Played around with a new app structure

app/Users/Controllers/RoleApiController.php

@@ -0,0 +1,137 @@
+<?php
+
+namespace BookStack\Users\Controllers;
+
+use BookStack\Http\Controllers\ApiController;
+use BookStack\Permissions\PermissionsRepo;
+use BookStack\Users\Models\Role;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\DB;
+
+class RoleApiController extends ApiController
+{
+    protected PermissionsRepo $permissionsRepo;
+
+    protected array $fieldsToExpose = [
+        'display_name', 'description', 'mfa_enforced', 'external_auth_id', 'created_at', 'updated_at',
+    ];
+
+    protected $rules = [
+        'create' => [
+            'display_name'  => ['required', 'string', 'min:3', 'max:180'],
+            'description'   => ['string', 'max:180'],
+            'mfa_enforced'  => ['boolean'],
+            'external_auth_id' => ['string'],
+            'permissions'   => ['array'],
+            'permissions.*' => ['string'],
+        ],
+        'update' => [
+            'display_name'  => ['string', 'min:3', 'max:180'],
+            'description'   => ['string', 'max:180'],
+            'mfa_enforced'  => ['boolean'],
+            'external_auth_id' => ['string'],
+            'permissions'   => ['array'],
+            'permissions.*' => ['string'],
+        ]
+    ];
+
+    public function __construct(PermissionsRepo $permissionsRepo)
+    {
+        $this->permissionsRepo = $permissionsRepo;
+
+        // Checks for all endpoints in this controller
+        $this->middleware(function ($request, $next) {
+            $this->checkPermission('user-roles-manage');
+
+            return $next($request);
+        });
+    }
+
+    /**
+     * Get a listing of roles in the system.
+     * Requires permission to manage roles.
+     */
+    public function list()
+    {
+        $roles = Role::query()->select(['*'])
+            ->withCount(['users', 'permissions']);
+
+        return $this->apiListingResponse($roles, [
+            ...$this->fieldsToExpose,
+            'permissions_count',
+            'users_count',
+        ]);
+    }
+
+    /**
+     * Create a new role in the system.
+     * Permissions should be provided as an array of permission name strings.
+     * Requires permission to manage roles.
+     */
+    public function create(Request $request)
+    {
+        $data = $this->validate($request, $this->rules()['create']);
+
+        $role = null;
+        DB::transaction(function () use ($data, &$role) {
+            $role = $this->permissionsRepo->saveNewRole($data);
+        });
+
+        $this->singleFormatter($role);
+
+        return response()->json($role);
+    }
+
+    /**
+     * View the details of a single role.
+     * Provides the permissions and a high-level list of the users assigned.
+     * Requires permission to manage roles.
+     */
+    public function read(string $id)
+    {
+        $role = $this->permissionsRepo->getRoleById($id);
+        $this->singleFormatter($role);
+
+        return response()->json($role);
+    }
+
+    /**
+     * Update an existing role in the system.
+     * Permissions should be provided as an array of permission name strings.
+     * An empty "permissions" array would clear granted permissions.
+     * In many cases, where permissions are changed, you'll want to fetch the existing
+     * permissions and then modify before providing in your update request.
+     * Requires permission to manage roles.
+     */
+    public function update(Request $request, string $id)
+    {
+        $data = $this->validate($request, $this->rules()['update']);
+        $role = $this->permissionsRepo->updateRole($id, $data);
+
+        $this->singleFormatter($role);
+
+        return response()->json($role);
+    }
+
+    /**
+     * Delete a role from the system.
+     * Requires permission to manage roles.
+     */
+    public function delete(string $id)
+    {
+        $this->permissionsRepo->deleteRole(intval($id));
+
+        return response('', 204);
+    }
+
+    /**
+     * Format the given role model for single-result display.
+     */
+    protected function singleFormatter(Role $role)
+    {
+        $role->load('users:id,name,slug');
+        $role->unsetRelation('permissions');
+        $role->setAttribute('permissions', $role->permissions()->orderBy('name', 'asc')->pluck('name'));
+        $role->makeVisible(['users', 'permissions']);
+    }
+}

app/Users/Controllers/RoleController.php

@@ -0,0 +1,164 @@
+<?php
+
+namespace BookStack\Users\Controllers;
+
+use BookStack\Exceptions\PermissionsException;
+use BookStack\Http\Controllers\Controller;
+use BookStack\Permissions\PermissionsRepo;
+use BookStack\Users\Models\Role;
+use BookStack\Users\Queries\RolesAllPaginatedAndSorted;
+use BookStack\Util\SimpleListOptions;
+use Exception;
+use Illuminate\Http\Request;
+
+class RoleController extends Controller
+{
+    protected PermissionsRepo $permissionsRepo;
+
+    public function __construct(PermissionsRepo $permissionsRepo)
+    {
+        $this->permissionsRepo = $permissionsRepo;
+    }
+
+    /**
+     * Show a listing of the roles in the system.
+     */
+    public function index(Request $request)
+    {
+        $this->checkPermission('user-roles-manage');
+
+        $listOptions = SimpleListOptions::fromRequest($request, 'roles')->withSortOptions([
+            'display_name' => trans('common.sort_name'),
+            'users_count' => trans('settings.roles_assigned_users'),
+            'permissions_count' => trans('settings.roles_permissions_provided'),
+            'created_at' => trans('common.sort_created_at'),
+            'updated_at' => trans('common.sort_updated_at'),
+        ]);
+
+        $roles = (new RolesAllPaginatedAndSorted())->run(20, $listOptions);
+        $roles->appends($listOptions->getPaginationAppends());
+
+        $this->setPageTitle(trans('settings.roles'));
+
+        return view('settings.roles.index', [
+            'roles'       => $roles,
+            'listOptions' => $listOptions,
+        ]);
+    }
+
+    /**
+     * Show the form to create a new role.
+     */
+    public function create(Request $request)
+    {
+        $this->checkPermission('user-roles-manage');
+
+        /** @var ?Role $role */
+        $role = null;
+        if ($request->has('copy_from')) {
+            $role = Role::query()->find($request->get('copy_from'));
+        }
+
+        if ($role) {
+            $role->display_name .= ' (' . trans('common.copy') . ')';
+        }
+
+        $this->setPageTitle(trans('settings.role_create'));
+
+        return view('settings.roles.create', ['role' => $role]);
+    }
+
+    /**
+     * Store a new role in the system.
+     */
+    public function store(Request $request)
+    {
+        $this->checkPermission('user-roles-manage');
+        $data = $this->validate($request, [
+            'display_name' => ['required', 'min:3', 'max:180'],
+            'description'  => ['max:180'],
+            'external_auth_id' => ['string'],
+            'permissions'  => ['array'],
+            'mfa_enforced' => ['string'],
+        ]);
+
+        $data['permissions'] = array_keys($data['permissions'] ?? []);
+        $data['mfa_enforced'] = ($data['mfa_enforced'] ?? 'false') === 'true';
+        $this->permissionsRepo->saveNewRole($data);
+
+        return redirect('/settings/roles');
+    }
+
+    /**
+     * Show the form for editing a user role.
+     */
+    public function edit(string $id)
+    {
+        $this->checkPermission('user-roles-manage');
+        $role = $this->permissionsRepo->getRoleById($id);
+
+        $this->setPageTitle(trans('settings.role_edit'));
+
+        return view('settings.roles.edit', ['role' => $role]);
+    }
+
+    /**
+     * Updates a user role.
+     */
+    public function update(Request $request, string $id)
+    {
+        $this->checkPermission('user-roles-manage');
+        $data = $this->validate($request, [
+            'display_name' => ['required', 'min:3', 'max:180'],
+            'description'  => ['max:180'],
+            'external_auth_id' => ['string'],
+            'permissions'  => ['array'],
+            'mfa_enforced' => ['string'],
+        ]);
+
+        $data['permissions'] = array_keys($data['permissions'] ?? []);
+        $data['mfa_enforced'] = ($data['mfa_enforced'] ?? 'false') === 'true';
+        $this->permissionsRepo->updateRole($id, $data);
+
+        return redirect('/settings/roles');
+    }
+
+    /**
+     * Show the view to delete a role.
+     * Offers the chance to migrate users.
+     */
+    public function showDelete(string $id)
+    {
+        $this->checkPermission('user-roles-manage');
+        $role = $this->permissionsRepo->getRoleById($id);
+        $roles = $this->permissionsRepo->getAllRolesExcept($role);
+        $blankRole = $role->newInstance(['display_name' => trans('settings.role_delete_no_migration')]);
+        $roles->prepend($blankRole);
+
+        $this->setPageTitle(trans('settings.role_delete'));
+
+        return view('settings.roles.delete', ['role' => $role, 'roles' => $roles]);
+    }
+
+    /**
+     * Delete a role from the system,
+     * Migrate from a previous role if set.
+     *
+     * @throws Exception
+     */
+    public function delete(Request $request, string $id)
+    {
+        $this->checkPermission('user-roles-manage');
+
+        try {
+            $migrateRoleId = intval($request->get('migrate_role_id') ?: "0");
+            $this->permissionsRepo->deleteRole($id, $migrateRoleId);
+        } catch (PermissionsException $e) {
+            $this->showErrorNotification($e->getMessage());
+
+            return redirect()->back();
+        }
+
+        return redirect('/settings/roles');
+    }
+}

app/Users/Controllers/UserApiController.php

@@ -0,0 +1,169 @@
+<?php
+
+namespace BookStack\Users\Controllers;
+
+use BookStack\Exceptions\UserUpdateException;
+use BookStack\Http\Controllers\ApiController;
+use BookStack\Users\Models\User;
+use BookStack\Users\UserRepo;
+use Closure;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Validation\Rules\Password;
+use Illuminate\Validation\Rules\Unique;
+
+class UserApiController extends ApiController
+{
+    protected UserRepo $userRepo;
+
+    protected array $fieldsToExpose = [
+        'email', 'created_at', 'updated_at', 'last_activity_at', 'external_auth_id',
+    ];
+
+    public function __construct(UserRepo $userRepo)
+    {
+        $this->userRepo = $userRepo;
+
+        // Checks for all endpoints in this controller
+        $this->middleware(function ($request, $next) {
+            $this->checkPermission('users-manage');
+            $this->preventAccessInDemoMode();
+
+            return $next($request);
+        });
+    }
+
+    protected function rules(int $userId = null): array
+    {
+        return [
+            'create' => [
+                'name'  => ['required', 'min:2', 'max:100'],
+                'email' => [
+                    'required', 'min:2', 'email', new Unique('users', 'email'),
+                ],
+                'external_auth_id' => ['string'],
+                'language'         => ['string', 'max:15', 'alpha_dash'],
+                'password'         => [Password::default()],
+                'roles'            => ['array'],
+                'roles.*'          => ['integer'],
+                'send_invite'      => ['boolean'],
+            ],
+            'update' => [
+                'name'  => ['min:2', 'max:100'],
+                'email' => [
+                    'min:2',
+                    'email',
+                    (new Unique('users', 'email'))->ignore($userId ?? null),
+                ],
+                'external_auth_id' => ['string'],
+                'language'         => ['string', 'max:15', 'alpha_dash'],
+                'password'         => [Password::default()],
+                'roles'            => ['array'],
+                'roles.*'          => ['integer'],
+            ],
+            'delete' => [
+                'migrate_ownership_id' => ['integer', 'exists:users,id'],
+            ],
+        ];
+    }
+
+    /**
+     * Get a listing of users in the system.
+     * Requires permission to manage users.
+     */
+    public function list()
+    {
+        $users = User::query()->select(['*'])
+            ->scopes('withLastActivityAt')
+            ->with(['avatar']);
+
+        return $this->apiListingResponse($users, [
+            'id', 'name', 'slug', 'email', 'external_auth_id',
+            'created_at', 'updated_at', 'last_activity_at',
+        ], [Closure::fromCallable([$this, 'listFormatter'])]);
+    }
+
+    /**
+     * Create a new user in the system.
+     * Requires permission to manage users.
+     */
+    public function create(Request $request)
+    {
+        $data = $this->validate($request, $this->rules()['create']);
+        $sendInvite = ($data['send_invite'] ?? false) === true;
+
+        $user = null;
+        DB::transaction(function () use ($data, $sendInvite, &$user) {
+            $user = $this->userRepo->create($data, $sendInvite);
+        });
+
+        $this->singleFormatter($user);
+
+        return response()->json($user);
+    }
+
+    /**
+     * View the details of a single user.
+     * Requires permission to manage users.
+     */
+    public function read(string $id)
+    {
+        $user = $this->userRepo->getById($id);
+        $this->singleFormatter($user);
+
+        return response()->json($user);
+    }
+
+    /**
+     * Update an existing user in the system.
+     * Requires permission to manage users.
+     *
+     * @throws UserUpdateException
+     */
+    public function update(Request $request, string $id)
+    {
+        $data = $this->validate($request, $this->rules($id)['update']);
+        $user = $this->userRepo->getById($id);
+        $this->userRepo->update($user, $data, userCan('users-manage'));
+        $this->singleFormatter($user);
+
+        return response()->json($user);
+    }
+
+    /**
+     * Delete a user from the system.
+     * Can optionally accept a user id via `migrate_ownership_id` to indicate
+     * who should be the new owner of their related content.
+     * Requires permission to manage users.
+     */
+    public function delete(Request $request, string $id)
+    {
+        $user = $this->userRepo->getById($id);
+        $newOwnerId = $request->get('migrate_ownership_id', null);
+
+        $this->userRepo->destroy($user, $newOwnerId);
+
+        return response('', 204);
+    }
+
+    /**
+     * Format the given user model for single-result display.
+     */
+    protected function singleFormatter(User $user)
+    {
+        $this->listFormatter($user);
+        $user->load('roles:id,display_name');
+        $user->makeVisible(['roles']);
+    }
+
+    /**
+     * Format the given user model for a listing multi-result display.
+     */
+    protected function listFormatter(User $user)
+    {
+        $user->makeVisible($this->fieldsToExpose);
+        $user->setAttribute('profile_url', $user->getProfileUrl());
+        $user->setAttribute('edit_url', $user->getEditUrl());
+        $user->setAttribute('avatar_url', $user->getAvatar());
+    }
+}

app/Users/Controllers/UserController.php

@@ -0,0 +1,207 @@
+<?php
+
+namespace BookStack\Users\Controllers;
+
+use BookStack\Access\SocialAuthService;
+use BookStack\Exceptions\ImageUploadException;
+use BookStack\Exceptions\UserUpdateException;
+use BookStack\Http\Controllers\Controller;
+use BookStack\Uploads\ImageRepo;
+use BookStack\Users\Models\Role;
+use BookStack\Users\Queries\UsersAllPaginatedAndSorted;
+use BookStack\Users\UserRepo;
+use BookStack\Util\SimpleListOptions;
+use Exception;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Validation\Rules\Password;
+use Illuminate\Validation\ValidationException;
+
+class UserController extends Controller
+{
+    protected UserRepo $userRepo;
+    protected ImageRepo $imageRepo;
+
+    public function __construct(UserRepo $userRepo, ImageRepo $imageRepo)
+    {
+        $this->userRepo = $userRepo;
+        $this->imageRepo = $imageRepo;
+    }
+
+    /**
+     * Display a listing of the users.
+     */
+    public function index(Request $request)
+    {
+        $this->checkPermission('users-manage');
+
+        $listOptions = SimpleListOptions::fromRequest($request, 'users')->withSortOptions([
+            'name' => trans('common.sort_name'),
+            'email' => trans('auth.email'),
+            'created_at' => trans('common.sort_created_at'),
+            'updated_at' => trans('common.sort_updated_at'),
+            'last_activity_at' => trans('settings.users_latest_activity'),
+        ]);
+
+        $users = (new UsersAllPaginatedAndSorted())->run(20, $listOptions);
+
+        $this->setPageTitle(trans('settings.users'));
+        $users->appends($listOptions->getPaginationAppends());
+
+        return view('users.index', [
+            'users'       => $users,
+            'listOptions' => $listOptions,
+        ]);
+    }
+
+    /**
+     * Show the form for creating a new user.
+     */
+    public function create()
+    {
+        $this->checkPermission('users-manage');
+        $authMethod = config('auth.method');
+        $roles = Role::query()->orderBy('display_name', 'asc')->get();
+        $this->setPageTitle(trans('settings.users_add_new'));
+
+        return view('users.create', ['authMethod' => $authMethod, 'roles' => $roles]);
+    }
+
+    /**
+     * Store a new user in storage.
+     *
+     * @throws ValidationException
+     */
+    public function store(Request $request)
+    {
+        $this->checkPermission('users-manage');
+
+        $authMethod = config('auth.method');
+        $sendInvite = ($request->get('send_invite', 'false') === 'true');
+        $externalAuth = $authMethod === 'ldap' || $authMethod === 'saml2' || $authMethod === 'oidc';
+        $passwordRequired = ($authMethod === 'standard' && !$sendInvite);
+
+        $validationRules = [
+            'name'             => ['required', 'max:100'],
+            'email'            => ['required', 'email', 'unique:users,email'],
+            'language'         => ['string', 'max:15', 'alpha_dash'],
+            'roles'            => ['array'],
+            'roles.*'          => ['integer'],
+            'password'         => $passwordRequired ? ['required', Password::default()] : null,
+            'password-confirm' => $passwordRequired ? ['required', 'same:password'] : null,
+            'external_auth_id' => $externalAuth ? ['required'] : null,
+        ];
+
+        $validated = $this->validate($request, array_filter($validationRules));
+
+        DB::transaction(function () use ($validated, $sendInvite) {
+            $this->userRepo->create($validated, $sendInvite);
+        });
+
+        return redirect('/settings/users');
+    }
+
+    /**
+     * Show the form for editing the specified user.
+     */
+    public function edit(int $id, SocialAuthService $socialAuthService)
+    {
+        $this->checkPermissionOrCurrentUser('users-manage', $id);
+
+        $user = $this->userRepo->getById($id);
+        $user->load(['apiTokens', 'mfaValues']);
+        $authMethod = ($user->system_name) ? 'system' : config('auth.method');
+
+        $activeSocialDrivers = $socialAuthService->getActiveDrivers();
+        $mfaMethods = $user->mfaValues->groupBy('method');
+        $this->setPageTitle(trans('settings.user_profile'));
+        $roles = Role::query()->orderBy('display_name', 'asc')->get();
+
+        return view('users.edit', [
+            'user'                => $user,
+            'activeSocialDrivers' => $activeSocialDrivers,
+            'mfaMethods'          => $mfaMethods,
+            'authMethod'          => $authMethod,
+            'roles'               => $roles,
+        ]);
+    }
+
+    /**
+     * Update the specified user in storage.
+     *
+     * @throws UserUpdateException
+     * @throws ImageUploadException
+     * @throws ValidationException
+     */
+    public function update(Request $request, int $id)
+    {
+        $this->preventAccessInDemoMode();
+        $this->checkPermissionOrCurrentUser('users-manage', $id);
+
+        $validated = $this->validate($request, [
+            'name'             => ['min:2', 'max:100'],
+            'email'            => ['min:2', 'email', 'unique:users,email,' . $id],
+            'password'         => ['required_with:password_confirm', Password::default()],
+            'password-confirm' => ['same:password', 'required_with:password'],
+            'language'         => ['string', 'max:15', 'alpha_dash'],
+            'roles'            => ['array'],
+            'roles.*'          => ['integer'],
+            'external_auth_id' => ['string'],
+            'profile_image'    => array_merge(['nullable'], $this->getImageValidationRules()),
+        ]);
+
+        $user = $this->userRepo->getById($id);
+        $this->userRepo->update($user, $validated, userCan('users-manage'));
+
+        // Save profile image if in request
+        if ($request->hasFile('profile_image')) {
+            $imageUpload = $request->file('profile_image');
+            $this->imageRepo->destroyImage($user->avatar);
+            $image = $this->imageRepo->saveNew($imageUpload, 'user', $user->id);
+            $user->image_id = $image->id;
+            $user->save();
+        }
+
+        // Delete the profile image if reset option is in request
+        if ($request->has('profile_image_reset')) {
+            $this->imageRepo->destroyImage($user->avatar);
+            $user->image_id = 0;
+            $user->save();
+        }
+
+        $redirectUrl = userCan('users-manage') ? '/settings/users' : "/settings/users/{$user->id}";
+
+        return redirect($redirectUrl);
+    }
+
+    /**
+     * Show the user delete page.
+     */
+    public function delete(int $id)
+    {
+        $this->checkPermissionOrCurrentUser('users-manage', $id);
+
+        $user = $this->userRepo->getById($id);
+        $this->setPageTitle(trans('settings.users_delete_named', ['userName' => $user->name]));
+
+        return view('users.delete', ['user' => $user]);
+    }
+
+    /**
+     * Remove the specified user from storage.
+     *
+     * @throws Exception
+     */
+    public function destroy(Request $request, int $id)
+    {
+        $this->preventAccessInDemoMode();
+        $this->checkPermissionOrCurrentUser('users-manage', $id);
+
+        $user = $this->userRepo->getById($id);
+        $newOwnerId = intval($request->get('new_owner_id')) ?: null;
+
+        $this->userRepo->destroy($user, $newOwnerId);
+
+        return redirect('/settings/users');
+    }
+}

app/Users/Controllers/UserPreferencesController.php

@@ -0,0 +1,143 @@
+<?php
+
+namespace BookStack\Users\Controllers;
+
+use BookStack\Http\Controllers\Controller;
+use BookStack\Settings\UserShortcutMap;
+use BookStack\Users\UserRepo;
+use Illuminate\Http\Request;
+
+class UserPreferencesController extends Controller
+{
+    protected UserRepo $userRepo;
+
+    public function __construct(UserRepo $userRepo)
+    {
+        $this->userRepo = $userRepo;
+    }
+
+    /**
+     * Show the user-specific interface shortcuts.
+     */
+    public function showShortcuts()
+    {
+        $shortcuts = UserShortcutMap::fromUserPreferences();
+        $enabled = setting()->getForCurrentUser('ui-shortcuts-enabled', false);
+
+        return view('users.preferences.shortcuts', [
+            'shortcuts' => $shortcuts,
+            'enabled' => $enabled,
+        ]);
+    }
+
+    /**
+     * Update the user-specific interface shortcuts.
+     */
+    public function updateShortcuts(Request $request)
+    {
+        $enabled = $request->get('enabled') === 'true';
+        $providedShortcuts = $request->get('shortcut', []);
+        $shortcuts = new UserShortcutMap($providedShortcuts);
+
+        setting()->putForCurrentUser('ui-shortcuts', $shortcuts->toJson());
+        setting()->putForCurrentUser('ui-shortcuts-enabled', $enabled);
+
+        $this->showSuccessNotification(trans('preferences.shortcuts_update_success'));
+
+        return redirect('/preferences/shortcuts');
+    }
+
+    /**
+     * Update the preferred view format for a list view of the given type.
+     */
+    public function changeView(Request $request, string $type)
+    {
+        $valueViewTypes = ['books', 'bookshelves', 'bookshelf'];
+        if (!in_array($type, $valueViewTypes)) {
+            return redirect()->back(500);
+        }
+
+        $view = $request->get('view');
+        if (!in_array($view, ['grid', 'list'])) {
+            $view = 'list';
+        }
+
+        $key = $type . '_view_type';
+        setting()->putForCurrentUser($key, $view);
+
+        return redirect()->back(302, [], "/");
+    }
+
+    /**
+     * Change the stored sort type for a particular view.
+     */
+    public function changeSort(Request $request, string $type)
+    {
+        $validSortTypes = ['books', 'bookshelves', 'shelf_books', 'users', 'roles', 'webhooks', 'tags', 'page_revisions'];
+        if (!in_array($type, $validSortTypes)) {
+            return redirect()->back(500);
+        }
+
+        $sort = substr($request->get('sort') ?: 'name', 0, 50);
+        $order = $request->get('order') === 'desc' ? 'desc' : 'asc';
+
+        $sortKey = $type . '_sort';
+        $orderKey = $type . '_sort_order';
+        setting()->putForCurrentUser($sortKey, $sort);
+        setting()->putForCurrentUser($orderKey, $order);
+
+        return redirect()->back(302, [], "/");
+    }
+
+    /**
+     * Toggle dark mode for the current user.
+     */
+    public function toggleDarkMode()
+    {
+        $enabled = setting()->getForCurrentUser('dark-mode-enabled', false);
+        setting()->putForCurrentUser('dark-mode-enabled', $enabled ? 'false' : 'true');
+
+        return redirect()->back();
+    }
+
+    /**
+     * Update the stored section expansion preference for the given user.
+     */
+    public function changeExpansion(Request $request, string $type)
+    {
+        $typeWhitelist = ['home-details'];
+        if (!in_array($type, $typeWhitelist)) {
+            return response('Invalid key', 500);
+        }
+
+        $newState = $request->get('expand', 'false');
+        setting()->putForCurrentUser('section_expansion#' . $type, $newState);
+
+        return response('', 204);
+    }
+
+    /**
+     * Update the favorite status for a code language.
+     */
+    public function updateCodeLanguageFavourite(Request $request)
+    {
+        $validated = $this->validate($request, [
+            'language' => ['required', 'string', 'max:20'],
+            'active'   => ['required', 'bool'],
+        ]);
+
+        $currentFavoritesStr = setting()->getForCurrentUser('code-language-favourites', '');
+        $currentFavorites = array_filter(explode(',', $currentFavoritesStr));
+
+        $isFav = in_array($validated['language'], $currentFavorites);
+        if (!$isFav && $validated['active']) {
+            $currentFavorites[] = $validated['language'];
+        } elseif ($isFav && !$validated['active']) {
+            $index = array_search($validated['language'], $currentFavorites);
+            array_splice($currentFavorites, $index, 1);
+        }
+
+        setting()->putForCurrentUser('code-language-favourites', implode(',', $currentFavorites));
+        return response('', 204);
+    }
+}

app/Users/Controllers/UserProfileController.php

@@ -0,0 +1,33 @@
+<?php
+
+namespace BookStack\Users\Controllers;
+
+use BookStack\Activity\ActivityQueries;
+use BookStack\Http\Controllers\Controller;
+use BookStack\Users\Queries\UserContentCounts;
+use BookStack\Users\Queries\UserRecentlyCreatedContent;
+use BookStack\Users\UserRepo;
+
+class UserProfileController extends Controller
+{
+    /**
+     * Show the user profile page.
+     */
+    public function show(UserRepo $repo, ActivityQueries $activities, string $slug)
+    {
+        $user = $repo->getBySlug($slug);
+
+        $userActivity = $activities->userActivity($user);
+        $recentlyCreated = (new UserRecentlyCreatedContent())->run($user, 5);
+        $assetCounts = (new UserContentCounts())->run($user);
+
+        $this->setPageTitle($user->name);
+
+        return view('users.profile', [
+            'user'            => $user,
+            'activity'        => $userActivity,
+            'recentlyCreated' => $recentlyCreated,
+            'assetCounts'     => $assetCounts,
+        ]);
+    }
+}

app/Users/Controllers/UserSearchController.php

@@ -0,0 +1,40 @@
+<?php
+
+namespace BookStack\Users\Controllers;
+
+use BookStack\Http\Controllers\Controller;
+use BookStack\Users\Models\User;
+use Illuminate\Http\Request;
+
+class UserSearchController extends Controller
+{
+    /**
+     * Search users in the system, with the response formatted
+     * for use in a select-style list.
+     */
+    public function forSelect(Request $request)
+    {
+        $hasPermission = signedInUser() && (
+            userCan('users-manage')
+                || userCan('restrictions-manage-own')
+                || userCan('restrictions-manage-all')
+        );
+
+        if (!$hasPermission) {
+            $this->showPermissionError();
+        }
+
+        $search = $request->get('search', '');
+        $query = User::query()
+            ->orderBy('name', 'asc')
+            ->take(20);
+
+        if (!empty($search)) {
+            $query->where('name', 'like', '%' . $search . '%');
+        }
+
+        return view('form.user-select-list', [
+            'users' => $query->get(),
+        ]);
+    }
+}