      onetime: 5.1.2
-      signal-exit: 3.0.7
-      strip-final-newline: 2.0.0
-
   execa@5.1.1:
     dependencies:
       cross-spawn: 7.0.3
@@ -17515,10 +16690,6 @@ snapshots:
       signal-exit: 4.1.0
       strip-final-newline: 3.0.0
 
-  executable@4.1.1:
-    dependencies:
-      pify: 2.3.0
-
   exifr@7.1.3: {}
 
   express@4.18.2:
@@ -17559,8 +16730,6 @@ snapshots:
 
   extend@3.0.2: {}
 
-  extendable-error@0.1.7: {}
-
   external-editor@3.1.0:
     dependencies:
       chardet: 0.7.0
@@ -17576,18 +16745,6 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  extract-zip@2.0.1(supports-color@8.1.1):
-    dependencies:
-      debug: 4.3.6(supports-color@8.1.1)
-      get-stream: 5.2.0
-      yauzl: 2.10.0
-    optionalDependencies:
-      '@types/yauzl': 2.10.0
-    transitivePeerDependencies:
-      - supports-color
-
-  extsprintf@1.3.0: {}
-
   fast-deep-equal@3.1.3: {}
 
   fast-diff@1.2.0: {}
@@ -17707,11 +16864,6 @@ snapshots:
       locate-path: 6.0.0
       path-exists: 4.0.0
 
-  find-yarn-workspace-root2@1.2.16:
-    dependencies:
-      micromatch: 4.0.5
-      pkg-dir: 4.2.0
-
   flat-cache@3.0.4:
     dependencies:
       flatted: 3.2.7
@@ -17745,16 +16897,8 @@ snapshots:
       cross-spawn: 7.0.3
       signal-exit: 4.1.0
 
-  forever-agent@0.6.1: {}
-
   form-data-encoder@2.1.4: {}
 
-  form-data@2.3.3:
-    dependencies:
-      asynckit: 0.4.0
-      combined-stream: 1.0.8
-      mime-types: 2.1.35
-
   form-data@4.0.0:
     dependencies:
       asynckit: 0.4.0
@@ -17869,10 +17013,6 @@ snapshots:
 
   get-port@5.1.1: {}
 
-  get-stream@5.2.0:
-    dependencies:
-      pump: 3.0.0
-
   get-stream@6.0.1: {}
 
   get-stream@8.0.1: {}
@@ -17892,19 +17032,11 @@ snapshots:
     dependencies:
       basic-ftp: 5.0.3
       data-uri-to-buffer: 6.0.1
-      debug: 4.3.6(supports-color@8.1.1)
+      debug: 4.3.6
       fs-extra: 8.1.0
     transitivePeerDependencies:
       - supports-color
 
-  getos@3.2.1:
-    dependencies:
-      async: 3.2.4
-
-  getpass@0.1.7:
-    dependencies:
-      assert-plus: 1.0.0
-
   giget@1.1.3:
     dependencies:
       colorette: 2.0.20
@@ -18068,8 +17200,6 @@ snapshots:
     optionalDependencies:
       uglify-js: 3.17.4
 
-  hard-rejection@2.1.0: {}
-
   has-bigints@1.0.2: {}
 
   has-flag@3.0.0: {}
@@ -18154,23 +17284,17 @@ snapshots:
     dependencies:
       '@tootallnate/once': 2.0.0
       agent-base: 6.0.2
-      debug: 4.3.6(supports-color@8.1.1)
+      debug: 4.3.6
     transitivePeerDependencies:
       - supports-color
 
   http-proxy-agent@7.0.0:
     dependencies:
       agent-base: 7.1.0
-      debug: 4.3.6(supports-color@8.1.1)
+      debug: 4.3.6
     transitivePeerDependencies:
       - supports-color
 
-  http-signature@1.3.6:
-    dependencies:
-      assert-plus: 1.0.0
-      jsprim: 2.0.2
-      sshpk: 1.17.0
-
   http2-wrapper@2.2.1:
     dependencies:
       quick-lru: 5.1.1
@@ -18179,35 +17303,31 @@ snapshots:
   https-proxy-agent@4.0.0:
     dependencies:
       agent-base: 5.1.1
-      debug: 4.3.6(supports-color@8.1.1)
+      debug: 4.3.6
     transitivePeerDependencies:
       - supports-color
 
   https-proxy-agent@5.0.1:
     dependencies:
       agent-base: 6.0.2
-      debug: 4.3.6(supports-color@8.1.1)
+      debug: 4.3.6
     transitivePeerDependencies:
       - supports-color
 
   https-proxy-agent@7.0.2:
     dependencies:
       agent-base: 7.1.0
-      debug: 4.3.6(supports-color@8.1.1)
+      debug: 4.3.6
     transitivePeerDependencies:
       - supports-color
 
   https-proxy-agent@7.0.4:
     dependencies:
       agent-base: 7.1.0
-      debug: 4.3.6(supports-color@8.1.1)
+      debug: 4.3.6
     transitivePeerDependencies:
       - supports-color
 
-  human-id@1.0.2: {}
-
-  human-signals@1.1.1: {}
-
   human-signals@2.1.0: {}
 
   human-signals@4.3.1: {}
@@ -18455,8 +17575,6 @@ snapshots:
 
   is-path-inside@3.0.3: {}
 
-  is-plain-obj@1.1.0: {}
-
   is-plain-object@2.0.4:
     dependencies:
       isobject: 3.0.1
@@ -18502,10 +17620,6 @@ snapshots:
     dependencies:
       has-tostringtag: 1.0.0
 
-  is-subdir@1.2.0:
-    dependencies:
-      better-path-resolve: 1.0.0
-
   is-symbol@1.0.4:
     dependencies:
       has-symbols: 1.0.3
@@ -18539,8 +17653,6 @@ snapshots:
 
   is-what@4.1.16: {}
 
-  is-windows@1.0.2: {}
-
   is-wsl@2.2.0:
     dependencies:
       is-docker: 2.2.1
@@ -18559,8 +17671,6 @@ snapshots:
 
   isobject@3.0.1: {}
 
-  isstream@0.1.2: {}
-
   issue-parser@6.0.0:
     dependencies:
       lodash.capitalize: 4.2.1
@@ -18706,8 +17816,6 @@ snapshots:
     dependencies:
       argparse: 2.0.1
 
-  jsbn@0.1.1: {}
-
   jscodeshift@0.15.1(@babel/preset-env@7.23.5(@babel/core@7.24.5)):
     dependencies:
       '@babel/core': 7.24.5
@@ -18788,8 +17896,6 @@ snapshots:
 
   json-stable-stringify-without-jsonify@1.0.1: {}
 
-  json-stringify-safe@5.0.1: {}
-
   json5@2.2.3: {}
 
   jsonc-eslint-parser@2.4.0:
@@ -18813,13 +17919,6 @@ snapshots:
 
   jsonpointer@5.0.1: {}
 
-  jsprim@2.0.2:
-    dependencies:
-      assert-plus: 1.0.0
-      extsprintf: 1.3.0
-      json-schema: 0.4.0
-      verror: 1.10.0
-
   jstransformer@1.0.0:
     dependencies:
       is-promise: 2.2.2
@@ -18835,8 +17934,6 @@ snapshots:
 
   kleur@3.0.3: {}
 
-  kleur@4.1.5: {}
-
   kolorist@1.8.0: {}
 
   latest-version@7.0.0:
@@ -18897,7 +17994,7 @@ snapshots:
       chalk: 5.2.0
       cli-truncate: 3.1.0
       commander: 10.0.0
-      debug: 4.3.4(supports-color@8.1.1)
+      debug: 4.3.4
       execa: 7.1.1
       lilconfig: 2.1.0
       listr2: 5.0.8(enquirer@2.3.6)
@@ -18911,19 +18008,6 @@ snapshots:
       - enquirer
       - supports-color
 
-  listr2@3.14.0(enquirer@2.3.6):
-    dependencies:
-      cli-truncate: 2.1.0
-      colorette: 2.0.19
-      log-update: 4.0.0
-      p-map: 4.0.0
-      rfdc: 1.3.0
-      rxjs: 7.8.1
-      through: 2.3.8
-      wrap-ansi: 7.0.0
-    optionalDependencies:
-      enquirer: 2.3.6
-
   listr2@5.0.8(enquirer@2.3.6):
     dependencies:
       cli-truncate: 2.1.0
@@ -18944,13 +18028,6 @@ snapshots:
       pify: 3.0.0
       strip-bom: 3.0.0
 
-  load-yaml-file@0.2.0:
-    dependencies:
-      graceful-fs: 4.2.11
-      js-yaml: 3.14.1
-      pify: 4.0.1
-      strip-bom: 3.0.0
-
   loader-runner@4.3.0: {}
 
   loader-utils@2.0.4:
@@ -18995,12 +18072,8 @@ snapshots:
 
   lodash.mergewith@4.6.2: {}
 
-  lodash.once@4.1.1: {}
-
   lodash.sortby@4.7.0: {}
 
-  lodash.startcase@4.4.0: {}
-
   lodash.uniqby@4.7.0: {}
 
   lodash@4.17.21: {}
@@ -19042,11 +18115,6 @@ snapshots:
 
   lru-cache@10.1.0: {}
 
-  lru-cache@4.1.5:
-    dependencies:
-      pseudomap: 1.0.2
-      yallist: 2.1.2
-
   lru-cache@5.1.1:
     dependencies:
       yallist: 3.1.1
@@ -19092,10 +18160,6 @@ snapshots:
     dependencies:
       tmpl: 1.0.5
 
-  map-obj@1.0.1: {}
-
-  map-obj@4.3.0: {}
-
   map-or-similar@1.5.0: {}
 
   map-stream@0.1.0: {}
@@ -19133,20 +18197,6 @@ snapshots:
 
   memorystream@0.3.1: {}
 
-  meow@6.1.1:
-    dependencies:
-      '@types/minimist': 1.2.2
-      camelcase-keys: 6.2.2
-      decamelize-keys: 1.1.0
-      hard-rejection: 2.1.0
-      minimist-options: 4.1.0
-      normalize-package-data: 2.5.0
-      read-pkg-up: 7.0.1
-      redent: 3.0.0
-      trim-newlines: 3.0.1
-      type-fest: 0.13.1
-      yargs-parser: 18.1.3
-
   merge-descriptors@1.0.1: {}
 
   merge-stream@2.0.0: {}
@@ -19182,8 +18232,6 @@ snapshots:
 
   mimic-response@4.0.0: {}
 
-  min-indent@1.0.1: {}
-
   mini-svg-data-uri@1.4.4: {}
 
   minimatch@3.0.8:
@@ -19206,12 +18254,6 @@ snapshots:
     dependencies:
       brace-expansion: 2.0.1
 
-  minimist-options@4.1.0:
-    dependencies:
-      arrify: 1.0.1
-      is-plain-obj: 1.1.0
-      kind-of: 6.0.3
-
   minimist@1.2.6: {}
 
   minipass@3.3.6:
@@ -19231,8 +18273,6 @@ snapshots:
 
   mitt@3.0.1: {}
 
-  mixme@0.5.4: {}
-
   mkdirp-classic@0.5.3: {}
 
   mkdirp@0.5.6:
@@ -19532,10 +18572,6 @@ snapshots:
 
   os-tmpdir@1.0.2: {}
 
-  ospath@1.2.2: {}
-
-  outdent@0.5.0: {}
-
   overlayscrollbars-vue@0.5.7(overlayscrollbars@2.5.0)(vue@3.5.11(typescript@5.6.2)):
     dependencies:
       overlayscrollbars: 2.5.0
@@ -19545,10 +18581,6 @@ snapshots:
 
   p-cancelable@3.0.0: {}
 
-  p-filter@2.1.0:
-    dependencies:
-      p-map: 2.1.0
-
   p-limit@2.3.0:
     dependencies:
       p-try: 2.2.0
@@ -19573,8 +18605,6 @@ snapshots:
     dependencies:
       p-limit: 3.1.0
 
-  p-map@2.1.0: {}
-
   p-map@4.0.0:
     dependencies:
       aggregate-error: 3.1.0
@@ -19598,7 +18628,7 @@ snapshots:
     dependencies:
       '@tootallnate/quickjs-emscripten': 0.23.0
       agent-base: 7.1.0
-      debug: 4.3.6(supports-color@8.1.1)
+      debug: 4.3.6
       get-uri: 6.0.2
       http-proxy-agent: 7.0.0
       https-proxy-agent: 7.0.2
@@ -19719,8 +18749,6 @@ snapshots:
 
   perfect-debounce@1.0.0: {}
 
-  performance-now@2.1.0: {}
-
   picocolors@0.2.1: {}
 
   picocolors@1.0.0: {}
@@ -19897,13 +18925,6 @@ snapshots:
 
   preact@10.11.2: {}
 
-  preferred-pm@3.0.3:
-    dependencies:
-      find-up: 5.0.0
-      find-yarn-workspace-root2: 1.2.16
-      path-exists: 4.0.0
-      which-pm: 2.0.0
-
   prelude-ls@1.1.2: {}
 
   prelude-ls@1.2.1: {}
@@ -20083,7 +19104,7 @@ snapshots:
   proxy-agent@6.3.1:
     dependencies:
       agent-base: 7.1.0
-      debug: 4.3.6(supports-color@8.1.1)
+      debug: 4.3.6
       http-proxy-agent: 7.0.0
       https-proxy-agent: 7.0.2
       lru-cache: 7.18.3
@@ -20093,8 +19114,6 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  proxy-from-env@1.0.0: {}
-
   proxy-from-env@1.1.0: {}
 
   prr@1.0.1:
@@ -20104,8 +19123,6 @@ snapshots:
     dependencies:
       event-stream: 3.3.4
 
-  pseudomap@1.0.2: {}
-
   psl@1.9.0: {}
 
   pug-attrs@3.0.0:
@@ -20204,7 +19221,7 @@ snapshots:
   puppeteer-core@2.1.1:
     dependencies:
       '@types/mime-types': 2.1.4
-      debug: 4.3.6(supports-color@8.1.1)
+      debug: 4.3.6
       extract-zip: 1.7.0
       https-proxy-agent: 4.0.0
       mime: 2.6.0
@@ -20237,14 +19254,10 @@ snapshots:
     dependencies:
       side-channel: 1.0.6
 
-  qs@6.5.3: {}
-
   querystringify@2.2.0: {}
 
   queue-microtask@1.2.3: {}
 
-  quick-lru@4.0.1: {}
-
   quick-lru@5.1.1: {}
 
   ramda@0.29.0: {}
@@ -20346,13 +19359,6 @@ snapshots:
       parse-json: 5.2.0
       type-fest: 0.6.0
 
-  read-yaml-file@1.1.0:
-    dependencies:
-      graceful-fs: 4.2.11
-      js-yaml: 3.14.1
-      pify: 4.0.1
-      strip-bom: 3.0.0
-
   readable-stream@2.3.7:
     dependencies:
       core-util-is: 1.0.3
@@ -20385,11 +19391,6 @@ snapshots:
     dependencies:
       resolve: 1.22.1
 
-  redent@3.0.0:
-    dependencies:
-      indent-string: 4.0.0
-      strip-indent: 3.0.0
-
   reflect-metadata@0.1.13: {}
 
   regenerate-unicode-properties@10.1.0:
@@ -20494,10 +19495,6 @@ snapshots:
 
   remove-accents@0.4.2: {}
 
-  request-progress@3.0.0:
-    dependencies:
-      throttleit: 1.0.0
-
   require-directory@2.1.1: {}
 
   require-from-string@2.0.2: {}
@@ -20583,7 +19580,7 @@ snapshots:
   rollup-plugin-esbuild@4.10.3(esbuild@0.14.54)(rollup@2.79.1):
     dependencies:
       '@rollup/pluginutils': 4.2.1
-      debug: 4.3.4(supports-color@8.1.1)
+      debug: 4.3.4
       es-module-lexer: 0.9.3
       esbuild: 0.14.54
       joycon: 3.1.1
@@ -20736,10 +19733,6 @@ snapshots:
 
   semver@6.3.1: {}
 
-  semver@7.5.2:
-    dependencies:
-      lru-cache: 6.0.0
-
   semver@7.5.4:
     dependencies:
       lru-cache: 6.0.0
@@ -20897,19 +19890,10 @@ snapshots:
 
   smart-buffer@4.2.0: {}
 
-  smartwrap@2.0.2:
-    dependencies:
-      array.prototype.flat: 1.3.0
-      breakword: 1.0.5
-      grapheme-splitter: 1.0.4
-      strip-ansi: 6.0.1
-      wcwidth: 1.0.1
-      yargs: 15.4.1
-
   socks-proxy-agent@8.0.2:
     dependencies:
       agent-base: 7.1.0
-      debug: 4.3.6(supports-color@8.1.1)
+      debug: 4.3.6
       socks: 2.7.1
     transitivePeerDependencies:
       - supports-color
@@ -20945,11 +19929,6 @@ snapshots:
 
   spawn-command@0.0.2-1: {}
 
-  spawndamnit@2.0.0:
-    dependencies:
-      cross-spawn: 5.1.0
-      signal-exit: 3.0.7
-
   spdx-correct@3.1.1:
     dependencies:
       spdx-expression-parse: 3.0.1
@@ -20972,18 +19951,6 @@ snapshots:
 
   sprintf-js@1.0.3: {}
 
-  sshpk@1.17.0:
-    dependencies:
-      asn1: 0.2.6
-      assert-plus: 1.0.0
-      bcrypt-pbkdf: 1.0.2
-      dashdash: 1.14.1
-      ecc-jsbn: 0.1.2
-      getpass: 0.1.7
-      jsbn: 0.1.1
-      safer-buffer: 2.1.2
-      tweetnacl: 0.14.5
-
   stackback@0.0.2: {}
 
   start-server-and-test@1.14.0:
@@ -21027,10 +19994,6 @@ snapshots:
 
   stream-shift@1.0.1: {}
 
-  stream-transform@2.1.3:
-    dependencies:
-      mixme: 0.5.4
-
   string-argv@0.3.1: {}
 
   string-width@4.2.3:
@@ -21139,10 +20102,6 @@ snapshots:
 
   strip-final-newline@3.0.0: {}
 
-  strip-indent@3.0.0:
-    dependencies:
-      min-indent: 1.0.1
-
   strip-json-comments@2.0.1: {}
 
   strip-json-comments@3.1.1: {}
@@ -21280,8 +20239,6 @@ snapshots:
       type-fest: 0.16.0
       unique-string: 2.0.0
 
-  term-size@2.2.1: {}
-
   terser-webpack-plugin@5.3.10(esbuild@0.18.20)(webpack@5.89.0(esbuild@0.18.20)):
     dependencies:
       '@jridgewell/trace-mapping': 0.3.25
@@ -21323,8 +20280,6 @@ snapshots:
     dependencies:
       any-promise: 1.3.0
 
-  throttleit@1.0.0: {}
-
   through2@2.0.5:
     dependencies:
       readable-stream: 2.3.7
@@ -21350,10 +20305,6 @@ snapshots:
     dependencies:
       os-tmpdir: 1.0.2
 
-  tmp@0.2.1:
-    dependencies:
-      rimraf: 3.0.2
-
   tmpl@1.0.5: {}
 
   to-fast-properties@2.0.0: {}
@@ -21370,11 +20321,6 @@ snapshots:
 
   totalist@3.0.0: {}
 
-  tough-cookie@2.5.0:
-    dependencies:
-      psl: 1.9.0
-      punycode: 2.1.1
-
   tough-cookie@4.1.2:
     dependencies:
       psl: 1.9.0
@@ -21398,8 +20344,6 @@ snapshots:
 
   tree-kill@1.2.2: {}
 
-  trim-newlines@3.0.1: {}
-
   ts-dedent@2.2.0: {}
 
   ts-interface-checker@0.1.13: {}
@@ -21415,22 +20359,6 @@ snapshots:
       tslib: 1.14.1
       typescript: 5.6.2
 
-  tty-table@4.1.6:
-    dependencies:
-      chalk: 4.1.2
-      csv: 5.5.3
-      kleur: 4.1.5
-      smartwrap: 2.0.2
-      strip-ansi: 6.0.1
-      wcwidth: 1.0.1
-      yargs: 17.5.1
-
-  tunnel-agent@0.6.0:
-    dependencies:
-      safe-buffer: 5.2.1
-
-  tweetnacl@0.14.5: {}
-
   type-check@0.3.2:
     dependencies:
       prelude-ls: 1.1.2
@@ -21441,8 +20369,6 @@ snapshots:
 
   type-detect@4.0.8: {}
 
-  type-fest@0.13.1: {}
-
   type-fest@0.16.0: {}
 
   type-fest@0.20.2: {}
@@ -21642,7 +20568,7 @@ snapshots:
       '@antfu/install-pkg': 0.1.1
       '@antfu/utils': 0.7.6
       '@iconify/utils': 2.1.12
-      debug: 4.3.4(supports-color@8.1.1)
+      debug: 4.3.4
       kolorist: 1.8.0
       local-pkg: 0.4.3
       unplugin: 1.5.1
@@ -21657,7 +20583,7 @@ snapshots:
       '@antfu/install-pkg': 0.3.3
       '@antfu/utils': 0.7.10
       '@iconify/utils': 2.1.30
-      debug: 4.3.6(supports-color@8.1.1)
+      debug: 4.3.6
       kolorist: 1.8.0
       local-pkg: 0.5.0
       unplugin: 1.12.1
@@ -21773,8 +20699,6 @@ snapshots:
 
   utils-merge@1.0.1: {}
 
-  uuid@8.3.2: {}
-
   uuid@9.0.1: {}
 
   v8-to-istanbul@9.0.1:
@@ -21790,12 +20714,6 @@ snapshots:
 
   vary@1.1.2: {}
 
-  verror@1.10.0:
-    dependencies:
-      assert-plus: 1.0.0
-      core-util-is: 1.0.2
-      extsprintf: 1.3.0
-
   vite-hot-client@0.2.3(vite@5.4.1(@types/node@18.13.0)(less@4.2.0)(sass@1.60.0)(terser@5.31.0)):
     dependencies:
       vite: 5.4.1(@types/node@18.13.0)(less@4.2.0)(sass@1.60.0)(terser@5.31.0)
@@ -21803,7 +20721,7 @@ snapshots:
   vite-node@0.34.1(@types/node@18.19.34)(less@4.2.0)(sass@1.60.0)(terser@5.31.0):
     dependencies:
       cac: 6.7.14
-      debug: 4.3.6(supports-color@8.1.1)
+      debug: 4.3.6
       mlly: 1.4.0
       pathe: 1.1.2
       picocolors: 1.1.0
@@ -21824,7 +20742,7 @@ snapshots:
       '@volar/typescript': 2.4.5
       '@vue/language-core': 2.1.6(typescript@5.5.4)
       compare-versions: 6.1.1
-      debug: 4.3.6(supports-color@8.1.1)
+      debug: 4.3.6
       kolorist: 1.8.0
       local-pkg: 0.5.0
       magic-string: 0.30.11
@@ -21843,7 +20761,7 @@ snapshots:
       '@volar/typescript': 2.4.5
       '@vue/language-core': 2.1.6(typescript@5.6.2)
       compare-versions: 6.1.1
-      debug: 4.3.6(supports-color@8.1.1)
+      debug: 4.3.6
       kolorist: 1.8.0
       local-pkg: 0.5.0
       magic-string: 0.30.11
@@ -21883,7 +20801,7 @@ snapshots:
     dependencies:
       '@antfu/utils': 0.7.10
       '@rollup/pluginutils': 5.1.0(rollup@4.17.2)
-      debug: 4.3.6(supports-color@8.1.1)
+      debug: 4.3.6
       error-stack-parser-es: 0.1.5
       fs-extra: 11.2.0
       open: 10.1.0
@@ -21897,7 +20815,7 @@ snapshots:
 
   vite-plugin-pwa@0.20.0(vite@5.4.1(@types/node@18.13.0)(less@4.2.0)(sass@1.60.0)(terser@5.31.0))(workbox-build@7.0.0(@types/babel__core@7.20.5))(workbox-window@7.0.0):
     dependencies:
-      debug: 4.3.4(supports-color@8.1.1)
+      debug: 4.3.4
       fast-glob: 3.3.2
       pretty-bytes: 6.1.1
       vite: 5.4.1(@types/node@18.13.0)(less@4.2.0)(sass@1.60.0)(terser@5.31.0)
@@ -22009,7 +20927,7 @@ snapshots:
       acorn-walk: 8.2.0
       cac: 6.7.14
       chai: 4.3.7
-      debug: 4.3.4(supports-color@8.1.1)
+      debug: 4.3.4
       local-pkg: 0.4.3
       magic-string: 0.30.2
       pathe: 1.1.1
@@ -22069,7 +20987,7 @@ snapshots:
 
   vue-eslint-parser@9.3.0(eslint@8.43.0):
     dependencies:
-      debug: 4.3.6(supports-color@8.1.1)
+      debug: 4.3.6
       eslint: 8.43.0
       eslint-scope: 7.2.0
       eslint-visitor-keys: 3.4.1
@@ -22082,7 +21000,7 @@ snapshots:
 
   vue-eslint-parser@9.3.1(eslint@8.43.0):
     dependencies:
-      debug: 4.3.6(supports-color@8.1.1)
+      debug: 4.3.6
       eslint: 8.43.0
       eslint-scope: 7.2.0
       eslint-visitor-keys: 3.4.1
@@ -22267,11 +21185,6 @@ snapshots:
 
   which-module@2.0.0: {}
 
-  which-pm@2.0.0:
-    dependencies:
-      load-yaml-file: 0.2.0
-      path-exists: 4.0.0
-
   which-typed-array@1.1.13:
     dependencies:
       available-typed-arrays: 1.0.5
@@ -22493,8 +21406,6 @@ snapshots:
 
   y18n@5.0.8: {}
 
-  yallist@2.1.2: {}
-
   yallist@3.1.1: {}
 
   yallist@4.0.0: {}
diff --git a/ui/tailwind.config.cjs b/ui/tailwind.config.cjs
index e807b8c957..5cc14280ce 100644
--- a/ui/tailwind.config.cjs
+++ b/ui/tailwind.config.cjs
@@ -37,21 +37,6 @@ module.exports = {
           },
         },
       },
-      themes: [
-        {
-          name: "theme-dark",
-          extend: {
-            colors: {
-              primary: "black",
-              secondary: "#0E1731",
-            },
-            borderRadius: {
-              base: "2px",
-            },
-          },
-        },
-      ],
     }),
   ],
-  safelist: ["theme-dark"],
 };
diff --git a/ui/tsconfig.node.json b/ui/tsconfig.node.json
index 646e8ec899..0e33b5b430 100644
--- a/ui/tsconfig.node.json
+++ b/ui/tsconfig.node.json
@@ -4,7 +4,6 @@
     "vite.config.ts",
     "vite.uc.config.ts",
     "vitest.config.*",
-    "cypress.config.*",
     "src/vite/library-external.ts",
     "src/vite/config-builder.ts"
   ],

From d2799c59be0dfd49b07147069f7397224efb3418 Mon Sep 17 00:00:00 2001
From: guqing <38999863+guqing@users.noreply.github.com>
Date: Tue, 22 Oct 2024 15:52:28 +0800
Subject: [PATCH 170/185] fix: path match rules for grouped OpenAPI (#6898)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?
/kind improvement
/area core
/milestone 2.20.x

#### What this PR does / why we need it:
修正 OpenAPI 的分组匹配规则 之前有很多 PublicAPIs 没有出现在对应的组

#### Does this PR introduce a user-facing change?
```release-note
None
```
---
 api-docs/openapi/v3_0/aggregated.json         |   27 +-
 .../v3_0/apis_extension.api_v1alpha1.json     | 5559 ++++++++++++-----
 .../v3_0/apis_public.api_v1alpha1.json        | 2804 +++++++--
 .../openapi/v3_0/apis_uc.api_v1alpha1.json    |  567 ++
 .../halo/app/infra/config/SwaggerConfig.java  |   21 +-
 .../endpoint/SubscriptionRouter.java          |    3 +-
 .../security/preauth/SystemSetupEndpoint.java |   12 +-
 ui/packages/api-client/entry/api-client.ts    |    6 +
 .../api-client/src/.openapi-generator/FILES   |    3 +-
 ui/packages/api-client/src/api.ts             |    3 +-
 ui/packages/api-client/src/api/default-api.ts |  126 +
 ...ts => notification-v1alpha1-public-api.ts} |   46 +-
 .../src/api/system-v1alpha1-public-api.ts     |   66 +
 13 files changed, 6973 insertions(+), 2270 deletions(-)
 create mode 100644 ui/packages/api-client/src/api/default-api.ts
 rename ui/packages/api-client/src/api/{api-notification-halo-run-v1alpha1-subscription-api.ts => notification-v1alpha1-public-api.ts} (67%)

diff --git a/api-docs/openapi/v3_0/aggregated.json b/api-docs/openapi/v3_0/aggregated.json
index d07c4b85c6..3296993b1f 100644
--- a/api-docs/openapi/v3_0/aggregated.json
+++ b/api-docs/openapi/v3_0/aggregated.json
@@ -6559,7 +6559,7 @@
           }
         },
         "tags": [
-          "api.notification.halo.run/v1alpha1/Subscription"
+          "NotificationV1alpha1Public"
         ]
       }
     },
@@ -15679,6 +15679,31 @@
           "AttachmentV1alpha1Uc"
         ]
       }
+    },
+    "/system/setup": {
+      "get": {
+        "description": "Jump to setup page",
+        "operationId": "JumpToSetupPage",
+        "responses": {
+          "default": {
+            "content": {
+              "text/html": {
+                "schema": {
+                  "type": "string"
+                }
+              }
+            },
+            "description": "default response"
+          }
+        },
+        "tags": [
+          "SystemV1alpha1Public"
+        ]
+      },
+      "post": {
+        "operationId": "SetNoCacheForSetUpPage",
+        "responses": {}
+      }
     }
   },
   "components": {
diff --git a/api-docs/openapi/v3_0/apis_extension.api_v1alpha1.json b/api-docs/openapi/v3_0/apis_extension.api_v1alpha1.json
index 84340604dc..0652eb77db 100644
--- a/api-docs/openapi/v3_0/apis_extension.api_v1alpha1.json
+++ b/api-docs/openapi/v3_0/apis_extension.api_v1alpha1.json
@@ -4757,10 +4757,10 @@
         ]
       }
     },
-    "/apis/plugin.halo.run/v1alpha1/extensiondefinitions": {
+    "/apis/notification.halo.run/v1alpha1/notifications": {
       "get": {
-        "description": "List ExtensionDefinition",
-        "operationId": "listExtensionDefinition",
+        "description": "List Notification",
+        "operationId": "listNotification",
         "parameters": [
           {
             "description": "Page number. Default is 0.",
@@ -4819,54 +4819,54 @@
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/ExtensionDefinitionList"
+                  "$ref": "#/components/schemas/NotificationList"
                 }
               }
             },
-            "description": "Response extensiondefinitions"
+            "description": "Response notifications"
           }
         },
         "tags": [
-          "ExtensionDefinitionV1alpha1"
+          "NotificationV1alpha1"
         ]
       },
       "post": {
-        "description": "Create ExtensionDefinition",
-        "operationId": "createExtensionDefinition",
+        "description": "Create Notification",
+        "operationId": "createNotification",
         "requestBody": {
           "content": {
             "*/*": {
               "schema": {
-                "$ref": "#/components/schemas/ExtensionDefinition"
+                "$ref": "#/components/schemas/Notification"
               }
             }
           },
-          "description": "Fresh extensiondefinition"
+          "description": "Fresh notification"
         },
         "responses": {
           "200": {
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/ExtensionDefinition"
+                  "$ref": "#/components/schemas/Notification"
                 }
               }
             },
-            "description": "Response extensiondefinitions created just now"
+            "description": "Response notifications created just now"
           }
         },
         "tags": [
-          "ExtensionDefinitionV1alpha1"
+          "NotificationV1alpha1"
         ]
       }
     },
-    "/apis/plugin.halo.run/v1alpha1/extensiondefinitions/{name}": {
+    "/apis/notification.halo.run/v1alpha1/notifications/{name}": {
       "delete": {
-        "description": "Delete ExtensionDefinition",
-        "operationId": "deleteExtensionDefinition",
+        "description": "Delete Notification",
+        "operationId": "deleteNotification",
         "parameters": [
           {
-            "description": "Name of extensiondefinition",
+            "description": "Name of notification",
             "in": "path",
             "name": "name",
             "required": true,
@@ -4877,19 +4877,19 @@
         ],
         "responses": {
           "200": {
-            "description": "Response extensiondefinition deleted just now"
+            "description": "Response notification deleted just now"
           }
         },
         "tags": [
-          "ExtensionDefinitionV1alpha1"
+          "NotificationV1alpha1"
         ]
       },
       "get": {
-        "description": "Get ExtensionDefinition",
-        "operationId": "getExtensionDefinition",
+        "description": "Get Notification",
+        "operationId": "getNotification",
         "parameters": [
           {
-            "description": "Name of extensiondefinition",
+            "description": "Name of notification",
             "in": "path",
             "name": "name",
             "required": true,
@@ -4903,23 +4903,23 @@
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/ExtensionDefinition"
+                  "$ref": "#/components/schemas/Notification"
                 }
               }
             },
-            "description": "Response single extensiondefinition"
+            "description": "Response single notification"
           }
         },
         "tags": [
-          "ExtensionDefinitionV1alpha1"
+          "NotificationV1alpha1"
         ]
       },
       "patch": {
-        "description": "Patch ExtensionDefinition",
-        "operationId": "patchExtensionDefinition",
+        "description": "Patch Notification",
+        "operationId": "patchNotification",
         "parameters": [
           {
-            "description": "Name of extensiondefinition",
+            "description": "Name of notification",
             "in": "path",
             "name": "name",
             "required": true,
@@ -4942,23 +4942,23 @@
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/ExtensionDefinition"
+                  "$ref": "#/components/schemas/Notification"
                 }
               }
             },
-            "description": "Response extensiondefinition patched just now"
+            "description": "Response notification patched just now"
           }
         },
         "tags": [
-          "ExtensionDefinitionV1alpha1"
+          "NotificationV1alpha1"
         ]
       },
       "put": {
-        "description": "Update ExtensionDefinition",
-        "operationId": "updateExtensionDefinition",
+        "description": "Update Notification",
+        "operationId": "updateNotification",
         "parameters": [
           {
-            "description": "Name of extensiondefinition",
+            "description": "Name of notification",
             "in": "path",
             "name": "name",
             "required": true,
@@ -4971,33 +4971,33 @@
           "content": {
             "*/*": {
               "schema": {
-                "$ref": "#/components/schemas/ExtensionDefinition"
+                "$ref": "#/components/schemas/Notification"
               }
             }
           },
-          "description": "Updated extensiondefinition"
+          "description": "Updated notification"
         },
         "responses": {
           "200": {
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/ExtensionDefinition"
+                  "$ref": "#/components/schemas/Notification"
                 }
               }
             },
-            "description": "Response extensiondefinitions updated just now"
+            "description": "Response notifications updated just now"
           }
         },
         "tags": [
-          "ExtensionDefinitionV1alpha1"
+          "NotificationV1alpha1"
         ]
       }
     },
-    "/apis/plugin.halo.run/v1alpha1/extensionpointdefinitions": {
+    "/apis/notification.halo.run/v1alpha1/notificationtemplates": {
       "get": {
-        "description": "List ExtensionPointDefinition",
-        "operationId": "listExtensionPointDefinition",
+        "description": "List NotificationTemplate",
+        "operationId": "listNotificationTemplate",
         "parameters": [
           {
             "description": "Page number. Default is 0.",
@@ -5056,54 +5056,54 @@
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/ExtensionPointDefinitionList"
+                  "$ref": "#/components/schemas/NotificationTemplateList"
                 }
               }
             },
-            "description": "Response extensionpointdefinitions"
+            "description": "Response notificationtemplates"
           }
         },
         "tags": [
-          "ExtensionPointDefinitionV1alpha1"
+          "NotificationTemplateV1alpha1"
         ]
       },
       "post": {
-        "description": "Create ExtensionPointDefinition",
-        "operationId": "createExtensionPointDefinition",
+        "description": "Create NotificationTemplate",
+        "operationId": "createNotificationTemplate",
         "requestBody": {
           "content": {
             "*/*": {
               "schema": {
-                "$ref": "#/components/schemas/ExtensionPointDefinition"
+                "$ref": "#/components/schemas/NotificationTemplate"
               }
             }
           },
-          "description": "Fresh extensionpointdefinition"
+          "description": "Fresh notificationtemplate"
         },
         "responses": {
           "200": {
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/ExtensionPointDefinition"
+                  "$ref": "#/components/schemas/NotificationTemplate"
                 }
               }
             },
-            "description": "Response extensionpointdefinitions created just now"
+            "description": "Response notificationtemplates created just now"
           }
         },
         "tags": [
-          "ExtensionPointDefinitionV1alpha1"
+          "NotificationTemplateV1alpha1"
         ]
       }
     },
-    "/apis/plugin.halo.run/v1alpha1/extensionpointdefinitions/{name}": {
+    "/apis/notification.halo.run/v1alpha1/notificationtemplates/{name}": {
       "delete": {
-        "description": "Delete ExtensionPointDefinition",
-        "operationId": "deleteExtensionPointDefinition",
+        "description": "Delete NotificationTemplate",
+        "operationId": "deleteNotificationTemplate",
         "parameters": [
           {
-            "description": "Name of extensionpointdefinition",
+            "description": "Name of notificationtemplate",
             "in": "path",
             "name": "name",
             "required": true,
@@ -5114,19 +5114,19 @@
         ],
         "responses": {
           "200": {
-            "description": "Response extensionpointdefinition deleted just now"
+            "description": "Response notificationtemplate deleted just now"
           }
         },
         "tags": [
-          "ExtensionPointDefinitionV1alpha1"
+          "NotificationTemplateV1alpha1"
         ]
       },
       "get": {
-        "description": "Get ExtensionPointDefinition",
-        "operationId": "getExtensionPointDefinition",
+        "description": "Get NotificationTemplate",
+        "operationId": "getNotificationTemplate",
         "parameters": [
           {
-            "description": "Name of extensionpointdefinition",
+            "description": "Name of notificationtemplate",
             "in": "path",
             "name": "name",
             "required": true,
@@ -5140,23 +5140,23 @@
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/ExtensionPointDefinition"
+                  "$ref": "#/components/schemas/NotificationTemplate"
                 }
               }
             },
-            "description": "Response single extensionpointdefinition"
+            "description": "Response single notificationtemplate"
           }
         },
         "tags": [
-          "ExtensionPointDefinitionV1alpha1"
+          "NotificationTemplateV1alpha1"
         ]
       },
       "patch": {
-        "description": "Patch ExtensionPointDefinition",
-        "operationId": "patchExtensionPointDefinition",
+        "description": "Patch NotificationTemplate",
+        "operationId": "patchNotificationTemplate",
         "parameters": [
           {
-            "description": "Name of extensionpointdefinition",
+            "description": "Name of notificationtemplate",
             "in": "path",
             "name": "name",
             "required": true,
@@ -5179,23 +5179,23 @@
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/ExtensionPointDefinition"
+                  "$ref": "#/components/schemas/NotificationTemplate"
                 }
               }
             },
-            "description": "Response extensionpointdefinition patched just now"
+            "description": "Response notificationtemplate patched just now"
           }
         },
         "tags": [
-          "ExtensionPointDefinitionV1alpha1"
+          "NotificationTemplateV1alpha1"
         ]
       },
       "put": {
-        "description": "Update ExtensionPointDefinition",
-        "operationId": "updateExtensionPointDefinition",
+        "description": "Update NotificationTemplate",
+        "operationId": "updateNotificationTemplate",
         "parameters": [
           {
-            "description": "Name of extensionpointdefinition",
+            "description": "Name of notificationtemplate",
             "in": "path",
             "name": "name",
             "required": true,
@@ -5208,33 +5208,33 @@
           "content": {
             "*/*": {
               "schema": {
-                "$ref": "#/components/schemas/ExtensionPointDefinition"
+                "$ref": "#/components/schemas/NotificationTemplate"
               }
             }
           },
-          "description": "Updated extensionpointdefinition"
+          "description": "Updated notificationtemplate"
         },
         "responses": {
           "200": {
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/ExtensionPointDefinition"
+                  "$ref": "#/components/schemas/NotificationTemplate"
                 }
               }
             },
-            "description": "Response extensionpointdefinitions updated just now"
+            "description": "Response notificationtemplates updated just now"
           }
         },
         "tags": [
-          "ExtensionPointDefinitionV1alpha1"
+          "NotificationTemplateV1alpha1"
         ]
       }
     },
-    "/apis/plugin.halo.run/v1alpha1/plugins": {
+    "/apis/notification.halo.run/v1alpha1/notifierDescriptors": {
       "get": {
-        "description": "List Plugin",
-        "operationId": "listPlugin",
+        "description": "List NotifierDescriptor",
+        "operationId": "listNotifierDescriptor",
         "parameters": [
           {
             "description": "Page number. Default is 0.",
@@ -5293,54 +5293,54 @@
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/PluginList"
+                  "$ref": "#/components/schemas/NotifierDescriptorList"
                 }
               }
             },
-            "description": "Response plugins"
+            "description": "Response notifierDescriptors"
           }
         },
         "tags": [
-          "PluginV1alpha1"
+          "NotifierDescriptorV1alpha1"
         ]
       },
       "post": {
-        "description": "Create Plugin",
-        "operationId": "createPlugin",
+        "description": "Create NotifierDescriptor",
+        "operationId": "createNotifierDescriptor",
         "requestBody": {
           "content": {
             "*/*": {
               "schema": {
-                "$ref": "#/components/schemas/Plugin"
+                "$ref": "#/components/schemas/NotifierDescriptor"
               }
             }
           },
-          "description": "Fresh plugin"
+          "description": "Fresh notifierDescriptor"
         },
         "responses": {
           "200": {
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/Plugin"
+                  "$ref": "#/components/schemas/NotifierDescriptor"
                 }
               }
             },
-            "description": "Response plugins created just now"
+            "description": "Response notifierDescriptors created just now"
           }
         },
         "tags": [
-          "PluginV1alpha1"
+          "NotifierDescriptorV1alpha1"
         ]
       }
     },
-    "/apis/plugin.halo.run/v1alpha1/plugins/{name}": {
+    "/apis/notification.halo.run/v1alpha1/notifierDescriptors/{name}": {
       "delete": {
-        "description": "Delete Plugin",
-        "operationId": "deletePlugin",
+        "description": "Delete NotifierDescriptor",
+        "operationId": "deleteNotifierDescriptor",
         "parameters": [
           {
-            "description": "Name of plugin",
+            "description": "Name of notifierDescriptor",
             "in": "path",
             "name": "name",
             "required": true,
@@ -5351,19 +5351,19 @@
         ],
         "responses": {
           "200": {
-            "description": "Response plugin deleted just now"
+            "description": "Response notifierDescriptor deleted just now"
           }
         },
         "tags": [
-          "PluginV1alpha1"
+          "NotifierDescriptorV1alpha1"
         ]
       },
       "get": {
-        "description": "Get Plugin",
-        "operationId": "getPlugin",
+        "description": "Get NotifierDescriptor",
+        "operationId": "getNotifierDescriptor",
         "parameters": [
           {
-            "description": "Name of plugin",
+            "description": "Name of notifierDescriptor",
             "in": "path",
             "name": "name",
             "required": true,
@@ -5377,23 +5377,23 @@
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/Plugin"
+                  "$ref": "#/components/schemas/NotifierDescriptor"
                 }
               }
             },
-            "description": "Response single plugin"
+            "description": "Response single notifierDescriptor"
           }
         },
         "tags": [
-          "PluginV1alpha1"
+          "NotifierDescriptorV1alpha1"
         ]
       },
       "patch": {
-        "description": "Patch Plugin",
-        "operationId": "patchPlugin",
+        "description": "Patch NotifierDescriptor",
+        "operationId": "patchNotifierDescriptor",
         "parameters": [
           {
-            "description": "Name of plugin",
+            "description": "Name of notifierDescriptor",
             "in": "path",
             "name": "name",
             "required": true,
@@ -5416,23 +5416,23 @@
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/Plugin"
+                  "$ref": "#/components/schemas/NotifierDescriptor"
                 }
               }
             },
-            "description": "Response plugin patched just now"
+            "description": "Response notifierDescriptor patched just now"
           }
         },
         "tags": [
-          "PluginV1alpha1"
+          "NotifierDescriptorV1alpha1"
         ]
       },
       "put": {
-        "description": "Update Plugin",
-        "operationId": "updatePlugin",
+        "description": "Update NotifierDescriptor",
+        "operationId": "updateNotifierDescriptor",
         "parameters": [
           {
-            "description": "Name of plugin",
+            "description": "Name of notifierDescriptor",
             "in": "path",
             "name": "name",
             "required": true,
@@ -5445,33 +5445,33 @@
           "content": {
             "*/*": {
               "schema": {
-                "$ref": "#/components/schemas/Plugin"
+                "$ref": "#/components/schemas/NotifierDescriptor"
               }
             }
           },
-          "description": "Updated plugin"
+          "description": "Updated notifierDescriptor"
         },
         "responses": {
           "200": {
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/Plugin"
+                  "$ref": "#/components/schemas/NotifierDescriptor"
                 }
               }
             },
-            "description": "Response plugins updated just now"
+            "description": "Response notifierDescriptors updated just now"
           }
         },
         "tags": [
-          "PluginV1alpha1"
+          "NotifierDescriptorV1alpha1"
         ]
       }
     },
-    "/apis/plugin.halo.run/v1alpha1/reverseproxies": {
+    "/apis/notification.halo.run/v1alpha1/reasons": {
       "get": {
-        "description": "List ReverseProxy",
-        "operationId": "listReverseProxy",
+        "description": "List Reason",
+        "operationId": "listReason",
         "parameters": [
           {
             "description": "Page number. Default is 0.",
@@ -5530,54 +5530,54 @@
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/ReverseProxyList"
+                  "$ref": "#/components/schemas/ReasonList"
                 }
               }
             },
-            "description": "Response reverseproxies"
+            "description": "Response reasons"
           }
         },
         "tags": [
-          "ReverseProxyV1alpha1"
+          "ReasonV1alpha1"
         ]
       },
       "post": {
-        "description": "Create ReverseProxy",
-        "operationId": "createReverseProxy",
+        "description": "Create Reason",
+        "operationId": "createReason",
         "requestBody": {
           "content": {
             "*/*": {
               "schema": {
-                "$ref": "#/components/schemas/ReverseProxy"
+                "$ref": "#/components/schemas/Reason"
               }
             }
           },
-          "description": "Fresh reverseproxy"
+          "description": "Fresh reason"
         },
         "responses": {
           "200": {
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/ReverseProxy"
+                  "$ref": "#/components/schemas/Reason"
                 }
               }
             },
-            "description": "Response reverseproxies created just now"
+            "description": "Response reasons created just now"
           }
         },
         "tags": [
-          "ReverseProxyV1alpha1"
+          "ReasonV1alpha1"
         ]
       }
     },
-    "/apis/plugin.halo.run/v1alpha1/reverseproxies/{name}": {
+    "/apis/notification.halo.run/v1alpha1/reasons/{name}": {
       "delete": {
-        "description": "Delete ReverseProxy",
-        "operationId": "deleteReverseProxy",
+        "description": "Delete Reason",
+        "operationId": "deleteReason",
         "parameters": [
           {
-            "description": "Name of reverseproxy",
+            "description": "Name of reason",
             "in": "path",
             "name": "name",
             "required": true,
@@ -5588,19 +5588,19 @@
         ],
         "responses": {
           "200": {
-            "description": "Response reverseproxy deleted just now"
+            "description": "Response reason deleted just now"
           }
         },
         "tags": [
-          "ReverseProxyV1alpha1"
+          "ReasonV1alpha1"
         ]
       },
       "get": {
-        "description": "Get ReverseProxy",
-        "operationId": "getReverseProxy",
+        "description": "Get Reason",
+        "operationId": "getReason",
         "parameters": [
           {
-            "description": "Name of reverseproxy",
+            "description": "Name of reason",
             "in": "path",
             "name": "name",
             "required": true,
@@ -5614,23 +5614,23 @@
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/ReverseProxy"
+                  "$ref": "#/components/schemas/Reason"
                 }
               }
             },
-            "description": "Response single reverseproxy"
+            "description": "Response single reason"
           }
         },
         "tags": [
-          "ReverseProxyV1alpha1"
+          "ReasonV1alpha1"
         ]
       },
       "patch": {
-        "description": "Patch ReverseProxy",
-        "operationId": "patchReverseProxy",
+        "description": "Patch Reason",
+        "operationId": "patchReason",
         "parameters": [
           {
-            "description": "Name of reverseproxy",
+            "description": "Name of reason",
             "in": "path",
             "name": "name",
             "required": true,
@@ -5653,23 +5653,23 @@
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/ReverseProxy"
+                  "$ref": "#/components/schemas/Reason"
                 }
               }
             },
-            "description": "Response reverseproxy patched just now"
+            "description": "Response reason patched just now"
           }
         },
         "tags": [
-          "ReverseProxyV1alpha1"
+          "ReasonV1alpha1"
         ]
       },
       "put": {
-        "description": "Update ReverseProxy",
-        "operationId": "updateReverseProxy",
+        "description": "Update Reason",
+        "operationId": "updateReason",
         "parameters": [
           {
-            "description": "Name of reverseproxy",
+            "description": "Name of reason",
             "in": "path",
             "name": "name",
             "required": true,
@@ -5682,33 +5682,33 @@
           "content": {
             "*/*": {
               "schema": {
-                "$ref": "#/components/schemas/ReverseProxy"
+                "$ref": "#/components/schemas/Reason"
               }
             }
           },
-          "description": "Updated reverseproxy"
+          "description": "Updated reason"
         },
         "responses": {
           "200": {
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/ReverseProxy"
+                  "$ref": "#/components/schemas/Reason"
                 }
               }
             },
-            "description": "Response reverseproxies updated just now"
+            "description": "Response reasons updated just now"
           }
         },
         "tags": [
-          "ReverseProxyV1alpha1"
+          "ReasonV1alpha1"
         ]
       }
     },
-    "/apis/plugin.halo.run/v1alpha1/searchengines": {
+    "/apis/notification.halo.run/v1alpha1/reasontypes": {
       "get": {
-        "description": "List SearchEngine",
-        "operationId": "listSearchEngine",
+        "description": "List ReasonType",
+        "operationId": "listReasonType",
         "parameters": [
           {
             "description": "Page number. Default is 0.",
@@ -5767,54 +5767,54 @@
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/SearchEngineList"
+                  "$ref": "#/components/schemas/ReasonTypeList"
                 }
               }
             },
-            "description": "Response searchengines"
+            "description": "Response reasontypes"
           }
         },
         "tags": [
-          "SearchEngineV1alpha1"
+          "ReasonTypeV1alpha1"
         ]
       },
       "post": {
-        "description": "Create SearchEngine",
-        "operationId": "createSearchEngine",
+        "description": "Create ReasonType",
+        "operationId": "createReasonType",
         "requestBody": {
           "content": {
             "*/*": {
               "schema": {
-                "$ref": "#/components/schemas/SearchEngine"
+                "$ref": "#/components/schemas/ReasonType"
               }
             }
           },
-          "description": "Fresh searchengine"
+          "description": "Fresh reasontype"
         },
         "responses": {
           "200": {
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/SearchEngine"
+                  "$ref": "#/components/schemas/ReasonType"
                 }
               }
             },
-            "description": "Response searchengines created just now"
+            "description": "Response reasontypes created just now"
           }
         },
         "tags": [
-          "SearchEngineV1alpha1"
+          "ReasonTypeV1alpha1"
         ]
       }
     },
-    "/apis/plugin.halo.run/v1alpha1/searchengines/{name}": {
+    "/apis/notification.halo.run/v1alpha1/reasontypes/{name}": {
       "delete": {
-        "description": "Delete SearchEngine",
-        "operationId": "deleteSearchEngine",
+        "description": "Delete ReasonType",
+        "operationId": "deleteReasonType",
         "parameters": [
           {
-            "description": "Name of searchengine",
+            "description": "Name of reasontype",
             "in": "path",
             "name": "name",
             "required": true,
@@ -5825,19 +5825,19 @@
         ],
         "responses": {
           "200": {
-            "description": "Response searchengine deleted just now"
+            "description": "Response reasontype deleted just now"
           }
         },
         "tags": [
-          "SearchEngineV1alpha1"
+          "ReasonTypeV1alpha1"
         ]
       },
       "get": {
-        "description": "Get SearchEngine",
-        "operationId": "getSearchEngine",
+        "description": "Get ReasonType",
+        "operationId": "getReasonType",
         "parameters": [
           {
-            "description": "Name of searchengine",
+            "description": "Name of reasontype",
             "in": "path",
             "name": "name",
             "required": true,
@@ -5851,23 +5851,23 @@
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/SearchEngine"
+                  "$ref": "#/components/schemas/ReasonType"
                 }
               }
             },
-            "description": "Response single searchengine"
+            "description": "Response single reasontype"
           }
         },
         "tags": [
-          "SearchEngineV1alpha1"
+          "ReasonTypeV1alpha1"
         ]
       },
       "patch": {
-        "description": "Patch SearchEngine",
-        "operationId": "patchSearchEngine",
+        "description": "Patch ReasonType",
+        "operationId": "patchReasonType",
         "parameters": [
           {
-            "description": "Name of searchengine",
+            "description": "Name of reasontype",
             "in": "path",
             "name": "name",
             "required": true,
@@ -5890,23 +5890,23 @@
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/SearchEngine"
+                  "$ref": "#/components/schemas/ReasonType"
                 }
               }
             },
-            "description": "Response searchengine patched just now"
+            "description": "Response reasontype patched just now"
           }
         },
         "tags": [
-          "SearchEngineV1alpha1"
+          "ReasonTypeV1alpha1"
         ]
       },
       "put": {
-        "description": "Update SearchEngine",
-        "operationId": "updateSearchEngine",
+        "description": "Update ReasonType",
+        "operationId": "updateReasonType",
         "parameters": [
           {
-            "description": "Name of searchengine",
+            "description": "Name of reasontype",
             "in": "path",
             "name": "name",
             "required": true,
@@ -5919,33 +5919,33 @@
           "content": {
             "*/*": {
               "schema": {
-                "$ref": "#/components/schemas/SearchEngine"
+                "$ref": "#/components/schemas/ReasonType"
               }
             }
           },
-          "description": "Updated searchengine"
+          "description": "Updated reasontype"
         },
         "responses": {
           "200": {
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/SearchEngine"
+                  "$ref": "#/components/schemas/ReasonType"
                 }
               }
             },
-            "description": "Response searchengines updated just now"
+            "description": "Response reasontypes updated just now"
           }
         },
         "tags": [
-          "SearchEngineV1alpha1"
+          "ReasonTypeV1alpha1"
         ]
       }
     },
-    "/apis/security.halo.run/v1alpha1/devices": {
+    "/apis/notification.halo.run/v1alpha1/subscriptions": {
       "get": {
-        "description": "List Device",
-        "operationId": "listDevice",
+        "description": "List Subscription",
+        "operationId": "listSubscription",
         "parameters": [
           {
             "description": "Page number. Default is 0.",
@@ -6004,54 +6004,54 @@
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/DeviceList"
+                  "$ref": "#/components/schemas/SubscriptionList"
                 }
               }
             },
-            "description": "Response devices"
+            "description": "Response subscriptions"
           }
         },
         "tags": [
-          "DeviceV1alpha1"
+          "SubscriptionV1alpha1"
         ]
       },
       "post": {
-        "description": "Create Device",
-        "operationId": "createDevice",
+        "description": "Create Subscription",
+        "operationId": "createSubscription",
         "requestBody": {
           "content": {
             "*/*": {
               "schema": {
-                "$ref": "#/components/schemas/Device"
+                "$ref": "#/components/schemas/Subscription"
               }
             }
           },
-          "description": "Fresh device"
+          "description": "Fresh subscription"
         },
         "responses": {
           "200": {
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/Device"
+                  "$ref": "#/components/schemas/Subscription"
                 }
               }
             },
-            "description": "Response devices created just now"
+            "description": "Response subscriptions created just now"
           }
         },
         "tags": [
-          "DeviceV1alpha1"
+          "SubscriptionV1alpha1"
         ]
       }
     },
-    "/apis/security.halo.run/v1alpha1/devices/{name}": {
+    "/apis/notification.halo.run/v1alpha1/subscriptions/{name}": {
       "delete": {
-        "description": "Delete Device",
-        "operationId": "deleteDevice",
+        "description": "Delete Subscription",
+        "operationId": "deleteSubscription",
         "parameters": [
           {
-            "description": "Name of device",
+            "description": "Name of subscription",
             "in": "path",
             "name": "name",
             "required": true,
@@ -6062,19 +6062,19 @@
         ],
         "responses": {
           "200": {
-            "description": "Response device deleted just now"
+            "description": "Response subscription deleted just now"
           }
         },
         "tags": [
-          "DeviceV1alpha1"
+          "SubscriptionV1alpha1"
         ]
       },
       "get": {
-        "description": "Get Device",
-        "operationId": "getDevice",
+        "description": "Get Subscription",
+        "operationId": "getSubscription",
         "parameters": [
           {
-            "description": "Name of device",
+            "description": "Name of subscription",
             "in": "path",
             "name": "name",
             "required": true,
@@ -6088,23 +6088,23 @@
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/Device"
+                  "$ref": "#/components/schemas/Subscription"
                 }
               }
             },
-            "description": "Response single device"
+            "description": "Response single subscription"
           }
         },
         "tags": [
-          "DeviceV1alpha1"
+          "SubscriptionV1alpha1"
         ]
       },
       "patch": {
-        "description": "Patch Device",
-        "operationId": "patchDevice",
+        "description": "Patch Subscription",
+        "operationId": "patchSubscription",
         "parameters": [
           {
-            "description": "Name of device",
+            "description": "Name of subscription",
             "in": "path",
             "name": "name",
             "required": true,
@@ -6127,23 +6127,23 @@
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/Device"
+                  "$ref": "#/components/schemas/Subscription"
                 }
               }
             },
-            "description": "Response device patched just now"
+            "description": "Response subscription patched just now"
           }
         },
         "tags": [
-          "DeviceV1alpha1"
+          "SubscriptionV1alpha1"
         ]
       },
       "put": {
-        "description": "Update Device",
-        "operationId": "updateDevice",
+        "description": "Update Subscription",
+        "operationId": "updateSubscription",
         "parameters": [
           {
-            "description": "Name of device",
+            "description": "Name of subscription",
             "in": "path",
             "name": "name",
             "required": true,
@@ -6156,33 +6156,33 @@
           "content": {
             "*/*": {
               "schema": {
-                "$ref": "#/components/schemas/Device"
+                "$ref": "#/components/schemas/Subscription"
               }
             }
           },
-          "description": "Updated device"
+          "description": "Updated subscription"
         },
         "responses": {
           "200": {
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/Device"
+                  "$ref": "#/components/schemas/Subscription"
                 }
               }
             },
-            "description": "Response devices updated just now"
+            "description": "Response subscriptions updated just now"
           }
         },
         "tags": [
-          "DeviceV1alpha1"
+          "SubscriptionV1alpha1"
         ]
       }
     },
-    "/apis/security.halo.run/v1alpha1/personalaccesstokens": {
+    "/apis/plugin.halo.run/v1alpha1/extensiondefinitions": {
       "get": {
-        "description": "List PersonalAccessToken",
-        "operationId": "listPersonalAccessToken",
+        "description": "List ExtensionDefinition",
+        "operationId": "listExtensionDefinition",
         "parameters": [
           {
             "description": "Page number. Default is 0.",
@@ -6241,54 +6241,54 @@
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/PersonalAccessTokenList"
+                  "$ref": "#/components/schemas/ExtensionDefinitionList"
                 }
               }
             },
-            "description": "Response personalaccesstokens"
+            "description": "Response extensiondefinitions"
           }
         },
         "tags": [
-          "PersonalAccessTokenV1alpha1"
+          "ExtensionDefinitionV1alpha1"
         ]
       },
       "post": {
-        "description": "Create PersonalAccessToken",
-        "operationId": "createPersonalAccessToken",
+        "description": "Create ExtensionDefinition",
+        "operationId": "createExtensionDefinition",
         "requestBody": {
           "content": {
             "*/*": {
               "schema": {
-                "$ref": "#/components/schemas/PersonalAccessToken"
+                "$ref": "#/components/schemas/ExtensionDefinition"
               }
             }
           },
-          "description": "Fresh personalaccesstoken"
+          "description": "Fresh extensiondefinition"
         },
         "responses": {
           "200": {
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/PersonalAccessToken"
+                  "$ref": "#/components/schemas/ExtensionDefinition"
                 }
               }
             },
-            "description": "Response personalaccesstokens created just now"
+            "description": "Response extensiondefinitions created just now"
           }
         },
         "tags": [
-          "PersonalAccessTokenV1alpha1"
+          "ExtensionDefinitionV1alpha1"
         ]
       }
     },
-    "/apis/security.halo.run/v1alpha1/personalaccesstokens/{name}": {
+    "/apis/plugin.halo.run/v1alpha1/extensiondefinitions/{name}": {
       "delete": {
-        "description": "Delete PersonalAccessToken",
-        "operationId": "deletePersonalAccessToken",
+        "description": "Delete ExtensionDefinition",
+        "operationId": "deleteExtensionDefinition",
         "parameters": [
           {
-            "description": "Name of personalaccesstoken",
+            "description": "Name of extensiondefinition",
             "in": "path",
             "name": "name",
             "required": true,
@@ -6299,19 +6299,19 @@
         ],
         "responses": {
           "200": {
-            "description": "Response personalaccesstoken deleted just now"
+            "description": "Response extensiondefinition deleted just now"
           }
         },
         "tags": [
-          "PersonalAccessTokenV1alpha1"
+          "ExtensionDefinitionV1alpha1"
         ]
       },
       "get": {
-        "description": "Get PersonalAccessToken",
-        "operationId": "getPersonalAccessToken",
+        "description": "Get ExtensionDefinition",
+        "operationId": "getExtensionDefinition",
         "parameters": [
           {
-            "description": "Name of personalaccesstoken",
+            "description": "Name of extensiondefinition",
             "in": "path",
             "name": "name",
             "required": true,
@@ -6325,23 +6325,23 @@
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/PersonalAccessToken"
+                  "$ref": "#/components/schemas/ExtensionDefinition"
                 }
               }
             },
-            "description": "Response single personalaccesstoken"
+            "description": "Response single extensiondefinition"
           }
         },
         "tags": [
-          "PersonalAccessTokenV1alpha1"
+          "ExtensionDefinitionV1alpha1"
         ]
       },
       "patch": {
-        "description": "Patch PersonalAccessToken",
-        "operationId": "patchPersonalAccessToken",
+        "description": "Patch ExtensionDefinition",
+        "operationId": "patchExtensionDefinition",
         "parameters": [
           {
-            "description": "Name of personalaccesstoken",
+            "description": "Name of extensiondefinition",
             "in": "path",
             "name": "name",
             "required": true,
@@ -6364,23 +6364,23 @@
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/PersonalAccessToken"
+                  "$ref": "#/components/schemas/ExtensionDefinition"
                 }
               }
             },
-            "description": "Response personalaccesstoken patched just now"
+            "description": "Response extensiondefinition patched just now"
           }
         },
         "tags": [
-          "PersonalAccessTokenV1alpha1"
+          "ExtensionDefinitionV1alpha1"
         ]
       },
       "put": {
-        "description": "Update PersonalAccessToken",
-        "operationId": "updatePersonalAccessToken",
+        "description": "Update ExtensionDefinition",
+        "operationId": "updateExtensionDefinition",
         "parameters": [
           {
-            "description": "Name of personalaccesstoken",
+            "description": "Name of extensiondefinition",
             "in": "path",
             "name": "name",
             "required": true,
@@ -6393,33 +6393,33 @@
           "content": {
             "*/*": {
               "schema": {
-                "$ref": "#/components/schemas/PersonalAccessToken"
+                "$ref": "#/components/schemas/ExtensionDefinition"
               }
             }
           },
-          "description": "Updated personalaccesstoken"
+          "description": "Updated extensiondefinition"
         },
         "responses": {
           "200": {
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/PersonalAccessToken"
+                  "$ref": "#/components/schemas/ExtensionDefinition"
                 }
               }
             },
-            "description": "Response personalaccesstokens updated just now"
+            "description": "Response extensiondefinitions updated just now"
           }
         },
         "tags": [
-          "PersonalAccessTokenV1alpha1"
+          "ExtensionDefinitionV1alpha1"
         ]
       }
     },
-    "/apis/security.halo.run/v1alpha1/remembermetokens": {
+    "/apis/plugin.halo.run/v1alpha1/extensionpointdefinitions": {
       "get": {
-        "description": "List RememberMeToken",
-        "operationId": "listRememberMeToken",
+        "description": "List ExtensionPointDefinition",
+        "operationId": "listExtensionPointDefinition",
         "parameters": [
           {
             "description": "Page number. Default is 0.",
@@ -6478,54 +6478,54 @@
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/RememberMeTokenList"
+                  "$ref": "#/components/schemas/ExtensionPointDefinitionList"
                 }
               }
             },
-            "description": "Response remembermetokens"
+            "description": "Response extensionpointdefinitions"
           }
         },
         "tags": [
-          "RememberMeTokenV1alpha1"
+          "ExtensionPointDefinitionV1alpha1"
         ]
       },
       "post": {
-        "description": "Create RememberMeToken",
-        "operationId": "createRememberMeToken",
+        "description": "Create ExtensionPointDefinition",
+        "operationId": "createExtensionPointDefinition",
         "requestBody": {
           "content": {
             "*/*": {
               "schema": {
-                "$ref": "#/components/schemas/RememberMeToken"
+                "$ref": "#/components/schemas/ExtensionPointDefinition"
               }
             }
           },
-          "description": "Fresh remembermetoken"
+          "description": "Fresh extensionpointdefinition"
         },
         "responses": {
           "200": {
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/RememberMeToken"
+                  "$ref": "#/components/schemas/ExtensionPointDefinition"
                 }
               }
             },
-            "description": "Response remembermetokens created just now"
+            "description": "Response extensionpointdefinitions created just now"
           }
         },
         "tags": [
-          "RememberMeTokenV1alpha1"
+          "ExtensionPointDefinitionV1alpha1"
         ]
       }
     },
-    "/apis/security.halo.run/v1alpha1/remembermetokens/{name}": {
+    "/apis/plugin.halo.run/v1alpha1/extensionpointdefinitions/{name}": {
       "delete": {
-        "description": "Delete RememberMeToken",
-        "operationId": "deleteRememberMeToken",
+        "description": "Delete ExtensionPointDefinition",
+        "operationId": "deleteExtensionPointDefinition",
         "parameters": [
           {
-            "description": "Name of remembermetoken",
+            "description": "Name of extensionpointdefinition",
             "in": "path",
             "name": "name",
             "required": true,
@@ -6536,19 +6536,19 @@
         ],
         "responses": {
           "200": {
-            "description": "Response remembermetoken deleted just now"
+            "description": "Response extensionpointdefinition deleted just now"
           }
         },
         "tags": [
-          "RememberMeTokenV1alpha1"
+          "ExtensionPointDefinitionV1alpha1"
         ]
       },
       "get": {
-        "description": "Get RememberMeToken",
-        "operationId": "getRememberMeToken",
+        "description": "Get ExtensionPointDefinition",
+        "operationId": "getExtensionPointDefinition",
         "parameters": [
           {
-            "description": "Name of remembermetoken",
+            "description": "Name of extensionpointdefinition",
             "in": "path",
             "name": "name",
             "required": true,
@@ -6562,23 +6562,23 @@
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/RememberMeToken"
+                  "$ref": "#/components/schemas/ExtensionPointDefinition"
                 }
               }
             },
-            "description": "Response single remembermetoken"
+            "description": "Response single extensionpointdefinition"
           }
         },
         "tags": [
-          "RememberMeTokenV1alpha1"
+          "ExtensionPointDefinitionV1alpha1"
         ]
       },
       "patch": {
-        "description": "Patch RememberMeToken",
-        "operationId": "patchRememberMeToken",
+        "description": "Patch ExtensionPointDefinition",
+        "operationId": "patchExtensionPointDefinition",
         "parameters": [
           {
-            "description": "Name of remembermetoken",
+            "description": "Name of extensionpointdefinition",
             "in": "path",
             "name": "name",
             "required": true,
@@ -6601,23 +6601,23 @@
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/RememberMeToken"
+                  "$ref": "#/components/schemas/ExtensionPointDefinition"
                 }
               }
             },
-            "description": "Response remembermetoken patched just now"
+            "description": "Response extensionpointdefinition patched just now"
           }
         },
         "tags": [
-          "RememberMeTokenV1alpha1"
+          "ExtensionPointDefinitionV1alpha1"
         ]
       },
       "put": {
-        "description": "Update RememberMeToken",
-        "operationId": "updateRememberMeToken",
+        "description": "Update ExtensionPointDefinition",
+        "operationId": "updateExtensionPointDefinition",
         "parameters": [
           {
-            "description": "Name of remembermetoken",
+            "description": "Name of extensionpointdefinition",
             "in": "path",
             "name": "name",
             "required": true,
@@ -6630,33 +6630,33 @@
           "content": {
             "*/*": {
               "schema": {
-                "$ref": "#/components/schemas/RememberMeToken"
+                "$ref": "#/components/schemas/ExtensionPointDefinition"
               }
             }
           },
-          "description": "Updated remembermetoken"
+          "description": "Updated extensionpointdefinition"
         },
         "responses": {
           "200": {
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/RememberMeToken"
+                  "$ref": "#/components/schemas/ExtensionPointDefinition"
                 }
               }
             },
-            "description": "Response remembermetokens updated just now"
+            "description": "Response extensionpointdefinitions updated just now"
           }
         },
         "tags": [
-          "RememberMeTokenV1alpha1"
+          "ExtensionPointDefinitionV1alpha1"
         ]
       }
     },
-    "/apis/storage.halo.run/v1alpha1/attachments": {
+    "/apis/plugin.halo.run/v1alpha1/plugins": {
       "get": {
-        "description": "List Attachment",
-        "operationId": "listAttachment",
+        "description": "List Plugin",
+        "operationId": "listPlugin",
         "parameters": [
           {
             "description": "Page number. Default is 0.",
@@ -6715,54 +6715,54 @@
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/AttachmentList"
+                  "$ref": "#/components/schemas/PluginList"
                 }
               }
             },
-            "description": "Response attachments"
+            "description": "Response plugins"
           }
         },
         "tags": [
-          "AttachmentV1alpha1"
+          "PluginV1alpha1"
         ]
       },
       "post": {
-        "description": "Create Attachment",
-        "operationId": "createAttachment",
+        "description": "Create Plugin",
+        "operationId": "createPlugin",
         "requestBody": {
           "content": {
             "*/*": {
               "schema": {
-                "$ref": "#/components/schemas/Attachment"
+                "$ref": "#/components/schemas/Plugin"
               }
             }
           },
-          "description": "Fresh attachment"
+          "description": "Fresh plugin"
         },
         "responses": {
           "200": {
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/Attachment"
+                  "$ref": "#/components/schemas/Plugin"
                 }
               }
             },
-            "description": "Response attachments created just now"
+            "description": "Response plugins created just now"
           }
         },
         "tags": [
-          "AttachmentV1alpha1"
+          "PluginV1alpha1"
         ]
       }
     },
-    "/apis/storage.halo.run/v1alpha1/attachments/{name}": {
+    "/apis/plugin.halo.run/v1alpha1/plugins/{name}": {
       "delete": {
-        "description": "Delete Attachment",
-        "operationId": "deleteAttachment",
+        "description": "Delete Plugin",
+        "operationId": "deletePlugin",
         "parameters": [
           {
-            "description": "Name of attachment",
+            "description": "Name of plugin",
             "in": "path",
             "name": "name",
             "required": true,
@@ -6773,19 +6773,19 @@
         ],
         "responses": {
           "200": {
-            "description": "Response attachment deleted just now"
+            "description": "Response plugin deleted just now"
           }
         },
         "tags": [
-          "AttachmentV1alpha1"
+          "PluginV1alpha1"
         ]
       },
       "get": {
-        "description": "Get Attachment",
-        "operationId": "getAttachment",
+        "description": "Get Plugin",
+        "operationId": "getPlugin",
         "parameters": [
           {
-            "description": "Name of attachment",
+            "description": "Name of plugin",
             "in": "path",
             "name": "name",
             "required": true,
@@ -6799,23 +6799,23 @@
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/Attachment"
+                  "$ref": "#/components/schemas/Plugin"
                 }
               }
             },
-            "description": "Response single attachment"
+            "description": "Response single plugin"
           }
         },
         "tags": [
-          "AttachmentV1alpha1"
+          "PluginV1alpha1"
         ]
       },
       "patch": {
-        "description": "Patch Attachment",
-        "operationId": "patchAttachment",
+        "description": "Patch Plugin",
+        "operationId": "patchPlugin",
         "parameters": [
           {
-            "description": "Name of attachment",
+            "description": "Name of plugin",
             "in": "path",
             "name": "name",
             "required": true,
@@ -6838,23 +6838,23 @@
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/Attachment"
+                  "$ref": "#/components/schemas/Plugin"
                 }
               }
             },
-            "description": "Response attachment patched just now"
+            "description": "Response plugin patched just now"
           }
         },
         "tags": [
-          "AttachmentV1alpha1"
+          "PluginV1alpha1"
         ]
       },
       "put": {
-        "description": "Update Attachment",
-        "operationId": "updateAttachment",
+        "description": "Update Plugin",
+        "operationId": "updatePlugin",
         "parameters": [
           {
-            "description": "Name of attachment",
+            "description": "Name of plugin",
             "in": "path",
             "name": "name",
             "required": true,
@@ -6867,33 +6867,33 @@
           "content": {
             "*/*": {
               "schema": {
-                "$ref": "#/components/schemas/Attachment"
+                "$ref": "#/components/schemas/Plugin"
               }
             }
           },
-          "description": "Updated attachment"
+          "description": "Updated plugin"
         },
         "responses": {
           "200": {
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/Attachment"
+                  "$ref": "#/components/schemas/Plugin"
                 }
               }
             },
-            "description": "Response attachments updated just now"
+            "description": "Response plugins updated just now"
           }
         },
         "tags": [
-          "AttachmentV1alpha1"
+          "PluginV1alpha1"
         ]
       }
     },
-    "/apis/storage.halo.run/v1alpha1/groups": {
+    "/apis/plugin.halo.run/v1alpha1/reverseproxies": {
       "get": {
-        "description": "List Group",
-        "operationId": "listGroup",
+        "description": "List ReverseProxy",
+        "operationId": "listReverseProxy",
         "parameters": [
           {
             "description": "Page number. Default is 0.",
@@ -6952,54 +6952,54 @@
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/GroupList"
+                  "$ref": "#/components/schemas/ReverseProxyList"
                 }
               }
             },
-            "description": "Response groups"
+            "description": "Response reverseproxies"
           }
         },
         "tags": [
-          "GroupV1alpha1"
+          "ReverseProxyV1alpha1"
         ]
       },
       "post": {
-        "description": "Create Group",
-        "operationId": "createGroup",
+        "description": "Create ReverseProxy",
+        "operationId": "createReverseProxy",
         "requestBody": {
           "content": {
             "*/*": {
               "schema": {
-                "$ref": "#/components/schemas/Group"
+                "$ref": "#/components/schemas/ReverseProxy"
               }
             }
           },
-          "description": "Fresh group"
+          "description": "Fresh reverseproxy"
         },
         "responses": {
           "200": {
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/Group"
+                  "$ref": "#/components/schemas/ReverseProxy"
                 }
               }
             },
-            "description": "Response groups created just now"
+            "description": "Response reverseproxies created just now"
           }
         },
         "tags": [
-          "GroupV1alpha1"
+          "ReverseProxyV1alpha1"
         ]
       }
     },
-    "/apis/storage.halo.run/v1alpha1/groups/{name}": {
+    "/apis/plugin.halo.run/v1alpha1/reverseproxies/{name}": {
       "delete": {
-        "description": "Delete Group",
-        "operationId": "deleteGroup",
+        "description": "Delete ReverseProxy",
+        "operationId": "deleteReverseProxy",
         "parameters": [
           {
-            "description": "Name of group",
+            "description": "Name of reverseproxy",
             "in": "path",
             "name": "name",
             "required": true,
@@ -7010,19 +7010,19 @@
         ],
         "responses": {
           "200": {
-            "description": "Response group deleted just now"
+            "description": "Response reverseproxy deleted just now"
           }
         },
         "tags": [
-          "GroupV1alpha1"
+          "ReverseProxyV1alpha1"
         ]
       },
       "get": {
-        "description": "Get Group",
-        "operationId": "getGroup",
+        "description": "Get ReverseProxy",
+        "operationId": "getReverseProxy",
         "parameters": [
           {
-            "description": "Name of group",
+            "description": "Name of reverseproxy",
             "in": "path",
             "name": "name",
             "required": true,
@@ -7036,23 +7036,23 @@
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/Group"
+                  "$ref": "#/components/schemas/ReverseProxy"
                 }
               }
             },
-            "description": "Response single group"
+            "description": "Response single reverseproxy"
           }
         },
         "tags": [
-          "GroupV1alpha1"
+          "ReverseProxyV1alpha1"
         ]
       },
       "patch": {
-        "description": "Patch Group",
-        "operationId": "patchGroup",
+        "description": "Patch ReverseProxy",
+        "operationId": "patchReverseProxy",
         "parameters": [
           {
-            "description": "Name of group",
+            "description": "Name of reverseproxy",
             "in": "path",
             "name": "name",
             "required": true,
@@ -7075,23 +7075,23 @@
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/Group"
+                  "$ref": "#/components/schemas/ReverseProxy"
                 }
               }
             },
-            "description": "Response group patched just now"
+            "description": "Response reverseproxy patched just now"
           }
         },
         "tags": [
-          "GroupV1alpha1"
+          "ReverseProxyV1alpha1"
         ]
       },
       "put": {
-        "description": "Update Group",
-        "operationId": "updateGroup",
+        "description": "Update ReverseProxy",
+        "operationId": "updateReverseProxy",
         "parameters": [
           {
-            "description": "Name of group",
+            "description": "Name of reverseproxy",
             "in": "path",
             "name": "name",
             "required": true,
@@ -7104,33 +7104,33 @@
           "content": {
             "*/*": {
               "schema": {
-                "$ref": "#/components/schemas/Group"
+                "$ref": "#/components/schemas/ReverseProxy"
               }
             }
           },
-          "description": "Updated group"
+          "description": "Updated reverseproxy"
         },
         "responses": {
           "200": {
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/Group"
+                  "$ref": "#/components/schemas/ReverseProxy"
                 }
               }
             },
-            "description": "Response groups updated just now"
+            "description": "Response reverseproxies updated just now"
           }
         },
         "tags": [
-          "GroupV1alpha1"
+          "ReverseProxyV1alpha1"
         ]
       }
     },
-    "/apis/storage.halo.run/v1alpha1/localthumbnails": {
+    "/apis/plugin.halo.run/v1alpha1/searchengines": {
       "get": {
-        "description": "List LocalThumbnail",
-        "operationId": "listLocalThumbnail",
+        "description": "List SearchEngine",
+        "operationId": "listSearchEngine",
         "parameters": [
           {
             "description": "Page number. Default is 0.",
@@ -7189,54 +7189,54 @@
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/LocalThumbnailList"
+                  "$ref": "#/components/schemas/SearchEngineList"
                 }
               }
             },
-            "description": "Response localthumbnails"
+            "description": "Response searchengines"
           }
         },
         "tags": [
-          "LocalThumbnailV1alpha1"
+          "SearchEngineV1alpha1"
         ]
       },
       "post": {
-        "description": "Create LocalThumbnail",
-        "operationId": "createLocalThumbnail",
+        "description": "Create SearchEngine",
+        "operationId": "createSearchEngine",
         "requestBody": {
           "content": {
             "*/*": {
               "schema": {
-                "$ref": "#/components/schemas/LocalThumbnail"
+                "$ref": "#/components/schemas/SearchEngine"
               }
             }
           },
-          "description": "Fresh localthumbnail"
+          "description": "Fresh searchengine"
         },
         "responses": {
           "200": {
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/LocalThumbnail"
+                  "$ref": "#/components/schemas/SearchEngine"
                 }
               }
             },
-            "description": "Response localthumbnails created just now"
+            "description": "Response searchengines created just now"
           }
         },
         "tags": [
-          "LocalThumbnailV1alpha1"
+          "SearchEngineV1alpha1"
         ]
       }
     },
-    "/apis/storage.halo.run/v1alpha1/localthumbnails/{name}": {
+    "/apis/plugin.halo.run/v1alpha1/searchengines/{name}": {
       "delete": {
-        "description": "Delete LocalThumbnail",
-        "operationId": "deleteLocalThumbnail",
+        "description": "Delete SearchEngine",
+        "operationId": "deleteSearchEngine",
         "parameters": [
           {
-            "description": "Name of localthumbnail",
+            "description": "Name of searchengine",
             "in": "path",
             "name": "name",
             "required": true,
@@ -7247,19 +7247,19 @@
         ],
         "responses": {
           "200": {
-            "description": "Response localthumbnail deleted just now"
+            "description": "Response searchengine deleted just now"
           }
         },
         "tags": [
-          "LocalThumbnailV1alpha1"
+          "SearchEngineV1alpha1"
         ]
       },
       "get": {
-        "description": "Get LocalThumbnail",
-        "operationId": "getLocalThumbnail",
+        "description": "Get SearchEngine",
+        "operationId": "getSearchEngine",
         "parameters": [
           {
-            "description": "Name of localthumbnail",
+            "description": "Name of searchengine",
             "in": "path",
             "name": "name",
             "required": true,
@@ -7273,23 +7273,23 @@
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/LocalThumbnail"
+                  "$ref": "#/components/schemas/SearchEngine"
                 }
               }
             },
-            "description": "Response single localthumbnail"
+            "description": "Response single searchengine"
           }
         },
         "tags": [
-          "LocalThumbnailV1alpha1"
+          "SearchEngineV1alpha1"
         ]
       },
       "patch": {
-        "description": "Patch LocalThumbnail",
-        "operationId": "patchLocalThumbnail",
+        "description": "Patch SearchEngine",
+        "operationId": "patchSearchEngine",
         "parameters": [
           {
-            "description": "Name of localthumbnail",
+            "description": "Name of searchengine",
             "in": "path",
             "name": "name",
             "required": true,
@@ -7312,23 +7312,23 @@
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/LocalThumbnail"
+                  "$ref": "#/components/schemas/SearchEngine"
                 }
               }
             },
-            "description": "Response localthumbnail patched just now"
+            "description": "Response searchengine patched just now"
           }
         },
         "tags": [
-          "LocalThumbnailV1alpha1"
+          "SearchEngineV1alpha1"
         ]
       },
       "put": {
-        "description": "Update LocalThumbnail",
-        "operationId": "updateLocalThumbnail",
+        "description": "Update SearchEngine",
+        "operationId": "updateSearchEngine",
         "parameters": [
           {
-            "description": "Name of localthumbnail",
+            "description": "Name of searchengine",
             "in": "path",
             "name": "name",
             "required": true,
@@ -7341,33 +7341,33 @@
           "content": {
             "*/*": {
               "schema": {
-                "$ref": "#/components/schemas/LocalThumbnail"
+                "$ref": "#/components/schemas/SearchEngine"
               }
             }
           },
-          "description": "Updated localthumbnail"
+          "description": "Updated searchengine"
         },
         "responses": {
           "200": {
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/LocalThumbnail"
+                  "$ref": "#/components/schemas/SearchEngine"
                 }
               }
             },
-            "description": "Response localthumbnails updated just now"
+            "description": "Response searchengines updated just now"
           }
         },
         "tags": [
-          "LocalThumbnailV1alpha1"
+          "SearchEngineV1alpha1"
         ]
       }
     },
-    "/apis/storage.halo.run/v1alpha1/policies": {
+    "/apis/security.halo.run/v1alpha1/devices": {
       "get": {
-        "description": "List Policy",
-        "operationId": "listPolicy",
+        "description": "List Device",
+        "operationId": "listDevice",
         "parameters": [
           {
             "description": "Page number. Default is 0.",
@@ -7426,54 +7426,54 @@
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/PolicyList"
+                  "$ref": "#/components/schemas/DeviceList"
                 }
               }
             },
-            "description": "Response policies"
+            "description": "Response devices"
           }
         },
         "tags": [
-          "PolicyV1alpha1"
+          "DeviceV1alpha1"
         ]
       },
       "post": {
-        "description": "Create Policy",
-        "operationId": "createPolicy",
+        "description": "Create Device",
+        "operationId": "createDevice",
         "requestBody": {
           "content": {
             "*/*": {
               "schema": {
-                "$ref": "#/components/schemas/Policy"
+                "$ref": "#/components/schemas/Device"
               }
             }
           },
-          "description": "Fresh policy"
+          "description": "Fresh device"
         },
         "responses": {
           "200": {
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/Policy"
+                  "$ref": "#/components/schemas/Device"
                 }
               }
             },
-            "description": "Response policies created just now"
+            "description": "Response devices created just now"
           }
         },
         "tags": [
-          "PolicyV1alpha1"
+          "DeviceV1alpha1"
         ]
       }
     },
-    "/apis/storage.halo.run/v1alpha1/policies/{name}": {
+    "/apis/security.halo.run/v1alpha1/devices/{name}": {
       "delete": {
-        "description": "Delete Policy",
-        "operationId": "deletePolicy",
+        "description": "Delete Device",
+        "operationId": "deleteDevice",
         "parameters": [
           {
-            "description": "Name of policy",
+            "description": "Name of device",
             "in": "path",
             "name": "name",
             "required": true,
@@ -7484,19 +7484,19 @@
         ],
         "responses": {
           "200": {
-            "description": "Response policy deleted just now"
+            "description": "Response device deleted just now"
           }
         },
         "tags": [
-          "PolicyV1alpha1"
+          "DeviceV1alpha1"
         ]
       },
       "get": {
-        "description": "Get Policy",
-        "operationId": "getPolicy",
+        "description": "Get Device",
+        "operationId": "getDevice",
         "parameters": [
           {
-            "description": "Name of policy",
+            "description": "Name of device",
             "in": "path",
             "name": "name",
             "required": true,
@@ -7510,23 +7510,23 @@
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/Policy"
+                  "$ref": "#/components/schemas/Device"
                 }
               }
             },
-            "description": "Response single policy"
+            "description": "Response single device"
           }
         },
         "tags": [
-          "PolicyV1alpha1"
+          "DeviceV1alpha1"
         ]
       },
       "patch": {
-        "description": "Patch Policy",
-        "operationId": "patchPolicy",
+        "description": "Patch Device",
+        "operationId": "patchDevice",
         "parameters": [
           {
-            "description": "Name of policy",
+            "description": "Name of device",
             "in": "path",
             "name": "name",
             "required": true,
@@ -7549,23 +7549,23 @@
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/Policy"
+                  "$ref": "#/components/schemas/Device"
                 }
               }
             },
-            "description": "Response policy patched just now"
+            "description": "Response device patched just now"
           }
         },
         "tags": [
-          "PolicyV1alpha1"
+          "DeviceV1alpha1"
         ]
       },
       "put": {
-        "description": "Update Policy",
-        "operationId": "updatePolicy",
+        "description": "Update Device",
+        "operationId": "updateDevice",
         "parameters": [
           {
-            "description": "Name of policy",
+            "description": "Name of device",
             "in": "path",
             "name": "name",
             "required": true,
@@ -7578,33 +7578,33 @@
           "content": {
             "*/*": {
               "schema": {
-                "$ref": "#/components/schemas/Policy"
+                "$ref": "#/components/schemas/Device"
               }
             }
           },
-          "description": "Updated policy"
+          "description": "Updated device"
         },
         "responses": {
           "200": {
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/Policy"
+                  "$ref": "#/components/schemas/Device"
                 }
               }
             },
-            "description": "Response policies updated just now"
+            "description": "Response devices updated just now"
           }
         },
         "tags": [
-          "PolicyV1alpha1"
+          "DeviceV1alpha1"
         ]
       }
     },
-    "/apis/storage.halo.run/v1alpha1/policytemplates": {
+    "/apis/security.halo.run/v1alpha1/personalaccesstokens": {
       "get": {
-        "description": "List PolicyTemplate",
-        "operationId": "listPolicyTemplate",
+        "description": "List PersonalAccessToken",
+        "operationId": "listPersonalAccessToken",
         "parameters": [
           {
             "description": "Page number. Default is 0.",
@@ -7663,54 +7663,54 @@
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/PolicyTemplateList"
+                  "$ref": "#/components/schemas/PersonalAccessTokenList"
                 }
               }
             },
-            "description": "Response policytemplates"
+            "description": "Response personalaccesstokens"
           }
         },
         "tags": [
-          "PolicyTemplateV1alpha1"
+          "PersonalAccessTokenV1alpha1"
         ]
       },
       "post": {
-        "description": "Create PolicyTemplate",
-        "operationId": "createPolicyTemplate",
+        "description": "Create PersonalAccessToken",
+        "operationId": "createPersonalAccessToken",
         "requestBody": {
           "content": {
             "*/*": {
               "schema": {
-                "$ref": "#/components/schemas/PolicyTemplate"
+                "$ref": "#/components/schemas/PersonalAccessToken"
               }
             }
           },
-          "description": "Fresh policytemplate"
+          "description": "Fresh personalaccesstoken"
         },
         "responses": {
           "200": {
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/PolicyTemplate"
+                  "$ref": "#/components/schemas/PersonalAccessToken"
                 }
               }
             },
-            "description": "Response policytemplates created just now"
+            "description": "Response personalaccesstokens created just now"
           }
         },
         "tags": [
-          "PolicyTemplateV1alpha1"
+          "PersonalAccessTokenV1alpha1"
         ]
       }
     },
-    "/apis/storage.halo.run/v1alpha1/policytemplates/{name}": {
+    "/apis/security.halo.run/v1alpha1/personalaccesstokens/{name}": {
       "delete": {
-        "description": "Delete PolicyTemplate",
-        "operationId": "deletePolicyTemplate",
+        "description": "Delete PersonalAccessToken",
+        "operationId": "deletePersonalAccessToken",
         "parameters": [
           {
-            "description": "Name of policytemplate",
+            "description": "Name of personalaccesstoken",
             "in": "path",
             "name": "name",
             "required": true,
@@ -7721,19 +7721,19 @@
         ],
         "responses": {
           "200": {
-            "description": "Response policytemplate deleted just now"
+            "description": "Response personalaccesstoken deleted just now"
           }
         },
         "tags": [
-          "PolicyTemplateV1alpha1"
+          "PersonalAccessTokenV1alpha1"
         ]
       },
       "get": {
-        "description": "Get PolicyTemplate",
-        "operationId": "getPolicyTemplate",
+        "description": "Get PersonalAccessToken",
+        "operationId": "getPersonalAccessToken",
         "parameters": [
           {
-            "description": "Name of policytemplate",
+            "description": "Name of personalaccesstoken",
             "in": "path",
             "name": "name",
             "required": true,
@@ -7747,23 +7747,23 @@
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/PolicyTemplate"
+                  "$ref": "#/components/schemas/PersonalAccessToken"
                 }
               }
             },
-            "description": "Response single policytemplate"
+            "description": "Response single personalaccesstoken"
           }
         },
         "tags": [
-          "PolicyTemplateV1alpha1"
+          "PersonalAccessTokenV1alpha1"
         ]
       },
       "patch": {
-        "description": "Patch PolicyTemplate",
-        "operationId": "patchPolicyTemplate",
+        "description": "Patch PersonalAccessToken",
+        "operationId": "patchPersonalAccessToken",
         "parameters": [
           {
-            "description": "Name of policytemplate",
+            "description": "Name of personalaccesstoken",
             "in": "path",
             "name": "name",
             "required": true,
@@ -7786,23 +7786,23 @@
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/PolicyTemplate"
+                  "$ref": "#/components/schemas/PersonalAccessToken"
                 }
               }
             },
-            "description": "Response policytemplate patched just now"
+            "description": "Response personalaccesstoken patched just now"
           }
         },
         "tags": [
-          "PolicyTemplateV1alpha1"
+          "PersonalAccessTokenV1alpha1"
         ]
       },
       "put": {
-        "description": "Update PolicyTemplate",
-        "operationId": "updatePolicyTemplate",
+        "description": "Update PersonalAccessToken",
+        "operationId": "updatePersonalAccessToken",
         "parameters": [
           {
-            "description": "Name of policytemplate",
+            "description": "Name of personalaccesstoken",
             "in": "path",
             "name": "name",
             "required": true,
@@ -7815,33 +7815,33 @@
           "content": {
             "*/*": {
               "schema": {
-                "$ref": "#/components/schemas/PolicyTemplate"
+                "$ref": "#/components/schemas/PersonalAccessToken"
               }
             }
           },
-          "description": "Updated policytemplate"
+          "description": "Updated personalaccesstoken"
         },
         "responses": {
           "200": {
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/PolicyTemplate"
+                  "$ref": "#/components/schemas/PersonalAccessToken"
                 }
               }
             },
-            "description": "Response policytemplates updated just now"
+            "description": "Response personalaccesstokens updated just now"
           }
         },
         "tags": [
-          "PolicyTemplateV1alpha1"
+          "PersonalAccessTokenV1alpha1"
         ]
       }
     },
-    "/apis/storage.halo.run/v1alpha1/thumbnails": {
+    "/apis/security.halo.run/v1alpha1/remembermetokens": {
       "get": {
-        "description": "List Thumbnail",
-        "operationId": "listThumbnail",
+        "description": "List RememberMeToken",
+        "operationId": "listRememberMeToken",
         "parameters": [
           {
             "description": "Page number. Default is 0.",
@@ -7900,54 +7900,54 @@
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/ThumbnailList"
+                  "$ref": "#/components/schemas/RememberMeTokenList"
                 }
               }
             },
-            "description": "Response thumbnails"
+            "description": "Response remembermetokens"
           }
         },
         "tags": [
-          "ThumbnailV1alpha1"
+          "RememberMeTokenV1alpha1"
         ]
       },
       "post": {
-        "description": "Create Thumbnail",
-        "operationId": "createThumbnail",
+        "description": "Create RememberMeToken",
+        "operationId": "createRememberMeToken",
         "requestBody": {
           "content": {
             "*/*": {
               "schema": {
-                "$ref": "#/components/schemas/Thumbnail"
+                "$ref": "#/components/schemas/RememberMeToken"
               }
             }
           },
-          "description": "Fresh thumbnail"
+          "description": "Fresh remembermetoken"
         },
         "responses": {
           "200": {
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/Thumbnail"
+                  "$ref": "#/components/schemas/RememberMeToken"
                 }
               }
             },
-            "description": "Response thumbnails created just now"
+            "description": "Response remembermetokens created just now"
           }
         },
         "tags": [
-          "ThumbnailV1alpha1"
+          "RememberMeTokenV1alpha1"
         ]
       }
     },
-    "/apis/storage.halo.run/v1alpha1/thumbnails/{name}": {
+    "/apis/security.halo.run/v1alpha1/remembermetokens/{name}": {
       "delete": {
-        "description": "Delete Thumbnail",
-        "operationId": "deleteThumbnail",
+        "description": "Delete RememberMeToken",
+        "operationId": "deleteRememberMeToken",
         "parameters": [
           {
-            "description": "Name of thumbnail",
+            "description": "Name of remembermetoken",
             "in": "path",
             "name": "name",
             "required": true,
@@ -7958,19 +7958,19 @@
         ],
         "responses": {
           "200": {
-            "description": "Response thumbnail deleted just now"
+            "description": "Response remembermetoken deleted just now"
           }
         },
         "tags": [
-          "ThumbnailV1alpha1"
+          "RememberMeTokenV1alpha1"
         ]
       },
       "get": {
-        "description": "Get Thumbnail",
-        "operationId": "getThumbnail",
+        "description": "Get RememberMeToken",
+        "operationId": "getRememberMeToken",
         "parameters": [
           {
-            "description": "Name of thumbnail",
+            "description": "Name of remembermetoken",
             "in": "path",
             "name": "name",
             "required": true,
@@ -7984,23 +7984,23 @@
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/Thumbnail"
+                  "$ref": "#/components/schemas/RememberMeToken"
                 }
               }
             },
-            "description": "Response single thumbnail"
+            "description": "Response single remembermetoken"
           }
         },
         "tags": [
-          "ThumbnailV1alpha1"
+          "RememberMeTokenV1alpha1"
         ]
       },
       "patch": {
-        "description": "Patch Thumbnail",
-        "operationId": "patchThumbnail",
+        "description": "Patch RememberMeToken",
+        "operationId": "patchRememberMeToken",
         "parameters": [
           {
-            "description": "Name of thumbnail",
+            "description": "Name of remembermetoken",
             "in": "path",
             "name": "name",
             "required": true,
@@ -8023,23 +8023,23 @@
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/Thumbnail"
+                  "$ref": "#/components/schemas/RememberMeToken"
                 }
               }
             },
-            "description": "Response thumbnail patched just now"
+            "description": "Response remembermetoken patched just now"
           }
         },
         "tags": [
-          "ThumbnailV1alpha1"
+          "RememberMeTokenV1alpha1"
         ]
       },
       "put": {
-        "description": "Update Thumbnail",
-        "operationId": "updateThumbnail",
+        "description": "Update RememberMeToken",
+        "operationId": "updateRememberMeToken",
         "parameters": [
           {
-            "description": "Name of thumbnail",
+            "description": "Name of remembermetoken",
             "in": "path",
             "name": "name",
             "required": true,
@@ -8052,33 +8052,33 @@
           "content": {
             "*/*": {
               "schema": {
-                "$ref": "#/components/schemas/Thumbnail"
+                "$ref": "#/components/schemas/RememberMeToken"
               }
             }
           },
-          "description": "Updated thumbnail"
+          "description": "Updated remembermetoken"
         },
         "responses": {
           "200": {
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/Thumbnail"
+                  "$ref": "#/components/schemas/RememberMeToken"
                 }
               }
             },
-            "description": "Response thumbnails updated just now"
+            "description": "Response remembermetokens updated just now"
           }
         },
         "tags": [
-          "ThumbnailV1alpha1"
+          "RememberMeTokenV1alpha1"
         ]
       }
     },
-    "/apis/theme.halo.run/v1alpha1/themes": {
+    "/apis/storage.halo.run/v1alpha1/attachments": {
       "get": {
-        "description": "List Theme",
-        "operationId": "listTheme",
+        "description": "List Attachment",
+        "operationId": "listAttachment",
         "parameters": [
           {
             "description": "Page number. Default is 0.",
@@ -8137,54 +8137,54 @@
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/ThemeList"
+                  "$ref": "#/components/schemas/AttachmentList"
                 }
               }
             },
-            "description": "Response themes"
+            "description": "Response attachments"
           }
         },
         "tags": [
-          "ThemeV1alpha1"
+          "AttachmentV1alpha1"
         ]
       },
       "post": {
-        "description": "Create Theme",
-        "operationId": "createTheme",
+        "description": "Create Attachment",
+        "operationId": "createAttachment",
         "requestBody": {
           "content": {
             "*/*": {
               "schema": {
-                "$ref": "#/components/schemas/Theme"
+                "$ref": "#/components/schemas/Attachment"
               }
             }
           },
-          "description": "Fresh theme"
+          "description": "Fresh attachment"
         },
         "responses": {
           "200": {
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/Theme"
+                  "$ref": "#/components/schemas/Attachment"
                 }
               }
             },
-            "description": "Response themes created just now"
+            "description": "Response attachments created just now"
           }
         },
         "tags": [
-          "ThemeV1alpha1"
+          "AttachmentV1alpha1"
         ]
       }
     },
-    "/apis/theme.halo.run/v1alpha1/themes/{name}": {
+    "/apis/storage.halo.run/v1alpha1/attachments/{name}": {
       "delete": {
-        "description": "Delete Theme",
-        "operationId": "deleteTheme",
+        "description": "Delete Attachment",
+        "operationId": "deleteAttachment",
         "parameters": [
           {
-            "description": "Name of theme",
+            "description": "Name of attachment",
             "in": "path",
             "name": "name",
             "required": true,
@@ -8195,19 +8195,19 @@
         ],
         "responses": {
           "200": {
-            "description": "Response theme deleted just now"
+            "description": "Response attachment deleted just now"
           }
         },
         "tags": [
-          "ThemeV1alpha1"
+          "AttachmentV1alpha1"
         ]
       },
       "get": {
-        "description": "Get Theme",
-        "operationId": "getTheme",
+        "description": "Get Attachment",
+        "operationId": "getAttachment",
         "parameters": [
           {
-            "description": "Name of theme",
+            "description": "Name of attachment",
             "in": "path",
             "name": "name",
             "required": true,
@@ -8221,23 +8221,23 @@
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/Theme"
+                  "$ref": "#/components/schemas/Attachment"
                 }
               }
             },
-            "description": "Response single theme"
+            "description": "Response single attachment"
           }
         },
         "tags": [
-          "ThemeV1alpha1"
+          "AttachmentV1alpha1"
         ]
       },
       "patch": {
-        "description": "Patch Theme",
-        "operationId": "patchTheme",
+        "description": "Patch Attachment",
+        "operationId": "patchAttachment",
         "parameters": [
           {
-            "description": "Name of theme",
+            "description": "Name of attachment",
             "in": "path",
             "name": "name",
             "required": true,
@@ -8260,23 +8260,23 @@
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/Theme"
+                  "$ref": "#/components/schemas/Attachment"
                 }
               }
             },
-            "description": "Response theme patched just now"
+            "description": "Response attachment patched just now"
           }
         },
         "tags": [
-          "ThemeV1alpha1"
+          "AttachmentV1alpha1"
         ]
       },
       "put": {
-        "description": "Update Theme",
-        "operationId": "updateTheme",
+        "description": "Update Attachment",
+        "operationId": "updateAttachment",
         "parameters": [
           {
-            "description": "Name of theme",
+            "description": "Name of attachment",
             "in": "path",
             "name": "name",
             "required": true,
@@ -8289,81 +8289,1745 @@
           "content": {
             "*/*": {
               "schema": {
-                "$ref": "#/components/schemas/Theme"
+                "$ref": "#/components/schemas/Attachment"
               }
             }
           },
-          "description": "Updated theme"
+          "description": "Updated attachment"
         },
         "responses": {
           "200": {
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/Theme"
+                  "$ref": "#/components/schemas/Attachment"
                 }
               }
             },
-            "description": "Response themes updated just now"
+            "description": "Response attachments updated just now"
           }
         },
         "tags": [
-          "ThemeV1alpha1"
+          "AttachmentV1alpha1"
         ]
       }
-    }
-  },
-  "components": {
-    "schemas": {
-      "AddOperation": {
-        "required": [
-          "op",
-          "path",
-          "value"
-        ],
-        "type": "object",
-        "properties": {
-          "op": {
-            "type": "string",
-            "enum": [
-              "add"
-            ]
-          },
-          "path": {
-            "pattern": "^(/[^/~]*(~[01][^/~]*)*)*$",
-            "type": "string",
-            "description": "A JSON Pointer path pointing to the location to move/copy from.",
-            "example": "/a/b/c"
+    },
+    "/apis/storage.halo.run/v1alpha1/groups": {
+      "get": {
+        "description": "List Group",
+        "operationId": "listGroup",
+        "parameters": [
+          {
+            "description": "Page number. Default is 0.",
+            "in": "query",
+            "name": "page",
+            "schema": {
+              "type": "integer",
+              "format": "int32"
+            }
           },
-          "value": {
-            "description": "Value can be any JSON value"
-          }
-        }
-      },
-      "AnnotationSetting": {
-        "required": [
-          "apiVersion",
-          "kind",
-          "metadata",
-          "spec"
-        ],
-        "type": "object",
-        "properties": {
-          "apiVersion": {
-            "type": "string"
+          {
+            "description": "Size number. Default is 0.",
+            "in": "query",
+            "name": "size",
+            "schema": {
+              "type": "integer",
+              "format": "int32"
+            }
           },
-          "kind": {
-            "type": "string"
+          {
+            "description": "Label selector. e.g.: hidden!\u003dtrue",
+            "in": "query",
+            "name": "labelSelector",
+            "schema": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
           },
-          "metadata": {
-            "$ref": "#/components/schemas/Metadata"
+          {
+            "description": "Field selector. e.g.: metadata.name\u003d\u003dhalo",
+            "in": "query",
+            "name": "fieldSelector",
+            "schema": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
           },
-          "spec": {
-            "$ref": "#/components/schemas/AnnotationSettingSpec"
-          }
+          {
+            "description": "Sorting criteria in the format: property,(asc|desc). Default sort order is ascending. Multiple sort criteria are supported.",
+            "in": "query",
+            "name": "sort",
+            "schema": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/GroupList"
+                }
+              }
+            },
+            "description": "Response groups"
+          }
+        },
+        "tags": [
+          "GroupV1alpha1"
+        ]
+      },
+      "post": {
+        "description": "Create Group",
+        "operationId": "createGroup",
+        "requestBody": {
+          "content": {
+            "*/*": {
+              "schema": {
+                "$ref": "#/components/schemas/Group"
+              }
+            }
+          },
+          "description": "Fresh group"
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/Group"
+                }
+              }
+            },
+            "description": "Response groups created just now"
+          }
+        },
+        "tags": [
+          "GroupV1alpha1"
+        ]
+      }
+    },
+    "/apis/storage.halo.run/v1alpha1/groups/{name}": {
+      "delete": {
+        "description": "Delete Group",
+        "operationId": "deleteGroup",
+        "parameters": [
+          {
+            "description": "Name of group",
+            "in": "path",
+            "name": "name",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Response group deleted just now"
+          }
+        },
+        "tags": [
+          "GroupV1alpha1"
+        ]
+      },
+      "get": {
+        "description": "Get Group",
+        "operationId": "getGroup",
+        "parameters": [
+          {
+            "description": "Name of group",
+            "in": "path",
+            "name": "name",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/Group"
+                }
+              }
+            },
+            "description": "Response single group"
+          }
+        },
+        "tags": [
+          "GroupV1alpha1"
+        ]
+      },
+      "patch": {
+        "description": "Patch Group",
+        "operationId": "patchGroup",
+        "parameters": [
+          {
+            "description": "Name of group",
+            "in": "path",
+            "name": "name",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json-patch+json": {
+              "schema": {
+                "$ref": "#/components/schemas/JsonPatch"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/Group"
+                }
+              }
+            },
+            "description": "Response group patched just now"
+          }
+        },
+        "tags": [
+          "GroupV1alpha1"
+        ]
+      },
+      "put": {
+        "description": "Update Group",
+        "operationId": "updateGroup",
+        "parameters": [
+          {
+            "description": "Name of group",
+            "in": "path",
+            "name": "name",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "*/*": {
+              "schema": {
+                "$ref": "#/components/schemas/Group"
+              }
+            }
+          },
+          "description": "Updated group"
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/Group"
+                }
+              }
+            },
+            "description": "Response groups updated just now"
+          }
+        },
+        "tags": [
+          "GroupV1alpha1"
+        ]
+      }
+    },
+    "/apis/storage.halo.run/v1alpha1/localthumbnails": {
+      "get": {
+        "description": "List LocalThumbnail",
+        "operationId": "listLocalThumbnail",
+        "parameters": [
+          {
+            "description": "Page number. Default is 0.",
+            "in": "query",
+            "name": "page",
+            "schema": {
+              "type": "integer",
+              "format": "int32"
+            }
+          },
+          {
+            "description": "Size number. Default is 0.",
+            "in": "query",
+            "name": "size",
+            "schema": {
+              "type": "integer",
+              "format": "int32"
+            }
+          },
+          {
+            "description": "Label selector. e.g.: hidden!\u003dtrue",
+            "in": "query",
+            "name": "labelSelector",
+            "schema": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          },
+          {
+            "description": "Field selector. e.g.: metadata.name\u003d\u003dhalo",
+            "in": "query",
+            "name": "fieldSelector",
+            "schema": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          },
+          {
+            "description": "Sorting criteria in the format: property,(asc|desc). Default sort order is ascending. Multiple sort criteria are supported.",
+            "in": "query",
+            "name": "sort",
+            "schema": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/LocalThumbnailList"
+                }
+              }
+            },
+            "description": "Response localthumbnails"
+          }
+        },
+        "tags": [
+          "LocalThumbnailV1alpha1"
+        ]
+      },
+      "post": {
+        "description": "Create LocalThumbnail",
+        "operationId": "createLocalThumbnail",
+        "requestBody": {
+          "content": {
+            "*/*": {
+              "schema": {
+                "$ref": "#/components/schemas/LocalThumbnail"
+              }
+            }
+          },
+          "description": "Fresh localthumbnail"
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/LocalThumbnail"
+                }
+              }
+            },
+            "description": "Response localthumbnails created just now"
+          }
+        },
+        "tags": [
+          "LocalThumbnailV1alpha1"
+        ]
+      }
+    },
+    "/apis/storage.halo.run/v1alpha1/localthumbnails/{name}": {
+      "delete": {
+        "description": "Delete LocalThumbnail",
+        "operationId": "deleteLocalThumbnail",
+        "parameters": [
+          {
+            "description": "Name of localthumbnail",
+            "in": "path",
+            "name": "name",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Response localthumbnail deleted just now"
+          }
+        },
+        "tags": [
+          "LocalThumbnailV1alpha1"
+        ]
+      },
+      "get": {
+        "description": "Get LocalThumbnail",
+        "operationId": "getLocalThumbnail",
+        "parameters": [
+          {
+            "description": "Name of localthumbnail",
+            "in": "path",
+            "name": "name",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/LocalThumbnail"
+                }
+              }
+            },
+            "description": "Response single localthumbnail"
+          }
+        },
+        "tags": [
+          "LocalThumbnailV1alpha1"
+        ]
+      },
+      "patch": {
+        "description": "Patch LocalThumbnail",
+        "operationId": "patchLocalThumbnail",
+        "parameters": [
+          {
+            "description": "Name of localthumbnail",
+            "in": "path",
+            "name": "name",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json-patch+json": {
+              "schema": {
+                "$ref": "#/components/schemas/JsonPatch"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/LocalThumbnail"
+                }
+              }
+            },
+            "description": "Response localthumbnail patched just now"
+          }
+        },
+        "tags": [
+          "LocalThumbnailV1alpha1"
+        ]
+      },
+      "put": {
+        "description": "Update LocalThumbnail",
+        "operationId": "updateLocalThumbnail",
+        "parameters": [
+          {
+            "description": "Name of localthumbnail",
+            "in": "path",
+            "name": "name",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "*/*": {
+              "schema": {
+                "$ref": "#/components/schemas/LocalThumbnail"
+              }
+            }
+          },
+          "description": "Updated localthumbnail"
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/LocalThumbnail"
+                }
+              }
+            },
+            "description": "Response localthumbnails updated just now"
+          }
+        },
+        "tags": [
+          "LocalThumbnailV1alpha1"
+        ]
+      }
+    },
+    "/apis/storage.halo.run/v1alpha1/policies": {
+      "get": {
+        "description": "List Policy",
+        "operationId": "listPolicy",
+        "parameters": [
+          {
+            "description": "Page number. Default is 0.",
+            "in": "query",
+            "name": "page",
+            "schema": {
+              "type": "integer",
+              "format": "int32"
+            }
+          },
+          {
+            "description": "Size number. Default is 0.",
+            "in": "query",
+            "name": "size",
+            "schema": {
+              "type": "integer",
+              "format": "int32"
+            }
+          },
+          {
+            "description": "Label selector. e.g.: hidden!\u003dtrue",
+            "in": "query",
+            "name": "labelSelector",
+            "schema": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          },
+          {
+            "description": "Field selector. e.g.: metadata.name\u003d\u003dhalo",
+            "in": "query",
+            "name": "fieldSelector",
+            "schema": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          },
+          {
+            "description": "Sorting criteria in the format: property,(asc|desc). Default sort order is ascending. Multiple sort criteria are supported.",
+            "in": "query",
+            "name": "sort",
+            "schema": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/PolicyList"
+                }
+              }
+            },
+            "description": "Response policies"
+          }
+        },
+        "tags": [
+          "PolicyV1alpha1"
+        ]
+      },
+      "post": {
+        "description": "Create Policy",
+        "operationId": "createPolicy",
+        "requestBody": {
+          "content": {
+            "*/*": {
+              "schema": {
+                "$ref": "#/components/schemas/Policy"
+              }
+            }
+          },
+          "description": "Fresh policy"
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/Policy"
+                }
+              }
+            },
+            "description": "Response policies created just now"
+          }
+        },
+        "tags": [
+          "PolicyV1alpha1"
+        ]
+      }
+    },
+    "/apis/storage.halo.run/v1alpha1/policies/{name}": {
+      "delete": {
+        "description": "Delete Policy",
+        "operationId": "deletePolicy",
+        "parameters": [
+          {
+            "description": "Name of policy",
+            "in": "path",
+            "name": "name",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Response policy deleted just now"
+          }
+        },
+        "tags": [
+          "PolicyV1alpha1"
+        ]
+      },
+      "get": {
+        "description": "Get Policy",
+        "operationId": "getPolicy",
+        "parameters": [
+          {
+            "description": "Name of policy",
+            "in": "path",
+            "name": "name",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/Policy"
+                }
+              }
+            },
+            "description": "Response single policy"
+          }
+        },
+        "tags": [
+          "PolicyV1alpha1"
+        ]
+      },
+      "patch": {
+        "description": "Patch Policy",
+        "operationId": "patchPolicy",
+        "parameters": [
+          {
+            "description": "Name of policy",
+            "in": "path",
+            "name": "name",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json-patch+json": {
+              "schema": {
+                "$ref": "#/components/schemas/JsonPatch"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/Policy"
+                }
+              }
+            },
+            "description": "Response policy patched just now"
+          }
+        },
+        "tags": [
+          "PolicyV1alpha1"
+        ]
+      },
+      "put": {
+        "description": "Update Policy",
+        "operationId": "updatePolicy",
+        "parameters": [
+          {
+            "description": "Name of policy",
+            "in": "path",
+            "name": "name",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "*/*": {
+              "schema": {
+                "$ref": "#/components/schemas/Policy"
+              }
+            }
+          },
+          "description": "Updated policy"
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/Policy"
+                }
+              }
+            },
+            "description": "Response policies updated just now"
+          }
+        },
+        "tags": [
+          "PolicyV1alpha1"
+        ]
+      }
+    },
+    "/apis/storage.halo.run/v1alpha1/policytemplates": {
+      "get": {
+        "description": "List PolicyTemplate",
+        "operationId": "listPolicyTemplate",
+        "parameters": [
+          {
+            "description": "Page number. Default is 0.",
+            "in": "query",
+            "name": "page",
+            "schema": {
+              "type": "integer",
+              "format": "int32"
+            }
+          },
+          {
+            "description": "Size number. Default is 0.",
+            "in": "query",
+            "name": "size",
+            "schema": {
+              "type": "integer",
+              "format": "int32"
+            }
+          },
+          {
+            "description": "Label selector. e.g.: hidden!\u003dtrue",
+            "in": "query",
+            "name": "labelSelector",
+            "schema": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          },
+          {
+            "description": "Field selector. e.g.: metadata.name\u003d\u003dhalo",
+            "in": "query",
+            "name": "fieldSelector",
+            "schema": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          },
+          {
+            "description": "Sorting criteria in the format: property,(asc|desc). Default sort order is ascending. Multiple sort criteria are supported.",
+            "in": "query",
+            "name": "sort",
+            "schema": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/PolicyTemplateList"
+                }
+              }
+            },
+            "description": "Response policytemplates"
+          }
+        },
+        "tags": [
+          "PolicyTemplateV1alpha1"
+        ]
+      },
+      "post": {
+        "description": "Create PolicyTemplate",
+        "operationId": "createPolicyTemplate",
+        "requestBody": {
+          "content": {
+            "*/*": {
+              "schema": {
+                "$ref": "#/components/schemas/PolicyTemplate"
+              }
+            }
+          },
+          "description": "Fresh policytemplate"
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/PolicyTemplate"
+                }
+              }
+            },
+            "description": "Response policytemplates created just now"
+          }
+        },
+        "tags": [
+          "PolicyTemplateV1alpha1"
+        ]
+      }
+    },
+    "/apis/storage.halo.run/v1alpha1/policytemplates/{name}": {
+      "delete": {
+        "description": "Delete PolicyTemplate",
+        "operationId": "deletePolicyTemplate",
+        "parameters": [
+          {
+            "description": "Name of policytemplate",
+            "in": "path",
+            "name": "name",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Response policytemplate deleted just now"
+          }
+        },
+        "tags": [
+          "PolicyTemplateV1alpha1"
+        ]
+      },
+      "get": {
+        "description": "Get PolicyTemplate",
+        "operationId": "getPolicyTemplate",
+        "parameters": [
+          {
+            "description": "Name of policytemplate",
+            "in": "path",
+            "name": "name",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/PolicyTemplate"
+                }
+              }
+            },
+            "description": "Response single policytemplate"
+          }
+        },
+        "tags": [
+          "PolicyTemplateV1alpha1"
+        ]
+      },
+      "patch": {
+        "description": "Patch PolicyTemplate",
+        "operationId": "patchPolicyTemplate",
+        "parameters": [
+          {
+            "description": "Name of policytemplate",
+            "in": "path",
+            "name": "name",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json-patch+json": {
+              "schema": {
+                "$ref": "#/components/schemas/JsonPatch"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/PolicyTemplate"
+                }
+              }
+            },
+            "description": "Response policytemplate patched just now"
+          }
+        },
+        "tags": [
+          "PolicyTemplateV1alpha1"
+        ]
+      },
+      "put": {
+        "description": "Update PolicyTemplate",
+        "operationId": "updatePolicyTemplate",
+        "parameters": [
+          {
+            "description": "Name of policytemplate",
+            "in": "path",
+            "name": "name",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "*/*": {
+              "schema": {
+                "$ref": "#/components/schemas/PolicyTemplate"
+              }
+            }
+          },
+          "description": "Updated policytemplate"
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/PolicyTemplate"
+                }
+              }
+            },
+            "description": "Response policytemplates updated just now"
+          }
+        },
+        "tags": [
+          "PolicyTemplateV1alpha1"
+        ]
+      }
+    },
+    "/apis/storage.halo.run/v1alpha1/thumbnails": {
+      "get": {
+        "description": "List Thumbnail",
+        "operationId": "listThumbnail",
+        "parameters": [
+          {
+            "description": "Page number. Default is 0.",
+            "in": "query",
+            "name": "page",
+            "schema": {
+              "type": "integer",
+              "format": "int32"
+            }
+          },
+          {
+            "description": "Size number. Default is 0.",
+            "in": "query",
+            "name": "size",
+            "schema": {
+              "type": "integer",
+              "format": "int32"
+            }
+          },
+          {
+            "description": "Label selector. e.g.: hidden!\u003dtrue",
+            "in": "query",
+            "name": "labelSelector",
+            "schema": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          },
+          {
+            "description": "Field selector. e.g.: metadata.name\u003d\u003dhalo",
+            "in": "query",
+            "name": "fieldSelector",
+            "schema": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          },
+          {
+            "description": "Sorting criteria in the format: property,(asc|desc). Default sort order is ascending. Multiple sort criteria are supported.",
+            "in": "query",
+            "name": "sort",
+            "schema": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/ThumbnailList"
+                }
+              }
+            },
+            "description": "Response thumbnails"
+          }
+        },
+        "tags": [
+          "ThumbnailV1alpha1"
+        ]
+      },
+      "post": {
+        "description": "Create Thumbnail",
+        "operationId": "createThumbnail",
+        "requestBody": {
+          "content": {
+            "*/*": {
+              "schema": {
+                "$ref": "#/components/schemas/Thumbnail"
+              }
+            }
+          },
+          "description": "Fresh thumbnail"
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/Thumbnail"
+                }
+              }
+            },
+            "description": "Response thumbnails created just now"
+          }
+        },
+        "tags": [
+          "ThumbnailV1alpha1"
+        ]
+      }
+    },
+    "/apis/storage.halo.run/v1alpha1/thumbnails/{name}": {
+      "delete": {
+        "description": "Delete Thumbnail",
+        "operationId": "deleteThumbnail",
+        "parameters": [
+          {
+            "description": "Name of thumbnail",
+            "in": "path",
+            "name": "name",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Response thumbnail deleted just now"
+          }
+        },
+        "tags": [
+          "ThumbnailV1alpha1"
+        ]
+      },
+      "get": {
+        "description": "Get Thumbnail",
+        "operationId": "getThumbnail",
+        "parameters": [
+          {
+            "description": "Name of thumbnail",
+            "in": "path",
+            "name": "name",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/Thumbnail"
+                }
+              }
+            },
+            "description": "Response single thumbnail"
+          }
+        },
+        "tags": [
+          "ThumbnailV1alpha1"
+        ]
+      },
+      "patch": {
+        "description": "Patch Thumbnail",
+        "operationId": "patchThumbnail",
+        "parameters": [
+          {
+            "description": "Name of thumbnail",
+            "in": "path",
+            "name": "name",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json-patch+json": {
+              "schema": {
+                "$ref": "#/components/schemas/JsonPatch"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/Thumbnail"
+                }
+              }
+            },
+            "description": "Response thumbnail patched just now"
+          }
+        },
+        "tags": [
+          "ThumbnailV1alpha1"
+        ]
+      },
+      "put": {
+        "description": "Update Thumbnail",
+        "operationId": "updateThumbnail",
+        "parameters": [
+          {
+            "description": "Name of thumbnail",
+            "in": "path",
+            "name": "name",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "*/*": {
+              "schema": {
+                "$ref": "#/components/schemas/Thumbnail"
+              }
+            }
+          },
+          "description": "Updated thumbnail"
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/Thumbnail"
+                }
+              }
+            },
+            "description": "Response thumbnails updated just now"
+          }
+        },
+        "tags": [
+          "ThumbnailV1alpha1"
+        ]
+      }
+    },
+    "/apis/theme.halo.run/v1alpha1/themes": {
+      "get": {
+        "description": "List Theme",
+        "operationId": "listTheme",
+        "parameters": [
+          {
+            "description": "Page number. Default is 0.",
+            "in": "query",
+            "name": "page",
+            "schema": {
+              "type": "integer",
+              "format": "int32"
+            }
+          },
+          {
+            "description": "Size number. Default is 0.",
+            "in": "query",
+            "name": "size",
+            "schema": {
+              "type": "integer",
+              "format": "int32"
+            }
+          },
+          {
+            "description": "Label selector. e.g.: hidden!\u003dtrue",
+            "in": "query",
+            "name": "labelSelector",
+            "schema": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          },
+          {
+            "description": "Field selector. e.g.: metadata.name\u003d\u003dhalo",
+            "in": "query",
+            "name": "fieldSelector",
+            "schema": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          },
+          {
+            "description": "Sorting criteria in the format: property,(asc|desc). Default sort order is ascending. Multiple sort criteria are supported.",
+            "in": "query",
+            "name": "sort",
+            "schema": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/ThemeList"
+                }
+              }
+            },
+            "description": "Response themes"
+          }
+        },
+        "tags": [
+          "ThemeV1alpha1"
+        ]
+      },
+      "post": {
+        "description": "Create Theme",
+        "operationId": "createTheme",
+        "requestBody": {
+          "content": {
+            "*/*": {
+              "schema": {
+                "$ref": "#/components/schemas/Theme"
+              }
+            }
+          },
+          "description": "Fresh theme"
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/Theme"
+                }
+              }
+            },
+            "description": "Response themes created just now"
+          }
+        },
+        "tags": [
+          "ThemeV1alpha1"
+        ]
+      }
+    },
+    "/apis/theme.halo.run/v1alpha1/themes/{name}": {
+      "delete": {
+        "description": "Delete Theme",
+        "operationId": "deleteTheme",
+        "parameters": [
+          {
+            "description": "Name of theme",
+            "in": "path",
+            "name": "name",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Response theme deleted just now"
+          }
+        },
+        "tags": [
+          "ThemeV1alpha1"
+        ]
+      },
+      "get": {
+        "description": "Get Theme",
+        "operationId": "getTheme",
+        "parameters": [
+          {
+            "description": "Name of theme",
+            "in": "path",
+            "name": "name",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/Theme"
+                }
+              }
+            },
+            "description": "Response single theme"
+          }
+        },
+        "tags": [
+          "ThemeV1alpha1"
+        ]
+      },
+      "patch": {
+        "description": "Patch Theme",
+        "operationId": "patchTheme",
+        "parameters": [
+          {
+            "description": "Name of theme",
+            "in": "path",
+            "name": "name",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json-patch+json": {
+              "schema": {
+                "$ref": "#/components/schemas/JsonPatch"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/Theme"
+                }
+              }
+            },
+            "description": "Response theme patched just now"
+          }
+        },
+        "tags": [
+          "ThemeV1alpha1"
+        ]
+      },
+      "put": {
+        "description": "Update Theme",
+        "operationId": "updateTheme",
+        "parameters": [
+          {
+            "description": "Name of theme",
+            "in": "path",
+            "name": "name",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "*/*": {
+              "schema": {
+                "$ref": "#/components/schemas/Theme"
+              }
+            }
+          },
+          "description": "Updated theme"
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/Theme"
+                }
+              }
+            },
+            "description": "Response themes updated just now"
+          }
+        },
+        "tags": [
+          "ThemeV1alpha1"
+        ]
+      }
+    }
+  },
+  "components": {
+    "schemas": {
+      "AddOperation": {
+        "required": [
+          "op",
+          "path",
+          "value"
+        ],
+        "type": "object",
+        "properties": {
+          "op": {
+            "type": "string",
+            "enum": [
+              "add"
+            ]
+          },
+          "path": {
+            "pattern": "^(/[^/~]*(~[01][^/~]*)*)*$",
+            "type": "string",
+            "description": "A JSON Pointer path pointing to the location to move/copy from.",
+            "example": "/a/b/c"
+          },
+          "value": {
+            "description": "Value can be any JSON value"
+          }
+        }
+      },
+      "AnnotationSetting": {
+        "required": [
+          "apiVersion",
+          "kind",
+          "metadata",
+          "spec"
+        ],
+        "type": "object",
+        "properties": {
+          "apiVersion": {
+            "type": "string"
+          },
+          "kind": {
+            "type": "string"
+          },
+          "metadata": {
+            "$ref": "#/components/schemas/Metadata"
+          },
+          "spec": {
+            "$ref": "#/components/schemas/AnnotationSettingSpec"
+          }
+        }
+      },
+      "AnnotationSettingList": {
+        "required": [
+          "first",
+          "hasNext",
+          "hasPrevious",
+          "items",
+          "last",
+          "page",
+          "size",
+          "total",
+          "totalPages"
+        ],
+        "type": "object",
+        "properties": {
+          "first": {
+            "type": "boolean",
+            "description": "Indicates whether current page is the first page."
+          },
+          "hasNext": {
+            "type": "boolean",
+            "description": "Indicates whether current page has previous page."
+          },
+          "hasPrevious": {
+            "type": "boolean",
+            "description": "Indicates whether current page has previous page."
+          },
+          "items": {
+            "type": "array",
+            "description": "A chunk of items.",
+            "items": {
+              "$ref": "#/components/schemas/AnnotationSetting"
+            }
+          },
+          "last": {
+            "type": "boolean",
+            "description": "Indicates whether current page is the last page."
+          },
+          "page": {
+            "type": "integer",
+            "description": "Page number, starts from 1. If not set or equal to 0, it means no pagination.",
+            "format": "int32"
+          },
+          "size": {
+            "type": "integer",
+            "description": "Size of each page. If not set or equal to 0, it means no pagination.",
+            "format": "int32"
+          },
+          "total": {
+            "type": "integer",
+            "description": "Total elements.",
+            "format": "int64"
+          },
+          "totalPages": {
+            "type": "integer",
+            "description": "Indicates total pages.",
+            "format": "int64"
+          }
+        }
+      },
+      "AnnotationSettingSpec": {
+        "required": [
+          "formSchema",
+          "targetRef"
+        ],
+        "type": "object",
+        "properties": {
+          "formSchema": {
+            "minLength": 1,
+            "type": "array",
+            "items": {
+              "minLength": 1,
+              "type": "object"
+            }
+          },
+          "targetRef": {
+            "$ref": "#/components/schemas/GroupKind"
+          }
+        }
+      },
+      "Attachment": {
+        "required": [
+          "apiVersion",
+          "kind",
+          "metadata",
+          "spec"
+        ],
+        "type": "object",
+        "properties": {
+          "apiVersion": {
+            "type": "string"
+          },
+          "kind": {
+            "type": "string"
+          },
+          "metadata": {
+            "$ref": "#/components/schemas/Metadata"
+          },
+          "spec": {
+            "$ref": "#/components/schemas/AttachmentSpec"
+          },
+          "status": {
+            "$ref": "#/components/schemas/AttachmentStatus"
+          }
+        }
+      },
+      "AttachmentList": {
+        "required": [
+          "first",
+          "hasNext",
+          "hasPrevious",
+          "items",
+          "last",
+          "page",
+          "size",
+          "total",
+          "totalPages"
+        ],
+        "type": "object",
+        "properties": {
+          "first": {
+            "type": "boolean",
+            "description": "Indicates whether current page is the first page."
+          },
+          "hasNext": {
+            "type": "boolean",
+            "description": "Indicates whether current page has previous page."
+          },
+          "hasPrevious": {
+            "type": "boolean",
+            "description": "Indicates whether current page has previous page."
+          },
+          "items": {
+            "type": "array",
+            "description": "A chunk of items.",
+            "items": {
+              "$ref": "#/components/schemas/Attachment"
+            }
+          },
+          "last": {
+            "type": "boolean",
+            "description": "Indicates whether current page is the last page."
+          },
+          "page": {
+            "type": "integer",
+            "description": "Page number, starts from 1. If not set or equal to 0, it means no pagination.",
+            "format": "int32"
+          },
+          "size": {
+            "type": "integer",
+            "description": "Size of each page. If not set or equal to 0, it means no pagination.",
+            "format": "int32"
+          },
+          "total": {
+            "type": "integer",
+            "description": "Total elements.",
+            "format": "int64"
+          },
+          "totalPages": {
+            "type": "integer",
+            "description": "Indicates total pages.",
+            "format": "int64"
+          }
+        }
+      },
+      "AttachmentSpec": {
+        "type": "object",
+        "properties": {
+          "displayName": {
+            "type": "string",
+            "description": "Display name of attachment"
+          },
+          "groupName": {
+            "type": "string",
+            "description": "Group name"
+          },
+          "mediaType": {
+            "type": "string",
+            "description": "Media type of attachment"
+          },
+          "ownerName": {
+            "type": "string",
+            "description": "Name of User who uploads the attachment"
+          },
+          "policyName": {
+            "type": "string",
+            "description": "Policy name"
+          },
+          "size": {
+            "minimum": 0,
+            "type": "integer",
+            "description": "Size of attachment. Unit is Byte",
+            "format": "int64"
+          },
+          "tags": {
+            "uniqueItems": true,
+            "type": "array",
+            "description": "Tags of attachment",
+            "items": {
+              "type": "string",
+              "description": "Tag name"
+            }
+          }
+        }
+      },
+      "AttachmentStatus": {
+        "type": "object",
+        "properties": {
+          "permalink": {
+            "type": "string",
+            "description": "Permalink of attachment.\nIf it is in local storage, the public URL will be set.\nIf it is in s3 storage, the Object URL will be set.\n"
+          },
+          "thumbnails": {
+            "type": "object",
+            "additionalProperties": {
+              "type": "string"
+            }
+          }
         }
       },
-      "AnnotationSettingList": {
+      "AuthProvider": {
+        "required": [
+          "apiVersion",
+          "kind",
+          "metadata",
+          "spec"
+        ],
+        "type": "object",
+        "properties": {
+          "apiVersion": {
+            "type": "string"
+          },
+          "kind": {
+            "type": "string"
+          },
+          "metadata": {
+            "$ref": "#/components/schemas/Metadata"
+          },
+          "spec": {
+            "$ref": "#/components/schemas/AuthProviderSpec"
+          }
+        }
+      },
+      "AuthProviderList": {
         "required": [
           "first",
           "hasNext",
@@ -8393,7 +10057,7 @@
             "type": "array",
             "description": "A chunk of items.",
             "items": {
-              "$ref": "#/components/schemas/AnnotationSetting"
+              "$ref": "#/components/schemas/AuthProvider"
             }
           },
           "last": {
@@ -8422,27 +10086,209 @@
           }
         }
       },
-      "AnnotationSettingSpec": {
+      "AuthProviderSpec": {
         "required": [
-          "formSchema",
-          "targetRef"
+          "authType",
+          "authenticationUrl",
+          "displayName"
         ],
         "type": "object",
         "properties": {
-          "formSchema": {
+          "authType": {
+            "type": "string",
+            "enum": [
+              "FORM",
+              "OAUTH2"
+            ]
+          },
+          "authenticationUrl": {
+            "type": "string",
+            "description": "Authentication url of the auth provider"
+          },
+          "bindingUrl": {
+            "type": "string"
+          },
+          "configMapRef": {
+            "$ref": "#/components/schemas/ConfigMapRef"
+          },
+          "description": {
+            "type": "string"
+          },
+          "displayName": {
+            "type": "string",
+            "description": "Display name of the auth provider"
+          },
+          "helpPage": {
+            "type": "string"
+          },
+          "logo": {
+            "type": "string"
+          },
+          "method": {
+            "type": "string"
+          },
+          "rememberMeSupport": {
+            "type": "boolean"
+          },
+          "settingRef": {
+            "$ref": "#/components/schemas/SettingRef"
+          },
+          "unbindUrl": {
+            "type": "string"
+          },
+          "website": {
+            "type": "string"
+          }
+        }
+      },
+      "Author": {
+        "required": [
+          "name"
+        ],
+        "type": "object",
+        "properties": {
+          "name": {
             "minLength": 1,
+            "type": "string"
+          },
+          "website": {
+            "type": "string"
+          }
+        }
+      },
+      "Backup": {
+        "required": [
+          "apiVersion",
+          "kind",
+          "metadata"
+        ],
+        "type": "object",
+        "properties": {
+          "apiVersion": {
+            "type": "string"
+          },
+          "kind": {
+            "type": "string"
+          },
+          "metadata": {
+            "$ref": "#/components/schemas/Metadata"
+          },
+          "spec": {
+            "$ref": "#/components/schemas/BackupSpec"
+          },
+          "status": {
+            "$ref": "#/components/schemas/BackupStatus"
+          }
+        }
+      },
+      "BackupList": {
+        "required": [
+          "first",
+          "hasNext",
+          "hasPrevious",
+          "items",
+          "last",
+          "page",
+          "size",
+          "total",
+          "totalPages"
+        ],
+        "type": "object",
+        "properties": {
+          "first": {
+            "type": "boolean",
+            "description": "Indicates whether current page is the first page."
+          },
+          "hasNext": {
+            "type": "boolean",
+            "description": "Indicates whether current page has previous page."
+          },
+          "hasPrevious": {
+            "type": "boolean",
+            "description": "Indicates whether current page has previous page."
+          },
+          "items": {
             "type": "array",
+            "description": "A chunk of items.",
             "items": {
-              "minLength": 1,
-              "type": "object"
+              "$ref": "#/components/schemas/Backup"
             }
           },
-          "targetRef": {
-            "$ref": "#/components/schemas/GroupKind"
+          "last": {
+            "type": "boolean",
+            "description": "Indicates whether current page is the last page."
+          },
+          "page": {
+            "type": "integer",
+            "description": "Page number, starts from 1. If not set or equal to 0, it means no pagination.",
+            "format": "int32"
+          },
+          "size": {
+            "type": "integer",
+            "description": "Size of each page. If not set or equal to 0, it means no pagination.",
+            "format": "int32"
+          },
+          "total": {
+            "type": "integer",
+            "description": "Total elements.",
+            "format": "int64"
+          },
+          "totalPages": {
+            "type": "integer",
+            "description": "Indicates total pages.",
+            "format": "int64"
           }
         }
       },
-      "Attachment": {
+      "BackupSpec": {
+        "type": "object",
+        "properties": {
+          "expiresAt": {
+            "type": "string",
+            "format": "date-time"
+          },
+          "format": {
+            "type": "string",
+            "description": "Backup file format. Currently, only zip format is supported."
+          }
+        }
+      },
+      "BackupStatus": {
+        "type": "object",
+        "properties": {
+          "completionTimestamp": {
+            "type": "string",
+            "format": "date-time"
+          },
+          "failureMessage": {
+            "type": "string"
+          },
+          "failureReason": {
+            "type": "string"
+          },
+          "filename": {
+            "type": "string"
+          },
+          "phase": {
+            "type": "string",
+            "enum": [
+              "PENDING",
+              "RUNNING",
+              "SUCCEEDED",
+              "FAILED"
+            ]
+          },
+          "size": {
+            "type": "integer",
+            "format": "int64"
+          },
+          "startTimestamp": {
+            "type": "string",
+            "format": "date-time"
+          }
+        }
+      },
+      "Category": {
         "required": [
           "apiVersion",
           "kind",
@@ -8461,14 +10307,14 @@
             "$ref": "#/components/schemas/Metadata"
           },
           "spec": {
-            "$ref": "#/components/schemas/AttachmentSpec"
+            "$ref": "#/components/schemas/CategorySpec"
           },
           "status": {
-            "$ref": "#/components/schemas/AttachmentStatus"
+            "$ref": "#/components/schemas/CategoryStatus"
           }
         }
       },
-      "AttachmentList": {
+      "CategoryList": {
         "required": [
           "first",
           "hasNext",
@@ -8498,7 +10344,7 @@
             "type": "array",
             "description": "A chunk of items.",
             "items": {
-              "$ref": "#/components/schemas/Attachment"
+              "$ref": "#/components/schemas/Category"
             }
           },
           "last": {
@@ -8527,62 +10373,72 @@
           }
         }
       },
-      "AttachmentSpec": {
+      "CategorySpec": {
+        "required": [
+          "displayName",
+          "priority",
+          "slug"
+        ],
         "type": "object",
         "properties": {
-          "displayName": {
-            "type": "string",
-            "description": "Display name of attachment"
+          "children": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
           },
-          "groupName": {
-            "type": "string",
-            "description": "Group name"
+          "cover": {
+            "type": "string"
           },
-          "mediaType": {
-            "type": "string",
-            "description": "Media type of attachment"
+          "description": {
+            "type": "string"
           },
-          "ownerName": {
-            "type": "string",
-            "description": "Name of User who uploads the attachment"
+          "displayName": {
+            "minLength": 1,
+            "type": "string"
           },
-          "policyName": {
-            "type": "string",
-            "description": "Policy name"
+          "hideFromList": {
+            "type": "boolean"
           },
-          "size": {
-            "minimum": 0,
+          "postTemplate": {
+            "maxLength": 255,
+            "type": "string"
+          },
+          "preventParentPostCascadeQuery": {
+            "type": "boolean"
+          },
+          "priority": {
             "type": "integer",
-            "description": "Size of attachment. Unit is Byte",
-            "format": "int64"
+            "format": "int32",
+            "default": 0
           },
-          "tags": {
-            "uniqueItems": true,
-            "type": "array",
-            "description": "Tags of attachment",
-            "items": {
-              "type": "string",
-              "description": "Tag name"
-            }
+          "slug": {
+            "minLength": 1,
+            "type": "string"
+          },
+          "template": {
+            "maxLength": 255,
+            "type": "string"
           }
         }
       },
-      "AttachmentStatus": {
+      "CategoryStatus": {
         "type": "object",
         "properties": {
           "permalink": {
-            "type": "string",
-            "description": "Permalink of attachment.\nIf it is in local storage, the public URL will be set.\nIf it is in s3 storage, the Object URL will be set.\n"
+            "type": "string"
           },
-          "thumbnails": {
-            "type": "object",
-            "additionalProperties": {
-              "type": "string"
-            }
+          "postCount": {
+            "type": "integer",
+            "format": "int32"
+          },
+          "visiblePostCount": {
+            "type": "integer",
+            "format": "int32"
           }
         }
       },
-      "AuthProvider": {
+      "Comment": {
         "required": [
           "apiVersion",
           "kind",
@@ -8601,11 +10457,14 @@
             "$ref": "#/components/schemas/Metadata"
           },
           "spec": {
-            "$ref": "#/components/schemas/AuthProviderSpec"
+            "$ref": "#/components/schemas/CommentSpec"
+          },
+          "status": {
+            "$ref": "#/components/schemas/CommentStatus"
           }
         }
       },
-      "AuthProviderList": {
+      "CommentList": {
         "required": [
           "first",
           "hasNext",
@@ -8635,7 +10494,7 @@
             "type": "array",
             "description": "A chunk of items.",
             "items": {
-              "$ref": "#/components/schemas/AuthProvider"
+              "$ref": "#/components/schemas/Comment"
             }
           },
           "last": {
@@ -8664,77 +10523,166 @@
           }
         }
       },
-      "AuthProviderSpec": {
+      "CommentOwner": {
         "required": [
-          "authType",
-          "authenticationUrl",
-          "displayName"
+          "kind",
+          "name"
         ],
         "type": "object",
         "properties": {
-          "authType": {
-            "type": "string",
-            "enum": [
-              "FORM",
-              "OAUTH2"
-            ]
-          },
-          "authenticationUrl": {
-            "type": "string",
-            "description": "Authentication url of the auth provider"
+          "annotations": {
+            "type": "object",
+            "additionalProperties": {
+              "type": "string"
+            }
           },
-          "bindingUrl": {
+          "displayName": {
             "type": "string"
           },
-          "configMapRef": {
-            "$ref": "#/components/schemas/ConfigMapRef"
+          "kind": {
+            "minLength": 1,
+            "type": "string"
           },
-          "description": {
+          "name": {
+            "maxLength": 64,
             "type": "string"
+          }
+        }
+      },
+      "CommentSpec": {
+        "required": [
+          "allowNotification",
+          "approved",
+          "content",
+          "hidden",
+          "owner",
+          "priority",
+          "raw",
+          "subjectRef",
+          "top"
+        ],
+        "type": "object",
+        "properties": {
+          "allowNotification": {
+            "type": "boolean",
+            "default": true
           },
-          "displayName": {
+          "approved": {
+            "type": "boolean",
+            "default": false
+          },
+          "approvedTime": {
             "type": "string",
-            "description": "Display name of the auth provider"
+            "format": "date-time"
           },
-          "helpPage": {
+          "content": {
+            "minLength": 1,
             "type": "string"
           },
-          "logo": {
-            "type": "string"
+          "creationTime": {
+            "type": "string",
+            "format": "date-time"
           },
-          "method": {
+          "hidden": {
+            "type": "boolean",
+            "default": false
+          },
+          "ipAddress": {
             "type": "string"
           },
-          "rememberMeSupport": {
-            "type": "boolean"
+          "lastReadTime": {
+            "type": "string",
+            "format": "date-time"
           },
-          "settingRef": {
-            "$ref": "#/components/schemas/SettingRef"
+          "owner": {
+            "$ref": "#/components/schemas/CommentOwner"
           },
-          "unbindUrl": {
+          "priority": {
+            "type": "integer",
+            "format": "int32",
+            "default": 0
+          },
+          "raw": {
+            "minLength": 1,
             "type": "string"
           },
-          "website": {
+          "subjectRef": {
+            "$ref": "#/components/schemas/Ref"
+          },
+          "top": {
+            "type": "boolean",
+            "default": false
+          },
+          "userAgent": {
             "type": "string"
           }
         }
       },
-      "Author": {
+      "CommentStatus": {
+        "type": "object",
+        "properties": {
+          "hasNewReply": {
+            "type": "boolean"
+          },
+          "lastReplyTime": {
+            "type": "string",
+            "format": "date-time"
+          },
+          "observedVersion": {
+            "type": "integer",
+            "format": "int64"
+          },
+          "replyCount": {
+            "type": "integer",
+            "format": "int32"
+          },
+          "unreadReplyCount": {
+            "type": "integer",
+            "format": "int32"
+          },
+          "visibleReplyCount": {
+            "type": "integer",
+            "format": "int32"
+          }
+        }
+      },
+      "Condition": {
         "required": [
-          "name"
+          "lastTransitionTime",
+          "status",
+          "type"
         ],
         "type": "object",
         "properties": {
-          "name": {
-            "minLength": 1,
+          "lastTransitionTime": {
+            "type": "string",
+            "format": "date-time"
+          },
+          "message": {
+            "maxLength": 32768,
             "type": "string"
           },
-          "website": {
+          "reason": {
+            "maxLength": 1024,
+            "pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
+            "type": "string"
+          },
+          "status": {
+            "type": "string",
+            "enum": [
+              "TRUE",
+              "FALSE",
+              "UNKNOWN"
+            ]
+          },
+          "type": {
+            "maxLength": 316,
+            "pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
             "type": "string"
           }
         }
       },
-      "Backup": {
+      "ConfigMap": {
         "required": [
           "apiVersion",
           "kind",
@@ -8745,21 +10693,21 @@
           "apiVersion": {
             "type": "string"
           },
+          "data": {
+            "type": "object",
+            "additionalProperties": {
+              "type": "string"
+            }
+          },
           "kind": {
             "type": "string"
           },
           "metadata": {
             "$ref": "#/components/schemas/Metadata"
-          },
-          "spec": {
-            "$ref": "#/components/schemas/BackupSpec"
-          },
-          "status": {
-            "$ref": "#/components/schemas/BackupStatus"
           }
         }
       },
-      "BackupList": {
+      "ConfigMapList": {
         "required": [
           "first",
           "hasNext",
@@ -8789,7 +10737,7 @@
             "type": "array",
             "description": "A chunk of items.",
             "items": {
-              "$ref": "#/components/schemas/Backup"
+              "$ref": "#/components/schemas/ConfigMap"
             }
           },
           "last": {
@@ -8818,81 +10766,86 @@
           }
         }
       },
-      "BackupSpec": {
+      "ConfigMapRef": {
+        "required": [
+          "name"
+        ],
         "type": "object",
         "properties": {
-          "expiresAt": {
-            "type": "string",
-            "format": "date-time"
-          },
-          "format": {
-            "type": "string",
-            "description": "Backup file format. Currently, only zip format is supported."
+          "name": {
+            "minLength": 1,
+            "type": "string"
           }
         }
       },
-      "BackupStatus": {
+      "CopyOperation": {
+        "required": [
+          "op",
+          "from",
+          "path"
+        ],
         "type": "object",
         "properties": {
-          "completionTimestamp": {
+          "from": {
+            "pattern": "^(/[^/~]*(~[01][^/~]*)*)*$",
             "type": "string",
-            "format": "date-time"
-          },
-          "failureMessage": {
-            "type": "string"
-          },
-          "failureReason": {
-            "type": "string"
-          },
-          "filename": {
-            "type": "string"
+            "description": "A JSON Pointer path pointing to the location to move/copy from.",
+            "example": "/a/b/c"
           },
-          "phase": {
+          "op": {
             "type": "string",
             "enum": [
-              "PENDING",
-              "RUNNING",
-              "SUCCEEDED",
-              "FAILED"
+              "copy"
             ]
           },
-          "size": {
-            "type": "integer",
-            "format": "int64"
-          },
-          "startTimestamp": {
+          "path": {
+            "pattern": "^(/[^/~]*(~[01][^/~]*)*)*$",
             "type": "string",
-            "format": "date-time"
+            "description": "A JSON Pointer path pointing to the location to move/copy from.",
+            "example": "/a/b/c"
           }
         }
       },
-      "Category": {
+      "Counter": {
         "required": [
           "apiVersion",
           "kind",
-          "metadata",
-          "spec"
+          "metadata"
         ],
         "type": "object",
         "properties": {
           "apiVersion": {
             "type": "string"
           },
+          "approvedComment": {
+            "type": "integer",
+            "format": "int32"
+          },
+          "downvote": {
+            "type": "integer",
+            "format": "int32"
+          },
           "kind": {
             "type": "string"
           },
           "metadata": {
             "$ref": "#/components/schemas/Metadata"
           },
-          "spec": {
-            "$ref": "#/components/schemas/CategorySpec"
+          "totalComment": {
+            "type": "integer",
+            "format": "int32"
           },
-          "status": {
-            "$ref": "#/components/schemas/CategoryStatus"
+          "upvote": {
+            "type": "integer",
+            "format": "int32"
+          },
+          "visit": {
+            "type": "integer",
+            "format": "int32"
           }
         }
       },
-      "CategoryList": {
+      "CounterList": {
         "required": [
           "first",
           "hasNext",
@@ -8922,7 +10875,7 @@
             "type": "array",
             "description": "A chunk of items.",
             "items": {
-              "$ref": "#/components/schemas/Category"
+              "$ref": "#/components/schemas/Counter"
             }
           },
           "last": {
@@ -8951,77 +10904,36 @@
           }
         }
       },
-      "CategorySpec": {
-        "required": [
-          "displayName",
-          "priority",
-          "slug"
-        ],
+      "CustomTemplates": {
         "type": "object",
         "properties": {
-          "children": {
+          "category": {
             "type": "array",
             "items": {
-              "type": "string"
+              "$ref": "#/components/schemas/TemplateDescriptor"
             }
           },
-          "cover": {
-            "type": "string"
-          },
-          "description": {
-            "type": "string"
-          },
-          "displayName": {
-            "minLength": 1,
-            "type": "string"
-          },
-          "hideFromList": {
-            "type": "boolean"
-          },
-          "postTemplate": {
-            "maxLength": 255,
-            "type": "string"
-          },
-          "preventParentPostCascadeQuery": {
-            "type": "boolean"
-          },
-          "priority": {
-            "type": "integer",
-            "format": "int32",
-            "default": 0
-          },
-          "slug": {
-            "minLength": 1,
-            "type": "string"
-          },
-          "template": {
-            "maxLength": 255,
-            "type": "string"
-          }
-        }
-      },
-      "CategoryStatus": {
-        "type": "object",
-        "properties": {
-          "permalink": {
-            "type": "string"
-          },
-          "postCount": {
-            "type": "integer",
-            "format": "int32"
+          "page": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/TemplateDescriptor"
+            }
           },
-          "visiblePostCount": {
-            "type": "integer",
-            "format": "int32"
+          "post": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/TemplateDescriptor"
+            }
           }
         }
       },
-      "Comment": {
+      "Device": {
         "required": [
           "apiVersion",
           "kind",
           "metadata",
-          "spec"
+          "spec",
+          "status"
         ],
         "type": "object",
         "properties": {
@@ -9035,14 +10947,14 @@
             "$ref": "#/components/schemas/Metadata"
           },
           "spec": {
-            "$ref": "#/components/schemas/CommentSpec"
+            "$ref": "#/components/schemas/DeviceSpec"
           },
           "status": {
-            "$ref": "#/components/schemas/CommentStatus"
+            "$ref": "#/components/schemas/DeviceStatus"
           }
         }
       },
-      "CommentList": {
+      "DeviceList": {
         "required": [
           "first",
           "hasNext",
@@ -9072,7 +10984,7 @@
             "type": "array",
             "description": "A chunk of items.",
             "items": {
-              "$ref": "#/components/schemas/Comment"
+              "$ref": "#/components/schemas/Device"
             }
           },
           "last": {
@@ -9101,191 +11013,175 @@
           }
         }
       },
-      "CommentOwner": {
+      "DeviceSpec": {
         "required": [
-          "kind",
-          "name"
+          "ipAddress",
+          "principalName",
+          "sessionId"
         ],
         "type": "object",
         "properties": {
-          "annotations": {
-            "type": "object",
-            "additionalProperties": {
-              "type": "string"
-            }
-          },
-          "displayName": {
-            "type": "string"
-          },
-          "kind": {
-            "minLength": 1,
-            "type": "string"
-          },
-          "name": {
-            "maxLength": 64,
+          "ipAddress": {
+            "maxLength": 129,
             "type": "string"
-          }
-        }
-      },
-      "CommentSpec": {
-        "required": [
-          "allowNotification",
-          "approved",
-          "content",
-          "hidden",
-          "owner",
-          "priority",
-          "raw",
-          "subjectRef",
-          "top"
-        ],
-        "type": "object",
-        "properties": {
-          "allowNotification": {
-            "type": "boolean",
-            "default": true
-          },
-          "approved": {
-            "type": "boolean",
-            "default": false
           },
-          "approvedTime": {
+          "lastAccessedTime": {
             "type": "string",
             "format": "date-time"
           },
-          "content": {
-            "minLength": 1,
-            "type": "string"
-          },
-          "creationTime": {
+          "lastAuthenticatedTime": {
             "type": "string",
             "format": "date-time"
           },
-          "hidden": {
-            "type": "boolean",
-            "default": false
-          },
-          "ipAddress": {
+          "principalName": {
+            "minLength": 1,
             "type": "string"
           },
-          "lastReadTime": {
-            "type": "string",
-            "format": "date-time"
-          },
-          "owner": {
-            "$ref": "#/components/schemas/CommentOwner"
-          },
-          "priority": {
-            "type": "integer",
-            "format": "int32",
-            "default": 0
+          "rememberMeSeriesId": {
+            "type": "string"
           },
-          "raw": {
+          "sessionId": {
             "minLength": 1,
             "type": "string"
           },
-          "subjectRef": {
-            "$ref": "#/components/schemas/Ref"
-          },
-          "top": {
+          "userAgent": {
+            "maxLength": 500,
+            "type": "string"
+          }
+        }
+      },
+      "DeviceStatus": {
+        "type": "object",
+        "properties": {
+          "browser": {
+            "type": "string"
+          },
+          "os": {
+            "type": "string"
+          }
+        }
+      },
+      "Excerpt": {
+        "required": [
+          "autoGenerate"
+        ],
+        "type": "object",
+        "properties": {
+          "autoGenerate": {
             "type": "boolean",
-            "default": false
+            "default": true
           },
-          "userAgent": {
+          "raw": {
             "type": "string"
           }
         }
       },
-      "CommentStatus": {
+      "ExtensionDefinition": {
+        "required": [
+          "apiVersion",
+          "kind",
+          "metadata",
+          "spec"
+        ],
         "type": "object",
         "properties": {
-          "hasNewReply": {
-            "type": "boolean"
-          },
-          "lastReplyTime": {
-            "type": "string",
-            "format": "date-time"
-          },
-          "observedVersion": {
-            "type": "integer",
-            "format": "int64"
+          "apiVersion": {
+            "type": "string"
           },
-          "replyCount": {
-            "type": "integer",
-            "format": "int32"
+          "kind": {
+            "type": "string"
           },
-          "unreadReplyCount": {
-            "type": "integer",
-            "format": "int32"
+          "metadata": {
+            "$ref": "#/components/schemas/Metadata"
           },
-          "visibleReplyCount": {
-            "type": "integer",
-            "format": "int32"
+          "spec": {
+            "$ref": "#/components/schemas/ExtensionSpec"
           }
         }
       },
-      "Condition": {
+      "ExtensionDefinitionList": {
         "required": [
-          "lastTransitionTime",
-          "status",
-          "type"
+          "first",
+          "hasNext",
+          "hasPrevious",
+          "items",
+          "last",
+          "page",
+          "size",
+          "total",
+          "totalPages"
         ],
         "type": "object",
         "properties": {
-          "lastTransitionTime": {
-            "type": "string",
-            "format": "date-time"
+          "first": {
+            "type": "boolean",
+            "description": "Indicates whether current page is the first page."
           },
-          "message": {
-            "maxLength": 32768,
-            "type": "string"
+          "hasNext": {
+            "type": "boolean",
+            "description": "Indicates whether current page has previous page."
           },
-          "reason": {
-            "maxLength": 1024,
-            "pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
-            "type": "string"
+          "hasPrevious": {
+            "type": "boolean",
+            "description": "Indicates whether current page has previous page."
           },
-          "status": {
-            "type": "string",
-            "enum": [
-              "TRUE",
-              "FALSE",
-              "UNKNOWN"
-            ]
+          "items": {
+            "type": "array",
+            "description": "A chunk of items.",
+            "items": {
+              "$ref": "#/components/schemas/ExtensionDefinition"
+            }
           },
-          "type": {
-            "maxLength": 316,
-            "pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
-            "type": "string"
+          "last": {
+            "type": "boolean",
+            "description": "Indicates whether current page is the last page."
+          },
+          "page": {
+            "type": "integer",
+            "description": "Page number, starts from 1. If not set or equal to 0, it means no pagination.",
+            "format": "int32"
+          },
+          "size": {
+            "type": "integer",
+            "description": "Size of each page. If not set or equal to 0, it means no pagination.",
+            "format": "int32"
+          },
+          "total": {
+            "type": "integer",
+            "description": "Total elements.",
+            "format": "int64"
+          },
+          "totalPages": {
+            "type": "integer",
+            "description": "Indicates total pages.",
+            "format": "int64"
           }
         }
       },
-      "ConfigMap": {
+      "ExtensionPointDefinition": {
         "required": [
           "apiVersion",
           "kind",
-          "metadata"
+          "metadata",
+          "spec"
         ],
         "type": "object",
         "properties": {
           "apiVersion": {
             "type": "string"
           },
-          "data": {
-            "type": "object",
-            "additionalProperties": {
-              "type": "string"
-            }
-          },
           "kind": {
             "type": "string"
           },
           "metadata": {
             "$ref": "#/components/schemas/Metadata"
+          },
+          "spec": {
+            "$ref": "#/components/schemas/ExtensionPointSpec"
           }
         }
       },
-      "ConfigMapList": {
+      "ExtensionPointDefinitionList": {
         "required": [
           "first",
           "hasNext",
@@ -9315,7 +11211,7 @@
             "type": "array",
             "description": "A chunk of items.",
             "items": {
-              "$ref": "#/components/schemas/ConfigMap"
+              "$ref": "#/components/schemas/ExtensionPointDefinition"
             }
           },
           "last": {
@@ -9344,86 +11240,109 @@
           }
         }
       },
-      "ConfigMapRef": {
+      "ExtensionPointSpec": {
         "required": [
-          "name"
+          "className",
+          "displayName",
+          "type"
         ],
         "type": "object",
         "properties": {
-          "name": {
-            "minLength": 1,
+          "className": {
+            "type": "string"
+          },
+          "description": {
+            "type": "string"
+          },
+          "displayName": {
+            "type": "string"
+          },
+          "icon": {
             "type": "string"
+          },
+          "type": {
+            "type": "string",
+            "enum": [
+              "SINGLETON",
+              "MULTI_INSTANCE"
+            ]
           }
         }
       },
-      "CopyOperation": {
+      "ExtensionSpec": {
         "required": [
-          "op",
-          "from",
-          "path"
+          "className",
+          "displayName",
+          "extensionPointName"
         ],
         "type": "object",
         "properties": {
-          "from": {
-            "pattern": "^(/[^/~]*(~[01][^/~]*)*)*$",
-            "type": "string",
-            "description": "A JSON Pointer path pointing to the location to move/copy from.",
-            "example": "/a/b/c"
+          "className": {
+            "type": "string"
           },
-          "op": {
-            "type": "string",
-            "enum": [
-              "copy"
-            ]
+          "description": {
+            "type": "string"
           },
-          "path": {
-            "pattern": "^(/[^/~]*(~[01][^/~]*)*)*$",
-            "type": "string",
-            "description": "A JSON Pointer path pointing to the location to move/copy from.",
-            "example": "/a/b/c"
+          "displayName": {
+            "type": "string"
+          },
+          "extensionPointName": {
+            "type": "string"
+          },
+          "icon": {
+            "type": "string"
           }
         }
       },
-      "Counter": {
+      "FileReverseProxyProvider": {
+        "type": "object",
+        "properties": {
+          "directory": {
+            "type": "string"
+          },
+          "filename": {
+            "type": "string"
+          }
+        }
+      },
+      "Group": {
         "required": [
           "apiVersion",
           "kind",
-          "metadata"
+          "metadata",
+          "spec"
         ],
         "type": "object",
         "properties": {
           "apiVersion": {
             "type": "string"
           },
-          "approvedComment": {
-            "type": "integer",
-            "format": "int32"
-          },
-          "downvote": {
-            "type": "integer",
-            "format": "int32"
-          },
           "kind": {
             "type": "string"
           },
           "metadata": {
             "$ref": "#/components/schemas/Metadata"
           },
-          "totalComment": {
-            "type": "integer",
-            "format": "int32"
+          "spec": {
+            "$ref": "#/components/schemas/GroupSpec"
           },
-          "upvote": {
-            "type": "integer",
-            "format": "int32"
+          "status": {
+            "$ref": "#/components/schemas/GroupStatus"
+          }
+        }
+      },
+      "GroupKind": {
+        "type": "object",
+        "properties": {
+          "group": {
+            "type": "string"
           },
-          "visit": {
-            "type": "integer",
-            "format": "int32"
+          "kind": {
+            "type": "string"
           }
         }
       },
-      "CounterList": {
+      "GroupList": {
         "required": [
           "first",
           "hasNext",
@@ -9453,7 +11372,7 @@
             "type": "array",
             "description": "A chunk of items.",
             "items": {
-              "$ref": "#/components/schemas/Counter"
+              "$ref": "#/components/schemas/Group"
             }
           },
           "last": {
@@ -9482,36 +11401,122 @@
           }
         }
       },
-      "CustomTemplates": {
+      "GroupSpec": {
+        "required": [
+          "displayName"
+        ],
         "type": "object",
         "properties": {
-          "category": {
-            "type": "array",
-            "items": {
-              "$ref": "#/components/schemas/TemplateDescriptor"
-            }
+          "displayName": {
+            "type": "string",
+            "description": "Display name of group"
+          }
+        }
+      },
+      "GroupStatus": {
+        "type": "object",
+        "properties": {
+          "totalAttachments": {
+            "minimum": 0,
+            "type": "integer",
+            "description": "Total of attachments under the current group",
+            "format": "int64"
           },
-          "page": {
-            "type": "array",
-            "items": {
-              "$ref": "#/components/schemas/TemplateDescriptor"
-            }
+          "updateTimestamp": {
+            "type": "string",
+            "description": "Update timestamp of the group",
+            "format": "date-time"
+          }
+        }
+      },
+      "InterestReason": {
+        "required": [
+          "reasonType",
+          "subject"
+        ],
+        "type": "object",
+        "properties": {
+          "expression": {
+            "type": "string",
+            "description": "The expression to be interested in"
           },
-          "post": {
-            "type": "array",
-            "items": {
-              "$ref": "#/components/schemas/TemplateDescriptor"
+          "reasonType": {
+            "type": "string",
+            "description": "The name of the reason definition to be interested in"
+          },
+          "subject": {
+            "$ref": "#/components/schemas/InterestReasonSubject"
+          }
+        },
+        "description": "The reason to be interested in"
+      },
+      "InterestReasonSubject": {
+        "required": [
+          "apiVersion",
+          "kind"
+        ],
+        "type": "object",
+        "properties": {
+          "apiVersion": {
+            "minLength": 1,
+            "type": "string"
+          },
+          "kind": {
+            "minLength": 1,
+            "type": "string"
+          },
+          "name": {
+            "type": "string",
+            "description": "if name is not specified, it presents all subjects of the specified reason type and custom resources"
+          }
+        },
+        "description": "The subject name of reason type to be interested in"
+      },
+      "JsonPatch": {
+        "minItems": 1,
+        "uniqueItems": true,
+        "type": "array",
+        "description": "JSON schema for JSONPatch operations",
+        "items": {
+          "oneOf": [
+            {
+              "$ref": "#/components/schemas/AddOperation"
+            },
+            {
+              "$ref": "#/components/schemas/ReplaceOperation"
+            },
+            {
+              "$ref": "#/components/schemas/TestOperation"
+            },
+            {
+              "$ref": "#/components/schemas/RemoveOperation"
+            },
+            {
+              "$ref": "#/components/schemas/MoveOperation"
+            },
+            {
+              "$ref": "#/components/schemas/CopyOperation"
             }
+          ]
+        }
+      },
+      "License": {
+        "type": "object",
+        "properties": {
+          "name": {
+            "type": "string"
+          },
+          "url": {
+            "type": "string"
           }
         }
       },
-      "Device": {
+      "LocalThumbnail": {
         "required": [
           "apiVersion",
           "kind",
           "metadata",
-          "spec",
-          "status"
+          "spec"
         ],
         "type": "object",
         "properties": {
@@ -9525,14 +11530,14 @@
             "$ref": "#/components/schemas/Metadata"
           },
           "spec": {
-            "$ref": "#/components/schemas/DeviceSpec"
+            "$ref": "#/components/schemas/LocalThumbnailSpec"
           },
           "status": {
-            "$ref": "#/components/schemas/DeviceStatus"
+            "$ref": "#/components/schemas/LocalThumbnailStatus"
           }
         }
       },
-      "DeviceList": {
+      "LocalThumbnailList": {
         "required": [
           "first",
           "hasNext",
@@ -9562,7 +11567,7 @@
             "type": "array",
             "description": "A chunk of items.",
             "items": {
-              "$ref": "#/components/schemas/Device"
+              "$ref": "#/components/schemas/LocalThumbnail"
             }
           },
           "last": {
@@ -9591,70 +11596,88 @@
           }
         }
       },
-      "DeviceSpec": {
+      "LocalThumbnailSpec": {
         "required": [
-          "ipAddress",
-          "principalName",
-          "sessionId"
+          "filePath",
+          "imageSignature",
+          "imageUri",
+          "size",
+          "thumbSignature",
+          "thumbnailUri"
         ],
         "type": "object",
         "properties": {
-          "ipAddress": {
-            "maxLength": 129,
+          "filePath": {
             "type": "string"
           },
-          "lastAccessedTime": {
-            "type": "string",
-            "format": "date-time"
-          },
-          "lastAuthenticatedTime": {
-            "type": "string",
-            "format": "date-time"
-          },
-          "principalName": {
+          "imageSignature": {
             "minLength": 1,
             "type": "string"
           },
-          "rememberMeSeriesId": {
+          "imageUri": {
+            "minLength": 1,
             "type": "string"
           },
-          "sessionId": {
+          "size": {
+            "type": "string",
+            "enum": [
+              "S",
+              "M",
+              "L",
+              "XL"
+            ]
+          },
+          "thumbSignature": {
             "minLength": 1,
             "type": "string"
           },
-          "userAgent": {
-            "maxLength": 500,
+          "thumbnailUri": {
+            "minLength": 1,
             "type": "string"
           }
         }
       },
-      "DeviceStatus": {
+      "LocalThumbnailStatus": {
         "type": "object",
         "properties": {
-          "browser": {
-            "type": "string"
-          },
-          "os": {
-            "type": "string"
+          "phase": {
+            "type": "string",
+            "enum": [
+              "PENDING",
+              "SUCCEEDED",
+              "FAILED"
+            ]
           }
         }
       },
-      "Excerpt": {
+      "LoginHistory": {
         "required": [
-          "autoGenerate"
+          "loginAt",
+          "sourceIp",
+          "successful",
+          "userAgent"
         ],
         "type": "object",
         "properties": {
-          "autoGenerate": {
-            "type": "boolean",
-            "default": true
+          "loginAt": {
+            "type": "string",
+            "format": "date-time"
           },
-          "raw": {
+          "reason": {
+            "type": "string"
+          },
+          "sourceIp": {
+            "type": "string"
+          },
+          "successful": {
+            "type": "boolean"
+          },
+          "userAgent": {
             "type": "string"
           }
         }
       },
-      "ExtensionDefinition": {
+      "Menu": {
         "required": [
           "apiVersion",
           "kind",
@@ -9667,76 +11690,17 @@
             "type": "string"
           },
           "kind": {
-            "type": "string"
-          },
-          "metadata": {
-            "$ref": "#/components/schemas/Metadata"
-          },
-          "spec": {
-            "$ref": "#/components/schemas/ExtensionSpec"
-          }
-        }
-      },
-      "ExtensionDefinitionList": {
-        "required": [
-          "first",
-          "hasNext",
-          "hasPrevious",
-          "items",
-          "last",
-          "page",
-          "size",
-          "total",
-          "totalPages"
-        ],
-        "type": "object",
-        "properties": {
-          "first": {
-            "type": "boolean",
-            "description": "Indicates whether current page is the first page."
-          },
-          "hasNext": {
-            "type": "boolean",
-            "description": "Indicates whether current page has previous page."
-          },
-          "hasPrevious": {
-            "type": "boolean",
-            "description": "Indicates whether current page has previous page."
-          },
-          "items": {
-            "type": "array",
-            "description": "A chunk of items.",
-            "items": {
-              "$ref": "#/components/schemas/ExtensionDefinition"
-            }
-          },
-          "last": {
-            "type": "boolean",
-            "description": "Indicates whether current page is the last page."
-          },
-          "page": {
-            "type": "integer",
-            "description": "Page number, starts from 1. If not set or equal to 0, it means no pagination.",
-            "format": "int32"
-          },
-          "size": {
-            "type": "integer",
-            "description": "Size of each page. If not set or equal to 0, it means no pagination.",
-            "format": "int32"
+            "type": "string"
           },
-          "total": {
-            "type": "integer",
-            "description": "Total elements.",
-            "format": "int64"
+          "metadata": {
+            "$ref": "#/components/schemas/Metadata"
           },
-          "totalPages": {
-            "type": "integer",
-            "description": "Indicates total pages.",
-            "format": "int64"
+          "spec": {
+            "$ref": "#/components/schemas/MenuSpec"
           }
         }
       },
-      "ExtensionPointDefinition": {
+      "MenuItem": {
         "required": [
           "apiVersion",
           "kind",
@@ -9755,11 +11719,14 @@
             "$ref": "#/components/schemas/Metadata"
           },
           "spec": {
-            "$ref": "#/components/schemas/ExtensionPointSpec"
+            "$ref": "#/components/schemas/MenuItemSpec"
+          },
+          "status": {
+            "$ref": "#/components/schemas/MenuItemStatus"
           }
         }
       },
-      "ExtensionPointDefinitionList": {
+      "MenuItemList": {
         "required": [
           "first",
           "hasNext",
@@ -9789,7 +11756,7 @@
             "type": "array",
             "description": "A chunk of items.",
             "items": {
-              "$ref": "#/components/schemas/ExtensionPointDefinition"
+              "$ref": "#/components/schemas/MenuItem"
             }
           },
           "last": {
@@ -9818,109 +11785,62 @@
           }
         }
       },
-      "ExtensionPointSpec": {
-        "required": [
-          "className",
-          "displayName",
-          "type"
-        ],
+      "MenuItemSpec": {
         "type": "object",
         "properties": {
-          "className": {
-            "type": "string"
-          },
-          "description": {
-            "type": "string"
+          "children": {
+            "uniqueItems": true,
+            "type": "array",
+            "description": "Children of this menu item",
+            "items": {
+              "type": "string",
+              "description": "The name of menu item child"
+            }
           },
           "displayName": {
-            "type": "string"
+            "type": "string",
+            "description": "The display name of menu item."
           },
-          "icon": {
-            "type": "string"
+          "href": {
+            "type": "string",
+            "description": "The href of this menu item."
           },
-          "type": {
+          "priority": {
+            "type": "integer",
+            "description": "The priority is for ordering.",
+            "format": "int32"
+          },
+          "target": {
             "type": "string",
+            "description": "The \u003ca\u003e target attribute of this menu item.",
             "enum": [
-              "SINGLETON",
-              "MULTI_INSTANCE"
+              "_blank",
+              "_self",
+              "_parent",
+              "_top"
             ]
-          }
-        }
-      },
-      "ExtensionSpec": {
-        "required": [
-          "className",
-          "displayName",
-          "extensionPointName"
-        ],
-        "type": "object",
-        "properties": {
-          "className": {
-            "type": "string"
-          },
-          "description": {
-            "type": "string"
-          },
-          "displayName": {
-            "type": "string"
-          },
-          "extensionPointName": {
-            "type": "string"
-          },
-          "icon": {
-            "type": "string"
-          }
-        }
-      },
-      "FileReverseProxyProvider": {
-        "type": "object",
-        "properties": {
-          "directory": {
-            "type": "string"
-          },
-          "filename": {
-            "type": "string"
-          }
-        }
-      },
-      "Group": {
-        "required": [
-          "apiVersion",
-          "kind",
-          "metadata",
-          "spec"
-        ],
-        "type": "object",
-        "properties": {
-          "apiVersion": {
-            "type": "string"
-          },
-          "kind": {
-            "type": "string"
-          },
-          "metadata": {
-            "$ref": "#/components/schemas/Metadata"
-          },
-          "spec": {
-            "$ref": "#/components/schemas/GroupSpec"
           },
-          "status": {
-            "$ref": "#/components/schemas/GroupStatus"
+          "targetRef": {
+            "$ref": "#/components/schemas/Ref"
           }
-        }
+        },
+        "description": "The spec of menu item."
       },
-      "GroupKind": {
+      "MenuItemStatus": {
         "type": "object",
         "properties": {
-          "group": {
-            "type": "string"
+          "displayName": {
+            "type": "string",
+            "description": "Calculated Display name of menu item."
           },
-          "kind": {
-            "type": "string"
+          "href": {
+            "type": "string",
+            "description": "Calculated href of manu item."
           }
-        }
+        },
+        "description": "The status of menu item."
       },
-      "GroupList": {
+      "MenuList": {
         "required": [
           "first",
           "hasNext",
@@ -9950,7 +11870,7 @@
             "type": "array",
             "description": "A chunk of items.",
             "items": {
-              "$ref": "#/components/schemas/Group"
+              "$ref": "#/components/schemas/Menu"
             }
           },
           "last": {
@@ -9979,7 +11899,7 @@
           }
         }
       },
-      "GroupSpec": {
+      "MenuSpec": {
         "required": [
           "displayName"
         ],
@@ -9987,71 +11907,105 @@
         "properties": {
           "displayName": {
             "type": "string",
-            "description": "Display name of group"
+            "description": "The display name of the menu."
+          },
+          "menuItems": {
+            "uniqueItems": true,
+            "type": "array",
+            "description": "Names of menu children below this menu.",
+            "items": {
+              "type": "string",
+              "description": "Names of menu children below this menu."
+            }
           }
-        }
+        },
+        "description": "The spec of menu."
       },
-      "GroupStatus": {
+      "Metadata": {
+        "required": [
+          "name"
+        ],
         "type": "object",
         "properties": {
-          "totalAttachments": {
-            "minimum": 0,
-            "type": "integer",
-            "description": "Total of attachments under the current group",
-            "format": "int64"
+          "annotations": {
+            "type": "object",
+            "additionalProperties": {
+              "type": "string"
+            }
           },
-          "updateTimestamp": {
+          "creationTimestamp": {
             "type": "string",
-            "description": "Update timestamp of the group",
-            "format": "date-time"
-          }
-        }
-      },
-      "JsonPatch": {
-        "minItems": 1,
-        "uniqueItems": true,
-        "type": "array",
-        "description": "JSON schema for JSONPatch operations",
-        "items": {
-          "oneOf": [
-            {
-              "$ref": "#/components/schemas/AddOperation"
-            },
-            {
-              "$ref": "#/components/schemas/ReplaceOperation"
-            },
-            {
-              "$ref": "#/components/schemas/TestOperation"
-            },
-            {
-              "$ref": "#/components/schemas/RemoveOperation"
-            },
-            {
-              "$ref": "#/components/schemas/MoveOperation"
-            },
-            {
-              "$ref": "#/components/schemas/CopyOperation"
+            "format": "date-time",
+            "nullable": true
+          },
+          "deletionTimestamp": {
+            "type": "string",
+            "format": "date-time",
+            "nullable": true
+          },
+          "finalizers": {
+            "uniqueItems": true,
+            "type": "array",
+            "nullable": true,
+            "items": {
+              "type": "string",
+              "nullable": true
             }
-          ]
+          },
+          "generateName": {
+            "type": "string",
+            "description": "The name field will be generated automatically according to the given generateName field"
+          },
+          "labels": {
+            "type": "object",
+            "additionalProperties": {
+              "type": "string"
+            }
+          },
+          "name": {
+            "type": "string",
+            "description": "Metadata name"
+          },
+          "version": {
+            "type": "integer",
+            "format": "int64",
+            "nullable": true
+          }
         }
       },
-      "License": {
+      "MoveOperation": {
+        "required": [
+          "op",
+          "from",
+          "path"
+        ],
         "type": "object",
         "properties": {
-          "name": {
-            "type": "string"
+          "from": {
+            "pattern": "^(/[^/~]*(~[01][^/~]*)*)*$",
+            "type": "string",
+            "description": "A JSON Pointer path pointing to the location to move/copy from.",
+            "example": "/a/b/c"
           },
-          "url": {
-            "type": "string"
+          "op": {
+            "type": "string",
+            "enum": [
+              "move"
+            ]
+          },
+          "path": {
+            "pattern": "^(/[^/~]*(~[01][^/~]*)*)*$",
+            "type": "string",
+            "description": "A JSON Pointer path pointing to the location to move/copy from.",
+            "example": "/a/b/c"
           }
         }
       },
-      "LocalThumbnail": {
+      "Notification": {
         "required": [
           "apiVersion",
           "kind",
-          "metadata",
-          "spec"
+          "metadata"
         ],
         "type": "object",
         "properties": {
@@ -10065,14 +12019,11 @@
             "$ref": "#/components/schemas/Metadata"
           },
           "spec": {
-            "$ref": "#/components/schemas/LocalThumbnailSpec"
-          },
-          "status": {
-            "$ref": "#/components/schemas/LocalThumbnailStatus"
+            "$ref": "#/components/schemas/NotificationSpec"
           }
         }
       },
-      "LocalThumbnailList": {
+      "NotificationList": {
         "required": [
           "first",
           "hasNext",
@@ -10102,7 +12053,7 @@
             "type": "array",
             "description": "A chunk of items.",
             "items": {
-              "$ref": "#/components/schemas/LocalThumbnail"
+              "$ref": "#/components/schemas/Notification"
             }
           },
           "last": {
@@ -10131,116 +12082,50 @@
           }
         }
       },
-      "LocalThumbnailSpec": {
+      "NotificationSpec": {
         "required": [
-          "filePath",
-          "imageSignature",
-          "imageUri",
-          "size",
-          "thumbSignature",
-          "thumbnailUri"
+          "htmlContent",
+          "rawContent",
+          "reason",
+          "recipient",
+          "title"
         ],
         "type": "object",
         "properties": {
-          "filePath": {
-            "type": "string"
-          },
-          "imageSignature": {
-            "minLength": 1,
-            "type": "string"
-          },
-          "imageUri": {
-            "minLength": 1,
+          "htmlContent": {
             "type": "string"
           },
-          "size": {
+          "lastReadAt": {
             "type": "string",
-            "enum": [
-              "S",
-              "M",
-              "L",
-              "XL"
-            ]
+            "format": "date-time"
           },
-          "thumbSignature": {
-            "minLength": 1,
+          "rawContent": {
             "type": "string"
           },
-          "thumbnailUri": {
+          "reason": {
             "minLength": 1,
-            "type": "string"
-          }
-        }
-      },
-      "LocalThumbnailStatus": {
-        "type": "object",
-        "properties": {
-          "phase": {
-            "type": "string",
-            "enum": [
-              "PENDING",
-              "SUCCEEDED",
-              "FAILED"
-            ]
-          }
-        }
-      },
-      "LoginHistory": {
-        "required": [
-          "loginAt",
-          "sourceIp",
-          "successful",
-          "userAgent"
-        ],
-        "type": "object",
-        "properties": {
-          "loginAt": {
             "type": "string",
-            "format": "date-time"
+            "description": "The name of reason"
           },
-          "reason": {
-            "type": "string"
+          "recipient": {
+            "minLength": 1,
+            "type": "string",
+            "description": "The name of user"
           },
-          "sourceIp": {
+          "title": {
+            "minLength": 1,
             "type": "string"
           },
-          "successful": {
+          "unread": {
             "type": "boolean"
-          },
-          "userAgent": {
-            "type": "string"
-          }
-        }
-      },
-      "Menu": {
-        "required": [
-          "apiVersion",
-          "kind",
-          "metadata",
-          "spec"
-        ],
-        "type": "object",
-        "properties": {
-          "apiVersion": {
-            "type": "string"
-          },
-          "kind": {
-            "type": "string"
-          },
-          "metadata": {
-            "$ref": "#/components/schemas/Metadata"
-          },
-          "spec": {
-            "$ref": "#/components/schemas/MenuSpec"
           }
         }
       },
-      "MenuItem": {
+      "NotificationTemplate": {
         "required": [
           "apiVersion",
           "kind",
-          "metadata",
-          "spec"
+          "metadata"
         ],
         "type": "object",
         "properties": {
@@ -10254,14 +12139,11 @@
             "$ref": "#/components/schemas/Metadata"
           },
           "spec": {
-            "$ref": "#/components/schemas/MenuItemSpec"
-          },
-          "status": {
-            "$ref": "#/components/schemas/MenuItemStatus"
+            "$ref": "#/components/schemas/NotificationTemplateSpec"
           }
         }
       },
-      "MenuItemList": {
+      "NotificationTemplateList": {
         "required": [
           "first",
           "hasNext",
@@ -10291,7 +12173,7 @@
             "type": "array",
             "description": "A chunk of items.",
             "items": {
-              "$ref": "#/components/schemas/MenuItem"
+              "$ref": "#/components/schemas/NotificationTemplate"
             }
           },
           "last": {
@@ -10320,62 +12202,40 @@
           }
         }
       },
-      "MenuItemSpec": {
+      "NotificationTemplateSpec": {
         "type": "object",
         "properties": {
-          "children": {
-            "uniqueItems": true,
-            "type": "array",
-            "description": "Children of this menu item",
-            "items": {
-              "type": "string",
-              "description": "The name of menu item child"
-            }
-          },
-          "displayName": {
-            "type": "string",
-            "description": "The display name of menu item."
-          },
-          "href": {
-            "type": "string",
-            "description": "The href of this menu item."
-          },
-          "priority": {
-            "type": "integer",
-            "description": "The priority is for ordering.",
-            "format": "int32"
-          },
-          "target": {
-            "type": "string",
-            "description": "The \u003ca\u003e target attribute of this menu item.",
-            "enum": [
-              "_blank",
-              "_self",
-              "_parent",
-              "_top"
-            ]
+          "reasonSelector": {
+            "$ref": "#/components/schemas/ReasonSelector"
           },
-          "targetRef": {
-            "$ref": "#/components/schemas/Ref"
+          "template": {
+            "$ref": "#/components/schemas/TemplateContent"
           }
-        },
-        "description": "The spec of menu item."
+        }
       },
-      "MenuItemStatus": {
+      "NotifierDescriptor": {
+        "required": [
+          "apiVersion",
+          "kind",
+          "metadata"
+        ],
         "type": "object",
         "properties": {
-          "displayName": {
-            "type": "string",
-            "description": "Calculated Display name of menu item."
+          "apiVersion": {
+            "type": "string"
           },
-          "href": {
-            "type": "string",
-            "description": "Calculated href of manu item."
+          "kind": {
+            "type": "string"
+          },
+          "metadata": {
+            "$ref": "#/components/schemas/Metadata"
+          },
+          "spec": {
+            "$ref": "#/components/schemas/NotifierDescriptorSpec"
           }
-        },
-        "description": "The status of menu item."
+        }
       },
-      "MenuList": {
+      "NotifierDescriptorList": {
         "required": [
           "first",
           "hasNext",
@@ -10405,7 +12265,7 @@
             "type": "array",
             "description": "A chunk of items.",
             "items": {
-              "$ref": "#/components/schemas/Menu"
+              "$ref": "#/components/schemas/NotifierDescriptor"
             }
           },
           "last": {
@@ -10434,105 +12294,44 @@
           }
         }
       },
-      "MenuSpec": {
-        "required": [
-          "displayName"
-        ],
-        "type": "object",
-        "properties": {
-          "displayName": {
-            "type": "string",
-            "description": "The display name of the menu."
-          },
-          "menuItems": {
-            "uniqueItems": true,
-            "type": "array",
-            "description": "Names of menu children below this menu.",
-            "items": {
-              "type": "string",
-              "description": "Names of menu children below this menu."
-            }
-          }
-        },
-        "description": "The spec of menu."
-      },
-      "Metadata": {
+      "NotifierDescriptorSpec": {
         "required": [
-          "name"
+          "displayName",
+          "notifierExtName"
         ],
         "type": "object",
         "properties": {
-          "annotations": {
-            "type": "object",
-            "additionalProperties": {
-              "type": "string"
-            }
-          },
-          "creationTimestamp": {
-            "type": "string",
-            "format": "date-time",
-            "nullable": true
-          },
-          "deletionTimestamp": {
-            "type": "string",
-            "format": "date-time",
-            "nullable": true
-          },
-          "finalizers": {
-            "uniqueItems": true,
-            "type": "array",
-            "nullable": true,
-            "items": {
-              "type": "string",
-              "nullable": true
-            }
+          "description": {
+            "type": "string"
           },
-          "generateName": {
-            "type": "string",
-            "description": "The name field will be generated automatically according to the given generateName field"
+          "displayName": {
+            "minLength": 1,
+            "type": "string"
           },
-          "labels": {
-            "type": "object",
-            "additionalProperties": {
-              "type": "string"
-            }
+          "notifierExtName": {
+            "minLength": 1,
+            "type": "string"
           },
-          "name": {
-            "type": "string",
-            "description": "Metadata name"
+          "receiverSettingRef": {
+            "$ref": "#/components/schemas/NotifierSettingRef"
           },
-          "version": {
-            "type": "integer",
-            "format": "int64",
-            "nullable": true
+          "senderSettingRef": {
+            "$ref": "#/components/schemas/NotifierSettingRef"
           }
         }
       },
-      "MoveOperation": {
+      "NotifierSettingRef": {
         "required": [
-          "op",
-          "from",
-          "path"
+          "group",
+          "name"
         ],
         "type": "object",
         "properties": {
-          "from": {
-            "pattern": "^(/[^/~]*(~[01][^/~]*)*)*$",
-            "type": "string",
-            "description": "A JSON Pointer path pointing to the location to move/copy from.",
-            "example": "/a/b/c"
-          },
-          "op": {
-            "type": "string",
-            "enum": [
-              "move"
-            ]
+          "group": {
+            "type": "string"
           },
-          "path": {
-            "pattern": "^(/[^/~]*(~[01][^/~]*)*)*$",
-            "type": "string",
-            "description": "A JSON Pointer path pointing to the location to move/copy from.",
-            "example": "/a/b/c"
+          "name": {
+            "type": "string"
           }
         }
       },
@@ -10883,12 +12682,245 @@
               "UNKNOWN"
             ]
           },
-          "stylesheet": {
+          "stylesheet": {
+            "type": "string"
+          }
+        }
+      },
+      "Policy": {
+        "required": [
+          "apiVersion",
+          "kind",
+          "metadata",
+          "spec"
+        ],
+        "type": "object",
+        "properties": {
+          "apiVersion": {
+            "type": "string"
+          },
+          "kind": {
+            "type": "string"
+          },
+          "metadata": {
+            "$ref": "#/components/schemas/Metadata"
+          },
+          "spec": {
+            "$ref": "#/components/schemas/PolicySpec"
+          }
+        }
+      },
+      "PolicyList": {
+        "required": [
+          "first",
+          "hasNext",
+          "hasPrevious",
+          "items",
+          "last",
+          "page",
+          "size",
+          "total",
+          "totalPages"
+        ],
+        "type": "object",
+        "properties": {
+          "first": {
+            "type": "boolean",
+            "description": "Indicates whether current page is the first page."
+          },
+          "hasNext": {
+            "type": "boolean",
+            "description": "Indicates whether current page has previous page."
+          },
+          "hasPrevious": {
+            "type": "boolean",
+            "description": "Indicates whether current page has previous page."
+          },
+          "items": {
+            "type": "array",
+            "description": "A chunk of items.",
+            "items": {
+              "$ref": "#/components/schemas/Policy"
+            }
+          },
+          "last": {
+            "type": "boolean",
+            "description": "Indicates whether current page is the last page."
+          },
+          "page": {
+            "type": "integer",
+            "description": "Page number, starts from 1. If not set or equal to 0, it means no pagination.",
+            "format": "int32"
+          },
+          "size": {
+            "type": "integer",
+            "description": "Size of each page. If not set or equal to 0, it means no pagination.",
+            "format": "int32"
+          },
+          "total": {
+            "type": "integer",
+            "description": "Total elements.",
+            "format": "int64"
+          },
+          "totalPages": {
+            "type": "integer",
+            "description": "Indicates total pages.",
+            "format": "int64"
+          }
+        }
+      },
+      "PolicyRule": {
+        "type": "object",
+        "properties": {
+          "apiGroups": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "nonResourceURLs": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "resourceNames": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "resources": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "verbs": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          }
+        }
+      },
+      "PolicySpec": {
+        "required": [
+          "displayName",
+          "templateName"
+        ],
+        "type": "object",
+        "properties": {
+          "configMapName": {
+            "type": "string",
+            "description": "Reference name of ConfigMap extension"
+          },
+          "displayName": {
+            "type": "string",
+            "description": "Display name of policy"
+          },
+          "templateName": {
+            "type": "string",
+            "description": "Reference name of PolicyTemplate"
+          }
+        }
+      },
+      "PolicyTemplate": {
+        "required": [
+          "apiVersion",
+          "kind",
+          "metadata"
+        ],
+        "type": "object",
+        "properties": {
+          "apiVersion": {
+            "type": "string"
+          },
+          "kind": {
+            "type": "string"
+          },
+          "metadata": {
+            "$ref": "#/components/schemas/Metadata"
+          },
+          "spec": {
+            "$ref": "#/components/schemas/PolicyTemplateSpec"
+          }
+        }
+      },
+      "PolicyTemplateList": {
+        "required": [
+          "first",
+          "hasNext",
+          "hasPrevious",
+          "items",
+          "last",
+          "page",
+          "size",
+          "total",
+          "totalPages"
+        ],
+        "type": "object",
+        "properties": {
+          "first": {
+            "type": "boolean",
+            "description": "Indicates whether current page is the first page."
+          },
+          "hasNext": {
+            "type": "boolean",
+            "description": "Indicates whether current page has previous page."
+          },
+          "hasPrevious": {
+            "type": "boolean",
+            "description": "Indicates whether current page has previous page."
+          },
+          "items": {
+            "type": "array",
+            "description": "A chunk of items.",
+            "items": {
+              "$ref": "#/components/schemas/PolicyTemplate"
+            }
+          },
+          "last": {
+            "type": "boolean",
+            "description": "Indicates whether current page is the last page."
+          },
+          "page": {
+            "type": "integer",
+            "description": "Page number, starts from 1. If not set or equal to 0, it means no pagination.",
+            "format": "int32"
+          },
+          "size": {
+            "type": "integer",
+            "description": "Size of each page. If not set or equal to 0, it means no pagination.",
+            "format": "int32"
+          },
+          "total": {
+            "type": "integer",
+            "description": "Total elements.",
+            "format": "int64"
+          },
+          "totalPages": {
+            "type": "integer",
+            "description": "Indicates total pages.",
+            "format": "int64"
+          }
+        }
+      },
+      "PolicyTemplateSpec": {
+        "required": [
+          "settingName"
+        ],
+        "type": "object",
+        "properties": {
+          "displayName": {
+            "type": "string"
+          },
+          "settingName": {
             "type": "string"
           }
         }
       },
-      "Policy": {
+      "Post": {
         "required": [
           "apiVersion",
           "kind",
@@ -10907,11 +12939,14 @@
             "$ref": "#/components/schemas/Metadata"
           },
           "spec": {
-            "$ref": "#/components/schemas/PolicySpec"
+            "$ref": "#/components/schemas/PostSpec"
+          },
+          "status": {
+            "$ref": "#/components/schemas/PostStatus"
           }
         }
       },
-      "PolicyList": {
+      "PostList": {
         "required": [
           "first",
           "hasNext",
@@ -10941,7 +12976,7 @@
             "type": "array",
             "description": "A chunk of items.",
             "items": {
-              "$ref": "#/components/schemas/Policy"
+              "$ref": "#/components/schemas/Post"
             }
           },
           "last": {
@@ -10970,63 +13005,156 @@
           }
         }
       },
-      "PolicyRule": {
+      "PostSpec": {
+        "required": [
+          "allowComment",
+          "deleted",
+          "excerpt",
+          "pinned",
+          "priority",
+          "publish",
+          "slug",
+          "title",
+          "visible"
+        ],
         "type": "object",
         "properties": {
-          "apiGroups": {
+          "allowComment": {
+            "type": "boolean",
+            "default": true
+          },
+          "baseSnapshot": {
+            "type": "string"
+          },
+          "categories": {
             "type": "array",
             "items": {
               "type": "string"
             }
           },
-          "nonResourceURLs": {
+          "cover": {
+            "type": "string"
+          },
+          "deleted": {
+            "type": "boolean",
+            "default": false
+          },
+          "excerpt": {
+            "$ref": "#/components/schemas/Excerpt"
+          },
+          "headSnapshot": {
+            "type": "string"
+          },
+          "htmlMetas": {
             "type": "array",
             "items": {
-              "type": "string"
+              "type": "object",
+              "additionalProperties": {
+                "type": "string"
+              }
             }
           },
-          "resourceNames": {
+          "owner": {
+            "type": "string"
+          },
+          "pinned": {
+            "type": "boolean",
+            "default": false
+          },
+          "priority": {
+            "type": "integer",
+            "format": "int32",
+            "default": 0
+          },
+          "publish": {
+            "type": "boolean",
+            "default": false
+          },
+          "publishTime": {
+            "type": "string",
+            "format": "date-time"
+          },
+          "releaseSnapshot": {
+            "type": "string"
+          },
+          "slug": {
+            "minLength": 1,
+            "type": "string"
+          },
+          "tags": {
             "type": "array",
             "items": {
               "type": "string"
             }
           },
-          "resources": {
+          "template": {
+            "type": "string"
+          },
+          "title": {
+            "minLength": 1,
+            "type": "string"
+          },
+          "visible": {
+            "type": "string",
+            "default": "PUBLIC",
+            "enum": [
+              "PUBLIC",
+              "INTERNAL",
+              "PRIVATE"
+            ]
+          }
+        }
+      },
+      "PostStatus": {
+        "type": "object",
+        "properties": {
+          "commentsCount": {
+            "type": "integer",
+            "format": "int32"
+          },
+          "conditions": {
             "type": "array",
+            "properties": {
+              "empty": {
+                "type": "boolean"
+              }
+            },
             "items": {
-              "type": "string"
+              "$ref": "#/components/schemas/Condition"
             }
           },
-          "verbs": {
+          "contributors": {
             "type": "array",
             "items": {
               "type": "string"
             }
-          }
-        }
-      },
-      "PolicySpec": {
-        "required": [
-          "displayName",
-          "templateName"
-        ],
-        "type": "object",
-        "properties": {
-          "configMapName": {
-            "type": "string",
-            "description": "Reference name of ConfigMap extension"
           },
-          "displayName": {
-            "type": "string",
-            "description": "Display name of policy"
+          "excerpt": {
+            "type": "string"
           },
-          "templateName": {
+          "hideFromList": {
+            "type": "boolean"
+          },
+          "inProgress": {
+            "type": "boolean"
+          },
+          "lastModifyTime": {
             "type": "string",
-            "description": "Reference name of PolicyTemplate"
+            "format": "date-time"
+          },
+          "observedVersion": {
+            "type": "integer",
+            "format": "int64"
+          },
+          "permalink": {
+            "type": "string"
+          },
+          "phase": {
+            "type": "string"
           }
         }
       },
-      "PolicyTemplate": {
+      "Reason": {
         "required": [
           "apiVersion",
           "kind",
@@ -11044,11 +13172,20 @@
             "$ref": "#/components/schemas/Metadata"
           },
           "spec": {
-            "$ref": "#/components/schemas/PolicyTemplateSpec"
+            "$ref": "#/components/schemas/ReasonSpec"
           }
         }
       },
-      "PolicyTemplateList": {
+      "ReasonAttributes": {
+        "type": "object",
+        "properties": {
+          "empty": {
+            "type": "boolean"
+          }
+        },
+        "description": "Attributes used to transfer data"
+      },
+      "ReasonList": {
         "required": [
           "first",
           "hasNext",
@@ -11078,7 +13215,7 @@
             "type": "array",
             "description": "A chunk of items.",
             "items": {
-              "$ref": "#/components/schemas/PolicyTemplate"
+              "$ref": "#/components/schemas/Reason"
             }
           },
           "last": {
@@ -11107,26 +13244,76 @@
           }
         }
       },
-      "PolicyTemplateSpec": {
+      "ReasonProperty": {
         "required": [
-          "settingName"
+          "name",
+          "type"
         ],
         "type": "object",
         "properties": {
-          "displayName": {
+          "description": {
             "type": "string"
           },
-          "settingName": {
+          "name": {
+            "minLength": 1,
+            "type": "string"
+          },
+          "optional": {
+            "type": "boolean",
+            "default": false
+          },
+          "type": {
+            "minLength": 1,
             "type": "string"
           }
         }
       },
-      "Post": {
+      "ReasonSelector": {
+        "required": [
+          "language",
+          "reasonType"
+        ],
+        "type": "object",
+        "properties": {
+          "language": {
+            "minLength": 1,
+            "type": "string",
+            "default": "default"
+          },
+          "reasonType": {
+            "minLength": 1,
+            "type": "string"
+          }
+        }
+      },
+      "ReasonSpec": {
+        "required": [
+          "author",
+          "reasonType",
+          "subject"
+        ],
+        "type": "object",
+        "properties": {
+          "attributes": {
+            "$ref": "#/components/schemas/ReasonAttributes"
+          },
+          "author": {
+            "type": "string"
+          },
+          "reasonType": {
+            "type": "string"
+          },
+          "subject": {
+            "$ref": "#/components/schemas/ReasonSubject"
+          }
+        }
+      },
+      "ReasonSubject": {
         "required": [
           "apiVersion",
           "kind",
-          "metadata",
-          "spec"
+          "name",
+          "title"
         ],
         "type": "object",
         "properties": {
@@ -11136,18 +13323,40 @@
           "kind": {
             "type": "string"
           },
-          "metadata": {
-            "$ref": "#/components/schemas/Metadata"
+          "name": {
+            "type": "string"
           },
-          "spec": {
-            "$ref": "#/components/schemas/PostSpec"
+          "title": {
+            "type": "string"
           },
-          "status": {
-            "$ref": "#/components/schemas/PostStatus"
+          "url": {
+            "type": "string"
+          }
+        }
+      },
+      "ReasonType": {
+        "required": [
+          "apiVersion",
+          "kind",
+          "metadata"
+        ],
+        "type": "object",
+        "properties": {
+          "apiVersion": {
+            "type": "string"
+          },
+          "kind": {
+            "type": "string"
+          },
+          "metadata": {
+            "$ref": "#/components/schemas/Metadata"
+          },
+          "spec": {
+            "$ref": "#/components/schemas/ReasonTypeSpec"
           }
         }
       },
-      "PostList": {
+      "ReasonTypeList": {
         "required": [
           "first",
           "hasNext",
@@ -11177,7 +13386,7 @@
             "type": "array",
             "description": "A chunk of items.",
             "items": {
-              "$ref": "#/components/schemas/Post"
+              "$ref": "#/components/schemas/ReasonType"
             }
           },
           "last": {
@@ -11206,152 +13415,26 @@
           }
         }
       },
-      "PostSpec": {
+      "ReasonTypeSpec": {
         "required": [
-          "allowComment",
-          "deleted",
-          "excerpt",
-          "pinned",
-          "priority",
-          "publish",
-          "slug",
-          "title",
-          "visible"
+          "description",
+          "displayName"
         ],
         "type": "object",
         "properties": {
-          "allowComment": {
-            "type": "boolean",
-            "default": true
-          },
-          "baseSnapshot": {
-            "type": "string"
-          },
-          "categories": {
-            "type": "array",
-            "items": {
-              "type": "string"
-            }
-          },
-          "cover": {
-            "type": "string"
-          },
-          "deleted": {
-            "type": "boolean",
-            "default": false
-          },
-          "excerpt": {
-            "$ref": "#/components/schemas/Excerpt"
-          },
-          "headSnapshot": {
-            "type": "string"
-          },
-          "htmlMetas": {
-            "type": "array",
-            "items": {
-              "type": "object",
-              "additionalProperties": {
-                "type": "string"
-              }
-            }
-          },
-          "owner": {
-            "type": "string"
-          },
-          "pinned": {
-            "type": "boolean",
-            "default": false
-          },
-          "priority": {
-            "type": "integer",
-            "format": "int32",
-            "default": 0
-          },
-          "publish": {
-            "type": "boolean",
-            "default": false
-          },
-          "publishTime": {
-            "type": "string",
-            "format": "date-time"
-          },
-          "releaseSnapshot": {
-            "type": "string"
-          },
-          "slug": {
+          "description": {
             "minLength": 1,
             "type": "string"
           },
-          "tags": {
-            "type": "array",
-            "items": {
-              "type": "string"
-            }
-          },
-          "template": {
-            "type": "string"
-          },
-          "title": {
+          "displayName": {
             "minLength": 1,
             "type": "string"
           },
-          "visible": {
-            "type": "string",
-            "default": "PUBLIC",
-            "enum": [
-              "PUBLIC",
-              "INTERNAL",
-              "PRIVATE"
-            ]
-          }
-        }
-      },
-      "PostStatus": {
-        "type": "object",
-        "properties": {
-          "commentsCount": {
-            "type": "integer",
-            "format": "int32"
-          },
-          "conditions": {
-            "type": "array",
-            "properties": {
-              "empty": {
-                "type": "boolean"
-              }
-            },
-            "items": {
-              "$ref": "#/components/schemas/Condition"
-            }
-          },
-          "contributors": {
+          "properties": {
             "type": "array",
             "items": {
-              "type": "string"
+              "$ref": "#/components/schemas/ReasonProperty"
             }
-          },
-          "excerpt": {
-            "type": "string"
-          },
-          "hideFromList": {
-            "type": "boolean"
-          },
-          "inProgress": {
-            "type": "boolean"
-          },
-          "lastModifyTime": {
-            "type": "string",
-            "format": "date-time"
-          },
-          "observedVersion": {
-            "type": "integer",
-            "format": "int64"
-          },
-          "permalink": {
-            "type": "string"
-          },
-          "phase": {
-            "type": "string"
           }
         }
       },
@@ -12677,6 +14760,124 @@
           }
         }
       },
+      "Subscription": {
+        "required": [
+          "apiVersion",
+          "kind",
+          "metadata"
+        ],
+        "type": "object",
+        "properties": {
+          "apiVersion": {
+            "type": "string"
+          },
+          "kind": {
+            "type": "string"
+          },
+          "metadata": {
+            "$ref": "#/components/schemas/Metadata"
+          },
+          "spec": {
+            "$ref": "#/components/schemas/SubscriptionSpec"
+          }
+        }
+      },
+      "SubscriptionList": {
+        "required": [
+          "first",
+          "hasNext",
+          "hasPrevious",
+          "items",
+          "last",
+          "page",
+          "size",
+          "total",
+          "totalPages"
+        ],
+        "type": "object",
+        "properties": {
+          "first": {
+            "type": "boolean",
+            "description": "Indicates whether current page is the first page."
+          },
+          "hasNext": {
+            "type": "boolean",
+            "description": "Indicates whether current page has previous page."
+          },
+          "hasPrevious": {
+            "type": "boolean",
+            "description": "Indicates whether current page has previous page."
+          },
+          "items": {
+            "type": "array",
+            "description": "A chunk of items.",
+            "items": {
+              "$ref": "#/components/schemas/Subscription"
+            }
+          },
+          "last": {
+            "type": "boolean",
+            "description": "Indicates whether current page is the last page."
+          },
+          "page": {
+            "type": "integer",
+            "description": "Page number, starts from 1. If not set or equal to 0, it means no pagination.",
+            "format": "int32"
+          },
+          "size": {
+            "type": "integer",
+            "description": "Size of each page. If not set or equal to 0, it means no pagination.",
+            "format": "int32"
+          },
+          "total": {
+            "type": "integer",
+            "description": "Total elements.",
+            "format": "int64"
+          },
+          "totalPages": {
+            "type": "integer",
+            "description": "Indicates total pages.",
+            "format": "int64"
+          }
+        }
+      },
+      "SubscriptionSpec": {
+        "required": [
+          "reason",
+          "subscriber",
+          "unsubscribeToken"
+        ],
+        "type": "object",
+        "properties": {
+          "disabled": {
+            "type": "boolean",
+            "description": "Perhaps users need to unsubscribe and interact without receiving notifications again"
+          },
+          "reason": {
+            "$ref": "#/components/schemas/InterestReason"
+          },
+          "subscriber": {
+            "$ref": "#/components/schemas/SubscriptionSubscriber"
+          },
+          "unsubscribeToken": {
+            "type": "string",
+            "description": "The token to unsubscribe"
+          }
+        }
+      },
+      "SubscriptionSubscriber": {
+        "required": [
+          "name"
+        ],
+        "type": "object",
+        "properties": {
+          "name": {
+            "minLength": 1,
+            "type": "string"
+          }
+        },
+        "description": "The subscriber to be notified"
+      },
       "Tag": {
         "required": [
           "apiVersion",
@@ -12806,6 +15007,24 @@
           }
         }
       },
+      "TemplateContent": {
+        "required": [
+          "title"
+        ],
+        "type": "object",
+        "properties": {
+          "htmlBody": {
+            "type": "string"
+          },
+          "rawBody": {
+            "type": "string"
+          },
+          "title": {
+            "minLength": 1,
+            "type": "string"
+          }
+        }
+      },
       "TemplateDescriptor": {
         "required": [
           "file",
diff --git a/api-docs/openapi/v3_0/apis_public.api_v1alpha1.json b/api-docs/openapi/v3_0/apis_public.api_v1alpha1.json
index 2572b1c21b..672c4c35ce 100644
--- a/api-docs/openapi/v3_0/apis_public.api_v1alpha1.json
+++ b/api-docs/openapi/v3_0/apis_public.api_v1alpha1.json
@@ -17,10 +17,10 @@
     }
   ],
   "paths": {
-    "/apis/api.halo.run/v1alpha1/comments": {
+    "/apis/api.content.halo.run/v1alpha1/categories": {
       "get": {
-        "description": "List comments.",
-        "operationId": "ListComments",
+        "description": "Lists categories.",
+        "operationId": "queryCategories",
         "parameters": [
           {
             "description": "Page number. Default is 0.",
@@ -41,9 +41,9 @@
             }
           },
           {
-            "description": "Sorting criteria in the format: property,(asc|desc). Default sort order is ascending. Multiple sort criteria are supported.",
+            "description": "Label selector. e.g.: hidden!\u003dtrue",
             "in": "query",
-            "name": "sort",
+            "name": "labelSelector",
             "schema": {
               "type": "array",
               "items": {
@@ -52,55 +52,25 @@
             }
           },
           {
-            "description": "The comment subject group.",
-            "in": "query",
-            "name": "group",
-            "schema": {
-              "type": "string"
-            }
-          },
-          {
-            "description": "The comment subject version.",
-            "in": "query",
-            "name": "version",
-            "required": true,
-            "schema": {
-              "type": "string"
-            }
-          },
-          {
-            "description": "The comment subject kind.",
-            "in": "query",
-            "name": "kind",
-            "required": true,
-            "schema": {
-              "type": "string"
-            }
-          },
-          {
-            "description": "The comment subject name.",
-            "in": "query",
-            "name": "name",
-            "required": true,
-            "schema": {
-              "type": "string"
-            }
-          },
-          {
-            "description": "Whether to include replies. Default is false.",
+            "description": "Field selector. e.g.: metadata.name\u003d\u003dhalo",
             "in": "query",
-            "name": "withReplies",
+            "name": "fieldSelector",
             "schema": {
-              "type": "boolean"
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
             }
           },
           {
-            "description": "Reply size of the comment, default is 10, only works when withReplies is true.",
+            "description": "Sorting criteria in the format: property,(asc|desc). Default sort order is ascending. Multiple sort criteria are supported.",
             "in": "query",
-            "name": "replySize",
+            "name": "sort",
             "schema": {
-              "type": "integer",
-              "format": "int32"
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
             }
           }
         ],
@@ -109,36 +79,7 @@
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/CommentWithReplyVoList"
-                }
-              }
-            },
-            "description": "default response"
-          }
-        },
-        "tags": [
-          "CommentV1alpha1Public"
-        ]
-      },
-      "post": {
-        "description": "Create a comment.",
-        "operationId": "CreateComment",
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/CommentRequest"
-              }
-            }
-          },
-          "required": true
-        },
-        "responses": {
-          "default": {
-            "content": {
-              "*/*": {
-                "schema": {
-                  "$ref": "#/components/schemas/Comment"
+                  "$ref": "#/components/schemas/CategoryVoList"
                 }
               }
             },
@@ -146,16 +87,17 @@
           }
         },
         "tags": [
-          "CommentV1alpha1Public"
+          "CategoryV1alpha1Public"
         ]
       }
     },
-    "/apis/api.halo.run/v1alpha1/comments/{name}": {
+    "/apis/api.content.halo.run/v1alpha1/categories/{name}": {
       "get": {
-        "description": "Get a comment.",
-        "operationId": "GetComment",
+        "description": "Gets category by name.",
+        "operationId": "queryCategoryByName",
         "parameters": [
           {
+            "description": "Category name",
             "in": "path",
             "name": "name",
             "required": true,
@@ -169,7 +111,7 @@
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/CommentVoList"
+                  "$ref": "#/components/schemas/CategoryVo"
                 }
               }
             },
@@ -177,16 +119,17 @@
           }
         },
         "tags": [
-          "CommentV1alpha1Public"
+          "CategoryV1alpha1Public"
         ]
       }
     },
-    "/apis/api.halo.run/v1alpha1/comments/{name}/reply": {
+    "/apis/api.content.halo.run/v1alpha1/categories/{name}/posts": {
       "get": {
-        "description": "List comment replies.",
-        "operationId": "ListCommentReplies",
+        "description": "Lists posts by category name.",
+        "operationId": "queryPostsByCategoryName",
         "parameters": [
           {
+            "description": "Category name",
             "in": "path",
             "name": "name",
             "required": true,
@@ -211,84 +154,47 @@
               "type": "integer",
               "format": "int32"
             }
-          }
-        ],
-        "responses": {
-          "default": {
-            "content": {
-              "*/*": {
-                "schema": {
-                  "$ref": "#/components/schemas/ReplyVoList"
-                }
-              }
-            },
-            "description": "default response"
-          }
-        },
-        "tags": [
-          "CommentV1alpha1Public"
-        ]
-      },
-      "post": {
-        "description": "Create a reply.",
-        "operationId": "CreateReply",
-        "parameters": [
+          },
           {
-            "in": "path",
-            "name": "name",
-            "required": true,
+            "description": "Label selector. e.g.: hidden!\u003dtrue",
+            "in": "query",
+            "name": "labelSelector",
             "schema": {
-              "type": "string"
-            }
-          }
-        ],
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/ReplyRequest"
+              "type": "array",
+              "items": {
+                "type": "string"
               }
             }
           },
-          "required": true
-        },
-        "responses": {
-          "default": {
-            "content": {
-              "*/*": {
-                "schema": {
-                  "$ref": "#/components/schemas/Reply"
-                }
-              }
-            },
-            "description": "default response"
-          }
-        },
-        "tags": [
-          "CommentV1alpha1Public"
-        ]
-      }
-    },
-    "/apis/api.halo.run/v1alpha1/indices/-/search": {
-      "post": {
-        "description": "Search indices.",
-        "operationId": "IndicesSearch",
-        "requestBody": {
-          "content": {
-            "*/*": {
-              "schema": {
-                "$ref": "#/components/schemas/SearchOption"
+          {
+            "description": "Field selector. e.g.: metadata.name\u003d\u003dhalo",
+            "in": "query",
+            "name": "fieldSelector",
+            "schema": {
+              "type": "array",
+              "items": {
+                "type": "string"
               }
             }
           },
-          "description": "Please note that the \"filterPublished\", \"filterExposed\" and \"filterRecycled\" fields are ignored in this endpoint."
-        },
+          {
+            "description": "Sorting criteria in the format: property,(asc|desc). Default sort order is ascending. Multiple sort criteria are supported.",
+            "in": "query",
+            "name": "sort",
+            "schema": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          }
+        ],
         "responses": {
           "default": {
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/SearchResult"
+                  "$ref": "#/components/schemas/ListedPostVoList"
                 }
               }
             },
@@ -296,48 +202,64 @@
           }
         },
         "tags": [
-          "IndexV1alpha1Public"
+          "CategoryV1alpha1Public"
         ]
       }
     },
-    "/apis/api.halo.run/v1alpha1/indices/post": {
+    "/apis/api.content.halo.run/v1alpha1/posts": {
       "get": {
-        "deprecated": true,
-        "description": "Search posts with fuzzy query. This method is deprecated, please use POST /indices/-/search instead.",
-        "operationId": "SearchPost",
+        "description": "Lists posts.",
+        "operationId": "queryPosts",
         "parameters": [
           {
-            "description": "Keyword to search",
+            "description": "Page number. Default is 0.",
             "in": "query",
-            "name": "keyword",
-            "required": true,
+            "name": "page",
             "schema": {
-              "type": "string"
+              "type": "integer",
+              "format": "int32"
             }
           },
           {
-            "description": "Limit of search results",
+            "description": "Size number. Default is 0.",
             "in": "query",
-            "name": "limit",
+            "name": "size",
             "schema": {
               "type": "integer",
               "format": "int32"
             }
           },
           {
-            "description": "Highlight pre tag",
+            "description": "Label selector. e.g.: hidden!\u003dtrue",
             "in": "query",
-            "name": "highlightPreTag",
+            "name": "labelSelector",
             "schema": {
-              "type": "string"
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
             }
           },
           {
-            "description": "Highlight post tag",
+            "description": "Field selector. e.g.: metadata.name\u003d\u003dhalo",
             "in": "query",
-            "name": "highlightPostTag",
+            "name": "fieldSelector",
             "schema": {
-              "type": "string"
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          },
+          {
+            "description": "Sorting criteria in the format: property,(asc|desc). Default sort order is ascending. Multiple sort criteria are supported.",
+            "in": "query",
+            "name": "sort",
+            "schema": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
             }
           }
         ],
@@ -346,7 +268,7 @@
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/SearchResult"
+                  "$ref": "#/components/schemas/ListedPostVoList"
                 }
               }
             },
@@ -354,20 +276,31 @@
           }
         },
         "tags": [
-          "IndexV1alpha1Public"
+          "PostV1alpha1Public"
         ]
       }
     },
-    "/apis/api.halo.run/v1alpha1/menus/-": {
+    "/apis/api.content.halo.run/v1alpha1/posts/{name}": {
       "get": {
-        "description": "Gets primary menu.",
-        "operationId": "queryPrimaryMenu",
+        "description": "Gets a post by name.",
+        "operationId": "queryPostByName",
+        "parameters": [
+          {
+            "description": "Post name",
+            "in": "path",
+            "name": "name",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
         "responses": {
           "default": {
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/MenuVo"
+                  "$ref": "#/components/schemas/PostVo"
                 }
               }
             },
@@ -375,17 +308,17 @@
           }
         },
         "tags": [
-          "MenuV1alpha1Public"
+          "PostV1alpha1Public"
         ]
       }
     },
-    "/apis/api.halo.run/v1alpha1/menus/{name}": {
+    "/apis/api.content.halo.run/v1alpha1/posts/{name}/navigation": {
       "get": {
-        "description": "Gets menu by name.",
-        "operationId": "queryMenuByName",
+        "description": "Gets a post navigation by name.",
+        "operationId": "queryPostNavigationByName",
         "parameters": [
           {
-            "description": "Menu name",
+            "description": "Post name",
             "in": "path",
             "name": "name",
             "required": true,
@@ -399,7 +332,7 @@
             "content": {
               "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/MenuVo"
+                  "$ref": "#/components/schemas/NavigationPostVo"
                 }
               }
             },
@@ -407,20 +340,73 @@
           }
         },
         "tags": [
-          "MenuV1alpha1Public"
+          "PostV1alpha1Public"
         ]
       }
     },
-    "/apis/api.halo.run/v1alpha1/stats/-": {
+    "/apis/api.content.halo.run/v1alpha1/singlepages": {
       "get": {
-        "description": "Gets site stats",
-        "operationId": "queryStats",
-        "responses": {
-          "default": {
-            "content": {
-              "*/*": {
+        "description": "Lists single pages",
+        "operationId": "querySinglePages",
+        "parameters": [
+          {
+            "description": "Page number. Default is 0.",
+            "in": "query",
+            "name": "page",
+            "schema": {
+              "type": "integer",
+              "format": "int32"
+            }
+          },
+          {
+            "description": "Size number. Default is 0.",
+            "in": "query",
+            "name": "size",
+            "schema": {
+              "type": "integer",
+              "format": "int32"
+            }
+          },
+          {
+            "description": "Label selector. e.g.: hidden!\u003dtrue",
+            "in": "query",
+            "name": "labelSelector",
+            "schema": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          },
+          {
+            "description": "Field selector. e.g.: metadata.name\u003d\u003dhalo",
+            "in": "query",
+            "name": "fieldSelector",
+            "schema": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          },
+          {
+            "description": "Sorting criteria in the format: property,(asc|desc). Default sort order is ascending. Multiple sort criteria are supported.",
+            "in": "query",
+            "name": "sort",
+            "schema": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          }
+        ],
+        "responses": {
+          "default": {
+            "content": {
+              "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/SiteStatsVo"
+                  "$ref": "#/components/schemas/ListedSinglePageVoList"
                 }
               }
             },
@@ -428,344 +414,1631 @@
           }
         },
         "tags": [
-          "SystemV1alpha1Public"
+          "SinglePageV1alpha1Public"
         ]
       }
     },
-    "/apis/api.halo.run/v1alpha1/trackers/counter": {
-      "post": {
-        "description": "Count an extension resource visits.",
-        "operationId": "count",
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/CounterRequest"
-              }
+    "/apis/api.content.halo.run/v1alpha1/singlepages/{name}": {
+      "get": {
+        "description": "Gets single page by name",
+        "operationId": "querySinglePageByName",
+        "parameters": [
+          {
+            "description": "SinglePage name",
+            "in": "path",
+            "name": "name",
+            "required": true,
+            "schema": {
+              "type": "string"
             }
-          },
-          "required": true
-        },
+          }
+        ],
         "responses": {
           "default": {
-            "content": {},
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/SinglePageVo"
+                }
+              }
+            },
             "description": "default response"
           }
         },
         "tags": [
-          "MetricsV1alpha1Public"
+          "SinglePageV1alpha1Public"
         ]
       }
     },
-    "/apis/api.halo.run/v1alpha1/trackers/downvote": {
-      "post": {
-        "description": "Downvote an extension resource.",
-        "operationId": "downvote",
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/VoteRequest"
+    "/apis/api.content.halo.run/v1alpha1/tags": {
+      "get": {
+        "description": "Lists tags",
+        "operationId": "queryTags",
+        "parameters": [
+          {
+            "description": "Page number. Default is 0.",
+            "in": "query",
+            "name": "page",
+            "schema": {
+              "type": "integer",
+              "format": "int32"
+            }
+          },
+          {
+            "description": "Size number. Default is 0.",
+            "in": "query",
+            "name": "size",
+            "schema": {
+              "type": "integer",
+              "format": "int32"
+            }
+          },
+          {
+            "description": "Label selector. e.g.: hidden!\u003dtrue",
+            "in": "query",
+            "name": "labelSelector",
+            "schema": {
+              "type": "array",
+              "items": {
+                "type": "string"
               }
             }
           },
-          "required": true
+          {
+            "description": "Field selector. e.g.: metadata.name\u003d\u003dhalo",
+            "in": "query",
+            "name": "fieldSelector",
+            "schema": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          },
+          {
+            "description": "Sorting criteria in the format: property,(asc|desc). Default sort order is ascending. Multiple sort criteria are supported.",
+            "in": "query",
+            "name": "sort",
+            "schema": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          }
+        ],
+        "responses": {
+          "default": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/TagVoList"
+                }
+              }
+            },
+            "description": "default response"
+          }
         },
+        "tags": [
+          "TagV1alpha1Public"
+        ]
+      }
+    },
+    "/apis/api.content.halo.run/v1alpha1/tags/{name}": {
+      "get": {
+        "description": "Gets tag by name",
+        "operationId": "queryTagByName",
+        "parameters": [
+          {
+            "description": "Tag name",
+            "in": "path",
+            "name": "name",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
         "responses": {
           "default": {
-            "content": {},
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/TagVo"
+                }
+              }
+            },
             "description": "default response"
           }
         },
         "tags": [
-          "MetricsV1alpha1Public"
+          "TagV1alpha1Public"
         ]
       }
     },
-    "/apis/api.halo.run/v1alpha1/trackers/upvote": {
-      "post": {
-        "description": "Upvote an extension resource.",
-        "operationId": "upvote",
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/VoteRequest"
+    "/apis/api.content.halo.run/v1alpha1/tags/{name}/posts": {
+      "get": {
+        "description": "Lists posts by tag name",
+        "operationId": "queryPostsByTagName",
+        "parameters": [
+          {
+            "description": "Tag name",
+            "in": "path",
+            "name": "name",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "description": "Page number. Default is 0.",
+            "in": "query",
+            "name": "page",
+            "schema": {
+              "type": "integer",
+              "format": "int32"
+            }
+          },
+          {
+            "description": "Size number. Default is 0.",
+            "in": "query",
+            "name": "size",
+            "schema": {
+              "type": "integer",
+              "format": "int32"
+            }
+          },
+          {
+            "description": "Label selector. e.g.: hidden!\u003dtrue",
+            "in": "query",
+            "name": "labelSelector",
+            "schema": {
+              "type": "array",
+              "items": {
+                "type": "string"
               }
             }
           },
-          "required": true
-        },
+          {
+            "description": "Field selector. e.g.: metadata.name\u003d\u003dhalo",
+            "in": "query",
+            "name": "fieldSelector",
+            "schema": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          },
+          {
+            "description": "Sorting criteria in the format: property,(asc|desc). Default sort order is ascending. Multiple sort criteria are supported.",
+            "in": "query",
+            "name": "sort",
+            "schema": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          }
+        ],
         "responses": {
           "default": {
-            "content": {},
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/ListedPostVo"
+                }
+              }
+            },
             "description": "default response"
           }
         },
         "tags": [
-          "MetricsV1alpha1Public"
+          "TagV1alpha1Public"
         ]
       }
-    }
-  },
-  "components": {
-    "schemas": {
-      "AddOperation": {
-        "required": [
+    },
+    "/apis/api.halo.run/v1alpha1/comments": {
+      "get": {
+        "description": "List comments.",
+        "operationId": "ListComments",
+        "parameters": [
+          {
+            "description": "Page number. Default is 0.",
+            "in": "query",
+            "name": "page",
+            "schema": {
+              "type": "integer",
+              "format": "int32"
+            }
+          },
+          {
+            "description": "Size number. Default is 0.",
+            "in": "query",
+            "name": "size",
+            "schema": {
+              "type": "integer",
+              "format": "int32"
+            }
+          },
+          {
+            "description": "Sorting criteria in the format: property,(asc|desc). Default sort order is ascending. Multiple sort criteria are supported.",
+            "in": "query",
+            "name": "sort",
+            "schema": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          },
+          {
+            "description": "The comment subject group.",
+            "in": "query",
+            "name": "group",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "description": "The comment subject version.",
+            "in": "query",
+            "name": "version",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "description": "The comment subject kind.",
+            "in": "query",
+            "name": "kind",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "description": "The comment subject name.",
+            "in": "query",
+            "name": "name",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "description": "Whether to include replies. Default is false.",
+            "in": "query",
+            "name": "withReplies",
+            "schema": {
+              "type": "boolean"
+            }
+          },
+          {
+            "description": "Reply size of the comment, default is 10, only works when withReplies is true.",
+            "in": "query",
+            "name": "replySize",
+            "schema": {
+              "type": "integer",
+              "format": "int32"
+            }
+          }
+        ],
+        "responses": {
+          "default": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/CommentWithReplyVoList"
+                }
+              }
+            },
+            "description": "default response"
+          }
+        },
+        "tags": [
+          "CommentV1alpha1Public"
+        ]
+      },
+      "post": {
+        "description": "Create a comment.",
+        "operationId": "CreateComment",
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/CommentRequest"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "default": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/Comment"
+                }
+              }
+            },
+            "description": "default response"
+          }
+        },
+        "tags": [
+          "CommentV1alpha1Public"
+        ]
+      }
+    },
+    "/apis/api.halo.run/v1alpha1/comments/{name}": {
+      "get": {
+        "description": "Get a comment.",
+        "operationId": "GetComment",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "name",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "default": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/CommentVoList"
+                }
+              }
+            },
+            "description": "default response"
+          }
+        },
+        "tags": [
+          "CommentV1alpha1Public"
+        ]
+      }
+    },
+    "/apis/api.halo.run/v1alpha1/comments/{name}/reply": {
+      "get": {
+        "description": "List comment replies.",
+        "operationId": "ListCommentReplies",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "name",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "description": "Page number. Default is 0.",
+            "in": "query",
+            "name": "page",
+            "schema": {
+              "type": "integer",
+              "format": "int32"
+            }
+          },
+          {
+            "description": "Size number. Default is 0.",
+            "in": "query",
+            "name": "size",
+            "schema": {
+              "type": "integer",
+              "format": "int32"
+            }
+          }
+        ],
+        "responses": {
+          "default": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/ReplyVoList"
+                }
+              }
+            },
+            "description": "default response"
+          }
+        },
+        "tags": [
+          "CommentV1alpha1Public"
+        ]
+      },
+      "post": {
+        "description": "Create a reply.",
+        "operationId": "CreateReply",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "name",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/ReplyRequest"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "default": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/Reply"
+                }
+              }
+            },
+            "description": "default response"
+          }
+        },
+        "tags": [
+          "CommentV1alpha1Public"
+        ]
+      }
+    },
+    "/apis/api.halo.run/v1alpha1/indices/-/search": {
+      "post": {
+        "description": "Search indices.",
+        "operationId": "IndicesSearch",
+        "requestBody": {
+          "content": {
+            "*/*": {
+              "schema": {
+                "$ref": "#/components/schemas/SearchOption"
+              }
+            }
+          },
+          "description": "Please note that the \"filterPublished\", \"filterExposed\" and \"filterRecycled\" fields are ignored in this endpoint."
+        },
+        "responses": {
+          "default": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/SearchResult"
+                }
+              }
+            },
+            "description": "default response"
+          }
+        },
+        "tags": [
+          "IndexV1alpha1Public"
+        ]
+      }
+    },
+    "/apis/api.halo.run/v1alpha1/indices/post": {
+      "get": {
+        "deprecated": true,
+        "description": "Search posts with fuzzy query. This method is deprecated, please use POST /indices/-/search instead.",
+        "operationId": "SearchPost",
+        "parameters": [
+          {
+            "description": "Keyword to search",
+            "in": "query",
+            "name": "keyword",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "description": "Limit of search results",
+            "in": "query",
+            "name": "limit",
+            "schema": {
+              "type": "integer",
+              "format": "int32"
+            }
+          },
+          {
+            "description": "Highlight pre tag",
+            "in": "query",
+            "name": "highlightPreTag",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "description": "Highlight post tag",
+            "in": "query",
+            "name": "highlightPostTag",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "default": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/SearchResult"
+                }
+              }
+            },
+            "description": "default response"
+          }
+        },
+        "tags": [
+          "IndexV1alpha1Public"
+        ]
+      }
+    },
+    "/apis/api.halo.run/v1alpha1/menus/-": {
+      "get": {
+        "description": "Gets primary menu.",
+        "operationId": "queryPrimaryMenu",
+        "responses": {
+          "default": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/MenuVo"
+                }
+              }
+            },
+            "description": "default response"
+          }
+        },
+        "tags": [
+          "MenuV1alpha1Public"
+        ]
+      }
+    },
+    "/apis/api.halo.run/v1alpha1/menus/{name}": {
+      "get": {
+        "description": "Gets menu by name.",
+        "operationId": "queryMenuByName",
+        "parameters": [
+          {
+            "description": "Menu name",
+            "in": "path",
+            "name": "name",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "default": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/MenuVo"
+                }
+              }
+            },
+            "description": "default response"
+          }
+        },
+        "tags": [
+          "MenuV1alpha1Public"
+        ]
+      }
+    },
+    "/apis/api.halo.run/v1alpha1/stats/-": {
+      "get": {
+        "description": "Gets site stats",
+        "operationId": "queryStats",
+        "responses": {
+          "default": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/SiteStatsVo"
+                }
+              }
+            },
+            "description": "default response"
+          }
+        },
+        "tags": [
+          "SystemV1alpha1Public"
+        ]
+      }
+    },
+    "/apis/api.halo.run/v1alpha1/trackers/counter": {
+      "post": {
+        "description": "Count an extension resource visits.",
+        "operationId": "count",
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/CounterRequest"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "default": {
+            "content": {},
+            "description": "default response"
+          }
+        },
+        "tags": [
+          "MetricsV1alpha1Public"
+        ]
+      }
+    },
+    "/apis/api.halo.run/v1alpha1/trackers/downvote": {
+      "post": {
+        "description": "Downvote an extension resource.",
+        "operationId": "downvote",
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/VoteRequest"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "default": {
+            "content": {},
+            "description": "default response"
+          }
+        },
+        "tags": [
+          "MetricsV1alpha1Public"
+        ]
+      }
+    },
+    "/apis/api.halo.run/v1alpha1/trackers/upvote": {
+      "post": {
+        "description": "Upvote an extension resource.",
+        "operationId": "upvote",
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/VoteRequest"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "default": {
+            "content": {},
+            "description": "default response"
+          }
+        },
+        "tags": [
+          "MetricsV1alpha1Public"
+        ]
+      }
+    },
+    "/apis/api.notification.halo.run/v1alpha1/subscriptions/{name}/unsubscribe": {
+      "get": {
+        "description": "Unsubscribe a subscription",
+        "operationId": "Unsubscribe",
+        "parameters": [
+          {
+            "description": "Subscription name",
+            "in": "path",
+            "name": "name",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "description": "Unsubscribe token",
+            "in": "query",
+            "name": "token",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "default": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "type": "string"
+                }
+              }
+            },
+            "description": "default response"
+          }
+        },
+        "tags": [
+          "NotificationV1alpha1Public"
+        ]
+      }
+    },
+    "/apis/api.plugin.halo.run/v1alpha1/plugins/{name}/available": {
+      "get": {
+        "description": "Gets plugin available by name.",
+        "operationId": "queryPluginAvailableByName",
+        "parameters": [
+          {
+            "description": "Plugin name",
+            "in": "path",
+            "name": "name",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "default": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "description": "default response"
+          }
+        },
+        "tags": [
+          "PluginV1alpha1Public"
+        ]
+      }
+    },
+    "/apis/api.storage.halo.run/v1alpha1/thumbnails/-/via-uri": {
+      "get": {
+        "description": "Get thumbnail by URI",
+        "operationId": "GetThumbnailByUri",
+        "parameters": [
+          {
+            "description": "The URI of the image",
+            "in": "query",
+            "name": "uri",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "description": "The size of the thumbnail,available values are s,m,l,xl",
+            "in": "query",
+            "name": "size",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "default": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "type": "string",
+                  "format": "binary"
+                }
+              }
+            },
+            "description": "default response"
+          }
+        },
+        "tags": [
+          "ThumbnailV1alpha1Public"
+        ]
+      }
+    }
+  },
+  "components": {
+    "schemas": {
+      "AddOperation": {
+        "required": [
           "op",
           "path",
           "value"
         ],
         "type": "object",
         "properties": {
-          "op": {
-            "type": "string",
-            "enum": [
-              "add"
-            ]
+          "op": {
+            "type": "string",
+            "enum": [
+              "add"
+            ]
+          },
+          "path": {
+            "pattern": "^(/[^/~]*(~[01][^/~]*)*)*$",
+            "type": "string",
+            "description": "A JSON Pointer path pointing to the location to move/copy from.",
+            "example": "/a/b/c"
+          },
+          "value": {
+            "description": "Value can be any JSON value"
+          }
+        }
+      },
+      "CategorySpec": {
+        "required": [
+          "displayName",
+          "priority",
+          "slug"
+        ],
+        "type": "object",
+        "properties": {
+          "children": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "cover": {
+            "type": "string"
+          },
+          "description": {
+            "type": "string"
+          },
+          "displayName": {
+            "minLength": 1,
+            "type": "string"
+          },
+          "hideFromList": {
+            "type": "boolean"
+          },
+          "postTemplate": {
+            "maxLength": 255,
+            "type": "string"
+          },
+          "preventParentPostCascadeQuery": {
+            "type": "boolean"
+          },
+          "priority": {
+            "type": "integer",
+            "format": "int32",
+            "default": 0
+          },
+          "slug": {
+            "minLength": 1,
+            "type": "string"
+          },
+          "template": {
+            "maxLength": 255,
+            "type": "string"
+          }
+        }
+      },
+      "CategoryStatus": {
+        "type": "object",
+        "properties": {
+          "permalink": {
+            "type": "string"
+          },
+          "postCount": {
+            "type": "integer",
+            "format": "int32"
+          },
+          "visiblePostCount": {
+            "type": "integer",
+            "format": "int32"
+          }
+        }
+      },
+      "CategoryVo": {
+        "required": [
+          "metadata"
+        ],
+        "type": "object",
+        "properties": {
+          "metadata": {
+            "$ref": "#/components/schemas/Metadata"
+          },
+          "postCount": {
+            "type": "integer",
+            "format": "int32"
+          },
+          "spec": {
+            "$ref": "#/components/schemas/CategorySpec"
+          },
+          "status": {
+            "$ref": "#/components/schemas/CategoryStatus"
+          }
+        }
+      },
+      "CategoryVoList": {
+        "required": [
+          "first",
+          "hasNext",
+          "hasPrevious",
+          "items",
+          "last",
+          "page",
+          "size",
+          "total",
+          "totalPages"
+        ],
+        "type": "object",
+        "properties": {
+          "first": {
+            "type": "boolean",
+            "description": "Indicates whether current page is the first page."
+          },
+          "hasNext": {
+            "type": "boolean",
+            "description": "Indicates whether current page has previous page."
+          },
+          "hasPrevious": {
+            "type": "boolean",
+            "description": "Indicates whether current page has previous page."
+          },
+          "items": {
+            "type": "array",
+            "description": "A chunk of items.",
+            "items": {
+              "$ref": "#/components/schemas/CategoryVo"
+            }
+          },
+          "last": {
+            "type": "boolean",
+            "description": "Indicates whether current page is the last page."
+          },
+          "page": {
+            "type": "integer",
+            "description": "Page number, starts from 1. If not set or equal to 0, it means no pagination.",
+            "format": "int32"
+          },
+          "size": {
+            "type": "integer",
+            "description": "Size of each page. If not set or equal to 0, it means no pagination.",
+            "format": "int32"
+          },
+          "total": {
+            "type": "integer",
+            "description": "Total elements.",
+            "format": "int64"
+          },
+          "totalPages": {
+            "type": "integer",
+            "description": "Indicates total pages.",
+            "format": "int64"
+          }
+        }
+      },
+      "Comment": {
+        "required": [
+          "apiVersion",
+          "kind",
+          "metadata",
+          "spec"
+        ],
+        "type": "object",
+        "properties": {
+          "apiVersion": {
+            "type": "string"
+          },
+          "kind": {
+            "type": "string"
+          },
+          "metadata": {
+            "$ref": "#/components/schemas/Metadata"
+          },
+          "spec": {
+            "$ref": "#/components/schemas/CommentSpec"
+          },
+          "status": {
+            "$ref": "#/components/schemas/CommentStatus"
+          }
+        }
+      },
+      "CommentEmailOwner": {
+        "type": "object",
+        "properties": {
+          "avatar": {
+            "type": "string"
+          },
+          "displayName": {
+            "type": "string"
+          },
+          "email": {
+            "type": "string"
+          },
+          "website": {
+            "type": "string"
+          }
+        }
+      },
+      "CommentOwner": {
+        "required": [
+          "kind",
+          "name"
+        ],
+        "type": "object",
+        "properties": {
+          "annotations": {
+            "type": "object",
+            "additionalProperties": {
+              "type": "string"
+            }
+          },
+          "displayName": {
+            "type": "string"
+          },
+          "kind": {
+            "minLength": 1,
+            "type": "string"
+          },
+          "name": {
+            "maxLength": 64,
+            "type": "string"
+          }
+        }
+      },
+      "CommentRequest": {
+        "required": [
+          "content",
+          "raw",
+          "subjectRef"
+        ],
+        "type": "object",
+        "properties": {
+          "allowNotification": {
+            "type": "boolean",
+            "default": false
+          },
+          "content": {
+            "minLength": 1,
+            "type": "string"
+          },
+          "owner": {
+            "$ref": "#/components/schemas/CommentEmailOwner"
+          },
+          "raw": {
+            "minLength": 1,
+            "type": "string"
+          },
+          "subjectRef": {
+            "$ref": "#/components/schemas/Ref"
+          }
+        }
+      },
+      "CommentSpec": {
+        "required": [
+          "allowNotification",
+          "approved",
+          "content",
+          "hidden",
+          "owner",
+          "priority",
+          "raw",
+          "subjectRef",
+          "top"
+        ],
+        "type": "object",
+        "properties": {
+          "allowNotification": {
+            "type": "boolean",
+            "default": true
+          },
+          "approved": {
+            "type": "boolean",
+            "default": false
+          },
+          "approvedTime": {
+            "type": "string",
+            "format": "date-time"
+          },
+          "content": {
+            "minLength": 1,
+            "type": "string"
+          },
+          "creationTime": {
+            "type": "string",
+            "format": "date-time"
+          },
+          "hidden": {
+            "type": "boolean",
+            "default": false
+          },
+          "ipAddress": {
+            "type": "string"
+          },
+          "lastReadTime": {
+            "type": "string",
+            "format": "date-time"
+          },
+          "owner": {
+            "$ref": "#/components/schemas/CommentOwner"
+          },
+          "priority": {
+            "type": "integer",
+            "format": "int32",
+            "default": 0
+          },
+          "raw": {
+            "minLength": 1,
+            "type": "string"
+          },
+          "subjectRef": {
+            "$ref": "#/components/schemas/Ref"
+          },
+          "top": {
+            "type": "boolean",
+            "default": false
+          },
+          "userAgent": {
+            "type": "string"
+          }
+        }
+      },
+      "CommentStatsVo": {
+        "type": "object",
+        "properties": {
+          "upvote": {
+            "type": "integer",
+            "format": "int32"
+          }
+        }
+      },
+      "CommentStatus": {
+        "type": "object",
+        "properties": {
+          "hasNewReply": {
+            "type": "boolean"
+          },
+          "lastReplyTime": {
+            "type": "string",
+            "format": "date-time"
+          },
+          "observedVersion": {
+            "type": "integer",
+            "format": "int64"
+          },
+          "replyCount": {
+            "type": "integer",
+            "format": "int32"
+          },
+          "unreadReplyCount": {
+            "type": "integer",
+            "format": "int32"
+          },
+          "visibleReplyCount": {
+            "type": "integer",
+            "format": "int32"
+          }
+        }
+      },
+      "CommentVo": {
+        "required": [
+          "metadata",
+          "owner",
+          "spec",
+          "stats"
+        ],
+        "type": "object",
+        "properties": {
+          "metadata": {
+            "$ref": "#/components/schemas/Metadata"
+          },
+          "owner": {
+            "$ref": "#/components/schemas/OwnerInfo"
+          },
+          "spec": {
+            "$ref": "#/components/schemas/CommentSpec"
+          },
+          "stats": {
+            "$ref": "#/components/schemas/CommentStatsVo"
+          },
+          "status": {
+            "$ref": "#/components/schemas/CommentStatus"
+          }
+        },
+        "description": "A chunk of items."
+      },
+      "CommentVoList": {
+        "required": [
+          "first",
+          "hasNext",
+          "hasPrevious",
+          "items",
+          "last",
+          "page",
+          "size",
+          "total",
+          "totalPages"
+        ],
+        "type": "object",
+        "properties": {
+          "first": {
+            "type": "boolean",
+            "description": "Indicates whether current page is the first page."
           },
-          "path": {
-            "pattern": "^(/[^/~]*(~[01][^/~]*)*)*$",
-            "type": "string",
-            "description": "A JSON Pointer path pointing to the location to move/copy from.",
-            "example": "/a/b/c"
+          "hasNext": {
+            "type": "boolean",
+            "description": "Indicates whether current page has previous page."
           },
-          "value": {
-            "description": "Value can be any JSON value"
+          "hasPrevious": {
+            "type": "boolean",
+            "description": "Indicates whether current page has previous page."
+          },
+          "items": {
+            "type": "array",
+            "description": "A chunk of items.",
+            "items": {
+              "$ref": "#/components/schemas/CommentVo"
+            }
+          },
+          "last": {
+            "type": "boolean",
+            "description": "Indicates whether current page is the last page."
+          },
+          "page": {
+            "type": "integer",
+            "description": "Page number, starts from 1. If not set or equal to 0, it means no pagination.",
+            "format": "int32"
+          },
+          "size": {
+            "type": "integer",
+            "description": "Size of each page. If not set or equal to 0, it means no pagination.",
+            "format": "int32"
+          },
+          "total": {
+            "type": "integer",
+            "description": "Total elements.",
+            "format": "int64"
+          },
+          "totalPages": {
+            "type": "integer",
+            "description": "Indicates total pages.",
+            "format": "int64"
           }
         }
       },
-      "Comment": {
+      "CommentWithReplyVo": {
         "required": [
-          "apiVersion",
-          "kind",
           "metadata",
-          "spec"
+          "owner",
+          "spec",
+          "stats"
         ],
         "type": "object",
         "properties": {
-          "apiVersion": {
-            "type": "string"
-          },
-          "kind": {
-            "type": "string"
-          },
           "metadata": {
             "$ref": "#/components/schemas/Metadata"
           },
+          "owner": {
+            "$ref": "#/components/schemas/OwnerInfo"
+          },
+          "replies": {
+            "$ref": "#/components/schemas/ListResultReplyVo"
+          },
           "spec": {
             "$ref": "#/components/schemas/CommentSpec"
           },
+          "stats": {
+            "$ref": "#/components/schemas/CommentStatsVo"
+          },
           "status": {
             "$ref": "#/components/schemas/CommentStatus"
           }
-        }
+        },
+        "description": "A chunk of items."
       },
-      "CommentEmailOwner": {
+      "CommentWithReplyVoList": {
+        "required": [
+          "first",
+          "hasNext",
+          "hasPrevious",
+          "items",
+          "last",
+          "page",
+          "size",
+          "total",
+          "totalPages"
+        ],
         "type": "object",
         "properties": {
-          "avatar": {
-            "type": "string"
+          "first": {
+            "type": "boolean",
+            "description": "Indicates whether current page is the first page."
           },
-          "displayName": {
-            "type": "string"
+          "hasNext": {
+            "type": "boolean",
+            "description": "Indicates whether current page has previous page."
           },
-          "email": {
-            "type": "string"
+          "hasPrevious": {
+            "type": "boolean",
+            "description": "Indicates whether current page has previous page."
           },
-          "website": {
-            "type": "string"
+          "items": {
+            "type": "array",
+            "description": "A chunk of items.",
+            "items": {
+              "$ref": "#/components/schemas/CommentWithReplyVo"
+            }
+          },
+          "last": {
+            "type": "boolean",
+            "description": "Indicates whether current page is the last page."
+          },
+          "page": {
+            "type": "integer",
+            "description": "Page number, starts from 1. If not set or equal to 0, it means no pagination.",
+            "format": "int32"
+          },
+          "size": {
+            "type": "integer",
+            "description": "Size of each page. If not set or equal to 0, it means no pagination.",
+            "format": "int32"
+          },
+          "total": {
+            "type": "integer",
+            "description": "Total elements.",
+            "format": "int64"
+          },
+          "totalPages": {
+            "type": "integer",
+            "description": "Indicates total pages.",
+            "format": "int64"
           }
         }
       },
-      "CommentOwner": {
+      "Condition": {
         "required": [
-          "kind",
-          "name"
+          "lastTransitionTime",
+          "status",
+          "type"
         ],
         "type": "object",
         "properties": {
-          "annotations": {
-            "type": "object",
-            "additionalProperties": {
-              "type": "string"
-            }
+          "lastTransitionTime": {
+            "type": "string",
+            "format": "date-time"
           },
-          "displayName": {
+          "message": {
+            "maxLength": 32768,
             "type": "string"
           },
-          "kind": {
-            "minLength": 1,
+          "reason": {
+            "maxLength": 1024,
+            "pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
             "type": "string"
           },
-          "name": {
-            "maxLength": 64,
+          "status": {
+            "type": "string",
+            "enum": [
+              "TRUE",
+              "FALSE",
+              "UNKNOWN"
+            ]
+          },
+          "type": {
+            "maxLength": 316,
+            "pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
             "type": "string"
           }
         }
       },
-      "CommentRequest": {
-        "required": [
-          "content",
-          "raw",
-          "subjectRef"
-        ],
+      "ContentVo": {
         "type": "object",
         "properties": {
-          "allowNotification": {
-            "type": "boolean",
-            "default": false
-          },
           "content": {
-            "minLength": 1,
             "type": "string"
           },
-          "owner": {
-            "$ref": "#/components/schemas/CommentEmailOwner"
-          },
           "raw": {
-            "minLength": 1,
             "type": "string"
-          },
-          "subjectRef": {
-            "$ref": "#/components/schemas/Ref"
           }
         }
       },
-      "CommentSpec": {
+      "ContributorVo": {
         "required": [
-          "allowNotification",
-          "approved",
-          "content",
-          "hidden",
-          "owner",
-          "priority",
-          "raw",
-          "subjectRef",
-          "top"
+          "metadata"
         ],
         "type": "object",
         "properties": {
-          "allowNotification": {
-            "type": "boolean",
-            "default": true
-          },
-          "approved": {
-            "type": "boolean",
-            "default": false
+          "avatar": {
+            "type": "string"
           },
-          "approvedTime": {
-            "type": "string",
-            "format": "date-time"
+          "bio": {
+            "type": "string"
           },
-          "content": {
-            "minLength": 1,
+          "displayName": {
             "type": "string"
           },
-          "creationTime": {
-            "type": "string",
-            "format": "date-time"
+          "metadata": {
+            "$ref": "#/components/schemas/Metadata"
           },
-          "hidden": {
-            "type": "boolean",
-            "default": false
+          "name": {
+            "type": "string"
           },
-          "ipAddress": {
+          "permalink": {
             "type": "string"
+          }
+        }
+      },
+      "CopyOperation": {
+        "required": [
+          "op",
+          "from",
+          "path"
+        ],
+        "type": "object",
+        "properties": {
+          "from": {
+            "pattern": "^(/[^/~]*(~[01][^/~]*)*)*$",
+            "type": "string",
+            "description": "A JSON Pointer path pointing to the location to move/copy from.",
+            "example": "/a/b/c"
           },
-          "lastReadTime": {
+          "op": {
             "type": "string",
-            "format": "date-time"
+            "enum": [
+              "copy"
+            ]
           },
-          "owner": {
-            "$ref": "#/components/schemas/CommentOwner"
+          "path": {
+            "pattern": "^(/[^/~]*(~[01][^/~]*)*)*$",
+            "type": "string",
+            "description": "A JSON Pointer path pointing to the location to move/copy from.",
+            "example": "/a/b/c"
+          }
+        }
+      },
+      "CounterRequest": {
+        "type": "object",
+        "properties": {
+          "group": {
+            "type": "string"
+          },
+          "hostname": {
+            "type": "string"
           },
-          "priority": {
-            "type": "integer",
-            "format": "int32",
-            "default": 0
+          "language": {
+            "type": "string"
           },
-          "raw": {
-            "minLength": 1,
+          "name": {
             "type": "string"
           },
-          "subjectRef": {
-            "$ref": "#/components/schemas/Ref"
+          "plural": {
+            "type": "string"
           },
-          "top": {
-            "type": "boolean",
-            "default": false
+          "referrer": {
+            "type": "string"
           },
-          "userAgent": {
+          "screen": {
             "type": "string"
           }
         }
       },
-      "CommentStatsVo": {
+      "Excerpt": {
+        "required": [
+          "autoGenerate"
+        ],
         "type": "object",
         "properties": {
-          "upvote": {
-            "type": "integer",
-            "format": "int32"
+          "autoGenerate": {
+            "type": "boolean",
+            "default": true
+          },
+          "raw": {
+            "type": "string"
           }
         }
       },
-      "CommentStatus": {
+      "HaloDocument": {
+        "required": [
+          "content",
+          "id",
+          "metadataName",
+          "ownerName",
+          "permalink",
+          "title",
+          "type"
+        ],
         "type": "object",
         "properties": {
-          "hasNewReply": {
-            "type": "boolean"
+          "annotations": {
+            "type": "object",
+            "additionalProperties": {
+              "type": "string"
+            }
           },
-          "lastReplyTime": {
+          "categories": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "content": {
+            "type": "string"
+          },
+          "creationTimestamp": {
             "type": "string",
             "format": "date-time"
           },
-          "observedVersion": {
-            "type": "integer",
-            "format": "int64"
+          "description": {
+            "type": "string"
           },
-          "replyCount": {
-            "type": "integer",
-            "format": "int32"
+          "exposed": {
+            "type": "boolean"
           },
-          "unreadReplyCount": {
-            "type": "integer",
-            "format": "int32"
+          "id": {
+            "type": "string"
           },
-          "visibleReplyCount": {
-            "type": "integer",
-            "format": "int32"
-          }
-        }
-      },
-      "CommentVo": {
-        "required": [
-          "metadata",
-          "owner",
-          "spec",
-          "stats"
-        ],
-        "type": "object",
-        "properties": {
-          "metadata": {
-            "$ref": "#/components/schemas/Metadata"
+          "metadataName": {
+            "type": "string"
           },
-          "owner": {
-            "$ref": "#/components/schemas/OwnerInfo"
+          "ownerName": {
+            "type": "string"
           },
-          "spec": {
-            "$ref": "#/components/schemas/CommentSpec"
+          "permalink": {
+            "type": "string"
           },
-          "stats": {
-            "$ref": "#/components/schemas/CommentStatsVo"
+          "published": {
+            "type": "boolean"
           },
-          "status": {
-            "$ref": "#/components/schemas/CommentStatus"
+          "recycled": {
+            "type": "boolean"
+          },
+          "tags": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "title": {
+            "type": "string"
+          },
+          "type": {
+            "type": "string"
+          },
+          "updateTimestamp": {
+            "type": "string",
+            "format": "date-time"
           }
-        },
-        "description": "A chunk of items."
+        }
       },
-      "CommentVoList": {
+      "JsonPatch": {
+        "minItems": 1,
+        "uniqueItems": true,
+        "type": "array",
+        "description": "JSON schema for JSONPatch operations",
+        "items": {
+          "oneOf": [
+            {
+              "$ref": "#/components/schemas/AddOperation"
+            },
+            {
+              "$ref": "#/components/schemas/ReplaceOperation"
+            },
+            {
+              "$ref": "#/components/schemas/TestOperation"
+            },
+            {
+              "$ref": "#/components/schemas/RemoveOperation"
+            },
+            {
+              "$ref": "#/components/schemas/MoveOperation"
+            },
+            {
+              "$ref": "#/components/schemas/CopyOperation"
+            }
+          ]
+        }
+      },
+      "ListResultReplyVo": {
         "required": [
           "first",
           "hasNext",
@@ -795,7 +2068,7 @@
             "type": "array",
             "description": "A chunk of items.",
             "items": {
-              "$ref": "#/components/schemas/CommentVo"
+              "$ref": "#/components/schemas/ReplyVo"
             }
           },
           "last": {
@@ -824,37 +2097,48 @@
           }
         }
       },
-      "CommentWithReplyVo": {
+      "ListedPostVo": {
         "required": [
-          "metadata",
-          "owner",
-          "spec",
-          "stats"
+          "metadata"
         ],
         "type": "object",
         "properties": {
+          "categories": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/CategoryVo"
+            }
+          },
+          "contributors": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/ContributorVo"
+            }
+          },
           "metadata": {
             "$ref": "#/components/schemas/Metadata"
           },
           "owner": {
-            "$ref": "#/components/schemas/OwnerInfo"
-          },
-          "replies": {
-            "$ref": "#/components/schemas/ListResultReplyVo"
+            "$ref": "#/components/schemas/ContributorVo"
           },
           "spec": {
-            "$ref": "#/components/schemas/CommentSpec"
+            "$ref": "#/components/schemas/PostSpec"
           },
           "stats": {
-            "$ref": "#/components/schemas/CommentStatsVo"
+            "$ref": "#/components/schemas/StatsVo"
           },
           "status": {
-            "$ref": "#/components/schemas/CommentStatus"
+            "$ref": "#/components/schemas/PostStatus"
+          },
+          "tags": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/TagVo"
+            }
           }
-        },
-        "description": "A chunk of items."
+        }
       },
-      "CommentWithReplyVoList": {
+      "ListedPostVoList": {
         "required": [
           "first",
           "hasNext",
@@ -884,7 +2168,7 @@
             "type": "array",
             "description": "A chunk of items.",
             "items": {
-              "$ref": "#/components/schemas/CommentWithReplyVo"
+              "$ref": "#/components/schemas/ListedPostVo"
             }
           },
           "last": {
@@ -901,174 +2185,49 @@
             "description": "Size of each page. If not set or equal to 0, it means no pagination.",
             "format": "int32"
           },
-          "total": {
-            "type": "integer",
-            "description": "Total elements.",
-            "format": "int64"
-          },
-          "totalPages": {
-            "type": "integer",
-            "description": "Indicates total pages.",
-            "format": "int64"
-          }
-        }
-      },
-      "CopyOperation": {
-        "required": [
-          "op",
-          "from",
-          "path"
-        ],
-        "type": "object",
-        "properties": {
-          "from": {
-            "pattern": "^(/[^/~]*(~[01][^/~]*)*)*$",
-            "type": "string",
-            "description": "A JSON Pointer path pointing to the location to move/copy from.",
-            "example": "/a/b/c"
-          },
-          "op": {
-            "type": "string",
-            "enum": [
-              "copy"
-            ]
-          },
-          "path": {
-            "pattern": "^(/[^/~]*(~[01][^/~]*)*)*$",
-            "type": "string",
-            "description": "A JSON Pointer path pointing to the location to move/copy from.",
-            "example": "/a/b/c"
-          }
-        }
-      },
-      "CounterRequest": {
-        "type": "object",
-        "properties": {
-          "group": {
-            "type": "string"
-          },
-          "hostname": {
-            "type": "string"
-          },
-          "language": {
-            "type": "string"
-          },
-          "name": {
-            "type": "string"
-          },
-          "plural": {
-            "type": "string"
-          },
-          "referrer": {
-            "type": "string"
-          },
-          "screen": {
-            "type": "string"
+          "total": {
+            "type": "integer",
+            "description": "Total elements.",
+            "format": "int64"
+          },
+          "totalPages": {
+            "type": "integer",
+            "description": "Indicates total pages.",
+            "format": "int64"
           }
         }
       },
-      "HaloDocument": {
+      "ListedSinglePageVo": {
         "required": [
-          "content",
-          "id",
-          "metadataName",
-          "ownerName",
-          "permalink",
-          "title",
-          "type"
+          "metadata"
         ],
         "type": "object",
         "properties": {
-          "annotations": {
-            "type": "object",
-            "additionalProperties": {
-              "type": "string"
-            }
-          },
-          "categories": {
+          "contributors": {
             "type": "array",
             "items": {
-              "type": "string"
+              "$ref": "#/components/schemas/ContributorVo"
             }
           },
-          "content": {
-            "type": "string"
-          },
-          "creationTimestamp": {
-            "type": "string",
-            "format": "date-time"
-          },
-          "description": {
-            "type": "string"
-          },
-          "exposed": {
-            "type": "boolean"
-          },
-          "id": {
-            "type": "string"
-          },
-          "metadataName": {
-            "type": "string"
-          },
-          "ownerName": {
-            "type": "string"
-          },
-          "permalink": {
-            "type": "string"
-          },
-          "published": {
-            "type": "boolean"
-          },
-          "recycled": {
-            "type": "boolean"
+          "metadata": {
+            "$ref": "#/components/schemas/Metadata"
           },
-          "tags": {
-            "type": "array",
-            "items": {
-              "type": "string"
-            }
+          "owner": {
+            "$ref": "#/components/schemas/ContributorVo"
           },
-          "title": {
-            "type": "string"
+          "spec": {
+            "$ref": "#/components/schemas/SinglePageSpec"
           },
-          "type": {
-            "type": "string"
+          "stats": {
+            "$ref": "#/components/schemas/StatsVo"
           },
-          "updateTimestamp": {
-            "type": "string",
-            "format": "date-time"
+          "status": {
+            "$ref": "#/components/schemas/SinglePageStatus"
           }
-        }
-      },
-      "JsonPatch": {
-        "minItems": 1,
-        "uniqueItems": true,
-        "type": "array",
-        "description": "JSON schema for JSONPatch operations",
-        "items": {
-          "oneOf": [
-            {
-              "$ref": "#/components/schemas/AddOperation"
-            },
-            {
-              "$ref": "#/components/schemas/ReplaceOperation"
-            },
-            {
-              "$ref": "#/components/schemas/TestOperation"
-            },
-            {
-              "$ref": "#/components/schemas/RemoveOperation"
-            },
-            {
-              "$ref": "#/components/schemas/MoveOperation"
-            },
-            {
-              "$ref": "#/components/schemas/CopyOperation"
-            }
-          ]
-        }
+        },
+        "description": "A chunk of items."
       },
-      "ListResultReplyVo": {
+      "ListedSinglePageVoList": {
         "required": [
           "first",
           "hasNext",
@@ -1098,7 +2257,7 @@
             "type": "array",
             "description": "A chunk of items.",
             "items": {
-              "$ref": "#/components/schemas/ReplyVo"
+              "$ref": "#/components/schemas/ListedSinglePageVo"
             }
           },
           "last": {
@@ -1324,6 +2483,20 @@
           }
         }
       },
+      "NavigationPostVo": {
+        "type": "object",
+        "properties": {
+          "current": {
+            "$ref": "#/components/schemas/PostVo"
+          },
+          "next": {
+            "$ref": "#/components/schemas/PostVo"
+          },
+          "previous": {
+            "$ref": "#/components/schemas/PostVo"
+          }
+        }
+      },
       "OwnerInfo": {
         "type": "object",
         "properties": {
@@ -1333,14 +2506,207 @@
           "displayName": {
             "type": "string"
           },
-          "email": {
-            "type": "string"
+          "email": {
+            "type": "string"
+          },
+          "kind": {
+            "type": "string"
+          },
+          "name": {
+            "type": "string"
+          }
+        }
+      },
+      "PostSpec": {
+        "required": [
+          "allowComment",
+          "deleted",
+          "excerpt",
+          "pinned",
+          "priority",
+          "publish",
+          "slug",
+          "title",
+          "visible"
+        ],
+        "type": "object",
+        "properties": {
+          "allowComment": {
+            "type": "boolean",
+            "default": true
+          },
+          "baseSnapshot": {
+            "type": "string"
+          },
+          "categories": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "cover": {
+            "type": "string"
+          },
+          "deleted": {
+            "type": "boolean",
+            "default": false
+          },
+          "excerpt": {
+            "$ref": "#/components/schemas/Excerpt"
+          },
+          "headSnapshot": {
+            "type": "string"
+          },
+          "htmlMetas": {
+            "type": "array",
+            "items": {
+              "type": "object",
+              "additionalProperties": {
+                "type": "string"
+              }
+            }
+          },
+          "owner": {
+            "type": "string"
+          },
+          "pinned": {
+            "type": "boolean",
+            "default": false
+          },
+          "priority": {
+            "type": "integer",
+            "format": "int32",
+            "default": 0
+          },
+          "publish": {
+            "type": "boolean",
+            "default": false
+          },
+          "publishTime": {
+            "type": "string",
+            "format": "date-time"
+          },
+          "releaseSnapshot": {
+            "type": "string"
+          },
+          "slug": {
+            "minLength": 1,
+            "type": "string"
+          },
+          "tags": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "template": {
+            "type": "string"
+          },
+          "title": {
+            "minLength": 1,
+            "type": "string"
+          },
+          "visible": {
+            "type": "string",
+            "default": "PUBLIC",
+            "enum": [
+              "PUBLIC",
+              "INTERNAL",
+              "PRIVATE"
+            ]
+          }
+        }
+      },
+      "PostStatus": {
+        "type": "object",
+        "properties": {
+          "commentsCount": {
+            "type": "integer",
+            "format": "int32"
+          },
+          "conditions": {
+            "type": "array",
+            "properties": {
+              "empty": {
+                "type": "boolean"
+              }
+            },
+            "items": {
+              "$ref": "#/components/schemas/Condition"
+            }
+          },
+          "contributors": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "excerpt": {
+            "type": "string"
+          },
+          "hideFromList": {
+            "type": "boolean"
+          },
+          "inProgress": {
+            "type": "boolean"
+          },
+          "lastModifyTime": {
+            "type": "string",
+            "format": "date-time"
+          },
+          "observedVersion": {
+            "type": "integer",
+            "format": "int64"
+          },
+          "permalink": {
+            "type": "string"
+          },
+          "phase": {
+            "type": "string"
+          }
+        }
+      },
+      "PostVo": {
+        "required": [
+          "metadata"
+        ],
+        "type": "object",
+        "properties": {
+          "categories": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/CategoryVo"
+            }
+          },
+          "content": {
+            "$ref": "#/components/schemas/ContentVo"
+          },
+          "contributors": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/ContributorVo"
+            }
+          },
+          "metadata": {
+            "$ref": "#/components/schemas/Metadata"
+          },
+          "owner": {
+            "$ref": "#/components/schemas/ContributorVo"
+          },
+          "spec": {
+            "$ref": "#/components/schemas/PostSpec"
+          },
+          "stats": {
+            "$ref": "#/components/schemas/StatsVo"
           },
-          "kind": {
-            "type": "string"
+          "status": {
+            "$ref": "#/components/schemas/PostStatus"
           },
-          "name": {
-            "type": "string"
+          "tags": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/TagVo"
+            }
           }
         }
       },
@@ -1718,6 +3084,175 @@
           }
         }
       },
+      "SinglePageSpec": {
+        "required": [
+          "allowComment",
+          "deleted",
+          "excerpt",
+          "pinned",
+          "priority",
+          "publish",
+          "slug",
+          "title",
+          "visible"
+        ],
+        "type": "object",
+        "properties": {
+          "allowComment": {
+            "type": "boolean",
+            "default": true
+          },
+          "baseSnapshot": {
+            "type": "string"
+          },
+          "cover": {
+            "type": "string"
+          },
+          "deleted": {
+            "type": "boolean",
+            "default": false
+          },
+          "excerpt": {
+            "$ref": "#/components/schemas/Excerpt"
+          },
+          "headSnapshot": {
+            "type": "string"
+          },
+          "htmlMetas": {
+            "type": "array",
+            "items": {
+              "type": "object",
+              "additionalProperties": {
+                "type": "string"
+              }
+            }
+          },
+          "owner": {
+            "type": "string"
+          },
+          "pinned": {
+            "type": "boolean",
+            "default": false
+          },
+          "priority": {
+            "type": "integer",
+            "format": "int32",
+            "default": 0
+          },
+          "publish": {
+            "type": "boolean",
+            "default": false
+          },
+          "publishTime": {
+            "type": "string",
+            "format": "date-time"
+          },
+          "releaseSnapshot": {
+            "type": "string"
+          },
+          "slug": {
+            "minLength": 1,
+            "type": "string"
+          },
+          "template": {
+            "type": "string"
+          },
+          "title": {
+            "minLength": 1,
+            "type": "string"
+          },
+          "visible": {
+            "type": "string",
+            "default": "PUBLIC",
+            "enum": [
+              "PUBLIC",
+              "INTERNAL",
+              "PRIVATE"
+            ]
+          }
+        }
+      },
+      "SinglePageStatus": {
+        "type": "object",
+        "properties": {
+          "commentsCount": {
+            "type": "integer",
+            "format": "int32"
+          },
+          "conditions": {
+            "type": "array",
+            "properties": {
+              "empty": {
+                "type": "boolean"
+              }
+            },
+            "items": {
+              "$ref": "#/components/schemas/Condition"
+            }
+          },
+          "contributors": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "excerpt": {
+            "type": "string"
+          },
+          "hideFromList": {
+            "type": "boolean"
+          },
+          "inProgress": {
+            "type": "boolean"
+          },
+          "lastModifyTime": {
+            "type": "string",
+            "format": "date-time"
+          },
+          "observedVersion": {
+            "type": "integer",
+            "format": "int64"
+          },
+          "permalink": {
+            "type": "string"
+          },
+          "phase": {
+            "type": "string"
+          }
+        }
+      },
+      "SinglePageVo": {
+        "required": [
+          "metadata"
+        ],
+        "type": "object",
+        "properties": {
+          "content": {
+            "$ref": "#/components/schemas/ContentVo"
+          },
+          "contributors": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/ContributorVo"
+            }
+          },
+          "metadata": {
+            "$ref": "#/components/schemas/Metadata"
+          },
+          "owner": {
+            "$ref": "#/components/schemas/ContributorVo"
+          },
+          "spec": {
+            "$ref": "#/components/schemas/SinglePageSpec"
+          },
+          "stats": {
+            "$ref": "#/components/schemas/StatsVo"
+          },
+          "status": {
+            "$ref": "#/components/schemas/SinglePageStatus"
+          }
+        }
+      },
       "SiteStatsVo": {
         "type": "object",
         "properties": {
@@ -1743,6 +3278,147 @@
           }
         }
       },
+      "StatsVo": {
+        "type": "object",
+        "properties": {
+          "comment": {
+            "type": "integer",
+            "format": "int32"
+          },
+          "upvote": {
+            "type": "integer",
+            "format": "int32"
+          },
+          "visit": {
+            "type": "integer",
+            "format": "int32"
+          }
+        }
+      },
+      "TagSpec": {
+        "required": [
+          "displayName",
+          "slug"
+        ],
+        "type": "object",
+        "properties": {
+          "color": {
+            "pattern": "^#([a-fA-F0-9]{6}|[a-fA-F0-9]{3})$",
+            "type": "string"
+          },
+          "cover": {
+            "type": "string"
+          },
+          "displayName": {
+            "minLength": 1,
+            "type": "string"
+          },
+          "slug": {
+            "minLength": 1,
+            "type": "string"
+          }
+        }
+      },
+      "TagStatus": {
+        "type": "object",
+        "properties": {
+          "observedVersion": {
+            "type": "integer",
+            "format": "int64"
+          },
+          "permalink": {
+            "type": "string"
+          },
+          "postCount": {
+            "type": "integer",
+            "format": "int32"
+          },
+          "visiblePostCount": {
+            "type": "integer",
+            "format": "int32"
+          }
+        }
+      },
+      "TagVo": {
+        "required": [
+          "metadata"
+        ],
+        "type": "object",
+        "properties": {
+          "metadata": {
+            "$ref": "#/components/schemas/Metadata"
+          },
+          "postCount": {
+            "type": "integer",
+            "format": "int32"
+          },
+          "spec": {
+            "$ref": "#/components/schemas/TagSpec"
+          },
+          "status": {
+            "$ref": "#/components/schemas/TagStatus"
+          }
+        }
+      },
+      "TagVoList": {
+        "required": [
+          "first",
+          "hasNext",
+          "hasPrevious",
+          "items",
+          "last",
+          "page",
+          "size",
+          "total",
+          "totalPages"
+        ],
+        "type": "object",
+        "properties": {
+          "first": {
+            "type": "boolean",
+            "description": "Indicates whether current page is the first page."
+          },
+          "hasNext": {
+            "type": "boolean",
+            "description": "Indicates whether current page has previous page."
+          },
+          "hasPrevious": {
+            "type": "boolean",
+            "description": "Indicates whether current page has previous page."
+          },
+          "items": {
+            "type": "array",
+            "description": "A chunk of items.",
+            "items": {
+              "$ref": "#/components/schemas/TagVo"
+            }
+          },
+          "last": {
+            "type": "boolean",
+            "description": "Indicates whether current page is the last page."
+          },
+          "page": {
+            "type": "integer",
+            "description": "Page number, starts from 1. If not set or equal to 0, it means no pagination.",
+            "format": "int32"
+          },
+          "size": {
+            "type": "integer",
+            "description": "Size of each page. If not set or equal to 0, it means no pagination.",
+            "format": "int32"
+          },
+          "total": {
+            "type": "integer",
+            "description": "Total elements.",
+            "format": "int64"
+          },
+          "totalPages": {
+            "type": "integer",
+            "description": "Indicates total pages.",
+            "format": "int64"
+          }
+        }
+      },
       "TestOperation": {
         "required": [
           "op",
diff --git a/api-docs/openapi/v3_0/apis_uc.api_v1alpha1.json b/api-docs/openapi/v3_0/apis_uc.api_v1alpha1.json
index b804cb96a8..a65865fb95 100644
--- a/api-docs/openapi/v3_0/apis_uc.api_v1alpha1.json
+++ b/api-docs/openapi/v3_0/apis_uc.api_v1alpha1.json
@@ -17,6 +17,353 @@
     }
   ],
   "paths": {
+    "/apis/api.notification.halo.run/v1alpha1/notifiers/{name}/receiver-config": {
+      "get": {
+        "description": "Fetch receiver config of notifier",
+        "operationId": "FetchReceiverConfig",
+        "parameters": [
+          {
+            "description": "Notifier name",
+            "in": "path",
+            "name": "name",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "default": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "type": "object"
+                }
+              }
+            },
+            "description": "default response"
+          }
+        },
+        "tags": [
+          "NotifierV1alpha1Uc"
+        ]
+      },
+      "post": {
+        "description": "Save receiver config of notifier",
+        "operationId": "SaveReceiverConfig",
+        "parameters": [
+          {
+            "description": "Notifier name",
+            "in": "path",
+            "name": "name",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "default": {
+            "content": {},
+            "description": "default response"
+          }
+        },
+        "tags": [
+          "NotifierV1alpha1Uc"
+        ]
+      }
+    },
+    "/apis/api.notification.halo.run/v1alpha1/userspaces/{username}/notification-preferences": {
+      "get": {
+        "description": "List notification preferences for the authenticated user.",
+        "operationId": "ListUserNotificationPreferences",
+        "parameters": [
+          {
+            "description": "Username",
+            "in": "path",
+            "name": "username",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "default": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/ReasonTypeNotifierMatrix"
+                }
+              }
+            },
+            "description": "default response"
+          }
+        },
+        "tags": [
+          "NotificationV1alpha1Uc"
+        ]
+      },
+      "post": {
+        "description": "Save notification preferences for the authenticated user.",
+        "operationId": "SaveUserNotificationPreferences",
+        "parameters": [
+          {
+            "description": "Username",
+            "in": "path",
+            "name": "username",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "*/*": {
+              "schema": {
+                "$ref": "#/components/schemas/ReasonTypeNotifierCollectionRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "default": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/ReasonTypeNotifierMatrix"
+                }
+              }
+            },
+            "description": "default response"
+          }
+        },
+        "tags": [
+          "NotificationV1alpha1Uc"
+        ]
+      }
+    },
+    "/apis/api.notification.halo.run/v1alpha1/userspaces/{username}/notifications": {
+      "get": {
+        "description": "List notifications for the authenticated user.",
+        "operationId": "ListUserNotifications",
+        "parameters": [
+          {
+            "description": "Username",
+            "in": "path",
+            "name": "username",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "description": "Page number. Default is 0.",
+            "in": "query",
+            "name": "page",
+            "schema": {
+              "type": "integer",
+              "format": "int32"
+            }
+          },
+          {
+            "description": "Size number. Default is 0.",
+            "in": "query",
+            "name": "size",
+            "schema": {
+              "type": "integer",
+              "format": "int32"
+            }
+          },
+          {
+            "description": "Label selector. e.g.: hidden!\u003dtrue",
+            "in": "query",
+            "name": "labelSelector",
+            "schema": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          },
+          {
+            "description": "Field selector. e.g.: metadata.name\u003d\u003dhalo",
+            "in": "query",
+            "name": "fieldSelector",
+            "schema": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          },
+          {
+            "description": "Sorting criteria in the format: property,(asc|desc). Default sort order is ascending. Multiple sort criteria are supported.",
+            "in": "query",
+            "name": "sort",
+            "schema": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          }
+        ],
+        "responses": {
+          "default": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/NotificationList"
+                }
+              }
+            },
+            "description": "default response"
+          }
+        },
+        "tags": [
+          "NotificationV1alpha1Uc"
+        ]
+      }
+    },
+    "/apis/api.notification.halo.run/v1alpha1/userspaces/{username}/notifications/-/mark-specified-as-read": {
+      "put": {
+        "description": "Mark the specified notifications as read.",
+        "operationId": "MarkNotificationsAsRead",
+        "parameters": [
+          {
+            "description": "Username",
+            "in": "path",
+            "name": "username",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/MarkSpecifiedRequest"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "default": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  }
+                }
+              }
+            },
+            "description": "default response"
+          }
+        },
+        "tags": [
+          "NotificationV1alpha1Uc"
+        ]
+      }
+    },
+    "/apis/api.notification.halo.run/v1alpha1/userspaces/{username}/notifications/{name}": {
+      "delete": {
+        "description": "Delete the specified notification.",
+        "operationId": "DeleteSpecifiedNotification",
+        "parameters": [
+          {
+            "description": "Username",
+            "in": "path",
+            "name": "username",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "description": "Notification name",
+            "in": "path",
+            "name": "name",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "default": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/Notification"
+                }
+              }
+            },
+            "description": "default response"
+          }
+        },
+        "tags": [
+          "NotificationV1alpha1Uc"
+        ]
+      }
+    },
+    "/apis/api.notification.halo.run/v1alpha1/userspaces/{username}/notifications/{name}/mark-as-read": {
+      "put": {
+        "description": "Mark the specified notification as read.",
+        "operationId": "MarkNotificationAsRead",
+        "parameters": [
+          {
+            "description": "Username",
+            "in": "path",
+            "name": "username",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "description": "Notification name",
+            "in": "path",
+            "name": "name",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "default": {
+            "content": {
+              "*/*": {
+                "schema": {
+                  "$ref": "#/components/schemas/Notification"
+                }
+              }
+            },
+            "description": "default response"
+          }
+        },
+        "tags": [
+          "NotificationV1alpha1Uc"
+        ]
+      }
+    },
     "/apis/uc.api.auth.halo.run/v1alpha1/user-connections/{registerId}/disconnect": {
       "put": {
         "description": "Disconnect my connection from a third-party platform.",
@@ -1586,6 +1933,17 @@
           }
         }
       },
+      "MarkSpecifiedRequest": {
+        "type": "object",
+        "properties": {
+          "names": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          }
+        }
+      },
       "Metadata": {
         "required": [
           "name"
@@ -1666,6 +2024,140 @@
           }
         }
       },
+      "Notification": {
+        "required": [
+          "apiVersion",
+          "kind",
+          "metadata"
+        ],
+        "type": "object",
+        "properties": {
+          "apiVersion": {
+            "type": "string"
+          },
+          "kind": {
+            "type": "string"
+          },
+          "metadata": {
+            "$ref": "#/components/schemas/Metadata"
+          },
+          "spec": {
+            "$ref": "#/components/schemas/NotificationSpec"
+          }
+        }
+      },
+      "NotificationList": {
+        "required": [
+          "first",
+          "hasNext",
+          "hasPrevious",
+          "items",
+          "last",
+          "page",
+          "size",
+          "total",
+          "totalPages"
+        ],
+        "type": "object",
+        "properties": {
+          "first": {
+            "type": "boolean",
+            "description": "Indicates whether current page is the first page."
+          },
+          "hasNext": {
+            "type": "boolean",
+            "description": "Indicates whether current page has previous page."
+          },
+          "hasPrevious": {
+            "type": "boolean",
+            "description": "Indicates whether current page has previous page."
+          },
+          "items": {
+            "type": "array",
+            "description": "A chunk of items.",
+            "items": {
+              "$ref": "#/components/schemas/Notification"
+            }
+          },
+          "last": {
+            "type": "boolean",
+            "description": "Indicates whether current page is the last page."
+          },
+          "page": {
+            "type": "integer",
+            "description": "Page number, starts from 1. If not set or equal to 0, it means no pagination.",
+            "format": "int32"
+          },
+          "size": {
+            "type": "integer",
+            "description": "Size of each page. If not set or equal to 0, it means no pagination.",
+            "format": "int32"
+          },
+          "total": {
+            "type": "integer",
+            "description": "Total elements.",
+            "format": "int64"
+          },
+          "totalPages": {
+            "type": "integer",
+            "description": "Indicates total pages.",
+            "format": "int64"
+          }
+        }
+      },
+      "NotificationSpec": {
+        "required": [
+          "htmlContent",
+          "rawContent",
+          "reason",
+          "recipient",
+          "title"
+        ],
+        "type": "object",
+        "properties": {
+          "htmlContent": {
+            "type": "string"
+          },
+          "lastReadAt": {
+            "type": "string",
+            "format": "date-time"
+          },
+          "rawContent": {
+            "type": "string"
+          },
+          "reason": {
+            "minLength": 1,
+            "type": "string",
+            "description": "The name of reason"
+          },
+          "recipient": {
+            "minLength": 1,
+            "type": "string",
+            "description": "The name of user"
+          },
+          "title": {
+            "minLength": 1,
+            "type": "string"
+          },
+          "unread": {
+            "type": "boolean"
+          }
+        }
+      },
+      "NotifierInfo": {
+        "type": "object",
+        "properties": {
+          "description": {
+            "type": "string"
+          },
+          "displayName": {
+            "type": "string"
+          },
+          "name": {
+            "type": "string"
+          }
+        }
+      },
       "Part": {
         "type": "object"
       },
@@ -1946,6 +2438,81 @@
           }
         }
       },
+      "ReasonTypeInfo": {
+        "type": "object",
+        "properties": {
+          "description": {
+            "type": "string"
+          },
+          "displayName": {
+            "type": "string"
+          },
+          "name": {
+            "type": "string"
+          },
+          "uiPermissions": {
+            "uniqueItems": true,
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          }
+        }
+      },
+      "ReasonTypeNotifierCollectionRequest": {
+        "required": [
+          "reasonTypeNotifiers"
+        ],
+        "type": "object",
+        "properties": {
+          "reasonTypeNotifiers": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/ReasonTypeNotifierRequest"
+            }
+          }
+        }
+      },
+      "ReasonTypeNotifierMatrix": {
+        "type": "object",
+        "properties": {
+          "notifiers": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/NotifierInfo"
+            }
+          },
+          "reasonTypes": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/ReasonTypeInfo"
+            }
+          },
+          "stateMatrix": {
+            "type": "array",
+            "items": {
+              "type": "array",
+              "items": {
+                "type": "boolean"
+              }
+            }
+          }
+        }
+      },
+      "ReasonTypeNotifierRequest": {
+        "type": "object",
+        "properties": {
+          "notifiers": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "reasonType": {
+            "type": "string"
+          }
+        }
+      },
       "Ref": {
         "required": [
           "name"
diff --git a/application/src/main/java/run/halo/app/infra/config/SwaggerConfig.java b/application/src/main/java/run/halo/app/infra/config/SwaggerConfig.java
index 00337a47c6..e930901fa8 100644
--- a/application/src/main/java/run/halo/app/infra/config/SwaggerConfig.java
+++ b/application/src/main/java/run/halo/app/infra/config/SwaggerConfig.java
@@ -72,19 +72,25 @@ GroupedOpenApi aggregatedV1alpha1Api() {
             .pathsToMatch(
                 "/apis/*/v1alpha1/**",
                 "/api/v1alpha1/**",
-                "/login/**"
+                "/login/**",
+                "/system/setup"
             )
             .build();
     }
 
-
     @Bean
     GroupedOpenApi publicV1alpha1Api() {
         return GroupedOpenApi.builder()
             .group("apis_public.api_v1alpha1")
             .displayName("Public API V1alpha1")
             .pathsToMatch(
-                "/apis/api.halo.run/**"
+                "/apis/api.*/**"
+            )
+            .pathsToExclude(
+                "/apis/api.console.*/v1alpha1/**",
+                // compatible with legacy issues
+                "/apis/api.notification.halo.run/v1alpha1/userspaces/**",
+                "/apis/api.notification.halo.run/v1alpha1/notifiers/**"
             )
             .build();
     }
@@ -108,7 +114,10 @@ GroupedOpenApi ucV1alpha1Api() {
             .group("apis_uc.api_v1alpha1")
             .displayName("User-center API V1alpha1")
             .pathsToMatch(
-                "/apis/uc.api.*/v1alpha1/**"
+                "/apis/uc.api.*/v1alpha1/**",
+                // compatible with legacy issues
+                "/apis/api.notification.halo.run/v1alpha1/userspaces/**",
+                "/apis/api.notification.halo.run/v1alpha1/notifiers/**"
             )
             .build();
     }
@@ -128,7 +137,9 @@ GroupedOpenApi extensionV1alpha1Api() {
                 "/apis/auth.halo.run/v1alpha1/**",
                 "/apis/metrics.halo.run/v1alpha1/**",
                 "/apis/storage.halo.run/v1alpha1/**",
-                "/apis/plugin.halo.run/v1alpha1/**"
+                "/apis/plugin.halo.run/v1alpha1/**",
+                "/apis/notification.halo.run/**",
+                "/apis/migration.halo.run/**"
             )
             .build();
     }
diff --git a/application/src/main/java/run/halo/app/notification/endpoint/SubscriptionRouter.java b/application/src/main/java/run/halo/app/notification/endpoint/SubscriptionRouter.java
index 7344613ab0..e577cfac66 100644
--- a/application/src/main/java/run/halo/app/notification/endpoint/SubscriptionRouter.java
+++ b/application/src/main/java/run/halo/app/notification/endpoint/SubscriptionRouter.java
@@ -39,10 +39,11 @@ public class SubscriptionRouter {
 
     @Bean
     RouterFunction<ServerResponse> notificationSubscriptionRouter() {
+        final var tag = "NotificationV1alpha1Public";
         return SpringdocRouteBuilder.route()
             .GET(UNSUBSCRIBE_PATTERN, this::unsubscribe, builder -> {
                 builder.operationId("Unsubscribe")
-                    .tag("api.notification.halo.run/v1alpha1/Subscription")
+                    .tag(tag)
                     .description("Unsubscribe a subscription")
                     .parameter(parameterBuilder()
                         .in(ParameterIn.PATH)
diff --git a/application/src/main/java/run/halo/app/security/preauth/SystemSetupEndpoint.java b/application/src/main/java/run/halo/app/security/preauth/SystemSetupEndpoint.java
index d622b4479f..cbf2d8f365 100644
--- a/application/src/main/java/run/halo/app/security/preauth/SystemSetupEndpoint.java
+++ b/application/src/main/java/run/halo/app/security/preauth/SystemSetupEndpoint.java
@@ -3,7 +3,9 @@
 import static io.r2dbc.spi.ConnectionFactoryOptions.DRIVER;
 import static io.swagger.v3.oas.annotations.media.Schema.RequiredMode.REQUIRED;
 import static org.springdoc.core.fn.builders.apiresponse.Builder.responseBuilder;
+import static org.springdoc.core.fn.builders.content.Builder.contentBuilder;
 import static org.springdoc.core.fn.builders.requestbody.Builder.requestBodyBuilder;
+import static org.springdoc.core.fn.builders.schema.Builder.schemaBuilder;
 import static org.springframework.web.reactive.function.server.RequestPredicates.accept;
 import static org.springframework.web.reactive.function.server.RequestPredicates.contentType;
 import static org.springframework.web.reactive.function.server.RequestPredicates.path;
@@ -85,7 +87,7 @@ public class SystemSetupEndpoint {
 
     @Bean
     RouterFunction<ServerResponse> setupPageRouter() {
-        final var tag = "System";
+        final var tag = "SystemV1alpha1Public";
         return SpringdocRouteBuilder.route()
             .GET(path("/system/setup").and(accept(MediaType.TEXT_HTML)), this::setupPage,
                 builder -> builder.operationId("JumpToSetupPage")
@@ -103,9 +105,11 @@ RouterFunction<ServerResponse> setupPageRouter() {
                     .description("Setup system")
                     .tag(tag)
                     .requestBody(requestBodyBuilder()
-                        .implementation(SetupRequest.class)
-                        .content(Builder.contentBuilder()
-                            .mediaType(MediaType.APPLICATION_FORM_URLENCODED_VALUE)
+                        .required(true)
+                        .content(contentBuilder()
+                            .mediaType(MediaType.APPLICATION_JSON_VALUE)
+                            .schema(schemaBuilder()
+                                .implementation(SetupRequest.class))
                         )
                     )
                     .response(responseBuilder()
diff --git a/ui/packages/api-client/entry/api-client.ts b/ui/packages/api-client/entry/api-client.ts
index 4cae6d0436..abfb44573d 100644
--- a/ui/packages/api-client/entry/api-client.ts
+++ b/ui/packages/api-client/entry/api-client.ts
@@ -26,6 +26,7 @@ import {
   MigrationV1alpha1ConsoleApi,
   NotificationTemplateV1alpha1Api,
   NotificationV1alpha1Api,
+  NotificationV1alpha1PublicApi,
   NotificationV1alpha1UcApi,
   NotifierDescriptorV1alpha1Api,
   NotifierV1alpha1ConsoleApi,
@@ -435,6 +436,11 @@ function createPublicApiClient(axiosInstance: AxiosInstance) {
     metrics: {
       metrics: new MetricsV1alpha1PublicApi(undefined, baseURL, axiosInstance),
     },
+    notification: new NotificationV1alpha1PublicApi(
+      undefined,
+      baseURL,
+      axiosInstance
+    ),
   };
 }
 
diff --git a/ui/packages/api-client/src/.openapi-generator/FILES b/ui/packages/api-client/src/.openapi-generator/FILES
index 90d1b4d591..cc42c1c805 100644
--- a/ui/packages/api-client/src/.openapi-generator/FILES
+++ b/ui/packages/api-client/src/.openapi-generator/FILES
@@ -3,7 +3,6 @@
 .openapi-generator-ignore
 api.ts
 api/annotation-setting-v1alpha1-api.ts
-api/api-notification-halo-run-v1alpha1-subscription-api.ts
 api/attachment-v1alpha1-api.ts
 api/attachment-v1alpha1-console-api.ts
 api/attachment-v1alpha1-uc-api.ts
@@ -17,6 +16,7 @@ api/comment-v1alpha1-console-api.ts
 api/comment-v1alpha1-public-api.ts
 api/config-map-v1alpha1-api.ts
 api/counter-v1alpha1-api.ts
+api/default-api.ts
 api/device-v1alpha1-api.ts
 api/device-v1alpha1-uc-api.ts
 api/extension-definition-v1alpha1-api.ts
@@ -32,6 +32,7 @@ api/metrics-v1alpha1-public-api.ts
 api/migration-v1alpha1-console-api.ts
 api/notification-template-v1alpha1-api.ts
 api/notification-v1alpha1-api.ts
+api/notification-v1alpha1-public-api.ts
 api/notification-v1alpha1-uc-api.ts
 api/notifier-descriptor-v1alpha1-api.ts
 api/notifier-v1alpha1-console-api.ts
diff --git a/ui/packages/api-client/src/api.ts b/ui/packages/api-client/src/api.ts
index 3a4af9afb5..a2b1159d2a 100644
--- a/ui/packages/api-client/src/api.ts
+++ b/ui/packages/api-client/src/api.ts
@@ -15,7 +15,6 @@
 
 
 export * from './api/annotation-setting-v1alpha1-api';
-export * from './api/api-notification-halo-run-v1alpha1-subscription-api';
 export * from './api/attachment-v1alpha1-api';
 export * from './api/attachment-v1alpha1-console-api';
 export * from './api/attachment-v1alpha1-uc-api';
@@ -29,6 +28,7 @@ export * from './api/comment-v1alpha1-console-api';
 export * from './api/comment-v1alpha1-public-api';
 export * from './api/config-map-v1alpha1-api';
 export * from './api/counter-v1alpha1-api';
+export * from './api/default-api';
 export * from './api/device-v1alpha1-api';
 export * from './api/device-v1alpha1-uc-api';
 export * from './api/extension-definition-v1alpha1-api';
@@ -44,6 +44,7 @@ export * from './api/metrics-v1alpha1-public-api';
 export * from './api/migration-v1alpha1-console-api';
 export * from './api/notification-template-v1alpha1-api';
 export * from './api/notification-v1alpha1-api';
+export * from './api/notification-v1alpha1-public-api';
 export * from './api/notification-v1alpha1-uc-api';
 export * from './api/notifier-descriptor-v1alpha1-api';
 export * from './api/notifier-v1alpha1-console-api';
diff --git a/ui/packages/api-client/src/api/default-api.ts b/ui/packages/api-client/src/api/default-api.ts
new file mode 100644
index 0000000000..0c7914d1d3
--- /dev/null
+++ b/ui/packages/api-client/src/api/default-api.ts
@@ -0,0 +1,126 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * Halo
+ * No description provided (generated by Openapi Generator https://github.com/openapitools/openapi-generator)
+ *
+ * The version of the OpenAPI document: 2.20.0-SNAPSHOT
+ * 
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+
+import type { Configuration } from '../configuration';
+import type { AxiosPromise, AxiosInstance, RawAxiosRequestConfig } from 'axios';
+import globalAxios from 'axios';
+// Some imports not used depending on template conditions
+// @ts-ignore
+import { DUMMY_BASE_URL, assertParamExists, setApiKeyToObject, setBasicAuthToObject, setBearerAuthToObject, setOAuthToObject, setSearchParams, serializeDataIfNeeded, toPathString, createRequestFunction } from '../common';
+// @ts-ignore
+import { BASE_PATH, COLLECTION_FORMATS, RequestArgs, BaseAPI, RequiredError, operationServerMap } from '../base';
+/**
+ * DefaultApi - axios parameter creator
+ * @export
+ */
+export const DefaultApiAxiosParamCreator = function (configuration?: Configuration) {
+    return {
+        /**
+         * 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        setNoCacheForSetUpPage: async (options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            const localVarPath = `/system/setup`;
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+
+            const localVarRequestOptions = { method: 'POST', ...baseOptions, ...options};
+            const localVarHeaderParameter = {} as any;
+            const localVarQueryParameter = {} as any;
+
+            // authentication basicAuth required
+            // http basic authentication required
+            setBasicAuthToObject(localVarRequestOptions, configuration)
+
+            // authentication bearerAuth required
+            // http bearer authentication required
+            await setBearerAuthToObject(localVarHeaderParameter, configuration)
+
+
+    
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
+
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+    }
+};
+
+/**
+ * DefaultApi - functional programming interface
+ * @export
+ */
+export const DefaultApiFp = function(configuration?: Configuration) {
+    const localVarAxiosParamCreator = DefaultApiAxiosParamCreator(configuration)
+    return {
+        /**
+         * 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async setNoCacheForSetUpPage(options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<void>> {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.setNoCacheForSetUpPage(options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['DefaultApi.setNoCacheForSetUpPage']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
+    }
+};
+
+/**
+ * DefaultApi - factory interface
+ * @export
+ */
+export const DefaultApiFactory = function (configuration?: Configuration, basePath?: string, axios?: AxiosInstance) {
+    const localVarFp = DefaultApiFp(configuration)
+    return {
+        /**
+         * 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        setNoCacheForSetUpPage(options?: RawAxiosRequestConfig): AxiosPromise<void> {
+            return localVarFp.setNoCacheForSetUpPage(options).then((request) => request(axios, basePath));
+        },
+    };
+};
+
+/**
+ * DefaultApi - object-oriented interface
+ * @export
+ * @class DefaultApi
+ * @extends {BaseAPI}
+ */
+export class DefaultApi extends BaseAPI {
+    /**
+     * 
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof DefaultApi
+     */
+    public setNoCacheForSetUpPage(options?: RawAxiosRequestConfig) {
+        return DefaultApiFp(this.configuration).setNoCacheForSetUpPage(options).then((request) => request(this.axios, this.basePath));
+    }
+}
+
diff --git a/ui/packages/api-client/src/api/api-notification-halo-run-v1alpha1-subscription-api.ts b/ui/packages/api-client/src/api/notification-v1alpha1-public-api.ts
similarity index 67%
rename from ui/packages/api-client/src/api/api-notification-halo-run-v1alpha1-subscription-api.ts
rename to ui/packages/api-client/src/api/notification-v1alpha1-public-api.ts
index 5b1612ed7c..18830ddfac 100644
--- a/ui/packages/api-client/src/api/api-notification-halo-run-v1alpha1-subscription-api.ts
+++ b/ui/packages/api-client/src/api/notification-v1alpha1-public-api.ts
@@ -22,10 +22,10 @@ import { DUMMY_BASE_URL, assertParamExists, setApiKeyToObject, setBasicAuthToObj
 // @ts-ignore
 import { BASE_PATH, COLLECTION_FORMATS, RequestArgs, BaseAPI, RequiredError, operationServerMap } from '../base';
 /**
- * ApiNotificationHaloRunV1alpha1SubscriptionApi - axios parameter creator
+ * NotificationV1alpha1PublicApi - axios parameter creator
  * @export
  */
-export const ApiNotificationHaloRunV1alpha1SubscriptionApiAxiosParamCreator = function (configuration?: Configuration) {
+export const NotificationV1alpha1PublicApiAxiosParamCreator = function (configuration?: Configuration) {
     return {
         /**
          * Unsubscribe a subscription
@@ -79,11 +79,11 @@ export const ApiNotificationHaloRunV1alpha1SubscriptionApiAxiosParamCreator = fu
 };
 
 /**
- * ApiNotificationHaloRunV1alpha1SubscriptionApi - functional programming interface
+ * NotificationV1alpha1PublicApi - functional programming interface
  * @export
  */
-export const ApiNotificationHaloRunV1alpha1SubscriptionApiFp = function(configuration?: Configuration) {
-    const localVarAxiosParamCreator = ApiNotificationHaloRunV1alpha1SubscriptionApiAxiosParamCreator(configuration)
+export const NotificationV1alpha1PublicApiFp = function(configuration?: Configuration) {
+    const localVarAxiosParamCreator = NotificationV1alpha1PublicApiAxiosParamCreator(configuration)
     return {
         /**
          * Unsubscribe a subscription
@@ -95,68 +95,68 @@ export const ApiNotificationHaloRunV1alpha1SubscriptionApiFp = function(configur
         async unsubscribe(name: string, token: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<string>> {
             const localVarAxiosArgs = await localVarAxiosParamCreator.unsubscribe(name, token, options);
             const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
-            const localVarOperationServerBasePath = operationServerMap['ApiNotificationHaloRunV1alpha1SubscriptionApi.unsubscribe']?.[localVarOperationServerIndex]?.url;
+            const localVarOperationServerBasePath = operationServerMap['NotificationV1alpha1PublicApi.unsubscribe']?.[localVarOperationServerIndex]?.url;
             return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
         },
     }
 };
 
 /**
- * ApiNotificationHaloRunV1alpha1SubscriptionApi - factory interface
+ * NotificationV1alpha1PublicApi - factory interface
  * @export
  */
-export const ApiNotificationHaloRunV1alpha1SubscriptionApiFactory = function (configuration?: Configuration, basePath?: string, axios?: AxiosInstance) {
-    const localVarFp = ApiNotificationHaloRunV1alpha1SubscriptionApiFp(configuration)
+export const NotificationV1alpha1PublicApiFactory = function (configuration?: Configuration, basePath?: string, axios?: AxiosInstance) {
+    const localVarFp = NotificationV1alpha1PublicApiFp(configuration)
     return {
         /**
          * Unsubscribe a subscription
-         * @param {ApiNotificationHaloRunV1alpha1SubscriptionApiUnsubscribeRequest} requestParameters Request parameters.
+         * @param {NotificationV1alpha1PublicApiUnsubscribeRequest} requestParameters Request parameters.
          * @param {*} [options] Override http request option.
          * @throws {RequiredError}
          */
-        unsubscribe(requestParameters: ApiNotificationHaloRunV1alpha1SubscriptionApiUnsubscribeRequest, options?: RawAxiosRequestConfig): AxiosPromise<string> {
+        unsubscribe(requestParameters: NotificationV1alpha1PublicApiUnsubscribeRequest, options?: RawAxiosRequestConfig): AxiosPromise<string> {
             return localVarFp.unsubscribe(requestParameters.name, requestParameters.token, options).then((request) => request(axios, basePath));
         },
     };
 };
 
 /**
- * Request parameters for unsubscribe operation in ApiNotificationHaloRunV1alpha1SubscriptionApi.
+ * Request parameters for unsubscribe operation in NotificationV1alpha1PublicApi.
  * @export
- * @interface ApiNotificationHaloRunV1alpha1SubscriptionApiUnsubscribeRequest
+ * @interface NotificationV1alpha1PublicApiUnsubscribeRequest
  */
-export interface ApiNotificationHaloRunV1alpha1SubscriptionApiUnsubscribeRequest {
+export interface NotificationV1alpha1PublicApiUnsubscribeRequest {
     /**
      * Subscription name
      * @type {string}
-     * @memberof ApiNotificationHaloRunV1alpha1SubscriptionApiUnsubscribe
+     * @memberof NotificationV1alpha1PublicApiUnsubscribe
      */
     readonly name: string
 
     /**
      * Unsubscribe token
      * @type {string}
-     * @memberof ApiNotificationHaloRunV1alpha1SubscriptionApiUnsubscribe
+     * @memberof NotificationV1alpha1PublicApiUnsubscribe
      */
     readonly token: string
 }
 
 /**
- * ApiNotificationHaloRunV1alpha1SubscriptionApi - object-oriented interface
+ * NotificationV1alpha1PublicApi - object-oriented interface
  * @export
- * @class ApiNotificationHaloRunV1alpha1SubscriptionApi
+ * @class NotificationV1alpha1PublicApi
  * @extends {BaseAPI}
  */
-export class ApiNotificationHaloRunV1alpha1SubscriptionApi extends BaseAPI {
+export class NotificationV1alpha1PublicApi extends BaseAPI {
     /**
      * Unsubscribe a subscription
-     * @param {ApiNotificationHaloRunV1alpha1SubscriptionApiUnsubscribeRequest} requestParameters Request parameters.
+     * @param {NotificationV1alpha1PublicApiUnsubscribeRequest} requestParameters Request parameters.
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
-     * @memberof ApiNotificationHaloRunV1alpha1SubscriptionApi
+     * @memberof NotificationV1alpha1PublicApi
      */
-    public unsubscribe(requestParameters: ApiNotificationHaloRunV1alpha1SubscriptionApiUnsubscribeRequest, options?: RawAxiosRequestConfig) {
-        return ApiNotificationHaloRunV1alpha1SubscriptionApiFp(this.configuration).unsubscribe(requestParameters.name, requestParameters.token, options).then((request) => request(this.axios, this.basePath));
+    public unsubscribe(requestParameters: NotificationV1alpha1PublicApiUnsubscribeRequest, options?: RawAxiosRequestConfig) {
+        return NotificationV1alpha1PublicApiFp(this.configuration).unsubscribe(requestParameters.name, requestParameters.token, options).then((request) => request(this.axios, this.basePath));
     }
 }
 
diff --git a/ui/packages/api-client/src/api/system-v1alpha1-public-api.ts b/ui/packages/api-client/src/api/system-v1alpha1-public-api.ts
index f6367f2c5a..88b47ab9ca 100644
--- a/ui/packages/api-client/src/api/system-v1alpha1-public-api.ts
+++ b/ui/packages/api-client/src/api/system-v1alpha1-public-api.ts
@@ -29,6 +29,43 @@ import { SiteStatsVo } from '../models';
  */
 export const SystemV1alpha1PublicApiAxiosParamCreator = function (configuration?: Configuration) {
     return {
+        /**
+         * Jump to setup page
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        jumpToSetupPage: async (options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            const localVarPath = `/system/setup`;
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+
+            const localVarRequestOptions = { method: 'GET', ...baseOptions, ...options};
+            const localVarHeaderParameter = {} as any;
+            const localVarQueryParameter = {} as any;
+
+            // authentication basicAuth required
+            // http basic authentication required
+            setBasicAuthToObject(localVarRequestOptions, configuration)
+
+            // authentication bearerAuth required
+            // http bearer authentication required
+            await setBearerAuthToObject(localVarHeaderParameter, configuration)
+
+
+    
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
+
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
         /**
          * Gets site stats
          * @param {*} [options] Override http request option.
@@ -76,6 +113,17 @@ export const SystemV1alpha1PublicApiAxiosParamCreator = function (configuration?
 export const SystemV1alpha1PublicApiFp = function(configuration?: Configuration) {
     const localVarAxiosParamCreator = SystemV1alpha1PublicApiAxiosParamCreator(configuration)
     return {
+        /**
+         * Jump to setup page
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async jumpToSetupPage(options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<string>> {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.jumpToSetupPage(options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['SystemV1alpha1PublicApi.jumpToSetupPage']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
         /**
          * Gets site stats
          * @param {*} [options] Override http request option.
@@ -97,6 +145,14 @@ export const SystemV1alpha1PublicApiFp = function(configuration?: Configuration)
 export const SystemV1alpha1PublicApiFactory = function (configuration?: Configuration, basePath?: string, axios?: AxiosInstance) {
     const localVarFp = SystemV1alpha1PublicApiFp(configuration)
     return {
+        /**
+         * Jump to setup page
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        jumpToSetupPage(options?: RawAxiosRequestConfig): AxiosPromise<string> {
+            return localVarFp.jumpToSetupPage(options).then((request) => request(axios, basePath));
+        },
         /**
          * Gets site stats
          * @param {*} [options] Override http request option.
@@ -115,6 +171,16 @@ export const SystemV1alpha1PublicApiFactory = function (configuration?: Configur
  * @extends {BaseAPI}
  */
 export class SystemV1alpha1PublicApi extends BaseAPI {
+    /**
+     * Jump to setup page
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof SystemV1alpha1PublicApi
+     */
+    public jumpToSetupPage(options?: RawAxiosRequestConfig) {
+        return SystemV1alpha1PublicApiFp(this.configuration).jumpToSetupPage(options).then((request) => request(this.axios, this.basePath));
+    }
+
     /**
      * Gets site stats
      * @param {*} [options] Override http request option.

From 61718cce980377eedffb36e91b3acd14a495140e Mon Sep 17 00:00:00 2001
From: John Niang <johnniang@foxmail.com>
Date: Tue, 22 Oct 2024 17:20:29 +0800
Subject: [PATCH 171/185] Support nested configuration properties (#6920)

#### What type of PR is this?

/kind improvement
/area core
/milestone 2.20.x

#### What this PR does / why we need it:

This PR adds the annotations `@NestedConfigurationProperties` to let Spring Configuration Processor generate fully metadata.

We can execute command `./gradlew :application:compileJava` to generate `application/build/classes/java/main/META-INF/spring-configuration-metadata.json`. If you are using IDEA Ultimate, configuration hints related to Halo will be available.

#### Does this PR introduce a user-facing change?

```release-note
None
```
---
 .../run/halo/app/infra/properties/ConsoleProperties.java   | 2 ++
 .../java/run/halo/app/infra/properties/HaloProperties.java | 7 +++++++
 2 files changed, 9 insertions(+)

diff --git a/application/src/main/java/run/halo/app/infra/properties/ConsoleProperties.java b/application/src/main/java/run/halo/app/infra/properties/ConsoleProperties.java
index 8bf245a459..b98a99e892 100644
--- a/application/src/main/java/run/halo/app/infra/properties/ConsoleProperties.java
+++ b/application/src/main/java/run/halo/app/infra/properties/ConsoleProperties.java
@@ -2,6 +2,7 @@
 
 import jakarta.validation.Valid;
 import lombok.Data;
+import org.springframework.boot.context.properties.NestedConfigurationProperty;
 
 @Data
 public class ConsoleProperties {
@@ -9,6 +10,7 @@ public class ConsoleProperties {
     private String location = "classpath:/console/";
 
     @Valid
+    @NestedConfigurationProperty
     private ProxyProperties proxy = new ProxyProperties();
 
 }
diff --git a/application/src/main/java/run/halo/app/infra/properties/HaloProperties.java b/application/src/main/java/run/halo/app/infra/properties/HaloProperties.java
index e89bc2b0c1..b492788d22 100644
--- a/application/src/main/java/run/halo/app/infra/properties/HaloProperties.java
+++ b/application/src/main/java/run/halo/app/infra/properties/HaloProperties.java
@@ -9,6 +9,7 @@
 import java.util.Set;
 import lombok.Data;
 import org.springframework.boot.context.properties.ConfigurationProperties;
+import org.springframework.boot.context.properties.NestedConfigurationProperty;
 import org.springframework.validation.Errors;
 import org.springframework.validation.Validator;
 import org.springframework.validation.annotation.Validated;
@@ -45,21 +46,27 @@ public class HaloProperties implements Validator {
     private boolean requiredExtensionDisabled;
 
     @Valid
+    @NestedConfigurationProperty
     private final ExtensionProperties extension = new ExtensionProperties();
 
     @Valid
+    @NestedConfigurationProperty
     private final SecurityProperties security = new SecurityProperties();
 
     @Valid
+    @NestedConfigurationProperty
     private final ConsoleProperties console = new ConsoleProperties();
 
     @Valid
+    @NestedConfigurationProperty
     private final UcProperties uc = new UcProperties();
 
     @Valid
+    @NestedConfigurationProperty
     private final ThemeProperties theme = new ThemeProperties();
 
     @Valid
+    @NestedConfigurationProperty
     private final AttachmentProperties attachment = new AttachmentProperties();
 
     @Override

From 7e63d4448fdcc7d99e58767057c43b8e56349f73 Mon Sep 17 00:00:00 2001
From: John Niang <johnniang@foxmail.com>
Date: Tue, 22 Oct 2024 17:37:56 +0800
Subject: [PATCH 172/185] Support pushing Docker image into Fit2Cloud Docker
 Registry (#6921)

Signed-off-by: JohnNiang <johnniang@foxmail.com>
---
 .github/actions/docker-buildx-push/action.yaml | 15 +++++++++++++++
 .github/workflows/halo.yaml                    |  2 ++
 2 files changed, 17 insertions(+)

diff --git a/.github/actions/docker-buildx-push/action.yaml b/.github/actions/docker-buildx-push/action.yaml
index d377b43347..84bf08df52 100644
--- a/.github/actions/docker-buildx-push/action.yaml
+++ b/.github/actions/docker-buildx-push/action.yaml
@@ -14,6 +14,14 @@ inputs:
     description: Token for the DockerHub account
     required: false
     default: ""
+  f2c-registry-user:
+    description: "User name of Fit2Cloud Docker Registry."
+    required: false
+    default: ""
+  f2c-registry-token:
+    description: "Token of Fit2Cloud Docker Registry."
+    required: false
+    default: ""
   push:
     description: Should push the docker image or not.
     required: false
@@ -37,6 +45,7 @@ runs:
         images: |
           ghcr.io/${{ github.repository_owner }}/${{ inputs.image-name }}
           halohub/${{ inputs.image-name }}
+          registry.fit2cloud.com/halo/${{ inputs.image-name }}
         tags: |
           type=schedule,pattern=nightly-{{date 'YYYYMMDD'}},enabled=${{ github.event_name == 'schedule' }}
           type=ref,event=branch,enabled=${{ github.event_name == 'push' }}
@@ -64,6 +73,12 @@ runs:
       with:
         username: ${{ inputs.dockerhub-user }}
         password: ${{ inputs.dockerhub-token }}
+    - name: Login to Fit2Cloud Docker Registry
+      if: inputs.f2c-registry-token != '' && github.event_name != 'pull_request'
+      uses: docker/login-action@v3
+      with:
+        username: ${{ inputs.f2c-registry-username }}
+        password: ${{ inputs.f2c-registry-token }}
     - name: Build and push
       uses: docker/build-push-action@v5
       with:
diff --git a/.github/workflows/halo.yaml b/.github/workflows/halo.yaml
index b83bae4abd..660a9a65f8 100644
--- a/.github/workflows/halo.yaml
+++ b/.github/workflows/halo.yaml
@@ -98,6 +98,8 @@ jobs:
           ghcr-token: ${{ secrets.GITHUB_TOKEN }}
           dockerhub-user: ${{ secrets.DOCKER_USERNAME }}
           dockerhub-token: ${{ secrets.DOCKER_TOKEN }}
+          f2c-registry-user: ${{ secrets.F2C_REGISTRY_USER }}
+          f2c-registry-token: ${{ secrets.F2C_REGISTRY_TOKEN }}
           push: true
           platforms: linux/amd64,linux/arm64/v8,linux/ppc64le,linux/s390x
 

From c8a8ac1b571f534fcbcb11d9525785b5847400e1 Mon Sep 17 00:00:00 2001
From: Ryan Wang <i@ryanc.cc>
Date: Tue, 22 Oct 2024 18:05:00 +0800
Subject: [PATCH 173/185] chore: update action.yaml (#6923)

---
 .github/actions/docker-buildx-push/action.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/actions/docker-buildx-push/action.yaml b/.github/actions/docker-buildx-push/action.yaml
index 84bf08df52..0605a2198c 100644
--- a/.github/actions/docker-buildx-push/action.yaml
+++ b/.github/actions/docker-buildx-push/action.yaml
@@ -77,7 +77,7 @@ runs:
       if: inputs.f2c-registry-token != '' && github.event_name != 'pull_request'
       uses: docker/login-action@v3
       with:
-        username: ${{ inputs.f2c-registry-username }}
+        username: ${{ inputs.f2c-registry-user }}
         password: ${{ inputs.f2c-registry-token }}
     - name: Build and push
       uses: docker/build-push-action@v5

From aeaa47f6c4a421f61139644aa1324f6557ba741a Mon Sep 17 00:00:00 2001
From: John Niang <johnniang@foxmail.com>
Date: Tue, 22 Oct 2024 18:25:40 +0800
Subject: [PATCH 174/185] Configure registry while login to Fit2Cloud Docker
 Registry (#6925)

Signed-off-by: JohnNiang <johnniang@foxmail.com>
---
 .github/actions/docker-buildx-push/action.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/actions/docker-buildx-push/action.yaml b/.github/actions/docker-buildx-push/action.yaml
index 0605a2198c..819ea02788 100644
--- a/.github/actions/docker-buildx-push/action.yaml
+++ b/.github/actions/docker-buildx-push/action.yaml
@@ -77,6 +77,7 @@ runs:
       if: inputs.f2c-registry-token != '' && github.event_name != 'pull_request'
       uses: docker/login-action@v3
       with:
+        registry: registry.fit2cloud.com
         username: ${{ inputs.f2c-registry-user }}
         password: ${{ inputs.f2c-registry-token }}
     - name: Build and push

From 7cc3dfa0a0703c8ff9ca6ec465becfcc91d891a7 Mon Sep 17 00:00:00 2001
From: guqing <38999863+guqing@users.noreply.github.com>
Date: Wed, 23 Oct 2024 11:34:17 +0800
Subject: [PATCH 175/185] fix: remove httpOnly from language cookie to allow JS
 to access current language (#6933)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?
/kind bug
/area core
/milestone 2.20.x

#### What this PR does / why we need it:
修复登录时切换了其他语言但是登录成功后始终显示中文的问题

此问题为 https://github.com/halo-dev/halo/pull/6891 导致

#### Does this PR introduce a user-facing change?
```release-note
修复登录时切换了其他语言但是登录成功后始终显示中文的问题
```
---
 .../java/run/halo/app/infra/webfilter/LocaleChangeWebFilter.java | 1 -
 1 file changed, 1 deletion(-)

diff --git a/application/src/main/java/run/halo/app/infra/webfilter/LocaleChangeWebFilter.java b/application/src/main/java/run/halo/app/infra/webfilter/LocaleChangeWebFilter.java
index d4bd8e661f..5f1885a59f 100644
--- a/application/src/main/java/run/halo/app/infra/webfilter/LocaleChangeWebFilter.java
+++ b/application/src/main/java/run/halo/app/infra/webfilter/LocaleChangeWebFilter.java
@@ -54,7 +54,6 @@ public Mono<Void> filter(ServerWebExchange exchange, WebFilterChain chain) {
     void setLanguageCookie(ServerWebExchange exchange, Locale locale) {
         var cookie = ResponseCookie.from(LANGUAGE_COOKIE_NAME, locale.toLanguageTag())
             .path("/")
-            .httpOnly(true)
             .secure("https".equalsIgnoreCase(exchange.getRequest().getURI().getScheme()))
             .sameSite("Lax")
             .build();

From fae03d4a5b51b5eeeced62948daf8a3e4e301a20 Mon Sep 17 00:00:00 2001
From: guqing <38999863+guqing@users.noreply.github.com>
Date: Wed, 23 Oct 2024 16:38:20 +0800
Subject: [PATCH 176/185] fix: missing deleted index in list method of single
 page finder (#6922)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?
/kind bug
/area core
/milestone 2.20.x

#### What this PR does / why we need it:
修复使用 `singlePageFinder.list()` 时会提示缺少 spec.deleted 索引的问题

#### Which issue(s) this PR fixes:
Fixes #6919

#### Does this PR introduce a user-facing change?
```release-note
修复使用 `singlePageFinder.list()` 时会提示缺少 spec.deleted 索引的问题
```
---
 .../java/run/halo/app/infra/SchemeInitializer.java   | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/application/src/main/java/run/halo/app/infra/SchemeInitializer.java b/application/src/main/java/run/halo/app/infra/SchemeInitializer.java
index 12e407be6a..49ab3d0a64 100644
--- a/application/src/main/java/run/halo/app/infra/SchemeInitializer.java
+++ b/application/src/main/java/run/halo/app/infra/SchemeInitializer.java
@@ -13,7 +13,6 @@
 import java.util.Set;
 import java.util.stream.Collectors;
 import org.apache.commons.lang3.BooleanUtils;
-import org.apache.commons.lang3.ObjectUtils;
 import org.apache.commons.lang3.StringUtils;
 import org.springframework.boot.context.event.ApplicationContextInitializedEvent;
 import org.springframework.context.ApplicationListener;
@@ -288,7 +287,7 @@ public void onApplicationEvent(@NonNull ApplicationContextInitializedEvent event
                         return "0";
                     }
                     var stats = JsonUtils.jsonToObject(statsStr, Stats.class);
-                    return ObjectUtils.defaultIfNull(stats.getVisit(), 0).toString();
+                    return defaultIfNull(stats.getVisit(), 0).toString();
                 })));
 
             indexSpecs.add(new IndexSpec()
@@ -300,7 +299,7 @@ public void onApplicationEvent(@NonNull ApplicationContextInitializedEvent event
                         return "0";
                     }
                     var stats = JsonUtils.jsonToObject(statsStr, Stats.class);
-                    return ObjectUtils.defaultIfNull(stats.getTotalComment(), 0).toString();
+                    return defaultIfNull(stats.getTotalComment(), 0).toString();
                 })));
         });
         schemeManager.register(Category.class, indexSpecs -> {
@@ -497,6 +496,13 @@ public void onApplicationEvent(@NonNull ApplicationContextInitializedEvent event
                         .orElse(null))
                 )
             );
+            is.add(new IndexSpec()
+                .setName("spec.deleted")
+                .setIndexFunc(simpleAttribute(SinglePage.class, page -> {
+                    var deleted = defaultIfNull(page.getSpec().getDeleted(), false);
+                    return String.valueOf(deleted);
+                }))
+            );
             is.add(new IndexSpec()
                 .setName("spec.visible")
                 .setIndexFunc(

From 17ec34c75e4ba6094c740808bbf71cbd979de21c Mon Sep 17 00:00:00 2001
From: guqing <38999863+guqing@users.noreply.github.com>
Date: Wed, 23 Oct 2024 16:40:20 +0800
Subject: [PATCH 177/185] fix: ignore conversion exceptions for plugin
 configuration to prevent program errors (#6924)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?
/kind bug
/area plugin
/milestone 2.20.x

#### What this PR does / why we need it:
修复插件配置可能因为缺少校验导致使用时类型转换失败从而影响 Halo 使用的问题

#### Which issue(s) this PR fixes:
Fixes #6899

#### Does this PR introduce a user-facing change?
```release-note
修复插件配置可能因为缺少校验导致使用时类型转换失败从而影响 Halo 使用的问题
```
---
 .../plugin/DefaultReactiveSettingFetcher.java    | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/application/src/main/java/run/halo/app/plugin/DefaultReactiveSettingFetcher.java b/application/src/main/java/run/halo/app/plugin/DefaultReactiveSettingFetcher.java
index 397e3ff9cf..835f5bb253 100644
--- a/application/src/main/java/run/halo/app/plugin/DefaultReactiveSettingFetcher.java
+++ b/application/src/main/java/run/halo/app/plugin/DefaultReactiveSettingFetcher.java
@@ -8,6 +8,7 @@
 import java.util.LinkedHashMap;
 import java.util.Map;
 import java.util.Objects;
+import lombok.extern.slf4j.Slf4j;
 import org.apache.commons.lang3.StringUtils;
 import org.springframework.beans.BeansException;
 import org.springframework.beans.factory.DisposableBean;
@@ -26,7 +27,6 @@
 import run.halo.app.extension.controller.Controller;
 import run.halo.app.extension.controller.ControllerBuilder;
 import run.halo.app.extension.controller.Reconciler;
-import run.halo.app.infra.utils.JsonParseException;
 import run.halo.app.infra.utils.JsonUtils;
 
 /**
@@ -35,6 +35,7 @@
  * @author guqing
  * @since 2.0.0
  */
+@Slf4j
 public class DefaultReactiveSettingFetcher
     implements ReactiveSettingFetcher, Reconciler<Reconciler.Request>, DisposableBean,
     ApplicationContextAware {
@@ -130,12 +131,21 @@ private JsonNode readTree(String json) {
         try {
             return JsonUtils.DEFAULT_JSON_MAPPER.readTree(json);
         } catch (JsonProcessingException e) {
-            throw new JsonParseException(e);
+            // ignore
+            log.error("Failed to parse plugin [{}] config json: [{}]", pluginName, json, e);
         }
+        return JsonNodeFactory.instance.missingNode();
     }
 
     private <T> T convertValue(JsonNode jsonNode, Class<T> clazz) {
-        return JsonUtils.DEFAULT_JSON_MAPPER.convertValue(jsonNode, clazz);
+        try {
+            return JsonUtils.DEFAULT_JSON_MAPPER.convertValue(jsonNode, clazz);
+        } catch (IllegalArgumentException e) {
+            // ignore
+            log.error("Failed to convert plugin [{}] configMap [{}] to class [{}]",
+                pluginName, configMapName, clazz, e);
+        }
+        return null;
     }
 
     @NonNull

From 2c234ab3eb2558c32cd14bba7b5883898e5c53b2 Mon Sep 17 00:00:00 2001
From: guqing <38999863+guqing@users.noreply.github.com>
Date: Wed, 23 Oct 2024 16:42:20 +0800
Subject: [PATCH 178/185] fix: prioritize login page route to prevent single
 page override (#6926)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?
/kind bug
/area core
/milestone 2.20.x

#### What this PR does / why we need it:
修复登录页面路由会被自定义页面覆盖导致无法登录的问题

#### Which issue(s) this PR fixes:
Fixes #6893

#### Does this PR introduce a user-facing change?
```release-note
修复登录页面路由会被自定义页面路由覆盖导致无法登录的问题
```
---
 .../security/preauth/PreAuthEmailPasswordResetEndpoint.java    | 3 +++
 .../run/halo/app/security/preauth/PreAuthLoginEndpoint.java    | 3 +++
 .../run/halo/app/security/preauth/PreAuthSignUpEndpoint.java   | 3 +++
 .../halo/app/security/preauth/PreAuthTwoFactorEndpoint.java    | 3 +++
 .../run/halo/app/security/preauth/SystemSetupEndpoint.java     | 3 +++
 5 files changed, 15 insertions(+)

diff --git a/application/src/main/java/run/halo/app/security/preauth/PreAuthEmailPasswordResetEndpoint.java b/application/src/main/java/run/halo/app/security/preauth/PreAuthEmailPasswordResetEndpoint.java
index 55c40d5d10..afa9fed61a 100644
--- a/application/src/main/java/run/halo/app/security/preauth/PreAuthEmailPasswordResetEndpoint.java
+++ b/application/src/main/java/run/halo/app/security/preauth/PreAuthEmailPasswordResetEndpoint.java
@@ -18,6 +18,8 @@
 import lombok.Data;
 import org.springframework.context.MessageSource;
 import org.springframework.context.annotation.Bean;
+import org.springframework.core.Ordered;
+import org.springframework.core.annotation.Order;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.MediaType;
 import org.springframework.http.server.reactive.ServerHttpRequest;
@@ -55,6 +57,7 @@ public PreAuthEmailPasswordResetEndpoint(
     }
 
     @Bean
+    @Order(Ordered.HIGHEST_PRECEDENCE + 100)
     RouterFunction<ServerResponse> preAuthPasswordResetEndpoints(
         GlobalInfoService globalInfoService,
         PasswordResetAvailabilityProviders availabilityProviders,
diff --git a/application/src/main/java/run/halo/app/security/preauth/PreAuthLoginEndpoint.java b/application/src/main/java/run/halo/app/security/preauth/PreAuthLoginEndpoint.java
index 4905ae2c2b..4e7fc1954b 100644
--- a/application/src/main/java/run/halo/app/security/preauth/PreAuthLoginEndpoint.java
+++ b/application/src/main/java/run/halo/app/security/preauth/PreAuthLoginEndpoint.java
@@ -8,6 +8,8 @@
 import java.util.Optional;
 import org.apache.commons.lang3.StringUtils;
 import org.springframework.context.annotation.Bean;
+import org.springframework.core.Ordered;
+import org.springframework.core.annotation.Order;
 import org.springframework.security.web.server.savedrequest.ServerRequestCache;
 import org.springframework.stereotype.Component;
 import org.springframework.web.reactive.function.server.RouterFunction;
@@ -53,6 +55,7 @@ class PreAuthLoginEndpoint {
     }
 
     @Bean
+    @Order(Ordered.HIGHEST_PRECEDENCE + 100)
     RouterFunction<ServerResponse> preAuthLoginEndpoints() {
         return RouterFunctions.nest(path("/login"), RouterFunctions.route()
             .GET("", request -> {
diff --git a/application/src/main/java/run/halo/app/security/preauth/PreAuthSignUpEndpoint.java b/application/src/main/java/run/halo/app/security/preauth/PreAuthSignUpEndpoint.java
index 57595adc84..62ab62ed03 100644
--- a/application/src/main/java/run/halo/app/security/preauth/PreAuthSignUpEndpoint.java
+++ b/application/src/main/java/run/halo/app/security/preauth/PreAuthSignUpEndpoint.java
@@ -14,6 +14,8 @@
 import java.net.URI;
 import lombok.Data;
 import org.springframework.context.annotation.Bean;
+import org.springframework.core.Ordered;
+import org.springframework.core.annotation.Order;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.server.reactive.ServerHttpRequest;
 import org.springframework.stereotype.Component;
@@ -67,6 +69,7 @@ class PreAuthSignUpEndpoint {
     }
 
     @Bean
+    @Order(Ordered.HIGHEST_PRECEDENCE + 100)
     RouterFunction<ServerResponse> preAuthSignUpEndpoints() {
         return RouterFunctions.nest(path("/signup"), RouterFunctions.route()
             .GET("", request -> {
diff --git a/application/src/main/java/run/halo/app/security/preauth/PreAuthTwoFactorEndpoint.java b/application/src/main/java/run/halo/app/security/preauth/PreAuthTwoFactorEndpoint.java
index 6f5c75e04a..ebf3d551bc 100644
--- a/application/src/main/java/run/halo/app/security/preauth/PreAuthTwoFactorEndpoint.java
+++ b/application/src/main/java/run/halo/app/security/preauth/PreAuthTwoFactorEndpoint.java
@@ -2,6 +2,8 @@
 
 import java.util.Map;
 import org.springframework.context.annotation.Bean;
+import org.springframework.core.Ordered;
+import org.springframework.core.annotation.Order;
 import org.springframework.stereotype.Component;
 import org.springframework.web.reactive.function.server.RouterFunction;
 import org.springframework.web.reactive.function.server.RouterFunctions;
@@ -19,6 +21,7 @@
 class PreAuthTwoFactorEndpoint {
 
     @Bean
+    @Order(Ordered.HIGHEST_PRECEDENCE + 100)
     RouterFunction<ServerResponse> preAuthTwoFactorEndpoints(GlobalInfoService globalInfoService) {
         return RouterFunctions.route()
             .GET("/challenges/two-factor/totp",
diff --git a/application/src/main/java/run/halo/app/security/preauth/SystemSetupEndpoint.java b/application/src/main/java/run/halo/app/security/preauth/SystemSetupEndpoint.java
index cbf2d8f365..ab4d7718f4 100644
--- a/application/src/main/java/run/halo/app/security/preauth/SystemSetupEndpoint.java
+++ b/application/src/main/java/run/halo/app/security/preauth/SystemSetupEndpoint.java
@@ -30,6 +30,8 @@
 import org.springframework.beans.factory.config.PlaceholderConfigurerSupport;
 import org.springframework.boot.autoconfigure.r2dbc.R2dbcConnectionDetails;
 import org.springframework.context.annotation.Bean;
+import org.springframework.core.Ordered;
+import org.springframework.core.annotation.Order;
 import org.springframework.core.io.ClassPathResource;
 import org.springframework.dao.OptimisticLockingFailureException;
 import org.springframework.http.HttpStatus;
@@ -86,6 +88,7 @@ public class SystemSetupEndpoint {
     private final ObjectProvider<R2dbcConnectionDetails> connectionDetails;
 
     @Bean
+    @Order(Ordered.HIGHEST_PRECEDENCE + 100)
     RouterFunction<ServerResponse> setupPageRouter() {
         final var tag = "SystemV1alpha1Public";
         return SpringdocRouteBuilder.route()

From 17e9f2be1f63cbfe328d806987a284c702be79fe Mon Sep 17 00:00:00 2001
From: guqing <38999863+guqing@users.noreply.github.com>
Date: Wed, 23 Oct 2024 20:32:20 +0800
Subject: [PATCH 179/185] fix: leading zeroes incorrect for index key
 comparator (#6934)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?
/kind bug
/area core
/milestone 2.20.x

#### What this PR does / why we need it:
修复索引比较会因为全是 0 的字符串与其他字符串可能相等的问题

原因是遇到了全是 0 的字符串会因为跳过前导 0 的逻辑导致全部忽略了

#### Does this PR introduce a user-facing change?
```release-note
None
```
---
 .../halo/app/extension/index/KeyComparator.java  | 16 +---------------
 .../app/extension/index/KeyComparatorTest.java   |  8 ++++++++
 2 files changed, 9 insertions(+), 15 deletions(-)

diff --git a/api/src/main/java/run/halo/app/extension/index/KeyComparator.java b/api/src/main/java/run/halo/app/extension/index/KeyComparator.java
index b94d4c7ef3..286bd21800 100644
--- a/api/src/main/java/run/halo/app/extension/index/KeyComparator.java
+++ b/api/src/main/java/run/halo/app/extension/index/KeyComparator.java
@@ -60,14 +60,6 @@ private int compareNumbers(String a, String b, int startA, int startB) {
         int i = startA;
         int j = startB;
 
-        // Skip leading zeros for both numbers
-        while (i < a.length() && a.charAt(i) == '0') {
-            i++;
-        }
-        while (j < b.length() && b.charAt(j) == '0') {
-            j++;
-        }
-
         // Compare lengths of remaining digits
         int lengthA = countDigits(a, i);
         int lengthB = countDigits(b, j);
@@ -114,13 +106,6 @@ private int compareIntegerPart(String a, String b, int startA, int startB, int p
         int i = startA;
         int j = startB;
 
-        while (i < pointA && a.charAt(i) == '0') {
-            i++;
-        }
-        while (j < pointB && b.charAt(j) == '0') {
-            j++;
-        }
-
         int lengthA = pointA - i;
         int lengthB = pointB - j;
         if (lengthA != lengthB) {
@@ -150,6 +135,7 @@ private int compareFractionalPart(String a, String b, int i, int j) {
             j++;
         }
 
+        // If one number has more digits left, and they're not all zeroes, it is larger
         while (i < a.length() && Character.isDigit(a.charAt(i))) {
             if (a.charAt(i) != '0') {
                 return 1;
diff --git a/api/src/test/java/run/halo/app/extension/index/KeyComparatorTest.java b/api/src/test/java/run/halo/app/extension/index/KeyComparatorTest.java
index 959980a0aa..acca24d7da 100644
--- a/api/src/test/java/run/halo/app/extension/index/KeyComparatorTest.java
+++ b/api/src/test/java/run/halo/app/extension/index/KeyComparatorTest.java
@@ -388,6 +388,13 @@ public void pureNumbersTest() {
             assertThat(comparator.compare("124", "123")).isGreaterThan(0);
             // Leading zeros
             assertThat(comparator.compare("00123", "123") > 0).isTrue();
+            assertThat(comparator.compare("0", "0")).isEqualTo(0);
+            assertThat(comparator.compare("0", "0000")).isLessThan(0);
+            assertThat(comparator.compare("0x", "0")).isGreaterThan(0);
+            assertThat(comparator.compare("0", "1")).isLessThan(0);
+            assertThat(comparator.compare("1", "0")).isGreaterThan(0);
+            assertThat(comparator.compare("001", "0")).isGreaterThan(0);
+            assertThat(comparator.compare("0x5e", "0000")).isLessThan(0);
         }
 
         @Test
@@ -430,6 +437,7 @@ public void decimalStringsTest() {
             assertThat(comparator.compare("123.46", "123.45")).isGreaterThan(0);
             // Decimal equivalence
             assertThat(comparator.compare("123.5", "123.50")).isLessThan(0);
+            assertThat(comparator.compare("123.0005", "123.00050")).isLessThan(0);
         }
 
         @Test

From 180b6b2b877696f3239b9c13d9a81a57040c4029 Mon Sep 17 00:00:00 2001
From: John Niang <johnniang@foxmail.com>
Date: Fri, 25 Oct 2024 12:49:32 +0800
Subject: [PATCH 180/185] Update version to 2.20.8-SNAPSHOT (#6940)

---
 gradle.properties | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/gradle.properties b/gradle.properties
index ad074883b9..a26f15cd30 100644
--- a/gradle.properties
+++ b/gradle.properties
@@ -1 +1 @@
-version=2.20.0-SNAPSHOT
+version=2.20.8-SNAPSHOT

From a0b352ac2d8af55a4304a8aeea37da04a27dd47c Mon Sep 17 00:00:00 2001
From: John Niang <johnniang@foxmail.com>
Date: Fri, 25 Oct 2024 15:55:54 +0800
Subject: [PATCH 181/185] Support hooking user creation (#6945)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/kind feature
/area core
/milestone 2.20.x

#### What this PR does / why we need it:

This PR adds support for hooking user creating. Plugin developers can define extension points of `UserPreCreatingHandler` and `UserPostCreatingHandler` to do something else.

#### Does this PR introduce a user-facing change?

```release-note
支持在插件中定义用户创建的前置和后置处理器
```
---
 .../user/service/UserPostCreatingHandler.java | 23 +++++++++++++
 .../user/service/UserPreCreatingHandler.java  | 23 +++++++++++++
 .../service/{ => impl}/UserServiceImpl.java   | 26 +++++++++++---
 .../{ => impl}/UserServiceImplTest.java       | 34 +++++++++++++++++--
 4 files changed, 99 insertions(+), 7 deletions(-)
 create mode 100644 api/src/main/java/run/halo/app/core/user/service/UserPostCreatingHandler.java
 create mode 100644 api/src/main/java/run/halo/app/core/user/service/UserPreCreatingHandler.java
 rename application/src/main/java/run/halo/app/core/user/service/{ => impl}/UserServiceImpl.java (90%)
 rename application/src/test/java/run/halo/app/core/user/service/{ => impl}/UserServiceImplTest.java (92%)

diff --git a/api/src/main/java/run/halo/app/core/user/service/UserPostCreatingHandler.java b/api/src/main/java/run/halo/app/core/user/service/UserPostCreatingHandler.java
new file mode 100644
index 0000000000..e7ad214fc8
--- /dev/null
+++ b/api/src/main/java/run/halo/app/core/user/service/UserPostCreatingHandler.java
@@ -0,0 +1,23 @@
+package run.halo.app.core.user.service;
+
+import org.pf4j.ExtensionPoint;
+import reactor.core.publisher.Mono;
+import run.halo.app.core.extension.User;
+
+/**
+ * User post-creating handler.
+ *
+ * @author johnniang
+ * @since 2.20.8
+ */
+public interface UserPostCreatingHandler extends ExtensionPoint {
+
+    /**
+     * Do something after creating user.
+     *
+     * @param user create user.
+     * @return {@code Mono.empty()} if handling successfully.
+     */
+    Mono<Void> postCreating(User user);
+
+}
diff --git a/api/src/main/java/run/halo/app/core/user/service/UserPreCreatingHandler.java b/api/src/main/java/run/halo/app/core/user/service/UserPreCreatingHandler.java
new file mode 100644
index 0000000000..775324eda4
--- /dev/null
+++ b/api/src/main/java/run/halo/app/core/user/service/UserPreCreatingHandler.java
@@ -0,0 +1,23 @@
+package run.halo.app.core.user.service;
+
+import org.pf4j.ExtensionPoint;
+import reactor.core.publisher.Mono;
+import run.halo.app.core.extension.User;
+
+/**
+ * User pre-creating handler.
+ *
+ * @author johnniang
+ * @since 2.20.8
+ */
+public interface UserPreCreatingHandler extends ExtensionPoint {
+
+    /**
+     * Do something before user creating.
+     *
+     * @param user modifiable user detail
+     * @return {@code Mono.empty()} if handling successfully.
+     */
+    Mono<Void> preCreating(User user);
+
+}
diff --git a/application/src/main/java/run/halo/app/core/user/service/UserServiceImpl.java b/application/src/main/java/run/halo/app/core/user/service/impl/UserServiceImpl.java
similarity index 90%
rename from application/src/main/java/run/halo/app/core/user/service/UserServiceImpl.java
rename to application/src/main/java/run/halo/app/core/user/service/impl/UserServiceImpl.java
index fb1b451244..86a4414247 100644
--- a/application/src/main/java/run/halo/app/core/user/service/UserServiceImpl.java
+++ b/application/src/main/java/run/halo/app/core/user/service/impl/UserServiceImpl.java
@@ -1,4 +1,4 @@
-package run.halo.app.core.user.service;
+package run.halo.app.core.user.service.impl;
 
 import static run.halo.app.extension.ExtensionUtil.defaultSort;
 import static run.halo.app.extension.index.query.QueryFactory.equal;
@@ -25,6 +25,12 @@
 import run.halo.app.core.extension.Role;
 import run.halo.app.core.extension.RoleBinding;
 import run.halo.app.core.extension.User;
+import run.halo.app.core.user.service.EmailVerificationService;
+import run.halo.app.core.user.service.RoleService;
+import run.halo.app.core.user.service.SignUpData;
+import run.halo.app.core.user.service.UserPostCreatingHandler;
+import run.halo.app.core.user.service.UserPreCreatingHandler;
+import run.halo.app.core.user.service.UserService;
 import run.halo.app.event.user.PasswordChangedEvent;
 import run.halo.app.extension.ListOptions;
 import run.halo.app.extension.Metadata;
@@ -38,6 +44,7 @@
 import run.halo.app.infra.exception.EmailVerificationFailed;
 import run.halo.app.infra.exception.UnsatisfiedAttributeValueException;
 import run.halo.app.infra.exception.UserNotFoundException;
+import run.halo.app.plugin.extensionpoint.ExtensionGetter;
 
 @Service
 @RequiredArgsConstructor
@@ -57,6 +64,8 @@ public class UserServiceImpl implements UserService {
 
     private final EmailVerificationService emailVerificationService;
 
+    private final ExtensionGetter extensionGetter;
+
     private Clock clock = Clock.systemUTC();
 
     void setClock(Clock clock) {
@@ -222,13 +231,20 @@ public Mono<User> createUser(User user, Set<String> roleNames) {
                     )
                     .then();
             })
-            .then(Mono.defer(() -> client.create(user)
-                .flatMap(newUser -> grantRoles(user.getMetadata().getName(), roleNames)
-                    .retryWhen(
-                        Retry.backoff(5, Duration.ofMillis(100))
+            .then(extensionGetter.getExtensions(UserPreCreatingHandler.class)
+                .concatMap(handler -> handler.preCreating(user))
+                .then(Mono.defer(() -> client.create(user)
+                    .flatMap(newUser -> grantRoles(user.getMetadata().getName(), roleNames)
+                        .retryWhen(Retry.backoff(5, Duration.ofMillis(100))
                             .filter(OptimisticLockingFailureException.class::isInstance)
+                        )
                     )
                 ))
+                .flatMap(createdUser -> extensionGetter.getExtensions(UserPostCreatingHandler.class)
+                    .concatMap(handler -> handler.postCreating(createdUser))
+                    .then()
+                    .thenReturn(createdUser)
+                )
             );
     }
 
diff --git a/application/src/test/java/run/halo/app/core/user/service/UserServiceImplTest.java b/application/src/test/java/run/halo/app/core/user/service/impl/UserServiceImplTest.java
similarity index 92%
rename from application/src/test/java/run/halo/app/core/user/service/UserServiceImplTest.java
rename to application/src/test/java/run/halo/app/core/user/service/impl/UserServiceImplTest.java
index d01bed46d5..9b1a5f5571 100644
--- a/application/src/test/java/run/halo/app/core/user/service/UserServiceImplTest.java
+++ b/application/src/test/java/run/halo/app/core/user/service/impl/UserServiceImplTest.java
@@ -1,4 +1,4 @@
-package run.halo.app.core.user.service;
+package run.halo.app.core.user.service.impl;
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.junit.jupiter.api.Assertions.assertEquals;
@@ -8,6 +8,7 @@
 import static org.mockito.ArgumentMatchers.anySet;
 import static org.mockito.ArgumentMatchers.anyString;
 import static org.mockito.ArgumentMatchers.argThat;
+import static org.mockito.ArgumentMatchers.assertArg;
 import static org.mockito.ArgumentMatchers.eq;
 import static org.mockito.ArgumentMatchers.isA;
 import static org.mockito.Mockito.doReturn;
@@ -19,6 +20,7 @@
 import static org.mockito.Mockito.when;
 import static run.halo.app.extension.GroupVersionKind.fromExtension;
 
+import java.util.HashMap;
 import java.util.Set;
 import org.junit.jupiter.api.DisplayName;
 import org.junit.jupiter.api.Nested;
@@ -37,6 +39,10 @@
 import run.halo.app.core.extension.RoleBinding;
 import run.halo.app.core.extension.RoleBinding.Subject;
 import run.halo.app.core.extension.User;
+import run.halo.app.core.user.service.RoleService;
+import run.halo.app.core.user.service.SignUpData;
+import run.halo.app.core.user.service.UserPostCreatingHandler;
+import run.halo.app.core.user.service.UserPreCreatingHandler;
 import run.halo.app.event.user.PasswordChangedEvent;
 import run.halo.app.extension.Metadata;
 import run.halo.app.extension.ReactiveExtensionClient;
@@ -46,6 +52,7 @@
 import run.halo.app.infra.exception.DuplicateNameException;
 import run.halo.app.infra.exception.UnsatisfiedAttributeValueException;
 import run.halo.app.infra.exception.UserNotFoundException;
+import run.halo.app.plugin.extensionpoint.ExtensionGetter;
 
 @ExtendWith(MockitoExtension.class)
 class UserServiceImplTest {
@@ -65,6 +72,9 @@ class UserServiceImplTest {
     @Mock
     RoleService roleService;
 
+    @Mock
+    ExtensionGetter extensionGetter;
+
     @InjectMocks
     UserServiceImpl userService;
 
@@ -305,6 +315,7 @@ void shouldUpdateRoleBindingIfExists() {
 
     @Nested
     class SignUpTest {
+
         @Test
         void signUpWhenRegistrationNotAllowed() {
             SystemSetting.User userSetting = new SystemSetting.User();
@@ -354,6 +365,8 @@ void signUpWhenRegistrationUsernameExists() {
             when(passwordEncoder.encode(eq("fake-password"))).thenReturn("fake-password");
             when(client.fetch(eq(User.class), eq("fake-user")))
                 .thenReturn(Mono.just(createFakeUser("test", "test")));
+            when(extensionGetter.getExtensions(UserPreCreatingHandler.class))
+                .thenReturn(Flux.empty());
 
             var signUpData = createSignUpData("fake-user", "fake-password");
             userService.signUp(signUpData)
@@ -382,6 +395,20 @@ void signUpWhenRegistrationSuccessfully() {
             UserServiceImpl spyUserService = spy(userService);
             doReturn(Mono.just(fakeUser)).when(spyUserService).grantRoles(eq("fake-user"),
                 anySet());
+            when(extensionGetter.getExtensions(UserPreCreatingHandler.class))
+                .thenReturn(Flux.just(user -> {
+                    if (user.getMetadata().getAnnotations() == null) {
+                        user.getMetadata().setAnnotations(new HashMap<>());
+                    }
+                    user.getMetadata().getAnnotations()
+                        .put("pre.creating.handler.handled", "true");
+                    return Mono.empty();
+                }));
+            when(extensionGetter.getExtensions(UserPostCreatingHandler.class))
+                .thenReturn(Flux.just(user -> {
+                    assertEquals(fakeUser, user);
+                    return Mono.empty();
+                }));
 
             spyUserService.signUp(signUpData)
                 .as(StepVerifier::create)
@@ -391,7 +418,10 @@ void signUpWhenRegistrationSuccessfully() {
                 })
                 .verifyComplete();
 
-            verify(client).create(any(User.class));
+            verify(client).create(assertArg(u -> {
+                var handled = u.getMetadata().getAnnotations().get("pre.creating.handler.handled");
+                assertEquals("true", handled);
+            }));
             verify(spyUserService).grantRoles(eq("fake-user"), anySet());
         }
 

From edfb2300080cece86ebad3b8110db60e3a8da102 Mon Sep 17 00:00:00 2001
From: John Niang <johnniang@foxmail.com>
Date: Sun, 27 Oct 2024 11:52:01 +0800
Subject: [PATCH 182/185] Upgrade to Spring Boot 3.4.0-RC1 (#6952)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/kind improvement
/area core
/milestone 2.20.x

#### What this PR does / why we need it:

This PR upgrades to Spring Boot [3.4.0-RC1](https://github.com/spring-projects/spring-boot/releases/tag/v3.4.0-RC1).

#### Does this PR introduce a user-facing change?

```release-note
升级 Spring Boot 至 3.4.0-RC1
```
---
 build.gradle | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/build.gradle b/build.gradle
index 272959fcb2..1919920d06 100644
--- a/build.gradle
+++ b/build.gradle
@@ -1,5 +1,5 @@
 plugins {
-    id 'org.springframework.boot' version '3.4.0-M3' apply false
+    id 'org.springframework.boot' version '3.4.0-RC1' apply false
     id 'io.spring.dependency-management' version '1.1.6' apply false
     id "com.gorylenko.gradle-git-properties" version "2.4.1" apply false
     id "de.undercouch.download" version "5.6.0" apply false

From 65808c8c6f3bbe4eb1805c897521618319404cff Mon Sep 17 00:00:00 2001
From: LuijpCN <139390536+luijp@users.noreply.github.com>
Date: Sun, 27 Oct 2024 16:26:01 +0800
Subject: [PATCH 183/185] feat: add supports for displaying jpeg icon in
 attachments list (#6956)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/kind improvement


#### What this PR does / why we need it:

在附件，列表模式中，为 jpeg 后缀文件添加图标。

#### Which issue(s) this PR fixes:

Fixes #

#### Special notes for your reviewer:

#### Does this PR introduce a user-facing change?

```release-note
为 jpeg 后缀文件添加图标
```
---
 ui/src/components/icon/AttachmentFileTypeIcon.vue | 1 +
 1 file changed, 1 insertion(+)

diff --git a/ui/src/components/icon/AttachmentFileTypeIcon.vue b/ui/src/components/icon/AttachmentFileTypeIcon.vue
index a479676311..51ada6392b 100644
--- a/ui/src/components/icon/AttachmentFileTypeIcon.vue
+++ b/ui/src/components/icon/AttachmentFileTypeIcon.vue
@@ -35,6 +35,7 @@ import VscodeIconsFileTypeYaml from "~icons/vscode-icons/file-type-yaml";
 const FileTypeIconsMap = {
   // image
   ".jpg": markRaw(VscodeIconsFileTypeImage),
+  ".jpeg": markRaw(VscodeIconsFileTypeImage),
   ".png": markRaw(VscodeIconsFileTypeImage),
   ".gif": markRaw(VscodeIconsFileTypeImage),
   ".webp": markRaw(VscodeIconsFileTypeImage),

From d44fa5f6d8b070ac526c0abceeb3209186d9f919 Mon Sep 17 00:00:00 2001
From: Nancy <153055234+LEIYOUSU@users.noreply.github.com>
Date: Sun, 27 Oct 2024 17:52:01 +0800
Subject: [PATCH 184/185] feat: add support for creating a new group when
 uploading attachments (#6951)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#### What type of PR is this?

/kind improvement
/area ui
/milestone 2.20.x

#### What this PR does / why we need it:

支持在附件上传界面创建新分组。

#### Which issue(s) this PR fixes:

Fixes #6942

#### Special notes for your reviewer:

#### Does this PR introduce a user-facing change?

```release-note
支持在附件上传界面创建新分组。
```
---
 .../components/AttachmentUploadModal.vue      | 30 +++++++++++++++++--
 1 file changed, 28 insertions(+), 2 deletions(-)

diff --git a/ui/console-src/modules/contents/attachments/components/AttachmentUploadModal.vue b/ui/console-src/modules/contents/attachments/components/AttachmentUploadModal.vue
index 6091ecdbd2..f2dfc1ddce 100644
--- a/ui/console-src/modules/contents/attachments/components/AttachmentUploadModal.vue
+++ b/ui/console-src/modules/contents/attachments/components/AttachmentUploadModal.vue
@@ -1,4 +1,5 @@
 <script lang="ts" setup>
+import UppyUpload from "@/components/upload/UppyUpload.vue";
 import type { PolicyTemplate } from "@halo-dev/api-client";
 import {
   IconAddCircle,
@@ -15,6 +16,7 @@ import {
   useFetchAttachmentPolicyTemplate,
 } from "../composables/use-attachment-policy";
 import AttachmentGroupBadge from "./AttachmentGroupBadge.vue";
+import AttachmentGroupEditingModal from "./AttachmentGroupEditingModal.vue";
 import AttachmentPolicyBadge from "./AttachmentPolicyBadge.vue";
 import AttachmentPolicyEditingModal from "./AttachmentPolicyEditingModal.vue";
 
@@ -22,7 +24,7 @@ const emit = defineEmits<{
   (event: "close"): void;
 }>();
 
-const { groups } = useFetchAttachmentGroup();
+const { groups, handleFetchGroups } = useFetchAttachmentGroup();
 const { policies, handleFetchPolicies } = useFetchAttachmentPolicy();
 const { policyTemplates } = useFetchAttachmentPolicyTemplate();
 
@@ -30,6 +32,7 @@ const modal = ref<InstanceType<typeof VModal> | null>(null);
 const selectedGroupName = useLocalStorage("attachment-upload-group", "");
 const selectedPolicyName = useLocalStorage("attachment-upload-policy", "");
 const policyEditingModal = ref(false);
+const groupEditingModal = ref(false);
 const policyTemplateNameToCreate = ref();
 
 onMounted(() => {
@@ -43,13 +46,23 @@ const handleOpenCreateNewPolicyModal = (policyTemplate: PolicyTemplate) => {
   policyEditingModal.value = true;
 };
 
+const handleOpenCreateNewGroupModal = () => {
+  groupEditingModal.value = true;
+};
+
 const onEditingModalClose = async () => {
   await handleFetchPolicies();
   policyTemplateNameToCreate.value = undefined;
   selectedPolicyName.value = policies.value?.[0].metadata.name;
   policyEditingModal.value = false;
 };
+
+const onGroupEditingModalClose = async () => {
+  await handleFetchGroups();
+  groupEditingModal.value = false;
+};
 </script>
+
 <template>
   <VModal
     ref="modal"
@@ -128,7 +141,15 @@ const onEditingModalClose = async () => {
           :is-selected="group.metadata.name === selectedGroupName"
           :features="{ actions: false, checkIcon: true }"
           @click="selectedGroupName = group.metadata.name"
-        >
+        />
+
+        <AttachmentGroupBadge @click="handleOpenCreateNewGroupModal">
+          <template #text>
+            <span>{{ $t("core.common.buttons.new") }}</span>
+          </template>
+          <template #actions>
+            <IconAddCircle />
+          </template>
         </AttachmentGroupBadge>
       </div>
       <UppyUpload
@@ -155,4 +176,9 @@ const onEditingModalClose = async () => {
     :template-name="policyTemplateNameToCreate"
     @close="onEditingModalClose"
   />
+
+  <AttachmentGroupEditingModal
+    v-if="groupEditingModal"
+    @close="onGroupEditingModalClose"
+  />
 </template>

From 25086ee3e63f0c8b6ed380140a068c44404ef2b2 Mon Sep 17 00:00:00 2001
From: John Niang <johnniang@foxmail.com>
Date: Sun, 27 Oct 2024 18:02:01 +0800
Subject: [PATCH 185/185] Rearrange order of security configurers (#6939)

#### What type of PR is this?

/kind improvement
/area core
/milestone 2.20.x

#### What this PR does / why we need it:

This PR rearranges order of security configurers. Especially, SecurityWebFiltersConfigurer has lower priority to configure than other security configurers.

So we can catch internal authentication in plugins.

#### Does this PR introduce a user-facing change?

```release-note
None
```
---
 .../src/main/java/run/halo/app/security/CorsConfigurer.java     | 2 ++
 .../src/main/java/run/halo/app/security/CsrfConfigurer.java     | 2 ++
 .../java/run/halo/app/security/ExceptionSecurityConfigurer.java | 2 ++
 .../java/run/halo/app/security/LogoutSecurityConfigurer.java    | 2 ++
 .../run/halo/app/security/SecurityWebFiltersConfigurer.java     | 2 +-
 .../security/authentication/login/LoginSecurityConfigurer.java  | 2 ++
 .../authentication/oauth2/OAuth2SecurityConfigurer.java         | 2 ++
 .../authentication/rememberme/RememberMeConfigurer.java         | 2 ++
 .../twofactor/TwoFactorAuthSecurityConfigurer.java              | 2 ++
 9 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/application/src/main/java/run/halo/app/security/CorsConfigurer.java b/application/src/main/java/run/halo/app/security/CorsConfigurer.java
index 8584fb228b..dc91f21797 100644
--- a/application/src/main/java/run/halo/app/security/CorsConfigurer.java
+++ b/application/src/main/java/run/halo/app/security/CorsConfigurer.java
@@ -2,6 +2,7 @@
 
 import com.google.common.net.HttpHeaders;
 import java.util.List;
+import org.springframework.core.annotation.Order;
 import org.springframework.security.config.web.server.ServerHttpSecurity;
 import org.springframework.stereotype.Component;
 import org.springframework.web.cors.CorsConfiguration;
@@ -10,6 +11,7 @@
 import run.halo.app.security.authentication.SecurityConfigurer;
 
 @Component
+@Order(0)
 public class CorsConfigurer implements SecurityConfigurer {
     @Override
     public void configure(ServerHttpSecurity http) {
diff --git a/application/src/main/java/run/halo/app/security/CsrfConfigurer.java b/application/src/main/java/run/halo/app/security/CsrfConfigurer.java
index 75d37cb20e..2d86cc31f9 100644
--- a/application/src/main/java/run/halo/app/security/CsrfConfigurer.java
+++ b/application/src/main/java/run/halo/app/security/CsrfConfigurer.java
@@ -2,6 +2,7 @@
 
 import static org.springframework.security.web.server.util.matcher.ServerWebExchangeMatchers.pathMatchers;
 
+import org.springframework.core.annotation.Order;
 import org.springframework.security.config.web.server.ServerHttpSecurity;
 import org.springframework.security.web.server.csrf.CookieServerCsrfTokenRepository;
 import org.springframework.security.web.server.csrf.CsrfWebFilter;
@@ -12,6 +13,7 @@
 import run.halo.app.security.authentication.SecurityConfigurer;
 
 @Component
+@Order(0)
 class CsrfConfigurer implements SecurityConfigurer {
 
     @Override
diff --git a/application/src/main/java/run/halo/app/security/ExceptionSecurityConfigurer.java b/application/src/main/java/run/halo/app/security/ExceptionSecurityConfigurer.java
index 940b232e4b..85a762e574 100644
--- a/application/src/main/java/run/halo/app/security/ExceptionSecurityConfigurer.java
+++ b/application/src/main/java/run/halo/app/security/ExceptionSecurityConfigurer.java
@@ -5,6 +5,7 @@
 
 import java.util.ArrayList;
 import org.springframework.context.MessageSource;
+import org.springframework.core.annotation.Order;
 import org.springframework.http.HttpMethod;
 import org.springframework.http.HttpStatus;
 import org.springframework.security.config.web.server.ServerHttpSecurity;
@@ -21,6 +22,7 @@
 import run.halo.app.security.authentication.twofactor.TwoFactorAuthenticationEntryPoint;
 
 @Component
+@Order(0)
 public class ExceptionSecurityConfigurer implements SecurityConfigurer {
 
     private final MessageSource messageSource;
diff --git a/application/src/main/java/run/halo/app/security/LogoutSecurityConfigurer.java b/application/src/main/java/run/halo/app/security/LogoutSecurityConfigurer.java
index f7b1160873..b8254dead2 100644
--- a/application/src/main/java/run/halo/app/security/LogoutSecurityConfigurer.java
+++ b/application/src/main/java/run/halo/app/security/LogoutSecurityConfigurer.java
@@ -7,6 +7,7 @@
 import lombok.RequiredArgsConstructor;
 import org.springframework.context.ApplicationContext;
 import org.springframework.context.annotation.Bean;
+import org.springframework.core.annotation.Order;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.MediaType;
 import org.springframework.security.config.web.server.ServerHttpSecurity;
@@ -31,6 +32,7 @@
 
 @Component
 @RequiredArgsConstructor
+@Order(0)
 public class LogoutSecurityConfigurer implements SecurityConfigurer {
     private final RememberMeServices rememberMeServices;
     private final ApplicationContext applicationContext;
diff --git a/application/src/main/java/run/halo/app/security/SecurityWebFiltersConfigurer.java b/application/src/main/java/run/halo/app/security/SecurityWebFiltersConfigurer.java
index 52a5e1e8d6..bb134c9f36 100644
--- a/application/src/main/java/run/halo/app/security/SecurityWebFiltersConfigurer.java
+++ b/application/src/main/java/run/halo/app/security/SecurityWebFiltersConfigurer.java
@@ -24,7 +24,7 @@
 
 @Component
 // Specific an order here to control the order or security configurer initialization
-@Order(-100)
+@Order(100)
 public class SecurityWebFiltersConfigurer implements SecurityConfigurer {
 
     private final ExtensionGetter extensionGetter;
diff --git a/application/src/main/java/run/halo/app/security/authentication/login/LoginSecurityConfigurer.java b/application/src/main/java/run/halo/app/security/authentication/login/LoginSecurityConfigurer.java
index fb49212d88..43296e113e 100644
--- a/application/src/main/java/run/halo/app/security/authentication/login/LoginSecurityConfigurer.java
+++ b/application/src/main/java/run/halo/app/security/authentication/login/LoginSecurityConfigurer.java
@@ -3,6 +3,7 @@
 import io.github.resilience4j.ratelimiter.RateLimiterRegistry;
 import io.micrometer.observation.ObservationRegistry;
 import org.springframework.context.MessageSource;
+import org.springframework.core.annotation.Order;
 import org.springframework.http.HttpMethod;
 import org.springframework.security.authentication.ObservationReactiveAuthenticationManager;
 import org.springframework.security.authentication.ReactiveAuthenticationManager;
@@ -28,6 +29,7 @@
 import run.halo.app.security.authentication.twofactor.TwoFactorAuthentication;
 
 @Component
+@Order(0)
 public class LoginSecurityConfigurer implements SecurityConfigurer {
 
     private final ObservationRegistry observationRegistry;
diff --git a/application/src/main/java/run/halo/app/security/authentication/oauth2/OAuth2SecurityConfigurer.java b/application/src/main/java/run/halo/app/security/authentication/oauth2/OAuth2SecurityConfigurer.java
index d4bf79f447..0f25d6883f 100644
--- a/application/src/main/java/run/halo/app/security/authentication/oauth2/OAuth2SecurityConfigurer.java
+++ b/application/src/main/java/run/halo/app/security/authentication/oauth2/OAuth2SecurityConfigurer.java
@@ -1,5 +1,6 @@
 package run.halo.app.security.authentication.oauth2;
 
+import org.springframework.core.annotation.Order;
 import org.springframework.security.config.web.server.SecurityWebFiltersOrder;
 import org.springframework.security.config.web.server.ServerHttpSecurity;
 import org.springframework.security.core.userdetails.ReactiveUserDetailsService;
@@ -15,6 +16,7 @@
  * @since 2.20.0
  */
 @Component
+@Order(0)
 class OAuth2SecurityConfigurer implements SecurityConfigurer {
 
     private final ServerSecurityContextRepository securityContextRepository;
diff --git a/application/src/main/java/run/halo/app/security/authentication/rememberme/RememberMeConfigurer.java b/application/src/main/java/run/halo/app/security/authentication/rememberme/RememberMeConfigurer.java
index 97cbc683c1..7e2dbf0583 100644
--- a/application/src/main/java/run/halo/app/security/authentication/rememberme/RememberMeConfigurer.java
+++ b/application/src/main/java/run/halo/app/security/authentication/rememberme/RememberMeConfigurer.java
@@ -3,6 +3,7 @@
 import static org.springframework.security.web.server.util.matcher.ServerWebExchangeMatcher.MatchResult;
 
 import lombok.RequiredArgsConstructor;
+import org.springframework.core.annotation.Order;
 import org.springframework.security.config.web.server.SecurityWebFiltersOrder;
 import org.springframework.security.config.web.server.ServerHttpSecurity;
 import org.springframework.security.core.context.ReactiveSecurityContextHolder;
@@ -13,6 +14,7 @@
 
 @Component
 @RequiredArgsConstructor
+@Order(0)
 public class RememberMeConfigurer implements SecurityConfigurer {
 
     private final RememberMeServices rememberMeServices;
diff --git a/application/src/main/java/run/halo/app/security/authentication/twofactor/TwoFactorAuthSecurityConfigurer.java b/application/src/main/java/run/halo/app/security/authentication/twofactor/TwoFactorAuthSecurityConfigurer.java
index d392c0fc37..571d49043f 100644
--- a/application/src/main/java/run/halo/app/security/authentication/twofactor/TwoFactorAuthSecurityConfigurer.java
+++ b/application/src/main/java/run/halo/app/security/authentication/twofactor/TwoFactorAuthSecurityConfigurer.java
@@ -2,6 +2,7 @@
 
 import static org.springframework.security.web.server.util.matcher.ServerWebExchangeMatchers.pathMatchers;
 
+import org.springframework.core.annotation.Order;
 import org.springframework.http.HttpMethod;
 import org.springframework.security.config.web.server.SecurityWebFiltersOrder;
 import org.springframework.security.config.web.server.ServerHttpSecurity;
@@ -17,6 +18,7 @@
 import run.halo.app.security.authentication.twofactor.totp.TotpCodeAuthenticationConverter;
 
 @Component
+@Order(0)
 public class TwoFactorAuthSecurityConfigurer implements SecurityConfigurer {
 
     private final ServerSecurityContextRepository securityContextRepository;